Host requests settle; background surfaces cannot raise sheets by guofoo · Pull Request #204 · OctoSense-org/OctoSense

guofoo · 2026-09-30T20:25:16Z

Takes up OctoSense-org/OctoSense-App-Hub#38: every host request answers exactly once, and ServiceCall carries the surface's may_prompt.

Needs App Hub 954f5da7 (the merge of #38), which main's App Hub pin already contains; this PR changes no pins.

Why it matters on main today (App Hub 58c3c8ae since #243):

Every ServiceCall says may_prompt: true, an assistant's tool call included, and glance tiles keep host_prompts on.
ModelService sets no timeout, so a model.complete call is cut off at App Hub's 60 s default, although the service allows 2 × 120 s per provider.

Changes

Glance tiles are a background surface. app_isolate sets host_prompts: false, and GlanceTiles::sweep cancels a gone tile's waiting requests (cancel_heap).
Agent tool calls. They run with may_prompt: false. HostServiceExecutor::cancel(call_id) now stops the wait and drops the request in App Hub, instead of keeping it until the service answers.
Mail. add_account refuses a call that cannot prompt before it touches a sign-in already under way. On main, a tile or tool call left it waiting forever, after it had cancelled the person's own sign-in.
AI providers. raise refuses the same way for add_provider, edit_provider, import_qr, export_qr and connect_client, and the sheet already up stays.
The model service's timeout covers every attempt on one provider (2 × 120 s + 30 s). Other services keep App Hub's 60 s.
Tests build ServiceCall with may_prompt: true, as they behaved before.

Checks

These were run on 337f98a, before ymote's merge of main (23e71c1). The change set is unchanged: git diff from the merge base equals a rebase on main 07516e5, which compiles. Run locally on 337f98a (rebased on main 4e88b7d). The sources are makepad a1c81312 with main's runtime patch set (tree cff137d1), runtime 96587629 and Octoscript dbd48cfb. All 41 commands of the apps, desktop and phone workflows pass, apart from the kernel-artifact and real_kernel jobs:

setup.py --check --cargo, native_apps.py --check, test_native_apps.py and check-shell-graph.sh.
cargo check for every desktop and phone feature set.
The listed clippy -D warnings steps.
cargo test: 1794 tests, including -p octosense-app-policy -p octosense-app-hub.

New tests, each of which failed before its change:

a_tiles_isolate_cannot_raise_a_sheet
a_swept_tiles_requests_are_cancelled
a_cancelled_tool_call_stops_waiting
a_background_surface_cannot_raise_or_replace_a_sheet (AI providers)
a_model_call_may_wait_out_every_attempt_on_a_provider
a background add_account case in Mail's sign-in test

Merged with main

Rebased on main by ymote (with Claude Code) as a merge of origin/main into this branch, with no history rewrite. The App Hub pin hunks (root pins, Cargo.lock, native-apps.json) and the www-alias [patch] section were dropped as superseded: main pins App Hub 58c3c8ae, which contains 954f5da7. Main's #243 had already added may_prompt: true to the tests and to the tool-call ServiceCall; the merge keeps main's test changes and sets the tool call to may_prompt: false, as this PR intends. The checks above were run on 337f98a; after the merge, the targeted shell, AI providers and Mail tests, cargo check --locked for desktop and phone with mobile-apps, and setup.py --check --cargo pass on the merge, 23e71c1.

App Hub 954f5da7, the merge of OctoSense-App-Hub#38 (after App Hub#44, reserved native ids and ADR 0004 storage and tool fields), makes every host request answer exactly once and carries the surface's may_prompt on ServiceCall. This moves App Hub there (native-apps.json, the root pins and the www alias patch) and takes up the new contract: - Glance tiles are a background surface: their isolates' host_prompts is false, and a swept tile cancels its waiting requests (cancel_heap). - An agent's tool call has no surface for a sheet (may_prompt: false); cancelling one stops it waiting and drops the request in App Hub. - Mail's add_account and AI providers' sheets refuse a call that cannot prompt, before touching a sign-in or sheet already under way (on main a glance tile or tool call left Mail's add_account waiting forever). - The model service allows every attempt on a provider (2 x 120 s + 30 s) before App Hub times a call out; other services keep the 60 s default. - Tests build ServiceCall with may_prompt: true, as they behaved before.

… (until #204) App Hub main (58c3c8ae) includes App Hub #38: every ServiceCall carries may_prompt, and App Hub's own sheet handler refuses a sheet when it is false. Before #38 nothing read it and a sheet was always allowed. Every ServiceCall OctoSense builds (the shell's agent tool calls in script_apps.rs, and the services' tests) passes may_prompt: true, so behaviour is unchanged; no OctoSense service reads the field yet. Isolates are unchanged too: App Hub's isolate_settings now sets host_prompts true for a foreground app, so a glance tile's requests carry may_prompt true and its sheets are allowed, as today. Refusing sheets on background surfaces is #204's work. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Main's App Hub pin (58c3c8ae, after #243) already contains 954f5da7 (App Hub#38), so this keeps main's root pins, Cargo.lock and native-apps.json, and drops the www alias [patch] section, which main no longer has. - host_tools/script_apps.rs: main's imports and check_script_app_id stay; a tool call now sets may_prompt: false (main's #243 set it to true to keep behaviour unchanged; this branch is the behaviour change). - ai-providers tests/service.rs: main's send, then this branch's send_background. - Other tests already build ServiceCall with may_prompt: true on main. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

ymote · 2026-10-01T16:57:20Z

Merged main into this branch (no history rewrite) at the user's request; dropped the now-superseded App Hub pin/alias hunks; targeted tests pass. Queued for the merge queue.

