fix: reuse search-history repairs and align Claude 2.1.296

[dofastted]

Changes

• Reuse a successfully confirmed search-history repair on exact subsequent turns, scoped to conversation, account, VM, model, credential generation and search/tool fingerprint. Prevent repeated 400 -> repair -> 200 without changing lease release, session affinity, quota, signatures or new/changed encrypted history.
• Include the session's Claude 2.1.296 identity/cache-ownership changes, default-TTL setting, and Environment opt-out/caller preservation, in separate commits.
• Candidate 1.3.188, cut in its own VERSION/CHANGELOG commit. Native manifest now pins the published immutable payload-2026.10.18-cc296.
• Built from current origin/main, preserving already-merged GPT credits and KVM terminal fixes; unrelated local MobaXterm ignore changes excluded.

CI analysis

The previously red run 39067288984 belongs to another PR (#512). Its source contained the literal @file:/workspace/src/lib/identity/crs-persona.mjs, causing a Node syntax error; its ARM64 image built but the control plane exited before readiness. This candidate contains the actual module, not that marker. No failing checks were bypassed or rerun to hide the issue.

Current head f7e224e passed all five checks in CI 39088593405: unit / worker / kernel / web / arm64. This run includes the real new native payload. Local frontend TypeScript/Vite build passed; fix checkout Node suite 2933 passed / 8 skipped, focused repair/scheduler suites 220 passed.

Explicitly approved live gate — passed, exit 0

The user explicitly approved master management authentication plus original-state preservation, instead of the stale configured password-login check. Default password mode is retained; password login is not claimed to have passed. No credentials were reset.

The local verifier's explicit invocation was:

python3 skills/version-switch/scripts/verify-live.py 1.3.188 --before <captured-host-container-baseline> --auth-mode master --container-policy baseline

All checks passed: version file, running admin version 1.3.188, Node health service=vm2api, authenticated management API, 11 VM records, public console, 8/8 host container IDs/states preserved, and a unique real upstream conversation returning 200 pong. Separate full Docker snapshots cover every local and cluster container, including the originally stopped AWS slot.

Deployment and behavior evidence

• Deploy-first hotfix 8594008d was applied to 1.3.187, then the complete 1.3.188 candidate tree was deployed before merge.
• Full candidate backup: /opt/vm2api/.deploy-bak-vm2api-1.3.188-20261018T020306Z.
• Installed and checksum-verified: 310 runtime files + 286 frontend files from candidate f7e224e3.
• Node restarted once for the 1.3.188 cutover. Go unchanged. No slot sync/restart/recreation; every local/cluster container ID, state and start time, VM scheduling/manual state, binary hash, and routing hash preserved. Existing native files already match the new payload.
• Three genuine upstream turns share one outbound session; attempt statuses [400,200] -> [200] -> [200], all final replies pong:
  • faaf2933-aa82-4fb5-af10-91b54a4ca9b7
  • 90c0be02-db6c-4fc3-9985-762827412db0
  • c653a2b3-eea3-471b-9b8a-e651b31be07b
• 8/8 running Anthropic kernels healthy, no closed/recovering slots, actual CLI processes configured for 20 native slots / 2.1.296. An initial auxiliary assertion incorrectly demanded all 20 slots idle during live traffic; concurrent vm-10 request b4fd2fe5-e3aa-47e7-bfc3-a2c80e17cdf2 subsequently completed 200. The corrected check uses real health/capacity semantics; completed upstream probes were recovered from logs, not resent.
• All 11 published payload assets' sizes and GitHub SHA256 digests match prepared files. Only kernel/CLI changed; other nine assets unchanged. Kernel 983575591514f771fdef6a2445bdb76db390b177874c533b0eb7562cd04f7977; CLI 244ef884ce427feba8f0eec6ce7957045c2226e103fb0bec2d7df2949f5bc6c7.

Release

All previously listed blockers are resolved. Merge only the verified head above, then create v1.3.188 on the merged main commit. Do not retag, rewrite history, overwrite old payload assets, or reset the user's original local worktree.

The base main advanced to the concurrently merged Desktop fix #518 during verification. It was incorporated with a normal merge (no history rewrite), targeted combined regressions passed 152/152, all five CI jobs passed again on f7e224e3, and only the two changed runtime modules were cut over with one further controlled Node restart. All slot processes/containers and Go remain unchanged; the final explicitly approved live gate exited 0 on this exact combined tree.

---

Note

Medium Risk
Touches core inference failover, native cache passthrough, and usage accounting on the Anthropic path; behavior is heavily tested but mis-scoped repair hints or cache validation could change client-visible errors or billing buckets.

Overview
Release 1.3.188 tightens Anthropic cache_control handling, adds search-history repair reuse, expands Environment persona controls, bumps the shipped Claude Code 2.1.296 kernel/CLI payload, and exposes default cache TTL in the protocol settings UI.

Search history: After a successful in-request flatten repair, FailoverRunner stores a fingerprint (session + account + VM + model + credential generation + search/tool shape). The next turn with the same fingerprint applies flatten on the first hop so clients avoid another 400 → repair → 200 cycle; new/changed history, failed repairs, or a second rejection clear the hint.

Caching: Official native passthrough keeps caller markers, explicit TTLs, and missing TTLs; invalid layouts (too many breakpoints, thinking markers, bad TTL order) return 400 invalid_cache_control before scheduling. Rewrite mode strips caller markers, fills only Node-owned missing TTLs, and enforces limits without silent fixes. CLI-hop/native paths stop using the panel TTL to re-bucket mixed upstream usage for billing/logs.

Persona / Environment: Turning off Environment for a preset omits generated {{env}} blocks (including official_full), drops empty cached placeholders, and preserves caller-supplied # Environment text without slot timezone overwrite on HTTP or CLI prep.

Identity: Outbound pins and bootstrap scripts align with 2.1.296; deploy/payload.json updates kernel/CLI hashes.

^{Reviewed by Cursor Bugbot for commit f7e224e. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f7e224e. Configure here.}

[cursor]

Rewrite stamps 1h after 5m

Medium Severity

Native rewrite stamps message breakpoints with the session TTL, then fillMissingCacheTtl may write 1h onto later markers, and validateCacheBreakpoints fails closed. An earlier explicit 5m (or a missing TTL, which Anthropic treats as 5m) plus default 1h message stamps becomes invalid_cache_control even though the inbound template was legal. Saved system templates that still use 5m can 400 every cli-hop rewrite turn with no upstream call.

Additional Locations (2)

• src/lib/protocol/outbound-attempt.mjs#L216-L221
• src/lib/protocol/cache-ttl.mjs#L84-L124

 

^{Reviewed by Cursor Bugbot for commit f7e224e. Configure here.}