Spaces:
Running on CPU Upgrade
Running on CPU Upgrade
Commit History
-
Retire hosted ML Intern web app (#363)
Unverified signature* Retire hosted ML Intern web app Replace the active Space UI with a HuggingChat migration notice and start a minimal status-only backend. Co-authored-by: OpenAI Codex <codex@openai.com> * Add retirement page preview Store the verified desktop screenshot for the pull request description. Co-authored-by: OpenAI Codex <codex@openai.com> * Cover retired static serving Exercise the retirement page mount in CI and document the hosted entrypoint separately from the rollback backend. Co-authored-by: OpenAI Codex <codex@openai.com> --------- Co-authored-by: OpenAI Codex <codex@openai.com>b85312c
-
[codex] Switch defaults to GLM 5.2 (#333)
Unverified signature* Switch defaults to GLM 5.2 Co-authored-by: OpenAI Codex <codex@openai.com> * Rename default model alias Co-authored-by: OpenAI Codex <codex@openai.com> * Drop user threading from default model helper Co-authored-by: OpenAI Codex <codex@openai.com> * Track selected chat model by path Co-authored-by: OpenAI Codex <codex@openai.com> --------- Co-authored-by: OpenAI Codex <codex@openai.com>550a209 -
[codex] Harden agent prompt guidance (#331)
Unverified signature* Harden agent prompt guidance Co-authored-by: OpenAI Codex <codex@openai.com> * Handle streaming LLM read timeouts Co-authored-by: OpenAI Codex <codex@openai.com> * Address autonomous prompt review feedback Co-authored-by: OpenAI Codex <codex@openai.com> * Address prompt review comments Co-authored-by: OpenAI Codex <codex@openai.com> * Address reviewer feedback on prompt guidance Co-authored-by: OpenAI Codex <codex@openai.com> * Stop activation from resetting usage windows Co-authored-by: OpenAI Codex <codex@openai.com> * Harden ML dependency freshness guidance Co-authored-by: OpenAI Codex <codex@openai.com> * Constrain kernels dependency guidance Co-authored-by: OpenAI Codex <codex@openai.com> * Exclude T4 for flash attention kernels Co-authored-by: OpenAI Codex <codex@openai.com> * Use shell-safe kernels dependency spec Co-authored-by: OpenAI Codex <codex@openai.com> --------- Co-authored-by: OpenAI Codex <codex@openai.com>ece0775
-
Remove unused model provider metadata (#330)
Unverified signatureCo-authored-by: OpenAI Codex <codex@openai.com>13ff73d -
[codex] Update hosted web model defaults (#328)
Unverified signature* Update hosted web model defaults Co-authored-by: OpenAI Codex <codex@openai.com> * Pin hosted web models to Novita Co-authored-by: OpenAI Codex <codex@openai.com> * Use GLM as the free web default Co-authored-by: OpenAI Codex <codex@openai.com> * Use plan-aware model for LLM health check Co-authored-by: OpenAI Codex <codex@openai.com> * Refresh Kimi test fixtures Co-authored-by: OpenAI Codex <codex@openai.com> --------- Co-authored-by: OpenAI Codex <codex@openai.com>433a22b
-
Remove ~900 lines of dead code across agent, backend, and frontend (#318)
Unverified signature* Remove dead code across agent, backend, and frontend A vulture/knip audit with manual repo-wide verification found ~900 lines of dead code: - Delete agent/tools/private_hf_repo_tools.py (650 lines): disabled when hf_repo_files/hf_repo_git replaced it, never imported since. - Drop orphaned functions, constants, and type aliases across agent/ and backend/ (record_jobs_access_blocked, last_fetch_error, update_local_save_status, verify_session_access, OperationType aliases, OpType.INTERRUPT in both enums, etc.). - Trim unused Sandbox client surface (pause/restart/to_dict/ tool_definitions and unused constants); keep Sandbox.connect, which the live auth integration test uses. - Remove production code only its own tests kept alive: _needs_approval (tests retargeted to _base_needs_approval / production path), fetch_hf_user_plan, _cleanup_user_orphan_sandboxes (superseded by scripts/sweep_orphan_sandboxes.py), DEFAULT_MODEL_ID alias. - Drop unused boto3 dependency (still …7943555 -
