5 Commits

Author	SHA1	Message	Date
Jaroslav Beneš	9ddc0a2103	Something can happen because time passed, and land somewhere worth reading ... Nothing in LLeMbas ever happened on its own. Every reply was downstream of somebody pressing Send, and the one exception -- jobs.wake, waking a chat when a background job finishes -- was downstream of a command they had run. PLAN.md never listed scheduling as unbuilt because services/chat.py:618 had recorded it as a decision: "a scheduler is a whole new concern for a single-worker application". This is that concern, taken on deliberately, plus the two places its output goes. Reports first, because it is useful with no scheduling at all. A report is not a Chat with one Message in it: it has no turns and no reply, it is read top to bottom, and it must be writable with no chat behind it -- being the fallback for a run whose own chat has gone. As a Chat it would need a sidebar row per daily report, a title that regenerates itself, a composer to suppress and a bubble with a rewind button around something that is not a turn. The section's character is enforced by absence: nothing under reports/ includes the composer or renders chat/_message.html, so there is no sse-connect anywhere and nothing on those pages *can* start a generation. The test reads that off the OpenAPI schema, not by walking app.routes -- this FastAPI keeps an included router wrapped rather than flattening it, so the walk finds nothing and the assertion passes for the wrong reason. rule.py is pure, total, and was finished before anything called it. No session, no wall clock, nothing that raises: validate clamps what it recognises, drops what it does not, and answers {} for prose -- at which point the caller shows the manual form. It had to be that way because the compile step's output is model output that becomes a *timer*, which is the sharpest case of hard rule 6 here. The invariant, pinned: anything validate accepts has a computable next occurrence. A schedule that can never fire looks exactly like a working one on every screen it appears on. Wall-clock and elapsed time are kept apart because they mean different things. at.times are wall-clock in the owner's zone, so 15:00 stays 15:00 across a daylight-saving change -- that is what "every Monday at 3PM" means. every is elapsed real time, so six hours stays six hours across a 23- or 25-hour day -- that is what a timer means. Conflating them gets one of the two wrong twice a year. A time inside the spring-forward gap fires at the first minute that exists; left to zoneinfo's own resolution it lands an hour away wearing a wall-clock time that did not happen, and a daily 02:30 report vanishing once a year on a machine nobody watches is the failure this file is arranged around. The ticker claims and commits *before* it fires. The other order is a hot loop: a firing that raises is retried every tick for ever against whatever it was that failed, and the only symptom is load. Its blanket except is copied from the terminal reaper for a sharper reason -- a ticker that dies on one bad row stops every schedule on the instance and says nothing at all. No request fails, no reply errors, no dot appears. The reports simply stop. Three rules that look like bugs from outside: a firing arriving while the chat is still answering queues rather than starting a second reply, and past max_queued is skipped with the reason on the row; Run now does not advance next_fire_at, or testing a schedule silently consumes the run it was testing; resuming recomputes from now, or a schedule paused for a month fires the instant it comes back, once per occurrence it missed. Catching up lives in the sweep and not in a startup hook, because a suspended host and a long stall reproduce "its time passed while nothing was running" with no restart to hang one on. services/wake.py is the lock discipline extracted rather than copied. A finished job and a due schedule are the same problem, and both depend on there being no await between the running_for check and the writes; two lock dictionaries for one invariant is how one of them drifts. jobs.wake is now a caller that supplies wording, and _completion_text stayed exactly where it was because tool.background quotes its opening sentence. A scheduled run has no reader, so ask_user is withdrawn from resolve_tools rather than merely discouraged in core.unattended -- a rule living only in a system message is one a page the model just read can argue with, and a parked question holds the reply for the whole approval_timeout with nobody to answer it. For the same reason a task chat may not be an agent chat in v1: Manual, Edit and Plan all stop to ask on RISK_EXECUTE, so the only two outcomes would be unattended execution and a reply that stalls. That deserves its own pass. Messages is bounded in the request and unbounded on disk. Only the latest