adam/open-swe
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/open-swe.git synced 2026-09-30 08:03:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
open-swe/docs/upstream-sync/triage.md

119 lines
16 KiB
Markdown
Raw Normal View History

feat(infra): upstream-sync triage ledger, cherry-pick hooks, and git cp (#118) * docs(upstream-sync): add triage ledger + cherry-pick hook plan Seeds the upstream triage ledger (52 diverged commits from langchain-ai/open-swe categorized: landed/won't-merge/deferred/untriaged) and the design plan for a git-hook mechanism to keep it in sync during cherry-picks. * feat(upstream-sync): jsonl-backed triage ledger + generator CLI triage.jsonl is now the source of truth (52 rows migrated from triage.md); triage.md is generated with a do-not-edit banner. scripts/triage.py provides migrate/generate/reconcile/lookup/check-reject/set; make triage-render/check/reconcile added (triage-check is CI-safe staleness gate). Stdlib-only so git hooks can call it. * feat(upstream-sync): cherry-pick triage git hooks + git cp wrapper post-commit journals each -x pick to an untracked .git-local journal; prepare-commit-msg hard-blocks known-reject picks (commit-msg is a secondary backstop — clean picks skip it on git 2.50.1), overridable via git cp --force / SH_CHERRYPICK_ALLOW_REJECT=1 / sh.cherrypick.blockRejects=false. git-cp is the pre-apply guard + auto-reconcile. pre-push is a SHIM that re-execs the global Sea Haven security pre-push so core.hooksPath=.githooks does not shadow it; install-hooks.sh verifies that shim FIRST and refuses if it is missing. * docs(upstream-sync): correct hook plan + git cp runbook Record the verified git 2.50.1 finding that clean cherry-picks skip commit-msg, so the block lives in prepare-commit-msg; note the locked HARD-BLOCK-by-default reject policy. CHERRYPICK.md now leads with make install-hooks + git cp and explains the generated-md ledger. * chore(upstream-sync): mark #1651 landed (Bedrock family fix on gateway-routing) * docs(upstream-sync): rewrite CHERRYPICK.md as a repo-specific runbook * feat(upstream-sync): add triage.py sync + make triage-sync Discovers commits on dev..upstream/main not yet in the ledger and appends them as untriaged (PR # and subject parsed from each commit), then bumps _meta 'last synced' to the upstream tip and regenerates triage.md. Closes the discovery side of the workflow: triage-sync to pull in new work, git cp to land it. * docs(upstream-sync): move cherry-pick runbook to PR1 branch as cherry-pick-runbook.md
2026-07-03 11:46:00 -04:00
<!-- GENERATED — do not hand-edit. Edit docs/upstream-sync/triage.jsonl, then run `make triage-render`. Staleness is enforced in CI by `make triage-check`. -->
# Upstream triage ledger
Commits on `upstream/main` (langchain-ai/open-swe) not yet in `dev`, and the decision on each.
Rows key on the **upstream SHA** (stable across local cherry-picks). Deferred rows are provisional
— re-inspect before picking. See the fork-maintenance runbook in `CLAUDE.md`.
chore: sync upstream triage ledger (#183)
2026-07-14 08:53:49 -04:00
**Last synced `upstream/main`:** `bfa67a7a` (2026-07-14)
feat(infra): upstream-sync triage ledger, cherry-pick hooks, and git cp (#118) * docs(upstream-sync): add triage ledger + cherry-pick hook plan Seeds the upstream triage ledger (52 diverged commits from langchain-ai/open-swe categorized: landed/won't-merge/deferred/untriaged) and the design plan for a git-hook mechanism to keep it in sync during cherry-picks. * feat(upstream-sync): jsonl-backed triage ledger + generator CLI triage.jsonl is now the source of truth (52 rows migrated from triage.md); triage.md is generated with a do-not-edit banner. scripts/triage.py provides migrate/generate/reconcile/lookup/check-reject/set; make triage-render/check/reconcile added (triage-check is CI-safe staleness gate). Stdlib-only so git hooks can call it. * feat(upstream-sync): cherry-pick triage git hooks + git cp wrapper post-commit journals each -x pick to an untracked .git-local journal; prepare-commit-msg hard-blocks known-reject picks (commit-msg is a secondary backstop — clean picks skip it on git 2.50.1), overridable via git cp --force / SH_CHERRYPICK_ALLOW_REJECT=1 / sh.cherrypick.blockRejects=false. git-cp is the pre-apply guard + auto-reconcile. pre-push is a SHIM that re-execs the global Sea Haven security pre-push so core.hooksPath=.githooks does not shadow it; install-hooks.sh verifies that shim FIRST and refuses if it is missing. * docs(upstream-sync): correct hook plan + git cp runbook Record the verified git 2.50.1 finding that clean cherry-picks skip commit-msg, so the block lives in prepare-commit-msg; note the locked HARD-BLOCK-by-default reject policy. CHERRYPICK.md now leads with make install-hooks + git cp and explains the generated-md ledger. * chore(upstream-sync): mark #1651 landed (Bedrock family fix on gateway-routing) * docs(upstream-sync): rewrite CHERRYPICK.md as a repo-specific runbook * feat(upstream-sync): add triage.py sync + make triage-sync Discovers commits on dev..upstream/main not yet in the ledger and appends them as untriaged (PR # and subject parsed from each commit), then bumps _meta 'last synced' to the upstream tip and regenerates triage.md. Closes the discovery side of the workflow: triage-sync to pull in new work, git cp to land it. * docs(upstream-sync): move cherry-pick runbook to PR1 branch as cherry-pick-runbook.md
2026-07-03 11:46:00 -04:00
| sha | pr | subject | decision | why | branch |
|---|---|---|---|---|---|
| `0b76afdc` | #1653 | reviews block agenda, sticky headers, diff scroll | Landed | | cherry-pick-upstream |
| `7530653b` | #1655 | ResizeObserver settle for review scroll-to | Landed | | cherry-pick-upstream |
| `23bd4a63` | #1660 | top padding to sticky review block header | Landed | | cherry-pick-upstream |
| `9e5a1924` | #1656 | purge expired thread_wakeup crons | Landed | | cherry-pick-upstream |
| `63eb9a08` | #1661 | sidebar filter popover border tokens | Landed | | cherry-pick-upstream |
| `bc7ce591` | #1668 | preserve dashboard redirect after login | Landed | | cherry-pick-upstream |
| `f32e492a` | #1637 | return to thread after plan approval | Landed | | cherry-pick-upstream |
| `7ee3e057` | #1636 | make plan view mobile friendly | Landed | | cherry-pick-upstream |
| `6575c327` | #1654 | disable React StrictMode | Landed | kept fork's `PwaUpdateProvider` | cherry-pick-upstream |
chore(upstream-sync): reconcile ledger after deferred-features stack merged (#131) Mark the 13 upstream SHAs re-landed by the now-merged stack as landed: - #127 cherry-picks: #1612, #1624, #1625, #1647, #1657, #1698 - #128 ports (adapted): #1626, #1630, #1632, #1635 - #129 ports: #1684, #1685 - #130 re-implementation: #1610 (editable plan mode; was wont-merge) Also carries the pending sync refresh to upstream/main fd2541ce (2026-07-08). triage.md regenerated from triage.jsonl; generate --check passes.
2026-07-08 19:02:09 -04:00
| `00906401` | #1610 | editable plan mode | Landed | re-implemented in fork via #130 (editable plan mode) | |
chore: cherry-pick ui/AGENTS.md bun convention (#1639) (#132) * chore: require bun for ui agent work (#1639) Co-authored-by: Ramon Nogueira <270434257+ramon-langchain@users.noreply.github.com> Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com> (cherry picked from commit f5670f24e8a5c1728867c275d8416749c411dea9) * chore(upstream-sync): record triage for this cherry-pick pass - #1639 (ui/AGENTS.md) -> landed (picked in this PR) - #1689 sandbox-id sidebar -> deferred (clean apply, needs UI/e2e validation) - #1679 cmd-enter plan comments -> deferred (clean apply, fork-diverged PlanReview) - #1667 fireworks-ai a86 bump -> deferred (conflicts; dev at a85, manual bump needed) --------- Co-authored-by: Ramon Nogueira <ramon.nogueira@langchain.dev> Co-authored-by: Ramon Nogueira <270434257+ramon-langchain@users.noreply.github.com> Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
2026-07-08 19:20:26 -04:00
| `f5670f24` | #1639 | require bun for ui agent work | Landed | cherry-picked (-x) in this PR (#132) | PR1 |
feat: port durable dispatch hardening and startup latency improvements (#160) * feat: port plan-review & workflow-approval UX (#135) Port six upstream commits onto dev: - c03a6be7 (already ported): keep plan guidance high-level - 546042a4: add workflow approval UI with diff preview, approval URLs, web review links, and polling for approval status during active runs - 216cf181: remove workflow token elevation; approved pushes pass through directly without proxy token rewriting - 3dbc0282: preserve plan redirects after login by accepting relative same-origin redirect_to values and rejecting blocked paths - bb104d93: submit plan comments with cmd+enter - 90cb6caa: terse Slack replies, shared content via save_plan outside plan mode (PLAN_STATUS_SHARED), reject shared-content mutations Refs: #135 * feat: port durable dispatch hardening and startup latency improvements Port five upstream PRs onto dev: - #1621 / #1658: durable dispatch with loopback webhook defense, create_durable_run helper, _config_with_prepare_run_id, degradation to None for relative/loopback completion webhook URLs - #1696: run-level completion webhook deduplication (replace claim-then-post with post-then-flag per run_id), DeferredErrorModel for graph-factory resilience, ToolRetryMiddleware for task subagents, TimeoutWrapupMiddleware for all three graphs - #1697: lazy-load __init__.py for agent.middleware, agent.tools, agent.dashboard (PEP 562); defer heavy imports (exa_py in web_search, agent.webapp in request_pr_review, deepagents in sandbox.py); add ttl_cache.py with stale-while-revalidate for tool loaders Refs: #137 * fix: restore login page render and clear CI lint/format The plan-review port removed the authRedirectUrl import from login.tsx but left its call site, crashing the login page at runtime (blank page, no 'Sign in to open-swe'). Pass the relative path straight to loginUrl, matching the plan route and the backend relative-redirect handling. Also drop an unused os import in the guard test and reformat workflow_push_guard.py to satisfy ruff. * fix: restore RepairOrphaned middleware export and repoint model fake to deferred_model boundary * fix: restore RepairOrphanedToolCallsMiddleware, fix E2E model-fake patch, drop dead ttl_cache - Re-add RepairOrphanedToolCallsMiddleware to the lazy middleware __init__ (_MIDDLEWARE_MODULES, __all__, TYPE_CHECKING) so agent.reviewer can import it. - Reroute E2E model patching to deferred_model.make_model so make_model_or_defer (used by all three graph factories) returns the scripted fake instead of building a real model with fake credentials. - Drop unused agent/utils/ttl_cache.py — no agent module imports it. - Fix import ordering in agent/reviewer.py and agent/analyzer.py (ruff I001). - Format tests/test_dispatch.py. * fix: claim-then-post run-level failure dedup; stop permanent suppression --------- Co-authored-by: amoussa1229 <166072409+amoussa1229@users.noreply.github.com> Co-authored-by: Adam Moussa <adam@seahavenind.com>
2026-07-09 17:11:25 -04:00
| `209132d3` | #1621 | durable interrupt dispatch + completion webhook | Landed | investigate first — may be applied | durable-dispatch |
| `02bb4dfd` | #1658 | don't attach loopback run-complete webhooks | Landed | | durable-dispatch |
| `29015fad` | #1614 | gate workflow pushes with approval | Landed | | durable-dispatch |