Instrument dataset usage and billing analytics (#316)
Unverified signature* Instrument session usage analytics Add durable usage_metrics snapshots, backend HF billing refreshes, and shared dataset row usage columns. Co-authored-by: OpenAI Codex <codex@openai.com> * Address usage billing review feedback Timebox billing refreshes, keep user-facing saves fire-and-forget, and share sandbox lifecycle aggregation semantics. Co-authored-by: OpenAI Codex <codex@openai.com> * Simplify HF Jobs usage label Display HF Jobs without the estimated qualifier while preserving fallback usage logic. Co-authored-by: OpenAI Codex <codex@openai.com> --------- Co-authored-by: OpenAI Codex <codex@openai.com>4ecc3bd -
Enforce YOLO cap across session usage (#313)
Unverified signature* Enforce YOLO cap across session usage Co-authored-by: OpenAI Codex <codex@openai.com> * Address YOLO budget review feedback Co-authored-by: OpenAI Codex <codex@openai.com> * Switch YOLO LLM cap checks to post-call warnings Co-authored-by: OpenAI Codex <codex@openai.com> * Improve YOLO cap reached CTA Co-authored-by: OpenAI Codex <codex@openai.com> * Fix YOLO blocked approval flow Show cap extension controls for pre-execution budget blocks and preserve approved tool parts during approval continuation streams. Co-authored-by: OpenAI Codex <codex@openai.com> * Sync usage meter with YOLO ledger Co-authored-by: OpenAI Codex <codex@openai.com> * Fix YOLO usage accounting drift Co-authored-by: OpenAI Codex <codex@openai.com> * Emit YOLO updates for observed spend Co-authored-by: OpenAI Codex <codex@openai.com> * Handle YOLO updates in active chat stream Co-authored-by: OpenAI Codex <codex@openai.com> * Reconcile YOLO ledger from usage fetches Co-authored-by: OpenAI Codex…d76b37c -
Use session billing endpoint for inference usage (#314)
Unverified signature* Use session billing endpoint for inference usage Replace current-session inference billing estimates with the Hugging Face session usage endpoint and ensure HF Router requests carry session IDs across providers. Co-authored-by: OpenAI Codex <codex@openai.com> * Rotate inference billing session IDs Co-authored-by: OpenAI Codex <codex@openai.com> * Address session billing review feedback Co-authored-by: OpenAI Codex <codex@openai.com> * Send Router billing session ID header Co-authored-by: OpenAI Codex <codex@openai.com> * Fix duplicate streamed assistant text Co-authored-by: OpenAI Codex <codex@openai.com> --------- Co-authored-by: OpenAI Codex <codex@openai.com>9e28f0f
-
Add sandbox costs to usage meter (#311)
Unverified signature* Add sandbox costs to usage meter Co-authored-by: OpenAI Codex <codex@openai.com> * Remove usage rollup buckets Co-authored-by: OpenAI Codex <codex@openai.com> * Remove obsolete usage rollup assertions Co-authored-by: OpenAI Codex <codex@openai.com> * Remove unused usage window aggregation Co-authored-by: OpenAI Codex <codex@openai.com> * Update usage event sort test Co-authored-by: OpenAI Codex <codex@openai.com> --------- Co-authored-by: OpenAI Codex <codex@openai.com>1b98491
-
Add session usage threshold approvals (#310)
Unverified signature* Add session usage threshold approvals Co-authored-by: OpenAI Codex <codex@openai.com> * Address usage threshold review feedback Co-authored-by: OpenAI Codex <codex@openai.com> --------- Co-authored-by: OpenAI Codex <codex@openai.com>18716c3 -
Add plan-aware CLI billing CTA (#309)
Unverified signature* Add plan-aware CLI billing CTA Co-authored-by: OpenAI Codex <codex@openai.com> * Address billing CTA review feedback Co-authored-by: OpenAI Codex <codex@openai.com> --------- Co-authored-by: OpenAI Codex <codex@openai.com>ebc9798
-
Rename idle reaper timeout to minutes (#305)
Unverified signatureCo-authored-by: OpenAI Codex <codex@openai.com>c7f69d4
-
