Repository navigation
feat(web): select roles when creating a workbench/agent (CL-9780) - #1093
Merged
Merged
Conversation
Both create surfaces offer the tenant's live platform roles as checkboxes. Selections travel as role names into NewAgentInput and CreateWorkbenchInput, resolve to per-tenant ids against live roles (fail fast on unknown names), and assign to the agent's workflow principal via stock role routes once the install lands. Reads gate the submit so a failed roles fetch never silent-fallbacks; a fresh agent with no first run yet fails closed with its deploy in place.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Role selection is part of the create basics UI: both create surfaces offer the tenant's live platform roles as checkboxes (agent panel: the workbench's roles; new-workbench picker: the workspace's system roles, the portable set for a fresh tenant), so a new agent starts with the right grants.
Known limitation (accepted for now): the platform mints an agent's workflow principal at its first run, not at deploy — a deployment's run principal is reserved on first delivery (see commitRunGrants), so there is nothing to assign roles to on a brand-new agent. Selecting roles on a fresh create therefore fails closed after the deploy lands (workbench/agent in place, honest error with the remedy: let the agent run once, then resubmit/retry or assign in Settings). Redeploys of agents that have already run assign cleanly. If we want roles to land on first run with no retry, that needs a platform mechanism (e.g. definition-level role requirements) — follow-up.
Verification: web typecheck clean, repo typecheck/lint/fmt:check green (lint: 0 errors; 3 pre-existing warnings in apps/sidecar), @workbench/web tests 98 pass / 0 fail, vite build clean. Full-repo test run has 7 failing packages in unrelated areas (hub/worker/workflows/deferred-tools/url-path/approvals/e2e) with environmental signatures (shared-DB sidecar leases, missing tmp module); none depends on apps/web.