AI Agents

  • Fixed

    • The chart no longer publishes an unauthenticated muster. ingress.enabled or gatewayAPI.enabled rendered a route while muster.oauth.server.enabled was false (its default), and without OAuth muster serves every request as the synthetic default-user. The render now fails and names the switch; muster.oauth.server.acknowledgeUnauthenticatedExposure: true allows it for a deliberately unauthenticated install behind a trusted proxy. agent-platform is unaffected: it enables OAuth and leaves both switches off. (#1071)
  • Added

    • muster test names who holds a Valkey stand-in’s port. A scenario on Valkey storage failed now and then in CI with failed to start valkey on 127.0.0.1:<port>: bind: address already in use, and nothing said which socket held the port. The allocator had handed it out from outside the ephemeral range, behind a guard. The failure now carries the socket table for that port (local and remote address, state, owning pid and command line where visible), as instance startup failures already do. (#1356)
  • Added

    • muster test dumps its goroutines while a call is blocked past its deadline. A stalled call’s diagnostics (#1260) were taken after the call had unwound, so the blocked frame was gone. In CI a poll with a 20s budget came back only after 90s, and muster serve never logged its request. The call ignored its context somewhere in the harness’s client path. A call to muster serve that is still running 2s after its context’s deadline now has the harness’s goroutines recorded while it is blocked, as harness_goroutines_at_overrun in the report, and the failure line points at it. (#1206)
  • Added

    • Claude Sonnet 5.5 is priced in the LLM routing catalog: llmRouting.modelCatalog.providers.anthropic.models.claude-sonnet-5-5. Input $2, output $10, cache reads $0.20 and 5-minute cache writes $2.50 per million tokens, from Anthropic’s pricing page, the same as Claude Sonnet 5. The data plane’s built-in catalog (agentgateway 2.1.2) does not price the model, so without the entry every lookup misses and the gateway emits no cost sample for its calls. Both charts carry it.
  • Fixed

    • Delete instances whose workspace has read-only directories in #365 by @teemow

    Full Changelog: https://github.com/giantswarm/klausctl/compare/v0.4.21...v0.4.22

  • Fixed

    • call_tool tells the model to write name before arguments, in its description, its name argument, describe_tool’s invocation note and the missing-name error. Its schema reaches the model with arguments listed first (properties are serialized alphabetically), and models that follow that order lost name inside a long arguments object (a workflow definition, a table row), failing with “name argument is required”.
  • Fixed

    Full Changelog: https://github.com/giantswarm/muster/compare/v5.34.0...v5.34.1

  • Fixed

    Full Changelog: https://github.com/giantswarm/klaus/compare/v0.1.42...v0.1.43

  • Fixed

    • Reject unknown tool arguments; fail fast without a credential in #364 by @teemow

    Full Changelog: https://github.com/giantswarm/klausctl/compare/v0.4.20...v0.4.21

  • Added

    • The provider token refresh threshold is configurable. muster hands out the Dex token it holds for a person as is while it has more than mcp-oauth’s TokenRefreshThreshold (5 minutes) left, so a refresh by a client could return a token with minutes to live, and a long agent turn whose tool calls carry it lost every tool when it expired. aggregator.oauth.server.providerTokenRefreshThreshold (chart: muster.oauth.server.providerTokenRefreshThreshold), a Go duration of at least 1s, sets it; empty keeps 5 minutes. Keep it below Dex’s ID token lifetime, or every request refreshes at Dex.