After tai sandbox containers start as root with dynamic UID mapping,
docker exec defaults to root. Add User field to ExecOptions and
hardcode "sandbox" in Box.Exec/Stream to ensure commands run as the
correct user.
Made-with: Cursor
- Implemented GetWorkspaceID method in the context package to retrieve the workspace ID.
- Updated buildContextVariables to include WORKSPACE_ID in the context variables if available.
- Enhanced buildEnv function to set CTX_WORKSPACE_ID in the environment configuration based on the workspace ID.
- Refactored role connector handling to support multiple connectors in the environment setup.
- Added tests for new role connector functionality and workspace ID integration.
In CI environments where a real tai gRPC endpoint is reachable on
port 19100, the asynchronous connectTunnelNode goroutine can dial
successfully and send an "open" TunnelControl frame on the Register
stream before the test's "pong" arrives.
Loop on Recv() and skip non-pong frames so the test passes regardless
of whether connectTunnelNode fires in the background.
Made-with: Cursor
- Replaced the previous file extension checks with a unified parsing function for sandbox configuration, improving code clarity and maintainability.
- Introduced a new HostExecConfig structure to manage local execution settings, allowing for more granular control over command execution permissions.
- Removed deprecated Moapi API files and related functionality, simplifying the codebase and reducing maintenance overhead.
- Updated the Tai node registration process to ensure local capabilities are accurately reflected based on the environment, enhancing overall system robustness.
- Updated Docker run commands in CI workflows to include the `-direct` flag for improved server operation.
- Implemented image existence checks and automatic pulling for sandbox environments, enhancing reliability during initialization.
- Added loading status updates for sandbox operations, providing better feedback during the setup process.
- Refactored lifecycle management to ensure accurate tracking of sandbox states and improved error handling.
Made-with: Cursor
- Modified BuildGRPCEnv to accept the Tai node's gRPC port directly, enhancing flexibility for different modes.
- Updated test cases to reflect changes in gRPC address construction, ensuring accurate environment variable settings for local, direct, and tunnel modes.
- Added a new test for handling unknown modes, improving test coverage and robustness.
- Adjusted Docker configuration to ensure proper host resolution for gRPC communication.
Made-with: Cursor
- Introduced a relay daemon port (2099/tcp) to facilitate communication between the host Tai server and containers.
- Updated port bindings to ensure the relay port is always mapped to the host IP for improved connectivity.
Made-with: Cursor
- Updated VNC and proxy handling in the tunnel to utilize a structured routing approach, enhancing clarity and maintainability.
- Replaced direct port checks with a new `forwardRoute` struct to encapsulate routing information, including channel type, container ID, and port.
- Modified request handling to streamline the forwarding process and improve error handling for unknown routes.
- Enhanced tests to validate the new routing logic and ensure consistent behavior across VNC and proxy requests.
Made-with: Cursor
- Introduced a human-readable display name for the sandbox, constructed from the agent and workspace names.
- Updated the BuildIdentifier function to include workspace ID in identifiers for long-running and persistent lifecycles.
- Modified sandbox creation options to incorporate the display name, improving clarity in sandbox management.
- Refactored related tests to ensure compatibility with the new identifier structure and display name integration.
Made-with: Cursor
- Added support for issuing and passing a sandbox token during stream execution in the Assistant.
- Updated StreamRequest to include a Token field for managing user authentication.
- Enhanced ClaudeRunner to set environment variables for the sandbox token and refresh token.
- Refactored SandboxToken structure to clarify its purpose and manage token credentials effectively.
- Modified sandbox management routes to enforce OAuth guard for improved security.
Made-with: Cursor
- Updated test cases to handle potential stream closure more gracefully by checking for send errors before proceeding with receive operations.
- Enhanced clarity in test logic to ensure that expected errors are correctly asserted when metadata is missing or channel IDs are non-existent.
Made-with: Cursor
- Added constants for channel ID byte size and short length to improve clarity and maintainability.
- Implemented ShortChannelID function to truncate channel IDs for log messages, enhancing readability.
- Updated gRPC tunnel logging to utilize the new ShortChannelID function, ensuring consistent and concise channel ID representation in logs.
Made-with: Cursor
- Implemented a new endpoint to retrieve the absolute path of a workspace's root directory.
- Enhanced the workspace interface with a GetRoot method to facilitate this functionality.
- Updated the workspace manager to utilize the new method for improved path resolution.
Made-with: Cursor
- Added keepalive parameters to the gRPC server configuration to manage connection health more effectively.
- Implemented sorting logic in the computer and sandbox response handling to ensure consistent ordering by display name and last active timestamp.
- Refactored node display name retrieval for better clarity and reuse across different functions.
Made-with: Cursor
- Introduced ExpandHosts function to parse and expand comma-separated host entries, including special values like "internal" and "localhost".
- Updated gRPC server to utilize the new ExpandHosts function for improved host management.
- Added HostHasInternal function to check for "internal" in host strings, enhancing configuration flexibility.
