Add agent-driven signup with live progress and Relay animation - #112
Conversation
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
|
Preview deployed!
This is a Cloudflare Workers preview version of this PR's build. |
barryollama
left a comment
barryollama
left a comment
There was a problem hiding this comment.
Independent agent review — Teams/UI/routing
Reviewer: signup_contract_review (separate agent; this is its review recorded by the PR author, not the author's own review pass).
Verdict: APPROVE for the assigned scope at ef37519.
Reviewed the Teams instructions against RelayHistory probe Rust output, desktop ProbeCommand/DesktopConnection/AppModel, and Cloud/Relay authentication code, plus the client handoff and anonymous Markdown route. Identified and re-verified fixes for snake_case verification fields, SOURCE:SESSION_ID construction, and existing-workspace deep-link conflicts. No remaining blocking findings in Teams instructions, shared authentication/credential handoff, client UI, or route origins.
Live OAuth and desktop installation were not exercised; this is code/contract review.
barryollama
left a comment
barryollama
left a comment
There was a problem hiding this comment.
Independent agent review — Auth/Flows contracts
Reviewer: signup_auth_review (separate agent; this is its review recorded by the PR author, not the author's own review pass).
Verdict: APPROVE for the assigned scope at ef37519.
Compared device polling, refresh, whoami, integration connect/status, deployment authorization, and listener verification with Cloud current main. Confirmed the direct-source body is accepted by the actual handler. Identified and re-verified fixes for provider-addressable approvers and explicit per-repository GitHub trigger filtering; both published examples and regression assertions now agree. The public Teams/Flows device signup marker preserves existing self-service admission and verified-email/device-approval requirements. No remaining actionable findings.
Live Google/provider OAuth remains unverified; this is code/contract review.
barryollama
left a comment
barryollama
left a comment
There was a problem hiding this comment.
Independent agent review — visible signup card
Reviewer: signup_contract_review (separate agent; verdict relayed by the PR author, not the author’s own review).
Verdict: APPROVE for UI changes at a0f97ca; no actionable findings.
Reviewed current-origin display and copy behavior, relative runbook links, clipboard fallback, native keyboard controls, pressed state, labels, live status, responsive layout, and reduced-motion support.
Separate validation by the author: production build and 307 tests passed (1 skipped); Chrome checks passed for both products at 320–1440px including agent selection, copy, denied-clipboard fallback, and overflow. Desktop/mobile screenshots inspected. Live OAuth not exercised.
barryollama
left a comment
barryollama
left a comment
There was a problem hiding this comment.
Independent agent review — visible signup card
Reviewer: signup_auth_review (separate agent; verdict relayed by the PR author, not the author’s own review).
Verdict: APPROVE for UI changes at a0f97ca; no actionable findings.
Reviewed truthful approval expectations, agent-choice semantics, current-origin copy, fallback selection, accessible controls/status, and mobile wrapping/stacking. Signup and authorization runbooks remain unchanged.
Separate validation by the author: production build and 307 tests passed (1 skipped); Chrome checks passed for both products at 320–1440px including agent selection, copy, denied-clipboard fallback, and overflow. Desktop/mobile screenshots inspected. Live OAuth not exercised.
barryollama
changed the title
barryollama
left a comment
barryollama
left a comment
There was a problem hiding this comment.
Independent agent review by signup_auth_review (recorded by the author; this is not a human or GitHub approval). APPROVE: reviewed session restoration, polling/recovery, capability handoff, and guide/API agreement. Six displayed stages correctly represent five API steps plus completion. No blockers. Live OAuth and visual acceptance were outside this review.
barryollama
left a comment
barryollama
left a comment
There was a problem hiding this comment.
Independent agent review by signup_contract_review (recorded by the author; this is not a human or GitHub approval). APPROVE after fixing the four screenshot paths to use testInfo.outputPath. Reviewed canonical Relay paths, pointer interaction, reduced motion, introductory copy, horizontal six-circle details and protocol consistency. No remaining blockers.
| <main className={s.main}> | ||
| <div className={s.content}> | ||
| <h1>{heading}</h1> | ||
| <p className={s.subtitle}>{complete ? 'Your agent has verified setup. You’re ready to go.' : active ? detail : 'Give this prompt to your coding agent and hang out here to watch it sign you up.'}</p> |
There was a problem hiding this comment.
Expired idle session shows waiting copy
Medium Severity
title and detail already handle expired and failed, but the heading and subtitle only use them when active is truthy. A stale or timed-out session at step 0 still shows the waiting prompt copy, cycling agent icons, and a disabled Copy button, so the page looks ready to start after the session is already dead.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 0094d14. Configure here.
There was a problem hiding this comment.
