Repository navigation
Conversation
A member whose Namespace grants Agent create got a full Create Agent form, then a mid-form note that Installation access was needed and a disabled Create (GET /installation is 403 for members). The form now proceeds when the Namespace permission answer grants create: an info status above the form says why, no option is refused client-side (the preflight and create still decide), and a member learns that an Installation administrator grants the new Agent access to its Secrets. The form names its Preset, and a disabled Create Agent on the list is described by its reason.
…ember story Internal review: a member cannot read the Installation, so the form cannot know whether a draft deploys as is (a Credential Gateway, for one, refuses a raw Secret at deploy). The line under the fields now says only that the Agent is saved as a draft, the copy names Installation administration access rather than a role, and the no-Preset copy claims only the Configuration check. Storybook gains Member with Agent create, and the capability-denied story keeps its refusal by failing the permission read.
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
Visual review: the access status reads as one paragraph with a lighter second sentence, the post-create note no longer repeats it, and a long Preset name wraps inside the card at phone width.
clawsweeper
Bot
added
clawsweeper:intake:bug
|
Codex review: needs maintainer review before merge. What this changesThis PR lets members explicitly granted Agent creation save drafts when Installation capabilities are unreadable. Example: A member in Member team has agents.create permission but receives GET /installation 403.
Review scores
ProductKind: Bug fix · Worth it: Yes · Fix scope: Complete Merge readiness✅ Ready for maintainer review Keep this PR open: it fixes a source-confirmed member creation blocker, and the previous documentation finding is resolved; no actionable code defects remain. Priority: P2 Before mergeNone. FindingsNone. Tests
Agent review detailsHow this fits togetherThe console reads Namespace permissions and Installation capabilities, submits Configuration and Agent requests to OCC, and uses existing IAM routes for credential grants. flowchart TD
Member[Namespace member] --> Console[Create Agent console]
Console --> Permissions[Namespace permissions]
Console --> Capabilities[Installation capabilities]
Console --> OCC[Authorized OCC operations]
OCC --> Draft[Saved Agent draft]
Console --> IAM[Administrator credential grants]
Technical reviewBest possible solution: Retain the explicit-permission draft path, server authorization, and clear administrator handoff. Do we have a high-confidence way to reproduce the issue? Current main requires successful Installation capability discovery before submission, although OCC permits Namespace-authorized members to create Agents; the supplied browser regression exercises that mismatch without faking IAM responses. Is this the best way to solve the issue? The change uses the existing form and server operations, limits the exception to an explicit creation grant, and preserves refusal when permission discovery is unknown. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning medium; reviewed against 7f44e5f4c91e. Provenance checked
TestingProof path: in-process harness. SecurityNone. EvidenceWhat I checked:
Likely related people:
LabelsLabel changes:
Label justifications:
Rating scale6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior. WorkflowClawSweeper edits this one comment on every review. Comment HistoryReview history (1 earlier review cycle)
Reviewed October 20, 2026, 12:32 AM ET / 04:32 UTC (Revision 2). |
…andoff Review: the flow and the creation reference now say a member with Agent create but no Installation read saves drafts only, and that granting the Agent's key access needs Installation administer. Word-neutral edits keep both pages under the cap.
|
@clawsweeper re-review |
|
🦞👀 Re-review progress:
|
clawsweeper
Bot
added
clawsweeper:intake:bug
1 participant
Problem
A Namespace member whose role grants Agent create could not create an Agent in the console (UX plan A2, spec 3.11; findings 1901, 493).
GET /installationis 403 for members, so the Create Agent form opened, then showed a grey mid-form note ("Creating an Agent needs Installation access...") and kept Create Agent disabled for good, with no reason beside the button. The API accepts Agent create from such a member (the preflight answers 204, finding 1873).Change
Client only. No server, IAM, policy or permission change; the API still authorizes every request.
agents/create.mjs: whenGET /installationis 403 and the Namespace permission answer saysagents.create === true, the form proceeds without the Installation's capabilities. It refuses no option client-side (the preflightPOST /agents/validateand Agent create decide before and at save), creates a draft (no provisioning without the capability), and shows an info status above the form: "Your access: You can create Agents in . Installation-wide capabilities are not readable with your access, so the options below come from this Namespace's Presets. An Installation administrator then gives the new Agent access to its Secrets." An unknown permission answer (failed read) keeps today's refusal. A member without Agent create still never sees the form.From Preset · <name>badge when it came from a Preset (flows.md C8);presets.mjspasses the Preset name.agents/list.mjs: a disabled Create Agent isaria-describedbyits reason ("Your access does not include creating Agents in this Namespace."), alongside the Namespace-not-ready note.docs/flows/platform-console.mdanddocs/reference/console/create-and-deploy.mddescribe the member draft path and that granting the Agent's key access needs Installationadminister(word-neutral edits).Follow-up recorded as finding 2090 (owner/design decision, out of scope here): a member can create an Agent but cannot give it access to its model Secret, because the grant routes are Installation administration.
Verification
tests/browser/console-create-agent-member.test.mjs(mapped tochecks-browser), real Native IAM Driver, no route fakes for the personas:GET /installation403; the info status sits right above the form; no Installation refusal; badgeFrom Preset · default-codex; Create Agent enabled; realPOST validate 204,POST configurations 201,POST agents 201; then the Installation-administration note with an Open saved Agent link./console/agents/newshows "Creating Agents is not available", no form, noGET /installation.GET /installation200, no access note, badge shown, Create Agent enabled.origin/mainversions of create.mjs, list.mjs, presets.mjs, console.css: 0/3 pass) and pass with the change.console-agents.test.mjs"denied capability check" case now fails the permission read, so it still pins the refusal for an unknown answer.taskset -c 22,23):console-create-agent-member20/20 andconsole-agents20/20 on 52b8de1 (later commits: docs and a clean main merge).node scripts/ci/run-tests.mjs audit: no issues. prettier and eslint clean on touched files.git merge-treevs main, then vs this head): feat(console): Settings with Sign out and session facts #2996, feat(console): stat row for Agent facts and one disclosure per page #2995, feat: add Gateway managed mode to Agent deployments #2982, fix(console): let the create preflight carry any configuration both creates accept #2833, feat(console): show the authorized native Gateway people roster #2596, feat(console): stop and delete Agents from the Agents list #2524, Add OCE policy simulation and tester for network and plugin actions #2445, fix: preserve native plugin permissions across Harness selection and admission #2258, fix(console): grant Agent access to accepted Configuration Secrets #2255, Support custom Installation profiles and readable Preset starters #2253, feat(auth): sign people in to occ with a device code (rfc-0019) #1619, feat: assign configured OpenClaw roles to Agent users #906, feat: add Agent workload tags #115 gain no new conflicted file and no new conflict hunk.UI media (before on main, after on this head; Storybook frames via shots.mjs)
Unchanged for a member without Agent create (after):
Real-server walkthrough (final sources, member-write persona, real Native IAM Driver; not Storybook)
Risks