Remove inference usage link from usage popover (#298)
Unverified signature* Remove inference usage link Co-authored-by: OpenAI Codex <codex@openai.com> * Document GitHub CLI usage Co-authored-by: OpenAI Codex <codex@openai.com> * Remove unused inference usage link Co-authored-by: OpenAI Codex <codex@openai.com> --------- Co-authored-by: OpenAI Codex <codex@openai.com>f83747e -
Reset usage billing window on session activation (#296)
Unverified signature* Reset usage billing window on session activation Co-authored-by: OpenAI Codex <codex@openai.com> * Avoid resetting usage on browser refresh Co-authored-by: OpenAI Codex <codex@openai.com> * Use billing baselines for session usage resets Co-authored-by: OpenAI Codex <codex@openai.com> --------- Co-authored-by: OpenAI Codex <codex@openai.com>1a8fb0c -
Fix billing usage visibility (#294)
Unverified signature* Fix billing usage visibility Request the HF read-billing OAuth scope and make the usage meter surface HF billing API failures while still showing live telemetry estimates. Co-authored-by: OpenAI Codex <codex@openai.com> * Tighten billing usage fallback Keep inference cost display tied to HF billing usage, expose app-observed calls and tokens when readback is unavailable, and pin usage error codes in backend tests. Co-authored-by: OpenAI Codex <codex@openai.com> --------- Co-authored-by: OpenAI Codex <codex@openai.com>3a4d158 -
Add app-attributed usage display (#292)
Unverified signature* Add app-attributed usage display Co-authored-by: OpenAI Codex <codex@openai.com> * Fix usage windows for local timestamps Co-authored-by: OpenAI Codex <codex@openai.com> * Add HF billing usage to usage display Co-authored-by: OpenAI Codex <codex@openai.com> * Simplify usage popover Co-authored-by: OpenAI Codex <codex@openai.com> * Remove token row from usage popover Co-authored-by: OpenAI Codex <codex@openai.com> * Move session billing note to usage header Co-authored-by: OpenAI Codex <codex@openai.com> * Optimize usage popover rollup loading Co-authored-by: OpenAI Codex <codex@openai.com> * Round usage costs to cents Co-authored-by: OpenAI Codex <codex@openai.com> --------- Co-authored-by: OpenAI Codex <codex@openai.com>7d506e1
-
Make LLM health check use request token (#290)
Unverified signature* Make LLM health check use request token Co-authored-by: OpenAI Codex <codex@openai.com> * Document skipped LLM health checks Co-authored-by: OpenAI Codex <codex@openai.com> --------- Co-authored-by: OpenAI Codex <codex@openai.com>a999dba -
Implement user-billed model policy (#289)
Unverified signature* Implement user-billed model policy - bill hosted inference to user tokens and remove subsidy quota state - switch web and CLI defaults and remove Sonnet from model lists - add plan-aware inference credit CTAs Co-authored-by: OpenAI Codex <codex@openai.com> * Recommend Opus in model picker Co-authored-by: OpenAI Codex <codex@openai.com> * Remove minimum plan from model config Co-authored-by: OpenAI Codex <codex@openai.com> * Link message failures to Space discussions Co-authored-by: OpenAI Codex <codex@openai.com> * Remove compatibility quota endpoint Co-authored-by: OpenAI Codex <codex@openai.com> * Remove obsolete bill_to_user argument Co-authored-by: OpenAI Codex <codex@openai.com> * Remove model tier metadata Co-authored-by: OpenAI Codex <codex@openai.com> * Remove model picker provider subtitles Co-authored-by: OpenAI Codex <codex@openai.com> --------- Co-authored-by: OpenAI Codex <codex@openai.com>ded9881
-
Enforce premium quota across sessions daily (#287)
Unverified signatureCo-authored-by: OpenAI Codex <codex@openai.com>cbf5d33 -
Set Sonnet as default premium model (#284)
Unverified signature* Set Sonnet as default premium model Co-authored-by: OpenAI Codex <codex@openai.com> * Address pro-only premium review feedback Co-authored-by: OpenAI Codex <codex@openai.com> --------- Co-authored-by: OpenAI Codex <codex@openai.com>b103510
