@burdenoff/microfe-vibecontrols 2026.1011.1 → 2026.1013.1

package/dist/components/agents/CheckSessionHealthDialog.js

@@ -0,0 +1,19 @@
+import { useTr as e } from "../../shared/hooks/useTr.js";
+import { ConfirmDialog as t } from "../shared/ConfirmDialog.js";
+import { jsx as n } from "react/jsx-runtime";
+//#region src/components/agents/CheckSessionHealthDialog.tsx
+function r({ isOpen: r, onClose: i, onConfirm: a, isLoading: o = !1, message: s }) {
+	let c = e();
+	return /* @__PURE__ */ n(t, {
+		isOpen: r,
+		onClose: i,
+		onConfirm: a,
+		title: c("agentDetails.checkSessionHealthTitle", "Check session health?"),
+		message: s ?? c("agentDetails.checkSessionHealthMessage", "This checks every running session in the whole workspace, not only this agent’s. Any session whose agent reports it dead or cannot be reached is marked stopped, including sessions that belong to other agents."),
+		confirmLabel: c("agentDetails.checkSessionHealthConfirm", "Check all sessions"),
+		variant: "warning",
+		isLoading: o
+	});
+}
+//#endregion
+export { r as CheckSessionHealthDialog };

package/dist/components/agents/GatewayAuthCard.js

@@ -1,281 +1,271 @@
-import { useSetupAgentGatewayAuthMutation as e, useUpdateAgentMutation as t } from "../../generated/wspace-operations.js";
-import { useTr as n } from "../../shared/hooks/useTr.js";
-import { ConfirmDialog as r } from "../shared/ConfirmDialog.js";
-import { Card as i } from "../shared/Card.js";
+import { useUpdateAgentMutation as e } from "../../generated/wspace-operations.js";
+import { useTr as t } from "../../shared/hooks/useTr.js";
+import { ConfirmDialog as n } from "../shared/ConfirmDialog.js";
+import { Card as r } from "../shared/Card.js";
 import "../shared/index.js";
-import { isNative as a, nativeCopyText as o, nativeToast as s } from "../../utils/nativeBridge.js";
-import { useState as c } from "react";
-import { Check as l, Copy as u, Eye as d, EyeOff as f, Link2 as p, Loader2 as m, Monitor as h, RefreshCw as g, Shield as _, Unlink as v, X as y } from "lucide-react";
-import { Fragment as b, jsx as x, jsxs as S } from "react/jsx-runtime";
-import { Button as C } from "@burdenoff/fe-libs/ui";
+import { isNative as i, nativeCopyText as a, nativeToast as o } from "../../utils/nativeBridge.js";
+import { notify as s } from "../../lib/toast.js";
+import { VIBE_PERMISSIONS as c } from "../../constants/permissions.js";
+import { useRepairGatewayAuth as l } from "../../hooks/useRepairGatewayAuth.js";
+import { OneTimeSecretPanel as u } from "./OneTimeSecretPanel.js";
+import { RepairGatewayAuthDialog as d } from "./RepairGatewayAuthDialog.js";
+import { useState as f } from "react";
+import { Check as p, Copy as m, Link2 as h, Loader2 as g, Monitor as _, RefreshCw as v, Shield as y, Unlink as b, X as x } from "lucide-react";
+import { Fragment as S, jsx as C, jsxs as w } from "react/jsx-runtime";
+import { Button as T } from "@burdenoff/fe-libs/ui";
+import { PermissionButton as E } from "@burdenoff/fe-libs/shared/components";
 //#region src/components/agents/GatewayAuthCard.tsx
-function w({ agent: w, onUpdate: T }) {
-	let E = n(), [D] = t(), [O] = e(), [k, A] = c(!1), [j, M] = c(null), [N, P] = c(!1), [F, I] = c(null), [L, R] = c(!1), [z, B] = c(!1), [V, H] = c(!1), [U, W] = c(!1), G = !!(w.appId && w.appClientId), K = w.metadata?.devportalApplicationId, q = async () => {
-		A(!0), M(null);
+function D({ agent: D, onUpdate: O }) {
+	let k = t(), [A] = e(), { repair: j, running: M, rotationEpoch: N } = l(D.id), [P, F] = f(!1), [I, L] = f(null), [R, z] = f(null), B = R && R.epoch === N ? R : null, [V, H] = f(!1), [U, W] = f(!1), [G, K] = f(!1), [q, J] = f(!1), Y = !!(D.appId && D.appClientId), X = D.metadata?.devportalApplicationId, Z = async () => {
