feat(hub): explain a stale base, and show what this machine carries - #271
Merged
Conversation
The aggregate contextSha256 can only say the build context changed, never which file changed - the one thing anyone wants when a provider reports stale. computeContextSha256 already hashed every file and threw the digests away; computeContextManifest keeps them and the aggregate delegates to it, so stored fingerprints are unaffected. Also fixes a real invalidation gap: eight files Dockerfile.box COPYs were missing from DOCKER_CONTEXT_FILE_MAP (gh-shim, git-shim, ntn-shim, linear-shim, chromium-resolver, agentbox-sshd-start, agentbox-portless-trust, opencode-agentbox-plugin.js), so editing any of them never invalidated the image. The guard test now derives the expected set from the Dockerfile's COPY lines instead of spot-checking four keys, which is why it never caught this. Every stored fingerprint changes once as a result. Claude-Session: https://claude.ai/code/session_01BcoSQCZtnaWV8rVJikyy5W
The System page listed DOCKER_CONTEXT_FILE_MAP - agentbox's own baked assets - which tells a user nothing about their setup, and a stale provider said only that the fingerprint moved. Both gaps cost an hour of manual archaeology when a Mac mini rebuilt the box image instead of pulling the published one. - stale rows open to show WHICH files changed, diffed against the per-file manifest now recorded at bake time; a base baked before manifests existed says so instead of guessing from mtimes - 'Carried from this machine' replaces the internal-file list: agent configs, skills by name, ~/.gitconfig - present-only, derived from AGENT_SYNC_SPECS and the same pathExists gates the sync layer uses, so an absent path is one no box receives - a 'Box image' card with the registry, the exact sha- tag this host pulls and the fingerprint it last stamped All of it flows through the __AGENTBOX_HUB_SYSTEM globalThis seam - the route still must not import @agentbox/sandbox-core, which is what 500'd the standalone build in #268. Verified against build:standalone, not next dev. Claude-Session: https://claude.ai/code/session_01BcoSQCZtnaWV8rVJikyy5W
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 4bdaa5b. Configure here.
| if (!stored || Object.keys(stored).length === 0) return { hasManifest: false }; | ||
| const mod = (await IMPORTERS[id]()).providerModule; | ||
| const current = await mod.currentBaseFileHashes?.(); | ||
| if (!current) return { hasManifest: false }; |
There was a problem hiding this comment.
Stale diff hides stored manifest
Medium Severity
When a bake already has a per-file manifest but currentBaseFileHashes cannot run, providerBakeDiff returns hasManifest: false. The stale accordion then says no manifest was recorded, which is wrong and sends users toward a needless re-bake instead of a fingerprint or runtime resolution issue.
Reviewed by Cursor Bugbot for commit 4bdaa5b. Configure here.
| kind: isSkillHost ? 'skills' : 'config', | ||
| ...(isSkillHost ? { skills: childDirs(skillsDir) } : {}), | ||
| }); | ||
| } |
There was a problem hiding this comment.
OpenCode state path false positive
Low Severity
collectHostCarried lists every existing OpenCode staticPaths entry, including ~/.local/state/opencode, but docker create only enables OpenCode when ~/.config/opencode or ~/.local/share/opencode exists (or opencodeConfig is set). A host with only the state directory can show a carried path that create never syncs.
Reviewed by Cursor Bugbot for commit 4bdaa5b. Configure here.
System diagnoses a stale base but has no bake control - that lives on Settings -
so a user landing on a re-bake nag had to guess where to go. The Providers header
now links to /settings#providers ('Bake in Settings' when something is stale,
'Manage in Settings' otherwise), and the providers card carries the anchor.
Sidebar order follows: System sits under Settings, since it is the read-only
companion to it rather than a peer of Custody.
Claude-Session: https://claude.ai/code/session_01BcoSQCZtnaWV8rVJikyy5W
The System page's link to Settings used a bespoke style with state-dependent wording; use the shared Button (outline/sm) like every other page, labelled just 'Settings'. Settings auto-expanded the credential form for every provider without a key, so a fresh hub opened as a wall of forms. The badge already says which providers need attention - start collapsed and let the user open the one they came for. Claude-Session: https://claude.ai/code/session_01BcoSQCZtnaWV8rVJikyy5W
…ode path Two Bugbot findings, both confirmed against the source: - providerBakeDiff returned hasManifest:false when currentBaseFileHashes could not run, even though a manifest WAS recorded. The accordion then told the user to re-bake to enable a diff they already had, when the real problem is resolving the current assets. New liveUnavailable flag renders that honestly. - collectHostCarried listed ~/.local/state/opencode on a host that has only that dir, but create.ts's wantOpencode gates on ~/.config/opencode or ~/.local/share/opencode - the state dir rides along and never enables the volume itself. Listing it alone promised a box a path create never mounts, breaking the present-means-carried contract. Claude-Session: https://claude.ai/code/session_01BcoSQCZtnaWV8rVJikyy5W
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Makes the System page answer the questions that cost an hour of manual archaeology when a Mac mini rebuilt the box image instead of pulling the published one.
