KohakuTerrarium 2.0.0.dev9__tar.gz → 2.0.0.dev11__tar.gz

{kohakuterrarium-2.0.0.dev9/src/KohakuTerrarium.egg-info → kohakuterrarium-2.0.0.dev11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: KohakuTerrarium
-Version: 2.0.0.dev9
+Version: 2.0.0.dev11
 Summary: A universal agent framework for building self-driven AI agents and multi-agent teams
 Author-email: "Shih-Ying Yeh (KohakuBlueLeaf)" <apolloyeh0123@gmail.com>
 License-Expression: LicenseRef-KohakuTerrarium-1.0

{kohakuterrarium-2.0.0.dev9 → kohakuterrarium-2.0.0.dev11}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "KohakuTerrarium"
-version = "2.0.0.dev9"
+version = "2.0.0.dev11"
 description = "A universal agent framework for building self-driven AI agents and multi-agent teams"
 authors = [
     { name = "Shih-Ying Yeh (KohakuBlueLeaf)", email = "apolloyeh0123@gmail.com" },
@@ -291,7 +291,7 @@ select = ["F401", "F841"]
 [tool.briefcase]
 project_name = "KohakuTerrarium"
 bundle = "com.kohaku.terrarium"
-version = "2.0.0.dev9"
+version = "2.0.0.dev11"
 url = "https://github.com/Kohaku-Lab/KohakuTerrarium"
 # License is read from PEP 639 ``[project]`` above; Briefcase
 # 0.3.21+ no longer accepts ``license.file`` here.

{kohakuterrarium-2.0.0.dev9 → kohakuterrarium-2.0.0.dev11/src/KohakuTerrarium.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: KohakuTerrarium
-Version: 2.0.0.dev9
+Version: 2.0.0.dev11
 Summary: A universal agent framework for building self-driven AI agents and multi-agent teams
 Author-email: "Shih-Ying Yeh (KohakuBlueLeaf)" <apolloyeh0123@gmail.com>
 License-Expression: LicenseRef-KohakuTerrarium-1.0

{kohakuterrarium-2.0.0.dev9 → kohakuterrarium-2.0.0.dev11}/src/KohakuTerrarium.egg-info/SOURCES.txt

@@ -811,12 +811,12 @@ src/kohakuterrarium/web_dist/assets/KaTeX_Size4-Regular-Dl5lxZxV.woff2
 src/kohakuterrarium/web_dist/assets/KaTeX_Typewriter-Regular-C0xS9mPB.woff
 src/kohakuterrarium/web_dist/assets/KaTeX_Typewriter-Regular-CO6r4hn1.woff2
 src/kohakuterrarium/web_dist/assets/KaTeX_Typewriter-Regular-D3Ib7_Hf.ttf
-src/kohakuterrarium/web_dist/assets/_id_-BwN6vCT_.js
-src/kohakuterrarium/web_dist/assets/_key_-mOfYdFA8.js
+src/kohakuterrarium/web_dist/assets/_id_-C4sMjQFE.js
+src/kohakuterrarium/web_dist/assets/_key_-CXi3dOT_.js
 src/kohakuterrarium/web_dist/assets/abap-DNgBPGRI.js
 src/kohakuterrarium/web_dist/assets/apex-B4r7dYl2.js
-src/kohakuterrarium/web_dist/assets/api-CdBGIjO8.js
-src/kohakuterrarium/web_dist/assets/axios-Cx6az8TG.js
+src/kohakuterrarium/web_dist/assets/api-Bz2eaDbk.js
+src/kohakuterrarium/web_dist/assets/axios-COLhni8v.js
 src/kohakuterrarium/web_dist/assets/azcli-BKm6S2Cw.js
 src/kohakuterrarium/web_dist/assets/bat-BSxnouuk.js
 src/kohakuterrarium/web_dist/assets/bicep-B_GZ-wpx.js
@@ -850,10 +850,10 @@ src/kohakuterrarium/web_dist/assets/highlight-C8LL_u4z.css
 src/kohakuterrarium/web_dist/assets/html-DVGxM4pJ.js
 src/kohakuterrarium/web_dist/assets/html.worker-wsVgX3gp.js
 src/kohakuterrarium/web_dist/assets/htmlMode-C5KOTPV1.js
-src/kohakuterrarium/web_dist/assets/index-CAxTq8GR.js
+src/kohakuterrarium/web_dist/assets/index-BoUWOr2Q.js
 src/kohakuterrarium/web_dist/assets/index-CuB7PtQi.css
 src/kohakuterrarium/web_dist/assets/ini-BeMa714h.js
-src/kohakuterrarium/web_dist/assets/instances-B2ySdeCd.js
+src/kohakuterrarium/web_dist/assets/instances-uey62TBM.js
 src/kohakuterrarium/web_dist/assets/java-Dq86Qznf.js
 src/kohakuterrarium/web_dist/assets/javascript-BOm_W1Jn.js
 src/kohakuterrarium/web_dist/assets/json.worker-CcNiYOcv.js
@@ -873,8 +873,8 @@ src/kohakuterrarium/web_dist/assets/monaco-editor-Br_kD0ds.css
 src/kohakuterrarium/web_dist/assets/msdax-_4dmgZQ-.js
 src/kohakuterrarium/web_dist/assets/mysql-P77yJQsH.js
 src/kohakuterrarium/web_dist/assets/objective-c-ClnQjoXg.js
-src/kohakuterrarium/web_dist/assets/pages-B_cEdNdl.js
-src/kohakuterrarium/web_dist/assets/panel-debug-BT1go744.js
+src/kohakuterrarium/web_dist/assets/pages-MXpFNTpi.js
+src/kohakuterrarium/web_dist/assets/panel-debug-CR4EE1o5.js
 src/kohakuterrarium/web_dist/assets/pascal-Bc7vQ0ww.js
 src/kohakuterrarium/web_dist/assets/pascaligo-CU0Jj3mr.js
 src/kohakuterrarium/web_dist/assets/perl-DUQq7oYb.js

