`zoneinfo` has no time-zone data on Windows unless the `tzdata` wheel is
installed, so `ZoneInfo("UTC")` raises ZoneInfoNotFoundError there. Two
scheduler modules evaluate it at module top:
omnigent/server/scheduled/rrule.py:32 _UTC = ZoneInfo("UTC")
omnigent/server/scheduled/scheduler.py:47 _UTC = ZoneInfo("UTC")
Both are pulled onto the core server boot path via server/app.py, so a
clean Windows install crashes during import on `omnigent server start`
before any port is bound:
File ".../omnigent/server/scheduled/rrule.py", line 32, in <module>
_UTC = ZoneInfo("UTC")
File ".../zoneinfo/_common.py", line 24, in load_tzdata
raise ZoneInfoNotFoundError(f"No time zone found with key {key}")
zoneinfo._common.ZoneInfoNotFoundError: No time zone found with key UTC
The same gap affects user-supplied timezones at run time
(scheduler.py:93, routes/scheduled_tasks.py:164). POSIX platforms use the
system database and are unaffected, which is why the dependency is marked
rather than unconditional.
uv.lock regenerated with `uv lock` under WSL2 and normalized with
scripts/normalize_uv_lock_registry.py, per CONTRIBUTING.md's note that
native Windows is unsupported for development.
Verified: `uv tool install omnigent --with tzdata` starts the server
normally on Windows 11 / CPython 3.12.
Signed-off-by: Injun Lee <2006ijlee@gmail.com>
A prompt sent to a resuming claude-native session sometimes never reached the
Omnigent DB while still showing in Claude's TUI pane — no error, no warning.
`start_at_end=True` means "skip the prefix I just wrote" — it is set iff this
launch synthesized a resume transcript from committed Omnigent history (which
the DB already has, so forwarding it would duplicate the conversation). But it
was implemented as "skip whatever exists when I get around to looking", and
those are different things. Seeding requires `transcript_path` from Claude's
first hook, and `inject_user_message` waits on the same boot; the two are
unordered, so the paste routinely wins. Everything Claude wrote in that
window — the user's prompt included — then sat behind the cursor, skipped for
the session's lifetime.
The prefix length is already known before launch: all three synthesizing paths
(`_ensure_local_claude_resume_transcript` on cold resume, `_clone_claude_transcript`
for a same-host fork, the items-rebuild for a cross-family fork) return the path
they wrote. Measure it there and pass `start_at_offset` through instead of
relying on a later `stat`. The skip becomes exactly the prefix regardless of
when the forwarder is scheduled, so the race is removed rather than narrowed.
`start_at_end` stays for reattach, where nothing was synthesized and a live
end-offset is correct — the CLI attach path has no concurrent inject. The
offset is clamped to the transcript end so a truncated/replaced file cannot
leave the cursor past EOF, and a failed measurement falls back to the old
behaviour rather than to 0 (re-forwarding all history is the worse failure).
claude-native only: `supervise_forwarder` here is distinct from the same-named
codex function, and no other harness forwarder has `start_at_end`.
Co-authored-by: Isaac
* fix(acp): let a generic-ACP agent declare the env vars it authenticates with
A generic-ACP agent configured the documented way (an `acp.agents:` row, or
`omnigent setup` -> Custom ACP agent) was spawned with no provider credentials
and no way to be given any, so it started unauthenticated, stalled during the
handshake, and every turn failed.
The spawn env is deny-by-default with an empty prefix family: the executor
drives an arbitrary agent, so it cannot know which vendor family that agent
authenticates with, and guessing would re-widen the leak that filtering closed.
That part is right. The gap was the escape hatch: `env_passthrough` only existed
on a full agent spec's `os_env.sandbox`, which a user configuring an agent
through `acp.agents:` never authors. Measured against a realistic environment,
only HOME/PATH/TERM survived.
Keep deny-by-default and make the hatch reachable per agent:
acp:
agents:
- name: Grok Build
command: grok agent stdio
env_passthrough: [XAI_API_KEY]
Names only, never values: the variable is read from the host environment at
spawn, so no secret lands in config.yaml. A `NAME=value` entry is rejected
rather than accepted-and-ignored, since that mistake would write a plaintext
credential and still not reach the agent. Threaded through the existing
plumbing (AcpAgentEntry -> HARNESS_ACP_ENV_PASSTHROUGH -> AcpAgentConfig ->
_build_spawn_env), unioned with any spec-declared names, and also honored for a
spec-embedded one-shot agent.
Also stop the handshake timeout reporting itself as a blank failure.
`asyncio.TimeoutError` carries no message, so a caller reporting it by
`str(exc)` produced `inner executor error: ` with nothing to act on. `_rpc` now
raises a TimeoutError naming the agent, the stalled method and the deadline, at
the one place every handshake RPC routes through.
Before: `inner executor error: `
After: `inner executor error: ACP agent 'Grok Build' did not answer
session/new within 30s (command: 'grok agent stdio')`
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* fix(acp): keep the spawn-env canary working with the agent-declared allowlist
The canary drives the real `_build_spawn_env` on an executor built via
`object.__new__` carrying only the attributes the builder reads, so reading
`self._config` unconditionally raised AttributeError there. Read the agent
config defensively, matching the duck-typed style `declared_passthrough`
already uses for the spec chain.
Also extend the canary to the new field: a declared name is an allowlist, not a
bypass, so the declared variable arrives and every planted canary secret still
stays out.
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
---------
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
The bundle injector resolved its source directory by counting parents off
its own module file. When native terminal orchestration was extracted from
the runner app into its own subpackage, the module moved one level deeper
and the parent count came along unchanged, so the path resolved to a
directory that does not exist. The is_dir guard then returned on every
call, silently, injecting nothing into any bundle.
Nothing landed in the bundle's skills directory, so build-omnigent was
not discovered by Claude Code via --plugin-dir, not discovered by Codex
(whose skill-source resolution only returns the bundle root when that
directory exists), and never reached the user-invocable slash-command
menu. The MCP load_skill path was unaffected: it is served by a sibling
injector that did not move.
Anchor on the package root instead of a parent count, so relocating this
module cannot break the path again, and log the missing-source branch so
the next such regression is visible rather than silent.
Add regression coverage: nothing referenced this function before, which
is why the breakage shipped. The tests assert the observable outcome (the
skill lands, and the real Codex resolver finds it) rather than the path
expression. Verified they fail on the pre-fix code and pass after.
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* fix(cli): guard headless -p turns against a lost terminal SSE event
_query_sessions_once's first-turn chat.query(prompt) call had no
timeout, so a specific variant of the documented subscribe-after-post
race (see the surrounding comment on _persisted_turn_text) could hang
the CLI indefinitely: the runner completes and persists the turn
server-side, but the client's no-replay SSE subscription misses the
terminal response.completed event. Unlike the two already-handled
variants (an OmnigentError from a runner disconnect, or a clean return
with empty text), this one raises nothing and never returns — periodic
session.heartbeat events keep the stream's async iterator busy
indefinitely, so the loop just waits forever for a terminal event that
will never arrive.
Wrap the first-turn query in asyncio.wait_for using the same
_PER_TURN_TIMEOUT_S race-window guard already applied to the
multi-turn synthesis loop later in this function, and on timeout fall
through to the same _persisted_turn_text reconciliation already used
for the other two variants of this race.
Root-caused by manually replaying the codex app-server JSON-RPC
protocol (confirming the protocol and CodexExecutor are both correct),
then instrumenting the runner scaffold and server SSE route to show
the runner always yields a correct terminal event and the session
always reaches "idle" server-side, even on client hangs.
* fix(cli): make the headless first-turn guard status-aware
The wait_for guard alone cannot tell a lost terminal event from a
healthy turn that simply outlasts it. The server persists assistant
items incrementally, so reconciling straight away returns a mid-turn
fragment as the final answer (silent truncation) for any first turn
longer than the guard window, and raises for one with no output yet.
On timeout, keep waiting while the session still reports the turn in
flight, mirroring the extra-turns loop's refresh-and-continue, and
reconcile against the durable transcript only once the session is no
longer running. Hoist the shared timeout constants to module level so
tests can patch them, and cover the lost-event, no-output, and
slow-turn paths.
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
---------
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
Co-authored-by: Dhruv Gupta <dhruv.gupta@databricks.com>
A runner stop or disconnect empties the terminal list; landing while the
terminal view was open stranded the user on 'No terminals available.' with
the Terminal toggle greyed out. Flip terminal-first sessions back to chat on
that edge, where the composer can resume the session. Edge-triggered and
guarded on terminalStartingUp so a cold boot or relaunch isn't yanked.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
test_build_startup_header_creds_line_hints_first_available asserts the openai
surface with no default falls back to a configured Databricks workspace. On a
dev machine running a local Ollama, ambient detection (a hardcoded
localhost:11434 TCP probe) injects an openai-serving provider that outranks
Databricks, so the creds line read "Codex → Ollama" and the test failed —
while CI (no Ollama) passed. Pin detect_providers to none so the test
exercises config-order fallback deterministically.
(cherry picked from commit 8b0d6eeb23d057c1657524f637bb3248c9d2483c)
Signed-off-by: apeltekci <andrew@peltekci.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
_session_snapshot deliberately refuses to cache an incomplete or failed
snapshot so spec resolution can retry until the agent binds. The workspace
projection cache defeated that: both _session_workspace_value and
_ensure_session_registered wrote snapshot.workspace unconditionally, so a
single transient non-200 pinned workspace=None for the session's lifetime.
_session_runtime_cwd then returned the global runner workspace instead of
the session's worktree, and the harness process manager bakes the
subprocess env at first spawn, so the session never recovered. Nothing
short of deleting the session cleared it: the reset-agent-cache path only
evicts _session_snapshot_cache, not the projections.
Guard both writes on snapshot.ok. created_at stays unconditional in
_ensure_session_registered because its wall-time fallback is documented
behavior there.
Signed-off-by: Enes Yilmaz <enesyilmaz5157@gmail.com>
* fix(web): keep a selected row's title clear of its "Needs response" tag
The tag is absolutely positioned, so the row's right padding is the only thing
holding the title clear of it. That reserve narrows to make room for the trailing
pin/kebab -- but it narrowed on `group-focus-within`, while the tag fades (and the
controls appear) on `group-has-[:focus-visible]`.
`focus-within` matches a plain mouse click; `:focus-visible` does not. Clicking a
row therefore cut the reserve from 116px to 56px with the tag still fully opaque
and the controls still hidden, sliding the title 59px underneath it. The tag
surface is translucent, so the collision reads as a washed-out opacity glitch
rather than the layout problem it is.
Key the reserve on `group-has-[:focus-visible]` so it narrows exactly when the
tag fades and the controls appear -- the three can no longer disagree about
whether that space is free. Measured on the selected row: +59.4px of overlap ->
-0.6px, with the idle row's title width byte-identical (120px at every interface
font size), so nothing truncates earlier than before.
Note this is the selected-state defect only. A row at interface font 15px+ still
overlaps in *every* state, including idle, because the 116px reserve is fixed
while the tag's width tracks the font size; that is a separate pre-existing bug
and is left alone here.
Covered two ways: a unit test pinning that the reserve and the tag's fade share
their triggers (the class-level contract), and a Playwright test measuring the
real painted glyphs against the tag's edge after a click (jsdom reports every box
as 0x0, so geometry needs a browser). Both were confirmed to fail with the
`focus-within` trigger restored.
Also repoints the Inbox count bubble from the shared amber `--warning` to
`--brand-accent`, matching the pink the tag and unread dot already use.
Signed-off-by: Edwin He <41037314+Edwinhe03@users.noreply.github.com>
Co-authored-by: Isaac
* test(ui-snapshot): update the populated-sidebar baseline for the pink Inbox badge
Regenerated in the digest-pinned Playwright image the gate renders in, so the
bytes match what CI compares against.
Only the populated-sidebar baseline drifts; the other four visual snapshots
render identically. The diff is a single 16x16px region at (288,118) -- the Inbox
count bubble, amber (218,164,71) -> brand pink (227,87,150). Nothing else in the
1280x800 frame changes, and the row-reserve fix contributes no pixel delta here
(the fixture's awaiting row is idle, whose geometry is unchanged).
Signed-off-by: Edwin He <41037314+Edwinhe03@users.noreply.github.com>
Co-authored-by: Isaac
---------
Signed-off-by: Edwin He <41037314+Edwinhe03@users.noreply.github.com>
* fix(cli): make no-AGENT `run --server ""` select local mode
`omnigent run --server ""` is documented as the way to "auto-spawn a
persistent local server ... instead of a remote one". It worked when an
AGENT was passed, but the bare no-AGENT form failed with:
Error: Agent path not found: https:
With no AGENT, `target is None`, so `_dispatch_run` takes the no-AGENT
direct-server branch. That branch gated on `server is not None` rather
than truthiness, so `""` reached `_resolve_server_url("")` and normalized
to the bare scheme `"https:"` — `_with_default_scheme("")` returns
`"https://"`, which the trailing-slash trim reduces to `"https:"`. That
string is not `_is_url`-shaped (no `//`), so it was passed as
`run_chat(target=...)` and died as a missing agent path. With an AGENT the
branch is skipped entirely and `""` flows to `_ensure_backend`, which
already reads it as local mode via a truthy `if server:`.
Treat an explicit empty `--server` as the local-mode request it is:
collapse it to the `None` sentinel `_ensure_backend` understands, and keep
the config fallback from putting a configured remote back in its place.
Both gates now test truthiness, and `_resolve_server_url` rejects an
empty/whitespace-only value outright rather than inventing a nonsense URL.
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
Co-authored-by: Isaac
* feat(cli): accept `--server local` as a readable local-mode alias
`--server ""` was the only way to say "ignore any configured remote and run
against a local server", which is hard to discover and easy to mistake for a
missing value. Accept the literal `local` as an alias for it.
`local` is already this codebase's name for the mode — `_LOCAL_DAEMON_MARKER`
is the marker local mode records in host.pid, where "real URLs never collide
with the marker". Neither spelling can be a genuine target: an empty value has
no host, and a bare `local` would normalize to the unroutable `https://local`.
Both spellings now route through one `_is_local_server_request` helper, matched
case-insensitively on the whole trimmed value — so `localhost:8000` and
`http://localhost:6767` keep their normal explicit-server behavior.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
---------
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* fix(web): remember the sidebar's session filter across reloads
The Sessions heading's filter menu ("All sessions" / "My sessions" /
"Shared sessions" / "Archived sessions") kept its pick only in React
state, so every reload snapped the list back to "All sessions" — a
viewer who works out of "My sessions" had to re-pick it after each
refresh.
Persist the pick to localStorage and seed the sidebar's state from it,
matching the other `*Preferences` helpers (and the sidebar's own
collapsed-section / expanded-project state). Writing it inside
`switchTab` keeps the documented single funnel for tab changes, so the
"New session" snap-back to "My sessions" is remembered too.
A stored value is validated on read: an unknown filter, or "shared" on
a loopback-only server where the menu drops that option, falls back to
"All sessions" rather than scoping the list to a slice the viewer has
no menu entry to leave.
Co-authored-by: Isaac
Signed-off-by: Edwin He <41037314+Edwinhe03@users.noreply.github.com>
* test(e2e): cover the sidebar session filter surviving a reload
The E2E UI Required gate asks for a tests/e2e_ui/** test whenever web/**
changes user-facing behavior; the filter-persistence fix shipped with
unit/component coverage only.
Adds three Playwright tests against a live server:
- "My sessions" still scopes the list after a full page reload, asserted
both by the shared row staying out and by the radio item reading
checked, so a list that happens to look right can't pass.
- The Shared filter round-trips too, proving the write isn't
special-cased to "mine" (it hangs off the single tab-change funnel).
- A stored "shared" is dropped on a loopback-only server, where the menu
omits that option — seeded via add_init_script so the value is in
storage before any app script runs, as a returning viewer's first
paint would see it.
The first two fail on a build without the seed (the filtered-out row
reappears after reload) and pass with it, so they pin the actual
regression rather than the current rendering.
Co-authored-by: Isaac
Signed-off-by: Edwin He <41037314+Edwinhe03@users.noreply.github.com>
---------
Signed-off-by: Edwin He <41037314+Edwinhe03@users.noreply.github.com>
The header switcher hid both destinations behind a dropdown: a
MessagesSquare + chevron trigger you had to open before you could see
which view you were in or switch to the other one. Reading the current
view took a hover (the tooltip), and switching took two clicks.
Replace it with a two-segment icon toggle in a shared track. Both
destinations are always on screen, the active one is filled, and
switching is a single click. Sits in the same header slot, immediately
left of Share, at the same 32px scale as the neighbouring controls
(size-6 segments in a p-0.5 track).
Behavior is unchanged: the same TerminalFirstContext drives it, it
self-gates for non-terminal-first sessions, the iOS shell (native
Liquid Glass bar), and rail-opened shell views, and Terminal stays
disabled — with a spinner while a PTY is coming up — until one is
reachable. Each segment carries aria-pressed and a tooltip naming it,
so the icon-only control stays legible to pointer and AT users alike;
the Terminal tooltip doubles as the "starting up" explanation.
Collapsing the menu drops the machinery it needed: the controlled
tooltip (two merged Slots on one node dropped its listeners), the
pointer-vs-keyboard close-refocus ref, and the e2e open-retry loop
that existed because a toggle-trigger click could net back to closed.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
A `claude-sdk` agent with `sandbox.type: linux_bwrap` died at every session
spawn with:
bwrap: Can't create file at /tmp/claude-<uid>/<proj>/<sess>/tasks/<id>.output:
No such file or directory
The dotfile / escaping-symlink masker emitted `--bind-try /dev/null <path>`
for every non-directory entry. bwrap resolves a mount destination *through*
a final symlink, so when the entry is a symlink both mask shapes abort the
whole namespace (`Can't create file at <link>` for the file shape,
`Can't mount tmpfs on <link>` for the dir shape) and the launcher exits
non-zero, surfacing as an opaque Claude SDK connect timeout.
The claude CLI links `tasks/<id>.output` into `~/.claude/projects/...`,
which escapes the safe-root set, so the walker flagged it and the emitter
produced a mount aimed at the link.
Skip symlink entries instead. This is safe because the mount namespace
already confines symlink resolution: the link is followed inside the sandbox
view, where an escaping target is either not mounted or independently
masked. Verified against bwrap: reads through a symlink to a masked dotfile
and into a masked dotdir both return empty with no mount on the link.
Not claude-sdk specific. The cwd pass always runs and `linux_bwrap` is the
Linux default, so any escaping symlink in an agent workspace hit this.
`darwin_seatbelt` shares the walker but emits path-based SBPL literals and
is unaffected.
The prepare-time degrade from #2749 could not catch this: `wrap_launcher_argv`
only builds argv and never executes bwrap, so a mount-time failure is
invisible to it.
Closes#3265
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
Every runner-spawned context lost the ssh-agent socket, so any agent doing
git-over-SSH or SSH-cert-authenticated tooling failed with "dial unix:
missing address" (often surfacing as a confusing 401 from the endpoint,
since such tools have no cached-token fallback).
Two independent gates dropped it:
- `_build_runner_env` filters the host env through `_RUNNER_ENV_ALLOWLIST`,
which omitted SSH_AUTH_SOCK. This is also the list both host-daemon modes
consult, so the one entry fixes the daemon hop too, including remote mode.
- `clean_agent_env` is the shared deny-by-default filter for every vendor
CLI, and its safe base omitted it. Fixing the shared base covers all
seven harnesses rather than only the one whose report surfaced this.
Classified as a path, not a bearer secret: it names a unix socket, and
reaching the agent behind it still requires the user's own ssh-agent to be
running and holding the key. Same footing as KUBECONFIG, already allowlisted.
An ACTIVE OS sandbox deliberately keeps excluding it: that boundary exists
to confine the agent, and signing with the user's keys is what it confines.
`os_env.py` previously justified its exclusion by calling the variable "a
credential surface masquerading as a path", which contradicts the
classification above; that rationale is rewritten to rest on the sandbox
boundary instead, so the codebase states one position.
Downstream paths needed no change: `sys_os_shell` (sandbox inactive) and
`sys_terminal_launch` both mirror the parent env, so they inherit the fix.
Codex's `shell_environment_policy.inherit` was reported as a third gate
requiring omnigent to force `inherit="all"`. It does not reproduce: on
codex-cli 0.144.3 the default already passes SSH_AUTH_SOCK through
(identical 72-var env), and only an explicit `inherit="core"` drops it.
Forcing `all` would override that deliberate user choice, so no override
is added.
Co-authored-by: Isaac
* fix(cli): accept a copied conversation URL as a server, and stop the SPA mislabeling missing API routes
A conversation link copied from the browser (`<host>/c/<id>`) is what a user
naturally pastes when asked for their omnigent URL, and `omnigent login` stored
it verbatim as the default server. `/c/<id>` is a client-side SPA route, so
every later API call was addressed under it and matched no router. A bare
`omni` then crashed at session-create, on a machine the user never pointed at a
remote by hand.
Nothing caught the bad URL earlier because the web UI is mounted at `/` and
answers any unmatched GET with its HTML shell: `GET <base>/c/<id>/v1/me`
returns 200, so the login probe reads it as header-auth mode and persists it,
and `/health` passes too. The first request that needs a real route is the
session create.
That failure then reported `405 Method Not Allowed`, because StaticFiles serves
only GET/HEAD and raises 405 for anything else. The body is identical to
FastAPI's path-matched-wrong-method response, so the error reads as "this
endpoint exists, you used the wrong verb" and points at the server instead of
the URL.
- Trim the `/c/<id>` route in `_resolve_server_url`, the chokepoint every entry
point already normalizes through, so an existing stored link is repaired on
the next run rather than needing a hand-edited config.
- Answer 404, not 405, for anything reaching the SPA catch-all: nothing that
gets there exists, and a non-GET is never an SPA navigation.
- Report a failed session create as a ClickException naming the URL, which the
function's docstring already promised; the raw client error was reaching the
crash handler as a traceback.
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* fix(cli): address review notes on the conversation-URL trim
- Return the rstripped URL on the no-match path too, so both branches of
strip_conversation_path normalize a trailing slash identically.
- Reword the session-create guard's comment: it covers fork and resume
rejections as well, not only a wrong base URL.
- Pin the OPTIONS case in the catch-all test. No CORS middleware is
installed, so a preflight reaching the SPA mount was already a 405 no
browser could use; 404 is more accurate rather than a lost capability.
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
---------
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
A custom agent spec carrying executor.auth or a legacy profile routed fine in-process but was invisible to resolve_native_codex_launch, so the native TUI fell to the Codex login screen and timed out. Thread the spec through and resolve it with _resolve_provider_for_build, the same resolver the in-process harness uses; machine-level flows are unchanged when no spec credential is present.
Signed-off-by: Andrew Demczuk <andrew.demczuk@gmail.com>
* fix(web): stop a stalled POST from wedging every send in the tab
A send whose POST never settles (postEvent issues its fetch with no
timeout) never released its link on the module-level send chain, so every
later send — in any conversation — parked on it forever. The composer
queued messages with no error and no recovery short of a page reload, and
steer, which bypasses the queue gate, was silently swallowed too.
- Key the POST-ordering chain per conversation. Ordering only means
anything within a conversation, so one stalled send no longer delays
every other session in the tab.
- Bound the wait on the prior send. Past it the successor proceeds and
only ordering degrades, which beats a chain that can deadlock.
- Surface a send that fails alongside a streaming turn instead of rolling
its bubble back in silence, without touching that turn's lifecycle.
- Let the active conversation's queue drain off the server's own status
once a stranded latch outlives any plausible POST, the way
flushBackgroundQueues already does for every other conversation.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* test(e2e_ui): pin that a stalled send can't wedge another session
The E2E UI gate requires a Playwright test for web/** behavior changes. A
send whose POST never settles held the tab-wide POST-ordering chain, so
every later send in every conversation parked on it. This drives that
shape through the real UI: B's POST is held open, the user switches to A
via the sidebar (client-side nav, so the store survives), and A's send
must still reach the server.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
---------
Signed-off-by: dbczumar <corey.zumar@databricks.com>
Both floors were unsatisfiable by the CLI they gate, so
`harness_cli_installed` returned False for every shipping build. That makes
`harness_is_configured` false, and the host then refuses the launch frame
outright — kimi-native and hermes-native could not start a session on any
machine, reporting "not configured" however current the CLI was.
kimi: the harness drives Moonshot's `kimi-code` CLI — the `kimi` binary this
spec's own installer puts on PATH — whose releases are a 0.x series. The floor
was taken from the separately numbered `kimi-cli` project (1.x), so no
`kimi-code` build could ever satisfy `>=1.47.0`. Retarget it at the first
`kimi-code` release after the 2026-06-01 cutoff the sibling floors use: 0.7.0.
hermes: the floor assumed date-tagged releases, but Hermes reports a semver
version with the build date beside it (`Hermes Agent v0.19.1 (2026.7.30)`), so
the parser reads `0.19.1` — never `>=2026.06.05`. Use the functional
requirement the comment already documents: 0.17.0, where the parent_session_id
schema landed.
Adds a regression test per harness pinned to the CLIs' real `--version` output.
Signed-off-by: Andrew Peltekci <andrew@peltekci.com>
Forwarding a message to the runner never checked the HTTP status. httpx
only raises on transport errors, so a runner that answered with a 4xx/5xx
read as a started turn: the server published input.consumed — telling the
client the runner had the message — and the session settled idle, showing
a finished turn for work that never ran.
A rejection now publishes failed carrying the runner's own error/detail,
persisted as labels so the reason survives a reload instead of vanishing
with the SSE edge. The labels are written before the status edge is
published so a client that reloads on failed can't race a snapshot that
has no last_task_error yet.
The transport-failure path keeps publishing idle: the runner never
answered, so the turn may yet run. A rejection means the live runner
answered and took nothing, which is what makes idle wrong there. Neither
is strictly terminal — the user item stays persisted either way, so a
later reconnect can still replay it as a recovery turn; failed is the
honest state for the runner we have now, not a promise the message is
gone.
The status is checked directly rather than through raise_for_status so the
runner-client fakes that expose only status_code keep behaving as they do
in production.
Co-authored-by: Isaac
Signed-off-by: Pat Sukprasert <pattara.sk127@gmail.com>
* fix(web): insert dictated text at the caret, not the end of the draft
Voice dictation always appended to the bottom of the composer. A common
flow is to paste a block of context, click above it, and dictate the
instructions that should lead: those words landed under the pasted block
instead, and had to be cut and re-pasted by hand.
`useDictationInsert` built every update as `base + text`, so the caret was
never consulted. It now splices at the caret, padding with single spaces so
dictated words never fuse with the draft on either side (and skipping the
space before punctuation that hugs the previous word), then leaves the
caret after the inserted text so typing continues naturally.
The caret is read from the textarea at insert time rather than mirrored in
React state. The `select` event only fires for real range selections, so a
plain click that collapses the caret never reports one; `selectionStart` is
preserved on the element across blur, which also survives the mic button
taking focus. The composers only report that the field has been focused,
since an untouched draft's `selectionStart` of 0 is indistinguishable from
a caret placed at the start; until then text still appends, preserving the
previous behavior for restored drafts.
Consecutive utterances chain after the previous one rather than re-reading
the caret. A partial and its final can arrive in one React batch, where the
caret write (a layout effect) has not run yet and every insert would read
the same stale offset and interleave backwards.
The hook now takes the draft as a value instead of reading it inside a
setDraft updater. Transcripts arrive off a socket, where React defers the
updater, so any offset it computed would be written back too late for the
next partial and a streaming region would append instead of revise.
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* fix(web): track dictation ownership instead of inferring it from the draft
Addresses two defects found in review, both reproduced with a failing test
before fixing.
Requesting a caret on a no-op update stranded the request. The mic ends every
take with onInterim(""), which lands as an empty insert once the preceding
final has cleared the interim region. That produced a same-value setDraft,
which React can bail out of without committing, so the layout effect never ran
to clear the pending caret. Every later utterance then read the DOM caret as
stale and pinned itself to the tail, ignoring wherever the user had clicked:
the exact behavior this change set out to add. An insert that changes nothing
now returns before touching the caret bookkeeping.
Ownership was inferred by comparing the draft to the last string written, but
equality is not identity. Editing away and undoing back restores equality while
those characters now belong to the user, so a spent interim span could be
sliced back out of the middle of their text, breaking the invariant that
dictation never deletes text it didn't write. Ownership is now released as soon
as a draft arrives that this hook didn't write, and regained only by writing
again.
Also fixes spacing around delimiters: dictating just inside an opening bracket
left a stray space (`call( the arg)`), and quotes were treated as always
closing, so inserting before one fused the words (`say please"quoted"`). Quotes
are ambiguous enough that spacing them like any other character is the safer
default. The caret write now also restores scrollTop/scrollLeft when the
textarea is unfocused, since setting a selection there can scroll the element
to reveal it.
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* test(e2e_ui): cover dictation landing at the caret
The e2e_ui judge asks for Playwright coverage of user-visible web changes, and
caret-positioned dictation had only unit tests.
Extends the existing dictation e2e (same fake mic device and fake ASR engine)
with the reported flow: paste a block of context, click above it, dictate, and
assert the words lead the pasted block instead of trailing it. A second take
with the caret moved back to the top covers the caret being honored again
rather than the text chaining onto the previous utterance.
Verified the test bites: against the pre-fix append-to-end behavior it fails
with the transcript at the end of the draft.
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* fix(web): settle dictation ownership when an insert changes nothing
A final utterance whose spliced result is byte-identical to the partial already
on screen deleted the dictated word. The server routinely finalizes exactly what
it last streamed, so the splice is a no-op, and the early return that skips the
caret request was skipping the ownership update with it. The interim region
stayed pending, so the end-of-take clear lifted the finalized text back out:
"hello PASTED" became "PASTED", losing the word entirely.
The no-op path now settles ownership before returning (a final still pins, an
empty clear still releases) while continuing to skip the caret request, which
is the part that must not run: a same-value setDraft can bail out without
committing, leaving the request outstanding and pinning later inserts to the
tail.
Also documents that focusedRef is deliberately never reset on blur. Clicking the
mic blurs the composer, and the caret the user left there is still the one they
can see and mean.
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* chore: trigger UI preview build
The ui-preview workflow's label-gated jobs skipped on every "labeled" event
for this PR even though the label is applied and every documented gate passes
(not draft, MEMBER author, workflow active). Pushing an empty commit to fire a
"synchronize" event instead, whose payload carries the current label set.
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
---------
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* feat(policies): add tag push protection to GitHub policy
Add a `deny_tag_push` parameter (default `True`) to the GitHub
policy that blocks pushing tags to remotes via `git push --tags`,
`git push --follow-tags`, or explicit `refs/tags/` refspecs. Tags
are immutable references that downstream CI/CD and release tooling
depend on; an agent pushing a tag can trigger releases, deployments,
or break semver expectations.
Tag refspecs (`refs/tags/v1.0`) are also filtered out of the branch
set so they don't pollute `write_branches` checks.
The check fires before repo/branch gating so even a tag push to an
undeterminable remote alias is denied rather than surfaced as ASK.
Set `deny_tag_push=False` to let tag pushes through normal write
gating.
Signed-off-by: Yuan Tang <terrytangyuan@gmail.com>
* style(policies): join tag-push deny message onto one line for ruff format
Signed-off-by: Yuan Tang <terrytangyuan@gmail.com>
---------
Signed-off-by: Yuan Tang <terrytangyuan@gmail.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix(host): run session runners in the workspace, not the daemon's cwd
A host daemon started from a directory that later disappears (a temp
checkout, a removed worktree) passes that dead cwd to every runner it spawns.
Path.cwd() then raises FileNotFoundError inside the runner and native
sessions fail with "Native Pi terminal failed to start" — hit live while
verifying the pi-native gateway fix.
Spawn the runner with cwd=<session workspace>, which _build_runner_env
already documents as the runner's cwd and which is verified to exist just
above the spawn.
Signed-off-by: David O'Keeffe <david.okeeffe@databricks.com>
* chore: retrigger CI (flaky integration test)
Signed-off-by: David O'Keeffe <david.okeeffe@databricks.com>
* fix(host): require an explicit runner workspace on the zygote fork path
fork_runner defaulted workspace to os.getcwd() — the daemon's cwd, the
exact value the workspace fix exists to avoid. The forked child was
already strict (it raises when the request carries no cwd), so the
manager was the only lenient link: a call site that omitted the argument
silently resurrected the deleted-cwd crash instead of failing loudly.
Make the parameter required so both ends agree, and cover the zygote
fork path's cwd, which had no test — only the direct Popen path did.
---------
Signed-off-by: David O'Keeffe <david.okeeffe@databricks.com>
Co-authored-by: dbczumar <corey.zumar@databricks.com>
_inline_family_pi_provider returned on the first family carrying a base URL
and credential, never consulting the model. A gateway exposing both an
Anthropic and an OpenAI surface therefore served every model over
anthropic-messages, and a proxy that is not protocol-translating rejects
that — the turn hangs with no reply.
Order the families by the selected model instead: Claude ids prefer the
Anthropic family, everything else leads with OpenAI. The loop still falls
through to the other family, so a single-family translating proxy (LiteLLM
/anthropic passthrough serving GPT ids, or an OpenAI-compatible proxy
serving Claude) keeps working.
Co-authored-by: Isaac
Signed-off-by: Pat Sukprasert <pattara.sk127@gmail.com>
* fix(web): preserve chat and browser widths when toggling the sidebar
The center chat column could be squeezed below a usable width when the
left sidebar opened: the right rail's resize clamp only accounted for the
viewport (0.6 * innerWidth), ignoring the sidebar, so an open sidebar ate
into the chat instead of the rail.
Make the rail's ceiling sidebar-aware. The clamp now reserves the open
sidebar's live width plus the chat's 480px minimum and the 8px gap, with a
99vw nominal cap. The reserve is applied only at render time — the stored
preferred width is untouched — so opening the sidebar temporarily shrinks
the rail and collapsing it restores the user's chosen width. A manual drag
still writes a new preference; viewport/sidebar changes recompute against it.
Also tighten the drag lifecycle while here: the window mousemove/mouseup
listeners now mount only during an active drag (state-driven, no idle
handler), and moves are coalesced through a single requestAnimationFrame so
a burst of events yields at most one width update per frame.
Tests: unit coverage for the sidebar-aware clamp + preference restore in
useResizableInlinePanel.test.tsx, and a Playwright e2e that toggles the
sidebar and asserts the chat stays >= 480px while the rail springs back to
its prior width.
Co-authored-by: Isaac
Signed-off-by: Hubert Zub <hubert.zub@gmail.com>
* fix(web): preserve chat and browser widths when toggling the sidebar
The center chat column could be squeezed below a usable width when the
left sidebar opened: the right rail's resize clamp only accounted for the
viewport (0.6 * innerWidth), ignoring the sidebar, so an open sidebar ate
into the chat instead of the rail.
Make the rail's ceiling sidebar-aware. The clamp now reserves the open
sidebar's live width plus the chat's 480px minimum and the 8px gap, with a
99vw nominal cap. The reserve is applied only at render time — the stored
preferred width is untouched — so opening the sidebar temporarily shrinks
the rail and collapsing it restores the user's chosen width. A manual drag
still writes a new preference; viewport/sidebar changes recompute against it.
Two subtleties the first cut missed, both surfacing when both sidebars are
open and the window is then shrunk:
- The chat's 480px floor now outranks the panel's own 240px comfort
minimum. Previously `Math.max(minPx, ...)` pushed the rail back up to 240
once the chat-preserving ceiling dropped below it, squeezing the chat under
480. The panel now yields below its own minimum (to 0 if need be) so the
chat keeps its floor.
- A plain window resize that left the stored (no-reserve) width unchanged
never re-rendered, so the render-time reserve clamp went stale. A viewport
tick now forces the recompute on every resize.
Also tightened the drag lifecycle: the window mousemove/mouseup listeners
mount only during an active drag (no idle handler), and moves are coalesced
through a single requestAnimationFrame.
Tests: unit coverage for the sidebar-aware clamp, the chat-floor-wins shrink,
and preference restore in useResizableInlinePanel.test.tsx; a Playwright e2e
that toggles the sidebar and one that shrinks the viewport with the sidebar
open — both assert the chat stays >= 480px.
Co-authored-by: Isaac
Signed-off-by: Hubert Zub <hubert.zub@gmail.com>
* test(e2e-ui): regenerate visual baselines
---------
Signed-off-by: Hubert Zub <hubert.zub@gmail.com>
Co-authored-by: omnigent-ci[bot] <294685417+omnigent-ci[bot]@users.noreply.github.com>
Clicking a file in the viewer was slower than the payload warranted: the
workspace-file reads inline the whole file in a JSON `content` field, and no
gzip applied to them — GZipMiddleware was mounted only on the static web-ui
mount — so each click paid a full uncompressed file transfer.
Measured A/B against two deployments (one on main, one on this change), 8 reps
per fixture, interleaved: a 1 MB TypeScript file under the line cap goes
1,050,566 -> 14,827 bytes on the wire (70.9x) and 2256 ms -> 1270 ms; a
2000-line slice of a larger file 122,187 -> 587 bytes (208x) and 1582 ms ->
1080 ms. Level 4 reaches the same ratio as 9 on source text and JSON for about
half the CPU.
Implemented as an APIRoute subclass on a dedicated router holding just the
three read endpoints, so the route table stays the source of truth for what
compresses. A path-matching middleware would have to re-derive that from the
request path, duplicating the router's matching — and because a path says
nothing about the method, it would also wrap the PUT/PATCH/DELETE handlers
that share these URLs. Starlette rejects a mismatched method before it reaches
the route's app, so a route class only ever sees the methods its route
declares.
Binary reads opt out of compression, because base64 of already-compressed
media gains ~1.3x for real event-loop time (385 ms at the 10 MiB binary cap).
The handler makes that call via `skip_gzip(request)`, which sets a flag on
`request.state`; the route class reads it back at send time. Deciding in the
handler keeps domain knowledge where the payload already is — the response is
`application/json` for every file, so the transport layer cannot tell binary
from text without re-parsing the body, and doing so brought its own failure
modes (a length-bounded prefix scan, and a dependency on field ordering).
Response body, headers, status, and OpenAPI are unaffected.
Also declines `Range` requests, since a 206's Content-Range describes the
unencoded representation, and negotiates `Accept-Encoding` properly: tokens
are case-insensitive and `q=0` means the client declined (RFC 9110 §12.5.3),
which a substring test would miss.
Small files are unchanged: a ~1040 ms fixed per-request cost dominates them,
and that is untouched here.
Test Plan:
- tests/server/routes/test_session_resources.py: 14 new cases driving the real
routes through the real router — text read gzipped and byte-intact, binary
read skipped, a deeply nested binary path still skipped, text whose content
contains `"encoding":"base64"` still gzipped, directory listing and diff
gzipped, identity honored, 10 parametrized Accept-Encoding negotiations,
PUT/PATCH/DELETE on the read paths left uncompressed, and siblings
(changes/search/shell) untouched
- 138 passed in that file; 168 across it plus the app, REST, and
hosts-filesystem integration suites
- full tests/server + tests/runner: 33 failed / 4905 passed, with a byte-
identical failure set at the parent commit (33 failed / 4884 passed), so no
regressions
- verified at raw ASGI on the real route: absent Accept-Encoding, gzip, GZIP,
gzip;q=0, and Range each behave correctly
- OpenAPI unchanged: the read paths still document all four methods, and the
internal diff route stays out of the schema
Co-authored-by: Isaac
Signed-off-by: Daniel Lok <daniel.lok@databricks.com>
* fix(pi-native): route uncataloged models by family instead of the Anthropic surface
pi-native builds its primary Pi provider on the Databricks gateway's
Claude-only /ai-gateway/anthropic surface and splits non-Claude families
across the Responses, serving-endpoints and MLflow surfaces using the live
Unity Catalog model-services list. That split only holds while the fetch
succeeds — it is best-effort by design, so an expired token, a network blip
or a workspace that lists nothing all yield empty lists. to_models_config
then registered the selected model on the primary regardless, so a
non-Claude model went to the Anthropic surface and the gateway answered
"API type 'anthropic/v1/messages' is not supported by ...". The turn never
finished and the user saw no reply and no reason.
Keep the live catalog authoritative and fall back to classifying the model
by family when it did not list one. The classifier moves next to the other
Pi compatibility fallbacks and mirrors pi_executor's _pi_provider_for_model,
so both Pi paths route a given id to the same surface. A model whose surface
this credential cannot reach, or that Pi cannot parse on any wire, is left
unregistered so Pi fails fast rather than hanging — and that refusal is
surfaced to the session as an error banner via the path an unresolvable
credential already uses, since a log line the user never sees reads as
another silent hang.
Carrying the reachable surfaces on the config also distinguishes the
gateway's Claude-only primary from a LiteLLM-style proxy, which speaks
anthropic-messages for arbitrary models and must keep self-registering.
Co-authored-by: Isaac
Signed-off-by: Pat Sukprasert <pattara.sk127@gmail.com>
* fix(pi-native): render the models config once per launch
The launch both writes models.json and reads it back to resolve --provider,
so rendering twice logged how an uncataloged model was routed twice. Thread
the rendered config through write_pi_models_config instead.
Also drop the overclaim that the surface classifier mirrors pi_executor's
_pi_provider_for_model: for a keyword model (GLM, kimi) carrying no wire
metadata the two disagree, because this follows the catalog builder's split
and sends those to Responses. Name the disagreement rather than imply
parity. Align the two membership checks on entry.get("id").
Co-authored-by: Isaac
Signed-off-by: Pat Sukprasert <pattara.sk127@gmail.com>
* fix(pi-native): keep databricks-* aliases off the Responses surface
Probing a live workspace showed the keyword surface split only holds for
system.ai.* ids: the gateway serves Responses passthrough for
system.ai.glm-5-2 but answers "Responses API passthrough is not supported
for model databricks-glm-5-2" for the alias of the same model. The
fallback classifier applied the keywords to both, so an uncataloged GLM,
kimi, or qwen3 alias was routed to a surface that 400s.
Restrict the keyword check to system.ai.* ids and let aliases fall to
chat completions, which the workspace accepts for all of them.
Co-authored-by: Isaac
Signed-off-by: Pat Sukprasert <pattara.sk127@gmail.com>
---------
Signed-off-by: Pat Sukprasert <pattara.sk127@gmail.com>
`omni host status` printed server URLs and daemon log paths as bare text,
so terminals had to guess where each link started and ended. On a narrow
terminal the URL was middle-truncated for display with no separate click
target, and the log path had no width budget at all so it wrapped
mid-path — leaving the terminal to detect a "URL" spanning several lines
of the status block.
Emit OSC 8 hyperlinks instead: the visible text stays shortened to fit,
while the click target carries the full, untruncated URL (or a file://
URI for the log) and exact bounds. Also budget the log line so no line
fills the terminal width.
Closes#3861
Signed-off-by: Randy 🌞 <randypitcherii@gmail.com>
* fix(server): honor OMNIGENT_LOCAL_SINGLE_USER on non-loopback binds
A non-loopback bind auto-enabled accounts mode without checking whether
the operator had already declared a single-user server. Accounts mode
resolves identity via the session cookie, so neither the reserved
"local" fallback nor the X-Forwarded-Email header is reachable — every
request 401s and the host tunnel 403s, taking every agent down rather
than prompting for login.
A truthy OMNIGENT_LOCAL_SINGLE_USER now keeps header mode and warns that
the server serves unauthenticated requests on an exposed interface. Only
truthy counts, so LOCAL_SINGLE_USER=0 remains an opt-out, and an explicit
AUTH_ENABLED=1 still wins.
Co-authored-by: Isaac
Signed-off-by: Pat Sukprasert <pattara.sk127@gmail.com>
* test(e2e): close mock-LLM race in the no-AGENT harness round-trip
Harnesses registering a background session-title generator (codex among
them) issue an extra model call that races the user turn for the same
keyed mock queue. The test queued a single marker for every harness but
claude-sdk, so whichever call landed first consumed it and the other got
the queue default "Mock LLM response" — the turn never rendered the
marker and pexpect EOFd.
Serve the marker as a non-resettable fallback so every call on the key
answers with it, making the assertion independent of call ordering and
count. Adds set_fallback_mock_llm, mirroring the e2e_ui conftest helper.
Co-authored-by: Isaac
Signed-off-by: Pat Sukprasert <pattara.sk127@gmail.com>
* fix(cli): scope the single-user exposure warning to header mode
The non-loopback single-user warning fired whenever a truthy
OMNIGENT_LOCAL_SINGLE_USER met a non-loopback bind without an explicit
OMNIGENT_AUTH_ENABLED, without asking which auth source actually
resolved. An explicit OMNIGENT_AUTH_PROVIDER=accounts (or oidc) beside
the marker wins outright in resolve_auth_source(), so identity goes
through the cookie path and login really is required — yet the warning
still told the operator the server would serve unauthenticated requests
as the "local" user.
Gate on resolve_auth_source() == "header" instead. That is the only mode
where the "local" fallback is reachable, so it is the only mode with
something to warn about. It also fixes the mirror case the old
condition suppressed: AUTH_ENABLED=0 is "set" but falsy, resolving to
header mode, so that exposure is real and now gets announced.
Reported by the automated review on #4224.
Signed-off-by: Pat Sukprasert <pattara.sk127@gmail.com>
* feat(server): warn about exposed single-user mode on container startup
The unauthenticated-single-user warning only existed in the CLI bind
path, where it prints to stderr. Operators who set the marker through a
systemd unit or container env never see that -- stderr is buried in a
platform log viewer.
Worse, the container paths never ran the CLI helper at all. The Docker
entrypoint sets OMNIGENT_LOCAL_SINGLE_USER=1 for its documented
AUTH_ENABLED=0 kill-switch posture and binds 0.0.0.0, which resolves to
header mode with the "local" fallback live -- so a container started
with OMNIGENT_AUTH_ENABLED=0 served unauthenticated requests as "local"
with no warning whatsoever.
Move the gating into warn_if_single_user_exposed() in the auth module,
which owns the policy, and have each path choose how to surface it:
Click stderr for the CLI, logger.warning for the Docker and Databricks
entrypoints. Adds bind_host_is_loopback(), replacing the CLI's inline
literal tuple, so any 127.0.0.0/8 address counts and an unresolvable
host errs toward "reachable" -- over-warning is the safe direction for a
security notice.
Behavior for the CLI is unchanged (its 31 cases still pass); the
container paths gain the warning they never had.
Signed-off-by: Pat Sukprasert <pattara.sk127@gmail.com>
---------
Signed-off-by: Pat Sukprasert <pattara.sk127@gmail.com>
Policy evaluation sits on the PreToolUse critical path — the hook blocks on
the verdict — and spent most of its time re-reading the same rows.
build_policy_engine fetched the conversation about four times (root
resolution, labels, session state, model override) and walked the spawn tree
twice, because the session-wide gating seed and the per-node subtree seed
each called load_session_usage, which does its own conversation read plus a
full paged tree scan.
One conversation read and one tree scan now feed everything. Both usage seeds
derive from that list through a pure aggregation, so they stay semantically
distinct: cost gating remains tree-wide, so a sub-agent gates against the
whole session's spend, while the subtree total remains the per-node display
figure. A caller that already holds the row can pass it and skip the read.
A row the caller supplies is a HINT, not a fact. It names a tree, and loading
that tree verifies the claim: if the conversation is not in it, the root is
resolved again. Everything downstream — the rows, the root id, the policies
attached to that root, the accounting sums — comes from the tree that
verification produced. Deriving the root from the caller's row while taking
rows from a corrected tree mixes two epochs, and a conversation deleted and
recreated under a different root then seeded the old tree's spend.
Mutable state is likewise re-derived rather than trusted: labels, session
state, model override and agent binding all come from the verified tree,
whoever read the row first, because a caller's preload and this function's own
read are equally stale by the time a decision is made. A row absent from the
tree is confirmed with one re-read and then fails closed. A tree that needed
more than one page cannot vouch for its own rows — page one was read before
page two — so identity is confirmed once in that case, which single-page trees
never pay for.
Also here, because it is the same tree: the ancestor cost re-publish used to
do a conversation read plus a full tree scan PER ancestor, and derived the
chain from a row read earlier in the request. It now walks the verified tree,
so the whole fan-out costs one load and cannot publish to a chain that has
since changed. A chain that cannot be walked to the root yields nothing
rather than a prefix, since the caller publishes to every id returned.
The tree also stopped excluding archived conversations. Archiving is a listing
concern; the tree is an accounting structure. Excluding them let an archived
root — or an archived mid-tree node, which orphaned its descendants from the
walk — seed the enforcement total as $0 and allow a tool call over budget.
Archived spend consequently appears in displayed totals too, which is the
intended reading: the badge should agree with the gate.
Measured on both dialects: 30 queries per build to 6, or 3 when the caller
supplies the row. The whole authenticated route, by (tree size, whether the
caller supplies the row): 11 on a one-page tree when supplied, 14 when not;
17 on a 101-node tree when supplied, 20 when not. The tree load pages, so
cost is not independent of tree size, and the extra 3 on a paged tree over
the one-page count are the paging confirmation above, a full conversation
read — consistent at both tree sizes and both supplied/not-supplied. Counted
as SQL statements rather than store calls, because a store-call count cannot
see a helper that issues three statements per call. The route-level oracle
below covers only the one-page shape; the 101-node figures are measured, not
pinned by a test yet.
Every oracle here is paired with the mutation that kills it, including the two
that pin this round's fixes: deriving the root from the pre-refresh row fails
the recreated-child test, and skipping the paged-tree confirmation fails the
switch-during-paging test.
Signed-off-by: Andrew Reid <andrew@reid.ee>
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
Co-authored-by: Andrew Reid <andrew@reid.ee>
flush() and close() queue a marker carrying a Future and then await it, but
only the delta worker resolves those futures, from inside its loop. At
asyncio.run teardown the worker and the caller are cancelled in one pass, so
the marker is queued with nobody left to complete it and close() parks
forever. The runner never exits, which is also why the clean exit the
idle-resume work assumes is not always reached.
Race each marker against the worker itself, bounded, since a worker that has
stopped will never resolve it and the cancellation order between the worker
and its caller is arbitrary. Only reap a worker that actually finished;
awaiting a wedged one reintroduced the unbounded wait. Guard the two
resolvers so a marker settled elsewhere cannot kill the worker with
InvalidStateError, which _ensure_worker would never restart.
Closes#2748
Signed-off-by: Enes Yilmaz <enesyilmaz5157@gmail.com>
* examples: fix the commented web_search snippet in deep-research
The Google Programmable Search snippet in examples/deep-research/config.yaml
was missing search_provider, which _search() requires and has no default for,
so uncommenting the block verbatim returns "web_search error: no
search_provider configured" instead of searching. The Perplexity and Nimble
snippets below it already name theirs.
Also drop the hardcoded "bundled catalog default is claude-opus-4-8" claim:
the default is resolved at runtime by default_chat_model() from the configured
provider's catalog (newest model of the preferred tier), so naming one model
goes stale as the catalog moves.
Comments only, no behaviour change.
Signed-off-by: Ilya Bogin <ilya.bogin@keenable.ai>
* examples: drop the undocumented search mode from the deep-research skill
The skill told the model to pass `realtime` to `search_web_pages` when latency
matters, but `realtime` is not part of Keenable's documented public tool
surface: `mode: pro` is the documented default. Leaving the hint in means the
agent can send a mode that is not covered by the public API contract.
Signed-off-by: Ilya Bogin <ilya.bogin@keenable.ai>
---------
Signed-off-by: Ilya Bogin <ilya.bogin@keenable.ai>
* fix(opencode-native): re-seed dedupe on every SSE reconnect to close gap (#1778)
The opencode-native forwarder only called seed_dedupe_from_history() once
at startup. After an SSE reconnect the dedupe set was not refreshed, so
content produced during the disconnect window was never delivered (the
live stream re-emitted it as duplicate events that the stale dedupe set
silently dropped).
Fix: move seed_dedupe_from_history() inside the reconnect loop so it is
called on every attempt (initial connect and each reconnect). The
existing deduplication in OpenCodeForwarderState.mark() is idempotent:
keys seen before the drop are re-marked on reconnect and will not be
re-posted; new keys introduced during the gap are not yet in the set, so
those events are forwarded exactly once.
Also removed the dead update_last_event_id() call from handle_event.
The SSE Last-Event-ID resume header was never honoured by opencode's
server, so this call was dead code that imported an unused symbol and
created a misleading bridge write on every event.
Tests added in tests/test_opencode_forwarder_reconnect.py:
- seed_dedupe_from_history is called on initial connect
- seed is called on every reconnect attempt (not just the first)
- content seeded before a reconnect is not re-posted after reconnect
- update_last_event_id is no longer present in the module
* fix(opencode-native): replay history on SSE reconnect
* fix(opencode-native): add missing Any import and narrow info type in catch_up_from_history
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
---------
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
Co-authored-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix(web): fork fresh from project default base branch instead of reusing last worktree
When a project configures a default base branch (Project settings), a fresh
new-chat should fork a new branch off that default — not silently continue in
the user's last-used worktree.
The composer auto-seeds the working directory from the most-recent workspace.
When that path is an existing linked worktree, the branch field prefilled from
it, which flipped shouldCreateWorktree to false and made the base-branch
seeding effect early-return — so the project's default base branch was never
applied. This was a gap in the new default-base-branch feature, not a
regression of prior behavior (the last-used-worktree landing predates it).
Now, when a project default base branch is set, the once-per-host auto-seed
probes the recent path's repo; if it's a linked worktree, it redirects the seed
to the repo's main work tree and auto-generates a worktree-<uuid> branch so the
new-worktree flow (and base-branch fill) engages. Deliberate picks, sandboxes,
non-git paths, and projects with no default are unaffected.
