[AGE-4067] feat(agents): Inject custom secrets into agent runs - #6583
[AGE-4067] feat(agents): Inject custom secrets into agent runs#6583mmabrouk wants to merge 8 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
📘 Docs preview
This comment updates in place on every push. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Organization UI (inherited) Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (3)
Included review availability: Your plan provides up to 8 included reviews per hour; 5 remain after this review. 📝 SummarySummary by CodeRabbit
WalkthroughThe change adds project-scoped custom-secret bindings across the API, SDK, runner, entities, UI, and chat flows. It adds ChangesCustom secrets and platform delivery
Estimated code review effort: 5 (Critical) | ~120 minutes Merge Risk: 🟡 Moderate · up to Custom-secret attachment and request-secret flows add runtime credential delivery and revision-resume behavior, but unresolved validation, interaction, and release-coverage issues could cause failed secret runs or degraded setup flows. These risks should be addressed before merge. Sequence Diagram(s)sequenceDiagram
participant Agent
participant ChatHost
participant SecretRequestDock
participant CommitAgentCredentials
participant WorkflowAPI
Agent->>ChatHost: Emit request_secret interaction
ChatHost->>SecretRequestDock: Render pending request
SecretRequestDock->>CommitAgentCredentials: Submit secret binding
CommitAgentCredentials->>WorkflowAPI: Commit workflow revision
WorkflowAPI-->>CommitAgentCredentials: Return revision ID
CommitAgentCredentials-->>SecretRequestDock: Adopt committed revision
SecretRequestDock->>ChatHost: Send tool output
ChatHost->>Agent: Resume conversation
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Railway Preview Environment
|
Website previewPreview URL: https://pr-6583-agenta-website-preview.mahmoud-637.workers.dev Built from |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 14
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
docs/design/agent-custom-secrets/qa-browser-evidence.md (1)
39-42: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winComplete the documented QA cleanup.
The browser checklist requires deleting the unique test secret after validation, but this evidence records
qa-advanced-knog6uand a retained dummy attachment. Remove the retained fixtures or document a verified disposable-project teardown before using this evidence as the release record.
🧹 Nitpick comments (1)
web/packages/agenta-entity-ui/src/secret/SecretForm/useSecretForm.ts (1)
143-144: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winKeep this comment to one short line. As per coding guidelines: “Hard rule. At most ONE short line per comment.”
Proposed fix
- // Keyed on the secret's identity, not its object identity: a re-created prop must - // not wipe what the user has typed while the form is open. + // Key on the secret ID to preserve active input through prop recreation.Source: Coding guidelines
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Team
Run ID: a0bc6f03-ce68-47e1-bd8e-07be37d8d4d9
⛔ Files ignored due to path filters (6)
docs/design/agent-custom-secrets/assets/advanced-demo.pngis excluded by!**/*.pngdocs/design/agent-custom-secrets/assets/request-create-demo.pngis excluded by!**/*.pngdocs/design/agent-custom-secrets/assets/request-demo.pngis excluded by!**/*.pngdocs/design/agent-custom-secrets/assets/resume-demo.pngis excluded by!**/*.pngdocs/design/agent-custom-secrets/assets/retry-demo.pngis excluded by!**/*.pngweb/packages/agenta-api-client/src/generated/api/types/CustomSecretSettingsDto.tsis excluded by!**/generated/**
📒 Files selected for processing (117)