-
Remove old Claude model support (#283)
Unverified signature* Remove Claude Opus 4.6 model support Co-authored-by: OpenAI Codex <codex@openai.com> * Remove Claude Opus 4.7 model support Co-authored-by: OpenAI Codex <codex@openai.com> * Remove Claude Sonnet 4.6 model support Co-authored-by: OpenAI Codex <codex@openai.com> * Remove stale Sonnet model tag test Co-authored-by: OpenAI Codex <codex@openai.com> --------- Co-authored-by: OpenAI Codex <codex@openai.com>d32b803 -
Route LLM inference through HF Router (#282)
Unverified signature* Route LLM inference through HF Router Co-authored-by: OpenAI Codex <codex@openai.com> * Address HF router PR review Co-authored-by: OpenAI Codex <codex@openai.com> * Address router cleanup review Remove no-op prompt caching and reasoning replay paths, genericize router model handling, and update docs/tests for HF Router-only setup. Co-authored-by: OpenAI Codex <codex@openai.com> * Fix READEM --------- Co-authored-by: OpenAI Codex <codex@openai.com>437a804
-
Add Opus 4.8 as premium model (#281)
Unverified signature9c72f5f -
Fix endpoint for free calls (#279)
Unverified signature* Recover endpoint for subsidized callsf247952 -
Enable FAL endpoint to lift limits (#278)
Unverified signature* Bill premium models through the HF router on the user's HF account Route Claude Opus 4.6 and GPT-5.5 off Bedrock/native APIs onto the HF Inference Router (huggingface/anthropic/claude-opus-4.6:fal-ai and huggingface/openai/gpt-5.5:fal-ai). The same daily allowance as before (free=1, pro=20) stays company-subsidized via INFERENCE_TOKEN; once a user is past it, the session's premium_user_billed flag flips and the call bills the user's own HF OAuth token (no X-HF-Bill-To) instead of returning the old 429 cap. - llm_params: bill_to_user routes premium (anthropic/ + openai/) router calls to the user's token; free models stay subsidized. - premium_user_billed is persisted/restored and threaded through the main loop, context compaction, the research sub-agent (now downgraded to router Sonnet 4.6), and effort probes. - Frontend: per-session BillingBanner (dismissible daily); remove the now unreachable ClaudeCapDialog + 429 quota-exhausted plumbing; the model chip shows "Billed" p…c9a83ae -
Reclaim idle sessions to fix session-capacity overshoot (#277)
Unverified signature* Reclaim idle sessions and fix session-capacity overshoot Users hit "Server is at capacity (379/200)" and couldn't create sessions: idle/forgotten runtimes never left the global pool, the frontend reactivated every historical session on load, and concurrent creates could overshoot the cap. Backend: - Idle-session reaper (2h): releases the sandbox + RAM of inactive sessions and evicts them from the live pool, leaving them resumable from Mongo (persisted resumable, never "ended"). Teardown uses asyncio.wait so a shutdown cancel can't be swallowed; submit() enqueues under the lock and refuses sessions being reaped. Reaping is skipped when persistence is disabled and aborts if the resumable snapshot (incl. the message bulk_write, via save_snapshot strict mode) can't be durably written. - Global create-slot reservation closes the check-then-create race that let concurrent creates exceed MAX_SESSIONS. - last_active_at drives the reaper, stamped on genuine activity only. - Re…6cf406a
-
Add dataset uploads to Hub (#255)
Unverified signature* Add dataset uploads to Hub Co-authored-by: OpenAI Codex <codex@openai.com> * Address dataset upload review items Co-authored-by: OpenAI Codex <codex@openai.com> * Show dataset upload progress Co-authored-by: OpenAI Codex <codex@openai.com> * Move dataset upload button to composer corner Co-authored-by: OpenAI Codex <codex@openai.com> * Fix dataset upload file handoff Co-authored-by: OpenAI Codex <codex@openai.com> * Show upload alerts below composer Co-authored-by: OpenAI Codex <codex@openai.com> * Improve dataset upload errors and chips Co-authored-by: OpenAI Codex <codex@openai.com> * Link dataset chips to repo Co-authored-by: OpenAI Codex <codex@openai.com> * Expose dataset uploads as configs Co-authored-by: OpenAI Codex <codex@openai.com> --------- Co-authored-by: OpenAI Codex <codex@openai.com>2b4c539
