Merge branch 'feat/dashboard-agent-flows-watch' into feat/agent-storybook-gallery

Author: kathiekiwi

apps/webapp/app/components/dashboard-agent/DashboardAgentPanel.tsx

@@ -383,7 +383,7 @@ export function DashboardAgentPanel({
     });
   }, []);
 
-  const dismissWatchCard = useCallback(() => dispatchWatchCard({ type: "dismissed" }), []);
+  const dismissWatchCard = () => dispatchWatchCard({ type: "dismissed" });
 
   const submitWatch = useCallback(async () => {
     const draft = watchCard.draft;

apps/webapp/app/components/dashboard-agent/suggested-prompts/page-mappers.test.ts

@@ -212,6 +212,12 @@ describe("queueAgentPageContext", () => {
     expect(agentPageContextSchema.safeParse(context).success).toBe(true);
   });
 
+  // A watch the agent proposes off this context is validated against the stored name.
+  it("names a task queue by its stored name, prefix and all", () => {
+    const context = queueAgentPageContext(queueLoaderData({ type: "task", name: "send-receipt" }));
+    expect(context?.page).toMatchObject({ kind: "queue", name: "task/send-receipt" });
+  });
+
   it("emits no saturation signal when the queue is idle under its limit", () => {
     const context = queueAgentPageContext(queueLoaderData({ running: 10, queued: 0 }));
     expect(context?.signals).toEqual([]);

apps/webapp/app/components/dashboard-agent/suggested-prompts/page-mappers.ts

@@ -4,6 +4,7 @@
  */
 import type { AgentPageContext, AgentPageSignal } from "@internal/dashboard-agent-contracts";
 import { z } from "zod";
+import { storedQueueName } from "~/components/queues/queue-name";
 import { isQueueAtCapacity, OLDEST_WAIT_WARNING_MS } from "~/components/queues/queue-thresholds";
 
 export const FRESH_FAILURE_WINDOW_MS = 30 * 60_000;
@@ -163,6 +164,7 @@ export const QUEUE_OLDEST_WAIT_WARNING_MS = OLDEST_WAIT_WARNING_MS;
 const queueLoaderDataSchema = z.object({
   queue: z.object({
     name: z.string(),
+    type: z.string(),
     paused: z.boolean().nullish(),
     running: z.number(),
     queued: z.number(),
@@ -200,7 +202,7 @@ export function queueAgentPageContext(data: unknown): AgentPageContext | undefin
   const parsed = queueLoaderDataSchema.safeParse(data);
   if (!parsed.success) return undefined;
 
-  const { name, paused, running, queued, concurrencyLimit } = parsed.data.queue;
+  const { name, type, paused, running, queued, concurrencyLimit } = parsed.data.queue;
   const { environmentConcurrencyLimit, oldestQueuedAt, loadedAt, ckBreakdown } = parsed.data;
   const limit = concurrencyLimit ?? environmentConcurrencyLimit ?? null;
   const atCapacity = isQueueAtCapacity({ running, queued, limit });
@@ -217,7 +219,11 @@ export function queueAgentPageContext(data: unknown): AgentPageContext | undefin
     signals.push({ kind: "concurrency_saturation", severity: queued >= limit! ? "crit" : "warn" });
   }
 
-  return { page: { kind: "queue", name, health, paused: Boolean(paused) }, signals };
+  // The stored name, not the display one: a watch the agent proposes has to validate against it.
+  return {
+    page: { kind: "queue", name: storedQueueName({ type, name }), health, paused: Boolean(paused) },
+    signals,
+  };
 }
 
 export function deploymentsAgentPageContext(): AgentPageContext {

apps/webapp/app/routes/api.v1.orgs.ts

@@ -40,20 +40,33 @@ export const loader = createLoaderPATApiRoute(
   }
 );
 
