add agent-compose run diagnostics and llm ls; fix token validation and slow ps

[winterfx]

Summary

Make chaitin-cli agent-compose useful for investigating failed Runs, fix auth login / auth status accepting any Token, and make ps usable on projects with a long Scheduler Run history (~130s → ~4s).

All changes use APIs the daemon already exposes; no Agent Compose changes are needed.

Changes

Run diagnostics

• inspect run now shows error_stack, cleanup_error, warnings, labels, logs_path, artifacts_dir, and scheduler_id / trigger_id / scheduler_run_id. A failed Run used to show only agent execution failed; error_stack carries the real cause (for example, a model stream disconnecting mid-response).
• run ls --started-from / --started-to accept relative times (30m, 24h, 7d) as well as RFC3339. Values are truncated to milliseconds because the daemon rejects sub-millisecond filters.
• New run ls flags:
  • --scheduler-run <id>: Runs from one Scheduler Run.
  • --label key=value: repeatable, ANDed.
  • --all-projects: list across projects, with a PROJECT column. The JSON output omits project. It cannot be combined with --project.

New command

• llm ls: LLM providers, their models, the default model, and the latest protocol probes (for example responses=auth_failed). Per-model headers are deliberately omitted because they may carry credentials. It requires a daemon with LLMService; older daemons return version_incompatible.

Flags

• --project gets the -p shorthand.

Fix: Token validation

• auth login and auth status validated the Token by calling HealthService. The daemon exempts that service from Bearer auth so orchestrators can probe it, so any Token passed, and auth login saved a wrong one that only failed on the next real query.
• Both commands now call ListProjects (limit 1), which the daemon protects.

Fix: ps scanned every Scheduler Run

• ps labels each Sandbox with the Run that created it. For Sandboxes no Run owns, it read every Scheduler Run in the project, because ListSchedulerRuns cannot filter by Sandbox and Sandbox does not record its origin. On a project with ~31.5k Scheduler Runs (~1.7k/day, 20-day retention), that meant ~316 sequential requests: ~130s even for ps --limit 20.
• ps now looks up only the listed Sandboxes. It scans each agent's runs first (agent_name filter), because a scheduler creates Sandboxes for its own agent. This skips high-volume polling agents, 88% of the history here.
• ListSchedulerRuns is started_at DESC, so the scan stops when either:
  • every Sandbox is matched, or
  • runs started more than 24h before the oldest wanted Sandbox was created. The margin covers a run that creates its Sandbox long after it starts.
• Still-unmatched Sandboxes fall back to the same bounded scan across all agents, so no association is lost.
• A Sandbox without created_at keeps the old exhaustive scan.
• Known limitation: resolving a Scheduler Run from a short ID prefix still reads the full history (inspect scheduler-run, scheduler logs, scheduler stop). ResolveID has no Scheduler Run kind. The proper fix is daemon-side: a Scheduler Run kind in ResolveID, and a Sandbox origin field or a sandbox_id filter on ListSchedulerRuns.

Dependency

• github.com/chaitin/agent-compose/proto v0.1.8 → v0.1.12. No code changes are needed for the upgrade itself.

No config.yaml, environment variable, or .env changes.

Examples

chaitin-cli agent-compose run ls --all-projects --status failed --started-from 24h
chaitin-cli agent-compose run ls --scheduler-run <scheduler-run-id> --label env=prod
chaitin-cli agent-compose -p my-project inspect run <run-id>
chaitin-cli agent-compose llm ls --json

Commits

1. upgrade agent-compose proto to v0.1.12
2. add agent-compose run diagnostics and llm ls
3. validate agent-compose tokens against a protected rpc
4. bound agent-compose ps scheduler run scans

Each commit builds and passes tests on its own.

Test plan

• task fmt:check

• task lint

• task test

• New tests:

  • table-driven tests for time-bound and label parsing
  • filters forwarded on ListRunsRequest
  • --all-projects skips project resolution
  • the new inspect run fields
  • llm ls default-model marking and header omission
  • -p is honored
  • an invalid Token fails auth status even though HealthService is exempt

• Mutation-checked: removing the error_stack mapping, or reverting token validation to an always-pass check, fails the new tests.

• Smoke-tested against a live daemon (2609.4.5):

  • status, project ls
  • run ls with --all-projects, relative times, and -p
  • inspect run on a failed Run
  • auth status

• ps bounded scan: new tests in ps_scan_test.go. The stub honors agent_name and counts requests. They cover:

  • stop once matched
  • stop at the cutoff
  • find a run inside the margin
  • exhaustive scan when created_at is unknown
  • no scan when Runs cover every Sandbox
  • per-agent scan skips a noisy agent
  • fallback when the agent differs

  Each stop condition, the per-agent scan, the fallback, and the unknown-time guard was mutation-checked.

• ps --all --limit 100 on a live project with ~31.5k Scheduler Runs (old vs new):

  • old: 131.9s
  • new: 4.4s
  • all 100 Sandboxes have the same Run association, none unassociated

• llm ls against a daemon that implements LLMService (the live daemon predates it and returns version_incompatible).

🤖 Generated with Claude Code