Repository navigation
Conversation
This was referenced Oct 12, 2026
Lucas1479
added a commit
that referenced
this pull request
Oct 12, 2026
…on (#197) ## User scenario and compatibility On current main, the Host-owned **Settings → Providers → MCP → Test** probe is the only consumer of manually configured stdio MCP connections that this environment migration changes. Its process receives platform/toolchain variables plus explicitly encrypted connection bindings, rather than arbitrary Host environment credentials. A service relying on an ambient Host token may fail the probe while continuing to work through Codex/ACP's independently launched MCP service. Native Codex/ACP launch behavior and stored v1 records, commands, arguments and cwd are unchanged. Pi does not accept manual MCP connection bindings on main; its built-in web search uses HTTP and is unaffected. Later Host-owned stdio consumers, such as extension execution paths, can reuse this boundary; this PR does not introduce those consumers. Design #195. Standalone main-based review extracted from #188. Current head `06a4fc2` contains audit repair `38089f7` and current main `0dbf7ef` (including merged #189 and #198). Keep Draft pending review/CI; no merge is requested. ## Changes and audit repairs - Explicit environment allowlist at the Host stdio boundary. Required tokens/toolchain variables belong in **Encrypted environment values**, then save/restart/retest. There is no unrestricted inheritance fallback or OS-sandbox claim. - Probe errors unwrap nested exception groups and show bounded underlying reasons, instead of `unhandled errors in a TaskGroup`. Explicit credentials and resolved HTTP bearer tokens are redacted before truncation. - Stdio failures retain a clear conditional migration hint even for long errors; this does not assert that every failure is a missing credential. The UI translates the hint into Chinese and preserves its separate line. HTTP errors receive no stdio migration advice. - Windows explicit bindings override inherited names case-insensitively (Path/PATH, proxy variants); POSIX retains case-sensitive names. - Corrected this PR, Issue #195, migration documentation and UI wording: the current mainline impact is the connection test, not Pi tool execution or all existing native MCP calls. The real legacy fixture now binds Codex, and its direct Host helper call is explicitly described as a helper test. ## Validation Five new/strengthened regression cases failed before repair, reproducing the TaskGroup message, missing guidance and Windows duplicate-key behavior. On the synchronized head: - `python -m pytest -q tests/test_mcp_connections.py tests/test_subprocess_environment.py tests/test_mcp_provider_adapter.py tests/test_pi_web_tools.py`: **26 passed**, including **15** focused environment/probe cases. - Real local peer: ambient-only credential is absent and the failed probe returns `Connection closed` plus migration guidance; adding the explicit binding makes discovery and a direct helper tool call succeed, preserving cwd without an unrelated Host secret. - `cd electron; npm test`: **406 passed**; `npm run build`: passed. The first run caught unsorted new translation keys; the final catalog is sorted and the entire suite passes. - Ruff and diff checks passed. Clean source-release gate: **3,905 selected, 95 excluded, 0 errors/warnings**. - No native Codex/ACP launch semantics are changed or newly qualified by these tests. [Migration documentation](https://github.com/Code-Amadeus/Amadeus/blob/codex/mcp-environment-migration/docs/mcp_environment.md). ## Latest main synchronization validation At `06a4fc2`: - MCP/environment/provider/Pi-web/release-tooling regressions: **39 passed**. - Electron full suite: **416 passed**; production build passed. - Clean source-release gate: **3,908 selected, 95 excluded, 0 errors/warnings**. - GitHub reports `MERGEABLE`; new-head CI and review requirements still apply. Draft status is retained. ## Review and integration #189 and #198 have been merged by the maintainer. Main `0dbf7ef` is now integrated here. The only conflict was the adjacent documentation insertion in `release/source_release_policy.json`; both `docs/mcp_environment.md` and `docs/backend_shutdown.md` are retained. No MCP or shutdown implementation was changed while resolving it. After approval, freeze this prerequisite; rebuild/restack #188 from its own net diff rather than replaying its pre-split history. This update does not cascade changes through #188/#191/#192. The earlier experimental bare-parameter MCP constructor regression was not a main defect; main already used `Client(stdio_client(...))`. No extension capability grant, backend-stop policy, SDK licensing work, diagnostics feature or memory implementation is included here.
