sync(upstream): 1.0.5 → 1.0.8 + telemetry deadening - #12
Merged
Conversation
…1.0.8) Takes upstream d71f6e0c..07b2f714 for the protocol-types and ptyctl areas: feedback gains image attachments (count/size limits, inline format allow-list, camelCase wire structs), deployment config picks up its field tweaks, and the ptyctl client/registry move with them. The tier-1 default prompt is rebranded by hand - 'Grok Code' sits inside a string the rebrand tool leaves alone.
…1.0.6..1.0.8) chat-state gains the upstream compaction/mutation tweaks, tracing's http client picks up its two-line fix, and XaiProtoBuilder grows pbjson_exclude for extern_path'd types whose serde lives elsewhere. The proto dependency-scan hunk is deliberately NOT taken: upstream went back to --dependency_out=/dev/stdout with a /dev/null descriptor, which does not exist on Windows - our tempdir round-trip stays.
…he, task schema Port the xai-grok-tools delta with our identifiers preserved: - new mcp_elicitation module (schema parse/validate, wire types) and the matching elicitation surface staged for xai-grok-mcp; - util::shared_http process-cached clients; image_gen/image_edit/ video_gen/web_search adopt it, session ids move to per-request headers (with_session_id/post_json/request), and ImageGenConfig::stamp_session_id_header goes away; - registry/types.rs taken wholesale: memoized generate_schema_cached, RwLock resources with update_resources_with, app_builder config path; - tool_taxonomy gains InitOrUpdateApp and the spinner-label table; - TaskToolInput.capability_mode becomes harness-internal (schemars/serde skip both ways) so model JSON cannot set it; - extra-ca gains build_reqwest_client as an interim bridge until the upstream TLS-policy rework is ported deliberately. Chutes deltas reapplied on top of upstream text: ToolNamespace:: ChutesBuild* identifiers and wire ids, chutes.build/tool _meta key, api.chutes.ai test endpoints, our tier/ZDR upsell strings. Full lib suite: 2969 passed; the 74 failures are exactly the recorded Windows baseline (known_failures reports no new entries).
…tation - telemetry: OTLP external stream reworked upstream; adopt it with our CHUTES_BUILD_EXTERNAL_OTEL master switch (tests included) and the agent-id prewarm test pointed at CHUTES_BUILD_HOME; - xai-grok-version gains IS_DEV_BUILD plus the runtime-injected full_version() stamp (our CHUTES_BUILD_VERSION env names kept); - tty-utils exposes process CPU/memory-limit sampling helpers; - extra-ca adds build_reqwest_client / build_blocking_reqwest_client as interim bridges to the 1.0.8 callers until the full TLS-policy rework is ported deliberately; - xai-grok-mcp: elicitation surface + owned clients, wire constants, servers/tests refreshed - the crypto-provider hunk is held back with the TLS rework, so the local adapter keeps the 0.12 shape.
The anonymous-access tie-break verdict event that the refreshed MCP servers module emits after an inconclusive OAuth probe.
…ty refresh
Adopt upstream's NFS worktree strategy alongside grove-fuse/git:
nfs/{client,confined,liveness,mount_table,remove} plus the
create-latency stamp/metrics and a bench bin, with nfs_stub keeping
non-support platforms compiling. GC gains regression tests, checkout
learns the relative-gitdir backlink normalization, and the strategy
constants move to worktree::mod so stubs and callers share them.
The five failing git::safety tests locally are the known Windows
git-environment family (CI Linux exercises this crate); one new
symlink identity test is now correctly unix-gated.
Hub/workspace surface refresh plus the crates it needs: - workspace-types: DeleteScheduledTask RPC, worktree detach/salvage/clean-artifacts requests; - computer-hub-sdk/core: connection close-codes, OIDC and registry updates, DiagHandle::revive_connected via diag-server; - xai-grok-workspace: permission manager/prompter/shell-access split, hub + hub_server new RPC arms, handle gains acknowledged tool-notification channel and guarded session insert, workspace_ops repos manifest on .chutes-build with ancestor-hop budget, status config/preview supervisor discovery-refresh plumbing, server bins aligned; - new xai-grok-status-line crate wired into the workspace members; - agent/builder follows the app_builder config move and our ChutesBuildConcise naming. Env names stay ours (CHUTES_BUILD_HOME, CHUTES_BUILD_WORKSPACE_*), wire ids stay ChutesBuild:*, and the fuzzy status method keeps chutes.ai/search/fuzzy/status. Local suite: 1651 passed; the 43 failures are the recorded Windows baseline.
