';
- for (const sb of data.storyboards) {
+
+ const recommended = data.storyboards.filter(sb => storyboardMatchesAgent(sb, agentTracks));
+ const other = data.storyboards.filter(sb => !storyboardMatchesAgent(sb, agentTracks));
+
+ let html = '';
+ if (recommended.length > 0 && other.length > 0) {
+ html += '
';
+ for (const sb of recommended) {
html += '
';
html += '
';
html += '
' + escapeHtml(sb.title) + '
';
@@ -974,6 +1131,24 @@
Agents
html += '
';
}
html += '
';
+
+ if (other.length > 0) {
+ html += '
';
+ html += 'Other storyboards (' + other.length + ')
';
+ html += '';
+ for (const sb of other) {
+ html += '
';
+ html += '
';
+ html += '
' + escapeHtml(sb.title) + '
';
+ html += '
' + escapeHtml(sb.summary) + '
';
+ html += '
';
+ html += '
' + sb.phase_count + ' phases, ' + sb.step_count + ' steps';
+ html += '
';
+ }
+ html += '
';
+ }
+
panel.innerHTML = html;
} catch {
panel.innerHTML = '
Failed to load storyboards.';
@@ -992,7 +1167,9 @@
Agents
panel.style.display = 'none';
return;
}
- await renderStoryboardPicker(panel, agentUrl, cardId);
+ let agentTracks = null;
+ try { agentTracks = JSON.parse(storyboardBtn.dataset.agentTracks || 'null'); } catch {}
+ await renderStoryboardPicker(panel, agentUrl, cardId, agentTracks);
return;
}
@@ -1064,7 +1241,11 @@
Agents
const agentUrl = backBtn.dataset.agentUrl;
const cardId = backBtn.dataset.cardId;
const panel = document.getElementById(cardId + '-storyboard');
- if (panel) await renderStoryboardPicker(panel, agentUrl, cardId);
+ if (panel) {
+ let tracks = null;
+ try { tracks = JSON.parse(panel.dataset.agentTracks || 'null'); } catch {}
+ await renderStoryboardPicker(panel, agentUrl, cardId, tracks);
+ }
return;
}
@@ -1159,6 +1340,7 @@
Agents
}
panel.innerHTML = html;
+ panel.scrollIntoView({ behavior: 'smooth', block: 'start' });
} catch {
progressEl.textContent = 'Failed to run storyboard evaluation.';
runBtn.disabled = false;
@@ -1231,6 +1413,7 @@
Agents
}
panel.innerHTML = html;
+ panel.scrollIntoView({ behavior: 'smooth', block: 'start' });
} catch {
progressEl.textContent = 'Failed to run comparison.';
compareBtn.disabled = false;
diff --git a/server/src/addie/services/compliance-testing.ts b/server/src/addie/services/compliance-testing.ts
index f40d72ffc0..cb1805e34a 100644
--- a/server/src/addie/services/compliance-testing.ts
+++ b/server/src/addie/services/compliance-testing.ts
@@ -460,12 +460,14 @@ export async function comply(agentUrl: string, options: ComplyOptions = {}): Pro
});
const trackResults = buildTrackResults(requestedTracks, suite.results);
+
const tracks_passed = trackResults.filter((track) => track.status === 'pass').length;
const tracks_failed = trackResults.filter((track) => track.status === 'fail').length;
const tracks_partial = trackResults.filter((track) => track.status === 'partial').length;
const tracks_skipped = trackResults.filter((track) => track.status === 'skip').length;
const observations = buildObservations(trackResults);
+
const headline = `${tracks_passed} track${tracks_passed === 1 ? '' : 's'} passed, ${tracks_failed} failed, ${tracks_partial} partial, ${tracks_skipped} skipped`;
// Hard-fail agents that do not support v3
diff --git a/server/src/db/compliance-db.ts b/server/src/db/compliance-db.ts
index 752c3428ca..56ac46b61f 100644
--- a/server/src/db/compliance-db.ts
+++ b/server/src/db/compliance-db.ts
@@ -419,13 +419,16 @@ export class ComplianceDatabase {
