@galaxyproject/orbit 0.0.0 → 0.9.0

package/CHANGELOG.md

@@ -0,0 +1,123 @@
+# Changelog
+
+Notable, user-facing changes to Orbit (called Loom before 0.9). Each release lists a short set of
+highlights; the full commit-level notes live on the GitHub release pages. Add a
+new `## [<version>] - <date>` block with a `### Highlights` list at release time.
+
+## [0.9.0] - 2026-11-02
+
+### Highlights
+
+- Loom is now Orbit. The CLI is `orbit` (`npm install -g @galaxyproject/orbit`), the desktop app keeps its name, and the repo is github.com/galaxyproject/orbit (old links redirect). `npm install -g @galaxyproject/loom` keeps working as a thin shim that runs Orbit and points you at the new package
+- What moves on your machine: settings are copied from `~/.loom/config.json` to `~/.orbit/config.json` on first run, API keys included, nothing deleted, with a `MOVED-TO-ORBIT.txt` note left behind. Analyses stay where they are. Environment variables are `ORBIT_*`; the `LOOM_*` spellings still work and say so once. Standing instructions are read from `ORBIT.md` first, then `LOOM.md`
+- What changes in notebooks: new typed blocks are written as `orbit-invocation`, `orbit-job` and friends. The `loom-*` blocks older releases wrote are read as before and converge to the new name when next updated, so a notebook shared between Orbit 0.8 and 0.9 does not grow duplicates
+- Linux: the desktop package and executable are `orbit-desktop`, so the app no longer shadows the `orbit` CLI on PATH. The 0.8 package was called `orbit`; remove it with `sudo apt remove orbit` (or `rpm -e orbit`) after installing the new one
+- The CLI's `/orbit` hand-off command is now `/desktop`; `/orbit` still works for now
+- Orbit can now ship staging skills -- skills it needs before they have a permanent home upstream -- alongside the galaxy-skills catalog, under `skills_fetch({ repo: "orbit" })`. The first, `galaxy-data-libraries`, teaches the agent to browse a Galaxy data library and run tools on its datasets in place instead of copying them into a history
+- `GALAXY_URL=... GALAXY_API_KEY=... orbit` now reaches that server even when a different Galaxy profile is saved; before, the saved profile's URL won. The URL and key always come from the same place now, which fixes a case where a key exported for one server was sent to the saved profile's server instead. Setting just one of the two is ignored, with a warning
+- Orbit can ask before it runs: the agent proposes a Galaxy run, `/approve` signs off and submits it right away, `/revoke` takes an approval back, and `/pending` shows what's waiting. Proposals can map over collections and check dataset formats before anything is submitted
+- Lessons: when something goes wrong, the agent can propose a lesson and you keep it with `/lesson`. A kept lesson comes back on its own when the same situation shows up again, and you can search them any time
+- Desktop: offline English dictation into the composer, drop a file on the composer to insert its path, and open files in the system viewer from the context menu
+- Orbit runs on pi 1.4 and uses pi's built-in MCP support; `mcp.json` is backed up before it's migrated. Custom endpoints can run without an API key, Ollama is no longer offered, and refusals from OpenAI and ChatGPT-account models are explained instead of dumped as raw JSON
+- Fewer silent stalls: an empty model reply no longer ends a run with nothing said, questions survive model retries, Galaxy follow-ups survive pauses, a stop you asked for no longer shows as an error, and the web shell shows a prompt the brain rejected
+- Galaxy: a pasted server URL ending in `/api` works, finished workflows count their input steps so progress reaches the full step count, and the default BRC Analytics MCP points at production
+- Safety: Orbit refuses Galaxy writes into a history owned by another account, treats pi's credential store like the other credential stores, and blocks local-file uploads in remote mode
+
+## [0.8.0] - 2026-09-28
+
+### Highlights
+
+- Loom is being renamed Orbit in the next release: the CLI, the desktop app, and the GitHub repo will all be called Orbit. Once that happens, this version will tell you where to get the new one
+- Orbit has a Dashboard tab beside the notebook, built from widgets for plan progress, Galaxy jobs, results and history that you can arrange yourself