feat: port plan-review & workflow-approval UX (#159) * feat: port plan-review & workflow-approval UX (#135) Port six upstream commits onto dev: - c03a6be7 (already ported): keep plan guidance high-level - 546042a4: add workflow approval UI with diff preview, approval URLs, web review links, and polling for approval status during active runs - 216cf181: remove workflow token elevation; approved pushes pass through directly without proxy token rewriting - 3dbc0282: preserve plan redirects after login by accepting relative same-origin redirect_to values and rejecting blocked paths - bb104d93: submit plan comments with cmd+enter - 90cb6caa: terse Slack replies, shared content via save_plan outside plan mode (PLAN_STATUS_SHARED), reject shared-content mutations Refs: #135 * fix: restore login page render and clear CI lint/format The plan-review port removed the authRedirectUrl import from login.tsx but left its call site, crashing the login page at runtime (blank page, no 'Sign in to open-swe'). Pass the relative path straight to loginUrl, matching the plan route and the backend relative-redirect handling. Also drop an unused os import in the guard test and reformat workflow_push_guard.py to satisfy ruff. * fix: carry workflows:write on the standing proxy token Complete the half-ported upstream 216cf181 cascade. The port dropped _run_with_workflow_token from the guard but missed the paired github_app change, so an approved .github/workflows push ran with the base token (no workflows:write) and GitHub 403'd it. Add workflows:write to BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS and delete the now-orphaned WORKFLOW_RUNTIME_PROXY_TOKEN_PERMISSIONS constant; update the github_app and proxy_auth tests to match. The HITL approval gate in workflow_push_guard.py is unchanged — this only lets the standing token push once a human approves. * fix: restore transient workflow-token elevation (revert standing workflows:write) The standing GitHub-App proxy token (BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS) is ALWAYS-ON, so carrying workflows:write on it made the fork's HITL workflow-push guard the sole control over unapproved workflow pushes. The guard's git-push parser has gaps (obfuscated-expansion push, `gh api` REST contents PUT, fully-qualified cross-branch refspecs); with a permanently workflows-scoped token those gaps become live unapproved-workflow-push exploits (1 critical, 2 high — security review BLOCK on #159). Restore dev's transient-elevation model: - Drop workflows:write from BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS; re-add the WORKFLOW_RUNTIME_PROXY_TOKEN_PERMISSIONS constant (base + workflows:write). - Re-introduce _run_with_workflow_token in the guard: it mints the workflows-scoped token via refresh_proxy_token around the approved, guard-normalized fixed_command, then downscopes to RUNTIME then BASE in a finally. Route the approval branch through it. - Restore the dev token/elevation tests. The standing token no longer carries workflows:write, so the three parser bypasses hit GitHub 403 again; an approved push still succeeds because the elevation grants workflows:write only around the normalized command. Keeps all of #159's diff-preview / approval-URL / Slack-card guard additions. * fix: reject protocol-relative path from sanitizeAuthRedirect (open redirect) sanitizeAuthRedirect returned parsed.pathname+search+hash, which `new URL` can resolve to a protocol-relative `//host` (e.g. input `/..//evil.com` normalizes same-origin, passing the origin check, but yields a path starting with `//`). ClientRedirect / login.tsx feed that path to window.location.replace, so it navigates cross-origin — an open redirect. Reject any resolved path that is not a single-leading-slash path (`^/[^/]`), falling back to the default. Adds coverage for `/..//evil.com`, `/.//evil.com`, and `//evil.com`. * fix: log SECURITY error when workflow-token downscope fails The elevate->push->downscope finally block was silent on failure. If both refresh_proxy_token calls fail, the sandbox retains workflows:write for the rest of the run with no signal. Log a SECURITY error on the partial and full downscope-failure paths so the retention is observable. Addresses the GPT-4.1 cross-family review of the token-scope remediation. --------- Co-authored-by: amoussa1229 <166072409+amoussa1229@users.noreply.github.com> Co-authored-by: Adam Moussa <adam@seahavenind.com>
2026-07-09 16:03:13 -04:00
| `546042a4` | #1652 | add workflow approval UI | Landed | | plan-approval |
chore(upstream-sync): reconcile ledger after deferred-features stack merged (#131) Mark the 13 upstream SHAs re-landed by the now-merged stack as landed: - #127 cherry-picks: #1612, #1624, #1625, #1647, #1657, #1698 - #128 ports (adapted): #1626, #1630, #1632, #1635 - #129 ports: #1684, #1685 - #130 re-implementation: #1610 (editable plan mode; was wont-merge) Also carries the pending sync refresh to upstream/main fd2541ce (2026-07-08). triage.md regenerated from triage.jsonl; generate --check passes.
2026-07-08 19:02:09 -04:00
| `ae04b72b` | #1635 | publish plans from sandbox files | Landed | ported (adapted) in #128 (save_plan reads sandbox file) | plan-approval |
feat: port plan-review & workflow-approval UX (#159) * feat: port plan-review & workflow-approval UX (#135) Port six upstream commits onto dev: - c03a6be7 (already ported): keep plan guidance high-level - 546042a4: add workflow approval UI with diff preview, approval URLs, web review links, and polling for approval status during active runs - 216cf181: remove workflow token elevation; approved pushes pass through directly without proxy token rewriting - 3dbc0282: preserve plan redirects after login by accepting relative same-origin redirect_to values and rejecting blocked paths - bb104d93: submit plan comments with cmd+enter - 90cb6caa: terse Slack replies, shared content via save_plan outside plan mode (PLAN_STATUS_SHARED), reject shared-content mutations Refs: #135 * fix: restore login page render and clear CI lint/format The plan-review port removed the authRedirectUrl import from login.tsx but left its call site, crashing the login page at runtime (blank page, no 'Sign in to open-swe'). Pass the relative path straight to loginUrl, matching the plan route and the backend relative-redirect handling. Also drop an unused os import in the guard test and reformat workflow_push_guard.py to satisfy ruff. * fix: carry workflows:write on the standing proxy token Complete the half-ported upstream 216cf181 cascade. The port dropped _run_with_workflow_token from the guard but missed the paired github_app change, so an approved .github/workflows push ran with the base token (no workflows:write) and GitHub 403'd it. Add workflows:write to BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS and delete the now-orphaned WORKFLOW_RUNTIME_PROXY_TOKEN_PERMISSIONS constant; update the github_app and proxy_auth tests to match. The HITL approval gate in workflow_push_guard.py is unchanged — this only lets the standing token push once a human approves. * fix: restore transient workflow-token elevation (revert standing workflows:write) The standing GitHub-App proxy token (BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS) is ALWAYS-ON, so carrying workflows:write on it made the fork's HITL workflow-push guard the sole control over unapproved workflow pushes. The guard's git-push parser has gaps (obfuscated-expansion push, `gh api` REST contents PUT, fully-qualified cross-branch refspecs); with a permanently workflows-scoped token those gaps become live unapproved-workflow-push exploits (1 critical, 2 high — security review BLOCK on #159). Restore dev's transient-elevation model: - Drop workflows:write from BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS; re-add the WORKFLOW_RUNTIME_PROXY_TOKEN_PERMISSIONS constant (base + workflows:write). - Re-introduce _run_with_workflow_token in the guard: it mints the workflows-scoped token via refresh_proxy_token around the approved, guard-normalized fixed_command, then downscopes to RUNTIME then BASE in a finally. Route the approval branch through it. - Restore the dev token/elevation tests. The standing token no longer carries workflows:write, so the three parser bypasses hit GitHub 403 again; an approved push still succeeds because the elevation grants workflows:write only around the normalized command. Keeps all of #159's diff-preview / approval-URL / Slack-card guard additions. * fix: reject protocol-relative path from sanitizeAuthRedirect (open redirect) sanitizeAuthRedirect returned parsed.pathname+search+hash, which `new URL` can resolve to a protocol-relative `//host` (e.g. input `/..//evil.com` normalizes same-origin, passing the origin check, but yields a path starting with `//`). ClientRedirect / login.tsx feed that path to window.location.replace, so it navigates cross-origin — an open redirect. Reject any resolved path that is not a single-leading-slash path (`^/[^/]`), falling back to the default. Adds coverage for `/..//evil.com`, `/.//evil.com`, and `//evil.com`. * fix: log SECURITY error when workflow-token downscope fails The elevate->push->downscope finally block was silent on failure. If both refresh_proxy_token calls fail, the sandbox retains workflows:write for the rest of the run with no signal. Log a SECURITY error on the partial and full downscope-failure paths so the retention is observable. Addresses the GPT-4.1 cross-family review of the token-scope remediation. --------- Co-authored-by: amoussa1229 <166072409+amoussa1229@users.noreply.github.com> Co-authored-by: Adam Moussa <adam@seahavenind.com>
2026-07-09 16:03:13 -04:00
| `c03a6be7` | #1634 | keep plan guidance high-level | Landed | | plan-approval |
chore(upstream-sync): reconcile ledger after deferred-features stack merged (#131) Mark the 13 upstream SHAs re-landed by the now-merged stack as landed: - #127 cherry-picks: #1612, #1624, #1625, #1647, #1657, #1698 - #128 ports (adapted): #1626, #1630, #1632, #1635 - #129 ports: #1684, #1685 - #130 re-implementation: #1610 (editable plan mode; was wont-merge) Also carries the pending sync refresh to upstream/main fd2541ce (2026-07-08). triage.md regenerated from triage.jsonl; generate --check passes.
2026-07-08 19:02:09 -04:00
| `96cceb74` | #1632 | notify Slack on plan approval | Landed | ported (adapted) in #128 | plan-approval |
chore(upstream-sync): mark #1618 and #1646 landed (already in dev) (#133) A sweep of the deferred backlog found two rows whose changes already shipped in dev via #81 (the upstream-sync merge) — an empty cherry-pick confirms no net change: - #1618 (omit plan link in PR description when no plan exists) — was 'likely regression' - #1646 (install missing deps before verification) No code change; ledger accuracy only.
2026-07-08 19:27:31 -04:00
| `2f56d754` | #1618 | omit plan link when no plan exists | Landed | already in dev via #81 (upstream-sync); ledger was stale (was: likely regression) | plan-approval |
chore(upstream-sync): reconcile triage ledger for landed Slack-tooling cherry-picks
2026-07-03 15:51:31 -04:00
| `ee224d3e` | #1650 | add Slack reaction tool | Landed | | slack-tooling |
| `747ce4bb` | #1638 | add Slack breakout thread tool | Landed | | slack-tooling |
| `27d90ef1` | #1633 | include Slack channel context in prompts | Landed | | slack-tooling |
chore(upstream-sync): reconcile ledger after deferred-features stack merged (#131) Mark the 13 upstream SHAs re-landed by the now-merged stack as landed: - #127 cherry-picks: #1612, #1624, #1625, #1647, #1657, #1698 - #128 ports (adapted): #1626, #1630, #1632, #1635 - #129 ports: #1684, #1685 - #130 re-implementation: #1610 (editable plan mode; was wont-merge) Also carries the pending sync refresh to upstream/main fd2541ce (2026-07-08). triage.md regenerated from triage.jsonl; generate --check passes.