+		F(!0), L(null);
 		try {
-			let { data: e } = await O({ variables: { input: { agentId: w.id } } }), t = e?.setupAgentGatewayAuth;
-			if (!t) throw Error(E("agentDetails.gatewayAuthNoResultError", "No result returned from setupAgentGatewayAuth"));
-			I(t.clientSecret), t.error && M(t.error), T();
-		} catch (e) {
-			M(e instanceof Error ? e.message : E("agentDetails.failedSetupGatewayAuth", "Failed to set up gateway auth"));
+			let e = await j();
+			if (e.status === "busy") {
+				L(k("agentDetails.repairAlreadyRunning", "A repair for this agent is already running. Wait for it to finish."));
+				return;
+			}
+			if (e.status === "failed") {
+				L(e.message || k("agentDetails.failedSetupGatewayAuth", "Failed to set up gateway auth"));
+				return;
+			}
+			if (e.status === "unchanged") {
+				s.info(k("agentDetails.repairUnchanged", "Nothing was changed: a credential push for this agent is already in progress or has just completed.")), O();
+				return;
+			}
+			z({
+				value: e.clientSecret,
+				delivered: e.status === "ok",
+				epoch: e.epoch
+			}), e.status === "delivery-failed" && L(e.error), O();
 		} finally {
-			A(!1);
+			F(!1);
 		}
-	}, J = async () => {
-		H(!0), M(null);
+	}, Q = async () => {
+		W(!0), L(null);
 		try {
-			await D({ variables: {
-				id: w.id,
+			await A({ variables: {
+				id: D.id,
 				input: {
 					appId: null,
 					appClientId: null
 				}
-			} }), I(null), W(!1), T();
+			} }), z(null), K(!1), O();
 		} catch (e) {
-			W(!1), M(e instanceof Error ? e.message : E("agentDetails.failedUnlinkApp", "Failed to unlink app"));
+			K(!1), L(e instanceof Error ? e.message : k("agentDetails.failedUnlinkApp", "Failed to unlink app"));
 		} finally {
-			H(!1);
+			W(!1);
 		}
 	};
-	return /* @__PURE__ */ S(i, {
+	return /* @__PURE__ */ w(r, {
 		padding: "none",
 		children: [
-			/* @__PURE__ */ x("div", {
+			/* @__PURE__ */ C("div", {
 				className: "p-4 border-b border-border-default",
-				children: /* @__PURE__ */ S("h3", {
+				children: /* @__PURE__ */ w("h3", {
 					className: "font-semibold text-text-primary flex items-center gap-2",
-					children: [/* @__PURE__ */ x(_, {
+					children: [/* @__PURE__ */ C(y, {
 						className: "size-5",
 						"aria-hidden": "true"
-					}), E("agentDetails.gatewayAuthTitle", "Gateway Auth (OAuth2)")]
+					}), k("agentDetails.gatewayAuthTitle", "Gateway Auth (OAuth2)")]
 				})
 			}),
-			/* @__PURE__ */ S("div", {
+			/* @__PURE__ */ w("div", {
 				className: "p-4 space-y-3",
-				children: [j && /* @__PURE__ */ S("div", {
+				children: [I && /* @__PURE__ */ w("div", {
 					role: "alert",
 					className: "flex items-center gap-2 p-3 bg-status-error-bg-subtle border border-status-error-border text-status-error-text rounded-md text-sm",
 					children: [
-						/* @__PURE__ */ x(y, {
+						/* @__PURE__ */ C(x, {
 							className: "size-4 flex-shrink-0",
 							"aria-hidden": "true"
 						}),
-						/* @__PURE__ */ x("span", {
+						/* @__PURE__ */ C("span", {
 							className: "flex-1 min-w-0 break-words",
-							children: j
+							children: I
 						}),
-						/* @__PURE__ */ x("button", {
+						/* @__PURE__ */ C("button", {
 							type: "button",
-							onClick: () => M(null),
-							"aria-label": E("agentDetails.dismissError", "Dismiss error"),
+							onClick: () => L(null),
+							"aria-label": k("agentDetails.dismissError", "Dismiss error"),
 							className: "flex-shrink-0 p-0.5 hover:bg-status-error-border/40 rounded focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-border-focus",
-							children: /* @__PURE__ */ x(y, {
+							children: /* @__PURE__ */ C(x, {
 								className: "size-3.5",
 								"aria-hidden": "true"
 							})
 						})
 					]
-				}), G ? /* @__PURE__ */ S(b, { children: [
-					/* @__PURE__ */ S("div", {
+				}), Y ? /* @__PURE__ */ w(S, { children: [
+					/* @__PURE__ */ w("div", {
 						className: "flex items-start gap-3",
-						children: [/* @__PURE__ */ x("div", {
+						children: [/* @__PURE__ */ C("div", {
 							className: "size-8 rounded-lg bg-status-success-bg-subtle flex items-center justify-center flex-shrink-0 mt-0.5",
-							children: /* @__PURE__ */ x(p, {
+							children: /* @__PURE__ */ C(h, {
 								className: "size-4 text-status-success-text",
 								"aria-hidden": "true"
 							})
-						}), /* @__PURE__ */ S("div", {
+						}), /* @__PURE__ */ w("div", {
 							className: "flex-1 min-w-0 space-y-2",
-							children: [/* @__PURE__ */ S("div", { children: [/* @__PURE__ */ x("p", {
+							children: [/* @__PURE__ */ w("div", { children: [/* @__PURE__ */ C("p", {
 								className: "text-sm font-medium text-text-primary",
-								children: E("agentDetails.linkedToOauthApp", "Linked to OAuth App")
-							}), /* @__PURE__ */ x("p", {
+								children: k("agentDetails.linkedToOauthApp", "Linked to OAuth App")
+							}), /* @__PURE__ */ C("p", {
 								className: "text-xs text-text-muted",
-								children: E("agentDetails.gatewayAuthLinkedDescription", "This agent can authenticate with the API gateway using Client Credentials.")
-							})] }), /* @__PURE__ */ S("div", {
+								children: k("agentDetails.gatewayAuthLinkedDescription", "This agent can authenticate with the API gateway using Client Credentials.")
+							})] }), /* @__PURE__ */ w("div", {
 								className: "grid grid-cols-1 sm:grid-cols-2 gap-3",
-								children: [/* @__PURE__ */ S("div", {
+								children: [/* @__PURE__ */ w("div", {
 									className: "min-w-0",
-									children: [/* @__PURE__ */ x("p", {
+									children: [/* @__PURE__ */ C("p", {
 										className: "text-xs text-text-secondary mb-1",
-										children: E("agentDetails.clientId", "Client ID")
-									}), /* @__PURE__ */ S("div", {
+										children: k("agentDetails.clientId", "Client ID")
+									}), /* @__PURE__ */ w("div", {
 										className: "flex items-center gap-2",
-										children: [/* @__PURE__ */ x("code", {
+										children: [/* @__PURE__ */ C("code", {
 											className: "text-xs font-mono text-text-primary bg-bg-sunken px-2 py-1 rounded truncate block flex-1 min-w-0",
-											children: w.appClientId
-										}), /* @__PURE__ */ x("button", {
+											children: D.appClientId
+										}), /* @__PURE__ */ C("button", {
 											type: "button",
 											onClick: async () => {
-												if (w.appClientId) try {
-													await o(w.appClientId), a() && s("Copied"), B(!0), setTimeout(() => B(!1), 2e3);
+												if (D.appClientId) try {
+													await a(D.appClientId), i() && o("Copied"), H(!0), setTimeout(() => H(!1), 2e3);
 												} catch {}
 											},
-											"aria-label": E("agentDetails.copyClientId", "Copy Client ID"),
-											title: E("agentDetails.copyClientId", "Copy Client ID"),
+											"aria-label": k("agentDetails.copyClientId", "Copy Client ID"),
+											title: k("agentDetails.copyClientId", "Copy Client ID"),
 											className: "p-1 rounded hover:bg-bg-sunken transition-colors flex-shrink-0 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-border-focus",
-											children: z ? /* @__PURE__ */ x(l, {
+											children: V ? /* @__PURE__ */ C(p, {
 												className: "size-3.5 text-status-success-text",
 												"aria-hidden": "true"
-											}) : /* @__PURE__ */ x(u, {
+											}) : /* @__PURE__ */ C(m, {
 												className: "size-3.5 text-text-secondary",
 												"aria-hidden": "true"
 											})
 										})]
 									})]
-								}), /* @__PURE__ */ S("div", {
+								}), /* @__PURE__ */ w("div", {
 									className: "min-w-0",
-									children: [/* @__PURE__ */ x("p", {
+									children: [/* @__PURE__ */ C("p", {
 										className: "text-xs text-text-secondary mb-1",
-										children: E("agentDetails.appId", "App ID")
-									}), /* @__PURE__ */ x("code", {
+										children: k("agentDetails.appId", "App ID")
+									}), /* @__PURE__ */ C("code", {
 										className: "text-xs font-mono text-text-muted bg-bg-sunken px-2 py-1 rounded truncate block",
-										children: w.appId
+										children: D.appId
 									})]
 								})]
 							})]
 						})]
 					}),
-					F && /* @__PURE__ */ S("div", {
-						className: "p-3 bg-status-warning-bg-subtle border border-status-warning-border rounded-card space-y-2",
-						children: [
-							/* @__PURE__ */ x("p", {
-								className: "text-sm font-medium text-status-warning-text",
-								children: E("agentDetails.clientSecretOneTimeTitle", "Client Secret (one-time display)")
-							}),
-							/* @__PURE__ */ x("p", {
-								className: "text-xs text-text-secondary",
-								children: E("agentDetails.clientSecretOneTimeDescription", "This secret has been automatically sent to the agent. Save it now if you need it — it won't be shown again.")
-							}),
-							/* @__PURE__ */ S("div", {
-								className: "flex items-center gap-2",
-								children: [
-									/* @__PURE__ */ x("code", {
-										className: "text-xs font-mono text-text-primary bg-bg-sunken px-2 py-1 rounded flex-1 min-w-0 truncate",
-										children: N ? F : "•".repeat(32)
-									}),
-									/* @__PURE__ */ x("button", {
-										type: "button",
-										onClick: () => P(!N),
-										"aria-label": N ? E("agentDetails.hideClientSecret", "Hide client secret") : E("agentDetails.showClientSecret", "Show client secret"),
-										className: "p-1 rounded hover:bg-bg-sunken transition-colors flex-shrink-0 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-border-focus",
-										children: x(N ? f : d, {
-											className: "size-3.5 text-text-secondary",
-											"aria-hidden": "true"
-										})
-									}),
-									/* @__PURE__ */ x("button", {
-										type: "button",
-										onClick: async () => {
-											if (F) try {
-												await o(F), a() && s("Secret copied"), R(!0), setTimeout(() => R(!1), 2e3);
-											} catch {}
-										},
-										"aria-label": E("agentDetails.copyClientSecret", "Copy client secret"),
-										className: "p-1 rounded hover:bg-bg-sunken transition-colors flex-shrink-0 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-border-focus",
-										children: L ? /* @__PURE__ */ x(l, {
-											className: "size-3.5 text-status-success-text",
-											"aria-hidden": "true"
-										}) : /* @__PURE__ */ x(u, {
-											className: "size-3.5 text-text-secondary",
-											"aria-hidden": "true"
-										})
-									})
-								]
-							})
-						]
-					}),
-					/* @__PURE__ */ S("div", {
+					B && /* @__PURE__ */ C(u, {
+						secret: B.value,
+						description: B.delivered ? void 0 : k("agentDetails.clientSecretNotDelivered", "This secret could not be delivered to the agent, and the previous one no longer works. Save it now and configure the agent with it, or run Repair again once the agent is reachable — it won't be shown again.")
+					}, B.epoch),
+					/* @__PURE__ */ w("div", {
 						className: "flex flex-wrap items-center gap-2",
 						children: [
-							K && /* @__PURE__ */ S("a", {
-								href: `/devportal/apps/${K}`,
+							X && /* @__PURE__ */ w("a", {
+								href: `/devportal/apps/${X}`,
 								className: "inline-flex items-center gap-2 px-3 py-1.5 text-xs font-medium text-text-primary bg-bg-sunken hover:bg-bg-elevated rounded-button transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-border-focus",
-								children: [/* @__PURE__ */ x(h, {
+								children: [/* @__PURE__ */ C(_, {
 									className: "size-3",
 									"aria-hidden": "true"
-								}), E("agentDetails.viewInDeveloperPortal", "View in Developer Portal")]
+								}), k("agentDetails.viewInDeveloperPortal", "View in Developer Portal")]
 							}),
-							/* @__PURE__ */ S(C, {
-								type: "button",
-								variant: "secondary",
-								size: "sm",
-								onClick: () => void q(),
-								disabled: k,
-								"aria-busy": k,
-								title: E("agentDetails.repushCredentialsTitle", "Rotate the OAuth secret and push it to the agent. Use this if the agent shows degraded with \"boot state awaiting-config\"."),
-								children: [k ? /* @__PURE__ */ x(m, {
-									className: "size-3 animate-spin",
-									"aria-hidden": "true"
-								}) : /* @__PURE__ */ x(g, {
-									className: "size-3",
-									"aria-hidden": "true"
-								}), E("agentDetails.repushCredentials", "Re-push credentials")]
+							/* @__PURE__ */ C(E, {
+								permission: c.AGENT_UPDATE,
+								deniedBehavior: "disable",
+								deniedTooltip: k("agentDetails.repushCredentialsDenied", "You don't have permission to update agents"),
+								children: /* @__PURE__ */ w(T, {
+									type: "button",
+									variant: "secondary",
+									size: "sm",
+									onClick: () => J(!0),
+									disabled: P || M,
+									"aria-busy": P || M,
+									title: k("agentDetails.repushCredentialsTitle", "Rotate the OAuth secret and push it to the agent. Use this if the agent shows degraded with \"boot state awaiting-config\"."),
+									children: [P ? /* @__PURE__ */ C(g, {
+										className: "size-3 animate-spin",
+										"aria-hidden": "true"
+									}) : /* @__PURE__ */ C(v, {
+										className: "size-3",
+										"aria-hidden": "true"
+									}), k("agentDetails.repushCredentials", "Re-push credentials")]
+								})
 							}),
-							/* @__PURE__ */ S(C, {
+							/* @__PURE__ */ w(T, {
 								type: "button",
 								variant: "ghost",
 								size: "sm",
-								onClick: () => W(!0),
-								disabled: V,
-								"aria-busy": V,
+								onClick: () => K(!0),
+								disabled: U,
+								"aria-busy": U,
 								className: "text-status-error-text hover:bg-status-error-bg-subtle hover:text-status-error-text",
-								children: [V ? /* @__PURE__ */ x(m, {
+								children: [U ? /* @__PURE__ */ C(g, {
 									className: "size-3 animate-spin",
 									"aria-hidden": "true"
-								}) : /* @__PURE__ */ x(v, {
+								}) : /* @__PURE__ */ C(b, {
 									className: "size-3",
 									"aria-hidden": "true"
-								}), E("agentDetails.unlinkApp", "Unlink App")]
+								}), k("agentDetails.unlinkApp", "Unlink App")]
 							})
 						]
 					})
-				] }) : /* @__PURE__ */ S(b, { children: [/* @__PURE__ */ S("div", {
+				] }) : /* @__PURE__ */ w(S, { children: [/* @__PURE__ */ w("div", {
 					className: "flex items-start gap-3",
-					children: [/* @__PURE__ */ x("div", {
+					children: [/* @__PURE__ */ C("div", {
 						className: "size-8 rounded-lg bg-bg-sunken flex items-center justify-center flex-shrink-0 mt-0.5",
-						children: /* @__PURE__ */ x(_, {
+						children: /* @__PURE__ */ C(y, {
 							className: "size-4 text-text-muted",
 							"aria-hidden": "true"
 						})
-					}), /* @__PURE__ */ S("div", {
+					}), /* @__PURE__ */ w("div", {
 						className: "flex-1 min-w-0",
-						children: [/* @__PURE__ */ x("p", {
+						children: [/* @__PURE__ */ C("p", {
 							className: "text-sm font-medium text-text-primary",
-							children: E("agentDetails.noOauthAppLinked", "No OAuth App Linked")
-						}), /* @__PURE__ */ x("p", {
+							children: k("agentDetails.noOauthAppLinked", "No OAuth App Linked")
+						}), /* @__PURE__ */ C("p", {
 							className: "text-xs text-text-muted mt-0.5",
-							children: E("agentDetails.gatewayAuthSetupDescription", "Set up gateway auth to allow this agent to communicate with the API gateways using OAuth2 Client Credentials. This creates an OAuth app, registers it in the Developer Portal, and pushes the credentials to the agent.")
+							children: k("agentDetails.gatewayAuthSetupDescription", "Set up gateway auth to allow this agent to communicate with the API gateways using OAuth2 Client Credentials. This creates an OAuth app, registers it in the Developer Portal, and pushes the credentials to the agent.")
 						})]
 					})]
-				}), /* @__PURE__ */ x(C, {
+				}), /* @__PURE__ */ C(T, {
 					type: "button",
-					onClick: () => void q(),
-					disabled: k,
-					"aria-busy": k,
-					children: k ? /* @__PURE__ */ S(b, { children: [/* @__PURE__ */ x(m, {
+					onClick: () => void Z(),
+					disabled: P,
+					"aria-busy": P,
+					children: P ? /* @__PURE__ */ w(S, { children: [/* @__PURE__ */ C(g, {
 						className: "size-4 animate-spin",
 						"aria-hidden": "true"
-					}), E("agentDetails.settingUp", "Setting up...")] }) : /* @__PURE__ */ S(b, { children: [/* @__PURE__ */ x(p, {
+					}), k("agentDetails.settingUp", "Setting up...")] }) : /* @__PURE__ */ w(S, { children: [/* @__PURE__ */ C(h, {
 						className: "size-4",
 						"aria-hidden": "true"
-					}), E("agentDetails.setupGatewayAuth", "Setup Gateway Auth")] })
+					}), k("agentDetails.setupGatewayAuth", "Setup Gateway Auth")] })
 				})] })]
 			}),
-			/* @__PURE__ */ x(r, {
-				isOpen: U,
+			/* @__PURE__ */ C(d, {
+				isOpen: q,
+				onClose: () => {
+					P || J(!1);
+				},
+				onConfirm: () => {
+					Z().finally(() => J(!1));
+				},
+				agentName: D.name,
+				isLoading: P
+			}),
+			/* @__PURE__ */ C(n, {
+				isOpen: G,
 				onClose: () => {
-					V || W(!1);
+					U || K(!1);
 				},
-				onConfirm: () => void J(),
-				title: E("agentDetails.unlinkApp", "Unlink App"),
-				message: E("agentDetails.confirmUnlinkOauthApp", "Remove the linked OAuth app from this agent? The app will still exist in auth-svc."),
-				confirmLabel: E("agentDetails.unlinkApp", "Unlink App"),
+				onConfirm: () => void Q(),
+				title: k("agentDetails.unlinkApp", "Unlink App"),
+				message: k("agentDetails.confirmUnlinkOauthApp", "Remove the linked OAuth app from this agent? The app will still exist in auth-svc."),
+				confirmLabel: k("agentDetails.unlinkApp", "Unlink App"),
 				variant: "danger",
-				isLoading: V
+				isLoading: U
 			})
 		]
 	});
 }
 //#endregion
