diff --git a/_vendor/github.com/docker/docker-agent/docs/community/troubleshooting/index.md b/_vendor/github.com/docker/docker-agent/docs/community/troubleshooting/index.md index ac854ba2c058..1e73169e067b 100644 --- a/_vendor/github.com/docker/docker-agent/docs/community/troubleshooting/index.md +++ b/_vendor/github.com/docker/docker-agent/docs/community/troubleshooting/index.md @@ -228,6 +228,13 @@ Docker Agent validates config at startup and reports errors with line numbers. C ## Session & Connectivity Issues +### Downgrade fails with a newer-database error + +If an older Docker Agent binary cannot open the session database after an upgrade, +the database may contain a schema migration that the older binary does not know. +Restore a database created by the older version, or use a binary that includes the +migration. + ### Port conflicts When running Docker Agent as an API server or MCP server, ensure the port is not already in use: diff --git a/_vendor/github.com/docker/docker-agent/docs/concepts/distribution/index.md b/_vendor/github.com/docker/docker-agent/docs/concepts/distribution/index.md index 915adffa58b5..a2ea3aafde5f 100644 --- a/_vendor/github.com/docker/docker-agent/docs/concepts/distribution/index.md +++ b/_vendor/github.com/docker/docker-agent/docs/concepts/distribution/index.md @@ -108,11 +108,11 @@ $ docker agent run docker.io/myorg/private-agent:latest ``` > [!NOTE] -> **Docker Desktop credentials** +> **Docker authentication** > -> When pulling or running an agent from a `docker.com` or `*.docker.com` HTTPS URL (e.g. `desktop.docker.com`), Docker Agent automatically forwards your Docker Desktop JWT for authentication — no explicit login required when Docker Desktop is running and signed in. +> When pulling or running an agent from a `docker.com` or `*.docker.com` HTTPS URL (e.g. `desktop.docker.com`), Docker Agent automatically forwards a Docker token for authentication. If Docker Desktop is running and signed in, its token is used; otherwise, Docker Agent exchanges the access token stored by `docker login` for a fresh Docker token. Either way, no explicit login step is required beyond `docker login` (or being signed into Docker Desktop). > -> Note: `docker.io` (the standard Docker Hub registry domain) is a separate domain and is **not** covered by automatic JWT forwarding. Agents pulled from `docker.io` or `registry-1.docker.io` still require `docker login docker.io` for private repositories. +> Note: `docker.io` (the standard Docker Hub registry domain) is a separate domain and is **not** covered by automatic token forwarding. Agents pulled from `docker.io` or `registry-1.docker.io` still require `docker login docker.io` for private repositories. > [!NOTE] > **Troubleshooting** diff --git a/_vendor/github.com/docker/docker-agent/docs/concepts/tools/index.md b/_vendor/github.com/docker/docker-agent/docs/concepts/tools/index.md index 03676e0a931d..149e876d9a7a 100644 --- a/_vendor/github.com/docker/docker-agent/docs/concepts/tools/index.md +++ b/_vendor/github.com/docker/docker-agent/docs/concepts/tools/index.md @@ -49,6 +49,12 @@ Docker Agent ships with several built-in tools that require no external dependen | [Handoff](../../tools/handoff/index.md) | Hand the conversation off to another local agent in the same config (auto-enabled with `handoffs:`) | | [A2A](../../tools/a2a/index.md) | Connect to remote agents via the Agent-to-Agent protocol | | [MCP Catalog](../../tools/mcp-catalog/index.md) | Discover and activate remote MCP servers from the Docker MCP Catalog on demand | +| [Git](../../tools/git/index.md) | Read-only git repository inspection | +| [Scheduler](../../tools/scheduler/index.md) | Schedule instructions to run at a time or on a recurring interval | +| [Webhook](../../tools/webhook/index.md) | Outbound notifications to Slack, Discord, Telegram, IFTTT, and more | +| [Plan](../../tools/plan/index.md) | Shared persistent scratchpad for multi-agent collaboration | +| [Session Plan](../../tools/session_plan/index.md) | Per-session plan tracker for the draft/review/execute workflow | +| [Session Context](../../tools/session_context/index.md) | Reference a previous session as context | ## MCP Tools diff --git a/_vendor/github.com/docker/docker-agent/docs/configuration/models/index.md b/_vendor/github.com/docker/docker-agent/docs/configuration/models/index.md index c696794e60ce..0626bd48ef43 100644 --- a/_vendor/github.com/docker/docker-agent/docs/configuration/models/index.md +++ b/_vendor/github.com/docker/docker-agent/docs/configuration/models/index.md @@ -77,7 +77,7 @@ models: | `title_model` | string | ✗ | Model used for session-title generation. Can be a named model from the `models:` section or an inline `provider/model` string. When omitted, the agent's primary model generates titles. Cannot be combined with `first_available`. | | `compaction_model` | string | ✗ | Model used for session compaction (summary generation). Can be a named model or an inline `provider/model` string. The agent-level `compaction_model` takes precedence over this value, which in turn takes precedence over a provider-level default. When none is set, the primary model compacts. Cannot be combined with `first_available`. See the [Context & Compaction guide](../../guides/compaction/index.md). | | `compaction_threshold` | float | ✗ | Fraction of the context window at which proactive auto-compaction triggers for agents running this model. Must be greater than `0` and at most `1`. Takes precedence over the agent-level `compaction_threshold`. Cannot be combined with `first_available`. Default: `0.9`. See the [Context & Compaction guide](../../guides/compaction/index.md). | -| `bypass_models_gateway` | boolean | ✗ | When `true`, this model connects directly to its provider even when a models gateway (`--models-gateway` / `CAGENT_MODELS_GATEWAY`) is configured. Implied by a custom `base_url`. See [Gateway Bypass](#gateway-bypass). | +| `bypass_models_gateway` | boolean | ✗ | When `true`, this model connects directly to its provider even when a models gateway (`--models-gateway` / `DOCKER_AGENT_MODELS_GATEWAY`) is configured. Implied by a custom `base_url`. See [Gateway Bypass](#gateway-bypass). | ## Attachment Capability Overrides @@ -256,7 +256,7 @@ for complete examples. ## Gateway Bypass -When a models gateway (`--models-gateway` / `CAGENT_MODELS_GATEWAY`) is configured, +When a models gateway (`--models-gateway` / `DOCKER_AGENT_MODELS_GATEWAY`) is configured, models without a custom `base_url` route through it by default. Set `bypass_models_gateway: true` on a specific model to make it connect directly to its provider instead: diff --git a/_vendor/github.com/docker/docker-agent/docs/configuration/overview/index.md b/_vendor/github.com/docker/docker-agent/docs/configuration/overview/index.md index 3d50b996c487..705a698cf4af 100644 --- a/_vendor/github.com/docker/docker-agent/docs/configuration/overview/index.md +++ b/_vendor/github.com/docker/docker-agent/docs/configuration/overview/index.md @@ -162,6 +162,8 @@ API keys and secrets are read from environment variables — never stored in con | `DOCKER_AGENT_MODELS_GATEWAY` | Route model traffic through a gateway. Equivalent to the `--models-gateway` flag. | | `DOCKER_AGENT_HIDE_TELEMETRY_BANNER`| Set to `1` to suppress the first-run telemetry notice. | | `DOCKER_AGENT_AUTO_UPDATE` | Set to a truthy value (`1`, `true`, `yes`, `on`) to let standalone release binaries self-update before running. See [Optional