feat: add Strands TUI harness with bounded foreground cancellation

[nikhilachale]

Code changes: +831 -9
Tests: +779 -3
Others: +2985 -3

Binary assets: 5 (excluded from line counts).

Current publication, 2026-10-15: 4638c82aca17efa7d7d4148af37d6f2578a4637f. Incomplete qualification; AO UI evidence BLOCKED; not merge-ready. Main conflicts reconciled. Exact-head CI is recorded below; no local routine suites.

Published current-main reconciliation and new exact7ebd0dca diagnostic evidence:24PASS/1authBLOCKED/1catalogFAIL/2NOT_RUN. Independent ordinary file edits worked, but fresh/restored private/project/native instruction receipt effects were absent. Assisted runner success does not replace that independent failure.

Current report and scoped evidence. Historical runtime/source attribution is retained there.

The initial publication live-feeds check failed: a pinned install spec was sent as an npm package name (HTTP400). The new source separates unversioned package metadata from pinned0.2.0 installation/reinstallation and refuses automatic updates to unqualified releases. Added regression cases are remote-CI-only; all original runtime/UI non-pass gates remain.

Exact-head CI (2026-10-15T07:12:38.660620+00:00): complete at 4638c82aca17efa7d7d4148af37d6f2578a4637f — 25 SUCCESS (25 reported; 25 expected including the merged Go aggregate gate). Current checks. Mergeability MERGEABLE, merge state BLOCKED; draft handoff. CI does not qualify missing native/UI/provider/OS gates. The initial head293493b9 live-feeds HTTP400 failure remains preserved; the fix is tested only by this newer head’s CI. Canonical main subsequently advanced to48c4ef5e with only two non-overlapping preview-process files; GitHub reports this head mergeable. These completed checks belong to the stated publication head, not a newly rebuilt merge with that later base.

Preserved earlier description (historical status, validation and evidence snapshots)

Binary assets in the current PR diff: 5 (excluded from line counts).

Strands is now registered as a TUI-only harness using the supported public SDK shell replacement. Exact native restore, additive private instructions and foreground tool cancellation are demonstrated inside real AO Electron. Custom tools/sandboxes/subagent modules and unsupported native reconfiguration fail closed or are explicitly out of scope. No Chat or handoff support.

Detailed recovery report and real screenshots. The functional audit passed all lifecycle gates; its overall verdict remains diagnostic FAIL (24 PASS / 1 auth BLOCKED / 1 catalog FAIL / 2 catalog NOT_RUN). Current evidence HEAD: 022084e99b25e5aff7e31c46ebc1b6e869bf320f; all 23 current-head CI checks pass (workflow). AO003 used bypass-permissions/native Auto; native one-time-approval controls were separate. AO authentication probe remains configured rather than verified authorization, despite successful real provider calls.

The diff includes 5 PNG assets (3 actual AO Electron captures and 2 historical native-only captures); binary assets have no line counts.

Original native-only checkpoint and preserved failure history

Strands CLI 0.2.0 displays “Cancelled” after Escape or Ctrl+C while an approved shell tool continues running and writes its delayed artifact about 28 seconds later. This draft records that blocker and an isolated, unregistered terminal adapter candidate. Strands is not available in AO; AO lifecycle and UI conformance remain BLOCKED / NOT RUN.

The candidate preserves native profile instructions/model/plugins, separates the visible task from standing instructions, rejects missing or malformed restore history, and reports native activity through a supported SDK plugin. It does not modify domain/registry/activity dispatch, migrations, APIs, installation, pickers, Chat, or reviewers. Unsupported permission mappings and model overrides shadowed by native model modules fail explicitly.

The full conformance report records pinned upstream revision, native initial/private-instruction and exact-restore evidence, both cancellation failures, runner limitations, reproduction instructions, and two actual native-only terminal screenshots. A PR comment provides revision-pinned report and image links. The screenshots are from a separate native reproduction and do not show AO.