Why a base is stale — now answerable
A stale provider used to say only
build context changed (was abc…, now def…). It now opens to show which files changed:computeContextSha256already hashed every file and threw the digests away;computeContextManifestkeeps them and the aggregate delegates to it, so stored fingerprints are unaffected by the refactor. The manifest is recorded at bake time by all six providers.A base baked before manifests existed has nothing to diff against, and says so rather than guessing from mtimes — an mtime heuristic flags a touched-but-unchanged file and misses a changed one with a preserved mtime.
Carried from this machine — replaces the internal-file list
The old "Box image contents" section listed
DOCKER_CONTEXT_FILE_MAP: ten files AgentBox itself bakes, which tells a user nothing about their setup. Replaced with what this machine hands to a box — agent configs, skills by name,~/.gitconfig.Derived from
AGENT_SYNC_SPECSand the samepathExistsgates the sync layer uses, so it is present-only: a path missing from that list is one no box will receive. Dot-dirs (.system,.cursor) are filtered — they are machinery, not skills.Two things worth stating, since they contradict a reasonable assumption:
agentbox-setup/SKILL.md.registry.ts:169-171andopencode.ts:138) because sessions live in a multi-tenant DB — so it is correctly absent from the list.Box image card
The registry, the exact
sha-…tag this host pulls, and the fingerprint it last stamped — precisely what had to be reconstructed by hand fromdocker-prepared.json+ config + the registry.Also fixes a real invalidation gap
Eight files
Dockerfile.boxCOPYs were missing fromDOCKER_CONTEXT_FILE_MAP—gh-shim,git-shim,ntn-shim,linear-shim,chromium-resolver,agentbox-sshd-start,agentbox-portless-trust,opencode-agentbox-plugin.js. Editing any of them never invalidated the image, so a stale image shipped silently. The guard test now derives the expected set from the Dockerfile's COPY lines instead of spot-checking four names, which is why it never caught this.Every stored fingerprint changes once as a result — expect a single re-bake or re-pull per machine. Confirmed live: docker went
54e4690b036d→5b76d5109a39.Verification
Against the standalone build, not
next dev— the route still must not import@agentbox/sandbox-core, which is what 500'd the standalone build in #268. All new data flows through the__AGENTBOX_HUB_SYSTEMseam./api/v1/system→ 200, zeroFailed to load external modulesince process start.agentbox prepare --provider dockerrecorded an 18-file manifest.scripts/agentbox-openwith before/after hashes; restored it → back tofresh.https://claude.ai/code/session_01BcoSQCZtnaWV8rVJikyy5W
Note
Medium Risk
Touches box-image invalidation and prepared-state shape across all providers; one-time fingerprint churn and re-bake/re-pull is expected, but the fix prevents silent stale images after shim/script edits.
Overview
The hub System page and
GET /api/v1/systemnow explain why a provider base is stale and what the host actually gives boxes, instead of only listing AgentBox’s own baked files.Stale bases: Bake flows record a per-file manifest (
computeContextManifest/diffFileManifests) and exposebakeDiffon stale providers. The UI shows changed/added/removed paths (or “no manifest — re-bake to diff”). All six providers persistfilesat prepare time and implementcurrentBaseFileHasheson the provider module.System page content:
imageContextKeysis replaced byhostCarried(present-only agent configs, skills by name,~/.gitconfigviacollectHostCarried+AGENT_SYNC_SPECS) and aboxImagecard (registry,sha-…pull tag, stamped fingerprint). Data is wired through__AGENTBOX_HUB_SYSTEMinserver.ts, not from Next routes importing sandbox-core.Fingerprint fix: Eight
Dockerfile.boxCOPY’d scripts were added toDOCKER_CONTEXT_FILE_MAP; a test now requires every COPY line to appear in the map. Stored fingerprints change once until each machine re-bakes or re-pulls.Reviewed by Cursor Bugbot for commit 4bdaa5b. Configure here.