@app-vitals/agent-admin 0.0.1 → 0.1.0

package/src/agent-account-assignment.ts

@@ -0,0 +1,49 @@
+/**
+ * admin/src/agent-account-assignment.ts
+ * Post-assignment side effect for SSP-5.3 (admin assign/reassign an agent to
+ * an account). The task-store scope resolver reads Agent.accountId live, so no
+ * token re-mint is needed — only the tenant pod label / CPU limit (SSP-7.1)
+ * has to be re-applied, by reconciling the single agent's workload.
+ */
+
+import type { AgentAnthropicIdentity } from "./agent-anthropic-identity.ts";
+import type { AgentProvisioner } from "./agent-provisioner.ts";
+
+/**
+ * Reconciles the agent's K8s workload after its accountId changed. Self-hosted
+ * agents have no workload, so they are skipped. Never throws: the DB change is
+ * already committed, so a reconcile failure is returned as a warning string
+ * (the next full reconcile pass will converge it) instead of failing the call.
+ */
+export async function reconcileAgentAfterAccountChange(
+  provisioner: Pick<AgentProvisioner, "reconcile">,
+  agent: Partial<AgentAnthropicIdentity> & {
+    id: string;
+    name: string;
+    selfHosted: boolean;
+    accountId?: string | null;
+  },
+): Promise<string | undefined> {
+  if (agent.selfHosted) return undefined;
+  try {
+    const result = await provisioner.reconcile([
+      {
+        id: agent.id,
+        slug: agent.name,
+        accountId: agent.accountId ?? null,
+        ownerEmail: agent.ownerEmail,
+        anthropicIdentityName: agent.anthropicIdentityName,
+        anthropicServiceAccountId: agent.anthropicServiceAccountId,
+        anthropicFederationRuleId: agent.anthropicFederationRuleId,
+        k8sServiceAccountName: agent.k8sServiceAccountName,
+      },
+    ]);
+    const failure = result.failed.find((f) => f.agentId === agent.id);
+    return failure
+      ? `account updated, but reconciling the agent workload failed: ${failure.error}`
+      : undefined;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return `account updated, but reconciling the agent workload failed: ${message}`;
+  }
+}

package/src/agent-account-assignment.unit.test.ts

@@ -0,0 +1,99 @@
+import { describe, expect, it } from "bun:test";
+import { reconcileAgentAfterAccountChange } from "./agent-account-assignment.ts";
+
+interface Result {
+  recreated: string[];
+  orphans: string[];
+  failed: Array<{ agentId: string; error: string }>;
+  updated: string[];
+  migrated: string[];
+  noOwner: string[];
+  dryRun: boolean;
+}
+const EMPTY: Result = {
+  recreated: [],
+  migrated: [],
+  noOwner: [],
+  dryRun: false,
+  orphans: [],
+  failed: [],
+  updated: [],
+};
+
+function makeProvisioner(
+  impl: (agents: unknown[]) => Promise<Result> = async () => EMPTY,
+) {
+  const calls: unknown[][] = [];
+  return {
+    calls,
+    reconcile: async (agents: unknown[]) => {
+      calls.push(agents);
+      return impl(agents);
+    },
+  };
+}
+
+const agent = { id: "a1", name: "Bot", selfHosted: false, accountId: "acct" };
+
+describe("reconcileAgentAfterAccountChange", () => {
+  it("reconciles exactly the one in-cluster agent with its new accountId", async () => {
+    const p = makeProvisioner();
+    expect(await reconcileAgentAfterAccountChange(p, agent)).toBeUndefined();
+    expect(p.calls).toEqual([[{ id: "a1", slug: "Bot", accountId: "acct" }]]);
+  });
+
+  it("carries the agent's owner and identity fields into the reconcile target", async () => {
+    const p = makeProvisioner();
+    await reconcileAgentAfterAccountChange(p, {
+      ...agent,
+      ownerEmail: "jane.doe@example.com",
+      anthropicIdentityName: "jane-doe-a1",
+      anthropicServiceAccountId: "svac_1",
+      anthropicFederationRuleId: "fdrl_1",
+      k8sServiceAccountName: "a1",
+    });
+    expect(p.calls).toEqual([
+      [
+        {
+          id: "a1",
+          slug: "Bot",
+          accountId: "acct",
+          ownerEmail: "jane.doe@example.com",
+          anthropicIdentityName: "jane-doe-a1",
+          anthropicServiceAccountId: "svac_1",
+          anthropicFederationRuleId: "fdrl_1",
+          k8sServiceAccountName: "a1",
+        },
+      ],
+    ]);
+  });
+
+  it("passes null for a cleared account", async () => {
+    const p = makeProvisioner();
+    await reconcileAgentAfterAccountChange(p, { ...agent, accountId: null });
+    expect(p.calls).toEqual([[{ id: "a1", slug: "Bot", accountId: null }]]);
+  });
+
+  it("skips self-hosted agents", async () => {
+    const p = makeProvisioner();
+    await reconcileAgentAfterAccountChange(p, { ...agent, selfHosted: true });
+    expect(p.calls).toEqual([]);
+  });
+
+  it("returns a warning when reconcile reports a failure for the agent", async () => {
+    const p = makeProvisioner(async () => ({
+      ...EMPTY,
+      failed: [{ agentId: "a1", error: "k8s down" }],
+    }));
+    expect(await reconcileAgentAfterAccountChange(p, agent)).toContain(
+      "k8s down",
+    );
+  });
+
+  it("returns a warning instead of throwing when reconcile throws", async () => {
+    const p = makeProvisioner(async () => {
+      throw new Error("boom");
+    });
+    expect(await reconcileAgentAfterAccountChange(p, agent)).toContain("boom");
+  });
+});

