[rohan-chaturvedi]

🔍 Overview

Fixes from the review of #1025 (AI Agents, console side). Targets feat--agents. Covers the review's security, correctness and performance findings, regressions outside the Agents pages, UI nits, an audit of the Agent UI against the console's shared components, and rounds of UI feedback from a review on a seeded local stack.

💡 Proposed Changes

Integration credentials and Connections

• Editing a Postgres credential so that its host, port or database changes now restarts sessions on the moved Connections, refreshes the other bound Workflows, and writes an audit event with the old and new config. The edit form warns before saving. As with other credentials, IntegrationCredentials:update is the only permission needed.
• Creating a credential rejects keys the provider does not declare.
• Restored the GCP sync project default.

Host rules

• "Allow host" is refused while a Connection's custom hosts are waiting for review.
• Hostname validation rejects IP-like or numeric last labels, scope IDs, and single-label suffixes. Decoy random length is capped at 256.

Runtime API

• Every runtime failure (network policy, throttling, bad JSON, 404, 500) now returns the Agent error envelope. Throttling is retryable and sets Retry-After.
• A revoked or expired session returns 401 before any RBAC 403.
• Client capability fields must be lists of strings. Stored client metadata is capped at 8 KiB.
• A closed request no longer answers a repeated ask forever. Pending requests and denials (for 1 hour) still do, with a new cooldown flag.
• Assumed-role STS credentials are cached per session until they expire, and are requested outside row locks. Activity timestamps are written at most once a minute.

Lifecycle

• Agent and Workflow deletes are atomic, lock the Agent row, and keep earlier deletion times.
• Deleting an Agent, Workflow or Connection cancels its pending requests and retires unused placeholder Connections.
• Fulfilling a request whose Connection was deleted, or creating a duplicate Workflow name, returns a clear error.
• Org purge deletes Agent runtime rows in batches. Session revocation is one bulk update. Session credential lookups are indexed.

GraphQL

• Overdue requests expire before they are listed. Request lists are capped at 200, pending first.
• agentEvents pages history by event time, newest or oldest first (order), and filters by event time (start, end). order replaces newestFirst. The history cursor is opaque (event time, then ingest sequence). The live tail still follows ingest order.
• Workflow grants load with their Connections and credentials in one query (mesh poll on a test org: 49 → 11 queries).
• Agent management mutations that wrote no audit event now write one.

Console

• The activity log opens at the newest events and tails forward. Load more brings in 25 events a page, like the secret and SCIM logs, with a "Page N" divider before each page. The divider stays with its page while live events arrive on top.
• A failed poll keeps the last data on screen instead of a full-page error. Polls pause in hidden tabs.
• "Allow host" asks for confirmation, states the effect on Workflows and sessions, and is disabled while hosts are waiting for review.
• UI permission checks now match the API for Allow host, deny, fulfil, and viewing members.
• The setup dialog no longer preselects a credential the request did not name.
• Harness picker: horizontal cards with each brand mark in a fixed icon tile, larger labels, and a check on the selected harness. Required fields in the Agent dialogs all mark the asterisk the same way.
• Token dialogs: Generate token is now as wide as Create Agent. Both stay open on outside click or Escape until the token is copied, with its Copy button or by selecting it. "Continue to Agent" and a new Done button unlock after the copy. The close button still works.
• Token setup: the auth command still shows phase auth --mode token, but its Copy button copies PHASE_HOST=<this console> phase auth --mode token, so the CLI skips asking for the instance. It uses the same host as the secrets one-liner (getHostname()).
• Tokens: Generate token is hidden for disabled Agents, the setup token says it never expires, reveals say the token is shown once, past custom expiry dates are blocked, and the minted token is cleared from mutation state on close.
• Deny takes an optional note to the Agent. Added a Cancelled filter. Linked requests open and scroll once.
• "Continue to Agent" opens the Agent, "Back to Agents" goes to the list, the grant dialog lists only active ungranted Connections, GraphQL errors show one toast, plus plural and Workflow/Connection capitalisation fixes.