-export { w as GatewayAuthCard };
+export { D as GatewayAuthCard };

package/dist/components/agents/OneTimeSecretPanel.js

@@ -0,0 +1,79 @@
+import { useTr as e } from "../../shared/hooks/useTr.js";
+import { isNative as t, nativeCopyText as n, nativeToast as r } from "../../utils/nativeBridge.js";
+import { notify as i } from "../../lib/toast.js";
+import { useEffect as a, useRef as o, useState as s } from "react";
+import { Check as c, Copy as l, Eye as u, EyeOff as d } from "lucide-react";
+import { jsx as f, jsxs as p } from "react/jsx-runtime";
+import { Button as m } from "@burdenoff/fe-libs/ui";
+//#region src/components/agents/OneTimeSecretPanel.tsx
+function h({ secret: h, description: g, onDismiss: _ }) {
+	let v = e(), [y, b] = s(!1), [x, S] = s(!1), C = o(void 0);
+	a(() => () => clearTimeout(C.current), []);
+	let w = async () => {
+		if (!await n(h).catch(() => !1)) {
+			i.error(v("agentDetails.copyClientSecretFailed", "The secret could not be copied. Show it and copy it by hand: it will not be shown again."));
+			return;
+		}
+		t() && r("Secret copied"), S(!0), clearTimeout(C.current), C.current = setTimeout(() => S(!1), 2e3);
+	};
+	return /* @__PURE__ */ p("div", {
+		"data-testid": "one-time-secret-panel",
+		className: "p-3 bg-status-warning-bg-subtle border border-status-warning-border rounded-card space-y-2",
+		children: [
+			/* @__PURE__ */ f("p", {
+				className: "text-sm font-medium text-status-warning-text",
+				children: v("agentDetails.clientSecretOneTimeTitle", "Client Secret (one-time display)")
+			}),
+			/* @__PURE__ */ f("p", {
+				className: "text-xs text-text-secondary",
+				children: g ?? v("agentDetails.clientSecretOneTimeDescription", "This secret has been automatically sent to the agent. Save it now if you need it — it won't be shown again.")
+			}),
+			/* @__PURE__ */ p("div", {
+				className: "flex items-center gap-2",
+				children: [
+					/* @__PURE__ */ f("code", {
+						"data-testid": "one-time-secret-value",
+						className: "text-xs font-mono text-text-primary bg-bg-sunken px-2 py-1 rounded flex-1 min-w-0 truncate",
+						children: y ? h : "•".repeat(32)
+					}),
+					/* @__PURE__ */ f("button", {
+						type: "button",
+						onClick: () => b(!y),
+						"aria-label": y ? v("agentDetails.hideClientSecret", "Hide client secret") : v("agentDetails.showClientSecret", "Show client secret"),
+						className: "p-1 rounded hover:bg-bg-sunken transition-colors flex-shrink-0 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-border-focus",
+						children: f(y ? d : u, {
+							className: "size-3.5 text-text-secondary",
+							"aria-hidden": "true"
+						})
+					}),
+					/* @__PURE__ */ f("button", {
+						type: "button",
+						onClick: () => void w(),
+						"aria-label": v("agentDetails.copyClientSecret", "Copy client secret"),
+						className: "p-1 rounded hover:bg-bg-sunken transition-colors flex-shrink-0 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-border-focus",
+						children: x ? /* @__PURE__ */ f(c, {
+							className: "size-3.5 text-status-success-text",
+							"aria-hidden": "true"
+						}) : /* @__PURE__ */ f(l, {
+							className: "size-3.5 text-text-secondary",
+							"aria-hidden": "true"
+						})
+					})
+				]
+			}),
+			_ && /* @__PURE__ */ f("div", {
+				className: "flex justify-end",
+				children: /* @__PURE__ */ f(m, {
+					type: "button",
+					size: "sm",
+					variant: "ghost",
