Merge remote-tracking branch 'origin/main' into feat/live-model-switching

Author: Ambient Code Bot

.github/workflows/amber-issue-handler.yml

@@ -42,6 +42,13 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
+      - name: Acknowledge issue
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh api repos/${{ github.repository }}/issues/${{ github.event.issue.number }}/reactions \
+            -X POST -f content=eyes --silent || true
+
       - name: Resolve issue details
         id: issue
         env:
@@ -66,6 +73,14 @@ jobs:
             echo "skip=false" >> $GITHUB_OUTPUT
           fi
 
+      - name: Post immediate acknowledgement
+        if: steps.existing.outputs.skip != 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh issue comment ${{ steps.issue.outputs.number }} --repo "${{ github.repository }}" \
+            --body "🤖 Amber is working on this issue. A PR will be created shortly with the \`ambient-code:managed\` label."
+
       - name: Create session
         if: steps.existing.outputs.skip != 'true'
         id: session
@@ -100,16 +115,25 @@ jobs:
                first line of the PR body (read your session ID from the
                AGENTIC_SESSION_NAME environment variable):
                <!-- acp:session_id=$AGENTIC_SESSION_NAME source=#${{ steps.issue.outputs.number }} last_action=<ISO8601_NOW> retry_count=0 -->
+               At the bottom of the PR body, add a session link:
+               ---
+               🤖 [Ambient Session](<SESSION_URL>)
             6. Add the `ambient-code:managed` label to the PR.
-            7. After creating the PR, send a Slack notification:
-               ```bash
-               curl -X POST -H 'Content-type: application/json' \
-                 --data '{"text":"PR created for #${{ steps.issue.outputs.number }}\n*PR*: <PR_URL>\n*Session*: '"$PLATFORM_HOST/projects/$AGENTIC_SESSION_NAMESPACE/sessions/$AGENTIC_SESSION_NAME"'"}' \
-                 "$SLACK_WEBHOOK_URL"
-               ```
-               Only send if SLACK_WEBHOOK_URL is set.
-            8. Ensure CI passes. If it fails, investigate and fix.
-            9. Do not merge. Leave the PR open for human review.
+            7. Ensure CI passes. If it fails, investigate and fix.
+            8. Do not merge. Leave the PR open for human review.
+            9. When you comment on the PR, include this footer at the end:
+               _🤖 [Session](<SESSION_URL>)_
+
+            ## Session URL
+
+            IMPORTANT: Wherever a session link is needed (PR body, comments, Slack),
+            you MUST first resolve the URL by reading the environment variables. Run:
+            ```bash
+            echo "$PLATFORM_HOST/projects/$AGENTIC_SESSION_NAMESPACE/sessions/$AGENTIC_SESSION_NAME"
+            ```
+            Use the resolved output as the actual URL. Do NOT write `$PLATFORM_HOST`,
+            `$AGENTIC_SESSION_NAMESPACE`, or `$AGENTIC_SESSION_NAME` literally in any
+            markdown link — always substitute their actual values.
           repos: >-
             [{"url": "https://github.com/${{ github.repository }}", "branch": "main"}]
           model: claude-opus-4-6
@@ -118,15 +142,32 @@ jobs:
           environment-variables: >-
             {"SLACK_WEBHOOK_URL": "${{ secrets.SLACK_WEBHOOK_URL }}", "PLATFORM_HOST": "${{ secrets.PLATFORM_HOST }}"}
 
-      - name: Post-session labels and comment
+      - name: Post-session update comment
         if: steps.existing.outputs.skip != 'true'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SESSION_NAME: ${{ steps.session.outputs.session-name }}
           SESSION_PHASE: ${{ steps.session.outputs.session-phase }}
+          SESSION_URL: ${{ steps.session.outputs.session-url }}
+          PLATFORM_HOST: ${{ secrets.PLATFORM_HOST }}
+          AMBIENT_PROJECT: ${{ secrets.AMBIENT_PROJECT }}
         run: |
           if [ -n "$SESSION_NAME" ]; then
-            gh issue comment ${{ steps.issue.outputs.number }} --repo "${{ github.repository }}" --body "Session \`$SESSION_NAME\` created (phase: $SESSION_PHASE). PR will have the \`ambient-code:managed\` label."
+            # Build session link — prefer session-url output, fall back to constructed URL
+            if [ -n "$SESSION_URL" ]; then
+              LINK="$SESSION_URL"
+            elif [ -n "$PLATFORM_HOST" ] && [ -n "$AMBIENT_PROJECT" ]; then
+              LINK="${PLATFORM_HOST%/}/projects/$AMBIENT_PROJECT/sessions/$SESSION_NAME"
+            else
+              LINK=""
+            fi
+
+            if [ -n "$LINK" ]; then
+              BODY="🤖 Amber session completed (phase: $SESSION_PHASE). [View session]($LINK)"
+            else
+              BODY="🤖 Amber session \`$SESSION_NAME\` completed (phase: $SESSION_PHASE)."
+            fi
+            gh issue comment ${{ steps.issue.outputs.number }} --repo "${{ github.repository }}" --body "$BODY"
           fi
 
