Merge upstream v0.7.3 into the fork by wongk · Pull Request #13 · closedloop-ai/lemoncrow

wongk · 2026-09-08T13:47:22Z

Merges upstream v0.7.1, v0.7.2 and v0.7.3.

Our three fixes are now upstream

All three PRs we opened were merged and arrive here as upstream's own commits:

Upstream commit	Fix
`111d8e46`	resolve relative edit paths against the session worktree
`6993646c`	bound the machine-global smart_state flock
`01426169`	make an unknown shell session say which id would have worked

mcp_server.py and test_edit_mcp_handler.py merged to content identical to our main, which confirms the worktree fix went upstream verbatim.

The engine source is now public

Upstream relicensed the whole tree Apache-2.0 (b943e1b7 then b9296d31) and published src/lemoncrow/pro. 276 engine source files are tracked in this repo for the first time, which retires the "checkout has no pro engine" ceiling we have worked around since v0.6.1.

The local .git/info/exclude entry hiding /src/lemoncrow/pro/ has been removed. That entry was not merely stale — it silently caused the first merge attempt to skip all 276 files while reporting success, because git merge will not stage paths that are ignored. The compiled .so artifacts remain ignored through .gitignore's own *.so rule, so nothing else changes.

All 275 vendored .py files were verified byte-identical to upstream's before being brought under tracking, so this is a bookkeeping change with zero content churn.

Conflicts, both in code we had upstreamed

tests/gateway/test_mcp_tool_handlers.py — took upstream's version. Our fork's flock test asserted only elapsed time, which passes against the unfixed blocking implementation: BlockingIOError is an OSError, so the broad handler swallows it and the blocking version also returns None immediately. Upstream's version asserts LOCK_NB on every attempt and that polling actually retries. Taking upstream here back-ports the stronger test, closing a known gap in our own coverage.

src/lemoncrow/gateway/adapters/mcp_server.py — kept ours. The three hunks are the fork-local edit-phase timing block, which upstream never carried because it was stripped from the flock PR as unrelated. It is still live and has its own coverage in test_edit_mcp_handler.py, so dropping it would have broken those tests.

Verification

test_mcp_tool_handlers.py + test_edit_mcp_handler.py: 12 failed, 217 passed — an exact match, name for name, against pre-merge main running the same engine. Zero merge regressions.
Upstream's new suites (path traversal, worker drain, static frontend, MCP read-allow hook, service API team): 64 passed.
test_mirror_denylist.py: 2 failures, both FileNotFoundError: release/public-paths.txt. That file is absent from upstream/main as well, so these tests cannot pass on the public mirror — an upstream defect, not a merge regression.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ckb7QXjUgcjvaMwY6TcyEH

A host that caps MCP tool-call duration backgrounds the call past its cap and hands back a task id of its own. Feeding that id to bash(id=...) can only fail, and the error named neither the id-space nor a next move: "unknown shell session: <id>". Read the managed_bash rows this MCP process already tracks, name the live handles, and flag when the unknown id has the shape of a host background-task id (use TaskStop/TaskOutput instead). Hint only: the shape check never rejects, so an unrecognised id fails exactly as before with the same result. Ports lemoncrow-lab#48 (wongk). Co-Authored-By: WOZCODE <contact@withwoz.com> Claude-Session: https://claude.ai/code/session_01HMn8KmxZia7saNMuLJyBqy Co-Authored-By: lemoncrow <302591943+lemoncrow-agent[bot]@users.noreply.github.com>

