Kill ENABLE_MANAGED_AGENT_CONFIG; gate managed config on the server SAFE flag - #504
Merged
Merged
Conversation
david-siqi-liu
force-pushed
the
david/kill-managed-config-flag
branch
from
September 5, 2026 02:30
a6580cc to
a7ebe98
Compare
david-siqi-liu
marked this pull request as ready for review
September 6, 2026 13:29
david-siqi-liu
force-pushed
the
david/kill-managed-config-flag
branch
from
September 6, 2026 13:32
a7ebe98 to
245d121
Compare
david-siqi-liu
force-pushed
the
david/kill-managed-config-flag
branch
from
September 6, 2026 15:06
245d121 to
98cdaa6
Compare
david-siqi-liu
force-pushed
the
david/kill-managed-config-flag
branch
from
September 6, 2026 20:04
98cdaa6 to
377acf5
Compare
lilly-luo
approved these changes
Sep 8, 2026
david-siqi-liu
force-pushed
the
david/kill-managed-config-flag
branch
from
September 8, 2026 15:47
377acf5 to
a77db36
Compare
This was referenced Sep 8, 2026
david-siqi-liu
added a commit
that referenced
this pull request
Sep 8, 2026
## 🥞 Stack (ug configure + managed-config) - **#500** ⬅ this PR - #504 - #510 --- ## What did you change, and why? Customers running `ug configure` on a workspace where server-managed coding-agent config is disabled (FEATURE_DISABLED) hit an alarming, circular error and then dead-ended: ERROR Workspace-managed coding agent configuration is not available on this workspace. Use `ug configure` to set up agents for individual users instead. Root cause: `refresh_managed_config` treated FEATURE_DISABLED like a transient read failure and fell back to a stale cached config, returning it with the feature-disabled flag unset. That masked the disabled state, so an admin got routed into the managed setup flow, which re-read the workspace, got FEATURE_DISABLED again, and raised the message. The fix is in `managed_config.py`: FEATURE_DISABLED is now authoritative. It returns no config with the feature-disabled flag set and clears the persisted cache, so `ug configure` stays on the normal per-user flow, a launch never re-applies a policy the workspace turned off, and a later transient read or token failure cannot resurrect the disabled policy through the fallback. Also initializes the feature-disabled flag on the `--dry-run` path (a pre-existing UnboundLocalError on an empty local cache, surfaced by review). Hiding `ug setup`/`ug publish` from help and pruning the README, previously bundled here, moved to standalone #510 since it has no dependency on this fix. ## How do you know it works? Unit suites (managed_config, cli) green, including new coverage for the feature-disabled cache clear and the dry-run no-crash path. ruff check and format clean. PR CI green (test + e2e). Live-verified end to end against a real feature-disabled staging workspace (eng-ml-agent-platform, with the `codingAgentConfigCrudEnabled` SAFE flag turned off), where the gateway returns: ```json {"error_code":"FEATURE_DISABLED","message":"Coding agent config APIs are not enabled for this workspace."} ``` Invoking `ug configure` against that workspace as an admin, with a non-empty stale managed config cached (the exact condition that triggered the report): Old build (`0.1.0+81.g95999aa`) exits 1 with the circular dead-end error: ``` ERROR Workspace-managed coding agent configuration is not available on this workspace. Use `ug configure` to set up agents for individual users instead. ``` This branch exits 0 with no error and drops into the normal per-user configure flow. Under the hood `refresh_managed_config` now returns `(None, True)` and clears the stale cache to `{}`, so the admin is never routed into the managed-setup dead end. This pull request and its description were written by Isaac. Co-authored-by: Isaac <no-reply@databricks.com>
…AFE flag Remove the client-side ENABLE_MANAGED_AGENT_CONFIG env var and managed_agent_config_enabled(). Managed coding-agent config is now gated purely by the server-side SAFE flag, which surfaces as FEATURE_DISABLED from refresh_managed_config (authoritative: returns None and clears the cache). - Drop the `ug configure` admin auto-routing. It was a passthrough when the flag was off, so configure now behaves as it always did for non-flag users: non-interactive, no managed-config prompts. Keeps omnigent's `ucode configure --profiles --agents ... --use-pat` non-interactive. - Bare `ug` prints help when the feature is disabled server-side, instead of a silent no-op. - Launch always consults the managed config (removed the cached-launch fast path) so an admin's config can't be bypassed by stale local state. - Remove --skip-managed-config; it worked by unsetting the now-gone env var. - status and the launch "no managed config" note key off the server signal. Co-authored-by: Isaac <no-reply@databricks.com>
david-siqi-liu
force-pushed
the
david/kill-managed-config-flag
branch
from
September 8, 2026 16:22
a77db36 to
94db730
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🥞 Stack (ug configure + managed-config)
ug configureerroring on feature-disabled workspaces #500ug setupandug publish; ug is developer-only #510What did you change, and why?
Removes the client-side
ENABLE_MANAGED_AGENT_CONFIGopt-in (a bug-bash flag) andmanaged_agent_config_enabled(). Per team decision, workspace-managed coding-agent config is now gated purely by the server-side SAFE flag, which surfaces as aFEATURE_DISABLEDreason fromrefresh_managed_config(made authoritative in #500).Two constraints had to keep holding, and do:
ucode configure --profiles DEFAULT --agents claude,codex,pi --use-pat --skip-validate --skip-upgradestays fully non-interactive.Where to look:
cli.pyis the bulk of the diff: deletes the env-var gates, drops theug configureadmin auto-routing (it was a passthrough when the flag was unset, soug configurenow behaves for everyone as it did for non-flag users), and removes--skip-managed-config(it worked by unsetting the now-gone env var).statusand the launch "no managed config" note now key off the server signal.ugon a feature-disabled workspace prints one managed-free guidance line (runug configure, thenug <agent>) instead of a silent no-op.How do you know it works?
Unit suites (test_cli, test_managed_config, test_managed_wizard, test_lint) green; ruff check and format clean. PR CI green (test + e2e). A prior gpt-6-astra review verified both hard constraints; its one finding (feature-disabled help still surfaced managed-config wording) is addressed by the managed-free guidance line.
Follow-up (not in this PR)
ug statusreads the managed-config cache directly (load_managed_state), with no server-state check, so in a server-side enabled to disabled transition it can surface a stale managed summary until the nextug configureor launch clears the cache. Dormant today (the feature is unramped, so the cache is empty everywhere) and self-healing on the next refresh. Deferred: closing it means makingstatusrefresh from the server, which trades its offline-cheap local-diagnostic nature. Will address before the feature ramps.This pull request and its description were written by Isaac.