🤖 Generated with Claude Code

ymote · 2026-10-01T19:30:03Z

Local CI passed on 5a00b65 (tools/ci-local.sh --only desktop,phone,apps --linux-host, 18m44s, Darwin arm64; the ubuntu jobs on the Linux build host, Linux x86_64).

GitHub would run for this PR: desktop.yml, phone.yml, apps.yml. Merged on this local pass (macOS runner queue); GitHub CI runs on the merge commit on main.

Job	Step	Result	Time
ci-local / drift	The local mapping fits the workflows	PASS	-
desktop.yml / desktop	Prepare the pinned framework sources	PASS	0s
desktop.yml / desktop	Compile the desktop with the shared runtime	PASS	1m59s
desktop.yml / desktop	One copy of every shell source	PASS	-
desktop.yml / desktop	Desktop tools and scripts	PASS	10s
desktop.yml / desktop	One Makepad, App Hub, octos and Rinx in the locked graph	PASS	4s
desktop.yml / desktop	The native apps' generated places match native-apps.json	PASS	0s
phone.yml / home	Prepare pinned sources and the reviewed runtime patch	PASS	0s
phone.yml / home	Compile Home and its bundled modules	PASS	2m08s
phone.yml / home	Verify the single runtime graph	PASS	4s
phone.yml / home	The native apps' generated places match native-apps.json	PASS	0s
phone.yml / home	The pinned octos revision	PASS	0s
phone.yml / home	Build octos (unless cached)	PASS	-
phone.yml / home	Build Home, App Hub admission and runtime policy tests	PASS	2m19s
phone.yml / home	Test Home, App Hub admission and runtime policy	PASS	6m44s
phone.yml / home	Two-lane scenario (real kernel, scripted model)	PASS	33s
apps.yml / services (linux)	python3 tools/setup.py	PASS	0s
apps.yml / services (linux)	Kernel service	PASS	10s
apps.yml / services (linux)	App peers	PASS	23s
apps.yml / services (linux)	AI providers config	PASS	3s
apps.yml / services (linux)	System toolbox (workflow templates)	PASS	1m29s
apps.yml / kernel-security (linux)	python3 tools/setup.py	PASS	0s
apps.yml / kernel-security (linux)	The pinned octos revision	PASS	-
apps.yml / kernel-security (linux)	Build octos (unless cached)	PASS	-
apps.yml / kernel-security (linux)	Real-kernel tests	PASS	30s
apps.yml / apps	python3 tools/setup.py	PASS	4s
apps.yml / apps	Host services (Mail, AI providers, News)	PASS	1m05s
apps.yml / apps	Shell AI services (crates/ai-host)	PASS	2m48s
apps.yml / apps	AppCard runtime setup safeguards	PASS	0s
apps.yml / apps	AppCard clippy (own crates; shared runtime compiles)	PASS	34s
apps.yml / apps	AppCard transport and store	PASS	5s
apps.yml / apps	One Makepad, App Hub, octos and Rinx in the locked graph	PASS	4s
linux-host / sandbox (linux)	python3 tools/setup.py	PASS	0s
linux-host / sandbox (linux)	Process sandbox on Linux (Landlock, seccomp)	PASS	1m14s

Notes:

GitHub runs Python 3.12; this run used Python 3.9.6
GitHub runs Python 3.12; the Linux host used Python 3.14.4

ymote · 2026-10-01T19:30:42Z

Thanks @guofoo. This is merged now (user-approved). Here is what the two merge commits on your branch resolved, so nothing is a surprise:

23e71c1 (merge of main 461acab):
- Pins: your App Hub move to 954f5da7 and the www.github.com alias are superseded by main. Main moved to App Hub 58c3c8ae, which contains 954f5da7 (it is 12 commits ahead), to octosense-app-contract = "1" from crates.io and to Rinx v1.1.0, and dropped the alias for good (deps: one octosense-app-contract from crates.io; App Hub by contract version, Rinx v1.1.0 (ADR 0005 step 3) #243). So Cargo.toml, Cargo.lock and native-apps.json are main's.
- host_tools/script_apps.rs: the agent tool-call path keeps your Waiting { call_id, reply } (for cancel) and may_prompt: false. Main had filled it with may_prompt: true as a placeholder.
- ai-providers tests/service.rs: your send_background is kept.
- Every other ServiceCall site matches your branch: glance tiles host_prompts = false, agent tool calls false, and foreground surfaces and tests true.
5a00b65: a plain merge of the newer main (Fix News stuck on Updating when stories omit optional fields #212, Phone: draw rounded rects with a lean shader, not the desktop chrome one #254, Fix flaky tampered_codes_are_rejected (ai-providers QR test) #260, tools: ci-local --linux-host runs the ubuntu jobs on a Linux build host #259), with no conflicts.