{kohakuterrarium-2.0.0.dev9 → kohakuterrarium-2.0.0.dev11}/src/kohakuterrarium/api/routes/identity/codex.py

@@ -28,6 +28,16 @@ from kohakuterrarium.terrarium.service import TerrariumService
 
 router = APIRouter()
 
+# Heartbeat cadence for ``codex-login-stream``.  Without periodic
+# writes the NDJSON stream goes silent for up to 15 minutes (the
+# device-code poll window) and Android WebView / mobile browsers
+# happily kill the connection mid-poll.  When the ``completed``
+# event finally enqueues, it has nowhere to go and the modal stays
+# open forever.  15s is a comfortable margin under typical mobile
+# NAT idle timeouts (30–60s).  Exposed at module level so tests can
+# monkeypatch it down to a sub-second value.
+HEARTBEAT_INTERVAL = 15.0
+
 
 @router.post("/codex-login", dependencies=[Depends(verify_admin_token)])
 async def codex_login(
@@ -95,7 +105,18 @@ async def codex_login_stream(node: str = ""):
 
     async def run_login():
         try:
-            result = await login_async(on_device_code=emit_device_code)
+            # ``open_browser=False`` — the frontend modal is already
+            # the user's interaction surface.  Auto-popping a system
+            # browser on the host machine (same machine in standalone
+            # mode) is at best redundant; on Android Chaquopy it
+            # blocks the event loop hunting for a non-existent
+            # system browser.  The browser-redirect HTTP server on
+            # :1455 still runs in parallel — codex-rs ships the same
+            # dual-flow shape — so a user who manually clicks the
+            # printed auth URL still completes via the browser path.
+            result = await login_async(
+                on_device_code=emit_device_code, open_browser=False
+            )
             await queue.put(
                 {
                     "event": "completed",
@@ -113,7 +134,17 @@ async def codex_login_stream(node: str = ""):
         task = asyncio.create_task(run_login())
         try:
             while True:
-                event = await queue.get()
+                try:
+                    event = await asyncio.wait_for(
+                        queue.get(), timeout=HEARTBEAT_INTERVAL
+                    )
+                except asyncio.TimeoutError:
+                    # Heartbeat — keeps the underlying TCP / WebView
+                    # fetch alive during the long device-code poll.
+                    # The frontend ignores ``ping`` events; their
+                    # only job is to push bytes onto the wire.
+                    yield json.dumps({"event": "ping"}) + "\n"
+                    continue
                 if event is None:
                     break
                 yield json.dumps(event) + "\n"

{kohakuterrarium-2.0.0.dev9 → kohakuterrarium-2.0.0.dev11}/src/kohakuterrarium/llm/codex_auth.py

@@ -279,8 +279,18 @@ class _OAuthCallbackHandler(BaseHTTPRequestHandler):
         pass
 
 
-async def _browser_flow() -> CodexTokens:
-    """OAuth PKCE flow with browser redirect to localhost."""
+async def _browser_flow(open_browser: bool = True) -> CodexTokens:
+    """OAuth PKCE flow with browser redirect to localhost.
+
+    The HTTP callback server on ``127.0.0.1:REDIRECT_PORT`` always
+    starts; ``open_browser=False`` only suppresses the local
+    ``webbrowser.open()`` call.  A user who manually clicks the
+    printed auth URL still completes via the browser-redirect path.
+    The SSE / WebView modal route passes ``open_browser=False`` —
+    auto-popping a system browser on the server's machine is
+    redundant (web UI = same machine) and on Android Chaquopy
+    blocks the event loop hunting for a non-existent browser.
+    """
     code_verifier, code_challenge = _generate_pkce()
     state = secrets.token_urlsafe(32)
     auth_url = _build_auth_url(code_challenge, state)
@@ -302,10 +312,11 @@ async def _browser_flow() -> CodexTokens:
     thread = Thread(target=_serve_once, daemon=True)
     thread.start()
 
