Repository navigation
merge: integrate main into beta - #44
Merged
Merged
Conversation
* Let Core own the runtime history window * Keep runtime history schema limits in the route description * Ignore closing backdrops in the settings dialog width test
) * Guide new administrators from sign-in to a first Session * Name startup settings by their environment variables Core reports each installation setting under the OAC_* variable that sets it and drops the unused changeable field. Web shows that name as the row label, keeps the installation ID and source commit behind Installation details, links to the guide for changing a setting, and finishes the glossary and empty-state wording.
* Classify model provider rejections * Classify provider rejections by their declared code
* Make failed Sessions actionable * Give failed Sessions next steps for every Session kind * Wrap the Partial chip on narrow metric tiles
* Give health and capacity facts one home Nodes owns the node list, per-node capacity, host figures, Add node and Edit node. Overview rows open their pages instead of popovers. Sandbox metrics keeps the hosted Runtime series and counts running against total. Settings → Sandbox and scheduling keeps setup, rollout, reset and the idle policy. Core metrics leads with whether Core can run Turns and folds process internals into Diagnostics. * Address review of health and capacity pages
* Fit console tables and tabs on phones A list toolbar no longer widens the page body, so the page never scrolls sideways at 390 px. The Session log shows Status beside each Session, Settings tabs wrap instead of scrolling out of sight, KPI strips use two columns with whole labels, narrow fact cards keep two even columns, and the Request log table scrolls in its frame. * Keep Startup settings columns and page width on phones
The shared code style lets text break anywhere, so on phones the Startup settings table shrank the name column and split names mid-word (OAC_EXECUTIO N_CONCURRE NCY). Names now break only at the existing <wbr> after each underscore.
The console server proxies each request once, but the browser retries a failed read once (TanStack Query retry: 1), so "the console never retries" read as wrong.
* Delete unused console copy and legacy hash aliases * Align console terminology and empty states * Use the console's terms in the docs * Capitalise Harness in the site tagline * Use one zh term per concept in the console Providers are 提供商 (沙箱提供商, 模型提供商), Environment stays an API term, templates are 模板, and stray spaces between Chinese words are gone. The Plain Vocabulary Rule in DESIGN.md and PRODUCT.md now names these terms for the zh copy and the zh docs alike. * Delete the unused Vault catalog helpers Nothing outside their own tests called agentNeedsCredentialCatalog, deriveSessionVaultPlan, loadVaultCatalog or matchingCredentials, so they go with their tests, the error copy only they used, and the top-level collection pager only the catalog needed. * Use the console's zh names and one term per concept in the zh docs The zh docs now name pages and actions exactly as the zh console does, call project keys 项目 API 密钥, and use 项目, 沙箱提供商, 模型提供商, 提供商, 模板, 主机 and 子 Agent throughout, without gloss headings or stray spaces. * Smooth three zh sentences after the term pass
* Fix console leftovers from the UX review * Keep the refresh wording inside the storage editor A refresh after an uncertain save follows a successful read, so it keeps the "may be out of date" wording. Only the page's first read says the storage could not be read. * Give hosted Runtimes one Status column Hosted Runtimes showed Status (the Runtime observation, replaced by the sample reason when no sample came back) next to Recorded compute (the allocation's compute phase). Core derives the lifecycle state from that same phase, so both columns answered whether a sandbox uses compute, is suspended or is gone. Status now shows Core's lifecycle record alone, with a help tip. When an active sandbox has no sample, its CPU and Memory cells name why. The Session page's Runtime state uses the same rule and labels. * Use the zh page names on the Sandbox metrics row
* Fail Turns when the model host is unreachable * Classify connection failures from retries without a response
On hosted Claude Sessions the bridge sends its classified error and then reports the Turn settlement as unconfirmed; the daemon forwards that as a second error frame, "executor Turn settlement failed", without a code, and Core overwrote the stored engine_error_code with every error frame. Every Claude failure therefore reached diagnostics as harness_error. A frame without an accepted code now leaves the stored classification in place; a later accepted code still replaces it. The Core–Runtime protocol states the rule.
At 390 px the status column left the clamped reason one or two characters ("模…"), and touch has no tooltip. Below 640 px the log shows the status alone; the Session page keeps the reason and its next step.
