Skip to content

feat(daemon): backport live-VM daemon changes — provider capacity gate, artifact viewer, proxy accounts#104

Open
tbrownio wants to merge 2 commits into
mainfrom
daemon/vm-changes-sync
Open

feat(daemon): backport live-VM daemon changes — provider capacity gate, artifact viewer, proxy accounts#104
tbrownio wants to merge 2 commits into
mainfrom
daemon/vm-changes-sync

Conversation

@tbrownio

Copy link
Copy Markdown
Contributor

What

Syncs the daemon source currently running on the linear-agent VM (/opt/linear-agent-daemon, deploy of Jul 22 00:25 UTC) back into the canonical repo. These changes were developed and deployed directly on the host and never landed here.

Why now

On Jul 21 a routine deploy of repo main over /opt (rsync --delete) silently reverted these changes on the VM — immediately breaking implementer session resumes (TM-401 "Claude exited with code 1" at 18:48 UTC) until the newer build was redeployed (~20:37 UTC). Making the repo the source of truth again prevents a repeat.

Changes

  • Provider capacity gate: claude.ts collects capacity evidence from stream events (rate-limit rejections, 429/529 retries, out-of-credits); sessions.ts tracks provider readiness (provider_state_changed) and falls back to the Claudex runner, recording the downgrade. New ops wrappers: claudex, claudex-fable, codex-provider-gate.sh.
  • Artifact store + viewer: artifacts.ts (content-addressed bundle store), viewer.ts (self-contained HTML viewer), server.ts routes with management-token auth — backs the artifact viewer on the daemon host.
  • Ops: proxy-accounts.sh, provision.sh updates, trustedEnv passthrough into child sessions.
  • Reconcile: webhook re-enable now retries every minute instead of startup-only. Note: with client-credentials tokens lacking admin, this logs reconcile_webhook_failed once per minute per app — consider gating or downgrading that log line in a follow-up.
  • Runbook/README expanded to match.

Validation

  • pnpm typecheck, pnpm build — clean
  • pnpm test — 14 files, 204 passed / 1 skipped
  • bash -n ops/provision.sh — OK
  • Diff scanned for credentials/hostnames — only test fixtures ("Bearer management-secret" etc.)

🤖 Generated with Claude Code

Tyler Brown and others added 2 commits July 21, 2026 12:22
Co-Authored-By: Claude <noreply@anthropic.com>
…e, artifact viewer, proxy accounts

Sync the daemon source currently deployed on the linear-agent VM back
into the canonical repo. Deployed and iterated directly on the host, it
was clobbered by a repo-main deploy on Jul 21 (causing implementer turn
failures on TM-401 until redeployed); this makes the repo the source of
truth again.

- Capacity evidence + provider gate: claude.ts collects rate-limit /
  overload / out-of-credits evidence from stream events; sessions.ts
  tracks provider readiness and falls back to the Claudex runner,
  recording the downgrade (ops/claudex, ops/claudex-fable,
  ops/codex-provider-gate.sh).
- Artifact store + viewer: artifacts.ts, viewer.ts, and server.ts
  endpoints serving artifact bundles with management-token auth.
- ops/proxy-accounts.sh and provision.sh updates; trustedEnv
  passthrough into child sessions.
- Webhook reconcile now retries every minute (was startup-only).
- Runbook/README expanded to cover all of the above.

Validated: pnpm typecheck, build, test (204 passed), bash -n provision.sh.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant