Repository navigation
Conversation
Share Agent leaves the Agent overview for an Access tab, last in every version's strip (UX spec 3.8, plan D1). The panel shows the same text, grants and controls; it is now two cards (Share Agent, Direct Agent grants) with the recipients notice as an info status block. - The tab is left out when the session probe showed no Installation administration, as the panel was; a refused policy read hides it and opens Configuration. - tab=access is a valid sign-in destination; old links without it open the overview as before. - The panel is built once per page with the page's context, so a share in flight finishes across tab switches. - The listed-bindings sentence in the page disclosure shows only on the Access tab (finding 2091). - Sharing tests open tab=access; the stat row test checks the bindings sentence per tab; a new test pins the tab, the strip order and that the overview reads no sharing policy.
The keyboard tablist test walks to Access at End and on wrap; the Storybook keyboard walk names Access as the last tab.
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
…denial Review follow-ups for the Access tab: - Card titles use the large text size and semibold weight; the two cards are 24 px apart, as the overview's cards are. - Refresh sharing is a small secondary button, aligned with the card text. - A refused policy read while the Access tab has focus moves focus to Configuration's tab instead of the page. - Tests: the disclosure test opens tab=access with refused reads and checks each read is asked once; the hidden tab is skipped by the arrow keys; a share in flight finishes across a tab switch with each grant written once. - Two stale comments no longer place Share Agent on the overview.
|
ClawSweeper status: review started. I am starting a fresh review of this pull request: feat(console): move Share Agent into an Access tab This is item 1/1 in the current shard. Shard 0/1. This temporary status tracks the active review worker. The completed review will appear in the durable ClawSweeper review comment. Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted. |
clawsweeper
Bot
added
the
clawsweeper:intake:feature
#2518 rewrites the same stale line; editing it here would add a conflict hunk to that PR. The step's tab name is updated there or in a follow-up.
|
@clawsweeper re-review |
|
🦞👀 Re-review progress:
|
clawsweeper
Bot
added
P3
|
Codex review: needs maintainer review before merge. What this changesThis PR moves Agent sharing from the overview into an administrator-only Access tab. Example: An Installation administrator opens the Research assistant Agent.
Review scores
ProductKind: Feature · Worth it: Yes · Fix scope: Complete Merge readiness✅ Ready for maintainer review Keep this PR open: it delivers a focused, maintainer-directed console improvement, and review found no concrete introduced bug. Priority: P3 Before mergeNone. FindingsNone. Tests
Agent review detailsHow this fits togetherThe console renders Agent details and sends sharing requests to the existing Namespace IAM API; this change moves the presentation while preserving grants, removal, and server authorization. flowchart TB
A[Agent detail] --> B[Overview]
A --> C[Access tab]
C --> D[Existing sharing panel]
D --> E[Namespace IAM API]
E --> F[Roles and bindings]
Technical reviewBest possible solution: Land the focused Access-tab move with the existing sharing and authorization owners preserved. Do we have a high-confidence way to reproduce the issue? This is a navigation improvement; base source and inspected screenshots confirm that sharing currently occupies the overview. Is this the best way to solve the issue? Reusing the existing panel inside the existing tab lifecycle is a focused solution, with meaningful coverage for delayed reads and writes. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning medium; reviewed against 49c949700d64. Provenance checked
TestingProof path: in-process harness. SecurityNone. EvidenceWhat I checked:
Likely related people:
LabelsLabel changes: No label changes. Label justifications:
Rating scale6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior. WorkflowClawSweeper edits this one comment on every review. Comment HistoryReview history (1 earlier review cycle)
Reviewed October 20, 2026, 1:21 AM ET / 05:21 UTC (Revision 2). |
|
@clawsweeper re-review |
|
🦞👀 Re-review progress:
|
clawsweeper
Bot
added
clawsweeper:intake:feature
With Share Agent on its own tab (#2999) and the details folded, the error shows once, on the card, and the version detail can start in the lower half of the first screen at 1440. The recovery link tests now require only that it starts outside the upper half, which their in-view check needs.
Problem
Share Agent sat on the Agent overview, between the facts and the version tabs, on every visit. It took 136 words above the tabs and pushed Deploy down. Sharing is an occasional administration task, not the page's main job (UX plan D1, spec 3.8). The page disclosure's "Listed bindings…" sentence also showed on every tab, although it describes only the sharing list (finding 2091).
Change
Share Agent moves, unchanged in content and authorization, to a new Access tab (UX spec row P6).
navigation.mjs:accessis a validtab=, so a link to it survives sign-in.agents/detail.mjs:agents/access.mjs: same text, fields, grants, buttons and requests. The section is two cards (Share Agent, Direct Agent grants) and the recipients notice is an info status block labelled "What sharing grants" (spec 3.8). The region is still named "Share Agent". Share Agent stays secondary and Remove binding stays danger (finding 1967).console.css: the bindings sentence in the disclosure shows only while the sharing panel shows, which is now only on the Access tab (finding 2091).tab=accessopen the overview as before;tab=accessfor someone without the tab falls back to Configuration.tab=access.Not built from the mockup, to keep this a move: the grants table (Person / Access / Granted columns, ghost Remove). It would change what the list shows (no "Granted" date is read today) and the Remove tone.
Verification
Acceptance (spec row P6, measured with
shots.mjs/ the P5 word script on Storybook, main6c5bbd6ffvs this head):tab=accessrenders Share AgentdeployTop, 1440x900deployTop, 390x844P7 still owns
deployTop< 900 (the next-step card).Media (Storybook, before = main, after = this head; secret gist https://gist.github.com/freeqaz/ef9f7c6a504bfa8f7cea76417d2c9d48). Stories: Pages / Agent detail / Share an Agent (now
tab=access), Agent shared, Direct Agent grant removed, Sharing administration denied, Sharing outcome uncertain, Share Agent required fields.Tests
tab=accesswith its assertions unchanged: grants and removal, truncated response, email/unknown Principal, exact Roles, rejected-write reason, form disabled while loading, Refresh sharing focus, required fields, refusal status blocks, session-expiry refocus, deployment polls keeping Share Agent in place.Share Agent is on the Access tab, not the overview: strip order ends with Access, no Share Agent heading and no/iam/request on the overview, the panel inside the tab panel after a click, and atab=accesslink opening there after sign-in.hides sharing … to non-administratorsopenstab=accesswith refused policy reads: no error, the tab is hidden and Configuration opens.tab=accesslink opens Configuration.A share in flight finishes across a tab switch: the namespace binding POST is held, the reader opens Plugins, the write is released, and back on Access the share has finished with each grant written once.tab=accesswith refused reads: the bindings sentence stays hidden, the page ends on Configuration, and each policy read is asked once.6c5bbd6ff: 0/5, then 0/3 for the review additions).tests/browser/console*.test.mjsfiles: 789/789 on02677e096, 790/790 after merging main (fae0cfd84, with feat(console): Settings with Sign out and session facts #2996, fix(console): say email in the failed sign-in message #2997, test(console): resolve the drawer focus target again when a render detaches it #3000), and 798/798 after merging main again (4bbfae04f, with fix(console): let members with agent:create use the create form #2998, fix(console): offer Create Namespace again after Refresh #3002, fix(console): keep the new version notice in view on Edit current #3004).--text-lgsemibold, 24 px between the cards, Refresh sharing as a small secondary button). Not applied: making Share Agent full-width and re-classing its button (pre-existing, left for P12).Risks
Low; console only, no IAM or server change. The Access tab issues the same two policy reads and writes as before, only when opened, so admins who never open it cause no sharing reads. The panel is kept per page, so returning to the tab shows the last read (as the overview panel did); Refresh sharing reads again.
Open-PR conflict map (
git merge-treeof this head and of origin/main against every open PR touching these files): #2998, #2982, #2980, #2979, #2971, #2833, #2524, #2518, #2505, #2502, #2445, #2258, #2255, #2253, #1619 and #1605 have the same conflict set as against main (#2996 and #2997 have since landed and are merged in). Two gain a hunk that a move cannot avoid: #2596 (one hunk: it keeps the overviewrenderAgentAccessline this PR removes) and #906 (it edits the sharing panel itself; new hunks inaccess.mjs,detail.mjs, the sharing flow doc and one sharing test). An edit to the Storybook keyboard walk's stale last-tab line would have conflicted with #2518, which rewrites that line, so this PR leaves the file alone.