UI consistency with the rest of the console

• The activity log follows the Audit and SCIM logs:
  • A Filter menu with a dot while active, toggle buttons and Reset filter, instead of four always-visible selects.
  • Rows expand from a chevron, with the emerald open state and uppercase detail fields, now including the Connection the request went through.
  • The event's detail shows in the shared JSON block with copy, only when there is some. The Agent's proxy sends it (redacted), and the server adds it for credential resolution errors. Before, events without detail showed an empty {} box.
  • A centred Load more.
  • Fewer columns, so the table no longer scrolls sideways at laptop widths. The Agent column (always this Agent) is now Workflow. Provider moved to the row details, and latency to the status cell.
• The request status filter uses the same Filter menu, and Filter now comes before Refresh.
• Token expiry uses the Service Account and SCIM token picker (radio buttons with check icons).
• Raw controls replaced with shared ones:
  • Custom expiry dates and notes use Input and Textarea.
  • The member picker is a searchable list with avatars, not a native select.
  • Callouts and inline errors use Alert.
  • Retry, host-rule approval and "Manage Connection" use Button.
• Section and detail tabs use the shared tab underline, and empty states use the shared graphic size.
• In both Agent lists (the Agents tab and Access > Agents), each Agent shows its harness mark on a tile, with the harness name right under the Agent name. This matches the Overview cards and the Members and Service Accounts lists:
  • Only an Agent that is not active gets a status badge, beside its name. "Active" on every row was noise, and clashed with the "1 active session" count.
  • Access > Agents showed the same robot for every Agent.
  • Request cards use the same tile.
• The custom Claude, Cursor, Devin and OpenCode marks now default to 1em, like react-icons marks. Without a size they stretched to fill unsized containers, such as the tiles on Overview cards.
• Search bars already matched the Members and Service Accounts search. Only All Agents gained full width.
• Agent buttons take their icon through the Button icon prop, as the console's convention asks. The prop keeps icons from shrinking, and swaps them for the spinner while loading (Refresh, Load more, confirmations).
  • Buttons without an icon gained one: a trailing arrow on links (Review, Manage, Manage access, Continue to Agent), a check on saves and Done, a plus on creates and adds, and the action's own icon on confirm buttons.
  • The icon-only Edit on Connection cards now reads "Edit", like the other Edit buttons.
  • The filter and token expiry chips keep their coloured state dots as content, as in the logs filters, and the Overview filter chips keep their brand marks, because the prop cannot colour them.
• Destructive actions follow one icon rule across the Agent screens: Delete uses the trash can (Agent, Workflow, Connection), and Revoke and Remove use an X (grants, tokens, sessions, members), since they take access away rather than destroy anything. Confirmations use the same icon as their trigger.
• Every Agent menu highlights the hovered or active row with the Overview filter dropdown's translucent tint: the shared Agent select (Generate token's Workflow, Create Connection's service and credentials, the setup dialog's credentials, the grant dialog's Connection, the log's session filter) and Assign members' member list and Workflow dropdown. Before, the select lifted the row to a lighter card in light mode.

UI review feedback

• Logs follow event time, not ingest order. A late batch no longer shows "14 minutes ago" above "8 minutes ago".
  • The Time header sorts newest or oldest first. Live polling pauses while sorted oldest first, and the toolbar says so.
  • The Filter menu has a Time range section (last hour, 24h, 7d, 30d, or a custom start and end), like the Audit logs' date range.
• AWS and PostgreSQL are spelled correctly everywhere: request cards, the setup dialog, Connection badges, grant badges and the grant dialog, and the log's provider and credential action. One spelling map now serves both humanize helpers.
• Times are always relative ("5 minutes ago", "in 3 days"), with the full timestamp on hover. That covers request cards, Connection rows, every Agent table, the Agent page and the log, and Overview cards gained the hover.
• Request cards show when a pending request expires, when an expired one expired, and when an approved, denied or cancelled one was resolved. Before, closed requests still showed "Expires in 3 days".
• Request cards, the Connections and Agents lists, and the Agent page's Workflow cards and tables use the Overview card surface: lighter than the page in light mode, a step up in dark mode. The log table stays on the page, like the Audit logs, since its row and open states are drawn for that background.