The fork-fresh decision is resolved to a stable memoized value so the seed
effect depends on the decision, not the churning worktree-list array identity —
avoiding an intermediate re-fire that would let the auto-seed win the race
against the project-config workspace prefill.
Adds unit coverage (both the redirect and the no-default passthrough) and an
e2e_ui case asserting the create forks off the default at the main repo.
Co-authored-by: Isaac
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
* fix(web): gate fork-fresh branch generation on actual seed + empty branch
Address review findings on the fork-fresh seed effect:
- B1: generateBranchName() and the worktreeSeededForRef write fired on
didForkFresh alone, even when setWorkspace was a no-op because the field
already held a config-supplied workspace. A project that sets both a
workspace and a default base branch (with a linked-worktree recent path)
would be turned into an unexpected worktree fork. Gate the fork-fresh
side-effects on the workspace actually being seeded (cur === "").
- B2: no empty-branch guard meant a branch typed/picked during the probe's
async load window got clobbered when the probe resolved. Add the same
branchName === "" && prefilledBranch === "" guard the sibling
opt-in-worktree effect enforces.
- Store worktreeSeededForRef in the raw (un-normalized) representation the
opt-in-worktree effect compares against (workspaceTrimmed), so a
trailing-slash difference can't let it fire a second branch generation.
Adds a unit test for the B1 config-workspace passthrough (plain launch, no
fork).
Co-authored-by: Isaac
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
* fix(web): fall back to seeding the candidate when the worktree probe errors
Address the blocking review finding: the fork-fresh seed was gated on the
forkFreshMainPath memo, which returned undefined whenever the worktree probe's
data was undefined. useHostWorktrees maps a 400 (non-git path) to [], but any
other non-OK response throws — leaving React Query's data undefined for good.
That left forkFreshMainPath stuck at undefined, the seed effect early-returning
forever, and the working directory unseeded indefinitely for default-base-branch
projects on a transient 5xx (previously the seed was unconditional).
Treat a probe error (isError) as "no redirect" (null) so the seed still lands
on the candidate as-is, mirroring the hook's deliberate 400 → [] tolerance.
Adds a unit test asserting the recent workspace is still seeded when the probe
errors (verified it fails on the pre-fix code — the chip stays blank).
Co-authored-by: Isaac
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
---------
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
## Related issue
Closes OMNI-2524 — https://linear.app/omnigent/issue/OMNI-2524
## Summary
- In local mode `omnigent host --background` (#4317) already starts the local
server *and* registers this machine as a host, so it is effectively the "turn
Omnigent on" command — but finding it means knowing the `host` concept and a
flag. `omnigent start` is that command under the name people look for, and is
symmetric with the existing `omnigent stop`.
- It is a full alias, not a second implementation: same `--server` /
`--non-interactive` options, the same CLI → config → local target resolution
(`_resolve_host_server`), delegating to the same `_run_background_host()`.
`host --background` keeps working for scripts that want the host lifecycle by
name (`host status` / `host stop`).
Registered in `_CLICK_SUBCOMMANDS` too: `main()` consults that allowlist
before handing argv to click, so a top-level command missing from it can be
misread as the removed ad-hoc chat (enforced by
`test_click_subcommands_allowlist_covers_registered_commands`).
- The stop hint each entry point echoes is now passed in, so `start` suggests
`omnigent stop` while `host --background` keeps mirroring its own invocation.
```
$ omnigent start
Started the host daemon in the background (pid 52359).
server: http://127.0.0.1:6767
log: ~/.omnigent/logs/host/host-20260806-212352-515540.log
Stop it with:
omnigent stop
```
## Test Plan
- `uv run --extra dev pytest tests/host/test_cli_host.py -q` → 23 passed.
- Manually: `omnigent start` printed the block above in ~4s; `omnigent host
status` showed `mode=local process=online host=online`; a second `omnigent
start` reported `already running (pid 52359)` with no second spawn; and
`omnigent stop` reported `Stopped 1 daemon(s) and the background server`,
after which `host status` and `server status` were both clear.
- `omnigent --help` lists `start` next to `stop`; `omnigent start --help`
documents the alias and both options.
## Demo
N/A — CLI-only change; the new output is quoted above.
## Type of change
- [ ] Bug fix
- [x] Feature
- [ ] UI / frontend change
- [ ] Refactor / chore
- [ ] Docs
- [ ] Test / CI
- [ ] Breaking change
## Test coverage
- [x] Unit tests added / updated
- [ ] Integration tests added / updated
- [ ] E2E tests added / updated
- [x] Manual verification completed
- [ ] Existing tests cover this change
- [ ] Not applicable
## Coverage notes
Two new tests in `tests/host/test_cli_host.py` cover `start` spawning the same
detached local-mode daemon (with the local server URL reported, the foreground
loop skipped, and `omnigent stop` — not `host stop` — suggested), and
`start --server <url> --non-interactive` passing the target through to both the
sign-in pre-flight and the daemon argv. The daemon spawn and local-server
discovery are stubbed, so no process or log file is created; the detached
daemon itself was covered by the manual run above.
## Changelog
`omnigent start` starts the local server and registers this machine as a host —
the on switch to go with `omnigent stop`.
Signed-off-by: Zeyi (Rice) Fan <zeyi.f@databricks.com>
* revert(sessions): remove delegated approval authority (#3446)
Reverts the delegated approval feature from #3446, returning to
owner-only approval (the deny-by-default behavior from #3416). Owners
can no longer delegate a "can_approve" capability to shared editors;
approvals are again restricted to the session owner, while editors keep
reject/cancel.
The change is a faithful inverse of #3446 rebased on current main:
files untouched since #3446 revert byte-identical to their pre-feature
state; files later commits also modified keep those newer changes and
drop only the approval lines.
Migration handled non-destructively for deployed databases:
- The original additive migration (c4d5e6f7a8b9) is kept intact so
already-migrated databases still resolve their history.
- A new forward migration (f7a8b9c0d1e2) drops the session_permissions
.can_approve column; its downgrade re-adds it.
Also removes a dangling import of _approval_access_from_grants in
sessions/__init__.py left by the later wildcard-import refactor (#3934),
which otherwise broke server import after the helper was reverted.
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
* revert(sessions): remove shared-message attribution (#3422)
Reverts the model-visible shared-message authorship feature from #3422.
Messages no longer gain `[author]:` prefixes in the model prompt, the
SHARED_SESSION_AUTHORSHIP_INSTRUCTION framework instruction is removed,
and the OMNIGENT_SHARED_MESSAGE_ATTRIBUTION_ENABLED switch is gone.
Persisted `created_by` authorship (a store-level column predating #3422)
is unaffected.
Rebased on current main, keeping later independent work in the same
regions:
- Smart Routing's conditional `model_override` on the native-terminal
forward path is preserved.
- The `host_store` parameter added to the event-forward path is kept.
- The two `test_external_interrupt_*` tests from #4160 (which overlap
#3422's added block in test_sessions_endpoints.py) are kept; only
#3422's `test_external_user_message_strips_model_author_prefix` is
removed.
Also removes dangling imports of `_strip_pending_author_prefix` in
orchestration.py and sessions/__init__.py left after the helper's
definition was reverted.
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
* revert(sessions): restore editor approval authority (#3416)
Reverts the owner-only approval restriction from #3416. Approval events
and URL-based elicitation resolution are gated at LEVEL_EDIT again, so
shared editors — not only the owner — can resolve approvals.
SECURITY REGRESSION (intentional, per request): #3416 was a security
fix. Shared-session tools execute with the session owner's runner
identity and ambient credentials, so a shared editor can once more
authorize owner-credentialed tool calls. This, together with the #3422
and #3446 reverts, fully unwinds the #2150 stack and re-opens #2150.
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
---------
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
## Related issue
N/A
## Summary
- Bumps the iOS app's marketing version (`CFBundleShortVersionString`) from
`0.1.0` to `0.1.1` ahead of cutting a TestFlight build, so the release is not
published under the same user-facing version as the previous one.
- Only the **Omnigent** app target's Debug and Release configurations change, as
`web/ios/RELEASE.md` prescribes. The `.tests` / `.uitests` bundle versions are
left at `0.1.0`; they are never shipped, and Android's equivalent bump (#4309)
likewise touched only the app's version.
- The build number is deliberately untouched: it is computed per upload as
`latest_testflight_build_number + 1` and injected by fastlane at archive time,
so it must not be bumped by hand.
## Test Plan
- `xcodebuild build -project Omnigent.xcodeproj -scheme Omnigent -destination 'platform=iOS Simulator,name=iPhone 17,OS=26.5'`
succeeds, and the built app's `Info.plist` reports the new version:
`plutil -extract CFBundleShortVersionString raw .../Omnigent.app/Info.plist` → `0.1.1`.
- `plutil -lint web/ios/Omnigent.xcodeproj/project.pbxproj` passes, confirming the
hand-edited project file is still well-formed.
- Verified the two changed entries belong to the `ai.omnigent.ios` target (Debug
and Release) and that no other target's version moved.
## Demo
N/A — no user-visible interface change; only the reported version string.
## Type of change
- [ ] Bug fix
- [ ] Feature
- [ ] UI / frontend change
- [x] Refactor / chore
- [ ] Docs
- [ ] Test / CI
- [ ] Breaking change
## Test coverage
- [ ] Unit tests added / updated
- [ ] Integration tests added / updated
- [ ] E2E tests added / updated
- [x] Manual verification completed
- [x] Existing tests cover this change
- [ ] Not applicable
## Coverage notes
A version string has no behaviour to unit test. Verified by building the app and
reading `CFBundleShortVersionString` back out of the built `Info.plist`, plus a
`plutil -lint` on the edited project file to catch a malformed hand edit. The
existing iOS suites continue to cover app behaviour.
Signed-off-by: Zeyi (Rice) Fan <zeyi.f@databricks.com>
## Related issue
N/A
## Summary
- Someone opening Omnigent on a managed device has to know and type their
organization's server URL. This lets an administrator preset that list, so the
connect screen offers the org's servers under a "Provided by your organization"
heading and in the server switcher.
- Preset servers are **offered, not enforced**: nothing connects automatically,
the user can still type any URL, and preset entries are never written to the
saved-server list — so withdrawing the configuration withdraws them from the
app, and they never consume the 5-entry recents cap and evict a server the user
chose. `SettingsStore` is untouched, which makes that a structural guarantee
rather than a rule to remember.
- Two delivery channels, one decoder: a `com.apple.configuration.app.managed`
declaration read via the `ManagedApp` framework (preferred — validation errors
are reported back to the admin console and the device event log), and the
classic `com.apple.configuration.managed` defaults key (works on any MDM, no
error reporting). Declarative wins when both are present.
- Validation lives in `init(from:)` so a bad value becomes actionable admin
feedback instead of a server that silently never appears. Four documented error
codes; `https` only, because release builds keep App Transport Security
defaults and an `http://` preset could not load anyway.
- `web/ios/docs/managed-app-configuration.md` is the published specification
(keys, error codes, sample payload) — Apple's guidance is to host this where
administrators can reach it, so it is a standalone doc.
- Raises `IPHONEOS_DEPLOYMENT_TARGET` to 26.0, which the `ManagedApp` framework
(iOS 18.4+) no longer needs to be gated behind.
```
declaration (com.apple.configuration.app.managed / AppConfig) ─┐
├─► OmnigentManagedConfiguration
defaults key (com.apple.configuration.managed) ────────────────┘ (validate, https, dedupe, cap 10)
│
ManagedServers.resolve(declarative:legacy:)│ declarative wins
▼
ConnectView "Provided by your organization" + ServerSwitcher
(merged at read time; never persisted)
```
Two incidental fixes the change forced:
- `ConnectView`'s server rows only hit-tested the URL's glyphs, so a tap on the
empty part of the pill did nothing. This was pre-existing on the recents rows;
found by the new UI test, fixed with `.contentShape`.
- The iOS 26 floor surfaced a deprecation warning for
`NSURLErrorFailingURLStringErrorKey`; the redundant fallback was removed (the
caller already falls back to the web view's own URL).
## Test Plan
`xcodebuild test -project Omnigent.xcodeproj -scheme Omnigent -destination 'platform=iOS Simulator,name=iPhone 17,OS=26.5'`
- 65 unit tests pass (+7 for the classic channel and precedence). The decoder is
covered by decoding property lists directly — the exact shape the framework
hands `init(from:)` — so no device management is involved: absent key, empty
list, blank entry, invalid URL, `http://`, non-web scheme, over the cap, a bare
string instead of a list, duplicate origins, order preservation, and that our
error codes stay out of the system-reserved range.
- `ManagedServersUITests` drives the whole flow in the simulator through a
DEBUG-only `--omnigent-managed-servers` launch argument: preset servers appear
under their own heading, the app does not auto-connect, and tapping a row loads
it.
- Verified the classic channel end-to-end on a simulator with no launch argument,
pushing the same key an MDM writes:
`xcrun simctl spawn booted defaults write ai.omnigent.ios com.apple.configuration.managed '{ serverUrls = ("https://omnigent.corp.example.com", "https://my-workspace.cloud.databricks.com/ml/omnigents"); }'`
- Verified a mid-session configuration change: rewriting the key and returning to
the app replaces the list. This caught a real bug —
`UserDefaults.didChangeNotification` does not fire for an out-of-process write,
which is exactly how a configuration arrives, so the re-read is anchored to
`didBecomeActive` (plus a `synchronize()` to drop the stale in-process cache).
- `RedirectConsentUITests` and the deep-link UI tests still pass.
`OmnigentUITests.testLocalServerSnapshot` fails, but identically on a stashed
clean tree — it needs a live dev server.
- `pre-commit run` clean on all changed files.
Not covered: delivery of a real declaration, and the error codes reaching an
admin console. Nothing can deliver a declaration to a simulator, so that needs a
device enrolled in an MDM with declarative app configuration support.
## Demo
Preset servers on the connect screen, delivered through the classic channel with
no launch argument (`defaults write` of `com.apple.configuration.managed`), and
after an administrator changed the configuration mid-session:
| Two servers preset | Administrator changed it, user returned |
| --- | --- |
|  |  |
## Type of change
- [ ] Bug fix
- [ ] Feature
- [x] UI / frontend change
- [ ] Refactor / chore
- [ ] Docs
- [ ] Test / CI
- [ ] Breaking change
## Test coverage
- [x] Unit tests added / updated
- [ ] Integration tests added / updated
- [x] E2E tests added / updated
- [x] Manual verification completed
- [x] Existing tests cover this change
- [ ] Not applicable
## Coverage notes
Manual verification covered what automation cannot reach. The DEBUG launch
argument the UI test uses bypasses configuration delivery, so both channels were
exercised by hand on a simulator: the classic key was pushed with `defaults
write` (the same key an MDM writes, hitting the real decoder, validation, merge
and UI), then rewritten mid-session to confirm the app picks up an administrator's
change. Declarative delivery and admin-facing error reporting remain unverified —
they require an enrolled device, and no simulator can receive a declaration.
## Changelog
Administrators can preset the iOS app's server URLs with a managed app configuration, so managed users pick their organization's server instead of typing it
Signed-off-by: Zeyi (Rice) Fan <zeyi.f@databricks.com>
* fix(policies): thread resolved sandbox spec into claude-native bridge tools
force_sandbox/enforce_sandbox correctly resolves a policy-forced sandbox
onto a session's os_env.sandbox (runner/app.py's
_apply_sandbox_override_from_verdict), and that decision reaches the
claude-native terminal process itself. It never reached the bridge's own
sys_os_shell/sys_os_read/sys_os_write/sys_os_edit tools, though: those are
registered with the Claude Code subprocess via --mcp-config and backed by
an OSEnvironment that claude_native_bridge.py's _build_tools() built with
a hardcoded OSEnvSandboxSpec(type="none"), because prepare_bridge_dir()
never wrote a sandbox field into the bridge's on-disk config in the first
place. A server operator configuring force_sandbox for claude-native
sessions got silent, unenforced host access from the agent's own tool
calls despite the policy evaluating successfully.
prepare_bridge_dir() now accepts the resolved sandbox spec and persists
it; _build_tools() reads it back and falls through to the prior
unsandboxed default when absent, so paths with nothing to carry (e.g. the
omnigent claude CLI's own synthesized wrapper spec) are unaffected. The
orchestration.py call site threads the same agent_os_env used for the
terminal process's own sandbox, so both surfaces agree.
Signed-off-by: Kaushik Kumaran <kumarankaushik@gmail.com>
* fix(policies): stop credential_proxy from corrupting the bridge sandbox round-trip
Polly's automated review on PR #3910 found a real bug in the fix: dataclasses.asdict
flattens OSEnvSandboxSpec.credential_proxy (a nested CredentialProxySpec) to a plain
dict, and OSEnvSandboxSpec(**payload) on read has no way to tell that dict apart from
a real one, so it gets assigned straight through. Any sandboxed code that later
dereferences .entries / .databricks on it crashes with AttributeError, exactly in the
configuration this PR exists to support (a real sandbox backend plus a credential
proxy). Verified this empirically before and after the fix.
credential_proxy is resolved parent-side only and was never meant to cross this kind
of boundary in the first place - SandboxPolicy.to_jsonable already excludes it for the
same reason, since it can carry a credential source (an env var name or a shell
command) that has no business landing in a file on disk. This drops it from the
bridge config the same way, rather than inventing a new serialization path, and adds
a test that proves it's dropped cleanly rather than corrupted.
Signed-off-by: Kaushik Kumaran <kumarankaushik@gmail.com>
* test(policies): make sandbox round-trip tests platform-independent
CI caught what my local macOS run couldn't: both new tests hardcoded
darwin_seatbelt, which only resolves on macOS, so they failed on Linux CI
runners with OSError: darwin_seatbelt sandbox is only available on macOS.
Patches create_os_environment at the boundary instead, the same pattern
tests/inner/test_codex_harness.py already uses for this exact class of
problem (test_executor_factory_decodes_os_env_json patches CodexExecutor.__init__
rather than resolving a real backend). Asserting on the captured OSEnvSpec
proves the config plumbing is correct without depending on which OS the
test happens to run on.
Signed-off-by: Kaushik Kumaran <kumarankaushik@gmail.com>
* fix(policies): satisfy pyrefly's dict invariance check on the sandbox payload
pre-commit's pyrefly hook failed in CI (never ran locally before, since pyrefly
wasn't actually installed in the local dev venv despite being in the dev extra):
dict[str, X] is invariant in its value type, so dataclasses.asdict()'s inferred
return type isn't assignable to a dict[str, object] annotation even though every
member of that union is an object. dict[str, Any] is the correct annotation here,
matching how Any bypasses variance checks for exactly this kind of "whatever
asdict() gives me" case.
Signed-off-by: Kaushik Kumaran <kumarankaushik@gmail.com>
---------
Signed-off-by: Kaushik Kumaran <kumarankaushik@gmail.com>
## Related issue
Closes OMNI-2516 — https://linear.app/omnigent/issue/OMNI-2516
## Summary
- `omnigent host` only ever ran in the foreground, so registering a machine as
a host cost a dedicated terminal — even though the detached daemon it needs
already exists and is what `run` / `claude` / `codex` spawn via
`_ensure_host_daemon()`. `--background` exposes that path directly: spawn (or
adopt) the daemon, report it, and return.
- Sign-in stays interactive. A detached daemon has no terminal to run the
browser login on, so `_ensure_databricks_server_auth()` runs in the
foreground *before* the spawn; otherwise the daemon dies in the background
with an opaque "redirected to a login page" error. `--non-interactive` still
fails with the `omnigent login` hint instead of prompting.
- In local mode the daemon also owns the local Omnigent server, so the command
waits for that server and reports its URL — otherwise the Web UI is
unreachable without a follow-up `omnigent server status`. That makes
`omnigent host --background` the whole "start everything" step, which is now
the README quickstart (it replaces the `server --background` + `host` pair).
- A daemon that dies on startup (bad URL, missing credentials) leaves nothing
on the terminal, so the command waits a 2s grace and surfaces the daemon log
rather than falsely reporting success.
Output is a colorized headline plus aligned detail rows, with the stop command
on its own line so it can be copied:
```
Started the host daemon in the background (pid 74241).
server: https://dbc-…/api/2.0/omnigent
log: ~/.omnigent/logs/host/host-20260806-205308-765542.log
Stop it with:
omnigent host stop --server https://dbc-…/api/2.0/omnigent
```
That stop command mirrors the invocation: `host` and `host stop` resolve their
target identically (the `--server` value, else config, else local), so the flag
is echoed only when the user named a target — a bare `host --background` prints
a bare `omnigent host stop`. Colorizing reuses the existing `NO_COLOR`-aware
helper, renamed `_help_style` → `_cli_style` now that it is not help-only.
## Test Plan
- `uv run --extra dev pytest tests/host/test_cli_host.py -q` → 21 passed.
- Manually, local mode: `omnigent host --background` reported
`server: http://127.0.0.1:6767` and a bare `omnigent host stop` (no
`--server` typed, none echoed), which then stopped it.
- Manually, remote mode: `omnigent host --background --server https://dbc-…`
printed the block quoted above; `omnigent host status` showed
`process=online host=online`; re-running reported `already running (pid …)`
with no second spawn; and the echoed `host stop --server …` stopped it.
## Demo
N/A — CLI-only change; the new output is quoted above.
## Type of change
- [ ] Bug fix
- [x] Feature
- [ ] UI / frontend change
- [ ] Refactor / chore
- [ ] Docs
- [ ] Test / CI
- [ ] Breaking change
## Test coverage
- [x] Unit tests added / updated
- [ ] Integration tests added / updated
- [ ] E2E tests added / updated
- [x] Manual verification completed
- [ ] Existing tests cover this change
- [ ] Not applicable
## Coverage notes
Four new tests in `tests/host/test_cli_host.py` cover the spawn output
(including the local server URL and a flagless stop hint), that the foreground
daemon loop and in-process local-server bring-up are skipped, reuse of a
healthy daemon via an explicit `--server ""` (whose stop hint keeps the flag),
and that sign-in runs before the spawn. The daemon spawn and local-server
discovery are stubbed, so no process or log file is created. Manual
verification covered both modes end to end; the exits-immediately grace path is
covered by tests only.
## Changelog
`omnigent host --background` starts the local server and registers this machine
as a host without tying up a terminal.
Signed-off-by: Zeyi (Rice) Fan <zeyi.f@databricks.com>
## Related issue
N/A — no tracking issue.
## Summary
- Managed users had to type a server URL by hand on first launch, with no way
for IT to hand it to them. The Android shell now publishes an [Android managed
configuration](https://developer.android.com/work/managed-configurations), so
any EMM (Intune, Jamf, Workspace ONE, Google Workspace, Android Management
API) can preconfigure the server URLs an org uses.
- One restriction key, `serverUrls`: a comma- or newline-separated list, most
preferred first. `ManagedConfig` parses it (defaults a missing scheme to
`https://`, drops unparseable entries, collapses same-origin duplicates, caps
at 8) and `ServerStore.offeredServers()` puts the presets ahead of the user's
recent servers in the one existing list — on the connect screen and in the
server switcher.
- Presets are offers, not policy enforcement: the app never auto-connects and
never skips the connect screen, the user can still type any other server, and
a preset is never written to prefs so an admin's later edit is picked up on the
next read.
Android offers no plain string-array restriction type, hence the delimited
string: `multi-select` needs the app's own schema to enumerate every possible
host (they are customer-specific), and `bundle_array` renders poorly or not at
all in several EMM consoles.
```
EMM console ──push──> RestrictionsManager ──> ManagedConfig.serverUrls
│
ServerStore.offeredServers() ──┤ presets first
│ then recents (origin-deduped)
ConnectActivity list ◀─────────┴─────▶ server switcher menu
```
## Test Plan
- `cd web/android && ./gradlew :app:testDebugUnitTest` — 50 tests, 49 pass. The
one failure, `MainActivityTest > configuration change updates system bar icon
polarity`, is pre-existing: verified failing identically at `HEAD` in a clean
worktree without these changes. Not touched here.
- `./gradlew :app:assembleDebug` — confirmed the `APP_RESTRICTIONS` meta-data
lands in the merged manifest and `res/xml/app_restrictions.xml` is packaged in
the APK.
- On a wiped API 35 emulator with Test DPC 9.0.12 as device owner: Test DPC →
Managed configurations → Omnigent → **Load manifest restrictions** renders our
schema and produces the `serverUrls` key, confirming the manifest wiring
against a real DPC. Setting a value and relaunching shows the preset as a
tappable row on the connect screen, and the app does not auto-connect.
## Demo
Visible change is additive: preset URLs appear as tappable rows in the existing
server list on the connect screen and in the host-pill switcher menu. Unmanaged
installs are pixel-identical to before — no new views or strings on that screen.
## Type of change
- [ ] Bug fix
- [x] Feature
- [x] UI / frontend change
- [ ] Refactor / chore
- [ ] Docs
- [ ] Test / CI
- [ ] Breaking change
## Test coverage
- [x] Unit tests added / updated
- [ ] Integration tests added / updated
- [ ] E2E tests added / updated
- [x] Manual verification completed
- [ ] Existing tests cover this change
- [ ] Not applicable
## Coverage notes
`ManagedConfigTest` covers the parse layer (absent bundle, missing key, blank
value, mixed delimiters, scheme defaulting, dropped bad entries, origin dedupe,
the cap, and origin-based `includes`). `ServerStoreTest` covers precedence: a
preset is offered but never becomes current, several presets are all offered,
connecting is what makes one current, and presets lead the offered list while
covering same-origin recents. `MainActivityTest` asserts a preset never
overrides the server the user picked.
Manual verification was needed for the parts no unit test can reach: that a real
DPC renders our restriction schema, and that the key name matches what an EMM
pushes. Done on an emulator with Test DPC as device owner, as described above.
## Changelog
Organizations can preconfigure Omnigent server URLs through Android managed
configuration, and they show up ready to tap in the app's server list.
Signed-off-by: Zeyi (Rice) Fan <zeyi.f@databricks.com>
The duplicate-check comment asked reporters to close their own issue and
add details to the match, but never looked at whether the match was still
open. On #4245 it pointed at #1977 — closed as completed a month earlier
— so both asks were wrong: a shipped fix means a regression or an old
build, and details added to a closed issue go nowhere.
This is the common case, not an edge case. The corpus is deliberately
`--state all` so old reports stay discoverable, and 65% of top-ranked
candidates over the last 40 issues are already-fixed issues.
Comments now branch on the reference's own state:
- open — unchanged; the reporter can still move their report there.
- closed as completed — leads with the shipped fix and asks whether they
are on a build that includes it, keeping the issue open as a regression
if it still reproduces.
- closed as not planned (or `wontfix`) — points at the reasoning with no
self-close ask, since there is no live discussion to move into.
`stateReason` is plumbed through the corpus fetch and candidate
normalization; a missing disposition falls back to the open wording,
which asks rather than asserts. Mixed sets name each group separately so
a declined issue is never described as fixed.
Co-authored-by: Isaac
Signed-off-by: Pat Sukprasert <pattara.sk127@gmail.com>
* fix(runner): suppress KeyboardInterrupt traceback on zygote Ctrl+C
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fixup! fix(runner): suppress KeyboardInterrupt traceback on zygote Ctrl+C
Add explanatory comment to the except block.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fixup! fix(runner): suppress KeyboardInterrupt traceback on zygote Ctrl+C
Use contextlib.suppress per SIM105.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
---------
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix(host): keep the tunnel receive loop responsive during readiness refresh
The host->server tunnel disconnected with `4003 ping timeout`: the periodic
harness-readiness refresh ran inline on the receive loop and could block it for
~60s — two 30s CLI probe subprocesses (`--version` and `auth status`) hanging on
a wedged harness CLI. While blocked, the host never answered the server's
application-level pings, so the server watchdog declared the host dead and
closed the tunnel.
Fix A (host/connect.py): move the readiness refresh into its own task,
`_harness_readiness_loop`, so the receive loop only ever reads frames and
answers pings — a slow probe can no longer stall the keepalive.
Fix B (harness_install.py, harness_readiness.py, codex_native.py): bound
readiness CLI probes to READINESS_CLI_PROBE_TIMEOUT_S (10s, matching goose's
status-probe budget) instead of 30s, so a hung harness CLI fails fast on the
refresh, the startup hello, and Ctrl-C. Setup and launch gating keep the lenient
30s default via behavior-preserving timeout parameters.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* test: accept the readiness probe timeout kwarg in harness CLI stubs
Readiness now calls harness_cli_installed / harness_cli_logged_in with a timeout= kwarg (READINESS_CLI_PROBE_TIMEOUT_S); update the monkeypatch stubs in the affected suites to accept it so they exercise the same paths.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* test(host): cover off-loop readiness refresh and bounded CLI probe
Fix A moved the harness-readiness refresh off the tunnel receive loop into
_harness_readiness_loop. Rewrite the three live-host readiness tests to drive
that loop directly: the old versions drove _serve_frames with a fake tunnel
that blocks on recv, which under the pure recv loop never exits and hangs to
the pytest timeout. Add a harness_install test asserting the readiness caller
shortens the CLI probe subprocess timeout while setup/launch keep the 30s
default.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(server): show "Starting up…" for SDK sessions, not "Connecting…"
Creating a polly/debby session in the web UI showed a small "Connecting…"
wheel *below the composer* instead of the "Starting up…" spinner that
claude-code and codex sessions render in the conversation.
Both indicators key off `isTerminalFirst`
(`labels["omnigent.ui"] === "terminal"`). Native wrappers stamp that
label at creation, but a non-native session's runner stamps it in
`_auto_create_repl_terminal` only *after* the REPL terminal exists —
which is exactly when `terminalStartingUp` goes false. The window where
the label is present and the spinner condition still holds was therefore
empty by construction, so these sessions always fell through to the
passive "Connecting…" band.
Stamp the label at session creation for the same set whose runner
auto-creates the REPL terminal. The predicate mirrors the runner's own
gate (non-native harness, top-level session); the caller adds
`host_id is not None` so an in-process, runner-less session never shows a
Terminal pill it cannot open, and `harness_override == "auto"` is
excluded because the first-message router has not picked a harness yet.
No web changes: these sessions were already terminal-first once the
runner's later stamp landed, so this only moves the transition earlier.
Setting the label also enables the eager `terminal_pending` publish,
giving continuous spinner coverage; the runner's `finally` clears it,
with the `session.resource.created` self-heal as backstop.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
---------
Signed-off-by: dbczumar <corey.zumar@databricks.com>
The landing composer awaited the create POST — session bootstrap plus a
runner launch, so seconds of it — and then navigated unconditionally.
That closure outlives the composer's unmount, so a create that landed
after the user had opened another session yanked them into the new one,
tearing them out of the session they had deliberately gone to.
Gate the post-create navigation on the composer still being on screen.
The session is created either way and its first message stays held, so
opening it later still dispatches the prompt.
Flipping the "this draft is spent" flag on the response was too late for
the same reason: the unmount cleanup now runs while the create is still
in flight, so returning to the landing screen mid-create handed back the
message that had already been sent. Flip it at submit instead, and hand
the draft back when a create fails or is rejected — otherwise a failed
send would eat the user's message.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(web): even out spacing between collapsed "Worked for" rows
A turn that yields mid-task (dispatching sub-agents, then awaiting them)
folds its whole trace behind the "Worked for" row and carries no answer
of its own. The bubble's copy/fork row is gated on collectBubbleMarkdown,
which counts every text item -- including narration sealed inside the
fold -- so such a bubble grew a 28px action row plus 12px of margins
whenever its HIDDEN trace happened to narrate. Consecutive collapsed
rows then sat 16px or 56px apart with nothing on screen to explain it.
Skip the actions on a bubble that renders nothing but the collapsed row;
bubbles with a visible answer keep them, under the answer. The fold
predicate moves into a shared pure isFoldEligible/rendersOnlyWorkedFold
so the bubble asks the renderer's own question instead of restating it.
Those rows also lost their trailing hairline: MessageContent is w-fit, so
a bubble holding only the summary row shrank to ~110px, collapsing the
rule's flex-1 span to zero and cutting the click target short. Give them
w-full at the existing max-w-3xl cap -- not the full-column width isWide
grants, which on >=1921px screens would push these rules wider than
answered turns' and misalign them.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* chore: retrigger CI
Workflow runs for this PR were dropped by the GitHub Actions incident
(webhooks throttled to ~15%); an empty commit re-fires the triggers.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* test(web): pin the settled status the fold-only cases depend on
The fold-only assertions turn on `possiblyLive` being false, which they
were getting from the store's default `sessionStatus` rather than saying
so. Set it explicitly in the fixture, and note on
`rendersOnlyWorkedFold` that it answers from shape and liveness alone —
so across the renderer's settle window the two decisions may differ for
a beat, which costs nothing on a bubble with no answer to anchor.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
---------
Signed-off-by: dbczumar <corey.zumar@databricks.com>
## Related issue
N/A — chore, no issue required.
## Summary
- Bumps the Android shell's `versionName` from `0.1.0` to `0.1.1`.
- `versionCode` is intentionally untouched: it is supplied per release by CI
(`android-bundle.yml` passes `-PversionCode=<input>`, documented as "must be
higher than the last uploaded to Play; starts at 3"). The `?: 2` in
`build.gradle.kts` is only a local-build fallback, so changing it would have
no effect on what ships to Play.
## Test Plan
- `./gradlew :app:processDebugMainManifest` and inspected the merged manifest:
```
app/build/intermediates/merged_manifest/debug/processDebugMainManifest/AndroidManifest.xml
android:versionCode="2"
android:versionName="0.1.1"
```
- `pre-commit run --files web/android/app/build.gradle.kts` — passes.
## Demo
N/A — no visual change.
## Type of change
- [ ] Bug fix
- [ ] Feature
- [ ] UI / frontend change
- [x] Refactor / chore
- [ ] Docs
- [ ] Test / CI
- [ ] Breaking change
## Test coverage
- [ ] Unit tests added / updated
- [ ] Integration tests added / updated
- [ ] E2E tests added / updated
- [x] Manual verification completed
- [ ] Existing tests cover this change
- [x] Not applicable
## Coverage notes
A version-string constant has no behaviour to unit test. Verified by building
the merged manifest and confirming `android:versionName="0.1.1"` is what the
build actually emits, rather than only reading back the source line.
Signed-off-by: Zeyi (Rice) Fan <zeyi.f@databricks.com>
* fix(chat): create fresh sessions by agent_id on a remote-URL target
Connecting to a remote server with `omnigent chat <url>` could discover
the server's registered agents but never start a conversation with one.
Both entry points assumed a local agent bundle was available to upload:
- Interactive chat raised "Sessions API fresh session creation requires
a local agent bundle" from the REPL adapter, before any network call.
- Headless `-p` fell through to the legacy `/v1/responses` endpoint,
which the server no longer exposes, so the turn failed on a bare
"Not Found".
A remote target has no bundle to upload by definition: the agent is
already registered server-side. The server has long accepted a JSON
`{"agent_id": ...}` body on POST /v1/sessions (the route the web UI's
new-chat flow uses), so the client just needs to use it.
Add `sessions.create_from_agent_id()` and `sessions.resolve_agent_id()`
to the Python SDK, then take that path in both places when no bundle is
present. The headless fix goes in the shared `_query_sessions_once` so
the no-bundle case is handled once, for every caller, rather than in a
second branch per entry point; that also retires the dead legacy
fallback and its now-unused event imports.
An unknown agent name now fails with a LookupError naming the agent and
listing what is registered, instead of a confusing session-create error.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* fix(chat): narrow bundle type, paginate agent lookup, keep /model pick
Addresses the pyrefly failure and Polly's review notes.
The flat if/elif chain in _ensure_session left self._session_bundle
typed as `bytes | None` at the multipart create call, which pyrefly
rejected. Split the two create paths into their own methods so each
one narrows what it needs, leaving _ensure_session as create-or-resume.
resolve_agent_id now follows the /v1/agents cursor, so an agent past
the first page resolves instead of raising a spurious LookupError.
The docstring also notes that the route lists only server-registered
agents, so a session-scoped agent is not resolvable by name.
A `/model` typed before the first turn was applied only on the bundle
path. Hoist that PATCH into one helper both create paths call, so the
pick is no longer silently dropped on a remote-URL session.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* fix(chat): route the third one-shot caller through the sessions API
Found while manually QAing this branch: `omnigent run --server <url> -p`
still failed with `Not Found`. That path goes through `_run_one_shot`,
a third caller I had missed — it gated on `session_bundle is not None`
the same way and otherwise fell back to the legacy client query.
Drop the gate so it uses `_query_sessions_once` like the other two
callers, which already picks the create route from whether a bundle
was supplied. Add an E2E guard that fails with the same `Not Found`
without this change.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* fix(chat): adopt an online server runner for remote-URL sessions
Review caught that the new tests injected a runner_id the real
remote-URL entry points never supply. Both `run_chat` and `run_prompt`
pass runner_id=None for a URL target, and I confirmed against a live
server that this still failed on the first turn: headless raised before
the new create path ran, and interactive created the session but then
failed the runner-binding precondition.
A URL target gets no host daemon (`--host` is a documented no-op there),
so the client has no runner of its own. But the server does: GET
/v1/runners lists the online runners owned by the requesting user along
with the harnesses each advertises, already ownership-scoped. Resolve the
agent's harness from GET /v1/agents and adopt a runner that advertises
it, so a fresh remote session can dispatch.
Both entry points now complete a real turn with runner_id=None. When the
server genuinely has no online runner, the error points at
`omnigent host --server <url>` rather than the --server flag the user
already passed.
Tests now pass runner_id=None to mirror production wiring, plus guards
for the no-runner error and for the JSON create route keeping its full
snapshot shape (create_from_agent_id parses it without a follow-up GET).
Also caps the agent-name list in the LookupError message.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* fix(chat): canonicalize harness names when adopting a server runner
Review flagged that runner adoption matched harness names raw while the
server canonicalizes first (`_runner_supports_harness`). Confirmed the
gap: with a runner advertising `claude-sdk`, an agent whose spec says
`claude` resolved to None and surfaced "no online runner" even though a
compatible runner was online. There are 17 such aliases.
Pass a canonicalizer into resolve_online_runner and compare both
spellings on both sides, matching server semantics. The SDK is a
standalone package and must not import from `omnigent`, so the callers
inject `canonicalize_harness` rather than the SDK reaching for it.
Also from review:
- Skip the GET /v1/agents round-trip when the agent id is already known
AND a runner is already bound (nothing needs the harness then).
- Drop `resolve_agent_id`: it had no callers after the switch to
`resolve_agent`, so it was dead public API rather than intended surface.
Adds a parametrized guard covering both alias directions; it fails
without the canonicalizer, which is the reported bug.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
---------
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* fix(antigravity-native): scope the CLI agy launch to a per-session gemini dir
The runner-owned (web) launch already pointed agy at an isolated
`--gemini_dir` and wrote the Omnigent MCP relay config there. The CLI launch
(`omnigent antigravity` -> `_launch_and_record`) did neither, so agy read the
user's real `~/.gemini`. Two consequences:
- No Omnigent relay in the config agy actually loads, so the wrapped agy had
no `sys_*` tools at all — the residual half of #1194 that the host-spawned
fix (#1216 / #1598) never covered.
- The survey/trust seeds rewrote the user's own
`~/.gemini/antigravity-cli/settings.json`, which is precisely the clobber
the isolated-dir design exists to prevent.
Mirror the runner path: `write_mcp_config` + `seed_isolated_agy_home` (trusting
the CLI cwd) and prepend `--gemini_dir=<isolated dir>` ahead of every generated
flag. `HOME` stays real, so agy's keyring-backed OAuth (macOS Keychain) still
unlocks — deliberately NOT relocating HOME, which is the regression #1598 undid.
Two related cleanups found while tracing this:
- `ensure_agy_onboarding_complete()` wrote the real `~/.gemini` on BOTH launch
paths for a marker agy no longer reads: `seed_isolated_agy_home` already
writes the identical file into the isolated dir, before launch. Dropped from
both callers, so nothing writes the user's tree any more. The function is
kept and marked `deprecated:: 0.9.0` (remove in 0.10.0) since it still has
dedicated tests.
- Added `google_accounts.json` to `_AGY_SEED_FILES`. It sits beside
`oauth_creds.json` on a signed-in Mac (confirmed on macOS 26.5.2); without it
agy can hold a valid token yet still prompt for account selection in a fresh
Gemini dir. This is the one-line seed #1477 asked for that never landed.
Also corrected three comments this falsifies, including one asserting macOS runs
agy under the real `~/.gemini` as "the #1477 Keychain trade-off" — no longer true
on either path.
Verified on macOS 26.5.2 (arm64) with `dev/verify_agy_gemini_dir.py` (added): it
drives the real launch path against a redirected fake HOME, so it needs no
server, runner, or real agy and is safe on a signed-in machine. 3 failures
pre-fix -> 0 post-fix. 144 agy unit tests pass; the new regression test fails on
unfixed code. Live `/mcp` confirmation still needs an `agy` install.
Part of #1477
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
Co-authored-by: Isaac
* fix(dev): drop hardcoded model id from the agy gemini-dir verifier
The `no-hardcoded-models` pre-commit hook excludes `tests/` but not `dev/`,
so the placeholder settings value tripped it and failed CI. The value only
has to be a user setting the launch must leave untouched, so an opaque
string works just as well.
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
---------
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* fix(server): stop a runner drop from failing finished sub-agents
Sub-agents ride their parent's runner, so a tunnel drop reaches every
child bound to it. `_on_runner_disconnect` marked all of them `failed`
regardless of whether they were mid-turn, and published the edge with no
`ErrorDetail` — so an Agents rail full of sub-agents that had completed
successfully went red, with nothing recording why.
The missing cause also made the state sticky: `_publish_runner_recovered_status`
only clears a failure it can identify as a disconnect, so the fan-out's
unlabelled `failed` survived a reconnect until the next `running` edge.
Only the per-session relay wrote the cause, and a session whose stream
already ended on `[DONE]` has no relay left to write it.
Both callbacks now go through `_mark_runner_sessions_offline`, which
skips sessions that were not mid-turn (cache first, the persisted
`live_status` as fallback), skips an intentional Stop/archive teardown,
and stamps the cause on the ones it does fail. `_on_runner_exited` passes
`fail_idle_top_level=True` so a runner that died before it could run
anything still surfaces on its top-level session; an idle sub-agent is
skipped either way, since its runner was already live.
No frontend change: `subagentStatus.ts` already renders a
`runner_disconnected` / `runner_failed_to_start` cause as a quiet
"Disconnected" rather than the red "Failed" — it was never given the data.
Addresses Gap 2 of #1113.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* test(server): cover the runner-disconnect fan-out end to end
The unit tests cover the reconciliation decision, but the wiring lives in
a `create_app` closure that cannot be imported. Drive a genuine WS close
on a dedicated runner with two sessions bound to it — one mid-turn, one
idle — and assert the idle one is untouched while the interrupted one is
failed with `runner_disconnected` labels.
Binds through the store rather than a PATCH so no relay spawns: the relay
reacts to the same close, which would leave it ambiguous which path
produced the labels.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* chore: retrigger CI
This PR was opened during a GitHub Actions dispatch outage (no
pull_request workflow runs were created repo-wide between 20:50Z and
22:41Z), so its opened / synchronize / ready_for_review events were all
dropped and no checks ever ran. Empty commit to fire a fresh
synchronize now that dispatch has recovered.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* chore: retrigger CI
Dispatch for `pull_request` workflows has been intermittent repo-wide;
this PR's earlier events landed in a dead window. Firing a fresh
synchronize while dispatch is confirmed working.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* test(server): cover the crash-report flag against interrupted and stopped turns
Two gaps in the reconciliation matrix: a mid-turn sub-agent under
`fail_idle_top_level` (a crash report must never downgrade an
interrupted turn), and an intentionally stopped session under the same
flag (the Stop/archive skip still wins).
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
---------
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(host): keep the tunnel receive loop responsive during readiness refresh
The host->server tunnel disconnected with `4003 ping timeout`: the periodic
harness-readiness refresh ran inline on the receive loop and could block it for
~60s — two 30s CLI probe subprocesses (`--version` and `auth status`) hanging on
a wedged harness CLI. While blocked, the host never answered the server's
application-level pings, so the server watchdog declared the host dead and
closed the tunnel.
Fix A (host/connect.py): move the readiness refresh into its own task,
`_harness_readiness_loop`, so the receive loop only ever reads frames and
answers pings — a slow probe can no longer stall the keepalive.
Fix B (harness_install.py, harness_readiness.py, codex_native.py): bound
readiness CLI probes to READINESS_CLI_PROBE_TIMEOUT_S (10s, matching goose's
status-probe budget) instead of 30s, so a hung harness CLI fails fast on the
refresh, the startup hello, and Ctrl-C. Setup and launch gating keep the lenient
30s default via behavior-preserving timeout parameters.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* test: accept the readiness probe timeout kwarg in harness CLI stubs
Readiness now calls harness_cli_installed / harness_cli_logged_in with a timeout= kwarg (READINESS_CLI_PROBE_TIMEOUT_S); update the monkeypatch stubs in the affected suites to accept it so they exercise the same paths.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* test(host): cover off-loop readiness refresh and bounded CLI probe
Fix A moved the harness-readiness refresh off the tunnel receive loop into
_harness_readiness_loop. Rewrite the three live-host readiness tests to drive
that loop directly: the old versions drove _serve_frames with a fake tunnel
that blocks on recv, which under the pure recv loop never exits and hangs to
the pytest timeout. Add a harness_install test asserting the readiness caller
shortens the CLI probe subprocess timeout while setup/launch keep the 30s
default.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(runner): name the runner log file in "see runner logs" errors
`omnigent codex` (and its siblings) surface the runner's message verbatim, so
a failed native terminal start read:
Codex terminal ensure failed (500): Native Codex terminal failed to start;
see runner logs for details.
which left the user hunting for a file whose name they could not know. The
runner already knows its own log path — the host passes it as
OMNIGENT_PROCESS_LOG_FILE when it spawns the subprocess — so name it:
... failed to start; see the runner log for details:
~/.omnigent/logs/runner/runner-<session>-<timestamp>.log
Same treatment for the generic runner detail string (_client_safe_error_detail,
~40 call sites: harness spawn, spec resolve, model change, compact, MCP
dispatch). The client-safe contract is unchanged: the raw cause still goes to
the log only, and the path is home-relative so it points somewhere without
leaking the account name.
process_logging grows current_process_log_path() / process_log_reference() to
publish the path, and display_log_path() is promoted out of host/connect.py
(it was private there) so both sides format paths the same way. The
daemon_launch "runner did not connect" message stops hardcoding
~/.omnigent/logs/runner/ and computes the real dir, so it is correct under
OMNIGENT_DATA_DIR.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* test(runner): pin the runner log path instead of trusting test order
The three tests asserting the new "see the runner log for details: <path>"
messages set OMNIGENT_PROCESS_LOG_FILE and expected the message to name it.
That holds only until some earlier test in the same xdist worker runs the real
configure_process_logging: test_runner_entry's
test_main_preserves_unexpected_runtime_errors calls main() without stubbing it,
which allocates ~/.omnigent/logs/runner/runner-<timestamp>.log and publishes
that path process-wide. The published path outranks the environment (it is what
the process actually logs to), so the assertions saw the leaked path and the
runner-app group failed in CI while passing when run alone.
Pin both sources in one place: a pinned_runner_log fixture in
tests/runner/conftest.py sets the published path and the env var, so the
assertions hold whatever else the worker ran first.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
---------
Signed-off-by: dbczumar <corey.zumar@databricks.com>
The rename's optimistic cache write reaches the row as a prop from the
sidebar list above it, which re-renders a tick after the row's own
`setIsEditing(false)`. For that one frame the row repainted the
pre-rename title as the inline editor closed.
Hold the committed title in the row until the prop carries it, or until
the PATCH settles so a failed rename rolls back to the old name.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(web): don't fetch history when opening a session
Opening a session kept loading older history for seconds after the page had
settled, shifting the transcript under a reader who had never scrolled. On a
real session that was 15 requests and a "Loading earlier messages…" row, for
someone who hadn't touched the scrollbar.
Two things drove it. bindStream rendered one 20-item page and HistoryAutoLoader
then paged from a layout effect until it found the previous user prompt. And
the scroll rule was "scrollTop is near the top", which the open satisfies by
itself: the pane scrolls to the bottom on load, and on a transcript shorter
than the fetch threshold that lands trivially near the top — so it fetched, the
prepend moved the cursor, and that fed the next fetch.
Fetch the window in one larger request at bind, and page only when the reader
asks. "Asks" is the gesture, not the movement: a pane shorter than the window
has no scroll range, so waiting for scrollTop to fall would strand older
history behind a scroll the pane can never report. A wheel-up or a downward
touch drag arms paging whether or not the pane has anywhere to go.
Also cap the trailing spacer at a third of the viewport, so a short latest turn
no longer reserves most of the screen as blank.
Measured on a real session, sitting still: 15 items requests -> 1, 13
transcript height steps -> 1, and the loading row never appears.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* test(ui-snapshot): update the turn-rail baseline for the capped spacer
Capping the trailing spacer at a third of the viewport means a short latest
turn no longer pushes everything to the top, so the preceding exchange stays
on screen. Adopted from the gate's own render (update_baseline_from_pr.sh).
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(web): fetch one window on reconnect too, and drop the dead page walk
The reconnect gap-close still grew its window with the multi-page
prompt-boundary walk, so the two paths that replace the whole transcript had
started to diverge — and its docstring's "exactly as a cold bind would" was no
longer true. That path fires off a dropped stream, so the reader didn't ask for
it either; paging it in over several requests shifts the transcript under them
for the same reason opening a session used to.
Point it at the same single window fetch. That leaves fetchInitialHistoryWindow
with no callers, so remove it along with MAX_INITIAL_PAGES / isUserPrompt /
initialWindowComplete and the tests covering it.
test_transcript_scroll_stability seeded 30 turns (60 items) to guarantee older
history beyond a 20-item window; a 100-item window swallows the whole
transcript, so its scroll-up had nothing to fetch. Seed past the new window
instead of relaxing what it asserts.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* test(ui-snapshot): re-render the turn-rail baseline after merging main
Main and this branch both moved this baseline, so the merge conflicted on it.
Neither side is right on its own — the correct image is a render of the merged
code (main's chat/sidebar polish plus this branch's capped spacer). Adopted
from the gate's own render of the merge commit.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
---------
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix: let a healthy route finish before the routing hook gives up
The first-message ladder was sized from the routing call alone, but the
server prepares the candidate catalog before it calls the router — about
three seconds on a first message. A healthy route therefore cost ~4.8s
against a 7s relay budget that started earlier, so the runner abandoned
verdicts that did arrive: the attempt was wasted, the prompt was replayed
a second time, and the transcript showed it twice.
Each hop now covers preparation plus the call, with the hook budget at the
15s ceiling and the harness kill still under Claude Code's own 30s
UserPromptSubmit default. A wedged router costs 15s instead of the 45s it
cost before this ladder existed. The magnitude test gains a floor as well
as a ceiling, so a future tightening cannot re-open the gap.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(web): say claude and codex on spawn chips, without the native suffix
A spawn chip's harness id is how the spawn runs, not something the chip
needs to spell out; the native suffix reads as noise there. SDK-brain
sub-agents (a bundle agent's codex / claude-sdk children) carry no suffix
and render unchanged, as do the session's own session/turn chips.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* test: align the spawn-gate budget assertion with the widened ladder
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(routing): keep a pinned session's spawns in its own family at the source
A pinned Smart Routing session was offered every agent by
``sys_agent_list``, so a codex session could stand up a claude-native
child and only then have routing decline it. Refuse the spawn before it
happens instead:
- ``sys_agent_list`` drops built-ins outside the caller's family when the
caller routes its spawns and is not auto-harness.
- ``POST /v1/sessions`` refuses an out-of-family child of such a parent,
naming the rule.
Auto-harness parents still cross families (the router owns theirs), and a
plain session sees and spawns exactly what it did before. The routing
decline stays as the fail-safe for a pane that exists anyway.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(routing): decline a route-turn whose parent routes another family
``route_turn_hook`` routed a pane's first typed prompt in the pane's own
family with no look at its parent, so a child pane on another family's CLI
could be pinned to a model its parent's family serves and the pane cannot
speak. The policy now declines (fail-open, nothing pinned, no chip) when
the pane's parent is a pinned Smart Routing session of another family.
The create gate refuses such a pane outright, so this only catches a row
that predates it — hence non-terminal, and the parent's switch stays
togglable.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(routing): a failed auto-harness route must not claim the route-once label
The auto-harness path stamped the routing-decision label on its own
"unavailable" card, and that label is the route-once gate — so a router
that happened to be down when the session started made every later
in-harness prompt decline as "already routed". Leave the label unclaimed
on failure, the way the turn, native-pane and child-spawn paths already
do; the declined card still says what happened.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(routing): stop routing a Smart Routing create's prompt twice
A native Smart Routing create routes the landing screen's prompt and pins
what it picked; the harness then submits that same prompt, and the
first-prompt hook scored it again — a second judge call tens of seconds
later, for the verdict the pane was already running on, and a needless
block-and-replay of the turn.
The create now fingerprints the prompt it routed (a hash: the label is
metadata, and the user's prompt does not belong there). When the hook sees
that prompt again it claims the create's decision instead of making a new
one — one router call, one chip. A prompt the user edited before sending
does not match and still routes on its own, as does the first prompt of a
session whose create-time route failed.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* perf(routing): take catalog preparation off the turn path
A first routed message spent ~3.2s preparing routing candidates before the
routes:select POST went out, and nothing in the logs named where it went. Two
runner-derived catalogs were being resolved while the user's prompt was held:
the claude-native picker vocabulary, whose stale entry the turn path awaits for
up to _ROUTING_CATALOG_WAIT_S (3.0s) while the fetch retries a booting runner,
and the runner model catalog, a round trip per turn for every pane that has no
picker vocabulary of its own.