       - name: Session summary
@@ -158,6 +199,13 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
+      - name: Acknowledge comment
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh api repos/${{ github.repository }}/issues/comments/${{ github.event.comment.id }}/reactions \
+            -X POST -f content=eyes --silent || true
+
       - name: Resolve context
         id: context
         env:
@@ -231,13 +279,28 @@ jobs:
             4. Ensure the PR body contains this frontmatter as the first line
                (read your session ID from the AGENTIC_SESSION_NAME environment variable):
                <!-- acp:session_id=$AGENTIC_SESSION_NAME source=#${{ steps.context.outputs.number }} last_action=<ISO8601_NOW> retry_count=<N> -->
-               Increment retry_count from whatever it was before. If retry_count reaches 3 or more,
-               stop working, add `ambient-code:needs-human` label, remove `ambient-code:managed` label,
+               Only increment retry_count if you actually had to fix something (CI failure,
+               conflict, review comment). If the PR is already healthy, do NOT increment —
+               just update last_action. If retry_count reaches 3 or more, stop working,
+               add `ambient-code:needs-human` label, remove `ambient-code:managed` label,
                comment "AI was unable to resolve after 3 attempts. Needs human attention.",
                and send a Slack notification (see below).
             5. Add the `ambient-code:managed` label.
             6. Do not merge. Do not close. Do not force-push.
             7. If fundamentally broken beyond repair, add a comment explaining and stop.
+            8. When you comment on the PR, include this footer at the end:
+               _🤖 [Session](<SESSION_URL>)_
+
+            ## Session URL
+
+            IMPORTANT: Wherever a session link is needed (PR body, comments, Slack),
+            you MUST first resolve the URL by reading the environment variables. Run:
+            ```bash
+            echo "$PLATFORM_HOST/projects/$AGENTIC_SESSION_NAMESPACE/sessions/$AGENTIC_SESSION_NAME"
+            ```
+            Use the resolved output as the actual URL. Do NOT write `$PLATFORM_HOST`,
+            `$AGENTIC_SESSION_NAMESPACE`, or `$AGENTIC_SESSION_NAME` literally in any
+            markdown link — always substitute their actual values.
 
             ## Slack Notifications
 
@@ -293,16 +356,25 @@ jobs:
                first line of the PR body (read your session ID from the
                AGENTIC_SESSION_NAME environment variable):
                <!-- acp:session_id=$AGENTIC_SESSION_NAME source=#${{ steps.context.outputs.number }} last_action=<ISO8601_NOW> retry_count=0 -->
+               At the bottom of the PR body, add a session link:
+               ---
+               🤖 [Ambient Session](<SESSION_URL>)
             6. Add the `ambient-code:managed` label to the PR.
-            7. After creating the PR, send a Slack notification:
-               ```bash
-               curl -X POST -H 'Content-type: application/json' \
-                 --data '{"text":"PR created for #${{ steps.context.outputs.number }}\n*PR*: <PR_URL>\n*Session*: '"$PLATFORM_HOST/projects/$AGENTIC_SESSION_NAMESPACE/sessions/$AGENTIC_SESSION_NAME"'"}' \
-                 "$SLACK_WEBHOOK_URL"
-               ```
-               Only send if SLACK_WEBHOOK_URL is set.
-            8. Ensure CI passes. If it fails, investigate and fix.
-            9. Do not merge. Leave the PR open for human review.
+            7. Ensure CI passes. If it fails, investigate and fix.
+            8. Do not merge. Leave the PR open for human review.
+            9. When you comment on the PR, include this footer at the end:
+               _🤖 [Session](<SESSION_URL>)_
+
+            ## Session URL
+
+            IMPORTANT: Wherever a session link is needed (PR body, comments, Slack),
+            you MUST first resolve the URL by reading the environment variables. Run:
+            ```bash
+            echo "$PLATFORM_HOST/projects/$AGENTIC_SESSION_NAMESPACE/sessions/$AGENTIC_SESSION_NAME"
+            ```
+            Use the resolved output as the actual URL. Do NOT write `$PLATFORM_HOST`,
+            `$AGENTIC_SESSION_NAMESPACE`, or `$AGENTIC_SESSION_NAME` literally in any
+            markdown link — always substitute their actual values.
           repos: >-
             [{"url": "https://github.com/${{ github.repository }}", "branch": "main"}]
           model: claude-opus-4-6
@@ -552,10 +624,49 @@ jobs:
                   print(f"  Failed to create session: {e}")
                   return None
 
