[merge] v0.115.3 and its hot fixes into v0.115.4 - #6730
Closed
mmabrouk wants to merge 2 commits into
Closed
Conversation
added 2 commits
September 9, 2026 13:28
Merges hotfix/v0.115.3 (main 204703f plus #6722 and #6723) into release/v0.115.4. Sixteen files conflicted, in four groups. Where the two sides competed the 115.4 structure wins and the 115.3 fix is re-applied inside it. - Markdown link hardening (#6659/#6666/#6675) moves into the shared ChatMarkdown renderer 115.4 introduced, so /w and /m both keep it. - The rename menu (#6686) keeps its deferred menu handoff, which is the fix that makes the editor survive the menu's focus trap. - Permissions simplification (#6641) keeps its reduced group set, rendered through 115.4's Advanced section rail. - Provider-key presence (#6691) reads value_status, unchanged.
Every one of these suites passed on its own branch and fails only once the two are merged, because a v0.115.3 test now meets the surface v0.115.4 rebuilt under it. - The mobile link test drove `AssistantMarkdown`'s own component map. The map moved into the shared `ChatMarkdown`, so the test drives that one, with the resolver the mobile surface supplies. `ChatMarkdown` exports the map and its resolver context for it. - The slash-command test lived beside a hook v0.115.4 moved into `@agenta/chat` and deleted the test with. It moves to the package, and drops the host stubs the hook now takes as props. - Two Advanced-drawer suites navigated an accordion that is a section rail now: shorter nav labels, one panel mounted at a time, and a real button where the rail label used to carry `role="button"`. - The config summary card row is "Model", not "Model & harness". - The admission suite replaced `@agenta/entities/session` wholesale, and the composer's file palette reads a real export of it. - Two Next copies resolve in this workspace, so a test that mounts a package component cannot satisfy its `useRouter`. Both apps' vitest configs pin one copy for the run.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Member
Author
|
@coderabbitai review |
Contributor
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Organization UI (inherited) Review profile: CHILL Plan: Advanced Run ID: ⛔ Files ignored due to path filters (3)
📒 Files selected for processing (244)
Disabled knowledge base sources:
📝 SummarySummary by CodeRabbit
WalkthroughThis PR delivers many linked changes: a per-turn session-context feature (agent name, session name, first-turn flag) that flows from the API through the SDK to the runner prompt; a session-rename guard that protects person-chosen names; starter-credits model reconciliation; a new "allow" default runner permission with explicit build-kit op permissions; a request_secret tool; sandbox .tools restoration; a hotfix that makes the SDK tolerate saved gateway tool entries with missing policy or legacy provider_action fields; template playbook rewrites; and substantial frontend work on pending-send echoes, mount-generation guards, markdown link safety, and permissions UI. ChangesSession Context and Naming
Permissions, Secrets, and Sandbox Tooling
Frontend Chat and Permissions UI
Estimated code review effort: 5 (Critical) | ~180 minutes Severity of issue fixed: High Sequence Diagram(s)sequenceDiagram
participant Browser
participant AgentService as Agent Service (SDK)
participant Backend as Agenta Backend
participant Runner
participant Harness
Browser->>AgentService: POST /invoke (turn request)
AgentService->>AgentService: build SessionConfig
AgentService->>Backend: read workflow name, session name, latest turn
Backend-->>AgentService: agent_name, session_name, first_turn
AgentService->>AgentService: render turnContext (platform_instructions)
AgentService->>Runner: /run request with turnContext
Runner->>Runner: prepend turnContext to prompt blocks
Runner->>Harness: run turn with fresh session facts
Harness-->>Runner: turn result
Runner-->>AgentService: response
AgentService-->>Browser: turn response
sequenceDiagram
participant Model as Model (rename_session tool)
participant API as Sessions Router
participant Service as SessionStreamsService
participant DAO as SessionStreamsDAO
Model->>API: PUT header rename (name_source=automatic)
API->>Service: set_header(name_source)
Service->>DAO: update_header(name_source) with row lock
DAO->>DAO: refuse_name_change(current_source, edit)
alt person-chosen name protected
DAO-->>Service: raise SessionNameProtected
Service-->>API: raise SessionNameProtected
API-->>Model: 409 with envelope (code, next_step)