Compact Workflow layouts

• Overview cards list Workflows one per line (name and grant count), with one Generate token per Agent instead of one per Workflow. A card with two Workflows went from 271px to 218px.
• The Agent's oldest Workflow (created with it as its default) sorts first, the rest A–Z. The Overview, the Agent page, the Agents list and the token dialog use this order.
• Pending requests stay in full, but move to the top of the card. Each shows the Workflow and target, the kind, the deadline ("Expires in 20 hours", red in its last day) and Review. The soonest deadline comes first, and the card is outlined in amber. Several requests on one card are divided by a thin line.
• Hovering a card lights only its direct neighbours, and other connectors fade. Before, a shared Connection lit almost every Agent.
• The gutter between Agents and Connections takes the board's spare width (up to 480px), so connectors fan out instead of bunching.
• The Agents list names each Agent's Workflows (three, then "+N more"). Sessions and last seen share an Activity column, so rows still fit at 1440px.

Pending requests and review actions

• Request cards end with an action bar after the proposal: Deny (red) at the far left, and the action that resolves the request at the far right. A new success Button variant makes that action green in light mode too, where primary is black.
• Review in every list of pending requests (Overview cards, and the Agent page's Overview tab and Workflow rows) is an amber text link with an arrow, not a solid button, so a list of requests is not a column of buttons. It uses a new shared textWarning Button variant: the emerald text link in amber.
• On the Overview, a Connection card lists the pending requests that ask for it, in the same section as an Agent card's: each row names the Agent and Workflow that asked, with the kind, the deadline and Review. Requests from every Agent are merged, soonest first. The card is outlined in amber, and hovering a row lights that request's line, as on the Agent card.
• Pending requests show across the console: an amber count on the AI Agents sidebar item (a dot when the sidebar is collapsed and in the mobile tab bar), a "(N)" prefix on the tab title, and an amber dot on the favicon. The navbar checks once a minute, in background tabs too, and the sidebar reads the same cache entry. Only members who can read Agent requests see these.
• Pending requests draw amber lines on the Overview: solid where the Workflow already has the grant (a credential update), dotted where approving would add it. Hovering an Agent, Workflow, Connection or request shows the lines in its scope, and a credential update also lights the other Workflows using that Connection. With the Pending requests chip on, every request line shows.

Overview filters

• Filter chips sit opposite the Overview search. They are Buttons: secondary while off, primary while on (black in light mode, emerald in dark).
• One chip per harness and per Connection type in use, with its card count, and none while every card shares one. A group with more than three options folds into one dropdown ("Harness", "Connection type"): each option with its icon, count and a checkbox, then Reset filter. The trigger names the first choice, with "+N" for more. It keeps the width of its longest label, so choosing never moves it or the open panel.
• A harness keeps its Agents and the Connections they use or ask for. A Connection type keeps its Connections and the Agents linked to them. Choices in one group add up, and the groups narrow each other.
• The Pending requests chip (the warning Button while on) keeps only the Agents with pending requests and the Connections they use or ask for. It replaces the pending requests alert.
• Column counts read "5/7" while a filter hides cards. On a selected chip, black marks (Codex, Cursor, Devin, OpenCode) and generic icons take the chip's text colour, and brand colours stay.

Connections page

• Connections are a table like the other Agent lists, instead of a two-column grid whose cards stretched to match their neighbours. Each row shows:
  • the service tile, with the service named under the Connection;
  • the integration credential, linked, with its provider. "Credentials needed" in amber when there is none, so a pending Connection needs no extra badge. Other inactive states (Disabled) get a badge beside the name;
  • the endpoint: built-in hosts, the configured host, or a custom host override marked approved or awaiting review. Postgres endpoints stay summarised as "Configured endpoint", as on the old cards;
  • when it was updated.
• Edit and a red Delete show on row hover.
• An override waiting for review gets an amber row under its Connection: the state ("Needs independent review", or "Waiting for another authorized member to approve" for its author), the version, and "Approve reviewed version" on the right.
• The Overview's Connection cards dropped the badge that repeated the service.

