[BigDataDZ]

Goal And Delivered Outcome

• Outcome basis: current main fails the shipped UTF-8 subprocess guard on two Antigravity discovery reads, with a corresponding reproducible discovery failure.
• Gap: ps and lsof output is decoded using the host locale. Under a GBK decoder, UTF-8 process names/paths cause pipe-reader failure and endpoint discovery cannot complete, even when the local endpoint is healthy.
• Delivered result: pin UTF-8 with replacement for malformed unrelated listing bytes, retaining candidate selection, deadlines and endpoint verification.
• Intended base: main at 867615e2c3aa2a32516a71d46f11a20d6fcb3289.

Author Declaration

• Written by: model_agent — OpenAI Codex, under contributor direction.

Implemented against

• Specification: existing tests/test_runtime_subprocess_utf8.py UTF-8 runtime invariant at the base above; existing discovery function's same-user process enumeration and verified loopback endpoint contract.

Criterion	Disposition	Evidence
Decode UTF-8 listings independently of Python's locale	implemented	Chinese/emoji in either process or port listing, real child pipes under GBK decoder
Tolerate an unrelated malformed listing line	implemented	Additional invalid-byte cases still discover the verified endpoint
Verify the discovered endpoint without starting work	implemented	Existing real loopback HTTP fixture receives only GetCascadeModelConfigData; zero sent messages

• Self-check: the listing commands, arguments, PID scope, deadline and local URL/CSRF verification are unchanged. Only the text decoding boundary changes.

Scope And Continuation

Complete within the existing POSIX process discovery adapter. No new capability, model invocation, host execution, authorization or configuration surface. Default-off activation remains unchanged; explicit URL/token discovery remains unchanged. UTF-8 replaces locale-dependent decoding on these two reads by default.

Related open #7837 modifies invocation/recovery later in this module; its current diff does not repair these discovery reads. This proposal requires neither that branch nor its host integration and makes no native Antigravity installation qualification claim.

Bounded refactoring pass: reuse the nearest existing adapter and subprocess contract; introducing a shared process-list abstraction for two provider-specific commands is unnecessary.

Validation

• Tested revision: this PR's commit.
• Run state: finished.
• Input classes: synthetic.

Check kind	Result	Evidence / limitations
regression_parity	passed	Original two Unicode cases fail against unchanged source with GBK pipe-reader errors; repaired source passes them plus malformed-listing controls.
integration	passed	Real Python child stdout pipes, existing discovery/parser and a real disposable HTTP endpoint. Process listings are synthetic; no real provider or POSIX ps/lsof execution is claimed on Windows.
unit	passed	Full test_antigravity_steward_adapter.py plus test_runtime_subprocess_utf8.py: 51 passed on native Windows Python 3.12. All provider responses synthetic; no paid model calls.
static	passed	Changed-file Ruff, diff whitespace, staged RFC bilingual check and semantic advisory. No new shared vocabulary.
integration	not_run	Native macOS/Linux process discovery, installed Antigravity/App/frontend, full repository CI. Hosted checks and maintainer review remain required.

Frontend / Visual Evidence

UI impact: none. Existing availability discovery repair only; no frontend/Lark operation or settings added. The test uses the real existing verification boundary rather than claiming a full installed user journey.

Type of Change

• Bug fix
• Test update

LoopX Area

• Host or runtime integration

Technical Direction

Existing Python provider observation boundary; no parallel generic control-plane authority or new capability/provider.

Shared-authority RFC fixture impact

N/A: no authority schema, provider-routing policy or projection change.

Boundary Checklist

• Synthetic credentials/listings only; no live tokens, private state, local machine paths, raw logs or internal links.
• No model/benchmark execution or active Goal changes.
• No paired RFC or visual entrypoint changes.
• Explicit staging, DCO sign-off and maintainer merge.

[loopx-agent]

1) 问题定义（为什么改、要解决什么）

• 修复 discover_antigravity_language_server 在非 UTF-8 默认 locale 或进程命令行包含非 ASCII/破损字节时，调用 subprocess.check_output(..., text=True) 因依赖系统 locale 解码而抛出 UnicodeDecodeError 的问题。

2) 改动摘要（按模块分组）

• 子进程输出 UTF-8 容错解码 (loopx/capabilities/native_chat/antigravity_adapter.py)：在 ps 与 lsof 的 subprocess.check_output 调用中显式指定 encoding="utf-8" 与 errors="replace"。
• 参数化回归测试 (tests/test_antigravity_steward_adapter.py)：新增 4 组参数化测试（ps/lsof × 合法 UTF-8/破损字节流），验证在非 UTF-8 首选编码环境下仍能正常完成本地 Language Server 端点探测与握手。

3) 逐点审阅结论（架构、语义、正确性、测试、风险）

• 正确性与边界安全：改动最小且精确，消除了宿主进程列表包含任意非 ASCII 路径或破损字节时的发现失败风险，无副作用。

4) 建议修改项（分 P0/P1/P2，带文件路径和行号）

• 无阻塞项。

5) 最终结论（Verdict）

Approved — ready to merge (exact head 4bb9032193de6130dbec9f9e4c63448e2850ce0f verified).