else rename allowed
DAO->>DAO: apply header edit, bump name_revision
DAO-->>Service: updated row
Service-->>API: success
API-->>Model: 200 OK
end
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Member
Author
|
Superseded: Ashraf merged release/v0.115.3 into release/v0.115.4 directly (5e40dd7, 05b91e7, ca335f0). His tree carries every v0.115.3 fix and both hot fixes; the only behavioral difference, /m inline code spans resolving as file links, is the chosen direction. The resolution table and the QA evidence in this PR stay as the record. Branch left in place for reference. |
Member
Author
Do not merge: superseded, and merging this would revert newer commits
That merge resolved the same sixteen conflicts the same way this one did, independently. Checked on the target: the deferred menu handoff is present on the card list, the tab rail and the tag bar; the link hardening sits inside the shared Merging this now would be a revert. Its base predates a17ae79, so it would undo "reject non-http(s) schemes in the document URL preview link" in Moved to draft so it cannot be merged by accident. It should be closed. |
Contributor
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this merges
hotfix/v0.115.3intorelease/v0.115.4, at 3807043. That branch is the tip ofrelease/v0.115.3and carries the whole v0.115.3 line plus its two hot fixes:One correction to the premise this was opened on.
hotfix/v0.115.3is notmainplus those two fixes:mainat 204703f is not an ancestor of it.release/v0.115.3andhotfix/v0.115.3point at the same commit, so everything from v0.115.3 does arrive here. What does not arrive is one automated commit that landed onmaindirectly, 7c49baa, an API-reference refresh touching three files underdocs/.release/v0.115.4does not have it either. It is out of the scope this PR was asked for and it regenerates on its own, so I left it alone rather than dragging amainmerge into this diff.The merge base with
release/v0.115.4is f676a77, from 2026-09-07.release/v0.115.4carries 130 commits of its own since then, most of them Ashraf's: the classic-mode redirect loop (#6648), sending a Classic-mode user out of/m(#6645), per-user/mpreferences keyed by auth user id, drive-file@-mentions in the composer, and the mobile-desktop parity pass.Sixteen files conflicted. The rule I applied throughout: keep both behaviors, and where the two genuinely compete, keep the v0.115.4 structure and re-apply the v0.115.3 fix inside it. Every place where that was a real choice is listed under "Please check" at the bottom.
The sixteen conflicts
Markdown link hardening (#6659, #6666, #6675)
v0.115.4 unified both hosts' markdown renderers into a new shared
ChatMarkdown. v0.115.3 hardened the anchor in each host separately. The hardening moved into the shared renderer, so/wand/mboth keep it and cannot drift again.web/oss/src/components/AgentChatSlice/assets/markdown.tsxMD_REHYPE_PLUGINSso the shipped link-gate test keeps its import path.web/mobile/src/features/chat/AssistantMarkdown.tsx/m. Code spans stay plain there, as on v0.115.3.web/packages/agenta-chat/src/components/ChatMarkdown.tsxweb/mobile/src/features/chat/DriveLink.tsxThe rename menu (#6686)
Both branches built
onRenameRowon the card list independently. The one thing only v0.115.3 has is the deferred menu handoff, and it is the fix that matters: an editor opened while the menu still holds its focus trap is blurred straight back out, and a blur commits. That is kept everywhere.web/packages/agenta-sessions-ui/src/SessionCardList.tsxweb/packages/agenta-sessions-ui/src/SessionTabRail.tsxonRenameTabis a superset: pencil, double-click, the menu and Alt+R all reach one editor. The menu route was changed to the deferred form.web/packages/agenta-sessions-ui/src/SessionListCard.tsxweb/packages/agenta-sessions-ui/src/SessionListPanel.tsxweb/packages/agenta-entity-ui/src/agent/AgentOverviewBody.tsxweb/packages/agenta-home-ui/src/HomeOverview.tsxonSessionRenameRow.web/mobile/src/features/home/HomeScreen.tsxweb/mobile/src/features/chat/SessionTabs.tsxweb/oss/src/components/AgentChatSlice/components/SessionTagBar.tsxweb/oss/src/components/pages/agent-home/StripHome.tsxwas not conflicted but follows the kept prop name.Permissions simplification (#6641) and provider-key presence (#6691)
v0.115.3 removed the Claude, Pi and sandbox permission editors and promoted permissions out of Advanced into its own section. v0.115.4 rebuilt Advanced as a section rail. Both hold: the reduced group set, rendered through the rail.