Agent page, aligned with the service account and member pages

• The five stat cards are gone; their numbers were already in the tab labels. The header has the harness tile, the name, then the copyable Agent ID with the status and harness badges. "Server-side KMS", "Created … by …", and last seen with active sessions sit on the right.
• Rename the Agent in place, as on service accounts: Save and Discard, Enter and Escape. A draft survives the 15-second refresh. Clicking the harness tile opens the harness picker. The Edit dialog is gone.
• Generate token sits at the end of the tab row, on every tab, and nowhere else on the page. The Logs tab has no count; the log shows its own live state.
• The page opens on a new Overview tab. ?tab= links still open the other tabs.
  • This Agent's pending requests come first, one line each: Workflow and target, kind, deadline and Review. Up to three show, and an amber View all opens the Workflows tab. A heavier rule sets the heading apart from the rows.
  • Workflows, Tokens and Members cards list up to five items each, then "and N more". Each card has an icon, and an emerald View all at the bottom that opens its tab.
  • The Danger Zone is on this tab only, at the bottom, as on the service account and member pages. Disable is a plain card, since Enable undoes it. Only Delete is red, with a trash can on the button and its confirmation. The subtitle reads "These actions take effect immediately and may interrupt active sessions."
• Each Workflow is its own card. Add Connection, Edit and a red Delete sit in its header beside the name, on hover. Grant and request rows share the card's padding, so Delete, Revoke and Review line up on the right.
• Row actions appear on hover or keyboard focus, as on the service account, member and app member pages: a red Revoke on token, active session and grant rows, and Edit and a red Remove on member rows.
• The Sessions tab names the harness, then the full session ID (copyable) with the CLI name and version from the session's client info. It adds when the session started, shows the status with its time ("expires in 47 minutes", or when it expired or was revoked), and lists active sessions first, then the most recently seen. Rows are 50px instead of about 59px, and the Tokens table matches.
• Members is a compact table like the app members page: member, their Workflows, then Edit and Remove on row hover. The creator card is gone: the header shows the creator, and the description notes that creating an Agent does not assign its creator.
• Assign members works like Add members in app access: pick several members from a searchable list, give each their own Workflows from a dropdown, and assign them in one go. The member list opens with the dialog, with the search box focused, whenever someone can be assigned. Assignments are sent one at a time; after a failure, only the members not yet assigned stay in the dialog. The dropdown uses the same Workflow rows as Edit access, and a click anywhere on a row toggles it.
• The Workflows tab also shows the Agent's pending requests, inside the Workflow they belong to and above its grants: target, kind, deadline, a Pending badge and Review. The tab label shows the count ("2 pending"), so it is visible from other tabs. Members who can read requests but not Connections still see the rows.

Regressions from #1025 outside the Agents pages

• CopyButton keeps its width, and its visible label as the accessible name.
• The app home title shows "Secrets" again.
• AWS credential setup opens on Assume Role again, unless an Agent asks for access keys.
• The sidebar shows the Beta stage for AI Agents.

Cleanup

• Removed get_agent_from_token, the unreachable Agent branch in token_is_expired_or_deleted, and unused imports.
• Role pruning covers agent_permissions. The fail-closed RBAC route test matches token auth subclasses and lists the Agent views.
• JsonBlock moved from the SCIM logs into components/common, so both logs share it. No change to the SCIM logs.
• Comments added or changed by this PR are one short line each.

🖼️ Screenshots or Demo

Screenshots of every Agent page were taken from a local stack seeded with seven Agents (one with four Workflows), ten requests, three host overrides and 86 log events, in light and dark, before and after each feedback round.

📝 Release Notes

N/A. Fixes to the unreleased AI Agents feature on feat--agents.

❓ Open Questions

Left out on purpose:

• Access to integration credentials, and binding them to Connections, including Vault vault_role_id sensitivity. Planned with the integration credential access work.
• Members with Agents:update can disable and resume an Agent. Kept as designed.
• Network access policies for Agents. Agent tokens follow org-wide policies only, as before. A creator's own policies do not apply, because Agents run on other machines. A test now pins this.
• Request lifecycle events in the Agent log. Only the Agent's proxy (and credential resolution errors on the server) write to it; a request being raised, approved, denied or expired is recorded in the audit log instead. Writing those to the Agent log, with the request ID in the detail, would make it a full timeline. Left for a follow-up.