2026-07-08 19:02:09 -04:00
| `92dbf6f9` | #1630 | update Slack trace reply on web handoff | Landed | ported in #128 (trace_message_ts on first-mention run mapping) | slack-tooling |
chore(upstream-sync): reconcile triage ledger for landed Slack-tooling cherry-picks
2026-07-03 15:51:31 -04:00
| `bb36448b` | #1627 | surface Slack thread errors | Landed | | slack-tooling |
feat: port LangSmith LLM Gateway routing from upstream (#1671, #1673, #1674, #1678) (#155) * feat: port LangSmith LLM Gateway routing from upstream (#1671, #1673, #1674, #1678) Ports four upstream commits that add opt-in LLM call routing through the LangSmith Gateway, preserving fork conventions (Bedrock/Fireworks model IDs, no-agent-attribution, bun toolchain). - #1671 (e9dc6e01): opt-in gateway routing — new gateway.py, team-settings toggle, admin UI section, wired into make_model for all graph entrypoints - #1673 (702ef908): dedicated LANGSMITH_GATEWAY_API_KEY precedence over platform LANGSMITH_API_KEY - #1674 (5f7c2f46): fix Fireworks gateway base URL to /fireworks (bare host, SDK appends /v1/chat/completions) + SanitizeFireworksMessagesMiddleware - #1678 (73b7d1c0): fix OpenAI Responses reasoning replay — SanitizeOpenAIResponsesMiddleware, store/include config for encrypted reasoning content, reasoning_effort coercion for Chat Completions fallback Refs #134 * fix: downgrade gateway not-routed log to debug, add Bedrock UI note, add sanitizer parity - Downgrade logger.warning to logger.debug in gateway_overrides for not-routed providers and missing API key (Bedrock is the default provider in this fork, so these are expected steady states) - Add Bedrock to the LLMGatewaySection route-toggle description so admins know it is not routed through the gateway - Add SanitizeOpenAIResponsesMiddleware to chat.py for parity with server.py and reviewer.py - Restore the Bedrock region comment in model.py that explains the AWS_REGION / AWS_DEFAULT_REGION precedence Refs #138 --------- Co-authored-by: amoussa1229 <166072409+amoussa1229@users.noreply.github.com>
2026-07-09 14:44:15 -04:00
| `73b7d1c0` | #1678 | fix OpenAI Responses reasoning replay | Landed | | gateway-routing |
| `5f7c2f46` | #1674 | fix Fireworks Gateway base URL | Landed | | gateway-routing |
| `702ef908` | #1673 | dedicated LangSmith gateway API key | Landed | | gateway-routing |
| `e9dc6e01` | #1671 | opt-in LangSmith LLM Gateway routing | Landed | | gateway-routing |
feat(infra): upstream-sync triage ledger, cherry-pick hooks, and git cp (#118) * docs(upstream-sync): add triage ledger + cherry-pick hook plan Seeds the upstream triage ledger (52 diverged commits from langchain-ai/open-swe categorized: landed/won't-merge/deferred/untriaged) and the design plan for a git-hook mechanism to keep it in sync during cherry-picks. * feat(upstream-sync): jsonl-backed triage ledger + generator CLI triage.jsonl is now the source of truth (52 rows migrated from triage.md); triage.md is generated with a do-not-edit banner. scripts/triage.py provides migrate/generate/reconcile/lookup/check-reject/set; make triage-render/check/reconcile added (triage-check is CI-safe staleness gate). Stdlib-only so git hooks can call it. * feat(upstream-sync): cherry-pick triage git hooks + git cp wrapper post-commit journals each -x pick to an untracked .git-local journal; prepare-commit-msg hard-blocks known-reject picks (commit-msg is a secondary backstop — clean picks skip it on git 2.50.1), overridable via git cp --force / SH_CHERRYPICK_ALLOW_REJECT=1 / sh.cherrypick.blockRejects=false. git-cp is the pre-apply guard + auto-reconcile. pre-push is a SHIM that re-execs the global Sea Haven security pre-push so core.hooksPath=.githooks does not shadow it; install-hooks.sh verifies that shim FIRST and refuses if it is missing. * docs(upstream-sync): correct hook plan + git cp runbook Record the verified git 2.50.1 finding that clean cherry-picks skip commit-msg, so the block lives in prepare-commit-msg; note the locked HARD-BLOCK-by-default reject policy. CHERRYPICK.md now leads with make install-hooks + git cp and explains the generated-md ledger. * chore(upstream-sync): mark #1651 landed (Bedrock family fix on gateway-routing) * docs(upstream-sync): rewrite CHERRYPICK.md as a repo-specific runbook * feat(upstream-sync): add triage.py sync + make triage-sync Discovers commits on dev..upstream/main not yet in the ledger and appends them as untriaged (PR # and subject parsed from each commit), then bumps _meta 'last synced' to the upstream tip and regenerates triage.md. Closes the discovery side of the workflow: triage-sync to pull in new work, git cp to land it. * docs(upstream-sync): move cherry-pick runbook to PR1 branch as cherry-pick-runbook.md
2026-07-03 11:46:00 -04:00
| `289f5e3a` | #1651 | add Sonnet 5 to model picker | Landed | already in dev; added Bedrock family fallback fix (c16fb915) | gateway-routing |
chore(upstream-sync): reconcile ledger after deferred-features stack merged (#131) Mark the 13 upstream SHAs re-landed by the now-merged stack as landed: - #127 cherry-picks: #1612, #1624, #1625, #1647, #1657, #1698 - #128 ports (adapted): #1626, #1630, #1632, #1635 - #129 ports: #1684, #1685 - #130 re-implementation: #1610 (editable plan mode; was wont-merge) Also carries the pending sync refresh to upstream/main fd2541ce (2026-07-08). triage.md regenerated from triage.jsonl; generate --check passes.
2026-07-08 19:02:09 -04:00
| `5da3d0c6` | #1624 | post reviewer resolution notes verbatim | Landed | cherry-picked (-x) in #127 | reviewer-misc |
| `69148f54` | #1612 | add PR trace resolution | Landed | cherry-picked (-x) in #127 | reviewer-misc |
| `6d125526` | #1625 | stop wrapping installs in sfw | Landed | already present in dev; empty pick confirmed in #127 | reviewer-misc |
| `320bb39a` | #1657 | opt-in tracemalloc for aiohttp sessions | Landed | cherry-picked (-x) in #127 | reviewer-misc |
| `4f913198` | #1647 | widen split review diffs | Landed | already present in dev; empty pick confirmed in #127 | reviewer-misc |
chore(upstream-sync): mark #1618 and #1646 landed (already in dev) (#133) A sweep of the deferred backlog found two rows whose changes already shipped in dev via #81 (the upstream-sync merge) — an empty cherry-pick confirms no net change: - #1618 (omit plan link in PR description when no plan exists) — was 'likely regression' - #1646 (install missing deps before verification) No code change; ledger accuracy only.
2026-07-08 19:27:31 -04:00
| `20f63e8c` | #1646 | install missing deps before verification | Landed | already in dev via #81 (upstream-sync); ledger was stale | prompt-tweaks |
chore(upstream-sync): reconcile ledger after deferred-features stack merged (#131) Mark the 13 upstream SHAs re-landed by the now-merged stack as landed: - #127 cherry-picks: #1612, #1624, #1625, #1647, #1657, #1698 - #128 ports (adapted): #1626, #1630, #1632, #1635 - #129 ports: #1684, #1685 - #130 re-implementation: #1610 (editable plan mode; was wont-merge) Also carries the pending sync refresh to upstream/main fd2541ce (2026-07-08). triage.md regenerated from triage.jsonl; generate --check passes.
2026-07-08 19:02:09 -04:00
| `2f237b53` | #1626 | fall back to vision model for image threads | Landed | ported (adapted to Bedrock/Fireworks vision) in #128 | gateway-routing |
chore(triage): mark upstream #1667 (fireworks-ai a86) landed as superseded (#167) dev already pins fireworks-ai>=1.2.0a88 (uv.lock resolves a88) via #158 (efeb6b12), which jumped a85 -> a88 and exceeds the a86 that upstream #1667 (fbc6de85) bumps to. Porting it would downgrade the constraint, so mark the row landed/superseded rather than picking it. Closes #141. Part of #134.
2026-07-10 13:00:12 -04:00
| `fbc6de85` | #1667 | chore(deps): bump fireworks-ai from 1.2.0a75 to 1.2.0a86 (#1667) | Landed | Superseded by #158 (fireworks-ai a85 -> a88, efeb6b12); dev already exceeds a86. No port needed. | deps |
feat: port model-fallback resilience from upstream (#1694, #1695) (#161) * feat: port plan-review & workflow-approval UX (#135) Port six upstream commits onto dev: - c03a6be7 (already ported): keep plan guidance high-level - 546042a4: add workflow approval UI with diff preview, approval URLs, web review links, and polling for approval status during active runs - 216cf181: remove workflow token elevation; approved pushes pass through directly without proxy token rewriting - 3dbc0282: preserve plan redirects after login by accepting relative same-origin redirect_to values and rejecting blocked paths - bb104d93: submit plan comments with cmd+enter - 90cb6caa: terse Slack replies, shared content via save_plan outside plan mode (PLAN_STATUS_SHARED), reject shared-content mutations Refs: #135 * feat: port durable dispatch hardening and startup latency improvements Port five upstream PRs onto dev: - #1621 / #1658: durable dispatch with loopback webhook defense, create_durable_run helper, _config_with_prepare_run_id, degradation to None for relative/loopback completion webhook URLs - #1696: run-level completion webhook deduplication (replace claim-then-post with post-then-flag per run_id), DeferredErrorModel for graph-factory resilience, ToolRetryMiddleware for task subagents, TimeoutWrapupMiddleware for all three graphs - #1697: lazy-load __init__.py for agent.middleware, agent.tools, agent.dashboard (PEP 562); defer heavy imports (exa_py in web_search, agent.webapp in request_pr_review, deepagents in sandbox.py); add ttl_cache.py with stale-while-revalidate for tool loaders Refs: #137 * fix: restore login page render and clear CI lint/format The plan-review port removed the authRedirectUrl import from login.tsx but left its call site, crashing the login page at runtime (blank page, no 'Sign in to open-swe'). Pass the relative path straight to loginUrl, matching the plan route and the backend relative-redirect handling. Also drop an unused os import in the guard test and reformat workflow_push_guard.py to satisfy ruff. * feat: port model-fallback resilience from upstream (#1694, #1695) - Add httpx.TransportError to the transient-exception set so incomplete chunked reads on streamed responses trigger a fallback instead of cancelling the run (#1694 / c9f6dd86). - Rewrite fallback to alternate primary/fallback with exponential backoff instead of a single failover, so the agent survives multi-minute gateway outages spanning both providers (#1695 / c9a9a7cd). - Default backoff schedule (0, 5, 15, 30, 45) reaches past the gateway's ~30s recovery window; jittered ±25%. - On exhaustion, surface a terminal AIMessage explaining the outage instead of crashing — progress is checkpointed so the user can retrigger to continue. - Preserve fork conventions: Bedrock ClientError retryability check, sync wrap_model_call (using time.sleep instead of asyncio.sleep), and existing access-error surfacing for Anthropic, OpenAI, and Bedrock (botocore) provider errors. - Update triage ledger (c9f6dd86, c9a9a7cd → landed) and re-render triage.md. Refs: #139 * fix: align workflow-push-guard tests with dev's transient-elevation impl The dev merge auto-combined dev's elevation tests with the stale passthrough tests inherited from the durable-dispatch branch; the passthrough tests contradict dev's restored _run_with_workflow_token impl. Take dev's test file. * fix: drop dead ttl_cache module; make fallback backoff jitter two-sided ttl_cache.py was re-introduced via the dev merge but dev/#160 deliberately removed it as dead code (no agent importer). Remove it to match dev. Also make _jittered_delay symmetric (±25%) to match its docstring. * chore(upstream-sync): triage 4 new upstream commits (#1708-#1713) Synced ledger to upstream/main (71e3b818). New rows all deferred: - #1708 add GPT-5.6 OpenAI models (FLAG-HUMAN: fork picker is Bedrock/Fireworks-only) - #1709 stale admin model defaults after upgrades - #1710 bump langchain-fireworks 1.4.4 - #1713 align reviewer eval with published findings --------- Co-authored-by: amoussa1229 <166072409+amoussa1229@users.noreply.github.com> Co-authored-by: Adam Moussa <adam@seahavenind.com>
