Repository navigation
Conversation
`omnigraph studio --target NAME [--graph G] [--json]` validates a server target offline, builds one `omnigraph-studio://open?target=NAME&binding=<digest>&home=<digest>[&graph=G]` link, hands it to the platform, prints it and exits. It sends no request, binds or reads no credential, and starts nothing that serves a graph. The platform opens the link only through a handler it names for Studio: `open -b com.modernrelay.omnigraph-studio` on macOS; `xdg-open` on other Unix desktops only after `xdg-mime query default x-scheme-handler/omnigraph-studio` names a handler; on Windows `rundll32 url.dll,FileProtocolHandler` only after the registry holds an `omnigraph-studio` URL protocol with an open command. Without one it prints the link, says where to download Studio and refuses with `studio_unavailable`, never reaching a generic opener that would hand the link to a browser. The opener sits behind a command-runner seam, so no test opens anything. `home` digests the canonical location of the operator file the invocation read, the path credential custody is keyed by. `binding` digests a server target's endpoint, auth provider and its source, and transport; a token's value and `default_graph` never enter it, and equivalent spellings digest alike. Both are defined once in `target_identity` and reported by `target inspect --json`, so Studio can resolve the target through the CLI and compare. Direct, managed and inline targets refuse with `target_kind_unsupported` before any I/O; a Unix-socket server refuses with `studio_transport_unsupported`, though a version-1 document cannot name one. `version --json` reports `protocols.studio: 1`, which versions the link, `studio --json` and the inspected digests; the target protocol stays 2, since inspection only gains fields. `studio` is a CLI-only operation with the command index, condensed reference, user guide and release note.
|
Recommendation: do not merge until the Linux opener launches the registered handler. A browser on WhyA person or an agent needs to open OmniGraph Studio on a server target that is already configured. The command must send no HTTP request, must pass no credential, and must keep the link away from a web browser. What
The link is How
A direct target, a managed graph, or an inline path returns ImpactThe link, the shared digest, and the refusal-before-I/O behavior hold. The Linux launch does not hold the browser promise. On a generic desktop with no display, Blocking
Reproduction. A desktop file
Change the launch. When Point the unit test and the integration stand-in at that handler binary. Update OptionalNone. Tradeoffs and liabilityThe feature adds one command, one digest module, and protocol number 1. Exit 2 with The Linux branch adds liability. Success currently means " macOS code signing stays in the installer phase. That matches the RFC. Windows checks the registry before Sibling pull requests that edit shared surfaces:
ValidationReviewed head: Local checks used toolchain 1.97.1,
Those tests use a recorded runner and CI on this commit, run GQT regression proof does not apply. This is a new CLI handoff, and the defect is in process launch. GQT expresses rows, counts, column types, and query errors. It does not express LimitationsI did not run the Windows registry path on Windows. I did not run the macOS |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
| success: true, | ||
| stdout, | ||
| }) if !stdout.trim().is_empty() => launched( | ||
| runner.launch("xdg-open", &[link]), |
There was a problem hiding this comment.
This launch treats a non-empty xdg-mime answer plus xdg-open exit 0 as "Studio opened". Stock xdg-open 1.1.3 does not do that on a generic desktop with no display.
open_generic runs the scheme handler only when DISPLAY or WAYLAND_DISPLAY is set (has_display in /usr/bin/xdg-open). With both unset, and with XDG_CURRENT_DESKTOP unset, it skips the registered handler and tries www-browser, links2, elinks, links, lynx, and w3m.
I registered omnigraph-studio.desktop with an absolute Exec and left the display unset. xdg-mime query default x-scheme-handler/omnigraph-studio printed omnigraph-studio.desktop.
- A
www-browserstub that exits 0 madexdg-openexit 0 and recordedBROWSERplus the studio link. The handler did not run. This arm would returnOpening::Opened. - On
PATH=/usr/bin:/bin,xdg-openexited 3 withno method available for openingthe link. The handler did not run. This arm would returnstudio_unavailablewhile the handler was executable. - With
DISPLAY=:99, the same registration ran the handler andxdg-openexited 0.
freedesktop_opens_only_through_a_named_scheme_handler and FakeOpeners both accept an xdg-open that exits 0. They never execute this script, so CI stays green.
