Runtime robustness: shell execution, safety policy, permission asks, MCP startup, and tool-call handling by alcholiclg · Pull Request #951 · modelscope/ms-agent

alcholiclg · 2026-08-27T09:00:35Z

Change Summary

Shell safety policy: quote-aware redirect parsing (fixes the false Create path outside allowed directories: /dev/null) block), heredoc bodies treated as code rather than paths, subshell/brace-group unwrapping, OS temp dir writable by default; real violations (writes outside allowed dirs, glob creates, variable-expansion targets) still refused
New ask categories: interpreter_exec for inline interpreter code (python3 -c, heredocs) — rememberable per project via "always allow"; sensitive_read for credential paths (~/.ssh/*, *.pem, …) — denied in auto mode, never rememberable, kept separate from the write-protection list so e.g. .git/config stays readable
Ask handling: interactive mode waits indefinitely; full-access times out after 25 min with feedback that marks it a timeout, not a refusal; public pending-ask APIs (is_awaiting / awaiting_request_ids / resolve_matching / cancel_pending) so front-ends stop reading private state
Shell executor: commands run verbatim in a non-login shell — python3 -V and python3 -V ; true no longer resolve different interpreters; agent-friendly environment (PAGER=cat, GIT_TERMINAL_PROMPT=0, NO_COLOR=1, …) injected unconditionally; tool description states no state persists between calls
MCP: parallel connects under per-server owner tasks (anyio-safe teardown), stdio startup timeout, per-server failure isolation; Pydantic union errors deduplicated with actionable guidance prepended
Tool calls: schema-driven coercion of string-typed numerics ("19.5" → 19.5), unique-prefix tool-name resolution with candidate suggestions on miss, read_file re-reads return content with an "unchanged" note instead of a stub
Prompting: the system prompt documents framework-managed directories (sessions/, .ms_agent/) so transcript matches are not mistaken for user content
Tests: 6 new test files + 2 extended; suite baseline unchanged (25 pre-existing env/network failures); verified end-to-end through the WebUI (approval flows, policy blocks, MCP coercion, PATH/env)

Related issue number

Checklist

The pull request title is a good summary of the changes - it will be used in the changelog
Unit tests for the changes exist
Run pre-commit install and pre-commit run --all-files before git commit, and passed lint check.
Documentation reflects the changes where applicable

…openai-compat transport

…laying

…x/runtime-robustness

…asks at once

… the batch

The orchestrator now owns the write discipline around a backend: - schedule_add() runs the extraction-LLM + embedding cost (seconds) in a background task; flush_pending() is the teardown barrier so the last write is never dropped, and an inline fallback keeps writes when no loop is running. - retrieval/ingestion/flush serialize on one per-store asyncio lock (embedded qdrant underneath is lock-free single-client code). - a content-hash delta ledger (<base_dir>/ingest_state.json) makes each ingest send only messages the store has not seen; hashes are recorded only after a confirmed write, so a failed ingest retries naturally. - ingest_status reports the last outcome (state/count/error/pending) so a UI can show memory working instead of silence. Mem0Backend: per-turn retrieval cache (rounds 2..N of a tool-calling turn reuse round 1's search instead of paying an embedding round-trip each), on_messages returns the event count and propagates failures -- the orchestrator is the swallow-and-report layer now and needs the exception to keep failed messages un-marked for retry.

…-side close - add_memory(add_after_step) now fires only when a round closes the turn (assistant reply with no tool calls) and dispatches through the backend's schedule_add when available: tool rounds are intermediate state, and ingesting every round cost O(rounds x history) extraction calls where the closing ingest covers the whole turn. - an interrupted round advances the ingest ledger WITHOUT ingesting (mark_ingested): a half-finished answer is not durable conversational truth and must not be swept into the next turn's delta. - cleanup_tools drains scheduled ingestion (flush only -- memory instances are shared across agents of one store, so closing here would yank the store from a sibling agent); the new SharedMemoryManager.close_matching(base_dir) is the owner-of-last- resort that actually closes instances and releases the embedded store's exclusive file lock.

The number of recalled memories injected per turn was hardcoded twice (search default 20, then a [:10] formatting slice). MemoryConfig gains recall_top_k (default 10, read from the unified_memory node) and the mem0 adapter threads it through search and formatting — consumers can now size recall to their context budget.

…E) instead of scattered config fields, gated by personalization.enabled. When those files change mid-conversation the next user turn carries a durable <system-reminder> naming them, so the model can tell a changed file from its own faulty memory.

…end's MEMORY.md snapshot in step with edits made outside the agent. Also translates the memory tool descriptions and prompt headings to English.

…fig patch once instead of twice.

# Conflicts: # .gitignore # ms_agent/memory/unified/backends/mem0_adapter.py # ms_agent/memory/unified/orchestrator.py # setup.py

…ts last entry deleted, instead of leaving the previous round's block in place.

- an interrupt marks only its own round, and never messages a scheduled ingest still owns (both lost the write silently) - one shared instance per store, not per model, reconfigured in place - close() is terminal: a straggler can no longer reopen a released store - the store lock is per (loop, path), and search() takes it too - search() honours its limit; injected memories carry their date - memories are written in the language the user used

# Conflicts: # ms_agent/memory/unified/backends/mem0_adapter.py

…ters Thinking support is per-model with no naming rule, and an unsupported model may reject the whole request (DashScope returns 400) instead of ignoring the flag. So we ask, and on a refusal retry once with it off, remembering the model.

…g dialect

…t do different jobs

…orwards, and read OpenRouter's reasoning field

…f a smaller invented one

…dpoints reject

…reads back

…the command the user approved

…gerous

…ally uses

…a text file listing

…o a vision-disabled model neither claims nor disowns them

…x/runtime-robustness # Conflicts: # ms_agent/agent/llm_agent.py # ms_agent/memory/unified/backends/mem0_adapter.py # ms_agent/memory/unified/orchestrator.py

…tover credentials in the environment

…hat arrive mid-stream - images go out only when the model's own switch says so; a provider's declared vision capability no longer implies it - a 400 delivered on the first streamed chunk is repaired like an eager one - thinking refusals are repaired on the Anthropic and Responses paths too - a tool call the model is still writing is reported instead of nothing at all - an unreadable managed MCP config is logged instead of silently yielding none

… tell the agent why a search failed instead of reporting no results

…ps cutting structured results into invalid JSON

…x/runtime-robustness

…TTP client fail to construct

… and gate interpreter execution and credential reads behind mode-aware asks

… unique tool-name prefixes, and return content instead of a stub on unchanged re-reads

