Network allow list holds only the machine's ticked sites, none by default; strict/standard removed.
The app no longer installs OpenShell; setup is two checks and one step with progress.
DMG build requires grpcio so the sidecar can use OpenShell.
Network: registries and search (strict folded in) with the machine's own hosts, or allow everything.
Credentials list only what was added; shipped entries become presets with the variable each tool reads.
A hung docker info no longer fails the OpenShell checklist.
The OpenShell checklist and setup job show under the OpenShell type; the Windows setup keeps its own routes.
Co-Authored-By: Devika Verma <devikaverma11@gmail.com>
Setup and remove routes prove the wall in a throwaway sandbox before the choice takes effect.
Credential entries are a file or a folder, labelled credential or configuration; collapsible cards.
The same-user fallback is gone: without setup the provider refuses and Settings say why (ruling 18).
A shell could not enter a granted folder under the profile; the parents now get a traverse-only entry.
The entry check matches by SID, so it works for a real account too.
From a fresh-user run on WSL (2026-09-27): "Set up sandbox" handed over two
commands, gave no install instructions, and put a Copy button on notes
("found none") and file paths.
- steps carry `command` (run in a terminal, gets Copy) apart from `hint`
(a note) and `docs` (a Guide link). `checks()` prints command or hint.
- `admin_prefix()`: `sudo -n` when this user may sudo without a password,
else `pkexec` (the desktop's own password prompt) when there is a display
and this is not WSL. The app never sees or holds a password.
- `install_openshell()`: NVIDIA's installer as the user on a Mac; on Linux
under the admin prefix with `loginctl enable-linger` FIRST in the same
run, because the installer starts the gateway through the user's systemd
manager, which on WSL does not run until linger is on (it otherwise
prints "could not reach the user systemd manager" and exits 0 without
registering the gateway). The job streams its output as progress and it
can be cancelled.
- No prefix (WSL): the openshell row hands over ONE command, linger + the
installer, and the job stops until "Check again".
- `enable_linger()` tries the user, then the admin prefix, then hands over.
- Terminal `setup`: linger (sudo) before the installer; Guide URL printed.
- Page: "Run this in a terminal on this machine:" above a command; notes
plain, no Copy; Guide links; install progress row; a fixable row shows
its command only once the app could not do it.
- Wording: switch-off text says what it means ("directly on this machine,
with the same access as your user account"); "stored in <path>" only
while the switch is on; the credential editor explains itself with an
npm example and placeholders; "needs download" hint points at the
button, not a terminal command.
The page listed "No sandbox", "macOS sandbox" and "OpenShell" as three equal radio
buttons (with "ready" next to no-sandbox, and "on this Mac" on every OS), and always
showed the network allow list and shared credentials even when they applied to nothing.
Choosing OpenShell did not say what the machine still needed; the user found out when a
session was refused.
Now:
- One switch, "Run agents in a sandbox". Off removes `sandbox_provider` from
config.toml (it used to write "direct", which also disabled a headless machine's
automatic-OpenShell rule); on picks Seatbelt on a Mac, OpenShell elsewhere, with a
dropdown when both exist. On Windows the switch is disabled with the WSL hint.
- Under the switch, for OpenShell: a readiness checklist, the same rows `openworker
machine sandbox status` prints, now with keys and whether the app may fix each one
itself, plus two new rows: free disk space for the image (about 10 GB) and Landlock in
the kernel (OpenShell refuses to start a sandbox without it). Each missing row shows
the command to run, with Copy.
- "Set up sandbox" runs `SetupJob` on the machine's server: it fixes what the app may
(bind-mount config and gateway restart, the config line, linger when no administrator
is needed, the image download with per-layer progress and Cancel) and stops at a step
that needs an administrator or an installer, showing the command; "Check again"
continues. It never runs anything as root and never turns the sandbox off. A desktop
notification says when the download is done.
- Network allow list and shared credentials are collapsible and shown only while the
switch is on.
`setup_cmd` is refactored into `steps()` (rows with keys and fixability) and one
function per fix, used by both the terminal `setup` and the job, so there is one list
of checks. New endpoints: GET /v1/settings/sandbox/readiness, GET/POST
/v1/settings/sandbox/setup, POST /v1/settings/sandbox/setup/cancel.
Copied credentials (and the policy file) went into tempfile.mkdtemp() under /tmp and
were bind-mounted into the sandbox. NVIDIA's installer runs the gateway as a systemd
user service with PrivateTmp=true, so the gateway has its own empty /tmp: the mount
source "does not exist" for it and every session with a shared credential failed to
create. Verified through /proc/<gateway pid>/mountinfo and /proc/<pid>/root/tmp.
The folder is now `<state dir>/sandbox-runtime/ow-openshell-<pid>-<random>/`: on the
real filesystem, owner-only, and a SIBLING of `sandbox/`, never a child, because
`sandbox/` is mounted read-only into every sandbox for the runner and copied keys must
not be readable from another session's sandbox. The server pid in the name lets the
registry's reap sweep the folders of a dead server, which /tmp used to do on its own.
