* feat(telemetry): routing decision and setting-change events
Routing needs to be answerable after the fact: which arm the router
picked, whether it was applied, and what the user changed. Adds
``RoutingDecisionEvent`` and ``RoutingSettingChangedEvent`` plus a
``model_labels`` helper that reduces a model id to a family/tier pair, so
records stay useful without carrying raw model ids.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat(sessions): persist routing decisions and session warnings
A routing decision has to survive the turn that produced it, so the UI
can show what the router chose and — crucially — whether it was actually
applied. Adds ``RoutingDecisionData`` to the conversation entity with
store support, and a ``session_warnings`` module for the non-fatal
routing conditions a session needs to surface (router unreachable,
verdict not applied) without failing the turn.
Records are honest by construction: a decision that could not be applied
is stored with ``applied=false`` and its reason rather than being
dropped or reported as a success.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat(routing): session-start smart routing core
Adds the server-side routing core behind Smart Routing: an external
``task_v1`` route-options seam that offers the router the frozen arm menu
its scenario requires, maps a pick back onto a servable catalog id via
nearest-cost substitution, and derives the harness that can actually run
it. Routing settings become one value object on ``RuntimeCaps`` so every
consumer reads the same knobs instead of re-parsing config. Databricks
model discovery resolves catalog spellings deterministically so the same
endpoint is named the same way on every path.
Reconciled against main's catalog-driven routing:
- Main's ``_fetch_runner_catalog`` / ``_RunnerModel`` plumbing and its
cost-tier ordering are the single source of live model availability;
``fetch_runner_models`` remains the id-only adapter over it.
- Main's ``ModelIntent``-parameterized judge rubric replaces the
family-specific tier hints.
- Main's catalog wire-API check survives as
``_redirect_wire_incompatible_pick``, layered after the static
``_HARNESS_EXCLUDED_MODELS`` bar list. The two cover different things:
the catalog knows what an endpoint advertises, the bar list knows the
client-side rejections it does not.
- ``model_family_token`` defers to ``is_codex_compatible_model`` so the
GLM/Kimi delegate arms read as the codex family everywhere.
The static ``MODEL_LISTS`` table is retained, unlike main, because the
nearest-cost substitution needs a family cost ordering on paths with no
catalog in reach (hook scripts, pre-session creates).
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat(server): route sessions at start and expose the decision
Wires the routing core into session lifecycle. A session created in
Smart Routing mode is routed once, at start, from the first user message:
the verdict picks the harness and the model before the runner launches,
and pre-launch host model options supply the candidate catalog when no
runner exists yet. Later turns never re-route — a session's harness is
settled once so a conversation cannot change identity underneath the
user.
The decision is exposed on the session snapshot and event stream with
its applied state, so the UI can distinguish "the router picked X and we
are running X" from "the router picked X and we could not apply it",
rather than silently showing the request as the outcome.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat(claude): apply a routed model to Claude Code
A routed arm only matters if the harness actually runs it. Adds a Claude
model vocabulary that maps between router arm ids, catalog spellings, and
the ``/model`` names Claude Code accepts, and pins the CLI's family
aliases to the frozen task_v1 Claude arms at launch so the first turn's
switch can reach whatever the router picked.
The vocabulary reads its catalog prefixes from one definition shared with
the server seam, so the hook path — which cannot read server config —
cannot drift from it.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat(codex): apply a routed model to Codex
The Codex side of the apply layer: the native app server and executor
accept a routed model override and enforce it on the session they launch,
so a verdict that names a GLM/Kimi delegate arm reaches the CLI instead
of being dropped for the harness default.
Codex spawns with no routable signal skip the router outright rather
than routing on an empty prompt and recording a decision nobody asked
for.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat(routing): route sub-agent spawns from harness hooks
Sub-agents spawned by a native CLI never pass through the server's
session-create path, so they were unroutable. Adds hook scripts the
Claude and Codex CLIs invoke at spawn time, plus a runner-side router
that answers them, so a spawned child is routed on its own task text and
launched on the chosen model.
A child is only ever offered its parent's harness family: routing may
change which model a sub-agent runs, never which vendor it belongs to.
Hook commands run under ``python -I`` so a repo-local module on the CLI's
cwd cannot shadow the interpreter's own imports.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat(web): surface routing decisions and Smart Routing controls
Adds the Smart Routing harness option to new-chat, a routing chip that
shows the routed model on the session, a sub-agent routing row, and a
warning banner for the non-fatal routing conditions the server reports.
The chip reports what actually happened. When a decision could not be
applied it says so and names the model in use, instead of showing the
router's request as though it were the outcome.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* test(routing): cover the routing apply layer end to end
Adds the remaining routing coverage: the CLI's routing-client build, the
native Smart Routing create path, an end-to-end routing integration test,
and the discovery/override unit tests. Also updates the existing native
bridge, forwarder, and launch-arg tests for the model-override plumbing.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs(routing): record the routing design and verification state
Captures the plan the implementation followed, the per-CUJ verification
status, and the observed live-model state the harness bar list is derived
from — the gateway rejections that catalog metadata does not advertise.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: registry stamps — rebased-tree battery green, session-start verified live
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: re-sync CUJ walkthrough with the rebased tree
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat(routing): offer Smart Routing only where the apply layer can work
Smart Routing rewrites a launch's model through the Databricks AI Gateway,
so a host whose claude-native or codex inference resolves anywhere else
(Bedrock, a plain API key, the vendor CLI's own login) got an option that
could never take effect. Gate each surface on the fact that decides it.
The host already resolves this at launch, so reuse those resolutions as a
cheap config-only check — no process launch, no network — and report a
`gateway_inference` map alongside `configured_harnesses` on registration
and every readiness refresh. It rides the host frames into the store and
out through GET /v1/hosts. A host that never reports it sends `null`, and
`null` means unknown: nothing is gated away on older host builds.
Web gates the three surfaces independently, classified in the single
`smartRoutingAvailability` point as a new `not-gateway-backed` cause:
Configure Claude Code's Model row needs the claude family, Configure
Codex's needs the codex family, and the top-level Smart Routing harness
row needs both (it drives the five-arm menu).
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs(routing): record the gateway-backed availability decision
Plan §10 gains decision 9 (Smart Routing offered only where the apply
layer can work, with the per-surface rule and the absent-means-unknown
compatibility contract), and §8 gains the two follow-ups it defers: a
liveness probe, and moving the routes:select call host-side so routing
auth/workspace always matches the host's inference.
CUJ_STATUS gains recipe R9 (point a host at a non-AIGW config and assert
the option disappears) plus one pending check row per gated surface.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: rewrite the CUJ walkthrough in simplified technical English
Rewrite designs/CUJ_IMPLEMENTATION.md in ASD-STE100-inspired Simplified
Technical English so every sentence parses one way only: active voice with a
named actor, simple tenses, one statement per sentence, noun clusters of at
most three words, and lists for any sequence of three or more steps. Add a
six-term glossary (arm, seam, pane, rollout, canary, spelling) to the intro.
Remove the hard 80-column wrapping so each paragraph is one soft-wrapped line.
No facts change: every sha citation and every file:line reference is
byte-identical to bc4b6c0.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: stamp the gateway-inference positive half
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: keep the routing design docs local-only
The four routing design documents (plan, test registry, CUJ walkthrough,
live model state) stay on disk for local reference but leave version
control — they are working notes, not reviewable deliverables.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(routing): serve turn routing the launch-exact claude vocabulary
Two claude-path defects from the live verification round.
Turn-1 routing on a claude-native pane could substitute the routed arm.
`_native_turn_catalog` read `_model_options_cache` without consulting
`_model_options_stale`, so a catalog hydrated from the session's *host*
before launch (whose family aliases carry the workspace default) became
the offered vocabulary. With the launch pinning `opus ->
databricks-claude-opus-4-8` and turn 1 routing ~100ms later, the pinned
arm had no spelling on offer and the router substituted sonnet. Turn
routing now awaits a refetch from the bound runner's
`claude-model-options` endpoint — which reports the launch-pinned
aliases — whenever the cached entry is stale, and falls back to the
stale catalog when no runner can answer.
Every claude-native turn also 400'd with `invalid beta flag`: the ucode
gateway launch env never set `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS`,
and Claude Code 2.1.220 sends three flags the Databricks gateway
rejects (`prompt-caching-scope-2026-01-05`, `advisor-tool-2026-03-01`
and, under `ENABLE_TOOL_SEARCH`, `advanced-tool-use-2025-11-20`), which
fails the whole request. Set the knob on that path too.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(routing): no substitution arrow for prefix-only subagent raw picks
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(web): float the session warning banner over the chat
The session warning strip rendered in-flow between the chat header and
<main>, so a warning arriving mid-session pushed the whole conversation
down. Render it as an overlay instead, on the same positioning contract
as the chat header: anchored inside the chat column, below the header,
stopping short of the workspace panel via --workspace-panel-offset, and
transparent to pointer events outside its own rows so the chat stays
scrollable. Multiple warnings stack downward inside the overlay.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(routing): gate the codex canary check on a real turn, clear it per launch
`subagent_routing_unenforced` was posted on codex-native sessions whose
routing hooks were in fact trusted and running. Codex dispatches
`SessionStart` (the canary) when a thread's *first turn* begins, but the
enforcement watcher's first-turn gate was released by any
`thread/status/changed → active` or `item/*` event — and the MCP startup
round activates the thread and emits items without running a turn. So a
session that had not been asked anything yet (or whose first turn was
interrupted before it started) failed the canary check 30s later. Live
evidence (session e6074fb1...): thread activated by the MCP startup round
at 13:58:06, warning posted at 13:58:36, and the canary file for that same
session/app-server finally appeared at 14:01:36 when a real turn ran —
proving the hooks were trusted and effective. The stale warning stuck only
because the runner was stopped before the repair tick.
Direct probes against `codex app-server` (isolated CODEX_HOME) also
disprove the "codex captures hook trust at process start" theory: trust
written after the spawn (the shipped ordering) takes effect, even for a
turn already in flight when `config/batchWrite` lands. The real invariant
is that trust must land before the first *turn*, which `start()` already
guarantees — now written down where it can be broken.
Second fix: the canary is the proof that *this* launch's hooks ran, so
`clear_bridge_state` now drops it. The per-workspace bridge dir is reused
across launches, and a canary left by an earlier launch masked a genuine
fail-open for the rest of the session. Transition-only posting still
clears a previous launch's warning on the new forwarder's first check.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(routing): clear the codex spawn audit per launch too
Same staleness class as the canary (51e36c8c): the audit is reconciled
against the routing decisions *this* launch's endpoint relayed, so a line
left by a previous launch — whose approving decision lives in that
launch's router — reads as a spawn the router never approved. The
per-workspace bridge dir is reused across launches, so `clear_bridge_state`
now drops the audit alongside the canary.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(routing): apply the glm arm under the gateway's model route
The task_v1 codex arm `glm-5-2` resolved to the catalog's
`databricks-glm-5-2`, which the codex turn then failed to serve: that
serving endpoint advertises chat-completions only and 400s on
`/codex/v1`. Probes on staging and prod (2026-08-01) show the Responses
API does serve GLM — but only under the gateway model route
`system.ai.glm-5-2`. GLM appears in no discovery listing, so the working
name can only be pinned, not discovered.
Add a per-model servable-alias map next to the arm tables and consult it
when an arm resolves to a servable id, so the codex apply layer writes
`system.ai.glm-5-2`. Subagent candidates are offered under the same
spelling, so a rewrite spawns with the id routing resolves to. The
router's arm id stays `glm-5-2`, and the alias strips to the same bare id
so decision records show no substitution.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: track the routing design docs again
Re-adds the plan (with the decision log), the test registry, the
enumerated CUJ walkthrough, and the codex model-state notes, all
current as of the post-verification state.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat(routing): route the model at create time for a fixed native harness
A native terminal launches with the session row and its turns originate in
the TUI, so the server never sees the first message pre-inference — the turn
gate that routes a plain claude/codex session never fires for a CLI-driven
one. Create-time routing existed only on the `harness_override: "auto"` path,
which picks harness AND model.
A create that carries `cost_control_mode_override: "on"`, a non-empty
`smart_routing_message`, and a FIXED native harness (claude-native /
codex-native, via the wrapper agent, `harness_override`, or the spec) now
routes its MODEL during the create: candidates come from the host's
pre-launch catalog for that one harness, the pick is constrained to it, and
the routed id is persisted as `model_override` with the routing-decision
label plus a session-scoped decision record. Fails open — an unconfigured
router, or a pick the harness cannot run, pins nothing and records the
reason, so the session still opens on the CLI's default model.
Session-start cadence is unchanged: the pinned model closes the per-turn gate
exactly as the auto path's create pin does. The branch is skipped for SDK
harnesses (which still route on their first turn), child and sub-agent
sessions, and a create that pinned its own model.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat(cli): route the model (and harness) before a native TUI launch
Smart Routing was web-only: a CLI user who wanted the server to pick a
model had to start the session in the browser. Add the two launch surfaces
Bryan asked for, both of which route *before* anything starts — the harness
pick is physical (a session is a live claude/codex process) and the model is
applied as a launch flag, so there is nothing to change after the fact.
- `omnigent claude|codex --smart-routing -p "<prompt>"` and
`run --harness <native> --smart-routing -p ...` route the model and keep
the requested harness.
- `omnigent run --smart-routing -p "<prompt>"` (no --harness, or
`--harness auto`) routes harness *and* model, then launches that wrapper.
One session, routed at create: the CLI creates it through the standard JSON
`POST /v1/sessions` (bound to the host it will run on, whose model options
are the router's candidate catalog) and the wrapper ATTACHES to it instead
of bundling its own. The row the server writes already carries the agent
binding, the wrapper's presentation labels, the routed model and the
decision card, so a routed CLI launch gets the same chip and provenance the
web UI does. The resolved harness is read from `SessionResponse.harness`;
native rows leave `harness_override` null on purpose.
`--smart-routing` requires `-p`: routing needs text, and the degraded
route-on-turn-2 mode is not shipping, so an empty invocation is a usage
error pointing at `-p` or the web UI. It also rejects an AGENT, the
REPL-only flags, and `--resume`/`--continue` (routing is a create-time
decision, so a routed launch is always a new session). Preflight
(`smart_routing_enabled` plus the host's per-harness `gateway_inference`)
is a hard error naming the reason, because a routed model the pane cannot
reach is worse than no pick; the create itself always fails open — the
wrapper then starts a plain session behind one notice line.
`omnigent claude` also gains `-p`, and claude/codex now accept a prompt
through `run --harness <native> -p` instead of rejecting it. The prompt
travels as argv (Claude Code's positional prompt; Codex keeps its existing
first-turn delivery), so multi-line prompts survive intact.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(cli): resolve the claude agent name from harness_plugins on this branch
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: PR rewrite plan — cut list, commit series, CLI integration
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* chore: track the isolated dev-stack scripts the test registry references
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: cover the glm gateway-route fix
907f8886 pins the id the glm arm is applied under: the gateway serves GLM
on the Responses API only as the model route `system.ai.glm-5-2`, so the
catalog's `databricks-glm-5-2` row 400s every codex turn. Record the
mechanics in CUJ_IMPLEMENTATION.md §3.5h (with the §1.3 spelling note and
the residual "pinned, not discovered" open item), and close the C1 /
§2.8 blocker in CUJ_STATUS.md against the live session 80fb6d1f: config
mirror and every rollout turn context on system.ai.glm-5-2, zero
BAD_REQUEST, real generation. The only error left on that thread is a
gateway-capacity 429, which is load and not routing.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: cover the CLI smart-routing entry points
`omnigent claude|codex --smart-routing -p` (tier 2) and `omnigent run
--smart-routing -p` (tier 3) were undocumented. Record the fourth surface:
CUJ_IMPLEMENTATION.md gains §6 (commands and tiers, prompt delivery,
preflight, the create-time MODEL route for a fixed native harness, the
create the CLI drives, rejected combinations, the routed launch, decision
persistence, and the agent-name import fix), and known-open moves to §7.
