Prompt hooks make a single-turn LLM call returning {"ok": true/false}.
Agent hooks run a multi-turn LLM tool loop with sandbox access (exec_command, read_file).
Both fail-open on errors/timeouts. Prompt hooks default to 30s timeout,
agent hooks to 60s with max 50 tool rounds. Default model is "haiku".
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Introduce a `tls` field on HTTP hooks with three modes: `verify` (default,
requires https + cert validation), `no_verify` (requires https, skips cert
validation), and `off` (allows http, skips cert validation). This prevents
hooks from accidentally sending credentials over plaintext connections.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
HTTP hooks (type = "http") now actually execute instead of failing with
"no command specified". The executor POSTs the hook context as JSON,
parses HookDecision from the response, and fails open on errors.
Header values support $VAR/${VAR} interpolation gated by an
allowed_env_vars whitelist on the hook definition. Renames
CommandHookExecutor to HookExecutorImpl since it now handles both
command and HTTP hook types.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Replace JSON-based HookEvent::Display with simple match arms
- Use floor_char_boundary for Unicode-safe truncation in effective_name
- Cache compiled regexes in HookRunner instead of recompiling per check
- Simplify run_non_blocking (was run_parallel) to plain sequential loop
- Propagate hook_runner through parallel handler branch services
- Use unique temp file paths for sandbox hook context (avoid collisions)
- Add hook imports to engine.rs, reducing verbose crate:🪝: paths
- Extract duplicate RunFailed hook code into run_failed_hook helper
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Introduce a configurable hook system that triggers user-defined actions
at workflow lifecycle points (RunStart, StageStart, StageComplete,
StageFailed, EdgeSelected, CheckpointSaved, etc). Hooks can block
execution, skip nodes, or override edge routing via JSON decisions.
- New `hook/` module: types, config, executor (command), runner
- Engine instrumented at 8 lifecycle points with HookRunner calls
- TOML config: `[[hooks]]` in server.toml and run config files
- Config cascade: server hooks + run hooks merge, name collisions
resolved by run config winning
- Remove legacy tool_hooks.pre/post from codergen handler (breaking)
- 30 e2e integration tests covering all hook events and behaviors
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Rename the endpoint, schema (RunFiles -> RunCompare), operation ID,
handlers, and frontend route across the full stack.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The question_type field on ApiQuestion was a bare string serialized via
Debug formatting. Define a proper enum in the spec so typify generates a
typed QuestionType, then map from the workflow enum in the handler.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace inline json!() wrappers with a shared ListResponse<T> struct
that serializes directly, avoiding the intermediate serde_json::Value.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Wrap 4 list endpoints that returned bare arrays in the standard
paginated `{ data, meta: { has_more } }` shape so adding real
pagination later is additive rather than a breaking change.
Endpoints: GET /runs/{id}/questions, /runs/{id}/stages,
/runs/{id}/verifications, and /verifications.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Deserialize permissions/output_format as typed enums instead of strings
so invalid values in cli.toml fail at parse time
- Use Option::or/or_else combinators instead of if-is_none pattern
- Load cli.toml only for agent/llm commands, not all CLI invocations
- Standalone arc-agent binary calls apply_cli_defaults for single source
of hardcoded defaults
- Remove redundant #[serde(default)] on Option fields
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Multi-stage Dockerfile builds Rust API binary and bundles the web app
and docs into a single image. docker-compose.demo.yaml orchestrates
the three services (api, web, docs) with a shared entrypoint router.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Users who always use the same provider/model/permissions no longer need
to pass flags every time. Precedence: CLI flag > cli.toml > hardcoded default.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Define failover_eligible() in terms of retryable() to prevent drift
(only difference: QuotaExceeded is failover-eligible but not retryable)
- Extract spawn_event_forwarder() to eliminate duplicated event-forwarding
spawn blocks and fix missing file-change tracking in failover path
- Replace hardcoded "anthropic" default with self.provider.as_str()
- Refactor create_session into create_session_for(model, provider) to
avoid constructing throwaway AgentApiBackend during failover
- Use &[FallbackTarget] slice instead of cloning Vec on every one_shot
- Remove redundant run_defaults fallback in resolve_fallback_chain
(apply_defaults already merges fallbacks before it's called)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When an LLM provider returns a transient error (rate limit, server error,
quota exceeded, timeout, network, or stream failure), Arc now automatically
retries on fallback providers using the closest matching model from the
catalog based on capability filters and cost proximity.
Key changes:
- closest_model() and build_fallback_chain() in arc-llm catalog
- failover_eligible() on SdkError to classify transient vs deterministic errors
- fallbacks config field on LlmConfig with task-wins-over-defaults merging
- WorkflowRunEvent::Failover variant for observability
- Failover logic in both one_shot and agent session (run) code paths
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Reuse expand_vars() from run_config to scan for $identifier patterns
in codergen prompt expansion. Unknown variables like $gaol now produce
an ArcError::Validation at runtime instead of silently passing through.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replaces 10 identical copies of the pagination block with a single
shared function. Also eliminates a redundant second collect() by
using truncate() instead.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Apply the same page[limit]/page[offset] pagination pattern from
GET /runs to: workflows, workflow runs, retros, sessions, projects,
branches, saved queries, query history, and stage turns.