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=max

动机 / Motivation

使用 Antigravity 适配器的用户，在 Python 默认解码器与进程列表编码不一致时会遇到此问题。 旧实现遇到中文或 emoji 进程名时可能无法发现健康端点；新实现正确解码并验证本地端点，遇到无关坏字节也能继续。 同一组合在 base 四次发现失败，在 head 四次成功；实际 loopback 服务只收到配置探测，发送消息计数始终为零。 边界是现有 POSIX 进程发现的解码，不证明原生 Antigravity 安装、Windows 进程枚举或模型执行。

改动思路 / Approach

编码属于 provider I/O 适配；将它放在原有两个读取点符合已有 UTF-8 guard，未引入通用控制面策略。 当前 PR 只修正两个 subprocess 文本读取边界，保留本地端点校验与激活规则。 不修改会继续把健康端点误判为不可用；修改全局 locale 会影响无关进程；在两个既有调用显式声明解码是最小修复。 正向路径从 discover_antigravity_language_server → GetCascadeModelConfigData 进入既有 owner，返回经 HTTP 验证的 loopback endpoint，zero sends。；异常路径保留 原发现 deadline 与本地 endpoint/CSRF validator，无关坏行不阻断健康候选；远程/redirect/未验证服务仍不获得消息或 token。。本次完整审查当前 head，没有继承先前模板审查的通过结论。

具体改动 / Changes

2 files +46/-0，生产代码新增两组显式解码参数，其余为四个真实 pipe/HTTP 回归。 同 UID/PID、CSRF、deadline 与本地 URL 仍由原函数和 _rpc_post 负责；无重复发现策略。 没有新增持久化事实、分类字段或第二份 authority；沿用现有 canonical input。

关键代码讲解

• discover_antigravity_language_server：发现并验证现有本地服务。 ps 与 lsof 都从 locale 解码改为 UTF-8 replacement；筛选/timeout 未变。 输入为env 或本 UID 进程/监听端口列表，关键条件是明确环境变量分支仍在 ps 之前，缺 URL/token 拒绝。坏候选/超时继续或返回 None

• _rpc_post：执行原有本地 Connect RPC 验证。 本函数没有变化，发现仍依赖成功配置探测。 输入为经 _local_url 验证的 URL 与 synthetic token，关键条件是探测只调用 GetCascadeModelConfigData。transport/error remains CodexChatAgentError

规格为 tests/test_runtime_subprocess_utf8.py，spec_revision 867615e2c3aa2a32516a71d46f11a20d6fcb3289；现有 runtime 子进程契约要求显式 UTF-8；发现合同要求同用户 PID、loopback/CSRF 验证且探测不发送工作。

• UTF-8 listings：implemented。合法中文/emoji 不能因默认 GBK 解码而失败。 对应 discover_antigravity_language_server；两处读取各两种坏字节组合的配对 probe。
• verified discovery：implemented。只能返回通过原有本地验证的端点，不产生消息。 对应 _rpc_post GetCascadeModelConfigData；四个 head 情形 sent_count=0；完整 51 tests。

对主干的风险 / Risks

最强风险是容错解码扩大可接受 endpoint 或跳过原有验证，使可用性修复变成未经授权的消息发送。 为区分修复与无效测试，我对不可变 base/head 执行相同输入：base 四个发现 oracle 全部失败，消息数仍为零。；head 四个全部成功，服务仅见 GetCascadeModelConfigData；51 tests passed。。只检查 encoding 参数不能证明 endpoint 仍校验；因此实际子进程字节经现有解析器进入真实 HTTP 服务，并断言探测方法及零消息。 合法/非法字节、两个不同列表来源都执行；明确环境 URL 分支与远程拒绝由完整套件覆盖，无新状态/分页选择。

• PASSED：four same child-pipe/HTTP oracles at base and head — base 4 failures；head 4 passes；zero sends。
• PASSED：full adapter + runtime subprocess UTF-8 suites — 51 passed。
• PASSED：uv run --extra test python -m pytest -q tests/test_antigravity_steward_adapter.py tests/test_runtime_subprocess_utf8.py; git diff --check 867615e2c3aa2a32516a71d46f11a20d6fcb3289...HEAD — 51 passed；完整 diff read。

语义与 CI 对齐

保持现有 local-only discovery、CSRF 和 UTF-8 子进程约束；没有新状态值或更宽 authority。 没有新增 opt-in claim 或开关；既有 adapter 的激活保持原状。完整相关套件保留未配置、拒绝及异常分支。 独立证据覆盖当前 changed invariant；远端 CI 的其他状态与合并 readiness 另行保留，没有把检查颜色当作正确性证明。 ps/lsof 列表由合成子进程输出；真实 pipe 和 loopback HTTP 已执行，未冒充原生 Windows 枚举、安装的 Antigravity 或模型调用。

我的整体评价 / Verdict

APPROVE：当前完整 diff 在所声明边界内达到 goal_achieved；long_horizon 为 improved，发现失败的无效重试被消除；deadline、失败回落和调用生命周期保持。 user_experience 为 improved，可发现已运行的健康 provider，错误不再由本地默认编码决定。 本次检查的是既有安装命令或进程发现 owner，没有渲染页面、布局或设置交互变化；visual_review not_applicable。 编码属于 provider I/O 适配；将它放在原有两个读取点符合已有 UTF-8 guard，未引入通用控制面策略。 当前 PR 只修正两个 subprocess 文本读取边界，保留本地端点校验与激活规则。 两个 provider 专属读取点无需新增共享 process-discovery 抽象。 不把本次 review 当作合并授权。

English verdict: APPROVE — 4bb9032193de6130dbec9f9e4c63448e2850ce0f; UTF-8 discovery survives Unicode and unrelated malformed bytes while retaining verified local-only probing. Four paired discovery oracles pass with zero sends; 51 local tests pass.