Skip to content

Console Agent

The optional Console Agent can explain a loaded design or completed run, prepare a reviewable RunSpec change, and prepare an exact-revision run request inside the local Console. The Console, RunSpecs, saved artifacts, and all normal analysis panes remain fully usable without it.

The Agent is available by default, but remains optional: it does not make a provider request until you send a message or explicitly test a connection. To remove the Agent surface and disable its local runtime, set the opt-out flag before starting the Console:

$env:ASTRAEUS_CONSOLE_AGENT = "0"
astraeus console

export ASTRAEUS_CONSOLE_AGENT=0
astraeus console

Remove the variable, or set it to 1, and restart the Console to make the Agent available again. Existing local conversations remain in the Console workspace while it is disabled; opting out does not change runs, designs, or artifacts.

Configure A Provider

Open Agent, then open its settings. Add the provider key and choose how to keep it:

  • Operating-system credential store uses Windows Credential Manager, Secret Service, KWallet, or macOS Keychain when a supported backend is available.
  • For this Console process only keeps the key in memory until that Console process stops.
  • An environment variable is also accepted and takes precedence over settings. For OpenAI, use OPENAI_API_KEY.

The browser never receives a saved key. Astraeus does not write it to the Console database, transcript, logs, or support export. A WSL session commonly has no Linux desktop secret service; in that case the settings page states that persistent storage is unavailable and offers the process-session or environment path. It does not create a plaintext fallback file.

The installed Console opens the browser with a random, process-scoped Agent access channel. The browser removes that value from the address bar, keeps it only for the tab session, and presents it on credential mutations and provider work. Other loopback clients cannot spend the configured provider credential without that channel. Source-development servers may omit this installed-mode guard and therefore remain suitable only for a trusted, single-user development session.

The release-qualified embedded providers are OpenAI with gpt-5.6-terra at none reasoning effort (avoiding a simultaneous reasoning-effort increase), Anthropic with claude-sonnet-5, and Google with gemini-3.6-flash. The Console exposes only these qualified models in this release; adding another model requires the same streaming, tool, usage, cancellation, error, and live workflow qualification. A model selected through an environment override is shown as a candidate and can be connection-tested, but cannot run normal Agent conversations until that exact model is added to the release-qualified catalog. When a qualified default replaces its predecessor, Astraeus moves existing conversation sessions to the replacement for future turns while retaining the original model identity on historical turns and usage records. The deterministic demo provider is local and does not contact a model service, but it is reserved for Astraeus tests and offline qualification and does not appear as a product provider choice.

The provider selected in Settings controls the conversation, credential status and actions, privacy notice, and connection test together. The one qualified model for that provider is shown as read-only release metadata.

Test connection performs an explicit read-only model-access check. Merely opening the Console, Agent, or settings does not make a provider request.

What The Agent Receives

Each request uses the bounded Full context shown in the Agent source list. It can include the current Console state, current RunSpec, example intent, run overview, and available result summaries. The envelope is limited to 64 KB and 12 sources; result tools and individual tool responses are also bounded.

Conversation history is stored in the local Console workspace. Astraeus sends the retained conversation and selected evidence to the provider for each turn; provider-side data controls and retention still apply. Review the provider notice and policy link in settings before using confidential engineering data.

The packaged skills route each request to one documented workflow. Only one skill's server-owned tools are active at a time. Engineering content is treated as data and cannot grant the model more Console authority.

Analysis, RunSpec Changes, And Runs

For analysis, ask about the currently loaded run and inspect the cited source list beneath the response. Missing artifact families remain unavailable rather than being inferred.

For a RunSpec change, the Agent can propose exact path edits against the current immutable revision. Astraeus constructs and validates the complete candidate locally. The proposal card shows the resulting YAML and diff. It cannot change the active RunSpec until you separately approve and apply it; a stale base revision conflicts instead of overwriting newer work. The Agent has no authority to apply the proposal by itself.

For a run, ask the Agent to validate and run the current configuration. The runner may prepare a launch request bound to the exact immutable RunSpec revision and its validation result. Preparing the request does not create a job or start a simulation. Review the run name, revision, validation state, scope, and memory-preflight policy in the card, then press Run yourself. That click uses the normal Console licensing, single-active-run, process, and Run Monitor path. If the RunSpec changes first, the request expires. Repeating the same confirmation returns the same job instead of starting a duplicate.

The model cannot call the confirmation endpoint and has no authority to cancel a simulation. Cancellation remains an explicit Run Monitor action.

Cancellation And Recovery

Only one turn can run in a conversation, at most two provider streams can run in one Console process, and the process accepts at most 20 provider turns per minute. Cancel terminates the local turn and asks the provider stream to stop. Completed and failed turns remain in the local conversation.

Astraeus does not automatically replay failed provider requests. This avoids duplicating a proposal after an ambiguous network failure. Review the durable conversation and start a new turn when retrying is appropriate.

For a support request, open http://127.0.0.1:8765/agent/support-export while the enabled Console is running. The JSON export contains only aggregate record counts, provider/model usage totals, recent turn states, and the active ceilings. Its schema excludes keys, prompts and responses, engineering evidence, RunSpec proposal content, launch-request content, and filesystem paths.

For the broader Console workflow, continue with Console And Visualization. For assistants that operate the installed CLI outside the Console, see Using AI Skills.