Repository navigation
Remove per-repo fullsend-vertex-ai.yaml to inherit upstream profile #16
Description
What happened
PR #15 added **/claude.exe to .fullsend/profiles/fullsend-vertex-ai.yaml — the same 1-line fix previously applied to node-api#13, rhdh-plugins#12, and overlays#13/#14. The root cause was that this repo maintains a local copy of the Vertex AI profile that shadows the upstream version in fullsend-ai/agents. When Claude Code 2.1+ changed its binary name from claude to claude.exe, the upstream profile was not updated yet (agents#1118 is still open), and each per-repo override also needed a manual patch.
Comparing the per-repo profile to upstream main: the per-repo version is a subset of upstream. It has api.anthropic.com and *.googleapis.com endpoints (upstream has both plus allow_uninspected_credentials), and binaries **/claude, **/claude.exe, **/node (upstream has those plus **/pi). The per-repo override adds nothing beyond what upstream provides — it is a stale copy with local patches applied over time.
What could go better
When the upstream profile evolves (new binaries, new endpoints, new flags), this repo's local override silently diverges. The next binary name change, endpoint addition, or security flag will require another per-repo PR — multiplied across every rhdh-parasol repo that maintains a local copy. This is the same pattern that caused 5 independent PRs for the claude.exe fix.
Confidence is high that the per-repo override is unintentional drift rather than a deliberate divergence: the file content is a strict subset of upstream main, the PR history shows it was copied early and patched locally, and there is no comment or documentation explaining why a local override is needed. The only risk is if a future upstream change includes something this repo explicitly does not want (e.g., **/pi binary access), but that would be better handled by filing an upstream issue than by maintaining a shadow copy.
Proposed change
After fullsend-ai/agents#1118 merges and a new agents release is cut (post-v0.37.0), delete .fullsend/profiles/fullsend-vertex-ai.yaml from this repo so the harness falls back to the upstream profile. Verify that the upstream profile at the new release tag is a superset of the current per-repo file before deleting. If the repo needs to exclude specific binaries or endpoints, use a targeted per-repo policy override rather than copying the entire profile.
The same evaluation should be done for other rhdh-parasol repos that maintain local copies of this profile (node-api, rhdh-plugins, rhdh-plugin-export-overlays).
Validation criteria
After the per-repo profile is removed: (1) the next refine agent dispatch on this repo succeeds without policy_denied errors — claude.exe access to sts.googleapis.com is allowed by the inherited upstream profile; (2) future upstream profile changes (e.g., adding new binaries or endpoints) are inherited automatically without per-repo PRs; (3) no new fullsend-vertex-ai.yaml override is re-created in the next 3 agent releases.
Generated by retro agent from #15
Activity
fullsend-ai-triage commentedon Sep 1, 2026
🤖 Finished Triage · ✅ Success · Started 5:52 PM UTC · Completed 5:56 PM UTC
Commit:
0a81563· View workflow run →Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $0.68
fullsend-ai-triage commentedon Sep 1, 2026
This issue is blocked on an upstream dependency. The upstream PR to add
claude.exeto the Vertex AI profile infullsend-ai/agentsis still open. Until that PR merges and a new agents release is cut, deleting the local profile override would causepolicy_deniederrors because the inherited upstream profile would not yet include the**/claude.exebinary entry.Once the upstream PR merges and a release is available, the proposed change is straightforward: verify the upstream profile is a superset of the local file, then delete
.fullsend/profiles/fullsend-vertex-ai.yaml.Note: the same evaluation applies to sibling repos (
node-api,rhdh-plugins,rhdh-plugin-export-overlays) that maintain local copies of this profile.Blocked by:
Labels: Enhancement to remove stale config override in favor of upstream inheritance.