+- When a Galaxy job or workflow finishes or fails, Loom now checks the outputs or starts investigating on its own instead of waiting to be asked. It stops after three automatic turns in a row and pauses when you hit Stop. It also reconnects to Galaxy by itself when the connection drops, polls less, shows progress on long waits, and no longer aborts a turn after the laptop sleeps
+- Describe the analysis you want ("which genes changed in my RNA-seq?") and Loom looks for a community IWC workflow first, checks that its inputs match the data you have, and suggests a chain when one workflow isn't enough. Plans are now tagged by where the compute runs: `[remote]` for Galaxy, `[hybrid]`, or `[local]` (older `[galaxy]` plans still work)
+- Smaller Galaxy fixes: SRA downloads are batched into one job instead of one per accession, Galaxy datasets and histories are clickable links in the notebook and chat, and a large catalog of user-defined tools no longer floods the conversation
+- Galaxy skill content now ships inside Loom, pinned to a commit of `galaxyproject/agentic-plugins`, so a fresh install has the full catalog with no network and no waiting. Preferences shows which repos are bundled and at which commit, and pointing a repo at a branch goes back to fetching it live. The failure-triage guidance is now a whole Foundry cast, with eleven more for finding, adapting and validating workflows. None of them enter the system prompt
+- Your Galaxy API key is no longer sent along when a request is redirected to a different host
+
+## [0.7.0] - 2026-09-17
+
+### Highlights
+
+- Loom now talks to Anthropic-compatible gateways -- an institutional proxy, LiteLLM in anthropic mode -- by picking an API shape next to the base URL, and a custom endpoint's model can be typed rather than only chosen from what it advertises, so a gateway that serves no model list is still usable. Custom endpoints also re-fetch their model list from the stored key, and a connection failure says what actually went wrong instead of "fetch failed"
+- A finished Galaxy run can wake the agent and carry on by itself (opt-in), and job tracking got harder to fool: the poller reads the invocation's own state, refuses to be silenced, and leaves an audit row behind -- and a failed invocation points the agent at vendored Galaxy reference material instead of leaving it to guess
+- The agent can no longer quietly mark a plan step done while Galaxy still says the run is in flight: a new evidence gate watches for that contradiction and records it, and the override is yours to give with a reason rather than something the model can grant itself
+- Standing instructions in a `LOOM.md` file load into every conversation, so preferences you'd otherwise repeat every session stay put
+- Provider setup stops losing things: the first-run screen keeps each provider's key with that provider instead of the one you last looked at, sign-in-capable providers are no longer treated as key-less, models too small to run Loom stay out of the picker, and a startup failure the brain already diagnosed is shown rather than retried into a generic crash box
+- Orbit and safety polish: the classic Galaxy mark in the title bar, the chat pane takes its full width back when the artifact pane is hidden, the exec-guard approval prompt shows the whole command instead of its first 200 characters, two exec-guard gaps close (an alternate file-path spelling, and writes into Orbit's own analyses directory being denied outright), and WSL shows up as WSL in feedback reports
+- pi moves to 0.85.1 and pi-mcp-adapter to 2.34.0, which lines up what a fresh install resolves with what we actually test -- a new install used to end up running two different versions of pi-ai side by side
+
+## [0.6.0] - 2026-08-14
+
+### Highlights
+
+- Orbit can now run as a Galaxy Interactive Tool as well as standalone, with the notebook syncing to and from a Galaxy Page
+- Galaxy job tracking is sturdier: the poller now tracks individual tool runs (not just workflow invocations), reconnects cleanly after a long-idle MCP session, and no longer clobbers notebook edits made mid-poll -- timed-out Galaxy calls and a missing `uv`/`uvx` now come with guidance that actually gets you unstuck
+- pi bumped to 0.83 and then 0.84.1, bringing the 5-series models; OAuth sign-in now drives off each provider's own registry entry instead of a hardcoded path, fixing sign-in hangs in Orbit and extending sign-in to more providers
