Skip to content

Open Cloud sandbox agents as Herdr panes - #3

Merged
khaliqgant merged 2 commits into
mainfrom
codex/t5-cloud-sandbox-panes
Aug 8, 2026
Merged

Open Cloud sandbox agents as Herdr panes#3
khaliqgant merged 2 commits into
mainfrom
codex/t5-cloud-sandbox-panes

Conversation

@khaliqgant

@khaliqgant khaliqgant commented Aug 7, 2026

Copy link
Copy Markdown
Member

What changed

  • add a cloud picker entrypoint that uses the existing non-interactive Agent Relay Cloud session
  • select an active coding credential, warm its Daytona box in Relayfile mode, and spawn or reuse one PTY broker agent in the returned live mount
  • open the existing fleet-agent entrypoint against the remote broker, preserving the T3/T4 pane and single-writer status-projection model
  • query remote broker status through @agent-relay/harness-driver
  • keep Cloud and broker credentials out of argv/logs and discard the box response's Relayfile token
  • document selection, behavior, lifecycle, and security boundaries

Why

T5 requires a Cloud sandbox agent to appear as a drivable Herdr pane while working in a live Relayfile-mounted tree with no clone or push. Cloud already exposes the broker through a signed Daytona preview URL, so this extends the existing fleet pane rather than introducing a third terminal model.

Dependency

Depends on AgentWorkforce/cloud#2957. The picker sends the new requireRelayfileMount: true flag so Cloud fails the warm rather than returning a mountless ready box.

Validation

  • npm ci --omit=dev: exit 0
  • npm test: 65 passed, 1 Windows-only skip, exit 0
  • git diff --check: exit 0

Live probe status

Cloud auth, workspace lookup, agent listing, a real Daytona box, and its broker endpoint were reachable. The live probe also exposed the missing required-mount guard fixed by cloud#2957: hosted Cloud marked a box ready while /workspace was unavailable for PTY spawn. Provider credentials available on this host were expired or failed their warm/spawn path, and Herdr itself is not installed here. Therefore the final visible-pane + local-edit acceptance is intentionally not claimed yet; it requires deployment of cloud#2957 and a host with Herdr plus a healthy coding credential.


Summary by cubic

Adds a Cloud picker that warms a Daytona Cloud agent box in Relayfile mode and opens its broker terminal as a Herdr pane using the existing fleet-agent. Also ensures concurrent Cloud pane opens converge on a single broker agent.

  • New Features

    • New cloud entrypoint and pane in herdr-plugin.toml that uses a non-interactive agent-relay login session to warm a box with requireRelayfileMount: true and /workspace, then spawn or reuse one PTY agent with a stable name; concurrent opens re-list and attach to the same agent.
    • Opens fleet-agent against the remote broker and keeps the T3/T4 pane model and single-writer status projection.
    • Queries remote broker status through @agent-relay/harness-driver; passes RELAY_BROKER_URL/RELAY_BROKER_API_KEY via env only, discards the Relayfile token, and avoids putting Cloud/broker credentials in argv or logs. Docs and tests added.
  • Dependencies

    • Added @agent-relay/cloud and @agent-relay/harness-driver.
    • Requires AgentWorkforce/cloud#2957 to enforce the Relayfile mount requirement.

Written for commit e7cf2bc. Summary will update on new commits.

Review in cubic

@coderabbitai

coderabbitai Bot commented Aug 7, 2026

Copy link
Copy Markdown

Review Change Stack

📝 Walkthrough

Walkthrough

The change adds a Cloud entrypoint that selects an Agent Relay Cloud agent, warms its Daytona box, starts or reuses its broker agent, and attaches the broker stream to a Herdr pane. Documentation, manifest configuration, dependencies, and integration tests are included.