-    print("[Browser] Opening authentication URL:")
+    print("[Browser] Authentication URL:")
     print(auth_url)
     print()
-    webbrowser.open(auth_url)
+    if open_browser:
+        webbrowser.open(auth_url)
 
     try:
         await asyncio.wait_for(received.wait(), timeout=300)
@@ -331,22 +342,19 @@ async def _browser_flow() -> CodexTokens:
 async def _device_code_flow(
     on_device_code: "callable | None" = None,
 ) -> CodexTokens:
-    """OAuth device code flow for headless environments.
-
-    Uses OpenAI's Codex-specific device auth endpoints:
-    1. POST /api/accounts/deviceauth/usercode -> get device_auth_id + user_code
-    2. User visits /codex/device and enters user_code
-    3. Poll /api/accounts/deviceauth/token until user completes auth
-    4. Server returns authorization_code + PKCE codes
-    5. Exchange at /oauth/token for access + refresh tokens
-
-    ``on_device_code`` is an optional async callback ``(verification_url,
-    user_code, expires_in) -> None`` invoked AS SOON AS the user code
-    is obtained — before we start polling.  The SSE / WebSocket layer
-    uses this to push the code to the frontend modal so the user can
-    paste it on another device while the server polls in background.
-    Tests and the CLI invoker pass ``None`` to keep the existing
-    print-only behaviour.
+    """OAuth device code flow for headless / WebView environments.
+
+    Polling matches codex-rs verbatim: 2xx = success, 403/404 = keep
+    polling, anything else = abort.  The earlier 400/428 + error-
+    JSON-parsing branch was a superset that occasionally tripped on
+    transient errors and bailed the modal early.
+
+    Success body: ``{authorization_code, code_verifier, code_challenge}``;
+    exchanged at ``/oauth/token`` with the device-specific redirect_uri.
+
+    ``on_device_code(verification_url, user_code, expires_in)`` is
+    invoked as soon as the user-code is obtained, before any poll,
+    so the SSE route can push it to the modal.
     """
     async with httpx.AsyncClient(timeout=30) as client:
         resp = await client.post(
@@ -390,28 +398,29 @@ async def _device_code_flow(
     deadline = time.time() + expires_in
     async with httpx.AsyncClient(timeout=30) as client:
         while time.time() < deadline:
-            await asyncio.sleep(interval)
-            resp = await client.post(
-                DEVICE_TOKEN_URL,
-                json={
-                    "device_auth_id": device_auth_id,
-                    "user_code": user_code,
-                },
-            )
+            try:
+                resp = await client.post(
+                    DEVICE_TOKEN_URL,
+                    json={
+                        "device_auth_id": device_auth_id,
+                        "user_code": user_code,
+                    },
+                )
+            except (httpx.NetworkError, httpx.TimeoutException) as exc:
+                # Transient blip — treat same as a pending poll.
+                logger.debug("Device-code poll transient error", error=str(exc))
+                await asyncio.sleep(interval)
+                continue
 
             if resp.status_code == 200:
                 token_data = resp.json()
-                # Server returns authorization_code + PKCE codes
                 auth_code = token_data.get("authorization_code", "")
                 code_verifier = token_data.get("code_verifier", "")
-
                 if auth_code and code_verifier:
-                    # Exchange using device-specific redirect_uri
                     return await _exchange_code(
                         auth_code, code_verifier, DEVICE_REDIRECT_URI
                     )
-
-                # Some responses may return tokens directly
+                # Direct-token shape (legacy / OIDC fallback path).
                 if "access_token" in token_data:
                     tokens = CodexTokens(
                         access_token=token_data["access_token"],
@@ -422,35 +431,34 @@ async def _device_code_flow(
                     tokens.save()
                     logger.info("Device code login successful")
                     return tokens
-
-            # Handle pending/error responses
-            if resp.status_code in (403, 400, 428):
-                try:
-                    error_data = resp.json()
-                    raw_error = error_data.get("error", "")
-                    # error field may be a string or a dict {"message": ..., "type": ...}
-                    if isinstance(raw_error, dict):
-                        error = raw_error.get("code", raw_error.get("type", "unknown"))
-                        error_msg = raw_error.get("message", str(raw_error))
-                    else:
-                        error = raw_error
-                        error_msg = error
-                except Exception as e:
-                    logger.debug("Failed to parse error response JSON", error=str(e))
-                    continue
-                if error in (
-                    "authorization_pending",
-                    "pending",
-                    "deviceauth_authorization_unknown",  # user hasn't completed yet
-                ):
-                    continue
-                if error == "slow_down":
-                    interval += 5  # slow down
-                    continue
-                if error in ("expired_token", "access_denied"):
-                    raise RuntimeError(f"Device code auth failed: {error}")
-                # Any other unrecognised error is fatal — don't loop until timeout
-                raise RuntimeError(f"Device code auth error: {error_msg}")
+                # 200 with no usable fields — log + treat as pending.
+                logger.debug(
+                    "Device-code poll returned 200 with no auth code; will retry"
+                )
+                await asyncio.sleep(interval)
+                continue
+
+            # codex-rs treats 403 + 404 identically: "user hasn't
+            # entered the code yet, keep polling."  No JSON parse,
+            # no error matching — the simpler invariant survives the
+            # widest range of OpenAI server-side response shapes.
+            if resp.status_code in (403, 404):
+                await asyncio.sleep(interval)
+                continue
+
+            # 429 — back off and keep polling.
+            if resp.status_code == 429:
+                interval = min(interval + 5, 30)
+                await asyncio.sleep(interval)
+                continue
+
+            # Anything else (4xx that isn't 403/404/429, 5xx) is
+            # fatal.  We surface the body so the modal can show
+            # something useful instead of an opaque hang.
+            body = resp.text[:200]
+            raise RuntimeError(
+                f"Device code poll failed: HTTP {resp.status_code} {body}"
+            )
 
     raise RuntimeError("Device code auth timed out")
 