Warm both when the runner binds instead. _on_runner_connect now calls
prefetch_session_routing_catalogs once the session-init handshake has created
the terminal, so the catalogs land before the first prompt rather than under
it. The runner catalog also gains a per-session cache behind _fetch_runner_catalog
(single-flight, 5-minute backstop TTL) whose entries drop through the seam that
already invalidates runner-derived snapshot overlays — a rebind or relaunch can
change which models a pane accepts, so it must not keep routing off the previous
runner's list. A cold cache still takes the inline fetch, so nothing depends on
the prefetch having run.
route_turn now logs its two phases separately (prep vs router) and the stale
catalog refresh logs what it waited, so the timeout ladder can be revisited
against measurements instead of a guess. The ladder constants are unchanged
here.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(codex): check a routed slug is reachable before switching the pane
The routing verdict comes from a server-side gateway map that can go stale, so
the routed model is not necessarily one this pane's gateway serves. The hook
switched onto it regardless: codex accepted the id, the next turn failed, and
nothing anywhere said why — the failure mode the #4074 review flagged.
The pane's live model/list is the only authority on what it can be moved onto,
and the hook already reads it to translate the routed id into codex's spelling.
Make that read the reachability check too: codex_model_slug becomes
codex_reachable_model_slug and answers None when no row names the model, and
_apply_thread_model returns a decline reason instead of a bare bool. An
unreachable pick leaves the pane on its own model, writes no marker, blocks
nothing, and records "routed model not in this pane's catalog" to the routing
trace and stderr — the same fail-open shape the claude side uses when a routed
model has no spelling its picker accepts.
A model/list that cannot be read is now distinguished from an empty catalog and
also declines: an unreadable catalog is not evidence of reachability, and
declining costs a turn of routing where switching blind costs the turn itself.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(auth): one workspace identity, and a refresh that can fall back
Two credential faults that made a healthy workspace look unreachable.
**One identity.** A pane and the server could authenticate as different
~/.databrickscfg profiles for the same host. The server's router client uses
the config's `kind: databricks` provider profile; the claude-native pane
installed ucode's recorded token command, which selects the workspace however
ucode was set up — usually by host. Two profiles on one host are two
identities, so re-authing one left the other's token expired and the two halves
disagreed about whether the workspace was up. The named profile is now the
authority on both sides: the pane's apiKeyHelper is regenerated against it
(only for the recognizable `databricks auth token` shape — an enterprise
deployment's own token command has a selector we have no business guessing at),
and a `routing:` block that names no profile falls back to the provider block's
rather than to the ambient SDK chain. Host selection stays the fallback for
when nothing names a profile.
**A refresh that can fall back.** The generated helper forced a refresh on
every call. The reason is real — `--force-refresh` renews a still-valid token
and keeps a long gateway session off a mid-session 401 — but it fails outright
once the refresh token has gone stale, which turned a perfectly usable cached
access token into a hard auth failure (twice in one day). The forced attempt is
now speculative: its output is captured, its stderr dropped, and an empty
result falls back to plain `auth token`, which serves the cached token and
renews it near expiry. The fallback keeps its stderr so a genuine auth failure
is still visible.
Both harnesses generated this command separately, so the shape now has one
definition (databricks_bearer_token_command) and the claude and codex helpers
delegate to it.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* test: align both hook-budget assertions with the widened ladder
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* test: keep the catalog-cache reset import-free; cover the spawn chip in e2e_ui
The autouse cache-reset fixture imported omnigent.server.smart_routing in
every teardown, which detonated inside the spec suite's import-blocker
test and taxed lanes that never load the server. A sys.modules lookup
clears the cache only where it exists. The new Playwright case pins the
shortened spawn-chip harness label the UI judge flagged.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: leave a visible declined chip when the turn hook's routing call fails
The create and dispatch paths already card a failed route; the in-harness
first-message hook failed open silently, so a router 401 looked like the
session simply ignoring Smart Routing. The hook now persists the same
unavailable card with the cause, without claiming the route-once label —
the next prompt can still route. Benign allows (already routed, routing
off, the family guard) are not failures and stay chipless.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat(cli): drop create-time Smart Routing; keep first-message routing
The CLI can only route a prompt it never shows: `--smart-routing -p` picked a
model (and, on `run`, a harness) before the TUI existed, so the user typed at a
session whose pick they could neither see nor change. The web UI is the surface
that can do that. So the CLI keeps the one routing shape a terminal can honour
— arm the session, let the harness's own hook route the first message typed —
and rejects the rest.
`omni claude|codex --smart-routing` stay, bare only. `-p` alongside them is now
a usage error pointing at the TUI or the web UI, and `run --smart-routing`
(with it the CLI's auto-harness route) is rejected outright; its flag stays
hidden purely to say where routing moved, and comes out in 0.11.
That leaves nothing behind the create-time path: the routed create no longer
sends a message or the `auto` sentinel, reads back no verdict, and the
launch-side plumbing that applied one is gone. `create_smart_routing_session`
becomes `arm_smart_routing_session` and `RoutingDecision` becomes
`ArmedSession` (session id + fail-open notice), because neither decides
anything any more. The preflight gate, the `--resume` rejection and every
server-side create path are untouched.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(web): drop "-native" from every routing chip, not just spawn chips
A session-scope chip read "codex-native", which leaks how the pane runs
into a label that only needs to name the brain. The shortening was scoped
to sub-agent decisions; it belongs on every chip, so harnessDisplayLabel
no longer takes a scope and always trims the trailing suffix. SDK ids
(codex / claude-sdk / auto) carry no suffix and render unchanged.
The e2e session-chip assertion now also pins the negative: a bare
"claude" substring-matches "claude-native", so only not_to_contain_text
catches a regression. Same for the card unit test, which anchors on the
full label.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(web): render an auto-harness create chip below its prompt
A session created with Smart Routing as both the model AND the harness
records the pick as a `session` chip at create time, and its first turn
routes again and records a `turn` chip — so two chips sit above the
session's first user message. `deferredRoutingChips` only paired a chip
whose immediate next content block was that message, so the first of the
two was left in place and rendered ABOVE the prompt, reading as a
preamble instead of the verdict on it. It only looked right when the two
verdicts matched and the create chip was dropped by the collapse.
Look forward past the sibling chips waiting on the same message (and
past superseded ones, which render nothing) and defer them all below the
message, in transcript order. A sub-agent chip still stops the scan: it
renders standalone where it occurred, and stepping over it would reorder
the two. The cache's pending-pair guard learns the same rule so the pair
stays stable frame by frame.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* perf(runner): skip the sys_agent_list routing lookup on plain sessions
Family confinement made every sys_agent_list pay a serial
GET /v1/sessions/{id} with a 30s budget before discovering the session
was not routed at all. Plain sessions — the overwhelming majority —
carried seconds of fan-out latency for a feature they never use, and a
wedged server stalled the listing for the full 30s.
Read the runner-local routing class first: a session with no routing
armed, or an auto-harness one, answers without a server hop. Only a
locally pinned routed session spends the lookup, now on a 5s budget that
fails open to the unfiltered listing, and its answer is cached for the
session (routing state is fixed at create). The create-path gate still
refuses out-of-family creates, so a fail-open listing stays safe.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(auth): fall back to ucode's recorded token command
Pinning the pane's apiKeyHelper to the config-named Databricks profile
fixed one outage and opened its mirror image: when the named profile
holds no usable credential — a config naming DEFAULT while the user
authenticated under another profile on the same host — the helper now
prints nothing and every turn 401s, where before the rewrite ucode's own
recorded command served a working token.
The named profile stays the preferred identity; the recorded command
becomes the helper's last resort, after the forced refresh and the cached
token have both come up empty. An injected DATABRICKS_BEARER still
short-circuits everything.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* perf(routing): only warm catalogs for routed, live sessions
A runner reconnect walks every session bound to that runner, and the
catalog prefetch fired for all of them — archived rows included — with no
Smart Routing gate. One host's tunnel flap with ~25 plain codex panes
launched 50 fire-and-forget tasks whose provider listings run on worker
threads, so the session re-init running alongside them timed out and the
panes came back stranded, all to warm a cache only Smart Routing reads.
Gate the prefetch on the canonical routing reader
(routing_class_from_snapshot), skip archived sessions, cap concurrent
warm-ups with a small semaphore, and have each task retrieve its own
exception: a tunnel dropped mid-prefetch raised RuntimeError that nothing
ever retrieved, which surfaced only as asyncio unretrieved-exception
noise.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat(routing): route a pinned native create before its pane launches
Picking Claude Code or Codex with Smart Routing as the model created the
session with no prompt to route on, so routing fell through to the
in-pane first-message hook: the prompt was blocked, routed, switched with
`/model` and replayed. The user watched their own message disappear for
seconds, and the composer's model pill stayed stale because the pin
landed mid-turn instead of before the snapshot bound.
The web create now sends `smart_routing_message` for a pinned
claude-native / codex-native pane too, whenever routing owns the model.
The server already routes the MODEL only on that path and pins
`model_override` before the terminal launches; the client still delivers
the real first message after navigation, exactly as the auto path does.
Bundle agents are untouched — their harness isn't decided until the first
message event, so there is nothing to route at create.
With the model pinned and the routing-decision label stamped before the
pane exists, the `UserPromptSubmit` turn-routing hook has no answer left
but "already routed" — paid for with a held prompt and a round trip per
prompt. The session's routing class now carries a `turn_routing` flag
that drops to false once the row has a routing decision, and the native
launch skips the loopback router; the absent advertisement is what leaves
the hook out of the generated settings. A create whose routing failed
stamps nothing and keeps its hook, so the first message is still its
retry, and spawn routing plus the extended catalog are untouched.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(web): keep a create-time routing chip below the prompt it decides
A pinned Smart Routing create routes at create time, so the session-scope
decision is persisted before the pane launches while the landing composer's
prompt is only posted after navigation. The prompt is on screen the whole
time, but as an optimistic `pendingUserMessages` entry merged in AFTER the
bubble walk — never a `user_message` block — so `pairableMessageAfter` cannot
see it and the chip renders above the message until the server persists it,
then visibly moves below.
Splice the pending prompt above a run of session-scope chips that opens the
committed timeline, matching the position `buildBubbles` gives the chip once
the message is persisted. The chip renders once, below the prompt, and stays
put across the pending → committed swap. Chips anywhere else (paired with
their message, or a standalone sub-agent spawn) keep their place, and a chip
with no message — including a declined create route — still renders.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* chore: trigger CI on the rebased tip
The rebase onto main and the chip-ordering fix never ran the test lanes;
only CodeQL and DCO reported.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
---------
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
## Related issue
Closes OMNI-2485 — https://linear.app/omnigent/issue/OMNI-2485
## Summary
- The Android shell previously sent *every* login through the system browser:
it stopped any off-origin navigation, requested a CLI-style ticket, opened
the browser, polled for the session JWT, then injected it as a cookie
(`OidcLoginManager`). That detour exists only because Google's OAuth endpoint
rejects embedded webviews — the browser and WebView have separate cookie
jars, so the session has to be carried across by hand.
- Databricks-hosted deployments authenticate via Okta, which permits embedded
user-agents. For those servers the whole detour is unnecessary: the redirect
chain can run inline and the server sets the session cookie on its own
domain, so nothing needs bridging.
- Adds `usesInWebViewAuth()` in `Origins.kt`, keyed on the **pinned server**
(`databricks.com`, `azuredatabricks.net`, `databricksapps.com`). When it
matches, off-origin navigation loads inline instead of triggering the browser
hop. `OidcLoginManager` is untouched and still handles every other server.
ELI5: the app used to kick you out to Chrome to log in, then smuggle the
resulting session back in. On Databricks servers it no longer needs to — you
just log in where you already are.
Keying on the pinned server rather than the destination is deliberate: during
login the WebView navigates to `databricks.okta.com`, so a destination
allowlist would have to enumerate IdP domains it can't know up front.
```mermaid
flowchart LR
A[off-origin nav] --> B{pinned server uses<br/>in-WebView auth}
B -- no --> C{gesture}
C -- yes --> D[system browser]
C -- no --> E[browser hop:<br/>ticket, poll, inject cookie]
B -- yes --> F{gesture AND<br/>on a pinned-origin page}
F -- yes --> D
F -- no --> G[load inline]
```
The gesture check is qualified by "on a pinned-origin page" because once the
WebView is on the IdP's own pages, its sign-in buttons and form posts are both
off-origin *and* gesture-driven — without that qualifier they get mistaken for
external links and ejected to the browser mid-login.
Safe because the native bridge is origin-allowlisted to the pinned origin by
WebView itself (`addWebMessageListener` / `addDocumentStartJavaScript` are both
passed `setOf(origin)`), so an IdP page loaded in this WebView cannot reach it.
Host matching uses a dot boundary (`host == d || host.endsWith(".$d")`) so a
lookalike like `databricks.com.example.org` does not qualify.
## Test Plan
- `./gradlew :app:compileDebugKotlin :app:compileDebugUnitTestKotlin` — clean.
- `pre-commit run --files <changed>` — ktlint format + check pass.
- New unit tests: 6 cases in `OmnigentWebViewClientTest` (inline IdP redirect,
browser hop for other servers, external link from the app page, sign-in tap
on the IdP page, both `onPageStarted` branches) and `OriginsInWebViewAuthTest`
for the dot-boundary matching.
- On-device against `https://omnigents-<id>.aws.databricksapps.com`: login
completes entirely in-app through Okta (Okta Verify), no browser launch and
no "Signed in" notification. `adb logcat -s OmnigentAuth`:
```
off-origin nav https://ai-oss-...cloud.databricks.com gesture=false
off-origin nav https://ai-oss-...cloud.databricks.com gesture=false
off-origin nav https://ai-oss-...cloud.databricks.com gesture=true
off-origin nav https://databricks.okta.com gesture=false
off-origin nav https://databricks.okta.com gesture=false
off-origin nav https://ai-oss-...cloud.databricks.com gesture=false
```
Every hop loads inline and `onLoginRequired` never fires. The return to the
pinned origin logs nothing because same-origin loads short-circuit earlier.
## Demo
N/A — no visual change; the difference is the absence of a browser launch. The
logcat trace above shows the new behaviour.
## Type of change
- [x] Bug fix
- [ ] Feature
- [ ] UI / frontend change
- [ ] Refactor / chore
- [ ] Docs
- [ ] Test / CI
- [ ] Breaking change
## Test coverage
- [x] Unit tests added / updated
- [ ] Integration tests added / updated
- [ ] E2E tests added / updated
- [x] Manual verification completed
- [ ] Existing tests cover this change
- [ ] Not applicable
## Coverage notes
Unit tests could not be executed locally: Robolectric cannot fetch
`org.robolectric:android-all-instrumented` because `repo1.maven.org` is
unreachable from this machine. This is pre-existing and environmental —
untouched tests such as `ThemeTest` fail identically. Compilation of both main
and test sources was verified instead, so CI is the first real run of the new
tests. The end-to-end flow was verified on-device as described above.
Known gaps, both pre-existing and out of scope here:
- Passkey sign-in at the IdP will still fail in the WebView. WebAuthn is off by
default (`WEB_AUTHENTICATION_SUPPORT_NONE`) and enabling it needs Digital
Asset Links published at the RP ID (`databricks.okta.com`), a domain this
repo does not control. Okta Verify and password+MFA are unaffected.
- `shouldOverrideUrlLoading` hands non-http schemes to `Intent(ACTION_VIEW,
url)`, which is wrong for `intent://…#Intent;…;end` URLs (needs
`Intent.parseUri`) and fails silently under `runCatching`.
## Changelog
Signing in to Databricks-hosted deployments on Android now happens in the app
instead of bouncing out to the browser
Signed-off-by: Zeyi (Rice) Fan <zeyi.f@databricks.com>
* Refine conversation turn rail navigation
Use a single reading-position marker and tighter spacing so the rail is easier to scan and accurately reflects the active turn.
Signed-off-by: Ajay Alfred <ajayalfred07@gmail.com>
* Refine message hover actions
Use compact, consistently muted controls and tighter spacing so chat actions match the rest of the interface.
Signed-off-by: Ajay Alfred <ajayalfred07@gmail.com>
* Polish new-session and sidebar UX
Align composer geometry, typography, controls, host context, and project navigation so new-session flows feel consistent and clearly scoped.
Signed-off-by: Ajay Alfred <ajayalfred07@gmail.com>
* Align selection and compact action styling
Match text selection to active navigation colors and improve compact chat actions with larger glyphs and clearer spacing.
Signed-off-by: Ajay Alfred <ajayalfred07@gmail.com>
* test(e2e-ui): regenerate visual baselines
* Fix local host label test expectations
Select hosts by stable identity and accept OS-aware local labels so unit and E2E coverage matches the intended UI behavior.
Signed-off-by: Ajay Alfred <ajayalfred07@gmail.com>
---------
Signed-off-by: Ajay Alfred <ajayalfred07@gmail.com>
Co-authored-by: omnigent-ci[bot] <294685417+omnigent-ci[bot]@users.noreply.github.com>
* fix(hermes-native): advance the mirror cursor per row, not per item
One Hermes `messages` row expands to several mirror items sharing a
`msg_id` (a reasoning delta, the prose, one `function_call` per tool
call), but the forwarder advanced and persisted `last_id = action.msg_id`
after each item. When an earlier item of a row delivered and a later one's
POST failed, the cursor had already moved past the row, so the next poll's
`WHERE id > last_id` skipped it and the undelivered items were lost
permanently: a silent, unrecoverable drop of an assistant turn's tool call
or prose on any transient post failure mid-row.
Advance `last_id` only at a row boundary, marked by the new
`_TurnAction.last_of_row`. A row that fails partway records
`partial_row_id` / `partial_row_items`, and the retry re-reads that row
with its already-delivered prefix dropped. The prefix-drop is required,
not defensive: `_post_conversation_item` carries no idempotency key, so
re-reading the row without it would mirror the delivered items twice.
The partial row is named explicitly rather than implied as "the row after
`last_id`", because compaction soft-deletes rows and an implied offset
could be applied to the wrong row after the row it describes disappears.
The per-poll heartbeat write and the compaction re-pin both carry or clear
the new fields, so a later poll cannot silently zero them.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* fix(hermes-native): restart the in-row item count on a new row
The in-row delivered count was only zeroed when a row reached its final
item. A row that fails partway can disappear before its retry: compaction
soft-deletes it, and the child re-pin that resets these fields is skipped
when the session has no child (the code logs "staying on parent"). The
stale count then carried into the next row, so that row's retry dropped
undelivered items as already delivered, losing them permanently: the same
silent loss this cursor exists to prevent.
Count from 1 whenever the row is not the one already in progress. Also
pass the partial fields explicitly at the child re-pin write (the one
write site of four relying on dataclass defaults) so a future default
change cannot silently break it.
Found by Polly review on #4261.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
---------
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* fix(host): keep the tunnel receive loop responsive during readiness refresh
The host->server tunnel disconnected with `4003 ping timeout`: the periodic
harness-readiness refresh ran inline on the receive loop and could block it for
~60s — two 30s CLI probe subprocesses (`--version` and `auth status`) hanging on
a wedged harness CLI. While blocked, the host never answered the server's
application-level pings, so the server watchdog declared the host dead and
closed the tunnel.
Fix A (host/connect.py): move the readiness refresh into its own task,
`_harness_readiness_loop`, so the receive loop only ever reads frames and
answers pings — a slow probe can no longer stall the keepalive.
Fix B (harness_install.py, harness_readiness.py, codex_native.py): bound
readiness CLI probes to READINESS_CLI_PROBE_TIMEOUT_S (10s, matching goose's
status-probe budget) instead of 30s, so a hung harness CLI fails fast on the
refresh, the startup hello, and Ctrl-C. Setup and launch gating keep the lenient
30s default via behavior-preserving timeout parameters.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* test: accept the readiness probe timeout kwarg in harness CLI stubs
Readiness now calls harness_cli_installed / harness_cli_logged_in with a timeout= kwarg (READINESS_CLI_PROBE_TIMEOUT_S); update the monkeypatch stubs in the affected suites to accept it so they exercise the same paths.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* test(host): cover off-loop readiness refresh and bounded CLI probe
Fix A moved the harness-readiness refresh off the tunnel receive loop into
_harness_readiness_loop. Rewrite the three live-host readiness tests to drive
that loop directly: the old versions drove _serve_frames with a fake tunnel
that blocks on recv, which under the pure recv loop never exits and hangs to
the pytest timeout. Add a harness_install test asserting the readiness caller
shortens the CLI probe subprocess timeout while setup/launch keep the 30s
default.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(web): name the vendor, not the Task type, on native sub-agents
A Claude Code sub-agent session read "General-purpose" in the composer
identity slot and "claude-native-ui" in the header breadcrumb. Both are
internals the user should never see: the child row reuses its parent's
`<vendor>-native-ui` agent and stores Claude's own `subagent_type` as
`sub_agent_name`.
The identity paths never consulted the one label that names the product.
`modelPickerKindForConv` matches only `claude-code-native-ui`, so a
`-subagent` child fell through `composerHarnessLabel` to the agent-name
branch; `ChatHeader` rendered `boundAgent.name` raw. Resolve the vendor
from the sub-agent wrapper label instead, so both surfaces read
"Claude Code" (and "Codex" / "OpenCode"), matching the Agents rail.
The sub-agent wrapper map is kept separate from `BY_WRAPPER` so
`isNativeWrapper` still reports false for children — they own no PTY and
take no input.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* test(e2e_ui): cover the native sub-agent identity labels
The `E2E UI Required` gate gives a web/** change a required e2e_ui test.
Register a child through the real `external_subagent_start` contract the
claude-native forwarder uses, so it carries the wrapper label and the
`general-purpose` sub-agent name the identity labels must choose
between, then assert the header and composer read "Claude Code" and that
neither internal reaches the screen.
Verified it fails without the fix: with both branches disabled and the
SPA rebuilt, the "Claude Code" breadcrumb is not found.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* chore: retrigger CI
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* chore: retrigger CI after the GitHub Actions outage
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* refactor(web): compute the sub-agent name only for child sessions
Review note: `subAgentName` ran on every render although only the
child-session branch reads it. Gate it on `isChildSession` so non-child
sessions skip the lookup.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
---------
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(claude-native): stop background shells from gating the composer and sidebar
When Claude Code's Stop hook fires with background shells still running, the
forwarder relabels the turn-end `idle` to `waiting`. That relabel existed only
to keep a spinner lit, but `waiting` is read as a turn gate everywhere else:
- the sidebar row spins, so a session that takes input reads as busy;
- `waiting` keeps `_session_active_response_cache` populated while the snapshot
projects it as `running`, so opening or reloading the session reopened the
already-settled turn as "streaming" — every message then queued behind
"Steer" and never drained, because the flush refuses to run while streaming;
- the composer offers Stop instead of Send.
Sub-agents already collapsed this back to `idle` (a `waiting` edge skipped the
terminal-delivery branch and hung the orchestrator). The turn has genuinely
ended for a top-level session too, so generalize that collapse: rename
`_subagent_delivery_status` to `_background_task_delivery_status` and drop the
sub-agent gate. Normalizing at server ingress rather than in the forwarder also
covers runners that predate the change. A genuine async-park `waiting` carries
no tally and is untouched.
The background-shell tally still rides the wire and the snapshot, so the in-chat
"N background tasks still running" indicator is unchanged. The tally no longer
forces a `running` sidebar row — it only refreshes on the next Stop hook, so a
spinner keyed off it can outlive the shells it claims are running.
`_best_effort_stop` used that same sidebar rollup as its "anything to stop?"
gate, so it now checks the tally directly — archiving or deleting a session
with live background shells must still stop the runner.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* chore: re-trigger CI after the GitHub Actions incident dropped the PR webhook
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* chore: re-trigger CI (GitHub Actions webhook throttling, attempt 2)
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* chore: re-trigger CI (attempt 3, runners recovered)
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* chore: re-trigger CI (attempt 4, runner success rate restored)
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* chore: re-trigger CI (attempt 5, pull_request webhooks recovering)
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* chore: re-trigger CI (attempt 6)
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* test(server): cover the active-response close on a background-task turn end
The composer bug's mechanism had no direct unit coverage: a `waiting`
turn-end keeps the in-flight response id, and the snapshot projects
`waiting` as `running`, so a reconnect reopened the settled turn as
streaming and queued every send behind "Steer". Assert that delivering
the turn-end as `idle` closes the response while the shell tally survives.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
---------
Signed-off-by: dbczumar <corey.zumar@databricks.com>
GitHub's cron is best-effort: the hourly sweep actually fires every 1.5 to 2.5 hours
(measured 09:34, 11:56, 14:10, 16:38, 18:17, 20:23, 22:09, 23:56 today). A
contributor waited that long for the nudge, and just as badly, waited that long for
it to stop applying after they added the issue.
Both scripts now accept PR_NUMBER and fetch that one PR instead of the window. Only
the fetch differs: every exemption, resolution, and dedupe path below it is the same
code, so the instant route and the sweep cannot reach different verdicts.
A new pr-hygiene-live workflow runs both on pull_request_target for opened,
reopened, ready_for_review, edited, and synchronize. `edited` is the one that
matters most after the nudge exists: editing the description to add "Closes #123" is
how a contributor complies, and that should clear immediately rather than in two
hours.
The sweep stays as the safety net. It catches what events miss -- a failed run, and
sidebar issue links, which fire no webhook at all -- and it is the only route that
reaches PRs opened before this workflow existed.
Two guards on the single-PR path, since an event can name a PR the sweep would never
have selected: the EFFECTIVE_FROM floor still applies, so an event on an old PR is
not a licence to reach into the backlog, and a PR that closed between the event and
the run is left alone.
Verified against production with writes blocked: #4173 skip (already nudged), #4187
exempt (maintainer), #4178 ok (has a link), #4104 skip. Each matches the verdict the
sweep reached for the same PR.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* feat(kubernetes): classify managed runner Pods by their agent
Stamp a managed runner Pod with `omnigent.ai/agent: <name>` when the
session is bound to a genuine built-in agent, so an admission policy can
select managed runners by agent and augment their runtime (e.g. inject a
workload-scoped credential). The anti-spoof gate is unchanged
(`session_id is None AND id == builtin_agent_id(name)`), so a user-named
session agent cannot self-classify.
- capabilities: add `classifies_runner_by_agent`, set True only on the
Kubernetes launcher. `_start_sandbox_host` threads `agent_name` into
`start_host` gated on that capability, never by probing the signature —
`start_host` is side-effecting, so a pass-then-retry risks a double
launch. The shared host-launch signature is left untouched, so
exec-model launchers that forward every keyword to `super()` keep
working.
- labels: the value is echo-or-omit — stamped only when the agent name is
already a valid label value, else dropped with a WARNING. It is never
sanitized: the value selects which credential admission injects, so a
lossy collision would cross a credential boundary. The classifier rides
the Pod only, not the launch-token Secret.
- launch: resolve the classifier inside `_run_managed_launch`, on the task
that already owns the single-flight claim. Only the winner resolves, so
no store read is wasted, the claim-to-spawn region stays free of any
await, and the create path does not read the agent store before its 201.
- reserve the `omnigent.sandbox.*` label namespace from client writes.
BREAKING: session create and patch now reject client-supplied labels
under that prefix, which were previously accepted.
- docs: document the classifier lifecycle (fork/switch-agent drop the
label; switching back does not restore it; a running Pod keeps its
launch-time label until replaced), both omit paths and where each logs,
and what the label does not do — namespace RBAC, verifying the creating
identity rather than the label alone, and a fail-closed policy shape.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: bdchatham <bdchatham@gmail.com>
* test(managed-hosts): establish the relaunch race instead of timing it
test_concurrent_relaunch_messages_kick_a_single_launch is flaky. It failed twice
on this branch and passed either side of both failures, with the code under test
and the test itself byte-identical between a passing and a failing run, so this
is the test rather than a regression.
The race it wants is a message reaching the tracker check while the winner's
claim is still unsettled. Both callers await asyncio.to_thread twice before that
check, and an executor hop takes an unpredictable number of event-loop turns to
deliver, so holding the winner open for five turns does not establish that
ordering. On a loaded machine the racer arrives after the claim settled, takes
the settled-entry retry branch, and kicks a second launch, which reads as the
double-launch this test exists to forbid.
That retry is intended behaviour. In production a second message arriving after
a successful relaunch is turned away by the is_online check further up, which
this test stubs False forever, so the state it was asserting on is one the real
system does not present.
Reproduced deterministically by delaying the racer 50ms inside its thread hop,
which is what a loaded runner does: three failures out of three, with the same
assert 2 == 1 CI reported.
The winner now holds its claim until the racer has demonstrably read the
tracker. That is an ordering rather than a duration, and the test now contains no
sleep, no timeout and no yield count at all — the wait is unbounded on purpose,
since any number there would be a second timing assumption and the suite's own
300s timeout is the backstop. Three reads is the whole exchange, and the count is
order-independent: whichever caller wins, the winner reads twice and the racer
once, and a broken invariant makes both read before either claims, which still
fails the assertion.
Verified in both directions. Under the same 50ms delay that broke the old test
three times out of three it now passes five out of five; twenty consecutive runs
are green; and adding an await between the tracker check and the claim still
fails it with the original assertion, so the guard is intact.
Whole file green at 218 passed including under xdist, ruff clean, and mypy
reports the same 47 pre-existing errors as on the unmodified file.
Signed-off-by: bdchatham <bdchatham@gmail.com>
---------
Signed-off-by: bdchatham <bdchatham@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
The runner's filesystem-changes routes shelled out to git synchronously,
inline on the asyncio event loop:
- `list_filesystem_changes` (the `?view=changed` file panel) →
`list_changed_files` → `git status --porcelain --untracked-files=all`
- `read_environment_file_diff` → `get_changed_file` → `git show` / `git diff`
On a large repository a cold `git status` can take several seconds (a
million-file monorepo measures ~6s here even with the untracked cache
enabled). While that blocking subprocess runs, the runner's event loop
can't service anything else — including the server's runner-stream relay
subscription probe. When a session's first turn (or the changed-files
panel) lands inside that window, the relay misses its readiness budget and
the turn fails with a 503 `runner_unavailable` ("runner didn't come online
in time"). It presents as flaky because it only fires when the git call
overlaps the readiness window — e.g. opening the UI on `?view=changed`
while the runner is still starting up reproduces it reliably.
Offload both git-backed calls with `asyncio.to_thread`, matching the
sibling `get_baseline` call in the same route. The git walk now runs on a
worker thread and the event loop stays responsive regardless of repo size
or cache warmth. Behavior is unchanged (same results, same error
handling); the redundant per-call asyncio import in the diff route is
folded into one at the top.
Co-authored-by: Isaac
Signed-off-by: Edwin He <41037314+Edwinhe03@users.noreply.github.com>
* fix(routing): fall back to the built-in judge when the external router cannot answer
A fully-OSS deployment configures the judge through the top-level `llm:`
block, has no `routing:` block, and keeps a `kind: databricks` provider for
inference. The bootstrap then auto-builds an external routing client pointed
at that workspace's `/ai-gateway/routing/v1`, the workspace never had the
routing API enabled, and every `routes:select` came back HTTP 404 — so the
session showed "Routing unavailable" while the judge it configured was never
asked. Smart Routing was effectively off for the whole OSS flow.
Route through both backends instead of one: `route_with_fallback` still
prefers the external router wherever it can serve (the Databricks posture is
unchanged), and asks the judge behind it when that call fails or declines.
The decision records `oss-llm`, so the chip says who answered. Every routing
surface goes through it — session/create routing, turn routing, the native
route-turn hook, and subagent spawns.
The 404 whose body says routes:select is not enabled is account-level
configuration rather than an outage, so the client latches it and skips the
request from then on; `/v1/info` stops advertising a router that can only
decline. Nothing is persisted — a restart re-probes.
Choosing BETWEEN native panes still needs the workspace router's menu, so a
judge-only deployment keeps the default pane on a top-level Smart Routing
create and routes just its model, with the reason on the chip, rather than
declining into a session with no terminal.
Fail-open is unchanged throughout: a routing failure never blocks a turn, a
spawn, or a create, and never claims the route-once label.
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
Co-authored-by: Isaac
* fix(web): require the external router for the native-pane Smart Routing row
On a deployment whose only smart router is the built-in OSS LLM judge, the
new-session picker still offered the top-level Smart Routing row — the one
that launches a native CLI pane with the router choosing BOTH the harness and
the model. Choosing which pane launches is the external AI-Gateway (task_v1)
router's job; the judge routes a model inside an already-chosen harness, so
that row had nothing behind it and the session would fail at launch.
Gate the row on `smart_routing_sources.external`. A judge-only server now
reports its own cause ("needs the workspace AI gateway router on this
server") instead of blaming the host's CLIs. Since the row runs on the
external router alone, the built-in judge also stops covering for an arm the
host keeps off the gateway — `not-gateway-backed` fires again there.
Two neighbouring surfaces are deliberately untouched:
- Per-harness Smart Routing (the Model row's `__smart__` sentinel, router
picks the model per turn) still takes either source, so it stays on a
judge-only deployment.
- A bundle agent's routed brain (Polly / Debby's "auto" harness override)
still takes either source too — the judge picks that harness as well as its
model — and has a test pinning it against a judge-only server.
`smart_routing_sources` is absent on an older server, and `resolveServerInfo`
already degrades that to both sources from `smart_routing_enabled`, so such a
server keeps the row exactly as it had it.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(routing): keep a named-worker spawn on its own harness
A Smart Routing parent forced EVERY child create onto the "auto" harness
sentinel, including a spawn that named a worker (polly's `pi`,
`claude_code`, `codex`). The child's first message then routed against
the whole multi-harness catalog, so a pi worker came back with a codex
verdict stamped "applied" while the runner respawned its pane from pi
onto codex mid-flight — and a native worker lost the terminal labels the
forced-auto branch skips.
A named sub-agent and an explicit spawn `harness_override` both decide
the CLI the child boots on, so neither is handed the sentinel now. The
child-routing call also reads its family off the CHILD rather than the
parent: parent-derived confinement offered a pi worker the brain's claude
family, and dropped confinement entirely under an auto brain. Candidates
are the child's own harness, so the verdict is an in-family pick or an
honest decline.
Finally, a verdict naming a harness the call never offered is dropped
rather than applied (worker-name spellings still resolve), so no routing
path can pin another family onto a pane already running.
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
Co-authored-by: Isaac
* fix(runner): report a routed session's real harness, not its spec's
The runner derived a session's harness from its cached spec alone, so a
session Smart Routing moved off that harness still read as the one it was
declared with. On a routed child of a bundle agent that flipped the
native-vs-SDK verdict: polly's `claude_code` / `codex` workers declare
native harnesses but ran the SDK `codex` the router picked, so the
SDK turn's stream-end skipped the completion push (it belongs to a native
path that never runs) and its status events were suppressed. The parent's
inbox only ever received the `pi` sibling — the one whose declared
harness was already non-native — and it waited on the other two forever.
The forwarded `harness_override` is recorded per session and wins over
the spec, so every nativeness check answers for the process that is
actually running.
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
Co-authored-by: Isaac
---------
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
The non-closing duplicate comment ended with "Leaving it open for a
maintainer to confirm", which parks the issue in a queue nobody is
watching. The reporter is the one person who can settle it immediately:
they know whether the linked issue covers their case.
Both the `duplicate` (closure disabled) and `similar` comments now ask
the reporter to take a look and close their own issue if it matches,
with an explicit path for when it doesn't. The `similar` copy stays
softer — a loose match is a weaker basis for that ask.
Rendering the new copy surfaced a pre-existing grammar bug: the plural
branch produced "these already covers this". Replaced with a phrase that
agrees in number, plus a regression test.
Co-authored-by: Isaac
Signed-off-by: Pat Sukprasert <pattara.sk127@gmail.com>
* dev/resolve-agent: resolve a reproduced bug (review-or-fix) and prove it
Adds the step after repro-agent: given a pointer to a completed repro run — a
local session link or a CI run URL (--ci-link) — resolve-agent recovers the
reproduction (verdict, per-facet breakdown, journey, the authored e2e test) and
drives the bug to resolution.
Two paths, decided by whether an open PR already fixes the bug:
- Review path: check out the existing PR, run the repro test against it
(pass = it fixes the bug; fail = it doesn't), review the diff, and comment
findings on that PR — no competing PR opened.
- Author path: audit the repro test against the unfixed tree so it fails on real
buggy behavior, root-cause, fix, add targeted tests at the changed layer, and
prove every live facet goes fail->pass.
Robustness on the author path: hostile-env rerun of env-default tests; an
independent cross-vendor review (a codex-native reviewer child on its own diff,
fed a recurring-pitfalls checklist) before opening the PR, reusing the server +
runner it already runs on. Opens a ready-for-review PR; does not merge.
--skip-push commits locally without pushing.
dev/resolve.py mirrors dev/repro.py; tests/dev/test_resolve.py unit-tests the
driver helpers.
Co-authored-by: Isaac
* dev/resolve-agent: address PR review — base off origin/main, stricter ci-link parse, honest guard comment
Review feedback on #4127:
- Base the fix worktree on the latest origin/main, not this checkout's HEAD.
Running the driver from a feature branch would otherwise drag unrelated
commits into the fix worktree and contaminate the PR/review. Adds
_resolve_base_ref() (fetch origin/main, fall back to local main, then HEAD).
- Confirm before creating the worktree, so answering "no" no longer leaves an
orphaned fix/<slug> worktree + branch on disk.
- Parse the --ci-link URL structurally (scheme + github.com host + anchored
path) instead of an unanchored substring regex, so a string that merely
contains the run path (or a different host) is rejected. Adds rejection tests.
- Soften the headless_subagent_purpose_guard comment in config.yaml: it only
inspects sys_session_send, not the sys_session_create that launches the
reviewer child, so it does not itself constrain that child — spawn_bounds caps
the fan-out and the reviewer's read-only behavior rests on its prompt + the
codex bundle's guardrails.
- Fix two inaccurate inline comments (worktree base, absolute-agent-path
rationale) to match the actual flow.
Co-authored-by: Isaac
* dev/resolve-agent: recover the pasted test from CI logs (repro-agent #4207)
repro-agent now pastes the complete verbatim e2e test source into its final
message before the JSON handoff. The CI job log echoes that message untruncated,
so on the --ci-link path the log itself now carries the full test body — prefer
reading it from the inline block there, with gh run download as the fallback.
(A live --session transcript is still truncated, so the disk read off the repro
session's workspace stays the robust path locally.)
Co-authored-by: Isaac
`omni host stop` pre-checks `GET /v1/sessions` so it never terminates a
daemon out from under live sessions. That API is one of the slowest on
managed, so the pre-check times out on otherwise healthy hosts and the
command fails with a bare `session list failed: ReadTimeout`.
`--force` already skips the pre-check and stops the daemon anyway, but
the failure never said so, leaving the daemon looking unstoppable. Name
both escape hatches in the error instead.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* docs(repro-agent): keep the journey user-observable, not a mechanism trace
The repro-agent was conflating the reproduction *journey* with the bug's
root-cause analysis: when a report named code paths, it verified those paths
(code traces / unit tests) instead of driving the observable user journey, and
packed the failure mechanism into the one-line `journey` field.
Sharpen the spec so the journey is strictly an ordered list of user actions
ending in a user-visible failure:
- Step 1: define the journey as concrete numbered user actions; a named code
path is a hypothesis to confirm as a facet, not the thing to verify. When a
report has no clear "Steps to reproduce", derive the journey rather than
adopting the root-cause analysis; if no reproducible user journey exists,
stop with needs_more_info.
- `journey` output field: the ordered user actions compacted to one line, with
the internal mechanism kept out (it belongs in facets/evidence).
- Also require pasting the authored e2e test source inline, immediately before
the JSON handoff block, so the reproduction test is visible when browsing the
session.
Co-authored-by: Isaac
* docs(repro-agent): require the inline test be complete, not elided
The agent pasted the test with the body replaced by a `# ... (see full file)`
placeholder, defeating the point of showing it inline. Spell out that the inline
block must be the whole file byte-for-byte, with no truncation, summary, or
placeholder.
Co-authored-by: Isaac
* docs(repro-agent): cover passive/time/system triggers as journey steps
The journey rules leaned on active user actions (click, type, send), so for
lifecycle/timeout bugs (e.g. an idle-timeout teardown hang) the agent had no
"action" to anchor on and fell back to dumping the mechanism trace into the
journey field. Spell out that passive triggers — waiting through a timeout, a
runner shutdown, a network drop — are journey steps, written as the observable
condition, not the code they run.
Co-authored-by: Isaac
* fix(runner): fall back to SDK/OIDC when managed mint fails due to expired proxy bearer
Host-launched runners start with a host-injected bearer
(RUNNER_INITIAL_AUTH_TOKEN) that expires after ~1h. When it expires,
_InitialAuthTokenFactory's fallback tries managed mint using
_last_initial_token as the proxy bearer — but that bearer is also expired,
so the Apps proxy returns 403 on every mint attempt. Previously 403 was
not in the decline set, so the factory stayed installed, returning None
forever and 403-looping on every callback.
Fix: introduce proxy_auth_failed on _ManagedMintTokenFactory, set when a
mint gets 401/403 with no prior successful mint. _make_managed_mint_factory
treats this the same as declined (returns None), so _make_auth_token_factory
falls through to SDK/OIDC auth instead of staying stuck on a dead bearer.
The _RunnerDatabricksAuth auth_flow also raises RequestError (not bare
request) when proxy_auth_failed, so the outer retry machinery can attempt
a credential refresh via the next path in resolution order.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix: re-resolve fallback in InitialAuthTokenFactory when proxy auth fails
The previous commit's RequestError path in auth_flow was wrong — it
propagated the error to callers without rebuilding the factory, so the
runner still had no credential.
The actual fix: when _InitialAuthTokenFactory's fallback factory has
proxy_auth_failed (managed mint 401/403'd on the expired initial bearer),
re-resolve the fallback without a proxy bearer so _make_auth_token_factory
falls through to SDK/OIDC auth instead.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix: skip managed mint on proxy_auth_failed re-resolve to avoid loop
The re-resolve after proxy_auth_failed was calling _make_auth_token_factory
without _allow_delegated_mint=False, so it could hit managed mint again
(no proxy_bearer this time), get 403 from Omnigent, set proxy_auth_failed
again, and loop. Use _allow_delegated_mint=False to go straight to SDK/OIDC.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix: log actionable databricks auth login hint when SDK credential is expired
When the host bootstrap bearer expires and the SDK/OIDC fallback also has
no valid credential, log an error with the exact command to re-authenticate
rather than silently returning None and dying with a generic 'check remote
server authentication' tunnel error.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix: avoid CodeQL clear-text logging flag on server URL in error message
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix: remove server URL from error log to resolve CodeQL finding
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
---------
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
Projects can now store a default base branch in their config, pre-filled
into the new-chat composer when naming a new worktree branch. The project
default takes precedence over the user-global default (Settings › Git),
falling through to it (then blank) when unset.
The field is shown only when the "Random worktree" default is on — a base
branch only forks a worktree — and is dropped from the stored config when
the toggle is off, so it can't linger as a stale invisible default.
Backend needs no change: projects.config is a client-owned JSON blob and
base_branch already flows through to worktree creation.
Co-authored-by: Isaac
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
Archiving hides a session from the default view, but the pinned label
persisted — so an archived session stayed pinned and would resurface as a
pinned row if later unarchived. Drop the archiver's own per-user pin when
the archive flag flips to true. Per-user scoped (only the requester's key
is cleared) and a no-op via delete_label when the session wasn't pinned.
The pin-clear runs after the label upsert (so a same-request archive+pin
can't re-add the pin) and after the archive stop (so a raise can't leave
the session archived-but-not-stopped).
Co-authored-by: Isaac
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
* fix(web): stop the transcript fighting the reader's scroll
Scrolling back through a conversation bounced. Three causes, all in the
transcript's scroll handling:
- HistoryAutoLoader wrote scrollTop after every history prepend. An
imperative write cancels in-flight momentum, so a page landing mid-flick
yanked the transcript — measured on a 1000-item session as 32 corrections
of up to 2083px, every one of them while the wheel was still moving.
Native scroll anchoring does the same job off the main thread; hand it
back by dropping [overflow-anchor:none] and the manual correction.
- The fetch fired 500px from the top, so the page almost always arrived
while the reader was already at offset 0 — where the browser stops
anchoring. Fire 2.5 viewports early instead, so it settles off that edge.
- Streamdown gives every code block a flat 200px intrinsic size under
content-visibility: auto, so offscreen blocks laid out at 200px and
snapped to their real height (108-1735px) on the way in, shifting the
text and resizing the scrollbar. Blocks under content-visibility are
also excluded from anchor selection, so this had to go first for
anchoring to work at all.
Perceived motion on a real 1000-item session, scrolling to the top:
direction flips 68 -> 11, scroll writes 32 -> 0, and a prepend away from
the top edge now moves visible content by 0px.
The scrollbar itself is replaced with a constant-height one: paging older
history genuinely lengthens the document, so a proportional thumb shrinks
a step per page while reporting a size it cannot know yet.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* test(e2e_ui): cover transcript scroll stability across history paging
Drives a real paginated transcript: parks at the bottom, escapes the
stick-to-bottom lock, then wheels up until older pages land, watching
whether anything assigns scrollTop and whether the scrollbar thumb ever
changes size.
Against the pre-fix ChatPage this reports writes of [53, 3851] and no
thumb at all; jsdom can show neither, having no layout, no scroll
anchoring and no compositor.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* test(e2e-ui): regenerate visual baselines
---------
Signed-off-by: dbczumar <corey.zumar@databricks.com>
Co-authored-by: omnigent-ci[bot] <294685417+omnigent-ci[bot]@users.noreply.github.com>
* fix(native): surface the upstream failure in the policy-eval relay 502
The runner's local policy-eval relay caught any upstream POST failure and
replied with BaseHTTPRequestHandler.send_error(502), whose stock http.server
HTML page carries no cause. The native policy hook truncates that page into
its fail-closed "Detail:", so an auth-refresh lapse (the refresh-capable
client raising "Databricks token refresh returned no token") reached users as
an opaque "server returned 502: <!DOCTYPE HTML>..." gateway blip. Emit a 502
whose plain-text body names the upstream exception so the blocked-turn reason
is actionable.
Does not change the token-refresh behavior itself; that failure is tracked
separately.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(native): keep the policy-eval relay 502 detail intact and logged
Address Polly review feedback on the upstream-failure 502 body:
- Truncate the failure detail before prepending the fixed prefix, so the
leading actionable cause always survives rather than being cut mid-reason
once the length cap is applied to the whole message.
- Log the full exception (with traceback) to the runner log alongside the
capped user-facing body, since the cap can drop a diagnostically useful tail.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
---------
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* feat(ci): gate duplicate comments behind a flag; add a manual dry run
Duplicate detection was commenting on every issue it triaged, including the
common case where it found nothing — "I did not find an existing issue that
confidently matches this report" is a bot announcing a non-event on the
majority of issues. The wording also leaked classifier internals ("candidates",
"automatic checks do not establish") and buried the one actionable line, the
issue link, under two sentences of hedging.
Turn commenting off by default while the classifier is calibrated, and add a
`workflow_dispatch` dry run so a decision can be inspected against any issue
without writing to it. Detection and labeling are unchanged, so the workflow
log still records every verdict and confidence.
- `ISSUE_TRIAGE_POST_DUPLICATE_COMMENTS` (default false) gates commenting; a
`none` verdict now builds no comment at all, so enabling it only ever speaks
up when there is an issue to point at.
- Manual dispatch takes an issue number plus `apply_labels` / `post_comment`,
both defaulting off. It classifies as an `opened` event so the full duplicate
path runs, and logs the comment it would have posted.
- Reword both remaining comments to lead with the issue link and drop the
internal vocabulary. The closing case now carries the model's own one-sentence
reason instead of a fixed string.
The model's reason derives from untrusted issue content, so it is sanitized
before it reaches a public comment: URLs replaced, mentions stripped of their
`@`, issue refs generalized, one sentence, length-capped. Previously no model
prose was ever posted, so this is a new surface — covered by tests asserting an
injected mention, link, and issue ref cannot survive.
Signed-off-by: Pat Sukprasert <pattara.sk127@gmail.com>
Co-authored-by: Isaac
* fix(ci): make the triage dry run actually write nothing
Review on the dry run found three ways it could still mutate the issue it was
only supposed to inspect.
The `post_comment` gate used an Actions `a && b || c` ternary. Those return the
operand value, so a false middle operand falls through to `c`: dispatching with
`post_comment=false` evaluated to the repo variable and posted for real
whenever commenting was enabled. Pass the dispatch inputs through raw and
combine them in Python instead — the same shape would have been a latent trap
for every future boolean input, not just this one.
Only the label edit was gated, so a dry run still assigned the issue via both
assignment paths, and closure was gated by the repo variable alone — a dry run
against a duplicate could close it. Assignment and closure now ride on
`apply_labels` too, so with both inputs off nothing is written at all.
Sanitizer gaps on the closing reason, all reachable from untrusted issue prose:
`@@admin` matched the second `@` and left the first, rendering a live mention;
scheme-relative `//host` links stayed clickable; `GH-999` cross-linked. Match
`@` runs, add `//host` and `GH-<n>` to the patterns, and keep `50//50` prose
intact via a lookbehind.
Also rename `test_public_comment_uses_templated_reason` — it now asserts the
non-closing comment carries no model prose at all.
Signed-off-by: Pat Sukprasert <pattara.sk127@gmail.com>
Co-authored-by: Isaac
---------
Signed-off-by: Pat Sukprasert <pattara.sk127@gmail.com>
* fix(web): keep Pinned and Projects sections independent of the session filter
The sidebar's session filter (All / My sessions / Shared / Archived) is meant
to re-scope only the flat Sessions list, but the Pinned and Projects sections
were derived from the filtered slice, so switching filters emptied them:
- A pinned shared session vanished from Pinned on "My sessions", and a pinned
owned session vanished on "Shared sessions".
- The Projects group and its folders disappeared entirely on the Shared and
Archived tabs.
Both sections are now built from the full non-archived set (notArchived), so
they always show every pin and every project folder regardless of the active
filter. Only the flat Sessions list still re-scopes with the filter.
Add e2e UI coverage (multi-user server) asserting the Pinned section holds
owned + shared pins across My/Shared/Archived, and the Projects group + folder
survive the Shared/Archived filters. Update the mocked Sidebar unit tests to
match the new behavior.
Co-authored-by: Isaac
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
* fix(web): gate project-folder membership on ownership
Filing into a project is owner-only (unlike pins, which are ownership-
agnostic), but the project membership filter matched the legacy omni_project
label by project NAME alone. Since projectGroups now scopes to notArchived
(which includes sessions shared with the viewer), a shared session whose owner
used a project name colliding with one of the viewer's folders would be pulled
into that folder — and dropped from the flat Shared list via filedIds.
Gate membership on isOwnedByViewer so a folder only ever holds the viewer's
owned sessions, matching the owner-only filing model. Fix the two misleading
comments (Projects are NOT ownership-agnostic; Pinned shows every non-archived
pin). Add unit + e2e coverage for the project-name collision.
Co-authored-by: Isaac
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
* test(web): move mixed-ownership Delete-count test to the flat list
The ownership guard on project-folder membership makes a folder owner-only, so
a folder can no longer hold another user's session — which was the premise of
the mixed-ownership Delete-count test (it seeded a foreign session into a
folder). With the guard, that foreign row now also renders in the flat Sessions
list, so the folder-based setup produced a duplicate "theirs" row and the query
threw.
Mixed ownership legitimately arises in the flat "All sessions" list (own +
shared), where the owned-count Delete label logic is identical. Re-seed the test
there instead of a project folder.
Co-authored-by: Isaac
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
---------
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
* fix(claude-native): keep the working indicator alive across turns
Claude's `sessions/<pid>.json` is rewritten only when its value *changes*, so
a turn that starts while the file already reads `busy` produces no write at
all. Because the file poller muted the PTY watcher whenever it resolved,
nothing could publish `running` and the session sat on a stale `idle` for the
whole turn — no spinner and no stop button in the chat view, while the
terminal tab showed the live TUI. Nothing else can rescue it: for a parent
claude-native session the server deliberately does not publish `running`
optimistically, and the hook map carries only Stop -> idle / StopFailure ->
failed.
- resource_registry: the PTY watcher is never muted — pane activity always
publishes `running`. A quiet pane defers to the file only while
`asserts_running` reports it fresh, so a `busy` left standing by a
background task can't pin the session to running either.
- resource_registry: the publish-dedup moved onto the registry so a
forwarder's hook-derived edge rebases it. Without that the watcher still
believes its own `running` is live and swallows the next turn's edge.
- status_file: an unrecognized literal now drops the dedup baseline instead
of silently consuming the transition, and `asserts_running` finally
consumes `statusUpdatedAt`.
- Surface Claude's `waitingFor` through a new optional `waiting_for` field on
`session.status`, so a session parked on a dialog the web UI doesn't mirror
reads "Waiting: permission prompt" rather than a bare spinner.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* test(e2e_ui): cover the parked-reason working indicator
The E2E UI Required judge flagged that the working-indicator change ships
only unit tests. Add the Playwright test it wants, alongside the existing
`test_working_indicator_*` siblings: a turn in flight shows an ordinary
label, a `waiting_for` edge names what the agent is parked on, answering it
drops the reason, and the turn ending clears the indicator.
Driving that end to end needs the reason to survive the route a native
forwarder actually posts to, so `external_session_status` now carries
`waiting_for` too — the relay path already did.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* refactor: rename the parked-reason field to blocked_on
`waiting_for` sat one word away from the `waiting` session status, which
means something unrelated — the turn ended and only background work remains
— and which must never be reused for a parked agent. `blocked_on` states
what the field is for and removes the collision.