Fixed in 4c129bb: heading/subtitle/agent-logo row/copy CTA now honor expired+failed before waiting state; copy button hides entirely when expired so the restart CTA is unambiguous.
| <div className={s.progressDots} aria-hidden="true">{steps.map((step, index) => <i key={step.title} data-done={complete || active > index + 1} data-current={!complete && active === index + 1} />)}</div> | ||
| <span>{expired ? 'Session expired' : error ? 'Waiting for a connection' : complete ? 'Setup complete' : active ? `${active} of 5 · ${paused ? 'Waiting for your approval' : failed ? 'Needs your attention' : steps[active - 1].title}` : progress ? 'Ready when your agent is' : 'Preparing your session…'}</span> | ||
| </div> | ||
| {error && <div className={s.error} role="alert"><p>{error}</p>{!progress && <button type="button" onClick={() => { boot.current = null; setError(''); setAttempt(value => value + 1); }}>Try again <RefreshCw size={12} /></button>}</div>} |
There was a problem hiding this comment.
Retry cannot recover expired sessions
Medium Severity
Try again after a missing-session 404 only clears the error and boot ref. It leaves expired set and keeps the session query param, so startSession GETs the same dead id again instead of creating a new session. The control that can recover is a separate restart action, so the error CTA is a dead end.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit 0094d14. Configure here.
barryollama
left a comment
barryollama
left a comment
There was a problem hiding this comment.
Independent agent review by signup_auth_review, recorded by the author (not a human/GitHub approval): APPROVE. Reviewed the API-only interaction policy, exact endpoints, account/progress token separation, and Teams handoff verification. The guide now distinguishes collector status from desktop attachment and requires user confirmation without agent screen inspection. No remaining actionable findings. Eleven focused tests pass; both live local guides serve the new policy.
barryollama
left a comment
barryollama
left a comment
There was a problem hiding this comment.
Independent agent review by signup_contract_review, recorded by the author (not a human/GitHub approval): APPROVE. Reviewed API-only prompts, HTTP guide fetching, documented terminal/CLI operations, user-owned approval pages, endpoint environment preservation and token separation. No blockers. The subsequent Teams handoff clarification was reviewed by signup_auth_review.
barryollama
left a comment
barryollama
left a comment
There was a problem hiding this comment.
Independent agent review by signup_auth_review, recorded by author (not a human/GitHub approval): APPROVE. Reviewed the shorter handoff prompt and fetched API runbook. No-computer-use restrictions and progress credentials remain explicit; desktop instructions consistently require prebuilt downloads and stop if unavailable, never building or switching environments. No blocking findings. Eleven focused tests, TypeScript, diff checks and the live local guide check pass.
barryollama
left a comment
barryollama
left a comment
There was a problem hiding this comment.
Independent agent review by signup_contract_review, recorded by author (not a human/GitHub approval): APPROVE. Reviewed the shorter handoff prompt and fetched API runbook. No-computer-use restrictions and progress credentials remain explicit; desktop instructions consistently require prebuilt downloads and stop if unavailable, never building or switching environments. No blocking findings. Eleven focused tests, TypeScript, diff checks and the live local guide check pass.
barryollama
left a comment
barryollama
left a comment
There was a problem hiding this comment.
Independent agent review recorded for the current analytics update (reviewer: signup_auth_review; relayed by the coordinating agent).
Verdict: approved, no remaining blockers. Reviewed browser/server correlation, persisted-transition emission, agent attribution, analytics failure isolation, consent-at-creation behavior, and privacy. Verified SPA exits record once, restart does not create a false exit on the replacement journey, and replay drops progress request/response data before serialization. Documentation accurately states best-effort delivery and outstanding production validation. This is an independent agent signoff, not human approval or a production rollout authorization.
barryollama
left a comment
barryollama
left a comment
There was a problem hiding this comment.
Independent agent review recorded for the current analytics update (reviewer: signup_contract_review; relayed by the coordinating agent).
Verdict: approved, no remaining blockers. The findings about serialized replay payloads and missing SPA exits were addressed. Progress network captures are dropped entirely; pagehide and SPA exits deduplicate across StrictMode and restart. Reviewed correlation, read-only watchers, self-reported agent attribution, and documented consent/delivery limitations. Diff whitespace validation passed. This is an independent agent signoff, not human approval or a production rollout authorization.
| let owner = !requested; | ||
| try { owner ||= JSON.parse(sessionStorage.getItem(storageKey(product)) || 'null')?.id === requested; } catch { /* Read-only until proven otherwise. */ } | ||
| if (owner && !viewed.current) { analytics.track('page_viewed'); viewed.current = true; } | ||
| boot.current ||= startSession(product, owner ? analytics.context() : undefined); |
There was a problem hiding this comment.
Signup analytics can miss session join
Medium Severity
page_viewed and the session POST analytics payload are recorded once on first effect. SignupTracker.context() returns nothing until ph.__loaded is true, but viewed.current is still set and boot.current keeps the first startSession result. Later prompt_copied and similar events then mint a journey_id Cloud never stored, so browser and server funnel steps do not join.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit 73521a0. Configure here.
