collavre 0.24.0 → 0.25.0

data/app/channels/collavre/comments_presence_channel.rb

@@ -24,19 +24,54 @@ class CommentsPresenceChannel < ApplicationCable::Channel
     )
   end
 
-  # Broadcast status for any currently running AI agent tasks for a creative.
-  # Called when a user subscribes to ensure they see ongoing agent activity.
-  def self.broadcast_running_agents(creative_id)
-    Task.where(status: %w[running pending]).find_each do |task|
+  # Replayed to late subscribers. "pending_approval" must be here: its job already
+  # returned, so no heartbeat or later broadcast will ever re-announce it, and a
+  # reloading viewer would lose the Stop button on the turn that is waiting on them.
+  AGENT_REPLAY_STATUSES = %w[running pending pending_approval].freeze
+
+  # Narrowed by creative in SQL, not in Ruby: a pending_approval turn sits until
+  # somebody answers it, so the replayable set is unbounded and deployment-wide,
+  # and every subscribe would otherwise load all of it just to keep one creative's
+  # rows. tasks.creative_id is written from the same context["creative"]["id"] the
+  # payload carries (AiAgentJob#admit_or_defer!, park_waiter), and is indexed.
+  # A row can only lose it to the FK's on_delete:
+  # :nullify, and a deleted creative already returns [] above.
+  #
+  # Ordered by id because the client appends these into a per-agent array and stops
+  # the last one. Not created_at: turns are stamped by whichever process dispatched
+  # them, so a web/worker clock skew can invert two of them (see PR #1431).
+  def self.replayable_tasks(creative_id)
+    Task.where(status: AGENT_REPLAY_STATUSES, creative_id: creative_id).order(:id)
+  end
+
+  # Scoped to the creative the popup is open on, not to its origin: the client keeps
+  # that id as this.creativeId and drops any payload naming a different one, and a
+  # link is a placement — replaying every task under the origin would put another
+  # user's shell id on the wire, which PermissionFilter#readable_ids exists to hide.
+  # Topics hang off the origin, so that is what resolves a task's topic_id.
+  def self.running_agent_payloads(creative_id, topic_id: nil)
+    creative = Creative.find_by(id: creative_id)&.effective_origin
+    return [] unless creative
+
+    replayable_tasks(creative_id).filter_map do |task|
+      # Still checked: the column is what the query trusts, the payload is what the
+      # client is handed back as source_creative_id, and a row where the two
+      # disagree must not name a creative it was not dispatched on.
       task_creative_id = task.trigger_event_payload&.dig("creative", "id")
       next unless task_creative_id == creative_id
 
-      broadcast_agent_status(
+      task_topic_id = AiAgent::AgentLifecycleManager.topic_id_for(task: task, creative: creative)
+      next if topic_id && task_topic_id.to_s != topic_id.to_s
+
+      agent_status_payload(
         creative_id,
-        status: "thinking",
+        # Replayed with its real status, not a blanket "thinking": the client keys
+        # its own handling off this string, and a paused turn is not a working one.
+        status: task.status == "pending_approval" ? "pending_approval" : "thinking",
         agent_id: task.agent_id,
         agent_name: task.agent.display_name,
         task_id: task.id,
+        topic_id: task_topic_id,
         source_creative_id: task_creative_id
       )
     end
@@ -45,62 +80,187 @@ class CommentsPresenceChannel < ApplicationCable::Channel
   # Broadcast agent status (thinking/streaming/idle) to presence channel.
   # This allows the frontend typing indicator to show AI agent activity.
   # source_creative_id: the actual creative where agent is working (for filtering on frontend)
-  def self.broadcast_agent_status(creative_id, status:, agent_id:, agent_name:, task_id: nil, content: nil, source_creative_id: nil)
+  def self.broadcast_agent_status(creative_id, status:, agent_id:, agent_name:, topic_id:, task_id: nil, content: nil, source_creative_id: nil)
+    ActionCable.server.broadcast(
+      "comments_presence:#{creative_id}",
+      agent_status_payload(
+        creative_id,
+        status: status, agent_id: agent_id, agent_name: agent_name, topic_id: topic_id,
+        task_id: task_id, content: content, source_creative_id: source_creative_id
+      )
+    )
+  end
+
+  def self.agent_status_payload(creative_id, status:, agent_id:, agent_name:, topic_id:, task_id: nil, content: nil, source_creative_id: nil)
     payload = {
       agent_status: {
         id: agent_id,
         name: agent_name,
         status: status,
         task_id: task_id,
+        topic_id: topic_id,
         creative_id: source_creative_id || creative_id
       }
     }
     payload[:agent_status][:content] = content if content.present?
-    ActionCable.server.broadcast("comments_presence:#{creative_id}", payload)
+    payload
   end
 
