feat: add control-plane host updates and release hardening - #44
Conversation
A live Windows triage exposed a 4-round-trip retry loop: the Agent could not know a valid powershell task payload upfront (open payload schema, payload_example omitted workspace_root and powershell_command), and each denial reported only one missing field at a time. - contracts: adapter profiles now declare workspace_root_required and complete payload examples (all adapters; powershell pins the bare powershell.exe allowlist + powershell_command Windows quirk) - hostrunner: DenialExplanation gains hint; workspace_required, missing_capability, command_not_allowlisted and workspace denials now tell the Agent exactly which field to add - regression tests for both; mcp/tools.json regenerated; QUALITY_MATRIX updated
Architecture-level update capability so enrolled Windows hosts can be
updated remotely and reliably without touching connection stability:
- gateway: GET /v1/sessions/{id}/artifacts/host-update serves the
configured connector under the endpoint lease (no new credential type),
digest header, no-store, audited
- host: rdev-host service update stages digest-keyed releases, switches
SCM binary path atomically (never overwriting the running image), waits
for the replacement to run and auto-rolls-back on boot failure; detached
updater survives the service stop; UPDATE_RESULT.json marker
- hostrunner: host-update adapter (lease-authed download, SHA-256 verify,
idempotent up-to-date short-circuit, workspace exemption, host.update
capability with hint)
- control plane: endpoint host_version/host_commit reported on join so
operators verify updates from session status
- docs: UPDATE_RUNBOOK with cutover/rollback/corner cases
RegistrationCapabilities omitted host.update, so gateway capability routing could never deliver a host-update task to a Windows endpoint even when the session ceiling granted it. Advertise it on Windows and pin the registration in the hostcmd tests.
The host-update adapter is exempt from the workspace_root preflight, but acquireWorkspaceLock still ran with an empty repo root on hosts with a configured lock store, denying every update with workspace_invalid. Skip the lock when there is no workspace to serialize.
…imeout The artifact download used http.DefaultClient, which negotiates HTTP/2 and honors environment proxies; against the production reverse proxy this repeatedly stalled mid-download, so the host never completed the update and replayed the offered task forever. Mirror the web-handoff bootstrap path (HTTP/1.1, no proxy) that is verified in production, with a 5-minute window for slow operator links.
…t recovery A one-off inline build produced an ELF binary named rdev-host.exe because GOOS did not apply; Windows could not start it, so service update rolled back forever and the connector service was left stopped on the canary host. scripts/build-release.sh now builds all three binaries deterministically and fails the build when rdev-host.exe is not a PE32+ image. UPDATE_RUNBOOK documents the observed pitfall and the one-command service recovery path.
Position the project as agent-native remote development: a controlled, policy-bound, auditable channel between AI agents and their Mac/Windows/Linux hosts. Drop the verbose role-based walkthrough; keep quick start, security model, and doc links. Chinese translation at README.zh-CN.md.
|
Warning Review limit reached
Next review available in: 44 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (25)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Closes #43
Control-plane driven managed host updates: artifact route, service update with health wait and rollback, host-update adapter, host.update capability advertisement, HTTP/1.1 long-timeout downloads, PE32+ release build gate, and a concise English-default README with zh-CN mirror.