[front] feat: add agent head fields to `agents` by sfriquet · Pull Request #32957 · dust-tt/dust

sfriquet · 2026-09-22T11:17:03Z

Description

Refs https://github.com/dust-tt/tasks/issues/10447

Adds status, scope, reinforcement, lastReinforcementAnalysisAt, templateId to agents,
nullable for now. They mirror the same columns of the configuration row the agent points at:

Tests

added tests + tested manually that agent changes propagates to agents table.

Risk

Low, nothing reads agents fields for now.

Deploy Plan

migrate then deploy

vercel · 2026-09-22T11:17:07Z

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated
playground	Ignored	Preview	Sep 22, 2026 4:30pm UTC
storybook	Ignored	Preview	Sep 22, 2026 4:30pm UTC

sfriquet · 2026-09-22T11:19:36Z

This change is part of the following stack:

[front] feat: add agent head fields to agents #32957 ◀
- [front] Backfill agent head fields from the current configuration #32959
  - [front] Make the agent head fields NOT NULL #32988

_{Change managed by git-spice.}

sfriquet · 2026-09-22T11:28:44Z

r? @tdraier

github-actions

cc-verify: violations found!

agent-verbs: Lifecycle writes bypass write permission
index-foreign-keys: Template foreign key lacks index
no-unsafe-type-assertions: Incomplete attributes cast as complete
models-behind-resources: Head-field writes bypass Resource

Findings and notifications outside the PR diff:

Source: front/lib/api/assistant/configuration/agent.ts:96

models-behind-resources in front/CONTRACTS requires runtime model access through Resources. This change extends the pre-existing direct AgentModel.create call with head-field initialization, leaving the new persistence logic owned by the business layer; move pending-agent persistence behind an AgentResource operation.

zeropath-ai · 2026-09-22T11:46:08Z

🟡 1 security issue detected below the blocking threshold. Reviewed everything up to d21ec7f.

The following issues were found:

Issue 1: Broken Access Control
- Location: front/lib/api/assistant/configuration/agent.ts:713-736
- Score: MEDIUM (52.0)
- Description: Restoring an archived agent re-enables every trigger associated with it by constructing an Authenticator for each trigger editor and calling trigger.enable, without checking that the editor remains an authorized editor of the agent or that the restored agent is still restricted to an accessible space. A user who was removed from the agent's editor grants (or whose space access was revoked) can therefore have their trigger silently reactivated, allowing their external trigger to invoke a restored agent despite the current authorization state.

Evidence: After updated, the code lists all triggers, resolves each trigger.editor to a user, builds editorAuth solely from that user's identity/workspace at lines 731-734, and calls trigger.enable(editorAuth) at line 735. No auth.can(...), current editor/grant lookup, or space-membership check gates reactivation. The prior archive path disables all triggers, so this new restore behavior is the security-relevant reactivation sink.

Link to UI: https://zeropath.com/app/issues/eaa4f557-a706-46a0-8607-3aef2300d009 (Issue 1, id: eaa4f557-a706-46a0-8607-3aef2300d009)

Security Overview

🔎 Scanned files: 8 changed file(s)
🔗 Scan Link: https://zeropath.com/app/repositories/e99db9ac-bfd2-43d3-9f69-534de35a1c30?scanId=2f8649ad-6609-47bf-8202-0404de6e53e6&codeScanTypes=PrScan&tab=issues&detectionTypes=traditional,businessLogic,customRule,IAC,SECRETS,CICD,EOL,uncategorized

Detected Code Changes

Change Type	Relevant files
Enhancement	► front/lib/api/assistant/configuration/agent.ts Modify createPendingAgentConfiguration to set initial head fields (status, scope, reinforcement, templateId)
Enhancement	► front/lib/models/agent/agent.ts Add new fields to AgentModel: status, scope, reinforcement, lastReinforcementAnalysisAt, templateId
Enhancement	► front/lib/models/agent/agent.ts Define new fields in model initialization and indexes for head fields
Enhancement	► front/lib/models/agent/agent.ts Establish template relationship via foreign keys and ORM associations
Enhancement	► front/lib/resources/agent_resource.ts Introduce head fields handling and integration points for mirroring head fields
Enhancement	► front/lib/resources/agent_resource.ts Update setCurrentConfiguration to mirror head fields when changing current configuration
Enhancement	► front/lib/resources/agent_resource.ts Add internal updateAgent helper to update head fields and agent model atomically
Enhancement	► front/lib/resources/agent_resource.ts Adapt archive/restore paths to utilize updateAgent and mirror head fields
Enhancement	► front/lib/resources/agent_resource.ts Augment delete/activate flows to reflect head-field mirroring and status changes
Enhancement	► front/lib/resources/agent_resource.ts Modify scope updates to use updateAgent and invalidate cache accordingly
Enhancement	► front/migrations/pre-deploy/20260915211031_add_head_fields_to_agents.sql Add head fields to agents table and create related indexes/foreign key
Enhancement	► front/migrations/20260813_revert_sonnet46_to_auto_migration.test.ts Update seeding to initialize head fields on identity and align currentVersion logic
Enhancement	► front/tests/utils/AgentConfigurationFactory.ts Pass through templateId and reinforcement in factory overrides

github-actions · 2026-09-22T13:51:27Z

	Fails
🚫	Please include a detailed Deploy Plan section in your PR description, at least 20 characters long.