-// No org exists yet, so there is nothing to scope the gate to; any authenticated user can create
-// an org and becomes its ADMIN. The gate is still declared so a narrowly-capped delegated token
-// (which cannot `manage`) is refused rather than inheriting its user's full reach.
+// No org exists yet, so there is nothing to scope a route-level gate to; any authenticated user
+// can create an org and becomes its ADMIN. A narrowly-capped delegated token (which cannot
+// `manage`) is still refused rather than inheriting its user's full reach — but only for
+// user-actor tokens, so an ordinary PAT is unaffected.
 export const action = createActionPATApiRoute(
   {
     method: "POST",
     body: CreateOrgRequestBody,
-    authorization: { action: "manage", resource: () => ({ type: "organization" }) },
   },
-  async ({ body, authentication }) => {
+  async ({ body, authentication, ability }) => {
     if (env.ORG_CREATION_API_ENABLED !== "1") {
       return json({ error: "Not found" }, { status: 404 });
     }
 
+    // After the env gate: an install with the API disabled should 404, not 403.
+    if (authentication.userActor && !ability.can("manage", { type: "organization" })) {
+      return json(
+        {
+          error: "Unauthorized",
+          code: "unauthorized",
+          param: "access_token",
+          type: "authorization",
+        },
+        { status: 403 }
+      );
+    }
+
     // Mirror the dashboard: stash companyUrl/companySize as onboarding data and
     // derive the org avatar from the company domain's favicon.
     const onboardingData: Record<string, string> = {};

apps/webapp/app/services/dashboardAgentWatches.server.ts

@@ -37,6 +37,7 @@ import {
   watchIdentity,
   watchOneShotBlockBody,
   watchRequestSentence,
+  watchResolvedBlockBody,
   watchSubjectLabel,
   type WatchDraft,
   type WatchExternalNotification,
@@ -609,8 +610,27 @@ export async function submitDashboardAgentWatch(params: {
     unavailable: boolean;
     external: WatchExternalNotification;
     confirmed?: WatchDraft;
+    /** The row this settles against, when the caller already read it. */
+    watch?: Watch | null;
   }) => {
     const confirmed = args.confirmed ?? draft;
+    // A retry can settle against a watch that already ran: say what it found, not "watching".
+    const resolution = args.watch?.status !== "active" ? args.watch?.resolution : null;
+    if (args.watch && resolution) {
+      return confirmationMessage({
+        id: `${WATCH_CONFIRMATION_MESSAGE_ID_PREFIX}${args.watchId}`,
+        blockId: args.watchId,
+        body: watchResolvedBlockBody({
+          watchId: args.watchId,
+          resolved: {
+            kind: confirmed.spec.kind,
+            identity: args.watch.identity,
+            resolution,
+            observed: args.watch.observedOutcome,
+          },
+        }),
+      });
+    }
     return confirmationMessage({
       id: `${WATCH_CONFIRMATION_MESSAGE_ID_PREFIX}${args.watchId}`,
       blockId: args.watchId,
@@ -796,6 +816,8 @@ export async function submitDashboardAgentWatch(params: {
     unavailable: boolean;
     /** The watch was already there: this call adopted it rather than creating it. */
     adopted: boolean;
+    /** The adopted row. Absent when this call created the watch, so it is active. */
+    watch?: Watch | null;
   }): Promise<SubmitWatchCardResult> => {
     // Attached after the watch exists, and a failure here never fails the creation — it is
     // said out loud in the confirmation instead, and recorded so a replay repeats it.
@@ -830,6 +852,7 @@ export async function submitDashboardAgentWatch(params: {
     return settle({
       confirmation: watchingConfirmation({
         watchId: args.watchId,
+        watch: args.watch,
         unavailable: args.unavailable,
         external,
       }),
@@ -851,7 +874,12 @@ export async function submitDashboardAgentWatch(params: {
       });
     }
     // `unavailable` isn't recoverable here: it belonged to the attempt that died.
-    return settleCreated({ watchId: reserved.id, unavailable: false, adopted: true });
+    return settleCreated({
+      watchId: reserved.id,
+      unavailable: false,
+      adopted: true,
+      watch: reserved,
+    });
   }
 
   const result = await create({

apps/webapp/test/contextlessPatRoutes.test.ts

@@ -13,6 +13,10 @@ const mocks = vi.hoisted(() => ({
   authenticatePat: vi.fn(),
   createOrganization: vi.fn(),
   findManyProjects: vi.fn(),
+  env: { SESSION_SECRET: "test-session-secret", ORG_CREATION_API_ENABLED: "1" } as {
+    SESSION_SECRET: string;
+    ORG_CREATION_API_ENABLED?: string;
+  },
 }));
 
