Repository navigation
fix: preserve provider command routing for spawned sessions - #576
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reachedNext included review available in 16 minutes. View limit detailsLimit details: You’ve used all 8 included reviews currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (9)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: ⛔ Files ignored due to path filters (4)
📒 Files selected for processing (15)
Included review availability: Your plan provides up to 8 included reviews per hour; 1 remains after this review. WalkthroughSpawned sessions now inherit compatible provider commands from their creator routes. Sessions persist resolved routing snapshots and emit command fingerprints in startup logs and provider-failure transcript markers. ChangesProvider route inheritance
Priority: ➖ Normal Estimated code review effort: 3 (Moderate) | ~25 minutes Severity of issue fixed: Medium Merge Risk: ⚪ Minimal · up to Spawned commandless sessions now retain compatible creator-specific provider routing while explicit or different-provider routes remain authoritative. The change also preserves route snapshots across lifecycle events and emits command fingerprints without exposing raw commands; no current merge-blocking risk is identified. Sequence Diagram(s)sequenceDiagram
participant SpawnedSession
participant SessionManager
participant ProviderDriver
SpawnedSession->>SessionManager: request session start
SessionManager->>SessionManager: resolve compatible creator provider route
SessionManager->>ProviderDriver: start with resolved provider command
ProviderDriver-->>SessionManager: start result
SessionManager-->>SpawnedSession: session state and diagnostics
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
| Filename | Overview |
|---|---|
| internal/session/spawn_provider.go | Implements compatibility-scoped provider-command inheritance, creator-lineage resolution, routing snapshots, and diagnostic fingerprints. |
| internal/session/manager_start_runtime.go | Integrates spawned-route resolution and command fingerprinting into runtime preparation. |
| internal/session/manager_prompt_runtime.go | Updates the routing snapshot only after a replacement runtime has committed successfully. |
| internal/session/manager_lifecycle.go | Records provider-failure markers for failed starts while preserving replay fallback for expected ACP negotiation failures. |
| internal/session/manager_transcript_marker.go | Adds the bound route fingerprint to provider-failure transcript evidence. |
| internal/session/spawn_test.go | Covers route precedence, isolation boundaries, failed-start retention, fingerprint correlation, and command-value non-disclosure. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Resolve spawned child] --> B{Explicit child command?}
B -->|Yes| C[Use child command]
B -->|No| D{Different provider selected?}
D -->|Yes| E[Use selected provider command]
D -->|No| F{Native CLI, operator home, same workspace/profile, compatible route?}
F -->|No| G[Use child provider configuration]
F -->|Yes| H{Creator is live?}
H -->|Yes| I[Use creator's in-memory routing snapshot]
H -->|No| J[Resolve persisted creator lineage]
J --> K{Creator metadata available and compatible?}
K -->|Yes| L[Inherit resolved creator command]
K -->|No| M[Use child fallback and emit diagnostic]
Reviews (2): Last reviewed commit: "docs: explain provider routing lifecycle..." | Re-trigger Greptile
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
Addressed the docstring coverage warning in f2b7b16. The touched production functions now document their non-obvious routing, authentication-boundary, replacement, and replay invariants with single-line comments, following the repository's Go comment convention. No executable code or tests changed; a diff check verified that every added/removed line is a comment. The original lint-staged tasks and commitlint passed without stash, and the working tree is clean. Existing local race/integration/gate evidence remains applicable to the unchanged behavior; current-head gates run in CI as requested. Please re-evaluate the docstring warning on the latest head. |
|
@coderabbitai review |
|
This branch was successfully deployed
1 participant
What & why
Fixes #564.
A creator pinned to native provider command B could spawn a commandless reviewer on global command
A. The child runtime was resolved from its agent definition and provider defaults without using
the creator's resolved command. An explicit child command and a different named provider were
already legitimate overrides; forcing the parent command onto every child would break them.
This change makes governed spawn precedence explicit:
selection continues to discard the original agent's provider-specific command.
provider, workspace and profile, with operator-home policy and compatible auth, environment,
harness, runtime provider, transport, base URL and auth probe/login settings.
Live sessions retain an internal resolved routing snapshot, so editing an agent definition after
its process starts does not redirect its delegated work. Runtime replacement updates the snapshot
only after the replacement is committed. On resume, a live creator supplies its snapshot; a stopped
creator is resolved through the existing persisted lineage and current configuration. Deleted
creator metadata preserves the child's configured fallback and emits an explicit diagnostic.