	Warnings
⚠️	Files in `**/lib/models/` have been modified and the PR has the `migration-ack` label. Don't forget to run the migration from prodbox. Before deleting an index, make sure it is actually not used by running: SELECT s.relname AS table_name, indexrelname AS index_name, i.indisunique, idx_scan AS index_scans FROM pg_catalog.pg_stat_user_indexes s, pg_index i WHERE i.indexrelid = s.indexrelid;

Generated by 🚫 dangerJS against d21ec7f

sfriquet · 2026-09-22T15:37:10Z

r? @tdraier

github-actions

cc-verify: violations found!

unreadable-agent-is-light: Light resources retain private fields
agent-publish-capability: Draft identities store visible scope
models-behind-resources: Direct model access (existing finding)

github-actions · 2026-09-22T15:45:12Z

@@ -559,7 +563,6 @@ export async function destroyAgentConfigurationRow(

  const remainingConfiguration = await AgentConfigurationModel.findOne({


This extends a pre-existing models-behind-resources violation (front/CONTRACTS): removing the projection makes this business-layer query load the full configuration for the new head-field mirroring, keeping that persistence access outside Resources. Move the replacement-configuration lookup and repointing behind AgentResource.

tdraier · 2026-09-22T15:45:47Z

        updatedAt: new Date(content.updatedAt),
        // The cached row is the current version, so its version is the agent's `currentVersion`.
        currentVersion: content.version,
+        ...NO_HEAD_FIELDS,


why no field here ? they must be restored (and should be in the toSnapshot)

it's not needed atm they are read from content

tdraier · 2026-09-22T15:46:53Z

        createdAt: new Date(),
        updatedAt: new Date(),
        currentVersion: configuration.version,
+        ...NO_HEAD_FIELDS,


not even a scope: global ?

tdraier · 2026-09-22T15:49:30Z

    );
  }

+  private async updateAgent(


maybe make it more clear we're updating the agent head fields ?

…configuration Adds `status`, `scope`, `reinforcement`, `lastReinforcementAnalysisAt`, `templateId` and `requestedSpaceIds` to `agents`, nullable for now. They mirror the same columns of the configuration row the agent points at: - `AgentResource.createIdentity` writes them with the identity, and `setCurrentConfiguration` copies them whenever the pointer moves (create, upgrade, pending activation, rollback re-point). - The in-place writers on a current configuration row (archive, restore, bulk scope change, requested-spaces propagation) also write the agent, in the same transaction, through `AgentResource.updateSettingsForCurrentConfigurations`. An index on (workspaceId, status, scope) prepares listings that filter agents before joining their configuration. Reads still come from `agent_configurations`; the backfill and NOT NULL step follow.

sfriquet requested a review from a team as a code owner September 22, 2026 11:17

sfriquet mentioned this pull request Sep 22, 2026

[front] Backfill agent head fields from the current configuration #32959

Open

github-actions Bot requested a review from tdraier September 22, 2026 11:28

github-actions Bot reviewed Sep 22, 2026

View reviewed changes

Comment thread front/lib/resources/agent_resource.ts Outdated

Comment thread front/lib/resources/agent_resource.ts Outdated

Comment thread front/migrations/pre-deploy/20260915211031_add_head_fields_to_agents.sql

Comment thread front/lib/resources/agent_resource.ts Outdated

sfriquet force-pushed the sf/feat-agent-head-fields branch from b5a58b9 to 6a80f07 Compare September 22, 2026 11:44

zeropath-ai Bot reviewed Sep 22, 2026

View reviewed changes

Comment thread front/lib/api/assistant/configuration/agent.ts Outdated

sfriquet force-pushed the sf/feat-agent-head-fields branch 2 times, most recently from f46fa38 to a8dabb3 Compare September 22, 2026 13:49

sfriquet mentioned this pull request Sep 22, 2026

[front] Make the agent head fields NOT NULL #32988

Open

sfriquet added the migration-ack 📁 Label to acknowledge that a migration is required. label Sep 22, 2026

sfriquet force-pushed the sf/feat-agent-head-fields branch 2 times, most recently from b02fc6f to 500fffb Compare September 22, 2026 15:36

sfriquet changed the title ~~[front] Add agent head fields to agents~~ [front] feat: add agent head fields to agents Sep 22, 2026

github-actions Bot reviewed Sep 22, 2026

View reviewed changes

tdraier reviewed Sep 22, 2026

View reviewed changes

sfriquet force-pushed the sf/feat-agent-head-fields branch 2 times, most recently from 37a6edd to aff28e0 Compare September 22, 2026 15:56

sfriquet force-pushed the sf/feat-agent-head-fields branch from aff28e0 to d21ec7f Compare September 22, 2026 16:30

		@@ -559,7 +563,6 @@ export async function destroyAgentConfigurationRow(

		const remainingConfiguration = await AgentConfigurationModel.findOne({

Conversation

sfriquet commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Tests

Risk

Deploy Plan

Uh oh!

vercel Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sfriquet commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sfriquet commented Sep 22, 2026

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

zeropath-ai Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sfriquet commented Sep 22, 2026

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot Sep 22, 2026

Choose a reason for hiding this comment

Uh oh!

tdraier Sep 22, 2026

Choose a reason for hiding this comment

Uh oh!

sfriquet Sep 22, 2026

Choose a reason for hiding this comment

Uh oh!

tdraier Sep 22, 2026

Choose a reason for hiding this comment

Uh oh!

tdraier Sep 22, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

sfriquet commented Sep 22, 2026 •

edited

Loading

vercel Bot commented Sep 22, 2026 •

edited

Loading

sfriquet commented Sep 22, 2026 •

edited

Loading

zeropath-ai Bot commented Sep 22, 2026 •

edited

Loading

github-actions Bot commented Sep 22, 2026 •

edited

Loading