Renames the field end to end (`blocked_on` on the wire, `blockedOn` in the
web store) and the label it drives, now "Blocked on: permission prompt".
Claude's own `waitingFor` key keeps its name where we read it — we translate
it into our vocabulary, as we already do for its busy/shell/idle literals.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
---------
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix: use online serving for issue classification
Signed-off-by: Pat Sukprasert <pattara.sk127@gmail.com>
* docs: explain community issue prioritization
Signed-off-by: Pat Sukprasert <pattara.sk127@gmail.com>
* docs: fold issue prioritization into contributing guide
Signed-off-by: Pat Sukprasert <pattara.sk127@gmail.com>
---------
Signed-off-by: Pat Sukprasert <pattara.sk127@gmail.com>
* fix(codex-native): point the exit resume hint at the session /new rotated into
Running a native `/new` in `omnigent codex` starts a fresh Codex thread, and
the forwarder rotates Omnigent ownership to a new conversation (recorded in
bridge state). Both CLI run paths still echoed the launch-time `prepared`
session id on exit, so the printed `--resume` command pointed at the session
the user had already cleared away from.
Read the active id from bridge state, falling back to `prepared.session_id`
when no rotation happened — matching what the Claude wrapper already does via
`read_active_session_id`.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix(tests): repair stale helper name in claude-sdk replay redaction test
`test_historical_image_source_block_is_replaced_with_compact_placeholder`
imports `_render_prior_content`, but the function is named
`_render_prior_content_blocks`. The ImportError raised at class scope crashes
the pytest-xdist worker outright (`AttributeError: 'tuple' object has no
attribute 'value'` inside pytest's unittest plugin), so the whole
`Pytest (inner-rest)` shard fails with an INTERNALERROR rather than a normal
test failure.
Use the real name, and join the returned content blocks via the existing
`_text_of` helper since it returns blocks rather than a string.
Verified the test still guards the behavior it was written for: disabling the
base64 `source`-block arm of `_redact_inline_base64` makes it fail, and
restoring it makes it pass. Full file: 122 passed (was 1 failed + worker crash).
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix(codex-native): stop auto-create from 409ing the /new terminal transfer
A native Codex `/new` starts a fresh thread in the SAME terminal, and the
forwarder rotates Omnigent ownership onto a fresh session before transferring
that terminal onto it. Binding the runner to the new session triggered
auto-create, and the resulting second `codex:main` made the rotation's transfer
fail:
terminal transfer failed: Terminal 'codex':'main' already exists for
conversation '<new>'
httpx.HTTPStatusError: Client error '400 Bad Request' for url
.../resources/terminals/terminal_codex_main/transfer
Because `transfer_terminal` is what calls `set_conversation_link`, the failed
transfer left the tmux `Omnigent: <url>` footer — and terminal ownership —
pinned to the superseded session while the web session streamed from the new
one. Rotation itself then aborted mid-flight.
Add the transfer-inbound guard codex was missing: skip auto-create when the
session's bridge already names a *different* session owning a live
`codex:main`, and let the transfer deliver the terminal. Claude and
antigravity already do exactly this
(`_claude_native_terminal_arrives_via_transfer`,
`_antigravity_native_terminal_arrives_via_transfer`); this is the codex mirror.
Verified live: `terminal_inbound=True` -> transfer 200 OK -> "rotated Omnigent
session after native thread switch", and the PTY-captured footer moves to the
new conversation id after `/new`.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
---------
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* feat(ci): auto-close duplicate issues
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
* fix(ci): improve duplicate candidate recall
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
* fix: search duplicate issues by terms
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
* fix: harden duplicate issue closure
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
* fix: preserve duplicate triage overrides
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
* feat: gate duplicate issue closure
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
* perf(triage): rank duplicates over the whole issue corpus
Keyword search was the real bottleneck on duplicate recall: across 11
recent issues it returned zero candidates for three of them and two or
fewer for four more, so the correct match never reached the LLM at all
(#4027's match was never retrieved). A query-dependent candidate set also
made IDF — and therefore the closure threshold — depend on what search
happened to return, so the same pair scored anywhere from 0.454 to 0.558.
Rank every issue in the repository instead. One `gh issue list` call
replaces the four search queries, fetches all 729 issues (open and
closed, so long-fixed reports stay discoverable) in ~10s, and scoring is
35ms. The candidate block sent to the model stays capped at 10.
Also strip code fences and traceback lines before tokenizing. Crash
reports share a long click/cli traceback template that scored unrelated
crashes at 0.79 cosine — above the close floor — which would have made
(DuplicateOptionError). Stripping drops that pair to 0.078 while genuine
repeats hold (#3359 -> #2993 stays at 0.956).
Co-authored-by: Isaac
Signed-off-by: Pat Sukprasert <pattara.sk127@gmail.com>
---------
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
Signed-off-by: Pat Sukprasert <pattara.sk127@gmail.com>
* fix(web): stop transcript images loading slowly and shoving the page
Attachment images took seconds to appear when opening a conversation, and
pushed the transcript down as they landed. Three independent causes:
The content route was `async def` but called `file_store.get()` and
`artifact_store.get()` synchronously, so every image read blocked the event
loop -- while every neighbouring route in the file already offloads with
`asyncio.to_thread`. Against an S3-latency artifact store, 8 images took
749ms fully serialized and *no* concurrent request completed at all, so the
SSE stream and the rest of the transcript load stalled alongside them.
Offloading both calls drops that to 111ms with a 0.5ms median ping.
Content is immutable per file id -- there is no update endpoint, only
delete -- but the route sent no validators, so every session load
re-downloaded full-resolution originals. A strong ETag plus an immutable
Cache-Control takes revisiting a conversation from 1.1MB to 0 bytes.
The `<img>` reserved no space, so it laid out at ~0 height and jumped on
decode. Nothing absorbs that growth: the chat scroller runs with
`overflow-anchor: none` because history prepends own the anchoring, and
PreserveScrollDistanceOnResize early-returns off iOS. A fixed-height
preview box, an absolute cap on the image (`max-h-full` cannot resolve
through the lightbox's auto-height button wrapper), and a non-wrapping
image row take the push from 469px to 0px.
Note: a message carrying several images now scrolls horizontally instead of
wrapping onto multiple lines; wrapping re-flowed as widths resolved and
still moved the page 264px.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* test(e2e_ui): cover the inline image preview holding its space
Asserts the layout guarantee the component tests cannot reach: jsdom has no
layout, so a unit test can check the box's classes but never that the image
actually occupies the space they promise.
Rather than race the network, the test renders the same seeded transcript
twice -- once with the image bytes aborted, once with them served -- and
requires the preview box and the reply beneath it to land identically. A
reserved box is the same height either way.
Verified it fails without the fix: the blocked render collapses the box from
180px to 16px and lifts the reply 164px.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
---------
Signed-off-by: dbczumar <corey.zumar@databricks.com>
LIMIT was 3 so the comment's wording could get its first real-world read on a
bounded number of PRs. It has now posted on 8, including three first-time
contributors, and reads correctly.
Keep a cap rather than removing it: it bounds how far a mistake in the wording or the
predicate can reach in a single sweep, and 25 is above the current flagged count so
it no longer paces normal operation.
The ready-for-review gate has no LIMIT and needs none: applying a label notifies
nobody and is trivially reversible.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
The gate had no author check, so it labelled maintainer PRs. Half the in-window PRs
are the team's own work, so labelling them halves the signal the label exists to
create: maintainers land their own changes and do not need routing into a review
queue. The nudge already exempts maintainers for the same reason, and the gate
should match it. Two of the four PRs labelled on the first enforcing run were
MEMBER-authored.
Detection uses both signals, like the nudge: a maintainer whose org membership is
private reads as CONTRIBUTOR, and one with write access may be missing from
.github/MAINTAINER. The file is read from the API rather than the checked-out tree,
so a PR cannot self-grant by editing it. Bots are skipped too.
Also skip closed and merged PRs. `is:open` in the search is index-backed and lags, so
a PR that closed in the last few minutes still comes back; the state we are handed is
now checked before writing.
Verified against production: 13 maintainer PRs now skip, and the two community PRs
already carrying the label keep it.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
The gate has run dry since it merged and its verdicts hold up: the PRs it marks
ready all reference an open issue, are not drafts, and are not waiting on their
author. Nothing else has ever applied this label to a fresh PR, so until now the
label could not be used as a review queue.
No LIMIT, unlike the issue nudge. Applying a label notifies nobody and is trivially
reversible, so there is no first-run blast radius to bound. A maintainer who removes
it is respected: the sweep will not reapply a label a human took off.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
Starting a session left the user on the landing screen for seconds after
hitting Send. The create POST doesn't answer until the host has finished
spawning a runner — a process boot, measured at 1.8-7.7 s — and the
screen navigated on that response. But the server writes the session row
and announces it on WS /v1/sessions/updates almost immediately, so the id
the UI is waiting for is available long before the response carries it.
Take the id from whichever arrives first. The chat page renders from the
id alone, so it opens right away and shows its own starting spinner while
the runner comes up.
The announcement can't be taken at face value, though: the stream carries
every session that becomes visible to this user — another tab, a
scheduled task, one just shared with them — with nothing tying a row back
to this create. And the id is not only the URL, it also keys the first
message handoff (setPendingInitialPrompt), so the wrong one would post
the user's message into somebody else's conversation. So the screen
matches the announced row against what it just asked for: never seen by
this tab, no parent_session_id, same agent_id, same host_id. The sandbox
path has no host to match on until the sandbox registers one, so it waits
for the response as before.
Winning on the announcement can't skip an error the user needed to see:
the workspace and agent are validated before the row is created, so a row
existing (and being announced) means the create already passed the checks
that produce a landing-screen error.
Measured end-to-end, click to session page open: 1862/2008/7664 ms ->
92/95/124/160/202 ms, with the create POST still in flight.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(claude-native): give scheduled /loop wakes their own marked turns
Cron and wakeup firings re-invoke Claude with no user transcript
entry, so each iteration's output inherited the finished turn's
response id: the web merged the whole loop into one ever-growing
bubble whose fold read a bare 'Worked' (mixed clocks yield no
duration) and popped the full history open at every iteration.
The forwarder now records a turn's Stop edge as a settle — activated
only once the transcript is quiet, so a delta-held final message
can't be mis-read as a wake — and assistant output still inheriting a
settled id opens a fresh turn behind a '[System: scheduled prompt
fired]' marker. Each iteration folds as its own 'Worked for Xs' row,
and the web latches a shown fold so the next wake's running edge
(Working shimmer included) can't pop it open; only the bubble's own
turn reviving re-expands it.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(web): keep a scheduled wake's early deltas out of the finished turn
A wake's first text deltas stream ahead of the transcript batch that
names the new turn. The stray-idle revive read them as proof the
FINISHED turn was still live — reopening its fold at every /loop
iteration — and their preview blocks glued to the settled bubble,
breaking its fold eligibility and inflating its worked-for span.
Terminal edges now stamp completedAt on the active response; a delta
arriving past the revive window (stray idles are contradicted within
seconds, wakes fire at 60s minimum) neither revives the turn nor
renders a preview — the message is retired and its text lands via the
authoritative item in the new turn's bubble.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(claude-native): close three settle-latch edge cases from review
- A batch holding the compact summary AND post-compaction output parsed
the resume against the still-armed settle, mis-marking it as a
scheduled wake: the reader now disarms the settle mid-batch at the
summary record.
- Promotion now defers on ANY item for the settling turn (a late tool
result can surface earlier than the delta-held assistant tail;
promoting on it split the turn's own answer into a phantom wake).
- The pending settle persists in the transcript cursor, so a forwarder
restart between the Stop edge and the quiet-poll promotion no longer
reverts the next wake to the merged-bubble rendering (the hook cursor
is already past the Stop edge and cannot re-derive it).
- completedAt is stamped in the remaining finalizers so the stray-delta
gate covers every completed transition, not just status-edge paths.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
---------
Signed-off-by: dbczumar <corey.zumar@databricks.com>
The check has run dry for a day, and its verdicts have been audited against live
GitHub twice: every flagged PR genuinely references no issue, every exemption is
legitimate, and the two PRs whose bodies mention numbers point at pull requests
rather than issues. No PR carries the dedupe marker, so nothing is double-nudged
on the first enforcing run.
LIMIT is 3 rather than 25. The first enforcing run is the only one where a wording
mistake is unrecoverable, and several PRs in the current window are from first-time
contributors, so bound the blast radius while the comment gets its first real-world
read. Raise it once the live comments look right.
Setting ENFORCE back to "false" returns to a dry run at any point.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
Two ways a PR could satisfy the issue rule without tracking any work, both found
on the first live run of the ready-for-review gate.
Quoted text counted. #4180 documents the bot's own comment, including the line
"`Part of #123`" inside a blockquote. #123 is a real issue, so the parser resolved
it and the PR satisfied its own rule. Fenced blocks had the same hole. Strip both
before scanning: quoted text is shown, not asserted. An unterminated fence
swallows the rest, which is the safe direction.
Closed and draft issues counted. A resolved issue is not tracked work and a draft
issue is not agreed work, but the resolver only checked that the target was not a
pull request.
Both checks now share one resolvesToOpenIssue. The gate previously carried its own
copy that tested only .pull_request, which is exactly how the two would drift on
what counts.
Note this drops #4095 from the ready set: its "Refs #3644" points at an issue that
has since closed.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* feat(ci): label fresh PRs waiting-for-review once they clear the bar
`waiting-for-review` had exactly one entrance: the handoff that fires when an
author replies to feedback. A PR nobody had touched yet sat in neither state, so
478 of 479 open PRs carry no review-state label and the label cannot yet be used
as a review queue.
A new sweep step applies it to PRs that clear the bar. The bar today is just
"references an issue", reusing pr-issue-link.js's resolution so the gate and the
nudge can never disagree about what counts. It is meant to rise: CI green, demo
present, Polly clean each become a predicate in `belowBar`.
Never applied to a draft, to a PR already carrying `waiting-on-author` (which
would break the mutual exclusion the pair relies on), or to a PR whose label a
human removed before, since a sweep that reapplies it hourly would be arguing
with the maintainer who took it off. Forward-only, sharing the issue-link
effective date, because labelling the whole backlog at once would bury the signal.
Ships dry-run. Verified against production with the label write rigged to throw:
26 PRs in the window, 4 ready, 20 below bar, 2 drafts skipped, no writes attempted.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* fix(ci): only treat a human removal as "not ready"
removedBefore matched any removal of waiting-for-review, ignoring the actor the
query already fetched. But waiting_on_author.py removes that label itself on every
waiting-on-author transition, since the two are mutually exclusive, so the bot's
own routine state change was read as a maintainer saying "not ready".
The effect was permanent: a PR that had been through one review round trip and then
ended up in neither state, which is exactly the gap this gate exists to close, would
never be re-labelled. Confirmed on a real PR from earlier today whose timeline
records "unlabeled waiting-for-review by github-actions[bot]".
Rename to removedByHuman and filter out [bot] actors. A missing actor fails toward
eligible, since a removal we cannot attribute is not evidence of intent.
Also make the label write per-PR so one failure no longer abandons the rest of the
sweep, matching the resilience close_stale_waiting_prs already has.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
---------
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* feat(telemetry): routing decision and setting-change events
Routing needs to be answerable after the fact: which arm the router
picked, whether it was applied, and what the user changed. Adds
``RoutingDecisionEvent`` and ``RoutingSettingChangedEvent`` plus a
``model_labels`` helper that reduces a model id to a family/tier pair, so
records stay useful without carrying raw model ids.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat(sessions): persist routing decisions and session warnings
A routing decision has to survive the turn that produced it, so the UI
can show what the router chose and — crucially — whether it was actually
applied. Adds ``RoutingDecisionData`` to the conversation entity with
store support, and a ``session_warnings`` module for the non-fatal
routing conditions a session needs to surface (router unreachable,
verdict not applied) without failing the turn.
Records are honest by construction: a decision that could not be applied
is stored with ``applied=false`` and its reason rather than being
dropped or reported as a success.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat(routing): session-start smart routing core
Adds the server-side routing core behind Smart Routing: an external
``task_v1`` route-options seam that offers the router the frozen arm menu
its scenario requires, maps a pick back onto a servable catalog id via
nearest-cost substitution, and derives the harness that can actually run
it. Routing settings become one value object on ``RuntimeCaps`` so every
consumer reads the same knobs instead of re-parsing config. Databricks
model discovery resolves catalog spellings deterministically so the same
endpoint is named the same way on every path.
Reconciled against main's catalog-driven routing:
- Main's ``_fetch_runner_catalog`` / ``_RunnerModel`` plumbing and its
cost-tier ordering are the single source of live model availability;
``fetch_runner_models`` remains the id-only adapter over it.
- Main's ``ModelIntent``-parameterized judge rubric replaces the
family-specific tier hints.
- Main's catalog wire-API check survives as
``_redirect_wire_incompatible_pick``, layered after the static
``_HARNESS_EXCLUDED_MODELS`` bar list. The two cover different things:
the catalog knows what an endpoint advertises, the bar list knows the
client-side rejections it does not.
- ``model_family_token`` defers to ``is_codex_compatible_model`` so the
GLM/Kimi delegate arms read as the codex family everywhere.
The static ``MODEL_LISTS`` table is retained, unlike main, because the
nearest-cost substitution needs a family cost ordering on paths with no
catalog in reach (hook scripts, pre-session creates).
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat(server): route sessions at start and expose the decision
Wires the routing core into session lifecycle. A session created in
Smart Routing mode is routed once, at start, from the first user message:
the verdict picks the harness and the model before the runner launches,
and pre-launch host model options supply the candidate catalog when no
runner exists yet. Later turns never re-route — a session's harness is
settled once so a conversation cannot change identity underneath the
user.
The decision is exposed on the session snapshot and event stream with
its applied state, so the UI can distinguish "the router picked X and we
are running X" from "the router picked X and we could not apply it",
rather than silently showing the request as the outcome.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat(claude): apply a routed model to Claude Code
A routed arm only matters if the harness actually runs it. Adds a Claude
model vocabulary that maps between router arm ids, catalog spellings, and
the ``/model`` names Claude Code accepts, and pins the CLI's family
aliases to the frozen task_v1 Claude arms at launch so the first turn's
switch can reach whatever the router picked.
The vocabulary reads its catalog prefixes from one definition shared with
the server seam, so the hook path — which cannot read server config —
cannot drift from it.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat(codex): apply a routed model to Codex
The Codex side of the apply layer: the native app server and executor
accept a routed model override and enforce it on the session they launch,
so a verdict that names a GLM/Kimi delegate arm reaches the CLI instead
of being dropped for the harness default.
Codex spawns with no routable signal skip the router outright rather
than routing on an empty prompt and recording a decision nobody asked
for.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat(routing): route sub-agent spawns from harness hooks
Sub-agents spawned by a native CLI never pass through the server's
session-create path, so they were unroutable. Adds hook scripts the
Claude and Codex CLIs invoke at spawn time, plus a runner-side router
that answers them, so a spawned child is routed on its own task text and
launched on the chosen model.
A child is only ever offered its parent's harness family: routing may
change which model a sub-agent runs, never which vendor it belongs to.
Hook commands run under ``python -I`` so a repo-local module on the CLI's
cwd cannot shadow the interpreter's own imports.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat(web): surface routing decisions and Smart Routing controls
Adds the Smart Routing harness option to new-chat, a routing chip that
shows the routed model on the session, a sub-agent routing row, and a
warning banner for the non-fatal routing conditions the server reports.
The chip reports what actually happened. When a decision could not be
applied it says so and names the model in use, instead of showing the
router's request as though it were the outcome.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* test(routing): cover the routing apply layer end to end
Adds the remaining routing coverage: the CLI's routing-client build, the
native Smart Routing create path, an end-to-end routing integration test,
and the discovery/override unit tests. Also updates the existing native
bridge, forwarder, and launch-arg tests for the model-override plumbing.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs(routing): record the routing design and verification state
Captures the plan the implementation followed, the per-CUJ verification
status, and the observed live-model state the harness bar list is derived
from — the gateway rejections that catalog metadata does not advertise.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: registry stamps — rebased-tree battery green, session-start verified live
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: re-sync CUJ walkthrough with the rebased tree
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat(routing): offer Smart Routing only where the apply layer can work
Smart Routing rewrites a launch's model through the Databricks AI Gateway,
so a host whose claude-native or codex inference resolves anywhere else
(Bedrock, a plain API key, the vendor CLI's own login) got an option that
could never take effect. Gate each surface on the fact that decides it.
The host already resolves this at launch, so reuse those resolutions as a
cheap config-only check — no process launch, no network — and report a
`gateway_inference` map alongside `configured_harnesses` on registration
and every readiness refresh. It rides the host frames into the store and
out through GET /v1/hosts. A host that never reports it sends `null`, and
`null` means unknown: nothing is gated away on older host builds.
Web gates the three surfaces independently, classified in the single
`smartRoutingAvailability` point as a new `not-gateway-backed` cause:
Configure Claude Code's Model row needs the claude family, Configure
Codex's needs the codex family, and the top-level Smart Routing harness
row needs both (it drives the five-arm menu).
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs(routing): record the gateway-backed availability decision
Plan §10 gains decision 9 (Smart Routing offered only where the apply
layer can work, with the per-surface rule and the absent-means-unknown
compatibility contract), and §8 gains the two follow-ups it defers: a
liveness probe, and moving the routes:select call host-side so routing
auth/workspace always matches the host's inference.
CUJ_STATUS gains recipe R9 (point a host at a non-AIGW config and assert
the option disappears) plus one pending check row per gated surface.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: rewrite the CUJ walkthrough in simplified technical English
Rewrite designs/CUJ_IMPLEMENTATION.md in ASD-STE100-inspired Simplified
Technical English so every sentence parses one way only: active voice with a
named actor, simple tenses, one statement per sentence, noun clusters of at
most three words, and lists for any sequence of three or more steps. Add a
six-term glossary (arm, seam, pane, rollout, canary, spelling) to the intro.
Remove the hard 80-column wrapping so each paragraph is one soft-wrapped line.
No facts change: every sha citation and every file:line reference is
byte-identical to bc4b6c0.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: stamp the gateway-inference positive half
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: keep the routing design docs local-only
The four routing design documents (plan, test registry, CUJ walkthrough,
live model state) stay on disk for local reference but leave version
control — they are working notes, not reviewable deliverables.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(routing): serve turn routing the launch-exact claude vocabulary
Two claude-path defects from the live verification round.
Turn-1 routing on a claude-native pane could substitute the routed arm.
`_native_turn_catalog` read `_model_options_cache` without consulting
`_model_options_stale`, so a catalog hydrated from the session's *host*
before launch (whose family aliases carry the workspace default) became
the offered vocabulary. With the launch pinning `opus ->
databricks-claude-opus-4-8` and turn 1 routing ~100ms later, the pinned
arm had no spelling on offer and the router substituted sonnet. Turn
routing now awaits a refetch from the bound runner's
`claude-model-options` endpoint — which reports the launch-pinned
aliases — whenever the cached entry is stale, and falls back to the
stale catalog when no runner can answer.
Every claude-native turn also 400'd with `invalid beta flag`: the ucode
gateway launch env never set `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS`,
and Claude Code 2.1.220 sends three flags the Databricks gateway
rejects (`prompt-caching-scope-2026-01-05`, `advisor-tool-2026-03-01`
and, under `ENABLE_TOOL_SEARCH`, `advanced-tool-use-2025-11-20`), which
fails the whole request. Set the knob on that path too.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(routing): no substitution arrow for prefix-only subagent raw picks
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(web): float the session warning banner over the chat
The session warning strip rendered in-flow between the chat header and
<main>, so a warning arriving mid-session pushed the whole conversation
down. Render it as an overlay instead, on the same positioning contract
as the chat header: anchored inside the chat column, below the header,
stopping short of the workspace panel via --workspace-panel-offset, and
transparent to pointer events outside its own rows so the chat stays
scrollable. Multiple warnings stack downward inside the overlay.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(routing): gate the codex canary check on a real turn, clear it per launch
`subagent_routing_unenforced` was posted on codex-native sessions whose
routing hooks were in fact trusted and running. Codex dispatches
`SessionStart` (the canary) when a thread's *first turn* begins, but the
enforcement watcher's first-turn gate was released by any
`thread/status/changed → active` or `item/*` event — and the MCP startup
round activates the thread and emits items without running a turn. So a
session that had not been asked anything yet (or whose first turn was
interrupted before it started) failed the canary check 30s later. Live
evidence (session e6074fb1...): thread activated by the MCP startup round
at 13:58:06, warning posted at 13:58:36, and the canary file for that same
session/app-server finally appeared at 14:01:36 when a real turn ran —
proving the hooks were trusted and effective. The stale warning stuck only
because the runner was stopped before the repair tick.
Direct probes against `codex app-server` (isolated CODEX_HOME) also
disprove the "codex captures hook trust at process start" theory: trust
written after the spawn (the shipped ordering) takes effect, even for a
turn already in flight when `config/batchWrite` lands. The real invariant
is that trust must land before the first *turn*, which `start()` already
guarantees — now written down where it can be broken.
Second fix: the canary is the proof that *this* launch's hooks ran, so
`clear_bridge_state` now drops it. The per-workspace bridge dir is reused
across launches, and a canary left by an earlier launch masked a genuine
fail-open for the rest of the session. Transition-only posting still
clears a previous launch's warning on the new forwarder's first check.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(routing): clear the codex spawn audit per launch too
Same staleness class as the canary (51e36c8c): the audit is reconciled
against the routing decisions *this* launch's endpoint relayed, so a line
left by a previous launch — whose approving decision lives in that
launch's router — reads as a spawn the router never approved. The
per-workspace bridge dir is reused across launches, so `clear_bridge_state`
now drops the audit alongside the canary.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(routing): apply the glm arm under the gateway's model route
The task_v1 codex arm `glm-5-2` resolved to the catalog's
`databricks-glm-5-2`, which the codex turn then failed to serve: that
serving endpoint advertises chat-completions only and 400s on
`/codex/v1`. Probes on staging and prod (2026-08-01) show the Responses
API does serve GLM — but only under the gateway model route
`system.ai.glm-5-2`. GLM appears in no discovery listing, so the working
name can only be pinned, not discovered.
Add a per-model servable-alias map next to the arm tables and consult it
when an arm resolves to a servable id, so the codex apply layer writes
`system.ai.glm-5-2`. Subagent candidates are offered under the same
spelling, so a rewrite spawns with the id routing resolves to. The
router's arm id stays `glm-5-2`, and the alias strips to the same bare id
so decision records show no substitution.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: track the routing design docs again
Re-adds the plan (with the decision log), the test registry, the
enumerated CUJ walkthrough, and the codex model-state notes, all
current as of the post-verification state.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat(routing): route the model at create time for a fixed native harness
A native terminal launches with the session row and its turns originate in
the TUI, so the server never sees the first message pre-inference — the turn
gate that routes a plain claude/codex session never fires for a CLI-driven
one. Create-time routing existed only on the `harness_override: "auto"` path,
which picks harness AND model.
A create that carries `cost_control_mode_override: "on"`, a non-empty
`smart_routing_message`, and a FIXED native harness (claude-native /
codex-native, via the wrapper agent, `harness_override`, or the spec) now
routes its MODEL during the create: candidates come from the host's
pre-launch catalog for that one harness, the pick is constrained to it, and
the routed id is persisted as `model_override` with the routing-decision
label plus a session-scoped decision record. Fails open — an unconfigured
router, or a pick the harness cannot run, pins nothing and records the
reason, so the session still opens on the CLI's default model.
Session-start cadence is unchanged: the pinned model closes the per-turn gate
exactly as the auto path's create pin does. The branch is skipped for SDK
harnesses (which still route on their first turn), child and sub-agent
sessions, and a create that pinned its own model.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat(cli): route the model (and harness) before a native TUI launch
Smart Routing was web-only: a CLI user who wanted the server to pick a
model had to start the session in the browser. Add the two launch surfaces
Bryan asked for, both of which route *before* anything starts — the harness
pick is physical (a session is a live claude/codex process) and the model is
applied as a launch flag, so there is nothing to change after the fact.
- `omnigent claude|codex --smart-routing -p "<prompt>"` and
`run --harness <native> --smart-routing -p ...` route the model and keep
the requested harness.
- `omnigent run --smart-routing -p "<prompt>"` (no --harness, or
`--harness auto`) routes harness *and* model, then launches that wrapper.
One session, routed at create: the CLI creates it through the standard JSON
`POST /v1/sessions` (bound to the host it will run on, whose model options
are the router's candidate catalog) and the wrapper ATTACHES to it instead
of bundling its own. The row the server writes already carries the agent
binding, the wrapper's presentation labels, the routed model and the
decision card, so a routed CLI launch gets the same chip and provenance the
web UI does. The resolved harness is read from `SessionResponse.harness`;
native rows leave `harness_override` null on purpose.
`--smart-routing` requires `-p`: routing needs text, and the degraded
route-on-turn-2 mode is not shipping, so an empty invocation is a usage
error pointing at `-p` or the web UI. It also rejects an AGENT, the
REPL-only flags, and `--resume`/`--continue` (routing is a create-time
decision, so a routed launch is always a new session). Preflight
(`smart_routing_enabled` plus the host's per-harness `gateway_inference`)
is a hard error naming the reason, because a routed model the pane cannot
reach is worse than no pick; the create itself always fails open — the
wrapper then starts a plain session behind one notice line.
`omnigent claude` also gains `-p`, and claude/codex now accept a prompt
through `run --harness <native> -p` instead of rejecting it. The prompt
travels as argv (Claude Code's positional prompt; Codex keeps its existing
first-turn delivery), so multi-line prompts survive intact.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(cli): resolve the claude agent name from harness_plugins on this branch
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: PR rewrite plan — cut list, commit series, CLI integration
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* chore: track the isolated dev-stack scripts the test registry references
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: cover the glm gateway-route fix
907f8886 pins the id the glm arm is applied under: the gateway serves GLM
on the Responses API only as the model route `system.ai.glm-5-2`, so the
catalog's `databricks-glm-5-2` row 400s every codex turn. Record the
mechanics in CUJ_IMPLEMENTATION.md §3.5h (with the §1.3 spelling note and
the residual "pinned, not discovered" open item), and close the C1 /
§2.8 blocker in CUJ_STATUS.md against the live session 80fb6d1f: config
mirror and every rollout turn context on system.ai.glm-5-2, zero
BAD_REQUEST, real generation. The only error left on that thread is a
gateway-capacity 429, which is load and not routing.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: cover the CLI smart-routing entry points
`omnigent claude|codex --smart-routing -p` (tier 2) and `omnigent run
--smart-routing -p` (tier 3) were undocumented. Record the fourth surface:
CUJ_IMPLEMENTATION.md gains §6 (commands and tiers, prompt delivery,
preflight, the create-time MODEL route for a fixed native harness, the
create the CLI drives, rejected combinations, the routed launch, decision
persistence, and the agent-name import fix), and known-open moves to §7.
CUJ_STATUS.md gains recipe R10 and §2.10 — unit rows stamped from the three
suites that pass at HEAD, every process-truth row ⬜ because no routed CLI
launch has run live yet.
PR_REWRITE_PLAN.md §2d/§5 corrected: both CLI halves have merged, and the
tier-2 server half is already its own commit, so the commit-3/commit-8 split
is mechanical. The CLI commit did not extend `_resolve_native_smart_routing`
— the fixed-harness route is a parallel path — but it does share the auto
path's lifted `_routing_host_for_create` helper, which the assembler must
keep.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: track the PR review fix list (rounds 1-2, all items addressed)
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: high-level routing system map for slimming iteration
Add designs/ROUTING_OVERVIEW.md: a one-altitude map of the Smart Routing
feature — the four user journeys, the fifteen subsystems with size and
rewrite fate, the invariants that must survive any cut, and the five open
decisions. Written in ASD-STE100 style with block IDs so the slimming
pass can cut and keep by reference.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: fold Bryan's critique decisions into the rewrite plan
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: fold the model-resolution rulings into the plans; STE pass on the rewrite plan
Bryan ruled on the three open resolution questions (2026-08-01): revert
the resolution machinery to main's shape (cut MODEL_LISTS, the cost
table, the allowlist), drop pi from the routed set for now (bar list
goes with it), and use one fixed fallback model per family (claude ->
sonnet, gpt -> terra) with an honest decline behind it. The rewrite
plan is now fully decided and rewritten in ASD-STE100 style; the
overview's subsystem fates, invariants, and decision records match.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: finish the STE pass, restructure 3i to the three rulings, pin the fallback-id assumptions
Reconciles the fold-agent's late completion (it amended 0baeea1c
locally; this lands the same tree as a follow-up commit instead of a
force-push). The whole plan now meets the STE caps, 3i lists Bryan's
three rulings as ruled (pi had been displaced by a mechanism bullet),
and the open-assumption list grows to three: glm declines with no
fallback; terra is today only a pi-exclusion entry, so the code must
add it as a servable target; sonnet pins to databricks-claude-sonnet-5.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: luna is the gpt+glm fallback, sonnet follows the alias pin; add verification criteria (6c-6e)
Bryan's final fallback rulings (2026-08-01): the gpt and glm families
both fall back to luna (databricks-gpt-5-6-luna, itself a frozen arm,
so a glm fallback never leaves the codex harness), and the claude
fallback is whatever the sonnet alias pin resolves to rather than a
hardcoded id. Terra is out; glm no longer declines. No open
assumptions remain in the plan.
New plan blocks 6c-6e state the verification criteria: the evidence
bars per layer, the registry recipe handles (R0-R10; R8 dies with the
enforcement cut), and the per-slice verification gates for the fleet.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: switch the plan to a from-scratch rewrite (7g)
Bryan chose a complete rewrite from scratch (2026-08-02) to keep the
new code as clean as possible, reversing the plan's earlier 'assemble,
do not re-implement' constraint.
The scope decisions all survive; the method and the safety net change.
New blocks: 0c names the three inputs an agent must read before it
writes a slice (the behavior inventory, the trap list, and the
reference implementation on routing-mvp-v1), 0d says to rewrite the
shape but transcribe the empirically-derived constants, 3l reframes
the cut list as 'do not build', 4e contains the integration risk that
moves to the end, 6f records that no evidence transfers, and 7g is the
decision itself. 3j becomes a ceiling rather than a subtraction, which
also retires its old arithmetic gap, and 5b turns the two CLI commits
into specifications rather than patches to apply.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: request-time managed flag, parallel wave plan, and four scope reversals
Bryan's review of the rewrite plan (2026-08-02) produced five changes.
The managed preview flag is evaluated per request, not at
construction, and it moves out of 2a into its own block 2f: flag off
routes through the naive LLM judge, flag on routes through the AI
Gateway, so a flag-off workspace degrades rather than loses the
feature. That also dissolves the managed-swap report's objection.
The glm gateway route is codex work, not CLI work, and the Smart
Routing harness inherits it because it runs codex underneath.
Cross-harness spawning is reinstated: harness agents get
sys_session_create instead of a deny message (3c, 7i). Telemetry
leaves the PR entirely for a follow-up Bryan owns (3e, 7j). The design
docs ride the branch for his reference and a final commit deletes them
before merge, so no docs PR exists (3a, 7j).
Execution is now three waves of five or six parallel workstreams on
one branch, preceded by a lead-authored wave-0 contract commit that
declares every shared signature and pre-creates every shared touch
point (4a, 4b, 4e, 6a, 6e, 7k). Size is a preference for
reviewability, not a target (3j).
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: make the rewrite plan readable without session context
The plan hands off to a fresh fleet that has none of this session's
history, so the spec sections (0-6) now read as instructions rather
than as diffs against earlier drafts. Removed the negations of
assumptions a new reader never held (the glm route is "not CLI work",
managed readiness is "not 2a", 3c "reverses the earlier cut"), the
RESOLVED-with-date tags inside spec blocks, and references only this
session could resolve. Section 7 keeps the full decision record, which
is its job. Empirical findings survive the trim: the A-sub
deny-message result, the zero-live-triggers evidence, and the
authorization-order trap now cite the document that records them.
Wave design is now the lead's rather than a placeholder: a wave-0
contract commit, 7 foundation streams, 6 integration streams, and a
4-stream closure wave. The turn gate and the create paths move into
separate modules so they stop colliding in orchestration.py; web and
CLI move into wave 2 behind the wave-0 HTTP contract, which keeps the
two largest surfaces off the critical path. Barrier 1 gains a real
check (apply a hardcoded model to a claude pane and a codex session
with no router involved) and barrier 3 gains the flag-off backend row.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: clear the last session-only references from the plan
3g was still written as "rewrite, not transplant" against a suite the
fleet never sees, and it cited a commit's method rather than a rule.
It now states the rule directly: start from the behavior inventory in
CUJ_STATUS.md section 2, one test per behavior, coverage as the gate.
The reference suite is described as what not to copy and why.
Also replaced the two remaining "three review waves" references, which
name history a fresh reader cannot resolve, with "the reference
implementation".
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: close the cold-read audit's blockers on the rewrite plan
A subagent with no context from this session read the plan as an
executor would and found that its load-bearing inputs are unreachable
from the branch it tells you to start on. Confirmed and fixed.
Blockers:
- routing-mvp-v1 was an aspiration, not a branch. It now exists,
pinned at f200a8bd, and 0c/1a cite the sha.
- None of the required-reading docs, and none of the R0/R6/R9/R10
verification harness, exists on origin/main. Wave 0 now carries all
twelve paths across, or every stream stops at its first instruction
and both live barriers have no stack to run on.
- 2f never named the preview flag. It is managed-side
(databricks.mas.omnigent.intelligentRouting, default off), so OSS
gets a per-request predicate the deployment supplies, plus a
default; stream 2 builds the seam, not a flag system.
- The migration had two owners. Wave 0 creates the empty revision and
stream 4 fills it.
- The file partition existed only as a promise, and where implied it
double-booked subagent_routing.py. New block 4f is the table, with
named modules for the transport/policy and turn-gate/create-path
splits, and cli.py declared lead-owned.
Also: new 2g records what main already ships (both routing clients and
the wire-compat redirect), which shrinks stream 2; wave 0 slims the
registry so waves 1-2 are gated on a true list; 6d had R5 and R6
transposed; 6e dropped row B3 and now names CUJ_STATUS as the row
authority; barrier-1's apply script has an owner; the UI acceptance
names Bryan, since no agent can close it; and the size figures in 1a
and 3h are re-measured (29,924/155, and web/src minus its lockfile).
One gap only Bryan can close, now flagged in 6e: INTELLIGENT_ROUTING_
PLAN.md section 11.1 does not embed the P-SOL prompt, and rows A3, B2,
C2 need it.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: add LOCAL_SETUP.md; drop the stray npm lockfile
R0 documented how to run the stack but not how to build it, and two
things stopped a fresh machine cold: .omnigent-local/config.yaml is
gitignored, so run-server.sh exits immediately with nothing explaining
what belongs in it, and run-frontend.sh hardcoded this machine's nvm
path. LOCAL_SETUP.md now covers prerequisites, uv sync + pnpm install,
the databricks profile the router needs, the config template (with the
two details that break things quietly: system.ai. keeps its trailing
dot, and router_name must be task_v1), bring-up, a health check, the
known local quirks, and teardown. R0 points at it and wave 0 carries
it across.
run-frontend.sh now resolves node from PATH, falling back to the newest
nvm install, and fails with a pointer if pnpm is missing.
Separately: web/package-lock.json was tracked again after the rebase.
The repo uses pnpm (pnpm-lock.yaml, packageManager pnpm@11.15.1) and
main has no npm lockfile, so this was 3,451 lines of generated
wrong-package-manager noise in the PR diff. Untracked, deleted, and
gitignored so it cannot come back.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: record the personal CLI setup and the provider topology
LOCAL_SETUP.md covered the repo, but a fresh clone still does not
reproduce the environment: the whole Claude Code and Codex setup lives
in $HOME. New section 9 carries it - the three personal ~/.claude
files, the model-serving proxy mode and its refresh hook, the Codex
Databricks provider block and the five personal hooks that Omnigent's
generated hooks.json must merge with, the two secrets that have to
move out of band, and the transfer order.
Section 9.5 records the provider topology, which is easy to misread:
the global config's default provider is a Claude subscription, its
AIGW provider (the /ai-gateway/anthropic route, which is the Gateway
despite the path) is not default, and the worktree config is a
separate staging workspace. Measured with omnigent.gateway_inference:
global reports False for both families, the worktree True for both.
That measurement surfaced a real defect, now recorded in plan block
3f: the codex check reads the base URL Omnigent resolves, so a
kind: cli-config provider (which defers to the user's own
~/.codex/config.toml) yields None and is reported as not-backed rather
than unknown. False hides the Smart Routing option; unknown does not.
The rewrite must read the delegated config or report unknown.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* Trim routing PR: cut enforcement/telemetry/machinery, fix GLM effort + blank page
Wave-1 trim of the routing reference implementation, plus two live-caught
bug fixes and test trims from a parallel cleanup pass.
Cuts (per designs/PR_REWRITE_PLAN.md §3):
- Enforcement stack: canary, watcher, spawn-audit, warning banner,
session_warnings (3b). Hook generation + trust handshake kept.
- Routing telemetry: telemetry/routing.py, model_labels.py (3e).
- Fork-spawn exemption from the hook script (3d).
- Model-resolution machinery in smart_routing.py: MODEL_LISTS cost-ladder
(_cost_position, _ARM_SUBSTITUTES) replaced by a fixed per-family
fallback (claude->sonnet, gpt/glm->luna) + honest decline (3i). The
static infer_models catalog is kept: subagent_routing.py consumes it.
Fixes:
- GLM reasoning effort: GLM rejects xhigh; a routed GLM codex turn now
clamps effort to medium at every config-write and thread-settings point
(clamp_effort_for_model / effort_for_model_switch). Locked down in
tests/test_reasoning_effort.py.
- Blank-page crash: chipPendingBeforeRegion indexed past a shortened block
array on a stale cache (session switch / history reload), reading
undefined.type and unmounting ChatPage. Guarded + regression-tested.
Tests trimmed to the surviving surface; suites collect clean (2277) and
the core routing sets pass (266).
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* Remove unused `act` import left by the warning-banner test cut
The enforcement/banner cut removed the AppShell test cases that used
`act`, but left the import — oxlint (a pre-commit + CI gate) fails on it.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* Substitute an unservable arm within its model tier before the family fallback
task_v1's frozen arms name a model *tier* (claude-opus-4-8 is the opus tier,
gpt-5-6-sol the sol tier), not a specific servable id. When the workspace
serves a different model of the same tier — claude-opus-5 for a
claude-opus-4-8 pick — that model is the arm the router meant, so
substitute_model now applies it (highest version within the tier) ahead of the
family fallback. Only when no same-tier model is servable does it fall to the
per-family fallback, then decline. Still no cost walk: an unservable pick never
slides down to a cheaper tier.
Adds _model_tier (the id's last alphabetic segment, None for a bare generation
id like gpt-5-5) and _version_key (numeric version, higher = newer) to rank
within a tier.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* Route unnamed codex subagent spawns on a placeholder instead of inheriting
Codex encrypts the spawn message, so an unnamed codex spawn carries no prompt
to route on. It previously fell through to allow-on-the-parent-model ("No
routable signal … inherits the session model"). Route it on a fixed
"Codex subagent task" placeholder instead, so it lands on the router's floor
arm rather than the parent's possibly-expensive model — matching ucode PR 251's
default_task_label. Precedence is unchanged: a real prompt (claude) wins, then
task_name/agent_name, then the placeholder.
Tradeoff, recorded honestly: every unnamed spawn scores the same placeholder
and so gets the same floor arm — a cheap sensible default, not per-spawn
routing. A named spawn still routes on its task_name; empirically that field
has been null on every observed codex spawn, so the placeholder is the whole
fix in practice. Per-prompt codex subagent routing is not reachable while the
message is encrypted.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: design plan for in-harness first-message routing (follow-up)
Route the main agent's model on the FIRST real user message via a
UserPromptSubmit hook + loopback callback (the route-subagent pattern),
so a bare `omni codex` / `omni claude` launch still routes, and web UI
and TUI share one mechanism. Marker = conv.model_override (authoritative,
existing cadence semantics) + a bridge-dir fast-skip file. Apply reuses
the verified composer forward path: thread/settings/update-then-turn/start
for codex, locked /model-injection-then-send-keys for claude
(block-and-replay). Cross-harness selection stays outside; create-time
routing stays for prompt-ful launches and composes via the marker.
Grounded in LIVE_MODEL_STATE.md probes and the official Claude Code hook
docs (block erases the prompt and injected input then proceeds; no hook
output can change the model; 30s synchronous timeout). Four spikes
ordered before any product code. Not part of the trim PR.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: record the conservative ruling on in-harness routing
Bryan's decision (2026-08-03): keep both paths. The server/create-time
path is the UI path and stays as the primary; the in-harness hook is
additive, covering only what the server cannot see (a prompt typed into
the TUI on a bare launch). One decision seam, three triggers, arbitrated
by model_override so exactly one fires per session. The outside path also
stays because it shares route_session_harness with cross-harness
selection - it is the cross-harness code, not a parallel implementation.
The maximal collapse (hook as sole trigger, CLI tier-2 entry machinery
deleted) is recorded as a deferred phase gated on determinism evidence
from the spikes plus live use, requiring an explicit go.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* Point a routed spawn at a tool the session actually has, and say why
The redirect told the model to "Use sys_session_send with args.harness=,
args.model=" — parameters that do not exist on the tool it holds. Those are
sys_session_send's named-spawn mode, which ToolManager only advertises for a
spec with declared sub-agents; the native harnesses declare none, so their
send tool exposes only {args, session_id} and the instruction was
unfollowable. Matrix row A-sub recorded the result: the model read the deny
and abandoned the spawn.
Name sys_session_create instead, which a spawn:True harness does hold (both
claude-native and codex-native set it) and whose schema really does take
model, message, and agent_id. Lead with the user's own choice to enable Smart
Routing and state that the sub-task is approved, so the deny reads as an
authorized re-route rather than a refusal, and close with the concrete call to
make. The same instruction now backs the deny branch when the verdict names a
model, instead of a bare "Spawn denied by Omnigent smart routing."
The redirect tests assert the properties that matter — denies, names the
routed model, names sys_session_create, never names sys_session_send — rather
than pinning the prose.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: register the bundle-agent and GLM-subagent CUJs (2.11, 2.12)
Two new surfaces enter the registry per Bryan. 2.11: Smart Routing on
bundle agents (debby/polly) reaches routing only through the gear
config's brain-harness override - a different code path from the native
Model row, previously untested; rows cover the menu render, the right
model/harness selection, and the live apply. 2.12: codex GLM subagents,
which ucode PR 251 explicitly skips; rows track the three blockers
(static candidates, placeholder floor-arm, and the effort wall) with
the sys_session_create child path recorded as already working.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(web): keep the bundle-agent harness row visible under Smart Routing
Two bugs in the debby/polly gear-config flow when Smart Routing is picked
as the brain harness:
- Picking Smart Routing unmounted the Agent Harness dropdown that made the
pick (it was gated on !autoRouting), leaving a lone locked Permissions
row with no way to read the pick back or switch away without Cancel.
The row now stays rendered, ordered above Permissions, and the gear
tooltip mirrors both rows.
- A remembered fully-auto pick had no degrade path when the server turns
smart routing off: the modal showed a blank harness select while the
create still sent harness_override "auto". The bundle flavor now drops
the pick quietly, matching the top-level auto-native rule, and keeps the
stored pick in case routing returns.
Adds 15 vitest cases on real debby/polly (claude-sdk) fixtures covering
menu shape, pick persistence, payloads, per-agent memory, and the
degrade; updates the one existing test that encoded the unmount bug.
NewChatDialog.test.tsx 228/228; shell suite 1754 pass; tsc/oxlint/
prettier clean.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: flip the §2.11 bundle-agent rows to vitest-backed
The gear-config menu bugs are fixed and covered (1f99705f); the two render
rows move to 🟡 pending a user eyeball, and the first-turn row records the
payload half as vitest-verified with the live end-to-end still owed.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: record the spawn-family policy in the GLM-subagent CUJ section
Subagent spawns stay within the parent harness family; GLM is
codex-family (all codex subagents may spawn gpt and glm arms when smart
routing is on); the auto harness alone spawns cross-family.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat: let codex sessions spawn GLM subagents
GLM belongs to the codex spawn family: with smart routing on, every
codex spawn may target both the gpt arms and glm-5-2 (the auto harness
alone spawns cross-family; claude parents stay claude-only). Three
layers had to move:
- Catalog: databricks-glm-5-2 joins _CURRENT_GENERATION_MODELS[gpt], so
infer_models offers it and a routed glm pick resolves exactly instead
of substituting down to luna (this also removes the create-path C1
substitution arrow). Since no discovery listing ever advertises glm, a
live catalog row would still hide it — candidate_models now tops up
known-unadvertised arms for the gpt family only, nested spawns
included, without widening multi-model harnesses like pi.
- Vocabulary: codex's spawn_agent validates model ids client-side
against a closed enum of its own slugs, which silently killed EVERY
catalog-id rewrite, not just glm. New codex_model_vocabulary maps
catalog ids to codex slugs (databricks-gpt-5-6-luna -> gpt-5.6-luna)
and clamps spawn effort in agreement with clamp_effort_for_model; the
router hook rewrites through it and falls open when no slug exists.
- Catalog file: glm has no codex slug at all, so the executor reads the
installed CLI's own catalog (codex debug models, cached per binary and
CODEX_HOME per host process) and writes the session's private
model_catalog_json with a glm entry cloned from the cheapest arm,
carrying its own low/medium/high effort ladder — codex then clamps an
inherited xhigh instead of refusing the spawn. Every failure path
leaves codex on its bundled catalog.
Live-proven on the local stack: a native spawn_agent glm subagent off an
xhigh codex parent ran at system.ai.glm-5-2/medium and completed, with a
luna sibling in the same turn unaffected. Family policy pinned by tests
in both directions and both modes.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat: give codex spawn routing a real signal and honor explicit asks
Live verification exposed that no codex spawn could ever land glm even
with it offered: this codex's spawn_agent has no task-name field, the
spawn message was withheld from the router on a disproven encryption
premise, and an explicit model in the spawn arguments was overridden by
the placeholder-scored default. Every spawn therefore routed on the
19-char placeholder and landed the default arm (verified live: three
spawns, including one explicitly asking for system.ai.glm-5-2, all ran
gpt-5.6-sol).
- The codex hook now forwards the spawn message (plaintext in hook
payloads — measured) as the routing prompt via a new prompt_keys seam,
so the router scores the actual task and can pick delegate arms.
- The hook also forwards an explicit spawn model as requested_model. The
server honors the ask when it is an arm the spawn's own harness could
have been routed to (bare-arm match, so any spelling lands the
servable one); a cross-family or unoffered ask is routed over and
recorded truthfully as attempted_override. The honor is restricted to
the requesting harness's candidate row because a rewrite runs
in-place — an auto-harness session must not hand codex a claude arm.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: carry requested_model across the runner relay hop
The relay resolver rebuilds the route-subagent body field by field, so
the new requested_model never reached the server: live, a spawn that
explicitly asked for system.ai.glm-5-2 was routed to luna with no
attempted_override recorded. The relay test now pins every routing
input surviving the hop.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: close the §2.12 GLM-subagent rows with live evidence
All four layers verified on the shipping path 2026-08-04: glm in the
live spawn menus, exact in-family resolution, and a live glm subagent
(turn_context system.ai.glm-5-2/medium off an xhigh parent). Records the
two extra layers live testing surfaced: message-as-signal (spawn_agent
has no task-name field here) and honoring explicit in-family model asks.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(web): scope a bundle agent's Smart Routing brain to that agent
Picking Smart Routing as Debby/Polly's brain-harness renamed the whole
composer selection — chip, tooltip, and modal title all flipped to
"Smart Routing" as if the top-level auto harness had been picked, and
re-clicking the agent's own row silently dropped the brain. The two
flavors share no state (auto vs auto-native sentinels, per-agent
memory), but the derived autoRoutingSelected union was used for
identity, not just row gating.
Identity readers (agentLabel, triggerTooltip, configSummary, modal
title) now key on smartRoutingHarnessSelected alone; the union keeps
its one honest reader (the routing-seed skip) and a comment stating the
rule. The bundle modal shows the Agent Harness row alone (locked
Permissions belongs to the top-level flavor whose creates actually send
permission fields), the permission-reset effect and handleSelectAgent
key on the top-level sentinel only, and create payloads are
byte-identical in all four flavor combinations.
Tests: 292 pass across the three NewChatDialog suites — includes a new
"Smart Routing flavors are scoped separately" describe (mixed fixture)
pinning both leak directions, plain-create isolation, and the brain
surviving a re-pick; the old chip test that encoded the leak now pins
the fix; the two locked-Permissions tests moved to the top-level
flavor's describe. tsc/oxlint/prettier clean.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: add CUJ_MASTER.md, the consolidated routing CUJ registry
One doc merging the full CUJ_STATUS registry (matrix, recipes, tiers,
all section areas), the v4 in-harness routing phases (phase 1 landed
with evidence; phase 2 blockers), tonight's six live-feedback rows, and
a new adversarial section: 23 Breakage CUJs (X1-X23) grounding how this
setup fails for other people — missing/old CLIs, non-AIGW credentials,
router timeouts vs the hook ladder, hook-merge precedence, shared
bridge roots across worktrees, and the static glm fallback offering an
arm a workspace may not serve. Includes stack bring-up with a pinned
random-port convention, the R11 bare-launch recipe, a 112-row registry,
and a revisit list split by needs-human vs headless.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(web): honest subagent-routing display — fresh reads and gated chips
The gear modal's Subagent routing row could show Inherit while "on"
was stored: the override hydrates only at session bind (no SSE event
carries it, the session query never refetches), and the modal seeded
its draft once per open — so the row displayed a stale value and Save
could PATCH a value the user never picked. The row now holds a pick
that reads through to the live store value until touched, save() writes
only a pick that still differs from a fresh store read, opening the
gear re-reads the two override switches (refreshSessionOverrides — slim
snapshot only, so it cannot trigger the sticky-model PATCH), and a
session switch under an open modal re-seeds instead of writing the old
session's drafts onto the new one.