- Implemented new gRPC endpoints for TaiTunnel registration and forwarding, improving tunnel communication capabilities.
- Refactored authentication logic to include new TaiTunnel endpoints, ensuring proper access control.
Made-with: Cursor
- Refactored the sandbox initialization process to resolve the connector before obtaining the Computer, allowing for the injection of OPENAI_PROXY_* environment variables.
- Updated the GetComputer and BuildCreateOptions functions to accept an optional connector parameter for improved environment variable management.
- Standardized the VNC configuration by replacing SANDBOX_VNC_ENABLED with VNC_ENABLED across Dockerfiles and related scripts for consistency.
- Enhanced the VNC service startup script to check the new VNC_ENABLED variable, ensuring proper service initialization.
Made-with: Cursor
- Updated the registration process to utilize NodeID instead of TaiID, allowing for server-generated TaiIDs.
- Implemented additional fields in the registration request, including DisplayName and improved error handling for missing parameters.
- Enhanced the connection logic for registered nodes, ensuring proper client binding and logging for better traceability.
- Introduced new methods for extracting and managing extra claims in OAuth tokens, improving the flexibility of user identification.
Made-with: Cursor
- Implemented V2 sandbox initialization in the assistant loading process, allowing for standalone sandbox.yao configuration.
- Added support for V2 sandbox execution paths in the Assistant's Stream method, differentiating between V1 and V2 sandboxes.
- Introduced comprehensive tests for V2 sandbox configurations, ensuring correct loading and execution behavior.
- Updated the context and types to accommodate V2 sandbox features, including system information and workspace management.
Made-with: Cursor
- Added sandbox initialization in the load process to ensure proper setup of the sandbox manager.
- Implemented gRPC heartbeat handling to track container liveness, enhancing the monitoring capabilities of the sandbox.
- Updated related documentation to reflect the new integration and functionality.
Made-with: Cursor
- Updated benchmark and test functions to utilize node configurations instead of pool configurations for improved clarity and consistency.
- Refactored related setup functions and test cases to align with the new node-based architecture.
- Adjusted error messages and documentation to reflect the transition from pool to node terminology.
Made-with: Cursor
- Updated benchmark functions to utilize TaiID instead of pool names for improved consistency and accuracy in tests.
- Refactored test cases across various files to ensure compatibility with the new TaiID structure.
- Enhanced setup functions to accept pointers to poolConfig for better memory management.
- Removed deprecated config struct and adjusted related documentation to reflect the changes in the sandbox architecture.
Made-with: Cursor
Align taiTestGRPC() helper with the new Tai 1.2.0 port standard.
Also support TAI_TEST_HOST and TAI_TEST_GRPC_PORT env vars used by CI.
Made-with: Cursor
- Update CI (unit-test.yml, pr-test.yml) to use yaoapp/tai:1.2.0
with new default ports (gRPC:19100, HTTP:8099, VNC:16080, Docker:12375)
- Add explicit 0.0.0.0 bind for containerized Tai instances
- Fix sandbox/v2 grpc.go default port fallback (9100 → 19100)
- Fix tai/tunnel/proxy.go fallback ports (8080→8099, 6080→16080)
- Sync tai SDK and sandbox/v2 documentation with implementation
- Add new docs: api.md, registry.md, tunnel.md
Made-with: Cursor
- Refactor GPT-5 test cases to improve clarity and maintainability.
- Comment out tests for temperature handling in GPT-5, indicating they are temporarily disabled.
- Remove the obsolete hostexec test file to clean up the codebase.
- Enhance the sandbox manager to support host execution capabilities and improve lifecycle management.
Made-with: Cursor
- Remove x-grpc-upstream metadata from gateway forwarding; use SetUpstream
- Remove YAO_GRPC_TAI / YAO_GRPC_UPSTREAM env vars from sandbox containers
- Delete benchmark-sandbox-v2 CI job (run benchmarks locally)
- Simplify sandbox-v2 CI to tai SDK + workspace tests only
- Add HostExec support to sandbox v2 box interface
- Add K8s semaphore and cleanup mutex for test stability
- Update design docs to reflect new architecture
Made-with: Cursor
Server lifecycle:
- Introduce service.Service to manage HTTP + gRPC startup/shutdown
- Fix gRPC mutex deadlock in StartServer when port is occupied
- Add GracefulStop with 5s timeout before forced Stop in grpc.go
- Pre-check HTTP and gRPC port availability in cmd/start.go
- Print gRPC server address in startup access-points block
gRPC client refactor:
- Move token manager and client from tai/grpc/ to grpc/client/
- Add backward-compatible aliases in tai/yao.go and tai/token.go
- Update cmd/run.go to import grpc/client directly (no tai dependency)
Sandbox v2 docker migration:
- Delete sandbox/v2/docker/ (moved to tai repo)
- Update sandbox/docker/build.sh hint to point to tai repo
- Clean up .gitignore entries for removed docker directory
- Temporarily disable SandboxV2Test and BenchmarkSandboxV2 in CI
(docker images need rebuild after tai repo migration)
Tai integration:
- Add direct-mode registration API handlers in tai/api/
- Add heartbeat handler and token management wrappers
- Update tai/registry and tai/tunnel for latest protocol
- Replace yao-grpc references with tai call in docs
Made-with: Cursor
- Introduce a new "tunnel" scheme for the Tai client, allowing connections through Yao's reverse proxy.