Found in review, not fixed here:

• Swapping a Connection's credential keeps an existing custom host approval.
• There is no retention job for AgentEvent rows.
• A member with AgentMemberships:update can change their own Workflow assignments (custom roles only).
• agentEvents uses the org Logs:read permission, not an Agent permission.

🧪 Testing

• Backend: 3376 passed. tests/utils/test_secret.py::test_file_read_permission_error was deselected: it fails when tests run as root, and also fails on feat--agents.
• Frontend: 78 suites, 753 tests pass. tsc is clean. eslint is clean on changed files.
• Each fix has new or updated tests. Each new test was checked to fail without its fix.
• The token dialogs were also checked in Chromium: outside click and Escape keep them open, and copying with the button or the keyboard unlocks them.
• CI does not run for PRs into feat--agents, so tests were run locally.

🎯 Reviewer Focus

• backend/backend/graphene/mutations/syncing.py: credential edits that move Connections.
• backend/api/utils/agent_credentials.py: STS cache and lock scope.
• backend/api/models.py and backend/backend/graphene/agents/mutations.py: delete paths and lock order.
• backend/api/views/agents/base.py: error envelope and session check order.
• backend/backend/graphene/agents/queries.py: the event-time keyset for agentEvents history pages.
• frontend/components/agents/AgentEventLog.tsx: paging, sort order and the live tail. The tail only runs while sorted newest first, and skips late events older than the loaded window, which history pages bring in at their place. Page dividers are keyed to the first event of each loaded page, not to row positions, so live rows do not shift them. The row's action cell stops clicks, so the Allow host confirmation never toggles the row.
• frontend/components/agents/AgentFilterMenu.tsx: the logs filter look on a Popover, so the inputs inside keep their own keyboard handling.
• frontend/components/agents/AgentMeshUtils.ts: meshFocusKeys (hover lights direct neighbours and the requests in scope), pendingMeshModel, chipMeshModel (what each filter chip keeps), and the Workflow and request order.
• frontend/components/agents/AgentMesh.tsx: request lines are measured with the grant lines, and a request on an existing grant replaces its green line. Agent and Connection cards share one pending requests section; Connection cards gather their requests from every Agent. FilterGroup shows chips up to three options (CHIP_LIMIT) and a Popover dropdown beyond; a choice whose chip has gone stops filtering. The dropdown trigger stacks every label it can show invisibly in one grid cell, so its width never changes.
• frontend/app/[team]/agents/[agent]/page.tsx: the header, Workflow cards with their actions in the header (named group/workflow and group/grant scopes), the session rows and their order, the Generate token placement, and the Overview tab, the only one with the Danger Zone.
• frontend/components/agents/AgentOverview.tsx: the Agent's Overview tab. It reads members with the Members tab's query, so that tab opens from the cache.
• frontend/app/[team]/agents/connections/page.tsx: the Connections table. Each Connection is its own <tbody>, so its review row highlights on hover together with it.
• frontend/components/agents/AgentDialogs.tsx: AgentNameField keeps its draft apart from the polled name, and AgentHarnessDialog takes its trigger as a render prop.
• frontend/components/agents/AgentMembers.tsx: the Assign members dialog sends one assignment at a time and keeps only the unassigned rows after a failure. Its member search and Workflow dropdowns are Popovers, so the search input keeps its own keyboard handling. The member list opens on the frame after the dialog sets its own focus.
• frontend/utils/agents/pendingRequests.ts: the once-a-minute check that keeps running in background tabs, and the favicon swap.
• frontend/components/common/Button.tsx: the new shared success and textWarning variants.