   def subscribed
     Rails.logger.info "User #{current_user&.email} subscribed to comments presence for creative #{params[:creative_id]}"
-    return unless params[:creative_id].present? && current_user
+    return reject unless params[:creative_id].present? && current_user
+
+    requested = Creative.find_by(id: params[:creative_id].to_i)
+    creative = requested&.effective_origin
+    # The only gate on this channel — nothing below is re-checked per message, and
+    # active_statuses already filters the same task data by :read.
+    return reject unless creative&.has_permission?(current_user, :read)
 
-    @creative_id = Creative.find(params[:creative_id].to_i).effective_origin.id
-    creative = Creative.find(@creative_id)
+    @creative_id = creative.id
+    # Kept for the whole subscription, not just for the replay below: comments live on
+    # the origin, so everything else on this channel is keyed by @creative_id, while
+    # a task is dispatched on — and replayed for — the creative the popup is open on.
+    # #running_agents replays too, and reading @creative_id there would search the
+    # origin for rows that only ever carried the shell's id.
+    @requested_creative_id = requested.id
+    @presence_subscription_id = SecureRandom.uuid
     stream_from stream_name
-    CommentPresenceStore.add(@creative_id, current_user.id)
+    CommentPresenceStore.add(@creative_id, current_user.id, subscription_id: @presence_subscription_id)
     Comment.broadcast_badge(creative, current_user)
     broadcast_presence
-    CommentsPresenceChannel.broadcast_running_agents(@creative_id)
+    # Transmitted, not broadcast: stream_from attaches asynchronously, so a broadcast
+    # published in the same breath can be dropped. Presence and badges survive that
+    # (later events re-send them); this replay is one-shot.
+    replay_running_agents
   end
 
   def unsubscribed
     if @creative_id && current_user
-      CommentPresenceStore.remove(@creative_id, current_user.id)
+      CommentPresenceStore.remove(@creative_id, current_user.id, subscription_id: @presence_subscription_id)
       creative = Creative.find(@creative_id)
-      pointer = CommentReadPointer.find_or_initialize_by(user: current_user, creative: creative)
-      pointer.last_read_comment_id = creative.comments.maximum(:id)
-      pointer.save!
       Comment.broadcast_badge(creative, current_user)
       broadcast_presence
     end
   end
 
-  def typing
+  # Presence is creative-wide for participant avatars, but unread suppression is
+  # topic-specific. A client reports the topic it is actively rendering so a
+  # message in another topic keeps its badge while the chat popup is open. All
+  # Messages also reports the topic snapshot rendered in its list: an active
+  # topic restored later has not yet been viewed.
+  def viewing_topic(data)
+    return unless @creative_id && current_user
+
+    topic_id = data["topic_id"] || data[:topic_id]
+    @viewing_topic_id = topic_id.present? && Topic.find_by(id: topic_id, creative_id: @creative_id)&.id
+    return if topic_id.present? && !@viewing_topic_id
+    @rendered_topic_ids = rendered_topic_ids_for(data) unless @viewing_topic_id
+    @rendered_legacy_topic = rendered_legacy_topic_for(data) unless @viewing_topic_id
+    @viewing_topic_reported = true
+
+    CommentPresenceStore.set_topic(
+      @creative_id,
+      current_user.id,
+      @viewing_topic_id,
+      subscription_id: @presence_subscription_id,
+      rendered_topic_ids: @rendered_topic_ids,
+      rendered_legacy_topic: @rendered_legacy_topic
+    )
+    Comment.broadcast_badge(Creative.find(@creative_id), current_user)
+  end
+
+  # The browser keeps this lease alive while its Action Cable subscription is
+  # healthy. If the process or connection disappears without #unsubscribed,
+  # the lease simply expires and no longer suppresses unread badges.
+  def heartbeat
+    return unless @creative_id && current_user
+
+    return if CommentPresenceStore.renew(
+      @creative_id,
+      current_user.id,
+      subscription_id: @presence_subscription_id
+    )
+
+    # A frozen browser can resume on an intact WebSocket after its cache lease
+    # expires. Recreate this live channel's membership from its last reported
+    # rendering context instead of waiting for a topic switch or resubscribe.
+    if @viewing_topic_reported
+      CommentPresenceStore.set_topic(
+        @creative_id,
+        current_user.id,
+        @viewing_topic_id,
+        subscription_id: @presence_subscription_id,
+        rendered_topic_ids: @rendered_topic_ids,
+        rendered_legacy_topic: @rendered_legacy_topic
+      )
+    else
+      CommentPresenceStore.add(@creative_id, current_user.id, subscription_id: @presence_subscription_id)
+    end
+    Comment.broadcast_badge(Creative.find(@creative_id), current_user)
+    broadcast_presence
+  end
+
+  def typing(data)
     return unless @creative_id && current_user
 