package/src/agent-anthropic-identity.integration.test.ts

@@ -0,0 +1,99 @@
+/**
+ * admin/src/agent-anthropic-identity.integration.test.ts
+ * Integration tests for the PAI-1.1 owner / Anthropic identity columns on
+ * Agent against a real PostgreSQL DB.
+ *
+ * Requires DATABASE_URL_ADMIN_TEST to be set; skips otherwise.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import type { PrismaClient } from "../prisma/client/client.ts";
+import { AgentAnthropicIdentityService } from "./agent-anthropic-identity.ts";
+import { ConflictError, NotFoundError } from "./errors.ts";
+import { createAdminPrismaClient } from "./prisma-client.ts";
+
+const TEST_DB = process.env.DATABASE_URL_ADMIN_TEST;
+
+const describeOrSkip = TEST_DB ? describe : describe.skip;
+
+function makePrisma(): PrismaClient {
+  // TEST_DB is guaranteed set — the describe block is skipped otherwise.
+  return createAdminPrismaClient(TEST_DB as string);
+}
+
+describeOrSkip("AgentAnthropicIdentityService (integration)", () => {
+  let prisma: PrismaClient;
+  let service: AgentAnthropicIdentityService;
+
+  beforeEach(async () => {
+    prisma = makePrisma();
+    await prisma.agentPhaseMethodology.deleteMany();
+    await prisma.agentToken.deleteMany();
+    await prisma.agentCronJob.deleteMany();
+    await prisma.agentTool.deleteMany();
+    await prisma.agentEnv.deleteMany();
+    await prisma.agent.deleteMany();
+    service = new AgentAnthropicIdentityService(prisma);
+  });
+
+  afterEach(async () => {
+    await prisma.$disconnect();
+  });
+
+  it("a newly created agent has null identity fields", async () => {
+    const agent = await prisma.agent.create({ data: { name: "A" } });
+    expect(await service.get(agent.id)).toEqual({
+      ownerEmail: null,
+      anthropicIdentityName: null,
+      anthropicServiceAccountId: null,
+      anthropicFederationRuleId: null,
+      k8sServiceAccountName: null,
+    });
+  });
+
+  it("set() round-trips and supports partial updates", async () => {
+    const agent = await prisma.agent.create({ data: { name: "A" } });
+    await service.set(agent.id, {
+      ownerEmail: "o@example.com",
+      anthropicIdentityName: "agent-a",
+      anthropicServiceAccountId: "sa_1",
+      anthropicFederationRuleId: "fr_1",
+      k8sServiceAccountName: "agent-a-sa",
+    });
+    await service.set(agent.id, { ownerEmail: null });
+    expect(await service.get(agent.id)).toEqual({
+      ownerEmail: null,
+      anthropicIdentityName: "agent-a",
+      anthropicServiceAccountId: "sa_1",
+      anthropicFederationRuleId: "fr_1",
+      k8sServiceAccountName: "agent-a-sa",
+    });
+  });
+
+  it("rejects a duplicate anthropicIdentityName with ConflictError", async () => {
+    const a = await prisma.agent.create({ data: { name: "A" } });
+    const b = await prisma.agent.create({ data: { name: "B" } });
+    await service.set(a.id, { anthropicIdentityName: "dup" });
+    await expect(
+      service.set(b.id, { anthropicIdentityName: "dup" }),
+    ).rejects.toBeInstanceOf(ConflictError);
+  });
+
+  it("the unique index also rejects duplicates at the DB level", async () => {
+    await prisma.agent.create({
+      data: { name: "A", anthropicIdentityName: "dup" },
+    });
+    await expect(
+      (async () =>
+        prisma.agent.create({
+          data: { name: "B", anthropicIdentityName: "dup" },
+        }))(),
+    ).rejects.toThrow();
+  });
+
+  it("set() throws NotFoundError for an unknown agent", async () => {
+    await expect(
+      service.set("missing", { ownerEmail: "x@example.com" }),
+    ).rejects.toBeInstanceOf(NotFoundError);
+  });
+});