Per the user's ruling, native_subagent routing chips now render only
when the override is explicitly "on": on Inherit (or off) the chip
would advertise a setting the user didn't choose. Display gate only —
the decision rows stay persisted as the audit trail, and an inheriting
session's spawns are still routed server-side. Flip-side caveat,
deliberate: toggling the setting retro-hides/reveals historical chips.
453 tests pass across the three touched suites (display/write matrix,
stale-under-open-modal regression proven failing pre-fix, chip-gate
scope table); tsc/oxlint/prettier clean.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* test(web): unit-cover the sub-agent routing chip gate
Pins stripGatedSubagentRoutingChips at the unit level alongside the
composer-level coverage: explicit "on" keeps spawn chips, Inherit hides
them while the session's own (and legacy scope-less) decisions stay.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat: gate Smart Routing per harness on AI-Gateway backing
A harness whose CLI runs off a personal subscription (ChatGPT codex,
Bedrock claude) cannot run a routed pick — routing rewrites the launch
model to a gateway catalog id. Verified across four mocked credential
states (neither/claude-only/codex-only/both backed) and closed the
holes where routing could still be reached:
- gateway_inference: gateway_inference_state / not_gateway_backed read
a host's reported map under any harness spelling; unknown (older
host, unevaluable family) never gates.
- server create: the auto path refuses to route when either arm is
unbacked (no safe half-menu — the pick lands after the create
commits), and an explicit routing-on create pinned to an unbacked
native harness 400s with the way out named, instead of minting a
session whose routing silently never applies. Children and subagent
sessions stay with their parents' spawn/turn gates.
- CLI preflight: --smart-routing consulted only the server's host row
and silently proceeded when no host had registered — pinning a
databricks model onto a ChatGPT-backed pane. The launch always runs
on this machine, so the local gateway-inference map is now the
authoritative first gate, with the host row as fallback; the two
failure modes get distinct messages (no routing model configured vs
not AI-Gateway-backed).
328 tests pass across the CLI/gateway/create/routing suites, including
a parametrized A-D truth table over both arms and the auto route.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(web): require gateway backing for the bundle-agent Smart Routing brain
The Debby/Polly Agent Harness menu offered Smart Routing whenever the
server flag was on, even when this host backs only one model family
with the AI Gateway — the router could then land the session's work on
an arm that cannot run its routed model (a codex pane on a ChatGPT
subscription). The auto option now requires both families
gateway-backed, mirroring the server-side create gate. Gateway backing
only: unlike the top-level harness row, the bundle brain routes across
SDK harnesses, so native wrappers/CLIs are deliberately not required.
The gate drops only the OPTIONS entry — membership checks and the
summary label for an existing pick keep the unfiltered map, so a saved
pick still reads back honestly.
235 NewChatDialog tests pass, including the new offers/hides matrix per
gateway state; tsc/oxlint/prettier clean.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: make cross-harness spawn redirects actionable in native sessions
An auto-harness claude session's redirected spawn was denied with an
instruction naming sys_session_create — a tool the model could not find
(claude spells MCP tools mcp__omnigent__<tool>, schemas are deferred
behind tool search, and no allowlist pre-approved them), so it treated
the deny reason as prompt injection and refused. The omnigent MCP was
attached all along; the actuation was unreachable.
- The deny/redirect reason now names the requesting harness's own
spelling (claude: mcp__omnigent__sys_session_create; codex: the bare
name plus its omnigent.<tool> display form — verified empirically
against codex-cli 0.145: the flattened omnigentsys_session_create is
log-only and not callable), notes the tools come from the attached
omnigent server and may need a tool search, and degrades gracefully —
when the session's relay does not advertise the spawn tool, it tells
the model to do the sub-task itself instead of naming a tool that is
not there.
- Auto-harness claude launches (label or harness_override 'auto', both
metadata loaders) add --append-system-prompt with the routing note and
an --allowedTools list of the four redirect-loop tools
(sys_session_create/sys_agent_list/sys_session_send/sys_read_inbox —
the inbox read was live-proven required to close the loop); pinned
launches stay byte-identical, pinned sessions never see redirects.
- Auto-harness codex launches get the note as developer_instructions
(through the reversible sidecar sync) and per-tool
approval_mode=approve tables in the generated mcp_servers section.
Live-proven on the incident's exact shape: auto-harness claude parent,
spawn redirected to gpt-5-6-sol/codex-native, model called
sys_agent_list then sys_session_create, child session created on the
codex arm with parent linkage, result returned via the inbox, parent
reported it. Control session (pinned) carried neither flag. 229 tests
pass across the five touched suites.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: record the e2e sweep's evidence across the CUJ_MASTER registry
Overnight sweep on both stacks: 9/9 create matrix exact (the C1 glm
arrow is gone), GLM subagent rows live-proven including the effort
clamp firing, cross-harness redirect actuation end to end, codex
bare-launch 8/8 including crash durability, gating row 65 closed live,
1,627 pytest + 1,446 vitest with only the two accepted baseline
failures. Registry corrections from false greens the sweep caught:
deleting the routing block does not disable routing (only
provider:none does), the audit/canary rows are unreproducible since the
machinery was cut, the turn-path fail-open is silent, and several
recipe spellings fixed.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: switch claude models via the picker, never the global-default arg form
Every routed claude-native switch (and the web model picker) typed
'/model <arg>' + Enter into the pane — claude's arg form saves that
model as the user's GLOBAL default in ~/.claude/settings.json, caught
live rewriting the file during the e2e sweep. Ported the v4 actuator:
inject_model_selection submits bare /model, polls for the picker, walks
the cursor onto the target row, and presses 's' (session-only — proven
to leave the file byte-identical; Enter and digit keys both save the
default and are never sent), resolving exact catalog-id matches across
all rows before any alias match so a workspace serving two generations
of one tier lands the right row. auto_confirm's fixed 0.3s sleep is
now a dialog poll with a deadline.
The web path needed more than the executor's targets, caught live: the
picker dropdown sends tier ids, and this workspace serves two Opus
generations — 'opus' alias-matched the wrong row and the custom slot
(labelled by display name) was unreachable. Targets now come from the
session's resolved launch-config env (alias pins + custom slot + slot
name) merged under the bridge record; both cases verified live
('opus' -> Opus 4.8, the custom tier -> Opus 5, each session-only).
Live proof on the running stack, no restart (runners spawn per session
from disk): a routed opus-5 -> sonnet-5 switch and two web switches,
panes showing bare /model + 'for this session only', zero 'saved as
your default' lines in full scrollback, and ~/.claude/settings.json
md5-identical throughout. 640 tests pass across the seven touched
suites, including a tripwire that fails if the arg form ever returns.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat: let a spec hand its brain harness to Smart Routing
A spec that pins executor.config.harness also pins the family its
sub-agents are routed within, so a two-headed agent loses the head that
lives in the other family: debby's `gpt` sub-agent, declared on codex,
was rerouted onto claude-sdk and both heads answered as Claude.
Add executor.config.smart_routing_harness: auto, which opts a spec out of
its own pin for a Smart Routing session and converges on the "auto"
sentinel path the brain-harness picker already offers by hand. Gated to
Smart Routing creates only, and never over a client's explicit harness or
model pick, so a spec carrying the key is inert with routing off.
Set it on debby and polly, whose sub-agents span harness families.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat: two-state subagent routing, stamped at create — Inherit is gone
Per the user's ruling: a session that starts with Smart Routing routes
the subagents it spawns; everything else is Default, meaning whatever
the harness natively does. The tri-state inherit (unset resolving to
the session's own cost-control state) produced displays the user never
picked and a chip gate that disagreed with behavior.
- subagent_routing_enabled is now exactly override == "on"; the spawn
gate reads one explicit switch instead of re-deriving parent state.
- The server create handler stamps "on" once, for every path that
starts routed: top-level auto harness, bundle-agent auto brain, fixed
native harness with routing on, CLI --smart-routing (including v4's
bare in-harness creates, which send cost_control on), and children of
a routed parent. Unrouted creates store nothing; an explicit caller
value always wins; only "on" is ever stamped so ordinary creates
cost no extra write.
- One-time data migration stamps "on" onto existing rows exactly
where the old inherit rule resolved to routed (146 of 158 live rows),
so sessions in flight keep routing their spawns across the deploy;
downgrade is a documented no-op.
- The gear row offers exactly two options — Smart Routing / Default —
reading through to the stored value; a legacy null displays Default
and re-picking it writes nothing. PATCH keeps accepting explicit null
as an API-level clear; the UI never sends it. The chip gate's logic
is unchanged and is now an exact mirror of behavior.
181 python + 642 web tests pass across the touched suites (stamp
matrix, migration up/down, two-option UI, PATCH back-compat);
tsc/oxlint/prettier and ruff clean.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat: the router always decides a requested-model spawn — honor only on match
A spawn naming a model bypassed routing entirely ('honored — it is a
routable arm'), so the parent model's habit of writing a model field
starved the delegate arms: a dry-run subtask that the router scores to
glm ran on sol because the router was never asked. Per the user's
ruling, the requested model never short-circuits: the router is always
called, 'honored' appears only when its pick matches the ask (bare-id
normalized, [1m] folded), and a mismatch applies the router's pick with
the ask recorded as attempted_override — struck through on the chip
next to the applied model — and named in the codex parent's notice so
it does not silently re-spawn.
Claude-side asks now resolve through the session's alias pins before
comparison (a bare 'opus' never matched its own pinned arm and logged a
spurious override on every named spawn); inherit/default sentinels
carry no ask. The sys_session_send path's raw string compare gets the
same normalizer (a servable-alias respelling is not an override). On
router outage the spawn still runs on the ask (fail-open unchanged)
and the record now says so.
Accepted cost, signed off: an explicit ask — including a user-authored
'use glm' — is honored only when the router independently lands the
same arm; task_v1 exposes no requested-model input (live-probed: config
hints ignored, narrowed menus rejected). Follow-ups if wanted: a
requested_model field in the routing proto, or a session-level pin.
197 python + 40 web tests across the touched suites; live-probed
against the real router with match, mismatch, and no-ask shapes.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat: session Smart Routing is a create-time choice; the gear keeps one knob
Custom/SDK agents (Polly, Debby, and any non-native agent session)
lose the in-session Smart Routing toggle. It was already a near-no-op
for the session's own turns — the first routed turn pins
model_override, after which the toggle changed nothing — and its only
live effect was gating child spawns through a field the visible
Subagent routing row did not control. Per the user's ruling, Smart
Routing for a session's own turns happens once, at session start.
The Subagent routing row (identical copy, options, and testids to
native sessions) is now the single in-session routing control, and the
three server-side child-spawn gates (_force_auto_for_child, the SDK and
native parent-routing turn gates) plus the child create-stamp's parent
clause read the subagent-routing switch instead of parent cost-control.
Behavior-identical for every existing row via the create-stamp and the
e6f7a8b9c0d1 backfill (live DB verified: zero stranded cc-on/sr-unset
rows) — and picking Default now genuinely stops a bundle's spawns from
being routed, which the old pair of knobs never delivered.
isSubagentRoutingSession widens to all non-native top-level agent
sessions (their spawns go through the create path, which is
harness-independent), closing the pi-brain gap where the row vanished
mid-session. The gear tooltip drops its standalone Smart Routing line,
matching native.
189 python + 293 web tests across the touched suites, including
gate-flip cases proven to fail against the reverted server edits; full
web suite unchanged at 5005 passing.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* spike: codex UserPromptSubmit routing probe (S1/S2 scaffolding)
A marker-gated spike-userprompt subcommand on the codex policy hook:
logs every UserPromptSubmit payload to the bridge dir, and (behind a
one-shot marker file) fires thread/settings/update on the live thread
via the app-server websocket, optionally blocking the prompt. Inert
without the marker files. Kept as the working reference for the real
route-turn hook: the ws:// client framing, the second-command-per-event
wiring, and the trusted-module trick are all proven here.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: record the spike verdicts - Variant B disproven, Variant A verified
S1 FAIL, 3 runs with a bogus-model positive control: codex binds the
turn model at turn/start and writes turn_context before UserPromptSubmit
runs, so an in-window thread/settings/update only lands on the NEXT
turn. Variant A (block -> settings update -> replay) was then verified
end-to-end on codex: clean 1.08s abort, routed turn_context on the
replay, re-entrancy marker held, and the forwarder self-pins
model_override off thread_settings_applied.
S2 PASS: UserPromptSubmit fires for turn/start RPC turns with payloads
byte-identical to TUI-typed input; payload carries prompt + LIVE model
+ codex thread id (not the omnigent session id). S4 PASS: full hook
chain 0.37-0.78s; the settings call 26-77ms, wide margin under the 30s
budget. New trap recorded: never read the live model from config.toml
(stale on every read during the spike); take it from the hook payload.
S3 (claude block-and-replay UX) is the only spike still open.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* spike: claude UserPromptSubmit block-and-replay probe (S3 scaffolding)
Marker-gated spike-userprompt subcommand on the claude policy hook plus a
second UserPromptSubmit command in the bridge's settings generation. Inert
without the marker file. Kept as the working reference for the real
route-turn hook on claude: it is what proved the block leaves a clean
slate and the bracketed-paste replay is byte-exact.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: S3 passes - claude block-and-replay verified, all spikes closed
Block is cleaner than documented: input erased, reason shown, and nothing
persists (transcript logs only an informational preventContinuation row -
no user row, no model call; the omnigent conversation records nothing for
the blocked prompt). Replay is byte-exact including a real multi-line
prompt, submitted as one turn by the existing bracketed-paste injector.
The replay's fresh UserPromptSubmit no-ops on the consumed marker, and
/model does not fire UserPromptSubmit so the switch cannot self-trigger.
Three routed turns landed three different arms. Visible gap ~3-4s, the
/model settle dominating. No turn-2 fallback needed.
Records the actuator spec (poll for the Switch model? dialog, settle on
context.json - never fixed sleeps) and four claude-specific findings: the
hook payload has no model field, /model <arg> rewrites the user's GLOBAL
default (product blocker for the actuator, needs a decision), the /model
echo can make a weak model refuse the replayed prompt, and this
deployment's /model vocabulary is full catalog ids rather than bare
aliases. Also flags a pre-existing defect that bites the current branch
independently: inject_slash_command(auto_confirm=True) confirms the switch
dialog after a fixed 0.3s sleep, but the dialog took 1.861s with cached
history - the Enter is dropped and the next injection times out.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat: in-harness first-message routing for codex (phase 1)
A bare 'omni codex' launch now routes on its first prompt, wherever that
prompt comes from (TUI-typed or RPC-delivered) — the spike-verified
block-and-replay variant, productionized:
- omnigent/runner/turn_routing.py: the decision seam (wire types, the
route-once policy, loopback relay with advertisement + live-pid check,
and the runner-side replay that waits on the hook's done-marker and the
blocked turn clearing before redelivering through the normal events
path, which re-checks the gate and records no second decision).
- codex hook 'route-turn' subcommand: fast-skip on the marker, POST to
the loopback, thread/settings/update + config mirror, then block.
- POST /v1/sessions/{id}/hooks/route-turn mirroring route-subagent,
reusing route_turn / catalog / decision-chip plumbing.
- Registered as a second UserPromptSubmit command in the trusted policy
hook module; started/torn down beside the subagent router at launch.
- write_advertisement/read_router_endpoint gain a filename kwarg so the
loopback plumbing is shared with subagent routing, not copied.
The route-once gate is the routing-decision label, not model_override:
the codex forwarder mirrors config.toml's stale model into
model_override at the first turn/started, beating the hook, so presence
can't distinguish a real pin from the mirror. Residual gap (documented
in already_routed): a manual pin with Smart Routing on gets hook-routed
once; closing it needs pin provenance, left for phase 2.
Live-verified on the :64688 stack: trivial->luna, sprawling->sol, one
decision row and one user turn each; second turn fast-skips with zero
network. Spike scaffolding (spike-userprompt) removed. 96+69 tests pass
under the sanitized env run.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: make the blocked first prompt durable across runner crashes
Between the hook's block and the replay delivery the prompt existed
only as an in-memory asyncio task — a runner crash in that window lost
it forever while the decision chip, model_override pin, and done-marker
all said routing succeeded (exactly the dead-session shape reported
from live testing, reproduced with a SIGKILL at the marker write).
The relay resolver now writes turn_replay_pending.json before handing
the verdict back (on disk before the hook can block), clears it on
delivery or when the hook is known to have fallen open, and keeps it on
a failed delivery. On the next launch schedule_pending_replay_recovery
drains a leftover record: it requires the marker (proof the hook
blocked), waits for the relaunched thread, and only delivers after
confirming via the item history that the prompt never ran — an
unreadable session leaves the record for a later launch rather than
risking a double-run. A session_id match guards forks sharing a bridge
dir. Adds a turn_routing.log hook trace for diagnosability.
Live-proven on the spike stack: four fresh sessions routed on their
first prompt with turn-2 fast-skips, plus a crash-recovery run
(SIGKILL at the marker; relaunch recovered and replayed the prompt on
the routed model, record cleared). Investigation of the reported dead
sessions showed no prompt ever reached them (no UserPromptSubmit, no
events, empty rollouts) — the durability gap was the adjacent real
defect. 101 tests pass across the turn-routing and codex hook suites.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat: in-harness first-message routing for claude (phase 2)
A bare 'omni claude --smart-routing' launch now routes on its first
typed prompt, mirroring codex phase 1 through the same turn_routing
seam: claude-native joins _TURN_HOOK_HARNESSES, the claude hook gains a
route-turn subcommand (marker fast-skip, loopback POST with the live
model read from context.json, block), and the runner performs the model
switch inside the replay via _apply_routed_model — the composer gate
only forwards model_override in-band when it just routed, so a
hook-routed replay previously arrived with no model and ran on the
launch model.
The switch actuator drives the /model PICKER instead of '/model <arg>':
sandbox-proven that the arg form saves the pick as the user's GLOBAL
default in settings.json, while walking the picker with arrows and
pressing 's' switches 'for this session only' with the file
md5-identical across idle soak and clean exit (digit keys also save the
default and are never sent). inject_model_selection resolves exact
catalog-id matches across all rows before any alias match — a workspace
serving two opus generations otherwise lands the wrong row. The routed
composer path switches through the same picker, closing the global
default rewrite on every routed turn; auto_confirm's fixed sleep is
replaced by a dialog poll with a deadline.
CLI: --smart-routing without -p now creates the bare routed session
(cost_control on, no create-time route) and launches the TUI for
harnesses with in-harness routing; auto/no-harness still requires -p.
Spike scaffolding (spike-userprompt) deleted.
Live-proven on an isolated stack: five bare claude launches, trivial
prompts routing to sonnet-5 and a narrow task escalating to opus-4-8
(the pane held opus-4-8 AND opus-5 rows — the id-first matcher picked
right), one decision and one user message each, second prompts
fast-skipping with zero network, and ~/.claude/settings.json
md5-unchanged after every run. 364 tests pass across the touched
suites.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: drop the vestigial turn_router_dir kwarg that broke claude launches
A merge-resolution leftover passed turn_router_dir to
augment_claude_args, whose merged signature never gained the parameter
(the claude route-turn hook registers via bridge_dir and self-gates on
the advertisement at fire time) — every claude-native launch on this
branch died with a TypeError before the pane existed. Caught by the e2e
sweep's bare-launch row.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: apply the routed model to the codex thread in codex's own slug
The route-turn actuator sent thread/settings/update the raw catalog id
(databricks-gpt-5-6-luna). The turn ran — the gateway serves the id —
but codex has no catalog metadata for that spelling, so the pane warned
'Model metadata not found, defaulting to fallback' and /model kept
highlighting the launch slug, which reads as routing not working.
New codex_model_vocabulary (shaped like claude_model_vocabulary):
comparable_model_id folds catalog prefixes, the [1m] suffix, and
dot/dash spelling; codex_model_slug resolves the routed id against
codex's live model/list rows, so codex stays the vocabulary authority
with no hardcoded table. The actuator lists models on the client it
already holds, sends the matched slug, and mirrors the same spelling
into config.toml so the forwarder cannot flip-flop between spellings;
model/list failure or an unmatched id falls back to the id verbatim.
The decision row keeps the catalog id.
Live-proven: thread_settings_applied carries gpt-5.6-luna, zero
catalog-id spellings in the rollout, /model shows the routed row as
(current), no metadata warning for the routed model, one decision,
turn-2 fast-skip. 122 tests across the four touched suites.
Known siblings left for follow-up: thread/start still passes the
catalog id (the remaining launch-model metadata warning), and the
codex spawn path injects catalog ids verbatim.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* feat: gateway backing selects the router; the chip discloses the source
Gateway inference stops being a hide gate and becomes a source
selector. Every Smart Routing surface stays available; the AIGW
conditions decide which router answers each decision: the external
task_v1 client when it is configured and every family the decision
involves is AI-Gateway-backed, else the built-in judge
(LLMRoutingClient) when the server has one, else today's errors —
now reworded to name the real neither-source cause.
- New routing_backend seam: RoutingBackends holds both clients;
select_router picks per decision; caps carry both (routing_client
stays the primary for un-migrated readers). The CLI builds both, so
a Databricks deployment keeps its judge as the fallback.
- Off-gateway decisions never see the static databricks-* tables:
allow_static_fallback gates the infer_models fallback/top-up, and the
route declines rather than offer an id the pane cannot run (the two
hazard tests pin this seam-first).
- Decisions persist router_source ('databricks-aigw' | 'oss-llm');
/v1/info exposes smart_routing_sources; older servers degrade to
both-mirror-smart_routing_enabled in the CLI and web alike.
- The chip carries a small Databricks mark only when the AI Gateway
router answered ('Routed by the Databricks AI Gateway'); OSS and
legacy rows carry none; pickers are never branded.
- CLI preflight on an off-gateway family with a judge available prints
one informational downgrade line and proceeds instead of erroring.
- Setup doc and routing overview updated to the source-table semantics.
696 python + 336 web tests across the touched suites (21-test selector
truth table, the create-refusal splits, the /v1/info matrix, badge
render cases); ruff/tsc/oxlint/prettier clean. The 9 wider-run
failures are pre-existing snapshot-cache pollution, reproduced
identically on the clean parent.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* test: apply the routing test-suite overhaul and refresh the CUJ registry
Registry (designs/CUJ_MASTER.md): 4 rows + 1 recipe cut as fixed or
contradicted; the spawn-audit/canary rows retired-with-reason (the
machinery went with 484f7300 — deliberately out of scope, named in the
PR); row 95 re-entered as a picker regression row; ~22 rows updated to
today's ground truth (codex slug comparisons via comparable_model_id,
strict adherence, the spec-declared auto brain, the deleted standalone
toggle, source-selector semantics); 19 new rows in area O covering the
create-stamp matrix through the off-gateway static-menu decline.
Suites: the turn-gate tests renamed test_turn_routing_enabled_* so they
stop reading as the two-state spawn gate; the matching-ask pair and
five integration duplicates folded into their parametrized seam tests
with per-item duplication proof (122 -> 119 cases, no coverage lost).
25 new targeted cases: an AST-based guard module pinning that no claude
routing path builds '/model <arg>', the switch path holds no fixed
sleeps, the picker reads only the user settings file, and cursor/kiro
remain the only (documented) arg-form senders; hook-settings cases
pinning both routing hooks' timeouts above their script budgets and
coexistence with the policy hooks; the turn-routing timeout ladder
strictly decreasing and the router client inside the hook budget; the
two-concurrent-first-prompts and manual-pin-routed-once gaps pinned as
recorded decisions; migration edge cases (unparseable blobs, dangling
parents, idempotent re-upgrade).
744 + 364 + 192 sanitized pytest passes across the routing slice; web
suites re-confirmed green as baseline; ruff and pre-commit clean.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* test: add the e2e routing CUJ suite behind a mocked router
Five end-to-end CUJs — claude and codex from session start (API) and
from a typed first message (TUI), plus the auto-harness cross-family
redirect — each asserting the routing artifacts (decision rows and
their router_source, the pinned model, marker files, thread settings in
codex's own slug, pane state, message counts) and never answer content.
Two properties make it CI-shaped. The routing API is mocked: a
deterministic routes:select service replays the live router's own rule
traces (trivial -> cheapest arm, delegate-class -> glm, crosscutting ->
default/escalate) and keeps the real contract honest by rejecting a
narrowed menu exactly as staging does — proven against the real
ExternalRoutingClient over HTTP, not a hand-written body. And subagent
spawns are asserted as issued-and-routed rather than awaited, so no
test waits on a child's output or an inbox return.
21 pass in ~5 minutes; the suite is opt-in (smart_routing marker plus
OMNIGENT_E2E_SMART_ROUTING=1) and skips with a named reason when the
CLIs, tmux, or a provider config are absent. Each test boots its own
ephemeral server, host, temp DB and temp config home; the developer's
settings files are left untouched, which CUJs 1/3/5 assert by digest.
The CLIs are launched with their trust-bypass flag through
terminal_launch_args (the pattern tests/e2e/test_comment_tools_claude_native.py
already uses) because a fresh temp workspace otherwise blocks the input
box on a trust dialog before any hook can fire.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* chore: remove development-session scaffolding from the PR
Working docs (CUJ registries, plan documents, session setup notes),
the personal dev scripts (dev-env/run-server/run-host/run-frontend and
the routing-API probe), and their allowlist rows were session tooling,
not product: several named internal staging workspaces and proxy
endpoints, and none of them belong in a public repo. A test fixture's
profile string is generified for the same reason. The user-facing
routing documentation moves to the omnigent-site docs (PR #446 there).
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: settle the rebase against main's session-routes and model-picker work
Main split the session routes into explicit imports and grew a
host-resolved Codex launch-model catalog while this branch was out; the
replay needed both re-applied by hand.
- Import the names the routing paths use explicitly (`_logger`,
`_get_runner_client`, `_spawn_gateway_backed`, the validators) now that
`routes_hooks` / `routes_core` no longer star-import them.
- Keep the pre-existing `native_policy_not_enforced` banner: the trim
commit dropped its server half, but the runner still reports the
degrade reason, and main re-exports the helpers.
- Codex's Model row now carries the host's real catalog alongside the
Smart Routing sentinel instead of replacing it, with the resolved
default label back via a `defaultLabel` prop on `RoutingModelSelect`.
- Refresh the tests those two changes made stale, and re-apply the hook
timeout the dropped merge commits had fixed in place.
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: apply the external-review fixes and drop both new migrations
- Turn dedup compares decoded user-message text, not a JSON dump
- A no-op model pick is terminal: pinned and recorded without replay
- Child sessions route once; follow-ups cannot flip harness_override
- The turn marker is scoped to {session, decision}; the claude hook
reads the live session id, so /clear cannot reuse a stale marker
- Hook relays require LEVEL_EDIT; rationales log at DEBUG
- The turn router registers only when routing is enabled; codex model
catalog population runs off the event loop with a 60s failure TTL;
hook timeouts sit 10s above the inner HTTP timeout
- gateway_inference moves off the hosts table onto the host connect
handshake, held in server memory (unknown-is-backed until a host
re-reports); both alembic migrations are deleted — the PR adds zero
migrations
- Routing availability checks unified on the routing_backend helpers
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* test: gate the router's ambient-credential tests on the databricks extra
The new ambient workspace-credential tests patch
``databricks.sdk.config.Config``, but ``tests/server`` runs on a lean CI
lane that neither installs the ``databricks`` extra nor deselects marked
tests, so all eight failed collection with ``ModuleNotFoundError: No
module named 'databricks'``.
Mark them the way the repo already gates SDK-coupled tests, and list
``tests/server/test_smart_routing.py`` on the databricks lane — a marked
test in a path that lane does not cover would otherwise run nowhere.
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* revert: switch claude models with `/model <id>`, not the picker
Switching a live claude-native pane through Claude Code's interactive
`/model` picker took ~530 lines of tmux screen-scraping to avoid one side
effect: the argument form also saves the pick as the person's global
default in `~/.claude/settings.json`. The repo owner has accepted that
write, and an external review found the picker path fragile in ways the
argument form has no equivalent of — a 5s server forward budget against a
~35s worst-case automation whose result was discarded, an applied-check
that could return before the ~1.9s "Switch model?" dialog rendered, a
next-message-swallowed-by-dialog hazard, no busy-pane gate, no scroll
handling, and no concurrency lock.
So every claude model-switch call site goes back to injecting the text
`/model <id>` plus Enter through `inject_slash_command`, with
`auto_confirm=True` so the cache-invalidation dialog is still answered:
- the web/API `model_change` endpoint (`runner/app.py`),
- the first-message turn-routing switch (`runner/turn_routing.py`),
- the per-turn executor switch (`inner/claude_native_executor.py`).
Fail-open semantics are unchanged: a failed injection is logged and the
turn still runs on the pane's current model.
Deleted with their last caller: `inject_model_selection`, the picker's
open/apply poll ladders, the row regex and row scanner, the row-matching
and row-picking helpers, the session-only key, and the two runner-side
target-spelling resolvers. Kept: `inject_slash_command` and the polling
`_confirm_tui_dialog` (shared with `/effort`, and a real improvement over
the fixed 0.3s sleep it replaced), plus a single picker-footer string the
pane-readiness gate uses to notice a picker the person opened by hand.
The AST guards that forbade the argument form are gone; the "omnigent
never writes the user's settings file" and "no fixed sleeps on the switch
path" guards stay, since both still guard live code. The e2e settings
guard now compares everything in `~/.claude/settings.json` except the
`model` key Claude Code itself moves.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix(web): one routing chip per pick, hydrate the gear modal's Model row
A Smart Routing create routes twice: once at create time (recorded as a
`session`-scope chip) and again on the session's first turn (a `turn`-scope
chip). Both land before the user's message, both resolve to the same model and
harness, and both render the identical "Smart routing · applied · claude-native"
card — one above the message, one below. The transcript opened on a duplicate.
Collapse them in the block walker: a `session` chip whose next content block is
a `turn` chip with the same model, harness, applied flag, and agent renders
nothing, and the turn chip (the one that pairs below the message) stands for the
pair. Both rows stay persisted as the audit trail, and a create-time pick the
turn CHANGES — or a failed create-time route, recorded as an unapplied
`"unavailable"` row — still renders its own chip, because those two chips say
different things.
Also in the gear modal, the Model row rendered blank on a routed session.
Routing pins the router's fully-qualified pick (`databricks-claude-opus-4-8`),
which the harness catalog carries only under an alias (`opus`) — so no option
declared the Select's value and Radix fell back to its empty placeholder. The
live model now rides as its own option, labelled exactly as the status label
below the composer. An untouched row still submits nothing: `save` re-pins only
a draft that actually changed.
Three review findings:
- `useSession` asks for `refresh_state=true` on every fetch again. Narrowing it
to the cache-cold fetch meant an invalidation refetch — how switching a
session's agent reloads the snapshot — came back off the runner's process
cache, leaving the PREVIOUS agent's model catalog on screen until a hard
reload.
- Drop the 30s snapshot poll every open session ran. Its only consumer was the
session warning banner, which the enforcement-stack trim removed; nothing
reads a field the poll refreshes, so the poll and its opt-in options go with
it. That also makes the unconditional refresh above safe — nothing re-asks
often enough to thrash the runner's caches.
- `refreshSessionOverrides` no longer fetches through the query client. It reads
two plain DB columns, but writing the reply into the shared `["session", id]`
cache replaced every other surface's refreshed snapshot with an unrefreshed
one, dropping the `model_options` the model picker renders from.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: scope the codex routing extras to the sessions that need them
Three session classes now decide what a codex home carries: a plain
session gets a byte-identical pre-routing home (bundled catalog,
symlinked hooks.json, no spawn gate, no extra tool approvals); a
pinned-harness Smart Routing session adds only the extended model
catalog; an auto-harness session that routes to codex adds the spawn
gate and the cross-session tool approvals. The subagent router
endpoint starts only where something consumes it. The catalog probe
validates its payload and holds a lock across concurrent boots.
Dispatch validation accepts gpt substrings again and localizes
glm/kimi ids mechanically. The codex env filter now lets the router
and catalog launch signals through — the SDK-codex hook path was
silently dead without them.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: keep pinned codex launches free of routed-spawn extras
The runner passed `developer_instructions` to `build_codex_native_server`
for every codex terminal (with a `None` value on pinned sessions), which
changed the launch call shape for sessions Smart Routing does not own.
Pass the kwarg only for auto-harness sessions.
The claude-native launch-args tests handed a raw `tmp_path` to
`augment_claude_args`, which validates the bridge dir against the real
bridge root; point the bridge root at the test temp dir the way the
bridge's own tests do so the tests pass under any TMPDIR.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: satisfy the type and hardcoded-model gates
pyrefly on the pre-commit gate rejected five shapes the routing work
introduced: an inferred `dict[str, int | str]` hook literal that could
not take the route-turn entry, two `Awaitable` resolver results handed to
`asyncio.run_coroutine_threadsafe` (which takes coroutines only), and two
locals — `_parent_conv`, `_auto_harness` — read on paths where only a
narrower branch had assigned them. It also flagged the create path
rebinding `conv` from `get_conversation` without a `None` check, which
made every later attribute read an error; it now raises the same
`INTERNAL_ERROR` its sibling label writes do.
The router's static model tables moved to `omnigent/model_fallbacks.py`
as owned `StaticModelFallback` records — the repo's only sanctioned home
for a static model id, per the `no-hardcoded-models` lint. Ids that are
composed from the gateway's model-route prefix (GLM's `system.ai.`
spelling) are now spelled that way instead of restated.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* test: cover the Smart Routing UI in the Playwright suite
The web changes add user-visible routing surfaces with no e2e_ui coverage,
which the E2E UI Required gate flags. Two specs, following the suite's
established stub patterns:
- `start_session/test_smart_routing.py` — the landing picker's Smart
Routing row (create sends `harness_override: "auto"` +
`smart_routing_message`, and none of the placeholder wrapper's knobs),
Smart Routing as the gear modal's Model choice (create sends
`cost_control_mode_override: "on"`, no pinned model), and the negative
gate: a server with routing off offers neither.
- `chat/test_smart_routing_session.py` — a routed session's two audit
rows (create-time `session` chip + first-turn `turn` chip) render as ONE
chip with the Databricks mark, and the session gear modal's Model row
names the router's fully-qualified pick instead of rendering blank.
Both run against the suite's spawned server with `/v1/info`, `/v1/hosts`
and `/v1/agents` stubbed, so neither needs gateway credentials.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: match the gateway's trusted parents on DNS labels
The AI Gateway trust check compared the parsed hostname against
dot-prefixed domain suffixes with `str.endswith`. Correct as written (the
leading dot is what rejects `evilcloud.databricks.com`), but the safety
rests on a spelling convention in a constant, and a string-suffix test on
a domain literal is exactly the shape static analysis flags as incomplete
URL sanitization.
Compare whole DNS labels from the right instead, requiring at least one
label of the host's own in front of the parent domain. Same verdicts,
with the boundary now structural, and tests pinning both look-alike
classes: a trusted domain that only appears mid-host, and a label that
merely ends in one (`evilcloud.databricks.com`,
`ai-gateway.notazuredatabricks.net`).
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: stop the routing hook's codex floor from blocking every launch
Raising `_CODEX_MIN_VERSION` to 0.145.0 for the routing PreToolUse hook
made `harness_cli_installed("openai")` report `version-too-low` on
0.137–0.144, which makes `harness_is_configured("codex")` false, which
makes the host refuse EVERY codex launch — plain sessions included — with
a misleading "run omni setup". CI pins codex 0.139.0, so the e2e lane
failed on it too.
Restore 0.137.0 as the launch floor and enforce 0.145.0 only where the
spawn gate is actually registered: both codex hook writers now probe
`codex --version` and, on an older CLI, log one line and drop the routing
bridge dir so no hooks are generated at all. Routing no-ops instead of
blocking, and the user's hooks.json stays symlinked.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: confirm the /effort dialog instead of hanging on its title
`inject_slash_command(auto_confirm=True)` polled `capture-pane` for the
hardcoded "Switch model?" and sent Enter only on a match. The web UI's
effort change injects `/effort <level>`, whose confirmation dialog is not
titled that — so it never matched, the dialog stayed open, the change never
committed and the pane was wedged for the next injection. The no-dialog
case also spent the whole 4s poll budget where the previous code spent
0.3s.
Make the hint a per-command parameter and keep an unconditional confirm
Enter as the floor, which is what the code did before the poll was
introduced: on the no-dialog case it lands on an empty prompt and is a
no-op. The three `/model` sites pass the title they know and keep their
fast path; `/effort` passes none, settles briefly and confirms blind.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: keep the spawn-routing apparatus off plain claude sessions
claude-native passed `auto_harness=True` hardcoded and the SDK path started
the router for every claude session, so a plain claude session carried a
loopback HTTP server, its thread, a bearer token on disk, and a `Task`
PreToolUse hook — a subprocess cold start on native, in-process on the SDK —
on every spawn, with a 30-40s worst case when the endpoint is wedged. All of
it for a verdict the server would never route.
Gate both starts on the session's routing class, the same one the codex
paths already read. A plain claude session now gets no router, no hook and
no token file, matching plain codex; a routed session (pinned or auto —
claude routes spawns in both) keeps everything, and the per-spawn
server-side gate stays as defense in depth.
Accepted consequence: the class is stamped at create, so flipping the gear's
Subagent-routing toggle on for a plain-created claude session is inert until
the session is recreated. That matches the stamped-at-create design the codex
paths already follow.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: stop plain launches from displacing the model picker slot
`claude_config_with_launch_model_pinned` ran on every claude-native launch.
Whenever the launch model is an exact id no family alias points at — a user
picking an older generation of a family the workspace still serves — it
overwrote `ANTHROPIC_CUSTOM_MODEL_OPTION`, taking the workspace's own picker
row with it.
The slot exists so a routed session can return to the model routing picked
for it. Nothing re-picks the launch model on a plain session, so gate the pin
to routed launches and leave a plain launch's env untouched.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* test: restore main's spawn-env secret-leak canary
The trim commit deleted this file by name collision with the routing
spawn-audit canary; it is main's own guard for clean_agent_env and was
never part of this PR's machinery.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: keep the router rendezvous out of logs
The subagent- and turn-router startup logs printed the handle's url, and
the hook's rejection diagnostics echoed the url read out of the
advertisement. Both values travel with the bearer token that authorizes
the loopback endpoint, so a log line was enough to point a reader at the
secret's neighbourhood; static analysis flagged the four sites as
clear-text logging of sensitive data.
Drop the url from all four: the session id and the bridge directory (or
the advertisement's file name) identify the rendezvous well enough, and
the advertisement itself is on disk for anyone debugging it.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: confirm an effort dialog that renders after the blind Enter
A command whose dialog text we cannot recognise — ``/effort`` — settled
0.3s and then Entered blind. On a warm session the confirmation renders
about 1.9s in, so that Enter landed on an idle prompt and the dialog that
arrived afterwards stayed open: the person's next message was typed into
the modal and swallowed.
Keep the blind Enter as the fast path, then keep watching the pane for a
dialog until the confirm timeout and Enter again if one turns up. With no
dialog text to match on, the watch uses a structural signal — a framed
menu of at least two numbered choices with one selected — which also
recognises the ``/model`` picker and steps around a composer draft that
merely starts with ``2. ``. A dialog already showing at the settle skips
the watch, so the common cases still cost one capture.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: derive claude launch routing state through the shared class
Both claude-native launch-metadata builders hand-derived
``routing_enabled`` from ``cost_control_mode_override`` alone, while
``routing_class_from_snapshot`` deliberately ORs in the auto-harness
signal. A sub-agent child of a routed parent is created with
``harness_override="auto"`` and the auto-harness label but no
cost-control stamp, so it launched ``routing_enabled=False`` with
``auto_harness=True``: no pinned arms, no launch-model pin, no turn
router and no subagent router — yet still carrying the routed-spawn
system-prompt note and the four pre-approved ``sys_*`` tools. Claude was
told to hand its spawns to a hook nothing answered.
Route both builders through ``routing_class_from_snapshot`` so the class
is derived in one place, and require the spawn router to have actually
started before the note and pre-approvals go onto the argv.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: stop offering subagent routing where it cannot work
The create path stamped ``subagent_routing_override="on"`` on every
session that started on Smart Routing, and the gear offered the
Subagent-routing select to every native Claude/Codex session. On a
session pinned to codex neither is real: spawn routing there needs the
generated ``hooks.json`` and the routed-spawn tool pre-approvals that
only an auto-harness launch installs, so the switch read "on" with
nothing consuming it. The same went for a plain native session of either
family, whose apparatus is fixed at create.
Leave the stamp off for a pinned codex create, and hide the row wherever
the session's class has no spawn-routing machinery — a claude-family
routed session and any auto-harness session keep both. Non-native
SDK/bundle sessions are untouched: their children go through the
session-create path, which re-reads the switch per spawn.
Subagent routing is now launch-time-fixed for codex.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: make the model switch land once, or say why it did not
Three faults left over from reverting the interactive ``/model`` picker.
The web/API model-change handler typed the resolved catalog id straight
into ``/model``, which takes only the pane's own picker vocabulary. An id
outside it left the pane on its old model while the handler reported
success. Translate through ``claude_model_command_arg`` like the routed
turn path and the executor already do, and fail with a clear 503 when the
picker has no spelling for the model.
A routed first message switched twice. The turn router blocks the prompt,
types the switch and replays the prompt with the same override, but the
executor seeded its baseline from ``launch_model`` — written once at
bridge prepare — so the replay compared against the pre-switch model and
typed a second, redundant ``/model``. Seed from the live statusLine model
instead, and compare normalized.
A dropped forward was invisible. The PATCH persisted ``model_override``
and discarded the forward's result, so on a native pane — where the
injection is the only thing that moves the model — the row and picker
claimed a model the terminal was never on. Publish a visible notice and
log the reason. The forward budget also went up: the ``/model`` and
``/effort`` injectors can legitimately spend ~5s waiting on the pane and
its confirm dialog, which the old 5s budget would have reported as a
failure.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: clear the routing punch list's small residuals
- The install and credential routes recorded ``gateway_inference`` straight
off the host's RPC reply, so a host answering with anything other than a
string→bool object 500'd them inside ``dict(...)``. Decode through the
same tolerant reader the tunnel path uses, where a non-mapping is
"unknown".
- Reworded the routing docstrings that cited design documents no longer in
the repo; the behaviour they described is stated inline, and the e2e
suite in tests/e2e/routing/ is the executable reference.
- ``routing_enabled(caps=)`` read the routing backends directly, which
misses the managed arm where only a policy-LLM factory is registered and
the routing client arrives later. It goes through ``routing_available``
now, the same gate the rest of the server uses.
- The codex model-catalog cache was keyed on binary path plus codex home,
so an in-place upgrade (same path, new bytes) served the previous
codex's catalog for the life of the host process. The binary's mtime and
size are part of the key now.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: match the gear's comments to the narrowed subagent gate
The two comments still described the old "every native Claude/Codex
session" rule. Say which classes carry the apparatus and which the row is
hidden for.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* test: pin that the late-dialog Enter only answers our own dialog
The extra Enter is scoped to a dialog that appeared after the settle, so a
menu already open when the command was injected — a live permission
prompt, say — still takes only the single blind Enter this seam always
sent. That property is what makes widening the confirm window safe, so it
gets a test and a note rather than living in the reviewer's head.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: answer the effort dialog by name, not by shape
The effort confirm watch Entered on any dialog that turned up during its
4s poll, so a ``/model`` picker the person opened by hand — or a tool
permission prompt that rendered mid-turn — took the Enter too: the first
silently rewrites their global default model, the second silently
approves the tool.
Claude Code titles both cache-invalidation confirmations from one
component, so ``/effort`` has a title to poll for just like ``/model``:
"Change effort level?". Pass it as the effort call's ``confirm_hint`` and
drop the shape-matching watch — ``auto_confirm`` now requires a hint. The
timeout Enter stays, so a title that drifts in a future release does not
wedge the pane, but is withheld when the pane shows a picker or a
permission prompt. The readiness gate learns the effort title too, so an
open effort dialog no longer reads as "an injection may land".
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: suppress the codex subagent stamp only where it is inert
The create-time subagent_routing_override stamp was skipped for anything
whose harness family is "gpt". That also caught an SDK/bundle agent whose
brain is codex or openai-agents — and those spawn their children through
the session-create path, which re-reads the switch per spawn, so the
stamp is exactly what gives them default child routing. Skipping it took
that away, and disagreed with the gear, which offers the row on every
non-native session.
Suppress only where the switch really has nothing behind it: a NATIVE
codex terminal, whose spawn routing comes from the hooks.json and
tool pre-approvals an auto-harness launch installs. The server and the
gear now agree class by class: native pinned-codex hides the row and
writes no stamp; a codex-brained bundle keeps both.
The old fixture had no spec harness, so it never reached the family
check; the new case pins a codex-brained bundle on both sides.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: clear the routing punch list's last three residuals
- The "terminal was not switched" banner fired on stopped and detached
native sessions too, where nothing was running to diverge from: the
relaunch reads model_override off the row. Surface it only when a runner
actually answered and refused, which is the reachability the /health
liveness field reports.
- Add the credential route the tolerance test the install route got: a
host reply whose gateway_inference is a list must read as "unknown", not
500 with the credential already written. The install test never proved
that — its garbled value was dropped by the fixture before it reached
the frame — so both now inject at the proxy's return, past the decoder
that would otherwise normalise it away.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* test: drive the gateway-flip repush through the readiness loop
Upstream moved readiness refresh into its own task; the flip test now
exercises that loop directly instead of the removed tunnel helper.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: log nothing that addresses the router rendezvous
The redaction kept the session id and bridge path, which still name the
loopback endpoint whose advertisement carries the bearer token. The
start-up lines and the marker-failure notice now carry no values at all.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: make routing fail open in seconds, not in half a minute
Routing was already advisory everywhere it mattered, but the budgets meant
a wedged router still stalled the work it was supposed to get out of the
way of: a subagent spawn sat behind a 30s request inside a 40s hook kill,
and a first typed prompt sat behind 25s inside 45s. A fail-open that takes
that long is blocking in practice — the user cannot tell it apart from a
hang, and the turn they were promised runs no sooner for the wait.
Retune every routing ladder around one number: the routing call itself gets
5s, sized from the observed round trip (healthy routes:select answers in
~1.4-3s; the slowest sample on record was a gateway 500, not a verdict).
Each hop above it takes one more second, out to the harness-registered kill
at 15s (spawn gate 12s), which is now the only budget above single digits.
One attempt, no retry: a second try on an interactive path only doubles the
stall.
Two budgets on these paths were unbounded rather than merely long. The
built-in judge inherited the server `llm:` block's 300s request timeout,
multiplied by every configured fallback model, so picking the OSS router as
the source turned a fail-open into a multi-minute hang; it now shares the
external router's 5s. And the stale native model-options refresh, awaited
only to sharpen a routing candidate list, retries a booting runner for
~30s; routing now waits 3s for it and lets the single-flight finish filling
the cache on its own.
The CLI's preflight reads move off the create's 60s read budget too. They
answer in milliseconds and every failure already degrades to "unknown",
which does not gate, so there was nothing to win by waiting. The create's
own budget is left alone: that one is a session create, not a routing call.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: stop a routing outage from 500ing the turn it was routing
`route_turn` was the one routing seam that let its failure out. Its two
callers on the message path did not guard it, so a client that raised
instead of declining — a gateway 500 surfacing as HTTPStatusError, a read
timeout, a garbled body, a 401 — propagated to `POST /v1/sessions/{id}/
events` as a 500. By then the user's message had already been persisted, so
the turn was not merely unrouted: it was persisted and abandoned. Its
sibling `route_session_harness` has always returned an `error` string for
exactly this, which is what made the asymmetry easy to miss.
Add `route_turn_or_decline` as the turn path's fail-open boundary, in the
same `(model, verdict, error)` shape, and take the visible half of failing
open with it: the declined `routing_decision` card the auto-harness path
already emitted ("unavailable", applied=False) now covers the turn and the
native-pane paths too, so a session does not quietly ignore the toggle the
user turned on.
A failure deliberately does NOT stamp the routing-decision label. That label
is the route-once gate, so claiming it would turn one outage into the reason
the session never routes again — the failure is a card, not a decision.
Everything else audited on the routing paths was already fail-open and stays
untouched: the CLI's routed create and its auto-harness fallback, the
create-time server paths, the spawn-gate relay, both first-message hooks,
the loopback relays, both clients, and the model-switch application step.
The precondition gates that decline before anything starts are also left
alone — those are config rejections the owner asked for, not call failures.
Regression coverage for both properties (work proceeds, budget respected)
across gateway 500 / timeout / malformed body / 401 / unreachable relay, at
every call site: the SDK turn path, the native pane path, the spawn relay,
the first-message relay, both create paths, both hook scripts, both clients,
and the CLI's non-routing-400 fallback notice. Timing assertions are against
the ladder constants, never a wall clock.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: give a child spawn's failed route the same visible decline
`route_session_harness` returns its reason as an `error` string, and the
child-spawn branch of the message path unpacked it into `_route_err` and
then never read it. So the last routing path that could not route left no
card at all: the spawn ran on whatever the orchestrator had asked for, which
is right, but from the transcript "the router was down" and "the router had
no opinion" were the same thing.
Emit the same "unavailable" card the auto-harness and turn paths emit. Set
last, after the branch's own pin and publish, so nothing upstream can pin or
announce the placeholder — and leave the route-once label unclaimed, because
a child routes per spawn and `_child_routed_before` reads that label, so
stamping it on a failure would stop the child from ever being routed again.
The flag is renamed `_route_failed` now that both branches set it.
Also covers the bounded catalog wait: a stale-catalog refetch that never
finishes serves the stale vocabulary within `_ROUTING_CATALOG_WAIT_S` and
leaves the single-flight running to fill the cache for the next turn.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: let a pinned Smart Routing codex session actually spawn
Suppressing the create-time subagent-routing stamp for a native pinned-codex
session was justified on the theory that the switch would be inert there. It
was worse than inert: the pinned class was also withheld the spawn-routing
advertisement, and on codex that advertisement is what turns on the generated
``hooks.json`` ``spawn_agent`` gate AND the four routed-spawn tool
pre-approvals. A pinned Smart Routing codex session therefore had no spawn gate
and no pre-approved cross-session spawn tools, so its spawns did not merely go
unrouted — they stalled on an approval prompt nobody was watching.
Stamp every routed create again, and start the endpoint for a routed
codex-native launch whether or not the harness was auto-picked, which brings
the gate and the approvals with it. The codex SDK arm keeps the auto-harness
requirement: its spawns go through the session-create path, which already
routes off the stamped switch, so an in-harness gate would only add a round
trip. Plain sessions still get none of it.
What separates pinned from auto-harness is not whether spawns route but where
they may land: ``cross_harness`` stays ``auto_harness_session``, so a pinned
codex spawn is offered codex arms only and a claude pick is denied. The web
predicate now shows the gear's Subagent-routing row for exactly the classes the
server stamps.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: collapse a repeated routing verdict into one chip again
A Smart Routing create records its pick as a session-scope chip and the first
turn records the identical pick as a turn-scope chip; only the turn chip should
render. The pairing test asked whether the two decisions were ADJACENT, using
the same neighbour walk that decides where a chip sits relative to the message
it routes. That walk steps over exactly the blocks allowed between a chip and
its message, so anything else a booting session emitted between the two
decisions — narration, an earlier message, a whole finished response — read as
"unrelated" and both chips rendered.
Pair them by decision order instead: the next routing decision anywhere later,
across intervening blocks and turn-group boundaries. A turn chip that CHANGED
the pick, a declined create-time route followed by an applied one, and a spawn's
deny-then-honor pair all still render as two — the first two because the
verdicts differ, the last because a subagent-scope decision is never the
supersessor.
The incremental path had its own hole: the create chip is finalized into the
cached prefix frames before the turn chip exists, and the drop was computed only
from the walk's resume point, so a chip already in the prefix could never be
removed. The verdict set is now resolved over the whole transcript and
remembered on the cache, and a disagreement over the prefix forces the single
rebuild that removes the stale chip.
For the record, the resource_event in the reported transcript is not the
mechanism: an unknown item type yields no block from itemsToBlocks and
session_resource_created adds none on the live path, so it never separated the
two. The wire rows are kept as a funnel regression test regardless.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: keep a pinned session's spawns in its own harness family
A pinned Smart Routing codex session spawned a claude child and the router
pinned it to claude-sonnet-5: the in-harness spawn gate holds the in-family
line (candidate_models(cross_harness=False)) but the child-session route on
the native-terminal dispatch path had no such rule. It routed whatever
family the child's own pane ran, so an orchestrator that named another
family's wrapper agent got a cross-family spawn blessed by routing —
against the standing ruling that only an auto-harness session may cross.
The native child path now asks the same predicate the spawn gate does
(auto_harness_session(conv, parent)) and, for a pinned parent whose child
runs another family's CLI, routes nothing: no pin, no in-band /model, and a
declined chip naming the rule. The spawn itself still runs, on its CLI's
own model.
Also resolve a native pane's family from the terminal it is actually
running rather than an unresolved "auto" sentinel. The sentinel carries no
family, so a forced-auto child was offered every model its gateway serves
and could be pinned to one its running CLI cannot speak.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: render one routing chip per spawn, not two
One spawn produces two decisions — the in-harness gate sizes the task, then
the child session it created routes its own first message — and the
transcript showed both: one chip labelled "Session" (the gate row carries no
agent name) and one naming the spawned agent, with the same rationale. To
the owner that is one decision about one spawn.