Launch the desktop file's Exec with the link in place of %u, the replacement search_desktop_file already performs. Leave xdg-open out of this path. Point those two tests at the handler binary. A browser on PATH must not be able to satisfy the command. Update the platform row in docs/user/cli/studio.md and the opener bullet in the serving RFC so they describe that launch. The RFC promise is "It never opens a browser." The mime query plus xdg-open misses that promise for a headless generic desktop, which is a normal environment for this CLI.
On a freedesktop desktop the opener ran `xdg-open` once `xdg-mime query default x-scheme-handler/omnigraph-studio` named a handler. Stock `xdg-open` with no `XDG_CURRENT_DESKTOP` and no display skips the registered handler and tries `www-browser`, `links2`, `elinks`, `links`, `lynx` and `w3m`. A browser on `PATH` then made `studio` report success, and without one a runnable handler read as `studio_unavailable`. The opener now resolves the desktop file ID `xdg-mime` names in `$XDG_DATA_HOME/applications` (default `~/.local/share/applications`), then each `$XDG_DATA_DIRS/applications` (default `/usr/local/share:/usr/share`), trying each `-` as a subdirectory. It parses the `[Desktop Entry]` group's `Exec` with the string escapes and the specification's quoting, puts the link in place of the one `%u` or `%U`, drops the other field codes, and runs that program directly, with no shell and no `xdg-open`. An entry that is hidden, runs in a terminal, is not an application, takes no URL, or uses a form it cannot run as written refuses with `studio_unavailable`. A launched program now gets its own process group, and the opener waits for it two seconds rather than ten: a freedesktop handler is Studio itself, which keeps running once it has the link. Registration queries keep their ten-second bound. Windows and macOS are unchanged. The unit test points at the handler named in a stand-in desktop entry, and the integration stand-ins add the handler, `xdg-open` and `www-browser`; neither of the last two may run. A new in-source test really launches a handler script through a resolved entry. Stand-in scripts run once before they are measured, since a platform may hold a new executable's first run for a scan longer than the opener waits. The Studio guide, the testing map and the RFC's opener bullet describe the launch, with a decision-log entry.
|
Addressed at 0ef1bf3. The Linux opener no longer runs
An entry that is hidden, runs in a terminal, is not an application, has no single Tests:
Two related launch changes:
Checks: |
|
Recommendation: the Linux opener fix holds. Do not merge this head into current main until the branch is on the v0.14.1 release line. The required docs check fails on that merge. Earlier findingResolved. The Linux opener no longer runs WhyA person or an agent needs Studio to open on a server target that is already configured. The command must send no request, must pass no credential, and must keep the link away from a web browser. What
The link is HowLinux has one opener path, The path does not call ImpactA headless generic desktop no longer reports that Studio opened when a browser received the link. A registered handler runs when no display is set. A named handler with no desktop file is refused, and the browser stays unused. Blocking
OptionalNone. Tradeoffs and liabilityThe fix removes one false success. Success no longer means that The parser is new liability. It has to track the desktop entry A process that is still running after 2 seconds counts as opened. A handler that exits with an error after those 2 seconds is reported as opened. Studio stays running, so the wait matches that program. Sibling pull requests at this head:
This change does not touch Lance, the engine, or the catalog. Lance 13.0.0 and a later Lance version do not change the link. ValidationReviewed head: Local checks used toolchain 1.97.1 and
Before and after used the same Linux host and
GQT regression proof does not apply. The contract is process launch, CI on this head, run LimitationsI did not run the Windows registry path. I did not run macOS |
# Conflicts: # docs/user/operations/troubleshooting.md
|
Recommendation: merge this change. The two earlier blockers are resolved. This head adds no new defect. Earlier findingsResolved. The Linux opener does not run Resolved. WhyA person or an agent needs Studio to open on a server target that is already configured. The command must send no request, must pass no credential, and must keep the link away from a web browser. What
The link is HowLinux has one opener path. It runs The path does not call
ImpactThe two merges of main do not change the opener. The first merge, BlockingNone. OptionalNone. Tradeoffs and liabilityThe opener owns the handoff. Success means the program named by the registered desktop entry was started with the link. A check in front of The desktop A process that is still running after 2 seconds counts as opened. Studio stays running, so the wait matches that program. This command is an occasional operator action. The wait is not on a query path. Correctness outranks that small delay. This change does not touch Lance, the engine, or the catalog. Lance stays 13.0.0. A later Lance version does not change the link. No Lance format page describes this handoff. Sibling pull requests at this head:
ValidationReviewed head:
Local checks used toolchain 1.97.1 and
The integration test uses token source GQT cannot express this contract. The observable facts are process launch, CI on this head is run LimitationsI did not run the Windows registry path. I did not run macOS |
Implements "Opening Studio" from the accepted graph access RFC (
docs/rfcs/2026-10-16-graph-access-serving-and-cross-process-writes.md, discussion #1017). Installing Studio stays a later phase and is not implemented.What it does
omnigraph studio --target NAME [--graph G] [--json]validates a server target offline, builds one link, hands it to the platform, prints it and exits:It sends no request, binds or reads no credential (Studio obtains its own through the CLI), and starts nothing that serves a graph.