Local CI (desktop, phone and apps, with the ubuntu jobs on the Linux host) passed on 5a00b65; the summary is in the comment above.

glance_card.rs tests: kept both sides (this branch's mail card tests, main's #204 tile background-surface tests). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

A heap key is an address, so a reopened PDF Tools could get its predecessor's key before any pdf call saw the death: the old documents then survived the sweep and filled the cap of 8. App Hub now tells services when an isolate closes (services::on_isolate_closed, called from cancel_heap; OctoSense-App-Hub#204). The pdf service registers its listener from register(), and every document bound to a closing isolate goes then, with its renders. If a call holds the table, the key waits for the next sweep, which still releases documents whose storage scope changed. - App Hub repinned to #204's head 8c86a4b9: the root Cargo.toml, native-apps.json, and the App Hub source lines in Cargo.lock. - Tests: a real isolate's closing releases its 3 documents and their renders, and a new isolate on the same key opens all 8; work goes on after each save, incremental and save-as (renders, find, text, further saves, reopen). - Docs: the known-gap text is gone from docs.rs and apps/AGENTS.md. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

App Hub #204 (services::on_isolate_closed) is merged, and its merge commit is App Hub main. The pin moves from #204's branch head 8c86a4b9 to it: the root Cargo.toml (5 crates), native-apps.json, and the five App Hub source lines of Cargo.lock. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

A heap key is an address, so a reopened PDF Tools could get its predecessor's key before any pdf call saw the death: the old documents then survived the sweep and filled the cap of 8. App Hub now tells services when an isolate closes (services::on_isolate_closed, called from cancel_heap; OctoSense-App-Hub#204). The pdf service registers its listener from register(), and every document bound to a closing isolate goes then, with its renders. If a call holds the table, the key waits for the next sweep, which still releases documents whose storage scope changed. - App Hub repinned to #204's head 8c86a4b9: the root Cargo.toml, native-apps.json, and the App Hub source lines in Cargo.lock. - Tests: a real isolate's closing releases its 3 documents and their renders, and a new isolate on the same key opens all 8; work goes on after each save, incremental and save-as (renders, find, text, further saves, reopen). - Docs: the known-gap text is gone from docs.rs and apps/AGENTS.md. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

App Hub #204 (services::on_isolate_closed) is merged, and its merge commit is App Hub main. The pin moves from #204's branch head 8c86a4b9 to it: the root Cargo.toml (5 crates), native-apps.json, and the five App Hub source lines of Cargo.lock. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

guofoo mentioned this pull request Sep 30, 2026

Host requests always settle, and the surface decides about sheets OctoSense-org/OctoSense-App-Hub#38

Merged

guofoo force-pushed the feat/bounded-host-requests branch from c60780f to 337f98a Compare September 30, 2026 22:23

guofoo marked this pull request as ready for review September 30, 2026 22:29

guofoo marked this pull request as draft September 30, 2026 22:30

guofoo marked this pull request as ready for review October 1, 2026 01:36

ymote mentioned this pull request Oct 1, 2026

deps: one octosense-app-contract from crates.io; App Hub by contract version, Rinx v1.1.0 (ADR 0005 step 3) #243

Merged

ymote added 2 commits October 1, 2026 10:37

Merge origin/main into feat/bounded-host-requests

3c3fb51

Merge origin/main into feat/bounded-host-requests

5a00b65

ymote merged commit 9bd7186 into main Oct 1, 2026
1 of 5 checks passed

ymote added a commit that referenced this pull request Oct 1, 2026

Merge origin/main into feat/mail-card-mvp

0455f78

glance_card.rs tests: kept both sides (this branch's mail card tests, main's #204 tile background-surface tests). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

guofoo deleted the feat/bounded-host-requests branch October 1, 2026 23:06

ymote mentioned this pull request Oct 10, 2026

pdf service v2: open documents for PDF Tools v2 #472

Merged

Navigation Menu

Repository navigation

Host requests settle; background surfaces cannot raise sheets - #204

Host requests settle; background surfaces cannot raise sheets#204
ymote merged 4 commits into
mainfrom
feat/bounded-host-requests

guofoo commented Sep 30, 2026 •

edited

Loading

Uh oh!

ymote commented Oct 1, 2026

Uh oh!

ymote commented Oct 1, 2026

Uh oh!

Uh oh!

ymote commented Oct 1, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

guofoo commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Checks

Merged with main

Uh oh!

ymote commented Oct 1, 2026

Uh oh!

ymote commented Oct 1, 2026

Uh oh!

Uh oh!

ymote commented Oct 1, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

guofoo commented Sep 30, 2026 •

edited

Loading