[piotrlaczkowski]

Three related pieces: fixing where agentomatic init puts code, making the platform's SSE streams survive a dropped connection, and hardening that new surface for production.

---

Part 1 — CLI scaffolding

The templates were never broken — all 16 generate real, working code. The bug was where it landed.

agentomatic init resolved agents/ against the current working directory. Run it from a subdirectory of a project — or from the parent it had just been created in — and it silently built a second, parallel project, leaving the real agents/ empty while reporting success:

$ agentomatic new my_platform
$ agentomatic init hello --template basic     # forgot to cd
   📍 Location: agents/hello                   # ← a NEW agents/ beside the project
$ ls my_platform/agents/
.gitkeep  __init__.py                          # ← empty

--dir made it worse: the bootstrap wrote stacks/, main.py and .agentomatic-stack into whatever directory happened to contain the target — a home directory if the flag pointed at one.

Target resolution

• Resolve the enclosing project by walking up from the current directory, stopping at a repository root or $HOME. Markers are specific so a scaffold cannot escape into a lookalike ancestor.
• Use a lone project found in a subdirectory (the new → forgot-to-cd case) and print which root was chosen; name the candidates and stay put when several match.
• Add --here to opt out; confine --dir to placing the package.
• Fix the same cwd assumption in add connection and add ingestion.

Making a scaffolded project run and deploy as advertised

• Prompt for NAME instead of hard-exiting on a bare agentomatic init; reject names that are not importable package names.
• Report the absolute location and verify files reached disk.
• Bootstrap the platform main.py — deploy renders uvicorn main:app, so a project without one built a container that could not boot. An existing main.py is never overwritten.
• Detect the model a local OpenAI-compatible server has loaded and bake it into stacks/local.yaml. The hardcoded Qwen3.5-9B-MLX-4bit meant any other loaded model answered the first invoke with HTTP 400.
• Add openai to the all extra — the default local stack's omlx provider needs it, so agentomatic[all] scaffolded a project whose every LLM call failed.

---

Part 2 — Resumable streams

TaskManager._emit returned early when a task had no subscribers, so events emitted while a client was disconnected were never created, let alone retained. A dropped SSE connection could only be recovered as far as the task's current state.

• TaskEvent gains a monotonic per-task sequence, gapless from 1, published as the SSE id:. A browser EventSource resumes through Last-Event-ID with no client code; ?since= does the same for other clients.
• New TaskEventLog: an ordered, bounded replay buffer with an in-memory default, a null implementation, and a provider registry so a shared backend can be registered for cross-worker replay (the interface ships, not a vendor client).
• A truncated resume point is announced rather than served as if complete.

This lands for every target type at once — agents, pipelines, plugins, endpoints and ingestion share one task manager, so a pipeline's per-step progress resumes exactly like an agent's.

A2A gains GET /a2a/tasks/{id}/events with the same contract, and /.well-known/agent.json now renders the same card as /{agent}/card through one builder — the discovery document previously omitted capabilities entirely and could not advertise streaming at all.

Other SSE surfaces: new agentomatic.streaming provides one encoder, a stream identity and a bounded replay buffer. /invoke/stream numbers and records its frames and returns X-Stream-Id; GET /invoke/stream/{stream_id} re-sends them. Studio's streams are numbered through the same helper.

What this deliberately does not claim

/invoke/stream replay returns what was produced. It does not restart the run: the agent execution is bound to the request Starlette cancels on disconnect. The docs say so and point at the durable path (submit as a task, follow its events) rather than implying a guarantee the architecture cannot keep.

---

Part 3 — Production hardening

A security review of this branch found — and reproduced — a cross-agent authorization bypass in the replay route added in Part 2. GET /{agent}/invoke/stream/{stream_id} resolved the id against a single process-wide buffer with no check that the stream belonged to the agent in the path. Zero-trust derives its policy purely from that agent segment, so a caller permitted on a permissive agent could name a restricted agent's stream id on their own route and receive the restricted agent's frames. Studio run frames shared the namespace, and Studio run ids are enumerable through a path zero-trust does not cover.

Fixed by restoring the pattern the codebase already used two files over (run.agent_name != name → 404):

• Frames carry an ownership tag pinning them to the producing agent and the principal they were produced for.
• The replay route answers 404 for a stream it may not read — the same answer as a nonexistent id, so it never confirms someone else's stream exists.
• Studio frames are tagged separately, so a run id is not valid on an agent route.
• create_streaming_response takes an owner and now requires a fresh new_stream_id.

Three more production defects, all found by review rather than by tests failing:

• Retention was not a memory bound. Both buffers capped entries by count only — ~300 MB of ordinary traffic, more with long answers. Byte budgets added at both per-stream and total level; the deques lost maxlen because an implicit drop evicted an entry without its size leaving the running total.
• Studio keyed its resume stream on thread_id — a client-supplied path parameter, so a second resume continued the first's numbering and a caller could name another thread's frames.
• The A2A stream read the task record once per replayed event, though it is only needed for the terminal frame — N queries with the SQL store.

Plus: retention is sized from the environment like every other platform switch (AGENTOMATIC_TASK_EVENT_*, AGENTOMATIC_STREAM_*; a bad value logs and falls back), and /status reports what the buffers hold so an operator can size them.

---

Testing

• All 16 templates: scaffold → compile → register with the platform.
• Full journey on a fresh pip install -e ".[all]": scaffold, boot, agent registers, discovery advertises streaming, live stream numbered, replay returns exactly the gap, task stream resumes from Last-Event-ID, /status reports occupancy.
• The reported exploit reproduced and asserted closed, including the indistinguishable 404.
• Memory bounds asserted under pressure; auth asserted on every new route.
• ~190 new tests across five files.

Gate: ruff check, ruff format --check, mypy (230 files), mkdocs build --strict clean; 2739 passed.

One pre-existing failure is unrelated and untouched: test_save_read_only_storage_returns_actionable_conflict chmods a directory read-only, which root ignores. It fails identically on a clean checkout of the branch point and passes on CI's non-root runner.

Notes for the reviewer

• Cross-worker replay is deliberately not implemented: it needs a broker, and shipping a Redis client would be a first-party vendor connector, which CLAUDE.md rules out. register_event_log_provider() is the extension point, and the docs state the single-process limitation plainly.
• The model probe adds a ~1.5s worst-case delay to init when no local server is running. AGENTOMATIC_LOCAL_MODEL skips it.
• This branch twice hit CI failures from pre-existing code that surfaced only because the gate runs pre-commit over changed files (a ruff-format disagreement and a UP038 error). Root cause: .pre-commit-config.yaml pins ruff v0.8.6 while the ruff>=0.8 dev dependency resolves to 0.15.x. Worth aligning separately — bumping the pin here would reformat the repo and bury this change.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Pk5bxkw7Q3j8VN1TvxeQ5V