Validation on the Linux VPS:

• Final candidate package unit/race tests, vet, and golangci-lint 2.13.2 passed after the malformed-history review fix; full backend build passed.
• Full backend tests ran and failed in five other packages: e2e startup retry (spawn 409), fake agent (missing events.log), OpenCode v2 binary resolution, integration Codex reconciliation, and service/agent private-file ancestor checks. These failures are untriaged; a baseline failure is not claimed.
• Full-repository race/lint, frontend suites, and native-OS workflows were not run locally. At head c3c834e0e7ef, all 21 GitHub checks passed, including Go build/tests/race/lint/drift, CLI E2E on Linux/macOS/Windows and in the container, and gitleaks. These repository checks do not establish native Strands cancellation or AO lifecycle/UI support. No API regeneration is needed.
• Staged diff check passed. Exact authorized-key scan across all 11 published files found zero matches; both screenshots were visually reviewed.

Do not register Strands until a pinned upstream fix or a separately reviewed existing containment boundary proves bounded cancellation without late side effects, followed by independent AO lifecycle and actual AO UI evidence. This draft is not a merge-ready integration.

Binary PNG assets in current PR diff: 5 (binary line counts excluded from the header).

[github-actions]

🏆 Review leaderboard

Oct 3–10, 2026 · UTC

Rank	Reviewer	PRs reviewed	Review rounds	PR comments
🥇	@illegalcall	28	47	11
🥈	@ronishrohan	20	23	17
🥉	@Vaibhaav-Tiwari	15	19	11
4	@Prasad-D-Ware	10	27	1
5	@nikhilachale	9	22	3
6	@axisrow	8	10	44
7	@mohakchakraborty2004	7	7	1
8	@Rishet11	6	15	2
9	@Pritom14	5	5	3
10	@codebanditssss	4	4	2

Ranked by distinct external PRs reviewed, then review rounds, then PR comments. Self-activity and bot activity are excluded.

Show 6 more reviewers

Rank	Reviewer	PRs reviewed	Review rounds	PR comments
11	@Annieeeee11	3	6	1
12	@harshitsinghbhandari	2	4	0
13	@neversettle17-101	2	3	0
14	@whoisasx	2	2	0
15	@AgentWrapper	1	3	0
16	@ApexYash11	1	2	0

[nikhilachale]

Revision-pinned conformance evidence for commit c3c834e0e7ef.

Full report: c3c834e0e7ef/strands-tui-conformance.md. The complete report is reproduced below, including the actual native-only screenshots pinned to this revision. Strands remains unregistered. These are not AO screenshots.

Strands CLI terminal conformance — blocked candidate

Strands is not registered in AO. The candidate adapter remains isolated in
backend/internal/adapters/agent/strands; there are no domain, registry,
activity-dispatch, migration, OpenAPI, Chat, reviewer, installer, or picker changes.
Native CLI success does not establish AO lifecycle support. AO spawn, restore,
kill, readiness, activity and UI screenshots remain BLOCKED / NOT RUN.

Release and execution environment

• Official executable/package: strands, @strands-agents/cli@0.2.0.
• Upstream: strands-agents/harness-sdk,
  tag harness-cli/v0.2.0, commit e519d67021b9c009e56e9309edcd94ab87e7156e.
• Installed dependencies resolved to @strands-agents/harness@0.1.1 and
  @strands-agents/sdk@1.20.0; the VPS installation lockfile is retained.
• Entrypoint SHA-256:
  987e32867f74496f26075d4e5a59d1f7af291162650d2db73b277be7fbd949a0.
• Linux VPS only, Node 24.21.0, isolated profiles and workspaces. Native setup
  retained default permissions and each tested shell/write approval was
  explicitly accepted once. Real account configuration was not changed.
• Authorized provider: Z.ai glm-5.3-flash through its existing coding endpoint.
  Strands' official modelModule configuration instantiated the shipped
  OpenAIModel with the exact authorized base URL. This was necessary because
  its litellm convenience builder unconditionally appends /v1. No provider
  source, native CLI source, or endpoint proxy was substituted. Credentials
  were passed only through the existing VPS credential wrapper and child
  environment; they are absent from source, argv, reports and profiles.

