Maintenance keeps an Online version observable, stoppable, and safe to iterate without presenting internal APIs or unaccepted platform behavior as developer features.
The Agent detail page must show Online. “Published successfully” alone does not prove that the Agent is accepting production traffic.
Use the user_agent_url from the publication result, or find the Agent by its exact name in the public Agents catalog and verify its identity. Click Use in ChatGPT, or choose Use in Claude or Use in WorkBuddy from the split-button menu. Do not construct a public URL from an internal Agent ID.
In the client, search for or select the current Agent by its exact name and verify its description and developer identity; a generic installation dialog does not itself bind the current Agent. Submit a representative minimum request and inspect the final output. If the Agent promises a file, image, or another artifact, open or download it. If the public page or installation entry is missing, record BLOCKED instead of substituting WebChat.
Record the version label, invocation time, input type, visible result, and any failure code. Redact tokens, Cookies, private keys, and sensitive portions of connection commands.
For maintenance, a high-risk defect, or service retirement, click Take Offline on the published version page and wait until the page confirms Offline. Offline stops new production invocations; it does not delete the Agent, version, or historical records.
If current behavior may cause incorrect delivery, unexpected cost, or data risk, stop new traffic with Take Offline before diagnosing the defect.
With explicit authorization, CLI 0.7.3 also exposes the corresponding allow-listed operations. Use oasn-sa-dev portal supply-status to change Agent supply state or oasn-sa-dev portal version-suspend to suspend a specific version, following each command's --help contract. These writes require confirmation and a stable idempotency key; command availability is not authorization.
For a behavior change to a published Program, use the developer page to create or edit a draft version, then repeat Workspace development, WebChat testing, Agent Card/MOM/pricing validation, Publish, and Go Online. Never assume that a published runtime snapshot can be edited in place.
N.N.N version label and describe the behavior change.oasn-webui output.succeeded + visible + Go Online + public-page installation + real invocation.| Capability | Current public entry point | What to do |
|---|---|---|
| Inspect source choices | CLI workspace sources | Read the existing Workspace and restorable versions, then obtain an explicit source choice. |
| Create a Workspace | Website guidance + CLI workspace create | Create for the target Version ID with an explicitly chosen --source-version-id or --fresh, and wait for active. |
| Query a Workspace | CLI workspace status | Read or wait on a known Workspace ID; this does not bind or verify SSH. |
| Connect with SSH | CLI workspace connect | Bind or verify the same public-key fingerprint and require bound + ssh_verified=true. |
| Renew an expired connection | CLI workspace resume | With explicit authorization, renew the same active Workspace; do not create another Sandbox. |
| Close a Workspace | No public website button or CLI command | Do not guess or call an internal API, and do not invent workspace close. |
| Configure WebUI ports | CLI version webui-ports get | set | refresh | Use CLI 0.7.3. The website has no port form. |
The current public gap is Workspace close—not WebUI-port configuration. Even if underlying services expose cleanup fields or private endpoints, do not call them. Use the 0.7.3 CLI for source, connection, resume, and port operations, and stop when an operation is not on its public allow-list.
Always begin with the authoritative query:
oasn-sa-dev version webui-ports get --version-id <agent_version_id>The two status fields answer different questions:
| Field | What it proves | What it does not prove |
|---|---|---|
sync_status=ready | The desired port declaration finished synchronizing. | It does not prove that a usable proxy link exists or that the HTTP service is healthy. |
proxy_status=ready | The returned links passed the current proxy session and target-metadata checks. | It does not prove that the application is listening or that every route works. |
When the complete desired list changes, save it as a replacement:
oasn-sa-dev version webui-ports set --version-id <agent_version_id> --ports 7860,8765An active Workspace applies this mapping in place. It does not rebuild the Sandbox, change the source, or restart the business process. Confirm both synchronization and proxy readiness, then test the real page and its nested routes. The old links become invalid after a mapping change.
Setting the same list again is an idempotent no-op. If the port list is correct but the link generation is expired or revoked and a new generation is explicitly required, first query the state and then, with explicit authorization, run:
oasn-sa-dev version webui-ports refresh --version-id <agent_version_id>refresh retains every declared port and creates new links; it does not clear the list or rebuild the Sandbox. A 502 generally requires checking that the business service is listening before refreshing. For pending, a timeout, or a conflict, query with get and do not automatically replay the write. If the Workspace connection itself is expired and the developer wants to continue using it, renew that same Workspace with workspace resume.
Development Workspace links and production result links are different. A development link is temporary and cannot prove production recovery. For a production invocation, the platform is designed to restore the environment and original WebUI services from the snapshot committed for that same session when the user reopens its result link; the rule applies equally to one or multiple ports.
The current restoration path is connected in code, but it has not completed formal end-to-end acceptance. Do not promise that a result link can always be reopened merely because a snapshot exists, ports are declared, or the development page works. Test single-port and multi-port production results after task completion when an authorized production invocation surface is available, and otherwise mark the behavior NOT TESTED.
The platform does not require a developer-supplied fixed restart script or health endpoint for this restoration contract. It preserves the original port, path, query, and fragment, but does not reuse old network connections or recreate a page that the original process deleted. Never work around a restoration failure by reducing the Agent to one port, regenerating the original task, or reusing old task credentials.
The CLI's expires_at is evidence for the short-lived connection. Before expiry, save and verify the business work under /oasn. An active Workspace with an expired connection may be renewed only through the explicit workspace resume flow. The following lifecycle states cannot be used as a development environment:
failed: creation or runtime failed; diagnose it with failure_code.closed: the Workspace is closed.published: publication moved this development Workspace to a terminal state.cleanup_pending / close_pending: the platform is finalizing it; do not upload or execute more work.For exact commands, return to CLI Reference. For port declarations and final reply syntax, see Input, Output, and WebUI.