Merge branch 'feat/dashboard-agent-ui' into feat/dashboard-agent-flows-watch

# Conflicts:
#	apps/webapp/app/components/dashboard-agent/view-actions.test.ts
#	apps/webapp/app/components/dashboard-agent/view-actions.ts

Author: kathiekiwi

apps/webapp/app/components/dashboard-agent/DashboardAgentMessages.tsx

@@ -23,6 +23,7 @@ import { stripModelImages } from "./model-markdown";
 import { reportBlockFromToolPart } from "./report-block-adapter";
 import { shouldShowLiveTurnError } from "./turn-error";
 import type { ResolvedUri } from "./ReportView";
+import { answerContinuesAfter } from "./view-actions";
 import { ViewBlocks } from "./view-catalog";
 import { findWakeWatch, WakeBanner, wakeRefFromMessageId, type WakeWatch } from "./WakeBanner";
 
@@ -246,6 +247,7 @@ const DashboardAgentTurn = memo(function DashboardAgentTurn({
               onIntent={onIntent}
               resolveUri={resolveUri}
               pagePaths={pagePaths}
+              answered={answerContinuesAfter(parts as never, i)}
             />
           </ChatCardSlot>
         );

apps/webapp/app/components/dashboard-agent/InvestigationCard.tsx

@@ -139,11 +139,14 @@ export function InvestigationCard({
   defaultExpanded = false,
   resolveUri,
   onIntent,
+  answered = false,
 }: {
   block: InvestigationBlock;
   defaultExpanded?: boolean;
   resolveUri?: ResolveUri;
   onIntent?: (intent: AgentIntent) => void;
+  /** The turn kept answering after this card, so "keep digging" has nothing to ask for. */
+  answered?: boolean;
 }) {
   const [expanded, setExpanded] = useState(defaultExpanded);
   const investigation = block.investigation;
@@ -237,7 +240,12 @@ export function InvestigationCard({
           ) : null}
         </div>
 
-        <InvestigationActions actions={block.capabilities?.actions ?? []} onIntent={onIntent} />
+        <InvestigationActions
+          actions={(block.capabilities?.actions ?? []).filter(
+            (action) => !answered || action.kind !== "ask_follow_up"
+          )}
+          onIntent={onIntent}
+        />
       </AgentCardBody>
     </AgentCard>
   );

apps/webapp/app/components/dashboard-agent/view-actions.test.ts

@@ -16,6 +16,7 @@ const watchAction: ActionsBlockAction = {
     },
   },
 };
+import { answerContinuesAfter, renderableActions } from "./view-actions";
 
 const askAction: ActionsBlockAction = {
   label: "Investigate it",
@@ -75,6 +76,18 @@ describe("one watch button per answer", () => {
         { label: "View similar", intent: { kind: "navigate", target: "trigger://x" } },
       ] as never)
     ).toEqual([{ label: "View similar", intent: { kind: "navigate", target: "trigger://x" } }]);
+describe("keep digging, only while there is digging left", () => {
+  const card = { type: "data-view" };
+  const text = (t: string) => ({ type: "text", text: t });
+
+  it("sees the answer the turn went on to give", () => {
+    expect(answerContinuesAfter([card, text("so here is why")] as never, 0)).toBe(true);
+  });
+
+  it("leaves a card the turn ended on", () => {
+    expect(answerContinuesAfter([text("looking"), card] as never, 1)).toBe(false);
+    // An empty trailing text part is not an answer.
+    expect(answerContinuesAfter([card, text("  ")] as never, 0)).toBe(false);
   });
 });
 

apps/webapp/app/components/dashboard-agent/view-actions.ts

@@ -32,3 +32,14 @@ export function cardAlreadyOffersWatch(blocks: ViewBlock[]): boolean {
 export function withoutWatchActions<T extends CardAction>(actions: T[]): T[] {
   return actions.filter((action) => action.intent.kind !== "watch");
 }
+
+/**
+ * "Keep digging" asks the agent to carry on — which is pointless once it already has.
+ * A turn that renders an inconclusive card and then keeps answering leaves the button
+ * offering work that is already done.
+ */
+export function answerContinuesAfter(parts: { type: string; text?: string }[], index: number) {
+  return parts
+    .slice(index + 1)
+    .some((part) => part.type === "text" && (part.text ?? "").trim().length > 0);
+}

apps/webapp/app/components/dashboard-agent/view-catalog.tsx

@@ -15,11 +15,14 @@ export function ViewBlocks({
   onIntent,
   resolveUri,
   pagePaths,
+  answered = false,
 }: {
   blocks: ViewBlock[];
   onIntent?: (intent: AgentIntent) => void;
   resolveUri?: (uri: string) => ResolvedUri | null;
   pagePaths?: Record<string, string>;
+  /** The turn kept answering after this card, so "keep digging" has nothing to ask for. */
+  answered?: boolean;
 }) {
   if (!Array.isArray(blocks)) return null;
   const rendered = latestRevisionBlocks(blocks);
@@ -52,6 +55,7 @@ export function ViewBlocks({
                 block={block}
                 resolveUri={resolveUri}
                 onIntent={onIntent}
+                answered={answered}
               />
             );
           // Host-emitted only, so the model cannot fabricate a confirmation.

apps/webapp/app/services/userActorEnvironment.server.ts

@@ -9,7 +9,12 @@
  */
 
 import { json } from "@remix-run/server-runtime";
-import { type RbacAbility, scopesWithinAbility, type UserActorClaims } from "@trigger.dev/rbac";
+import {
+  buildJwtAbility,
+  type RbacAbility,
+  scopesWithinAbility,
+  type UserActorClaims,
+} from "@trigger.dev/rbac";
 import { $replica } from "~/db.server";
 
 export const FORBIDDEN_ENVIRONMENT_CODE = "forbidden_environment";
@@ -112,20 +117,28 @@ export async function resolveUserActorEnvironmentScope(
 /** Mirrors the RBAC fallback's own default. */
 const CAPLESS_USER_ACTOR_SCOPES = ["read:all"];
 