The pair now collapses onto the child-session row, which is the informative
one: it names the spawned agent and the arm that actually ran, keeping the
gate's own pick visible as the router's raw verdict when a tier
substitution moved it (opus-4-8 -> opus-5). The two rows share no spawn id
— different decision ids, no agent on the gate row, minutes apart — so the
pairing key is the verdict: the same non-empty rationale AND the child
running the arm the gate picked. A deny-then-honor pair, two independent
spawns, and two genuinely different verdicts all still render as two chips.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* fix: name the cause on a routing decline that had none
A live decline read "Routing unavailable (router request failed: )" — a
dangling colon with the reason missing. httpx's timeouts stringify to the
empty string, so the exception the fail-open budget produces most often was
also the one that said nothing. Every routing failure string now falls back
to the exception class ("router request failed: ReadTimeout"), which is what
a 5s budget firing looks like.
The subagent gate had a second way to lose the cause: a client that raises
before it can record its own last_error left the chip saying only "router
returned no verdict", with the real failure in the server log alone. It now
carries the raised cause when the client reported none.
Co-authored-by: Isaac
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
---------
Signed-off-by: Bryan Qiu <bryan.qiu@databricks.com>
* docs: document the PR review process for contributors
The issue requirement, the review-state labels, and the 7-day close were all
built and shipped without ever being written down, so a contributor's first
encounter with any of them was a bot comment.
CONTRIBUTING now covers: that every PR needs a linked issue and how to link one,
what the two exceptions are, what `waiting-on-author` and `waiting-for-review`
mean and that automation manages both, and that a PR left waiting on the author
for 7 days is closed and reopenable with /reopen.
It states the 5 August 2026 cutover explicitly: maintainers follow this process
for new PRs, PRs opened earlier are being worked through separately and may not
carry the labels yet, and the issue rule does not apply retroactively. Without
that, a contributor reading the doc would expect labels on a 3-week-old PR and
conclude it had been dropped.
The bot's nudge is rewritten to match: it opens by thanking the author, says the
requirement applies to every PR rather than only naming what is missing, promotes
"open an issue first" to its own line, and closes the exemption loophole by
spelling out that a bug fix or feature needs an issue even when it also touches
docs or tests. A test pins that wording.
Also drops em dashes from the contributor-facing text in the workflows added
today, per house style.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* feat(ci): accept "Part of #N" as a tracked issue
GitHub only creates a link for the closing keywords, so a PR saying "Part of
#123" reads as unlinked to closingIssuesReferences and would have been nudged.
That punished the honest case: a PR that advances an issue without finishing it
had to either claim `Closes` (which closes an unfinished issue on merge) or take
the comment.
Non-closing references now satisfy the rule: Part of, Related to, Towards, Refs,
References, See. Closing keywords and sidebar links still work and are still
preferred, since only those close the issue for you.
Two limits keep it from becoming a free pass. A bare `#123` does not count, being
a cross-reference rather than a claim about this PR. And the reference must
resolve to an issue: "Refs #4147" pointing at another PR is not a tracking
record, which is the shape three PRs in the current backlog have.
Found because #4095 says `Refs #3644`, a real issue, and would have been flagged.
It escaped only because its author is a maintainer.
Verified against production: #4095 now satisfies the rule, and all seven currently
flagged PRs still flag.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
---------
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
Steering a claude-native turn mid-tool-use makes Claude write its own
"[Request interrupted by user for tool use]" record into the transcript
BEFORE the steering message. The forwarder mirrors both back as user
items, and `_persist_external_conversation_item` treated every mirrored
user message as the round-trip of a queued web message: it FIFO-drained
a pending-input entry and folded that entry's uploaded image/file blocks
into the item.
The interrupt record has no pending entry of its own, so draining for it
shifted the queue by a slot — the marker absorbed the queued message's
uploads and the real message persisted with none. In the web UI that
rendered as the raw marker text sitting beside the screenshots (the
system-marker gate bails out when a bubble has attachments) followed by
a blank bubble (the real message's absolute-path "[Attached: …]" markers
are stripped, and its file blocks were gone). It persisted that way, so
it survived reload.
Exempt the vendor CLI's own interrupt record from the drain. Runtime
"[System: …]" notices are deliberately NOT exempt: they are posted
through POST /events and record a pending entry of their own, so their
mirror-back must keep draining. The predicate matches on the first line
only, exactly as parseSystemMessage does web-side — a record the web
hides as a marker but the server drains for would reintroduce the bug.
chatStore's session.input.consumed handler had the same flaw on the live
path, so its FIFO-head fallback now holds back system markers too. A
"[System: …]" notice still lands on the drop-by-id branch via
clearedPendingId, so it is unaffected.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
Unarchiving from Settings -> Archived sessions left the user on the
settings page with no sign of where the restored session went. The row
simply vanished from the archived list, so bringing a session back took
a second step: find it again in the sidebar.
Navigate to /c/{id} once the unarchive PATCH lands, so the restored
session opens where the user expects it.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
Clearing the label and closing on it were automated; setting it was not. A
maintainer who left feedback without remembering the label got none of the
machinery -- no handoff back on reply, no 7-day clock.
Any non-approving engagement from someone with write access now applies it: a
review, a review-thread comment, or a PR comment. "Request changes" was too narrow,
since most feedback here arrives as a plain comment.
Deliberately excluded:
- approvals -- nothing is owed by the author
- slash commands (`/review`, `/reopen`, `/merge`) -- they drive automation rather
than ask for anything, so they must not flip a PR back to the author. Matched
only at the start of the body, so prose mentioning /review still counts.
- bots, and the author themselves even when they are a maintainer
Write access is read from the collaborator permission API, not the event's
`author_association`, which reports CONTRIBUTOR for a maintainer whose org
membership is private. It fails closed, so a stranger's comment never moves state.
Author activity still wins when both could apply, and applying the label clears
`waiting-for-review`, keeping the two mutually exclusive.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* fix(web): hold the transcript still while the composer grows
Adding a newline with Shift+Enter shunted the whole transcript down a
line, and the scrollbar and turn rail jittered along with it.
Two causes. The auto-grow hook reads its content height by collapsing the
textarea to `height: auto` — a one-row box. For the one layout that lasts,
the composer is short and the transcript's scroll viewport is taller, so
the browser clamps its scrollTop against the smaller maximum; the clamp
survives the composer springing back. Pinning the wrapper's height keeps
that collapse inside the composer.
The composer was also a plain flex sibling, so every extra row genuinely
stole height from the transcript's viewport. Messages could be held still
through that, but the native scrollbar (drawn from clientHeight/
scrollHeight) and the turn rail (centered on the same box) could not. The
hook now reports how far past its resting height the textarea has grown,
and the form offsets that with a negative top margin — its margin box
stays one row tall, the extra rows float over the transcript, and the
three overlays pinned to the transcript's bottom edge track the growth so
they keep meeting the card.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(web): publish zero growth when the composer has no layout
Addresses review notes on the auto-grow hook: the scrollHeight === 0 path
returned without reporting, so a caller offsetting its layout by the last
value held that offset across a route swap until the next measure. Also
corrects the resting-height comment, which named a min-height the landing
composer no longer sets.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* test(e2e): poll for settled layout instead of fixed sleeps
Addresses a review note: the fixed wait_for_timeout guesses were the
likeliest source of future flake under CI load. Reading the probe once two
consecutive reads agree can't return mid-settle, and costs nothing once the
layout is already quiet — the test also drops from ~4.6s to ~1.6s.
Re-confirmed non-vacuous by ablation.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
---------
Signed-off-by: dbczumar <corey.zumar@databricks.com>
The closer told authors to "reopen this PR or open a new one", but reopening needs
Triage+ on the base repo, which a fork contributor does not have -- so the advice
was unactionable for exactly the people receiving it. One author hit this last
week and had to re-raise their work as a fresh PR.
`/reopen` now exists, so point at it, and say what to do when the source branch is
already gone (the case where nothing can bring the PR back).
Also borrow Spark's framing that the close is not a judgement on the PR's merit.
An explained, reversible close is what keeps auto-close socially acceptable;
research on stale bots finds they shrink contributor counts along with backlogs.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
## Related issue
N/A
## Summary
`generate_formula.py` runs `uv pip compile --no-config`, which discards the repo's
`exclude-newer = "P7D"` along with the index and uv-version config. The cooldown
therefore never applied to the Homebrew formula: every one of the ~100 resource
pins in the artifact `brew install` users receive could be a distribution
published minutes earlier, even though the same dependency graph in `uv.lock` has
to wait the window out. A supply-chain control we apply to our own resolution was
absent from the one thing we ship to end users.
- Re-apply the window explicitly with `--exclude-newer`, keeping `--no-config` so
the index and `required-version` stay out of the picture.
- The cooldown cannot simply be left enabled: at release time `omnigent` and its
two lockstep SDKs are minutes old, and uv filters out the very version being
packaged (`no version of omnigent==X.Y.Z`). Those three are exempted with
`--exclude-newer-package`, which is what uv's own error message recommends.
- The span is read from `uv.toml` rather than hardcoded, so the formula's cooldown
cannot silently drift from the lockfile's. If it cannot be read, it falls back
to 7 days with a warning — never silently to "no cooldown".
- `--cooldown-days` overrides it for local experiments.
Pre-existing since #2654; every formula generated since has had it, including the
0.8.1 one that just shipped.
## Test Plan
Three runs against `omnigent==0.8.1`, all through a PyPI mirror:
- **No-op check** — cooldown 7 vs 0 at the same moment: **0 of 100 pins differ**,
so this does not churn today's output. (An earlier comparison suggested 3 pins
moved; that was mirror lag between two days, not the cooldown — the controlled
run is the valid one.)
- **Enforcement** — cooldown 7 vs 60: **45 pins held back**, e.g. `fastapi`
0.141.1 -> 0.136.3, `mcp` 1.29.0 -> 1.27.2, `grpcio` 1.83.0 -> 1.81.0. So the
flag demonstrably filters.
- **Exemption** — at a 60-day cooldown, `omnigent==0.8.1` (published 2 days ago)
still resolves and is still pinned as the stable url, which is only possible if
`--exclude-newer-package` is working. Without the exemption, resolution fails
outright; verified separately by running `uv pip compile` from the repo root
with the cooldown active:
`No solution found ... omnigent was filtered by exclude-newer`.
Also `ruff check`, `ruff format`, and the module imports with
`cooldown_days()` returning 7 from the repo's `uv.toml`.
## Demo
N/A — release tooling, no user-visible UI.
## Type of change
- [x] Bug fix
- [ ] Feature
- [ ] UI / frontend change
- [ ] Refactor / chore
- [ ] Docs
- [ ] Test / CI
- [ ] Breaking change
## Test coverage
- [ ] Unit tests added / updated
- [ ] Integration tests added / updated
- [ ] E2E tests added / updated
- [x] Manual verification completed
- [ ] Existing tests cover this change
- [ ] Not applicable
## Coverage notes
The generator has no test suite here, and the property that matters — "resource
pins respect the cooldown" — depends on live PyPI upload times, so it cannot be
asserted hermetically. Verified by the three controlled runs above: a no-op
against today's output, 45 pins moving under an exaggerated window to prove
enforcement, and the lockstep exemption proven by 0.8.1 resolving despite being
2 days old.
Signed-off-by: Zeyi (Rice) Fan <zeyi.f@databricks.com>
The notice failed with "Resource not accessible by integration" on every close.
Posting a comment on a pull request goes through /issues/{n}/comments, but GitHub
gates that on `pull-requests` when the target is a PR, so `issues: write` alone is
not enough -- every other comment-posting workflow here declares both.
Found by closing a throwaway PR after the merge: the run failed and no notice was
posted. reopen-pr.yml already declares both, so /reopen itself was unaffected.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* feat(ci): let PR authors reopen a bot-closed PR with /reopen
Reopening a PR requires Triage+ on the base repo, so a fork contributor
(Read only) cannot undo an automated close -- their only option is filing a
fresh PR. The bot has the permission, so it now does it on their behalf.
Guarded so it can only undo automation, never a maintainer's decision: the
commenter must be the PR author, the last close must have been the bot, and a
merged or already-open PR is ignored. A deleted head branch (which makes reopen
impossible for anyone) gets an explanation instead of a silent failure.
The duplicate-PR closer now advertises the command in its close comment, since
an escape hatch nobody knows about is not one.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* feat(ci): comment reopen instructions on every unmerged PR close
An escape hatch only helps if it is visible at the moment it is needed. Document
/reopen in CONTRIBUTING.md, and comment on close so an author looking at their
closed PR sees how to get it back without hunting for docs.
The notice is tailored to who closed it, because the answer differs: an author
who closed their own PR is told to use /reopen (they cannot press Reopen either,
being Read-only), while a maintainer close points them at the maintainer, since
/reopen deliberately will not override that. Bot closers post their own notice
and GitHub suppresses the closed event for GITHUB_TOKEN closes anyway, so this
covers human closes. A hidden marker keeps close/reopen/close from re-notifying.
Also widen /reopen to author self-closes, which have the same permission wall as
bot closes.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* fix(ci): make the reopen notice work on fork PRs
The notice workflow ran on `pull_request`, whose token is read-only for fork PRs
no matter what `permissions:` asks for, so commenting would have 403'd on exactly
the community PRs the feature exists to help -- and the workflow comment claimed
the opposite. Run it on `pull_request_target`, which gets a grantable token in
the base-repo context; the job already checks out only the default branch's
.github and runs no PR code, so nothing about the trust boundary changes.
Treat any `[bot]` close as automated instead of allowlisting github-actions[bot].
The notice already matched by suffix, so a close from a GitHub App would have
advertised /reopen and then been refused as a maintainer close.
`/reopen` now has to be a command rather than a mention: the workflow `if:`
prefilters on the substring, so "see /reopened elsewhere" reached the script.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
---------
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* feat(ci): hand PRs back to the reviewer with waiting-for-review
`waiting-on-author` can only say a PR is stalled. It cannot say the opposite, so
when an author replies the PR silently leaves the author's queue without entering
anyone else's -- and GitHub clears the review request the moment a review is
submitted, so the reply is invisible in the reviewer's queue too.
Add `waiting-for-review` as the other half of the cycle. Every path that clears
`waiting-on-author` now also applies it and re-requests the PR's owners, taking
them from `assignees` (the durable record) plus any surviving requested reviewers,
never the author. A failed re-request warns instead of failing the handoff, since
a reviewer can lose access.
The two labels are mutually exclusive: labeling a PR `waiting-on-author` removes
`waiting-for-review`, so a PR never advertises both states. That needs the
`labeled` trigger, which the workflow now subscribes to.
This is the label maintainers filter on to find PRs that are actually ready for
them, rather than reading the whole open list.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* fix(ci): re-request reviewers one at a time
GitHub rejects the whole reviewer batch when any single login is invalid, so a
maintainer who has since lost repo access would have silently taken the other
valid owners down with them -- the opposite of the resilience the batch call was
meant to provide. Request per reviewer and report which one was dropped.
Also warn when the handoff labels a PR waiting-for-review with nobody queued.
Auto-assign normally populates assignees, so an empty queue means something
upstream skipped the PR, and the label would otherwise advertise a state no
reviewer is actually in.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* fix(ci): satisfy ruff in the reviewer-request test
The fake request() override has to keep the base signature, so `method` looked
unused (ARG002). Assert on it instead of silencing the rule -- the test only ever
expects a POST.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
---------
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* feat(ci): flag PRs that link no issue (dry run)
Linking a PR to an issue is what gives it a priority in the review queue, but
329 of 480 open PRs link nothing, so most of the queue arrives unsorted.
Add an hourly issue-link check to the PR-hygiene sweep. It flags a PR with one
comment plus `missing-issue-link` and never closes anything: the label is the
signal a future merge gate or closer can read, following Prow's split where
plugins only label and merge blocking lives elsewhere.
It ships as a dry run. ENFORCE defaults to "false", which resolves every verdict
into the step summary while changing nothing, so the full list can be reviewed
before a single contributor is commented on. LIMIT caps flags per run.
Exemptions: bots (our CI bots author as CONTRIBUTOR, so an author_association
check would miss them), drafts, trivial changes (<= 9 lines, the size/XS
threshold), reverts, the `skip-issue-check` label, a `no-issue` line in the body
(a first-time contributor can type a line but cannot apply a label), and an
affirmatively checked Refactor / Docs / Test box. That last one requires a
declaration: exempting on the *absence* of a checked box would have made
deleting the template the cheapest way to skip the rule, which measured at 105
PRs versus 23 genuine chore declarations.
Link status is resolved per PR via closingIssuesReferences rather than a body
regex, so sidebar links, cross-repo refs, and full issue URLs all count -- forms
a keyword regex misses, and two of them appear in our own backlog. A failed
lookup fails closed and leaves the PR alone.
Rename the workflow to PR Hygiene now that it carries two checks, and rewrite
the template's "N/A" guidance to name the two escape hatches the bot honors.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* fix(ci): exempt maintainer PRs from the issue-link check
Nudging ourselves adds noise without changing our own behaviour, and maintainer
PRs were 79 of the 228 the dry run flagged.
Exempt on either signal, the same union demo-check.js uses: authorAssociation of
MEMBER/OWNER/COLLABORATOR, or a login in .github/MAINTAINER. Both are needed --
a maintainer whose org membership is private reads as CONTRIBUTOR, and one
maintainer holds write access without being listed in the file. The file is read
from the API rather than the checked-out tree so a PR cannot self-grant by
editing it.
Dry run after the change: 149 flagged (was 228), 210 exempt of which 112 are
maintainers.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* Update pull request template for issue association
Clarified instructions regarding issue association for certain types of changes.
Signed-off-by: Dhruv Gupta <dhruv0811@gmail.com>
* fix(ci): address Polly review on the issue-link check
The dry run existed so the whole verdict list could be read before any
contributor was commented on, but LIMIT was applied before the enforce gate, so
a dry run capped its own list at 25 and could never show it. Move the cap under
the enforce path.
Pin the rule to an effective date. The 24-hour window already kept the sweep off
the backlog, but that was a property of the window rather than of the rule; a
wider window or a manual run would have reached back. Nothing opened before the
effective date is considered now, whatever the window says.
Ticking Test / CI beside Bug fix was a free opt-out, since the exemption fired on
the presence of any chore-ish box. A tracked type now wins over an exempt one.
Also: LIMIT=0 meant unlimited rather than "flag nothing", and the trivial-lines
comment claimed parity with size/XS, which excludes lockfiles while this counts
raw additions plus deletions.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* refactor(ci): drop the missing-issue-link label
The nudge is a one-shot message, so a label alongside it only adds noise to the
queue maintainers filter on. Dedupe on a hidden marker in the bot's own comment
instead -- the same approach reopen-notice.js uses -- and drop the label creation
entirely.
The comment lookup happens only for PRs that reach the flag decision, so a dry
run still costs nothing extra per PR.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* refactor(ci): remove the no-issue self-service opt-out
A rule that anyone can opt out of by typing one line is not a rule. `no-issue`
let exactly the PRs this check targets skip it, so drop the regex, the bot
comment's mention of it, and the exemption.
What remains is a declared Refactor / chore / Docs / Test / CI type, which is a
statement about the change rather than a bypass, and the `skip-issue-check` label
for maintainers -- the only unconditional opt-out, and it needs write access.
The test now asserts `no-issue` in the body does nothing, so the hatch cannot
quietly return.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* fix(ci): make a malformed LIMIT fail toward flagging nothing
`Number("abc")` was falling through to Infinity, so a typo in the workflow env
would have removed the cap that bounds how many contributors one enforcing run
can comment on. Warn and flag nothing instead.
Also read .github/MAINTAINER from the event's default branch rather than a
hardcoded "main", matching the sibling checks, and fix the sweep's header comment,
which still claimed both checks dedupe on a label.
Co-authored-by: Isaac
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
---------
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
Signed-off-by: Dhruv Gupta <dhruv0811@gmail.com>
* fix(host): keep the tunnel receive loop responsive during readiness refresh
The host->server tunnel disconnected with `4003 ping timeout`: the periodic
harness-readiness refresh ran inline on the receive loop and could block it for
~60s — two 30s CLI probe subprocesses (`--version` and `auth status`) hanging on
a wedged harness CLI. While blocked, the host never answered the server's
application-level pings, so the server watchdog declared the host dead and
closed the tunnel.
Fix A (host/connect.py): move the readiness refresh into its own task,
`_harness_readiness_loop`, so the receive loop only ever reads frames and
answers pings — a slow probe can no longer stall the keepalive.
Fix B (harness_install.py, harness_readiness.py, codex_native.py): bound
readiness CLI probes to READINESS_CLI_PROBE_TIMEOUT_S (10s, matching goose's
status-probe budget) instead of 30s, so a hung harness CLI fails fast on the
refresh, the startup hello, and Ctrl-C. Setup and launch gating keep the lenient
30s default via behavior-preserving timeout parameters.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(sandbox): supervise the in-sandbox host so a crash can't strand the box
A sandbox container outlives the host process: PID 1 is `sleep infinity` or
the provider's own init, never `omnigent host`. So when the host dies the
container stays healthy and still billing, with nothing running in it.
Nothing notices until the next message, and the only recovery is
`relaunch_managed_host` re-provisioning a fresh sandbox — which discards the
workspace: the clone, the installed dependencies, the harness state.
Wrap every exec-model host launch in a restart loop at the one seam all
providers funnel through (`run_background`), so a crashed host restarts in
place and the workspace survives. No image changes, no init system, no new
privileges — replacing PID 1 across seven provider images would mean booting
systemd with cgroup mounts, which the Kubernetes Pod's "restricted" security
posture forbids outright.
To make restarting safe, give a permanent startup failure its own exit code
instead of sharing 1 with generic crashes: without it, a revoked or expired
launch token inside a remote sandbox becomes an invisible hot restart loop
with nobody watching a terminal. The supervisor stands down on that code, on
a clean exit, and on SIGTERM; anything else is a crash, retried with a
doubling delay capped at 30s.
OpenShell keeps its held exec stream — it reaps an exec's processes when the
RPC returns, so `setsid nohup` genuinely cannot work there — but gains the
same supervisor inside that stream. Kubernetes is untouched: it is
entrypoint-as-host with a deliberate `restartPolicy: Never`, recovering by
provisioning a replacement Pod rather than restarting in place.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(sandbox): make the supervisor's stop contract and backoff cap explicit
Review follow-ups on the in-sandbox host supervisor.
A signal-kill of the host alone (SIGKILL -> 137) stays classified as a crash on
purpose: that is what an OOM kill looks like, and restarting is the wanted
response. The consequence is that a path meaning to STOP the host must signal
the supervisor too, or the loop faithfully restarts it. Both in-sandbox stop
paths already do — `foreground_kill_command` signals the pidfile's recorded pid
(the supervisor, which the host `exec`s under), and islo's preserved-daemon stop
matches "omnigent host" against full argv, which the supervisor's own `sh -c`
argv contains. Documented so a future narrowing of either match doesn't silently
turn a stop into a restart loop.
The loop deliberately has no attempt ceiling — giving up would restore the
stranded-empty-box failure it exists to prevent — so add an attempt counter to
the restart log, making a persistently crashing host observable instead of an
indistinguishable repeat.
Cover the backoff clamp with a test asserting the full delay sequence
(1, 2, 4, 8, 16, 30, 30, 30), and point the `_harness_cli_version_string`
timeout example at READINESS_CLI_PROBE_TIMEOUT_S instead of a stale literal
that disagreed with it.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
---------
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(host): keep the tunnel receive loop responsive during readiness refresh
The host->server tunnel disconnected with `4003 ping timeout`: the periodic
harness-readiness refresh ran inline on the receive loop and could block it for
~60s — two 30s CLI probe subprocesses (`--version` and `auth status`) hanging on
a wedged harness CLI. While blocked, the host never answered the server's
application-level pings, so the server watchdog declared the host dead and
closed the tunnel.
Fix A (host/connect.py): move the readiness refresh into its own task,
`_harness_readiness_loop`, so the receive loop only ever reads frames and
answers pings — a slow probe can no longer stall the keepalive.
Fix B (harness_install.py, harness_readiness.py, codex_native.py): bound
readiness CLI probes to READINESS_CLI_PROBE_TIMEOUT_S (10s, matching goose's
status-probe budget) instead of 30s, so a hung harness CLI fails fast on the
refresh, the startup hello, and Ctrl-C. Setup and launch gating keep the lenient
30s default via behavior-preserving timeout parameters.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* test: accept the readiness probe timeout kwarg in harness CLI stubs
Readiness now calls harness_cli_installed / harness_cli_logged_in with a timeout= kwarg (READINESS_CLI_PROBE_TIMEOUT_S); update the monkeypatch stubs in the affected suites to accept it so they exercise the same paths.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* test(host): cover off-loop readiness refresh and bounded CLI probe
Fix A moved the harness-readiness refresh off the tunnel receive loop into
_harness_readiness_loop. Rewrite the three live-host readiness tests to drive
that loop directly: the old versions drove _serve_frames with a fake tunnel
that blocks on recv, which under the pure recv loop never exits and hangs to
the pytest timeout. Add a harness_install test asserting the readiness caller
shortens the CLI probe subprocess timeout while setup/launch keep the 30s
default.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
---------
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* refactor(db): rename projects.owner_user_id to user_id
Migration b3c1a2d4e5f6 unified the session-owner identity columns on the
schema-wide `user_id` convention, converting `hosts.owner` and
`scheduled_tasks.owner_user_id`. The `projects` table shipped five days
earlier (b1c2d3e4f5a6) and was missed, leaving it the last column still
diverging from `session_permissions.user_id`, `account_tokens.user_id`,
`device_grants.user_id`, `hosts.user_id`, and `scheduled_tasks.user_id`.
Renames the column, the entity field, and the store/route keyword argument.
`ix_projects_owner_user_id` becomes `ix_projects_user_id`, matching the
`ix_scheduled_tasks_user_id` precedent. `ix_projects_name` keeps its name —
the store's `_is_name_conflict` matches on that literal — but now covers
`user_id` and stays UNIQUE.
Type is unchanged (VARCHAR(128), nullable) and the rename is not
wire-visible: `owner_user_id` was never part of the ProjectObject response.
Co-authored-by: Isaac
Signed-off-by: aravind-segu <aravind.segu@databricks.com>
* refactor(db): drop the projects name UNIQUE index; compress config
Addresses two schema-review comments on the managed-schema mirror of this
table (databricks-eng/universe#2369565). Both are OSS model changes that the
managed USM schema then follows, so they land here first.
1. Drop `ix_projects_name` (UNIQUE over workspace_id, owner, name).
Folded into the same migration as the user_id rename, which already dropped
and recreated this index. It backed only the store's two `_name_taken`
probes, which now stand alone as the sole per-owner uniqueness check:
- It never held for single-user mode, where the owner column is NULL and SQL
treats NULLs as distinct, so that deployment has always allowed duplicates.
- `name` is mutable (`update` renames it), so a unique key over it was
maintained on every rename.
- The `?project=<name>` member join tolerates duplicate names by
construction: it unions first-class members with `omni_project`
label-projects matched on the same string, so name-collision merging is
already its defined behaviour.
The cost is that two concurrent creates or renames to the same name can both
land. `ix_projects_user_id` still covers both probes via its
(workspace_id, user_id) prefix, then filters `name` over the owner's handful
of rows, so neither query is left unindexed. `_is_name_conflict` and both
now-unreachable `IntegrityError` handlers are removed rather than left as
dead protection. The downgrade recreates the index, which will fail if
duplicates accumulated while it was absent — deliberately, so the conflict
surfaces instead of a row being discarded.
2. Store `config` as a compressed BLOB/BYTEA (new migration e6f7a8b9c0d1).
Finishes the sweep of z9a2b3c4d5e6, which converted the then-remaining opaque
TEXT columns to `CompressedText`. `projects.config` shipped four days earlier
and was missed, leaving it the last plain-TEXT column outside
`conversation_items`. It qualifies on the same terms: machine-generated JSON,
read and written whole with the row, never filtered or ordered in SQL. The
Python type stays `str | None`, so the store, entity, and routes are
unchanged, and no backfill is needed — the codec reads legacy unframed values
and re-frames each on its next write.
Co-authored-by: Isaac
Signed-off-by: aravind-segu <aravind.segu@databricks.com>
---------
Signed-off-by: aravind-segu <aravind.segu@databricks.com>
* docs(prioritization): add issue-prioritization-v2 design + scoring dry-run
The open-issue queue is ordered by a priority label that has lost its
meaning: 60% of open bugs are P1-high, P0/P3 are vestigial, and open-issue
age is flat across priorities — so priority no longer pulls anything to the
front. Feature requests default to P2 by rule, so a high-severity capability
gap (e.g. #2125) is indistinguishable from a trivial nice-to-have.
This adds a design doc and a runnable dry-run:
- designs/prioritization/issue-prioritization-v2.md — evidence from the
current backlog, a re-calibrated priority rubric (with a "P1 is a scarcity
signal" guardrail), a harness-tier axis derived from areas.json, a
composite score (severity x reach x tier + bounded demand + recency +
manual pin) as advisory ordering on top of the labels, and ongoing-
adjustment levers (weekly re-score, manual pin, re-gradable severity).
- designs/prioritization/score_prototype.py — reads an issues snapshot and
prints a before->after ranking with per-issue rank deltas, so weights can
be tuned against real issues. Demand is type-split (multiplier for FRs,
capped tiebreak for bugs), grounded in the 93%-zero reaction distribution.
The prototype grades severity with regex for reproducibility, and its own
false positives ("sandbox bypass" FRs, a bot audit issue) are the doc's
evidence that production severity must be LLM-graded by the existing
tool-less triage classifier.
Co-authored-by: Isaac
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
* docs(prioritization): address review — grade FRs, tier labels, readiness/dup axes, drop pin
Addresses PR review feedback:
- Grade FRs across all priority buckets (not defaulted to P2); an FR's
priority comes from the severity/reach of its absence. Rubric now applies
to bugs and FRs alike.
- Split comp:harnesses via tier labels (comp:harness-t1/-t2/-t3) mapped in
areas.json, preferred over per-harness labels for future-proofing.
- Add Axis 5 (duplicate reach: N dupes = N reporters = blast radius, +15%
each capped +50%) feeding off the dedup labeler (#4037); do NOT auto-close.
- Add Axis 6 (readiness: repro/body present -> small bump, needs-info ->
penalty) so actionable tickets surface above vague ones at equal severity.
- Drop the pin:high/low lever as over-engineering; maintainers re-grade
severity to bump, the one knob they already use.
- Add a worked example (data points -> score for #3265) and the severity
grade distribution across the backlog.
- Treat sandbox/security bypass as top-tier severity regardless of reach;
keep sandbox/policies as first-class components.
- Add prioritization-efficiency metric: sum(resolved score) / sum(top-k score).
- Use the MAINTAINER file (36 authored) rather than author_association for the
internal/community split; clarify the 128-open-P1 vs 125-P1-bugs figures.
- Fix inert uppercase severity regexes in the dry-run (CVE/RCE/PAT were never
matching lowercased text); document the 25-vs-30 default severity.
Co-authored-by: Isaac
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
* docs(prioritization): add priority-label regrade preview + mechanism
Adds the backfill view reviewers actually need — the priority *label*
regrade, distinct from the score/rank before->after already in the doc.
- New "How regrading works" subsection under Axis 2: the two regrade
situations (one-time backfill; ongoing on-demand relabel), the mechanical
severity x reach -> bucket mapping, a before->after label distribution
(P1 60% -> 25% of open bugs), and per-move examples with the regex-grader
caveat.
- score_prototype.py gains regrade() + a --regrade mode that prints the
current-vs-regraded label distribution and the changed-label breakdown, so
the backfill preview is reproducible.
Co-authored-by: Isaac
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
* docs(prioritization): document component-label recommendations
Adds a "Component taxonomy" subsection with the bar for a new comp: label
(filter on it, or it changes grading) and a per-label verdict table:
- Recommend adding comp:sandbox (carved from comp:runner, ~29 issues,
security-grade) and comp:mobile (carved from comp:web-ui, ~23 issues,
distinct domain); defer comp:desktop.
- Leave comp:server/tui/infra/repr/policies as-is with rationale.
- Prefer narrow comp:sandbox over a comp:security umbrella (which would
re-create a mega-bucket from credential/auth issues).
Trims the Sandbox section's component bullet to reference this, and updates
the rollout to add the labels + backfill.
Co-authored-by: Isaac
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
* docs(prioritization): add full top-200 ranking appendix; tighten prose
- Appendix C: full composite-score ranking of the top 200 of 360 open issues
from today's snapshot (score, re-graded severity, current label, rank delta,
linked issue). Reproducible via a new `--markdown [N]` mode in
score_prototype.py.
- Tighten the Community-demand and Ongoing-adjustment sections (removed
repetition of the drop-pin rationale and the reaction-distribution recap)
without dropping any detail.
Co-authored-by: Isaac
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
* docs(prioritization): add maintainer guide for hand-correcting the ranking
- New "Maintainer guide — hand-correcting the ranking" subsection: the one
knob (priority label), why corrections are sticky (triage fires on opened
issues only, never overwrites edits), a when-to-correct table, and — per the
"10% is fine" bar — an explicit escalation from per-issue editing to prompt/
weight tuning when the same misgrade recurs or the correction rate crosses
~10%. No per-issue score override, so the ranking stays explainable.
- Reframe Appendix C header as "illustrative, not actionable": call out that
the regex grader puts #2057/#2054 above the real P0 and that scores tie in
coarse bands (~8 tiers, not 200 ranks).
Co-authored-by: Isaac
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
* docs(prioritization): reconcile Serena's review
Addresses Serena's inline review (and the Pat/Serena thread resolutions):
- Priority vs score: spell out the three-layer flow (axes -> severity ->
score -> priority label). Label is the actionable outcome; score is the
continuous ordering and the reason for the label.
- P0 is now an explicit named list (cannot start; critical API broken; db
migration/data loss; security escape), not a blanket "security". Drop
"all-users-down" (we don't run a hosted service). Add a tier-1 -> at-least-P1
floor as a sanity check.
- Harness tiers backed by activity data: Pi moves to T2 (3rd most active,
above cursor; delegated check), opencode flagged as the marginal T2/T3 call.
- Age is neutral by default (an unfixed old bug shouldn't decay; escalate
instead). score_prototype gains age_factor()/DECAY_OLD; the top-200 appendix
is regenerated accordingly (#61 shifts 19->9, etc.).
- needs-info vs partial info: needs-info = incomprehensible -> no priority, no
reviewer; partial-but-serious -> still prioritized, just no readiness bump.
- Component taxonomy: go granular per review — add comp:sandbox, comp:mobile
(with desktop/iOS/Android device tags), comp:auth (with auth types), plus a
sub_area tag (SDK/native, UI surface, runner phase) so finer routing doesn't
require dozens of flat labels. Intake + rollout updated to match.
Co-authored-by: Isaac
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
* docs(prioritization): define score -> priority derivation (single system)
The doc previously described two inconsistent score->priority mappings: Layer 3
said the label is "where the score lands" (score -> label), while "How
regrading works" mapped severity x reach -> label independent of the score, and
no actual score->priority thresholds existed. Resolve to one derivation.
- Add explicit score thresholds: >=100 P0, >=60 P1, >=25 P2, else P3. Cut-points
sit at the severity band values, so a multiplier (tier/reach/dup/readiness/
demand) is what lets an issue cross up a band. On the snapshot: P0 9 / P1 58 /
P2 206 / P3 87, a 22% P1-bug share.
- score_prototype.py: replace regrade() (severity x reach) with
priority_from_score() using P0_MIN/P1_MIN/P2_MIN constants; keep `regrade`
as an alias. --regrade now reflects the thresholded labels.
- Reconcile the tier-1 "floor" as a grading heuristic (grade tier-1 bugs >=high,
which clears P1 via the normal path) rather than a label override that would
contradict the single derivation.
- Fix the worked example (#3265) to its real computed factors (reach 1.5,
readiness 1.0, score 126 -> P0) and refresh the backfill table/transition
examples to the thresholded numbers.
Co-authored-by: Isaac
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
* docs(prioritization): regenerate appendix table with derived-priority column
The top-200 appendix showed only the current label ("Now"); it didn't show the
priority the new score->label thresholds assign. Add a "Derived" column (with a
⚑ flag where it differs from today's label) so the appendix doubles as the
per-issue backfill preview — the ⚑ rows are the relabels the one-time regrade
would apply (103 of the top 200). Regenerated from the same snapshot the rest of
the doc cites, and updated the Appendix C header to explain the new column.
Co-authored-by: Isaac
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
* docs(prioritization): guarantee the bot never overwrites human priority
Now that priority is a computed output, the re-score/backfill jobs could clobber
a maintainer's deliberate P0->P2 or P3->P1. Add an explicit human-override guard
so that never happens:
- New "Human priority always wins" subsection: a bot-written priority is a
default, a human-written one is a decision. The bot sets priority only where
none exists or where the bot itself set the prior value; a human edit is
detected (bot-priority:* shadow label, or the issue-events actor as fallback)
and skipped — at most surfaced as bot/human disagreement in the ranked view.
- Re-score reads (for ordering) but does not relabel human-owned rows.
- Fix the "corrections are sticky" claim, which previously leaned only on the
on:opened trigger (true today, but the v2 re-score/backfill DO re-run and
write labels) — now it points at the guard.
- Thread the requirement into the Goal, the backfill step, and Rollout step 4
(scoring job MUST implement the guard).
Co-authored-by: Isaac
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
* docs(prioritization): mark rollout as not-yet-implemented
The design specifies new labels (comp:sandbox/mobile/auth, harness tiers),
areas.json wiring, prompt changes, and a scoring job — none of which are built.
Add an explicit "Status: none of this is built yet" note to the Rollout so the
doc is not mistaken for shipped work; each step is a follow-up.
Co-authored-by: Isaac
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
* feat(prioritization): unify component importance into one telemetry-seeded weight
Importance was a harness-only axis: score_prototype's tier_mult() boosted
comp:harnesses (1.4/1.1/0.9) and left every other component at a flat 1.0, so a
comp:server bug couldn't be weighted above a comp:repr one. And the harness
tiers were seeded from GitHub issue/reaction counts, not real usage.
Unify it into one per-area weight, seeded by telemetry where we have it:
- areas.json: add `weight` (bands 1.4/1.1/1.0/0.9) + `weight_source` to every
area. Harness weights are telemetry-seeded from LJ Sessions by Harness
(claude/codex 1.4; pi/opencode/cursor/antigravity/hermes/copilot 1.1;
goose/kimi/kiro/qwen 0.9 — note telemetry lifts hermes above its GitHub
signal). Non-harness weights are editorial (core server/runner 1.1; mainline
ui/policies/tui 1.0; repr/infra 0.9), honestly labeled weight_source:editorial
since there's no per-component usage signal.
- areas.test.js: assert weight ∈ allowed bands and weight_source ∈
{telemetry,editorial} for every area.
- score_prototype.py: replace tier_mult() (harness-only, title-keyword guess)
with area_weight() that reads areas.json — resolves a harness issue to its
specific harness area, else takes the max weight among the issue's comp:
labels. Drops the TIER1/TIER2 title lists.
- Doc: rewrite Axis 3 as unified Component weight (was Harness tier); update the
score formula, worked example, backfill preview, and regenerate Appendix C.
The unified weight lifts core-area bugs, moving P1-bug share 22%→27% — noted
as intended, with P1_MIN as the lever if we want it stricter.
This is the design + prototype + the areas.json weights themselves; label
creation and wiring areas.json into the live classifier remain rollout
follow-ups.
Co-authored-by: Isaac
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
* docs(prioritization): consistency pass — fix drift, trim repetition
Full read-through after the unified-weight change. Corrections + trims:
- Fix drift the incremental edits left: "harness-tier" → "component weight" in
the Goal, Layer-2, and Intake; the Rollout "Status" no longer claims
areas.json is unchanged (it now carries the weights).
- Refresh the Dry-run before→after tables to the current component-weighted
ranks (#2125 rank 1, #16 rank 7, #3557 rank 10, #61 rank 15, …); the stale
ranks predated the weight change.
- De-duplicate the regex-false-positive story: it was told four times (Axis 4,
backfill caveat, Dry-run limits, Appendix C). Keep the Dry-run "limits" table
as the canonical telling; Axis 4 and the caveat now point to it.
- Collapse the Sandbox section's component bullet (it duplicated Component
taxonomy) into a pointer; keep the evidence + the P0-severity rule.
Net −14 lines of prose, no content lost; Appendix C table unchanged.
Co-authored-by: Isaac
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
* docs(prioritization): score in one Databricks job; persist severity; determinism
Rework the scoring/triage architecture per review discussion so the score is
computed in exactly one place, and document reproducibility.
- Scoring job is a scheduled Databricks NOTEBOOK, not a GitHub Action. New
"Surfacing the score" section: reads the already-synced
main.team_eng_omnigent.github_issues_bronze table (reads are tokenless),
computes the score once, writes an issue_scores Delta table the dashboard
reads, and applies labels back to GitHub (the one credentialed step, via a
Databricks secret). Preserves the prompt-injection boundary and flags the
scheduled-vs-dispatch-Action latency decision for the team.
- Persist severity (Rollout step 1): graded once at triage and stored, since
it's the largest multiplier and can't be recomputed from labels/text — this
is what makes re-scoring deterministic.
- New "Determinism" section: pure-arithmetic score is reproducible given
persisted severity; demand/dup are intended bounded time-varying inputs;
tie-breaking deferred (ORDER BY score DESC, issue_number when wanted).
- Human-override guard now keyed on an issue_bot_state Delta table (also the
job's idempotency record against bronze ingestion lag), replacing the
bot-priority shadow-label sketch; stickiness no longer leans on on:opened.
- Linear: already synced regularly; scores stay in GitHub + dashboard, not
pushed to Linear.
Co-authored-by: Isaac
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
* docs(prioritization): S0-S3 severity, reach folded in, age axis, restructure
Reworks the design around the axes → severity → score → priority mental model
and tightens the doc.
- Severity is an S0-S3 grade the LLM gives from issue CONTENT; reach is folded
into the grade (no separate reach multiplier). Severity must not re-encode
factors weighted elsewhere (component). Soft claude/codex nudge, not a floor.
- Component weight (Axis 3): filled the weight table + combining rule (max),
bumped server/runner core to 1.2, documented the new labels
(comp:harness-t*, comp:sandbox/mobile/auth) and their inherited weights.
- Age promoted to its own axis (0-5d 1.0 / 5-21d 1.2 / 21d+ 0.8); Determinism
section reconciled (age is intended over-time drift, not neutral).
- score_prototype: drop reach(); age_factor bands anchored to the snapshot's
newest issue; areas.json weight 1.2 added + allowlisted in areas.test.js.
- Dry-run section replaced with an LLM-vs-regex comparison over the 100 oldest
open issues (distribution + confusion matrix; 49/100 flip), regenerated
Appendix C, and trimmed Intake/Rollout/Metrics (Rollout is now action items).
Nothing here is wired into the live classifier yet; areas.json weights + test
are the only runtime-adjacent change. Rollout lists the follow-ups.
Co-authored-by: Isaac
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
* docs: reconcile prioritization scoring review
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
* docs: simplify issue demand scoring
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
---------
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
`test_historical_image_source_block_is_replaced_with_compact_placeholder`
imports `_render_prior_content`, but the function is named
`_render_prior_content_blocks`. The ImportError raised at class scope crashes
the pytest-xdist worker outright (`AttributeError: 'tuple' object has no
attribute 'value'` inside pytest's unittest plugin), so the whole
`Pytest (inner-rest)` shard fails with an INTERNALERROR rather than a normal
test failure.
Use the real name, and join the returned content blocks via the existing
`_text_of` helper since it returns blocks rather than a string.
Verified the test still guards the behavior it was written for: disabling the
base64 `source`-block arm of `_redact_inline_base64` makes it fail, and
restoring it makes it pass. Full file: 122 passed (was 1 failed + worker crash).
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
omnigent-telemetry#15 introduces a CloudFront default config
(omnigent_version: "default") served for any version that lacks an
explicit config file. Without this change, the version check on line 190
always rejects the default payload and silently disables telemetry.
Accept "default" as an equivalent of the current VERSION so the default
config is honoured.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
The historical-replay redaction (_redact_inline_base64) only matched
whole-string "data:*;base64,..." URIs — the resolver form under
image_url / file_data. But Claude Code's Read tool returns an image file
as an Anthropic content block {"type":"image","source":{"type":"base64",
"data":"..."}} — raw base64 with no data: prefix — carried in a
function_call_output. That shape slipped past redaction, so if it reached
the "Conversation so far:" text prefix json.dumps flattened the full
base64 into prompt text (the same class of overrun that wedges resume on
the native path).
Extend _redact_inline_base64 to also rewrite image/document base64
"source" blocks to a compact "[image/attachment: <media>, <N> base64
chars]" placeholder. Verified: image and document source blocks now
redact (base64 absent), data-URI and plain-text paths unchanged.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
The per-turn idle watchdog fails a turn that emits no non-heartbeat
events for the window. Context compaction's summarizing LLM call runs
as a single long await that emits nothing until it returns, so on a
near-full context it can exceed the 240s default and trip the watchdog.
That wedges the session in a "Prompt is too long" -> compaction ->
240s-timeout loop, since every retry re-triggers the same slow compaction.
Raise the default from 240s to 600s so a healthy long compaction has
room to finish. The HARNESS_TURN_TIMEOUT_S env knob and the absolute
ceiling are unchanged.
Co-authored-by: Isaac
* fix(web): persist open shell tabs per session
Shell tabs lived only in transient component state and the
conversation-switch effect cleared them on every navigation, so opening
a shell, switching sessions, and returning lost the tab. The PTYs
themselves live on the server and are re-fetched by useTerminals — only
the tab strip was being discarded.
Persist openTerminals/selectedTerminalKey per session in
sessionWorkspaceState (mirroring the open file tabs), seed and restore
them on mount/switch, and gate the dead-tab prune effect on the
terminals list's loading state so a restored tab isn't wiped by the
transient empty list before the session's terminals load.
Co-authored-by: Isaac
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
* test(e2e): cover shell-tab persistence; skip prune on errored terminal fetch
Add an e2e_ui test that opens a real shell in one session, switches to
another via the sidebar (client-side nav), and returns — asserting the
shell tab and its live PTY are restored. This exercises the
conversation-switch effect that regressed, which a full page reload
wouldn't.
Also address review feedback: the dead-tab prune effect ran whenever the
terminals query wasn't loading, but an errored fetch also yields an empty
list — a non-authoritative one. Pruning against it would wipe restored
tabs whose PTYs we simply couldn't reach. Gate the effect on
terminalsError as well, with a component test for the errored-read case.
Co-authored-by: Isaac
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
---------
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
Claude Code >= v2.1.197 writes `status: "shell"` to its per-session status
file when a turn ends but a background shell is still alive. The status-file
poller's map didn't know that literal, so `read_session_status` returned
`None`, the poller fired no edge and stayed stuck on its last `running` (while
also suppressing the PTY watcher's `idle`). The session never reported idle
while a background shell ran, so `sessionStatus` stayed `running`,
`shouldQueueSend` returned true, and every new message queued client-side —
regressing the "don't queue while only background work runs" behavior.
Map `shell` to `idle`: the agent loop is idle, and the Stop hook separately
relabels its own `idle` to `waiting` with the shell tally, which is what keeps
the "N background tasks still running" spinner lit.
Co-authored-by: Isaac
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
This reverts commit 617293d3d9.
Painting a cached transcript before revalidation meant the contents
moved under the reader: the window appeared instantly, then shifted as
newer commits were gap-bridged onto it. A hydrate spinner that resolves
into a settled transcript reads better than a fast paint that jumps, so
go back to the cold-load spinner on every conversation switch.
Co-authored-by: Isaac
Signed-off-by: Daniel Lok <daniel.lok@databricks.com>
* ci: mirror linked issue priority onto closing PRs
Add a workflow that copies an issue's priority label (P0-P3) onto the
PR that closes it. Only closing links (closes/fixes/resolves #n) count;
a plain "related to #n" mention is ignored. When a PR closes several
issues the highest priority wins, and stale priority labels are dropped.
Runs on PR events and re-syncs when an issue's priority label changes;
the issue-label trigger is gated to priority labels only so other label
edits don't spin up the job.
Co-authored-by: Isaac
* ci: address review feedback on priority sync
- Tolerate null GraphQL nodes (unknown PR number, data: null) instead of
crashing on AttributeError; cover the parsing with tests.
- Add a 30s urlopen timeout so a stalled connection fails fast.
- Validate PR_NUMBER is an integer with a clear message.
- Surface a warning when the issue->PR GraphQL lookup fails rather than
silently succeeding.
- Pass the resolved PR list through an env var instead of interpolating
it into the run block.
Co-authored-by: Isaac
Rename the `enhancement` label to `Feature` and `documentation` to `Docs`
across the issue-triage system. The triage agent's `type` value is applied
verbatim as an issue label, so update the validator allow-list, the agent
schema and classification rule, the feature-request template's auto-label,
and the design proposal doc to keep them coherent.
Co-authored-by: Isaac
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
* perf(host): cache auth headers and parallelize status payloads
Two follow-on speedups for omni host status:
1. Cache _remote_headers() per base_url within a process.
Databricks SDK credential resolution (~3s) ran on every
_host_http_json call. Since tokens are valid for the lifetime
of a CLI invocation, resolving once and reusing is safe.
A threading.Lock serialises concurrent first-time resolution
for the same URL.
2. Build daemon status payloads in parallel with ThreadPoolExecutor.
With the dead-process skip from the previous commit, only live
daemons make HTTP calls. Parallelising them lets independent
servers be queried concurrently instead of sequentially.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* chore: restore uv.lock to main
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix: move header cache resolution inside try/except in _host_http_json
_remote_headers() does file I/O and Databricks SDK calls that can raise
OSError. The cache-populating call was outside the try block, so such a
failure propagated unhandled. Under ThreadPoolExecutor (added in this
PR) that aborted the entire omni host status listing.
Move the resolution inside the existing try/except so auth/file errors
remain recoverable and produce a status_code=0 result per daemon,
matching the pre-change behaviour.
Also adds test_host_http_json_handles_remote_headers_oserror to pin
this contract.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* chore: fix import order (ruff)
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
---------
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* ci(triage): re-triage issues when needs-info is cleared
Add a hybrid needs-info lifecycle. When the issue author comments on an
issue that still carries needs-info, needs-info-response.yml removes the
label using the omnigent-ci App token (the default GITHUB_TOKEN would not
re-trigger downstream workflows). That removal fires issue-triage.yml's
new `unlabeled` trigger, which reads the reporter's follow-up comments,
reclassifies, and assigns an owner — re-adding needs-info only if the
issue is still too vague. Issues the reporter never clarifies are closed
by the existing stale.yml.
issue-triage.yml changes:
- trigger on issues [opened, unlabeled]; the unlabeled path fires only
for needs-info on an open issue, and allows a bot actor (the App)
- feed the author's follow-up comments into the triage prompt
- remove needs-info on re-triage when the LLM no longer flags it
- suppress the duplicate-of comment on the re-triage path
- add a per-issue concurrency group
Co-authored-by: Isaac
* ci(triage): address review — idempotent label removal, dormant-App notice
- needs-info-response.yml: re-check live labels before `gh --remove-label`
so a stale event payload / race can't fail the step (gh errors on a
missing label); emit a ::notice:: when the omnigent-ci App is
unconfigured so a dormant feature is distinguishable from a broken one.
- issue-triage.yml: also suppress the `duplicate` label on the re-triage
path (not just the comment), keeping the label and its explanation
consistent; hoist `import os` to the top of the block.
Co-authored-by: Isaac
* feat(webui): capture raw SSE events and show in execution logs panel
- sseEventLog.ts: module-level ring buffer (max 500 events/session)
with subscribe/snapshot API for useSyncExternalStore
- useSseEventLog.ts: React hook that subscribes to the ring buffer
- chatStore.ts: tap tapSessionEvents to push each StreamEvent into the
ring buffer; clear on fresh stream bind (not reconnect)
- ExecutionLogsPanel.tsx: add Items/SSE toggle — SSE tab shows
timestamped raw events with expand-to-pretty-print, auto-scrolls
to bottom as events arrive
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* perf(webui): skip SSE ring buffer when debug mode is off
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* perf(webui): cache isDebugMode as module-level boolean
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix(webui): return new array ref on push so useSyncExternalStore re-renders
Object.is on the same mutated array always returns true, causing React
to skip re-renders. Produce a fresh array on every push/trim so the
snapshot reference changes and the SSE list updates in real time.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* feat(webui): support localStorage debug flag in addition to ?debug=1
Both useDebugMode and the SSE ring buffer guard now check
localStorage.getItem("debug") === "1" as a fallback, so debug mode
can be toggled once in the console without keeping ?debug=1 in every URL:
localStorage.setItem("debug", "1") // enable
localStorage.removeItem("debug") // disable
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix(webui): stable snapshot ref and correct debug flag detection
- snapshotSseLog: return shared EMPTY constant instead of allocating a
new [] on every call; prevents useSyncExternalStore render-loop from
the unstable reference on sessions with no log yet
- isDebugMode: re-read window.location.search + localStorage on every
call instead of caching against popstate; React Router uses pushState/
replaceState which never fires popstate, so the cached value stayed
stale when navigating to ?debug=1 in-app
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
---------
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix(web): split the harness picker by support level
The landing composer's harness picker split its primary list and "More"
group by host readiness, so any configured harness led: Claude Code,
Codex, Cursor, and Pi all competed for the few primary slots, while "More"
held only harnesses that happened to need setup. Support level — what
actually distinguishes these integrations — wasn't represented at all.