CUJ_STATUS.md gains recipe R10 and §2.10 — unit rows stamped from the three
suites that pass at HEAD, every process-truth row ⬜ because no routed CLI
launch has run live yet.
PR_REWRITE_PLAN.md §2d/§5 corrected: both CLI halves have merged, and the
tier-2 server half is already its own commit, so the commit-3/commit-8 split
is mechanical. The CLI commit did not extend `_resolve_native_smart_routing`
— the fixed-harness route is a parallel path — but it does share the auto
path's lifted `_routing_host_for_create` helper, which the assembler must
keep.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: track the PR review fix list (rounds 1-2, all items addressed)
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: high-level routing system map for slimming iteration
Add designs/ROUTING_OVERVIEW.md: a one-altitude map of the Smart Routing
feature — the four user journeys, the fifteen subsystems with size and
rewrite fate, the invariants that must survive any cut, and the five open
decisions. Written in ASD-STE100 style with block IDs so the slimming
pass can cut and keep by reference.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: fold Bryan's critique decisions into the rewrite plan
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: fold the model-resolution rulings into the plans; STE pass on the rewrite plan
Bryan ruled on the three open resolution questions (2026-08-01): revert
the resolution machinery to main's shape (cut MODEL_LISTS, the cost
table, the allowlist), drop pi from the routed set for now (bar list
goes with it), and use one fixed fallback model per family (claude ->
sonnet, gpt -> terra) with an honest decline behind it. The rewrite
plan is now fully decided and rewritten in ASD-STE100 style; the
overview's subsystem fates, invariants, and decision records match.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: finish the STE pass, restructure 3i to the three rulings, pin the fallback-id assumptions
Reconciles the fold-agent's late completion (it amended 0baeea1c
locally; this lands the same tree as a follow-up commit instead of a
force-push). The whole plan now meets the STE caps, 3i lists Bryan's
three rulings as ruled (pi had been displaced by a mechanism bullet),
and the open-assumption list grows to three: glm declines with no
fallback; terra is today only a pi-exclusion entry, so the code must
add it as a servable target; sonnet pins to databricks-claude-sonnet-5.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: luna is the gpt+glm fallback, sonnet follows the alias pin; add verification criteria (6c-6e)
Bryan's final fallback rulings (2026-08-01): the gpt and glm families
both fall back to luna (databricks-gpt-5-6-luna, itself a frozen arm,
so a glm fallback never leaves the codex harness), and the claude
fallback is whatever the sonnet alias pin resolves to rather than a
hardcoded id. Terra is out; glm no longer declines. No open
assumptions remain in the plan.
New plan blocks 6c-6e state the verification criteria: the evidence
bars per layer, the registry recipe handles (R0-R10; R8 dies with the
enforcement cut), and the per-slice verification gates for the fleet.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: switch the plan to a from-scratch rewrite (7g)
Bryan chose a complete rewrite from scratch (2026-08-02) to keep the
new code as clean as possible, reversing the plan's earlier 'assemble,
do not re-implement' constraint.
The scope decisions all survive; the method and the safety net change.
New blocks: 0c names the three inputs an agent must read before it
writes a slice (the behavior inventory, the trap list, and the
reference implementation on routing-mvp-v1), 0d says to rewrite the
shape but transcribe the empirically-derived constants, 3l reframes
the cut list as 'do not build', 4e contains the integration risk that
moves to the end, 6f records that no evidence transfers, and 7g is the
decision itself. 3j becomes a ceiling rather than a subtraction, which
also retires its old arithmetic gap, and 5b turns the two CLI commits
into specifications rather than patches to apply.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: request-time managed flag, parallel wave plan, and four scope reversals
Bryan's review of the rewrite plan (2026-08-02) produced five changes.
The managed preview flag is evaluated per request, not at
construction, and it moves out of 2a into its own block 2f: flag off
routes through the naive LLM judge, flag on routes through the AI
Gateway, so a flag-off workspace degrades rather than loses the
feature. That also dissolves the managed-swap report's objection.
The glm gateway route is codex work, not CLI work, and the Smart
Routing harness inherits it because it runs codex underneath.
Cross-harness spawning is reinstated: harness agents get
sys_session_create instead of a deny message (3c, 7i). Telemetry
leaves the PR entirely for a follow-up Bryan owns (3e, 7j). The design
docs ride the branch for his reference and a final commit deletes them
before merge, so no docs PR exists (3a, 7j).
Execution is now three waves of five or six parallel workstreams on
one branch, preceded by a lead-authored wave-0 contract commit that
declares every shared signature and pre-creates every shared touch
point (4a, 4b, 4e, 6a, 6e, 7k). Size is a preference for
reviewability, not a target (3j).
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: make the rewrite plan readable without session context
The plan hands off to a fresh fleet that has none of this session's
history, so the spec sections (0-6) now read as instructions rather
than as diffs against earlier drafts. Removed the negations of
assumptions a new reader never held (the glm route is "not CLI work",
managed readiness is "not 2a", 3c "reverses the earlier cut"), the
RESOLVED-with-date tags inside spec blocks, and references only this
session could resolve. Section 7 keeps the full decision record, which
is its job. Empirical findings survive the trim: the A-sub
deny-message result, the zero-live-triggers evidence, and the
authorization-order trap now cite the document that records them.
Wave design is now the lead's rather than a placeholder: a wave-0
contract commit, 7 foundation streams, 6 integration streams, and a
4-stream closure wave. The turn gate and the create paths move into
separate modules so they stop colliding in orchestration.py; web and
CLI move into wave 2 behind the wave-0 HTTP contract, which keeps the
two largest surfaces off the critical path. Barrier 1 gains a real
check (apply a hardcoded model to a claude pane and a codex session
with no router involved) and barrier 3 gains the flag-off backend row.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: clear the last session-only references from the plan
3g was still written as "rewrite, not transplant" against a suite the
fleet never sees, and it cited a commit's method rather than a rule.
It now states the rule directly: start from the behavior inventory in
CUJ_STATUS.md section 2, one test per behavior, coverage as the gate.
The reference suite is described as what not to copy and why.
Also replaced the two remaining "three review waves" references, which
name history a fresh reader cannot resolve, with "the reference
implementation".
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: close the cold-read audit's blockers on the rewrite plan
A subagent with no context from this session read the plan as an
executor would and found that its load-bearing inputs are unreachable
from the branch it tells you to start on. Confirmed and fixed.
Blockers:
- routing-mvp-v1 was an aspiration, not a branch. It now exists,
pinned at f200a8bd, and 0c/1a cite the sha.
- None of the required-reading docs, and none of the R0/R6/R9/R10
verification harness, exists on origin/main. Wave 0 now carries all
twelve paths across, or every stream stops at its first instruction
and both live barriers have no stack to run on.
- 2f never named the preview flag. It is managed-side
(databricks.mas.omnigent.intelligentRouting, default off), so OSS
gets a per-request predicate the deployment supplies, plus a
default; stream 2 builds the seam, not a flag system.
- The migration had two owners. Wave 0 creates the empty revision and
stream 4 fills it.
- The file partition existed only as a promise, and where implied it
double-booked subagent_routing.py. New block 4f is the table, with
named modules for the transport/policy and turn-gate/create-path
splits, and cli.py declared lead-owned.
Also: new 2g records what main already ships (both routing clients and
the wire-compat redirect), which shrinks stream 2; wave 0 slims the
registry so waves 1-2 are gated on a true list; 6d had R5 and R6
transposed; 6e dropped row B3 and now names CUJ_STATUS as the row
authority; barrier-1's apply script has an owner; the UI acceptance
names Bryan, since no agent can close it; and the size figures in 1a
and 3h are re-measured (29,924/155, and web/src minus its lockfile).
One gap only Bryan can close, now flagged in 6e: INTELLIGENT_ROUTING_
PLAN.md section 11.1 does not embed the P-SOL prompt, and rows A3, B2,
C2 need it.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: add LOCAL_SETUP.md; drop the stray npm lockfile
R0 documented how to run the stack but not how to build it, and two
things stopped a fresh machine cold: .omnigent-local/config.yaml is
gitignored, so run-server.sh exits immediately with nothing explaining
what belongs in it, and run-frontend.sh hardcoded this machine's nvm
path. LOCAL_SETUP.md now covers prerequisites, uv sync + pnpm install,
the databricks profile the router needs, the config template (with the
two details that break things quietly: system.ai. keeps its trailing
dot, and router_name must be task_v1), bring-up, a health check, the
known local quirks, and teardown. R0 points at it and wave 0 carries
it across.
run-frontend.sh now resolves node from PATH, falling back to the newest
nvm install, and fails with a pointer if pnpm is missing.
Separately: web/package-lock.json was tracked again after the rebase.
The repo uses pnpm (pnpm-lock.yaml, packageManager pnpm@11.15.1) and
main has no npm lockfile, so this was 3,451 lines of generated
wrong-package-manager noise in the PR diff. Untracked, deleted, and
gitignored so it cannot come back.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: record the personal CLI setup and the provider topology
LOCAL_SETUP.md covered the repo, but a fresh clone still does not
reproduce the environment: the whole Claude Code and Codex setup lives
in $HOME. New section 9 carries it - the three personal ~/.claude
files, the model-serving proxy mode and its refresh hook, the Codex
Databricks provider block and the five personal hooks that Omnigent's
generated hooks.json must merge with, the two secrets that have to
move out of band, and the transfer order.
Section 9.5 records the provider topology, which is easy to misread:
the global config's default provider is a Claude subscription, its
AIGW provider (the /ai-gateway/anthropic route, which is the Gateway
despite the path) is not default, and the worktree config is a
separate staging workspace. Measured with omnigent.gateway_inference:
global reports False for both families, the worktree True for both.
That measurement surfaced a real defect, now recorded in plan block
3f: the codex check reads the base URL Omnigent resolves, so a
kind: cli-config provider (which defers to the user's own
~/.codex/config.toml) yields None and is reported as not-backed rather
than unknown. False hides the Smart Routing option; unknown does not.
The rewrite must read the delegated config or report unknown.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* Trim routing PR: cut enforcement/telemetry/machinery, fix GLM effort + blank page
Wave-1 trim of the routing reference implementation, plus two live-caught
bug fixes and test trims from a parallel cleanup pass.
Cuts (per designs/PR_REWRITE_PLAN.md §3):
- Enforcement stack: canary, watcher, spawn-audit, warning banner,
session_warnings (3b). Hook generation + trust handshake kept.
- Routing telemetry: telemetry/routing.py, model_labels.py (3e).
- Fork-spawn exemption from the hook script (3d).
- Model-resolution machinery in smart_routing.py: MODEL_LISTS cost-ladder
(_cost_position, _ARM_SUBSTITUTES) replaced by a fixed per-family
fallback (claude->sonnet, gpt/glm->luna) + honest decline (3i). The
static infer_models catalog is kept: subagent_routing.py consumes it.
Fixes:
- GLM reasoning effort: GLM rejects xhigh; a routed GLM codex turn now
clamps effort to medium at every config-write and thread-settings point
(clamp_effort_for_model / effort_for_model_switch). Locked down in
tests/test_reasoning_effort.py.
- Blank-page crash: chipPendingBeforeRegion indexed past a shortened block
array on a stale cache (session switch / history reload), reading
undefined.type and unmounting ChatPage. Guarded + regression-tested.
Tests trimmed to the surviving surface; suites collect clean (2277) and
the core routing sets pass (266).
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* Remove unused `act` import left by the warning-banner test cut
The enforcement/banner cut removed the AppShell test cases that used
`act`, but left the import — oxlint (a pre-commit + CI gate) fails on it.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* Substitute an unservable arm within its model tier before the family fallback
task_v1's frozen arms name a model *tier* (claude-opus-4-8 is the opus tier,
gpt-5-6-sol the sol tier), not a specific servable id. When the workspace
serves a different model of the same tier — claude-opus-5 for a
claude-opus-4-8 pick — that model is the arm the router meant, so
substitute_model now applies it (highest version within the tier) ahead of the
family fallback. Only when no same-tier model is servable does it fall to the
per-family fallback, then decline. Still no cost walk: an unservable pick never
slides down to a cheaper tier.
Adds _model_tier (the id's last alphabetic segment, None for a bare generation
id like gpt-5-5) and _version_key (numeric version, higher = newer) to rank
within a tier.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* Route unnamed codex subagent spawns on a placeholder instead of inheriting
Codex encrypts the spawn message, so an unnamed codex spawn carries no prompt
to route on. It previously fell through to allow-on-the-parent-model ("No
routable signal … inherits the session model"). Route it on a fixed
"Codex subagent task" placeholder instead, so it lands on the router's floor
arm rather than the parent's possibly-expensive model — matching ucode PR 251's
default_task_label. Precedence is unchanged: a real prompt (claude) wins, then
task_name/agent_name, then the placeholder.
Tradeoff, recorded honestly: every unnamed spawn scores the same placeholder
and so gets the same floor arm — a cheap sensible default, not per-spawn
routing. A named spawn still routes on its task_name; empirically that field
has been null on every observed codex spawn, so the placeholder is the whole
fix in practice. Per-prompt codex subagent routing is not reachable while the
message is encrypted.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: design plan for in-harness first-message routing (follow-up)
Route the main agent's model on the FIRST real user message via a
UserPromptSubmit hook + loopback callback (the route-subagent pattern),
so a bare `omni codex` / `omni claude` launch still routes, and web UI
and TUI share one mechanism. Marker = conv.model_override (authoritative,
existing cadence semantics) + a bridge-dir fast-skip file. Apply reuses
the verified composer forward path: thread/settings/update-then-turn/start
for codex, locked /model-injection-then-send-keys for claude
(block-and-replay). Cross-harness selection stays outside; create-time
routing stays for prompt-ful launches and composes via the marker.
Grounded in LIVE_MODEL_STATE.md probes and the official Claude Code hook
docs (block erases the prompt and injected input then proceeds; no hook
output can change the model; 30s synchronous timeout). Four spikes
ordered before any product code. Not part of the trim PR.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: record the conservative ruling on in-harness routing
Bryan's decision (2026-08-03): keep both paths. The server/create-time
path is the UI path and stays as the primary; the in-harness hook is
additive, covering only what the server cannot see (a prompt typed into
the TUI on a bare launch). One decision seam, three triggers, arbitrated
by model_override so exactly one fires per session. The outside path also
stays because it shares route_session_harness with cross-harness
selection - it is the cross-harness code, not a parallel implementation.
The maximal collapse (hook as sole trigger, CLI tier-2 entry machinery
deleted) is recorded as a deferred phase gated on determinism evidence
from the spikes plus live use, requiring an explicit go.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* Point a routed spawn at a tool the session actually has, and say why
The redirect told the model to "Use sys_session_send with args.harness=,
args.model=" — parameters that do not exist on the tool it holds. Those are
sys_session_send's named-spawn mode, which ToolManager only advertises for a
spec with declared sub-agents; the native harnesses declare none, so their
send tool exposes only {args, session_id} and the instruction was
unfollowable. Matrix row A-sub recorded the result: the model read the deny
and abandoned the spawn.
Name sys_session_create instead, which a spawn:True harness does hold (both
claude-native and codex-native set it) and whose schema really does take
model, message, and agent_id. Lead with the user's own choice to enable Smart
Routing and state that the sub-task is approved, so the deny reads as an
authorized re-route rather than a refusal, and close with the concrete call to
make. The same instruction now backs the deny branch when the verdict names a
model, instead of a bare "Spawn denied by Omnigent smart routing."