2026-07-09 18:28:21 -04:00
| `c9f6dd86` | #1694 | fix: fall back on model stream transport errors (#1694) | Landed | adds httpx.TransportError to transient set; small conflict w/ dev's diverged Bedrock fallback | model-fallback |
| `c9a9a7cd` | #1695 | fix: retry model fallback exhaustion (#1695) | Landed | alternating retry+backoff rewrite; reconcile by hand w/ dev's Bedrock + sync wrap path | model-fallback |
feat: port durable dispatch hardening and startup latency improvements (#160) * feat: port plan-review & workflow-approval UX (#135) Port six upstream commits onto dev: - c03a6be7 (already ported): keep plan guidance high-level - 546042a4: add workflow approval UI with diff preview, approval URLs, web review links, and polling for approval status during active runs - 216cf181: remove workflow token elevation; approved pushes pass through directly without proxy token rewriting - 3dbc0282: preserve plan redirects after login by accepting relative same-origin redirect_to values and rejecting blocked paths - bb104d93: submit plan comments with cmd+enter - 90cb6caa: terse Slack replies, shared content via save_plan outside plan mode (PLAN_STATUS_SHARED), reject shared-content mutations Refs: #135 * feat: port durable dispatch hardening and startup latency improvements Port five upstream PRs onto dev: - #1621 / #1658: durable dispatch with loopback webhook defense, create_durable_run helper, _config_with_prepare_run_id, degradation to None for relative/loopback completion webhook URLs - #1696: run-level completion webhook deduplication (replace claim-then-post with post-then-flag per run_id), DeferredErrorModel for graph-factory resilience, ToolRetryMiddleware for task subagents, TimeoutWrapupMiddleware for all three graphs - #1697: lazy-load __init__.py for agent.middleware, agent.tools, agent.dashboard (PEP 562); defer heavy imports (exa_py in web_search, agent.webapp in request_pr_review, deepagents in sandbox.py); add ttl_cache.py with stale-while-revalidate for tool loaders Refs: #137 * fix: restore login page render and clear CI lint/format The plan-review port removed the authRedirectUrl import from login.tsx but left its call site, crashing the login page at runtime (blank page, no 'Sign in to open-swe'). Pass the relative path straight to loginUrl, matching the plan route and the backend relative-redirect handling. Also drop an unused os import in the guard test and reformat workflow_push_guard.py to satisfy ruff. * fix: restore RepairOrphaned middleware export and repoint model fake to deferred_model boundary * fix: restore RepairOrphanedToolCallsMiddleware, fix E2E model-fake patch, drop dead ttl_cache - Re-add RepairOrphanedToolCallsMiddleware to the lazy middleware __init__ (_MIDDLEWARE_MODULES, __all__, TYPE_CHECKING) so agent.reviewer can import it. - Reroute E2E model patching to deferred_model.make_model so make_model_or_defer (used by all three graph factories) returns the scripted fake instead of building a real model with fake credentials. - Drop unused agent/utils/ttl_cache.py — no agent module imports it. - Fix import ordering in agent/reviewer.py and agent/analyzer.py (ruff I001). - Format tests/test_dispatch.py. * fix: claim-then-post run-level failure dedup; stop permanent suppression --------- Co-authored-by: amoussa1229 <166072409+amoussa1229@users.noreply.github.com> Co-authored-by: Adam Moussa <adam@seahavenind.com>
2026-07-09 17:11:25 -04:00
| `e5dbc788` | #1696 | fix: Harden durable agent runs (#1696) | Landed | large durable-run hardening; 3 new modules dev lacks; rewrites fork dispatch/completion | durable-dispatch |
chore(upstream-sync): reconcile ledger after deferred-features stack merged (#131) Mark the 13 upstream SHAs re-landed by the now-merged stack as landed: - #127 cherry-picks: #1612, #1624, #1625, #1647, #1657, #1698 - #128 ports (adapted): #1626, #1630, #1632, #1635 - #129 ports: #1684, #1685 - #130 re-implementation: #1610 (editable plan mode; was wont-merge) Also carries the pending sync refresh to upstream/main fd2541ce (2026-07-08). triage.md regenerated from triage.jsonl; generate --check passes.
2026-07-08 19:02:09 -04:00
| `52fe2916` | #1698 | feat: add PR review link route (#1698) | Landed | cherry-picked (-x) in #127 (PR review link route) | reviewer-misc |
feat: port durable dispatch hardening and startup latency improvements (#160) * feat: port plan-review & workflow-approval UX (#135) Port six upstream commits onto dev: - c03a6be7 (already ported): keep plan guidance high-level - 546042a4: add workflow approval UI with diff preview, approval URLs, web review links, and polling for approval status during active runs - 216cf181: remove workflow token elevation; approved pushes pass through directly without proxy token rewriting - 3dbc0282: preserve plan redirects after login by accepting relative same-origin redirect_to values and rejecting blocked paths - bb104d93: submit plan comments with cmd+enter - 90cb6caa: terse Slack replies, shared content via save_plan outside plan mode (PLAN_STATUS_SHARED), reject shared-content mutations Refs: #135 * feat: port durable dispatch hardening and startup latency improvements Port five upstream PRs onto dev: - #1621 / #1658: durable dispatch with loopback webhook defense, create_durable_run helper, _config_with_prepare_run_id, degradation to None for relative/loopback completion webhook URLs - #1696: run-level completion webhook deduplication (replace claim-then-post with post-then-flag per run_id), DeferredErrorModel for graph-factory resilience, ToolRetryMiddleware for task subagents, TimeoutWrapupMiddleware for all three graphs - #1697: lazy-load __init__.py for agent.middleware, agent.tools, agent.dashboard (PEP 562); defer heavy imports (exa_py in web_search, agent.webapp in request_pr_review, deepagents in sandbox.py); add ttl_cache.py with stale-while-revalidate for tool loaders Refs: #137 * fix: restore login page render and clear CI lint/format The plan-review port removed the authRedirectUrl import from login.tsx but left its call site, crashing the login page at runtime (blank page, no 'Sign in to open-swe'). Pass the relative path straight to loginUrl, matching the plan route and the backend relative-redirect handling. Also drop an unused os import in the guard test and reformat workflow_push_guard.py to satisfy ruff. * fix: restore RepairOrphaned middleware export and repoint model fake to deferred_model boundary * fix: restore RepairOrphanedToolCallsMiddleware, fix E2E model-fake patch, drop dead ttl_cache - Re-add RepairOrphanedToolCallsMiddleware to the lazy middleware __init__ (_MIDDLEWARE_MODULES, __all__, TYPE_CHECKING) so agent.reviewer can import it. - Reroute E2E model patching to deferred_model.make_model so make_model_or_defer (used by all three graph factories) returns the scripted fake instead of building a real model with fake credentials. - Drop unused agent/utils/ttl_cache.py — no agent module imports it. - Fix import ordering in agent/reviewer.py and agent/analyzer.py (ruff I001). - Format tests/test_dispatch.py. * fix: claim-then-post run-level failure dedup; stop permanent suppression --------- Co-authored-by: amoussa1229 <166072409+amoussa1229@users.noreply.github.com> Co-authored-by: Adam Moussa <adam@seahavenind.com>
2026-07-09 17:11:25 -04:00
| `5f7f5fbd` | #1697 | fix: Reduce graph import and loader startup latency (#1697) | Landed | import-hygiene refactor; cross-cutting, references many deferred upstream-only modules | durable-dispatch |
feat: port plan-review & workflow-approval UX (#159) * feat: port plan-review & workflow-approval UX (#135) Port six upstream commits onto dev: - c03a6be7 (already ported): keep plan guidance high-level - 546042a4: add workflow approval UI with diff preview, approval URLs, web review links, and polling for approval status during active runs - 216cf181: remove workflow token elevation; approved pushes pass through directly without proxy token rewriting - 3dbc0282: preserve plan redirects after login by accepting relative same-origin redirect_to values and rejecting blocked paths - bb104d93: submit plan comments with cmd+enter - 90cb6caa: terse Slack replies, shared content via save_plan outside plan mode (PLAN_STATUS_SHARED), reject shared-content mutations Refs: #135 * fix: restore login page render and clear CI lint/format The plan-review port removed the authRedirectUrl import from login.tsx but left its call site, crashing the login page at runtime (blank page, no 'Sign in to open-swe'). Pass the relative path straight to loginUrl, matching the plan route and the backend relative-redirect handling. Also drop an unused os import in the guard test and reformat workflow_push_guard.py to satisfy ruff. * fix: carry workflows:write on the standing proxy token Complete the half-ported upstream 216cf181 cascade. The port dropped _run_with_workflow_token from the guard but missed the paired github_app change, so an approved .github/workflows push ran with the base token (no workflows:write) and GitHub 403'd it. Add workflows:write to BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS and delete the now-orphaned WORKFLOW_RUNTIME_PROXY_TOKEN_PERMISSIONS constant; update the github_app and proxy_auth tests to match. The HITL approval gate in workflow_push_guard.py is unchanged — this only lets the standing token push once a human approves. * fix: restore transient workflow-token elevation (revert standing workflows:write) The standing GitHub-App proxy token (BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS) is ALWAYS-ON, so carrying workflows:write on it made the fork's HITL workflow-push guard the sole control over unapproved workflow pushes. The guard's git-push parser has gaps (obfuscated-expansion push, `gh api` REST contents PUT, fully-qualified cross-branch refspecs); with a permanently workflows-scoped token those gaps become live unapproved-workflow-push exploits (1 critical, 2 high — security review BLOCK on #159). Restore dev's transient-elevation model: - Drop workflows:write from BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS; re-add the WORKFLOW_RUNTIME_PROXY_TOKEN_PERMISSIONS constant (base + workflows:write). - Re-introduce _run_with_workflow_token in the guard: it mints the workflows-scoped token via refresh_proxy_token around the approved, guard-normalized fixed_command, then downscopes to RUNTIME then BASE in a finally. Route the approval branch through it. - Restore the dev token/elevation tests. The standing token no longer carries workflows:write, so the three parser bypasses hit GitHub 403 again; an approved push still succeeds because the elevation grants workflows:write only around the normalized command. Keeps all of #159's diff-preview / approval-URL / Slack-card guard additions. * fix: reject protocol-relative path from sanitizeAuthRedirect (open redirect) sanitizeAuthRedirect returned parsed.pathname+search+hash, which `new URL` can resolve to a protocol-relative `//host` (e.g. input `/..//evil.com` normalizes same-origin, passing the origin check, but yields a path starting with `//`). ClientRedirect / login.tsx feed that path to window.location.replace, so it navigates cross-origin — an open redirect. Reject any resolved path that is not a single-leading-slash path (`^/[^/]`), falling back to the default. Adds coverage for `/..//evil.com`, `/.//evil.com`, and `//evil.com`. * fix: log SECURITY error when workflow-token downscope fails The elevate->push->downscope finally block was silent on failure. If both refresh_proxy_token calls fail, the sandbox retains workflows:write for the rest of the run with no signal. Log a SECURITY error on the partial and full downscope-failure paths so the retention is observable. Addresses the GPT-4.1 cross-family review of the token-scope remediation. --------- Co-authored-by: amoussa1229 <166072409+amoussa1229@users.noreply.github.com> Co-authored-by: Adam Moussa <adam@seahavenind.com>
