🔨 chore: add headless approval and apiKey WS auth to lh agent run#13819
Merged
Conversation
Two fixes so `lh agent run` works end-to-end against the WebSocket agent
gateway when the user is authenticated via LOBEHUB_CLI_API_KEY.
- Default to `userInterventionConfig: { approvalMode: 'headless' }` when
running the agent from the CLI. Without this flag the runtime waits
for human tool-call approval and local-device commands hang forever.
Users who want interactive approval can pass `--no-headless`.
- Pass `tokenType` (`jwt` | `apiKey`) in the WebSocket auth handshake so
the gateway knows how to verify the token. Previously the CLI sent
only the raw token value and the gateway assumed JWT, rejecting valid
API keys.
Fixes LOBE-6939
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## canary #13819 +/- ##
=========================================
Coverage 66.67% 66.67%
=========================================
Files 2029 2029
Lines 172332 172335 +3
Branches 17621 20153 +2532
=========================================
+ Hits 114895 114900 +5
+ Misses 57313 57311 -2
Partials 124 124
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
lh agent runlh agent run
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two independent issues that together block
lh agent runwhen auth'd viaLOBEHUB_CLI_API_KEY:userInterventionConfig: { approvalMode: 'headless' }, the runtime waits for human tool-call approval that never arrives in a non-interactive CLI context, so commands likeRun ls ~ | grep dev in my devicehang forever.tokenType— the auth handshake was{ token, type: 'auth' }, missing thetokenTypefield. The agent gateway defaulted to JWT verification and rejected API keys.Changes
src/server/routers/lambda/aiAgent.ts—ExecAgentSchemanow acceptsuserInterventionConfig(UserInterventionConfigSchema), and the router passes it through toaiAgentService.execAgent. Same shape the web/cron paths already use (e.g.task.ts:884,AgentBridgeService.ts:731).apps/cli/src/commands/agent.ts— new--no-headlessopt-out flag (default is headless). SendsuserInterventionConfig: { approvalMode: 'headless' }unless disabled. ReadstokenandtokenTypefromgetAgentStreamAuthInfo()and forwards them to the WS stream.apps/cli/src/api/http.ts—getAgentStreamAuthInfo()now also returns{ token, tokenType: 'jwt' | 'apiKey' }so callers don't have to re-derive the type from header names.apps/cli/src/utils/agentStream.ts—WebSocketStreamOptionsacceptstokenType(defaults to'jwt'), and the auth message now includes it:{ token, tokenType, type: 'auth' }. This matches what@lobechat/device-gateway-clientalready sends on the device-gateway WS.tokenType: 'apiKey'path.Scope notes
--no-headlessopt-out is included for completeness. Default stays headless because an interactive CLI prompt doesn't exist yet and a missing flag was the bug in the first place.resolveSocketAuthpattern as device-gateway); this PR just wires up the CLI side.Test plan
bunx vitest run apps/cli/src/utils/agentStream.test.ts— 14/14 green (includes new apiKey auth test)bunx vitest run src/server/routers/lambda/__tests__/aiAgent.test.ts— 10/10 greenbun run type-check— no new errors attributable to this PRFixes LOBE-6939
🤖 Generated with Claude Code