 vi.mock("~/services/rbac.server", () => ({
@@ -25,9 +29,7 @@ vi.mock("~/db.server", () => ({
   prisma: { project: { findMany: mocks.findManyProjects } },
   $replica: {},
 }));
-vi.mock("~/env.server", () => ({
-  env: { SESSION_SECRET: "test-session-secret", ORG_CREATION_API_ENABLED: "1" },
-}));
+vi.mock("~/env.server", () => ({ env: mocks.env }));
 vi.mock("~/models/organization.server", () => ({ createOrganization: mocks.createOrganization }));
 vi.mock("~/services/personalAccessToken.server", () => ({
   updateLastAccessedAtIfStale: vi.fn(),
@@ -77,6 +79,30 @@ async function createOrg(cap: string[]): Promise<{ status: number; body: any }>
   return { status: response.status, body: await response.json() };
 }
 
+// An ordinary PAT, paired with an ability that denies everything. Nothing on this route may
+// consult it — the route has no org to scope a gate to, and on cloud the plugin returns a
+// deny-shaped ability when there is no org context.
+async function createOrgWithPat(): Promise<{ status: number; body: any }> {
+  mocks.authenticatePat.mockImplementation(async () => ({
+    ok: true,
+    userId: USER_ID,
+    tokenId: "pat_1",
+    lastAccessedAt: new Date(),
+    ability: { can: () => false, canSuper: () => false },
+  }));
+
+  const response = await action({
+    request: new Request("https://api.trigger.dev/api/v1/orgs", {
+      method: "POST",
+      headers: { Authorization: "Bearer tr_pat_1234", "Content-Type": "application/json" },
+      body: JSON.stringify({ title: "New Org" }),
+    }),
+    params: {},
+    context: {},
+  } as any);
+  return { status: response.status, body: await response.json() };
+}
+
 const AGENT_ENVIRONMENT_ID = "env_dev";
 
 async function listProjects(): Promise<{ status: number; body: any }> {
@@ -146,6 +172,29 @@ describe("creating an organization over the API", () => {
     expect(mocks.createOrganization).not.toHaveBeenCalled();
   });
 
+  it("admits an ordinary PAT without consulting its ability", async () => {
+    const result = await createOrgWithPat();
+
+    expect(result.status).toBe(201);
+    expect(result.body.slug).toBe("new-org");
+  });
+
+  // The env gate runs before the capability gate, so an install with the API disabled tells
+  // every caller the same thing: the route does not exist. A capped token must not learn from a
+  // 403 that it would have been the only thing standing in its way.
+  it("hides the route from a capped token when the API is disabled", async () => {
+    mocks.env.ORG_CREATION_API_ENABLED = undefined;
+
+    try {
+      const result = await createOrg(["read:all"]);
+
+      expect(result.status).toBe(404);
+      expect(mocks.createOrganization).not.toHaveBeenCalled();
+    } finally {
+      mocks.env.ORG_CREATION_API_ENABLED = "1";
+    }
+  });
+
   it("still admits a token that carries the universal grant", async () => {
     const result = await createOrg(["admin"]);
 

apps/webapp/test/dashboardAgentInvestigationSweepCard.test.ts

@@ -18,8 +18,7 @@ import { liveInvestigation } from "~/components/dashboard-agent/progress-line";
 // connection is only stubbed so importing the service doesn't open a pool.
 vi.mock("~/services/dashboardAgentDb.server", () => ({ dashboardAgentDb: undefined }));
 
-const { sweepDashboardAgentInvestigations } =
-  await import("~/services/dashboardAgentInvestigationSweep.server");
+import { sweepDashboardAgentInvestigations } from "~/services/dashboardAgentInvestigationSweep.server";
 
 /**
  * The transcript half of the sweep, without a container: settling the row is invisible

apps/webapp/test/dashboardAgentWatches.test.ts

@@ -2300,6 +2300,49 @@ describe("the watch card submit", () => {
     }
   );
 