…-friendly environment unconditionally

…io startup timeouts and per-server failure isolation

…ranscript matches are not mistaken for user content

…x/runtime-robustness

alcholiclg · 2026-08-27T09:00:35Z

Change Summary

Shell safety policy: quote-aware redirect parsing (fixes the false Create path outside allowed directories: /dev/null) block), heredoc bodies treated as code rather than paths, subshell/brace-group unwrapping, OS temp dir writable by default; real violations (writes outside allowed dirs, glob creates, variable-expansion targets) still refused
New ask categories: interpreter_exec for inline interpreter code (python3 -c, heredocs) — rememberable per project via "always allow"; sensitive_read for credential paths (~/.ssh/*, *.pem, …) — denied in auto mode, never rememberable, kept separate from the write-protection list so e.g. .git/config stays readable
Ask handling: interactive mode waits indefinitely; full-access times out after 25 min with feedback that marks it a timeout, not a refusal; public pending-ask APIs (is_awaiting / awaiting_request_ids / resolve_matching / cancel_pending) so front-ends stop reading private state
Shell executor: commands run verbatim in a non-login shell — python3 -V and python3 -V ; true no longer resolve different interpreters; agent-friendly environment (PAGER=cat, GIT_TERMINAL_PROMPT=0, NO_COLOR=1, …) injected unconditionally; tool description states no state persists between calls
MCP: parallel connects under per-server owner tasks (anyio-safe teardown), stdio startup timeout, per-server failure isolation; Pydantic union errors deduplicated with actionable guidance prepended
Tool calls: schema-driven coercion of string-typed numerics ("19.5" → 19.5), unique-prefix tool-name resolution with candidate suggestions on miss, read_file re-reads return content with an "unchanged" note instead of a stub
Prompting: the system prompt documents framework-managed directories (sessions/, .ms_agent/) so transcript matches are not mistaken for user content
Tests: 6 new test files + 2 extended; suite baseline unchanged (25 pre-existing env/network failures); verified end-to-end through the WebUI (approval flows, policy blocks, MCP coercion, PATH/env)

Related issue number

Checklist

The pull request title is a good summary of the changes - it will be used in the changelog
Unit tests for the changes exist
Run pre-commit install and pre-commit run --all-files before git commit, and passed lint check.
Documentation reflects the changes where applicable

…openai-compat transport

…laying

…x/runtime-robustness

…asks at once

… the batch

The orchestrator now owns the write discipline around a backend: - schedule_add() runs the extraction-LLM + embedding cost (seconds) in a background task; flush_pending() is the teardown barrier so the last write is never dropped, and an inline fallback keeps writes when no loop is running. - retrieval/ingestion/flush serialize on one per-store asyncio lock (embedded qdrant underneath is lock-free single-client code). - a content-hash delta ledger (<base_dir>/ingest_state.json) makes each ingest send only messages the store has not seen; hashes are recorded only after a confirmed write, so a failed ingest retries naturally. - ingest_status reports the last outcome (state/count/error/pending) so a UI can show memory working instead of silence. Mem0Backend: per-turn retrieval cache (rounds 2..N of a tool-calling turn reuse round 1's search instead of paying an embedding round-trip each), on_messages returns the event count and propagates failures -- the orchestrator is the swallow-and-report layer now and needs the exception to keep failed messages un-marked for retry.

…-side close - add_memory(add_after_step) now fires only when a round closes the turn (assistant reply with no tool calls) and dispatches through the backend's schedule_add when available: tool rounds are intermediate state, and ingesting every round cost O(rounds x history) extraction calls where the closing ingest covers the whole turn. - an interrupted round advances the ingest ledger WITHOUT ingesting (mark_ingested): a half-finished answer is not durable conversational truth and must not be swept into the next turn's delta. - cleanup_tools drains scheduled ingestion (flush only -- memory instances are shared across agents of one store, so closing here would yank the store from a sibling agent); the new SharedMemoryManager.close_matching(base_dir) is the owner-of-last- resort that actually closes instances and releases the embedded store's exclusive file lock.

The number of recalled memories injected per turn was hardcoded twice (search default 20, then a [:10] formatting slice). MemoryConfig gains recall_top_k (default 10, read from the unified_memory node) and the mem0 adapter threads it through search and formatting — consumers can now size recall to their context budget.

…E) instead of scattered config fields, gated by personalization.enabled. When those files change mid-conversation the next user turn carries a durable <system-reminder> naming them, so the model can tell a changed file from its own faulty memory.

…end's MEMORY.md snapshot in step with edits made outside the agent. Also translates the memory tool descriptions and prompt headings to English.

…fig patch once instead of twice.

# Conflicts: # .gitignore # ms_agent/memory/unified/backends/mem0_adapter.py # ms_agent/memory/unified/orchestrator.py # setup.py

…ts last entry deleted, instead of leaving the previous round's block in place.

- an interrupt marks only its own round, and never messages a scheduled ingest still owns (both lost the write silently) - one shared instance per store, not per model, reconfigured in place - close() is terminal: a straggler can no longer reopen a released store - the store lock is per (loop, path), and search() takes it too - search() honours its limit; injected memories carry their date - memories are written in the language the user used

# Conflicts: # ms_agent/memory/unified/backends/mem0_adapter.py

…ters Thinking support is per-model with no naming rule, and an unsupported model may reject the whole request (DashScope returns 400) instead of ignoring the flag. So we ask, and on a refusal retry once with it off, remembering the model.

…g dialect

…t do different jobs

…orwards, and read OpenRouter's reasoning field

…f a smaller invented one

…dpoints reject

…reads back

…the command the user approved

…gerous

…ally uses

…a text file listing

…o a vision-disabled model neither claims nor disowns them

…x/runtime-robustness # Conflicts: # ms_agent/agent/llm_agent.py # ms_agent/memory/unified/backends/mem0_adapter.py # ms_agent/memory/unified/orchestrator.py

…tover credentials in the environment

…hat arrive mid-stream - images go out only when the model's own switch says so; a provider's declared vision capability no longer implies it - a 400 delivered on the first streamed chunk is repaired like an eager one - thinking refusals are repaired on the Anthropic and Responses paths too - a tool call the model is still writing is reported instead of nothing at all - an unreadable managed MCP config is logged instead of silently yielding none

… tell the agent why a search failed instead of reporting no results

…ps cutting structured results into invalid JSON

…x/runtime-robustness

…TTP client fail to construct

… and gate interpreter execution and credential reads behind mode-aware asks

… unique tool-name prefixes, and return content instead of a stub on unchanged re-reads

…-friendly environment unconditionally

…io startup timeouts and per-server failure isolation

…ranscript matches are not mistaken for user content

…x/runtime-robustness

alcholiclg · 2026-08-27T09:00:35Z

Change Summary

Shell safety policy: quote-aware redirect parsing (fixes the false Create path outside allowed directories: /dev/null) block), heredoc bodies treated as code rather than paths, subshell/brace-group unwrapping, OS temp dir writable by default; real violations (writes outside allowed dirs, glob creates, variable-expansion targets) still refused
New ask categories: interpreter_exec for inline interpreter code (python3 -c, heredocs) — rememberable per project via "always allow"; sensitive_read for credential paths (~/.ssh/*, *.pem, …) — denied in auto mode, never rememberable, kept separate from the write-protection list so e.g. .git/config stays readable
Ask handling: interactive mode waits indefinitely; full-access times out after 25 min with feedback that marks it a timeout, not a refusal; public pending-ask APIs (is_awaiting / awaiting_request_ids / resolve_matching / cancel_pending) so front-ends stop reading private state
Shell executor: commands run verbatim in a non-login shell — python3 -V and python3 -V ; true no longer resolve different interpreters; agent-friendly environment (PAGER=cat, GIT_TERMINAL_PROMPT=0, NO_COLOR=1, …) injected unconditionally; tool description states no state persists between calls
MCP: parallel connects under per-server owner tasks (anyio-safe teardown), stdio startup timeout, per-server failure isolation; Pydantic union errors deduplicated with actionable guidance prepended
Tool calls: schema-driven coercion of string-typed numerics ("19.5" → 19.5), unique-prefix tool-name resolution with candidate suggestions on miss, read_file re-reads return content with an "unchanged" note instead of a stub
Prompting: the system prompt documents framework-managed directories (sessions/, .ms_agent/) so transcript matches are not mistaken for user content
Tests: 6 new test files + 2 extended; suite baseline unchanged (25 pre-existing env/network failures); verified end-to-end through the WebUI (approval flows, policy blocks, MCP coercion, PATH/env)