+    topic_id = topic_id_for(data)
+    return unless topic_id
+
     ActionCable.server.broadcast(
       stream_name,
-      { typing: { id: current_user.id, name: current_user.display_name } }
+      { typing: { id: current_user.id, name: current_user.display_name, topic_id: topic_id } }
     )
   end
 
-  def stopped_typing
+  def stopped_typing(data)
+    return unless @creative_id && current_user
+
+    topic_id = topic_id_for(data)
+    return unless topic_id
+
+    ActionCable.server.broadcast(stream_name, { stop_typing: { id: current_user.id, topic_id: topic_id } })
+  end
+
+  # The client clears its agent state on every topic switch and asks for the new
+  # topic's snapshot. A pending_approval turn has no heartbeat behind it, so this
+  # replay is the only thing that can put its indicator and Stop button back.
+  def running_agents(data)
     return unless @creative_id && current_user
 
-    ActionCable.server.broadcast(stream_name, { stop_typing: { id: current_user.id } })
+    topic_id = topic_id_for(data)
+    return unless topic_id
+
+    replay_running_agents(topic_id: topic_id)
   end
 
   private
 
+  def rendered_topic_ids_for(data)
+    ids = data["rendered_topic_ids"] || data[:rendered_topic_ids]
+    return [] unless ids.is_a?(Array)
+
+    Topic.where(creative_id: @creative_id, id: ids).pluck(:id)
+  end
+
+  def rendered_legacy_topic_for(data)
+    ActiveModel::Type::Boolean.new.cast(data["rendered_legacy_topic"] || data[:rendered_legacy_topic])
+  end
+
+  # Transmitted to the connection that asked, never broadcast: the stream is per
+  # origin and shared by every viewer of it, so publishing one client's snapshot
+  # there would re-push agent state to everyone — including viewers sitting on a
+  # different topic, whose own state the client would then have to reconcile.
+  def replay_running_agents(topic_id: nil)
+    self.class
+        .running_agent_payloads(@requested_creative_id, topic_id: topic_id)
+        .each { |payload| transmit(payload) }
+  end
+
+  def topic_id_for(data)
+    topic_id = data["topic_id"] || data[:topic_id]
+    Topic.find_by(id: topic_id, creative_id: @creative_id)&.id
+  end
+
   def stream_name
     "comments_presence:#{@creative_id}"
   end

data/app/channels/collavre/inbox_badge_channel.rb

@@ -23,7 +23,13 @@ module Collavre
       # badge stale. transmit only reaches this just-confirmed subscriber, so the
       # snapshot can never be sent while no client is listening.
       inbox = Creative.inbox_for(current_user)
-      snapshot = Comment.inbox_badge_turbo_stream(inbox, current_user)
+      badge_index = Creatives::CommentBadgeIndex.new(user: current_user)
+      badge_index.index([ inbox ])
+      snapshot = Comment.inbox_badge_turbo_stream(
+        inbox,
+        current_user,
+        count: badge_index.unread_count_for(inbox)
+      )
       transmit(snapshot) if snapshot
     end
   end

data/app/components/collavre/inbox/badge_component.rb

@@ -14,24 +14,17 @@ module Collavre
       def count
         return @count if @count
 