chunk is sent; everything else stays exactly where it was written. Nothing is folded into text and nothing is deleted -- the visible conversation is identical either way, so destroying the older rows would buy only disk, against being irreversible and losing every attachment and tool call in the range, and it would contradict the rule compaction already holds. should_compact refuses this kind for the matching reason: two mechanisms narrowing one transcript is how a summary ends up summarising a summary. The history route is the mirror of thread_tail and keeps its four properties; the fifth is its own, that prepending moves the scroll position, so app.js records scrollHeight before the swap and adds the difference back after. An empty Chat.kind meant "both sides of the switch" and had been read as "no filter" since there were only two of them. The sidebar passes "" precisely when agent chats are switched off -- so the moment a third kind existed, every task chat and every Messages conversation appeared in somebody's ordinary chat list, on exactly the instances whose owners would never think to look. KINDS stays the two-sided fork, because set_sidebar_kind validates against it and a third entry there makes the tree filterable to a side with no button to leave it; ALL_KINDS is what a row may be. Both narrowings are pinned, because they are two implementations of one rule and only one of them is SQL. Per-user timezone had to exist for any of this: harness.py:179 was telling every reader the *server's* idea of the date, which is survivable while the answer is prose and stops being survivable the moment somebody says "every Monday at 3" and something has to work out when that is. Three things were caught by a test being wrong rather than by the code being wrong. The task-chat "no composer" assertions were passing against a page rendering its no-models-configured branch. A permission test asserted the same thing twice because the administrator bypasses every permission. And every Messages test passed with default_model never called, because none of them configured a model -- so the pair it returns was being assigned straight to model_id, and SQLite refuses a tuple in a String column. The fixtures now say why they exist. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-05 21:31:36 +02:00
Jaroslav Beneš	47d1ddbc3c	Draw a picture, on a ComfyUI you are running ... The last unbuilt capability, and built the way CLAUDE.md said it had to be: a ToolDef reaching resolve_tools plus a permission and a capability flag, not a new code path. The only genuinely new UI is one branch in the transcript. services/images/ is three modules. comfy.py speaks HTTP -- submit, poll /history, fetch the PNG, /free, and an /object_info discovery for the admin page only. Polled and not socketed, because holding a connection open for the length of a generation is the live-connection state the whole ssh.py design forbids, and the thing being waited for takes tens of seconds anyway. The base URL is exempt from the SSRF guard by construction, exactly as Connection.base_url and the audio endpoints are -- said out loud in the docstring, because a default of 127.0.0.1:8188 is precisely the shape that guard exists to refuse and therefore reads as a hole rather than a decision. workflow.py fills a template, and the one thing that matters is that it walks the parsed JSON rather than the text of it. A value that is exactly "{{steps}}" becomes the number 20; ComfyUI validates types and refuses the string. A placeholder inside a longer string is still text, which is what makes "{{prompt}}, masterpiece" work -- and text substitution would additionally mean a prompt containing a quotation mark produced a document that no longer parses, on the one input guaranteed to hold arbitrary text. Which node holds the prompt is the administrator's statement rather than a guess from node types: sniffing for the first CLIPTextEncode works on the shipped workflow and on nothing else, and swaps positive for negative the first time somebody reorders them. seed has no fixed default, because one would make every unspecified generation identical and make the retry loop redraw the same rejected picture four times. tool.py is one call, one finished image. Returning every attempt to the conversation would cost a round each, make the ceiling advisory rather than enforced, and walk the reader past every reject -- so the reviewer lives inside the tool and is asked about *bytes*: an attempt about to be discarded should not leave an Attachment behind, so it sees a downscaled preview built in memory and only the kept image is written. Anything that goes wrong in review is a keep; losing a picture because a judging request timed out would be the check destroying the thing it was checking. The last attempt is kept whatever the verdict, so a request always produces