-
Create Hub artifact collections lazily (#245)
Unverified signature* Create Hub artifact collections lazily Co-authored-by: OpenAI Codex <codex@openai.com> * Cache lazy Hub collection slugs in child hooks Co-authored-by: OpenAI Codex <codex@openai.com> --------- Co-authored-by: OpenAI Codex <codex@openai.com>60474c1
-
Fix Pro entitlement checks (#239)
Unverified signature* Fix Pro entitlement checks Normalize HF Pro and paid org plan detection, allow premium model selection with quota enforcement, and clarify HF Jobs credit billing copy. Co-authored-by: OpenAI Codex <codex@openai.com> * Limit premium quota to personal Pro Ignore org membership for premium-model quota so users need personal HF Pro for the higher cap, while dev mode uses the Pro tier for local testing. Co-authored-by: OpenAI Codex <codex@openai.com> * Scope model switch errors to model picker Show model switch failures through local ChatInput state instead of rendering the shared agent error field globally. Co-authored-by: OpenAI Codex <codex@openai.com> * Restrict premium quota detection to Pro accounts Co-authored-by: OpenAI Codex <codex@openai.com> * Use boolean Pro signal for premium quota Co-authored-by: OpenAI Codex <codex@openai.com> * Use documented isPro field for quota tier Co-authored-by: OpenAI Codex <codex@openai.com> * Remove dead global chat error state Co-…d7637ba
-
Force OAuth refresh after scope changes (#227)
Unverified signature* Force OAuth refresh after scope changes Co-authored-by: OpenAI Codex <codex@openai.com> * Address OAuth scope review comments Co-authored-by: OpenAI Codex <codex@openai.com> --------- Co-authored-by: OpenAI Codex <codex@openai.com>e90638c -
quick wins, after internal audit (#229)
Guillaume SalouUnverified signature* fix(api): cap /api/submit text to 100k chars Pydantic-level guard on SubmitRequest.text. Prevents a single oversized user message from bloating the conversation context for every subsequent turn (cost-amplification on Bedrock-tier models). 100k chars ≈ 25k tokens, well above any reasonable user prompt. * chore(api): disable FastAPI auto-docs on HF Spaces Gated on SPACE_ID env var, which is set by the HF Spaces runtime but not in local dev. /docs, /redoc, /openapi.json return 404 on the deployed Space; localhost keeps them for development convenience. Reduces public information disclosure of the full API surface. * fix(api): check session ownership before body validation on /truncate POST /api/truncate/{session_id} previously returned 422 (with the schema detail revealing 'user_message_index' is required) even when the caller didn't own the session, leaking the route's expected payload shape to unauthenticated probers. Now parses the body manually after _check_session_access, s…82bad21
-
Add collection OAuth scope (#226)
Unverified signature* Add collection OAuth scope Co-authored-by: OpenAI Codex <codex@openai.com> * Document GitHub PR-first workflow Co-authored-by: OpenAI Codex <codex@openai.com> * Document Space OAuth scope checks Co-authored-by: OpenAI Codex <codex@openai.com> --------- Co-authored-by: OpenAI Codex <codex@openai.com>8b35696 -
Add ML Intern Hub artifact metadata (#225)
Unverified signature* Add ML Intern Hub artifact metadata Co-authored-by: OpenAI Codex <codex@openai.com> * Extend Hub artifact hooks to sandbox bash Co-authored-by: OpenAI Codex <codex@openai.com> * Create Hub artifact collections at session start Co-authored-by: OpenAI Codex <codex@openai.com> * Address Hub artifact PR review comments Co-authored-by: OpenAI Codex <codex@openai.com> * Respect Hub collection title limits Co-authored-by: OpenAI Codex <codex@openai.com> * Shorten collection session UUID fragments Co-authored-by: OpenAI Codex <codex@openai.com> --------- Co-authored-by: OpenAI Codex <codex@openai.com>4fc6e96