.agents/skills/agent-release-gate/resources/coverage.md.agents/skills/agent-release-gate/resources/matrix_s1_custom_secrets.py.agents/skills/agent-release-gate/resources/path_triggers.py.agents/skills/agent-release-gate/resources/test_custom_secret_gate.pyapi/oss/src/apis/fastapi/workflows/router.pyapi/oss/src/core/secrets/dtos.pyapi/oss/src/core/secrets/services.pyapi/oss/src/core/workflows/static_catalog.pyapi/oss/tests/pytest/unit/vault/test_write_only_routes.pyapi/oss/tests/pytest/unit/workflows/test_sandbox_credential_permissions.pyapi/oss/tests/pytest/unit/workflows/test_static_catalog.pydocs/design/agent-custom-secrets/README.mddocs/design/agent-custom-secrets/assets/advanced-recovery-evidence.jsondocs/design/agent-custom-secrets/assets/browser-resume-evidence.jsondocs/design/agent-custom-secrets/assets/retry-evidence.jsondocs/design/agent-custom-secrets/context.mddocs/design/agent-custom-secrets/contracts.mddocs/design/agent-custom-secrets/plan.mddocs/design/agent-custom-secrets/qa-browser-checklist.mddocs/design/agent-custom-secrets/qa-browser-evidence.mddocs/design/agent-custom-secrets/qa.mddocs/design/agent-custom-secrets/research.mddocs/design/agent-custom-secrets/simplification.mddocs/design/agent-custom-secrets/status.mddocs/design/agent-platform-instructions/README.mddocs/design/agent-platform-instructions/context.mddocs/design/agent-platform-instructions/plan.mddocs/design/agent-platform-instructions/research.mddocs/design/agent-platform-instructions/status.mddocs/design/agent-workflows/documentation/protocol.mdsdks/python/agenta/sdk/agents/__init__.pysdks/python/agenta/sdk/agents/adapters/agenta_builtins.pysdks/python/agenta/sdk/agents/adapters/harnesses.pysdks/python/agenta/sdk/agents/dtos.pysdks/python/agenta/sdk/agents/handler.pysdks/python/agenta/sdk/agents/platform/gateway.pysdks/python/agenta/sdk/agents/platform/workflow.pysdks/python/agenta/sdk/agents/platform_instructions.pysdks/python/agenta/sdk/agents/sandbox_credentials.pysdks/python/agenta/sdk/agents/utils/wire.pysdks/python/agenta/sdk/agents/wire_models.pysdks/python/agenta/sdk/utils/types.pysdks/python/oss/tests/pytest/unit/agents/golden/run_request.codex.jsonsdks/python/oss/tests/pytest/unit/agents/golden/run_request.gateway_connection.jsonsdks/python/oss/tests/pytest/unit/agents/platform/test_gateway_connection_resolve.pysdks/python/oss/tests/pytest/unit/agents/test_dtos_agent_template.pysdks/python/oss/tests/pytest/unit/agents/test_harness_adapters.pysdks/python/oss/tests/pytest/unit/agents/test_sandbox_credentials.pysdks/python/oss/tests/pytest/unit/agents/test_wire_contract.pyservices/runner/src/engines/sandbox_agent/harness-trace-port.tsservices/runner/src/engines/sandbox_agent/run-plan.tsservices/runner/src/engines/sandbox_agent/sandbox-credentials.tsservices/runner/src/engines/sandbox_agent/session-identity.tsservices/runner/src/environment/runtime-lifecycle.tsservices/runner/src/lifecycle/desired-state.tsservices/runner/src/protocol.tsservices/runner/src/redaction.tsservices/runner/tests/unit/lifecycle-desired-state.test.tsservices/runner/tests/unit/lifecycle-session-coordinator.test.tsservices/runner/tests/unit/sandbox-agent-run-plan.test.tsservices/runner/tests/unit/sandbox-credentials.test.tsservices/runner/tests/unit/session-pool.test.tsservices/runner/tests/unit/wire-contract.test.tsweb/.prettierignoreweb/mobile/src/features/chat/ConfigPane.tsxweb/mobile/src/features/chat/DrillInBridgeProvider.tsxweb/mobile/src/features/chat/LiveConversation.tsxweb/mobile/src/features/chat/SessionWorkspace.tsxweb/mobile/src/features/context/useProjectPermission.tsweb/mobile/tests/unit/projectPermission.test.tsweb/oss/src/components/AgentChatSlice/AgentConversation.tsxweb/oss/src/components/AgentChatSlice/components/AgentComposerDock.tsxweb/oss/src/components/AgentChatSlice/hooks/useAgentChatSession.tsweb/oss/src/components/DrillInView/OSSdrillInUIProvider.tsxweb/packages/agenta-chat/src/clientTools/index.tsweb/packages/agenta-chat/src/clientTools/secretInteractions.tsweb/packages/agenta-chat/src/hooks/useAgentConversation.tsweb/packages/agenta-chat/tests/unit/hooks/useAgentConversation.test.tsweb/packages/agenta-entities/src/secret/core/index.tsweb/packages/agenta-entities/src/secret/core/transforms.tsweb/packages/agenta-entities/src/secret/core/types.tsweb/packages/agenta-entities/src/secret/index.tsweb/packages/agenta-entities/src/workflow/index.tsweb/packages/agenta-entities/src/workflow/state/agentCredentials.tsweb/packages/agenta-entities/tests/unit/agent-credentials-commit.test.tsweb/packages/agenta-entities/tests/unit/secret-transforms.test.tsweb/packages/agenta-entity-ui/src/DrillInView/SchemaControls/AgentTemplateControl.tsxweb/packages/agenta-entity-ui/src/DrillInView/SchemaControls/agentTemplate/AgentSecretsSection.tsxweb/packages/agenta-entity-ui/src/DrillInView/SchemaControls/agentTemplate/useModelHarness.tsxweb/packages/agenta-entity-ui/src/clientTools/SecretRequestDock.tsxweb/packages/agenta-entity-ui/src/clientTools/SecretRequestWidget.tsxweb/packages/agenta-entity-ui/src/clientTools/index.tsweb/packages/agenta-entity-ui/src/clientTools/registry.tsxweb/packages/agenta-entity-ui/src/secret/AgentSecretAttachmentDrawer.tsxweb/packages/agenta-entity-ui/src/secret/SecretForm/SecretForm.tsxweb/packages/agenta-entity-ui/src/secret/SecretForm/useSecretForm.tsweb/packages/agenta-entity-ui/src/secret/index.tsweb/packages/agenta-entity-ui/tests/unit/agentSecretAttachment.test.tsweb/packages/agenta-playground/src/state/execution/agentRequest.tsweb/packages/agenta-playground/tests/unit/agentRequest.test.tsweb/packages/agenta-sdk/src/resources.tsweb/packages/agenta-shared/src/clientTools/index.tsweb/packages/agenta-ui/src/drill-in/context/DrillInUIContext.tsxweb/storybook/.storybook/main.tsweb/storybook/.storybook/manager-head.htmlweb/storybook/.storybook/preview-head.htmlweb/storybook/public/agent-custom-secrets/Agent custom secrets.dc.htmlweb/storybook/public/agent-custom-secrets/Flow and handoff.dc.htmlweb/storybook/public/agent-custom-secrets/_ds/agenta-design-system-0263eb0f-a904-4476-a73b-7afca7b6d749/README.mdweb/storybook/public/agent-custom-secrets/_ds/agenta-design-system-0263eb0f-a904-4476-a73b-7afca7b6d749/_adherence.oxlintrc.jsonweb/storybook/public/agent-custom-secrets/_ds/agenta-design-system-0263eb0f-a904-4476-a73b-7afca7b6d749/_ds_bundle.jsweb/storybook/public/agent-custom-secrets/_ds/agenta-design-system-0263eb0f-a904-4476-a73b-7afca7b6d749/colors_and_type.cssweb/storybook/public/agent-custom-secrets/_ds/agenta-design-system-0263eb0f-a904-4476-a73b-7afca7b6d749/ui_kits/web/kit.cssweb/storybook/public/agent-custom-secrets/support.jsweb/storybook/stories/design/AgentCustomSecrets.stories.tsxweb/storybook/stories/entity-ui/AgentSecretAttachmentDrawer.stories.tsxweb/storybook/stories/entity-ui/SecretRequestDock.stories.tsx
Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.
| `matrix_s1_custom_secrets.py` does not claim the browser-owned `request_secret` setup interaction. The wire driver can | ||
| observe and settle a client-tool row, but it cannot prove the host created the secret and committed | ||
| the binding through the real form. Run that pause, configure, resume, cancel, and retry flow in the | ||
| host UI using [the custom-secret browser checklist](../../../../../docs/design/agent-custom-secrets/qa-browser-checklist.md) during exploratory QA until a browser automation cell owns it. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Fix the browser checklist link.
../../../../../docs ascends one directory past the repository root from this file. Use ../../../../docs/design/agent-custom-secrets/qa-browser-checklist.md.
| value_two = f"qa-secret-{uuid.uuid4().hex}-{uuid.uuid4().hex}" | ||
| expected_one = hashlib.sha256(value_one.encode()).hexdigest() | ||
| expected_two = hashlib.sha256(value_two.encode()).hexdigest() | ||
| digest_path = f"qa-custom-secret-{token}.sha256" |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Use a new result path for the rotated digest.
The second invocation reuses an existing file path. read_store_file returns the old content on its first 200 response before the durable-store overwrite becomes visible. The cell can report a failed rotation after a correct runtime update. Use a second path or wait for expected_two.
| "sdks/python/agenta/sdk/agents/sandbox_credentials.py": CUSTOM_SECRETS, | ||
| "sdks/python/agenta/sdk/agents/wire_models.py": CUSTOM_SECRETS, | ||
| "sdks/python/agenta/sdk/agents/utils/wire.py": CUSTOM_SECRETS, | ||
| "services/runner/src/engines/sandbox_agent/sandbox-credentials.ts": CUSTOM_SECRETS, | ||
| "services/runner/src/engines/sandbox_agent/run-plan.ts": CUSTOM_SECRETS, | ||
| "services/runner/src/engines/sandbox_agent/session-identity.ts": CUSTOM_SECRETS, | ||
| "services/runner/src/environment/runtime-lifecycle.ts": CUSTOM_SECRETS, | ||
| "services/runner/src/redaction.ts": CUSTOM_SECRETS, |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Cover all custom-secret delivery paths.
sdks/python/agenta/sdk/agents/handler.py resolves and serializes run credentials, and services/runner/src/lifecycle/desired-state.ts controls environment rebuilds when bindings or values change. Neither path requires matrix_s1_custom_secrets.py. A release that changes only either path can receive a false green.
.agents/skills/agent-release-gate/resources/path_triggers.py#L86-L93: Add both paths toCUSTOM_SECRETS..agents/skills/agent-release-gate/resources/test_custom_secret_gate.py#L7-L15: Assert that both paths activatematrix_s1_custom_secrets.py.
📍 Affects 2 files
.agents/skills/agent-release-gate/resources/path_triggers.py#L86-L93(this comment).agents/skills/agent-release-gate/resources/test_custom_secret_gate.py#L7-L15
| The current PR contains the plan only. It does not implement the prompt text or the tool, | ||
| and it must not close #5703 as completed work. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Update the implementation status in this plan.
This section says the current PR contains only the plan, but docs/design/agent-custom-secrets/README.md and docs/design/agent-custom-secrets/qa.md describe the V1 implementation and validation. Replace this historical statement with the current status and any remaining milestone-two scope.
|
|
||
| class SandboxEnvironmentBinding(BaseModel): | ||
| model_config = ConfigDict(extra="forbid") | ||
| type: Literal["env"] |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Default type to "env".
_SandboxEnvironmentBindingSchema declares this field with a default, but this DTO requires it. A revision that omits the redundant discriminator passes the template schema and then fails in AgentTemplate.from_params. Default the field here and add coverage for a binding that contains only name.
Proposed fix
- type: Literal["env"]
+ type: Literal["env"] = "env"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| type: Literal["env"] | |
| type: Literal["env"] = "env" |
| {/* Parked question forms: one question at a time, in a fixed-height card. Slotted | ||
| between approval and connect because that is also the keyboard precedence, so | ||
| visual order and shortcut order can never disagree. */} | ||
| {secretDock ? <div className={CHAT_COLUMN}>{secretDock}</div> : null} |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Include secretDock in gateDockOpen to hide queued messages during secret setup.
| if (entityPropRef.current !== entityId) { | ||
| entityIdRef.current = entityId | ||
| entityPropRef.current = entityId | ||
| } |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🔎 Supported by static analysis
🤖 get_repo_knowledge executed:
get_repo_knowledge Agenta-AI/agenta /tmp/coderabbit-repo-knowledge/agenta-ai-agenta-4b53879a/conventions /tmp/coderabbit-repo-knowledge/agenta-ai-agenta-4b53879a/learnings
Length of output: 26068
🏁 Script executed:
#!/bin/bash
set -e
printf '%s\n' '--- useAgentConversation ---'
sed -n '1,360p' web/packages/agenta-chat/src/hooks/useAgentConversation.ts
printf '%s\n' '--- useAgentChatSession ---'
sed -n '1,270p' web/oss/src/components/AgentChatSlice/hooks/useAgentChatSession.tsRepository: Agenta-AI/agenta
Length of output: 34039
🏁 Script executed:
#!/bin/bash
set -e
printf '%s\n' '--- remaining entity-ref and chat-binding paths ---'
rg -n -C 8 'entityIdRef|entityPropRef|adoptRevision|useSessionChat|hooks' \
web/packages/agenta-chat/src/hooks/useAgentConversation.ts \
web/oss/src/components/AgentChatSlice/hooks/useAgentChatSession.ts \
web/packages/agenta-chat/src/hooks/useSessionChat.ts
printf '%s\n' '--- request builder definition ---'
rg -n -C 12 'export .*buildAgentRequest|function buildAgentRequest|const buildAgentRequest' \
web/packages web/oss/srcRepository: Agenta-AI/agenta
Length of output: 36697
🌐 Web query:
React official docs refs writing during render concurrent rendering useRef
💡 Result:
In React, you must not read or write ref.current during the render phase [1][2][3]. The official documentation explicitly advises against this practice because it makes a component’s behavior unpredictable and violates the core requirement that rendering be a pure function [1][2][3]. Why this is restricted: - Rendering process: React expects that calling a component function during render will not have side effects [3]. In concurrent rendering, React may invoke your component multiple times, suspend, or abort and restart rendering [4][5]. If your component performs reads or writes to refs during these cycles, the component may observe stale, inconsistent, or incorrect values [6][7][8]. - Concurrency compatibility: Because React may "throw away" the results of a render if it is interrupted or superseded, any mutations performed during render might be triggered multiple times or never committed, leading to bugs that are difficult to debug [7][5][8]. The only exception: - Lazy initialization: It is permitted to write to a ref during render only if it is for lazy initialization, specifically when setting the initial value of a ref that will not change thereafter [1][9][3]. A common, safe pattern is: javascript const ref = useRef(null); if (ref.current === null) { ref.current = new ExpensiveObject(); } This is acceptable because the assignment happens only once during the first render and the value remains stable/predictable [1][3]. Recommended approach: - Use event handlers or useEffect for reading and writing refs [1][4][6]. These phases occur outside of the render phase (during commit or user interaction), making them the appropriate and safe locations for performing side effects [4][8]. - If you need to store information that affects what is rendered, use state (useState) instead of refs [1][2][10]. React is designed to track state changes and trigger re-renders appropriately, whereas refs are explicitly intended for values that do not trigger re-renders or affect the render output directly [2][6]. To enforce these rules, you can use the official eslint-plugin-react-hooks which includes specific rules to catch unauthorized ref access during render [6][9][7].
Citations:
- 1: https://react.dev/reference/react/useRef
- 2: https://react.dev/learn/referencing-values-with-refs
- 3: https://react.dev/reference/react/useRef.md
- 4: https://react.dev/learn/manipulating-the-dom-with-refs
- 5: https://stackoverflow.com/questions/68025789/is-it-safe-to-change-a-refs-value-during-render-instead-of-in-useeffect
- 6: https://react.dev/reference/eslint-plugin-react-hooks/lints/refs
- 7: GitHub issue 33041 in react/react (link omitted to avoid creating a cross-reference)
- 8: GitHub issue 29161 in facebook/react (link omitted to avoid creating a cross-reference)
- 9: GitHub pull request 24506 in facebook/react (link omitted to avoid creating a cross-reference)
- 10: https://stackoverflow.com/questions/78612876/accessing-ref-current-property-inside-render-call
🏁 Script executed:
#!/bin/bash
set -e
rg -n -C 10 'entityIdRef|entityPropRef|adoptRevision|useSessionChat|hooks' web/packages/agenta-chat/src/hooks/useAgentConversation.ts web/oss/src/components/AgentChatSlice/hooks/useAgentChatSession.ts web/packages/agenta-chat/src/hooks/useSessionChat.ts
rg -n -C 12 'export .*buildAgentRequest|function buildAgentRequest|const buildAgentRequest' web/packages web/oss/srcRepository: Agenta-AI/agenta
Length of output: 41845
Synchronize revision refs after commit, not during render.
Both hooks mutate entityIdRef during render, while useSessionChat preserves callbacks across renders. An interrupted render can therefore expose an uncommitted revision to buildAgentRequest, which selects the invocation URL by revision ID. Move the prop-to-ref synchronization into a layout effect in both hooks.
📍 Affects 2 files
web/packages/agenta-chat/src/hooks/useAgentConversation.ts#L271-L274(this comment)web/oss/src/components/AgentChatSlice/hooks/useAgentChatSession.ts#L175-L178
| }, | ||
| {queryParams: {project_id: projectId}}, | ||
| ) | ||
| revision = workflowRevisionResponseSchema.parse(response).workflow_revision |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
Use safeParseWithLogging here, as per coding guidelines: “Use safeParseWithLogging for the validation.”
Source: Coding guidelines
| onAdoptRevision, | ||
| onOutput, | ||
| }: SecretRequestDockProps) => { | ||
| const [targetId, setTargetId] = useState(revisionId) |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🔎 Supported by static analysis
🏁 Script executed:
#!/bin/bash
set -euo pipefail
ast-grep outline web/packages/agenta-entity-ui/src/clientTools/SecretRequestDock.tsx --items all
rg -n -C 6 'SecretRequestDock|revisionId=|onAdoptRevision' web --glob '*.ts' --glob '*.tsx'Repository: Agenta-AI/agenta
Length of output: 50373
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- SecretRequestDock ---'
cat -n web/packages/agenta-entity-ui/src/clientTools/SecretRequestDock.tsx
printf '%s\n' '--- SecretRequestDock call sites ---'
rg -n -C 12 '<SecretRequestDock|SecretRequestDock' web --glob '*.ts' --glob '*.tsx' \
| rg -v 'node_modules|SecretRequestDock\.tsx'
printf '%s\n' '--- adoption and revision state ---'
rg -n -C 14 'adoptSecretRevision|const entityId|entityId[),]|revisionId.*entityId' \
web/mobile/src/features/chat/LiveConversation.tsxRepository: Agenta-AI/agenta
Length of output: 31118
🏁 Script executed:
#!/bin/bash
set -euo pipefail
cat -n web/packages/agenta-entity-ui/src/clientTools/SecretRequestDock.tsx
printf '%s\n' '--- exact call sites ---'
rg -n -C 10 '<SecretRequestDock' web --glob '*.ts' --glob '*.tsx'
printf '%s\n' '--- revision adoption ---'
rg -n -C 12 'adoptSecretRevision|entityId' web/mobile/src/features/chat/LiveConversation.tsxRepository: Agenta-AI/agenta
Length of output: 21622
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- conversation revision adoption ---'
rg -n -C 12 'adoptRevision' web/mobile web/oss web/packages --glob '*.ts' --glob '*.tsx'
printf '%s\n' '--- LiveConversation hosts ---'
rg -n -C 10 '<LiveConversation|LiveConversation\(' web/mobile web/oss --glob '*.tsx'
printf '%s\n' '--- entityId updates in conversation hosts ---'
rg -n -C 8 'entityId.*set|setEntityId|selectedRevision|revisionId' web/mobile/src web/oss/src/components/AgentChatSlice --glob '*.ts' --glob '*.tsx' \
| head -n 300Repository: Agenta-AI/agenta
Length of output: 50372
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- mobile key and selected revision flow ---'
sed -n '55,105p' web/mobile/src/features/chat/ChatScreen.tsx
cat -n web/mobile/src/features/chat/conversationKey.ts
cat -n web/mobile/src/features/chat/selectedRevision.ts
printf '%s\n' '--- desktop AgentConversation hosts ---'
rg -n -C 12 '<AgentConversation|AgentConversation\(' web/oss/src --glob '*.tsx'
printf '%s\n' '--- desktop entity switching ---'
rg -n -C 14 'switchEntity' web/oss/src/components/AgentChatSlice --glob '*.ts' --glob '*.tsx'Repository: Agenta-AI/agenta
Length of output: 22453
Synchronize targetId with revisionId. Both chat hosts keep SecretRequestDock mounted when the revision changes: the mobile conversationKey ignores revisionId, and the desktop conversation survives entityId changes. targetId then remains stale, so the drawer and commitAgentCredentialsAtom can read and update the previous revision.
|
|
||
| class Component extends DCLogic { | ||
| timers = []; | ||
| state = this.build(new URLSearchParams(location.search).get("scenario") || "happy"); |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Validate the initial scenario value.
An unknown scenario query value makes SCENARIOS.find(...) return undefined, then line 795 throws on .hint. Default unsupported values to "happy" before calling build.
1 participant
Context
Agenta can store custom secrets, but an agent cannot yet use them or ask a user to attach one during a conversation. This implements V1 from #6565 and targets
release/v0.115.1. It includes the shared platform-instruction dependency required by secret guidance.Changes
Users can attach a text secret in the agent's Advanced drawer or complete an agent's
request_secretcard. Both use the same attachment drawer and existing vault form. The form exposes an optional default environment variable directly below Value; an attachment can override it without changing the vault default. There are no service templates.For example, a vault entry with default
DEPLOY_TOKENcan be attached asSTAGING_TOKEN. The agent revision stores only its secret slug and environment name. The SDK resolves the value for each run, and the runner injects it using its existing environment and credential lifecycle. Rotation and removal take effect on the next run while preserving the conversation and files.Card completion saves the binding, adopts the returned revision, settles a reference-only tool result, and resumes the same conversation. An attachment failure retains the saved vault entry for retry. Resume transport failures retain their error callout through transcript refresh and offer the existing guarded turn retry; a repeated secret request can Continue with the saved binding. Shared guidance explains requesting and consuming attached variables without reading environment values into the prompt. Host-restricted delivery remains milestone two.
The native components and their states are in the existing Storybook organization. The original designer-review URL remains valid.
How to review
Start with the vault metadata and workflow permission changes, then the SDK resolver and runner lifecycle. Review the shared entity commit action and attachment components before the desktop and mobile hosts. The release-gate cell and browser checklist cover future regressions.
Tests
Daytona live verification remains open: the disposable project has no usable OpenAI credential. The full three-harness, two-environment release matrix is not claimed as complete. Detailed results and remaining checks are in the QA record.
Demo
What to QA
matrix_s1_custom_secrets.pyon Daytona with an authorized model credential, plus the remaining harness/environment combinations in the QA checklist.