Related issue number

Checklist

The pull request title is a good summary of the changes - it will be used in the changelog
Unit tests for the changes exist
Run pre-commit install and pre-commit run --all-files before git commit, and passed lint check.
Documentation reflects the changes where applicable

…openai-compat transport

…laying

…x/runtime-robustness

…asks at once

… the batch

The orchestrator now owns the write discipline around a backend: - schedule_add() runs the extraction-LLM + embedding cost (seconds) in a background task; flush_pending() is the teardown barrier so the last write is never dropped, and an inline fallback keeps writes when no loop is running. - retrieval/ingestion/flush serialize on one per-store asyncio lock (embedded qdrant underneath is lock-free single-client code). - a content-hash delta ledger (<base_dir>/ingest_state.json) makes each ingest send only messages the store has not seen; hashes are recorded only after a confirmed write, so a failed ingest retries naturally. - ingest_status reports the last outcome (state/count/error/pending) so a UI can show memory working instead of silence. Mem0Backend: per-turn retrieval cache (rounds 2..N of a tool-calling turn reuse round 1's search instead of paying an embedding round-trip each), on_messages returns the event count and propagates failures -- the orchestrator is the swallow-and-report layer now and needs the exception to keep failed messages un-marked for retry.

…-side close - add_memory(add_after_step) now fires only when a round closes the turn (assistant reply with no tool calls) and dispatches through the backend's schedule_add when available: tool rounds are intermediate state, and ingesting every round cost O(rounds x history) extraction calls where the closing ingest covers the whole turn. - an interrupted round advances the ingest ledger WITHOUT ingesting (mark_ingested): a half-finished answer is not durable conversational truth and must not be swept into the next turn's delta. - cleanup_tools drains scheduled ingestion (flush only -- memory instances are shared across agents of one store, so closing here would yank the store from a sibling agent); the new SharedMemoryManager.close_matching(base_dir) is the owner-of-last- resort that actually closes instances and releases the embedded store's exclusive file lock.

The number of recalled memories injected per turn was hardcoded twice (search default 20, then a [:10] formatting slice). MemoryConfig gains recall_top_k (default 10, read from the unified_memory node) and the mem0 adapter threads it through search and formatting — consumers can now size recall to their context budget.

…E) instead of scattered config fields, gated by personalization.enabled. When those files change mid-conversation the next user turn carries a durable <system-reminder> naming them, so the model can tell a changed file from its own faulty memory.

…end's MEMORY.md snapshot in step with edits made outside the agent. Also translates the memory tool descriptions and prompt headings to English.

…fig patch once instead of twice.

# Conflicts: # .gitignore # ms_agent/memory/unified/backends/mem0_adapter.py # ms_agent/memory/unified/orchestrator.py # setup.py

…ts last entry deleted, instead of leaving the previous round's block in place.

- an interrupt marks only its own round, and never messages a scheduled ingest still owns (both lost the write silently) - one shared instance per store, not per model, reconfigured in place - close() is terminal: a straggler can no longer reopen a released store - the store lock is per (loop, path), and search() takes it too - search() honours its limit; injected memories carry their date - memories are written in the language the user used

# Conflicts: # ms_agent/memory/unified/backends/mem0_adapter.py

…ters Thinking support is per-model with no naming rule, and an unsupported model may reject the whole request (DashScope returns 400) instead of ignoring the flag. So we ask, and on a refusal retry once with it off, remembering the model.

…g dialect

…t do different jobs

…orwards, and read OpenRouter's reasoning field

…f a smaller invented one

…dpoints reject

…reads back

…the command the user approved

…gerous

…ally uses

…a text file listing

…o a vision-disabled model neither claims nor disowns them

…x/runtime-robustness # Conflicts: # ms_agent/agent/llm_agent.py # ms_agent/memory/unified/backends/mem0_adapter.py # ms_agent/memory/unified/orchestrator.py

…tover credentials in the environment

…hat arrive mid-stream - images go out only when the model's own switch says so; a provider's declared vision capability no longer implies it - a 400 delivered on the first streamed chunk is repaired like an eager one - thinking refusals are repaired on the Anthropic and Responses paths too - a tool call the model is still writing is reported instead of nothing at all - an unreadable managed MCP config is logged instead of silently yielding none

… tell the agent why a search failed instead of reporting no results

…ps cutting structured results into invalid JSON

…x/runtime-robustness

…TTP client fail to construct

… and gate interpreter execution and credential reads behind mode-aware asks

… unique tool-name prefixes, and return content instead of a stub on unchanged re-reads

…-friendly environment unconditionally

…io startup timeouts and per-server failure isolation

…ranscript matches are not mistaken for user content

…x/runtime-robustness

alcholiclg · 2026-08-27T09:00:35Z

Change Summary

Shell safety policy: quote-aware redirect parsing (fixes the false Create path outside allowed directories: /dev/null) block), heredoc bodies treated as code rather than paths, subshell/brace-group unwrapping, OS temp dir writable by default; real violations (writes outside allowed dirs, glob creates, variable-expansion targets) still refused
New ask categories: interpreter_exec for inline interpreter code (python3 -c, heredocs) — rememberable per project via "always allow"; sensitive_read for credential paths (~/.ssh/*, *.pem, …) — denied in auto mode, never rememberable, kept separate from the write-protection list so e.g. .git/config stays readable
Ask handling: interactive mode waits indefinitely; full-access times out after 25 min with feedback that marks it a timeout, not a refusal; public pending-ask APIs (is_awaiting / awaiting_request_ids / resolve_matching / cancel_pending) so front-ends stop reading private state
Shell executor: commands run verbatim in a non-login shell — python3 -V and python3 -V ; true no longer resolve different interpreters; agent-friendly environment (PAGER=cat, GIT_TERMINAL_PROMPT=0, NO_COLOR=1, …) injected unconditionally; tool description states no state persists between calls
MCP: parallel connects under per-server owner tasks (anyio-safe teardown), stdio startup timeout, per-server failure isolation; Pydantic union errors deduplicated with actionable guidance prepended
Tool calls: schema-driven coercion of string-typed numerics ("19.5" → 19.5), unique-prefix tool-name resolution with candidate suggestions on miss, read_file re-reads return content with an "unchanged" note instead of a stub
Prompting: the system prompt documents framework-managed directories (sessions/, .ms_agent/) so transcript matches are not mistaken for user content
Tests: 6 new test files + 2 extended; suite baseline unchanged (25 pre-existing env/network failures); verified end-to-end through the WebUI (approval flows, policy blocks, MCP coercion, PATH/env)

Related issue number

Checklist

The pull request title is a good summary of the changes - it will be used in the changelog
Unit tests for the changes exist
Run pre-commit install and pre-commit run --all-files before git commit, and passed lint check.
Documentation reflects the changes where applicable