-
Add CI for tests and Ruff (#217)
Unverified signature* Add CI for tests and Ruff Co-authored-by: OpenAI Codex <codex@openai.com> * Enforce Ruff formatting in CI Co-authored-by: OpenAI Codex <codex@openai.com> * Document Ruff pre-commit checks Co-authored-by: OpenAI Codex <codex@openai.com> --------- Co-authored-by: OpenAI Codex <codex@openai.com>754345f -
Preserve HF token across restored sessions (#218)
Unverified signature* Preserve HF token across restored sessions Carry the authenticated HF token internally through request dependencies without exposing it from auth/me, and retry CPU sandbox preload when a session previously failed only because the token was missing. Co-authored-by: OpenAI Codex <codex@openai.com> * Address HF token restore review feedback Only restart CPU sandbox preload after the specific missing-token failure and remove the dead user hf_token fallback. Co-authored-by: OpenAI Codex <codex@openai.com> --------- Co-authored-by: OpenAI Codex <codex@openai.com>5de6e8f -
Retry sandbox hardware requests (#210)
Unverified signature* Retry sandbox hardware requests Retry transient Hub errors when requesting hardware for a newly duplicated private sandbox Space. This covers the deployed OAuth path where duplicate succeeds but /hardware can briefly return 401/Repository Not Found before the private Space is manageable. Co-authored-by: OpenAI Codex <codex@openai.com> * Address sandbox retry review feedback Narrow transient hardware retry handling to 401 and 404, add coverage for timeout propagation, and fix top-level spacing. Co-authored-by: OpenAI Codex <codex@openai.com> * Ensure auto CPU sandboxes are cleaned up Persist sandbox identity on session records, clean stale sandboxes during restore, skip preloading when delete/teardown restores a session, and clean live sandboxes during backend shutdown. Add a scheduled orphan sweeper workflow as a backstop. Co-authored-by: OpenAI Codex <codex@openai.com> * Remove scheduled sandbox sweeper Delete the GitHub Actions cron workflow for orphan sandbox cleanup and…7636865
-
Fallback to free model for gated defaults (#208)
Unverified signature* Fallback to free model for gated defaults Co-authored-by: OpenAI Codex <codex@openai.com> * Cover explicit gated model access for HF users Co-authored-by: OpenAI Codex <codex@openai.com> * Seed model picker from created session Co-authored-by: OpenAI Codex <codex@openai.com> --------- Co-authored-by: OpenAI Codex <codex@openai.com>092f909 -
Auto-start CPU sandboxes for sessions (#200)
Unverified signature* Auto-start CPU sandboxes for sessions Co-authored-by: Codex <codex@openai.com> * Retry sandbox runtime visibility checks Co-authored-by: Codex <codex@openai.com> * Stabilize auto CPU sandbox creation Co-authored-by: OpenAI Codex <codex@openai.com> * Address sandbox PR review comments Co-authored-by: OpenAI Codex <codex@openai.com> --------- Co-authored-by: Codex <codex@openai.com>8615c28 -
Add session YOLO auto-approval budget (#201)
Unverified signature* Add session YOLO auto-approval budget Co-authored-by: Codex <codex@openai.com> * Address YOLO approval review feedback Co-authored-by: Codex <codex@openai.com> --------- Co-authored-by: Codex <codex@openai.com>77324b8 -
Use HF username for personal trace uploads (#199)
Unverified signature* Use HF username for personal trace uploads Co-authored-by: OpenAI Codex <codex@openai.com> * Remove redundant HF token branch Co-authored-by: OpenAI Codex <codex@openai.com> --------- Co-authored-by: OpenAI Codex <codex@openai.com>71e1892 -
Auto-share session traces to a private HF dataset (#193)