): Promise<{ type: 'bearer'; token: string } | { type: 'basic'; username: string; password: string } | undefined> {
try {
const result = await query(
- `SELECT ac.organization_id, ac.auth_token_encrypted, ac.auth_token_iv, ac.auth_type
+ `SELECT ac.organization_id,
+ ac.auth_token_encrypted, ac.auth_token_iv, ac.auth_type,
+ ac.oauth_access_token_encrypted, ac.oauth_access_token_iv,
+ ac.oauth_token_expires_at
FROM agent_contexts ac
JOIN member_profiles mp
ON mp.workos_organization_id = ac.organization_id
WHERE ac.agent_url = $1
AND mp.agents @> $2::jsonb
- AND ac.auth_token_encrypted IS NOT NULL
+ AND (ac.auth_token_encrypted IS NOT NULL OR ac.oauth_access_token_encrypted IS NOT NULL)
ORDER BY ac.updated_at DESC NULLS LAST
LIMIT 1`,
[agentUrl, JSON.stringify([{ url: agentUrl }])],
@@ -434,17 +437,39 @@ export class ComplianceDatabase {
const row = result.rows[0];
if (!row) return undefined;
- const token = decryptToken(row.auth_token_encrypted, row.auth_token_iv, row.organization_id);
+ // Prefer static token when available
+ if (row.auth_token_encrypted) {
+ const token = decryptToken(row.auth_token_encrypted, row.auth_token_iv, row.organization_id);
- if (row.auth_type === 'basic') {
- const decoded = Buffer.from(token, 'base64').toString();
- const colonIndex = decoded.indexOf(':');
- if (colonIndex >= 0) {
- return { type: 'basic', username: decoded.slice(0, colonIndex), password: decoded.slice(colonIndex + 1) };
+ if (row.auth_type === 'basic') {
+ const decoded = Buffer.from(token, 'base64').toString();
+ const colonIndex = decoded.indexOf(':');
+ if (colonIndex >= 0) {
+ return { type: 'basic', username: decoded.slice(0, colonIndex), password: decoded.slice(colonIndex + 1) };
+ }
}
+
+ return { type: 'bearer', token };
+ }
+
+ // Fall back to OAuth access token
+ if (row.oauth_access_token_encrypted && row.oauth_access_token_iv) {
+ // Check expiration with 5-minute buffer
+ if (row.oauth_token_expires_at) {
+ const expiresAt = new Date(row.oauth_token_expires_at);
+ if (expiresAt.getTime() - Date.now() <= 5 * 60 * 1000) {
+ logger.debug({ agentUrl, expiresAt }, 'OAuth token expired or expiring soon for compliance auth');
+ return undefined;
+ }
+ } else {
+ logger.debug({ agentUrl }, 'OAuth token has no expiration recorded');
+ }
+
+ const token = decryptToken(row.oauth_access_token_encrypted, row.oauth_access_token_iv, row.organization_id);
+ return { type: 'bearer', token };
}
- return { type: 'bearer', token };
+ return undefined;
} catch (error) {
logger.debug({ error, agentUrl }, 'Could not resolve owner auth for heartbeat');
return undefined;
diff --git a/server/src/routes/registry-api.ts b/server/src/routes/registry-api.ts
index 187001fd2a..88e6286a91 100644
--- a/server/src/routes/registry-api.ts
+++ b/server/src/routes/registry-api.ts
@@ -54,6 +54,8 @@ import { PropertyCheckService } from "../services/property-check.js";
import { PropertyCheckDatabase } from "../db/property-check-db.js";
import { BulkPropertyCheckService } from "../services/bulk-property-check.js";
import { ComplianceDatabase, type LifecycleStage } from "../db/compliance-db.js";
+import { AgentContextDatabase } from "../db/agent-context-db.js";
+import { getAllPlatformTypes } from "../addie/services/compliance-testing.js";
import { getRequestLog, getRequestCount } from "../db/outbound-log-db.js";
const logger = createLogger("registry-api");
@@ -61,6 +63,7 @@ const propertyCheckService = new PropertyCheckService();