…openai-compat transport

…laying

…x/runtime-robustness

…asks at once

… the batch

The orchestrator now owns the write discipline around a backend: - schedule_add() runs the extraction-LLM + embedding cost (seconds) in a background task; flush_pending() is the teardown barrier so the last write is never dropped, and an inline fallback keeps writes when no loop is running. - retrieval/ingestion/flush serialize on one per-store asyncio lock (embedded qdrant underneath is lock-free single-client code). - a content-hash delta ledger (<base_dir>/ingest_state.json) makes each ingest send only messages the store has not seen; hashes are recorded only after a confirmed write, so a failed ingest retries naturally. - ingest_status reports the last outcome (state/count/error/pending) so a UI can show memory working instead of silence. Mem0Backend: per-turn retrieval cache (rounds 2..N of a tool-calling turn reuse round 1's search instead of paying an embedding round-trip each), on_messages returns the event count and propagates failures -- the orchestrator is the swallow-and-report layer now and needs the exception to keep failed messages un-marked for retry.

…-side close - add_memory(add_after_step) now fires only when a round closes the turn (assistant reply with no tool calls) and dispatches through the backend's schedule_add when available: tool rounds are intermediate state, and ingesting every round cost O(rounds x history) extraction calls where the closing ingest covers the whole turn. - an interrupted round advances the ingest ledger WITHOUT ingesting (mark_ingested): a half-finished answer is not durable conversational truth and must not be swept into the next turn's delta. - cleanup_tools drains scheduled ingestion (flush only -- memory instances are shared across agents of one store, so closing here would yank the store from a sibling agent); the new SharedMemoryManager.close_matching(base_dir) is the owner-of-last- resort that actually closes instances and releases the embedded store's exclusive file lock.

The number of recalled memories injected per turn was hardcoded twice (search default 20, then a [:10] formatting slice). MemoryConfig gains recall_top_k (default 10, read from the unified_memory node) and the mem0 adapter threads it through search and formatting — consumers can now size recall to their context budget.

…E) instead of scattered config fields, gated by personalization.enabled. When those files change mid-conversation the next user turn carries a durable <system-reminder> naming them, so the model can tell a changed file from its own faulty memory.

…end's MEMORY.md snapshot in step with edits made outside the agent. Also translates the memory tool descriptions and prompt headings to English.

…fig patch once instead of twice.

# Conflicts: # .gitignore # ms_agent/memory/unified/backends/mem0_adapter.py # ms_agent/memory/unified/orchestrator.py # setup.py

…ts last entry deleted, instead of leaving the previous round's block in place.

- an interrupt marks only its own round, and never messages a scheduled ingest still owns (both lost the write silently) - one shared instance per store, not per model, reconfigured in place - close() is terminal: a straggler can no longer reopen a released store - the store lock is per (loop, path), and search() takes it too - search() honours its limit; injected memories carry their date - memories are written in the language the user used

# Conflicts: # ms_agent/memory/unified/backends/mem0_adapter.py

…ters Thinking support is per-model with no naming rule, and an unsupported model may reject the whole request (DashScope returns 400) instead of ignoring the flag. So we ask, and on a refusal retry once with it off, remembering the model.

…g dialect

…t do different jobs

…orwards, and read OpenRouter's reasoning field

…f a smaller invented one

…dpoints reject

…reads back

…the command the user approved

…gerous

…ally uses

…a text file listing

…o a vision-disabled model neither claims nor disowns them

…x/runtime-robustness # Conflicts: # ms_agent/agent/llm_agent.py # ms_agent/memory/unified/backends/mem0_adapter.py # ms_agent/memory/unified/orchestrator.py

…tover credentials in the environment

…hat arrive mid-stream - images go out only when the model's own switch says so; a provider's declared vision capability no longer implies it - a 400 delivered on the first streamed chunk is repaired like an eager one - thinking refusals are repaired on the Anthropic and Responses paths too - a tool call the model is still writing is reported instead of nothing at all - an unreadable managed MCP config is logged instead of silently yielding none

… tell the agent why a search failed instead of reporting no results

…ps cutting structured results into invalid JSON

…x/runtime-robustness

…TTP client fail to construct

… and gate interpreter execution and credential reads behind mode-aware asks

… unique tool-name prefixes, and return content instead of a stub on unchanged re-reads

…-friendly environment unconditionally

…io startup timeouts and per-server failure isolation

…ranscript matches are not mistaken for user content

…x/runtime-robustness

alcholiclg · 2026-08-27T09:00:35Z

Change Summary

Shell safety policy: quote-aware redirect parsing (fixes the false Create path outside allowed directories: /dev/null) block), heredoc bodies treated as code rather than paths, subshell/brace-group unwrapping, OS temp dir writable by default; real violations (writes outside allowed dirs, glob creates, variable-expansion targets) still refused
New ask categories: interpreter_exec for inline interpreter code (python3 -c, heredocs) — rememberable per project via "always allow"; sensitive_read for credential paths (~/.ssh/*, *.pem, …) — denied in auto mode, never rememberable, kept separate from the write-protection list so e.g. .git/config stays readable
Ask handling: interactive mode waits indefinitely; full-access times out after 25 min with feedback that marks it a timeout, not a refusal; public pending-ask APIs (is_awaiting / awaiting_request_ids / resolve_matching / cancel_pending) so front-ends stop reading private state
Shell executor: commands run verbatim in a non-login shell — python3 -V and python3 -V ; true no longer resolve different interpreters; agent-friendly environment (PAGER=cat, GIT_TERMINAL_PROMPT=0, NO_COLOR=1, …) injected unconditionally; tool description states no state persists between calls
MCP: parallel connects under per-server owner tasks (anyio-safe teardown), stdio startup timeout, per-server failure isolation; Pydantic union errors deduplicated with actionable guidance prepended
Tool calls: schema-driven coercion of string-typed numerics ("19.5" → 19.5), unique-prefix tool-name resolution with candidate suggestions on miss, read_file re-reads return content with an "unchanged" note instead of a stub
Prompting: the system prompt documents framework-managed directories (sessions/, .ms_agent/) so transcript matches are not mistaken for user content
Tests: 6 new test files + 2 extended; suite baseline unchanged (25 pre-existing env/network failures); verified end-to-end through the WebUI (approval flows, policy blocks, MCP coercion, PATH/env)

Related issue number

Checklist

The pull request title is a good summary of the changes - it will be used in the changelog
Unit tests for the changes exist
Run pre-commit install and pre-commit run --all-files before git commit, and passed lint check.
Documentation reflects the changes where applicable

…openai-compat transport

…laying

…x/runtime-robustness

…asks at once

… the batch

The orchestrator now owns the write discipline around a backend: - schedule_add() runs the extraction-LLM + embedding cost (seconds) in a background task; flush_pending() is the teardown barrier so the last write is never dropped, and an inline fallback keeps writes when no loop is running. - retrieval/ingestion/flush serialize on one per-store asyncio lock (embedded qdrant underneath is lock-free single-client code). - a content-hash delta ledger (<base_dir>/ingest_state.json) makes each ingest send only messages the store has not seen; hashes are recorded only after a confirmed write, so a failed ingest retries naturally. - ingest_status reports the last outcome (state/count/error/pending) so a UI can show memory working instead of silence. Mem0Backend: per-turn retrieval cache (rounds 2..N of a tool-calling turn reuse round 1's search instead of paying an embedding round-trip each), on_messages returns the event count and propagates failures -- the orchestrator is the swallow-and-report layer now and needs the exception to keep failed messages un-marked for retry.