-        if @creative && @user
-          # Use CommentReadPointer-based unread count for inbox creative
-          unread_count_for_creative
-        else
-          # Legacy fallback: InboxItem count
-          InboxItem.where(owner: @user, state: "new").count
-        end
+        return 0 unless @creative && @user
+
+        unread_count_for_creative
       end
 
       private
 
       def unread_count_for_creative
-        visible_comments = @creative.comments.visible_to(@user)
-        pointer = CommentReadPointer.find_by(user: @user, creative: @creative)
-        last_read_id = pointer&.last_read_comment_id
-
-        scope = last_read_id ? visible_comments.where("comments.id > ?", last_read_id) : visible_comments
-        scope.count
+        badge_index = Creatives::CommentBadgeIndex.new(user: @user)
+        badge_index.index([ @creative.effective_origin ])
+        badge_index.unread_count_for(@creative.effective_origin)
       end
     end
   end

data/app/components/collavre/progress_filter_component.html.erb

@@ -1,5 +1,5 @@
-<div class="progress-filter-group" data-controller="progress-filter">
+<div class="progress-filter-group" data-controller="progress-filter" data-progress-filter-index-path-value="<%= index_path %>" data-progress-filter-on-index-value="<%= on_index? %>">
   <% states.each do |state| %>
-    <button class="progress-filter-btn<%= ' active' if current_state.to_s == state[:value].to_s %>" data-action="click->progress-filter#apply" data-progress-filter-target="button" data-progress-filter-filter-param="<%= state[:value] %>"><%= state[:name] %></button>
+    <button class="progress-filter-btn<%= ' active' if current_state.to_s == state[:value].to_s %>" data-action="click->progress-filter#apply" data-progress-filter-target="button" data-filter-state="<%= filter_state_key(state[:value]) %>" data-progress-filter-filter-param="<%= state[:value] %>"><%= state[:name] %></button>
   <% end %>
 </div>

data/app/components/collavre/progress_filter_component.rb

@@ -1,10 +1,30 @@
 module Collavre
 class ProgressFilterComponent < ViewComponent::Base
+  # Progress/comment params are only consumed by Creatives::IndexQuery, so the
+  # buttons carry the creative index path and whether we are already on it.
+  # See app/javascript/lib/utils/filter_navigation.js.
+  PROGRESS_VALUES = %w[all complete incomplete].freeze
+
   def initialize(current_state:, states: [])
     @current_state = current_state&.to_sym
     @states = states
   end
 
   attr_reader :current_state, :states
+
+  def index_path
+    helpers.collavre.creatives_path
+  end
+
+  def on_index?
+    helpers.creative_index_page?
+  end
+
+  # Mirrors the keys syncFilterButtons() derives from the URL, so a frame-only
+  # navigation can re-apply the `active` class without a server round trip.
+  def filter_state_key(value)
+    value = value.to_s
+    PROGRESS_VALUES.include?(value) ? "progress:#{value}" : value
+  end
 end
 end

data/app/controllers/collavre/admin/settings_controller.rb

@@ -24,6 +24,7 @@ module Collavre
 
         # LLM settings
         @llm_request_timeout_seconds = SystemSetting.llm_request_timeout_seconds
+        @ai_agent_turn_deadline_seconds = SystemSetting.ai_agent_turn_deadline_seconds
 