There was a problem hiding this comment.
Fixed in 4c129bb: page_viewed and the session POST now go through SignupTracker.contextWhenReady() (<=2s bound, never blocks setup), so Cloud stores the same journey_id the browser emits. Two regression tests added.
Cursor review on #112 surfaced three live defects in the signup journey plus one stale finding: - Expired sessions at step 0 still rendered waiting copy, agent icons, and a disabled copy CTA alongside the restart path. - "Try again" after a missing-session 404 kept the dead ?session= param and expired state, re-requesting the same expired id. - page_viewed and the session POST fired before PostHog finished loading, so Cloud stored no journey_id and later browser events could not join the funnel. contextWhenReady waits briefly (<=2s) for the SDK without ever blocking setup. - The credential-copy finding was stale post Cloud #3944 (house promotion admits activation without a connected subscription); added the one real caveat: multi-agent flows can only house-fund a single declared harness per run. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
|
Review audit complete at
Tests: |
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 4c129bb. Configure here.
Cursor re-review of 4c129bb (bug 37ba8ad7): Try again cleared the stored session and ?session= unconditionally, so a transient load failure discarded a still-valid session and silently forked a new one — watchers could become owners of a different progress token. Scope the session reset to the expired path only; other errors now retry the same session id. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
miyaontherelay
left a comment
miyaontherelay
left a comment
There was a problem hiding this comment.
GO — review at exact head e8d60fb.
Verified the current diff and prior finding dispositions across the signup journey, route-origin handling, API-only agent instructions, progress-token/session separation, watcher vs owner behavior, analytics privacy, and Flows deployment guidance. The documented house-promotion semantics are consistent with Cloud current behavior: promotional house credentials cover the initial three runs, connected provider subscriptions take precedence when present, and the guide does not expose or request house keys. Progress/session tokens remain distinct from Cloud access credentials and are excluded from analytics/network capture.
Exact-head checks are terminal: Tests and typecheck SUCCESS, Deploy Preview SUCCESS, Cursor Bugbot SUCCESS; no failing or pending required checks. PR is MERGEABLE/CLEAN and non-draft. No remaining actionable blocker found for #112.
This review is for #112 only; stacked #116 must be reviewed against this exact #112 base and its own head.
5 participants
Teams and Flows visitors can choose “Let your agent do it,” copy a session-specific prompt, and watch their agent perform signup. The agent uses the documented APIs and CLI while the user approves sign-ins. The runbooks prohibit computer use and require the prebuilt desktop download rather than a source build.
The dedicated page uses an interactive Relay-shaped animation that grows with progress and settles into the logo at completion, with reduced-motion support. Session restoration, read-only watchers, clipboard fallback, expiry, and retry handling are included.
PostHog now joins browser handoff events to server milestones using an anonymous journey ID. Teams and Flows have separate step names; the agent reports its tool identity in its first progress update. Track entry, copy, each step, waits, failures, completion, and exits without treating a closed page as abandonment. Capability URLs, prompts, and progress request/response bodies are excluded from analytics/replay. Funnel setup instructions are in
web/analytics/agent-signup-funnel.md.Dependency: https://github.com/AgentWorkforce/cloud/pull/3910 provides the progress API, migration, and server analytics and must ship first. Device-signup auth from Cloud #3899 is already merged.
Validation: 318 unit tests passed (1 skipped), Web TypeScript passed, 3 signup browser tests passed, and 2 temporary real-PostHog-SDK browser checks passed for correlation, privacy hooks, SPA exits, and restarts. The temporary test page was removed. Local real-handler acceptance checks cover Teams and Flows with migrated PGlite. Marketing and Cloud production ingest configuration points to the same project. Live PostHog ingestion, real Google/provider OAuth, and desktop installation have not been exercised; no dashboard or production configuration was changed.
Note
Medium Risk
New signup UX depends on the separate Cloud progress API; browser session storage holds write tokens, mitigated by analytics redaction but still security-sensitive handoff surface.
Overview
Adds agent-led signup for Teams and Flows: landing CTAs open
/signup/{product}where owners get a session-specific prompt, live progress from Cloud’s agent signup API, and spectator/watch-only session links. Agents fetch markdown runbooks at/signup/agent/{product}(API/CLI only—no browser automation).PostHog joins browser handoff to server milestones via a per-attempt
journey_id, with signup-page replay/autocapture blocking and redaction of tokens, prompts, and progress API traffic. Funnel build notes live inweb/analytics/agent-signup-funnel.md.Also ships the signup Relay canvas animation (shared logo paths), updates Flows recommended-flow docs for the direct-source
flows/deployactivation contract, and adds unit + Playwright coverage.Reviewed by Cursor Bugbot for commit e8d60fb. Bugbot is set up for automated code reviews on this repo. Configure here.