Add a `fullySupported` flag to `NativeCodingAgentSpec` and set it on
Claude Code and Codex, the integrations we maintain and test end to end.
Only those lead; every other harness folds into "More" whether or not it
is configured on the host. The flag is opt-in, so the supported set is two
lines in one file rather than a marker on each of the nine others, and a
test asserts the set is exactly claude + codex so it can't drift silently.
Two behaviors are preserved: selecting a harness pins it inline via the
existing `effectiveAgentId` rule, so the active pick is never buried; and
the hide-unconfigured preference still outranks support level, dropping
harnesses that can't launch here (and the "More" trigger with them when
that empties the group).
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* feat(web): promote previously-launched harnesses in the picker
Splitting the picker by support level left Pi and Cursor users a hover
away from their harness on every new session, even though the split is
right for a first-time user. Nothing recorded which harnesses someone
actually launches.
Add a localStorage-backed `useRecentHarnesses` (modeled on
`useRecentWorkspaces`, but not host-scoped — a preference for Pi follows
the person across machines) and record the canonical harness id on a
successful create. The picker then promotes any recorded harness into the
primary list alongside the fully supported ones, so a regular Pi user
gets one click instead of one hover, while a fresh install still leads
with Claude Code and Codex only.
Recording happens only after the create succeeds, so a harness the user
merely browsed past never earns a slot, and the hide-unconfigured
preference still outranks recency: promotion applies within what can
launch on the host, never resurrecting a harness that can't run there.
Stored ids fold through the reversed-alias map, so `native-pi` matches
the canonical `pi-native` spec.
Also fixes the two CI failures from the support-level split: the flow
test's `selectAgent` helper now drills into "More" only when the row
isn't already inline, and the harness-install e2e no longer drills for
Codex (fully supported, so it leads inline even while needing setup).
Adds tests/e2e_ui coverage for both behaviors, stubbing every harness as
configured so the split is provably driven by support level rather than
host readiness.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
---------
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* feat(webui): wire SessionRail into AppShell behind ?debug=1
SessionRail and ExecutionLogsPanel were implemented but never rendered.
Add SessionRail as a desktop-only column between the chat and workspace
panel, gated on debugMode so it only appears with ?debug=1. The column
hides automatically when a push panel (terminals or execution logs) is
open.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix(webui): remove TerminalsCard from SessionRail debug rail
Terminals are already shown in WorkspacePanel. The debug rail should
only show the Execution logs card. Also removes the onExpandTerminals
prop and all terminal-related dead code from SessionRail.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix(webui): fix execution logs card title overflow in debug rail
Widen the debug column from w-48 to w-56 and add truncate/min-w-0 to
the CardTitle so the text doesn't overflow into the action buttons.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix(webui): add top padding to debug rail column
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
---------
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix(web): keep chat content clear of the TurnRail as the area narrows
PR #4085 replaced the transcript's md:pl-12 left inset with a symmetric
px-4 gutter, dropping the clearance that kept the centered chat column off
the left-edge TurnRail (the tick minimap). On a narrow conversation area
the prose crowded the ticks.
Restore the clearance as a continuous, width-driven clamp keyed on the
conversation area (@container/chat) rather than the viewport: the column
slides left with the area until its edge nears the rail, then the left
inset ramps up to hold a minimum gap and caps at 3rem so it stops moving
instead of snapping. Because it reads the area width, opening the sidebar
feeds it too.
Add a multi-turn visual-snapshot test that mounts the rail (it only renders
for >= 2 turns, so the one-turn baseline never covered it), rendered at a
narrower viewport so the inset is actually engaged in the capture.
Co-authored-by: Isaac
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
* test(e2e-ui): regenerate visual baselines
* fix(web): shrink rail gap to 24px and stop the pill leaking into snapshots
Reduce the restored TurnRail clearance cap from 3rem to 1.5rem (24px) so the
column sits closer to the ticks while still clearing them.
Park the pointer out of the transcript's top hover band before capture in both
chat snapshot tests. Playwright's virtual mouse starts at (0,0), inside the band
that reveals the "Jump to top" pill (and, on the rail test, over a tick), so a
load-timing race could flash that transient chrome into the resting-state
baseline. Moving the pointer low pins it hidden.
Co-authored-by: Isaac
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
* test(e2e-ui): regenerate visual baselines
* test(e2e-ui): hide the Jump-to-top pill from chat snapshots deterministically
The pill is transient chrome: the initial layout settle (LatestTurnSpacer +
StickToBottom pinning to the bottom) fires a scroll that reveals it for ~2s, so
whether it lands in a capture is a race — which is why a regenerated baseline
picked it up. Force it hidden via an injected style, the same way the shared
settle kills the blinking caret, so the resting-state baseline is deterministic
regardless of when the scroll settles.
Co-authored-by: Isaac
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
* test(e2e-ui): regenerate visual baselines
---------
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
Co-authored-by: omnigent-ci[bot] <294685417+omnigent-ci[bot]@users.noreply.github.com>
- PiExecutor._resolve_model: strip trailing [1m]-style bracket suffixes before
passing model IDs to the Databricks AI Gateway. The direct Anthropic API
accepts e.g. system.ai.claude-opus-5[1m] but the gateway endpoint does not
(returns 404).
- CodexExecutor.run_turn: when model_provider_override is set (cli-config path)
pass model=None to thread/create so the codex binary uses its own configured
model rather than forwarding an unresolvable alias (e.g. gpt-5.6) to the UC
API.
- credential_label: cli-config providers now label from the entry name
(provider_display_name) rather than the display_name field, for consistency
with other provider kinds.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* Root cause fix — omnigent/policies/builtins/_shell.py
sudo/env/command/time/exec moved out of CMD_WRAPPERS (skip-one-word) into _FLAG_WRAPPERS with their value-consuming flags. CMD_WRAPPERS is now just {"nohup"}, which genuinely takes no options. -- needs no entry — it's consumed as a valueless flag.
While verifying, I found the same hole one level down, which also affects the original GHSA-fixed wrappers: _skip_flag_wrapper_args matched value flags by whole-token equality, so bundled short options bypassed too — sudo -nu root git push, env -iu FOO git push, and (pre-existing) nice -qn 10 git push. It now scans the bundle's characters and consumes a separate value only when the value-taking option is the bundle's last character, so -n 10/-o L still consume while -n10/-oL stay attached. This mirrors orchestration.py:236-245, which already got this right for blast_radius.
Fail-safe backstop — new is_unresolved_invocation(), wired into both consumers
The wrapper tables are an enumeration, so I didn't want the next unmodelled wrapper to be another silent ALLOW. A head still starting with - now routes through each policy's existing "can't parse this" path rather than abstaining — ASK in github.py, the configured action in working_dir.py. Reachable today via nohup -- git push …. Detection is shared; the response stays per-policy, per the module's stated contract.
* 1. env -S / --split-string (the blocker). Reviewer was right: modelling -S as a value flag swallowed the command into the flag's value, leaving zero tokens — which is_unresolved_invocation([]) can't see. Fix takes the reviewer's option (b): env -S is a command interpreter like sh -c, so it's unwrapped and re-parsed on the path that already exists for bash -c / eval.
- _skip_flag_wrapper_args gained a capture_flags set and now returns (index, captured) — reusing the existing flag walk (which already handles --flag=v, -S v, -Sv, bundles like -iS v) instead of writing a second scanner.
- real_invocation_tokens stops at env when a split-string is captured; unwrap_shell_command returns it → recursion gates the inner command.
env -S 'git push <evil> main' → DENY. env -S 'npm test' → still abstains.
2. /usr/bin/sudo -u root git push — same fail-open, not flagged in either review. Wrapper lookup matched the bare word only, so a path token became the apparent command and the segment abstained → ALLOW. Wrappers now match on basename (unwrap_shell_command already did).
* fix(policies): add BSD sudo -a/--auth-type and -c/--login-class to value-flag set
These two options were missing from _FLAG_WRAPPERS["sudo"], leaving a
residual silent-ALLOW bypass: sudo -a foo git push ... left "foo" as
the apparent command head, which does not start with "-" so is_unresolved_invocation
could not catch it. Add both flags and tests for each form.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
---------
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
Co-authored-by: Tomu Hirata <tomu.hirata@gmail.com>
test_scheduled_task_create_edit_modal_and_time_picker flaked ~30% of runs,
always timing out on `_pick_minute`'s `name_input.click()` with
"dialog-overlay intercepts pointer events". While the time-picker Popover is
open, the Radix Dialog owns pointer hit-testing over the modal, so a normal
actionability-gated click at the input's coordinates resolves to the overlay
and blocks the full 30s under load.
Force every dismiss click on the name input (`click(force=True)`) — the same
technique the picker's open click already uses. A forced click still
dispatches a real pointerdown on the input, which Radix registers as the
interaction-outside that closes the popover, without waiting on overlay
actionability. Covers all three dismiss sites: the retry path and final
dismiss in `_pick_minute`, plus the two post-typed-time blurs in the test body
(focusing the time input reopens the picker via onFocus).
Verified: reproduced the flake (multiple failures across batches of 5-8 runs),
then 12/12 green after the fix; the full file's 9 tests pass.
Co-authored-by: Isaac
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
* refactor(web): decouple typography from interface geometry
Make the desktop font preference drive semantic text tokens while keeping icons, controls, and spacing fixed.
Signed-off-by: Ajay Alfred <ajayalfred07@gmail.com>
* refactor(web): migrate interface body text to text-ui
Use the settings-controlled semantic body token across shared components and application pages for consistent sizing.
Signed-off-by: Ajay Alfred <ajayalfred07@gmail.com>
* style(web): refine sidebar typography and empty states
Align sidebar hierarchy with settings-controlled tokens and make empty projects easier to scan.
Signed-off-by: Ajay Alfred <ajayalfred07@gmail.com>
* style(web): tighten sidebar density and theme polish
Unify sidebar row geometry, refine theme-specific colors and canvas treatments, and standardize compact controls.
Signed-off-by: Ajay Alfred <ajayalfred07@gmail.com>
* test(e2e-ui): align font size checks with typography tokens
Update browser assertions for the discrete desktop font token and its current bounds.
Signed-off-by: Ajay Alfred <ajayalfred07@gmail.com>
* test(ui-snapshot): update typography visual baselines
Adopt the CI-rendered snapshots for the intentional settings-driven typography changes.
Signed-off-by: Ajay Alfred <ajayalfred07@gmail.com>
* fix(web): preserve dark active sidebar hover
Keep selected row colors stable when hovering in dark mode across both sidebars.
Signed-off-by: Ajay Alfred <ajayalfred07@gmail.com>
* style(web): polish sidebar actions and overlays
Align sidebar controls, dropdowns, and tooltips with shared density, typography, and interaction tokens for a more consistent visual hierarchy.
* style(web): normalize mobile sidebar scale
Keep mobile sidebar typography and icon geometry predictable without changing the desktop presentation.
* style(web): refine responsive sidebar and chat density
Use responsive sidebar spacing and settings-driven chat typography so mobile and desktop retain clear, consistent reading rhythm.
* test(web): align CI expectations with sidebar polish
Update E2E assertions and reviewed visual baselines to reflect the intentional typography, navigation, and density changes.
Signed-off-by: Ajay Alfred <ajayalfred07@gmail.com>
---------
Signed-off-by: Ajay Alfred <ajayalfred07@gmail.com>
* dev/repro-agent: pin the verdict handoff to a single JSON block
The output contract only said "a single structured verdict block" without
pinning a format, so the agent rendered YAML on some runs and JSON on others,
and the shape drifted (missing facets, prose bullets instead of objects). That
makes the `verdict` field — which the caller parses to label the issue —
unreliable to extract.
Pin it: exactly one fenced ```json block as the final message, JSON only, every
key always present, and `verdict` restricted to the four lowercase literals so
it matches verbatim. `facets` becomes an array of {symptom, verdict, evidence}
objects instead of free-form bullets. README step 4 updated to match.
Co-authored-by: Isaac
* dev/repro-agent: require the JSON block be the last chunk, allow prose above
Some runs split the artifacts into separate markdown sections (a small
"Reproduction Verdict" block, then prose "Journey"/"Facets" headers) with no
single consolidated handoff, so there was no reliable last block to parse.
Clarify the contract: comprehensive prose above the block is fine, but the
```json block must be the LAST chunk of the final message (nothing after its
closing fence) and must carry the complete self-contained handoff. Explicitly
forbid splitting the artifacts across separate sections/headers. There is no
output-schema enforcement for the claude-sdk agentic loop (AgentSpec.output_type
is inert), so this is enforced by instruction plus last-```json-fence parsing on
the caller side.
Co-authored-by: Isaac
The "new session in project" pencil navigates to /?project=<name> while
the landing screen stays mounted. The project-prefill state machine only
restarted when the ?project= param changed, so re-clicking the SAME
project's pencil after editing its default settings kept the stale seeds
— the fix only showed up after clicking another project (or Home) and
back, which flipped the param away and back.
Track a signature of the config the machine last settled from and restart
the prefill when that content changes for the same project, mirroring the
project-switch reset. The saved config is already fresh in the react-query
cache; this makes the machine re-read it.
Co-authored-by: Isaac
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
* Add deep-research example (single agent over an MCP search server)
A single-agent example that answers a question with a cited, cross-checked
report: it plans sub-queries, searches the live web and reads full pages
through an MCP search server, and verifies claims across independent sources.
It is the repo's first example that wires an MCP server via tools/mcp/*.yaml
(auto-discovered), so it also documents the MCP extension path. One agent plus
one MCP server, no sub-agents — the simplest example to copy from. Runs
zero-config against a public, keyless endpoint.
Signed-off-by: Ilya Bogin <ilya.bogin@keenable.ai>
* test: add e2e coverage for the deep-research example agent
The examples-coverage-sync drift guard (test_every_agent_has_a_dedicated_test_file)
requires every example agent to have a dedicated e2e test. The deep-research
example shipped without one, failing E2E Tests (shard 0/4).
Add a structural test via validate_agent_def_structure (infra-free: the agent's
tools come from the hosted Keenable MCP server and it runs on the claude-sdk
harness, so it can't run end-to-end in CI). Because the agent name 'deep-research'
has a hyphen (not a valid Python test-module name), the test lives in
test_deep_research_example.py and the guard is told via a 'deep-research' entry
in _ALT_COVERED, mirroring the existing 'openai-coder' handling.
Signed-off-by: Ilya Bogin <ilya.bogin@keenable.ai>
* docs: show deep research search provider options
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
---------
Signed-off-by: Ilya Bogin <ilya.bogin@keenable.ai>
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
Co-authored-by: Pat Sukprasert <pattara.sk127@gmail.com>
Co-authored-by: Pat Sukprasert <pat.sukprasert@databricks.com>
* feat(qwen,goose): record delegated fs I/O and gate it with result-phase policy
Omnigent's OSEnvironment but left two layers as documented follow-ups: the
delegated I/O was invisible in history and no content policy ran on it.
Wire both onto the existing _handle_fs_read / _handle_fs_write handlers:
- emit a paired ToolCallRequest + ToolCallComplete per op so the I/O shows in
history (the adapter renders them as observed function_call items)
- run PHASE_TOOL_RESULT content policy on the bytes; an explicit deny refuses
the op (a write is gated before it happens), failing open otherwise
Content-only: the harness policy round-trip carries no request_data, so the
payload is {"result": content}. Closes the file-I/O recording / content policy
item in docs/QWEN_FOLLOWUPS.md.
Signed-off-by: Enes Yilmaz <enesyilmaz5157@gmail.com>
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
* fix(qwen,goose): gate delegated fs at the call phase and audit stale ops
Addresses the review on the delegated-fs recording/policy work.
1. Phase semantics. A delegated write was gated by a result-phase policy eval
before the write, which is content-only and fails open, so a policy timeout
would let the write through. Gate writes (and reads) at PHASE_TOOL_CALL with
the tool name, path, and content, failing closed on an eval error or an ASK
verdict (delegated fs has no elicitation path). Reads keep the result-phase
content check that decides whether the read bytes reach the model.
2. Audit records. Stale prior-turn server fs requests were answered at turn
start, running real I/O, and then had their ToolCall events cleared before
they reached history. Drain those events into history instead of dropping
them, so the I/O they performed is recorded.
Signed-off-by: Enes Yilmaz <enesyilmaz5157@gmail.com>
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
* fix(qwen,goose): evaluate result-phase policy after a delegated write
The write handlers gated at PHASE_TOOL_CALL and then wrote, but never ran a
result-phase evaluation, so the value env.write() returned was never policy
checked and the audit record dropped it. Reads already did both phases.
Run PHASE_TOOL_RESULT after the write carrying the actual result. A denial
records BLOCKED and refuses the response; it cannot undo the write, since it
runs after the operation. The success record now carries the real result too,
matching the read path.
_fs_content_policy_denies was read-specific, so it is now
_fs_result_policy_denies and takes any result. Read behavior is unchanged.
Signed-off-by: Enes Yilmaz <enesyilmaz5157@gmail.com>
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
---------
Signed-off-by: Enes Yilmaz <enesyilmaz5157@gmail.com>
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
PR #3105 removed the `server start` subcommand in favor of
`server --background` and updated the Electron shell-out in the same
commit. The desktop app ships on its own electron-updater channel, so a
client built before v0.7.0 is a normal steady state against a v0.7.0
CLI — and it still runs `omni server start`, which now dies with
"No such command 'start'". "Start locally" is broken for those users.
Restore the subcommand as a hidden alias that routes to the same helper
as the flag, so the two spellings cannot drift. The deprecation notice
goes to stderr; the desktop parses the URL off stdout, which is
unchanged.
Signed-off-by: Yi Lyu <isabellalyu1130@gmail.com>
Co-authored-by: Serena Ruan <82044803+serena-ruan@users.noreply.github.com>
Remove the cron schedule triggers from both discord-watch-rotation
workflows so they no longer fire automatically. workflow_dispatch is
kept for manual runs, and the original crons are left commented out so
the schedules can be restored later.
Co-authored-by: Isaac
Switching from a Codex session to a Claude Code session briefly painted
the Codex model (e.g. gpt-5.5) in the Claude session's composer before
correcting itself.
`switchTo` clears the session-scoped model fields but deliberately keeps
`selectedModel`, the cross-session sticky pick, so a CLI-created new chat
inherits the user's last choice. The native picker kind flips to Claude
immediately (the session query and sidebar row are already cached), so
for the whole snapshot round trip the composer resolved the sticky and
read the outgoing session's model.
Only surface the sticky once the session's own catalog vouches for it.
Pre-bind the catalog is empty, so the label waits instead of advertising
a model this session would reject; post-bind it is a no-op, since the
store only ever leaves a catalog-compatible sticky (or the override) in
`selectedModel`.
Co-authored-by: Isaac
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(server): file forked sessions into the source's project
Forking a session filed in a first-class project left the fork unfiled:
fork_conversation built the fork's metadata row without project_id. The
fork route now carries the source's project onto the fork, gated on the
forker owning that project (projects are owner-private, so a fork of a
shared session filed in someone else's project stays unfiled).
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(web): refresh the project folder when a session is forked
A fork inherits the source's project, but the dialog only invalidated the
flat session list — each folder renders its own ["project-sessions", name]
query, which has no poll and converges only on an explicit invalidation.
The push stream can't cover it either: it skips the active session, and the
fork becomes active on navigate. So the clone stayed missing from its folder
until a reload or a re-navigation.
Adds an e2e regression test. It seeds the committed turn the fork action
anchors on straight into the store (new seed_committed_turn helper) instead
of driving a model turn, so it neither waits on nor inherits the flakiness
of the mock-LLM harness.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(web): stabilize reasoning indicators during active turns
Signed-off-by: dbczumar <corey.zumar@databricks.com>
---------
Signed-off-by: dbczumar <corey.zumar@databricks.com>
A dropped host rendered two different indicators depending on incidental
state. The badge read the host tunnel directly (name + red dot), while
ChatPage passed a separate `hostOffline` prop derived from
`liveness.kind === "host_offline"` that replaced the name with generic
"Host is offline — click to reconnect" copy.
`host_offline` is far narrower than "the host tunnel is down": it also
requires the runner to be down (a live runner short-circuits to `online`),
the startup grace to have lapsed, and the host to be non-resumable. So the
same event — the host dropping — showed a passive, unclickable name when
the runner outlived the host, and a nameless reconnect prompt when it
didn't. The name is what tells the user which machine to go restart.
The badge now owns the decision: one shape (name + status dot) that turns
into a button opening the reconnect instructions whenever its bound host is
offline and reconnectable. A dormant resumable managed host stays passive —
the next message wakes it, so `omnigent host` would be wrong advice.
The reconnect dialog's state now comes from the session's host binding
rather than liveness, so a session whose runner outlived its host gets the
`omnigent host` command instead of the local `omnigent run --resume` one.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
Closes#866
The `omnigent` Homebrew formula has not built since 0.7.0, and the tap reported
green anyway, so 0.7.0, 0.8.0 and 0.8.1 all merged with no bottle — every user
compiled from source, and CEL policies silently did not work.
- **Root cause was the CEL migration.** #2970 swapped `cel-expr-python` for
`cel-python` on the premise that it is pure Python. It is not: `cel-python`
hard-depends on `google-re2`, whose sdist runs `bazel build` whenever
`GITHUB_ACTIONS` is set. The bazel dependency moved rather than disappeared.
- **Pin compiled extensions to upstream wheels.** `generate_formula.py` gains
`WHEEL_REQUIRED` / `PREFER_WHEEL` / `PURE_WHEEL` with abi3 and universal2
handling, so grpcio (by far the most expensive build), protobuf, regex,
uvloop, httptools, argon2-cffi-bindings, markupsafe, pyyaml, zstandard and
google-re2 stop being compiled. Native wheels rank above pure-Python ones, so
protobuf keeps its upb build instead of the slow fallback.
- **jiter, tiktoken and watchfiles keep building from source.** Their maturin
wheels carry no Mach-O install-name padding, so Homebrew relocation fails with
"Failed changing dylib ID" (#866). `pendulum` can go neither way — its wheel
cannot be relocated and its sdist does not link on 3.14 (pyo3 leaves
`_Py_NoneStruct` undefined) — so it takes the pure-Python wheel, which ships
no extension module at all.
- **A dropped dependency is now an error, not a warning.** A missing sdist used
to be skipped silently, yielding a formula whose venv lacked an import;
`--allow-no-sdist` is the explicit waiver. The formula test also asserts
`import re2, celpy`, since omnigent imports celpy behind `try/except
ImportError` and would otherwise disable policies silently.
- **Delete `update-homebrew.yml`.** It raced `homebrew-tap-pr.yml` on the same
`release: published` event and asserted on hand-maintained stanzas the
template no longer emits, so it failed on every run. Its one worthwhile part
moves into `homebrew-tap-pr.yml`: an admin/maintain gate on manual dispatch
(it writes to another repo with an App token), plus
`persist-credentials: false`. Its nightly `schedule` is deliberately NOT
carried over -- that cron only existed because `brew
update-python-resources` resolves through pip's `--uploaded-prior-to=P1D`
window and so could never see a same-day release. The generator runs `uv pip
compile --no-config` straight against PyPI, so the blindness it worked around
no longer exists, and a nightly regeneration would just burn a runner to
print "nothing to do".
Verified by building the generated formula in the tap, not by inspection.
- `omnigent-ai/homebrew-tap#18` contains **verbatim output of this
`generate_formula.py`** and bottled successfully on macos-15 and macos-26
(run 30944428771, `bottles_macos-15` / `bottles_macos-26` ≈ 37 MB each). This
is the check that matters: it proves the generator — not a hand-edit —
produces a buildable formula, so the next release regenerates something that
works.
- `omnigent-ai/homebrew-tap#17` carries the same fix for the shipped 0.8.1
formula and is green on all three runners, with `brew test` running
`import re2, celpy`. Inspected the bottle: `celpy/__init__.py`,
`re2/_re2.cpython-314-darwin.so`, and a relocated
`jiter/jiter.cpython-314-darwin.so`.
- Audited every pinned wheel by replaying Homebrew's own operation,
`install_name_tool -id <Cellar path>` against each extracted `.so`, so the
wheel/source split is evidence-based rather than guessed.
- `python3.12 -m py_compile`, `ruff check`, `ruff format --check`, `brew style`
(no offenses), `ruby -c`, plus stubbed-PyPI unit checks of the new failure
paths (missing sdist is fatal, `--allow-no-sdist` waives it, abi3 accepted,
free-threaded `cp314t` rejected).
- Confirmed generator output matches the green formula: same 100 resources,
identical sdist/wheel split, no non-comment differences.
N/A — release tooling, no user-visible UI.
- [x] Bug fix
- [ ] Feature
- [ ] UI / frontend change
- [ ] Refactor / chore
- [ ] Docs
- [ ] Test / CI
- [ ] Breaking change
- [ ] Unit tests added / updated
- [ ] Integration tests added / updated
- [ ] E2E tests added / updated
- [x] Manual verification completed
- [ ] Existing tests cover this change
- [ ] Not applicable
The generator has no test suite in this repo, and its real contract — "the
emitted formula builds under Homebrew on macOS" — cannot be asserted here. It is
covered instead by building the generated formula on the tap's `brew test-bot`
matrix (homebrew-tap#18, bottles produced on macos-15 and macos-26). The two new
generator failure paths were exercised locally against stubbed PyPI metadata,
and every wheel pin was verified relocatable with `install_name_tool`.
`brew install omnigent` works again, and installs prebuilt wheels instead of
compiling grpcio and friends from source.
Signed-off-by: Zeyi (Rice) Fan <zeyi.f@databricks.com>
The boxlite SDK's BoxOptions already supports disk_size_gb, but the
omnigent wrapper never threaded it through — every box got the SDK's
own default disk size with no way to override it. Add
sandbox.boxlite.disk_size_gb to the server config, alongside the
existing image/env knobs.
Signed-off-by: Avri Chen-Roth <11185446+the-mentor@users.noreply.github.com>
Co-authored-by: Avri Chen-Roth <11185446+the-mentor@users.noreply.github.com>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
* refactor(web): decouple typography from interface geometry
Make the desktop font preference drive semantic text tokens while keeping icons, controls, and spacing fixed.
Signed-off-by: Ajay Alfred <ajayalfred07@gmail.com>
* refactor(web): migrate interface body text to text-ui
Use the settings-controlled semantic body token across shared components and application pages for consistent sizing.
Signed-off-by: Ajay Alfred <ajayalfred07@gmail.com>
* style(web): refine sidebar typography and empty states
Align sidebar hierarchy with settings-controlled tokens and make empty projects easier to scan.
Signed-off-by: Ajay Alfred <ajayalfred07@gmail.com>
* test(e2e-ui): align font size checks with typography tokens
Update browser assertions for the discrete desktop font token and its current bounds.
Signed-off-by: Ajay Alfred <ajayalfred07@gmail.com>
* test(ui-snapshot): update typography visual baselines
Adopt the CI-rendered snapshots for the intentional settings-driven typography changes.
Signed-off-by: Ajay Alfred <ajayalfred07@gmail.com>
---------
Signed-off-by: Ajay Alfred <ajayalfred07@gmail.com>
`HostRegistry.deregister` was a bare `dict.pop`, and the host tunnel's receive
loop refreshed `conn.last_frame_at` without checking whether its connection was
still the registered one. The runner side already guards both (
`TunnelRegistry.deregister` takes a session guard and `mark_frame_seen` rejects a
superseded session); the host side did not, so a host could be left in a state
its own route handler never noticed.
Dropping a host registration from outside the route handler did not close the
socket or cancel its tasks. The ping loop kept writing `host_store.heartbeat`, so
the durable row stayed **online** while every `host_registry.get` reported the
host offline. Anything that resolves liveness from that row then waits for a
reconnect the host was never told to make, because from the host's side nothing
happened. `register` already poisons a replaced connection's outbound queue for
exactly this reason; `deregister` now does the same.
Three changes:
- `deregister` queues the `None` sentinel so the sender loop exits and the
socket tears down, letting the host redial.
- `deregister` takes an optional `conn` generation guard and returns whether it
removed an entry. The tunnel route gates its `set_offline` write on that
return, so a superseded handler reaching cleanup after a reconnect replaced it
can no longer evict the live connection or mark a live host offline.
- `mark_frame_seen` mirrors `TunnelRegistry.mark_frame_seen`: a frame only
refreshes liveness while its connection is current, and the receive loop stops
when it is not.
Six tests added to `tests/server/test_host_registry.py`; five of them fail
against the previous behavior.
Co-authored-by: Isaac
Signed-off-by: Mark Tai <mark.tai@databricks.com>
Co-authored-by: Mark Tai <mark.tai@databricks.com>
* feat(web): fold settled turns behind a 'Worked for Xs' row
Once a turn completes, the chat view collapses its whole process trace
(interstitial narration, tool-run folds, resolved approval cards,
reasoning) behind one muted 'Worked for Xs' expander with a hairline
rule, leaving only the final answer visible - mirroring the Codex
desktop treatment so it's obvious where reading starts instead of a
wall of uniform prose. Expanding the row replays the trace inline.
- Live turns keep their trace expanded; liveness comes from the
bubble's own lifecycle, not session status, so a completed turn
folds even while a later turn streams (and vice versa).
- partitionTurn splits a settled turn into foldable process, exempt
always-visible cards (pending elicitations, persistent
dispatch/routing cards, in-progress spinners), and the trailing
final answer; a turn with no trailing answer (interrupted / failed
/ tool-only) never folds. Resolved approval cards fold with the
trace in document order. Codex's trailing turn_diff bookkeeping
folds as process instead of masquerading as the answer.
- The 'Worked for Xs' duration spans the live stream clock while
streaming, or the items' server created_at stamps on reload;
ConversationItem.to_api_dict() now exposes created_at (additive)
to make the reload path possible.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* test(stores): expect created_at in the item API-shape round-trip
to_api_dict() now serializes created_at, so the exact-shape assertion
gains the store-assigned stamp.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* docs(web): demo screenshots + cross-clock note for the turn fold
Adds the collapsed/expanded 'Worked for Xs' screenshots referenced by
the PR description, documents that turnWorkedForS's first block picks
the clock branch, and pins the reverse mixed-clock direction
(live-first, epoch-last) as undefined.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(web): settle the turn lifecycle on bare terminal status edges
The 'Worked for Xs' fold (and the Fork action) only appeared after
navigating away and back: the turn lifecycle finalized live ONLY on a
session.status edge carrying a matching response id, but most idle
publishes carry none (the PTY-activity relay, orchestration teardown).
So a native turn ending on a bare idle cleared 'Working…' while the
bubble stayed 'streaming' forever — settled state was only re-derived
from the snapshot on reload.
- session_status: any terminal edge (idle/failed/waiting) now
finalizes a still-streaming turn, id-matched or not; cancelled is
preserved. The stray running->idle pair the policy-deny
short-circuit publishes mid-turn is healed by
reviveStrayCompletedResponse: live deltas for the turn flip it back
to streaming, so the misread is a brief flicker, not a mid-turn
fold.
- Mid-turn first open: the initial session bind now reopens the
streaming lifecycle from the snapshot's activeResponseId (mirroring
reconnectStatusPatch), so a running session's live turn renders
expanded instead of prematurely folded.
- e2e: test_bare_idle_finalizes_turn_and_folds drives the exact event
sequence (running+id -> items -> bare idle) against a real server
and asserts the fold forms in place, no reload.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(web): fold turns split by a sub-agent await, and ease the collapse
Two gaps in the 'Worked for Xs' fold, both visible on a turn that
dispatches sub-agents.
Fold never formed. Dispatching sub-agents ENDS the parent turn — it
must yield to await their results — and the inbox wake starts a new
turn under a new response id carrying the answer. That splits one
logical turn across bubbles: the first holds narration + tool calls
and no answer, the second holds the answer and no work. The fold
required both halves in ONE bubble, so neither qualified and the
narration stayed spread out unfolded. buildBubbles now flags a bubble
whose turn continues in a later assistant bubble (scanning past the
runtime [System: ...] wake markers, stopping at a real user turn),
and such a bubble folds its whole trace despite carrying no answer.
The flag participates in bubblesEqual so the memoized bubble actually
re-renders when its continuation lands.
Collapse was abrupt. The settled render swapped a tall expanded trace
for a one-line row in a single frame, which read as a partial page
reload. The fold now MOUNTS OPEN when the turn settles on screen and
closes on the next frame, so the steps visibly fold into the summary
row; settled history still mounts closed (nothing to animate away).
The height animation lives in index.css because it needs Radix's
measured --radix-collapsible-content-height, and is disabled under
prefers-reduced-motion.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(web): remove the jolt at the start of the turn-fold collapse
The collapse read as two motions. Measuring the bubble height every
frame through a settle showed why: inserting the summary row and the
fold's own padding/border grew the bubble ~43px TALLER in one frame,
and only then did the 200ms collapse run — a jolt up, then a ramp
down.
- The summary row now grows in (grid-template-rows 0fr -> 1fr) over
the same beat instead of appearing at full height, so row expanding
and trace shrinking net one monotonic shrink.
- The animated element carries no padding or border of its own: any
chrome there is height that lands before the collapse starts, which
is exactly the jolt. Expanded spacing comes from the row's hairline
above and the message column's gap below.
- The fold also animates when it appears on an already-mounted bubble,
not only when the turn itself settles — a turn split by a sub-agent
await folds when its continuation lands, and that case was snapping
shut with no animation at all.
Measured on a live server, same turn shape both times: leading jolt
43px -> 10px, and both the plain and sub-agent-split cases now show a
single animated ramp instead of a jump followed by one.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(web): stop the turn fold oscillating on codex sessions
On codex the fold flipped collapsed/expanded repeatedly as a turn
streamed. Instrumenting a live turn showed why: the server recorded
that turn as ONE response, but the client showed five to seven
bubbles. A streamed narration renders as its own transient 'live:'
preview bubble until its authoritative item replaces it, and reasoning
bursts group separately, so bubbles appear and merge away on every
delta. Each appearance gave an earlier bubble 'a later assistant
bubble' and marked it continued, folding a fragment; the merge
unmarked it and unfolded it again. Two fragments folded mid-turn as
'Worked for 1s' / 'Worked' rows carrying only a reasoning burst.
- markContinuedTurns only runs between turns: while a response is
streaming the transcript is mid-restructure, so nothing is marked.
Marks are sticky, so a bubble that has folded never reopens when the
next turn starts streaming.
- A continued bubble must also have RUN something (a tool call in its
process) to fold. That is the shape the flag exists for — narration
plus tool calls, then a yield to await sub-agents — and it keeps a
narration- or reasoning-only fragment from folding into a lone
'Worked' row with nothing behind it.
Measured on live codex turns, same prompt shape: fragments folding
mid-turn 2 -> 0, and the only remaining fold is the real one at turn
end.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(web): never fold a bubble made only of streaming artifacts
Residual codex flicker: the fold still appeared and vanished mid-turn,
just less often. This path never involved the continued flag, which is
why the previous guards only reduced the frequency.
Codex splits an in-flight turn into fragment bubbles — a reasoning
burst (ctx.itemId is null until its item is finalized) plus a 'live:'
narration preview. Their synthetic response id never matches
activeResponse, so walkBubbles labels them 'completed', and a fragment
holding reasoning + text satisfied the ordinary process-plus-answer
rule and folded. When the authoritative item replaced the preview the
fragment merged away and its fold went with it.
A genuine turn always carries at least one server-assigned item id, so
a bubble whose items are ALL null-id or 'live:'-prefixed is a fragment
of the turn still arriving and never folds. LIVE_ITEM_PREFIX moves to
lib/blocks.ts so the renderer and the store share one definition.
Verified by assertion: before this change a reasoning + live-preview
bubble rendered a fold; now it renders expanded. Two frame-exact
recordings of the reported prompt (63k frames, with approvals) showed
no fold disappearing, so this was found by construction rather than by
reproducing it live.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(web): render a native turn as one bubble live, so it folds like it does on reload
Root cause of the codex fold flicker, found by comparing the same
conversation live vs reloaded: 4 assistant bubbles and NO fold live, 1
bubble folded after a reload. A native turn was being split into
fragment bubbles while streaming and merged back into one on reload,
so the two views disagreed. walkBubbles groups by response id, and
three kinds of block carried the wrong one:
- Live text previews were stamped with a synthetic 'live:<id>' as
their response id, so each streamed narration broke the run. They
now adopt the live turn's id (falling back to the synthetic id when
no turn is tracked, so a preview can't join an unrelated bubble).
- A native harness emits no response.created, so the reducer never
learned the turn id and stamped its own blocks (reasoning, streamed
text) with a stale or empty one. A 'running' status edge carrying a
turn id IS the native turn-start signal, so the reducer adopts it --
without sealing an already-open section, since codex opens reasoning
~2s BEFORE that edge lands and closing would split one thought in
two.
- Blocks emitted in that ~2s window still carry no id, so the store
attributes the trailing unattributed run to the turn when the edge
names it.
With one bubble per turn, the fold condition stops oscillating: it was
flipping because the fragment boundaries moved as previews appeared
and merged, so whichever fragment momentarily had the
process-plus-answer shape folded and then unfolded.
Also: a trailing reasoning item no longer blocks the fold. Codex opens
a reasoning section as the turn ends, landing it after the final
message; reasoning is process, never the answer, so it peels into the
trace like the turn_diff wrap-up already did.
Measured on the reported prompt (with approvals), same shape each
time: bubbles 4 -> 1, and fold transitions went from 'never appears
live' to exactly one 0->1 the instant the turn ends, with zero
decreases (no flicker).
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(web): make bubble grouping and the turn fold robust to a mid-turn connect
The codex flicker survived the response-id stamping fixes because their
premise was fragile: they depend on the client CATCHING the one
'running' status edge that names the turn. A tab that connects (or
reconnects) mid-turn never sees it — SSE replays no status edges — so
reasoning blocks carry rid "" and live previews fall back to their
synthetic ids. Attaching a fresh client to the reporting user's live
session reproduced it exactly: the persisted turn was ONE response, but
the page rendered up to ELEVEN bubbles, five of which folded mid-turn,
including one fold flip back open.
Two structural fixes, replacing edge-dependence with invariants:
- walkBubbles no longer splits a bubble on ANONYMOUS response ids
("" or live:*): such blocks only ever come from the live stream of
the turn around them, so they join it, and a group that OPENED on
anonymous blocks adopts the first real id that arrives. One turn is
now one bubble regardless of which edges the client happened to see.
Bubbles also stop keying off transient live: preview ids, so the
authoritative-item swap no longer remounts the bubble.
- The LAST assistant bubble never folds while the session is running,
even when its lifecycle reads settled — a mid-turn connect misreads
the live turn as 'completed', and folding it collapsed and reopened
the trace as its tail alternated between text and tools. The
session's terminal status edge folds it, which is the natural moment
anyway. Earlier bubbles still fold as usual while a later turn runs.
Verified by attaching mid-turn to a live codex run of the reported
prompt (with approvals): before, 8+ bubbles with 5 mid-turn folds and
a fold flip; after, one bubble, expanded throughout, folding exactly
once when the turn ends.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(web): one bubble — and one 'Worked for' fold — per user turn
The reported flow (a codex step-wise/goal turn) rendered SEVEN
'Worked for Xs' folds under one user message: codex publishes a
distinct response id per STEP on its status edges while the items all
carry the thread id, so each step opened a new bubble, and every
settled fragment folded separately once the turn ended. The server had
persisted the whole thing as ONE response.
- walkBubbles now groups ONE bubble per user turn: a response-id
change between two assistant blocks with no user message between
them is a continuation (step-wise sub-turns, retries, pre-edge
blocks), not a new turn. The group tracks the LATEST real id so
lifecycle follows the live edge. Blocks stamped a distinct id ON
PURPOSE — deny/failure sentinels and REQUEST-phase elicitations —
still open their own bubble, in both directions.
- Fold appearance is debounced (500ms of held eligibility): a
step-wise turn's between-step idle edge, or a stray idle before its
revive, reads settled for a moment and would otherwise fold and
reopen the trace. Losing eligibility hides the fold immediately, and
settled history still mounts folded with no delay.
Tests that pinned per-response grouping modeled adjacent turns with no
user message between them; real streams separate turns with one (the
inbox wake marker in the sub-agent flow), so they now include it. The
reducer-driven reused-callId test keeps its no-cross-pollination
assertions within the merged bubble.
Verified live: a simulated 5-step turn (distinct per-step edge ids,
one thread id) renders one bubble with zero mid-run folds and exactly
one fold at the end, and a real codex approval run folds once, 0.5s
after the turn ends.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(web): don't fold a live turn's partial work on a mid-turn refresh
Refreshing while a turn was parked on an approval collapsed the
partial trace into a premature 'Worked for' row. Two holes let the
last-bubble fold suppression miss the live turn on reload:
- The parked elicitation forms its own trailing assistant bubble whose
card ChatPage floats to the page bottom, leaving the bubble
item-less (it renders null) — and that phantom was counted as the
'last assistant' bubble, handing the actual trace to the fold.
lastRenderableAssistantIndex now skips item-less bubbles.
- On a step-wise codex turn the snapshot's active_response_id names
the STEP id while the items carry the thread id, so on reload the
trace's lifecycle reads 'completed' even though the turn is parked.
A pending elicitation now suppresses the last bubble's fold
directly: a card awaiting the user proves the turn is in flight
regardless of what the lifecycle or session status read.
Verified live: reloading a session parked on a codex command approval
keeps the trace expanded with the card visible, and a simulated
mid-turn reload with the step/thread id mismatch stays expanded until
the terminal idle edge, then folds once.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(web): no 'Worked for' flash when a reload lands between turn steps
Approving an elicitation and refreshing flashed the fold: a step-wise
codex turn publishes an idle edge when each step completes, and a
reload landing in the between-step gap reads fully settled — status
idle, no pending card, trace ending in narration text — so the fold
mounted instantly (the settled-history fast path), then the next
step's running edge cancelled it. Reproduced deterministically: fold
at 0.27s, gone at 1.66s.
Nothing in that snapshot can distinguish the gap from a real turn end,
but the trace's AGE can say how ambiguous it is: items carry server
created_at stamps, so the bubble now records its newest item's time.
The last assistant bubble mounted over a JUST-active trace (newest
item < 15s old) holds its fold for 3s instead of showing it instantly
— long enough for the next step's running edge to cancel it, so the
gap reload never folds at all. A reload after a genuine turn end folds
once the hold elapses, and old history still mounts folded with no
delay.
Verified live against the simulated gap: reload-in-gap shows no fold
ever (was flash-then-hide), reload-after-real-end folds at ~3s, and
stale-history mounts fold instantly (unit-tested).
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(web): don't pop a settled turn's fold open while the next turn spins up
Once a real user message follows the last assistant bubble, a running
status belongs to the reply-in-flight for that newer input, so the
settled bubble's 'Worked for' fold must not be suppressed. Closes the
opencode dip where the prior fold opened for seconds until the new
turn's first item mirrored through the TUI.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* feat(web): scroll the expanded 'Worked for' trace into view
Clicking the fold expands the trace above the reading position, and the
browser's scroll anchoring keeps the answer below it stationary — the
work opens off the top of the viewport and the click looks like a no-op.
On a user-initiated expand whose row+trace don't fit the scroller, snap
the fold row to the top (before paint) so the trace reads from its
beginning. Fits-on-screen expands and the programmatic mount-collapse
animation don't scroll.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* test(e2e): cover the 'Worked for' fold across native wire shapes
Four deterministic events-API tests: step-wise per-step status edges
fold once with no mid-run flicker; items that switch response id
mid-turn still yield one fold per user message; a mid-turn reload keeps
partial work expanded until the terminal edge; and a settled turn's
fold holds through a follow-up send's item-less gap.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(web): always snap the fold row on user expand
The fits-on-screen fast path never held in practice: on the last turn
the stick-to-bottom scroller treats the 200ms expand animation as
appended content and re-pins the bottom, and elsewhere native scroll
anchoring pins the answer below — either way the growing trace glides
the row off the top and the click looks like a no-op. Snap the row to
the scroller top on every user expand (the upward scroll also unpins
stick-to-bottom) and park overflow-anchor for the animation.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(web): make the fold's expand snap win against the bottom-lock
Clicking 'Worked for' while the view is pinned at the bottom (the
resting position on the last turn) did nothing: the expand animation
opens at height 0, so the snap clamps against a scroller with no room,
and stick-to-bottom's resize handler then rides the growth to the
bottom — programmatic scrolls never unpin it. User expands now open at
full height in one frame (no height animation), release the bottom-lock
via a null-safe ConversationScrollLockContext (same recipe as
JumpToTopButton), and then snap the row to the top.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(web): land the fold's snap below the chat top fade
The snap parked the row 8px below the scroller edge — inside
chat-scroll-fade's transparent band (opaque only from 80px), so the
'Worked for' label sat scrolled-to-top yet invisible. The row's
scroll-margin-top now lives next to the fade definition (88px, plus the
iOS inset variant) so the two can't desync.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(web): restore the session busy signal when a live delta revives a turn
A stray idle edge clears sessionStatus before the revive flips the
turn back to streaming, so shouldQueueSend saw an idle session and let
a mid-turn send bypass the queue (and the Working indicator stayed dark
until the next running edge). The delta that triggers the revive proves
the session is mid-turn — restore sessionStatus: 'running' with it.
Local send status stays untouched: cross-client and TUI-typed turns
have no local send in flight.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* docs(web): drop the turn-fold demo screenshots from the repo
The PR description references them by pinned commit SHA, so the binary
assets don't need to live in the tree.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
---------
Signed-off-by: dbczumar <corey.zumar@databricks.com>
## Related issue
N/A
## Summary
- The Databricks AI gateway only serves Claude requests in coding-agent mode when the `x-databricks-use-coding-agent-mode: true` request header is present; omnigent's Claude launches to the gateway did not send it.
- `ClaudeSDKExecutor`'s Databricks gateway env (`_resolve_gateway_env`) and native-claude's ucode launch config now pass `ANTHROPIC_CUSTOM_HEADERS=x-databricks-use-coding-agent-mode: true`, which Claude Code forwards verbatim as request headers (this survives the thinking-display gateway shim, which forwards all request headers).
- Generic-provider gateway envs (non-Databricks `key`/`gateway` providers) deliberately do not receive the header.
## Test Plan
- `uv run pytest tests/test_claude_native.py tests/inner/test_claude_sdk_executor.py -q` — 283 passed.
- Updated the ucode env exact-equality assertion and gateway-env tests to assert the header; added `test_generic_provider_gateway_omits_databricks_header` to pin the Databricks-only scoping.
- `uv run ruff check` and `uv run ruff format --check` on the touched files — clean.
## Demo
N/A
## Type of change
- [x] Bug fix
- [ ] Feature
- [ ] UI / frontend change
- [ ] Refactor / chore
- [ ] Docs
- [ ] Test / CI
- [ ] Breaking change
## Test coverage
- [x] Unit tests added / updated
- [ ] Integration tests added / updated
- [ ] E2E tests added / updated
- [ ] Manual verification completed
- [ ] Existing tests cover this change
- [ ] Not applicable
## Coverage notes
N/A
## Changelog
Claude sessions routed through the Databricks AI gateway now send the `x-databricks-use-coding-agent-mode` header the gateway requires
Signed-off-by: Zeyi (Rice) Fan <zeyi.f@databricks.com>
Moves aravind-segu from `owners` to `owners_paused` in the 12 areas they
owned, so PR reviewer assignment and issue triage stop routing to them.
Readers use only `owners`; the 2+ owner check counts paused owners, so no
backfill was needed and no area is left without an active owner.
`policies` is now down to a single active owner (TomeHirata).
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* fix(codex-native): clear the MCP startup band once the model starts working
The web chat showed 'Starting MCP servers (3/4): <name>' underneath an
agent that was visibly already working, sometimes for minutes.
Codex delivers per-server startup edges only to the connection that owns
the thread, so the forwarder synthesizes the round and settles it when
the thread goes idle after a turn, or when a config-derived window
elapses. Both are late: a server that never reaches a terminal state
(e.g. a misconfigured command that never handshakes) keeps the band
pinned for the whole first turn, and the window stretches to the slowest
configured startup_timeout_sec plus grace (135s for a 120s budget).
Settle on the first model-produced turn item as well. Codex defers turn
EXECUTION until the startup round ends, so assistant-side output proves
the round is over while the turn is still running - the same invariant
the idle-edge settle already relies on, observed at the earliest point
it can be. The band now covers only the genuine pre-turn wait.
The turn's userMessage item is excluded, and only parent-thread events
count: a turn is ACCEPTED (thread flips active, user message
materializes) mid-startup, and a collab child's turn says nothing about
the parent's round.
Two adjacent fixes fall out: a mid-turn reload no longer re-shows the
stale band from the session snapshot, and hitting Stop during a first
turn no longer reports 'cancelled' for servers whose startup had in fact
finished. The failed-turn diagnostic that names still-pending servers is
unaffected - a failed turn/start produces no model output, so no settle
precedes it.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(codex-native): settle the MCP round once, and add before/after visuals
Addresses review feedback on the settle-on-model-output change:
- Settle at most once per forwarder connection. The round is seeded
once per connection and never on thread rotation, so once model
output settles it the outcome cannot change; without a guard every
later item in the session re-read the bridge file to reach the same
idempotent no-op. A state flag short-circuits them, and the new test
re-populates the map behind the flag so dropping the guard fails
rather than passing on idempotency alone.
- Add the before/after chat captures the review asked for, taken at the
same point in the turn (agent running 'sleep 40') against servers
built from the same web UI, differing only in this fix.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* chore(codex-native): drop the committed demo screenshots
The before/after captures don't need to live in the repo; the same
evidence is in the PR description as the sampled A/B table and the
runner-log timeline.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
---------
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(cursor-native): merge Omnigent MCP bridge into existing mcp.json instead of overwriting
write_mcp_config() previously called build_mcp_config() which returned a
dict with only the Omnigent bridge MCP server, then wrote it wholesale to
.cursor/mcp.json. This destroyed any user-configured MCP servers.
Now read the existing mcp.json, merge the Omnigent entry into mcpServers
leaving other keys intact, and write back the merged config.
Fixes#3083
Signed-off-by: lg320531124 <155300404+lg320531124@users.noreply.github.com>
* fix(cursor-native): guard malformed mcp.json and cover the merge path
A hand-edited .cursor/mcp.json can hold any JSON shape. The merge read it
and indexed straight into it, so a list/null root or a non-dict mcpServers
raised AttributeError/TypeError and took down the session launch, where the
old overwrite-always code could not.
Discard non-dict shapes before merging, swap the try/except/pass for
contextlib.suppress (SIM105), and add tests for the merge path (user server
plus a sibling top-level key survive) and the malformed shapes.
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* fix(cursor-native): type the mcp.json merge against JsonObject
main moved this module off typing.Any onto JsonObject (dict[str, object]),
so the merge's `dict[str, Any]` annotation broke ruff F821 and pyrefly
once rebased, and indexing the object-valued mcpServers failed bad-index.
Narrow the loaded JSON with isinstance into a local `servers` dict (the
pattern opencode_native_provider already uses) and bind it back into
`existing`, so the write lands through the alias and stays typed.
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
---------
Signed-off-by: lg320531124 <155300404+lg320531124@users.noreply.github.com>
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
Co-authored-by: Dhruv Gupta <dhruv.gupta@databricks.com>
The example Postgres URLs in these docstrings are placeholders, but gitleaks'
`postgres-connection-string` rule matches the `scheme://name:secret@host` shape
and can't tell a placeholder from a live DSN. That makes them permanent false
positives: they show up in GitGuardian digests, and the Databricks pre-push hook
re-flags them on every new-branch push, since pushing a new branch re-scans
commits already on main. Working around that means reaching for
SKIP_SECRET_SCAN, which is a habit worth not having.
Switching the examples to angle-bracket placeholders sidesteps the rule (`<` and
`>` fall outside its username/password character classes), and reads more
clearly as a placeholder besides.
Docstrings and comments only: with docstrings stripped, the AST of every touched
file is byte-identical to before. Test files are deliberately left alone: their
URLs are live inputs and expected values, and one case exists specifically to
prove percent-encoded credentials survive the prefix rewrite, so rewriting it
would defeat the test. Those remaining findings are best marked as false
positives in the scanner instead.
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
The private Databricks secure-release repo was named in 9 places: three
workflow header comments, the `release.yml` run summary, a design-doc table
row, and four direct links into the private repo's file tree from
`editors/vscode/PUBLISHING.md`. None of it resolves for anyone outside
Databricks.
`release.yml` printed the name into its run summary on every release. Public
run summaries are world-readable, so a repo variable would keep leaking it.
The summary now prints the full command with `<secure-release-repo>` as the
only placeholder, so a release manager still gets something to paste and fill
in, and points at the runbook for the value.
The rest is a straight substitution to "a Databricks-internal secure-release
repo". `PUBLISHING.md` keeps the build half and defers the repo name and
workflow paths to the runbook.
No behaviour change: no trigger, input, permission, or step logic is touched.
The only executable change is the summary `echo` block, verified by extracting
it from the YAML and running it.
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
`RELEASING.md` documents the whole release pipeline, including the private
Databricks secure-release repo, its workflow filenames, and its dispatch
inputs. A public reader can't act on any of that, so per the thread with Corey
and Rice it moves to `omnigent-internal` (`RELEASING.md`).
This deletes the file here and repoints the six inbound "see RELEASING.md"
pointers (4 workflows, the changelog script) at "the maintainer release
runbook", so nothing links to a path that no longer exists.
Scrubbing the private repo name from the workflow comments and
`editors/vscode/PUBLISHING.md` is a separate follow-up.