Lucas1479
added a commit
that referenced
this pull request
Oct 12, 2026
## Outcome Community TTS, MCP and Skill packages share an explicit install/configure/bind/update/remove lifecycle. Electron owns installation and durable settings; Python consumes startup snapshots; independent SDK Runners own external TTS. Packages install disabled, backend changes require restart, and Main Chat gains no tools, Skills or Host grants. Design: #194. This PR now targets **main**, with the maintainer's authorization to merge after the rebuilt head passes CI. ## Mainline integration and review - Current head `c9b5f93` is one contribution commit on main `52194c0`, which already contains #189, #198 and the corrected #197. - Only the reviewed `7ea55dc..43eda97` net diff was applied, not the old pre-split commit history. It applied without conflicts. Its stable patch-id before status-only documentation updates was identical (`592bba5c748e042587fda10ba4b18c2748d923d6`). Scope remains 132 files, +9,653/-136. - The only additional changes state that the pinned protocol source is now in protocol main history. No runtime or SDK behavior was added during reconstruction. Main's MCP migration messages, credential handling, translations and both source-release documentation entries remain present. - Protocol [#1](Code-Amadeus/Amadeus-Extensions#1) was merged with merge commit `c770dfe`. Its pinned `49449a0f3572e74ac7269129c02c5b9a9e685bef` remains an ancestor of main; no new wheel or pin is needed. - Public annotated tag [`extension-host-profile-v0.1-55e62ab`](https://github.com/Code-Amadeus/Amadeus/tree/extension-host-profile-v0.1-55e62ab) retains the Host commit referenced by the wheel's immutable README link. This is a documentation snapshot, not a release. - Maintainer-provided external re-review accepted the implementation, cancellation recovery, SDK artifact and main-based reconstruction. #191/#192 and protocol #2 are separate follow-ups and were not restacked in this merge preparation. ## SDK delivery and runtime boundaries - Protocol/SDK use Apache-2.0; authored examples use MIT-0; Host remains AGPL-3.0. External models/voices/assets retain their own rights. - The Host carries one canonical SDK wheel selected by `protocol-source.json`. Frontend builds verify it with Node and do not invoke Python to build or download the SDK. Source archives and packaged Electron contain the same artifact. - SDK SHA-256 remains `274bd66b81932c8ea50f39f58e7bf91530a8015196acfcf9bcfd77fa2d8b8084`. Independent Windows/Linux builds, a local rebuild and the vendored bytes match. Source hashes, PEP 639 metadata and embedded LICENSE are verified against the accepted source commit. - Static package inspection accepts compatible SDK ranges/exact versions, evaluates active markers, and rejects incompatible versions/direct SDK URLs before pip. Installation verifies its staged SDK bytes. Confirmation discloses the declared license, complete plugin wheel digest and local source filename. - Non-cooperative TTS cancellation has a 10-second cleanup grace, then bounded Runner recovery without replaying speech. Cooperative cleanup keeps the process/budget; old requests cannot cancel a replacement Runner. - MCP and Skill execution stays with the existing Provider paths. Installation is not a Host permission grant, and unsupported combinations fail closed. ## Validation on rebuilt head - `python -m pytest -q -rs tests/test_extensions.py tests/test_extension_sdk_build.py tests/test_extension_protocol_provenance.py tests/test_extension_mcp.py tests/test_extension_skills.py tests/test_extension_examples.py tests/test_extension_fish_audio.py tests/test_mcp_connections.py tests/test_mcp_provider_adapter.py tests/test_subprocess_environment.py tests/test_pi_web_tools.py tests/test_release_tooling.py tests/test_work_artifact_registry.py tests/test_work_artifact_preview.py tests/test_work_read_model.py`: **190 passed, 2 skipped** (local Windows symlink privileges). - Electron full suite: **463 passed**. Production build passed with `AMADEUS_PYTHON` pointing to a nonexistent interpreter. - Canonical-source comparison passes; the pinned protocol commit is in protocol main history. The vendored wheel and its digest are unchanged. - Clean source-release gate: **3,985 selected, 101 excluded, 0 errors/warnings**. Diff checks pass. - Final main-based CI must pass before merging; old-head green checks are not substituted for it. ## Remaining experimental limits Historical native Windows install/update/enable/restart/Chat playback/removal evidence is recorded in the Host profile. This reconstruction does not claim a new native-dialog acceptance run or new paid-service/natural-voice qualification. MiMo Japanese is unsupported. DSH stdout and Windows DACL/integrity limitations remain observable and fail closed. The accepted #197 follow-up about the MCP SDK reintroducing Windows `PATH` beside explicit `Path` remains a non-blocking independent migration fix; this reconstruction does not alter the approved MCP policy. The earlier bare-parameter MCP constructor defect was introduced and fixed within this experiment, not an existing main bug. Theme support/unified Plugins navigation (#191/#192), developer mode, logs, public SDK publication and memory are outside this PR. Merge to main with squash after final checks; do not merge to the retired temporary review base.