Darshan Thakare +2: lewtun, Codex Unverified signature* feat: add share_traces toggle and per-user trace repo template * feat: support Claude Code JSONL format and per-target auth * feat: dual-upload sessions to private user trace dataset * chore: retry personal trace uploads on booting * feat: add /share-traces command to flip dataset visibility * docs: document HF trace auto-share and /share-traces * Use HF token owner for local dev auth Co-authored-by: Codex <codex@openai.com> * Rename personal session trace dataset Co-authored-by: Codex <codex@openai.com> * Add session dataset card metadata Co-authored-by: Codex <codex@openai.com> * Fix session trace upload review issues Co-authored-by: OpenAI Codex <codex@openai.com> * Preserve secret scrubbing before trace uploads Co-authored-by: OpenAI Codex <codex@openai.com> * Link ML Intern demo in dataset card Co-authored-by: OpenAI Codex <codex@openai.com> --------- Co-authored-by: lewtun <lewis.c.tunstall@gmail.com> Co-authored-by: Codex <codex@openai.com>0bd7547
-
Add DeepSeek V4 Pro model option (#189)
Unverified signature* Add DeepSeek V4 Pro model option Co-authored-by: Codex <codex@openai.com> * Remove DeepSeek feature tests Co-authored-by: Codex <codex@openai.com> --------- Co-authored-by: Codex <codex@openai.com>1b922dd -
Expose OpenAI models in the UI & make Claude model picker configurable (#183)
Unverified signature* Add agent dev server notes * Make frontend model configurable * Support env-selected frontend models * Use Claude-specific model env var * Add GPT-5.5 to web model picker * Gate GPT-5.5 as a premium model * Avoid duplicate session model fetch * Remove legacy Claude quota aliases * Document GitHub CLI PR body workflow * Gate only deployed paid model IDs * Nits5db99fa
-
feat(telemetry): track 5 untracked Bedrock call sites for full cost attribution (#179)
Guillaume SalouUnverified signature* feat(telemetry): track 5 untracked Bedrock call sites for full cost attribution Cost Explorer ($78,738 over 6 days) vs the session dataset's total_cost_usd (~$354/day attributed) showed the dataset captures only ~33% of real Bedrock spend. Root cause: out of 9 acompletion() call sites, only 2 (in agent_loop.py) emit the llm_call event that total_cost_usd sums. This wires telemetry into the 5 Bedrock-billing call sites that were flying blind, with a `kind` tag on each call so analytics can split spend by category: - research_tool.py × 3 → kind="research" (sub-agent loop) - context_manager.py → kind="compaction" (history summary) - effort_probe.py → kind="effort_probe" (cascade walk) Plus a fourth tag for the session-restore summary path (session_manager.py → kind="restore"). Plumbing changes: - telemetry.record_llm_call now accepts kind="..." (default "main" preserves existing behavior). - summarize_messages() and ContextManager.compact() take optional ses…7867a7a
-
Track Pro conversions + credits top-up; emit user_id + new KPIs (#174)
Aksel Joonas ReediUnverified signatureAdds two telemetry events the dashboard needs to answer "how many users converted to Pro?" and "how many came back from a billing block?": - pro_conversion: per-user Pro state lives in a new Mongo `pro_users` collection. mark_pro_seen upserts on every authenticated request and uses an atomic find_one_and_update to fire at-most-once when a user first appears as Pro after having been seen as non-Pro. Wired through session_manager.create_session via the existing `is_pro` signal from /auth. - credits_topped_up: fires from jobs_tool when an hf_job submit succeeds in a session that previously hit a billing-required tool_state_change. Guarded against re-firing within a session. build_kpis aggregates both as plain count columns. CLI/local users with no Mongo silently skip via the NoopSessionStore stub.2715896 -
Fix _fetch_user_plan after JobsAccess.plan removal (#173)