…-side close - add_memory(add_after_step) now fires only when a round closes the turn (assistant reply with no tool calls) and dispatches through the backend's schedule_add when available: tool rounds are intermediate state, and ingesting every round cost O(rounds x history) extraction calls where the closing ingest covers the whole turn. - an interrupted round advances the ingest ledger WITHOUT ingesting (mark_ingested): a half-finished answer is not durable conversational truth and must not be swept into the next turn's delta. - cleanup_tools drains scheduled ingestion (flush only -- memory instances are shared across agents of one store, so closing here would yank the store from a sibling agent); the new SharedMemoryManager.close_matching(base_dir) is the owner-of-last- resort that actually closes instances and releases the embedded store's exclusive file lock.

The number of recalled memories injected per turn was hardcoded twice (search default 20, then a [:10] formatting slice). MemoryConfig gains recall_top_k (default 10, read from the unified_memory node) and the mem0 adapter threads it through search and formatting — consumers can now size recall to their context budget.

…E) instead of scattered config fields, gated by personalization.enabled. When those files change mid-conversation the next user turn carries a durable <system-reminder> naming them, so the model can tell a changed file from its own faulty memory.

…end's MEMORY.md snapshot in step with edits made outside the agent. Also translates the memory tool descriptions and prompt headings to English.

…fig patch once instead of twice.

# Conflicts: # .gitignore # ms_agent/memory/unified/backends/mem0_adapter.py # ms_agent/memory/unified/orchestrator.py # setup.py

…ts last entry deleted, instead of leaving the previous round's block in place.

- an interrupt marks only its own round, and never messages a scheduled ingest still owns (both lost the write silently) - one shared instance per store, not per model, reconfigured in place - close() is terminal: a straggler can no longer reopen a released store - the store lock is per (loop, path), and search() takes it too - search() honours its limit; injected memories carry their date - memories are written in the language the user used

# Conflicts: # ms_agent/memory/unified/backends/mem0_adapter.py

…ters Thinking support is per-model with no naming rule, and an unsupported model may reject the whole request (DashScope returns 400) instead of ignoring the flag. So we ask, and on a refusal retry once with it off, remembering the model.

…g dialect

…t do different jobs

…orwards, and read OpenRouter's reasoning field

…f a smaller invented one

…dpoints reject

…reads back

…the command the user approved

…gerous

…ally uses

…a text file listing

…o a vision-disabled model neither claims nor disowns them

…x/runtime-robustness # Conflicts: # ms_agent/agent/llm_agent.py # ms_agent/memory/unified/backends/mem0_adapter.py # ms_agent/memory/unified/orchestrator.py

…tover credentials in the environment

…hat arrive mid-stream - images go out only when the model's own switch says so; a provider's declared vision capability no longer implies it - a 400 delivered on the first streamed chunk is repaired like an eager one - thinking refusals are repaired on the Anthropic and Responses paths too - a tool call the model is still writing is reported instead of nothing at all - an unreadable managed MCP config is logged instead of silently yielding none

… tell the agent why a search failed instead of reporting no results

…ps cutting structured results into invalid JSON

…x/runtime-robustness

…TTP client fail to construct

… and gate interpreter execution and credential reads behind mode-aware asks

… unique tool-name prefixes, and return content instead of a stub on unchanged re-reads

…-friendly environment unconditionally

…io startup timeouts and per-server failure isolation

…ranscript matches are not mistaken for user content

…x/runtime-robustness

alcholiclg · 2026-08-27T09:00:35Z

Change Summary

Shell safety policy: quote-aware redirect parsing (fixes the false Create path outside allowed directories: /dev/null) block), heredoc bodies treated as code rather than paths, subshell/brace-group unwrapping, OS temp dir writable by default; real violations (writes outside allowed dirs, glob creates, variable-expansion targets) still refused
New ask categories: interpreter_exec for inline interpreter code (python3 -c, heredocs) — rememberable per project via "always allow"; sensitive_read for credential paths (~/.ssh/*, *.pem, …) — denied in auto mode, never rememberable, kept separate from the write-protection list so e.g. .git/config stays readable
Ask handling: interactive mode waits indefinitely; full-access times out after 25 min with feedback that marks it a timeout, not a refusal; public pending-ask APIs (is_awaiting / awaiting_request_ids / resolve_matching / cancel_pending) so front-ends stop reading private state
Shell executor: commands run verbatim in a non-login shell — python3 -V and python3 -V ; true no longer resolve different interpreters; agent-friendly environment (PAGER=cat, GIT_TERMINAL_PROMPT=0, NO_COLOR=1, …) injected unconditionally; tool description states no state persists between calls
MCP: parallel connects under per-server owner tasks (anyio-safe teardown), stdio startup timeout, per-server failure isolation; Pydantic union errors deduplicated with actionable guidance prepended
Tool calls: schema-driven coercion of string-typed numerics ("19.5" → 19.5), unique-prefix tool-name resolution with candidate suggestions on miss, read_file re-reads return content with an "unchanged" note instead of a stub
Prompting: the system prompt documents framework-managed directories (sessions/, .ms_agent/) so transcript matches are not mistaken for user content
Tests: 6 new test files + 2 extended; suite baseline unchanged (25 pre-existing env/network failures); verified end-to-end through the WebUI (approval flows, policy blocks, MCP coercion, PATH/env)

Related issue number

Checklist

The pull request title is a good summary of the changes - it will be used in the changelog
Unit tests for the changes exist
Run pre-commit install and pre-commit run --all-files before git commit, and passed lint check.
Documentation reflects the changes where applicable

…openai-compat transport

…laying

…x/runtime-robustness

…asks at once

… the batch

The orchestrator now owns the write discipline around a backend: - schedule_add() runs the extraction-LLM + embedding cost (seconds) in a background task; flush_pending() is the teardown barrier so the last write is never dropped, and an inline fallback keeps writes when no loop is running. - retrieval/ingestion/flush serialize on one per-store asyncio lock (embedded qdrant underneath is lock-free single-client code). - a content-hash delta ledger (<base_dir>/ingest_state.json) makes each ingest send only messages the store has not seen; hashes are recorded only after a confirmed write, so a failed ingest retries naturally. - ingest_status reports the last outcome (state/count/error/pending) so a UI can show memory working instead of silence. Mem0Backend: per-turn retrieval cache (rounds 2..N of a tool-calling turn reuse round 1's search instead of paying an embedding round-trip each), on_messages returns the event count and propagates failures -- the orchestrator is the swallow-and-report layer now and needs the exception to keep failed messages un-marked for retry.