➕ Additional Context

• Changes the CLI can see: the error envelope on every runtime failure, 401 before 403 for finished sessions, invalid_client for bad capability lists and for metadata over 8 KiB, and cooldown on repeated asks. The agentEvents change is console-only GraphQL.
• New migrations:
  • 0145_agent_runtime_lookups (depends on 0144): ProviderCredentials.revision DB default, session credential index, and the Workflow name constraint message (no SQL).
  • 0146_agent_event_time_index: an index on Agent events by Agent, event time and ingest sequence, for the history pages.
• GraphQL schema and generated types were regenerated. The only schema change is the agentEvents arguments. Console queries also fetch fields the schema already had: Workflow names and createdAt, request expiresAt on the Overview, and on the Agent page the Agent's createdAt, its pending requests, and each session's createdAt and clientInfo. The requests are behind @include(if: $includeRequests), since agentRequests fails the whole query without AgentRequests:read.
• public/assets/images/favicon-attention.svg is the favicon with an amber dot, shown while requests are pending. favicon-notification.svg, the same favicon with a Phase emerald dot (#10B981), sits beside it, unused, for other notifications. Both are under /assets, so they load without the session check, like /favicon.svg.
• ConfirmAgentAction and MintAgentTokenDialog no longer take triggerContent. To change a confirmation's icon, pass triggerProps={{ icon }}. The trigger and the confirm button both use it.
• EditAgentDialog is replaced by AgentNameField and AgentHarnessDialog, and AgentMembers no longer takes createdBy. The Overview's request deadline label moved to AgentUI as AgentRequestDeadline, and the request mapping and order are shared as meshRequestChip and byRequestDeadline. The Review link and the request kind icon are shared as AgentRequestReviewLink and AgentRequestKindIcon. AgentConnectionCredentialCard and AgentCardGridSkeleton went with the Connection cards.
• AgentBrandIcons names the colour classes of marks without a brand colour (MONOCHROME_MARK, GENERIC_MARK), so a selected filter chip can tell them apart.
• Merged feat--agents after #1102 landed. The one conflict was the token updates in Agent.delete and AgentWorkflow.delete (backend/api/models.py). They now update only live tokens and also clear wrapped_key_share. Every other retire path already clears the share.
• Commits are unsigned. The available signing key needs a passphrase.

✨ How to Test the Changes Locally

cd backend && pytest tests/api/agents tests/api/test_agent_auth.py tests/api/test_agent_sessions.py tests/api/test_agent_principals.py tests/tasks/test_organisation_deletion.py

cd frontend && yarn test

Manual check: change the host of a Postgres integration bound to an Agent Connection, and check the warning and the session restart. On an Agent, have the CLI hit a blocked host, then allow it from the activity log. Create an Agent and check that the dialog only closes from its close button until the token is copied. Paste the copied auth command into a terminal and check the CLI goes straight to the token prompt. In the activity log, sort by Time both ways and try a time range, load more to see the "Page 2" divider, and expand a row to see its Connection. Hover any time to see the full timestamp. On the Overview, hover an Agent, a Workflow, a Connection and a pending request, and check the lines that light up, then click the Pending requests chip to show only the Agents waiting on a decision, and pick harnesses from the Harness dropdown. A Connection that a pending request asks for lists that request with a Review link. Open an Agent: it opens on its Overview tab, with its pending requests, the Workflows, Tokens and Members cards, and the Danger Zone. Each View all opens its tab, which has no Danger Zone. On an Agent with a pending request, the request also sits in its Workflow, and the Workflows tab shows the count. Rename the Agent in place, change its harness from the tile, and hover a Workflow card, a grant, a token, a session and a member to see their actions. Open Assign members, type to search the open member list, and assign two members with different Workflows in one go. On Connections, hover a row for Edit and Delete, and approve an override from the row under it. Leave a request pending and switch to another browser tab: the console tab's title starts with the count, and its favicon shows an amber dot.

💚 Did You...

• Ensure linting passes (code style checks)? eslint and prettier on changed frontend lines, black on changed backend files that were already formatted. Files that were not already formatted have only my lines formatted.
• Update dependencies and lockfiles (if required): N/A
• Update migrations (if required)
• Regenerate graphql schema and types (if required)
• Verify the app builds locally? Not run. tsc passes, and the dev server ran every Agent page.
• Manually test the changes on different browsers/devices? Chromium only: every Agent page on a seeded local stack, light and dark.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UEDKwREdnbaZuFJzpo8gBz