- Enhance the Tai registry to manage tunnel-connected nodes and their ports.
- Add WebSocket and reverse proxy routes for tunnel connections in the OpenAPI server.
- Implement tunnel-specific proxy and VNC handling to facilitate communication with containerized environments.
- Update gRPC environment variable handling to support tunnel connections.
These changes improve the Tai service's flexibility and connectivity options, enabling better integration with remote and containerized environments.
- Rename and enhance the Docker instance startup steps for Tai in CI workflows, improving clarity and readiness checks for both HTTP and gRPC services.
- Update health check logic to ensure accurate reporting of service readiness, including specific error messages for failures.
- Modify environment variable configurations to streamline the setup for K8s and Docker instances, ensuring consistent port usage across tests.
These changes improve the reliability and clarity of the CI processes for the Tai service, enhancing overall testing and deployment workflows.
- Introduce new unit test targets for Workspace and Sandbox V2 integration in the Makefile, ensuring comprehensive testing of the new features.
- Update CI workflows to support MongoDB service for Sandbox V2 tests and improve Docker image handling.
- Implement Workspace as a first-class entity, allowing for persistent storage decoupled from container lifecycles.
- Enhance the Box struct to manage workspace IDs and update related methods for improved functionality.
- Refactor tests to accommodate new Workspace features, ensuring robust testing of the integration.
These changes significantly improve the testing framework and functionality of the Sandbox V2, enhancing the overall architecture and user experience.
- Add new test cases for VNC URL generation and connection in `box_attach_test.go`, ensuring proper functionality of VNC features.
- Update the Docker test image to include VNC desktop components, enhancing the testing environment for graphical applications.
- Modify the entrypoint script to start a virtual framebuffer and VNC server, allowing for remote desktop access during tests.
- Increase the test timeout in the Makefile to accommodate longer-running VNC tests.
These changes improve the testing framework for Sandbox V2 by integrating VNC capabilities, facilitating better testing of graphical applications.
- Add new gRPC endpoint for Heartbeat in the Yao service, enabling communication with the sandbox.
- Update Makefile to include a dedicated unit test target for Sandbox V2, ensuring proper testing of new features.
- Enhance CI workflows to incorporate Sandbox V2 tests, allowing for dual-mode testing (local and remote) with Docker.
- Modify .gitignore to exclude specific Docker files while allowing shell scripts for Sandbox V2.
- Update documentation in DESIGN.md to reflect the new architecture and capabilities of the Sandbox V2.
These changes enhance the Yao SDK's functionality, providing improved support for sandbox operations and testing.
- Add TAI_TEST_HOST_IP environment variable to CI workflows for unit tests, allowing better connectivity to the gRPC server from Docker containers.
- Update the `run.go` file to parse command-line arguments correctly.
- Modify the test utility to return the gRPC address reachable from Docker, improving integration test reliability.
- Refactor integration tests to utilize the new relay address function, ensuring proper communication with the Yao gRPC server.
These changes improve the testing framework and enhance the configuration for better service interaction during CI runs.
- Update health check messages in CI workflows to specify HTTP and gRPC readiness for the Tai service.
- Refactor integration tests to use `require` assertions instead of `assert`, improving error handling and test reliability.
- Ensure that responses from gRPC calls are not nil, enhancing test robustness.
These changes improve the clarity of service readiness checks and strengthen the integration test suite.
- Mark Phase 4 and Phase 5 as complete, indicating successful removal of fixed upstream connections and the introduction of dynamic routing based on request metadata.
- Implement `TokenManager` for handling authentication tokens and update gRPC client methods to support new features.
- Enhance tests for dynamic routing and token management, achieving significant coverage improvements.
- Begin preparations for Phase 6, outlining the structure for OAuth Device Flow and related tasks.
This commit finalizes key gRPC features and sets the stage for upcoming authentication enhancements.
- Add K8s sandbox implementation (sandbox/k8s.go) using client-go
- Extend tai.New() to support K8s runtime via Tai proxy
- Remove containerd support, fix default port assignment bug
- Update CI workflows to spin up k3d cluster and route K8s tests
through Tai proxy for full end-to-end coverage
- Make test ports configurable via environment variables
Made-with: Cursor
- Introduce new Tai SDK tests in the GitHub workflows, requiring a Tai container with Docker socket mount for execution.
- Update the Makefile to include a dedicated target for running Tai SDK tests, enhancing test coverage for the Tai integration.
- Modify the Go module dependencies to include the pierrec/lz4 package, ensuring compatibility with the new tests.
- Adjust test folder selection logic in the Makefile to exclude additional directories, streamlining the testing process.