Native result

Gate	Evidence
Real TUI / initial task	PASS: native Ink TUI executed a task beginning -Audit request through --prompt.
Private standing instructions	PASS: provider wrote both the configured domain token and the separate AO instruction token. The visible task did not contain either value.
Exact session restore	PASS: the same ao-native-001 persisted snapshot loaded after SIGKILL. The provider recovered the prior INITIAL_001 token without reading files.
Fresh restore instructions	PASS: a fresh random token was generated only after the first process was killed and reaped, supplied through --instructions, and written to the restored proof.
Native activity / identity	PASS for tested root invocation: the injected supported SDK plugin emitted session-start, active, then stop for the pinned native session. Cancellation exposed the delayed stop described below.
Escape cancellation	FAIL: after accepting the shell command once and letting it start, Escape displayed “Cancelled” but the shell ran another 28.105 s and created the delayed file.
Ctrl+C cancellation	FAIL: independent fresh run, same result in 28.090 s. Both the shell and its sleep child were still alive five seconds after Ctrl+C.
Authentication/model catalog	Local configured model was exercised successfully. AO authorization and catalogs are NOT RUN; arbitrary model modules remain auth-unknown and cannot truthfully accept a --model override.

The cancellation command was exactly:

sleep 30; printf done > CANCEL_SHOULD_NOT_EXIST

Each cancellation was sent approximately two seconds after accepting the native
permission prompt. The delayed file existed after both attempts. The native
AfterInvocationEvent arrived only after the shell finished. The instantaneous
“Cancelled” label was therefore not proof that execution or side effects stopped.

The shipped SDK's
makeShell
passes { timeout } to sandbox.execute without an abort signal. The CLI
workspace sandbox can terminate a process tree when it receives a signal, but
this call does not supply one. This is consistent with the observed live process
and delayed side effect. The previous CLI 0.1.4 tag
4a42ded67431c45db51624391a4afa8faba3d454 has the same call and SDK/harness
version ranges; it was source-inspected only, not separately live-qualified.

Actual native screenshots

These are live xterm captures from the separate native-005 reproduction,
not AO screenshots. The run again created the forbidden delayed file.

At 10:56:28 UTC, five seconds after Escape, Strands shows both “Cancelled” and
“Interrupting” while its shell is still running:

At 10:56:56 UTC the composer has settled. The run's delayed artifact now exists
with contents done, despite the retained “Cancelled” label:

The image SHA-256 values are respectively
89dac2c9ff297f5f47e544ba21a72d183f21f583e29c2130fa0058aa76247cce and
4faad8828d8375c8737dfb8db94a3ce2b688fcf3325c7e54df440cb3279e8b67.

Candidate boundaries

The unregistered package tests the intended thin adapter boundaries:

• Use a separate visible --prompt and private --instructions argument.
  --instructions replaces saved profile.instructions, so concatenate the
  configured domain string with AO's launch instructions while preserving the
  harness's built-in contract. Restore resolves the current AO instructions again.
• Preserve the saved model and plugin configuration. Add one private native
  activity plugin under AO data. Do not write workspace rules or global config.
• Keep native session snapshots and launch-to-workspace identity under AO data.
  Reject missing/malformed history and workspace mismatches before constructing
  --session-id, since the native CLI otherwise creates missing IDs silently.
• Support Ask Permissions only with native default permissions and no saved
  always-allowed tools. A requested bypass can only match an explicitly already
  configured native bypass; AO never writes that setting. Accept-edits and auto
  have no qualified mapping. The live runs used Ask Permissions only.
• Reject authored agent projects and model overrides shadowed by native model
  modules. Do not invent a model catalog or report credential presence as a
  verified login. The generic audit runner's hardcoded bypass request cannot
  establish the default-permission AO workflow.

This is a candidate, not a completed integration. Native in-TUI session switching,
custom root agent IDs/session managers, provider/platform coverage, and AO
lifecycle delivery have not been qualified. Hook/locator handling needs to be
revalidated against those cases before any production registration. ACP, Chat,
reviewers and interface handoff are explicitly out of scope.

