Fabro's run, session, turn, message and pair IDs are ULIDs. A ULID
occasionally has enough distinct characters to cross the secret
scanner's 4.5-bit entropy threshold, and the stream redaction then
rewrites the Web UI link to `/runs/REDACTED` and the run branch to
`fabro/run/REDACTED`. Two nightly releases in the last week failed on
`attach_replays_completed_detached_run` this way, and each fix so far
protected one field at a time.
Teach the entropy scanner the format instead: a token that is exactly
26 uppercase Crockford base32 characters and decodes to a timestamp
between 2020 and 2100 is an identifier, not a secret, and is left
alone wherever it appears. Trailing `-ULID`, `_ULID` and `=ULID`
segments are stripped before measuring, so `20261020-<id>` and
`<secret>-<id>` are handled, and the secret in the latter is still
found. The gitleaks credential patterns run on every token as before.
This mirrors detect-secrets' built-in UUID filter. A secret would have
to take exactly this shape and land in the date window to be missed,
which is about one in a hundred of the already rare tokens encoded as
26 uppercase base32 characters.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Fabro's shared resolver passed any unknown bare selector through verbatim
to the highest-priority ready provider. A provider name in the model field,
such as `gemini`, is not a catalog model, so it took that path and reached
Anthropic with wire model `gemini`. The same path turned any typo into a
request on whichever provider happened to win priority.
An unqualified unknown selector is now an error. Passthrough of an
uncatalogued model id still works, but only with a provider pin, which is
also how the operator docs already described it. A bare provider name gets
a dedicated error that names the provider and says to pin it and omit the
model to use its default.
The completions endpoint returns that error as a 400 before any provider
call; the models lookup returns it as a 404. Session creation keeps its
own provider-name message and no longer passes unknown unpinned names
through either. The OpenAPI description of `CreateCompletionRequest.model`
no longer advertises a provider id as a selector, and the TypeScript client
is regenerated from it.
Closes#950 by rejecting the input rather than resolving it: a provider
name in the model position is ambiguous with model aliases, and no
comparable library resolves it to a provider default.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Bump Petri to the commit that reports `pebble.usage_by_model`, the root
session's usage by the route that spent it, and add an end-to-end test:
an agent stage on a scripted model whose primary answers once and then
fails mid-prompt keeps every token Petri reported, and files the
primary's share and the fallback's share under their own models.
Only Petri moves; Pebble and sandbox-driver stay at their locked
revisions.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A run whose sandbox cleanup fails is kept for a retry, and only an explicit
force deletes it without its sandboxes. Say so in the 409 so a caller with a
run stuck behind an unavailable provider knows how to proceed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A finished agent stage replaced its live usage, which included every
subagent session, with the parent session's usage alone, so completed
stage and run totals dropped descendant tokens and spend. The subagent
accounts were also read as an array, while Petri reports them as an
object keyed by session id, so no per-model rows were ever built.
The completed stage now totals the parent's usage and each descendant
account once, and builds per-model rows for the parent and every
descendant. The parent's usage goes under the routes Petri reports in
`pebble.usage_by_model` when present (lithoscomputer/petri#110), and
under the stage's model until then.
Fixes#933
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
FabroHooks always declares required run finalization instead of only
when the run publishes or checkpoints. Every run takes one path, the
best-effort diff branch in run_finished goes away, and a fork always
declares what its worker's hooks will declare on resume, so the fork no
longer carries its source's flag across.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ManagedRun::settle owns the rule that a run's first terminal status
sticks, and the lifecycle fold, the finish settle, fail_managed_run and
the in-process finish all go through it. One release_managed_run
replaces the two helpers that released a run's live state and also
frees its scheduler slot. The engine reads the finish through the
projection's finished_status, so a cancelled finish carrying a
checkpoint failure, and a failed publication, are mapped in one place.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A failed checkpoint cancels the run, so Petri recorded it as cancelled
and the worker overrode its own outcome in memory. Runs that checkpoint
now declare required finalization, and finalize_run rejects with
checkpoint_failed before publishing. The projection and the engine
outcome report a cancelled finish carrying that failure as a workflow
failure with the checkpoint's message, and the in-memory override is
gone. A run whose checkpoint failed is never published.
Retry a host failure that storage rejects with a short backoff, so a
brief storage fault does not leave the run active and holding its
scheduler slot. A failure that never commits still leaves the run's
status alone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Share the managed-run cleanup between persist_run_failure and
fail_managed_run, return the committed projection from
commit_host_failure, and keep the run's status when the failure cannot
be stored. Restore the cancelled-launch message and keep the spawn
error's cause in the launch failure.
Rebuild Cargo.lock from main with only the Petri bump so the Windows
crates stay on their newer versions. Import the projection module
rather than the function, wrap long tracing calls, and document the
finalization test fixture.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Name the publish failure once, settle host failures through one flat
helper, share the append-then-finish path for in-process runs, reuse
the source state already read when checking a fork, and drop the
unused finished-run status shim.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Track Petri main now that required run finalization has merged there,
read workflow execution from the engine state, resume the failed-publication
regression with its admitted workflow, and keep the worker lifecycle helper
usable for rejected appends.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