Signed-off-by: Dhruv Gupta <dhruv.gupta@databricks.com>
* fix(sessions): expose persisted activity heartbeat
Signed-off-by: Solaris-star <820622658@qq.com>
* docs: broaden updated_at wording to cover session metadata edits
Per review feedback: updated_at also advances on title renames
(including auto-titling), agent switches, and archive toggles — not
just conversation item appends. An orchestrator treating it as a pure
item-append heartbeat should know a mid-stall rename resets the clock.
Broadened the docstring in SessionResponse and the SDK Session class,
and re-ran scripts/dump_openapi.py so the OpenAPI description matches.
---------
Signed-off-by: Solaris-star <820622658@qq.com>
Two bugs in the Kimi Code (kimi) harness integration:
Bug 1 - Omnigent could never detect a completed kimi login. The KIMI_KEY
install spec had no file-based login detector and the setup overview row was
hardcoded to "Not configured"/warn whenever the CLI was installed, so a
successful `kimi login` always showed as not signed in.
Fix: add a subprocess-free detector `kimi_auth.kimi_login_detected()` that
returns True when `~/.kimi-code/credentials/kimi-code.json` exists and is
non-empty (the file `kimi login` writes; verified against kimi CLI v0.29.1),
mirroring the Gemini `gemini_login_detected()` pattern. Wire it into
`harness_readiness._FAMILY_CREDENTIAL_CHECK` (binary + credential gating, like
agy) and make the setup overview row render green "Signed in" when detected.
Bug 2 - Sign-out was broken. The spec declared `logout_args=("logout",)` but
kimi has no `logout` subcommand (`kimi logout` errors "unknown command" on
v0.29.1). Set `logout_args=None` so `harness_logout` is a no-op for kimi (same
as Qwen / agy) and remove the "Sign out (kimi logout)" row and its branch from
the Kimi drill-in. Docstrings/comments claiming kimi ships `kimi logout` are
corrected.
Tests: add tests/onboarding/test_kimi_auth.py (present/absent/empty credential
via tmp paths), update the harness_install/harness_readiness onboarding tests
for the new logout_args=None and binary+credential readiness, and update the
CLI drill-in / setup-overview tests (no sign-out row; signed-in vs
not-configured overview row).
Signed-off-by: evangoh122 <evangohsg@gmail.com>
Signed-off-by: Evan Goh <authoremail@example.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Approving a plan from the web UI did nothing: the card showed as
approved but the plan never ran, and answering in the terminal view was
the only way through. Claude Code ignores a PermissionRequest hook's
`allow` for ExitPlanMode (that dialog only accepts a TUI answer), so the
`setMode` decision the server builds never took effect. As a result
Claude's `auto` mode was unreachable from the web UI, since the plan
card is the only surface that offers it.
Key the verdict into the pane instead, the way a local user would:
option 1 for accept-with-auto-mode, 2 for accept, Escape for reject.
The bridge only presses a key when the plan dialog is actually on
screen, which keeps a non-plan verdict (or one already answered in the
terminal) a no-op. Rides the approval event the server already forwards
to the runner, so no new event type or server plumbing.
Co-authored-by: Isaac
Signed-off-by: Pranav Setlur <psetlur@gmail.com>
The Databricks Apps entrypoint built every other store but never the
project store, and create_app mounts the projects router only when a
project store is wired — so first-class Projects were non-functional
on every Databricks Apps deployment while the bundled web UI still
offered project creation. The CLI server and Docker entrypoint paths
already wire it.
Construct SqlAlchemyProjectStore from the Lakebase DB URI and pass it
to create_app, mirroring the other stores.
Co-authored-by: Isaac
Claude-Session: https://claude.ai/code/session_01P9dr2dYHrwMvnXvJsjLDKk
Signed-off-by: Randy 🌞 <randypitcherii@gmail.com>
* Central CTA + background bugfix
Landing screen:
- Headline moves to Hanken Grotesk at 400 weight ("What should we build?"),
self-hosted via @fontsource-variable so no CDN is involved, exposed as the
`font-display-alt` token.
- The project variant swaps the bare folder glyph for a pink rounded tile,
using a new `tag-pink` token from the design's tag palette.
- The composer placeholder and its aria-label now name the selected project
("Start a new session in <project>") instead of always reading the generic
task prompt.
Bug fix — the mobile sidebar was see-through. Below md the sidebar is a
full-screen overlay on top of the chat, but the per-theme canvas rules paint
it with the `background` shorthand, which resets background-color and silently
overrode Sidebar.tsx's max-md:bg-card-solid; the dark stack is entirely
translucent, so the conversation showed straight through. Restores an opaque
fill under the gradients below md only, at matching specificity and after the
theme rules, so desktop keeps its intended translucency.
Adds regression tests for that contract, and updates the landing-screen tests
and visual-suite docs for the new headline.
Co-authored-by: Isaac
Signed-off-by: Hubert Zub <hubert.zub@databricks.com>
* test(e2e-ui): regenerate visual baselines
---------
Signed-off-by: Hubert Zub <hubert.zub@databricks.com>
Co-authored-by: Hubert Zub <hubert.zub@databricks.com>
Co-authored-by: omnigent-ci[bot] <294685417+omnigent-ci[bot]@users.noreply.github.com>
* perf(runner): bound per-runner memory via glibc arenas + threadpool cap
Each session spawns its own runner process, and each grows to ~200MB in
prod, over-using host resources. Profiling shows ~123MB is the irreducible
import floor; the growth on top is runtime bloat from threaded Python on
glibc: the runner offloads heavily via asyncio.to_thread, the default
executor sizes to min(32, cpu+4) threads, and glibc opens up to 8*ncpu
malloc arenas that never return to the OS. Nothing tuned any of this.
Three low-risk, env-gated levers (all no-ops or benign off Linux):
- MALLOC_ARENA_MAX=2 + a 128 MiB trim threshold, injected into the runner
child env at both spawn sites via a shared _proc.malloc_tuning_env()
helper. Empty off Linux; OMNIGENT_RUNNER_MALLOC_ARENA_MAX=0 reverts.
- Cap the asyncio default executor at 8 workers (runner.threadpool_max_workers
config key, OMNIGENT_RUNNER_THREADPOOL_MAX_WORKERS env override), set before
any to_thread use so the 20-thread default pool is never created.
- gc.freeze() after app construction to drop the static import graph from
GC's tracked set.
This targets the runtime growth, not the import floor; collapsing the floor
itself (a copy-on-write zygote) is tracked separately.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix(runner): apply the glibc arena cap at the zygote exec
The zygote forkserver landed and is now the default runner spawn path, which
silently defeated this branch's MALLOC_ARENA_MAX injection. glibc reads that
variable once, when its allocator initializes at exec; a zygote-forked runner
never execs, it just replaces os.environ, so the value arrived far too late to
configure an allocator and the cap stopped applying to every runner.
Move the injection to the zygote's own Popen -- the single real exec on this
path -- so all forked runners and harnesses inherit an already-capped
allocator. Two tests pin the contract at that boundary, including that an
operator's explicit export still wins.
The other two levers on this branch (the 8-worker threadpool cap and
gc.freeze()) live inside _run_tunnel_from_env, which every runner reaches
regardless of how it was started, so they were unaffected. Note in
malloc_tuning_env why the arena cap is glibc-only: macOS libmalloc uses
per-CPU magazines with madvise reclaim and ignores MALLOC_ARENA_MAX, so macOS
hosts get their reduction from the threadpool cap (measured: 21 threads -> 9).
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
---------
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
nimble-python is the optional `nimble` extra and the import is already
guarded by try/except ImportError. Pyrefly has no way to know it's
intentionally absent, so annotate with `# pyrefly: ignore[missing-import]`
to silence the false-positive without changing runtime behaviour.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* feat(policies): add force-push protection to GitHub policy
Add a `deny_force_push` parameter (default `True`) to the GitHub
policy that blocks `git push` with force flags (`--force`, `-f`,
`--force-with-lease`, `--force-if-includes`) regardless of
repo/branch allowlists. This prevents agents from rewriting remote
history, which can destroy commits and break collaborators' clones.
The check fires before repo/branch gating so even a force push to
an undeterminable remote alias is denied rather than surfaced as ASK.
Set `deny_force_push=False` to let force pushes through normal
write gating.
Signed-off-by: Yuan Tang <terrytangyuan@gmail.com>
* fix(policies): merge startswith calls to satisfy ruff PIE810
Signed-off-by: Yuan Tang <terrytangyuan@gmail.com>
* style(policies): join force-push condition onto one line for ruff format
Signed-off-by: Yuan Tang <terrytangyuan@gmail.com>
---------
Signed-off-by: Yuan Tang <terrytangyuan@gmail.com>
* spike(runner): measure copy-on-write savings from a warm-fork zygote
Each session spawns its own runner process, and each pays a ~123MB import
floor for omnigent's own graph plus pydantic/fastapi/httpx. Runtime tuning
trims the growth on top but can't touch that floor; the only way to collapse
it is to import the graph once in a warm parent and os.fork() a child per
session, sharing the read-only import pages copy-on-write.
This standalone script measures whether that COW sharing actually
materializes before we commit to the full zygote architecture. It imports the
runner graph once, forks N idle children, and reports aggregate memory against
an N-process Popen baseline, optionally with gc.freeze().
Not wired into the daemon — this is a measurement gate, not a feature. On this
macOS box (N=8) the fork path showed ~82% lower aggregate footprint than the
Popen baseline, but macOS phys_footprint is only an indicative analog to Linux
Pss and the children idle (no COW erosion from refcount page-dirtying), so a
Linux-under-load measurement is still required before productionizing.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* feat(runner): add copy-on-write zygote forkserver for runner processes
Every session spawns its own runner, and each pays the full ~120MB import
floor (omnigent's graph + pydantic/fastapi/httpx). On a host running N
sessions that floor is duplicated N times. This adds a zygote: a single
long-lived process that imports the runner graph once and os.fork()s a child
per session, so on Linux the read-only import pages are shared copy-on-write
and each extra runner costs only the pages it dirties.
Design (grounded in the daemon/runner lifecycle, not the naive sketch):
- omnigent/runner/_zygote.py — the forkserver. Single-threaded, no event loop
or network; imports the graph once, gc.freeze()s it, then blocks on an
AF_UNIX control socket forking a child per request. The child reopens its
log, replaces os.environ with the request env, and calls the unchanged
_entry.main() — so it behaves exactly like `python -m omnigent.runner._entry`.
It is Popen-exec'd by the daemon (never forked from it), so it inherits none
of the daemon's asyncio loop / websocket / worker threads — the classic
fork-in-multithreaded-async deadlock is avoided by construction.
- omnigent/host/runner_zygote.py — the daemon-side client. ZygoteManager owns
the control socket; ZygoteRunnerProc is a Popen-shaped shim so the existing
_RunnerHandle / _watch_runner / _handle_stop paths are unchanged. The daemon
is NOT the forked runner's parent, so poll()/returncode/wait() round-trip to
the zygote (the real parent) for exit status while terminate()/kill() signal
the pid directly.
- connect.py — _handle_launch forks via the zygote when enabled, else the
original Popen. RUNNER_PARENT_PID is set to the ZYGOTE's pid (not the
daemon's) because the runner's orphan watchdog compares os.getppid(); daemon
death -> control-socket EOF -> zygote exit -> runners reparent -> each tears
itself down, preserving today's parent-death semantics through one hop.
Gated behind OMNIGENT_RUNNER_ZYGOTE=1 and Linux-only; any zygote failure
disables it for the daemon's life and falls back to a direct Popen, so it is
never a hard dependency. Also removes the Phase-1 measurement spike script,
which this supersedes.
Verified on macOS: a real zygote subprocess forks children, reports pids and
exit codes, isolates per-fork env, reaps cleanly, and tears down on stop
(fork works on macOS even though the COW savings are Linux-only). The
production memory win and a full session-through-the-tunnel run are unverified
here — they need a Linux host under load, which this change is written to be
turned on for.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix(runner): address zygote review feedback
- connect.py: a failed fork no longer stops the running zygote. Stopping it
would kill healthy runners already forked from it (their orphan watchdog
sees the parent die), so one bad fork could take down unrelated live
sessions. Latch a `_zygote_disabled` flag for future launches instead and
retain the manager so the zygote is still reaped on daemon shutdown.
- runner_zygote.py: wait() after kill() in stop() so a zygote that ignored
SIGTERM is reaped rather than lingering as a zombie.
- _zygote.py: unify the _entry/app/native import to a single `from ... import`
(CodeQL flagged mixed import styles).
- test: build the fresh-interpreter probe via an explicit newline join instead
of implicit adjacent-string concatenation (CodeQL).
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix(runner): forward --log-to-stderr TTY fd through the zygote
The direct-Popen launch path forwards OMNIGENT_LOG_TTY_FD via
child_logging_popen_kwargs so a detached runner can still mirror logs to the
daemon's terminal. The zygote path dropped it, so --log-to-stderr mirroring
was lost for zygote-forked runners.
Forward it across both hops:
- daemon -> zygote: reuse child_logging_popen_kwargs to dup the TTY fd and add
it to the zygote's pass_fds (the helper also rewrites env[LOG_TTY_FD] to the
duped number).
- zygote -> forked runner: the valid fd number inside the child is the one the
zygote inherited, not the daemon-side number the payload carries, so the
child restores LOG_TTY_FD from the zygote's own value (and clears a stale
payload value when the zygote has no terminal mirror).
Adds a test asserting a bogus payload LOG_TTY_FD is cleared in the child.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix(runner): address second round of zygote review feedback
- _zygote.py: create the forked child's log file 0o600, not 0o644. Runner
logs can carry secrets (tokens, prompts); matches create_process_log_path.
- _zygote.py: the child guard now preserves SystemExit's code instead of
flattening it to a traceback + exit 1, so a zygote-forked runner exits with
the same code as `python -m omnigent.runner._entry` (main() raises
SystemExit on a tunnel rejection). New test covers it via a raise seam.
- runner_zygote.py: stop the partially-started zygote if the initial ping
raises (timeout / EOF), so a failed start never leaks a process + socket.
- runner_zygote.py: signal via signal.SIGTERM / signal.SIGKILL instead of the
raw 15 / 9.
- test: mark the suite posix_only (it uses os.fork / pass_fds) so cross-
platform sweeps skip it on Windows.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* feat(runner): enable the zygote on all POSIX hosts, not just Linux
The host daemon runs on the user's own machine — most often macOS — so a
Linux-only gate denied the copy-on-write import-floor savings to the majority
of hosts. Gate on IS_POSIX instead (the zygote needs os.fork + AF_UNIX
fd-passing, both POSIX; Windows still takes the direct Popen path).
macOS is the platform where fork-without-exec is riskiest (CoreFoundation/GCD
abort a forked child that touches them), so this was verified rather than
assumed. The abort is triggered by forking from a MULTI-threaded process, which
the zygote already designs against: it forks from a single-threaded parent
(asserted active_count()==1) and does create_app + all network work in the
child. Evidence on this macOS box:
- A faithful fork probe (fork from the single-threaded import state, child runs
create_app + getaddrinfo + TLS ctx + asyncio + httpx) survived 5/5. The same
work forked from a multi-threaded parent SIGSEGV'd 2/3 — confirming the
single-threaded fork is what makes it safe.
- test_host_launch_runner_and_session_round_trip passes with
OMNIGENT_RUNNER_ZYGOTE=1: a real host daemon forks a runner through the
zygote, the runner connects its tunnel, and a full mock-LLM session round-trip
completes. The daemon log confirms the zygote path (distinct zygote/runner
pids), not a Popen fallback.
Also adds an info log on the successful zygote-fork path so operators can see
the zygote is active and which pids are involved.
Still opt-in behind OMNIGENT_RUNNER_ZYGOTE=1 with the full Popen fallback; the
steady-state Pss win under load remains best measured on a Linux host.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* feat(runner): fork harness subprocesses from the runner zygote
The harness subprocess (`python -m omnigent.runtime.harnesses._runner`) is a
separate exec per conversation, so it re-pays its import floor — and that floor
is ~54MB of the same common graph (fastapi/pydantic/omnigent-core) the runner
zygote already holds resident. This extends the zygote to fork harness children
too, sharing that graph copy-on-write instead of exec'ing a fresh interpreter.
- _zygote.py: the serve loop becomes a single-threaded `selectors` multiplexer
over the daemon socket PLUS one inherited control socket per forked runner.
A new `fork_harness` command forks a child that reproduces `_runner.main(argv)`
in-process. The runner-fork request/response bytes are unchanged; the new
multiplexer wraps them rather than rewriting them. A forked child closes every
inherited zygote-side socket (it never speaks the fork protocol).
- _harness_zygote_client.py (new): the runner-side client. `HarnessZygoteClient`
reads the inherited control-socket fd from OMNIGENT_RUNNER_ZYGOTE_HARNESS_FD;
`ZygoteHarnessProc` is an asyncio.subprocess.Process-shaped shim (pid /
returncode / wait / send_signal / kill) with a background poll task keeping
returncode fresh for _wait_for_bind's synchronous reads.
- process_manager.py: `_spawn_harness_process` forks via the zygote when the
runner was itself zygote-forked, else the original create_subprocess_exec;
disabled on first failure so it falls back for the process's life.
- _runner.py: a zygote-forked harness has the zygote (not the runner) as OS
parent, so its watchdog probes the runner pid explicitly instead of trusting
os.getppid(), and skips PR_SET_PDEATHSIG (which would bind death to the
zygote). Gated by OMNIGENT_HARNESS_ZYGOTE_FORKED.
Present only when the runner itself was zygote-forked; any failure falls back to
a direct exec, so the harness fork is never a hard dependency. The win is
bounded to the ~54MB Python wrapper (the external claude/codex CLI is a separate
exec no Python zygote can share) and materializes under multi-conversation
fan-out. Verified on macOS: fork_harness forks, reports pid + exit code,
round-trips argv, reaps, and leaves the daemon socket serving; existing
process_manager tests unchanged. Linux Pss savings still unverified.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix(runner): clear pyrefly type errors in the zygote
- ZygoteRunnerProc.wait: narrow on `timeout` (not just `deadline`) so
TimeoutExpired(timeout=...) gets a `float`, not `float | None`.
- _spawn_zygote_process: pass stdin/stdout/stderr explicitly with a typed
`BinaryIO | None` log handle instead of a `dict[str, object]` splat that
matched no Popen overload.
- _ZygoteServer.serve: cast selector key.fileobj (HasFileno | int) to socket
— only sockets are ever registered.
- _ZygoteServer._on_readable: wrap the bytearray partition result in bytes()
before dispatch, which expects bytes.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix(runner): harden zygote failure paths (crash recovery, exit-code leak)
Review flagged three correctness bugs in the unhappy lifecycle paths; none are
security issues but each is reachable in prod.
1. Unexpected zygote crash stranded the daemon's view of every child. The
daemon isn't the runner's OS parent, so once the zygote died it had no
channel to learn a runner exited — ZygoteManager.poll returned None
("still live") forever, so _watch_runner looped, _handle_runner_status
reported gone sessions as alive, and _handle_stop's final wait() could hang.
Now poll() probes the runner pid directly when the zygote is gone: a dead
pid surfaces a non-zero sentinel (254) so the runner reads as dead-and-
failed, not eternal alive. _handle_stop's post-kill wait() is now bounded.
2. _exit_codes leaked for a dropped runner's harness children. Exit codes were
only popped via poll, but a dropped runner's harnesses have no remaining
client to poll them — the entries accumulated (unbounded map growth +
pid-reuse misattribution). _drop_runner now discards those descendants'
codes and marks still-live ones orphaned: _reap waitpid's them (no zombies)
but discards the code instead of storing it.
3. ZygoteHarnessProc.wait() masked a crashed harness as exit 0. If the zygote
went away, wait() returned 0, so a harness that crashed on boot (bind
failure, import error) read as a clean exit and the process manager could
hang waiting for a bind that never comes. Now probes the harness pid and
returns a non-zero sentinel when the code is unrecoverable.
Also: tighten "Linux-only" docstrings to "POSIX; COW savings on Linux" (the
gate is IS_POSIX and the path runs on macOS), and add a sleep test-seam so the
new failure-path tests can hold a child genuinely alive.
Tests: kill the zygote under a live runner and assert the daemon eventually
sees it dead (not hanging); a dropped runner's harness code is not retained; a
crashed harness with an unrecoverable code surfaces as failure, not 0.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix(runner): keep zygote poll/wait off the daemon event loop
Review flagged a liveness regression on the enabled path: for a zygote-forked
runner, poll()/wait() are blocking control-socket round-trips (with lock
contention against a booting zygote that holds the lock across its ~120MB
import), not the lock-free waitpid the direct-Popen path used. Calling them on
the loop thread could freeze the whole daemon — all sessions, websocket
traffic, heartbeats — until the import finishes or the 30s control timeout
elapses.
- _watch_runner: poll() now runs via asyncio.to_thread.
- _handle_stop: now async; the poll/terminate/wait sequence runs off-loop in a
_stop_runner_proc helper. Its dispatch site and three tests updated to await.
- _tracked_runner_pids: include the zygote pid so the orphan reaper never
waitpid's the zygote out from under ZygoteManager._proc on an unexpected
crash (which would confuse is_running()/stop()).
Also updates test_poll_after_stop to use a live child, since the crash-recovery
sentinel (254) now correctly fires for an already-exited pid after stop().
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix(runner): status query off-loop + enable zygote by default
- _handle_runner_status did its poll() on the event loop, the one place the
PR hadn't moved off it. For a zygote-forked runner poll() is a blocking
control-socket round-trip (bounded only by the 30s control timeout, and
contended against a booting zygote), so a slow zygote could stall the whole
daemon for a single status query. Made it async and run the poll via
asyncio.to_thread, matching _watch_runner / _handle_stop. Dispatch site and
the three status tests updated to await.
- Enable the zygote by default: OMNIGENT_RUNNER_ZYGOTE is now opt-OUT
(=0/false/no/off), not opt-in. The host daemon runs on the user's own
machine (most often macOS), so defaulting on lets most users share the
~120MB import floor. Still POSIX-gated with a full Popen fallback, so an
unsupported platform or any zygote failure is transparent.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix: prevent mid-spawn launch leaks and harden zygote request handling
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
---------
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* feat(web): set the text size steps from the design
Body and chat-thread text are both 13px/18px in the design; the shared
`text-13` step was on a 20px line, so tighten it to 18px. Adds the 12px/16px
caption step used by sidebar section subtitles (Projects, Sessions).
Defines the steps only — switching each surface onto them is follow-up work.
Co-authored-by: Isaac
Signed-off-by: Hubert Zub <hubert.zub@databricks.com>
* feat(web): put chat and sidebar text on the design's type scale
The chat thread hard-coded its own 15px/24px with negative tracking, and
sidebar rows set a size but no line height, so neither matched the design.
- Chat bubbles (user and assistant share the wrapper): 13px/18px, and the
-0.01em tracking is dropped — the design specifies 0.
- Sidebar body rows: pin the line height to 18/13 of the font size, which was
previously left to inherit.
Both stay in rem/unitless so the mobile root-font bump and the Appearance
font-size setting keep scaling them. Sidebar section captions were already
12px/16px and are unchanged.
Co-authored-by: Isaac
* test(e2e-ui): regenerate visual baselines
* refactor(web): express the sidebar line height in rem
1.3846 was the 18/13 ratio written as a unitless number — unreadable, and it
took arithmetic to confirm it meant 18px. 1.125rem is 18px directly and
scales the same way, matching how the chat wrapper states it.
Co-authored-by: Isaac
---------
Signed-off-by: Hubert Zub <hubert.zub@databricks.com>
Co-authored-by: Hubert Zub <hubert.zub@databricks.com>
Co-authored-by: omnigent-ci[bot] <294685417+omnigent-ci[bot]@users.noreply.github.com>
OMNIGENT_RUNNER_ENV_PASSTHROUGH lets an operator name extra env vars for the
host to forward on to spawned runners (provider gateway wiring, config env: refs,
etc.). It worked locally but was a silent no-op in --server mode: the remote
daemon env is allowlisted by a prefix set of DATABRICKS_ + LC_/MLFLOW_/OTEL_/
OMNIGENT_OTEL_ — NOT plain OMNIGENT_ — so the control var itself was stripped at
the CLI->daemon hop, and _build_runner_env never saw the names it listed. Any var
forwarded through the passthrough (e.g. a Linear API key for the repro-agent)
reached the runner locally but never remotely.
Add OMNIGENT_RUNNER_ENV_PASSTHROUGH to _RUNNER_ENV_ALLOWLIST so it survives both
hops. It carries only env var NAMES, not secrets, so allowlisting it leaks
nothing on its own — each named var must still independently reach the daemon
(here via the DATABRICKS_ prefix).
Tests: a daemon-hop test (remote env keeps the control var) and an end-to-end
two-hop test (a named var survives CLI->daemon->runner, an unnamed one doesn't).
Both fail without the one-line allowlist change.
Co-authored-by: Isaac
* dev/repro-agent: give Linear tickets a real fetch path + follow linked GitHub issues
The local repro-agent pointed Linear tickets at nonexistent "Linear tools",
so Linear runs had no way to read the ticket body and fell back to guessing
from the URL slug — noticeably worse reproductions than GitHub issues, which
have a working `gh issue view` path.
Wire Linear to the same GraphQL path the internal issue-sync agent uses
(api.linear.app/graphql, `Authorization: $LINEAR_API_KEY`, no Bearer), pulling
description/comments/attachments via sys_os_shell. When the key is absent or
auth fails, stop with needs_more_info naming the missing key instead of
guessing. Also: when a Linear ticket links a GitHub issue, always fetch that
issue too and treat it as authoritative for the technical journey — that
richer thread is why GitHub-first runs reproduced better.
Co-authored-by: Isaac
* dev/repro: forward the Linear key through the --server env strip
Reading a Linear ticket needs the key in the agent's shell, but under --server
the CLI->daemon->runner hops strip everything not allowlisted. The DATABRICKS_
prefix survives only the first hop; the daemon->runner hop has no DATABRICKS_
prefix. So dev/repro.py now names DATABRICKS_LINEAR_API_KEY in
OMNIGENT_RUNNER_ENV_PASSTHROUGH (itself allowlisted) when a Linear URL is passed
and the key is set, which forwards it the rest of the way. AGENTS.md reads
whichever name is present (LINEAR_API_KEY locally, DATABRICKS_LINEAR_API_KEY
under --server). Warns rather than fails when the key is missing.
Companion change (omnigent-internal): the repro-agent CI workflow must set
DATABRICKS_LINEAR_API_KEY from secrets.LINEAR_API_KEY in the run step, mirroring
how it already sets DATABRICKS_BEARER for the LLM key.
Co-authored-by: Isaac
* dev/repro: mirror LINEAR_API_KEY into the DATABRICKS_ name
Maintainers typically export the plain LINEAR_API_KEY locally, so copy it into
DATABRICKS_LINEAR_API_KEY when only the plain name is set — then the same
passthrough forwarding carries it past the --server env strip. Warn only when
neither is set.
Co-authored-by: Isaac
* feat(web): make the rails flush boxes and move the canvas gradient
The sidebar and workspace rails were floating cards (margin, rounded
corners, border, shadow) on a gradient canvas. The design has them flush to
the window edges, reading as part of the canvas.
- Left sidebar and right workspace rail sit flush: no outer margin, no
rounding, no drop shadow. The workspace rail keeps a left divider.
- Light canvas is flat white; the brand gradient moves onto the left
sidebar, joined by the mock's dot-grid and pink corner glow.
- Dark canvas carries the mock's purple gradient; the dark sidebar gets the
same dot-grid plus a purple bottom wash and the diagonal sheen.
- Both rails are excluded from the dark glass rule instead of overriding it,
so they no longer pick up its blur, sheen, fill, or border. The workspace
rail's panel contents are transparent too.
- Dark surface tokens (--card, --card-solid, --tray, --muted, --background)
move off their purple tint onto neutral slate.
Consolidates the canvas/rail CSS so each surface owns its full background in
one rule, and drops the now-redundant ::before dot overlay.
Co-authored-by: Isaac
Signed-off-by: Hubert Zub <hubert.zub@databricks.com>
* test(e2e-ui): regenerate visual baselines
---------
Signed-off-by: Hubert Zub <hubert.zub@databricks.com>
Co-authored-by: Hubert Zub <hubert.zub@databricks.com>
Co-authored-by: omnigent-ci[bot] <294685417+omnigent-ci[bot]@users.noreply.github.com>
Broaden issue-triage auto-assignment from P0/P1-only to every triaged
issue except needs_info ones. The gate now keys off needs_info alone, so
any bug/enhancement/doc issue with enough info to triage gets a
load-balanced area owner (least open assigned issues first, LLM rank as
tiebreaker) instead of only high-priority ones. Drops the now-unused
priority/type branch from the shell gate.
Also refresh .github/areas.json ownership:
- remove SabhyaC26 from all areas
- add PattaraS to harness-antigravity (keeps it at the 2-owner minimum)
- reactivate dbczumar (owners_paused -> owners) across their areas
Co-authored-by: Isaac
* fix(web): remount terminal view when switching same-vendor sessions
Two sessions of the same shape share a fixed agent-terminal id (e.g. every
claude-native session's `terminal_claude_main`, every SDK session's
`terminal_tui_main`). ChatPage stays mounted across a session switch and only
feeds MainTerminalView / TerminalsPanel a new conversationId, so keying the
xterm wrapper on the terminal id alone let React reuse the existing mount —
the pane kept the previous session's 20k-line scrollback until the new
WebSocket reconnected and tmux repainted. The stale history cleared only on a
manual refresh.
Scope the wrapper key to `${conversationId}:${terminalId}` in both surfaces so
a session switch forces a clean remount (fresh xterm + WebSocket, no stale
buffer). Add regression tests that switching conversationId with the same
terminal id remounts the TerminalView.
Co-authored-by: Isaac
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
* test(web): assign terminal mount id once per mount
Copilot review flagged that useRef(++terminalMountSeq) evaluates the
increment on every render (useRef ignores the arg after first render),
so the module counter advanced on re-renders — contradicting the
comment. The read value (instance.current) was still stable, so the
assertion held, but assign the id conditionally so the counter tracks
real mounts.
Co-authored-by: Isaac
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
---------
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
The Chat/Terminal switcher moved into the header as a Radix DropdownMenu
whose trigger toggles on pointer-down and carries a controlled hover
tooltip on the same node (ViewModeToggle.tsx). On a busy page — a live
terminal stream plus that tooltip re-rendering during the click — a lone
`.click()` occasionally nets the menu back to closed, so the follow-up
`expect(menuitemradio).to_be_visible()` times out. That is the observed
flake in test_codex_goal_mode and the native render-parity suites: the
failure snapshot shows `tooltip "Terminal view"` (rendered only while the
menu is closed) with no menu items.
Add a shared `_select_view_mode(page, option)` helper that reopens the
menu in a retry loop until the target radio item is actually visible, then
selects it, instead of trusting a single toggle click. Route
`_ensure_chat_view` and every native-parity `_open_terminal_view`
(codex, claude, goose, hermes, cursor, kiro) through it.
Co-authored-by: Isaac
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
Repoint the gray text and border tokens onto the shadcn Zinc scale so the
UI's neutrals match the design system:
- Primary text (--foreground, --card-foreground, --secondary-foreground,
--sidebar-foreground) -> Zinc 800 #27272a
- Secondary text (--muted-foreground) -> Zinc 500 #71717a
- Default border (--border, --input, --sidebar-border) -> Zinc 200 #e4e4e7
- Strong border (--border-strong) -> Zinc 400 #a1a1aa
Also adds the two tokens the palette needs but the app lacked:
--border-weak (Zinc 150) and --foreground-tertiary (Zinc 400), exposed as
Tailwind utilities.
Co-authored-by: Isaac
Signed-off-by: Hubert Zub <hubert.zub@databricks.com>
Co-authored-by: Hubert Zub <hubert.zub@databricks.com>
The codex goal-mode + native-parity targets need the Codex-parity Rust
sidecar. flake-stress-ui.yml relied on the fixture's inline `cargo build`
at test time, capped by --timeout=300. On a cold Rust cache every parallel
attempt independently compiles the ~1100-crate tree and overruns the
per-test timeout, so all attempts die at fixture setup before the test
body ever runs — masquerading as a 100% failure rate unrelated to the
target under test.
Mirror e2e-ui.yml / ci.yml: add a dedicated build-sidecar job that
compiles the sidecar once (same main-scoped cache key so it usually
restores), uploads the ~10MB binary, and has each attempt download it and
set CODEX_PARITY_SIDECAR_BIN. build_sidecar_bin() then returns the prebuilt
path and skips cargo entirely. Drops the per-attempt Rust toolchain + target
-dir cache that never made the inline build fit the timeout.
Co-authored-by: Isaac
Signed-off-by: Pat Sukprasert <pat.sukprasert@databricks.com>
`dev/repro.py --public` sets `public: true` in the agent's input contract, and
the agent shares the session read-only (`sys_session_share __public__`) at the
start of its run so it is browsable live — useful when watching a run or
reproducing against a shared --server. Off by default (a local session is
already yours to browse).
- dev/repro.py: add --public; include `"public": true` in the payload when set.
- config.yaml: re-add `agent_session_sharing: public` to grant the __public__
capability (opt-in via the flag).
- AGENTS.md: document the `public` input; make sharing the first preflight step.
- README.md: document the --public flag.
Co-authored-by: Isaac
* dev/repro: add worktree-isolating driver script; clarify browser context
Add dev/repro.py — a maintainer-only wrapper around `omnigent run
dev/repro-agent`. It prompts for the bug URL (or takes it as an argument /
bare id like OMNI-1234 / 3987), creates an isolated git worktree off the
current checkout's HEAD (branch repro/<slug>, auto-suffixed on collision),
and runs the agent FROM that worktree so the authored e2e test lands on its
own branch without dirtying your checkout. The worktree is always kept; the
script prints its path + branch + cleanup command at the end.
It lives under dev/ (not shipped in the wheel) rather than as an `omni`
subcommand because it depends on a source checkout — the repro-agent authors
into tests/e2e_ui/ / tests/e2e/, which only exist here.
Also, from PR review:
- AGENTS.md: note that UI-journey reproduction drives the desktop app's
embedded browser, so it expects a desktop / embedded-browser context (fall
back to the backend path / needs_more_info when there's no browser pane).
- README.md: document the dev/repro.py driver.
Co-authored-by: Isaac
* dev/repro-agent: handle compound / multi-symptom bug reports
Ported from the internal repro-agent (omnigent-internal#24). A single bug
report often bundles several distinct symptoms (e.g. "picker unavailable AND
catalog defaults lag"), and they can have different truth on the running
build — one already fixed, the other still live. Averaging them into one
verdict hides the part that's still broken.
AGENTS.md now instructs the agent to:
- enumerate each claimed sub-symptom in Step 1 (don't collapse a compound
report into one journey),
- reproduce and judge each independently in Step 2, and
- roll up to an overall verdict where ANY live sub-symptom ⇒ reproduced
(already_fixed only when every facet is fixed), emitting a per-facet
breakdown (`facets`) in the output so a partial fix stays visible.
Wording adapted to the local variant (running build / local session; no
deployed-app or public-share references).
Co-authored-by: Isaac
* dev/repro: drop the `ref` input — always reproduce against the running build
`ref` never controlled what was validated: the agent always reproduces against
the app it is connected to (the running build / latest main), and `ref` was
only informational — and redundant, since the reported version is already in
the bug report the agent reads. Simplify the input contract to just `bug_url`.
- dev/repro.py: remove the --ref option; the payload is {"bug_url": ...}.
- config.yaml / AGENTS.md / README.md: drop the ref bullet/examples; keep the
guidance that reproduction is always against the running build (so an
old-version report can still land already_fixed).
Co-authored-by: Isaac
A developer-facing repro agent under dev/. Given just a bug (a bug_url — GitHub
issue or Linear ticket — plus an optional ref), it reconstructs the user journey
from the linked report, drives the running Omnigent app it is connected to (the
server `omnigent run` spins up, or one passed with --server) through that journey
until the failure happens live, and authors a durable e2e test (Playwright under
tests/e2e_ui/ for UI bugs, or tests/e2e/ for backend) as the regression artifact.
It reproduces against whatever app it is connected to and authors the test into
the current checkout, so a developer can run it against their own local server:
omnigent run dev/repro-agent -p '{"bug_url":"https://github.com/omnigent-ai/omnigent/issues/1234"}'
It does not fix the bug, merge, or push — it produces a live-confirmed
reproduction plus the test and hands off (the fix half owns the before/after
fail->pass proof).
Files:
- config.yaml — claude-sdk brain, os_env shell/file access, blast-radius guard.
- AGENTS.md — the operating procedure (confirm workspace -> reconstruct journey
-> reproduce live -> author the e2e test -> structured verdict).
- README.md — prerequisites, usage, and what it produces.
Co-authored-by: Isaac
omni host status was slow because _add_daemon_host_status made a
GET /v1/hosts/{id} request for every daemon record, including the many
stale records accumulated over dev sessions (39 in one measured case).
Dead processes can't have an online tunnel, so the correct answer is
host_status=offline with no network round-trip.
Skip the HTTP call when process=offline and set host_status directly.
This cut omni host status from ~14s to ~5s on a workstation with many
stale daemon records.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
When a session's workspace directory no longer exists on the host
(e.g. a worktree was deleted), the host was returning a generic
failed status with no error_code, causing the server to silently
wait out the full connect timeout and then surface a generic
'runner_failed_to_start' banner.
Changes:
- Add WORKSPACE_MISSING_ERROR_CODE ('workspace_missing') to host/frames.py
- Host returns this code when workspace.is_dir() fails, alongside the
existing descriptive error message
- Server (routes_events.py post_event) handles workspace_missing the same
way as harness_not_configured: immediately consumes the user message and
persists an actionable runner_failed_to_start error item with the host's
'workspace path does not exist: ...' message instead of timing out into
a generic RUNNER_UNAVAILABLE
- orchestration.py _ensure_runner_relay_ready skips the connect-timeout
wait for workspace_missing (same as harness_not_configured), and records
the refusal in runner_exit_reports so snapshot-based renders also show
the actionable cause
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix(web): stop rendering shell-style env vars in prose as LaTeX math
Error messages like "Unresolved environment variable '$LLM_API_KEY' … Set
$LLM_API_KEY or $OMNIGENT_LLM_API_KEY" render through the assistant markdown
renderer, which has single-dollar math enabled. The paired `$` tokens collapsed
into a garbled inline formula.
normalizeExplicitMathDelimiters already escaped a lone `$` before a digit
(currency); extend that heuristic to also escape shell-style variable
references ($VAR_NAME and ${VAR_NAME}, SCREAMING_CASE) so they stay literal text
instead of flipping the math span.
Co-authored-by: Isaac
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
* docs(web): clarify SHELL_VAR_RE handles single-char braced refs
Address Copilot review: the comment said "2+ chars" but the braced
alternative uses `*`, so `${A}` matches. That's intended — braces
disambiguate a variable reference, so one char is enough there, while the
bare form still requires 2+ so `$X …` reads as inline math. Fix the comment
and add a test for both cases.
Co-authored-by: Isaac
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
* fix(web): require full-token boundary for bare shell-var match
Address Copilot review: SHELL_VAR_RE's bare branch matched a SCREAMING_CASE
prefix of a mixed-case token (e.g. `$FOOBar$`), escaping the opening `$` while
leaving the closing `$` as a delimiter — an unbalanced span that breaks
genuine inline math. Add a `(?![A-Za-z0-9_])` boundary so only full
SCREAMING_CASE tokens match, and greedy backtracking can't settle on a prefix.
Co-authored-by: Isaac
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
---------
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
When the VPN drops, a corporate proxy answers the host tunnel's
WebSocket upgrade with 401/403 before the request reaches the Omnigent
server. `_classify_http_status` treated those as permanently fatal, so a
live, already-registered host exited with code 1 and the user had to
re-run `omnigent host` after reconnecting.
A host that already completed an upgrade proved its credentials and
authorization are valid, so a later 401/403 is almost always a transient
network-path artifact. For a connected host, 401/403 now retries forever
via the normal reconnect path (mirroring the existing login-redirect
design), with a once-per-outage stderr notice so a foreground
`omnigent host` isn't silent. A fresh, never-connected host still fails
loud on the first 401/403.
Fixes OMNI-2367.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
Two fixes to _ManagedMintTokenFactory and _InitialAuthTokenFactory:
1. Only latch declined=True on 400/404 if the factory has never successfully
minted a token. A 400 mid-session (e.g. during an IP ACL flip) is
transient — the server already proved it mints for this runner, so treat
it like any other transient failure instead of bricking the factory.
2. Add a declined property to _InitialAuthTokenFactory that proxies the
inner fallback factory. Without this, auth_flow sees declined=False on
the outer wrapper and raises 'no token' instead of falling back to bare
requests, causing infinite retry loops in PATCH external_session_id and
other callbacks after the inner factory latches declined.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
A managed-host wake (resume_managed_host: resuming a dormant resumable
sandbox on the next message) never forwarded launch-pipeline stages to the
caller, unlike the fresh-launch path (_arm_and_start_host), which threads
on_stage through. As a result _run_managed_wake left the session on the
single "provisioning" band that _kick_managed_wake seeded for the entire
resume — even while the host was already re-execing and dialing back — so
the UI showed a frozen "Provisioning sandbox" band for the whole wake.
Thread on_stage through resume_managed_host into _start_sandbox_host (which
already accepts it), and have _run_managed_wake pass a _publish_sandbox_status
closure. The wake now advances to "starting" (emitted by base start_host)
before "connecting"/"ready", matching a fresh launch.
Signed-off-by: Edwin He <41037314+Edwinhe03@users.noreply.github.com>
Connecting a host to a Databricks-App-deployed omnigent server as a service
principal failed: `omni run --server <app>` resolves credentials through the
Databricks SDK's default chain, which reads only the DEFAULT ~/.databrickscfg
profile. When DEFAULT points at a different workspace than the one fronting the
app, the minted token is for the wrong workspace and the Apps proxy bounces the
request to interactive OIDC (302) instead of admitting it.
Add a `--profile NAME` option to `omni run` that sets DATABRICKS_CONFIG_PROFILE
for the CLI process, so every remote-auth path (_remote_headers, _server_auth,
_DatabricksTokenAuth) resolves the named service-principal profile. This enables
headless M2M access to a deployed app without a prior interactive `omnigent
login`. An explicit --profile wins over an ambient DATABRICKS_CONFIG_PROFILE;
omitting it leaves any preset untouched.
Prereq (Databricks-side, not code): the service principal must have CAN USE on
the app.
Co-authored-by: Isaac
Signed-off-by: Serena Ruan <serena.rxy@gmail.com>
* fix(runner): treat HTTP 403 as refreshable on tunnel reconnect
A runner whose auth token expires while the machine is offline can
receive HTTP 403 (not 401) when DNS resolves again and the server
rejects the stale credential. Previously 403 was in
_FATAL_SERVER_HTTP_STATUSES and caused the runner to exit immediately
with no retry, killing any active session.
Move 403 into _REFRESHABLE_HTTP_STATUSES alongside 401. The existing
_handle_refreshable_auth_failure path already handles this correctly:
it attempts one token refresh, and if the factory is invalidatable
(or returns None) the second 403 raises a fatal RuntimeError instead
of looping forever. A runner with no factory still exits fatally on
the first 403.
Add three tests covering the new behaviour:
- 403 with factory → refresh → retry → success
- 403 with invalidatable factory → refresh → persistent 403 → fatal
- 403 without factory → fatal immediately
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix(runner): guard 403/401 refresh against transient factory errors
- Drop the inline to_thread(factory) call in the refreshable-status
handler; rely on the loop-top _refresh_auth_token instead, which
already wraps factory calls in try/except for OSError/ValueError.
This prevents a transient IdP error on wake-from-sleep from crashing
serve_tunnel rather than falling back and retrying.
- Also removes the redundant double-refresh-per-cycle that the inline
call introduced.
- Update _handle_refreshable_auth_failure docstring: 401/403 now go
through the streak path, not this function; only 302 redirects
reach it.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix(server): import _spawn_archive_stop in routes_core
Missing import introduced in 2ce9c60b.
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
---------
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* perf(sessions): stop and archive in parallel so archiving isn't gated on stop timeouts
Archiving a live session took 5-10s: the sidebar serialized stop -> archive,
and the PATCH handler awaited its own best-effort stop (5s runner / 10s host
teardown ceilings per running session) before flipping the flag — even though
the archive proceeds regardless of the stop's outcome. Fire the client legs
in parallel and detach the server-side stop into a retained background task;
the stop still runs to completion, it just no longer holds the response.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(sessions): let the server own the archive stop so it can't race the client's
Review follow-ups on the parallel-archive change:
- The client no longer sends its own stop_session alongside the archive
PATCH. Two concurrent stops raced the same runner, and because the
runner's stop handlers are not idempotent (kill_session raises once
the pane is gone -> 503), the loser's failure aborted the client stop
before it reached the host-runner teardown -- orphaning a host-spawned
session's dedicated runner. Archive now sends one PATCH.
- The server's detached stop carries the host-runner teardown that only
the client stop used to do, so archiving still drops the runner's
tunnel and flips runner_online. Bulk archive gains this too; it never
sent a client stop.
- The stop is spawned only after the archived flag commits. It ran
ahead of later validations, so a PATCH rejected after that point
(reserved label, runner_id permission) could stop a session it did
not archive.
Adds an e2e_ui browser test for the archive flow plus server coverage
for the teardown and the rejected-PATCH case.
Signed-off-by: dbczumar <corey.zumar@databricks.com>
---------
Signed-off-by: dbczumar <corey.zumar@databricks.com>
2026-08-03 17:44:34 -07:00
815 changed files with 101240 additions and 10739 deletions
"definition":"The web frontend (web/) shared by all clients: React UI, components, embed. NOT the desktop or mobile app shells (those are separate areas below).",
"paths":[
"web/"
@@ -64,6 +80,9 @@
{
"key":"desktop-app",
"label":"comp:web-ui",
"priority_label":"comp:web-ui",
"weight":1.0,
"weight_source":"editorial",
"definition":"The desktop app shell (Electron wrapper around the web UI): main process, packaging, native desktop chrome.",
"paths":[
"web/electron/"
@@ -77,6 +96,9 @@
{
"key":"mobile-app",
"label":"comp:web-ui",
"priority_label":"comp:ios",
"weight":1.0,
"weight_source":"editorial",
"definition":"The mobile app shell (iOS wrapper around the web UI): native mobile integration and packaging.",
"paths":[
"web/ios/"
@@ -87,9 +109,28 @@
"daniellok-db"
]
},
{
"key":"android-app",
"label":"comp:web-ui",
"priority_label":"comp:android",
"weight":1.0,
"weight_source":"editorial",
"definition":"The Android app shell: native Android integration and packaging.",
"paths":[
"web/android/"
],
"owners":[
"serena-ruan",
"fanzeyi",
"daniellok-db"
]
},
{
"key":"inner",
"label":"comp:harnesses",
"priority_label":"comp:harness-t2",
"weight":1.1,
"weight_source":"editorial",
"definition":"Core agent runtime and the harness/executor layer shared by all harnesses (loader, executor base, tool bridge, sandboxes). Harness-specific code has its own areas below.",
"paths":[
"omnigent/inner/"
@@ -97,18 +138,20 @@
"owners":[
"dhruv0811",
"TomeHirata",
"SabhyaC26",
"bbqiu",
"fanzeyi",
"aravind-segu"
"dbczumar"
],
"owners_paused":[
"dbczumar"
"aravind-segu"
]
},
{
"key":"runner",
"label":"comp:runner",
"priority_label":"comp:runner",
"weight":1.2,
"weight_source":"editorial",
"definition":"The agent runner: the execution engine that drives a turn.",
"paths":[
"omnigent/runner/"
@@ -117,15 +160,18 @@
"dhruv0811",
"bbqiu",
"fanzeyi",
"aravind-segu"
"dbczumar"
],
"owners_paused":[
"dbczumar"
"aravind-segu"
]
},
{
"key":"runtime",
"label":"comp:runner",
"priority_label":"comp:runner",
"weight":1.2,
"weight_source":"editorial",
"definition":"The agent runtime and execution scaffolding surrounding the runner.",
`@${author} Thanks for the PR! It doesn't reference an issue yet.
**We require an issue for every PR**, so the work can be prioritized before it's reviewed. Add one to the description:
- \`Closes #123\` if this PR finishes the issue. That links it, gives your PR the issue's priority, and closes the issue when this merges. You can also link it from the **Development** section of the sidebar.
- \`Part of #123\` if this is one step towards it. \`Related to\`, \`Towards\`, and \`Refs\` work the same way, and leave the issue open.
No issue exists for this yet? Open one first, then reference it. That's how we track what's worth doing, and it's usually quicker than it sounds. Note a reference has to point at an issue: naming another PR doesn't count.
The only exceptions are changes with no user-visible behaviour: pure **Refactor / chore**, **Docs**, or **Test / CI** work. If that's genuinely what this is, check that box under *Type of change*. Anything that fixes a bug, adds a feature, or changes the UI needs an issue, even when it also touches docs or tests.
See [CONTRIBUTING.md](https://github.com/omnigent-ai/omnigent/blob/main/CONTRIBUTING.md#every-pr-needs-an-issue) for the full policy.
_No action is taken beyond this comment._`;
module.exports=async({context,github,core})=>{
const{owner,repo}=context.repo;
// Default to a dry run: enforcement is opt-in via the workflow env.
constenforce=process.env.ENFORCE==="true";
// Unset means unlimited; an explicit LIMIT=0 means flag nothing. A malformed
// value flags nothing rather than everything -- this bounds how many
// contributors one run may comment on, so the safe default is the low one.
constrawLimit=process.env.LIMIT;
letlimit=Infinity;
if(rawLimit!==undefined&&rawLimit!==""){
limit=Number(rawLimit);
if(!Number.isFinite(limit)){
core.warning(`LIMIT=${rawLimit} is not a number; flagging nothing this run.`);
limit=0;
}
}
try{
// Load maintainers from the API, not the checked-out tree, so a PR can't
// self-grant by editing the file (same approach as demo-check.js).
echo "Tag ${TAG} already at the converged release commit ${base_sha} — nothing to do." \
| tee -a "$GITHUB_STEP_SUMMARY"
else
echo "::error::Tag ${TAG} already exists at ${tag_sha} (stamped version: ${stamped:-unknown}), which is not the converged branch head ${base_sha}. Delete the tag first if this is recovery (see RELEASING.md)."
echo "::error::Tag ${TAG} already exists at ${tag_sha} (stamped version: ${stamped:-unknown}), which is not the converged branch head ${base_sha}. Delete the tag first if this is recovery (see the maintainer release runbook)."
exit 1
fi
fi
@@ -645,15 +645,18 @@ jobs:
{
echo "## Next steps"
echo ""
echo "1. Dispatch the secure-release repo on this tag:"
# Run summaries are world-readable on a public repo, so the
# secure-release repo is a placeholder here; the runbook names it.
echo "1. Dispatch the secure-release repo on this tag. Substitute the repo"
echo " name from the maintainer release runbook, then run:"
echo ' ```'
echo " gh workflow run omnigent.yml --repo databricks/secure-public-registry-releases-eng \\"
echo " gh workflow run omnigent.yml --repo <secure-release-repo> \\"
echo "2. Validate the rc from PyPI (see RELEASING.md). No GitHub release is created for rc tags (rcs live on PyPI only) — skip straight to the next rc or the final cut."
echo "2. Validate the rc from PyPI (see the maintainer release runbook). No GitHub release is created for rc tags (rcs live on PyPI only) — skip straight to the next rc or the final cut."
else
echo "2. Merge the CHANGELOG PR, curate the ${TAG} draft notes, then dispatch finalize-release.yml (tag=${TAG})."
echo "::warning::Resource resolution failed with ${TAG} only ${age_h}h old — inside pip's --uploaded-prior-to=P1D window. The nightly catch-up will open the tap PR."
echo "Deferred to the nightly catch-up (${TAG} is ${age_h}h old, inside the 24h PyPI window)." >> "$GITHUB_STEP_SUMMARY"
exit 0
fi
exit 1
fi
echo "deferred=false" >> "$GITHUB_OUTPUT"
brew style omnigent-ai/tap/omnigent
- name:Assert the hand-maintained sections survived
if [ -n "$(gh pr list --repo "$TAP_REPO" --head "$BRANCH" --state open --json number --jq '.[].number')" ]; then
echo "Bump PR already open for ${BRANCH} — force-push updated it." | tee -a "$GITHUB_STEP_SUMMARY"
exit 0
fi
body="$(printf 'Bumps the omnigent formula to **%s** (new sdist url/sha256, resources regenerated via `brew update-python-resources`).\n\ntest-bot builds the bottles on this PR. Review the resource diff — especially that the extras'"'"' deps survived — then apply the `pr-pull` label to publish bottles and merge.\n\nOpened by omnigent `.github/workflows/update-homebrew.yml`.' "$VERSION")"
gh pr create \
--repo "$TAP_REPO" \
--base main \
--head "$BRANCH" \
--title "omnigent ${VERSION}" \
--body "$body"
echo "Opened tap bump PR for omnigent ${VERSION}." | tee -a "$GITHUB_STEP_SUMMARY"
git tag v0.6.0rc1 && git push origin release/v0.6.0 v0.6.0rc1 # explicit tag, NOT --tags
```
Then continue from step 2 of the standard flow (secure-repo dispatches). For
a final `vX.Y.Z`, if the GH draft wasn't created, `gh release create vX.Y.Z
--draft --verify-tag --title vX.Y.Z` recreates it (rc tags get no draft by
design). To re-run the notes/site halves for an existing
tag, dispatch `draft-release-notes.yml` or `publish-changelog.yml` with the
`tag` input; for the tap, dispatch `update-homebrew.yml`.
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Tomu Hirata