Reproduce and evidence

The opt-in, standard-library-only
native_cancel_probe.py
starts the real pinned CLI in a PTY, approves the exact disposable shell command
once, sends the chosen native cancellation key, records the owned process tree,
and detects the delayed artifact. It never runs in the default unit suite.
Use an already prepared disposable native profile and the authorized credentials
in the execution host's environment:

python3 backend/internal/adapters/agent/strands/testdata/native_cancel_probe.py \
  --binary /absolute/path/to/strands \
  --home /absolute/path/to/disposable-profile \
  --report /absolute/path/to/new-report-directory \
  --interrupt escape
# Repeat with a fresh report directory and --interrupt ctrl-c.

VPS evidence root:
/home/azureuser/.ao/audits/harness-watch-20261010/reports/strands/.

• native-001: leading-dash/private/domain proof and the first restore-runner
  failure. Its readiness check ran only on incoming bytes and missed a quiescent
  ready screen. That failure is preserved.
• native-002: exact native restore and fresh post-kill instruction proof. The
  functional turn passed, while the runner's post-proof exit condition also
  waited on terminal bytes and reached its 150-second cleanup timeout. No full
  strict audit PASS is claimed.
• native-003: first real Escape failure, native hook events, permission and
  active terminal captures, delayed artifact.
• native-004: independent Ctrl+C failure, same owned shell and sleep PIDs
  before and five seconds after cancellation, delayed artifact.
• native-005: separate actual Xvfb/xterm capture run. Images are live native
  terminal captures, clearly labeled AO NOT REGISTERED / NOT TESTED. They
  are neither original-run screenshots nor AO screenshots. Capture metadata and
  cleanup status are in its result.json.

Audit tokens are nonsecret fixtures. The model echoed them in its final answer;
instruction consumption is proved, confidentiality against model echo is not.
Original failures, later controls, and screenshot reproduction are separate.

Validation

The candidate's unit tests, race test and go vet passed; go build ./... passed.
Focused golangci-lint 2.13.2 validation is recorded separately in
final-validation-003.log after the review's malformed-message-history fix.
The full go test ./... run was executed on the VPS and failed in existing
packages outside this unregistered candidate. The complete log is
backend-validation-001.log; it includes e2e startup retry, fake hook-file,
OpenCode v2 binary resolution, integration Codex reconciliation and service/agent
private-file ancestor failures. These have not been labeled passing or fixed by
this candidate. Full-repository race/lint, frontend/native-OS workflows and
remote CI remain outstanding. No API generation is required because no API or
registration source was changed.

All probe-owned processes were terminated and native evidence retained. Do not
register Strands until a pinned upstream release or a separately reviewed,
existing containment boundary proves bounded cancellation without late side
effects, followed by independent AO lifecycle and real AO UI evidence.

[nikhilachale]

Exact-head CI verification at 2026-10-10 12:48 UTC for c3c834e: 21/21 check runs completed successfully. Every inspected check and workflow was tied to this head SHA.

• Go: backend-core shards, chat/session/sqlite race jobs, Windows workspace, cloud build/test, lint, sqlc/API drift, and aggregate build-test passed.
• CLI E2E: native Linux/macOS/Windows and container jobs passed.
• gitleaks and review statistics passed.

No candidate source change or test rerun was needed. The five package failures from the earlier VPS full-backend run remain recorded and untriaged; this CI result does not relabel that local run as passing.

The conformance blocker remains: native Escape and Ctrl+C did not stop the approved shell tool or its delayed write. Strands remains unregistered, with AO lifecycle/UI evidence BLOCKED / NOT RUN. Repository CI passing is not native Strands qualification.

Full conformance report with revision-pinned native-only screenshots.

[nikhilachale]

Strands now runs inside AO as a registered TUI harness. Audit ao-003 passed every functional lifecycle gate at 98365b809f8378f642f09d711eb727654a86090d (binary SHA-256 7eb497daf80994fd2f710cdb70725f0d754aa64c2c0b9ae489a24d56b5ad3ab1): exactly-once initial delivery, private/project instructions, activity, second message, cancellation, Kill, exact native restore, initialized empty composer, history continuity and newly injected post-Kill instructions.