something. Rejects are recorded, not stored. Preserve VRAM unloads the chat's own connection and nothing else, because the memory being freed belongs to one machine: local llama-swap answers GET /unload, and a box on the network has no reason to be unloaded when ComfyUI wants memory here. The swap goes round the review rather than round the tool, which costs two model loads per retry -- so the two settings are independent and the page warns when both are on. Nothing loads the LLM back: the reply's next request does, and that step exists in the description and not in the code, so the code says so. Two rules elsewhere had to be drawn for the first time. message_payload sends images only on user turns -- no assistant message had ever carried one, and the moment one does the multimodal list form on an assistant turn is rejected by OpenAI and most local runners, breaking every later turn in the chat. And files.store gained keep_original, because _process_image turns anything without alpha into JPEG q85 at 1400px: right for a phone photo, a visible loss on the one output this feature exists to produce. /image sends the ordinary message with force_tool, which becomes tool_choice for the first round only -- left in place the reply would draw a picture, be asked again, and draw another. FORCEABLE_TOOLS is an allow list because the name is read off a form. ToolContext gained chat_id, and that fixed a tool nobody had ever successfully run: _run_scratch_write read context.chat_id on a dataclass with no such field, so every call raised AttributeError, swallowed by run_tool's blanket except into "the scratch_write tool failed" -- indistinguishable from a model calling it wrongly. The test that existed asserted the family and the risk, which are properties of the declaration rather than of the code. Verified against the real ComfyUI 0.27.0 on this machine rather than against documentation: every endpoint shape here was read off it, a generation ran end to end through the client, the reviewer was shown a matching and a mismatched prompt and answered KEEP and RETRY correctly, and the unload hook fired for the local llama-swap and not for the remote box. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-05 14:13:19 +02:00
Jaroslav Beneš	5766446b84	Files, open beside the conversation ... A third side panel, built the way the terminal is and filled the way the inspector is: tabs holding open files. Project files over SFTP in an agent chat; notes, skills, knowledge documents, this chat's text attachments and its own scratch document everywhere. Read with pygments, edited in a plain textarea, saved with a conflict check. A bug found on the way in, and the reason this needed its own read path. `ssh.read_file` ends in `clean_output`, which strips ANSI escapes and decodes with errors="replace" -- right for the output of a command, and fatal for an editor: open a file containing an escape byte, press Save, and you have silently rewritten it with the escapes gone and every undecodable byte replaced by U+FFFD. `read_text`/`write_text` decode strictly, report binary rather than mangling it, carry an mtime:size token for a file that moved underneath, and refuse an oversize write rather than truncating -- `write_file` truncates because a model is told how many bytes it wrote, and somebody pressing Save is not. The model-facing pair is untouched: what it returns is a contract a model has been shown. A truncated read opens read-only for the mirror-image reason. Six sources go through one dispatch table, for the reason tool_labels.py is a table: six independently written permission checks is how one ends up written slightly differently, and that failure looks like editing somebody else's note. A save on a project file bypasses agent/policy.py, which makes it the fourth documented exception to "the modes do not govern the keyboard" and the first that writes. Same argument as the terminal panel -- whoever owns the credential could write the file with scp -- but the consequence is larger and is now said out loud rather than left to be inferred. The model opens tabs from the file tools it was already calling, so no new schema and no tokens. It never brings one to the front: an agent reads forty files in a long reply, and taking the screen each time would drag somebody through all of them and lose any edit in progress. Only the strip is streamed, guarded on truthiness so the frame can never blank itself -- an empty one would close every open tab, the approval card you could press twice with the sign reversed. Both halves are settled on the server, which is why canvas.js needs no guard against a swap at all. No vendored editor. CodeMirror 6 needs a bundler, which is hard rule 1; CodeMirror 5 would be a larger payload than xterm on every page, and xterm is the one heavy dependency precisely because it loads only where it can be used. So: server-rendered highlighting for reading, a textarea for writing, and the panel says there is no colour while you type rather than pretending. Also here: a scratch document per chat, with `scratch_write` at RISK_READ on plan_update's argument, and a test pinning the three numbers that decide a panel's width -- LAYOUT_BOUNDS drops an unknown variable silently, so a panel missing from it has a drag handle that works and forgets. Driven under a DOM stub and against the running application. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-04 09:21:03 +02:00