+- Orbit polish: light/dark appearance themes, the notebook auto-loads on startup and re-syncs after external writes, inline HTML previews in the file pane, the footer status pill and chat copy button stay put, Enter accepts the highlighted slash command, and symlinked files show up correctly in the files tab
+- macOS builds are signed by Loom directly instead of going through osxSign, and Loom approves the install scripts npm now gates by default so `npm install` doesn't break
+- Fixed a weak-tier model-id matching bug that misclassified some Gemini models
+
+## [0.5.1] - 2026-06-20
+
+### Highlights
+
+- Destructive Galaxy deletes now ask first: deleting or purging a history, dataset, or collection prompts for confirmation before anything is removed (and the web shell blocks it outright)
+- Require the Galaxy MCP 1.9 server (up from 1.8): the agent can now work with Galaxy Pages -- creating, reading, and updating the notebook and report documents that pair an analysis with its narrative -- plus reliability fixes for workflow invocation and Galaxy auth
+- The text-selection Copy button stays put within the chat panel instead of drifting into the sidebar on wide or scrollable messages
+
+## [0.5.0] - 2026-06-19
+
+### Highlights
+
+- Orbit now runs on Windows as a remote-only desktop build, and a containerized `LOOM_MODE=remote` web shell brings Orbit to the browser
+- Galaxy data and jobs move faster: jobs run in the background by default and notify you when they finish, large local files upload over a native resumable path (no more MCP timeouts), and remote data is fetched server-side by URL instead of round-tripping through your machine
+- Galaxy connection state is now reflected live in the footer, reconnects when your credentials change, and surfaces the connected user plus a history panel even for env-driven sessions
+- The skills router is generated from skill frontmatter tags instead of a hardcoded list, and surfaces the udt-authoring skill for writing Galaxy user-defined tools
+- Stability and polish: Orbit no longer crashes when reopened, opaque "unknown error" provider messages are humanized (and a transient API failure now flags that the task was left incomplete), plus File-pane and chat fixes -- the Copy button stays put mid-stream, relative images and .tabular/fastq datatypes preview correctly, and the active analysis directory persists across restarts
+
+## [0.4.1] - 2026-06-11
+
+### Highlights
+
+- Require the Galaxy MCP 1.8 server (up from 1.6): workflow runs now validate inputs against the tool's datatypes before submitting -- catching datatype and collection mismatches early -- with input templates and run guidance to go with them
+- User-defined tools run again on Galaxy 26.0 servers
+
+## [0.4.0] - 2026-06-11
+
+### Highlights
+
+- Export any conversation to Markdown, copy a single message, or select-and-copy straight from the chat
+- A cold session can now discover and resume a Galaxy notebook, and Page sync round-trips through Galaxy-flavored Markdown
+- Stuck "thinking" turns recover or abort cleanly, resumed sessions and single tool runs record their history correctly, and `--print` exits instead of hanging
+- The terminal hides the model's thinking by default, `/cost` renders locally instead of billing the model, and `/tester-id` sets your tester ID without editing config
+- Tighter safety: config.json API keys stay out of provider logs, out-of-workspace reads are gated, and retired models are gone from the picker
+
+## [0.3.1] - 2026-06-04
+
+### Highlights
+
+- Connect any OpenAI-compatible model endpoint, with a one-click Jetstream preset
+- Orbit shows how full the context window is, right in the footer
+- Lower per-turn token use, plus `/compact` to trim conversation history on demand
+
+## [0.3.0] - 2026-06-03
+
+### Highlights
+
+- Orbit updates itself in place on macOS; the CLI now tells you when a new version is out (and `loom update` to get it)
+- Claude Opus 4.8 is available, with corrected pricing
+- `/orbit` hands a running CLI session off to the Orbit desktop app
+
+## [0.2.0] - 2026-06-02
+
+### Highlights
+
+- The agent's file writes are confined to your analysis directory by default, with an opt-in bash sandbox and a local-execution approval gate
+- Send feedback straight from Orbit or with `/feedback`
+
+## [0.1.1] - 2026-05-29
+
+### Highlights
+
+- Signed and notarized macOS builds

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024-2026 Galaxy Project contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OF OR OTHER DEALINGS IN
+THE SOFTWARE.