+  postgresTest(
+    "converging on a watch that already fired confirms the outcome, not 'watching'",
+    async ({ prisma, postgresContainer }) => {
+      await boot(prisma, postgresContainer.getConnectionUri());
+      const seeded = await seed(prisma, "submit-converge-fired");
+      await seedChat(seeded);
+
+      let reservedWatchId = "";
+      await expect(
+        submit({
+          seeded,
+          chatId: "chat_1",
+          create: async (createParams) => {
+            reservedWatchId = createParams.watchId!;
+            await createDashboardAgentWatch(createParams);
+            throw new Error("died after the watch was created");
+          },
+        })
+      ).rejects.toThrow("died after the watch was created");
+
+      // The watch ran and woke the chat before anyone retried the submit.
+      await transitionWatchCondition(ctx.agentDb, {
+        id: reservedWatchId,
+        resolution: "condition_met",
+        observedOutcome: { kind: "run_start", verified: true, status: "EXECUTING", started: true },
+      });
+
+      const retry = await submit({ seeded, chatId: "chat_1" });
+
+      expect(retry.ok).toBe(true);
+      if (!retry.ok) return;
+      // Still one row, still the same watch: adoption is not refused.
+      expect(retry.watchId).toBe(reservedWatchId);
+      expect(await countWatchRows(prisma, "chat_1")).toBe(1);
+
+      const parts = retry.messages.at(-1)?.parts ?? [];
+      const block = (parts[0] as any).data.blocks[0];
+      expect(block.outcome).toBe("already_true");
+      expect(block.headline).not.toContain("Watching");
+      expect(block.lifetime).toBeNull();
+    }
+  );
+
   postgresTest(
     "a refusal that wins the race leaves no live watch behind",
     async ({ prisma, postgresContainer }) => {
@@ -2407,6 +2450,37 @@ describe("the watch card submit", () => {
       expect(await storedMessages(seeded, "chat_1")).toEqual(transcript);
     }
   );
+
+  postgresTest(
+    "a replay repeats the recorded 'Watching' confirmation after the watch has fired",
+    async ({ prisma, postgresContainer }) => {
+      await boot(prisma, postgresContainer.getConnectionUri());
+      const seeded = await seed(prisma, "submit-replay-fired");
+      await seedChat(seeded);
+
+      const first = await submit({ seeded, chatId: "chat_1" });
+      expect(first.ok).toBe(true);
+      if (!first.ok || !first.watchId) return;
+
+      await transitionWatchCondition(ctx.agentDb, {
+        id: first.watchId,
+        resolution: "condition_met",
+      });
+
+      const retry = await submit({ seeded, chatId: "chat_1" });
+
+      expect(retry.ok).toBe(true);
+      if (!retry.ok) return;
+      expect(retry.repaired).toBe(true);
+
+      // The recorded outcome is replayed, never decided again: the append-once
+      // confirmation in the transcript says "Watching", so the answer has to as well.
+      const parts = retry.messages.at(-1)?.parts ?? [];
+      const block = (parts[0] as any).data.blocks[0];
+      expect(block.outcome).toBe("watching");
+      expect(block.headline).toContain("Watching");
+    }
+  );
 });
 
 describe("appendChatMessageOnce", () => {

internal-packages/dashboard-agent-contracts/src/watch-wording.ts

@@ -614,6 +614,32 @@ export function watchConfirmationBlockBody(args: {
   };
 }
 
+/**
+ * The confirmation for a watch that had already resolved before this submission settled
+ * (a retry adopting a fired or expired row). It states the outcome the watch reached
+ * rather than claiming something is still being watched.
+ */
+export function watchResolvedBlockBody(args: { watchId: string; resolved: WatchResolvedInput }): {
+  type: "watch_result";
+  outcome: "already_true" | "impossible";
+  headline: string;
+  lifetime: null;
+  detail: null;
+  followUp: never[];
+  watchId: string;
+} {
+  const presented = presentResolvedWatch(args.resolved);
+  return {
+    type: "watch_result",
+    outcome: presented.category === "positive" ? "already_true" : "impossible",
+    headline: presented.headline,
+    lifetime: null,
+    detail: null,
+    followUp: [],
+    watchId: args.watchId,
+  };
+}
+
 /**
  * The one-shot result block: the immediate check answered outright, so no watch was
  * created. Nothing is running, so there is no lifetime and no follow-ups.