         # Rate limiting settings
         @password_reset_rate_limit = SystemSetting.password_reset_rate_limit
@@ -108,6 +109,7 @@ module Collavre
         @api_rate_limit = params[:api_rate_limit].to_i.positive? ? params[:api_rate_limit].to_i : SystemSetting::DEFAULT_API_RATE_LIMIT
         @api_rate_period_minutes = params[:api_rate_period_minutes].to_i.positive? ? params[:api_rate_period_minutes].to_i : SystemSetting::DEFAULT_API_RATE_PERIOD_MINUTES
         @llm_request_timeout_seconds = params[:llm_request_timeout_seconds].to_i.positive? ? params[:llm_request_timeout_seconds].to_i : SystemSetting::DEFAULT_LLM_REQUEST_TIMEOUT_SECONDS
+        @ai_agent_turn_deadline_seconds = params[:ai_agent_turn_deadline_seconds].to_i.positive? ? params[:ai_agent_turn_deadline_seconds].to_i : SystemSetting::DEFAULT_AI_AGENT_TURN_DEADLINE_SECONDS
         @enabled_auth_providers = params[:auth_providers] || []
         render :index, status: :unprocessable_entity
       end
@@ -130,7 +132,8 @@ module Collavre
           "password_reset_rate_period_minutes" => int_setting(:password_reset_rate_period_minutes, SystemSetting::DEFAULT_PASSWORD_RESET_RATE_PERIOD_MINUTES),
           "api_rate_limit" => int_setting(:api_rate_limit, SystemSetting::DEFAULT_API_RATE_LIMIT),
           "api_rate_period_minutes" => int_setting(:api_rate_period_minutes, SystemSetting::DEFAULT_API_RATE_PERIOD_MINUTES),
-          "llm_request_timeout_seconds" => int_setting(:llm_request_timeout_seconds, SystemSetting::DEFAULT_LLM_REQUEST_TIMEOUT_SECONDS, min: 30)
+          "llm_request_timeout_seconds" => int_setting(:llm_request_timeout_seconds, SystemSetting::DEFAULT_LLM_REQUEST_TIMEOUT_SECONDS, min: 30),
+          "ai_agent_turn_deadline_seconds" => int_setting(:ai_agent_turn_deadline_seconds, SystemSetting::DEFAULT_AI_AGENT_TURN_DEADLINE_SECONDS, min: 60)
         }
       end
 

data/app/controllers/collavre/agent_connections_controller.rb

@@ -0,0 +1,165 @@
+# frozen_string_literal: true
+
+module Collavre
+  class AgentConnectionsController < ApplicationController
+    before_action :set_agent_and_workspace
+
+    def show; end
+
+    def status
+      client = proxy_client
+      engines = Array(client.engines["data"])
+      engine_rows = engines.map do |engine|
+        engine.merge("status" => client.engine_status(engine.fetch("engine")))
+      rescue Collavre::CliProxy::Client::Error => e
+        engine.merge("status" => { "state" => "unknown", "error" => e.message, "code" => e.code })
+      end
+
+      render json: {
+        engines: engine_rows,
+        provision: client.provision_status,
+        workspace: {
+          credential_id: @workspace.proxy_credential_id,
+          workspace_id: @workspace.proxy_workspace_id,
+          mode: @agent.agent_gateway.workspace_mode
+        }
+      }
+    rescue Collavre::CliProxy::Client::Error => e
+      render_proxy_error(e)
+    end
+
+    def create_auth_session
+      response = proxy_client.create_auth_session(
+        params[:engine],
+        flow: params[:flow].presence,
+        provisioning_url: manifest_url
+      )
+      render json: response, status: :created
+    rescue Collavre::CliProxy::Client::Error => e
+      render_proxy_error(e)
+    end
+
+    def auth_session
+      render json: proxy_client.auth_session(params[:engine], params[:session_id])
+    rescue Collavre::CliProxy::Client::Error => e
+      render_proxy_error(e)
+    end
+
+    def submit_auth_session
+      base_url = params[:base_url].presence
+      validate_custom_gateway_base_url!(base_url) if base_url
+      render json: proxy_client.submit_auth_session(
+        params[:engine],
+        params[:session_id],
+        params[:auth_secret],
+        base_url: base_url
+      )
+    rescue Collavre::CliProxy::Client::Error => e
+      render_proxy_error(e)
+    end
+
+    def cancel_auth_session
+      render json: proxy_client.cancel_auth_session(params[:engine], params[:session_id])
+    rescue Collavre::CliProxy::Client::Error => e
+      render_proxy_error(e)
+    end
+
+    def provision_sync
+      render json: sync_provisioning
+    rescue Collavre::CliProxy::Client::Error => e
+      render_proxy_error(e)
+    end
+
+    def provision_approve
+      render json: proxy_client.provision_approve(params[:type], params[:name])
+    rescue Collavre::CliProxy::Client::Error => e
+      render_proxy_error(e)
+    end
+
+    def provision_delete
+      render json: proxy_client.provision_delete(params[:type], params[:name])
+    rescue Collavre::CliProxy::Client::Error => e
+      render_proxy_error(e)
+    end
+
+    def rotate_tokens
+      @workspace.rotate_tokens!
+      redirect_to agent_connection_user_path(@agent), notice: t("collavre.agent_connections.tokens_rotated")
+    end
+
+    private
+
+    def set_agent_and_workspace
+      @agent = Collavre::User.find(params[:user_id] || params[:id])
+      return head :not_found unless @agent.cli_proxy_agent?
+      return head :forbidden unless @agent.gateway_accessible_to?(Current.user)
+
+      @workspace = Collavre::AgentWorkspace.resolve!(agent: @agent, user: Current.user)
+      gateway = @workspace.agent_gateway
+      if gateway.shared? && Current.user.id != @agent.created_by_id && !Current.user.system_admin?
+        head :forbidden
+      end
+    rescue ArgumentError => error
+      raise unless [ "Agent has no gateway", "Agent gateway is inactive" ].include?(error.message)
+
+      head :service_unavailable
+    end
+
+    def proxy_client
+      @proxy_client ||= Collavre::CliProxy::Client.new(gateway: @workspace.agent_gateway, workspace: @workspace)
+    end
+
+    # "Sync now" starts from registration rather than assuming one happened.
+    # A manifest URL otherwise only reaches the proxy as a side effect of a
+    # login, so a workspace whose registration never landed — an engine
+    # authenticated before provisioning existed, a first sync that failed, a
+    # proxy that lost its state — could only be repaired by logging in again.
+    #
+    # Registration is idempotent: re-registering the same URL is a plain
+    # re-sync. Two answers mean the proxy will not take a URL from us at all
+    # and a plain sync is the whole of what we can do — an operator who pinned
+    # the workspace with PROVISION_MANIFEST_URL (409 manifest_url_locked), and
+    # a proxy predating the endpoint, whose router answers 404 for it. The one
+    # 404 that is not that is provisioning_disabled, where the plain sync would
+    # only repeat the same answer and hide which of the two it was.
+    def sync_provisioning
+      proxy_client.provision_register_manifest(manifest_url)
+    rescue Collavre::CliProxy::Client::Error => error
+      registration_refused = error.code == "manifest_url_locked" ||
+        (error.status == 404 && error.code != "provisioning_disabled")
+      raise unless registration_refused
+
+      proxy_client.provision_sync
+    end
+
+    def manifest_url
+      "#{request.base_url}#{agent_provision_manifest_path(
+        agent_id: @agent.id,
+        token: @workspace.manifest_token
+      )}"
+    end
+
+    def render_proxy_error(error)
+      status = error.status.to_i.between?(400, 599) ? error.status : :bad_gateway
+      render json: { error: { message: error.message, code: error.code } }, status: status
+    end
+
+    # A custom provider URL is supplied by an agent user but fetched by the
+    # proxy with its credentials. Check it here as well as at the proxy boundary
+    # so a non-admin user cannot use the login form as an internal-network probe.
+    def validate_custom_gateway_base_url!(base_url)
+      return if Current.user.system_admin?
+
+      policy = Collavre::CliProxy::EndpointPolicy.new
+      return policy.resolve!(base_url) if policy.safe_literal?(base_url)
+
+      raise Collavre::CliProxy::EndpointPolicy::UnsafeEndpoint
+    rescue Collavre::CliProxy::EndpointPolicy::UnsafeEndpoint
+      raise Collavre::CliProxy::Client::Error.new(
+        t("collavre.agent_connections.errors.insecure_base_url"),
+        status: 422,
+        code: "insecure_base_url"
+      )
+    end
+  end
+end

data/app/controllers/collavre/agent_gateways_controller.rb

@@ -0,0 +1,132 @@
+# frozen_string_literal: true
+
+module Collavre
+  class AgentGatewaysController < ApplicationController
+    before_action :set_gateway, only: %i[edit update destroy check]
+
+    def index
+      @agent_gateways = Current.user.owned_agent_gateways.order(:name)
+    end
+
+    def new
+      @agent_gateway = Current.user.owned_agent_gateways.new
+    end
+
+    def create
+      @agent_gateway = Current.user.owned_agent_gateways.new(gateway_params)
+      if @agent_gateway.save
+        redirect_to agent_gateways_path, notice: t("collavre.agent_gateways.created")
+      else
+        render :new, status: :unprocessable_entity
+      end
+    end
+
+    def edit
+      @has_stored_completion_key = @agent_gateway.completion_key.present?
+    end
+
+    def update
+      attributes = gateway_params
+      clear_completion_key = ActiveModel::Type::Boolean.new.cast(attributes.delete(:clear_completion_key))
+      @has_stored_completion_key = @agent_gateway.completion_key.present?
+      @clear_completion_key = clear_completion_key
+
+      if clear_completion_key
+        attributes[:completion_key] = nil
+      elsif attributes[:completion_key].blank?
+        attributes.delete(:completion_key)
+      end
+
+      %i[admin_key identity_secret].each do |key|
+        attributes.delete(key) if attributes[key].blank?
+      end
+
+      if @agent_gateway.update(attributes)
+        redirect_to agent_gateways_path, notice: t("collavre.agent_gateways.updated")
+      else
+        render :edit, status: :unprocessable_entity
+      end
+    end
+
+    def destroy
+      if @agent_gateway.destroy
+        redirect_to agent_gateways_path, notice: t("collavre.agent_gateways.destroyed")
+      else
+        redirect_to agent_gateways_path, alert: t("collavre.agent_gateways.in_use")
+      end
+    end
+
+    def check
+      if @agent_gateway.completion_key.present?
+        data = connection_check_client(user_key: @agent_gateway.completion_key).engines
+        render_connection_check(data, identity: "completion_key")
+      else
+        check_with_workspace_or_admin
+      end
+    rescue Collavre::CliProxy::Client::Error => e
+      return retry_connection_check_with_workspace if e.code == "user_identity_required"
+
+      render json: { ok: false, error: e.message, code: e.code }, status: :bad_gateway
+    end
+
+    private
+
+    def set_gateway
+      @agent_gateway = Current.user.owned_agent_gateways.find(params[:id])
+    end
+
+    def gateway_params
+      params.require(:agent_gateway).permit(
+        :name, :base_url, :admin_key, :completion_key, :identity_secret,
+        :tenant_id, :workspace_mode, :active, :clear_completion_key
+      )
+    end
+
+    def retry_connection_check_with_workspace
+      workspace = connection_check_workspace
+      return render_identity_unverified unless workspace
+
+      data = connection_check_client(workspace: workspace).engines
+      render_connection_check(data, identity: "workspace")
+    rescue Collavre::CliProxy::Client::Error => e
+      render json: { ok: false, error: e.message, code: e.code }, status: :bad_gateway
+    end
+
+    def check_with_workspace_or_admin
+      workspace = connection_check_workspace
+      return retry_connection_check_with_workspace if workspace
+
+      data = connection_check_client.engines
+      render_identity_unverified(data)
+    end
+
+    def connection_check_workspace
+      scope = @agent_gateway.agent_workspaces.order(:id)
+      return scope.find_by(user: Current.user) if @agent_gateway.per_user?
+
+      scope.joins(:agent).find_by(user_id: nil, users: { created_by_id: Current.user.id })
+    end
+
+    def connection_check_client(user_key: nil, workspace: nil)
+      Collavre::CliProxy::Client.new(gateway: @agent_gateway, user_key: user_key, workspace: workspace)
+    end
+
+    def render_connection_check(data, identity:)
+      render json: {
+        ok: true,
+        identity_verified: true,
+        identity: identity,
+        engines: Array(data["data"]).pluck("engine")
+      }
+    end
+
+    def render_identity_unverified(data = {})
+      render json: {
+        ok: true,
+        identity_verified: false,
+        engines: Array(data["data"]).pluck("engine"),
+        warning: t("collavre.agent_gateways.identity_unverified")
+      }
+    end
+  end
+end