@@ -506,25 +514,24 @@ async def _exchange_code(
 
 async def oauth_login(
     on_device_code: "callable | None" = None,
+    open_browser: bool = True,
 ) -> CodexTokens:
+    """Authenticate with OpenAI Codex OAuth.
+
+    Runs BOTH flows in parallel (browser-redirect + device-code)
+    and returns whichever completes first.  Either flow may be
+    unusable in any given environment, so the dual race covers all
+    cases — codex-rs ships the same shape.
+
+    ``on_device_code`` is forwarded to the device-code branch; pass
+    ``None`` (default) for the print-only behaviour.
+
+    ``open_browser=False`` suppresses the local ``webbrowser.open()``
+    call but the browser-redirect HTTP server still listens.  Modal
+    callers pass ``False``; CLI keeps ``True``.
     """
-    Authenticate with OpenAI Codex OAuth.
-
-    Runs BOTH flows simultaneously - browser redirect AND device code.
-    Whichever completes first wins. This handles all environments:
-    - Local machine: browser opens, redirect catches it
-    - SSH/headless: user visits URL on another device, enters code
-    - Remote desktop: either flow may work
-    - Windows reserved port: browser fails fast, device code continues
-    - **Android / WebView frontend**: no browser opener available,
-      ``on_device_code`` callback pushes the verification URL + code
-      to the UI modal so the user can paste them on another device.
-
-    ``on_device_code`` is forwarded verbatim to the device-code branch;
-    pass ``None`` (default) for the original print-only behaviour.
-    """
-    # Start both flows as concurrent tasks
-    browser_task = asyncio.create_task(_browser_flow_safe())
+    # Start both flows as concurrent tasks.
+    browser_task = asyncio.create_task(_browser_flow_safe(open_browser=open_browser))
     device_task = asyncio.create_task(_device_code_flow(on_device_code=on_device_code))
 
     tasks = {browser_task, device_task}
@@ -551,10 +558,10 @@ async def oauth_login(
     raise RuntimeError(f"All authentication flows failed: {last_error}")
 
 
-async def _browser_flow_safe() -> CodexTokens:
+async def _browser_flow_safe(open_browser: bool = True) -> CodexTokens:
     """Browser flow that doesn't crash if port is busy or browser fails."""
     try:
-        return await _browser_flow()
+        return await _browser_flow(open_browser=open_browser)
     except OSError as e:
         # Port already in use / permission denied (e.g. Windows reserved ports)
         logger.debug("Browser flow unavailable", error=str(e))

{kohakuterrarium-2.0.0.dev9 → kohakuterrarium-2.0.0.dev11}/src/kohakuterrarium/studio/catalog/packages_scan.py

@@ -324,18 +324,34 @@ def scan_catalog() -> list[CatalogEntry]:
 
 
 def scan_creatures_in_dirs(base_dirs: list[Path]) -> list[dict]:
-    """Scan configured base dirs for creature configs (raw-YAML only).
-
-    Used by the ``/api/configs/creatures`` endpoint. Returns the
-    legacy ``{name, path, description}`` shape; ``path`` is rendered
-    as an ``@pkg/...`` ref when the directory lives inside a package,
-    matching ``api.routes.configs._to_ref``.
+    """Discover creature configs for the ``/api/configs/creatures`` endpoint.
+
+    Returns the legacy ``{name, path, description}`` shape; ``path``
+    is rendered as an ``@pkg/...`` ref when the directory lives
+    inside a package, matching ``api.routes.configs._to_ref``.
+
+    Discovery now matches ``scan_catalog`` exactly: every installed
+    package's manifest-declared creatures (read at request time via
+    ``list_packages()``) PLUS any extra ``base_dirs`` the caller
+    passes in (env-var overrides + cwd creature dirs, when wired).
+
+    Earlier versions of this scanner only walked ``base_dirs`` —
+    which were captured ONCE at API-server boot via
+    ``set_creatures_dirs``.  On Android the launcher never wires the
+    base dirs (packages can only be installed at runtime via the
+    frontend, so there's nothing to capture at boot), and on desktop
+    a package installed mid-session never showed up in the New-
+    creature modal because ``_creatures_dirs`` was frozen at startup.
+    Driving discovery from ``list_packages()`` at request time fixes
+    both — the modal now reflects whatever the catalog reflects, with
+    no boot-time wiring required.
 
