Refuse a shell the database, show a screen that ended, and unblock a taken-over sign-in - #289
Merged
Conversation
…taken-over sign-in Five fixes to issues open against 0.0.5, each generic and none vendor-specific: - The all-in-one image's embedded PostgreSQL moves from trust-auth to scram-sha-256 with a generated password, so a Bot's shell can no longer reach the vault/audit as the owner (#226). - A live screen that ends renders its reason in the branch that is mounted, instead of leaving a frozen frame (#287). - The Bot's browser drops the automation flags that make sites refuse a person's sign-in, at the source rather than by patching navigator.webdriver (#275). - The langgraph Bot carries a continuation turn when a run has no human message, and ends an empty reply on a visible line, so strict providers stop failing silently (#199). - A deterministic acceptance test drives the built-in Bot's authenticated AG-UI contract and asserts no secret is disclosed (#219).
davidmckayv
requested review from
MikeRyanDev,
guidovizoso and
tylerslaton
as code owners
August 28, 2026 17:14
The acceptance test spawns agent-bot and could not be run in a bare worktree (workspace dep resolution), so it went to CI unverified and failed there. Pulling it from this PR; #219's test half stays open for a change that can be verified before it ships. The four behavioural fixes remain.
9 tasks
davidmckayv
pushed a commit
that referenced
this pull request
Aug 31, 2026
…raph sees (#292) A reply with no text and no tool call ends the graph — the conditional edge sees no calls and stops. #289 tried to give that run a visible line by substituting a fallback AIMessage into the graph's state (withVisibleReply), so the CHANGELOG already promises "an empty reply ends on a visible line rather than in silence". It never reached the person. This service streams AG-UI by reading the run's framework events, and it emits text only from on_chat_model_stream (the model's own deltas) and tool events from the tools node. A message a graph node returns is never one of those, so a fallback placed in state is a fallback the surface never sees: an empty reply still ended on a bare RUN_STARTED/ RUN_FINISHED pair with nothing between them. Proof, driving the real reader over a real graph with a fake empty model: the graph's final state held the fallback, and the client received only ["RUN_FINISHED"]. The guard belongs on the wire, where the surface reads. streamRun now tracks whether anything a person can see reached it — a line of prose or a tool call — and ends a run that produced neither on the same fallback line. "Visible" is decided by textOfChunk, the one rule the streamed deltas already use, so a reply that is only a Responses-API reasoning summary (text the person is never shown) counts as empty here too — the case the state-based guard got wrong, since hasVisibleText read any `text` field as visible. The translation is extracted to stream.ts for the same reason history.ts and deltas.ts are: index.ts calls serve() at module scope, so importing runAgent to test it binds a port. stream.ts imports no runtime module beyond deltas, so its tests need no provider key and no network. Co-authored-by: kevin9327 <kevin9327@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes five issues left open after the 0.0.5 triage that were validated as still reproducing on
mainand in-spirit for the template. Bundled at request; each fix is independent and could be split.Closes #226, closes #287, closes #275, closes #199.
What each fix does
initdb -A trust -U openboton loopback, and the Bot's shell runs in the same container, so it couldpsql -h 127.0.0.1 -U openbotwith no password and reach the audit trail, policy store, and credential vault as the owner. Nowscram-sha-256with a password generated on first init, kept beside the data on the same volume, and handed toapi/migrateover the container environment. The shell's environment is an allow-list that does not carry the URL, and the password file is600/postgres, so the shell cannot learn it. External-DATABASE_URLdeployments are untouched (EMBEDDED_POSTGRES=offexits early).NothingToSee, which the take-the-wheel view does not mount, so the screen froze on its last frame. It is now rendered in the live-screen branch.--disable-blink-features=AutomationControlled+ignoreDefaultArgs: ["--enable-automation"], so a person who takes the wheel can sign in to a site that refuses obvious automation. This is the flag, not a JS patch ofnavigator.webdriver. See the deferral below.ENDwith nothing on screen. OpenAI is unchanged. (Part 3 was already fixed onmain.)Verification — honest about depth
Three of these can only be fully proven by a CI image build or a live provider; the agent processes (
agent-bot,agent-langgraph,agent-computer) also can't boot in a bare worktree due to workspace dep hoisting. So:lint0,typecheck0 (all packages),build0select 1returns1; without it, and as a non-postgresOS user (the Bot shell's case), the connection is refused.postgres-init.shparses (sh -n).with-contenv, persistence across restart) needs the assembled imageproblemin the mounted branchagent-computerrunningagent-langgraphunit tests need@langchain/core(CI has it)agent-bot, which needs@ag-ui(CI runs it)Deliberate deferrals (not silent gaps)
HeadlessChromein the user agent, which only running headed under a virtual display (Xvfb) removes — a heavier image change that can't be verified without a build and changes the browser's resource profile. This PR takes the low-risk signal reduction; the headed-Xvfb change is worth its own PR.