package/src/agent-anthropic-identity.ts

@@ -0,0 +1,78 @@
+/**
+ * admin/src/agent-anthropic-identity.ts
+ * AgentAnthropicIdentityService — typed read/update of an agent's owner and
+ * Anthropic identity columns (PAI-1.1). All fields are nullable; a duplicate
+ * anthropicIdentityName (unique index) surfaces as a ConflictError.
+ */
+
+import type { PrismaClient } from "../prisma/client/client.ts";
+import { ConflictError, NotFoundError } from "./errors.ts";
+
+export interface AgentAnthropicIdentity {
+  ownerEmail: string | null;
+  anthropicIdentityName: string | null;
+  anthropicServiceAccountId: string | null;
+  anthropicFederationRuleId: string | null;
+  k8sServiceAccountName: string | null;
+}
+
+/** Partial update — omitted keys are left untouched, null clears a field. */
+export type AgentAnthropicIdentityUpdate = Partial<AgentAnthropicIdentity>;
+
+const IDENTITY_SELECT = {
+  ownerEmail: true,
+  anthropicIdentityName: true,
+  anthropicServiceAccountId: true,
+  anthropicFederationRuleId: true,
+  k8sServiceAccountName: true,
+} as const satisfies Record<keyof AgentAnthropicIdentity, true>;
+
+const IDENTITY_KEYS = Object.keys(
+  IDENTITY_SELECT,
+) as (keyof AgentAnthropicIdentity)[];
+
+function prismaCode(err: unknown): unknown {
+  return (err as { code?: unknown } | null)?.code;
+}
+
+export class AgentAnthropicIdentityService {
+  constructor(private prisma: PrismaClient) {}
+
+  /** Returns the identity fields, or null if the agent does not exist. */
+  async get(agentId: string): Promise<AgentAnthropicIdentity | null> {
+    return this.prisma.agent.findUnique({
+      where: { id: agentId },
+      select: IDENTITY_SELECT,
+    });
+  }
+
+  /**
+   * Update the provided identity fields.
+   * @throws NotFoundError if the agent does not exist
+   * @throws ConflictError if anthropicIdentityName is already used
+   */
+  async set(
+    agentId: string,
+    update: AgentAnthropicIdentityUpdate,
+  ): Promise<AgentAnthropicIdentity> {
+    const data: AgentAnthropicIdentityUpdate = {};
+    for (const key of IDENTITY_KEYS) {
+      if (update[key] !== undefined) data[key] = update[key];
+    }
+    try {
+      return await this.prisma.agent.update({
+        where: { id: agentId },
+        data,
+        select: IDENTITY_SELECT,
+      });
+    } catch (err) {
+      if (prismaCode(err) === "P2002") {
+        throw new ConflictError("anthropicIdentityName is already in use");
+      }
+      if (prismaCode(err) === "P2025") {
+        throw new NotFoundError(`Agent ${agentId} not found`);
+      }
+      throw err;
+    }
+  }
+}

