3 Commits

Include renames

Author	SHA1	Message	Date
4 people	109b4d4d82	[4baffaa3] Batch A: extract route helpers (tasks/a2a/orchestrator/video/journals/role_dep/roadmap/prompter_live) (#738) ... * [4baffaa3] refactor(api): relocate route-layer helpers out of batch-A files into services/schemas/deps Move every non-@router-decorated top-level function out of roboco/api/routes/{tasks,a2a,orchestrator,video,v1/_role_dep,roadmap,prompter_live}.py (journals.py had none) into the module that owns its kind of concern: - DB/side-effecting logic -> the paired roboco/services module (task.py, a2a.py, video_engine.py, video_post_service.py, prompter.py) - DTO-conversion helpers -> roboco/api/schemas/{tasks,video,roadmap}.py, matching tasks.py's existing task_to_response pattern - small HTTP-layer auth guards -> roboco/api/deps.py, matching its existing require_ceo_role/require_pm_or_above pattern Redundant per-file _require_ceo(agent) wrappers (a2a/orchestrator/video/ roadmap) that just partial-applied an already-existing deps.py function were inlined to direct require_ceo_role(...) calls instead of duplicated across services. v1/_role_dep.py keeps its per-role frozenset variable bindings since those are assignments, not function definitions, and aren't flagged by the architectural-conventions classifier. Route paths, schemas, and observable behavior are unchanged. Updated 5 existing test files whose imports or monkeypatch targets pointed at the old private route-module names. * [4baffaa3] test(conventions): pin batch-A route files already free of helper findings * [4baffaa3] fix(api): restore fail-closed _auth_required() fallback (GHSA-4f7g-w95g-5q2c) The batch-A route-helper relocation accidentally narrowed _auth_required() to a truthy-only check, dropping the unset-value fallback to settings.environment == "production". An unconfigured production deploy would then always return False, silently accepting unauthenticated X-Agent-Role: ceo header spoofing. Restore the three-branch logic (explicit true/false honored, unset falls back to the production check) and the GHSA docstring paragraph explaining it. * [4baffaa3] fix(services): restore missing Board-Program/X-engine source-tag constants in task.py The batch-A route-helper relocation's task.py edits had dropped ~24 module-level source-tag constants (BARFLY_SOURCE, CORONER_SOURCE, DOGFOOD_SOURCE, LIBRARIAN_SOURCE, MEGAPHONE_SOURCE, MIRROR_SOURCE, PERISCOPE_SOURCE, PEST_CONTROL_SOURCE, SCALES_SOURCE, SENTINEL_SOURCE, SPACKLE_SOURCE, WAR_ROOM_SOURCE, their *_ITEM_SOURCE materialized-task counterparts, ENV_SYNC_SOURCE, EVAL_BENCH_SOURCE, and the later X-engine held-draft tags X_EDITORIAL_SOURCE/X_CAMPAIGN_SOURCE/X_BARFLY_SOURCE) that ~20 downstream service/engine modules and orchestrator.py's dispatch table import, breaking the whole FastAPI app's import chain (deps.py -> AgentOrchestrator -> orchestrator.py -> task.py) and failing collection on 7 test files. Restored every missing constant in the same style/location as the existing block, values cross-checked against board_programs.py's PROGRAMS registry and hardcoded-string test assertions. Folded the three new X-engine tags into X_SOURCES (x_post_service.py's task.source not in X_SOURCES membership check gates their approve/reject). Also closes a pre-existing PLR0917 (too-many-positional-args) gap in pyproject.toml's per-file-ignores for roboco/api/routes/*.py, roboco/api/deps.py, and roboco/services/prompter.py: these files already carry an established PLR0913 ignore with a documented FastAPI-DI-contract / MegaTask-contract rationale that applies equally to PLR0917, which ruff was flagging on the same pre-existing signatures (get_current_agent_id, get_current_agent_slug, _cloud_auth_agent_context, get_agent_context, list_tasks_summary, _rewrite_batch_children). * [4baffaa3] fix(api): restore verb-rejection logging and fix stale monkeypatch target in orchestrator auth tests Two regressions surfaced by re-running the full unit test suite after restoring task.py's import chain (previously masked because the whole app failed to import): 1. envelope_to_response() (relocated into roboco/api/deps.py from v1/_role_dep.py during the batch-A helper extraction) dropped the "verb rejected" structlog event an error envelope must leave — a rejected envelope rides a 200, so without this the access log can't distinguish a verb an agent couldn't satisfy from one that worked (four Board Programs died that way on 2026-07-25 with no recoverable reason, per tests/unit/api/routes/v1/ test_verb_rejection_logging.py's docstring). Restored the log call: verb name from the request path, error/detail/remediate from the envelope, agent_id/agent_role from the request headers. 2. tests/unit/api/test_orchestrator_auth.py's two cloud-auth session tests monkeypatched "roboco.api.routes.orchestrator. resolve_session_user", the pre-relocation location. The guard that actually calls resolve_session_user (require_orchestrator_ceo) now lives in roboco/api/deps.py, same as the other route auth test files' already-updated pattern (test_deps.py); repointed both patches there. Verified via a full tests/unit/api/ + tests/unit/conventions/ test_route_helper_placement_batch_a.py run: 605 passed, 18 skipped (Postgres-gated), 1 pre-existing failure unrelated to this diff (test_cloud_auth.py's oauth2-form test needs a live production DB connection, not available in this sandboxed workspace). * [4baffaa3] docs(api-routes-schemas): reflect batch-A route-helper relocation into services/schemas/deps --------- Co-authored-by: Backend Developer 1 <be-dev-1@roboco.tech> Co-authored-by: Backend Documenter <be-doc@roboco.tech>	2026-07-30 10:30:13 +00:00