Each endpoint now returns { data, meta: { has_more } } instead of
a bare array. Includes OpenAPI spec updates, demo handler changes,
regenerated TS client, updated frontend consumers, and a new
pagination conformance test.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
load_server_config() now accepts an optional explicit path. When
provided, it reads from that path (erroring if missing) instead of
the default ~/.arc/server.toml. The --config flag is wired through
ServeArgs and the hot-reload polling loop.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- AppState.server_config was stored but never read; remove it and revert
create_app_state_with_options back to 5 parameters
- Config polling now compares under a read lock first, only acquiring
the write lock when a change is detected
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Poll ~/.arc/server.toml every 5s and swap run_defaults/git config for new
runs without restarting. CLI overrides (--model, --provider) always win.
On parse error, log a warning and keep the previous config.
Also add a `default` field to the model catalog so default model resolution
uses catalog data instead of hardcoded model names in Rust code.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Runs now go through a state machine (queued → starting → running →
completed/failed/cancelled) instead of spawning immediately. A background
scheduler promotes queued runs when capacity is available, defaulting to
4 concurrent runs. Configurable via --max-concurrent-runs CLI flag or
max_concurrent_runs in server.toml.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Introduce page[limit]/page[offset] query params and { data, meta: { hasMore } }
response wrapper for the /runs endpoint, establishing the pagination pattern
for all future list endpoints.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace opaque (i64, i64, i64, f64) tuple with ModelUsageTotals struct
for readable field access. Remove redundant top-level token/cost fields
that duplicated by_model sums — derive them at read time instead.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Tracks total runs, input/output tokens, cost, and runtime in-memory
(resets on server restart). Accumulates from checkpoint node_outcomes
when runs complete. Includes per-model breakdown.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
All API errors now return a consistent JSON shape:
{"errors": [{"status": "4xx", "title": "...", "detail": "..."}]}
Introduces ApiError type with IntoResponse impl, replaces bare
StatusCode returns and ad-hoc {"error": "..."} responses in all
handlers and auth extractors. Updates OpenAPI spec and regenerates
TypeScript client.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Maps the Graphviz "insulator" shape to a new wait.timer handler that
reads a duration attribute and sleeps before proceeding with success.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Google's most cost-efficient model ($0.25/M input, $1.50/M output) with
1M context, 65K output, and full tool/vision/reasoning support.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add discovery, health check, OpenAPI spec, and current user endpoints.
The first three are public; /user requires authentication and returns
the login extracted from JWT sub claim, mTLS CN, or "demo" in demo mode.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Move CheckReport, CheckResult, CheckDetail, and CheckStatus types from
arc-cli doctor into arc-util so they can be reused. Refactor the workflow
run_preflight to render a styled check report instead of ad-hoc key=value
output and separate stderr errors.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Install ring CryptoProvider at CLI startup to prevent rustls panic
- Skip TLS in demo mode so the server uses plain HTTP
- Add ARC_DEMO=1 env var to web app config to bypass GitHub OAuth
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The Anthropic API returns HTTP 529 for overload conditions, but this
status code was falling through to the catch-all which classified it as
InvalidRequest (non-retryable). This meant neither LLM-level nor
node-level retries would trigger, causing workflow nodes to fail
immediately on transient overload errors.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Checks llm_model and llm_provider values in model_stylesheet against the
built-in catalog during `arc validate`. Unknown models or providers emit
warnings (not errors) since the catalog is advisory, not restrictive.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Multi-line arguments (e.g. spawn_agent task descriptions) were breaking
the single-line progress output.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
LLM responses were printing raw Markdown (bold markers, table pipes,
heading hashes). Use termimad to render with proper ANSI formatting
when color is enabled, falling back to plain text when NO_COLOR is set.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Both verbose and normal modes now use the same indicatif-based ProgressUI
renderer with the same visual hierarchy (indentation, glyphs, colors).
In verbose mode: tool calls persist after stage completion, no 5-call cap,
stage completion shows stats (turns, tool calls, tokens), and additional
events are rendered (edge transitions, loop restarts, setup commands,
retries, context warnings, compaction, subagents).
Remove the old format_event_summary function and its ~70 tests, the
verbose stderr printing from AgentApiBackend, and the verbose/styles
fields that are no longer needed.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
New demo 11-ensemble.dot fans out to Opus (Anthropic), Gemini (Google),
Codex (OpenAI), and Mercury (Inception) in parallel, then synthesizes
results. Also generates PNG and SVG renderings for all existing demo
dot files.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds a `--preserve-sandbox` CLI flag and `sandbox.preserve` TOML config
option that skips sandbox cleanup after a run. Cascade order:
CLI flag > run TOML > server.toml defaults > false.
When preserving, prints sandbox identity (container ID or Daytona
sandbox name) so users can reconnect for debugging.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Simplify create_ssh_access to return String directly
- Add jump_to_node field to Outcome for parallel handler fan-in
- Find convergence node from branch outgoing edges
- Use ..Outcome::success() spread in tests and error paths
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Return just the SSH command string instead of the full SshAccessDto,
and hardcode the 60-minute expiration internally.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Show smoothness rating, outcome, friction/open item counts, and file
path after retro completes instead of just the file path.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Creates SSH access after sandbox init and displays the connection
command in the progress output, aligned under the sandbox detail line.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Handle ParallelBranchStarted/Completed events as nested entries under
the fork stage, using the same indented spinner styling as tool calls.
Branch bars persist after the stage completes so they remain visible
in the final output.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