Changes

Cloud pane workflow

Layer / File(s) Summary
Cloud entrypoint and registration
package.json, herdr-plugin.toml, README.md
Adds Cloud dependencies, registers the Linux/macOS cloud pane, and documents login, selection, warming, token handling, and pane behavior.
Agent selection, warming, and broker reuse
test/cloud.test.mjs
Tests Cloud agent selection, box normalization, Daytona warming and polling, credential removal, broker-agent reuse, and concurrent creation convergence.
Fleet pane attachment and validation
test/cloud.test.mjs
Tests fleet-pane creation, remote broker status, attach commands, process lifecycle handling, credential isolation, manifest metadata, and platform documentation.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant CloudPicker
  participant AgentRelayCloud
  participant DaytonaBox
  participant FleetAgentPane
  CloudPicker->>AgentRelayCloud: select and warm Cloud agent
  AgentRelayCloud->>DaytonaBox: poll until box is ready
  AgentRelayCloud->>FleetAgentPane: provide broker connection
  FleetAgentPane-->>CloudPicker: attach live broker stream
Loading

Possibly related PRs

Poem

A rabbit warms the Cloud agent’s lair,
A broker stream runs through the air.
The Herdr pane attaches bright,
While tokens stay beyond its sight.
Close the pane; the box still remains.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Title check ✅ Passed The title clearly summarizes the primary change: opening Cloud sandbox agents as Herdr panes.
Description check ✅ Passed The description directly explains the Cloud picker, Daytona sandbox, broker reuse, Herdr pane, security, dependencies, and validation.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/t5-cloud-sandbox-panes

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@khaliqgant
khaliqgant marked this pull request as ready for review August 8, 2026 11:12
@cursor

cursor Bot commented Aug 8, 2026

Copy link
Copy Markdown

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (1)
test/cloud.test.mjs (1)

207-229: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

Preserve the single-writer status contract.

Add an assertion that runCloudPicker does not call pane.report_agent. The test collects all requests but only checks pane creation. A picker-side status write can race the fleet-agent status projector.

Proposed test assertion
   const open = requests.find((entry) => entry.method === 'plugin.pane.open').params;
+  assert.equal(
+    requests.filter((entry) => entry.method === 'pane.report_agent').length,
+    0,
+    'leaves fleet-agent as the only status writer'
+  );
   assert.equal(open.entrypoint, 'fleet-agent');
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/cloud.test.mjs` around lines 207 - 229, Add an assertion in the
runCloudPicker test that no collected request has method pane.report_agent,
while preserving the existing plugin.pane.open and result assertions.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/cloud.test.mjs`:
- Around line 138-184: Add a concurrent creation test for ensureCloudBrokerAgent
that invokes it twice before either spawn completes, ensuring only one Cloud
broker agent is ultimately created. Update the creation flow to handle this race
by making spawnCli idempotent for the derived agent name or, on duplicate-name
failure, listing agents and reusing the existing one.

---

Nitpick comments:
In `@test/cloud.test.mjs`:
- Around line 207-229: Add an assertion in the runCloudPicker test that no
collected request has method pane.report_agent, while preserving the existing
plugin.pane.open and result assertions.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1a6f35b7-c1c8-433f-bd0b-d6fd6d25f887

📥 Commits

Reviewing files that changed from the base of the PR and between fd143a3 and 73b084c.

⛔ Files ignored due to path filters (5)
  • dist/cloud-picker.mjs is excluded by !**/dist/**
  • dist/cloud.mjs is excluded by !**/dist/**
  • dist/fleet-agent.mjs is excluded by !**/dist/**
  • dist/fleet.mjs is excluded by !**/dist/**
  • package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing (4)
  • README.md
  • herdr-plugin.toml
  • package.json
  • test/cloud.test.mjs

Comment thread test/cloud.test.mjs

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All reported issues were addressed across 9 files

Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

Re-trigger cubic

Comment thread dist/cloud.mjs Outdated
Comment thread README.md
@khaliqgant
khaliqgant merged commit 4e9435c into main Aug 8, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant