chore(fullsend): use rhdh-fullsend-code and allowlist claude.exe - #4496
Merged
kadel merged 1 commit intoAug 31, 2026
Merged
Conversation
Pin code/fix/review to ghcr.io/redhat-developer/rhdh-fullsend-code:latest and allow Vertex STS from Claude Code's bun binary (claude.exe). Co-authored-by: Cursor <cursoragent@cursor.com>
|
kadel
approved these changes
Aug 31, 2026
Member
|
/lgtm |
2 tasks
4 tasks
subhashkhileri
added a commit
to subhashkhileri/rhdh-plugins
that referenced
this pull request
Sep 17, 2026
Our code/fix/review harnesses pinned fullsend-ai/agents@4bbe4f50e, set once in redhat-developer#4496 and never bumped — 794 commits behind main. Move to the agents@v0 tag (7ab05564b, 794 commits later) to pick up two fixes relevant to the /fs-review timeout on PR redhat-developer#4808 (run 35097265739): - fullsend-ai/agents#1116 (PR redhat-developer#1181): sonnet-tier review sub-agents now request the bare `sonnet` alias, pinned via ANTHROPIC_DEFAULT_SONNET_MODEL=claude-sonnet-4-6 in env/gcp-vertex.env, instead of the hardcoded `claude-sonnet-4-6@default` literal our pin still carries. That literal was falling through the CLI's own alias resolution to claude-sonnet-4 (Sonnet 4.5 not available on our Vertex project), landing on a base model with a 120k output-tokens/min quota vs. 300k for sonnet-4-6 — three parallel sonnet sub-agents blew through it and all failed with 429 RESOURCE_EXHAUSTED. - review harness timeout_minutes raised 20 -> 45, which independently would have absorbed the degraded run instead of hard-timing-out. Scope: base: URL + content sha256 only. Our rhdh/policies/*.yaml overrides are left as-is for now — upstream moved network policy from policy: to composable providers:/openshell: profiles: in the interim (ADR 0065), which likely makes the claude.exe allowlist in our policy fork redundant (profiles/fullsend-vertex-ai.yaml already allowlists it upstream), but retiring that fork is deferred to a follow-up so this change stays a minimal, low-risk version bump.
subhashkhileri
added a commit
to subhashkhileri/rhdh-plugins
that referenced
this pull request
Sep 17, 2026
Our code/fix/review harnesses pinned fullsend-ai/agents@4bbe4f50e, set once in redhat-developer#4496 and never bumped — 794 commits behind main. Move to the agents@v0 tag (7ab05564b, 794 commits later) to pick up two fixes relevant to the /fs-review timeout on PR redhat-developer#4808 (run 35097265739): - fullsend-ai/agents#1116 (PR redhat-developer#1181): sonnet-tier review sub-agents now request the bare `sonnet` alias, pinned via ANTHROPIC_DEFAULT_SONNET_MODEL=claude-sonnet-4-6 in env/gcp-vertex.env, instead of the hardcoded `claude-sonnet-4-6@default` literal our pin still carries. That literal was falling through the CLI's own alias resolution to claude-sonnet-4 (Sonnet 4.5 not available on our Vertex project), landing on a base model with a 120k output-tokens/min quota vs. 300k for sonnet-4-6 — three parallel sonnet sub-agents blew through it and all failed with 429 RESOURCE_EXHAUSTED. - review harness timeout_minutes raised 20 -> 45, which independently would have absorbed the degraded run instead of hard-timing-out. Scope: base: URL + content sha256 only. Our rhdh/policies/*.yaml overrides are left as-is for now — upstream moved network policy from policy: to composable providers:/openshell: profiles: in the interim (ADR 0065), which likely makes the claude.exe allowlist in our policy fork redundant (profiles/fullsend-vertex-ai.yaml already allowlists it upstream), but retiring that fork is deferred to a follow-up so this change stays a minimal, low-risk version bump.
durandom
pushed a commit
that referenced
this pull request
Sep 17, 2026
…4843) Our code/fix/review harnesses pinned fullsend-ai/agents@4bbe4f50e, set once in #4496 and never bumped — 794 commits behind main. Move to the agents@v0 tag (7ab05564b, 794 commits later) to pick up two fixes relevant to the /fs-review timeout on PR #4808 (run 35097265739): - fullsend-ai/agents#1116 (PR #1181): sonnet-tier review sub-agents now request the bare `sonnet` alias, pinned via ANTHROPIC_DEFAULT_SONNET_MODEL=claude-sonnet-4-6 in env/gcp-vertex.env, instead of the hardcoded `claude-sonnet-4-6@default` literal our pin still carries. That literal was falling through the CLI's own alias resolution to claude-sonnet-4 (Sonnet 4.5 not available on our Vertex project), landing on a base model with a 120k output-tokens/min quota vs. 300k for sonnet-4-6 — three parallel sonnet sub-agents blew through it and all failed with 429 RESOURCE_EXHAUSTED. - review harness timeout_minutes raised 20 -> 45, which independently would have absorbed the degraded run instead of hard-timing-out. Scope: base: URL + content sha256 only. Our rhdh/policies/*.yaml overrides are left as-is for now — upstream moved network policy from policy: to composable providers:/openshell: profiles: in the interim (ADR 0065), which likely makes the claude.exe allowlist in our policy fork redundant (profiles/fullsend-vertex-ai.yaml already allowlists it upstream), but retiring that fork is deferred to a follow-up so this change stays a minimal, low-risk version bump.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ghcr.io/redhat-developer/rhdh-fullsend-code:latest.claude.exe(Claude Code 2.1+ bun compile) so Vertex STS is notpolicy_denied.Proven
Same fix as rhdh-agentic #124 / #125:
ghcr.io/redhat-developer/rhdh-fullsend-code:latestpolicy_deniedWhy now
rhdh-plugins code agents are already failing with
policy_deniedon:https://github.com/redhat-developer/rhdh-plugins/actions/runs/33389059456
**/claudedoes not matchclaude.exe, which is what Claude Code 2.1+ uses to callsts.googleapis.comfor Vertex.Made with Cursor