On first use of the OpenShell sandbox, `openshell sandbox create` pulls the pinned base
image (about 5 GB). OpenWorker waited for that create with a 600 s timeout, inside the
session-start request; on a slow link the pull outlived it, the session failed with
`TimeoutExpired`, the UI showed "Starting OpenWorker..." and retried, and nothing told
the user a one-time download was the cause. Settings > Sandbox said "ready" throughout.
Now the image is part of the readiness check, keyed on the gateway's compute driver
(`openshell gateway info`), not the operating system, since the same image serves
Linux, WSL and macOS and only the Docker driver can be asked:
- `preflight()` raises `OpenShellImageMissing` (an `OpenShellUnavailable`) with the
`docker pull` command when the driver is Docker and the image is absent, so a session
is refused in a second with a message that says what to do.
- Settings > Sandbox shows OpenShell as "needs download" with a hint, and keeps it
selectable; `state` joins each provider row of /v1/settings/sandbox.
- `openworker machine sandbox status` gets a row for the image; `setup` offers the pull
last, with Docker's own progress and no time limit, on macOS too.
One list per platform (coworker/sandbox/toolchains.py), machine-level, editable by name; read entries on Windows,
the Seatbelt profile on the Mac. The Windows full mode passes its environment through a file (1024-character logon limit).
Any host, no proxy; the files stay confined. Strict remains the default elsewhere.
Settings offers it as a third choice; credential rows hide their hosts when it is on.
aisuite comes from PyPI (0.2.0), so the package has no git-URL dependency.
Older top-level spellings (openworker join, up, status) keep working, unlisted.
A machine joins with its own identity and holds a reverse channel to the controller.
Provider keys and connector accounts deploy sealed to the machine's pinned key.
OpenWorker had no way to choose how hard a model thinks per reply; the level
was whatever each endpoint defaulted to (Anthropic: high; Kimi K3 on
Together: max), and a run record could not state it.
- `Config.reasoning_effort` (low | medium | high | xhigh | max, Anthropic's
vocabulary), config.toml / workspace / `COWORKER_REASONING_EFFORT`,
validated; unset sends nothing so existing requests are unchanged.
- `build_engine` threads it through `model_settings` like `max_tokens`.
- providers/effort.py: the level→parameter tables and the nearest-supported
rule (ties go up). Anthropic adaptive models get `output_config.effort`
(per-model support from the effort doc, read 2026-09-08); budget-thinking
models get `thinking.budget_tokens` (2,048 / 8,192 / 16,000 / 24,000 /
32,000, max_tokens floored above); OpenAI-compatible endpoints get
`reasoning_effort` (Kimi K3: low/high/max verified; others the OpenAI
vocabulary). Gemini, Bedrock, Responses: not sent, recorded as such.
- Fallback: an endpoint that rejects the parameter (400 naming it) gets the
request once more without it; the model is remembered for the run.
- Record: `AssistantTurn.effort` → `reasoning_effort` sidecar on every
assistant message and on the ASSISTANT_MESSAGE event: {requested,
effective, param, note}; stripped before provider calls. When a level is
configured but the provider reports nothing, the record says so.
- docs/config.example.toml documents the key.
Tests: tests/test_reasoning_effort.py, 40 cases (levels, config layering and
rejection, build_engine plumbing, mapping tables incl. every curated model at
every level, Anthropic complete/stream/budget/fallback/unrelated error,
OpenAI-compatible unset/mapped/fallback, engine record and outbound strip).
Every provider capped each reply with a hard-coded constant (32,000 for the
Anthropic and OpenAI-compatible clients, 4,096 for Bedrock) that no config,
environment variable or CLI option could change, although `build_engine(...,
model_settings=)` already spread settings into every provider call and every
provider used `setdefault("max_tokens", ...)`. Now:
- `Config.max_output_tokens` (config.toml, workspace-overridable; env override
`COWORKER_MAX_OUTPUT_TOKENS`), validated as a positive integer; unset keeps
every provider's default byte-for-byte.
- `build_engine` folds it into `model_settings["max_tokens"]` unless the caller
passed an explicit value; explorer subagents inherit it.
- `AssistantTurn.output_limit`: the ceiling the provider actually sent, after
the Anthropic budget-thinking floor (which now logs a warning when it
overrides a configured value) or the OpenAI `max_completion_tokens` rename.
- The engine persists it on the assistant message as the `max_output_tokens`
sidecar and on the ASSISTANT_MESSAGE event, stripped before provider calls.
- Bedrock keeps 4,096 with a comment on why; the config key raises it.
- docs/config.example.toml documents the key.
Tests: tests/test_max_output_tokens.py (config layering, env override,
validation, build_engine plumbing, Anthropic complete/stream + floor warning,
OpenAI complete/stream + rename retry, engine record).
Imported from andrewyng/aisuite@1b4bbf303e
(contents of its platform/ directory, hoisted to the repo root).
Development history prior to this commit lives in that repository.
Co-authored-by: Devika <devikaverma11@gmail.com>
Rohit C Prasad