The redirect tests assert the properties that matter — denies, names the
routed model, names sys_session_create, never names sys_session_send — rather
than pinning the prose.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: register the bundle-agent and GLM-subagent CUJs (2.11, 2.12)
Two new surfaces enter the registry per Bryan. 2.11: Smart Routing on
bundle agents (debby/polly) reaches routing only through the gear
config's brain-harness override - a different code path from the native
Model row, previously untested; rows cover the menu render, the right
model/harness selection, and the live apply. 2.12: codex GLM subagents,
which ucode PR 251 explicitly skips; rows track the three blockers
(static candidates, placeholder floor-arm, and the effort wall) with
the sys_session_create child path recorded as already working.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(web): keep the bundle-agent harness row visible under Smart Routing
Two bugs in the debby/polly gear-config flow when Smart Routing is picked
as the brain harness:
- Picking Smart Routing unmounted the Agent Harness dropdown that made the
pick (it was gated on !autoRouting), leaving a lone locked Permissions
row with no way to read the pick back or switch away without Cancel.
The row now stays rendered, ordered above Permissions, and the gear
tooltip mirrors both rows.
- A remembered fully-auto pick had no degrade path when the server turns
smart routing off: the modal showed a blank harness select while the
create still sent harness_override "auto". The bundle flavor now drops
the pick quietly, matching the top-level auto-native rule, and keeps the
stored pick in case routing returns.
Adds 15 vitest cases on real debby/polly (claude-sdk) fixtures covering
menu shape, pick persistence, payloads, per-agent memory, and the
degrade; updates the one existing test that encoded the unmount bug.
NewChatDialog.test.tsx 228/228; shell suite 1754 pass; tsc/oxlint/
prettier clean.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: flip the §2.11 bundle-agent rows to vitest-backed
The gear-config menu bugs are fixed and covered (1f99705f); the two render
rows move to 🟡 pending a user eyeball, and the first-turn row records the
payload half as vitest-verified with the live end-to-end still owed.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: record the spawn-family policy in the GLM-subagent CUJ section
Subagent spawns stay within the parent harness family; GLM is
codex-family (all codex subagents may spawn gpt and glm arms when smart
routing is on); the auto harness alone spawns cross-family.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat: let codex sessions spawn GLM subagents
GLM belongs to the codex spawn family: with smart routing on, every
codex spawn may target both the gpt arms and glm-5-2 (the auto harness
alone spawns cross-family; claude parents stay claude-only). Three
layers had to move:
- Catalog: databricks-glm-5-2 joins _CURRENT_GENERATION_MODELS[gpt], so
infer_models offers it and a routed glm pick resolves exactly instead
of substituting down to luna (this also removes the create-path C1
substitution arrow). Since no discovery listing ever advertises glm, a
live catalog row would still hide it — candidate_models now tops up
known-unadvertised arms for the gpt family only, nested spawns
included, without widening multi-model harnesses like pi.
- Vocabulary: codex's spawn_agent validates model ids client-side
against a closed enum of its own slugs, which silently killed EVERY
catalog-id rewrite, not just glm. New codex_model_vocabulary maps
catalog ids to codex slugs (databricks-gpt-5-6-luna -> gpt-5.6-luna)
and clamps spawn effort in agreement with clamp_effort_for_model; the
router hook rewrites through it and falls open when no slug exists.
- Catalog file: glm has no codex slug at all, so the executor reads the
installed CLI's own catalog (codex debug models, cached per binary and
CODEX_HOME per host process) and writes the session's private
model_catalog_json with a glm entry cloned from the cheapest arm,
carrying its own low/medium/high effort ladder — codex then clamps an
inherited xhigh instead of refusing the spawn. Every failure path
leaves codex on its bundled catalog.
Live-proven on the local stack: a native spawn_agent glm subagent off an
xhigh codex parent ran at system.ai.glm-5-2/medium and completed, with a
luna sibling in the same turn unaffected. Family policy pinned by tests
in both directions and both modes.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat: give codex spawn routing a real signal and honor explicit asks
Live verification exposed that no codex spawn could ever land glm even
with it offered: this codex's spawn_agent has no task-name field, the
spawn message was withheld from the router on a disproven encryption
premise, and an explicit model in the spawn arguments was overridden by
the placeholder-scored default. Every spawn therefore routed on the
19-char placeholder and landed the default arm (verified live: three
spawns, including one explicitly asking for system.ai.glm-5-2, all ran
gpt-5.6-sol).
- The codex hook now forwards the spawn message (plaintext in hook
payloads — measured) as the routing prompt via a new prompt_keys seam,
so the router scores the actual task and can pick delegate arms.
- The hook also forwards an explicit spawn model as requested_model. The
server honors the ask when it is an arm the spawn's own harness could
have been routed to (bare-arm match, so any spelling lands the
servable one); a cross-family or unoffered ask is routed over and
recorded truthfully as attempted_override. The honor is restricted to
the requesting harness's candidate row because a rewrite runs
in-place — an auto-harness session must not hand codex a claude arm.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: carry requested_model across the runner relay hop
The relay resolver rebuilds the route-subagent body field by field, so
the new requested_model never reached the server: live, a spawn that
explicitly asked for system.ai.glm-5-2 was routed to luna with no
attempted_override recorded. The relay test now pins every routing
input surviving the hop.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: close the §2.12 GLM-subagent rows with live evidence
All four layers verified on the shipping path 2026-08-04: glm in the
live spawn menus, exact in-family resolution, and a live glm subagent
(turn_context system.ai.glm-5-2/medium off an xhigh parent). Records the
two extra layers live testing surfaced: message-as-signal (spawn_agent
has no task-name field here) and honoring explicit in-family model asks.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(web): scope a bundle agent's Smart Routing brain to that agent
Picking Smart Routing as Debby/Polly's brain-harness renamed the whole
composer selection — chip, tooltip, and modal title all flipped to
"Smart Routing" as if the top-level auto harness had been picked, and
re-clicking the agent's own row silently dropped the brain. The two
flavors share no state (auto vs auto-native sentinels, per-agent
memory), but the derived autoRoutingSelected union was used for
identity, not just row gating.
Identity readers (agentLabel, triggerTooltip, configSummary, modal
title) now key on smartRoutingHarnessSelected alone; the union keeps
its one honest reader (the routing-seed skip) and a comment stating the
rule. The bundle modal shows the Agent Harness row alone (locked
Permissions belongs to the top-level flavor whose creates actually send
permission fields), the permission-reset effect and handleSelectAgent
key on the top-level sentinel only, and create payloads are
byte-identical in all four flavor combinations.
Tests: 292 pass across the three NewChatDialog suites — includes a new
"Smart Routing flavors are scoped separately" describe (mixed fixture)
pinning both leak directions, plain-create isolation, and the brain
surviving a re-pick; the old chip test that encoded the leak now pins
the fix; the two locked-Permissions tests moved to the top-level
flavor's describe. tsc/oxlint/prettier clean.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: add CUJ_MASTER.md, the consolidated routing CUJ registry
One doc merging the full CUJ_STATUS registry (matrix, recipes, tiers,
all section areas), the v4 in-harness routing phases (phase 1 landed
with evidence; phase 2 blockers), tonight's six live-feedback rows, and
a new adversarial section: 23 Breakage CUJs (X1-X23) grounding how this
setup fails for other people — missing/old CLIs, non-AIGW credentials,
router timeouts vs the hook ladder, hook-merge precedence, shared
bridge roots across worktrees, and the static glm fallback offering an
arm a workspace may not serve. Includes stack bring-up with a pinned
random-port convention, the R11 bare-launch recipe, a 112-row registry,
and a revisit list split by needs-human vs headless.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(web): honest subagent-routing display — fresh reads and gated chips
The gear modal's Subagent routing row could show Inherit while "on"
was stored: the override hydrates only at session bind (no SSE event
carries it, the session query never refetches), and the modal seeded
its draft once per open — so the row displayed a stale value and Save
could PATCH a value the user never picked. The row now holds a pick
that reads through to the live store value until touched, save() writes
only a pick that still differs from a fresh store read, opening the
gear re-reads the two override switches (refreshSessionOverrides — slim
snapshot only, so it cannot trigger the sticky-model PATCH), and a
session switch under an open modal re-seeds instead of writing the old
session's drafts onto the new one.
Per the user's ruling, native_subagent routing chips now render only
when the override is explicitly "on": on Inherit (or off) the chip
would advertise a setting the user didn't choose. Display gate only —
the decision rows stay persisted as the audit trail, and an inheriting
session's spawns are still routed server-side. Flip-side caveat,
deliberate: toggling the setting retro-hides/reveals historical chips.
453 tests pass across the three touched suites (display/write matrix,
stale-under-open-modal regression proven failing pre-fix, chip-gate
scope table); tsc/oxlint/prettier clean.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* test(web): unit-cover the sub-agent routing chip gate
Pins stripGatedSubagentRoutingChips at the unit level alongside the
composer-level coverage: explicit "on" keeps spawn chips, Inherit hides
them while the session's own (and legacy scope-less) decisions stay.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat: gate Smart Routing per harness on AI-Gateway backing
A harness whose CLI runs off a personal subscription (ChatGPT codex,
Bedrock claude) cannot run a routed pick — routing rewrites the launch
model to a gateway catalog id. Verified across four mocked credential
states (neither/claude-only/codex-only/both backed) and closed the
holes where routing could still be reached:
- gateway_inference: gateway_inference_state / not_gateway_backed read
a host's reported map under any harness spelling; unknown (older
host, unevaluable family) never gates.
- server create: the auto path refuses to route when either arm is
unbacked (no safe half-menu — the pick lands after the create
commits), and an explicit routing-on create pinned to an unbacked
native harness 400s with the way out named, instead of minting a
session whose routing silently never applies. Children and subagent
sessions stay with their parents' spawn/turn gates.
- CLI preflight: --smart-routing consulted only the server's host row
and silently proceeded when no host had registered — pinning a
databricks model onto a ChatGPT-backed pane. The launch always runs
on this machine, so the local gateway-inference map is now the
authoritative first gate, with the host row as fallback; the two
failure modes get distinct messages (no routing model configured vs
not AI-Gateway-backed).
328 tests pass across the CLI/gateway/create/routing suites, including
a parametrized A-D truth table over both arms and the auto route.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(web): require gateway backing for the bundle-agent Smart Routing brain
The Debby/Polly Agent Harness menu offered Smart Routing whenever the
server flag was on, even when this host backs only one model family
with the AI Gateway — the router could then land the session's work on
an arm that cannot run its routed model (a codex pane on a ChatGPT
subscription). The auto option now requires both families
gateway-backed, mirroring the server-side create gate. Gateway backing
only: unlike the top-level harness row, the bundle brain routes across
SDK harnesses, so native wrappers/CLIs are deliberately not required.
The gate drops only the OPTIONS entry — membership checks and the
summary label for an existing pick keep the unfiltered map, so a saved
pick still reads back honestly.
235 NewChatDialog tests pass, including the new offers/hides matrix per
gateway state; tsc/oxlint/prettier clean.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: make cross-harness spawn redirects actionable in native sessions
An auto-harness claude session's redirected spawn was denied with an
instruction naming sys_session_create — a tool the model could not find
(claude spells MCP tools mcp__omnigent__<tool>, schemas are deferred
behind tool search, and no allowlist pre-approved them), so it treated
the deny reason as prompt injection and refused. The omnigent MCP was
attached all along; the actuation was unreachable.
- The deny/redirect reason now names the requesting harness's own
spelling (claude: mcp__omnigent__sys_session_create; codex: the bare
name plus its omnigent.<tool> display form — verified empirically
against codex-cli 0.145: the flattened omnigentsys_session_create is
log-only and not callable), notes the tools come from the attached
omnigent server and may need a tool search, and degrades gracefully —
when the session's relay does not advertise the spawn tool, it tells
the model to do the sub-task itself instead of naming a tool that is
not there.
- Auto-harness claude launches (label or harness_override 'auto', both
metadata loaders) add --append-system-prompt with the routing note and
an --allowedTools list of the four redirect-loop tools
(sys_session_create/sys_agent_list/sys_session_send/sys_read_inbox —
the inbox read was live-proven required to close the loop); pinned
launches stay byte-identical, pinned sessions never see redirects.
- Auto-harness codex launches get the note as developer_instructions
(through the reversible sidecar sync) and per-tool
approval_mode=approve tables in the generated mcp_servers section.
Live-proven on the incident's exact shape: auto-harness claude parent,
spawn redirected to gpt-5-6-sol/codex-native, model called
sys_agent_list then sys_session_create, child session created on the
codex arm with parent linkage, result returned via the inbox, parent
reported it. Control session (pinned) carried neither flag. 229 tests
pass across the five touched suites.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: record the e2e sweep's evidence across the CUJ_MASTER registry
Overnight sweep on both stacks: 9/9 create matrix exact (the C1 glm
arrow is gone), GLM subagent rows live-proven including the effort
clamp firing, cross-harness redirect actuation end to end, codex
bare-launch 8/8 including crash durability, gating row 65 closed live,
1,627 pytest + 1,446 vitest with only the two accepted baseline
failures. Registry corrections from false greens the sweep caught:
deleting the routing block does not disable routing (only
provider:none does), the audit/canary rows are unreproducible since the
machinery was cut, the turn-path fail-open is silent, and several
recipe spellings fixed.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: switch claude models via the picker, never the global-default arg form
Every routed claude-native switch (and the web model picker) typed
'/model <arg>' + Enter into the pane — claude's arg form saves that
model as the user's GLOBAL default in ~/.claude/settings.json, caught
live rewriting the file during the e2e sweep. Ported the v4 actuator:
inject_model_selection submits bare /model, polls for the picker, walks
the cursor onto the target row, and presses 's' (session-only — proven
to leave the file byte-identical; Enter and digit keys both save the
default and are never sent), resolving exact catalog-id matches across
all rows before any alias match so a workspace serving two generations
of one tier lands the right row. auto_confirm's fixed 0.3s sleep is
now a dialog poll with a deadline.
The web path needed more than the executor's targets, caught live: the
picker dropdown sends tier ids, and this workspace serves two Opus
generations — 'opus' alias-matched the wrong row and the custom slot
(labelled by display name) was unreachable. Targets now come from the
session's resolved launch-config env (alias pins + custom slot + slot
name) merged under the bridge record; both cases verified live
('opus' -> Opus 4.8, the custom tier -> Opus 5, each session-only).
Live proof on the running stack, no restart (runners spawn per session
from disk): a routed opus-5 -> sonnet-5 switch and two web switches,
panes showing bare /model + 'for this session only', zero 'saved as
your default' lines in full scrollback, and ~/.claude/settings.json
md5-identical throughout. 640 tests pass across the seven touched
suites, including a tripwire that fails if the arg form ever returns.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat: let a spec hand its brain harness to Smart Routing
A spec that pins executor.config.harness also pins the family its
sub-agents are routed within, so a two-headed agent loses the head that
lives in the other family: debby's `gpt` sub-agent, declared on codex,
was rerouted onto claude-sdk and both heads answered as Claude.
Add executor.config.smart_routing_harness: auto, which opts a spec out of
its own pin for a Smart Routing session and converges on the "auto"
sentinel path the brain-harness picker already offers by hand. Gated to
Smart Routing creates only, and never over a client's explicit harness or
model pick, so a spec carrying the key is inert with routing off.
Set it on debby and polly, whose sub-agents span harness families.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat: two-state subagent routing, stamped at create — Inherit is gone
Per the user's ruling: a session that starts with Smart Routing routes
the subagents it spawns; everything else is Default, meaning whatever
the harness natively does. The tri-state inherit (unset resolving to
the session's own cost-control state) produced displays the user never
picked and a chip gate that disagreed with behavior.
