Machine-level, read and written through /v1/settings/sandbox into the machine's config.toml.
Adds the sandbox_network_profile setting; strings in English and Chinese.
aisuite comes from PyPI (0.2.0), so the package has no git-URL dependency.
Older top-level spellings (openworker join, up, status) keep working, unlisted.
/#/gallery renders every card state from payload files; scenario sessions boot the real app from JSON.
A contract file keeps the states in step with what the server sends. Not in the production bundle.
The staffing card shows one line per role with a model and connector ticks for the whole role.
A lead's decision on a worker's call and the team update get their own cards; cards go two-tone.
api.ts routes each call to the session's machine or the cloud proxy.
One module turns server payloads into card props and card answers into wire messages.
Settings gains Machines and a machine scope for Models, Skills, Coworkers, Memory and Connectors.
Glance pages and configurations show which machine answers a workspace or repo.
Sessions group by machine; the setup row chooses where a session runs.
Calm type pass: token type scale, sentence-case labels, context ring on the model pill.
A reply that hit the output-token limit (finish_reason "length") with no tool
call — typically thinking consumed the whole budget and nothing else came back
— took the `if not turn.tool_calls` branch and ended the turn as "completed".
The task was silently abandoned (two of Fable 5.1's three failures and one of
Sonnet 5's on a ten-task trial were this shape).
Engine:
- On such a reply, append a user-role nudge (TRUNCATION_NUDGE: act now, do not
repeat the reasoning), emit a CONTINUATION event, and go round the loop.
At most MAX_TRUNCATION_CONTINUATIONS (2) consecutive nudges per turn; the
counter resets on any non-truncated reply and at the start of each turn.
- On the cap, persist a `truncated` notice and end with TURN_END
status "truncated" — never "completed".
- The cut-off reply stays in the transcript (finish_reason "length", its
partial reasoning) but is replayed to providers as a short stub
(`replay: "stub"` sidecar → TRUNCATION_STUB): its thinking block has no
signature, which Anthropic rejects, and it carries nothing useful anywhere.
- A truncated reply that still has a parseable tool call is unchanged (the
mangled-call path already covers broken arguments).
GUI (surfaces/gui): "continuation" event → info notice; turn_end "truncated"
→ warning; persisted `truncated` notice replays as a retriable warning; en/zh
strings.
Tests: tests/test_truncation_continuation.py (nudge then complete, stub
replay, partial text, cap → truncated + notice, tool-call case untouched,
counter resets within and between turns, normal path untouched, stub survives
persistence); GUI itemsFromMessages test for the truncated notice.
Approval surface:
- MCP cards show the full argument envelope (expandable JSON) and the real
destination ("leaves this computer → host", stamped from the user's own
config); the long-tail card path never silently truncates any argument —
values the one-liner can't show whole render as labeled complete blocks
(the old 96-char cut hid email bodies past char 96).
- The MCP grant ladder: Allow once / Allow for this request (EXTERNAL
family; tooltip states the trade — later calls in this answer run unseen,
nothing survives the answer) / Always allow this tool (durable, revocable
on the server page) / Deny. Session-wide grants stay hidden where the
server refuses them — no button that lies.
- One renderer for parked approvals: a redelivered (reconnect/navigation)
approval maps back into the real card component — evidence and buttons
can never drift from the live card again. Transcript origin chips name
their source: your trust rule vs the legacy server flag vs a run grant.
Connectors/MCP management:
- Connect-time tool review: per-tool checkboxes; first review is an
explicit "Keep these tools" consent moment (creates the include list and
locks in fail-closed growth), later toggles auto-save with a receipt;
"new" badges only tools the server added since review (declines are
remembered via the exclude list, never badged).
- Trust surface: right-aligned "always allowed · Revoke" chip per trusted
tool (idle-dimmed when the tool is unchecked — standing rules never
vanish from the screen that audits them); header counts granted
authority; loud banner + one-click migration for the legacy server flag.
- One tool-review dialect: shared row/chip/count primitives across MCP and
catalog-connector pages; read/asks-first chips explain themselves
(offered only where our own code pins the kind — MCP rows carry no risk
chips, a server's word is not evidence; the page states "every tool asks
unless always-allowed" once instead).
- Clarity passes from live testing: one healthy status word (Ready);
group headers count their own rows; adding/connecting a server lands on
the detail page where the review ceremony waits (curated offers live in
Available, never among servers you own); Test shows Testing…/a transient
result at the button with the durable receipt in the header; the
per-server Configuration mirror is replaced by one "Show mcp.json"
reveal-in-file-manager affordance; lifecycle controls carry explanatory
tooltips. en+zh throughout.
Folder-count summary gets _one/_other; keyboard shortcuts register at commit
so early input isn't dropped during boot; restores main's copy for the
files-location help and the onboarding signed-in line.
Approval origins (reviewer/user/bypass, notes, grants) ride the tool message display sidecar so chips and deny blocks survive reload.
The Auto-Approve explainer is persisted once per session server-side with new shorter copy; later switches persist one-line markers.
Breaker pauses loudly and resets on non-deny verdicts and ask_user answers; replies reach the judge with the agent question marked as data.
Cardless runs annotate quietly: auto-approved (reviewer reason) or approval bypassed.
Onboarding Next now accepts OAuth sign-in; an explicit draft folder pick survives a coworker change.
Composer shows context-window figures only (session totals on hold); specialists introduce themselves on first contact.
A new session briefly kept the previous session's mode value until the
ready event delivered the real one, so leaving an Auto-approve session
posted its banner into the fresh transcript, then a stray marker. The
notice logic now lives in a pure modeNoticeStep that is a no-op until
ready confirms which session the mode belongs to; tests replay the
reported sequence and the restored-session banner case.
Copy: "Auto-approve" sentence-cased like its sibling entries; picker
description recast as an imperative (owner wording); banner opens with
"classifies each action" to match. Stale approvalSlot comment rewritten.
Devika Verma