Lucas1479
force-pushed
the
codex/extension-profile-p1
branch
from
October 12, 2026 16:02
9cdbb35 to
80ae98e
Compare
Lucas1479
force-pushed
the
codex/extension-theme-pilot
branch
from
October 12, 2026 16:02
9310872 to
aca3530
Compare
Rebuild the P2-only contribution over main-based P1, retain the accepted SDK artifact, and synchronize provisional theme provenance. Repair the offline startup smoke by supplying the production theme state owner at its missing IPC boundary.
Lucas1479
force-pushed
the
codex/extension-theme-pilot
branch
from
October 12, 2026 17:18
aca3530 to
d7988dc
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Outcome and dependencies
P2 adds constrained desktop themes and one Plugins entry for TTS, MCP, Skill and theme lifecycle. Settings reuses that manager; Appearance selects themes. Pure frontend packages apply immediately; mixed packages use one actually loaded version until backend restart. Design #194. Draft; keep unmerged for focused external review.
Head
d7988dc9d83712a6accb9b9c5b845fde0d41b0fdis stacked on repaired #191bc89ae7, based on accepted mainc569a0f. The P2 contribution was rebased onto that repair; both appended resource regressions were retained. Theme provenance pins protocol #2 atd06f3193e214543e40d933e227aae785598457a4. It is accurately marked provisional until that PR merges. SDK source49449a0and SHA-256274bd66b81932c8ea50f39f58e7bf91530a8015196acfcf9bcfd77fa2d8b8084are unchanged.Audit repairs
--on-accentlabel. Authors cannot override it. Existing built-in appearance stays unchanged; example palettes satisfy the stricter extension checks.themeState()throughdesktop-theme.get; no production fallback or timeout increase.Fresh validation
Limits and merge sequence
Preparation/cancellation failures preserve the prior installation. After old backend shutdown releases references, v1 may be collected before v2 successfully starts; startup failure has no automatic rollback. This repair does not redesign that behavior.
The lifecycle driver reports
nativeDialogs: false; this is not a new manual confirmation or natural-voice audition. The recorded 2026-10-12 native-dialog/Chat journey remains historical. No new cross-platform GUI or paid-service qualification is claimed. MiMo Japanese remains unsupported; DSH stdout and Windows ACL limits stay observable and fail closed.Accept #191 and protocol #2 first (protocol via merge commit to retain the pinned source). Then move this P2 diff onto main, verify the pin is in protocol main history, update the provisional provenance note and rerun final-head CI before merging. No temporary source is described as already accepted. Developer mode, logs, registry, ASR, installed AUIP, character features and memory are outside this repair. No merge or auto-merge is requested.
Current CI scheduling evidence
The short red aggregate from run 38283387983 was superseded during base/head synchronization: all five prerequisite jobs were cancelled, and its log explicitly reports
SUITES_RESULT=cancelledandSMOKE_RESULT=cancelled. Replacement run 38283388026 must finish successfully. This does not explain away any actual test failure, and is separate from the previously repaired Windows Electron smoke defect.