package/src/agent-anthropic-identity.unit.test.ts

@@ -0,0 +1,77 @@
+/**
+ * admin/src/agent-anthropic-identity.unit.test.ts
+ * Unit tests for AgentAnthropicIdentityService — Prisma error mapping and
+ * partial-update semantics against an injected prisma test double.
+ */
+
+import { describe, expect, it } from "bun:test";
+import { AgentAnthropicIdentityService } from "./agent-anthropic-identity.ts";
+import { ConflictError, NotFoundError } from "./errors.ts";
+
+type Row = Record<string, string | null>;
+
+function makeFakePrisma(opts: { row?: Row | null; updateError?: unknown }) {
+  const calls: { update?: unknown } = {};
+  const agent = {
+    async findUnique() {
+      return opts.row ?? null;
+    },
+    async update(args: { data: Row }) {
+      calls.update = args;
+      if (opts.updateError) throw opts.updateError;
+      return { ...(opts.row ?? {}), ...args.data };
+    },
+  };
+  // biome-ignore lint/suspicious/noExplicitAny: minimal prisma double
+  return { prisma: { agent } as any, calls };
+}
+
+const EMPTY = {
+  ownerEmail: null,
+  anthropicIdentityName: null,
+  anthropicServiceAccountId: null,
+  anthropicFederationRuleId: null,
+  k8sServiceAccountName: null,
+};
+
+describe("AgentAnthropicIdentityService", () => {
+  it("get() returns the five identity fields", async () => {
+    const { prisma } = makeFakePrisma({ row: { ...EMPTY } });
+    expect(await new AgentAnthropicIdentityService(prisma).get("a1")).toEqual(
+      EMPTY,
+    );
+  });
+
+  it("get() returns null for an unknown agent", async () => {
+    const { prisma } = makeFakePrisma({ row: null });
+    expect(await new AgentAnthropicIdentityService(prisma).get("x")).toBeNull();
+  });
+
+  it("set() only writes fields that are present", async () => {
+    const { prisma, calls } = makeFakePrisma({ row: { ...EMPTY } });
+    await new AgentAnthropicIdentityService(prisma).set("a1", {
+      ownerEmail: "o@example.com",
+    });
+    expect((calls.update as { data: unknown }).data).toEqual({
+      ownerEmail: "o@example.com",
+    });
+  });
+
+  it("set() maps P2002 to ConflictError", async () => {
+    const { prisma } = makeFakePrisma({ updateError: { code: "P2002" } });
+    await expect(
+      new AgentAnthropicIdentityService(prisma).set("a1", {
+        anthropicIdentityName: "dup",
+      }),
+    ).rejects.toBeInstanceOf(ConflictError);
+  });
+
+  it("set() maps P2025 to NotFoundError", async () => {
+    const { prisma } = makeFakePrisma({ updateError: { code: "P2025" } });
+    await expect(
+      new AgentAnthropicIdentityService(prisma).set("nope", {
+        ownerEmail: "x@example.com",
+      }),
+    ).rejects.toBeInstanceOf(NotFoundError);
+  });
+});

package/src/agent-ask-config.ts

@@ -0,0 +1,59 @@
+/**
+ * admin/src/agent-ask-config.ts
+ *
+ * Pure parser for the agent-to-agent ask flag and its allowlist (COS-31.1).
+ * Takes an injected env object (no process.env reads) so it is
+ * deterministically unit-testable; admin-boot reads it once at startup and
+ * injects the resolved config as deps. Same "enabled" convention as the
+ * self-serve flag (self-serve-config.ts).
+ *
+ * SHIPWRIGHT_AGENT_ASK_ALLOWLIST is a comma-separated list of directional
+ * `from>to` agent-id pairs. Empty (or absent) denies every pair; a malformed
+ * pair throws at boot, naming every offending entry.
+ */
+
+/** Structural env shape — accepts `process.env` or a plain test object. */
+type AgentAskEnv = Readonly<Record<string, string | undefined>>;
+
+export interface AgentAskConfig {
+  /** True only when SHIPWRIGHT_AGENT_ASK_ENABLED === "enabled". */
+  enabled: boolean;
+  /** Allowed directional pairs, each stored as `from>to`. */
+  allowlist: ReadonlySet<string>;
+}
+
+// One agent id on each side: no whitespace, no `>` and no `,`.
+const PAIR_RE = /^([^\s>,]+)\s*>\s*([^\s>,]+)$/;
+
+export function parseAgentAskConfig(env: AgentAskEnv): AgentAskConfig {
+  const enabled = env.SHIPWRIGHT_AGENT_ASK_ENABLED === "enabled";
+  const allowlist = new Set<string>();
+  const malformed: string[] = [];
+  for (const raw of (env.SHIPWRIGHT_AGENT_ASK_ALLOWLIST ?? "").split(",")) {
+    const entry = raw.trim();
+    if (!entry) continue;
+    const match = PAIR_RE.exec(entry);
+    if (!match) {
+      malformed.push(entry);
+      continue;
+    }
+    allowlist.add(`${match[1]}>${match[2]}`);
+  }
+  if (malformed.length > 0) {
+    throw new Error(
+      `[admin] invalid SHIPWRIGHT_AGENT_ASK_ALLOWLIST pair(s): ${malformed
+        .map((p) => JSON.stringify(p))
+        .join(", ")} (expected comma-separated from>to agent ids)`,
+    );
+  }
+  return { enabled, allowlist };
+}
+
+/** Whether `from` may ask `to` (directional; empty allowlist denies all). */
+export function isAskAllowed(
+  config: Pick<AgentAskConfig, "allowlist">,
+  from: string,
+  to: string,
+): boolean {
+  return config.allowlist.has(`${from}>${to}`);
+}

package/src/agent-ask-config.unit.test.ts

@@ -0,0 +1,70 @@
+/**
+ * admin/src/agent-ask-config.unit.test.ts
+ * Pure parser tests for the agent-ask flag and from>to allowlist (COS-31.1).
+ */
+
+import { describe, expect, it } from "bun:test";
+import { isAskAllowed, parseAgentAskConfig } from "./agent-ask-config.ts";
+
+describe("parseAgentAskConfig — flag", () => {
+  it('is on only for the literal "enabled"', () => {
+    expect(
+      parseAgentAskConfig({ SHIPWRIGHT_AGENT_ASK_ENABLED: "enabled" }).enabled,
+    ).toBe(true);
+  });
+
+  it('"true", "" and absent are off', () => {
+    for (const value of ["true", "", "Enabled", " enabled", undefined]) {
+      expect(
+        parseAgentAskConfig({ SHIPWRIGHT_AGENT_ASK_ENABLED: value }).enabled,
+      ).toBe(false);
+    }
+    expect(parseAgentAskConfig({}).enabled).toBe(false);
+  });
+});
+
+describe("parseAgentAskConfig — allowlist", () => {
+  it("parses comma-separated from>to pairs, trimming whitespace", () => {
+    const config = parseAgentAskConfig({
+      SHIPWRIGHT_AGENT_ASK_ALLOWLIST: " a > b ,c>d,, ",
+    });
+    expect([...config.allowlist].sort()).toEqual(["a>b", "c>d"]);
+    expect(isAskAllowed(config, "a", "b")).toBe(true);
+    expect(isAskAllowed(config, "c", "d")).toBe(true);
+  });
+
+  it("pairs are directional", () => {
+    const config = parseAgentAskConfig({
+      SHIPWRIGHT_AGENT_ASK_ALLOWLIST: "a>b",
+    });
+    expect(isAskAllowed(config, "b", "a")).toBe(false);
+    expect(isAskAllowed(config, "a", "c")).toBe(false);
+  });
+
+  it("an empty or absent allowlist denies every pair", () => {
+    for (const value of ["", "  ", " , ", undefined]) {
+      const config = parseAgentAskConfig({
+        SHIPWRIGHT_AGENT_ASK_ENABLED: "enabled",
+        SHIPWRIGHT_AGENT_ASK_ALLOWLIST: value,
+      });
+      expect(config.allowlist.size).toBe(0);
+      expect(isAskAllowed(config, "a", "b")).toBe(false);
+    }
+  });
+
+  it("a malformed pair throws naming it", () => {
+    for (const bad of ["ab", "a>", ">b", "a>b>c", "a b>c"]) {
+      expect(() =>
+        parseAgentAskConfig({
+          SHIPWRIGHT_AGENT_ASK_ALLOWLIST: `x>y,${bad}`,
+        }),
+      ).toThrow(JSON.stringify(bad));
+    }
+  });
+
+  it("names every malformed pair in one error", () => {
+    expect(() =>
+      parseAgentAskConfig({ SHIPWRIGHT_AGENT_ASK_ALLOWLIST: "one,a>b,two>" }),
+    ).toThrow(/"one".*"two>"/);
+  });
+});