…-side close - add_memory(add_after_step) now fires only when a round closes the turn (assistant reply with no tool calls) and dispatches through the backend's schedule_add when available: tool rounds are intermediate state, and ingesting every round cost O(rounds x history) extraction calls where the closing ingest covers the whole turn. - an interrupted round advances the ingest ledger WITHOUT ingesting (mark_ingested): a half-finished answer is not durable conversational truth and must not be swept into the next turn's delta. - cleanup_tools drains scheduled ingestion (flush only -- memory instances are shared across agents of one store, so closing here would yank the store from a sibling agent); the new SharedMemoryManager.close_matching(base_dir) is the owner-of-last- resort that actually closes instances and releases the embedded store's exclusive file lock.

The number of recalled memories injected per turn was hardcoded twice (search default 20, then a [:10] formatting slice). MemoryConfig gains recall_top_k (default 10, read from the unified_memory node) and the mem0 adapter threads it through search and formatting — consumers can now size recall to their context budget.

…E) instead of scattered config fields, gated by personalization.enabled. When those files change mid-conversation the next user turn carries a durable <system-reminder> naming them, so the model can tell a changed file from its own faulty memory.

…end's MEMORY.md snapshot in step with edits made outside the agent. Also translates the memory tool descriptions and prompt headings to English.

…fig patch once instead of twice.

# Conflicts: # .gitignore # ms_agent/memory/unified/backends/mem0_adapter.py # ms_agent/memory/unified/orchestrator.py # setup.py

…ts last entry deleted, instead of leaving the previous round's block in place.

- an interrupt marks only its own round, and never messages a scheduled ingest still owns (both lost the write silently) - one shared instance per store, not per model, reconfigured in place - close() is terminal: a straggler can no longer reopen a released store - the store lock is per (loop, path), and search() takes it too - search() honours its limit; injected memories carry their date - memories are written in the language the user used

# Conflicts: # ms_agent/memory/unified/backends/mem0_adapter.py

…ters Thinking support is per-model with no naming rule, and an unsupported model may reject the whole request (DashScope returns 400) instead of ignoring the flag. So we ask, and on a refusal retry once with it off, remembering the model.

…g dialect

…t do different jobs

…orwards, and read OpenRouter's reasoning field

…f a smaller invented one

…dpoints reject

…reads back

…the command the user approved

…gerous

…ally uses

…a text file listing

…o a vision-disabled model neither claims nor disowns them

…x/runtime-robustness # Conflicts: # ms_agent/agent/llm_agent.py # ms_agent/memory/unified/backends/mem0_adapter.py # ms_agent/memory/unified/orchestrator.py

…tover credentials in the environment

…hat arrive mid-stream - images go out only when the model's own switch says so; a provider's declared vision capability no longer implies it - a 400 delivered on the first streamed chunk is repaired like an eager one - thinking refusals are repaired on the Anthropic and Responses paths too - a tool call the model is still writing is reported instead of nothing at all - an unreadable managed MCP config is logged instead of silently yielding none

… tell the agent why a search failed instead of reporting no results

…ps cutting structured results into invalid JSON

…x/runtime-robustness

…TTP client fail to construct

… and gate interpreter execution and credential reads behind mode-aware asks

… unique tool-name prefixes, and return content instead of a stub on unchanged re-reads

…-friendly environment unconditionally

…io startup timeouts and per-server failure isolation

…ranscript matches are not mistaken for user content

…x/runtime-robustness

alcholiclg · 2026-08-27T09:00:35Z

Change Summary

Shell safety policy: quote-aware redirect parsing (fixes the false Create path outside allowed directories: /dev/null) block), heredoc bodies treated as code rather than paths, subshell/brace-group unwrapping, OS temp dir writable by default; real violations (writes outside allowed dirs, glob creates, variable-expansion targets) still refused
New ask categories: interpreter_exec for inline interpreter code (python3 -c, heredocs) — rememberable per project via "always allow"; sensitive_read for credential paths (~/.ssh/*, *.pem, …) — denied in auto mode, never rememberable, kept separate from the write-protection list so e.g. .git/config stays readable
Ask handling: interactive mode waits indefinitely; full-access times out after 25 min with feedback that marks it a timeout, not a refusal; public pending-ask APIs (is_awaiting / awaiting_request_ids / resolve_matching / cancel_pending) so front-ends stop reading private state
Shell executor: commands run verbatim in a non-login shell — python3 -V and python3 -V ; true no longer resolve different interpreters; agent-friendly environment (PAGER=cat, GIT_TERMINAL_PROMPT=0, NO_COLOR=1, …) injected unconditionally; tool description states no state persists between calls
MCP: parallel connects under per-server owner tasks (anyio-safe teardown), stdio startup timeout, per-server failure isolation; Pydantic union errors deduplicated with actionable guidance prepended
Tool calls: schema-driven coercion of string-typed numerics ("19.5" → 19.5), unique-prefix tool-name resolution with candidate suggestions on miss, read_file re-reads return content with an "unchanged" note instead of a stub
Prompting: the system prompt documents framework-managed directories (sessions/, .ms_agent/) so transcript matches are not mistaken for user content
Tests: 6 new test files + 2 extended; suite baseline unchanged (25 pre-existing env/network failures); verified end-to-end through the WebUI (approval flows, policy blocks, MCP coercion, PATH/env)

Related issue number

Checklist

The pull request title is a good summary of the changes - it will be used in the changelog
Unit tests for the changes exist
Run pre-commit install and pre-commit run --all-files before git commit, and passed lint check.
Documentation reflects the changes where applicable

…openai-compat transport

…laying

…x/runtime-robustness

…asks at once

… the batch

The orchestrator now owns the write discipline around a backend: - schedule_add() runs the extraction-LLM + embedding cost (seconds) in a background task; flush_pending() is the teardown barrier so the last write is never dropped, and an inline fallback keeps writes when no loop is running. - retrieval/ingestion/flush serialize on one per-store asyncio lock (embedded qdrant underneath is lock-free single-client code). - a content-hash delta ledger (<base_dir>/ingest_state.json) makes each ingest send only messages the store has not seen; hashes are recorded only after a confirmed write, so a failed ingest retries naturally. - ingest_status reports the last outcome (state/count/error/pending) so a UI can show memory working instead of silence. Mem0Backend: per-turn retrieval cache (rounds 2..N of a tool-calling turn reuse round 1's search instead of paying an embedding round-trip each), on_messages returns the event count and propagates failures -- the orchestrator is the swallow-and-report layer now and needs the exception to keep failed messages un-marked for retry.

…-side close - add_memory(add_after_step) now fires only when a round closes the turn (assistant reply with no tool calls) and dispatches through the backend's schedule_add when available: tool rounds are intermediate state, and ingesting every round cost O(rounds x history) extraction calls where the closing ingest covers the whole turn. - an interrupted round advances the ingest ledger WITHOUT ingesting (mark_ingested): a half-finished answer is not durable conversational truth and must not be swept into the next turn's delta. - cleanup_tools drains scheduled ingestion (flush only -- memory instances are shared across agents of one store, so closing here would yank the store from a sibling agent); the new SharedMemoryManager.close_matching(base_dir) is the owner-of-last- resort that actually closes instances and releases the embedded store's exclusive file lock.

The number of recalled memories injected per turn was hardcoded twice (search default 20, then a [:10] formatting slice). MemoryConfig gains recall_top_k (default 10, read from the unified_memory node) and the mem0 adapter threads it through search and formatting — consumers can now size recall to their context budget.

…E) instead of scattered config fields, gated by personalization.enabled. When those files change mid-conversation the next user turn carries a durable <system-reminder> naming them, so the model can tell a changed file from its own faulty memory.