+					"data-testid": "one-time-secret-dismiss",
+					onClick: _,
+					children: v("agentDetails.dismissSecret", "Dismiss")
+				})
+			})
+		]
+	});
+}
+//#endregion
+export { h as OneTimeSecretPanel };

package/dist/components/agents/RepairGatewayAuthDialog.js

@@ -0,0 +1,19 @@
+import { useTr as e } from "../../shared/hooks/useTr.js";
+import { ConfirmDialog as t } from "../shared/ConfirmDialog.js";
+import { jsx as n } from "react/jsx-runtime";
+//#region src/components/agents/RepairGatewayAuthDialog.tsx
+function r({ isOpen: r, onClose: i, onConfirm: a, agentName: o, isLoading: s = !1 }) {
+	let c = e();
+	return /* @__PURE__ */ n(t, {
+		isOpen: r,
+		onClose: i,
+		onConfirm: a,
+		title: c("agentDetails.repairGatewayAuthTitle", "Repair gateway auth?"),
+		message: c("agentDetails.repairGatewayAuthMessage", "This rotates the OAuth secret of \"{{name}}\" and pushes a new one to the agent. The current secret stops working immediately, and the OAuth app is re-attributed to you. Only continue if the agent reports that it is waiting for its credentials.", { name: o }),
+		confirmLabel: c("agentDetails.repairGatewayAuthConfirm", "Rotate and push"),
+		variant: "warning",
+		isLoading: s
+	});
+}
+//#endregion
+export { r as RepairGatewayAuthDialog };

package/dist/components/agents/index.js

@@ -4,8 +4,11 @@ import "./RemoteTaskPermissionsCard.js";
 import "./AgentVisibilityCard.js";
 import "./AgentList.js";
 import "./AgentForm.js";
+import "./OneTimeSecretPanel.js";
+import "./RepairGatewayAuthDialog.js";
 import "./GatewayAuthCard.js";
 import "./ConfigureAgentDialog.js";
+import "./CheckSessionHealthDialog.js";
 import "./CreateSessionDialog.js";
 import "./PluginUIPanel.js";
 import "./OpenInBrowserEditorButton.js";

package/dist/hooks/useRepairGatewayAuth.js

@@ -0,0 +1,59 @@
+import { useSetupAgentGatewayAuthMutation as e } from "../generated/wspace-operations.js";
+import { useCallback as t, useSyncExternalStore as n } from "react";
+//#region src/hooks/useRepairGatewayAuth.ts
+var r = /* @__PURE__ */ new Set(), i = /* @__PURE__ */ new Map(), a = /* @__PURE__ */ new Set();
+function o() {
+	for (let e of a) e();
+}
+function s(e) {
+	let t = (i.get(e) ?? 0) + 1;
+	return i.set(e, t), o(), t;
+}
+function c(e) {
+	return a.add(e), () => {
+		a.delete(e);
+	};
+}
+function l(a) {
+	let [l] = e(), u = n(c, () => a ? r.has(a) : !1, () => !1), d = n(c, () => a ? i.get(a) ?? 0 : 0, () => 0);
+	return {
+		repair: t(async () => {
+			if (!a) return {
+				status: "failed",
+				message: "No agent"
+			};
+			if (r.has(a)) return { status: "busy" };
+			r.add(a), o();
+			try {
+				let { data: e, error: t } = await l({ variables: { input: { agentId: a } } }), n = e?.setupAgentGatewayAuth;
+				return n ? n.error ? n.clientSecret ? {
+					status: "delivery-failed",
+					clientSecret: n.clientSecret,
+					error: n.error,
+					epoch: s(a)
+				} : {
+					status: "failed",
+					message: n.error
+				} : n.clientSecret ? {
+					status: "ok",
+					clientSecret: n.clientSecret,
+					epoch: s(a)
+				} : { status: "unchanged" } : {
+					status: "failed",
+					message: t?.message || "No result returned from setupAgentGatewayAuth"
+				};
+			} catch (e) {
+				return {
+					status: "failed",
+					message: e instanceof Error ? e.message : String(e)
+				};
+			} finally {
+				r.delete(a), o();
+			}
+		}, [a, l]),
+		running: u,
+		rotationEpoch: d
+	};
+}
+//#endregion
+export { l as useRepairGatewayAuth };