Workbench fixes

[michaeljguarino]

• proxy config on docker, etc tools
• ...

Test Plan

Test environment: https://console.your-env.onplural.sh/

Checklist

• I have added a meaningful title and summary to convey the impact of this PR to a user.
• If required, I have updated the Plural documentation accordingly.
• I have added tests to cover my changes.
• I have deployed the agent to a test environment and verified that it works as expected (required only when changing agent code).

Plural Flow: console

[michaeljguarino]

plural deploy this

[soffi-ai]

Soffi AI Summary

This PR delivers a set of fixes and improvements to the AI Workbench, focusing on OCI registry compatibility, Docker tools reliability, and build/CI optimizations.

OCI registry robustness: The OCI client was significantly refactored to handle edge cases found in registries like public.ecr.aws — including support for opaque pagination cursors extracted from RFC 5988 Link headers (rather than naively re-using the last tag), graceful handling of JSON responses served with text/plain content types, rate-limit retries (HTTP 429), and correct proxy URL construction that avoids stripping the scheme. A new tags_page/2 function exposes paginated tag fetching for callers that need cursor-based pagination.

Docker workbench tool improvements: The search_tags Docker tool was refactored to use the new tags_page API, improving its efficiency and correctness. The tool's JSON schema and prompt context were also updated to match.

HTTP utility additions: A new Console.Utils.HTTP module was introduced (and tested) to centralize HTTP helper logic shared across clients.

Build and CI optimizations: The Dockerfile was restructured for better layer caching and build efficiency. Several CI/CD workflows (test, publish, nexus, observability-proxy) were consolidated and streamlined. Unused Mix dependencies were pruned from mix.exs.

Monitoring workbench improvements: The dashboard upsert tool schema and monitoring prompt were updated with minor enhancements.

Changes

OCI registry pagination and proxy compatibility fixes

• Refactored the OCI client to correctly handle opaque pagination cursors via RFC 5988 Link headers, JSON responses with text/plain content types (e.g., public.ecr.aws), rate-limit retries (HTTP 429), and proxy URL construction that preserves the scheme. Added a new tags_page/2 function for cursor-based paginated tag listing. (3c76352)
• Fixed proxy URL handling to avoid stripping the scheme when constructing proxy configurations for OCI registry clients. (11adc26)

Docker workbench search_tags tool refactor

• Refactored the Docker search_tags workbench tool to use the new cursor-based tags_page API, and updated the tool's JSON schema and monitoring prompt to reflect the improved interface. (c47ad8a)

Build and CI pipeline optimizations

• Restructured the Dockerfile for better layer caching and build efficiency. Consolidated and streamlined CI/CD workflows for test, publish, nexus, and observability-proxy pipelines. Pruned unused Mix dependencies from mix.exs. (76cf70e)

---

Updated: 2026-09-24 03:40 UTC

Deploy in Soffi

[plural-copilot]

Deployment PR created: https://github.com/pluralsh/plrl-up-demos/pull/3047 (pins Console to sha-df25317; Plural Service: mgmt/apps).

[greptile-apps]

Confidence Score: 4/5

The PR should not merge until authenticated proxy URLs are handled, while the no-op chart archive refresh should also be removed or made deterministic.

Findings

1.  Proxy Credentials Are Dropped ▶

Summary

This PR moves OCI proxy configuration into Req connection options, centralizes no-proxy matching, adds proxy-focused tests, and refreshes the bundled agent service chart.

• OCI registry and authentication clients now derive proxy connection options from the shared HTTP utility.
• Tests cover unauthenticated HTTP/HTTPS proxy tuples and exact/domain no-proxy entries.
• The bundled chart's logical contents remain unchanged despite its binary digest changing.

_{Reviews (1) · Last reviewed commit: "Workbench fixes"}

[greptile-apps]

Proxy Credentials Are Dropped

When an OCI proxy URL contains credentials, such as http://user:pass@proxy.example.com:8080, this path passes it through req_options/1. The proxy parser copies only the scheme, host, and port and uses empty proxy options, so the username and password are dropped. Registry and token requests therefore cannot authenticate with the proxy and will fail, typically with a 407 response. Preserve the credentials in the generated proxy options and add a test for authenticated proxy URLs.

[greptile-apps]

Comments Outside Diff

These findings sit on lines the diff does not cover, so they could not be posted inline. Each one leaves this list once its file changes.

•  Chart Refresh Invalidates Cache priv/agent-service-chart.tgz:1 ▶

  The bundled chart was regenerated without changing any member contents or modes; only the archive timestamps changed. Console hashes the raw archive, and the deployment operator uses that hash as its manifest-cache identity. This no-op update will therefore make each cluster invalidate and download an otherwise identical chart. Remove the binary update or make chart generation deterministic by normalizing archive metadata.

[michaeljguarino]

plural deploy this

[plural-copilot]

Deployment PR created: https://github.com/pluralsh/plrl-up-demos/pull/3048 — promotes this PR head (df25317) as Console image tag sha-df25317. It is annotated Plural Service: mgmt/apps.

[michaeljguarino]

plural deploy this

[plural-copilot]

Follow-up: deployment GitOps PR pluralsh/plrl-up-demos#3052 promotes this PR’s current head as sha-8fd1b30.

[michaeljguarino]

plural deploy this

[plural-copilot]

Deployment PR created: https://github.com/pluralsh/plrl-up-demos/pull/3053

[michaeljguarino]

plural deploy this

[plural-copilot]

GitOps promotion PR: https://github.com/pluralsh/plrl-up-demos/pull/3054 — pins the Console image to sha-76cf70e from current head 76cf70e5a70c1b03fe152d94be0d5ea9f390977f, annotated for mgmt/apps.