Taken wholesale: waterfall.rs (new spawn waterfall module), auth manager dir + flow/recovery/auth_method split handling, bundle re-export dedupe, workflow dir listing/status_line/named_workflow_args/ mcp_elicitation/reminders/spawn/sampler_turn/handle_request/mod, session acp_session+mod parents, mvp_agent mod+subagent_spawn, status-line dep wired (root deps + member). Remaining compile errors, each mapped to its fix: 1. agent plumbing: SkillsConfig/CompatConfig/MemoryConfig shapes moved upstream - needs surgical port of agent type files while preserving our prompt templates/advisor (identity seam); 2. compaction.rs 1529/1673: helper sigs in helpers/session_compact.rs; 3. UnblockResult fields: verify lock.rs taken state vs mvp_agent use; 4. acp_session_impl/mcp.rs icons fields (add Vec::new()). MANDATES for this branch before any release cut: - hard-deaden every telemetry export path at compile time (OTLP init/is_active no-op); local events.jsonl only; update PRIVACY.md; - keep harness wins: role merge, live routing pool, lean schemas.
…/icons, auth split Rate-limit retry const + re-export in the sampler (interim, full sampler delta still deliberately held), ModelInfo/ModelEntryConfig subagent_rate_limit_max_attempts plumbed through config + remote catalog parse, SessionCommand EmitStatusSnapshot/is_family_switch adopted at call sites, icons fields, auth manager/lock/meta/storage/ flow/recovery + http TransportFailureKind cert variants, bundle re-export dedupe.
…ring - UiConfig gains status_line: StatusLineConfig (shared dep added) - UsageTotals destructure extended for cache_hit/miss_calls - sampler re-exports MAX_RETRY_BACKOFF + RATE_LIMIT_RETRY_DISABLED - extra-ca: rustls bumped to workspace (aws-lc-rs), interim rustls_client_config + configured_bundle_env shims - auth manager loom feature declared; env names swept
… fixes - CHUTES_BUILD_COM_METHOD_ID alias + type annotation - BillingConfig gains usage_windows field (our fork) - ModelEntryConfig/ModelInfo subagent_rate_limit_max_attempts plumbed through config resolution and remote catalog parse - PromptUsageModel gains cache_hit_calls/cache_miss_calls + cache_read_ratio() for status blocks - ClientFeedbackInput images field in pager effects - managed_config TransportFailureKind cert variants matched
The user mandate is zero telemetry: init() is a no-op, is_active() returns false unconditionally, emit() drops every event, shutdown() and apply_remote_policy() are no-ops, and no OTLP exporter is ever constructed. The external_otlp_* integration tests are replaced with deadening-verification tests that assert the collector receives nothing even when every env var is set. PRIVACY.md documents the compile-time guarantee.
PRIVACY.md gains a paragraph stating the external OTEL stream is deadened at compile time. ARCHITECTURE.md, configuration.md, and the embedded user-guide authentication page are updated to match.
Known regression on this branch: ACP session spawn fails with 'no auth method id provided' — the upstream auth manager rework needs investigation before release. Main (1.2.4) is unaffected.
auth_method.rs read XAI_API_KEY instead of CHUTES_API_KEY, so the API-key probe failed and no auth method was published — the ACP session spawn returned 'no auth method id provided'. agent/config.rs also lost our llm.chutes.ai endpoint defaults when taken from upstream. Both are now restored: CHUTES_API_KEY / CHUTES_BUILD_API_KEY for auth, llm.chutes.ai/v1 for inference and proxy base URLs.
The lib compiles for all crates and the release binary works with the Auto router (verified via ACP probe). Remaining issues are test-only compilation errors: status-line test_support feature wiring, BillingConfig usage_windows initializers, base64 API changes.
…back - Added missing use base64::Engine as _ to test files taken from upstream - Fixed String + &String concat in leader/transport.rs test - Auth fallback: when the API-key probe fails during initialize(), default to CHUTES_API_KEY method instead of blocking session spawn Verified: cargo check --workspace ✓, clippy -D warnings ✓, release binary + ACP probe Auto router ✓
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| }; | ||
| let t_us = clock(); | ||
| match file { | ||
| None => eprintln!("{LINE_PREFIX} id={id} stage={stage} t_us={t_us}"), |
…ry deadening docs
GrokComConfig::default() on the WIP branch still created a hardcoded xAI OAuth2 provider (https://auth.x.ai, client b1a00492-...), so any fresh install without OIDC config entered the RFC 8628 device flow and opened https://accounts.x.ai/oauth2/device?user_code=... Chutes Build must never phone x.ai by default: take the main branch's auth/config.rs where Default only builds oauth2 from env vars, so an unconfigured install has oauth2=None and correctly asks for CHUTES_API_KEY instead. Also keep the earlier WIP fix where auth_method.rs reads CHUTES_API_KEY/CHUTES_BUILD_API_KEY (not XAI_API_KEY).