     Cached for ``_SCAN_CACHE_TTL`` seconds keyed by the resolved
-    base-dir tuple — the v2 dashboard quick-start modal otherwise pays
-    the YAML-parse cost every time it opens. Use
-    :func:`invalidate_scan_caches` after creating / deleting a creature
-    on disk to force a re-scan.
+    base-dir tuple — the dashboard quick-start modal otherwise pays
+    the YAML-parse cost every time it opens.  The 10s TTL is short
+    enough that newly-scaffolded creatures show up promptly; the
+    package install / uninstall / update ops explicitly call
+    :func:`invalidate_scan_caches` for immediate visibility.
     """
     global _creatures_cache
     key = _cache_key(base_dirs)
@@ -346,35 +362,68 @@ def scan_creatures_in_dirs(base_dirs: list[Path]) -> list[dict]:
             return cached_results
 
     results: list[dict] = []
+    seen: set[str] = set()
     package_roots = _build_package_root_map()
+
+    def _emit(config_dir: Path) -> None:
+        # Resolved-path dedup so a base_dir that overlaps a package
+        # directory doesn't produce two entries for the same creature.
+        try:
+            resolved = str(config_dir.resolve())
+        except OSError:
+            return
+        if resolved in seen:
+            return
+        seen.add(resolved)
+        config_file = config_dir / "config.yaml"
+        if not config_file.exists():
+            config_file = config_dir / "config.yml"
+        if not config_file.exists():
+            return
+        minimal = _parse_creature_minimal(config_dir)
+        results.append(
+            {
+                "name": minimal["name"],
+                "path": to_ref(config_dir, package_roots),
+                "description": minimal["description"],
+            }
+        )
+
+    # 1. Manifest-declared creatures from every installed package.
+    #    This is the source of truth ``scan_catalog`` uses; matching
+    #    it here keeps the two endpoints from diverging.
+    for pkg in list_packages():
+        pkg_path = Path(pkg["path"])
+        for c in pkg.get("creatures", []):
+            rel = c.get("path") if isinstance(c, dict) else None
+            if not rel:
+                continue
+            _emit(pkg_path / rel)
+
+    # 2. Configured base dirs — env-var overrides + cwd/creatures,
+    #    when the API-server boot path wired them.  Each subdir of a
+    #    base_dir is treated as a creature config dir.
     for base_dir in base_dirs:
         if not base_dir.is_dir():
             continue
         for child in sorted(base_dir.iterdir()):
-            if not child.is_dir():
-                continue
-            config_file = child / "config.yaml"
-            if not config_file.exists():
-                config_file = child / "config.yml"
-            if not config_file.exists():
-                continue
-            minimal = _parse_creature_minimal(child)
-            results.append(
-                {
-                    "name": minimal["name"],
-                    "path": to_ref(child, package_roots),
-                    "description": minimal["description"],
-                }
-            )
+            if child.is_dir():
+                _emit(child)
+
     _creatures_cache = (results, now, key)
     return results
 
 
 def scan_terrariums_in_dirs(base_dirs: list[Path]) -> list[dict]:
-    """Scan configured base dirs for terrarium configs (raw-YAML only).
+    """Discover terrarium configs for the ``/api/configs/terrariums`` endpoint.
 
-    Cached for ``_SCAN_CACHE_TTL`` seconds (see
-    :func:`scan_creatures_in_dirs` for caching rationale).
+    Mirror of :func:`scan_creatures_in_dirs` — see that function's
+    docstring for the rationale.  Discovery walks every installed
+    package's manifest-declared terrariums via ``list_packages()``
+    plus any extra ``base_dirs`` the caller supplies.
+
+    Cached for ``_SCAN_CACHE_TTL`` seconds; the package install /
+    uninstall / update ops bust the cache for immediate visibility.
     """
     global _terrariums_cache
     key = _cache_key(base_dirs)
@@ -385,26 +434,48 @@ def scan_terrariums_in_dirs(base_dirs: list[Path]) -> list[dict]:
             return cached_results
 
     results: list[dict] = []
+    seen: set[str] = set()
     package_roots = _build_package_root_map()
+
+    def _emit(config_dir: Path) -> None:
+        try:
+            resolved = str(config_dir.resolve())
+        except OSError:
+            return
+        if resolved in seen:
+            return
+        seen.add(resolved)
+        config_file = config_dir / "terrarium.yaml"
+        if not config_file.exists():
+            config_file = config_dir / "terrarium.yml"
+        if not config_file.exists():
+            return
+        minimal = _parse_terrarium_minimal(config_dir)
+        results.append(
+            {
+                "name": minimal["name"],
+                "path": to_ref(config_dir, package_roots),
+                "description": minimal["description"],
+            }
+        )
+
+    # 1. Manifest-declared terrariums from every installed package.
+    for pkg in list_packages():
+        pkg_path = Path(pkg["path"])
+        for t in pkg.get("terrariums", []):
+            rel = t.get("path") if isinstance(t, dict) else None
+            if not rel:
+                continue
+            _emit(pkg_path / rel)
+
+    # 2. Configured base dirs (env-var overrides + cwd/terrariums).
     for base_dir in base_dirs:
         if not base_dir.is_dir():
             continue
         for child in sorted(base_dir.iterdir()):
-            if not child.is_dir():
-                continue
-            config_file = child / "terrarium.yaml"
-            if not config_file.exists():
-                config_file = child / "terrarium.yml"
-            if not config_file.exists():
-                continue
-            minimal = _parse_terrarium_minimal(child)
-            results.append(
-                {
-                    "name": minimal["name"],
-                    "path": to_ref(child, package_roots),
-                    "description": minimal["description"],
-                }
-            )
+            if child.is_dir():
+                _emit(child)
+
     _terrariums_cache = (results, now, key)
     return results
 

{kohakuterrarium-2.0.0.dev9 → kohakuterrarium-2.0.0.dev11}/src/kohakuterrarium/studio/identity/codex_oauth.py

@@ -13,15 +13,23 @@ from kohakuterrarium.llm.codex_auth import CodexTokens, oauth_login, refresh_tok
 from kohakuterrarium.llm.codex_rate_limits import get_cached as _get_cached_usage
 
 
-async def login_async(on_device_code=None) -> dict[str, Any]:
+async def login_async(on_device_code=None, open_browser: bool = True) -> dict[str, Any]:
     """Run the Codex OAuth flow and return ``{status, expires_at}``.
 
     ``on_device_code`` is forwarded to :func:`oauth_login` so the
     SSE-streaming route in ``api/routes/identity/codex.py`` can push
     the verification URL + user code to the frontend modal as soon
     as the device-code flow obtains them.
+
+    ``open_browser`` is forwarded too: the SSE route passes ``False``
+    because the user already has the modal driving their interaction;
+    auto-popping a system browser on the server's machine is
+    redundant (web UI = same machine) and on Android Chaquopy /
+    headless boxes actively harmful.  The CLI ``run_login_blocking``
+    path keeps the default ``True`` since CLI users expect an
+    auto-opened browser.
     """
-    tokens = await oauth_login(on_device_code=on_device_code)
+    tokens = await oauth_login(on_device_code=on_device_code, open_browser=open_browser)
     return {"status": "ok", "expires_at": tokens.expires_at}
 
 

kohakuterrarium-2.0.0.dev9/src/kohakuterrarium/web_dist/assets/_id_-BwN6vCT_.js → kohakuterrarium-2.0.0.dev11/src/kohakuterrarium/web_dist/assets/_id_-C4sMjQFE.js

@@ -1 +1 @@
-import{B as e,K as t,U as n,W as r,it as i,jt as a,mt as o,ot as s,st as c}from"./element-plus-DadrrCeP.js";import{r as l}from"./vue-vendor-DroPwbFZ.js";import"./monaco-editor-BZeDFz3E.js";import{_ as u,d,f,m as p,v as m}from"./index-CAxTq8GR.js";var h={key:0,class:`h-full overflow-hidden`},g={__name:`[id]`,setup(g){let _=l(),v=m(),y=u(),b=d(),x=p(),S=e(()=>v.current),C=e(()=>S.value?.pwd||``);c(`panelProps`,e(()=>({"file-tree":{root:C.value,onSelect:E},files:{root:C.value,onSelect:E},chat:{instance:S.value},"editor-status":{instance:S.value},activity:{instance:S.value},state:{instance:S.value},debug:{instance:S.value},settings:{instance:S.value},modules:{instance:S.value}}))),i(async()=>{await T(),w()}),o(()=>_.params.id,async()=>{await T(),w()});function w(){let e=_.params.id;if(!e)return;x.loadInstanceOverrides(e);let t=x.getInstancePresetId(e),n=t&&x.allPresets[t]?t:`workspace`;x.switchPreset(n)}async function T(){let e=_.params.id;e&&(await v.fetchOne(e),S.value&&y.initForInstance(S.value))}function E(e){b.openFile(e)}return o(()=>y.currentMessages,e=>{if(!e.length)return;let t=e[e.length-1];if(t.tool_calls){for(let e of t.tool_calls)if(e.status===`done`&&(e.name===`write`||e.name===`edit`||e.name===`bash`)){b.refreshTree(),b.activeFilePath&&b.revertFile(b.activeFilePath);break}}},{deep:!0}),o(()=>x.activePresetId,e=>{let t=_.params.id;e&&t&&!e.startsWith(`legacy-`)&&x.rememberInstancePreset(t,e)}),(e,i)=>S.value?(s(),r(`div`,h,[t(f,{"instance-id":a(_).params.id},null,8,[`instance-id`])])):n(``,!0)}};export{g as default};
+import{B as e,K as t,U as n,W as r,it as i,jt as a,mt as o,ot as s,st as c}from"./element-plus-DadrrCeP.js";import{r as l}from"./vue-vendor-DroPwbFZ.js";import"./monaco-editor-BZeDFz3E.js";import{_ as u,d,f,m as p,v as m}from"./index-BoUWOr2Q.js";var h={key:0,class:`h-full overflow-hidden`},g={__name:`[id]`,setup(g){let _=l(),v=m(),y=u(),b=d(),x=p(),S=e(()=>v.current),C=e(()=>S.value?.pwd||``);c(`panelProps`,e(()=>({"file-tree":{root:C.value,onSelect:E},files:{root:C.value,onSelect:E},chat:{instance:S.value},"editor-status":{instance:S.value},activity:{instance:S.value},state:{instance:S.value},debug:{instance:S.value},settings:{instance:S.value},modules:{instance:S.value}}))),i(async()=>{await T(),w()}),o(()=>_.params.id,async()=>{await T(),w()});function w(){let e=_.params.id;if(!e)return;x.loadInstanceOverrides(e);let t=x.getInstancePresetId(e),n=t&&x.allPresets[t]?t:`workspace`;x.switchPreset(n)}async function T(){let e=_.params.id;e&&(await v.fetchOne(e),S.value&&y.initForInstance(S.value))}function E(e){b.openFile(e)}return o(()=>y.currentMessages,e=>{if(!e.length)return;let t=e[e.length-1];if(t.tool_calls){for(let e of t.tool_calls)if(e.status===`done`&&(e.name===`write`||e.name===`edit`||e.name===`bash`)){b.refreshTree(),b.activeFilePath&&b.revertFile(b.activeFilePath);break}}},{deep:!0}),o(()=>x.activePresetId,e=>{let t=_.params.id;e&&t&&!e.startsWith(`legacy-`)&&x.rememberInstancePreset(t,e)}),(e,i)=>S.value?(s(),r(`div`,h,[t(f,{"instance-id":a(_).params.id},null,8,[`instance-id`])])):n(``,!0)}};export{g as default};

kohakuterrarium-2.0.0.dev9/src/kohakuterrarium/web_dist/assets/_key_-mOfYdFA8.js → kohakuterrarium-2.0.0.dev11/src/kohakuterrarium/web_dist/assets/_key_-CXi3dOT_.js

@@ -1 +1 @@
-import{$ as e,B as t,Ft as n,G as r,H as i,Mt as a,Nt as o,V as s,W as c,dt as l,it as u,mt as d,nt as f,ot as p,st as m}from"./element-plus-DadrrCeP.js";import{r as h}from"./vue-vendor-DroPwbFZ.js";import"./monaco-editor-BZeDFz3E.js";import{_ as g,m as _,v}from"./index-CAxTq8GR.js";var y={class:`h-screen w-screen flex flex-col bg-warm-50 dark:bg-warm-950 overflow-hidden`},b={class:`flex items-center gap-2 px-3 h-7 border-b border-warm-200 dark:border-warm-700 bg-white dark:bg-warm-900 text-xs shrink-0`},x={class:`font-medium text-warm-700 dark:text-warm-300`},S={class:`text-warm-500 truncate max-w-64`},C={class:`flex-1 min-h-0`},w={key:1,class:`h-full flex items-center justify-center text-warm-400 text-xs`},T={class:`text-center`},E={__name:`[key]`,setup(E){let D=h(),O=_(),k=v(),A=g(),j=t(()=>{let e=String(D.params.key||``),t=e.indexOf(`--`);return t<0?{instanceId:e,panelId:``}:{instanceId:e.slice(0,t),panelId:e.slice(t+2)}}),M=t(()=>O.getPanel(j.value.panelId)),N=t(()=>M.value?.label||j.value.panelId),P=t(()=>({chat:`i-carbon-chat`,canvas:`i-carbon-canvas`,debug:`i-carbon-debug`,activity:`i-carbon-pulse`,state:`i-carbon-data-structured`,creatures:`i-carbon-network-4`,files:`i-carbon-folder`,"monaco-editor":`i-carbon-code`,settings:`i-carbon-settings`})[j.value.panelId]||`i-carbon-panel-expansion`),F=t(()=>k.current),I=t(()=>({chat:{instance:F.value},"status-dashboard":{instance:F.value},activity:{instance:F.value},state:{instance:F.value},creatures:{instance:F.value},files:{root:F.value?.pwd||``,onSelect:()=>{}},settings:{instance:F.value},modules:{instance:F.value},debug:{instance:F.value},"editor-status":{instance:F.value}}));m(`panelProps`,I);let L=t(()=>I.value[j.value.panelId]||{});d([N,F],([e,t])=>{typeof document<`u`&&(document.title=`${e} · ${t?.config_name||`KT`}`)},{immediate:!0});async function R(){let{instanceId:e,panelId:t}=j.value;e&&(await k.fetchOne(e),F.value&&A.initForInstance(F.value),t&&O.markDetached(t,e))}function z(){let{instanceId:e,panelId:t}=j.value;t&&O.unmarkDetached(t,e),typeof window<`u`&&window.close()}return u(R),f(()=>{let{instanceId:e,panelId:t}=j.value;t&&O.unmarkDetached(t,e)}),(t,u)=>(p(),c(`div`,y,[s(`div`,b,[s(`div`,{class:a([P.value,`text-[12px] text-warm-500`])},null,2),s(`span`,x,n(N.value),1),u[1]||=s(`span`,{class:`text-warm-400`},`·`,-1),s(`span`,S,n(F.value?.config_name||`—`),1),u[2]||=s(`span`,{class:`flex-1`},null,-1),s(`button`,{class:`px-2 py-0.5 rounded bg-warm-100 dark:bg-warm-800 text-warm-600 dark:text-warm-300 hover:text-iolite transition-colors`,title:`Close this window (the panel returns to the main window)`,onClick:z},[...u[0]||=[s(`div`,{class:`i-carbon-chevron-right inline-block text-[11px] mr-1`},null,-1),r(` Reattach `,-1)]])]),s(`div`,C,[M.value?.component?(p(),i(l(M.value?.component),o(e({key:0},L.value)),null,16)):(p(),c(`div`,w,[s(`div`,T,[u[3]||=s(`div`,{class:`i-carbon-warning-alt text-2xl mb-2 mx-auto opacity-40`},null,-1),r(` Panel "`+n(j.value.panelId)+`" not registered. `,1)])]))])]))}};export{E as default};
+import{$ as e,B as t,Ft as n,G as r,H as i,Mt as a,Nt as o,V as s,W as c,dt as l,it as u,mt as d,nt as f,ot as p,st as m}from"./element-plus-DadrrCeP.js";import{r as h}from"./vue-vendor-DroPwbFZ.js";import"./monaco-editor-BZeDFz3E.js";import{_ as g,m as _,v}from"./index-BoUWOr2Q.js";var y={class:`h-screen w-screen flex flex-col bg-warm-50 dark:bg-warm-950 overflow-hidden`},b={class:`flex items-center gap-2 px-3 h-7 border-b border-warm-200 dark:border-warm-700 bg-white dark:bg-warm-900 text-xs shrink-0`},x={class:`font-medium text-warm-700 dark:text-warm-300`},S={class:`text-warm-500 truncate max-w-64`},C={class:`flex-1 min-h-0`},w={key:1,class:`h-full flex items-center justify-center text-warm-400 text-xs`},T={class:`text-center`},E={__name:`[key]`,setup(E){let D=h(),O=_(),k=v(),A=g(),j=t(()=>{let e=String(D.params.key||``),t=e.indexOf(`--`);return t<0?{instanceId:e,panelId:``}:{instanceId:e.slice(0,t),panelId:e.slice(t+2)}}),M=t(()=>O.getPanel(j.value.panelId)),N=t(()=>M.value?.label||j.value.panelId),P=t(()=>({chat:`i-carbon-chat`,canvas:`i-carbon-canvas`,debug:`i-carbon-debug`,activity:`i-carbon-pulse`,state:`i-carbon-data-structured`,creatures:`i-carbon-network-4`,files:`i-carbon-folder`,"monaco-editor":`i-carbon-code`,settings:`i-carbon-settings`})[j.value.panelId]||`i-carbon-panel-expansion`),F=t(()=>k.current),I=t(()=>({chat:{instance:F.value},"status-dashboard":{instance:F.value},activity:{instance:F.value},state:{instance:F.value},creatures:{instance:F.value},files:{root:F.value?.pwd||``,onSelect:()=>{}},settings:{instance:F.value},modules:{instance:F.value},debug:{instance:F.value},"editor-status":{instance:F.value}}));m(`panelProps`,I);let L=t(()=>I.value[j.value.panelId]||{});d([N,F],([e,t])=>{typeof document<`u`&&(document.title=`${e} · ${t?.config_name||`KT`}`)},{immediate:!0});async function R(){let{instanceId:e,panelId:t}=j.value;e&&(await k.fetchOne(e),F.value&&A.initForInstance(F.value),t&&O.markDetached(t,e))}function z(){let{instanceId:e,panelId:t}=j.value;t&&O.unmarkDetached(t,e),typeof window<`u`&&window.close()}return u(R),f(()=>{let{instanceId:e,panelId:t}=j.value;t&&O.unmarkDetached(t,e)}),(t,u)=>(p(),c(`div`,y,[s(`div`,b,[s(`div`,{class:a([P.value,`text-[12px] text-warm-500`])},null,2),s(`span`,x,n(N.value),1),u[1]||=s(`span`,{class:`text-warm-400`},`·`,-1),s(`span`,S,n(F.value?.config_name||`—`),1),u[2]||=s(`span`,{class:`flex-1`},null,-1),s(`button`,{class:`px-2 py-0.5 rounded bg-warm-100 dark:bg-warm-800 text-warm-600 dark:text-warm-300 hover:text-iolite transition-colors`,title:`Close this window (the panel returns to the main window)`,onClick:z},[...u[0]||=[s(`div`,{class:`i-carbon-chevron-right inline-block text-[11px] mr-1`},null,-1),r(` Reattach `,-1)]])]),s(`div`,C,[M.value?.component?(p(),i(l(M.value?.component),o(e({key:0},L.value)),null,16)):(p(),c(`div`,w,[s(`div`,T,[u[3]||=s(`div`,{class:`i-carbon-warning-alt text-2xl mb-2 mx-auto opacity-40`},null,-1),r(` Panel "`+n(j.value.panelId)+`" not registered. `,1)])]))])]))}};export{E as default};

kohakuterrarium-2.0.0.dev9/src/kohakuterrarium/web_dist/assets/api-CdBGIjO8.js → kohakuterrarium-2.0.0.dev11/src/kohakuterrarium/web_dist/assets/api-Bz2eaDbk.js

@@ -1 +1 @@
-import"./element-plus-DadrrCeP.js";import{A as e,C as t,D as n,E as r,M as i,N as a,O as o,P as s,S as c,T as l,b as u,j as d,k as f,w as p,x as m}from"./index-CAxTq8GR.js";export{u as agentAPI,e as sessionAPI,a as terrariumAPI};
+import"./element-plus-DadrrCeP.js";import{A as e,C as t,D as n,E as r,M as i,N as a,O as o,P as s,S as c,T as l,b as u,j as d,k as f,w as p,x as m}from"./index-BoUWOr2Q.js";export{u as agentAPI,e as sessionAPI,a as terrariumAPI};

kohakuterrarium-2.0.0.dev11/src/kohakuterrarium/web_dist/assets/axios-COLhni8v.js

@@ -0,0 +1 @@
+import{F as e}from"./index-BoUWOr2Q.js";export{e as default};