* Upgrade the installation volume in init Init now upgrades a volume from an older release in place: it verifies the receipt, refuses a release that is not newer by the node manifest's new source_time, publishes its own release beside the old ones, keeps the secrets and installation ID, and writes the receipt as the single commit point. The receipt lists every retained release and no longer pins active.json; init rewrites the pointer from the receipt on every start, so a crash between the two heals. Receipts from v0.0.10 and v0.0.11 upgrade without special code. Core refuses a database schema newer than its migrations. Web computes the node installer digest per request from the active release. The Compose smoke builds the checkout's node metadata instead of downloading the v0.0.3 archive, and upgrades a published v0.0.11 installation in place to the checkout. * Name a missing installed release and reword the downgrade refusal
* Upgrade installations with the installer oac install --upgrade and install.py --upgrade move an existing installation to the installer's release in place. They stage the new files, check them with oac-core check-config and init against the installation's .env and override, and only then replace oac and compose.yaml and start the services. Without --upgrade, another release is refused before any Docker change; the same release resumes through the start oac apply uses. The release checksum is verified in the stage only, and starts recreate changed containers and remove orphans. node_payload is split into publish and activate so a bundle upgrade keeps earlier releases and moves the active pointer after the checks. * Read the Windows command name in the upgrade test * Run init before the configuration check on resume and address review findings
Replace the Mermaid rendering with the deployment and protocol-boundary diagram: control server, microsandbox compute servers, E2B, self-hosted machines, independent workspace storage and external services, with each protocol labeled on its connection. scripts/generate-architecture-diagram.py owns the layout and colors and writes docs/assets/architecture.svg with IBM Plex Sans from Web's @fontsource dependency embedded, so GitHub and the website render the same text metrics. It uses only the Python standard library and rejects text that overflows its box or lacks a glyph. The website no longer frames the image in a white box, since the diagram now carries its own background.
* Serve installer from project domain * Include website shell entry in website checks
A new installation is now assembled in a .staging-* directory inside the installation directory and moved into place after docker compose config accepts it, compose.yaml last. A failure before then removes the stage, and the directory when the run created it, so the same command can be rerun; the next run removes a stage a killed run left. A non-empty directory without compose.yaml is still refused. Failures exit with one line instead of a traceback: distribution and payload errors print their message, a failed command names its step and points at the output above, Ctrl-C asks to rerun, and permission errors name the path with the sudo chown command that returns it. A same-release resume check no longer says "Upgrade stopped". The bundle modules are imported from the script's own directory, so the unused --bundle-dir flag is removed.
oac install now reports Docker's own reason without exit statuses or template output, and says what to install or start: the Docker access case names the docker group, Docker Desktop and rootless Docker and warns against sudo. Permission errors on ~/.oac, the lock, the stage or the installation directory name the blocked path and the sudo chown command that returns it. A busy lock and a failed image pull say what happened and the next step, and release downloads retry network errors, 429 and 5xx responses three times.
A registered node that could not connect logged only "sandbox node connection interrupted; reconnecting" on every retry, and a service that started while Core was unreachable printed "cannot confirm approved node capacity" with no reason. A reverse proxy without WebSocket upgrades, a firewall, DNS, an untrusted certificate and a Core that refuses the node's hello all looked the same. The node now logs the cause: the HTTP status of a refused WebSocket upgrade, the close code and reason, or the network or TLS error without the URL, addresses or local port. Run logs each cause once until a connection holds for 30 seconds, and logs "sandbox node connected to Core" after a logged failure. A connection that ends between hello and welcome is reported as "Core did not accept the node", which is how a node of another protocol version shows up. The identity refresh at service start names the same cause. Nodes troubleshooting gains a Connection failures table.
An install that failed before Core recorded the node no longer dead-ends after a sandbox configuration change or a Core upgrade: the next command replaces the earlier attempt's configuration and mismatching cached files and continues. A registered node keeps its state, and a rerun that meets a newer node program or a changed configuration says what is true and the Remove node, uninstall and Add node steps. The installer checks free disk before downloading, shows a full disk as such, and deletes the Runtime archives once the image is imported. It drops the unused --update and --bundle options, keeps the local provider check's class on a failed registration, and names the cause in a dozen smaller messages.
* Keep the installer's proxy and clean up node uninstall * Restart a running node service when its proxy changes
* Uninstall self-hosted machines * Keep a shared download cache until the last installation goes
* Show the node uninstall command any time * Say what node uninstall keeps
Fresh installs now run init, check-config and up like oac apply. Refusals from init and check-config are reported as themselves, a failed start names the services that are not healthy with their log command, and Ctrl-C prints that the installer can be rerun. Docker children ignore OAC_* and COMPOSE_* variables of the caller's shell. Output adds pull and start progress, the effective console origin and, only on a fresh install, the Core key.
* Keep self-hosted uninstall inside its installation Install defaults to the environment directory and refuses a foreign non-empty directory; uninstall deletes only the installation's own entries, removes its record and executable last, and reports what it keeps. The bootstraps accept a complete partial download and give the grant only to the installer, and the grant variable name has one definition. * Count the Windows daemon lock file as installation-owned
* Check the Web port before an offline install * Fall back to Compose defaults for empty settings
chore: sync OpenAgentCore upstream main
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Merge main through
cdea7612into beta while retaining beta's input receipts, event flow control, diagnostics, native suspension, observations and deployment configuration.Resolve overlapping Codex classification changes by retaining billing classification and private correlation alongside upstream structured provider rejection parsing. Preserve Runtime observation initialization with the new connection arguments, project beta capacity settings using current environment-variable names, and reconcile bilingual protocol documentation. Regenerate OpenAPI and SQL projections.
Validation
make check-runtime-contract check-docs