- subagent_routing_enabled is now exactly override == "on"; the spawn
gate reads one explicit switch instead of re-deriving parent state.
- The server create handler stamps "on" once, for every path that
starts routed: top-level auto harness, bundle-agent auto brain, fixed
native harness with routing on, CLI --smart-routing (including v4's
bare in-harness creates, which send cost_control on), and children of
a routed parent. Unrouted creates store nothing; an explicit caller
value always wins; only "on" is ever stamped so ordinary creates
cost no extra write.
- One-time data migration stamps "on" onto existing rows exactly
where the old inherit rule resolved to routed (146 of 158 live rows),
so sessions in flight keep routing their spawns across the deploy;
downgrade is a documented no-op.
- The gear row offers exactly two options — Smart Routing / Default —
reading through to the stored value; a legacy null displays Default
and re-picking it writes nothing. PATCH keeps accepting explicit null
as an API-level clear; the UI never sends it. The chip gate's logic
is unchanged and is now an exact mirror of behavior.
181 python + 642 web tests pass across the touched suites (stamp
matrix, migration up/down, two-option UI, PATCH back-compat);
tsc/oxlint/prettier and ruff clean.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat: the router always decides a requested-model spawn — honor only on match
A spawn naming a model bypassed routing entirely ('honored — it is a
routable arm'), so the parent model's habit of writing a model field
starved the delegate arms: a dry-run subtask that the router scores to
glm ran on sol because the router was never asked. Per the user's
ruling, the requested model never short-circuits: the router is always
called, 'honored' appears only when its pick matches the ask (bare-id
normalized, [1m] folded), and a mismatch applies the router's pick with
the ask recorded as attempted_override — struck through on the chip
next to the applied model — and named in the codex parent's notice so
it does not silently re-spawn.
Claude-side asks now resolve through the session's alias pins before
comparison (a bare 'opus' never matched its own pinned arm and logged a
spurious override on every named spawn); inherit/default sentinels
carry no ask. The sys_session_send path's raw string compare gets the
same normalizer (a servable-alias respelling is not an override). On
router outage the spawn still runs on the ask (fail-open unchanged)
and the record now says so.
Accepted cost, signed off: an explicit ask — including a user-authored
'use glm' — is honored only when the router independently lands the
same arm; task_v1 exposes no requested-model input (live-probed: config
hints ignored, narrowed menus rejected). Follow-ups if wanted: a
requested_model field in the routing proto, or a session-level pin.
197 python + 40 web tests across the touched suites; live-probed
against the real router with match, mismatch, and no-ask shapes.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat: session Smart Routing is a create-time choice; the gear keeps one knob
Custom/SDK agents (Polly, Debby, and any non-native agent session)
lose the in-session Smart Routing toggle. It was already a near-no-op
for the session's own turns — the first routed turn pins
model_override, after which the toggle changed nothing — and its only
live effect was gating child spawns through a field the visible
Subagent routing row did not control. Per the user's ruling, Smart
Routing for a session's own turns happens once, at session start.
The Subagent routing row (identical copy, options, and testids to
native sessions) is now the single in-session routing control, and the
three server-side child-spawn gates (_force_auto_for_child, the SDK and
native parent-routing turn gates) plus the child create-stamp's parent
clause read the subagent-routing switch instead of parent cost-control.
Behavior-identical for every existing row via the create-stamp and the
e6f7a8b9c0d1 backfill (live DB verified: zero stranded cc-on/sr-unset
rows) — and picking Default now genuinely stops a bundle's spawns from
being routed, which the old pair of knobs never delivered.
isSubagentRoutingSession widens to all non-native top-level agent
sessions (their spawns go through the create path, which is
harness-independent), closing the pi-brain gap where the row vanished
mid-session. The gear tooltip drops its standalone Smart Routing line,
matching native.
189 python + 293 web tests across the touched suites, including
gate-flip cases proven to fail against the reverted server edits; full
web suite unchanged at 5005 passing.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* spike: codex UserPromptSubmit routing probe (S1/S2 scaffolding)
A marker-gated spike-userprompt subcommand on the codex policy hook:
logs every UserPromptSubmit payload to the bridge dir, and (behind a
one-shot marker file) fires thread/settings/update on the live thread
via the app-server websocket, optionally blocking the prompt. Inert
without the marker files. Kept as the working reference for the real
route-turn hook: the ws:// client framing, the second-command-per-event
wiring, and the trusted-module trick are all proven here.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: record the spike verdicts - Variant B disproven, Variant A verified
S1 FAIL, 3 runs with a bogus-model positive control: codex binds the
turn model at turn/start and writes turn_context before UserPromptSubmit
runs, so an in-window thread/settings/update only lands on the NEXT
turn. Variant A (block -> settings update -> replay) was then verified
end-to-end on codex: clean 1.08s abort, routed turn_context on the
replay, re-entrancy marker held, and the forwarder self-pins
model_override off thread_settings_applied.
S2 PASS: UserPromptSubmit fires for turn/start RPC turns with payloads
byte-identical to TUI-typed input; payload carries prompt + LIVE model
+ codex thread id (not the omnigent session id). S4 PASS: full hook
chain 0.37-0.78s; the settings call 26-77ms, wide margin under the 30s
budget. New trap recorded: never read the live model from config.toml
(stale on every read during the spike); take it from the hook payload.
S3 (claude block-and-replay UX) is the only spike still open.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* spike: claude UserPromptSubmit block-and-replay probe (S3 scaffolding)
Marker-gated spike-userprompt subcommand on the claude policy hook plus a
second UserPromptSubmit command in the bridge's settings generation. Inert
without the marker file. Kept as the working reference for the real
route-turn hook on claude: it is what proved the block leaves a clean
slate and the bracketed-paste replay is byte-exact.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: S3 passes - claude block-and-replay verified, all spikes closed
Block is cleaner than documented: input erased, reason shown, and nothing
persists (transcript logs only an informational preventContinuation row -
no user row, no model call; the omnigent conversation records nothing for
the blocked prompt). Replay is byte-exact including a real multi-line
prompt, submitted as one turn by the existing bracketed-paste injector.
The replay's fresh UserPromptSubmit no-ops on the consumed marker, and
/model does not fire UserPromptSubmit so the switch cannot self-trigger.
Three routed turns landed three different arms. Visible gap ~3-4s, the
/model settle dominating. No turn-2 fallback needed.
Records the actuator spec (poll for the Switch model? dialog, settle on
context.json - never fixed sleeps) and four claude-specific findings: the
hook payload has no model field, /model <arg> rewrites the user's GLOBAL
default (product blocker for the actuator, needs a decision), the /model
echo can make a weak model refuse the replayed prompt, and this
deployment's /model vocabulary is full catalog ids rather than bare
aliases. Also flags a pre-existing defect that bites the current branch
independently: inject_slash_command(auto_confirm=True) confirms the switch
dialog after a fixed 0.3s sleep, but the dialog took 1.861s with cached
history - the Enter is dropped and the next injection times out.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat: in-harness first-message routing for codex (phase 1)
A bare 'omni codex' launch now routes on its first prompt, wherever that
prompt comes from (TUI-typed or RPC-delivered) — the spike-verified
block-and-replay variant, productionized:
- omnigent/runner/turn_routing.py: the decision seam (wire types, the
route-once policy, loopback relay with advertisement + live-pid check,
and the runner-side replay that waits on the hook's done-marker and the
blocked turn clearing before redelivering through the normal events
path, which re-checks the gate and records no second decision).
- codex hook 'route-turn' subcommand: fast-skip on the marker, POST to
the loopback, thread/settings/update + config mirror, then block.
- POST /v1/sessions/{id}/hooks/route-turn mirroring route-subagent,
reusing route_turn / catalog / decision-chip plumbing.
- Registered as a second UserPromptSubmit command in the trusted policy
hook module; started/torn down beside the subagent router at launch.
- write_advertisement/read_router_endpoint gain a filename kwarg so the
loopback plumbing is shared with subagent routing, not copied.
The route-once gate is the routing-decision label, not model_override:
the codex forwarder mirrors config.toml's stale model into
model_override at the first turn/started, beating the hook, so presence
can't distinguish a real pin from the mirror. Residual gap (documented
in already_routed): a manual pin with Smart Routing on gets hook-routed
once; closing it needs pin provenance, left for phase 2.
Live-verified on the :64688 stack: trivial->luna, sprawling->sol, one
decision row and one user turn each; second turn fast-skips with zero
network. Spike scaffolding (spike-userprompt) removed. 96+69 tests pass
under the sanitized env run.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: make the blocked first prompt durable across runner crashes
Between the hook's block and the replay delivery the prompt existed
only as an in-memory asyncio task — a runner crash in that window lost
it forever while the decision chip, model_override pin, and done-marker
all said routing succeeded (exactly the dead-session shape reported
from live testing, reproduced with a SIGKILL at the marker write).
The relay resolver now writes turn_replay_pending.json before handing
the verdict back (on disk before the hook can block), clears it on
delivery or when the hook is known to have fallen open, and keeps it on
a failed delivery. On the next launch schedule_pending_replay_recovery
drains a leftover record: it requires the marker (proof the hook
blocked), waits for the relaunched thread, and only delivers after
confirming via the item history that the prompt never ran — an
unreadable session leaves the record for a later launch rather than
risking a double-run. A session_id match guards forks sharing a bridge
dir. Adds a turn_routing.log hook trace for diagnosability.
Live-proven on the spike stack: four fresh sessions routed on their
first prompt with turn-2 fast-skips, plus a crash-recovery run
(SIGKILL at the marker; relaunch recovered and replayed the prompt on
the routed model, record cleared). Investigation of the reported dead
sessions showed no prompt ever reached them (no UserPromptSubmit, no
events, empty rollouts) — the durability gap was the adjacent real
defect. 101 tests pass across the turn-routing and codex hook suites.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat: in-harness first-message routing for claude (phase 2)
A bare 'omni claude --smart-routing' launch now routes on its first
typed prompt, mirroring codex phase 1 through the same turn_routing
seam: claude-native joins _TURN_HOOK_HARNESSES, the claude hook gains a
route-turn subcommand (marker fast-skip, loopback POST with the live
model read from context.json, block), and the runner performs the model
switch inside the replay via _apply_routed_model — the composer gate
only forwards model_override in-band when it just routed, so a
hook-routed replay previously arrived with no model and ran on the
launch model.
The switch actuator drives the /model PICKER instead of '/model <arg>':
sandbox-proven that the arg form saves the pick as the user's GLOBAL
default in settings.json, while walking the picker with arrows and
pressing 's' switches 'for this session only' with the file
md5-identical across idle soak and clean exit (digit keys also save the
default and are never sent). inject_model_selection resolves exact
catalog-id matches across all rows before any alias match — a workspace
serving two opus generations otherwise lands the wrong row. The routed
composer path switches through the same picker, closing the global
default rewrite on every routed turn; auto_confirm's fixed sleep is
replaced by a dialog poll with a deadline.
CLI: --smart-routing without -p now creates the bare routed session
(cost_control on, no create-time route) and launches the TUI for
harnesses with in-harness routing; auto/no-harness still requires -p.
Spike scaffolding (spike-userprompt) deleted.
Live-proven on an isolated stack: five bare claude launches, trivial
prompts routing to sonnet-5 and a narrow task escalating to opus-4-8
(the pane held opus-4-8 AND opus-5 rows — the id-first matcher picked
right), one decision and one user message each, second prompts
fast-skipping with zero network, and ~/.claude/settings.json
md5-unchanged after every run. 364 tests pass across the touched
suites.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: drop the vestigial turn_router_dir kwarg that broke claude launches
A merge-resolution leftover passed turn_router_dir to
augment_claude_args, whose merged signature never gained the parameter
(the claude route-turn hook registers via bridge_dir and self-gates on
the advertisement at fire time) — every claude-native launch on this
branch died with a TypeError before the pane existed. Caught by the e2e
sweep's bare-launch row.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: apply the routed model to the codex thread in codex's own slug
The route-turn actuator sent thread/settings/update the raw catalog id
(databricks-gpt-5-6-luna). The turn ran — the gateway serves the id —
but codex has no catalog metadata for that spelling, so the pane warned
'Model metadata not found, defaulting to fallback' and /model kept
highlighting the launch slug, which reads as routing not working.
New codex_model_vocabulary (shaped like claude_model_vocabulary):
comparable_model_id folds catalog prefixes, the [1m] suffix, and
dot/dash spelling; codex_model_slug resolves the routed id against
codex's live model/list rows, so codex stays the vocabulary authority
with no hardcoded table. The actuator lists models on the client it
already holds, sends the matched slug, and mirrors the same spelling
into config.toml so the forwarder cannot flip-flop between spellings;
model/list failure or an unmatched id falls back to the id verbatim.
The decision row keeps the catalog id.
Live-proven: thread_settings_applied carries gpt-5.6-luna, zero
catalog-id spellings in the rollout, /model shows the routed row as
(current), no metadata warning for the routed model, one decision,
turn-2 fast-skip. 122 tests across the four touched suites.
Known siblings left for follow-up: thread/start still passes the
catalog id (the remaining launch-model metadata warning), and the
codex spawn path injects catalog ids verbatim.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat: gateway backing selects the router; the chip discloses the source
Gateway inference stops being a hide gate and becomes a source
selector. Every Smart Routing surface stays available; the AIGW
conditions decide which router answers each decision: the external
task_v1 client when it is configured and every family the decision
involves is AI-Gateway-backed, else the built-in judge
(LLMRoutingClient) when the server has one, else today's errors —
now reworded to name the real neither-source cause.
- New routing_backend seam: RoutingBackends holds both clients;
select_router picks per decision; caps carry both (routing_client
stays the primary for un-migrated readers). The CLI builds both, so
a Databricks deployment keeps its judge as the fallback.
- Off-gateway decisions never see the static databricks-* tables:
allow_static_fallback gates the infer_models fallback/top-up, and the
route declines rather than offer an id the pane cannot run (the two
hazard tests pin this seam-first).
- Decisions persist router_source ('databricks-aigw' | 'oss-llm');
/v1/info exposes smart_routing_sources; older servers degrade to
both-mirror-smart_routing_enabled in the CLI and web alike.
- The chip carries a small Databricks mark only when the AI Gateway
router answered ('Routed by the Databricks AI Gateway'); OSS and
legacy rows carry none; pickers are never branded.
- CLI preflight on an off-gateway family with a judge available prints
one informational downgrade line and proceeds instead of erroring.
- Setup doc and routing overview updated to the source-table semantics.
696 python + 336 web tests across the touched suites (21-test selector
truth table, the create-refusal splits, the /v1/info matrix, badge
render cases); ruff/tsc/oxlint/prettier clean. The 9 wider-run
failures are pre-existing snapshot-cache pollution, reproduced
identically on the clean parent.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* test: apply the routing test-suite overhaul and refresh the CUJ registry
Registry (designs/CUJ_MASTER.md): 4 rows + 1 recipe cut as fixed or
contradicted; the spawn-audit/canary rows retired-with-reason (the
machinery went with 484f7300 — deliberately out of scope, named in the
PR); row 95 re-entered as a picker regression row; ~22 rows updated to
today's ground truth (codex slug comparisons via comparable_model_id,
strict adherence, the spec-declared auto brain, the deleted standalone
toggle, source-selector semantics); 19 new rows in area O covering the
create-stamp matrix through the off-gateway static-menu decline.
Suites: the turn-gate tests renamed test_turn_routing_enabled_* so they
stop reading as the two-state spawn gate; the matching-ask pair and
five integration duplicates folded into their parametrized seam tests
with per-item duplication proof (122 -> 119 cases, no coverage lost).