The advisor was an upstream concept this fork carried without a Chutes
reason to keep it: an always-registered read-only reviewer subagent
plus an /advisor slash command writing [subagents.toggle].advisor
and [subagents.roles.advisor].model (which were never part of the
typed settings registry). Removing it shrinks the task-tool catalogue
advertised to every model, drops one reserved slash name, and deletes
the only config writers that bypass the typed registry.
- xai-tool-types: drop ADVISOR_PROMPT/ADVISOR_SUBAGENT;
BUILTIN_SUBAGENTS is now three entries.
- xai-grok-agent: drop BuiltinAgentName::Advisor, its toolset,
AgentDefinition::advisor(), and its subagent_variants entry. This
also fixes twelve discovery::tests::merge_* tests that asserted a
three-builtin catalogue and could only fail while advisor existed.
- xai-grok-pager: delete slash/commands/advisor.rs and the
Action/Effect/setter/effect-handler chain behind it.
- xai-grok-shell: remove the no-op set_advisor_{model,enabled} stubs
and the 'advisor' reservation in PAGER_COMMAND_KEYS.
- Docs: remove /advisor from docs/slash-commands.md, ARCHITECTURE.md,
and the embedded guide chapters (04, 05, 16).
Historical mentions in CHANGELOG.md, AGENTS.md,
docs/upstream-sync.md and docs/token-efficiency-plan.md are records
of past states and are left as they are.
…_model)
Entering plan mode can now switch to a stronger planning model and
leaving it to a cheaper build model, both opt-in and independent:
[models]
plan_model = "zai-org/GLM-5.2-TEE"
build_model = "Qwen/Qwen3.5-397B-A17B-TEE"
Each direction fires only when its key is set; a key that resolves to
nothing (typo, removed from the catalog) logs a warning and keeps the
current model - the mode change itself never fails because of it.
Hooked where client-driven mode changes converge: session/set_mode
(Shift+Tab cycle, /plan) and the chutes.build/toggle_plan_mode ext
method. Model-driven exits - approving an exit_plan_mode proposal -
do not pass through these hooks and keep the current model.
Also fix four auth test-profile initializers that predate main's
client_secret field on OidcAuthConfig/OAuth2ProviderConfig; they kept
the test profile from compiling after the config restore.
Re-recorded from a full local run on the sync branch: xai-grok-pager drops to 4, xai-grok-tools to 74, xai-grok-workspace to 54. The old 116-entry file predated the workspace/status_line and shell fixes.
live_auto_pool_appends_only_behind_the_dashboard_alias observed the ambient CHUTES_ROUTING_STRATEGY through auto_live_strategy while env_resolution_reads_pool_and_strategy mutated it on another thread, flaking roughly one run in five under cargo's parallel harness. Both tests now hold one process-wide lock around the observation and the mutation; the stale single-threaded-harness comment is gone.
…scope The 1.0.8 port brought upstream auth tests whose fixtures assume a POSIX shell and an always-configured OAuth provider; 54 of them failed on Windows, and one production seam came back with them. Production: - API_KEY_SCOPE was "xai::api_key" again; it is "chutes::api_key" (the auth.json key this fork stores plain API keys under). - credential scrub docs now name the chutes scope. Tests: - true/false fixtures became synthesized process Outputs (fake_output): those programs do not exist on Windows. - POSIX shell one-liners (printf/sleep/wc/head/sh -c) now drive the already-shipped auth-provider-fixture binary, located beside the test binary or at the profile root; the gate builds it first. This covers counting providers, expiry precedence payloads, timeouts, env handback, stderr flooding, stdout caps, and the README contract script (fixture `gate` mode mirrors its expired-refusal shape). - static API-key tests now set/clear CHUTES_API_KEY (plus legacy and upstream names) so an ambient developer shell cannot leak in. - issuer-compatibility and device-flow tests build their OAuth app explicitly (cfg_with_oauth2) instead of assuming default() carries one - on Chutes it deliberately does not. - lock holder-info reads are Unix-only: Windows LockFileEx ranges block a plain read from another handle. - embedding_session_credentials first-party host is llm.chutes.ai; api.x.ai is third-party here and must stay denied. xai-grok-shell --lib auth:: is green again: 385 passed, 0 failed.