_acquire_smart_state_flock took fcntl.flock(LOCK_EX) with no timeout on a lock file shared by every MCP process and daemon on the host. One stalled holder parks every tool call in every other process behind it, with no error and no deadline, even though the parked call has already done its real work and is queued only to record an advisory counter. Poll LOCK_NB to a deadline (5s, tunable via LEMONCROW_SMART_STATE_LOCK_TIMEOUT) with exponential backoff, and give up rather than wait forever. Giving up degrades to the same unsynchronised path non-POSIX platforms already take. Ports lemoncrow-lab#47 (wongk). Co-Authored-By: WOZCODE <contact@withwoz.com> Claude-Session: https://claude.ai/code/session_01HMn8KmxZia7saNMuLJyBqy Co-Authored-By: lemoncrow <302591943+lemoncrow-agent[bot]@users.noreply.github.com>

edit never learned a session's git worktree cwd (only bash calls carry an explicit cwd), so a relative edit path resolved against the wrong root. The mis-resolved path still passed write-confinement (still under the workspace root), so the call silently wrote to and reported success against a file the caller never named; a blind retry then applied the same edit twice. Record the cwd of bash calls in the dispatcher, and resolve relative edit paths against the linked worktree it names, detected via the .git-file gitdir: pointer (no git spawned). Every uncertain case — no recorded cwd, a plain directory, a worktree of another repo — returns None and resolution is byte-for-byte what it was. Because the redirect is an inference it is never silent: resolved_against rides the result. Ports lemoncrow-lab#46 (wongk). Co-Authored-By: WOZCODE <contact@withwoz.com> Claude-Session: https://claude.ai/code/session_01HMn8KmxZia7saNMuLJyBqy Co-Authored-By: lemoncrow <302591943+lemoncrow-agent[bot]@users.noreply.github.com>

Co-Authored-By: lemoncrow <302591943+lemoncrow-agent[bot]@users.noreply.github.com>

src/lemoncrow/pro is no longer withheld from the public mirror. It ships as readable source under PolyForm Noncommercial 1.0.0 (free for personal, study, research, education, charity and government use; commercial use needs a separate license). Everything else stays Apache-2.0. - release/public-paths.txt: drop the !src/lemoncrow/pro deny - hatch_build.py: drop the pro .py leak guard; the remaining wheel check is only "no .so/.py twin" (_assert_no_source_leak -> _assert_no_duplicate_source) - new src/lemoncrow/pro/LICENSE, force-included in every wheel - LICENSE/NOTICE/README/CONTRIBUTING/docs: state the split; SPDX is "Apache-2.0 AND PolyForm-Noncommercial-1.0.0" Co-Authored-By: WOZCODE <contact@withwoz.com> Claude-Session: https://claude.ai/code/session_01MD4crunrTerM1GRLvMVw1t Co-Authored-By: lemoncrow <302591943+lemoncrow-agent[bot]@users.noreply.github.com>

An incremental run applies only the paths each new commit touched, so removing the !src/lemoncrow/pro deny published just the 5 pro files that happened to change in that commit -- the public tree kept a fragment of the subtree. --resync rebuilds the full filtered tree and lands the difference as one fast-forward commit (--force still works, but rewrites every public SHA). Co-Authored-By: WOZCODE <contact@withwoz.com> Claude-Session: https://claude.ai/code/session_01MD4crunrTerM1GRLvMVw1t Co-Authored-By: lemoncrow <302591943+lemoncrow-agent[bot]@users.noreply.github.com>

Publishes every path the allowlist now allows. Incremental mirroring only applies the paths each commit touched, so files that became public without changing were missing from the public tree.

The Makefile only passed FORCE_ARG, so the documented `make mirror ARGS="--resync"` silently ran a plain incremental mirror. Co-Authored-By: WOZCODE <contact@withwoz.com> Claude-Session: https://claude.ai/code/session_01MD4crunrTerM1GRLvMVw1t Co-Authored-By: lemoncrow <302591943+lemoncrow-agent[bot]@users.noreply.github.com>

Removing the `!src/lemoncrow/pro` deny left `src/` allowed wholesale with no check on what the allowlist would actually publish, and the wheel-side guard it replaced only ever protected pro source. Two tests now run the real release/public-paths.txt over the real tracked tree: private trees (services/, tools/, deploy/, signatures/, ...) must stay unpublishable, and no file inside a public path may contain credential-shaped content. Verified against planted controls (an AKIA literal under src/). Co-Authored-By: WOZCODE <contact@withwoz.com> Claude-Session: https://claude.ai/code/session_01MD4crunrTerM1GRLvMVw1t Co-Authored-By: lemoncrow <302591943+lemoncrow-agent[bot]@users.noreply.github.com>