The complete result remains diagnostic FAIL: 24 PASS / 1 authentication BLOCKED / 1 AO catalog FAIL / 2 catalog NOT_RUN. AO's auth probe still reports configured credentials rather than verified authorization; native listing is unavailable and AO's catalog is empty. Real provider execution used native CLI 0.2.0 / harness 0.1.1 / SDK 1.20.0 and real Z.ai glm-5.3-flash through a private loopback transport relay.

AO003 used AO bypass-permissions (native Auto); the separate native cancellation controls used one-time approval.

The public SDK plugin now propagates cancellation into Strands' native sandbox. Final native Ctrl+C reaped an already-started shell in 97 ms, settled in 210 ms, and produced no delayed write over 32 seconds. Independent AO Kill003 reaped the target shell in 389 ms with no late artifact; the unrelated restored control survived with the same generation immediately and later.

Capture 2026-10-10T21:08:21.227532Z; UI source 878957f4583fbe7762ebef29708a0f79a61acc5d; AO session audit-strands-daefeaa2-1; native-ID SHA-256 750f2289056d635ce4330cd6fcbf0002731214db6e9dbfcb0c8c7d4e86863ee8; generation 1dcba694-ef1b-4c71-83c2-513d5c691724, unchanged before/after. PNG SHA-256 ffae74a4e45becc91b11c019c8ece1ee128a2aa7c8651ab992c8b84e1b442303.

The complete report preserves released-native 28-second late writes, the invalid top-level config flag, AO001's actual pre-spawn stale-readiness stop, Kill002's fetch failure and the blank Electron renderer-startup failure. Only the worker's own service TasksMax was raised from 256 to 512; host RAM was unchanged.

Scope is foreground TUI. Model-callable strands_config is removed; public registry checks reject background-manager configuration. Human /setup, /tools and native profile takeover require exiting and starting a new AO session. Guard-only commit 1b9caed8a950937b516c1cf5b631a6a6a0f94264 additionally rejects saved custom subagent modules; the live audit remains labeled with its tested 98365b809 revision.

Final HEAD: 022084e99b25e5aff7e31c46ebc1b6e869bf320f. Complete exact-HEAD CI: 23/23 checks passed, verified 2026-10-10T21:45:35.644176+00:00. VPS SDK/focused tests and build evidence are separate from full CI; no full local-suite pass is claimed.

The migration-ledger CI failure at1b9caed was corrected in cf448df and its focused ledger/migration tests passed. Owned final audit sessions were killed (HTTP200) and the daemon stopped (HTTP202); isolated evidence/profiles remain.

[nikhilachale]

Final CI: all 23 checks pass at the current evidence head 022084e99b25e5aff7e31c46ebc1b6e869bf320f (backend workflow, desktop workflow). This includes the corrected migration ledger; no broad local suite pass is claimed.

Permission clarification: AO003 used bypass-permissions / native Auto. The native Escape/Ctrl+C controls used separate one-time approvals. AO auth probe remains configured, rather than verified authorization, despite successful real provider calls. The strict audit remains diagnostic FAIL for the documented auth/catalog gaps. Published real AO proof.

[nikhilachale]

Read-only review of head 022084e99b25e5aff7e31c46ebc1b6e869bf320f: changes recommended before merge. Three P2 findings are attached inline: permission waits never become needs_input, the npm recipe accepts unsupported Node versions, and the only setup/documentation route points to a nonexistent repository.

I reviewed the adapter, cancellation plugin, restore validation, activity dispatch, domain/registry wiring, install/auth plans, API artifacts, picker additions, migration/reconciliation paths, added test source, and the recorded native/AO evidence. I also traced the pinned native implementation. No migration-number collision was found with current main or the concurrent Neovate/Tau/Open Interpreter/MiniMax/memcode PRs. No additional actionable defect was established in the foreground shell cancellation or exact-history restore paths within their documented scope.