25 new targeted cases: an AST-based guard module pinning that no claude
routing path builds '/model <arg>', the switch path holds no fixed
sleeps, the picker reads only the user settings file, and cursor/kiro
remain the only (documented) arg-form senders; hook-settings cases
pinning both routing hooks' timeouts above their script budgets and
coexistence with the policy hooks; the turn-routing timeout ladder
strictly decreasing and the router client inside the hook budget; the
two-concurrent-first-prompts and manual-pin-routed-once gaps pinned as
recorded decisions; migration edge cases (unparseable blobs, dangling
parents, idempotent re-upgrade).
744 + 364 + 192 sanitized pytest passes across the routing slice; web
suites re-confirmed green as baseline; ruff and pre-commit clean.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* test: add the e2e routing CUJ suite behind a mocked router
Five end-to-end CUJs — claude and codex from session start (API) and
from a typed first message (TUI), plus the auto-harness cross-family
redirect — each asserting the routing artifacts (decision rows and
their router_source, the pinned model, marker files, thread settings in
codex's own slug, pane state, message counts) and never answer content.
Two properties make it CI-shaped. The routing API is mocked: a
deterministic routes:select service replays the live router's own rule
traces (trivial -> cheapest arm, delegate-class -> glm, crosscutting ->
default/escalate) and keeps the real contract honest by rejecting a
narrowed menu exactly as staging does — proven against the real
ExternalRoutingClient over HTTP, not a hand-written body. And subagent
spawns are asserted as issued-and-routed rather than awaited, so no
test waits on a child's output or an inbox return.
21 pass in ~5 minutes; the suite is opt-in (smart_routing marker plus
OMNIGENT_E2E_SMART_ROUTING=1) and skips with a named reason when the
CLIs, tmux, or a provider config are absent. Each test boots its own
ephemeral server, host, temp DB and temp config home; the developer's
settings files are left untouched, which CUJs 1/3/5 assert by digest.
The CLIs are launched with their trust-bypass flag through
terminal_launch_args (the pattern tests/e2e/test_comment_tools_claude_native.py
already uses) because a fresh temp workspace otherwise blocks the input
box on a trust dialog before any hook can fire.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* chore: remove development-session scaffolding from the PR
Working docs (CUJ registries, plan documents, session setup notes),
the personal dev scripts (dev-env/run-server/run-host/run-frontend and
the routing-API probe), and their allowlist rows were session tooling,
not product: several named internal staging workspaces and proxy
endpoints, and none of them belong in a public repo. A test fixture's
profile string is generified for the same reason. The user-facing
routing documentation moves to the omnigent-site docs (PR #446 there).
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: settle the rebase against main's session-routes and model-picker work
Main split the session routes into explicit imports and grew a
host-resolved Codex launch-model catalog while this branch was out; the
replay needed both re-applied by hand.
- Import the names the routing paths use explicitly (`_logger`,
`_get_runner_client`, `_spawn_gateway_backed`, the validators) now that
`routes_hooks` / `routes_core` no longer star-import them.
- Keep the pre-existing `native_policy_not_enforced` banner: the trim
commit dropped its server half, but the runner still reports the
degrade reason, and main re-exports the helpers.
- Codex's Model row now carries the host's real catalog alongside the
Smart Routing sentinel instead of replacing it, with the resolved
default label back via a `defaultLabel` prop on `RoutingModelSelect`.
- Refresh the tests those two changes made stale, and re-apply the hook
timeout the dropped merge commits had fixed in place.
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: apply the external-review fixes and drop both new migrations
- Turn dedup compares decoded user-message text, not a JSON dump
- A no-op model pick is terminal: pinned and recorded without replay
- Child sessions route once; follow-ups cannot flip harness_override
- The turn marker is scoped to {session, decision}; the claude hook
reads the live session id, so /clear cannot reuse a stale marker
- Hook relays require LEVEL_EDIT; rationales log at DEBUG
- The turn router registers only when routing is enabled; codex model
catalog population runs off the event loop with a 60s failure TTL;
hook timeouts sit 10s above the inner HTTP timeout
- gateway_inference moves off the hosts table onto the host connect
handshake, held in server memory (unknown-is-backed until a host
re-reports); both alembic migrations are deleted — the PR adds zero
migrations
- Routing availability checks unified on the routing_backend helpers
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* test: gate the router's ambient-credential tests on the databricks extra
The new ambient workspace-credential tests patch
``databricks.sdk.config.Config``, but ``tests/server`` runs on a lean CI
lane that neither installs the ``databricks`` extra nor deselects marked
tests, so all eight failed collection with ``ModuleNotFoundError: No
module named 'databricks'``.
Mark them the way the repo already gates SDK-coupled tests, and list
``tests/server/test_smart_routing.py`` on the databricks lane — a marked
test in a path that lane does not cover would otherwise run nowhere.
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* revert: switch claude models with `/model <id>`, not the picker
Switching a live claude-native pane through Claude Code's interactive
`/model` picker took ~530 lines of tmux screen-scraping to avoid one side
effect: the argument form also saves the pick as the person's global
default in `~/.claude/settings.json`. The repo owner has accepted that
write, and an external review found the picker path fragile in ways the
argument form has no equivalent of — a 5s server forward budget against a
~35s worst-case automation whose result was discarded, an applied-check
that could return before the ~1.9s "Switch model?" dialog rendered, a
next-message-swallowed-by-dialog hazard, no busy-pane gate, no scroll
handling, and no concurrency lock.
So every claude model-switch call site goes back to injecting the text
`/model <id>` plus Enter through `inject_slash_command`, with
`auto_confirm=True` so the cache-invalidation dialog is still answered:
- the web/API `model_change` endpoint (`runner/app.py`),
- the first-message turn-routing switch (`runner/turn_routing.py`),
- the per-turn executor switch (`inner/claude_native_executor.py`).
Fail-open semantics are unchanged: a failed injection is logged and the
turn still runs on the pane's current model.
Deleted with their last caller: `inject_model_selection`, the picker's
open/apply poll ladders, the row regex and row scanner, the row-matching
and row-picking helpers, the session-only key, and the two runner-side
target-spelling resolvers. Kept: `inject_slash_command` and the polling
`_confirm_tui_dialog` (shared with `/effort`, and a real improvement over
the fixed 0.3s sleep it replaced), plus a single picker-footer string the
pane-readiness gate uses to notice a picker the person opened by hand.
The AST guards that forbade the argument form are gone; the "omnigent
never writes the user's settings file" and "no fixed sleeps on the switch
path" guards stay, since both still guard live code. The e2e settings
guard now compares everything in `~/.claude/settings.json` except the
`model` key Claude Code itself moves.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(web): one routing chip per pick, hydrate the gear modal's Model row
A Smart Routing create routes twice: once at create time (recorded as a
`session`-scope chip) and again on the session's first turn (a `turn`-scope
chip). Both land before the user's message, both resolve to the same model and
harness, and both render the identical "Smart routing · applied · claude-native"
card — one above the message, one below. The transcript opened on a duplicate.
Collapse them in the block walker: a `session` chip whose next content block is
a `turn` chip with the same model, harness, applied flag, and agent renders
nothing, and the turn chip (the one that pairs below the message) stands for the
pair. Both rows stay persisted as the audit trail, and a create-time pick the
turn CHANGES — or a failed create-time route, recorded as an unapplied
`"unavailable"` row — still renders its own chip, because those two chips say
different things.
Also in the gear modal, the Model row rendered blank on a routed session.
Routing pins the router's fully-qualified pick (`databricks-claude-opus-4-8`),
which the harness catalog carries only under an alias (`opus`) — so no option
declared the Select's value and Radix fell back to its empty placeholder. The
live model now rides as its own option, labelled exactly as the status label
below the composer. An untouched row still submits nothing: `save` re-pins only
a draft that actually changed.
Three review findings:
- `useSession` asks for `refresh_state=true` on every fetch again. Narrowing it
to the cache-cold fetch meant an invalidation refetch — how switching a
session's agent reloads the snapshot — came back off the runner's process
cache, leaving the PREVIOUS agent's model catalog on screen until a hard
reload.
- Drop the 30s snapshot poll every open session ran. Its only consumer was the
session warning banner, which the enforcement-stack trim removed; nothing
reads a field the poll refreshes, so the poll and its opt-in options go with
it. That also makes the unconditional refresh above safe — nothing re-asks
often enough to thrash the runner's caches.
- `refreshSessionOverrides` no longer fetches through the query client. It reads
two plain DB columns, but writing the reply into the shared `["session", id]`
cache replaced every other surface's refreshed snapshot with an unrefreshed
one, dropping the `model_options` the model picker renders from.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: scope the codex routing extras to the sessions that need them
Three session classes now decide what a codex home carries: a plain
session gets a byte-identical pre-routing home (bundled catalog,
symlinked hooks.json, no spawn gate, no extra tool approvals); a
pinned-harness Smart Routing session adds only the extended model
catalog; an auto-harness session that routes to codex adds the spawn
gate and the cross-session tool approvals. The subagent router
endpoint starts only where something consumes it. The catalog probe
validates its payload and holds a lock across concurrent boots.
Dispatch validation accepts gpt substrings again and localizes
glm/kimi ids mechanically. The codex env filter now lets the router
and catalog launch signals through — the SDK-codex hook path was
silently dead without them.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: keep pinned codex launches free of routed-spawn extras
The runner passed `developer_instructions` to `build_codex_native_server`
for every codex terminal (with a `None` value on pinned sessions), which
changed the launch call shape for sessions Smart Routing does not own.
Pass the kwarg only for auto-harness sessions.
The claude-native launch-args tests handed a raw `tmp_path` to
`augment_claude_args`, which validates the bridge dir against the real
bridge root; point the bridge root at the test temp dir the way the
bridge's own tests do so the tests pass under any TMPDIR.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: satisfy the type and hardcoded-model gates
pyrefly on the pre-commit gate rejected five shapes the routing work
introduced: an inferred `dict[str, int | str]` hook literal that could
not take the route-turn entry, two `Awaitable` resolver results handed to
`asyncio.run_coroutine_threadsafe` (which takes coroutines only), and two
locals — `_parent_conv`, `_auto_harness` — read on paths where only a
narrower branch had assigned them. It also flagged the create path
rebinding `conv` from `get_conversation` without a `None` check, which
made every later attribute read an error; it now raises the same
`INTERNAL_ERROR` its sibling label writes do.
The router's static model tables moved to `omnigent/model_fallbacks.py`
as owned `StaticModelFallback` records — the repo's only sanctioned home
for a static model id, per the `no-hardcoded-models` lint. Ids that are
composed from the gateway's model-route prefix (GLM's `system.ai.`
spelling) are now spelled that way instead of restated.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* test: cover the Smart Routing UI in the Playwright suite
The web changes add user-visible routing surfaces with no e2e_ui coverage,
which the E2E UI Required gate flags. Two specs, following the suite's
established stub patterns:
- `start_session/test_smart_routing.py` — the landing picker's Smart
Routing row (create sends `harness_override: "auto"` +
`smart_routing_message`, and none of the placeholder wrapper's knobs),
Smart Routing as the gear modal's Model choice (create sends
`cost_control_mode_override: "on"`, no pinned model), and the negative
gate: a server with routing off offers neither.
- `chat/test_smart_routing_session.py` — a routed session's two audit
rows (create-time `session` chip + first-turn `turn` chip) render as ONE
chip with the Databricks mark, and the session gear modal's Model row
names the router's fully-qualified pick instead of rendering blank.
Both run against the suite's spawned server with `/v1/info`, `/v1/hosts`
and `/v1/agents` stubbed, so neither needs gateway credentials.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: match the gateway's trusted parents on DNS labels
The AI Gateway trust check compared the parsed hostname against
dot-prefixed domain suffixes with `str.endswith`. Correct as written (the
leading dot is what rejects `evilcloud.databricks.com`), but the safety
rests on a spelling convention in a constant, and a string-suffix test on
a domain literal is exactly the shape static analysis flags as incomplete
URL sanitization.
Compare whole DNS labels from the right instead, requiring at least one
label of the host's own in front of the parent domain. Same verdicts,
with the boundary now structural, and tests pinning both look-alike
classes: a trusted domain that only appears mid-host, and a label that
merely ends in one (`evilcloud.databricks.com`,
`ai-gateway.notazuredatabricks.net`).
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: stop the routing hook's codex floor from blocking every launch
Raising `_CODEX_MIN_VERSION` to 0.145.0 for the routing PreToolUse hook
made `harness_cli_installed("openai")` report `version-too-low` on
0.137–0.144, which makes `harness_is_configured("codex")` false, which
makes the host refuse EVERY codex launch — plain sessions included — with
a misleading "run omni setup". CI pins codex 0.139.0, so the e2e lane
failed on it too.
Restore 0.137.0 as the launch floor and enforce 0.145.0 only where the
spawn gate is actually registered: both codex hook writers now probe
`codex --version` and, on an older CLI, log one line and drop the routing
bridge dir so no hooks are generated at all. Routing no-ops instead of
blocking, and the user's hooks.json stays symlinked.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: confirm the /effort dialog instead of hanging on its title
`inject_slash_command(auto_confirm=True)` polled `capture-pane` for the
hardcoded "Switch model?" and sent Enter only on a match. The web UI's
effort change injects `/effort <level>`, whose confirmation dialog is not
titled that — so it never matched, the dialog stayed open, the change never
committed and the pane was wedged for the next injection. The no-dialog
case also spent the whole 4s poll budget where the previous code spent
0.3s.
Make the hint a per-command parameter and keep an unconditional confirm
Enter as the floor, which is what the code did before the poll was
introduced: on the no-dialog case it lands on an empty prompt and is a
no-op. The three `/model` sites pass the title they know and keep their
fast path; `/effort` passes none, settles briefly and confirms blind.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: keep the spawn-routing apparatus off plain claude sessions
claude-native passed `auto_harness=True` hardcoded and the SDK path started
the router for every claude session, so a plain claude session carried a
loopback HTTP server, its thread, a bearer token on disk, and a `Task`
PreToolUse hook — a subprocess cold start on native, in-process on the SDK —
on every spawn, with a 30-40s worst case when the endpoint is wedged. All of
it for a verdict the server would never route.
Gate both starts on the session's routing class, the same one the codex
paths already read. A plain claude session now gets no router, no hook and
no token file, matching plain codex; a routed session (pinned or auto —
claude routes spawns in both) keeps everything, and the per-spawn
server-side gate stays as defense in depth.
Accepted consequence: the class is stamped at create, so flipping the gear's
Subagent-routing toggle on for a plain-created claude session is inert until
the session is recreated. That matches the stamped-at-create design the codex
paths already follow.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: stop plain launches from displacing the model picker slot
`claude_config_with_launch_model_pinned` ran on every claude-native launch.
Whenever the launch model is an exact id no family alias points at — a user
picking an older generation of a family the workspace still serves — it
overwrote `ANTHROPIC_CUSTOM_MODEL_OPTION`, taking the workspace's own picker
row with it.
The slot exists so a routed session can return to the model routing picked
for it. Nothing re-picks the launch model on a plain session, so gate the pin
to routed launches and leave a plain launch's env untouched.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* test: restore main's spawn-env secret-leak canary
The trim commit deleted this file by name collision with the routing
spawn-audit canary; it is main's own guard for clean_agent_env and was
never part of this PR's machinery.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: keep the router rendezvous out of logs
The subagent- and turn-router startup logs printed the handle's url, and
the hook's rejection diagnostics echoed the url read out of the
advertisement. Both values travel with the bearer token that authorizes
the loopback endpoint, so a log line was enough to point a reader at the
secret's neighbourhood; static analysis flagged the four sites as
clear-text logging of sensitive data.