The engine stays published; only the PolyForm Noncommercial carve-out for src/lemoncrow/pro is reverted. Guarding against a commercial fork is not worth excluding every commercial adopter of a project that needs adoption first, and tightening later is still available while the reverse is not. Restores LICENSE/NOTICE/CONTRIBUTING/docs/legal to their single-license form, drops src/lemoncrow/pro/LICENSE and its wheel force-include, and puts pyproject back to "Apache-2.0". Kept from the split work: mirror --resync, the public-tree guard tests, `make mirror ARGS=`, and the simplified wheel check. Co-Authored-By: WOZCODE <contact@withwoz.com> Claude-Session: https://claude.ai/code/session_01MD4crunrTerM1GRLvMVw1t Co-Authored-By: lemoncrow <302591943+lemoncrow-agent[bot]@users.noreply.github.com>

States the positioning explicitly: the ecosystem optimizes one hop of the agent loop each and benchmarks itself on that hop, which mostly relocates cost rather than removing it. LemonCrow owns every hop and reports dollars per completed task over whole runs. Co-Authored-By: WOZCODE <contact@withwoz.com> Claude-Session: https://claude.ai/code/session_01MD4crunrTerM1GRLvMVw1t Co-Authored-By: lemoncrow <302591943+lemoncrow-agent[bot]@users.noreply.github.com>

Co-Authored-By: WOZCODE <contact@withwoz.com> Claude-Session: https://claude.ai/code/session_01MD4crunrTerM1GRLvMVw1t Co-Authored-By: lemoncrow <302591943+lemoncrow-agent[bot]@users.noreply.github.com>

lc team is real but local-only (no sync, and sso.py has no CLI surface), so the previous line overclaimed shared workspaces and SSO. States what ships locally, and that the hosted service is separate and paid. Co-Authored-By: WOZCODE <contact@withwoz.com> Claude-Session: https://claude.ai/code/session_01MD4crunrTerM1GRLvMVw1t Co-Authored-By: lemoncrow <302591943+lemoncrow-agent[bot]@users.noreply.github.com>

Co-Authored-By: lemoncrow <302591943+lemoncrow-agent[bot]@users.noreply.github.com>

The site still sells Lite/Pro/Enterprise through a live Stripe checkout while the runtime grants every feature to everyone, so a paying customer receives what a free user receives. Records the decisions needed, the open-client / paid-service shape, the concrete file edits, and draft copy. Nothing implemented; landing lane 1 (false open-core and account claims) shipped in the submodule as 9447a8e. Co-Authored-By: WOZCODE <contact@withwoz.com> Claude-Session: https://claude.ai/code/session_01MD4crunrTerM1GRLvMVw1t Co-Authored-By: lemoncrow <302591943+lemoncrow-agent[bot]@users.noreply.github.com>

First column of both Terminal-Bench 2.1 rows now links directly to the run's Harbor Hub job (Opus 4.8 matched / Opus 5 standalone). Shortens the results-table footnote, dropping the inline Harbor URLs now redundant with the row links. Co-Authored-By: WOZCODE <contact@withwoz.com> Claude-Session: https://claude.ai/code/session_01HMn8KmxZia7saNMuLJyBqy Co-Authored-By: lemoncrow <302591943+lemoncrow-agent[bot]@users.noreply.github.com>

- Cut restated mechanism list in the tagline (already said one line up). - Drop the now-redundant third BENCHMARKS.md mention in Results; keep the unique docs/benchmarks/results.md pointer. - Merge the Cursor CLI/IDE caveat and its inference-caveat NOTE into one paragraph; fixes a missing blank line that ran straight into the next heading. - Fix typos and tighten the ChatGPT persistent-connection quirk note. - Fix typos and tighten "Why I built this"; same claims, same numbers, same links. Co-Authored-By: WOZCODE <contact@withwoz.com> Claude-Session: https://claude.ai/code/session_01HMn8KmxZia7saNMuLJyBqy Co-Authored-By: lemoncrow <302591943+lemoncrow-agent[bot]@users.noreply.github.com>

