fix(agent-zero): map v2.8 endpoints — /healthz → /api/health (compose crash-loop fix) - #2421
Conversation
|
Warning Review limit reached
Next review available in: 34 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (5)
📝 WalkthroughWalkthroughThe change updates Agent Zero integration settings and its submodule reference, adds bounded Docker log rotation, and documents autonomous Git operation and merge rules. ChangesAgent Zero and service configuration
Autonomy governance
Estimated code review effort: 2 (Simple) | ~15 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ef3378c677
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pmoves/env.tier-agent.example`:
- Around line 105-121: Update the generated-file source of truth in
pmoves/chit/secrets_manifest_v2.yaml or its generator input to define the five
Agent Zero settings shown in the diff, then regenerate
pmoves/env.tier-agent.example and the matching pmoves/env.tier-* files with
pmoves.tools.secrets_sync. Do not retain a direct-only edit to the generated
file.
- Line 119: Update the hardened-tier configuration around
AGENT_ZERO_CAPTURE_OUTPUT to disable output capture by default, and document
that explicit redaction and truncation are required before enabling it.
- Around line 114-118: Update the comments above AGENT_ZERO_HEALTH_PATH and
AGENT_ZERO_HEALTH_PATH_FALLBACK to accurately describe AgentZeroClient.health()
behavior for 404 and successful non-JSON responses, and document the intended
PMOVES health endpoint. Replace the generic fallback "/" with that documented
health endpoint while preserving the existing primary path configuration.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: ac565f0e-a6e1-46ca-95a5-78d5ec38ae27
📒 Files selected for processing (3)
CRUSH.mdPMOVES-Agent-Zeropmoves/env.tier-agent.example
Docker Hardening ValidationHardening Validation ReportValidated: Thu Aug 6 01:19:15 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: p7-room-orchestrator [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret [INFO] Validating: p7_control_token ====================================== |
P1 #1 (capture output deadlock): removed AGENT_ZERO_CAPTURE_OUTPUT=true from env.tier-agent.example. When true, the wrapper attaches PIPE to stdout/stderr but never drains them — the inner process hangs once the OS pipe buffer fills (~64KB on Linux). Left at default (false). P1 #2 (CRUSH closeout oversimplification): expanded the merge section to reference the full PR_CLOSEOUT.md contract (current branch, resolved threads, completed tasks, settled checks, live-head audit) — not just 3-body ACK + SHA confirmation. CR Major (generated-file claim): false positive — env.tier-agent.example is hand-maintained, not generated by secrets_sync. Verified: no references to env.tier-agent.example in secrets_manifest_v2.yaml, secrets_sync.py, or bootstrap_env.py. 💘 Generated with Crush
Docker Hardening ValidationHardening Validation ReportValidated: Thu Aug 6 01:45:24 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: p7-room-orchestrator [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret [INFO] Validating: p7_control_token ====================================== |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pmoves/env.tier-agent.example`:
- Around line 117-118: Update the Agent Zero Compose environment configuration
to use the v2.8 health paths from env.tier-agent.example: remove the hard-coded
health-path overrides from every Agent Zero Compose layer, or consistently set
AGENT_ZERO_HEALTH_PATH to /api/health and AGENT_ZERO_HEALTH_PATH_FALLBACK to /
in those layers.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: c020c3be-e833-4e1e-8119-1a81fe0455af
📒 Files selected for processing (9)
CRUSH.mdpmoves/docker-compose.agents.ymlpmoves/docker-compose.apps.ymlpmoves/docker-compose.base.ymlpmoves/docker-compose.core.ymlpmoves/docker-compose.juicefs.ymlpmoves/docker-compose.workers.ymlpmoves/docker-compose.ymlpmoves/env.tier-agent.example
🚧 Files skipped from review as they are similar to previous changes (1)
- CRUSH.md
P1 #1 (capture output deadlock): removed AGENT_ZERO_CAPTURE_OUTPUT=true from env.tier-agent.example. When true, the wrapper attaches PIPE to stdout/stderr but never drains them — the inner process hangs once the OS pipe buffer fills (~64KB on Linux). Left at default (false). P1 #2 (CRUSH closeout oversimplification): expanded the merge section to reference the full PR_CLOSEOUT.md contract (current branch, resolved threads, completed tasks, settled checks, live-head audit) — not just 3-body ACK + SHA confirmation. CR Major (generated-file claim): false positive — env.tier-agent.example is hand-maintained, not generated by secrets_sync. Verified: no references to env.tier-agent.example in secrets_manifest_v2.yaml, secrets_sync.py, or bootstrap_env.py. 💘 Generated with Crush
d1a0970 to
77ca1f3
Compare
Docker Hardening ValidationHardening Validation ReportValidated: Thu Aug 6 02:06:33 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: p7-room-orchestrator [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret [INFO] Validating: p7_control_token ====================================== |
v2.8 replaced the FastAPI app with Flask + a /api/<path> dispatch
router. The PMOVES wrapper (pmoves/services/agent-zero/main.py) polls
AGENT_ZERO_HEALTH_PATH every second to detect readiness — without
these overrides it polled /healthz forever (404), the watchdog never
saw the runtime as ready, and compose marked the container crash-
looping even though the inner A0 was up.
Paths were already parameterised in compose via ${VAR:-default} so
the fix is a 5-line addition to env.tier-agent.example:
AGENT_ZERO_HEALTH_PATH=/api/health
AGENT_ZERO_HEALTH_PATH_FALLBACK=/
AGENT_ZERO_CAPTURE_OUTPUT=true
AGENT_ZERO_MESSAGE_PATH=/api/message
AGENT_ZERO_LOG_PATH=/api/api_log_get
Also advances the PMOVES-Agent-Zero submodule pin from 7aea9176
(v2.6+v2.7+v2.8 merge) to 8b3b05d1 (hardened tip) so the two PMOVES
patches ship with the image:
58ba8ff9 fix(embedding): always prepend provider/ prefix for TZ models
8b3b05d1 fix(migration): cross-device link fallback in move_dir
Verified on SPARK: compose --profile core up -d agent-zero brings
the container to (healthy) in <30s; wrapper logs "Agent Zero
runtime is ready"; NATS controller started + JetStream active.
Known follow-up (not blocking): CSRF on /api/message blocks the
wrapper's HTTP pass-through POST; v2.8 exposes MCP at /t-{token}/sse
(token-prefixed) — needs wrapper route map update before the
/mcp/command URLs in compose resolve.
💘 Generated with Crush
…gated Clarifies the actual PMOVES rules (per AUTOMODE_FLEET_CONFIG.md:48-63, PATTERNS.md §PR Review & Merge, PR_CLOSEOUT.md) so future Crush sessions don't default to a generic "ask before push" posture that isn't a PMOVES rule: - Push to feature branches + gh pr create on POWERFULMOVES repos: routine, autonomous (AUTOMODE_FLEET_CONFIG.md:48) - Cross-submodule gitlink promotion: routine (AUTOMODE_FLEET_CONFIG.md:49,58) - Force-push on Hardened branches: soft_deny (history rewrite is destructive) - Force-push on main: hard-block (damage-control Strand A) - gh pr merge: gated — 3-body ACK + explicit SHA confirmation (signoff-gate.sh, PR_CLOSEOUT.md:76-92) The Village Rule (claim → work → sign → release) is coordination discipline, not a per-push gate. Damage-control hooks gate dangerous commands (docker, netsh, destructive git), not pushes. 💘 Generated with Crush
v2.8 mounts MCP under /mcp/t-{token}/sse (Starlette Mount at
/mcp in helpers/ui_server.py:235). The previous /mcp/command
default was a v2.5-era REST convention (POST {url}/tools/{name})
used by the PMOVES agentzero_client.py wrapper.
Three consumers referenced the stale /mcp/command default:
- github-branch-naming
- github-crossrepo-sync
- github-crossrepo-pr
Normalization to /mcp (the actual v2.8 mount point) lets env
operators pin the full token-prefixed URL via AGENTZERO_MCP_URL
in env.tier-agent when they pin AGENT_ZERO_MCP_TOKEN.
Also adds a documented note in env.tier-agent.example covering
the v2.8 token-prefixed SSE route pattern.
KNOWN FOLLOW-UP (not in this PR): the PMOVES agentzero_client.py
uses a custom REST convention (POST {url}/tools/{name}) that
predates v2.8's real MCP-over-SSE protocol. A proper rewrite to
use an MCP client library, or a thin HTTP-to-MCP bridge inside
the wrapper, is needed before the crossrepo/branch-naming
services can call AZ tools. Tracked as a follow-up lane.
Regenerates split overlays via `make -C pmoves compose-split`.
💘 Generated with Crush
P1 #1 (capture output deadlock): removed AGENT_ZERO_CAPTURE_OUTPUT=true from env.tier-agent.example. When true, the wrapper attaches PIPE to stdout/stderr but never drains them — the inner process hangs once the OS pipe buffer fills (~64KB on Linux). Left at default (false). P1 #2 (CRUSH closeout oversimplification): expanded the merge section to reference the full PR_CLOSEOUT.md contract (current branch, resolved threads, completed tasks, settled checks, live-head audit) — not just 3-body ACK + SHA confirmation. CR Major (generated-file claim): false positive — env.tier-agent.example is hand-maintained, not generated by secrets_sync. Verified: no references to env.tier-agent.example in secrets_manifest_v2.yaml, secrets_sync.py, or bootstrap_env.py. 💘 Generated with Crush
77ca1f3 to
de1cd78
Compare
Docker Hardening ValidationHardening Validation ReportValidated: Thu Aug 6 02:11:08 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: p7-room-orchestrator [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret [INFO] Validating: p7_control_token ====================================== |
1 participant
Summary
/api/<path>dispatch router. The PMOVES wrapper (pmoves/services/agent-zero/main.py:513) pollsAGENT_ZERO_HEALTH_PATHevery second; without an override it polled/healthzforever (404), so_wait_until_ready()never saw readiness even though inner A0 was up. Container marked crash-looping despite inner A0 serving 200 on/.pmoves/env.tier-agent.example(paths were already parameterised in compose via${VAR:-default}):AGENT_ZERO_HEALTH_PATH=/api/healthAGENT_ZERO_HEALTH_PATH_FALLBACK=/AGENT_ZERO_CAPTURE_OUTPUT=trueAGENT_ZERO_MESSAGE_PATH=/api/messageAGENT_ZERO_LOG_PATH=/api/api_log_getPMOVES-Agent-Zero7aea9176(v2.6+v2.7+v2.8 merge) →8b3b05d1(hardened tip) so the two PMOVES patches ship with the image:58ba8ff9fix(embedding): always prependprovider/prefix for TensorZero models8b3b05d1fix(migration): cross-device link fallback inmove_dirAUTOMODE_FLEET_CONFIG.md:48-63,PATTERNS.md§PR Review & Merge,PR_CLOSEOUT.md) so future Crush sessions don't default to a generic "ask before push" posture that isn't a PMOVES rule. Push to feature branches +gh pr createare routine;gh pr mergeis gated (3-body ACK + explicit SHA).Verification (SPARK node, GB10 ARM64)
Known follow-up (not blocking this PR)
/t-{token}/sse(token-prefixed) instead of/mcp/command. Compose still references/mcp/command— needs a wrapper route map update before MCP clients route correctly. Tracked below./api/message: POST via wrapper's HTTP pass-through hitsCSRF token missing or invalid(403). The modern path is MCP, not HTTP POST. Non-blocking — MCP is the intended integration surface.Test plan
validate-composes— green (no compose changes)python-tests— green (no Python changes)submodule-gitlink-gate— green (PMOVES-Agent-Zeropin advances to pushed hardened tip)hardening-validation— greenenv.tier-agent.exampleoverrides →make -C pmoves up-agent-zero→ container reaches(healthy)within 60s💘 Generated with Crush
Summary by CodeRabbit
New Features
Improvements
Documentation