Drop the url from all four: the session id and the bridge directory (or
the advertisement's file name) identify the rendezvous well enough, and
the advertisement itself is on disk for anyone debugging it.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: confirm an effort dialog that renders after the blind Enter
A command whose dialog text we cannot recognise — ``/effort`` — settled
0.3s and then Entered blind. On a warm session the confirmation renders
about 1.9s in, so that Enter landed on an idle prompt and the dialog that
arrived afterwards stayed open: the person's next message was typed into
the modal and swallowed.
Keep the blind Enter as the fast path, then keep watching the pane for a
dialog until the confirm timeout and Enter again if one turns up. With no
dialog text to match on, the watch uses a structural signal — a framed
menu of at least two numbered choices with one selected — which also
recognises the ``/model`` picker and steps around a composer draft that
merely starts with ``2. ``. A dialog already showing at the settle skips
the watch, so the common cases still cost one capture.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: derive claude launch routing state through the shared class
Both claude-native launch-metadata builders hand-derived
``routing_enabled`` from ``cost_control_mode_override`` alone, while
``routing_class_from_snapshot`` deliberately ORs in the auto-harness
signal. A sub-agent child of a routed parent is created with
``harness_override="auto"`` and the auto-harness label but no
cost-control stamp, so it launched ``routing_enabled=False`` with
``auto_harness=True``: no pinned arms, no launch-model pin, no turn
router and no subagent router — yet still carrying the routed-spawn
system-prompt note and the four pre-approved ``sys_*`` tools. Claude was
told to hand its spawns to a hook nothing answered.
Route both builders through ``routing_class_from_snapshot`` so the class
is derived in one place, and require the spawn router to have actually
started before the note and pre-approvals go onto the argv.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: stop offering subagent routing where it cannot work
The create path stamped ``subagent_routing_override="on"`` on every
session that started on Smart Routing, and the gear offered the
Subagent-routing select to every native Claude/Codex session. On a
session pinned to codex neither is real: spawn routing there needs the
generated ``hooks.json`` and the routed-spawn tool pre-approvals that
only an auto-harness launch installs, so the switch read "on" with
nothing consuming it. The same went for a plain native session of either
family, whose apparatus is fixed at create.
Leave the stamp off for a pinned codex create, and hide the row wherever
the session's class has no spawn-routing machinery — a claude-family
routed session and any auto-harness session keep both. Non-native
SDK/bundle sessions are untouched: their children go through the
session-create path, which re-reads the switch per spawn.
Subagent routing is now launch-time-fixed for codex.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: make the model switch land once, or say why it did not
Three faults left over from reverting the interactive ``/model`` picker.
The web/API model-change handler typed the resolved catalog id straight
into ``/model``, which takes only the pane's own picker vocabulary. An id
outside it left the pane on its old model while the handler reported
success. Translate through ``claude_model_command_arg`` like the routed
turn path and the executor already do, and fail with a clear 503 when the
picker has no spelling for the model.
A routed first message switched twice. The turn router blocks the prompt,
types the switch and replays the prompt with the same override, but the
executor seeded its baseline from ``launch_model`` — written once at
bridge prepare — so the replay compared against the pre-switch model and
typed a second, redundant ``/model``. Seed from the live statusLine model
instead, and compare normalized.
A dropped forward was invisible. The PATCH persisted ``model_override``
and discarded the forward's result, so on a native pane — where the
injection is the only thing that moves the model — the row and picker
claimed a model the terminal was never on. Publish a visible notice and
log the reason. The forward budget also went up: the ``/model`` and
``/effort`` injectors can legitimately spend ~5s waiting on the pane and
its confirm dialog, which the old 5s budget would have reported as a
failure.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: clear the routing punch list's small residuals
- The install and credential routes recorded ``gateway_inference`` straight
off the host's RPC reply, so a host answering with anything other than a
string→bool object 500'd them inside ``dict(...)``. Decode through the
same tolerant reader the tunnel path uses, where a non-mapping is
"unknown".
- Reworded the routing docstrings that cited design documents no longer in
the repo; the behaviour they described is stated inline, and the e2e
suite in tests/e2e/routing/ is the executable reference.
- ``routing_enabled(caps=)`` read the routing backends directly, which
misses the managed arm where only a policy-LLM factory is registered and
the routing client arrives later. It goes through ``routing_available``
now, the same gate the rest of the server uses.
- The codex model-catalog cache was keyed on binary path plus codex home,
so an in-place upgrade (same path, new bytes) served the previous
codex's catalog for the life of the host process. The binary's mtime and
size are part of the key now.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: match the gear's comments to the narrowed subagent gate
The two comments still described the old "every native Claude/Codex
session" rule. Say which classes carry the apparatus and which the row is
hidden for.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* test: pin that the late-dialog Enter only answers our own dialog
The extra Enter is scoped to a dialog that appeared after the settle, so a
menu already open when the command was injected — a live permission
prompt, say — still takes only the single blind Enter this seam always
sent. That property is what makes widening the confirm window safe, so it
gets a test and a note rather than living in the reviewer's head.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: answer the effort dialog by name, not by shape
The effort confirm watch Entered on any dialog that turned up during its
4s poll, so a ``/model`` picker the person opened by hand — or a tool
permission prompt that rendered mid-turn — took the Enter too: the first
silently rewrites their global default model, the second silently
approves the tool.
Claude Code titles both cache-invalidation confirmations from one
component, so ``/effort`` has a title to poll for just like ``/model``:
"Change effort level?". Pass it as the effort call's ``confirm_hint`` and
drop the shape-matching watch — ``auto_confirm`` now requires a hint. The
timeout Enter stays, so a title that drifts in a future release does not
wedge the pane, but is withheld when the pane shows a picker or a
permission prompt. The readiness gate learns the effort title too, so an
open effort dialog no longer reads as "an injection may land".
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: suppress the codex subagent stamp only where it is inert
The create-time subagent_routing_override stamp was skipped for anything
whose harness family is "gpt". That also caught an SDK/bundle agent whose
brain is codex or openai-agents — and those spawn their children through
the session-create path, which re-reads the switch per spawn, so the
stamp is exactly what gives them default child routing. Skipping it took
that away, and disagreed with the gear, which offers the row on every
non-native session.
Suppress only where the switch really has nothing behind it: a NATIVE
codex terminal, whose spawn routing comes from the hooks.json and
tool pre-approvals an auto-harness launch installs. The server and the
gear now agree class by class: native pinned-codex hides the row and
writes no stamp; a codex-brained bundle keeps both.
The old fixture had no spec harness, so it never reached the family
check; the new case pins a codex-brained bundle on both sides.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: clear the routing punch list's last three residuals
- The "terminal was not switched" banner fired on stopped and detached
native sessions too, where nothing was running to diverge from: the
relaunch reads model_override off the row. Surface it only when a runner
actually answered and refused, which is the reachability the /health
liveness field reports.
- Add the credential route the tolerance test the install route got: a
host reply whose gateway_inference is a list must read as "unknown", not
500 with the credential already written. The install test never proved
that — its garbled value was dropped by the fixture before it reached
the frame — so both now inject at the proxy's return, past the decoder
that would otherwise normalise it away.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* test: drive the gateway-flip repush through the readiness loop
Upstream moved readiness refresh into its own task; the flip test now
exercises that loop directly instead of the removed tunnel helper.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: log nothing that addresses the router rendezvous
The redaction kept the session id and bridge path, which still name the
loopback endpoint whose advertisement carries the bearer token. The
start-up lines and the marker-failure notice now carry no values at all.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: make routing fail open in seconds, not in half a minute
Routing was already advisory everywhere it mattered, but the budgets meant
a wedged router still stalled the work it was supposed to get out of the
way of: a subagent spawn sat behind a 30s request inside a 40s hook kill,
and a first typed prompt sat behind 25s inside 45s. A fail-open that takes
that long is blocking in practice — the user cannot tell it apart from a
hang, and the turn they were promised runs no sooner for the wait.
Retune every routing ladder around one number: the routing call itself gets
5s, sized from the observed round trip (healthy routes:select answers in
~1.4-3s; the slowest sample on record was a gateway 500, not a verdict).
Each hop above it takes one more second, out to the harness-registered kill
at 15s (spawn gate 12s), which is now the only budget above single digits.
One attempt, no retry: a second try on an interactive path only doubles the
stall.
Two budgets on these paths were unbounded rather than merely long. The
built-in judge inherited the server `llm:` block's 300s request timeout,
multiplied by every configured fallback model, so picking the OSS router as
the source turned a fail-open into a multi-minute hang; it now shares the
external router's 5s. And the stale native model-options refresh, awaited
only to sharpen a routing candidate list, retries a booting runner for
~30s; routing now waits 3s for it and lets the single-flight finish filling
the cache on its own.
The CLI's preflight reads move off the create's 60s read budget too. They
answer in milliseconds and every failure already degrades to "unknown",
which does not gate, so there was nothing to win by waiting. The create's
own budget is left alone: that one is a session create, not a routing call.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: stop a routing outage from 500ing the turn it was routing
`route_turn` was the one routing seam that let its failure out. Its two
callers on the message path did not guard it, so a client that raised
instead of declining — a gateway 500 surfacing as HTTPStatusError, a read
timeout, a garbled body, a 401 — propagated to `POST /v1/sessions/{id}/
events` as a 500. By then the user's message had already been persisted, so
the turn was not merely unrouted: it was persisted and abandoned. Its
sibling `route_session_harness` has always returned an `error` string for
exactly this, which is what made the asymmetry easy to miss.
Add `route_turn_or_decline` as the turn path's fail-open boundary, in the
same `(model, verdict, error)` shape, and take the visible half of failing
open with it: the declined `routing_decision` card the auto-harness path
already emitted ("unavailable", applied=False) now covers the turn and the
native-pane paths too, so a session does not quietly ignore the toggle the
user turned on.
A failure deliberately does NOT stamp the routing-decision label. That label
is the route-once gate, so claiming it would turn one outage into the reason
the session never routes again — the failure is a card, not a decision.
Everything else audited on the routing paths was already fail-open and stays
untouched: the CLI's routed create and its auto-harness fallback, the
create-time server paths, the spawn-gate relay, both first-message hooks,
the loopback relays, both clients, and the model-switch application step.
The precondition gates that decline before anything starts are also left
alone — those are config rejections the owner asked for, not call failures.
Regression coverage for both properties (work proceeds, budget respected)
across gateway 500 / timeout / malformed body / 401 / unreachable relay, at
every call site: the SDK turn path, the native pane path, the spawn relay,
the first-message relay, both create paths, both hook scripts, both clients,
and the CLI's non-routing-400 fallback notice. Timing assertions are against
the ladder constants, never a wall clock.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: give a child spawn's failed route the same visible decline
`route_session_harness` returns its reason as an `error` string, and the
child-spawn branch of the message path unpacked it into `_route_err` and
then never read it. So the last routing path that could not route left no
card at all: the spawn ran on whatever the orchestrator had asked for, which
is right, but from the transcript "the router was down" and "the router had
no opinion" were the same thing.
Emit the same "unavailable" card the auto-harness and turn paths emit. Set
last, after the branch's own pin and publish, so nothing upstream can pin or
announce the placeholder — and leave the route-once label unclaimed, because
a child routes per spawn and `_child_routed_before` reads that label, so
stamping it on a failure would stop the child from ever being routed again.
The flag is renamed `_route_failed` now that both branches set it.
Also covers the bounded catalog wait: a stale-catalog refetch that never
finishes serves the stale vocabulary within `_ROUTING_CATALOG_WAIT_S` and
leaves the single-flight running to fill the cache for the next turn.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: let a pinned Smart Routing codex session actually spawn
Suppressing the create-time subagent-routing stamp for a native pinned-codex
session was justified on the theory that the switch would be inert there. It
was worse than inert: the pinned class was also withheld the spawn-routing
advertisement, and on codex that advertisement is what turns on the generated
``hooks.json`` ``spawn_agent`` gate AND the four routed-spawn tool
pre-approvals. A pinned Smart Routing codex session therefore had no spawn gate
and no pre-approved cross-session spawn tools, so its spawns did not merely go
unrouted — they stalled on an approval prompt nobody was watching.
Stamp every routed create again, and start the endpoint for a routed
codex-native launch whether or not the harness was auto-picked, which brings
the gate and the approvals with it. The codex SDK arm keeps the auto-harness
requirement: its spawns go through the session-create path, which already
routes off the stamped switch, so an in-harness gate would only add a round
trip. Plain sessions still get none of it.
What separates pinned from auto-harness is not whether spawns route but where
they may land: ``cross_harness`` stays ``auto_harness_session``, so a pinned
codex spawn is offered codex arms only and a claude pick is denied. The web
predicate now shows the gear's Subagent-routing row for exactly the classes the
server stamps.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: collapse a repeated routing verdict into one chip again
A Smart Routing create records its pick as a session-scope chip and the first
turn records the identical pick as a turn-scope chip; only the turn chip should
render. The pairing test asked whether the two decisions were ADJACENT, using
the same neighbour walk that decides where a chip sits relative to the message
it routes. That walk steps over exactly the blocks allowed between a chip and
its message, so anything else a booting session emitted between the two
decisions — narration, an earlier message, a whole finished response — read as
"unrelated" and both chips rendered.
Pair them by decision order instead: the next routing decision anywhere later,
across intervening blocks and turn-group boundaries. A turn chip that CHANGED
the pick, a declined create-time route followed by an applied one, and a spawn's
deny-then-honor pair all still render as two — the first two because the
verdicts differ, the last because a subagent-scope decision is never the
supersessor.
The incremental path had its own hole: the create chip is finalized into the
cached prefix frames before the turn chip exists, and the drop was computed only
from the walk's resume point, so a chip already in the prefix could never be
removed. The verdict set is now resolved over the whole transcript and
remembered on the cache, and a disagreement over the prefix forces the single
rebuild that removes the stale chip.
For the record, the resource_event in the reported transcript is not the
mechanism: an unknown item type yields no block from itemsToBlocks and
session_resource_created adds none on the live path, so it never separated the
two. The wire rows are kept as a funnel regression test regardless.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: keep a pinned session's spawns in its own harness family
A pinned Smart Routing codex session spawned a claude child and the router
pinned it to claude-sonnet-5: the in-harness spawn gate holds the in-family
line (candidate_models(cross_harness=False)) but the child-session route on
the native-terminal dispatch path had no such rule. It routed whatever
family the child's own pane ran, so an orchestrator that named another
family's wrapper agent got a cross-family spawn blessed by routing —
against the standing ruling that only an auto-harness session may cross.
The native child path now asks the same predicate the spawn gate does
(auto_harness_session(conv, parent)) and, for a pinned parent whose child
runs another family's CLI, routes nothing: no pin, no in-band /model, and a
declined chip naming the rule. The spawn itself still runs, on its CLI's
own model.
Also resolve a native pane's family from the terminal it is actually
running rather than an unresolved "auto" sentinel. The sentinel carries no
family, so a forced-auto child was offered every model its gateway serves
and could be pinned to one its running CLI cannot speak.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: render one routing chip per spawn, not two
One spawn produces two decisions — the in-harness gate sizes the task, then
the child session it created routes its own first message — and the
transcript showed both: one chip labelled "Session" (the gate row carries no
agent name) and one naming the spawned agent, with the same rationale. To
the owner that is one decision about one spawn.
The pair now collapses onto the child-session row, which is the informative
one: it names the spawned agent and the arm that actually ran, keeping the
gate's own pick visible as the router's raw verdict when a tier
substitution moved it (opus-4-8 -> opus-5). The two rows share no spawn id
— different decision ids, no agent on the gate row, minutes apart — so the
pairing key is the verdict: the same non-empty rationale AND the child
running the arm the gate picked. A deny-then-honor pair, two independent
spawns, and two genuinely different verdicts all still render as two chips.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: name the cause on a routing decline that had none
A live decline read "Routing unavailable (router request failed: )" — a
dangling colon with the reason missing. httpx's timeouts stringify to the
empty string, so the exception the fail-open budget produces most often was
also the one that said nothing. Every routing failure string now falls back
to the exception class ("router request failed: ReadTimeout"), which is what
a 5s budget firing looks like.