-          # Get all open ambient-code:managed PRs (include updatedAt to avoid per-PR API calls)
+          BOT_LOGINS = ["github-actions[bot]", "ambient-code[bot]", "ambient-bot"]
+
+          def needs_attention(pr_number):
+              """Check if a PR has actionable issues that need the fixer's attention.
+              Returns (needs_work, reason) tuple."""
+              # Check CI status
+              checks_json = gh("pr", "checks", str(pr_number), "--repo", REPO,
+                               "--json", "name,state",
+                               "--jq", "[.[] | .state] | unique")
+              try:
+                  states = json.loads(checks_json) if checks_json else []
+              except json.JSONDecodeError:
+                  states = []
+
+              if not states:
+                  pass  # No CI checks — nothing to fix
+              elif "FAILURE" in states:
+                  return True, "CI failing"
+
+              # Check for merge conflicts
+              mergeable = gh("pr", "view", str(pr_number), "--repo", REPO,
+                            "--json", "mergeable", "--jq", ".mergeable")
+              if mergeable == "CONFLICTING":
+                  return True, "merge conflicts"
+
+              # Check for changes_requested from non-bot users
+              bot_filter = " and ".join([f'.user.login != "{b}"' for b in BOT_LOGINS])
+              try:
+                  reviews_raw = gh("api", f"repos/{REPO}/pulls/{pr_number}/reviews",
+                                  "--jq", f'[.[] | select(.state == "CHANGES_REQUESTED" and {bot_filter})] | length')
+                  changes_requested = int(reviews_raw) if reviews_raw else 0
+              except (ValueError, TypeError):
+                  changes_requested = 0
+
+              if changes_requested > 0:
+                  return True, "changes requested"
+
+              return False, "healthy"
+
+          # Get all open ambient-code:managed PRs
           prs_json = gh("pr", "list", "--repo", REPO, "--state", "open",
                         "--label", "ambient-code:managed", "--limit", "200",
-                        "--json", "number,body,title,updatedAt")
+                        "--json", "number,body,title")
           prs = json.loads(prs_json) if prs_json else []
           print(f"Found {len(prs)} ambient-code:managed PRs")
 
@@ -576,12 +687,13 @@ jobs:
                   session_id = fm["session_id"]
                   source = fm["source"]
 
-                  # Check for changes using updatedAt from gh pr list (no extra API call)
-                  updated_at = pr.get("updatedAt", "")
-                  if updated_at and updated_at <= fm["last_action"]:
-                      print(f"PR #{number}: no changes since {fm['last_action']} (updatedAt={updated_at}), skipping")
+                  # Only trigger if the PR actually needs work
+                  needs_work, reason = needs_attention(number)
+                  if not needs_work:
+                      print(f"PR #{number}: {reason}, skipping")
                       skipped += 1
                       continue
+                  print(f"PR #{number}: {reason}")
 
               # Trigger fix — reuse session if exists, create new if not
               print(f"PR #{number}: triggering fix (session_id={session_id or 'new'})")
@@ -602,12 +714,28 @@ jobs:
           4. Ensure the PR body contains this frontmatter as the first line
              (read your session ID from the AGENTIC_SESSION_NAME environment variable):
              <!-- acp:session_id=$AGENTIC_SESSION_NAME source={source} last_action=<ISO8601_NOW> retry_count=<N> -->
-             The current retry_count is {current_retry}. Increment it by 1.
+             The current retry_count is {current_retry}. Only increment retry_count if
+             you actually had to fix something (CI failure, conflict, review comment).
+             If the PR is already healthy (CI green, no conflicts, no open reviews),
+             do NOT increment — just update last_action.
              If retry_count reaches 3 or more, stop working, add `ambient-code:needs-human` label,
              remove `ambient-code:managed` label, comment on the PR, and send a Slack notification.
           5. Add the `ambient-code:managed` label.
           6. Do not merge. Do not close. Do not force-push.
           7. If fundamentally broken beyond repair, add a comment explaining and stop.
+          8. When you comment on the PR, include this footer at the end:
+             _🤖 [Session](<SESSION_URL>)_
+
+          ## Session URL
+
+          IMPORTANT: Wherever a session link is needed (PR body, comments, Slack),
+          you MUST first resolve the URL by reading the environment variables. Run:
+          ```bash
+          echo "$PLATFORM_HOST/projects/$AGENTIC_SESSION_NAMESPACE/sessions/$AGENTIC_SESSION_NAME"
+          ```
+          Use the resolved output as the actual URL. Do NOT write `$PLATFORM_HOST`,
+          `$AGENTIC_SESSION_NAMESPACE`, or `$AGENTIC_SESSION_NAME` literally in any
+          markdown link — always substitute their actual values.
 