2026-07-09 16:03:13 -04:00
| `216cf181` | #1699 | fix: keep workflow HITL without token downscoping (#1699) | Landed | DIVERGES-FROM-UPSTREAM: fork deliberately does NOT adopt #1699's standing-token workflows:write broadening. Security review (#159) BLOCKed it — the standing ALWAYS-ON proxy token carrying workflows:write turns the HITL guard's git-push-parser gaps (obfuscated-expansion push, `gh api` REST contents PUT, cross-branch refspecs) into live unapproved-workflow-push exploits. Fork keeps BASE without workflows:write and restores the transient per-approval elevation (_run_with_workflow_token mints WORKFLOW_RUNTIME_PROXY_TOKEN_PERMISSIONS around the approved, guard-normalized fixed_command, then downscopes to RUNTIME then BASE): the token scope is the backstop the parser relies on, so a bypass hits GitHub 403. HITL diff-preview/approval-URL/Slack-card additions from #159 retained; token-model divergence only. | plan-approval |
feat: surface attributed PR creation failures (#180) * feat: surface attributed PR creation failures Port upstream #1659: adds PullRequestCreationGuardMiddleware that blocks shell fallbacks (gh pr create, gh api /pulls, curl) when open_pull_request fails, keeping failures visible. Also adds preflight branch/repo visibility checks in open_pull_request with structured failure payloads, and updates the prompt to forbid PR creation fallbacks. Refs: #134 * fix: fall back to core GitHub App scope when optional grants missing (#1701) * fix: fall back to core GitHub App scope when optional grants missing Proxy-token minting requested workflows:write and actions:read in the permission set used for every sandbox. GitHub 422s a token request that asks for a permission the installation hasn't granted, so any install without workflows:write failed to mint a token and every run died in before-agent setup with "GitHub App installation token is unavailable". _resolve_proxy_token now walks a permission ladder (full -> +workflows -> core) and returns the first scope that mints, recording the granted scope so hourly proxy refreshes stay consistent. A missing optional grant now degrades to the install-time core scope instead of failing the run; workflow-file HITL pushes still require workflows:write and fail at push time when it is absent. * refactor: flatten proxy-token ladder loop with continue --------- Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com> (cherry picked from commit f53caff1aa24a7b29d851b267aa3bdfe62c1e935) Sea Haven fork deviation: upstream #1701 folds workflows:write into the standing BASE/RUNTIME scope. This fork deliberately keeps workflows:write OUT of the standing permission ladder (RUNTIME = core + actions:read; LADDER = (RUNTIME, CORE)) so the sandbox proxy token cannot push .github/workflows/* during normal operation. workflows:write is minted only transiently by WorkflowPushGuardMiddleware for an approved HITL push and dropped on restore, preserving token scope as a backstop for the workflow- push approval control. Security-reviewed (agentic fan-out + GPT-4.1 cross review); the standing-scope-carries-workflows:write bypass was blocked. * fix(open-swe): harden proxy-token restore and mint error handling Two low-severity follow-ups from the security review of the #1701 port. Restore the recorded baseline scope after a workflow-push elevation instead of a hardcoded RUNTIME. An install granted workflows:write but not actions:read resolves its standing token to core; hardcoding RUNTIME on restore requested the ungranted actions:read, 422'd, and fired a false "SECURITY: failed to downscope" error on every approved workflow push before the core fallback recovered. The guard now captures the run's recorded scope before elevating (via the new get_recorded_proxy_permissions) and restores exactly that, falling back to the guaranteed core scope only when the baseline restore fails. Classify installation-token mint failures. get_github_app_installation_token_ with_expiry now treats HTTP 422 (a permission the installation hasn't granted) as the ladder's expected descend signal and keeps it at debug, while a non-422 failure (network/5xx/timeout) is surfaced at WARNING even when errors are otherwise suppressed — so a transient blip no longer silently downscopes a whole run under a debug-only trace. The reduced-scope warning no longer asserts a missing grant as the sole cause. * chore(triage): mark upstream #1701 landed on this branch Ported via PR #181 as Option A (workflows:write kept out of the standing proxy-token scope). Regenerated triage.md from triage.jsonl. * fix: restructure PR creation to POST-first with diagnose-on-failure Move preflight checks from an authoritative gate (before POST) to a diagnostic run after POST failure. This avoids false-positive failures when a just-pushed head branch is momentarily invisible to GitHub ref endpoints, and eliminates 2-3 extra serial API round-trips on the happy path. Also drop unused _PR_CREATED_FALSE indirection and add a docstring to pr_creation_guard acknowledging the fail-open detection design. --------- Co-authored-by: amoussa1229 <166072409+amoussa1229@users.noreply.github.com> Co-authored-by: Ramon Nogueira <ramon.nogueira@langchain.dev> Co-authored-by: Adam Moussa <adam@seahavenind.com>
2026-07-13 14:45:19 -04:00
| `67abf5b0` | #1659 | fix: surface attributed PR creation failures (#1659) | Landed | PR-attribution-failure guard (new mw, safe imports); heavy conflict on diverged open_pull_request.py | pr-attribution |
feat: port plan-review & workflow-approval UX (#159) * feat: port plan-review & workflow-approval UX (#135) Port six upstream commits onto dev: - c03a6be7 (already ported): keep plan guidance high-level - 546042a4: add workflow approval UI with diff preview, approval URLs, web review links, and polling for approval status during active runs - 216cf181: remove workflow token elevation; approved pushes pass through directly without proxy token rewriting - 3dbc0282: preserve plan redirects after login by accepting relative same-origin redirect_to values and rejecting blocked paths - bb104d93: submit plan comments with cmd+enter - 90cb6caa: terse Slack replies, shared content via save_plan outside plan mode (PLAN_STATUS_SHARED), reject shared-content mutations Refs: #135 * fix: restore login page render and clear CI lint/format The plan-review port removed the authRedirectUrl import from login.tsx but left its call site, crashing the login page at runtime (blank page, no 'Sign in to open-swe'). Pass the relative path straight to loginUrl, matching the plan route and the backend relative-redirect handling. Also drop an unused os import in the guard test and reformat workflow_push_guard.py to satisfy ruff. * fix: carry workflows:write on the standing proxy token Complete the half-ported upstream 216cf181 cascade. The port dropped _run_with_workflow_token from the guard but missed the paired github_app change, so an approved .github/workflows push ran with the base token (no workflows:write) and GitHub 403'd it. Add workflows:write to BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS and delete the now-orphaned WORKFLOW_RUNTIME_PROXY_TOKEN_PERMISSIONS constant; update the github_app and proxy_auth tests to match. The HITL approval gate in workflow_push_guard.py is unchanged — this only lets the standing token push once a human approves. * fix: restore transient workflow-token elevation (revert standing workflows:write) The standing GitHub-App proxy token (BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS) is ALWAYS-ON, so carrying workflows:write on it made the fork's HITL workflow-push guard the sole control over unapproved workflow pushes. The guard's git-push parser has gaps (obfuscated-expansion push, `gh api` REST contents PUT, fully-qualified cross-branch refspecs); with a permanently workflows-scoped token those gaps become live unapproved-workflow-push exploits (1 critical, 2 high — security review BLOCK on #159). Restore dev's transient-elevation model: - Drop workflows:write from BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS; re-add the WORKFLOW_RUNTIME_PROXY_TOKEN_PERMISSIONS constant (base + workflows:write). - Re-introduce _run_with_workflow_token in the guard: it mints the workflows-scoped token via refresh_proxy_token around the approved, guard-normalized fixed_command, then downscopes to RUNTIME then BASE in a finally. Route the approval branch through it. - Restore the dev token/elevation tests. The standing token no longer carries workflows:write, so the three parser bypasses hit GitHub 403 again; an approved push still succeeds because the elevation grants workflows:write only around the normalized command. Keeps all of #159's diff-preview / approval-URL / Slack-card guard additions. * fix: reject protocol-relative path from sanitizeAuthRedirect (open redirect) sanitizeAuthRedirect returned parsed.pathname+search+hash, which `new URL` can resolve to a protocol-relative `//host` (e.g. input `/..//evil.com` normalizes same-origin, passing the origin check, but yields a path starting with `//`). ClientRedirect / login.tsx feed that path to window.location.replace, so it navigates cross-origin — an open redirect. Reject any resolved path that is not a single-leading-slash path (`^/[^/]`), falling back to the default. Adds coverage for `/..//evil.com`, `/.//evil.com`, and `//evil.com`. * fix: log SECURITY error when workflow-token downscope fails The elevate->push->downscope finally block was silent on failure. If both refresh_proxy_token calls fail, the sandbox retains workflows:write for the rest of the run with no signal. Log a SECURITY error on the partial and full downscope-failure paths so the retention is observable. Addresses the GPT-4.1 cross-family review of the token-scope remediation. --------- Co-authored-by: amoussa1229 <166072409+amoussa1229@users.noreply.github.com> Co-authored-by: Adam Moussa <adam@seahavenind.com>
2026-07-09 16:03:13 -04:00
| `3dbc0282` | #1676 | fix: preserve plan redirects after login (#1676) | Landed | FLAG-HUMAN: follow-on to landed #1668 refining sanitize_redirect_to (open-redirect auth surface); not a dup | plan-approval |
feat(open-swe): re-add Fable 5 behind an admin toggle (Bedrock) (#172) * feat(models): re-add Fable 5 with admin disable toggle (port of upstream #1677) * refactor(models): convert re-added Fable 5 to Bedrock model IDs * fix(open-swe): correct Fable copy to describe provider data sharing, not ZDR The ported admin toggle description and code comments described Fable 5 as incompatible with Zero Data Retention. That is backwards: Fable 5 requires the account to opt into Bedrock provider_data_share — prompts/completions are retained and shared with Anthropic (up to 30 days, incl. human review). The old UI copy would lead an admin to believe the opposite of what enabling the toggle does. Reword the toggle description and the gate_fable_model / team_settings comments accordingly. Still off by default. Refs #171.