-/** A delegated token must never mint something more capable than itself, so it is the ceiling. */
+/**
+ * A delegated token must never mint something more capable than itself. Two ceilings apply:
+ * the actor's own ability (their role) and the token's `cap`. The role alone is not enough —
+ * a read-only agent token belongs to a user who may well be allowed to write.
+ */
 export function clampUserActorScopes(
   requestedScopes: string[] | undefined,
   userActor: UserActorClaims,
   ability: RbacAbility
 ): { scopes: string[]; deniedScopes: string[] } {
-  const requested =
-    requestedScopes && requestedScopes.length > 0
-      ? requestedScopes
-      : (userActor.cap ?? CAPLESS_USER_ACTOR_SCOPES);
+  const cap = userActor.cap ?? CAPLESS_USER_ACTOR_SCOPES;
+  const requested = requestedScopes && requestedScopes.length > 0 ? requestedScopes : cap;
 
-  const { deniedScopes } = scopesWithinAbility(requested, ability);
+  const denied = new Set([
+    ...scopesWithinAbility(requested, ability).deniedScopes,
+    ...scopesWithinAbility(requested, buildJwtAbility(cap)).deniedScopes,
+  ]);
 
-  return { scopes: requested.filter((scope) => !deniedScopes.includes(scope)), deniedScopes };
+  return {
+    scopes: requested.filter((scope) => !denied.has(scope)),
+    deniedScopes: [...denied],
+  };
 }
 
 function assertClaimIsOptional(userActor: UserActorClaims): void {

apps/webapp/test/dashboardAgentDelegatedScopeCeiling.test.ts

@@ -58,6 +58,18 @@ it("still hands over the reads the cap does carry", async () => {
   expect(clamped.scopes).toEqual(["read:runs"]);
 });
 
+it("refuses a write the cap forbids even when the user's role allows it", async () => {
+  // The cloud path builds the ability from the user's role, not from the token's cap —
+  // so the role alone would hand a read-only agent token a write JWT.
+  const { claims } = await abilityFor(AGENT_CAP);
+  const roleAllowsEverything = { can: () => true, canSuper: () => false } as never;
+
+  const clamped = clampUserActorScopes(["write:runs"], claims, roleAllowsEverything);
+
+  expect(clamped.scopes).toEqual([]);
+  expect(clamped.deniedScopes).toContain("write:runs");
+});
+
 it("keeps a capless delegated token read-only", async () => {
   const { ability, claims } = await abilityFor();
 

apps/webapp/test/dashboardAgentTranscriptStore.test.ts

@@ -311,6 +311,7 @@ describe("invariant 3: an ordinary transcript write can never change a stored me
       await persistTurn(agentDb, {
         chatId,
         messages: [toolMessage("a1", "output-available")],
+        finalizeMessageIds: ["a1"],
         session: { publicAccessToken: "pat_store" },
       });
 
@@ -645,6 +646,8 @@ describe("a write can no longer lose a message another process appended", () =>
       await persistTurn(agentDb, {
         chatId,
         messages: [{ ...(card.message as Record<string, unknown>), tampered: true }],
+        // Even named outright, a durable event is not this turn's to rewrite.
+        finalizeMessageIds: [cardId],
         session: { publicAccessToken: "pat_store" },
       });
       const afterCard = (await rows(prisma, chatId)).find(

internal-packages/dashboard-agent-db/drizzle/meta/0002_snapshot.json

@@ -74,20 +74,14 @@
       "compositePrimaryKeys": {
         "chat_messages_chat_id_message_id_pk": {
           "name": "chat_messages_chat_id_message_id_pk",
-          "columns": [
-            "chat_id",
-            "message_id"
-          ]
+          "columns": ["chat_id", "message_id"]
         }
       },
       "uniqueConstraints": {
         "chat_messages_chat_position_key": {
           "name": "chat_messages_chat_position_key",
           "nullsNotDistinct": false,
-          "columns": [
-            "chat_id",
-            "position"
-          ]
+          "columns": ["chat_id", "position"]
         }
       },
       "policies": {},
@@ -408,10 +402,7 @@
       "compositePrimaryKeys": {
         "chat_turn_evals_chat_id_turn_pk": {
           "name": "chat_turn_evals_chat_id_turn_pk",
-          "columns": [
-            "chat_id",
-            "turn"
-          ]
+          "columns": ["chat_id", "turn"]
         }
       },
       "uniqueConstraints": {},
@@ -690,10 +681,7 @@
       "compositePrimaryKeys": {
         "watch_batches_environment_id_cadence_minutes_pk": {
           "name": "watch_batches_environment_id_cadence_minutes_pk",
-          "columns": [
-            "environment_id",
-            "cadence_minutes"
-          ]
+          "columns": ["environment_id", "cadence_minutes"]
         }
       },
       "uniqueConstraints": {},
@@ -846,10 +834,7 @@
       "compositePrimaryKeys": {
         "watch_submissions_chat_id_client_request_id_pk": {
           "name": "watch_submissions_chat_id_client_request_id_pk",
-          "columns": [
-            "chat_id",
-            "client_request_id"
-          ]
+          "columns": ["chat_id", "client_request_id"]
         }
       },
       "uniqueConstraints": {},
@@ -1298,4 +1283,4 @@
     "schemas": {},
     "tables": {}
   }
-}
+}

internal-packages/dashboard-agent-db/drizzle/meta/_journal.json

@@ -24,4 +24,4 @@
       "breakpoints": true
     }
   ]
-}
+}