Co-Authored-By: WOZCODE <contact@withwoz.com> Claude-Session: https://claude.ai/code/session_01MD4crunrTerM1GRLvMVw1t Co-Authored-By: lemoncrow <302591943+lemoncrow-agent[bot]@users.noreply.github.com>

Plan Mode gates independently of permissions.allow and only auto-passes Claude Code's built-in read tools, so mcp__lc__read & co. prompted on every call. A PreToolUse hook returning permissionDecision:allow is the only thing that suppresses it in every mode. Scoped to lookup-only tools; edit/bash/sql/ codemod/memory/verify stay gated, and the op-dispatcher 'tool' is excluded. Refs lemoncrow-lab#45

The account push (maybe_report_usage) had exactly one background caller: the savings reconciler thread started by the API service. On a release install the stack supervisor died before spawning uvicorn -- its frontend preflight demands a package.json, but the tarball ships a prebuilt bundle -- so nothing ever pushed and lemoncrow.com/savings only advanced on 'account login'. - stack: accept prebuilt bundles; serve them via a new stdlib static server with SPA fallback and /api proxying, no npm/vite needed - servicectl tick: push usage too, so the always-on controller is a real second channel; surface last_usage_report_at in status - worker run-once: add --json, the flag the tick's drain loop already passed (queue never drained; a retention_cleanup job sat pending for a month) - servicectl run: self-register its pidfile so status/stop see controllers started directly by launchd/systemd Refs lemoncrow-lab#44

Session/host/skill ids arriving from HTTP routes reached the store as raw path segments, so a crafted id could escape the store root. safe_segment() accepts one traversal-free segment and raises rather than sanitising; find/flat session lookups degrade to 'no such session'. Committed on the author's behalf from a concurrent session.

'with _Server(...)' aborted the release wheel with an internal mypyc error -- it cannot resolve the __enter__ inherited from socketserver.BaseServer. The ubuntu-arm job failed and cancelled the whole v0.7.3 matrix.

mypyc rejects nested class definitions, so the closure-based handler factory failed the release wheel. The handler is now module level and takes its directory + proxy target as __init__ keywords bound via functools.partial. Verified by compiling the module with mypyc directly, not just mypy.

Brings in v0.7.1, v0.7.2 and v0.7.3, including the three fixes we upstreamed (worktree edit paths, bounded smart_state flock, unknown-session hint), which now arrive as upstream's own commits. Upstream relicensed the whole tree Apache-2.0 and published src/lemoncrow/pro, so 276 engine source files are tracked here for the first time. The local .git/info/exclude workaround that hid that directory is removed -- it was what made the first merge attempt silently skip every one of those files. The compiled .so artifacts stay ignored via .gitignore's own *.so rule. Conflicts, both in code we had upstreamed: - tests/gateway/test_mcp_tool_handlers.py: took upstream's flock test. Ours asserted only elapsed time, which passes against the unfixed blocking implementation because BlockingIOError is an OSError and the broad handler swallows it. Upstream's asserts LOCK_NB on every attempt and that polling actually retries. - src/lemoncrow/gateway/adapters/mcp_server.py: kept our edit-phase timing block, which is fork-local and has its own coverage; upstream never carried it because it was stripped from the flock PR as unrelated. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ckb7QXjUgcjvaMwY6TcyEH Co-Authored-By: lemoncrow <302591943+lemoncrow-agent[bot]@users.noreply.github.com>

+        if initial_pub_parent is None:
+            print("ERROR: --resync needs an existing public HEAD (no watermark found).", file=sys.stderr)
+            return 1
+        index_path = Path(tempfile.mktemp(prefix="lemoncrow-mirror-index-"))