2026-07-10 14:05:20 -04:00
| `c75cbb1f` | #1677 | feat: re-add Fable 5 with an admin toggle to disable it (#1677) | Landed | Ported + Bedrock-converted onto dev via feat/readd-fable5-bedrock; anthropic: Fable ID mapped to bedrock_converse:us.anthropic.claude-fable-5. | fable-admin-toggle |
feat: port plan-review & workflow-approval UX (#159) * feat: port plan-review & workflow-approval UX (#135) Port six upstream commits onto dev: - c03a6be7 (already ported): keep plan guidance high-level - 546042a4: add workflow approval UI with diff preview, approval URLs, web review links, and polling for approval status during active runs - 216cf181: remove workflow token elevation; approved pushes pass through directly without proxy token rewriting - 3dbc0282: preserve plan redirects after login by accepting relative same-origin redirect_to values and rejecting blocked paths - bb104d93: submit plan comments with cmd+enter - 90cb6caa: terse Slack replies, shared content via save_plan outside plan mode (PLAN_STATUS_SHARED), reject shared-content mutations Refs: #135 * fix: restore login page render and clear CI lint/format The plan-review port removed the authRedirectUrl import from login.tsx but left its call site, crashing the login page at runtime (blank page, no 'Sign in to open-swe'). Pass the relative path straight to loginUrl, matching the plan route and the backend relative-redirect handling. Also drop an unused os import in the guard test and reformat workflow_push_guard.py to satisfy ruff. * fix: carry workflows:write on the standing proxy token Complete the half-ported upstream 216cf181 cascade. The port dropped _run_with_workflow_token from the guard but missed the paired github_app change, so an approved .github/workflows push ran with the base token (no workflows:write) and GitHub 403'd it. Add workflows:write to BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS and delete the now-orphaned WORKFLOW_RUNTIME_PROXY_TOKEN_PERMISSIONS constant; update the github_app and proxy_auth tests to match. The HITL approval gate in workflow_push_guard.py is unchanged — this only lets the standing token push once a human approves. * fix: restore transient workflow-token elevation (revert standing workflows:write) The standing GitHub-App proxy token (BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS) is ALWAYS-ON, so carrying workflows:write on it made the fork's HITL workflow-push guard the sole control over unapproved workflow pushes. The guard's git-push parser has gaps (obfuscated-expansion push, `gh api` REST contents PUT, fully-qualified cross-branch refspecs); with a permanently workflows-scoped token those gaps become live unapproved-workflow-push exploits (1 critical, 2 high — security review BLOCK on #159). Restore dev's transient-elevation model: - Drop workflows:write from BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS; re-add the WORKFLOW_RUNTIME_PROXY_TOKEN_PERMISSIONS constant (base + workflows:write). - Re-introduce _run_with_workflow_token in the guard: it mints the workflows-scoped token via refresh_proxy_token around the approved, guard-normalized fixed_command, then downscopes to RUNTIME then BASE in a finally. Route the approval branch through it. - Restore the dev token/elevation tests. The standing token no longer carries workflows:write, so the three parser bypasses hit GitHub 403 again; an approved push still succeeds because the elevation grants workflows:write only around the normalized command. Keeps all of #159's diff-preview / approval-URL / Slack-card guard additions. * fix: reject protocol-relative path from sanitizeAuthRedirect (open redirect) sanitizeAuthRedirect returned parsed.pathname+search+hash, which `new URL` can resolve to a protocol-relative `//host` (e.g. input `/..//evil.com` normalizes same-origin, passing the origin check, but yields a path starting with `//`). ClientRedirect / login.tsx feed that path to window.location.replace, so it navigates cross-origin — an open redirect. Reject any resolved path that is not a single-leading-slash path (`^/[^/]`), falling back to the default. Adds coverage for `/..//evil.com`, `/.//evil.com`, and `//evil.com`. * fix: log SECURITY error when workflow-token downscope fails The elevate->push->downscope finally block was silent on failure. If both refresh_proxy_token calls fail, the sandbox retains workflows:write for the rest of the run with no signal. Log a SECURITY error on the partial and full downscope-failure paths so the retention is observable. Addresses the GPT-4.1 cross-family review of the token-scope remediation. --------- Co-authored-by: amoussa1229 <166072409+amoussa1229@users.noreply.github.com> Co-authored-by: Adam Moussa <adam@seahavenind.com>
2026-07-09 16:03:13 -04:00
| `bb104d93` | #1679 | fix: submit plan comments with cmd enter (#1679) | Landed | applies clean but edits fork-diverged PlanReview.tsx (#130); needs UI/e2e validation — separate PR | plan-approval |
chore: port question-answering prompt clarification (#1680) (#178) Port upstream 304032fa: clarify that information-only answers should check out relevant repos first for context, answer fully inline, and only post a concise summary to Slack threads. The fork already carried the shared-base Slack guidance; this adds the missing TASK_EXECUTION_SECTION update and its test coverage. Refs: #146 Co-authored-by: amoussa1229 <166072409+amoussa1229@users.noreply.github.com>
2026-07-13 13:16:26 -04:00
| `304032fa` | #1680 | chore: clarify question answering prompt (#1680) | Landed | reword Slack info-only answer guidance; conflicts w/ fork's customized Slack prompt | prompt-tweaks |
feat(open-swe): open Linear-triggered PRs as the triggering user (#179) * feat: open Linear-triggered PRs as the triggering user Add 'linear' to the set of sources that carry a mapped GitHub login (Slack, Linear, dashboard, schedule), so Linear-triggered runs resolve the per-user OAuth token when the author_prs_as_user profile flag is enabled. Previously only Slack and dashboard runs could open PRs as the user; Linear runs always used the bot token. The Linear webhook now resolves the GitHub login from the Linear email via the same user-mapping store Slack uses, and passes it through the run configurable and thread owner metadata. Refs: 5003c953 (upstream #1683) * fix(open-swe): restrict Linear token attribution to comment author only Split actor_email (comment_author only, feeds github_login for token attribution) from user_email (full fallback chain, for display/model). This ensures a PR is never opened as a non-actor (creator/assignee). Add test_resolve_github_token_linear_defaults_to_bot to lock the security-critical default: Linear + mapped login + no opt-in → bot. --------- Co-authored-by: amoussa1229 <166072409+amoussa1229@users.noreply.github.com> Co-authored-by: Adam Moussa <adam@seahavenind.com>
2026-07-13 15:17:00 -04:00
| `5003c953` | #1683 | feat: open Linear-triggered PRs as the triggering user (#1683) | Landed | FLAG-HUMAN: adds linear to resolve_github_token per-user OAuth branch (auth surface); depends on #1626 linear.py | feature/port-linear-pr-author |
feat(dashboard): surface thread sandbox ID in sidebar (#169) * feat(dashboard): surface thread sandbox ID in sidebar Port of upstream #1689 (feb7ac98): expose the thread's sandbox_id on the dashboard thread summary and surface it in the sidebar via a "Copy sandbox ID" action. - thread_api: add sandboxId to the thread summary, hiding the "__creating__" in-flight sentinel. - queries/types: thread the sandboxId field through AgentThread and the optimistic thread. - AgentsSidebar: replace the hover-only resolve/delete buttons and the right-click context menu with one touch-friendly kebab (⋮) menu that works on both pointer and touch, and add the Copy sandbox ID item. - vite: disable the PWA service worker in dev (it precaches assets and defeats HMR). - tests: unit test for the summary field + e2e spec in the real-backend harness. Closes #140. Part of #134. * chore(triage): mark feb7ac98 (#1689) landed Ported to dev via feat/thread-sandbox-id-sidebar (#140).
2026-07-10 13:17:03 -04:00
| `feb7ac98` | #1689 | feat(web): surface thread sandbox ID with touch-friendly menu (#1689) | Landed | Ported to dev via feat/thread-sandbox-id-sidebar. | dashboard-ui |
chore(upstream-sync): reconcile ledger after deferred-features stack merged (#131) Mark the 13 upstream SHAs re-landed by the now-merged stack as landed: - #127 cherry-picks: #1612, #1624, #1625, #1647, #1657, #1698 - #128 ports (adapted): #1626, #1630, #1632, #1635 - #129 ports: #1684, #1685 - #130 re-implementation: #1610 (editable plan mode; was wont-merge) Also carries the pending sync refresh to upstream/main fd2541ce (2026-07-08). triage.md regenerated from triage.jsonl; generate --check passes.
2026-07-08 19:02:09 -04:00
| `7f7af715` | #1684 | feat: auto-load scoped AGENTS on reads (#1684) | Landed | ported in #129 (SubdirAgentsReadMiddleware) | subdir-agents |
| `88b62322` | #1685 | feat: add platform issue reporting tool (#1685) | Landed | ported in #129 (report_platform_issue tool) | small-tools |
feat: port plan-review & workflow-approval UX (#159) * feat: port plan-review & workflow-approval UX (#135) Port six upstream commits onto dev: - c03a6be7 (already ported): keep plan guidance high-level - 546042a4: add workflow approval UI with diff preview, approval URLs, web review links, and polling for approval status during active runs - 216cf181: remove workflow token elevation; approved pushes pass through directly without proxy token rewriting - 3dbc0282: preserve plan redirects after login by accepting relative same-origin redirect_to values and rejecting blocked paths - bb104d93: submit plan comments with cmd+enter - 90cb6caa: terse Slack replies, shared content via save_plan outside plan mode (PLAN_STATUS_SHARED), reject shared-content mutations Refs: #135 * fix: restore login page render and clear CI lint/format The plan-review port removed the authRedirectUrl import from login.tsx but left its call site, crashing the login page at runtime (blank page, no 'Sign in to open-swe'). Pass the relative path straight to loginUrl, matching the plan route and the backend relative-redirect handling. Also drop an unused os import in the guard test and reformat workflow_push_guard.py to satisfy ruff. * fix: carry workflows:write on the standing proxy token Complete the half-ported upstream 216cf181 cascade. The port dropped _run_with_workflow_token from the guard but missed the paired github_app change, so an approved .github/workflows push ran with the base token (no workflows:write) and GitHub 403'd it. Add workflows:write to BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS and delete the now-orphaned WORKFLOW_RUNTIME_PROXY_TOKEN_PERMISSIONS constant; update the github_app and proxy_auth tests to match. The HITL approval gate in workflow_push_guard.py is unchanged — this only lets the standing token push once a human approves. * fix: restore transient workflow-token elevation (revert standing workflows:write) The standing GitHub-App proxy token (BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS) is ALWAYS-ON, so carrying workflows:write on it made the fork's HITL workflow-push guard the sole control over unapproved workflow pushes. The guard's git-push parser has gaps (obfuscated-expansion push, `gh api` REST contents PUT, fully-qualified cross-branch refspecs); with a permanently workflows-scoped token those gaps become live unapproved-workflow-push exploits (1 critical, 2 high — security review BLOCK on #159). Restore dev's transient-elevation model: - Drop workflows:write from BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS; re-add the WORKFLOW_RUNTIME_PROXY_TOKEN_PERMISSIONS constant (base + workflows:write). - Re-introduce _run_with_workflow_token in the guard: it mints the workflows-scoped token via refresh_proxy_token around the approved, guard-normalized fixed_command, then downscopes to RUNTIME then BASE in a finally. Route the approval branch through it. - Restore the dev token/elevation tests. The standing token no longer carries workflows:write, so the three parser bypasses hit GitHub 403 again; an approved push still succeeds because the elevation grants workflows:write only around the normalized command. Keeps all of #159's diff-preview / approval-URL / Slack-card guard additions. * fix: reject protocol-relative path from sanitizeAuthRedirect (open redirect) sanitizeAuthRedirect returned parsed.pathname+search+hash, which `new URL` can resolve to a protocol-relative `//host` (e.g. input `/..//evil.com` normalizes same-origin, passing the origin check, but yields a path starting with `//`). ClientRedirect / login.tsx feed that path to window.location.replace, so it navigates cross-origin — an open redirect. Reject any resolved path that is not a single-leading-slash path (`^/[^/]`), falling back to the default. Adds coverage for `/..//evil.com`, `/.//evil.com`, and `//evil.com`. * fix: log SECURITY error when workflow-token downscope fails The elevate->push->downscope finally block was silent on failure. If both refresh_proxy_token calls fail, the sandbox retains workflows:write for the rest of the run with no signal. Log a SECURITY error on the partial and full downscope-failure paths so the retention is observable. Addresses the GPT-4.1 cross-family review of the token-scope remediation. --------- Co-authored-by: amoussa1229 <166072409+amoussa1229@users.noreply.github.com> Co-authored-by: Adam Moussa <adam@seahavenind.com>
