Repository navigation
feat(website): a session cookie per site, /go?sid=, the clock's rate, conformance levels and models= (FD-4683) - #444
Open
williamloo-scale wants to merge 16 commits into
Conversation
…n_<name> (FD-4683) Two SDK sites browsed under one gateway host overwrote each other's agentenv_session. The cookie is now named after the site's environment name, advertised on the website/v1 card, and the conformance check holds the session path to it; the shared legacy cookie is still read for one release. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…e of its own (FD-4683) The website state verifier reads /go?sid= per checked session, the CUA-Gym convention in which every sid is an isolated world started from the seed and no sid is the shared default. Collections keeps sessions; a request runs in its ?sid= or the one its browser last named (kept in <session cookie>_sid), self.store resolves to that session, and the default session (sid=default or none) is the data plane's state, as before. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…stead of guessing it (FD-4683) The gateway's /clock/time now carries virtual_seconds_per_real_second beside virtual_time (an extra field; readers of virtual_time are unaffected). UniverseClock extrapolates at that rate when a clock answers one and falls back to inferring it from two agreeing read intervals when it doesn't. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
… recommended ones (FD-4683) Only what website/v1 requires of any server fails a run: / for any Host, the health path, no page at the reserved paths (a new check), and the data-plane round trip when the card advertises one. The card's details, X-Universe-Now, clock sync, forwarded handling and cookies are recommended and warn; --strict makes a warning fail too. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…rver's database (FD-4683) models= takes an object with load/export/reset, or SQLAlchemy models (a declarative Base, a MetaData, or a module holding one). For models the site gets self.db, a session factory on DATABASE_URL (the env's schema, by its search_path), whose tables the data plane loads, exports and resets and /go reports, so the GUI and the MCP tools share rows. SQLAlchemy is imported only then, from the new db extra. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
# Conflicts: # packages/agentenv-protocol/examples/website/notes/README.md
# Conflicts: # packages/agentenv-protocol/src/agentenv_protocol/website/clock.py
williamloo-scale
changed the title
williamloo-scale
marked this pull request as ready for review
November 3, 2026 00:24
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
# Conflicts: # packages/agentenv-protocol/src/agentenv_protocol/website/conformance.py
…ath themselves (FD-4683) A server serving a page at the exact RPC_PATH or WELL_KNOWN_PATH, and 404 under them, now fails the required check. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…river (FD-4683) The db extra carries SQLAlchemy and no driver; the module docstring says the site installs the one its URL names, and Tables.engine turns create_engine's bare ModuleNotFoundError into an ImportError naming it. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Brings in #428's review fixes beside this branch's: the clock's sync reads under the refresh lock and keeps the answered rate; conformance checks X-Universe-Now last, on every answer, at the recommended level, with the reserved-path probes counted; the handwritten test server stamps its 404s and 405s like every other answer. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…s hooks still own (FD-4683) ModelState.load_parts now deep-copies the hooks' export when it saves the initial state, so a hook that returns row dicts it keeps editing no longer changes what /go reports as the starting value. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
… session cookie (FD-4683) The cookie keeping the session a browser last named was the session cookie's name plus `_sid`, so the site `notes`'s `agentenv_session_notes_sid` was also the sign-in cookie of a site named `notes_sid`. It is now `agentenv_sid_<name>`, a prefix no session cookie has. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…s changes (FD-4683) data/reset drops a store's named sessions, which data/get doesn't export, so a check run while a browser had edited ?sid=task-1 erased that session. /go now names the site's changed_sessions, the named sessions whose state changed, and the checker skips the round trip when it names any, as it does for a changed default state. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #443.
Website SDK follow-ups.
agentenv_session_<name>, named on the card, so two sites under one gateway host don't overwrite each other's. The sharedagentenv_sessionis still read for one release./go?sid=. Each sid is a store of its own started from the seed, the CUA-Gym convention the website state verifier reads. A request runs in its?sid=, else the one its browser last named (<cookie>_sid), else the default session, which is the data plane's state as before./clock/timealso answersvirtual_seconds_per_real_second, whichUniverseClockfollows instead of inferring it.X-Universe-Now, clock, forwarded headers and cookies warn;--strictfails on a warning.@website(models=...). An object with load/export/reset, or SQLAlchemy models. With models the site getsself.dbonDATABASE_URL, and the data plane and/goread those tables, so the GUI and the MCP tools share rows.Before merging
models=adds an optionaldbextra (sqlalchemy>=2.0), included indev, and updatesuv.lock. SQLAlchemy is imported only when a site uses models.Test
Unit suite: 12,625 passed; the
models=tests (6) also pass with SQLAlchemy installed.🤖 Generated with Claude Code
The reviewed changes appear safe to merge with dependent PR #446’s development-checker fix.Summary
Adds per-site cookies, named stores through
?sid=, explicit clock rates, required versus recommended checks, and database-backed sites throughmodels=.Reviews (4) · Last reviewed commit: "fix(website): the conformance round trip..." · Reviewed by Greptile