Aksel Joonas ReediUnverified signaturePR #172 removed the `plan` attribute from `JobsAccess`, but `backend/dependencies.py` still called `jobs_access_from_whoami(whoami).plan`. Every authenticated request hit `AttributeError: 'JobsAccess' object has no attribute 'plan'` and returned 500 — the live Space went down right after deploying #172. Inline the Pro/free/org derivation directly off the whoami payload so the Claude daily-cap tier no longer depends on the HF-Jobs JobsAccess shape (those concerns split with #172). Behaviour matches the pre-#172 mapping: isPro / `pro|enterprise|team` plan strings → "pro", any org membership → "org", everything else → "free".c21a9b1 -
Bill HF Jobs by namespace credits, drop Pro and org-join gating (#172)
Aksel Joonas ReediUnverified signature* Bill HF Jobs by namespace credits, drop Pro and org-join gating - Drop the Pro/Team subscription pre-check on hf_jobs. Any namespace the caller belongs to is eligible; HF returns a billing error at job creation time if the wallet is empty, which the agent surfaces as a "top up to launch" dialog pointing at /settings/billing. - Remove the "Join ML Agent Explorers" onboarding step. The org-join hook, /auth/org-membership endpoint, and the OAuth orgIds suggestion are gone. - Rework JobsUpgradeDialog: namespace picker shows all eligible accounts/orgs with avatars + select rings; billing mode opens the HF billing page; "Skip this tool call" stays available for both. - Backend pre-flight only forces the picker when the caller has multiple eligible namespaces; single-namespace users default to their personal account silently. - jobs_tool now catches HfHubHTTPError, detects billing failures by pattern + 402 status, emits a tool_state_change(state=billing_required) so t…bed4e38 -
Persist Space sessions in MongoDB (#170)
Aksel Joonas ReediUnverified signature* Persist Space sessions across backend restarts The hosted Space lost active conversations because sessions, approval state, event streams, and Claude quotas only lived in process memory. This adds a shared optional Mongo store for frontend sessions while keeping local and CLI runs on the no-op/local path when Mongo is absent. Constraint: Space deployment needs durable state without making PyPI/local CLI users configure Mongo. Constraint: Frontend deletes must hide sessions with a visibility tag, not erase traces needed for recovery or SFT export. Rejected: Restore every active session at startup | large user counts would create a thundering herd after deploys. Rejected: Store one giant session document | Mongo document limits make per-message snapshot docs safer. Confidence: medium Scope-risk: broad Directive: Keep session_messages as compactable runtime snapshots and session_trace_messages/session_events as append-only raw traces; do not collapse them into one collection wit…d9d9785 -
fix(sandbox): retry cleanup on transient failures + add backstop sweeper (#163)
Guillaume SalouUnverified signature* fix(sandbox): retry delete on transient failures + add backstop sweeper The agent creates a sandbox Space per session (template duplicated from burtenshaw/sandbox into the user's account). A scan on 2026-04-27 found 2,310 orphan sandbox-* Spaces — every sandbox ever created was still around. Two failure modes were causing the leak: 1. The cleanup in `_run_session.finally` doesn't fire if the pod is killed (OOM, deploy rollout, pre-emption) or if the WebSocket drops without a /shutdown. 2. When `sandbox.delete` itself failed (HF API 5xx, transient network blip, rate-limit), the previous code logged a warning and moved on. No retry, no recovery — the Space lived forever. This PR addresses both: - `_cleanup_sandbox` now retries 3× with exponential backoff (1s, 2s). Closes the transient-failure path. - New `scripts/sweep_orphan_sandboxes.py` is a standalone sweeper that finds sandbox-* forks of burtenshaw/sandbox older than N days and deletes them. Designed to run …1d50c78