Commands and credentials are not added to persisted session metadata, DTOs or logs.
Observability is separate from account authentication. The selected-route log and provider failure
markers carry a SHA-256
provider_command_fingerprint, allowing correlation without exposing rawcommands or account directories. The launch-time JSON selection log has one authoritative fingerprint field. A failed replacement
logs its attempted route while preserving the prior runtime binding.
Startup failures now emit the existing provider failure marker after their canonical error and
stop events. Unsupported or missing ACP session loads continue through the established replay
fallback without inserting a transient failure into the replay transcript. Prompt auth errors retain the established recoverable logical-session behavior:
activeand successful spawn do not promise that the provider will authenticate a later prompt.The fingerprint identifies command configuration; it does not identify a login account or profile.
How you verified it
Implementation and verification owner: Codex, GPT-6-Astra at High reasoning.
cases launched A instead of B; explicit child and different-provider cases passed.
policies, authorized foreign workspace routing, runtime replacement, recoverable prompt auth
diagnostics, failed-start retention and route fingerprint correlation. JSON logs are checked
for duplicate fingerprint keys and private command-value leakage.
GOMAXPROCS=4 CGO_ENABLED=1 mise exec -- go test -race -p=1 -parallel=4 -tags=integration ./internal/sessionwith the six focused routing/diagnostic andintegration tests named in the QA report,
-count=1: PASS in 16.902s.parent B / inherited child B / explicit child C, no unexpected A execution, live creator snapshot
after config edits, and child resume with live and stopped creators. Existing provider persistence
and full stop/resume/stop integration cases passed alongside it.
host contention. The unchanged case passed three isolated repetitions; no assertions or timeout
values were weakened.
emission was corrected without changing the existing replay assertions. The final targeted
-race -p=1 -parallel=4run ofTestResumeReplayFallback,TestSpawnProviderRouteDiagnosticsandTestPromptRuntimeReplacementLifecyclepassed in 8.166s.GOMAXPROCS=4 COMPOZY_GO_TEST_P=1 COMPOZY_GO_LINT_CONCURRENCY=2 mise exec -- make gate: PASS.Go lint/format: zero issues; full affected Session Manager race suite: PASS in 147.115s;
internal/session/inputqueueandskills: PASS.make gate-statusconfirmed CURRENT-PASS aftercommit for tree
730ae879b38c3d791797eee0eaea0e942de13acb, head7f8ad1cf49b89f386b85971a078b1f0927488f2a. Repo-pinned golangci-lint: 2.13.1.--no-stash --no-hide-partially-staged; the commit left the validated tree unchanged.docs/qa/reports/2026-09-09-issue-564-provider-routing.md; affected scenario:docs/qa/scenarios/RT-session-spawn-wake.md. Targeted teardown recordedclean: true, no survivors,and no killed unrelated processes.
The routing processes are controlled ACP fixtures, not two live OAuth accounts. This proves command
selection and actual subprocess execution, not live OAuth refresh or provider-service availability.
No operator login state was changed or copied. Web rendering and unrelated wake journeys were not
repeated. CodeRabbit, Greptile and current-head required CI are tracked after publication.
Impact
Cross-surface audit under
docs/_memory/change-impact.md:compozy__session_spawn,compozy spawnand agent spawn routesshare the corrected Session Manager resolution. No IDs, input/output schemas, flags, permission
gates, risk classifications or readiness promises are changed. Existing event consumers gain
the fingerprint in the extensible provider-marker evidence map.
shape. Explicit child overrides and different-provider selection remain authoritative. Spawn
hooks, permission narrowing, TTL, caps and role selection still run through their existing owners.
No credentials are copied or injected beyond the child's existing auth/home/environment policy.
foreign-workspace spawn still uses that workspace's routing. Provider ID, profile scope and
command/account identity remain distinct; no account registry is introduced.
skills/compozy/references/runtime-operations.mddocuments precedence,diagnostics and the acceptance/authentication boundary.
current schema. No Web component or cache key changes are needed. The site spawning guide and
owning QA scenario/report co-ship the behavior and resume/fallback limits.
config.toml, persisted layout or session metadata shapechanges; no migration, deletion or compatibility shim. Existing orphan-child fallback remains
available and becomes observable. Internal snapshot fields are not public DTO fields.
make gatepasses locally; this PR is delivered only after its required CI checks are greenSummary by CodeRabbit
New Features
Bug Fixes