           ## Slack Notifications
 

.github/workflows/claude-live-test.yml

@@ -83,7 +83,7 @@ jobs:
           -f components/operator/Dockerfile components/operator
 
         docker build -t quay.io/ambient_code/vteam_claude_runner:claude-test \
-          -f components/runners/ambient-runner/Dockerfile components/runners
+          components/runners/ambient-runner
 
         echo "✅ All images built"
 

.github/workflows/components-build-deploy.yml

@@ -51,7 +51,7 @@ jobs:
             {"name":"frontend","context":"./components/frontend","image":"quay.io/ambient_code/vteam_frontend","dockerfile":"./components/frontend/Dockerfile"},
             {"name":"backend","context":"./components/backend","image":"quay.io/ambient_code/vteam_backend","dockerfile":"./components/backend/Dockerfile"},
             {"name":"operator","context":"./components/operator","image":"quay.io/ambient_code/vteam_operator","dockerfile":"./components/operator/Dockerfile"},
-            {"name":"ambient-runner","context":"./components/runners","image":"quay.io/ambient_code/vteam_claude_runner","dockerfile":"./components/runners/ambient-runner/Dockerfile"},
+            {"name":"ambient-runner","context":"./components/runners/ambient-runner","image":"quay.io/ambient_code/vteam_claude_runner","dockerfile":"./components/runners/ambient-runner/Dockerfile"},
             {"name":"state-sync","context":"./components/runners/state-sync","image":"quay.io/ambient_code/vteam_state_sync","dockerfile":"./components/runners/state-sync/Dockerfile"},
             {"name":"public-api","context":"./components/public-api","image":"quay.io/ambient_code/vteam_public_api","dockerfile":"./components/public-api/Dockerfile"},
             {"name":"ambient-api-server","context":"./components/ambient-api-server","image":"quay.io/ambient_code/vteam_api_server","dockerfile":"./components/ambient-api-server/Dockerfile"}
@@ -206,7 +206,7 @@ jobs:
 
       - name: Log in to OpenShift Cluster
         run: |
-          oc login ${{ secrets.OPENSHIFT_SERVER }} --token=${{ secrets.OPENSHIFT_TOKEN }} --insecure-skip-tls-verify
+          oc login ${{ secrets.OPENSHIFT_SERVER }} --token=${{ secrets.OPENSHIFT_TOKEN }}
 
       - name: Deploy Service Mesh operator via OLM
         run: |
@@ -327,7 +327,7 @@ jobs:
 
       - name: Log in to OpenShift Cluster
         run: |
-          oc login ${{ secrets.OPENSHIFT_SERVER }} --token=${{ secrets.OPENSHIFT_TOKEN }} --insecure-skip-tls-verify
+          oc login ${{ secrets.OPENSHIFT_SERVER }} --token=${{ secrets.OPENSHIFT_TOKEN }}
 
       - name: Apply RBAC and CRD manifests
         run: |
@@ -360,7 +360,7 @@ jobs:
 
       - name: Log in to OpenShift Cluster
         run: |
-          oc login ${{ secrets.OPENSHIFT_SERVER }} --token=${{ secrets.OPENSHIFT_TOKEN }} --insecure-skip-tls-verify
+          oc login ${{ secrets.OPENSHIFT_SERVER }} --token=${{ secrets.OPENSHIFT_TOKEN }}
 
       - name: Update kustomization with SHA image tags
         working-directory: components/manifests/overlays/production
@@ -435,7 +435,7 @@ jobs:
 
       - name: Log in to OpenShift Cluster
         run: |
-          oc login ${{ secrets.OPENSHIFT_SERVER }} --token=${{ secrets.OPENSHIFT_TOKEN }} --insecure-skip-tls-verify
+          oc login ${{ secrets.OPENSHIFT_SERVER }} --token=${{ secrets.OPENSHIFT_TOKEN }}
 
       - name: Update kustomization with SHA image tags
         working-directory: components/manifests/overlays/production

.github/workflows/e2e.yml

@@ -135,8 +135,7 @@ jobs:
         if [ "${{ needs.detect-changes.outputs.claude-runner }}" == "true" ]; then
           echo "Building ambient-runner (changed)..."
           docker build -t quay.io/ambient_code/vteam_claude_runner:e2e-test \
-            -f components/runners/ambient-runner/Dockerfile \
-            components/runners
+            components/runners/ambient-runner
         else
           echo "Claude-runner unchanged, pulling latest..."
           docker pull quay.io/ambient_code/vteam_claude_runner:latest