Self-Updates](../../getting-started/installation/index.md#optional-self-updates). | +| `DOCKER_AGENT_NO_TOKEN_EXCHANGE` | Set to `1` to stop Docker Agent from exchanging the access token stored by `docker login` for a Docker token. See [Docker authentication](../../guides/secrets/index.md#docker-authentication). | +| `DOCKER_AGENT_HUB_LOGIN_URL` | Point the token exchange at a Docker staging environment. Ignored unless it is an HTTPS `docker.com` URL. | > [!NOTE] > **Legacy `CAGENT_*` aliases** diff --git a/_vendor/github.com/docker/docker-agent/docs/configuration/permissions/index.md b/_vendor/github.com/docker/docker-agent/docs/configuration/permissions/index.md index 58bad45b0893..c49f5df5501b 100644 --- a/_vendor/github.com/docker/docker-agent/docs/configuration/permissions/index.md +++ b/_vendor/github.com/docker/docker-agent/docs/configuration/permissions/index.md @@ -25,13 +25,15 @@ Every session runs in a **safety mode** that decides what happens when no permis | ---- | ---- | ----------- | ------- | | `strict` | ask | ask | ask | | `balanced` | **allow** | ask | ask | +| `restricted` | **allow** | deny | deny | | `autonomous` | **allow** | **allow** | **allow** | - **`strict`** prompts for every tool call, read-only ones included. Only an `allow:` rule silences a prompt. - **`balanced`** runs safe calls silently and asks about everything else. +- **`restricted`** is the fail-closed profile for unattended/headless runs: safe calls run silently and everything else is **denied without asking** — the mode's fallback never prompts. Custom rules still win: an `allow:` rule can approve a destructive/unknown call, a `deny:` rule always blocks, and session-scoped `ask:` rules still prompt (as can a `preempt_yolo` hook). Restricted is defense in depth against unwanted tool calls, not a security boundary — for real isolation use [sandbox mode](../sandbox/index.md). - **`autonomous`** is the legacy `--yolo` behavior: everything runs. Only `deny:` rules, session-scoped `ask:` rules, and `preempt_yolo` hooks still gate. -Pick a mode with the `--safety` flag (`docker-agent run --safety balanced ...`), the `safety_policy` field on session create (`POST /api/sessions`) or mid-session (`PATCH /api/sessions/:id/safety-policy`), or escalate directly from a confirmation prompt (`B` switches to balanced, `A` to autonomous). Sessions that never choose a mode keep the historical default: read-only tools auto-approve, everything else asks. +Pick a mode with the `--safety` flag (`docker-agent run --safety balanced ...`), the `safety_policy` field on session create (`POST /api/sessions`) or mid-session (`PATCH /api/sessions/:id/safety-policy`), or escalate directly from a confirmation prompt (`B` switches to balanced, `A` to autonomous; the `restricted` fallback never prompts, so the mode is only selected via flag/config/API). Sessions that never choose a mode keep the historical default: read-only tools auto-approve, everything else asks. ### Declarative Safety Defaults @@ -54,7 +56,7 @@ agents: safety: strict # overrides runtime.safety for this agent ``` -All four fields accept only the three canonical modes — `strict`, `balanced`, `autonomous` (yes, an author may declare `autonomous`) — and any other value fails loading with an error naming the field. The legacy spellings remain as aliases for `autonomous`: `settings.YOLO`, the alias `yolo` option, and the `--yolo` flag. When both are set at the same scope, `safety` wins over the legacy `YOLO`/`yolo`. +All four fields accept only the four canonical modes — `strict`, `balanced`, `restricted`, `autonomous` (yes, an author may declare `autonomous`) — and any other value fails loading with an error naming the field. The legacy spellings remain as aliases for `autonomous`: `settings.YOLO`, the alias `yolo` option, and the `--yolo` flag. When both are set at the same scope, `safety` wins over the legacy `YOLO`/`yolo`. For a **new** root session the first source in this order wins: @@ -73,7 +75,7 @@ Sessions created through the API (`POST /api/sessions`) without a `safety_policy > [!WARNING] > **Trust: author defaults never outrank you.** `runtime.safety` and `agents..safety` are written by the agent's author — which may be a config you pulled from a URL or an OCI registry. They only fill the gap when you expressed no preference: any user-owned source (CLI flag, alias option, user settings) always takes precedence, and a resumed session keeps its stored mode. Still, an author default of `autonomous` means a fresh session runs every tool call unprompted — review third-party configs before running them, or pin your own floor with `settings.safety` / `--safety`. -**Custom rules always win over the mode**, with one asymmetry: `ask:` rules written in an agent's YAML (or global config) are agent-author advisories and yield to a user-chosen `balanced`/`autonomous` mode, while `ask:` rules granted at the session level (interactive "always ask" decisions, the session permissions API) always prompt. +**Custom rules always win over the mode**, with one asymmetry: `ask:` rules written in an agent's YAML (or global config) are agent-author advisories and yield to a user-chosen `balanced`/`restricted`/`autonomous` mode (under `restricted` they resolve to the mode's allow-or-deny verdict rather than introducing a prompt), while `ask:` rules granted at the session level (interactive "always ask" decisions, the session permissions API) always prompt. ## Permission Levels @@ -299,11 +301,12 @@ Permissions work alongside [hooks](../hooks/index.md). The evaluation order is: 1. Run **`preempt_yolo` pre_tool_use hooks** — security-critical checks that no mode or allow rule can bypass 2. Check **deny** patterns — if matched, tool is blocked 3. Check **allow** patterns — if matched, tool is auto-approved -4. Apply the **[safety mode](#safety-modes)** to the call's safety label — may auto-approve -5. Run **pre_tool_use hooks** — hooks can allow, deny, or ask -6. If no decision, **ask user** for confirmation +4. Check **ask** patterns — if matched, the user is prompted directly, skipping the default `pre_tool_use` lane +5. If no rule matched, apply the **[safety mode](#safety-modes)** to the call's safety label — may auto-approve (or, under `restricted`, deny) +6. On a mode "ask", run **pre_tool_use hooks** — hooks can allow, deny, or ask +7. If no decision, **ask user** for confirmation -Default-lane hooks only see calls the rules and the mode routed to "ask"; they cannot override deny decisions. +Default-lane hooks only see calls the mode routed to "ask"; they cannot override deny decisions or explicit `ask:` rules. > [!WARNING] > **Security Note** diff --git a/_vendor/github.com/docker/docker-agent/docs/configuration/structured-output/index.md b/_vendor/github.com/docker/docker-agent/docs/configuration/structured-output/index.md index ee370e7d6c98..9dc4c9e30343 100644 --- a/_vendor/github.com/docker/docker-agent/docs/configuration/structured-output/index.md +++ b/_vendor/github.com/docker/docker-agent/docs/configuration/structured-output/index.md @@ -57,12 +57,45 @@ agents: ## Properties -| Property | Type | Required | Description | -| ------------- | ------- | -------- | --------------------------------------------------- | -| `name` | string | ✓ | Name identifier for the output schema | -| `description` | string | ✗ | Description of what the output represents | -| `strict` | boolean | ✗ | Enforce strict schema validation (default: `false`) | -| `schema` | object | ✓ | JSON Schema defining the output structure | +| Property | Type | Required | Description | +| ------------- | ------- | -------- | ----------------------------------------------------------------- | +| `name` | string | ✓ | Name identifier for the output schema | +| `description` | string | ✗ | Description of what the output represents | +| `strict` | boolean | ✗ | Enforce strict schema adherence — `native` mode only (default: `false`) | +| `schema` | object | ✓ | JSON Schema defining the output structure | +| `mode` | string | ✗ | Enforcement mode: `native` (default) or `tool` (see [Modes](#modes)) | + +## Modes + +### `native` (default) + +The schema is passed to the provider's native structured-output support (OpenAI JSON mode, Gemini JSON mode, ...). Omitting `mode` keeps this behavior. + +### `tool` + +```yaml +structured_output: + mode: tool + name: analysis_result + schema: + type: object + properties: + summary: + type: string + required: ["summary"] +``` + +In tool mode nothing is sent to the provider's native structured-output API. Instead, the runtime exposes an internal tool named `__structured_output__` whose parameters are exactly the configured schema. The model works normally — including calling other tools — and delivers its final answer by calling that tool, alone, as the only tool call of its response. The runtime validates the arguments against the schema: + +- A valid call ends the turn; the validated (compacted) JSON becomes the final assistant message. +- Invalid JSON gets a detailed tool error so the model can correct itself and retry. +- If the model answers in plain text instead, the runtime injects a transient system reminder and retries (at most 2 reminders), then fails with a `structured_output_failed` error. + +Tool-mode validation applies the full JSON Schema, including `additionalProperties` — unexpected fields are rejected when the schema forbids them. External `$ref` references (`http(s)://`, `file://`, cross-document) are rejected when the schema is compiled; only same-document references starting with `#` (e.g. `#/definitions/item`) are allowed. The `strict` flag has no effect in tool mode. + +Fork-mode skills (`context: fork`) run as exempt sub-sessions: the skill produces its own plain-text answer for the calling agent and is not required to call the output tool. The parent agent still delivers its final answer through the tool. + +Use tool mode when the model must combine tool use with a schema-constrained final answer, or when the provider has no native structured-output support. See [`examples/structured-output-tool-mode.yaml`](https://github.com/docker/docker-agent/blob/main/examples/structured-output-tool-mode.yaml). ## Schema Format @@ -119,7 +152,7 @@ schema: ## Strict Mode -When `strict: true`, the model is constrained to only produce output that exactly matches the schema. This provides stronger guarantees but may limit the model's flexibility. +`strict` only applies to `native` mode: it is passed to the provider's structured-output API. Tool mode ignores it and always validates against the full schema instead. When `strict: true`, the model is constrained to only produce output that exactly matches the schema. This provides stronger guarantees but may limit the model's flexibility. - **`strict: false` (default)** — model aims to match the schema but may include additional fields or slight variations. - **`strict: true`** — model output is constrained to exactly match the schema. Stronger guarantees. @@ -214,4 +247,4 @@ agents: > [!WARNING] > **Tool Limitations** > -> When using structured output, the agent typically cannot use tools since its response format is constrained to the schema. Design your agent workflow accordingly — structured output agents work best for single-turn analysis or extraction tasks. +> When using native structured output, the agent typically cannot use tools since its response format is constrained to the schema. Design your agent workflow accordingly — native structured output agents work best for single-turn analysis or extraction tasks. Use `mode: tool` when the agent needs to call tools before producing its schema-constrained final answer. diff --git a/_vendor/github.com/docker/docker-agent/docs/configuration/user-settings/index.md b/_vendor/github.com/docker/docker-agent/docs/configuration/user-settings/index.md index 4ff74860e8a6..92a050df6d03 100644 --- a/_vendor/github.com/docker/docker-agent/docs/configuration/user-settings/index.md +++ b/_vendor/github.com/docker/docker-agent/docs/configuration/user-settings/index.md @@ -44,7 +44,7 @@ You rarely need to hand-edit this file. Most fields are managed from the TUI's ` | `theme_dark` | string | `default` | Theme applied when `theme: auto` and the terminal background is dark. | | `theme_light` | string | `default-light` | Theme applied when `theme: auto` and the terminal background is light. | | `YOLO` | boolean | `false` | Auto-approve all tool calls globally, across every agent you run. Mirrors the `--yolo` flag and the `/yolo` command. Legacy alias for `safety: autonomous`; when both are set, `safety` wins. | -| `safety` | string | _unset_ | Default [safety mode](../permissions/index.md#safety-modes) for new sessions: `strict`, `balanced`, or `autonomous` (any other value fails config loading). Wins over the legacy `YOLO` flag. Applied when no explicit `--safety`/`--yolo` flag and no alias safety option was given; wins over the agent YAML's `agents..safety` / `runtime.safety` defaults. Never changes the mode of a resumed session. | +| `safety` | string | _unset_ | Default [safety mode](../permissions/index.md#safety-modes) for new sessions: `strict`, `balanced`, `restricted`, or `autonomous` (any other value fails config loading). Wins over the legacy `YOLO` flag. Applied when no explicit `--safety`/`--yolo` flag and no alias safety option was given; wins over the agent YAML's `agents..safety` / `runtime.safety` defaults. Never changes the mode of a resumed session. | | `lean` | boolean | `false` | Make the [lean TUI](../../features/tui/index.md#lean-tui) (simplified, minimal-chrome interface) the default for interactive runs instead of the full TUI. | | `tab_title_max_length` | int | `20` | Maximum display length for tab titles; longer titles are truncated with an ellipsis. | | `restore_tabs` | boolean | `false` | Restore previously open tabs when launching the TUI. | diff --git a/_vendor/github.com/docker/docker-agent/docs/features/a2a/index.md b/_vendor/github.com/docker/docker-agent/docs/features/a2a/index.md index 2e82eecd2c7a..a09f5b006536 100644 --- a/_vendor/github.com/docker/docker-agent/docs/features/a2a/index.md +++ b/_vendor/github.com/docker/docker-agent/docs/features/a2a/index.md @@ -49,6 +49,42 @@ $ docker agent serve a2a myorg/agent:tag | `--hook-session-end ` | (none) | Add a session-end hook (repeatable). | | `--hook-on-user-input ` | (none) | Add an on-user-input hook (repeatable). | | `--hook-stop ` | (none) | Add a stop hook, fired when the model finishes responding (repeatable). | +| `--auth-token ` | (none) | Bearer token required for agent-card and invocation requests. | +| `--cors-origin ` | (none) | Allowed browser origins, comma-separated; empty disables CORS. | +| `--insecure-no-auth` | `false` | Allow an unauthenticated non-loopback listener (unsafe). | +| `--safety ` | `restricted` | Tool safety policy; `autonomous` is permitted only through this explicit CLI flag. | + +## Authentication and network exposure + +Loopback listeners may run without authentication. Non-loopback listeners require +`--auth-token` unless `--insecure-no-auth` explicitly acknowledges the exposure. +Clients must send `Authorization: Bearer ` for both agent-card discovery +and JSON-RPC invocation. Configure browser access with `--cors-origin`; it accepts +comma-separated literal origins or `~`-prefixed regular expressions and permits +credentials only for matching origins. + +```bash +$ docker agent serve a2a ./agent.yaml --auth-token "$A2A_TOKEN" \ + --cors-origin http://localhost:3000 +``` + +## Tool safety and migration + +A2A sessions default to the `restricted` tool safety policy. Precedence is the +`--safety` flag, then agent YAML, then runtime YAML. YAML may select `strict`, +`balanced`, or `restricted`; `safety: autonomous` stops startup and directs the +operator to `--safety autonomous`. That CLI flag is the only deliberate opt-in +to autonomous tool execution. + +Existing deployments should choose an explicit policy before upgrading. Migration +027 labels pre-existing sessions as `run`, so they cannot be resumed through +`/invoke`; clients must start new A2A contexts. An A2A context ID that collides +with another session is rejected without changing that session. + +Downgrading to a binary that predates migration 027 fails because the session +database has a newer schema (`ErrNewerDatabase`). Restore an older database, or +use a binary that includes the migration. Revert changes without removing the +migration catalogue entry. ## Features diff --git a/_vendor/github.com/docker/docker-agent/docs/features/chat-server/index.md b/_vendor/github.com/docker/docker-agent/docs/features/chat-server/index.md index d7e58a31b4bf..6b9957568064 100644 --- a/_vendor/github.com/docker/docker-agent/docs/features/chat-server/index.md +++ b/_vendor/github.com/docker/docker-agent/docs/features/chat-server/index.md @@ -155,7 +155,9 @@ When a request fails — for example because the model returns an error or the ` ## Authentication -The chat server has **no authentication by default**. To require a Bearer +The chat server defaults to loopback binding. A non-loopback `--listen` address requires `--api-key`, `--api-key-env`, or the explicit `--insecure-no-auth` override. An environment variable selected by `--api-key-env` must be set and non-empty. + +To require a Bearer token, pass `--api-key` (literal value) or `--api-key-env` (name of an environment variable that holds the value): @@ -170,7 +172,11 @@ protected once a key is set. > [!WARNING] > **Public exposure** > -> The default listen address is `127.0.0.1:8083`. If you bind to a non-loopback address, always set `--api-key` or `--api-key-env` — there is no other authentication layer. +> The default listen address is `127.0.0.1:8083`. Non-loopback binding is rejected unless `--api-key`, `--api-key-env`, or `--insecure-no-auth` is supplied. Use the insecure override only behind a trusted authentication boundary. + +## Tool safety + +The chat server resolves its safety policy in this order: `--safety`, agent configuration, runtime configuration, then `restricted`. Cached conversations retain the more restrictive of their prior policy and the server policy, so a continuation cannot regain permissions after the server policy becomes stricter. ## CORS @@ -194,7 +200,9 @@ docker agent serve chat | [flags] | `-l, --listen ` | `127.0.0.1:8083` | Address to listen on. | | `--cors-origin ` | (none) | Allowed CORS origin (e.g. `https://example.com`). Empty disables CORS. | | `--api-key ` | (none) | Required Bearer token clients must present (`Authorization: Bearer `). Empty disables auth. | -| `--api-key-env ` | (none) | Read the API key from this environment variable instead of the command line. | +| `--api-key-env ` | (none) | Read the required API key from this non-empty environment variable. | +| `--insecure-no-auth` | `false` | Permit unauthenticated non-loopback binding. Use only behind a trusted authentication boundary. | +| `--safety ` | `restricted` | Tool safety policy. CLI value overrides agent/runtime configuration. | | `--max-request-size ` | `1048576` (1 MiB) | Maximum request body size in bytes. Requests whose body exceeds this limit are rejected with HTTP 413 (Request Entity Too Large) — see [Troubleshooting: HTTP 413](../../community/troubleshooting/index.md#http-413-request-body-too-large) if you hit this. | | `--request-timeout ` | `5m` | Per-request timeout (covers model + tool calls + streaming). | | `--conversations-max ` | `0` | Cache up to N conversations server-side, keyed by `X-Conversation-Id`. `0` disables — clients must resend history. | diff --git a/_vendor/github.com/docker/docker-agent/docs/features/cli/index.md b/_vendor/github.com/docker/docker-agent/docs/features/cli/index.md index 688823172f71..41db671d409d 100644 --- a/_vendor/github.com/docker/docker-agent/docs/features/cli/index.md +++ b/_vendor/github.com/docker/docker-agent/docs/features/cli/index.md @@ -29,7 +29,7 @@ $ docker agent run [config] [message...] [flags] | --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | | `-a, --agent ` | Run a specific agent from the config | | `--yolo` | Auto-approve tool calls (unless explicitly denied). Legacy alias for `--safety autonomous`. | -| `--safety ` | Safety mode for tool approval: `strict` (ask for everything), `balanced` (auto-approve safe calls), or `autonomous` (approve everything). Wins over `--yolo` when both are given. Without the flag, the mode falls back to alias/user-config defaults, then the agent YAML's `agents..safety` / `runtime.safety`; a resumed session keeps its stored mode unless `--safety`/`--yolo` is passed explicitly. See [Safety Modes](../../configuration/permissions/index.md#safety-modes). | +| `--safety ` | Safety mode for tool approval: `strict` (ask for everything), `balanced` (auto-approve safe calls), `restricted` (auto-approve safe calls, deny the rest — fail-closed for unattended runs), or `autonomous` (approve everything). Wins over `--yolo` when both are given. Without the flag, the mode falls back to alias/user-config defaults, then the agent YAML's `agents..safety` / `runtime.safety`; a resumed session keeps its stored mode unless `--safety`/`--yolo` is passed explicitly. See [Safety Modes](../../configuration/permissions/index.md#safety-modes). | | `--model ` | Override model(s). Use `provider/model` for all agents, or `agent=provider/model` for specific agents. Comma-separate multiple overrides. | | `--session ` | Resume a previous session. Supports relative refs (`-1` = newest by creation time, `-2` = second-newest, … — creation order, not last-used). An explicit ID that does not exist yet is created with that ID, so a supervisor can own the session ID upfront and reuse it across runs. | | `-s, --session-db ` | Path to the SQLite session database (default: `/session.db`, so `~/.cagent/session.db` unless `--data-dir` is set) | @@ -318,6 +318,9 @@ $ docker agent serve mcp [flags] | `-a, --agent ` | (all agents) | Name of the agent to expose. If omitted, every agent in the config is exposed as a separate tool. | | `--tool-name ` | (agent name) | Override the MCP tool identifier clients call; only valid when exposing a single agent. | | `--http` | `false` | Use streaming HTTP transport instead of stdio. | +| `--safety ` | `restricted` | HTTP MCP safety policy; no effect on stdio or `--attach`. | +| `--auth-token ` | (none) | Required Bearer token for HTTP MCP requests. | +| `--insecure-no-auth` | `false` | Permit unauthenticated non-loopback HTTP MCP binding. | | `-l, --listen ` | `127.0.0.1:8081` | Address to listen on (only used with `--http`). | | `--mcp-keepalive `| `0` (disabled) | Interval between MCP keep-alive pings (e.g. `30s`). | | `--attach [target]` | (none) | Attach to a running TUI run by pid, address, or session id; given without a value, selects the most recent run. | @@ -394,7 +397,9 @@ $ docker agent serve chat [flags] | `-l, --listen ` | `127.0.0.1:8083` | Address to listen on. | | `--cors-origin ` | (none) | Allowed CORS origin (e.g. `https://example.com`). Empty disables CORS. | | `--api-key ` | (none) | Required Bearer token clients must present (`Authorization: Bearer `). Empty disables auth. | -| `--api-key-env ` | (none) | Read the API key from this environment variable instead of the command line. | +| `--api-key-env ` | (none) | Read the required API key from this non-empty environment variable. | +| `--insecure-no-auth` | `false` | Permit unauthenticated non-loopback binding. | +| `--safety ` | `restricted` | Tool safety policy; CLI value overrides agent/runtime configuration. | | `--max-request-size ` | `1048576` (1 MiB) | Maximum request body size. Requests exceeding this limit are rejected with HTTP 413 — see [Troubleshooting: HTTP 413](../../community/troubleshooting/index.md#http-413-request-body-too-large). | | `--request-timeout ` | `5m` | Per-request timeout (covers model + tool calls + streaming). | | `--conversations-max ` | `0` | Cache up to N conversations server-side, keyed by `X-Conversation-Id`. `0` disables — clients must resend history. | @@ -449,6 +454,48 @@ $ docker agent share pull docker.io/username/my-agent:latest --force See [Agent Distribution](../../concepts/distribution/index.md) for full registry workflow details. +### `docker agent sessions diff` + +Compare two recorded sessions and report the first point where the agent behaved +differently — the triage answer when a task that worked yesterday does not work +today. + +```bash +$ docker agent sessions diff [flags] +``` + +```console +$ docker agent sessions diff -1 -2 +Comparing a1b2c3d4 (7 turns) against e5f6a7b8 (9 turns) + +❌ First divergence at turn 3 (after 3 matching turn(s)). + a1b2c3d4 called: + read_file({"path":"pkg/cache/cache.go"}) + e5f6a7b8 called: + search_files_content({"query":"persistToDisk","path":"."}) + +Everything after this point is downstream of the divergence and is not compared. +``` + +Session references accept a full ID, a unique ID prefix, or a relative form such +as `-1` for the most recent run. + +| Flag | Default | Description | +| ----------------------- | ----------------------- | ------------------------------------------------ | +| `-s, --session-db` | `/session.db` | Path to the session database | +| `--json` | `false` | Emit the comparison as JSON | +| `--fail-on-divergence` | `false` | Exit non-zero when the two sessions diverge | + +Comparison is over the sequence of tool calls, not the assistant's prose: model +output is nondeterministic, so two runs of the same task almost always word +things differently while doing the same work. Turns taken by delegated +sub-agents are included in sequence. Reporting stops at the first divergence — +everything after it is downstream of that difference. + +This locates *where* two runs diverged, not *why*. Re-running a session against +a different model while holding the environment fixed is a separate, unbuilt +feature. + ### `docker agent eval` Run agent evaluations against a directory of recorded sessions. @@ -468,6 +515,8 @@ $ docker agent eval | [|./evals] [flags] | `--keep-containers` | `false` | Keep containers after evaluation (don't remove with `--rm`) | | `-e, --env` | (none) | Environment variables to pass to container (`KEY` or `KEY=VALUE`, repeatable) | | `--repeat ` | `1` | Number of times to repeat each evaluation (useful for computing baselines) | +| `--baseline ` | (none) | Compare against a previously saved run JSON (`/.json`) and exit non-zero on regression | +| `--regression-tolerance ` | `0` | How far an aggregate quality rate may fall before `--baseline` reports a regression (0–1) | All [runtime configuration flags](#runtime-configuration-flags) are also accepted. @@ -524,7 +573,7 @@ $ docker agent run yolo-coder **Alias Options:** Aliases can include runtime options that apply automatically when used: - `--yolo` — Auto-approve tool calls (unless explicitly denied) when running the alias. Legacy alias for `--safety autonomous`. -- `--safety ` — Default [safety mode](../../configuration/permissions/index.md#safety-modes) (`strict`, `balanced`, or `autonomous`) when running the alias. Wins over the alias's `yolo` option; both are stored declaratively in the user config (`aliases..safety` / `aliases..yolo`), so you can also edit them there by hand. +- `--safety ` — Default [safety mode](../../configuration/permissions/index.md#safety-modes) (`strict`, `balanced`, `restricted`, or `autonomous`) when running the alias. Wins over the alias's `yolo` option; both are stored declaratively in the user config (`aliases..safety` / `aliases..yolo`), so you can also edit them there by hand. - `--model ` — Override the model for the alias - `--hide-tool-results` — Hide tool call results in the TUI when running the alias - `--sandbox` — Always run the alias inside a [Docker sandbox](../../configuration/sandbox/index.md) @@ -677,7 +726,7 @@ $ docker agent debug [flags] | `toolsets ` | List every toolset each agent in the config exposes, with each tool's name and description. | | `skills ` | List the skills discovered for each agent, marking forked skills. | | `title ` | Generate a session title for `` using the same title-generation path the TUI uses (including any configured `title_model`), without starting a session. See [Session Titles](../sessions/index.md#session-titles). | -| `auth` | Print parsed Docker Desktop authentication info from the locally stored JWT (subject, issuer, expiry, username/email). Add `--json` for machine-readable output. | +| `auth` | Print parsed Docker authentication info from the token in use (source, subject, issuer, expiry, username/email). Add `--json` for machine-readable output. | | `oauth list` | List stored MCP OAuth tokens (resource, scope, expiry, redacted access token). Add `--json` for machine-readable output. | | `oauth remove ` | Remove a stored MCP OAuth token. | | `oauth login ` | Perform an interactive OAuth login for a remote MCP server declared in the config, by its name or URL. See [Remote MCP Servers](../remote-mcp/index.md). | @@ -696,7 +745,9 @@ $ docker agent debug oauth login agent.yaml github > [!WARNING] > **`debug auth --json` prints the full bearer token** > -> The text output of `debug auth` truncates the token to a short preview, but `--json` includes the complete, unredacted JWT in its `token` field. Never paste `debug auth --json` output into logs, issue trackers, or bug reports — anyone with that token can act as you against Docker Desktop's backend. Use the plain-text output (or redact the `token` field yourself) when sharing diagnostic output. +> The text output of `debug auth` truncates the token to a short preview, but `--json` includes the complete, unredacted JWT in its `token` field. Never paste `debug auth --json` output into logs, issue trackers, or bug reports — anyone with that token can act as you against Docker. Use the plain-text output (or redact the `token` field yourself) when sharing diagnostic output. + +The `Source` field says where the token came from: `docker desktop`, or `minted from the stored access token` when it was obtained by exchanging the access token `docker login` stored. See [Docker authentication](../../guides/secrets/index.md#docker-authentication). The `config`, `toolsets`, `skills`, and `title` subcommands also accept [runtime configuration flags](#runtime-configuration-flags) (`--working-dir`, `--models-gateway`, …); `title` additionally accepts `--model` to override the model used to resolve the config before generating the title. diff --git a/_vendor/github.com/docker/docker-agent/docs/features/evaluation/index.md b/_vendor/github.com/docker/docker-agent/docs/features/evaluation/index.md index 03c36a9fc1c6..c90701dec2e4 100644 --- a/_vendor/github.com/docker/docker-agent/docs/features/evaluation/index.md +++ b/_vendor/github.com/docker/docker-agent/docs/features/evaluation/index.md @@ -139,6 +139,10 @@ Docker Agent evaluates agents across three dimensions: | **Relevance** | An LLM judge (configurable via `--judge-model`) evaluates whether each relevance statement is satisfied by the response. | | **Size** | Whether the response length matches the expected size category (S/M/L/XL). | +## Serve-safety verification and rollback + +When changing an agent served over MCP HTTP, chat, or A2A, add an evaluation that attempts an approval-requiring tool call and verifies the resolved safety policy and authentication behavior. Run the evaluation with the same explicit `--safety` setting used in deployment. If a rollout must be reversed, stop the affected listener, restore the prior agent configuration and explicit safety flag, then restart only after confirming non-loopback listeners still require authentication. Do not restore an unauthenticated network listener as a rollback shortcut. + ## Creating Eval Sessions The easiest way to create eval sessions is from real conversations: @@ -168,6 +172,39 @@ $ docker agent eval | [|./evals] | `--keep-containers` | `false` | Keep containers after evaluation (don't remove with `--rm`) | | `-e, --env` | (none) | Environment variables to pass to container (`KEY` or `KEY=VALUE`) | | `--repeat` | `1` | Number of times to repeat each evaluation (useful for computing baselines) | +| `--baseline` | (none) | Compare against a previously saved run JSON and exit non-zero on regression (see [Regression gate](#regression-gate)) | +| `--regression-tolerance` | `0` | How far an aggregate quality rate may fall before `--baseline` reports a regression (0–1) | + +### Regression gate + +`--baseline` compares the run against a previous one and exits non-zero when +quality regressed, so an eval suite can gate CI: + +```console +$ docker agent eval ./agent.yaml --baseline results/2026-08-01-run.json +``` + +The baseline is the run JSON written by a previous invocation — +`/.json` — so there is no separate artifact to produce. + +Four rules decide the verdict, and they are worth knowing before wiring this +into CI: + +- **The tolerance governs aggregate rates only.** An LLM judge does not return + the same score twice, so without a tolerance the gate flaps. `--regression-tolerance 0.05` + lets an aggregate rate fall five points before it counts. +- **An evaluation that passed and now fails always gates**, regardless of the + tolerance. That transition is the signal the gate exists to catch, so it is + never absorbed. +- **Cost is reported but never gates.** A provider price change is not a quality + regression. +- **An added *failing* evaluation gates** via the aggregate rate, even though no + existing evaluation regressed. A suite that got worse should say so — but it + means committing a known-failing eval needs a tolerance bump or a fix. + +A baseline that carries no evaluations, or a run that produced none (an +`--only` pattern that matched nothing), is rejected rather than reported as +passing: a gate that cannot fail is worse than no gate. ### Provider Credentials diff --git a/_vendor/github.com/docker/docker-agent/docs/features/mcp-mode/index.md b/_vendor/github.com/docker/docker-agent/docs/features/mcp-mode/index.md index bc01ef3b1f10..9e3ae0bf69eb 100644 --- a/_vendor/github.com/docker/docker-agent/docs/features/mcp-mode/index.md +++ b/_vendor/github.com/docker/docker-agent/docs/features/mcp-mode/index.md @@ -45,8 +45,8 @@ To expose the MCP server over streaming HTTP instead, pass `--http`: # Streaming HTTP transport on the default 127.0.0.1:8081 $ docker agent serve mcp ./agent.yaml --http -# Override the listen address / port -$ docker agent serve mcp ./agent.yaml --http --listen 0.0.0.0:9090 +# Override the listen address / port; non-loopback HTTP requires authentication +$ docker agent serve mcp ./agent.yaml --http --listen 0.0.0.0:9090 --auth-token "$MCP_BEARER_TOKEN" ``` | Flag | Default | Description | @@ -55,10 +55,17 @@ $ docker agent serve mcp ./agent.yaml --http --listen 0.0.0.0:9090 | `-l`, `--listen` | `127.0.0.1:8081` | Address to listen on when `--http` is enabled. | | `-a`, `--agent` | all agents | Expose a single named agent instead of every agent in the config. | | `--tool-name` | (none) | Override the MCP tool identifier clients call (defaults to agent name); only valid when exposing one agent. | +| `--auth-token` | (none) | Require this Bearer token for HTTP requests. Required for non-loopback HTTP unless explicitly overridden. | +| `--insecure-no-auth` | `false` | Permit unauthenticated non-loopback HTTP. Use only behind a trusted authentication boundary. | +| `--safety` | `restricted` | Tool safety policy for HTTP requests. CLI value overrides agent/runtime configuration. | | `--mcp-keepalive` | `0` | Interval between MCP keep-alive pings (e.g. `30s`); `0` disables keep-alive. | Runtime configuration flags such as `--working-dir`, `--env-from-file`, `--models-gateway`, and hook flags are also available — see the [CLI reference](../cli/index.md). +## HTTP security + +HTTP MCP defaults to loopback binding. A non-loopback `--listen` address requires `--auth-token`; use `--insecure-no-auth` only when a trusted reverse proxy or network boundary authenticates clients. The safety policy is resolved in this order: `--safety`, agent configuration, runtime configuration, then `restricted`. These HTTP-only flags do not affect stdio or `--attach` operation. + ## Using with Claude Desktop Add a configuration to your Claude Desktop MCP settings file: diff --git a/_vendor/github.com/docker/docker-agent/docs/guides/headless/index.md b/_vendor/github.com/docker/docker-agent/docs/guides/headless/index.md index 6be79908dc83..76a87bd4d505 100644 --- a/_vendor/github.com/docker/docker-agent/docs/guides/headless/index.md +++ b/_vendor/github.com/docker/docker-agent/docs/guides/headless/index.md @@ -92,7 +92,7 @@ Interactively, the TUI prompts for confirmation before a tool call runs unless i Two different questions come up here, and it's worth keeping them separate: -- **What is allowed to run without asking?** — the safety mode (`--safety strict|balanced|autonomous`, with `--yolo` as the legacy spelling of `autonomous`) and permission allow-lists answer this. +- **What is allowed to run without asking?** — the safety mode (`--safety strict|balanced|restricted|autonomous`, with `--yolo` as the legacy spelling of `autonomous`) and permission allow-lists answer this. - **What happens if the model runs something it shouldn't have?** — only `--sandbox` answers that one. The rest of this section explains why, and treats that distinction as the whole point. ### `--sandbox`: the isolation boundary @@ -114,12 +114,29 @@ Permission allow-lists (`permissions.allow` on the agent, or `settings.permissio - Both work by matching the shell command **string** (or, for `permissions`, the tool's arguments). The classifier's safe-list refuses to vouch for any command carrying shell metacharacters (`;`, `&`, `|`, `<`, `>`, backticks, `$(`, newlines — spaced or not), so `ls && rm -rf ~`, `grep foo|rm -rf /`, and `grep x > /etc/passwd` all fall through to a confirmation instead of inheriting a safe verdict. But string matching still can't reason about what a command actually *does* — see the next point. - Command-string and argument matching in general can't reason about what a command actually does; a dynamically built string, an unusual quoting form, or a wrapper script can slip past any fixed set of patterns. -Treat permissions and the balanced mode as a way to reduce prompt fatigue and catch the obvious cases, paired with least-privilege CI credentials — never as the reason a CI job is safe to run unattended. For that, use `--sandbox`. +For unattended runs, the `restricted` safety mode packages this stance as a fail-closed default: classifier-safe calls run, every other unmatched call is **denied outright** instead of falling through to a confirmation prompt nobody will answer. Pair it with an allow-list scoped to what the job actually needs — explicit `allow` rules still win over the mode, so the job's known-good commands run even when the classifier can't vouch for them: + +```yaml +# agent.yaml — the allow-list overrides restricted's deny for these calls +permissions: + allow: + - "shell:cmd=go test*" + - "shell:cmd=go build*" +``` + +```bash +# Safe and allow-listed calls run; every other call is denied without prompting +$ docker agent run --exec --safety restricted agent.yaml --json "Fix the failing test" +``` + +Like the allow-list itself, `restricted` is defense in depth, not a security boundary: it narrows what runs unattended, but only `--sandbox` contains what a misbehaving agent can do with the calls that are allowed. + +Treat permissions and the balanced/restricted modes as a way to reduce prompt fatigue and catch the obvious cases, paired with least-privilege CI credentials — never as the reason a CI job is safe to run unattended. For that, use `--sandbox`. > [!WARNING] > **`--yolo` without `--sandbox` runs untrusted, unattended code with no boundary** > -> A CI job is exactly the environment where a runaway or misled agent does the most damage before anyone notices — no one is at the keyboard to catch a bad `shell` call before it runs, and, per above, a permission allow-list or the shell classifier can't be trusted to catch everything either. If you can't add `--sandbox`, prefer `--safety balanced` or a permission allow-list scoped to what the job actually needs over blanket `--yolo`, and budget for the credentials and blast radius of the agent's toolsets as if the job itself were compromised — see [`examples/permissions.yaml`](https://github.com/docker/docker-agent/blob/main/examples/permissions.yaml) for a worked allow/deny list. +> A CI job is exactly the environment where a runaway or misled agent does the most damage before anyone notices — no one is at the keyboard to catch a bad `shell` call before it runs, and, per above, a permission allow-list or the shell classifier can't be trusted to catch everything either. If you can't add `--sandbox`, prefer `--safety restricted` with a permission allow-list scoped to what the job actually needs over blanket `--yolo`, and budget for the credentials and blast radius of the agent's toolsets as if the job itself were compromised — see [`examples/permissions.yaml`](https://github.com/docker/docker-agent/blob/main/examples/permissions.yaml) for a worked allow/deny list. > [!NOTE] > **A worktree is not a security boundary either** diff --git a/_vendor/github.com/docker/docker-agent/docs/guides/secrets/index.md b/_vendor/github.com/docker/docker-agent/docs/guides/secrets/index.md index 1cc653db6b28..26fe93547132 100644 --- a/_vendor/github.com/docker/docker-agent/docs/guides/secrets/index.md +++ b/_vendor/github.com/docker/docker-agent/docs/guides/secrets/index.md @@ -184,6 +184,14 @@ The command is invoked with the variable name appended as the final argument, an On machines where Docker Desktop is installed, Docker Agent queries Docker Desktop's backend for secrets stored against your signed-in Docker account. This is transparent — no extra configuration — and it is how signed-in Docker users get provider API keys without setting any environment variables. +## Docker Authentication + +Routing model traffic through the [Docker models gateway](../../configuration/models/index.md) needs a Docker token. Docker Desktop hands out one that is valid for 15 minutes and cannot be renewed by Docker Agent, so when Desktop has nothing usable to offer — it is signed out, not running, or its own refresh is stuck — Docker Agent exchanges the long-lived access token that `docker login` left in your credential store for a fresh Docker token, the same exchange `docker login` itself performs. Signing in with `docker login` is therefore enough; Docker Desktop is not required. + +Only Docker access tokens are exchanged — the `dckr_…` secrets `docker login` stores — never an account password, and the exchange goes to Docker Hub over HTTPS. The resulting bearer token is cached in a private file under Docker Agent's cache directory so sibling processes reuse it instead of minting their own, and it stops being used within seconds of a `docker logout` or an account switch. Run `docker agent debug auth` to see which token is in use and where it came from. + +Set `DOCKER_AGENT_NO_TOKEN_EXCHANGE=1` to opt out: Docker Agent then relies on Docker Desktop alone. + ## 1Password References Any secret value resolved through the chain above can be a **1Password secret reference** instead of the literal secret. If the value starts with `op://`, Docker Agent resolves it by invoking the [1Password CLI](https://developer.1password.com/docs/cli/) (`op read `) and uses the result. diff --git a/_vendor/github.com/docker/docker-agent/docs/tools/a2a/index.md b/_vendor/github.com/docker/docker-agent/docs/tools/a2a/index.md index 9e405ab49454..f07a9fe62435 100644 --- a/_vendor/github.com/docker/docker-agent/docs/tools/a2a/index.md +++ b/_vendor/github.com/docker/docker-agent/docs/tools/a2a/index.md @@ -27,6 +27,8 @@ toolsets: X-Tenant: "acme" ``` +The `Authorization` header shown above authenticates to endpoints served with `docker agent serve a2a --auth-token`. + ## Properties | Property | Type | Required | Description | diff --git a/_vendor/github.com/docker/docker-agent/docs/tools/filesystem/index.md b/_vendor/github.com/docker/docker-agent/docs/tools/filesystem/index.md index 42a5471619f9..19b0be53e1c2 100644 --- a/_vendor/github.com/docker/docker-agent/docs/tools/filesystem/index.md +++ b/_vendor/github.com/docker/docker-agent/docs/tools/filesystem/index.md @@ -44,13 +44,24 @@ This helps agents distinguish between an empty directory and a tool failure, avo | `read_file` | Read the contents of a file (whole file, or a line range of a text file) | | `read_multiple_files` | Read several files in one call (more efficient than multiple `read_file`) | | `write_file` | Create or overwrite a file with new content | -| `edit_file` | Make line-based edits (find-and-replace) in an existing file | +| `edit_file` | Make line-based edits (find-and-replace) in an existing file. Each edit must specify a non-empty `oldText` to match and replace; empty `oldText` values are rejected with an error. | | `list_directory` | List files and directories at a given path (explicitly reports empty directories) | | `directory_tree` | Recursive tree view of a directory | | `create_directory` | Create a new directory (creates parent directories as needed) | | `remove_directory` | Remove an empty directory | | `search_files_content` | Search for text or regex patterns across files | +## edit_file Validation + +The `edit_file` tool applies a sequence of find-and-replace edits to a file in memory, then writes the result back atomically. Each edit must provide a non-empty `oldText` value: + +- **Valid**: `{"oldText": "line one", "newText": "LINE ONE"}` +- **Invalid**: `{"oldText": "", "newText": "INJECTED"}` — rejected with error + +An empty `oldText` is never a meaningful edit: Go's `strings.Contains(s, "")` is always `true`, and `strings.Replace(s, "", new, 1)` silently inserts at offset 0. Without validation, this would prepend content to the file while still reporting success. The tool now returns an explicit error ("oldText must not be empty") when an edit has an empty `oldText`, and no changes are written to disk. + +When a sequence contains multiple edits and a later one is rejected, the entire operation fails and the file is left untouched — edits are applied in memory and only written once at the end, so partial application is not possible. + ## Configuration ```yaml diff --git a/_vendor/github.com/docker/docker-agent/docs/tools/plan/index.md b/_vendor/github.com/docker/docker-agent/docs/tools/plan/index.md index bea761a6f887..3f27b0198939 100644 --- a/_vendor/github.com/docker/docker-agent/docs/tools/plan/index.md +++ b/_vendor/github.com/docker/docker-agent/docs/tools/plan/index.md @@ -160,18 +160,6 @@ Keybindings: Every mutation is guarded by the version shown on screen (the same optimistic locking as `last_known_revision`): if an agent changed the plan in the meantime, the write is rejected, a notification reports the current version, the newer content is left intact and re-read into the browser, and an edit draft is kept in a temp file so nothing is lost. Session plans are read-only here — status, edit, and delete report why instead of attempting the write. The browser also refreshes live when agents in the same process write, re-status, or delete plans (and when this session's agent updates its session plan); in the lean TUI, which has no overlays, `/plans` is unavailable. -## Related plan work - -Plan support grew across several issues and pull requests; they are useful context for the design decisions on this page: - -- [#2788](https://github.com/docker/docker-agent/issues/2788) — proposed `/plan`, approval UX, and plan/execution separation; superseded by read-only planner sub-agents and the dedicated plan tools. -- [#3227](https://github.com/docker/docker-agent/pull/3227) / [#3237](https://github.com/docker/docker-agent/issues/3237) — introduced the shared `plan` toolset and its pluggable-storage direction. -- [#3239](https://github.com/docker/docker-agent/pull/3239) — added the pluggable `Storage` interface. -- [#3263](https://github.com/docker/docker-agent/issues/3263) / [#3274](https://github.com/docker/docker-agent/pull/3274) — file-based revisions, export, free-form status, and optimistic locking. -- [#3292](https://github.com/docker/docker-agent/pull/3292) / [#3305](https://github.com/docker/docker-agent/pull/3305) — the per-session markdown plan of the [session plan toolset](../session_plan/index.md) and its `exit_plan_mode` marker, alongside the shared plan toolset. -- [#3140](https://github.com/docker/docker-agent/pull/3140) / [#3168](https://github.com/docker/docker-agent/pull/3168) — related plan-mode and persona history. -- [#3844](https://github.com/docker/docker-agent/issues/3844) — the host-facing management layer: the [`docker agent plans` CLI](../../features/cli/index.md#docker-agent-plans) and the TUI `/plans` browser documented above. - > [!TIP] > **Plan vs. Todo vs. Tasks** > diff --git a/_vendor/github.com/docker/docker-agent/docs/tools/shell/index.md b/_vendor/github.com/docker/docker-agent/docs/tools/shell/index.md index 4649dff3aad9..5da9fc8f8233 100644 --- a/_vendor/github.com/docker/docker-agent/docs/tools/shell/index.md +++ b/_vendor/github.com/docker/docker-agent/docs/tools/shell/index.md @@ -59,7 +59,7 @@ Every shell command is classified against an embedded taxonomy before the approv - **Known-safe reads** (`ls`, `cat`, `git status`, `git diff`, `docker ps`, `docker logs`, `kubectl get`, …) are labelled `safe`. - **Everything else** is labelled `unknown`. -The session's [safety mode](../../configuration/permissions/index.md#safety-modes) decides what each label means: `strict` asks about everything, `balanced` auto-runs safe commands and asks about destructive/unknown ones, `autonomous` runs everything. Custom permission rules always win over the mode. +The session's [safety mode](../../configuration/permissions/index.md#safety-modes) decides what each label means: `strict` asks about everything, `balanced` auto-runs safe commands and asks about destructive/unknown ones, `restricted` auto-runs safe commands and denies destructive/unknown ones without asking (fail-closed for unattended runs), `autonomous` runs everything. Custom permission rules always win over the mode. Compound shell (`a && b`, `a; b`, `a | b`) is never matched against the safe allowlist; any destructive segment falls through to ask. The full taxonomy lives in [`pkg/safety/safety_patterns.json`](https://github.com/docker/docker-agent/blob/main/pkg/safety/safety_patterns.json). diff --git a/_vendor/modules.txt b/_vendor/modules.txt index 734b01b27239..1ac92137fbbf 100644 --- a/_vendor/modules.txt +++ b/_vendor/modules.txt @@ -4,4 +4,4 @@ # github.com/docker/cli v29.7.2+incompatible # github.com/docker/compose/v5 v5.5.0 # github.com/docker/model-runner v1.1.36 -# github.com/docker/docker-agent v1.124.0 +# github.com/docker/docker-agent v1.126.0 diff --git a/go.mod b/go.mod index 2db4e7eec662..eb4897444a12 100644 --- a/go.mod +++ b/go.mod @@ -11,7 +11,7 @@ require ( github.com/docker/buildx v0.36.1 github.com/docker/cli v29.7.2+incompatible github.com/docker/compose/v5 v5.5.0 - github.com/docker/docker-agent v1.124.0 + github.com/docker/docker-agent v1.126.0 github.com/docker/model-runner v1.1.36 github.com/moby/buildkit v0.32.2 github.com/moby/moby/api v1.55.0 diff --git a/go.sum b/go.sum index f1c5eb8fadbf..7f20917de281 100644 --- a/go.sum +++ b/go.sum @@ -156,6 +156,8 @@ github.com/docker/docker-agent v1.122.0 h1:xOei5d7L1M0stvZNwULnOssOS4CzDRE2Xj7k1 github.com/docker/docker-agent v1.122.0/go.mod h1:HgHOV3OkqM1Hl0qD7iTCBZSBNWpy5mWN2s8tr2/NdOA= github.com/docker/docker-agent v1.124.0 h1:dNVrrRozYq5IMgokjaSm6grYReEMP1inrEaHVnVQiyg= github.com/docker/docker-agent v1.124.0/go.mod h1:CyLlU/NVcq3kSjffVzRKNaO0XIngqKPOxhgmbru+LWE= +github.com/docker/docker-agent v1.126.0 h1:GjX84SHcvS4Txo7dGjatWhKGFLNpDqKcGAoIsyvfj40= +github.com/docker/docker-agent v1.126.0/go.mod h1:K38q6CsnSTHDOrLP46HLGhKwv3i+vjmu33cjmjpkAvg= github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8= github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo= github.com/docker/docker-credential-helpers v0.9.5 h1:EFNN8DHvaiK8zVqFA2DT6BjXE0GzfLOZ38ggPTKePkY=