const propertyCheckDb = new PropertyCheckDatabase();
const bulkCheckService = new BulkPropertyCheckService();
const complianceDb = new ComplianceDatabase();
+const agentContextDb = new AgentContextDatabase();
/** Strip protocol, path, query, and fragment from a URL to extract the domain. */
function extractDomain(raw: string): string {
@@ -2539,6 +2542,91 @@ export function createRegistryApiRouter(config: RegistryApiConfig): Router {
}
});
+ router.put("/registry/agents/:encodedUrl/connect", brandCreationRateLimiter, ...complianceWriteMiddleware, async (req, res) => {
+ try {
+ const agentUrl = decodeURIComponent(req.params.encodedUrl);
+ if (!validateAgentUrlParam(agentUrl)) {
+ return res.status(400).json({ error: "Invalid agent URL" });
+ }
+
+ if (!req.user) {
+ return res.status(401).json({ error: "Authentication required" });
+ }
+
+ const { auth_token, auth_type, platform_type } = req.body;
+
+ if (auth_token && typeof auth_token !== "string") {
+ return res.status(400).json({ error: "auth_token must be a string" });
+ }
+ if (auth_token && auth_token.length > 4096) {
+ return res.status(400).json({ error: "auth_token exceeds maximum length" });
+ }
+
+ const validAuthTypes = ["bearer", "basic"];
+ if (auth_token && auth_type && !validAuthTypes.includes(auth_type)) {
+ return res.status(400).json({ error: `Invalid auth_type. Valid types: ${validAuthTypes.join(", ")}` });
+ }
+ const resolvedAuthType = validAuthTypes.includes(auth_type) ? auth_type : "bearer";
+
+ if (platform_type && typeof platform_type !== "string") {
+ return res.status(400).json({ error: "platform_type must be a string" });
+ }
+ const validPlatformTypes = new Set(getAllPlatformTypes() as string[]);
+ if (platform_type && !validPlatformTypes.has(platform_type)) {
+ return res.status(400).json({
+ error: `Invalid platform_type. Valid types: ${[...validPlatformTypes].join(", ")}`,
+ });
+ }
+
+ // Verify ownership and get org ID in a single query
+ const orgResult = await query(
+ `SELECT mp.workos_organization_id
+ FROM member_profiles mp
+ JOIN organization_memberships om
+ ON om.workos_organization_id = mp.workos_organization_id
+ WHERE mp.agents @> $1::jsonb
+ AND om.workos_user_id = $2
+ LIMIT 1`,
+ [JSON.stringify([{ url: agentUrl }]), req.user.id],
+ );
+
+ if (orgResult.rows.length === 0) {
+ return res.status(403).json({ error: "You do not have permission to modify this agent" });
+ }
+
+ const orgId = orgResult.rows[0].workos_organization_id;
+
+ // Get or create agent context
+ let context = await agentContextDb.getByOrgAndUrl(orgId, agentUrl);
+ if (!context) {
+ context = await agentContextDb.create({
+ organization_id: orgId,
+ agent_url: agentUrl,
+ created_by: req.user.id,
+ });
+ }
+
+ // Save auth token if provided
+ if (auth_token) {
+ await agentContextDb.saveAuthToken(context.id, auth_token, resolvedAuthType);
+ }
+
+ // Set platform type if provided
+ if (platform_type) {
+ await complianceDb.upsertRegistryMetadata(agentUrl, { platform_type });
+ }
+
+ res.json({
+ connected: true,
+ has_auth: !!auth_token || context.has_auth_token,
+ platform_type: platform_type || undefined,
+ });
+ } catch (error) {
+ logger.error({ err: error, path: req.path }, "Failed to connect agent");
+ res.status(500).json({ error: "Failed to connect agent" });
+ }
+ });
+
// ── Storyboards ────────────────────────────────────────────────
router.get("/storyboards", async (req, res) => {