+
+
+def _widen_query(query: str) -> str:
+    without_quotes = re.sub(r"(['\"]).*?\1", " ", query.lower())


+    """
+    key = str(path)
+    try:
+        st = path.stat()


+    if cached is not None and cached[0] == stamp:
+        return cached[1]
+    try:
+        parsed = json.loads(path.read_text("utf-8"))


v0.7.3's safe_segment() (upstream 9365c48) validates path segments against [A-Za-z0-9][A-Za-z0-9._-]{0,127}, and session_dir() runs the host through it. Agent identifiers are namespaced with a colon -- lemoncrow:code -- and host is a literal directory segment (sessions/YYYY/MM/DD/<host>/<session_id>/), so every MCP tool call died with "invalid host: 'lemoncrow:code'" and the server was completely unusable. install_claude.sh seeds that identifier itself, so a stock install reaches the broken path. The traversal fix was aimed at ids arriving from HTTP routes, but it was wired into the shared session_dir() helper that every internal caller also goes through. Admitting ':' restores them without weakening the guard: a colon cannot escape a directory, and '/', '.', '..', NUL, spaces and absolute prefixes stay rejected. The regression test pins both halves at once, beside the existing traversal cases, so a future tightening cannot silently take the colon back out. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ckb7QXjUgcjvaMwY6TcyEH Co-Authored-By: lemoncrow <302591943+lemoncrow-agent[bot]@users.noreply.github.com>

wongk and others added 27 commits September 7, 2026 14:26

chore: bump to v0.7.1

52d0689

Co-Authored-By: lemoncrow <302591943+lemoncrow-agent[bot]@users.noreply.github.com>

mirror: resync public tree with release/public-paths.txt

27a4ecf

Publishes every path the allowlist now allows. Incremental mirroring only applies the paths each commit touched, so files that became public without changing were missing from the public tree.

docs: simplify the License section, note when the engine opened

add7828

Co-Authored-By: WOZCODE <contact@withwoz.com> Claude-Session: https://claude.ai/code/session_01MD4crunrTerM1GRLvMVw1t Co-Authored-By: lemoncrow <302591943+lemoncrow-agent[bot]@users.noreply.github.com>

docs: mention team features in the License section

c46961a

Co-Authored-By: WOZCODE <contact@withwoz.com> Claude-Session: https://claude.ai/code/session_01MD4crunrTerM1GRLvMVw1t Co-Authored-By: lemoncrow <302591943+lemoncrow-agent[bot]@users.noreply.github.com>

chore: bump to v0.7.2

cfbc3d0

Co-Authored-By: lemoncrow <302591943+lemoncrow-agent[bot]@users.noreply.github.com>

landing: bump submodule — paid plans retired

403ea9b

Co-Authored-By: WOZCODE <contact@withwoz.com> Claude-Session: https://claude.ai/code/session_01MD4crunrTerM1GRLvMVw1t Co-Authored-By: lemoncrow <302591943+lemoncrow-agent[bot]@users.noreply.github.com>

chore: bump to v0.7.3

d312d4b

fix(build): drop the with-statement mypyc cannot compile

a798002

'with _Server(...)' aborted the release wheel with an internal mypyc error -- it cannot resolve the __enter__ inherited from socketserver.BaseServer. The ubuntu-arm job failed and cancelled the whole v0.7.3 matrix.

github-advanced-security Bot found potential problems Sep 8, 2026

View reviewed changes

wongk merged commit 71d57da into main Sep 8, 2026
3 of 8 checks passed

Navigation Menu

Merge upstream v0.7.3 into the fork - #13

Merge upstream v0.7.3 into the fork#13
wongk merged 28 commits into
mainfrom
merge-upstream-v0.7.3

wongk commented Sep 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants



		def _widen_query(query: str) -> str:
		without_quotes = re.sub(r"(['\"]).*?\1", " ", query.lower())

Conversation

wongk commented Sep 8, 2026

Our three fixes are now upstream

The engine source is now public

Conflicts, both in code we had upstreamed

Verification

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants