[evergreen] Flue-native agent type — opencomputer (gateway / package / CLI / docs)

.github/workflows/publish-flue-sdk.yml

@@ -0,0 +1,65 @@
+name: Publish Flue SDK
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'sdks/flue/**'
+      - '.github/workflows/publish-flue-sdk.yml'
+  workflow_dispatch:
+
+concurrency:
+  group: publish-flue-sdk
+  cancel-in-progress: false
+
+defaults:
+  run:
+    working-directory: sdks/flue
+
+jobs:
+  publish:
+    name: Test, build & publish to npm
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22.19'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Check if this exact version is already published
+        id: check
+        run: |
+          LOCAL_VERSION=$(node -p "require('./package.json').version")
+          if LOOKUP=$(npm view "@opencomputer/flue@$LOCAL_VERSION" version 2>&1); then
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            echo "Version $LOCAL_VERSION is already published; skipping."
+          elif [[ "$LOOKUP" == *"E404"* ]]; then
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+            echo "Publishing version $LOCAL_VERSION."
+          else
+            echo "npm registry lookup failed; refusing to guess that the version is unpublished." >&2
+            echo "$LOOKUP" >&2
+            exit 1
+          fi
+
+      - name: Test
+        if: steps.check.outputs.skip == 'false'
+        run: npm test
+
+      - name: Build
+        if: steps.check.outputs.skip == 'false'
+        run: npm run build
+
+      - name: Publish
+        if: steps.check.outputs.skip == 'false'
+        run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

PRODUCT.md

@@ -0,0 +1,33 @@
+# Product
+
+## Register
+
+product
+
+## Users
+
+Developers and operators who deploy OpenComputer agents, start and steer durable sessions, and diagnose their lifecycle from the dashboard. They need to understand current state, queued work, output, and failures without learning framework-specific internals.
+
+## Product Purpose
+
+OpenComputer provides a direct operational surface for creating, controlling, and observing agents and their sessions. Success means an operator can act quickly, trust that the UI reflects durable platform state, and identify a failure without changing or redeploying production code.
+
+## Brand Personality
+
+Calm, direct, and technical. The product should feel dependable and precise while staying approachable to a developer using it for the first time.
+
+## Anti-references
+
+Avoid decorative AI imagery, conversational gimmicks, theatrical loading states, ornamental motion, and framework-specific terminology in shared product concepts. Do not invent novel controls where a familiar operator affordance is clearer.
+
+## Design Principles
+
+1. Show durable truth. Status, ordering, errors, and completion must follow the platform record rather than optimistic animation.
+2. Keep the operator in flow. Common actions and state changes should be immediate, compact, and easy to scan.
+3. Explain failures where they occur. Use actionable language and preserve enough context to diagnose the problem.
+4. Keep framework details behind neutral product concepts unless the framework itself is the subject.
+5. Preserve the existing interface vocabulary. Consistency and earned familiarity matter more than novelty.
+
+## Accessibility & Inclusion
+
+Meet WCAG AA for contrast and interaction. Preserve keyboard and screen-reader semantics, never rely on color alone for state, and provide reduced-motion behavior for every animation.

cloudflare-workers/log-tail/src/index.test.ts

@@ -0,0 +1,72 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import worker from "./index.ts";
+
+const env = {
+  AXIOM_HOST: "https://axiom.test",
+  AXIOM_DATASET: "edge",
+  AXIOM_TOKEN: "test-token",
+};
+
+test("records a silent HTTP 5xx even when the invocation outcome is ok", async () => {
+  const originalFetch = globalThis.fetch;
+  let records: Array<Record<string, unknown>> = [];
+  globalThis.fetch = (async (_input: RequestInfo | URL, init?: RequestInit) => {
+    records = JSON.parse(String(init?.body));
+    return new Response(null, { status: 200 });
+  }) as typeof fetch;
+
+  try {
+    await worker.tail([{
+      scriptName: "agt_test",
+      outcome: "ok",
+      eventTimestamp: Date.parse("2026-07-13T20:00:00Z"),
+      event: {
+        request: {
+          method: "POST",
+          url: "https://user:password@dispatch.test/agents/example/session?token=secret#fragment",
+        },
+        response: { status: 500 },
+      },
+      logs: [],
+      exceptions: [],
+    }], env, {} as ExecutionContext);
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+
+  assert.equal(records.length, 1);
+  assert.equal(records[0]?.level, "ERROR");
+  assert.equal(records[0]?.msg, "worker request returned HTTP 500");
+  assert.equal(records[0]?.service, "agt_test");
+  assert.equal(records[0]?.response_status, 500);
+  assert.equal(records[0]?.request_url, "https://dispatch.test/agents/example/session");
+  assert.equal(JSON.stringify(records[0]).includes("secret"), false);
+  assert.equal(JSON.stringify(records[0]).includes("password"), false);
+});
+
+test("fails the collector invocation when the durable sink rejects a batch", async () => {
+  const originalFetch = globalThis.fetch;
+  const originalConsoleError = console.error;
+  globalThis.fetch = (async () => new Response(
+    JSON.stringify({ code: 403, message: "not allowed to ingest into dataset" }),
+    { status: 403 },
+  )) as typeof fetch;
+  console.error = () => {};
+
+  try {
+    await assert.rejects(
+      worker.tail([{
+        scriptName: "agt_test",
+        outcome: "exception",
+        eventTimestamp: Date.parse("2026-07-13T20:00:00Z"),
+        logs: [],
+        exceptions: [],
+      }], env, {} as ExecutionContext),
+      /axiom ingest failed status=403/,
+    );
+  } finally {
+    globalThis.fetch = originalFetch;
+    console.error = originalConsoleError;
+  }
+});

cloudflare-workers/log-tail/src/index.ts

@@ -54,6 +54,22 @@ function safeStringify(v: unknown): string {
   catch { return String(v); }
 }
 
+// Request query strings can carry browser client tokens (`?token=...`). Keep
+// the route useful for diagnostics without copying credentials into Axiom.
+function requestUrlForLogs(value?: string): string | undefined {
+  if (!value) return undefined;
+  try {
+    const url = new URL(value);
+    url.username = "";
+    url.password = "";
+    url.search = "";
+    url.hash = "";
+    return url.toString();
+  } catch {
+    return undefined;
+  }
+}
+
 // Map CF console level → Axiom-friendly level string matching what our Go
 // slog handler emits ("INFO", "WARN", "ERROR", "DEBUG").
 function level(l: TraceLog["level"]): string {
@@ -76,7 +92,7 @@ export default {
         cell_id: "cf-edge",
         region: "global",
         outcome: item.outcome,
-        request_url: item.event?.request?.url,
+        request_url: requestUrlForLogs(item.event?.request?.url),
         request_method: item.event?.request?.method,
         response_status: item.event?.response?.status,
         cron: item.event?.cron,
@@ -104,15 +120,20 @@ export default {
         });
       }
 
-      // Synthetic record when a request ended in exception/exceededCpu/etc
-      // but had no console output — gives us a row to count "failed
-      // requests by script" in Axiom without joining streams.
-      if (item.outcome !== "ok" && item.logs.length === 0 && item.exceptions.length === 0) {
+      // Synthetic record when a request failed without logging. A Worker can
+      // catch an exception and return 5xx while Cloudflare still reports the
+      // invocation outcome as "ok", so response status is part of the failure
+      // contract too. This keeps silent server errors searchable in Axiom.
+      const responseStatus = item.event?.response?.status;
+      const serverError = typeof responseStatus === "number" && responseStatus >= 500;
+      if ((item.outcome !== "ok" || serverError) && item.logs.length === 0 && item.exceptions.length === 0) {
         records.push({
           _time: new Date(item.eventTimestamp ?? Date.now()).toISOString(),
           time: new Date(item.eventTimestamp ?? Date.now()).toISOString(),
           level: "ERROR",
-          msg: `worker request ended with outcome=${item.outcome}`,
+          msg: serverError
+            ? `worker request returned HTTP ${responseStatus}`
+            : `worker request ended with outcome=${item.outcome}`,
           ...baseEnvelope,
         });
       }
@@ -131,7 +152,12 @@ export default {
     });
     if (!resp.ok) {
       const body = await resp.text().catch(() => "");
-      console.error(`axiom ingest failed status=${resp.status} body=${body.slice(0, 200)}`);
+      const message = `axiom ingest failed status=${resp.status} body=${body.slice(0, 200)}`;
+      console.error(message);
+      // The collector has Cloudflare Workers Logs enabled as an independent
+      // fallback. Throwing makes a broken durable sink an observable failed
+      // invocation instead of an apparently healthy, lossy success.
+      throw new Error(message);
     }
   },
 };

cloudflare-workers/log-tail/wrangler.prod.toml

@@ -1,6 +1,6 @@
 # log-tail Worker — PROD on Mo's CF account.
 # Tail consumer for opencomputer-edge-prod + opencomputer-events-ingest-prod.
-# Forwards console output + exceptions to Axiom dataset cf-prod.
+# Forwards console output + exceptions to Axiom dataset oc-platform-edge.
 # Deploy: `wrangler deploy -c wrangler.prod.toml`
 
 name = "opencomputer-log-tail-prod"
@@ -9,8 +9,18 @@ compatibility_date = "2024-12-01"
 account_id = "b8f23cb87a7a6c64040d3134643da448"
 workers_dev = false
 
+# Independent fallback for failures in the Axiom sink itself. Tenant/dispatch
+# logs go to Axiom; collector invocation failures remain searchable in the
+# Cloudflare Observability dashboard even when Axiom is unavailable.
+[observability]
+enabled = true
+
+  [observability.logs]
+  invocation_logs = true
+  head_sampling_rate = 1
+
 # Secrets (set via `wrangler secret put --config wrangler.prod.toml`):
-#   AXIOM_TOKEN — xaat-... ingest token for the cf-prod dataset
+#   AXIOM_TOKEN — ingest-capable token scoped to the oc-platform-edge dataset
 [vars]
 AXIOM_HOST = "https://api.axiom.co"
 AXIOM_DATASET = "oc-platform-edge"

cloudflare-workers/oc-gateway/.gitignore

@@ -0,0 +1,4 @@
+node_modules/
+.dev.vars
+.wrangler/
+dist/