No local tests, builds, linters, or validation commands were run, and no code or commits were changed. This is a COMMENT review because the authenticated account is the PR author; it is not an approval.

[nikhilachale]

Harness-specific reports, JSON receipts, screenshots and provenance now live on this integration PR branch, rather than the skill PR #6509.

Evidence index with embedded screenshots and JSON links.

Historical successes, failures and scope limitations remain as recorded. Moving these files does not rerun native/AO testing or upgrade any verdict.

This is evidence relocation only. Existing tested source/native hashes and failures are preserved; the documentation commit is not a fresh runtime pass. Applicable checks run in PR CI.

[nikhilachale]

Canonical main conflicts reconciled at aa200d3d2789, preserving previous source/evidence ancestry and every existing harness report/screenshot byte. Reconciliation receipt.

Validation is PR CI only; current-head checks are pending until GitHub reports them. This merge does not constitute a new native/AO run or promote historical fresh/restore/provider-role proof. Harness evidence stays on this integration PR; PR6509 remains reusable guidance and linked summaries.

[nikhilachale]

Canonical main conflicts reconciled at 0ac108f42196, preserving previous source/evidence ancestry and every existing harness report/screenshot byte. Reconciliation receipt.

Validation is PR CI only; current-head checks are pending until GitHub reports them. This merge does not constitute a new native/AO run or promote historical fresh/restore/provider-role proof. Harness evidence stays on this integration PR; PR6509 remains reusable guidance and linked summaries.

[nikhilachale]

Canonical main conflicts reconciled at 779c3c503fc7, preserving previous source/evidence ancestry and every existing harness report/screenshot byte. Reconciliation receipt.

Validation is PR CI only; current-head checks are pending until GitHub reports them. This merge does not constitute a new native/AO run or promote historical fresh/restore/provider-role proof. Harness evidence stays on this integration PR; PR6509 remains reusable guidance and linked summaries.

[nikhilachale]

Published, incomplete qualification — AO UI evidence BLOCKED; not merge-ready.

Head 4638c82aca17efa7d7d4148af37d6f2578a4637f; main 54b28374912cb2771f17b8cc32a9482e6d607bce reconciled without force-push. Published current-main reconciliation and new exact7ebd0dca diagnostic evidence:24PASS/1authBLOCKED/1catalogFAIL/2NOT_RUN. Independent ordinary file edits worked, but fresh/restored private/project/native instruction receipt effects were absent. Assisted runner success does not replace that independent failure.

Publication report · All ordered screenshot checkpoints

Every applicable latest UI checkpoint remains NOT_RUN because this stage had no genuine isolated Electron dependencies and insufficient disk preserving512MiB. API/native receipts are auxiliary, never screenshot substitutes. No image was fabricated.

Exact publication-head CI is being checked separately below; old green heads do not qualify edited/merged source. No routine VPS tests, lint, typecheck, gofmt or CI emulator ran. Linux/provider evidence does not establish other OS/provider coverage. Original failures/profiles/logs remain intact privately. No skill6509 writes, production changes, merge, release or deployment.

The initial publication live-feeds check failed: a pinned install spec was sent as an npm package name (HTTP400). The new source separates unversioned package metadata from pinned0.2.0 installation/reinstallation and refuses automatic updates to unqualified releases. Added regression cases are remote-CI-only; all original runtime/UI non-pass gates remain.

Exact-head CI (2026-10-15T07:12:38.660620+00:00): complete at 4638c82aca17efa7d7d4148af37d6f2578a4637f — 25 SUCCESS (25 reported; 25 expected including the merged Go aggregate gate). Current checks. Mergeability MERGEABLE, merge state BLOCKED; draft handoff. CI does not qualify missing native/UI/provider/OS gates. The initial head293493b9 live-feeds HTTP400 failure remains preserved; the fix is tested only by this newer head’s CI. Canonical main subsequently advanced to48c4ef5e with only two non-overlapping preview-process files; GitHub reports this head mergeable. These completed checks belong to the stated publication head, not a newly rebuilt merge with that later base.