The subagent gate had a second way to lose the cause: a client that raises
before it can record its own last_error left the chip saying only "router
returned no verdict", with the real failure in the server log alone. It now
carries the raised cause when the client reported none.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
---------
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(codex-native): clear the MCP startup band once the model starts working
The web chat showed 'Starting MCP servers (3/4): <name>' underneath an
agent that was visibly already working, sometimes for minutes.
Codex delivers per-server startup edges only to the connection that owns
the thread, so the forwarder synthesizes the round and settles it when
the thread goes idle after a turn, or when a config-derived window
elapses. Both are late: a server that never reaches a terminal state
(e.g. a misconfigured command that never handshakes) keeps the band
pinned for the whole first turn, and the window stretches to the slowest
configured startup_timeout_sec plus grace (135s for a 120s budget).
Settle on the first model-produced turn item as well. Codex defers turn
EXECUTION until the startup round ends, so assistant-side output proves
the round is over while the turn is still running - the same invariant
the idle-edge settle already relies on, observed at the earliest point
it can be. The band now covers only the genuine pre-turn wait.
The turn's userMessage item is excluded, and only parent-thread events
count: a turn is ACCEPTED (thread flips active, user message
materializes) mid-startup, and a collab child's turn says nothing about
the parent's round.
Two adjacent fixes fall out: a mid-turn reload no longer re-shows the
stale band from the session snapshot, and hitting Stop during a first
turn no longer reports 'cancelled' for servers whose startup had in fact
finished. The failed-turn diagnostic that names still-pending servers is
unaffected - a failed turn/start produces no model output, so no settle
precedes it.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(codex-native): settle the MCP round once, and add before/after visuals
Addresses review feedback on the settle-on-model-output change:
- Settle at most once per forwarder connection. The round is seeded
once per connection and never on thread rotation, so once model
output settles it the outcome cannot change; without a guard every
later item in the session re-read the bridge file to reach the same
idempotent no-op. A state flag short-circuits them, and the new test
re-populates the map behind the flag so dropping the guard fails
rather than passing on idempotency alone.
- Add the before/after chat captures the review asked for, taken at the
same point in the turn (agent running 'sleep 40') against servers
built from the same web UI, differing only in this fix.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* chore(codex-native): drop the committed demo screenshots
The before/after captures don't need to live in the repo; the same
evidence is in the PR description as the sampled A/B table and the
runner-log timeline.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
---------
Signed-off-by: dbczumar <corey.zumar@databricks.com>
Codex-native sessions emit plan state through `turn/plan/updated`
app-server notifications, which the forwarder previously mirrored only
as an inline assistant message. Map those plan steps to the same
todo-list schema Claude produces via TodoWrite and post them as an
`external_session_todos` event, so the web TodoPanel renders a Codex
plan the same way it renders a Claude todo list. The plan still appears
inline in the transcript as well.
On the web side, the Tasks tab/drawer gate moves from `isClaudeNative`
to a `todosSupported = isClaudeNative || isCodexNative` flag; the panel
itself is already harness-agnostic.
Co-authored-by: Isaac
* chore: drop PR/issue references from code comments
Per the AGENTS.md code-comment guidance, comments should describe the
scenario rather than point at PR/issue numbers a reader must chase. Strip
the internal PR/issue/finding references from inline comments and
docstrings across production code and tests, rewording where needed so
each comment still explains what the code handles and why.
External upstream references (claude-code, coreweave/cwsandbox-client) and
local fix enumerations are left intact.
Co-authored-by: Isaac
* chore: tighten reworded comments after issue-ref removal
Fix two comments that read awkwardly after their issue references were
dropped: remove a now-duplicated parenthetical in the codex sandbox-error
guidance, and make the openai-executor regression-test docstring name the
actual scenario (missing databricks-sdk falling through to the env-var
client) instead of a vague "missing/invalid config".
Co-authored-by: Isaac
* chore: leave the initial-schema migration comment untouched
Revert the comment edit in the initial-schema migration; that file should
not change.
Co-authored-by: Isaac
The codex-native forwarder silently dropped three Codex item/turn signal
types that the native TUI shows, so the web transcript missed them:
- imageView / imageGeneration items -> view_image / generate_image tool
cards via _TOOL_ITEM_BUILDERS (the raw base64 result is not mirrored;
ap-web has no assistant-side image rendering).
- enteredReviewMode / exitedReviewMode items -> a short assistant-message
marker (the plan-update rail), not a [System: ...] user note that would
drain the server-side pending-input FIFO.
- turn/diff/updated -> coalesced per turn and flushed once at the terminal
boundary as a turn_diff function_call/output pair, so the growing diff
never spams the transcript.
Shapes confirmed against the live Codex app-server protocol
(codex app-server generate-ts / generate-json-schema, codex 0.141.0).
Adds 7 forwarder tests.
Co-authored-by: Pat Sukprasert <pattara.sk127@gmail.com>
* fix(runner): surface forwarder connectivity failures in idle-watchdog turn reason
When a native forwarder can't POST session events to the server (e.g.
`ConnectError: No route to host`), the turn stops making progress and the
idle-turn watchdog fails it after 240s with a generic reason ("likely a wedged
LLM or tool call"). The real cause — the connectivity failure — is logged
separately and never attached to the failure the user sees (issue #1119).
Add a process-local record of the most recent native-forwarder POST failure
(`omnigent/_native_forwarder_health.py`). A native-harness subprocess serves
one conversation and its forwarder runs in the same event loop as the watchdog,
so a single timestamped slot is unambiguous:
- Writers: the codex forwarder's exhausted-retry path
(`_log_post_transport_failure`) and the shared
`_native_post_delivery.post_session_event_with_retry` final-failure path
(covers antigravity / other shared users) record the failure.
- Reader: the idle-watchdog branch in `_scaffold._guarded_run_turn` appends a
recent failure to the turn-failure reason. The recency window is 2x the idle
timeout — the failure that began the stall is already ~idle_timeout old when
the watchdog fires, so a window equal to the stall would race past it, while
2x still ignores a long-resolved earlier blip.
Tests reproduce the full chain at unit level, each verified failing-first:
- `tests/test_native_forwarder_health.py`: the health record's round-trip,
recency-window expiry, and clear.
- `tests/test_native_post_delivery.py` and `tests/test_codex_native_forwarder.py`:
a real `ConnectError` driven through the shared and codex retry loops exhausts
retries and is recorded in `_native_forwarder_health`.
- `tests/runtime/harnesses/test_scaffold.py`: an in-process watchdog test that
records a forwarder failure, drives a wedged `run_turn` to the idle timeout,
and asserts the raised reason names the connectivity cause.
Closes#1119
Co-authored-by: Isaac
* fix(runner): clear forwarder-failure record on a successful POST; doc single-turn assumption
Addresses code-review feedback on the issue #1119 watchdog change:
- Misattribution guard: a POST that gets any HTTP response proves the server is
reachable, so it now clears the recorded connectivity failure
(`note_post_success`, wired into the shared `_native_post_delivery` and codex
retry loops). Without this, a recovered connection could leave a stale failure
that the idle watchdog (recency window = 2x idle timeout) would misattribute
to a later, unrelated stall. The record now only ever reflects connectivity
trouble since the last successful round-trip.
- Document that the single process-global slot assumes one active turn per
subprocess (the native UI's model), since the watchdog attributes the record
to the current turn.
Tests: add `note_post_success` clears at the module level, and a retry-loop
test that a successful POST clears a prior recorded failure (verified
failing-first — fails without the clear-on-success wiring).
Co-authored-by: Isaac
* feat(native-forwarders): replay proven-undelivered dead-lettered items on codex startup
Follow-up to #1588 (dead-lettering). Adds conservative startup replay of
recoverable dead-lettered transcript/usage POSTs for the codex native
forwarder, plus the classification it depends on.
Phase 1 - enrich the dead-letter record:
- append_dead_letter now persists delivered_ambiguous, http_status, and
transport_error alongside the human-readable reason.
- codex's _post_session_event_inner returned httpx.Response | None and
conflated two None cases (ambiguous-skip vs proven-undelivered after
retries). It now returns a small _PostResult that surfaces which, and
_post_session_event passes the correct classification into the dead-letter.
- claude's drop sites (permanent 4xx only) set http_status from
_http_status_for_log and delivered_ambiguous=False.
Phase 2 - conservative replay (codex, startup-triggered):
- supervise_forwarder drains dead_letter.jsonl on startup (.1 backup first,
then current, preserving order) via the shared replay_dead_letters helper.
- Only proven-undelivered records are re-POSTed: transport failures with no
response, and retryable statuses (e.g. 503) exhausted after bounded retries.
Ambiguous and permanent-4xx records are never replayed (no duplicate, no
re-reject) and are left as a forensic record.
- A delivered record is removed; a still-failing one is retained, with its
classification refreshed from the latest attempt so a record that now fails
ambiguously is never auto-replayed again. Files are rewritten atomically.
- Records written before classification existed are treated as unsafe.
Server-side idempotency (which would let ambiguous items replay safely) stays
out of scope; tracked in #1594.
Closes#1579
Co-authored-by: Isaac
* perf(codex-native): bound startup dead-letter replay so it cannot stall startup
Replay was awaited before live forwarding with no latency ceiling: each
re-POST used the live 3-attempt retry loop on the 30s client timeout, so a
slow/hung server could block startup for up to ~90s per record, unbounded by
record count.
- _post_session_event_inner now accepts max_attempts and an optional per-request
timeout (defaults preserve live behavior). Replay passes max_attempts=1 (its
natural retry is the next startup) and a 5s timeout so a hung server fails fast.
- replay_dead_letters now accepts max_records and deadline_seconds. Codex caps
replay at 500 records and a 30s wall-clock budget; records left over by either
bound are retained unchanged (deferred to a later startup) and logged, never
silently dropped.
Worst case goes from N x 90s (unbounded) to a flat ~30s. The whole-file read is
still bounded by the existing 50MB dead-letter rotation cap.
Co-authored-by: Isaac
* fix(native-forwarders): dead-letter unforwarded transcript/usage items
Second mitigation for #1120 (the first, the degraded-sync indicator, landed in
#1278/#1580). When a native forwarder permanently fails to POST a durable event
to the server, the payload was dropped and silently lost. Now it is appended to
{bridge_dir}/dead_letter.jsonl so it is recoverable on disk.
- Shared best-effort helper append_dead_letter() in _native_post_delivery.py:
writes one JSON line per dropped event, never raises (a dead-letter failure
must not disrupt forwarding), and stops at a 50 MB per-session cap (logged
once per path).
- codex: bind the bridge dir via a ContextVar at the forwarder entry and
dead-letter durable event types (external_conversation_item,
external_session_usage) at the single _post_session_event failure funnel.
- claude: dead-letter at all three permanent-drop sites (parent transcript item,
sub-agent start, sub-agent transcript item), where bridge_dir is in scope.
The ambiguous-delivery skip path is intentionally not dead-lettered (the item
may already be committed).
Write-only: replay of dead-lettered items on recovery is tracked in #1579.
Closes#1120
Co-authored-by: Isaac
* fix: rename key var to avoid CodeQL sensitive-name false positive
CodeQL py/clear-text-logging-sensitive-data flagged logging the dead-letter
path because the local `key = str(path)` matched its sensitive-name heuristic,
tainting the data-flow-equivalent path. The value is a filesystem path, not a
secret; rename to capped_path to clear the false positive.
Co-authored-by: Isaac
* fix(dead-letter): keep newest on cap via rotation; add usage + rotation tests
Addresses review follow-ups on #1120 dead-lettering:
- At the size cap, rotate the file to a single .1 backup and start fresh so
the most recent drops are retained (keep-newest) instead of stopping at the
oldest. Disk stays bounded at ~2x the cap. Removes the stop-at-cap latch.
- Add tests: external_session_usage is dead-lettered (the other durable type),
and the cap rotation keeps the newest record while moving old content to .1.
Co-authored-by: Isaac
* fix: log session id not bridge path on dead-letter rotation (CodeQL)
The rotation warning logged the bridge-dir path, which trips CodeQL
py/clear-text-logging-sensitive-data (a bridge directory is not a secret;
heuristic over-match on path-like data). Log session_id instead -- more
useful for operators and not flagged (the except-branch log already logs it).
Co-authored-by: Isaac
* fix(codex): fix glob pattern for rollout — sessions dir is year/month/day
The rollout path is sessions/2026/06/29/rollout-...jsonl (3 levels
deep), but the glob used sessions/*/* (2 levels). This caused
_read_compacted_history to never find the rollout file, so
compacted_messages was always None.
Co-authored-by: Isaac
* fix(codex): store full replacement_history including compaction tokens
The replacement_history contains opaque compaction tokens
({type: "compaction", encrypted_content: "..."}) alongside user
messages. These tokens ARE the compacted context — filtering them
out (keeping only user/assistant messages) loses the actual
compacted state.
Co-authored-by: Isaac
* fix(codex): only store compaction tokens, not duplicate messages
User/assistant messages from replacement_history are already persisted
as individual msg_* items in the conversation store. Only store the
opaque compaction tokens ({type: "compaction", encrypted_content: "..."})
which don't exist elsewhere in the DB.
Co-authored-by: Isaac
* fix(codex): store full replacement_history for rollout reconstruction
Revert the token-only filter. The full replacement_history (messages +
compaction tokens) is needed to reconstruct the rollout JSONL for
sandbox recovery. The duplication with pre-compaction msg_* items is
acceptable — losing the data makes recovery impossible.
Co-authored-by: Isaac
* feat(codex): store window_id from rollout Compacted entry
Add window_id to CompactionData and persist it from the rollout's
Compacted entry. Needed for rollout reconstruction — the Compacted
entry requires window_id alongside replacement_history.
Also return full replacement_history (messages + compaction tokens)
and add tests for _read_compacted_history.
Co-authored-by: Isaac
* feat(codex): reconstruct Compacted rollout record from DB compaction item
When _codex_rollout_records_from_session_items encounters a compaction
item with compacted_messages, it emits a {type: "compacted", payload:
{replacement_history, window_id, message}} record and discards all
prior response_item records. This enables rollout reconstruction for
sandbox recovery — codex resume reads the Compacted entry from the
rollout to restore the post-compaction context.
Co-authored-by: Isaac
* feat(claude-native): handle compaction items in transcript reconstruction
When _claude_transcript_records_from_session_items encounters a
compaction item with compacted_messages, it clears all prior records
and replays the compacted messages as transcript entries. This enables
Claude transcript recovery in sandbox environments where the local
JSONL is lost.
Co-authored-by: Isaac
* fix(claude-native): emit compact_boundary system record in transcript reconstruction
Claude Code's transcript has a {type: "system", subtype: "compact_boundary"}
entry marking where compaction occurred. Without it, Claude may not
recognize the compaction on resume. Emit this record before replaying
compacted_messages.
Co-authored-by: Isaac
* fix(web-ui): hide compaction summary message from chat bubbles
Claude Code injects a user message with the conversation summary
after /compact. This message is needed for the model's context
(resume) but should not render as a chat bubble. Detect messages
starting with "This session is being continued from a previous
conversation" and skip them in itemsToBlocks.
Co-authored-by: Isaac
* test(web-ui): add test for compaction summary message hiding
Verify that user messages starting with "This session is being
continued from a previous conversation" are hidden from chat bubbles
while normal user messages remain visible.