The session-lifecycle port from upstream 1.0.8 rewrote sampler_turn.rs and turn.rs and silently dropped the text-tool-call recovery feature shipped in 3ae715e: the helpers/mod.rs declaration, the recover_text_tool_calls implementation, and its call site before any downstream code reads tool_calls or stop_reason all vanished. The file itself stayed in the tree, unreferenced - dead_modules caught it exactly as designed, since an undeclared module compiles to nothing. Restored the declaration, the implementation (accepts a candidate only when the name resolves to a registered tool and its arguments parse), and the call site right after auth_retry_schedule.reset_on_success(). Its 11 unit tests are back and green; dead_modules reports all files reachable again. Also delete subagent_coordinator.rs: upstream 1.0.8 moved the shell runner adapter into subagent_spawn.rs, which this branch already carries, so keeping both duplicates MvpAgent impl items.
…release 1.3.0 rebrand.py --apply rewrote the branding tokens the 1.0.8 port carried in (339 files, overwhelmingly doc comments and env-var names); --check now reports no forbidden token, with only the four ambiguous families left as deliberate keeps. One mechanical collision was fixed by hand: the GROK_COM_METHOD_ID rename doubled a const declaration in auth_method.rs. - .github/upstream.json advances d71f6e0c/1.0.5 -> 07b2f714/1.0.8. - docs/upstream-sync.md: the WIP section became the completed review record - areas taken, deliberate divergences, the two silent-loss catches, Windows test work, deferred clippy.toml. - CHANGELOG.md gains the 1.3.0 entry; package.json, Cargo.lock and the lockstepped manifests move to 1.3.0 (verify:release aligned). Post-apply verification: workspace check clean, chutes-build-core / xai-tool-types / shell auth:: / agent config:: / pager slash:: green, clippy gate clean, fmt clean, verify:release aligned at 1.3.0. Runtime smoke on the release binary: --version shows 1.3.0, --help carries no upstream tokens, models resolves through CHUTES_API_KEY, du works.
The zsh script embeds every subcommand's doc comment, and the mcp args help still said flags are 'passed to the server instead of grok' - bare 'grok' is a rebrand-ambiguous token, so neither --apply nor the wordmark tests caught it, but completions_cmd's no-leak assert did, on all three CI platforms at once. The comment now says 'the agent', and all four shells generate zero occurrences.
provider_expiry_source_precedence and provider_unusable_expiry_still_mints handed the fixture's JSON payloads through the shell-form command; sh -c strips the double quotes, so the mint parsed nothing on Linux CI (cmd /C happens to pass them through, which is why Windows stayed green). These two now use the command+args direct-exec form like their siblings - argv is verbatim on every platform. jwt_with_exp also installs the jsonwebtoken crypto provider itself instead of relying on whichever sibling test ran first.
The 1.0.8 session port reverted two things main had already settled in 87ba25d, and the Linux CI step caught the first: - prompt_encrypted.rs went back to stale ciphertext; regenerated from the current templates via a restored scripts/encrypt_templates.py (the generator upstream used was never retained by the fork), so the staleness gate is reproducible instead of hand-patched. - The browser-verification render test assumed the standard primary template carries upstream's conditional marker. The Chutes prompt deliberately omits it: the gate now exercises the flag against an inline template with that conditional, and pins the divergence (flag inert on the standard prompt) as its own test. Also make three environment-shaped tests honest about their platform: - skills path assertions are separator-agnostic (Windows joins with \). - repo home-is-a-git-repo and plugins outside-home fixtures fake home through $HOME, which Windows resolves from %USERPROFILE% instead - gated to unix with the reason stated. xai-grok-agent --lib is green again: 580 passed, 0 failed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Ports the upstream grok-build delta d71f6e0c..07b2f714 (1.0.6→1.0.8) into Chutes Build, one area per commit:
Privacy mandate
The external OTEL stream is deadened at compile time: init() is a no-op, is_active() returns false unconditionally, and no exporter is ever constructed. Integration tests verify that no data reaches any collector even when every env var is set.
Harness improvements
Test plan