Merge branch 'feat/dashboard-agent-flows' into feat/dashboard-agent-ui

Author: kathiekiwi

apps/webapp/app/routes/api.v1.queues.$queueParam.ts

@@ -14,6 +14,9 @@ export const loader = createLoaderApiRoute(
       queueParam: z.string().transform((val) => val.replace(/%2F/g, "/")),
     }),
     searchParams: SearchParamsSchema,
+    // An environment JWT may read a queue, the way it already reads that queue's metrics.
+    // Same data class — name, depth, limit, paused — and the `queues` scope still gates it.
+    allowJWT: true,
     findResource: async () => 1, // This is a dummy function, we don't need to find a resource
     authorization: {
       action: "read",

apps/webapp/test/queueRetrieveJwt.test.ts

@@ -0,0 +1,26 @@
+import { readFileSync } from "node:fs";
+import { describe, expect, it } from "vitest";
+
+/**
+ * The agent reads a queue's live row — paused, depth, limit — through the environment JWT it
+ * exchanges its delegated token for. Metrics already answer that JWT; without the same on the
+ * retrieve route the agent got a 401, which reaches the model as absent data and had it
+ * telling users a queue of thousands of runs did not exist.
+ */
+const ROUTE = "apps/webapp/app/routes/api.v1.queues.$queueParam.ts";
+const METRICS = "apps/webapp/app/routes/api.v1.queues.$queueParam.metrics.ts";
+
+describe("queue retrieve accepts an environment JWT", () => {
+  const source = readFileSync(ROUTE, "utf8");
+
+  it("allows the JWT, like its own metrics route does", () => {
+    expect(source).toContain("allowJWT: true");
+    expect(readFileSync(METRICS, "utf8")).toContain("allowJWT: true");
+  });
+
+  it("keeps the queues scope as the gate", () => {
+    // Widening who may ask must not widen what they may read.
+    expect(source).toContain('resource: () => ({ type: "queues" })');
+    expect(source).toContain('action: "read"');
+  });
+});