Co-authored-by: Isaac
* style: prettier format itemsToBlocks test
Co-authored-by: Isaac
The _handle_completed_item path (contextCompaction item) was not
passing bridge_dir to _persist_codex_compaction_item, so rollout
reading was skipped. Since the idempotency guard means whichever
call site fires first wins, if contextCompaction arrived before
thread/compacted, the persist happened without compacted_messages.
Thread bridge_dir through _handle_completed_event →
_handle_completed_item → _persist_codex_compaction_item so both
call sites can read the rollout.
Co-authored-by: Isaac
The structured `codexErrorInfo` auth check used `frozenset({"Unauthorized"})`
(CamelCase), but the Codex app-server enum serializes the variant as lowercase
snake_case (`unauthorized`, verified against the codex 0.140 binary's
`CodexErrorInfo` schema, alongside `usage_limit_exceeded`, `bad_request`, etc.).
So `_classify_codex_error`'s preferred structured signal never matched real
auth errors — classification only worked via the httpStatusCode (401/403) and
message-substring fallbacks (introduced in #1108 / #1250), masking the gap.
Store the auth variant set as lowercase canonical and compare the variant
case-insensitively, so the structured path fires for the real `unauthorized`
enum while still matching legacy `Unauthorized` spellings.
Adds regression cases for the lowercase `unauthorized` variant (string and
tagged-object shapes) with a non-auth message, isolating the structured path.
Co-authored-by: Isaac
* feat: persist compaction items for native harnesses (claude, cursor, codex)
When native harnesses compact their context, persist a compaction
boundary item to the conversation store so transcript rebuild from
DB knows where compaction happened. Also update compaction_to_history_items
to use compacted_messages when available.
- claude-native: reads post-compaction messages via get_session_messages()
- cursor-native: reads post-compaction messages from SQLite store
- codex-native: persists boundary marker (no compacted_messages available)
- compaction.py: compaction_to_history_items uses compacted_messages
Co-authored-by: Isaac
* test: add unit tests for native compaction item persistence
Cover _persist_native_compaction_item (cursor) and
_persist_codex_compaction_item (codex) — verifying POST shape,
last_item_id resolution, compacted_messages inclusion/omission,
and the empty-items fallback path.
Co-authored-by: Isaac
* fix: add idempotency guard for codex compaction item persist
Both _handle_completed_item (contextCompaction) and
_maybe_handle_turn_event (thread/compacted) can fire for the same
compaction boundary, causing duplicate persist calls. Add a
compaction_item_persisted boolean to _CodexForwarderState that gates
the persist and resets when a new compaction starts (in_progress),
mirroring the existing compaction_status_posted dedup pattern.
Co-authored-by: Isaac
* fix(ci): sort imports in test_codex_native_forwarder
Co-authored-by: Isaac
* feat(codex-native): include compacted_messages from server items
Read all persisted conversation items from the server and include
them as compacted_messages in the compaction event. This enables
transcript rebuild from DB to replay the full post-compaction state.
Co-authored-by: Isaac
* fix(codex): revert compacted_messages — server items are pre-compaction
The server's mirrored items are the pre-compaction history, not the
post-compaction state. Storing them as compacted_messages would replay
the full uncompacted history on resume, defeating the purpose.
Codex's post-compaction state is internal to its app-server protocol
and not readable from the forwarder, so the boundary marker
(last_item_id) is the only durable signal. The synthetic summary pair
fallback handles resume.
Co-authored-by: Isaac
* feat(hermes-native): truncate long tool outputs in web UI mirror
Skill loads and other verbose tool results no longer flood the chat
view. Outputs over 1000 chars are truncated with a "… (truncated)"
marker. The full output remains visible in the embedded terminal.
Co-authored-by: Isaac
* Revert "feat(hermes-native): truncate long tool outputs in web UI mirror"
This reverts commit 26e62e735f.
* feat(codex): read post-compaction rollout JSONL for compacted_messages
After compaction, codex rewrites the rollout JSONL with the compacted
state. Read the rollout file to extract user/assistant messages as
compacted_messages when bridge_dir is available. The rollout path is
derived from codex_home + thread_id in the bridge state.
bridge_dir is optional — the _handle_completed_item call site doesn't
have it, but the idempotency guard ensures the first call site
(thread/compacted in _maybe_handle_turn_event, which has bridge_dir)
wins.
Co-authored-by: Isaac
* refactor: remove truncation helper, keep skill-name replacement only
Co-authored-by: Isaac
* Revert "refactor: remove truncation helper, keep skill-name replacement only"
This reverts commit fa642b7f16.
* feat(hermes-native): persist compaction items from hermes to session
Add _has_new_compaction and _persist_hermes_compaction_item to detect
when hermes has compacted messages and mirror a compaction boundary
event (with post-compaction messages) into the Omnigent session.
Co-authored-by: Isaac
* test(hermes-native): add compaction item persistence tests
Cover _has_new_compaction and _persist_hermes_compaction_item with
four unit tests verifying compacted-row detection, POST body shape
with messages, and the empty-DB fallback boundary id.
Co-authored-by: Isaac
* fix(codex): remove rollout reading — JSONL is append-only, not post-compaction state
The codex rollout JSONL is an append-only log of the full session,
not rewritten after compaction. Reading it would give the full
pre-compaction history. The post-compaction context is only available
via the app-server's thread/resume WebSocket call. Persist only the
boundary marker (last_item_id).
Co-authored-by: Isaac
* feat(codex): read replacement_history from rollout Compacted entry
Codex appends a {type: "compacted", payload: {replacement_history: [...]}}
entry to the rollout JSONL after compaction. The replacement_history
contains the post-compaction ResponseItems — the actual context the
model sees. Read this instead of the full rollout to get the correct
post-compaction state.
Co-authored-by: Isaac
Network failures (connect timeouts, 503s, resets) make the forwarder drop
transcript/usage events after its bounded retries, previously visible only
as scattered per-item warnings — a sustained outage was effectively silent.
Wrap _post_session_event (renamed inner to _post_session_event_inner) to
classify each outcome into a process-level _ForwardHealth: a sub-400
response is a success that clears the run; None or a >=400 final response is
a permanent failure. After _FORWARD_DEGRADED_THRESHOLD consecutive failures
sync escalates once to a single ERROR ("forward sync degraded … transcript/
usage mirroring may be incomplete"); recovery logs an INFO and re-arms the
indicator. The latch ensures one signal per outage, not per dropped item.
Scope: the operator-facing degraded-sync indicator (the issue's first fix
clause). On-disk dead-letter + replay is a deliberate follow-up (needs a
persistence path + retention policy).
Co-authored-by: Isaac
* fix(codex-native): surface turn errors instead of silent success (#1108)
The codex-native forwarder could complete a turn that actually carried an
``item/completed`` error item but report it via a clean ``turn/completed``
boundary — a "silent success" that closed the Omnigent session as idle and
dropped the failure reason on history reload.
Phase 1 (surface only, no auto-retry):
- Add a shared `_terminal_error_from_turn(params)` that scans
`params['turn']['items']` for a `type == "error"` item, plus a single
shared `_classify_codex_error` classifier (auth vs generic) reused by
both the live and resume paths.
- `_terminal_turn_status_edge`: an error item forces `status="failed"` and
attaches the classified error; add an `error` field to `_CodexTurnStatusEdge`.
- `_omnigent_status_from_resume_turn` / resume edge: apply the same
error-item check so the resume path reaches status parity with the
live path.
- `_convert_raw_items_to_input` (runner/app.py): stop dropping error items;
map each to a visible message block so the reason survives history reload.
- `_post_turn_status_edge`: surface the error message as the terminal
`output`; an auth-classified error additionally flags `reauth_required`
and appends a re-auth hint. No automatic `codex login` is triggered.
- Empty turn (zero items) maps to idle and emits a WARN.
Tests: error-item => failed; auth classification; resume-path parity;
empty-turn => idle + WARN; converter surfaces error items; and a
regression that a clean turn still reports idle/success.
Co-authored-by: omnigent <noreply@omnigent.ai>
* fix(#1108): map codex error items to a typed error content block
Cross-review fix for PR #1250: history loading previously dropped codex
``error`` items, replaying a failed turn as a clean slate ("silent
success"). The first fix surfaced them as a synthetic user-role
``input_text`` message, which kept the text visible but mis-attributed
the failure to the user's input and lost the error semantics.
Now ``_convert_raw_items_to_input`` preserves each error item as a typed
``error`` block (the ``ErrorData`` shape: source/code/message), so the
failure stays visible AND correctly attributed as an error, and the
stable ``code`` round-trips for downstream classification. The test is
rewritten to pin the typed-error shape and assert the text does NOT leak
into a user message. A comment in the auth-fragment classifier explains
the broad ``login``/``sign in`` tokens are intentional (recall over
precision for a surface-only re-auth hint).
Co-authored-by: omnigent <noreply@omnigent.ai>
* fix(codex-native): ground turn-error detection in turn.status/turn.error (#1108)
Address PR review on #1250:
1. Live/resume detection: the app-server protocol carries a failed turn as
turn.status=="failed" + turn.error{message,codexErrorInfo}, not as a
type=="error" item in turn.items. Rework _terminal_error_from_turn to read
turn.error and classify auth via codexErrorInfo (Unauthorized / httpStatus
401-403) with a message-fragment fallback; force failed on turn.error or a
bare turn.status=="failed". The runner rollout 'error'-item path (Responses
vocabulary) is unchanged.
2. Server surfacing: external_session_status now builds an ErrorDetail from
data.output, persists it (last_task_error), and passes it to
_publish_status so a top-level session sees the reason on its own status
edge. reauth_required selects a distinct codex_reauth_required code.
Trim verbose comments; update fixtures to the protocol-accurate shape and add
a server-handler test.
Co-authored-by: Isaac
* chore(codex-native): trim verbose comments, drop issue refs from code
Shorten the inline comments added for the turn-error surfacing change and
remove the #1108 references from comments/docstrings.
Co-authored-by: Isaac
* fix(codex-native): also detect error ThreadItem as turn-failure fallback
The installed codex binary (0.140.0-alpha.2) carries a failed turn as both a
turn.error object AND, per ThreadItem.ts, an "error" item in turn.items (the
public docs claim only the former). Since the wire shape varies by version,
_terminal_error_from_turn now prefers turn.error and falls back to an error
item, so detection is robust either way. Add coverage for the fallback and the
turn.error-wins precedence.
Co-authored-by: Isaac
---------
Co-authored-by: omnigent <noreply@omnigent.ai>
The codex-native forwarder dropped Codex's context-compaction signals, so
the web UI never showed that the context window was compacted — now common
with GPT-5.1-Codex-Max auto-compaction.
Mirror compaction to the existing external_compaction_status event (same
one claude-native uses → response.compaction.in_progress/completed SSE):
- contextCompaction item/started -> in_progress (spinner on)
- contextCompaction item/completed and the thread/compacted notification
-> completed (spinner off)
Consecutive identical statuses are deduped on forwarder state (Codex may
signal completion via both an item and a notification). A turn-boundary
safety net forces "completed" if a compaction was left in_progress, so the
spinner can't hang if a completion signal is missed.
The Codex signal strings (contextCompaction item type, thread/compacted
notification) come from the Codex app-server protocol enums; handlers are
harmless no-ops if a build spells them differently — worth confirming
against live Codex.
Co-authored-by: Isaac
The codex-native forwarder dropped Codex reasoning: item/reasoning/*
deltas had no handler, so only the reasoning effort *level* synced, never
the thinking text. The reasoning visible in the native TUI was absent
from the web mirror.
Handle item/reasoning/textDelta and item/reasoning/summaryTextDelta in
the delta dispatcher and publish the transient external_output_reasoning_delta
event the server already supports (it emits response.reasoning.started +
response.reasoning_text.delta, matching the in-process executor's wire
shape). The first delta of a reasoning item opens the block (started=True),
tracked per reasoning item id on forwarder state and reset at turn/started.
Reasoning has no completed conversation item by design — the block is
finalized when the turn's assistant message arrives — so no completed-item
branch is added. Buffered assistant text is flushed first to preserve
arrival order.
Co-authored-by: Isaac
When codex-native runs a model-issued shell command, codex executes it inside
its own bwrap command sandbox. In a hardened container that disallows
unprivileged user namespaces, that sandbox cannot start and every command
hard-fails with a raw `bwrap: No permissions to create new namespace ...`
output, with no hint at how to recover.
Detect that marker in the `commandExecution` output and append actionable
guidance, instead of surfacing only the opaque bwrap error: start a new Codex
session with the "Full access" approval preset (New chat → Advanced settings),
or set `sandbox_mode = "danger-full-access"` in `~/.codex/config.toml` on the
runner. The raw output and exit code are preserved verbatim; ordinary command
output is never altered. Mirrors the degrade-instead-of-crash ask in #517.
Note: the issue's primary request — a true sandbox-bypass option in the codex
web selector — already shipped in #403 (the "Full access" preset sends
`--sandbox danger-full-access`), so this PR covers the remaining gap: turning
the default-preset failure into a clear, actionable message rather than an
opaque one.
Tests: `_command_execution_tool_call` appends guidance only on the
namespace-failure marker and leaves normal output untouched.
Co-authored-by: Pat Sukprasert <pattara.sk127@gmail.com>
* Add Codex-native model and effort controls
* Query Codex for native model options
* Use raw Codex model ids in UI
* Clarify native effort event comment
* Use Set for Codex effort dedupe
* Fix ChatPage Codex hook order
* Fix Codex model options startup retry
* Refresh Codex session state on load
* Use Codex model display metadata
* Pass through Codex model metadata
* Add Codex model metadata UI coverage
* Add Codex plan mode controls
* Cover Codex plan mode in e2e UI
* fix: guard session_model and session_reasoning_effort handlers by conversationId
The session_codex_plan_mode handler correctly checked conversationId before
applying state, but session_model and session_reasoning_effort did not — a
stale event from a previously-open session could overwrite the picker for the
currently-open one.
Also forward effort=None to Codex app-server instead of silently returning
204, so clearing effort on a Codex-native session actually reaches the
thread/settings/update RPC.
Co-authored-by: Isaac
* refactor: generalize Codex-specific API surface to harness-agnostic names
Rename API fields and SSE events to be harness-agnostic:
- codex_plan_mode (bool) → collaboration_mode (str) on PATCH body
- codex_model_options → model_options on session snapshot
- SessionCodexPlanModeEvent → SessionCollaborationModeEvent
- SessionCodexModelOptionsEvent → SessionModelOptionsEvent
- session.codex_plan_mode → session.collaboration_mode SSE event
- session.codex_model_options → session.model_options SSE event
Internal labels and helpers that are genuinely Codex-specific remain
prefixed — only the external API surface is generalized.
Co-authored-by: Isaac
---------
Co-authored-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix(codex-native): use per-turn input tokens for context ring instead of cumulative total
The context-window ring was showing 100% on long Codex sessions because
`context_tokens` was sourced from `tokenUsage.total.inputTokens` (cumulative
across all turns) rather than the current context occupancy. For a multi-turn
session the cumulative total easily exceeds the window (e.g. 4.8M vs 1.2M).
Read `context_tokens` from `tokenUsage.last.inputTokens` (per-turn breakdown
Codex already provides) so the ring reflects actual window usage. Falls back to
the cumulative total when `last` is absent (first frame before a turn completes).
Co-authored-by: Isaac
* fix: fall back to cumulative tokens when last.inputTokens is missing/invalid
When tokenUsage.last is present but lacks a usable inputTokens value,
fall back to total.inputTokens for context_tokens rather than omitting
it entirely (which would leave the ring stuck on a stale coalescer value).
Co-authored-by: Isaac
Bryan Qiu