feat: add agent timesheet access - #12
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
There was a problem hiding this comment.
Pull request overview
Adds a scoped “agent access” flow so Codex (and similar agents) can record session nodes and timer intervals via a dedicated Agent API key that is limited to the selected node’s subtree, plus deployment-specific harness setup prompts to install the Codex skill safely.
Changes:
- Introduces TimeTree Codex skill/setup prompt generation with strict origin + time zone validation and non-mutating connection verification guidance.
- Adds a dashboard “Agent access” section and modal dialog to create/rotate/revoke subtree-scoped Agent API keys with one-time secret display.
- Expands unit/E2E coverage for harness-origin normalization, prompt generation, and the end-to-end agent-access UI flows (including layout checks).
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| tests/unit/agent-setup.test.ts | Unit tests for origin normalization/mismatch handling and Codex setup prompt/skill generation. |
| tests/e2e/foundation.spec.ts | Adds a layout assertion helper and applies it to timer control buttons. |
| tests/e2e/agent-access.spec.ts | New E2E suite covering create/rotate/revoke flows, clipboard fallback, and dialog layout constraints. |
| src/lib/server/agent-setup.ts | Server-only helper to derive canonical origin from env for harness setup gating. |
| src/lib/agent/setup.ts | Origin security rules + Codex skill/installation/verification prompt generation. |
| src/components/node-dialogs.tsx | Exports DialogFrame and adds optional className for reusable modal styling. |
| src/components/icons.tsx | Adds Key and Copy icons used by the agent access UI. |
| src/components/dashboard-shell.tsx | Adds “Agent access” summary section, refresh handling, and dialog integration for the selected node. |
| src/components/agent-access-dialog.tsx | New agent access dialog UI with one-time secret display and key management actions. |
| src/app/page.tsx | Fetches initial agent key metadata + canonical origin server-side when a node is selected. |
| src/app/globals.css | Styles agent access summary/dialog and updates disabled/aria-disabled button styling. |
| SPEC.md | Updates spec to remove local-storage “acknowledgement” persistence for harness setup. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Why
This lets Codex and other agents record each working session as a TimeTree node and continuously add timer entries, without granting access to parent or sibling nodes.
Verification
pnpm lintpnpm typecheckpnpm testpnpm test:integrationpnpm db:checkpnpm buildSecurity boundary
The generated credential can read and mutate only its selected node and descendants. Ancestors and sibling subtrees remain inaccessible, secrets are displayed only at creation/rotation time, and revoked credentials are rejected.