2026-07-09 16:03:13 -04:00
| `90cb6caa` | #1681 | feat: terse Slack replies, share long content via plan-review page (#1681) | Landed | terse Slack + long-content-via-plan-page; conflicts w/ fork prompt + diverged plan stack | plan-approval |
fix(open-swe): port core GitHub-App scope fallback (#1701), workflows:write kept out of standing scope (#181) * fix: fall back to core GitHub App scope when optional grants missing (#1701) * fix: fall back to core GitHub App scope when optional grants missing Proxy-token minting requested workflows:write and actions:read in the permission set used for every sandbox. GitHub 422s a token request that asks for a permission the installation hasn't granted, so any install without workflows:write failed to mint a token and every run died in before-agent setup with "GitHub App installation token is unavailable". _resolve_proxy_token now walks a permission ladder (full -> +workflows -> core) and returns the first scope that mints, recording the granted scope so hourly proxy refreshes stay consistent. A missing optional grant now degrades to the install-time core scope instead of failing the run; workflow-file HITL pushes still require workflows:write and fail at push time when it is absent. * refactor: flatten proxy-token ladder loop with continue --------- Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com> (cherry picked from commit f53caff1aa24a7b29d851b267aa3bdfe62c1e935) Sea Haven fork deviation: upstream #1701 folds workflows:write into the standing BASE/RUNTIME scope. This fork deliberately keeps workflows:write OUT of the standing permission ladder (RUNTIME = core + actions:read; LADDER = (RUNTIME, CORE)) so the sandbox proxy token cannot push .github/workflows/* during normal operation. workflows:write is minted only transiently by WorkflowPushGuardMiddleware for an approved HITL push and dropped on restore, preserving token scope as a backstop for the workflow- push approval control. Security-reviewed (agentic fan-out + GPT-4.1 cross review); the standing-scope-carries-workflows:write bypass was blocked. * fix(open-swe): harden proxy-token restore and mint error handling Two low-severity follow-ups from the security review of the #1701 port. Restore the recorded baseline scope after a workflow-push elevation instead of a hardcoded RUNTIME. An install granted workflows:write but not actions:read resolves its standing token to core; hardcoding RUNTIME on restore requested the ungranted actions:read, 422'd, and fired a false "SECURITY: failed to downscope" error on every approved workflow push before the core fallback recovered. The guard now captures the run's recorded scope before elevating (via the new get_recorded_proxy_permissions) and restores exactly that, falling back to the guaranteed core scope only when the baseline restore fails. Classify installation-token mint failures. get_github_app_installation_token_ with_expiry now treats HTTP 422 (a permission the installation hasn't granted) as the ladder's expected descend signal and keeps it at debug, while a non-422 failure (network/5xx/timeout) is surfaced at WARNING even when errors are otherwise suppressed — so a transient blip no longer silently downscopes a whole run under a debug-only trace. The reduced-scope warning no longer asserts a missing grant as the sole cause. * chore(triage): mark upstream #1701 landed on this branch Ported via PR #181 as Option A (workflows:write kept out of the standing proxy-token scope). Regenerated triage.md from triage.jsonl. --------- Co-authored-by: Ramon Nogueira <ramon.nogueira@langchain.dev>
2026-07-13 14:24:37 -04:00
| `f53caff1` | #1701 | fix: fall back to core GitHub App scope when optional grants missing (#1701) | Landed | Ported as Option A: workflows:write kept OUT of standing scope, minted only transiently by the workflow-push guard (security-reviewed); PR #181 | chore/port-github-app-scope-fallback |
feat(infra): upstream-sync triage ledger, cherry-pick hooks, and git cp (#118) * docs(upstream-sync): add triage ledger + cherry-pick hook plan Seeds the upstream triage ledger (52 diverged commits from langchain-ai/open-swe categorized: landed/won't-merge/deferred/untriaged) and the design plan for a git-hook mechanism to keep it in sync during cherry-picks. * feat(upstream-sync): jsonl-backed triage ledger + generator CLI triage.jsonl is now the source of truth (52 rows migrated from triage.md); triage.md is generated with a do-not-edit banner. scripts/triage.py provides migrate/generate/reconcile/lookup/check-reject/set; make triage-render/check/reconcile added (triage-check is CI-safe staleness gate). Stdlib-only so git hooks can call it. * feat(upstream-sync): cherry-pick triage git hooks + git cp wrapper post-commit journals each -x pick to an untracked .git-local journal; prepare-commit-msg hard-blocks known-reject picks (commit-msg is a secondary backstop — clean picks skip it on git 2.50.1), overridable via git cp --force / SH_CHERRYPICK_ALLOW_REJECT=1 / sh.cherrypick.blockRejects=false. git-cp is the pre-apply guard + auto-reconcile. pre-push is a SHIM that re-execs the global Sea Haven security pre-push so core.hooksPath=.githooks does not shadow it; install-hooks.sh verifies that shim FIRST and refuses if it is missing. * docs(upstream-sync): correct hook plan + git cp runbook Record the verified git 2.50.1 finding that clean cherry-picks skip commit-msg, so the block lives in prepare-commit-msg; note the locked HARD-BLOCK-by-default reject policy. CHERRYPICK.md now leads with make install-hooks + git cp and explains the generated-md ledger. * chore(upstream-sync): mark #1651 landed (Bedrock family fix on gateway-routing) * docs(upstream-sync): rewrite CHERRYPICK.md as a repo-specific runbook * feat(upstream-sync): add triage.py sync + make triage-sync Discovers commits on dev..upstream/main not yet in the ledger and appends them as untriaged (PR # and subject parsed from each commit), then bumps _meta 'last synced' to the upstream tip and regenerates triage.md. Closes the discovery side of the workflow: triage-sync to pull in new work, git cp to land it. * docs(upstream-sync): move cherry-pick runbook to PR1 branch as cherry-pick-runbook.md
2026-07-03 11:46:00 -04:00
| `c3292d82` | #1611 | bake sfw binary into sandbox image | Won't merge | already in dev | |
| `48bf712b` | #1609 | show message timestamps | Won't merge | already in dev | |
| `85c0f63e` | #1620 | clickable shared PR header | Won't merge | already in dev | |
| `db2ae58e` | #1643 | pre-bundle shiki/@pierre deps | Won't merge | already in dev | |
| `1d9da064` | #1662 | bump astral-sh/setup-uv | Won't merge | dev ahead (v8.2.0, `checkout@v7`) | |
| `83cb40a0` | #1616 | update langsmith sdk to 0.9.3 | Won't merge | regression — dev has 0.9.6 | |
| `e5a29eca` | #1613 | plan links in PR descriptions | Won't merge | regression — dev has async plan-ref | |
| `e1d85526` | #1645 | switch ui to pnpm | Won't merge | tooling — fork keeps bun | |
chore(upstream-sync): reconcile ledger after deferred-features stack merged (#131) Mark the 13 upstream SHAs re-landed by the now-merged stack as landed: - #127 cherry-picks: #1612, #1624, #1625, #1647, #1657, #1698 - #128 ports (adapted): #1626, #1630, #1632, #1635 - #129 ports: #1684, #1685 - #130 re-implementation: #1610 (editable plan mode; was wont-merge) Also carries the pending sync refresh to upstream/main fd2541ce (2026-07-08). triage.md regenerated from triage.jsonl; generate --check passes.
2026-07-08 19:02:09 -04:00
| `5dc360d8` | #1619 | bump langgraph-checkpoint 4.1.0→4.1.1 | Won't merge | already in dev — uv.lock already resolves langgraph-checkpoint 4.1.1 | |
| `89f886e2` | #1642 | request actions read for sandbox logs | Won't merge | already in dev — actions:read in RUNTIME_PROXY_TOKEN_PERMISSIONS + identical prompt line | |
| `ab4eea4b` | #1663 | chore(deps): bump the major group across 1 directory with 3 updates (#1663) | Won't merge | already in dev — CI already on checkout@v7/setup-node@v6/upload-artifact@v7 | |
| `2bf207fb` | #1664 | chore(deps): bump python in the minor-and-patch group (#1664) | Won't merge | already in dev — Dockerfile already at python 3.14.6-slim-trixie | |
| `13b40113` | #1666 | chore(deps): bump cryptography from 48.0.1 to 49.0.0 in the major group (#1666) | Won't merge | already in dev — same 48->49 cryptography bump dev did via #105 | |
| `290d0fee` | #1669 | chore(deps): update langgraph-cli[inmem] requirement (#1669) | Won't merge | already in dev — langgraph-cli[inmem] at 0.4.30 | |
| `73a9e8b5` | #1693 | chore(deps): bump the minor-and-patch group across 1 directory with 19 updates (#1693) | Won't merge | dev at-or-ahead on 17/19; group fights dev's pinned langsmith==0.9.7 (#115) and carries an upstream plan-route test | |
| `9cd7e464` | #1700 | Fix workflow approval visibility (#1700) | Won't merge | superseded — dev's list_workflow_approvals_for_thread already enforces owner-only 403 | |
| `fd2541ce` | #1705 | fix: drop orphaned function_call items with stale OpenAI reasoning (#1705) | Won't merge | N/A — edits sanitize_openai_responses.py which dev deleted in the Bedrock/Fireworks migration (#62) | |
feat(infra): upstream-sync triage ledger, cherry-pick hooks, and git cp (#118) * docs(upstream-sync): add triage ledger + cherry-pick hook plan Seeds the upstream triage ledger (52 diverged commits from langchain-ai/open-swe categorized: landed/won't-merge/deferred/untriaged) and the design plan for a git-hook mechanism to keep it in sync during cherry-picks. * feat(upstream-sync): jsonl-backed triage ledger + generator CLI triage.jsonl is now the source of truth (52 rows migrated from triage.md); triage.md is generated with a do-not-edit banner. scripts/triage.py provides migrate/generate/reconcile/lookup/check-reject/set; make triage-render/check/reconcile added (triage-check is CI-safe staleness gate). Stdlib-only so git hooks can call it. * feat(upstream-sync): cherry-pick triage git hooks + git cp wrapper post-commit journals each -x pick to an untracked .git-local journal; prepare-commit-msg hard-blocks known-reject picks (commit-msg is a secondary backstop — clean picks skip it on git 2.50.1), overridable via git cp --force / SH_CHERRYPICK_ALLOW_REJECT=1 / sh.cherrypick.blockRejects=false. git-cp is the pre-apply guard + auto-reconcile. pre-push is a SHIM that re-execs the global Sea Haven security pre-push so core.hooksPath=.githooks does not shadow it; install-hooks.sh verifies that shim FIRST and refuses if it is missing. * docs(upstream-sync): correct hook plan + git cp runbook Record the verified git 2.50.1 finding that clean cherry-picks skip commit-msg, so the block lives in prepare-commit-msg; note the locked HARD-BLOCK-by-default reject policy. CHERRYPICK.md now leads with make install-hooks + git cp and explains the generated-md ledger. * chore(upstream-sync): mark #1651 landed (Bedrock family fix on gateway-routing) * docs(upstream-sync): rewrite CHERRYPICK.md as a repo-specific runbook * feat(upstream-sync): add triage.py sync + make triage-sync Discovers commits on dev..upstream/main not yet in the ledger and appends them as untriaged (PR # and subject parsed from each commit), then bumps _meta 'last synced' to the upstream tip and regenerates triage.md. Closes the discovery side of the workflow: triage-sync to pull in new work, git cp to land it. * docs(upstream-sync): move cherry-pick runbook to PR1 branch as cherry-pick-runbook.md
2026-07-03 11:46:00 -04:00
| `4cd5fa5c` | #1629 | avoid recapping Slack replies | Deferred | | slack-tooling |
| `baf0c248` | #1617 | filter & grouping menu in threads sidebar | Deferred | ~998 LOC | own branch |
| `f29868ff` | #1615 | recover thread work as patch | Deferred | ~495 LOC | own branch |
| `8e0788dc` | #1631 | show queued dashboard follow-ups | Deferred | | own branch |
| `9c601ca1` | #1648 | add Stagehand-powered browser subagent | Deferred | | own branch |
| `8c944381` | #1622 | restore forced tool call | Deferred | | own branch |
chore(upstream-sync): reconcile ledger after deferred-features stack merged (#131) Mark the 13 upstream SHAs re-landed by the now-merged stack as landed: - #127 cherry-picks: #1612, #1624, #1625, #1647, #1657, #1698 - #128 ports (adapted): #1626, #1630, #1632, #1635 - #129 ports: #1684, #1685 - #130 re-implementation: #1610 (editable plan mode; was wont-merge) Also carries the pending sync refresh to upstream/main fd2541ce (2026-07-08). triage.md regenerated from triage.jsonl; generate --check passes.