…end's MEMORY.md snapshot in step with edits made outside the agent. Also translates the memory tool descriptions and prompt headings to English.

…fig patch once instead of twice.

# Conflicts: # .gitignore # ms_agent/memory/unified/backends/mem0_adapter.py # ms_agent/memory/unified/orchestrator.py # setup.py

…ts last entry deleted, instead of leaving the previous round's block in place.

- an interrupt marks only its own round, and never messages a scheduled ingest still owns (both lost the write silently) - one shared instance per store, not per model, reconfigured in place - close() is terminal: a straggler can no longer reopen a released store - the store lock is per (loop, path), and search() takes it too - search() honours its limit; injected memories carry their date - memories are written in the language the user used

# Conflicts: # ms_agent/memory/unified/backends/mem0_adapter.py

…ters Thinking support is per-model with no naming rule, and an unsupported model may reject the whole request (DashScope returns 400) instead of ignoring the flag. So we ask, and on a refusal retry once with it off, remembering the model.

…g dialect

…t do different jobs

…orwards, and read OpenRouter's reasoning field

…f a smaller invented one

…dpoints reject

…reads back

…the command the user approved

…gerous

…ally uses

…a text file listing

…o a vision-disabled model neither claims nor disowns them

…x/runtime-robustness # Conflicts: # ms_agent/agent/llm_agent.py # ms_agent/memory/unified/backends/mem0_adapter.py # ms_agent/memory/unified/orchestrator.py

…tover credentials in the environment

…hat arrive mid-stream - images go out only when the model's own switch says so; a provider's declared vision capability no longer implies it - a 400 delivered on the first streamed chunk is repaired like an eager one - thinking refusals are repaired on the Anthropic and Responses paths too - a tool call the model is still writing is reported instead of nothing at all - an unreadable managed MCP config is logged instead of silently yielding none

… tell the agent why a search failed instead of reporting no results

…ps cutting structured results into invalid JSON

…x/runtime-robustness

…TTP client fail to construct

… and gate interpreter execution and credential reads behind mode-aware asks

… unique tool-name prefixes, and return content instead of a stub on unchanged re-reads

…-friendly environment unconditionally

…io startup timeouts and per-server failure isolation

…ranscript matches are not mistaken for user content

…x/runtime-robustness

alcholiclg · 2026-08-27T09:00:35Z

Change Summary

Shell safety policy: quote-aware redirect parsing (fixes the false Create path outside allowed directories: /dev/null) block), heredoc bodies treated as code rather than paths, subshell/brace-group unwrapping, OS temp dir writable by default; real violations (writes outside allowed dirs, glob creates, variable-expansion targets) still refused
New ask categories: interpreter_exec for inline interpreter code (python3 -c, heredocs) — rememberable per project via "always allow"; sensitive_read for credential paths (~/.ssh/*, *.pem, …) — denied in auto mode, never rememberable, kept separate from the write-protection list so e.g. .git/config stays readable
Ask handling: interactive mode waits indefinitely; full-access times out after 25 min with feedback that marks it a timeout, not a refusal; public pending-ask APIs (is_awaiting / awaiting_request_ids / resolve_matching / cancel_pending) so front-ends stop reading private state
Shell executor: commands run verbatim in a non-login shell — python3 -V and python3 -V ; true no longer resolve different interpreters; agent-friendly environment (PAGER=cat, GIT_TERMINAL_PROMPT=0, NO_COLOR=1, …) injected unconditionally; tool description states no state persists between calls
MCP: parallel connects under per-server owner tasks (anyio-safe teardown), stdio startup timeout, per-server failure isolation; Pydantic union errors deduplicated with actionable guidance prepended
Tool calls: schema-driven coercion of string-typed numerics ("19.5" → 19.5), unique-prefix tool-name resolution with candidate suggestions on miss, read_file re-reads return content with an "unchanged" note instead of a stub
Prompting: the system prompt documents framework-managed directories (sessions/, .ms_agent/) so transcript matches are not mistaken for user content
Tests: 6 new test files + 2 extended; suite baseline unchanged (25 pre-existing env/network failures); verified end-to-end through the WebUI (approval flows, policy blocks, MCP coercion, PATH/env)

Related issue number

Checklist

The pull request title is a good summary of the changes - it will be used in the changelog
Unit tests for the changes exist
Run pre-commit install and pre-commit run --all-files before git commit, and passed lint check.
Documentation reflects the changes where applicable

…openai-compat transport

…laying

…x/runtime-robustness

…asks at once

… the batch

The orchestrator now owns the write discipline around a backend: - schedule_add() runs the extraction-LLM + embedding cost (seconds) in a background task; flush_pending() is the teardown barrier so the last write is never dropped, and an inline fallback keeps writes when no loop is running. - retrieval/ingestion/flush serialize on one per-store asyncio lock (embedded qdrant underneath is lock-free single-client code). - a content-hash delta ledger (<base_dir>/ingest_state.json) makes each ingest send only messages the store has not seen; hashes are recorded only after a confirmed write, so a failed ingest retries naturally. - ingest_status reports the last outcome (state/count/error/pending) so a UI can show memory working instead of silence. Mem0Backend: per-turn retrieval cache (rounds 2..N of a tool-calling turn reuse round 1's search instead of paying an embedding round-trip each), on_messages returns the event count and propagates failures -- the orchestrator is the swallow-and-report layer now and needs the exception to keep failed messages un-marked for retry.

…-side close - add_memory(add_after_step) now fires only when a round closes the turn (assistant reply with no tool calls) and dispatches through the backend's schedule_add when available: tool rounds are intermediate state, and ingesting every round cost O(rounds x history) extraction calls where the closing ingest covers the whole turn. - an interrupted round advances the ingest ledger WITHOUT ingesting (mark_ingested): a half-finished answer is not durable conversational truth and must not be swept into the next turn's delta. - cleanup_tools drains scheduled ingestion (flush only -- memory instances are shared across agents of one store, so closing here would yank the store from a sibling agent); the new SharedMemoryManager.close_matching(base_dir) is the owner-of-last- resort that actually closes instances and releases the embedded store's exclusive file lock.

The number of recalled memories injected per turn was hardcoded twice (search default 20, then a [:10] formatting slice). MemoryConfig gains recall_top_k (default 10, read from the unified_memory node) and the mem0 adapter threads it through search and formatting — consumers can now size recall to their context budget.

…E) instead of scattered config fields, gated by personalization.enabled. When those files change mid-conversation the next user turn carries a durable <system-reminder> naming them, so the model can tell a changed file from its own faulty memory.

…end's MEMORY.md snapshot in step with edits made outside the agent. Also translates the memory tool descriptions and prompt headings to English.

…fig patch once instead of twice.

# Conflicts: # .gitignore # ms_agent/memory/unified/backends/mem0_adapter.py # ms_agent/memory/unified/orchestrator.py # setup.py

…ts last entry deleted, instead of leaving the previous round's block in place.