--jsonprints{"protocol":1,"target":…,"binding":…,"home":…,"link":…}.authtarget_kind_unsupported, before any I/Ostudio_transport_unsupported(defensive: a version-1 document cannot name one, which a test pins)--graphis optional (the link carries it only when given), sostudiohas its own requirement,ServedTarget, rather thanServedGraph, which requires a graph.--asand--profileare refused.Platforms
The opener sits behind a command-runner seam; in-source tests inject a recording runner and the integration test puts stand-in openers on
PATH, so no test opens anything.open -b com.modernrelay.omnigraph-studio LINKExecof the desktop entryxdg-mime query default x-scheme-handler/omnigraph-studionames, found in$XDG_DATA_HOME/applicationsthen each$XDG_DATA_DIRS/applications(each-also tried as a subdirectory), run directly with the link in place of%u; no shell, neverxdg-openrundll32 url.dll,FileProtocolHandler LINK, only afterreg queryfindsHKCR\omnigraph-studiowithURL Protocolandshell\open\commandWithout a handler the command prints the link and where to download Studio and refuses with
studio_unavailable(the JSON refusal carrieslinkandinstall); a generic opener is never asked, so no browser opens. On Linux an entry that is hidden, runs in a terminal, takes no URL through%u/%U, or uses anExecform the CLI cannot run exactly as written also refuses withstudio_unavailable. A launched program gets its own process group and a 2 s wait (a freedesktop handler is Studio itself and keeps running); registration queries keep 10 s. The Windows path is unit-tested through the seam on every platform but has not run on Windows.Digests
Both live in
crates/omnigraph-cli/src/target_identity.rs:home=sha256:+ SHA-256("omnigraph operator home v1\0"‖ canonical operator file path), the path credential custody is keyed by (--operator-config, elseconfig.yamlunderOMNIGRAPH_HOME/~/.omnigraph; directory aliases resolved, file name kept).binding=sha256:+ SHA-256("omnigraph server target binding v1\0"‖ JSON of the server target's kind, canonical endpoint, auth provider with its source identity (store / env name / lexical file path / helper argv) and transport (CA mode and path, proxy mode/URL)). A token's value, a helper's timeout anddefault_graphnever enter it; equivalent spellings digest alike.target inspect NAME --jsonnow reportshomeand, for a server target,binding, so Studio can resolve the target through the CLI and compare.target list --jsonis unchanged: its rows are the configuration entries verbatim, the shapetarget addreads back.Protocols
version --jsongainsprotocols.studio: 1, which versions the link,studio --jsonand the inspected digests.TARGET_PROTOCOLstays 2:target inspectonly gains fields, and the documented rule bumps a protocol for incompatible changes only.Tests
target_identity(digest format, equivalent spellings, token rotation, distinct endpoints/kinds/sources/transports, canonical home),commands::studio(link format, JSON and human output,studio_unavailable, refusals before the platform is asked, unconfigurable Unix socket),commands::studio::desktop(base directories, desktop file ID lookup with subdirectories,Execquoting and field codes, refused forms, bounded UTF-8 reads) andcommands::studio::open(each platform's exact argv; the Linux handler from its desktop entry and neverxdg-openor a browser; a real launch of a handler script through a resolved entry; norundll32without a registered protocol).planesactor matrix gainsstudio; the operation inventory listsstudioas CLI-only; protocol assertions includestudio: 1.integration/cli_data.rs:studio_opens_a_server_target_whose_digests_target_inspect_reports(stand-inxdg-mime, desktop entry, handler,xdg-openandwww-browseron Linux; a registration without an entry refuses and runs neither of the last two), andtarget_list_and_inspect_have_the_same_versioned_bindingnow asserts the digests.Docs
New
docs/user/cli/studio.md; rows in the CLI reference, user index, install (protocols), troubleshooting (exits), targets (inspect digests), testing map, skill command index and condensed reference;changelog.d/cli-studio-opener.added.md.