Jaroslav Beneš	89d2d6ebfd	Let a command run in the background instead of being killed ... An agent command is one blocking conn.run over a per-call connection, killed the moment it hits its timeout -- so a ten-minute apt install is impossible, which is exactly what a user hit. This is the substrate for running it detached instead: the model can ask for background=true, or a command that outlasts its timeout is kept running rather than killed, and either way the model gets tools to read and stop it. Opt-in, off by default, under Admin -> Agents; off is byte-for-byte the old behaviour. The mechanism has to survive the connection closing (that is the whole premise of the per-call model), so a job is a setsid-detached process on the far side, redirected to a remote logfile and an exit-file; LLeMbas reconnects, as always, to read it later. services/agent/jobs.py holds the wrappers. Three things in those wrappers are load-bearing and each was got wrong in the first sketch: - The command never touches a quoted shell context. sh -c '<cmd>' shatters the instant the command contains a quote -- git commit -m 'fix', awk '{…}', sed 's/…/…/' are the common case, and it is an injection hole besides. So the command is base64-encoded in Python and decoded on the far side into a script file; it is bytes, never shell syntax. - The child records its own pid via $$ as its first act, under setsid where it is the session leader, so job_stop can kill the whole process group. echo $! from the launcher captures the wrong pid. - The command's exit status comes from the exit-file, never the wrapper's own status -- which is ~0 from its trailing rm. Reading the wrapper's status would mark every job a success. A command that finishes in time is indistinguishable from a foreground one -- same output, same wording; the difference shows only when it does not, where instead of "stopped after Ns" it becomes a job id. Auto-convert is its own sub-switch: with it off, a timeout stays a hard stop and nothing is left running, because routing the plain case through the detached wrapper would leave an orphan running past a stop an administrator asked for. New agent tools job_output/job_list/job_stop, offered only when the feature is on (the plan_submit gating pattern); job_stop is RISK_EXECUTE since it kills a process. A job's files are namespaced by the calling chat's id and the wrappers are always built from it, so a model in one chat cannot even name another's job. Tested against a real local /bin/sh rather than the fake echo-the-command sshd fixture, because the shell logic -- setsid, base64, the wait loop, the child surviving the wait being cut off -- is the whole of the risk. The auto-wake that prompts the model back when a job finishes is the next commit. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-03 14:15:49 +02:00
Jaroslav Beneš	a58e48fce5	Say what a tool did, not where it ran ... An agent event set its label to the SSH profile's name, so the transcript read "homeserver · ls -la" -- naming the machine rather than the thing that was done. Built-in tools set no label at all and fell back to the function name, so a saved memory read "memory_add". The status line said "Running shell_run…" and the approval card had its own hand-written wording. Four places, four answers, nothing checking that any of them agreed. services/tool_labels.py is the one table all of them read now. Bash, Read, Write, List, Web search, Memory saved; an icon each, instead of everything being the sparkle. The precedence is inverted on purpose. Tool events are persisted in Message.tool_calls_json, so every agent row already on disk carries the profile name -- a resolver that preferred the stored value would fix nothing for any transcript that already exists. So a name the table knows resolves from the table, and a name it does not -- a custom HTTP tool, an MCP tool, whose labels are per row and cannot be tabulated -- keeps its own. One rule, both cases correct. The machine moves to `detail`, where "where this ran" belongs. tool_label and tool_icon are Jinja globals because a message bubble is rendered from four handlers, and a fifth thing each of them must remember to pass is a fifth thing one of them will forget. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-03 10:58:02 +02:00