- an interrupt marks only its own round, and never messages a scheduled ingest still owns (both lost the write silently) - one shared instance per store, not per model, reconfigured in place - close() is terminal: a straggler can no longer reopen a released store - the store lock is per (loop, path), and search() takes it too - search() honours its limit; injected memories carry their date - memories are written in the language the user used

# Conflicts: # ms_agent/memory/unified/backends/mem0_adapter.py

…ters Thinking support is per-model with no naming rule, and an unsupported model may reject the whole request (DashScope returns 400) instead of ignoring the flag. So we ask, and on a refusal retry once with it off, remembering the model.

…g dialect

…t do different jobs

…orwards, and read OpenRouter's reasoning field

…f a smaller invented one

…dpoints reject

…reads back

…the command the user approved

…gerous

…ally uses

…a text file listing

…o a vision-disabled model neither claims nor disowns them

…x/runtime-robustness # Conflicts: # ms_agent/agent/llm_agent.py # ms_agent/memory/unified/backends/mem0_adapter.py # ms_agent/memory/unified/orchestrator.py

…tover credentials in the environment

…hat arrive mid-stream - images go out only when the model's own switch says so; a provider's declared vision capability no longer implies it - a 400 delivered on the first streamed chunk is repaired like an eager one - thinking refusals are repaired on the Anthropic and Responses paths too - a tool call the model is still writing is reported instead of nothing at all - an unreadable managed MCP config is logged instead of silently yielding none

… tell the agent why a search failed instead of reporting no results

…ps cutting structured results into invalid JSON

…x/runtime-robustness

…TTP client fail to construct

… and gate interpreter execution and credential reads behind mode-aware asks

… unique tool-name prefixes, and return content instead of a stub on unchanged re-reads

…-friendly environment unconditionally

…io startup timeouts and per-server failure isolation

…ranscript matches are not mistaken for user content

…x/runtime-robustness

alcholiclg added 30 commits August 5, 2026 01:15

Fix tool_call_id loss in unified memory message round-trip
ecd6974

Pair tool results with pending calls when tool_call_id is missing in …
f8ce706
…openai-compat transport

Seal errored rounds so resume consumes the next prompt instead of rep…
a7b86ec
…laying

Skip LLM call retries for non-retryable 4xx client errors
0686305

Dedupe identical per-round error records in SessionLog
977d16b

Use native Windows shell semantics in the local code executor
4b5f976

Infer provider from model name only when no service is configured
0ae7224

Ingest a round's memory before the blocking interactive input wait
738640e

Release the mem0 vector client on close and log ingestion failures
ed01753

Merge branch 'main' ofhttps://github.com/modelscope/ms-agentinto fi…
18bfe05
…x/runtime-robustness

Let a handler that supports it receive a round's parallel permission …
4335a8b
…asks at once

Report each parallel tool call's completion as it finishes, not after…
c1654a5
… the batch

Attach vector recall durably to each user turn and keep the file back…
2712ff7
…end's MEMORY.md snapshot in step with edits made outside the agent. Also translates the memory tool descriptions and prompt headings to English.

Ship agent_hub default configs in the wheel and merge the project con…
e66e382
…fig patch once instead of twice.

Merge remote-tracking branch 'upstream/main' into fix/runtime-robustness
6d07904
# Conflicts: # .gitignore # ms_agent/memory/unified/backends/mem0_adapter.py # ms_agent/memory/unified/orchestrator.py # setup.py

Remove the memory section from the prompt when memory is cleared or i…
ec2816c
…ts last entry deleted, instead of leaving the previous round's block in place.

fix ut
67a07b1

Merge branch 'fix/memory-config-and-rebuild' into fix/runtime-robustness
4815b4b
# Conflicts: # ms_agent/memory/unified/backends/mem0_adapter.py

Lower a single reasoning_effort knob onto each endpoint's own thinkin…
c9389bc
…g dialect

Send both thinking knobs on DashScope, where the switch and the effor…
e8a910c
…t do different jobs

Lower the thinking knob once per request, repair mandatory-thinking f…
582f0ac
…orwards, and read OpenRouter's reasoning field

Adopt the effort vocabulary the endpoints themselves report instead o…
2893443
…f a smaller invented one

Clamp a thinking tier downward, never upward, and record only what en…
1f26c86
…dpoints reject

Ask MiniMax to deliver reasoning in its own field, the only shape it …
e2fa162
…reads back

alcholiclg added 18 commits August 18, 2026 12:36

Offer only the tiers an endpoint actually has, not the whole ladder
5ddb09c

Match a bare command against its own <cmd> * rule
34bddc0

Confirm network commands instead of refusing them, and remember only …
b39bd5f
…the command the user approved

Stop a bare * in dangerous_removal_paths from making every path dan…
b271839
…gerous

Test the remembered pattern through the allow_always path the UI actu…
3d0b0e0
…ally uses

Send attached images to the model as native image content instead of …
20b4288
…a text file listing

Merge branch 'feat/multimodal-input' into fix/runtime-robustness
d9f2428

Mark earlier image descriptions as another model's reliable history s…
e614df6
…o a vision-disabled model neither claims nor disowns them

Merge branch 'main' ofhttps://github.com/modelscope/ms-agentinto fi…
8374082
…x/runtime-robustness # Conflicts: # ms_agent/agent/llm_agent.py # ms_agent/memory/unified/backends/mem0_adapter.py # ms_agent/memory/unified/orchestrator.py

Simulate mem0's absence explicitly so the test stops depending on lef…
89a4c57
…tover credentials in the environment

Merge branch 'fix/vision-and-stream-retry' into fix/runtime-robustness
eb0bbce

Fall back to Tavily's keyless tier when no API key is configured, and…
be1b176
… tell the agent why a search failed instead of reporting no results

Let a tool declare its own output budget so the generic truncator sto…
2312cc3
…ps cutting structured results into invalid JSON

Correct the comments.
8d4cc5f

Merge branch 'main' ofhttps://github.com/modelscope/ms-agentinto fi…
3cb3076
…x/runtime-robustness

Add socksio so a SOCKS proxy in the environment does not make every H…
bd6ce98
…TTP client fail to construct

update requirements
3944d50

alcholiclg had a problem deploying to testci August 27, 2026 09:00 — with GitHub Actions Error

alcholiclg added 7 commits August 27, 2026 17:16

Fix shell policy misfires on redirects, heredocs and temp-dir writes,…
bb945a9
… and gate interpreter execution and credential reads behind mode-aware asks

Coerce string-typed arguments to their declared schema types, resolve…
3d8d2d2
… unique tool-name prefixes, and return content instead of a stub on unchanged re-reads

Run shell commands verbatim in a non-login shell and inject the agent…
9ba17f0
…-friendly environment unconditionally

Connect MCP servers in parallel under per-server owner tasks with std…
054166b
…io startup timeouts and per-server failure isolation

Tell the model which workspace directories are framework-managed so t…
ae5f3b2
…ranscript matches are not mistaken for user content

Ignore the Qoder IDE directory
ed00df9

Merge branch 'main' ofhttps://github.com/modelscope/ms-agentinto fi…
14afad6
…x/runtime-robustness

alcholiclg force-pushed the fix/runtime-robustness branch from 0b4c16a to 14afad6Compare August 27, 2026 09:27

alcholiclg had a problem deploying to testci August 27, 2026 09:27 — with GitHub Actions Error

wangxingjun778 approved these changes Aug 27, 2026
View reviewed changes

alcholiclg merged commit a8ad587 into modelscope:mainAug 27, 2026
1 check failed