2026-07-08 19:02:09 -04:00
| `27f987dc` | #1686 | refactor: remove dead sync-interface compatibility code (#1686) | Deferred | chain head: dead-code removal (get_sandbox_backend_sync); pointless alone | sandbox-refactor |
| `2503a2f4` | #1687 | refactor(open-swe): provision LangSmith sandboxes natively async (#1687) | Deferred | FLAG-HUMAN: load-bearing async pivot of create_sandbox + _configure_github_proxy (GitHub-App auth surface) | sandbox-refactor |
| `2529b109` | #1690 | fix: checkpoint per-run graph setup (#1690) | Deferred | per-run graph-setup checkpoint; built on async server.py; entangled | sandbox-refactor |
| `c0a7e93e` | #1691 | fix: reconnect sandbox backend on resumed runs (#1691) | Deferred | reconnect proxy (has_backend/reconnect); assumes async create_sandbox | sandbox-refactor |
| `4f8bc2dd` | #1692 | refactor: simplify open-swe agent sandbox lifecycle (#1692) | Deferred | FLAG-HUMAN: structural rewrite of ensure_sandbox_for_thread (drops __creating__ 4-case sentinel) | sandbox-refactor |
| `48217b68` | #1489 | feat(open-swe): add E2B sandbox provider (#1489) | Deferred | additive E2B provider; separable but ships on the async sandbox.py base | sandbox-refactor |
| `22e024cb` | #1704 | fix: link issue PRs and prompt repo conventions (#1704) | Deferred | issue/PR linking + repo-convention prompt; clean but prompt-conflict risk vs #113 | webhook-issue-linking |
feat: port model-fallback resilience from upstream (#1694, #1695) (#161) * feat: port plan-review & workflow-approval UX (#135) Port six upstream commits onto dev: - c03a6be7 (already ported): keep plan guidance high-level - 546042a4: add workflow approval UI with diff preview, approval URLs, web review links, and polling for approval status during active runs - 216cf181: remove workflow token elevation; approved pushes pass through directly without proxy token rewriting - 3dbc0282: preserve plan redirects after login by accepting relative same-origin redirect_to values and rejecting blocked paths - bb104d93: submit plan comments with cmd+enter - 90cb6caa: terse Slack replies, shared content via save_plan outside plan mode (PLAN_STATUS_SHARED), reject shared-content mutations Refs: #135 * feat: port durable dispatch hardening and startup latency improvements Port five upstream PRs onto dev: - #1621 / #1658: durable dispatch with loopback webhook defense, create_durable_run helper, _config_with_prepare_run_id, degradation to None for relative/loopback completion webhook URLs - #1696: run-level completion webhook deduplication (replace claim-then-post with post-then-flag per run_id), DeferredErrorModel for graph-factory resilience, ToolRetryMiddleware for task subagents, TimeoutWrapupMiddleware for all three graphs - #1697: lazy-load __init__.py for agent.middleware, agent.tools, agent.dashboard (PEP 562); defer heavy imports (exa_py in web_search, agent.webapp in request_pr_review, deepagents in sandbox.py); add ttl_cache.py with stale-while-revalidate for tool loaders Refs: #137 * fix: restore login page render and clear CI lint/format The plan-review port removed the authRedirectUrl import from login.tsx but left its call site, crashing the login page at runtime (blank page, no 'Sign in to open-swe'). Pass the relative path straight to loginUrl, matching the plan route and the backend relative-redirect handling. Also drop an unused os import in the guard test and reformat workflow_push_guard.py to satisfy ruff. * feat: port model-fallback resilience from upstream (#1694, #1695) - Add httpx.TransportError to the transient-exception set so incomplete chunked reads on streamed responses trigger a fallback instead of cancelling the run (#1694 / c9f6dd86). - Rewrite fallback to alternate primary/fallback with exponential backoff instead of a single failover, so the agent survives multi-minute gateway outages spanning both providers (#1695 / c9a9a7cd). - Default backoff schedule (0, 5, 15, 30, 45) reaches past the gateway's ~30s recovery window; jittered ±25%. - On exhaustion, surface a terminal AIMessage explaining the outage instead of crashing — progress is checkpointed so the user can retrigger to continue. - Preserve fork conventions: Bedrock ClientError retryability check, sync wrap_model_call (using time.sleep instead of asyncio.sleep), and existing access-error surfacing for Anthropic, OpenAI, and Bedrock (botocore) provider errors. - Update triage ledger (c9f6dd86, c9a9a7cd → landed) and re-render triage.md. Refs: #139 * fix: align workflow-push-guard tests with dev's transient-elevation impl The dev merge auto-combined dev's elevation tests with the stale passthrough tests inherited from the durable-dispatch branch; the passthrough tests contradict dev's restored _run_with_workflow_token impl. Take dev's test file. * fix: drop dead ttl_cache module; make fallback backoff jitter two-sided ttl_cache.py was re-introduced via the dev merge but dev/#160 deliberately removed it as dead code (no agent importer). Remove it to match dev. Also make _jittered_delay symmetric (±25%) to match its docstring. * chore(upstream-sync): triage 4 new upstream commits (#1708-#1713) Synced ledger to upstream/main (71e3b818). New rows all deferred: - #1708 add GPT-5.6 OpenAI models (FLAG-HUMAN: fork picker is Bedrock/Fireworks-only) - #1709 stale admin model defaults after upgrades - #1710 bump langchain-fireworks 1.4.4 - #1713 align reviewer eval with published findings --------- Co-authored-by: amoussa1229 <166072409+amoussa1229@users.noreply.github.com> Co-authored-by: Adam Moussa <adam@seahavenind.com>
2026-07-09 18:28:21 -04:00
| `27b0ddeb` | #1708 | feat: add GPT-5.6 OpenAI models (#1708) | Deferred | FLAG-HUMAN: adds OpenAI GPT-5.6 to the model picker; fork's picker is Bedrock/Fireworks-only — needs a product decision before adopting OpenAI models. Gateway (#155) can route OpenAI if adopted. | model-picker |
| `62e0ca2d` | #1709 | fix: stale admin model defaults after model upgrades (#1709) | Deferred | stale admin model-default cleanup in team_settings after model upgrades; applies to fork's default-model resolution. | model-picker |
| `138ab9ec` | #1710 | fix: bump langchain-fireworks to 1.4.4 (#1710) | Deferred | langchain-fireworks 1.4.4 bump; fork uses Fireworks as a primary provider — adopt with a lockfile refresh. | deps |
| `71e3b818` | #1713 | fix: align reviewer eval with published findings (#1713) | Deferred | reviewer-eval/judge alignment; touches reviewer.py + add_finding/publish_review which are fork-diverged — reconcile against fork's reviewer before porting. | reviewer-eval |
chore: sync upstream triage ledger (#166) * chore: sync upstream triage ledger * chore: triage upstream PRs #1718, #1717, #1720 as deferred Assign dispositions to the three rows the sync added: - #1718 sanitize orphaned OpenAI tool results -> deferred (openai-sanitize): middleware already wired; adopt but middleware+pyproject conflict, refresh lock. - #1717 terse Slack tool messages -> deferred (slack-terse): impl auto-merges; resolve one test conflict. - #1720 separate review access from auto-reviews -> deferred (reviewer-access): clean textual pick but access-control change on fork-diverged auto-review surface; re-inspect semantics + human sign-off before picking. --------- Co-authored-by: amoussa1229 <166072409+amoussa1229@users.noreply.github.com> Co-authored-by: Adam Moussa <adam@seahavenind.com>
2026-07-10 12:31:32 -04:00
| `35659177` | #1718 | fix: sanitize orphaned OpenAI tool results (#1718) | Deferred | Correctness fix for orphaned OpenAI tool results before Responses API calls. Fork already wires SanitizeOpenAIResponsesMiddleware and uses OpenAI, so relevant - adopt, but the middleware file and pyproject conflict (fork copy diverged from an earlier pick); hand-resolve and refresh uv.lock. | openai-sanitize |
| `092abafa` | #1717 | fix: enforce terse Slack tool messages (#1717) | Deferred | Terse Slack tool-message UX fix. Impl (prompt.py + slack_thread_reply.py) auto-merges; only tests/test_github_comment_prompts.py conflicts against the fork prompt customizations - adopt and resolve that one test. | slack-terse |
| `92d63170` | #1720 | fix: separate review access from automatic reviews (#1720) | Deferred | Separates review access from automatic reviews; touches fork-diverged webapp.py + webhooks/github.py auto-review flow + review UI. Cherry-picks clean textually but is an access-control change on the fork-customized opened/ready_for_review auto-review surface - re-inspect semantics and get human sign-off before picking. | reviewer-access |
chore: sync upstream triage ledger (#175)
2026-07-11 10:35:55 -04:00
| `8356eb34` | #1726 | refactor: organize repository by domain (#1726) | Untriaged | | |
| `83abea26` | #1724 | fix: accept natural-language Slack plan approvals (#1724) | Untriaged | | |
| `129ddcf9` | #1728 | chore: include ripgrep in sandbox image (#1728) | Untriaged | | |
| `ddbe457b` | #1727 | fix: restore GPT-5.5 as default model (#1727) | Untriaged | | |
| `1ea03a43` | #1729 | feat: include Cargo in sandbox image (#1729) | Untriaged | | |
| `5136079d` | #1725 | chore: disable todos for GPT-5.6 Sol (#1725) | Untriaged | | |
| `09eaf94c` | #1730 | fix: let admins interrupt runaway agents (#1730) | Untriaged | | |
| `30832d29` | #1731 | fix: preserve OpenAI Responses tool history (#1731) | Untriaged | | |
chore: sync upstream triage ledger (#183)
2026-07-14 08:53:49 -04:00
| `1ea0e600` | #1736 | fix: bind cached GitHub tokens to users (#1736) | Untriaged | | |
| `3fcb27ce` | #1737 | fix: bound reviewer diff fetching (#1737) | Untriaged | | |
| `d714586c` | #1732 | fix: normalize dashboard label rendering (#1732) | Untriaged | | |
| `ef68c09b` | #1734 | fix: handle Slack DMs as mentions (#1734) | Untriaged | | |
| `bfa67a7a` | #1711 | chore(deps): bump soupsieve from 2.8.3 to 2.8.4 (#1711) | Untriaged | | |
feat(infra): upstream-sync triage ledger, cherry-pick hooks, and git cp (#118) * docs(upstream-sync): add triage ledger + cherry-pick hook plan Seeds the upstream triage ledger (52 diverged commits from langchain-ai/open-swe categorized: landed/won't-merge/deferred/untriaged) and the design plan for a git-hook mechanism to keep it in sync during cherry-picks. * feat(upstream-sync): jsonl-backed triage ledger + generator CLI triage.jsonl is now the source of truth (52 rows migrated from triage.md); triage.md is generated with a do-not-edit banner. scripts/triage.py provides migrate/generate/reconcile/lookup/check-reject/set; make triage-render/check/reconcile added (triage-check is CI-safe staleness gate). Stdlib-only so git hooks can call it. * feat(upstream-sync): cherry-pick triage git hooks + git cp wrapper post-commit journals each -x pick to an untracked .git-local journal; prepare-commit-msg hard-blocks known-reject picks (commit-msg is a secondary backstop — clean picks skip it on git 2.50.1), overridable via git cp --force / SH_CHERRYPICK_ALLOW_REJECT=1 / sh.cherrypick.blockRejects=false. git-cp is the pre-apply guard + auto-reconcile. pre-push is a SHIM that re-execs the global Sea Haven security pre-push so core.hooksPath=.githooks does not shadow it; install-hooks.sh verifies that shim FIRST and refuses if it is missing. * docs(upstream-sync): correct hook plan + git cp runbook Record the verified git 2.50.1 finding that clean cherry-picks skip commit-msg, so the block lives in prepare-commit-msg; note the locked HARD-BLOCK-by-default reject policy. CHERRYPICK.md now leads with make install-hooks + git cp and explains the generated-md ledger. * chore(upstream-sync): mark #1651 landed (Bedrock family fix on gateway-routing) * docs(upstream-sync): rewrite CHERRYPICK.md as a repo-specific runbook * feat(upstream-sync): add triage.py sync + make triage-sync Discovers commits on dev..upstream/main not yet in the ledger and appends them as untriaged (PR # and subject parsed from each commit), then bumps _meta 'last synced' to the upstream tip and regenerates triage.md. Closes the discovery side of the workflow: triage-sync to pull in new work, git cp to land it. * docs(upstream-sync): move cherry-pick runbook to PR1 branch as cherry-pick-runbook.md
2026-07-03 11:46:00 -04:00
_Maintenance: after a `git sync`, add new `dev..upstream/main` SHAs as **Untriaged** (edit `triage.jsonl`) and bump "Last synced". A successful `git cherry-pick -x` auto-moves the row to **Landed** via the `post-commit` journal + `make triage-reconcile`._
Reference in a new issue Copy permalink