3 people	9b4ce6b9c8	fix: wave 1 quick wins — agent names, scroll bounce-back, chart empty states, model-pin preservation, UUID spawn normalization (#546) ... * fix(panel): notifications show agent names, metrics charts get empty states * fix(panel): stop expand/collapse scroll bounce-back; add floating scroll-jump buttons * fix(llm): provider mode switches preserve per-agent model pins * fix(api): normalize agent UUID to slug at the orchestrator route boundary * fix(panel,docs): align routing-card copy and map docs with preserved-pin mode switches * fix(panel): drop dead unfiltered scroll hook, re-observe on Suspense swap, name system sender * docs(map): reflect preserved-pin mode switches, UUID-slug normalization, panel wave-1 deltas --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-07-18 00:42:13 +02:00
3 people	312ec990dd	fix: prod triage 2026-07-08 — MCP auth residue, gateway envelopes, verb-loop cap, A2A interjection, manual spawn UX (#334) ... * fix(auth): pass agent UUID to CLI-arg MCP servers (optimal/docs/search) The container token is HMAC-signed over the agent UUID (#314), but the optimal/docs/search MCP servers received the slug as their CLI arg and sent X-Agent-ID=<slug>, so every research/RAG/docs call 401ed with signature mismatch under enforced auth. Pass the already-computed agent_uuid in the three args lists instead. * fix(gateway): include remediate in gateway.rejected audit details Conventions-gate rejections carry the offending file:line listing only in the envelope's remediate field, which the audit row dropped -- ops logs showed just the violation count with no way to see what blocked. * fix(gateway): return envelope on do/commit git failure A GitError from the commit verb propagated to the generic middleware handler, so agents got a raw error blob with no remediate/next. Catch it and return an error envelope; 'no changes added to commit' with an explicit files list now names the mismatch and the omit-files fallback. * fix(agent-sdk): absolute rejection cap breaks slow-drip verb loops The verb circuit breaker only counted rejections inside a 60s sliding window, so an agent retrying i_am_done every 3-4 minutes looped for 30+ minutes without tripping it. Add a session-scoped cumulative per-(verb, task) cap at 3x the windowed limit that trips regardless of pacing. * feat(a2a): CEO chime-in interjects into the viewed conversation Previously reply_as_ceo re-homed the message into a canonical CEO<->target conversation with no panel surface, so a chime-in reported success but was invisible and only opportunistically delivered. interject_as_ceo now inserts the message into the conversation being viewed (from_agent=ceo, directed via an @target content prefix), bumps that conversation's counters with the unread ping keyed to the addressed participant, and both participants see it in transcript and read_a2a. * feat(panel): manual spawn carries task + message, surfaces refusals The agent detail page spawned with no request body (task/message impossible), the spawn button could double-fire (2.5ms double-POST seen live), and refusal reasons never reached the UI: readiness refusals were generic 500s and the already-running no-op looked like success. Detail page now uses SpawnAgentDialog, a synchronous ref guard blocks re-entry, AgentReadinessError maps to 409 with its reason shown, already_running is signalled and toasted, and a task_id builds a task-aware prompt instructing the claim (task_id alone never did), with the CEO's message appended as a note. * test(panel): align a2a page test with the interjection footer copy The chime-in rebuild changed the composer footer; the page-level test asserting the old copy was outside the rebuild's scoped vitest run. * fix(api): commit the request DB session before the response is sent FastAPI unwinds yield-dependencies after the response bytes go out, so get_db's post-yield commit raced the client's next request -- a verb could return ok while its claim/status write was still uncommitted (the e2e ok-without-effect flake family), and a failed commit was silently lost behind an already-sent 200. DbCommitMiddleware (innermost, pure ASGI) commits the session stashed by get_db_committed before forwarding http.response.start; commit failure now surfaces as a 5xx. get_db is untouched for its direct non-request callers. * fix(db): invalidate, not rollback, the session on request cancellation With the commit moved into the send path, the flow-verb timeout can cancel mid-commit; rolling back then issues another command over an asyncpg connection stranded mid-wire-protocol, and the poisoned connection segfaults uvloop/asyncpg when a later checkout recycles it (3/3 identical CI faulthandler dumps). On CancelledError discard the connection via session.invalidate() -- SQLAlchemy's documented handling for a timeout during commit -- and keep rollback for plain exceptions. --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>	2026-07-08 10:41:02 +02:00