q792602257andClaude Opus 4.6
ec261d57c2
Host Agent now persists step-level execution detail locally (via a real TaskMetadataStore/Timeline wired into TaskRunner) and reports a bounded in-progress snapshot piggybacked on lease renewal. Cloud persists that snapshot per active assignment and exposes it through the existing task list/detail query path; Cloud Console renders it as a live badge. Host Agent's local console gains authenticated, read-only task list and detail/timeline pages (same-origin, server-rendered) with inlined screenshots. Also fixes a pre-existing gap in the shared Timeline: the actual per-step LLM prompt is now recorded instead of the task goal, benefiting both Runtime and Host Agent consoles. When a host uses the cloud planner transport, each decide call's prompt and resulting tool decision are durably logged in a new planner_decision_log table (with bounded retention) and browsable from Cloud Console; direct-transport hosts explicitly surface a "not reported" state. Includes Alembic migrations 0008 (progress columns on scheduled_tasks) and 0009 (planner_decision_log), bounded Host-Agent-local retention, dual-backend repository parity, and Vitest + pytest coverage. Task 6.5 (manual end-to-end device verification) remains. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Cloud Console
Vue 3 + Vite single-page app for the Cloud Control Plane (apps/cloud-api).
The primary flow is a Cloud user account: username/password login creates an
expiring, revocable HttpOnly session cookie, while the frontend sends the
separate CSRF cookie value on writes. The browser never stores the session
secret in JavaScript.
Prerequisites
- Node.js 20+
- A current Cloud API database migration and at least one administrator created
with
device-cloud-admin users create ... - HTTPS for production:
CLOUD_SESSION_COOKIE_SECURE=trueis required in a production Cloud API. Terminate TLS at the origin serving/console/.
Accounts have fixed roles:
viewer: task, device/host, and plugin read viewsoperator: viewer access plus task submission APIsadmin: all API scopes
Administrators can use Users & limits to manage accounts, restrict task
submission to explicit Host/Device targets, configure Host self-submission and
active-task limits, and inspect non-secret Cloud-proxy usage. Daily token
budgets are enforced only for Hosts reporting AI_PLANNER_TRANSPORT=cloud;
direct-provider Hosts are labelled unmetered rather than budget compliant.
The configured proxy reservation ceiling must fit within any daily budget.
Local development
cd cloud-console
cp .env.example .env.local
# Point this to the local Cloud API when it is not http://127.0.0.1:8001
npm install
npm run dev
For a Vite origin such as http://127.0.0.1:5173, configure the API with the
exact origin and disable secure cookies only in local/test mode:
export CLOUD_CONSOLE_CORS_ORIGINS="http://127.0.0.1:5173"
export CLOUD_SESSION_COOKIE_SECURE=false
The Console uses credentials: include. 401 returns to the login screen;
403 remains an authorization error so an otherwise valid session is retained.
Production
npm run build type-checks and creates dist/. The repository Dockerfile
already builds this bundle into /app/console-static and configures the Cloud
API to serve it at the same-origin /console/ route. No CORS configuration is
required in that deployment shape. Use device-cloud-admin for account
provisioning and recovery.