.../agentTemplate/useModelHarness.tsx.../agentTemplate/BuildKitSection.tsxformatPermissionValueandPermissionOverrideHint.web/packages/agenta-entity-ui/src/agent/AgentConfigSummaryCard.tsxweb/storybook/stories/entity-ui/BuildKitSection.stories.tsxThe composer
web/packages/agenta-chat/src/hooks/index.tsTests carried onto the new structure
A second commit fixes suites that pass on either branch alone and fail only once the two meet. None of these is a product change.
AssistantMarkdown's own component map, which moved intoChatMarkdown. It drives the shared one now, with the resolver the mobile surface supplies. Every assertion is unchanged.@agenta/chat, deleting the test with it. It moved to the package and dropped the host stubs the hook now takes as props.@agenta/entities/sessionwholesale, and the composer's file palette reads a real export of it.useRouter. Both apps' vitest configs pin one copy per run.Checks
git diff --checkclean.@agenta/chat@agenta/entity-ui@agenta/sessions-ui@agenta/oss@agenta/mobileLive QA
An EE dev stack built from this branch, at http://144.76.237.122:8480, compose project
agenta-ee-dev-merge1154. Image tags were renamed first so the build could not stage imagesunder any other stack on the box. Evidence, including eleven screenshots, is at
~/agenta-qa-evidence/2026-09-09-merge-1153-into-1154/./mhome screen rendersvalue_status, never the write-only key (#6691)/m(#6645)/wto/mredirect loop (#6648), sampled 15 times across two navigations/m: a "Model" row stating the model alone, and a "Permissions" row/w//hostlink is refused@-mention of a drive fileCell 14 is the one worth reading: it is the #6686 deferred handoff, the fix that keeps the
editor alive past the menu's focus trap, working on the merged code.
The last four need a completed agent run and no run completes on this stack. The composer
refuses to send before issuing any request, and the API log shows no run call at all: the
client's runnable-route check does not pass for the curated model routes with a plain OpenAI
key. The stored key is fine, which cell 2 shows. That is the local provider-key gate, not
anything this merge changed. With no run there is no reply to render markdown into and no
session in the list, so cells 17 and 18 have nothing to act on.
Standing in for them: cell 17 is covered by 15 link-gate tests that render the merged shared
renderer end to end, including the whole #6666 host-refusal list; cells 14 and 15 exercise the
same rename machinery cell 18 would, on another surface; cells 16 and 19 sit on code that
merged without conflict.
Please check
Four places where the two branches genuinely competed and I had to choose.
Custom secrets became a rail panel. On v0.115.3 the Advanced body always rendered a Custom secrets section. v0.115.4's rail has three panels and none of them is that section, so on
release/v0.115.4as it stands Custom secrets is unreachable outside a focus filter. Taking the rail unchanged would have taken that section away from v0.115.3 users, so I gave it a panel. If you would rather matchrelease/v0.115.4exactly, that panel is the thing to remove.The Permissions panel is gone from Advanced. [feat] Simplify agent permissions and allow routine work by default #6641 made permissions its own top-level section. Leaving v0.115.4's Advanced rail panel in place would render the same control twice. I dropped the panel.
/mcode spans stay plain. The shared renderer resolves both anchors and code spans against the drive. v0.115.3's/mresolved anchors only, so I added aninlineCodeLinksflag and turned it off there. Turning it on would give/minline file links, which is parity, but neither branch shipped it.Prop names.
HomeOverviewgained the same rename callback on both sides under two names. I kept v0.115.4'sonSessionRenameRowand updated the one v0.115.3 call site.One smaller call: the mobile relative-href fallback. When a relative href does not resolve to a drive file,
/mnow renders an external anchor instead of plain text, which is what the desktop already did and what v0.115.4's/mdid.