Repository navigation
feat(agentbase): switch default inbound mode to IAM - #26
Merged
Merged
Conversation
added 9 commits
October 26, 2026 02:10
Every agentbase group command lacked Run/RunE, so cobra treated them as non-runnable: a bare invocation printed help with exit 0 (fine), but an unknown subcommand word ALSO printed help and exited 0 -- a typo like 'grn agentbase runtime delte' looked successful. Add requireSubcommand (bare invocation -> help + exit 0; unknown word -> hard error pointing at --help) and wire it into the 44 group commands living in pure wiring files: access 7, agentbase 1, catalog 4, context 1, cr 5, deploy 1, gateway 12, memory 6, policy 3, tools 4. The remaining 5 (runtime 3, code-interpreter 2) land with their fix commits -- 49 total, 5 more than the audited 44 (5 memory sub-groups + runtimeEndpointCmd). Test: subcommand_test.go unit-tests both paths and walks the whole agentbase tree asserting every group is runnable, so future groups cannot regress silently. The vks command group has the same gap; fixing it is left as a follow-up. Refs #34838.
…tract create: the flag path dropped the name from the request; the server 400'd with "name must not be blank" while everything looked fine client-side. createRequestFromSpec now sends the prompt-resolved name. (Refs #34830) create/update: imageAuth is @NotNull server-side. readImageAuth returned nil for a public image, so the field was omitted from the JSON and the request 400'd ("imageAuth must not be null"). The disabled path now returns {enabled: false}, create --file defaults it the same way, and the generate template ships it uncommented. (Refs #34831) update: the API applies a full-spec replacement, but the CLI only required image-url/flavor-id, so every other field was zeroed on each flag-mode update (env wiped, network dropped, autoscaling reset, auth cleared). Unset flags now carry the current version's field over (a stderr note lists them); a set flag replaces its field wholesale (no element-level merge). imageAuth is the exception: the API never returns the stored password, so username/password auth cannot be carried over and errors instead of silently disabling; update --file without an explicit imageAuth is rejected for the same reason. readRuntimeSpec gains a forUpdate mode: no prompting for image-url/flavor-id (unset = carried over), but explicitly-set-but-empty is rejected. (Refs #34836) vpc-id/subnet-id/route-cidrs without --network-mode were silently ignored; they now error. help: runtime/create/update Long texts and the spec template describe the flag-driven contract. (Part of #34839) runtime/trace/endpoint groups are wired to requireSubcommand. (Part of #34838) models: the version DTO gains the typed ImageAuth/JWKS fields needed to read the current version for carry-over; the update request comment documents the contract. Tests: create-request name, update-mode readRuntimeSpec, dangling network flags, and a carry-over matrix (unset carries incl. network/inbound/JWT/ autoscaling/imageAuth branches, set replaces wholesale, password-auth carry fails safe).
The backend rejects a listFiles invocation without directoryPath (400, error -32602 invalid params) while the platform MCP server defaults it to '.'. The CLI passed the empty flag value through, so a bare listFiles failed. Default the flag to '.' (the session working directory) when it is not set; an explicit value still wins. Also wire the code-interpreter group commands to requireSubcommand (part of #34838) and document the default in the invoke help. Refs #34837.
Update the runtime command pages for the flag-mode contract: - create is fully flag-driven; --file is for keeping the image-auth password (and inline JWKS) out of the shell history, not a requirement for "advanced" fields - update carries unset fields over from the current version (imageAuth caveat documented: password auth cannot carry, --file must include imageAuth explicitly); --image-url/--flavor-id are no longer required - the update file's name is ignored (it is not validated as required -- imageUrl/flavorId are); imageAuth must be present - generate ships imageAuth enabled:false and doubles as the update spec - listFiles --directory-path defaults to '.' Refs #34839.
…eted
A completed delete removes the gateway/runtime record, so the wait poll GET
returns HTTP 404 instead of a DELETED state — every delete+wait flow
exited 1. Map that 404 onto the DELETED terminal success: gateway wait and
runtime wait report the resource as deleted and exit 0 (a 404 before any
successful poll returns a minimal {id/name, DELETED} snapshot; after one,
the last-seen resource). deploy destroy gets the same success mapping,
while deploy up keeps 404 an error (it waits for ACTIVE).
Refs #34856
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Brief description of what this PR does.
Type of change
Checklist
cd go && go test ./...)feat:/fix:/feat!:) — drives the releaseRelated issues
Closes #