UN-3479 [FIX] Agentic project sharing via share action (groups included)

Share axes are read-only on AgenticProjectSerializer, so a detail PATCH
silently no-ops. Route share replication through the dedicated share
action (POST agentic/projects/{id}/share/), which also handles the
polymorphic group axis — so agentic group shares now replicate like every
other shared resource. Drops the now-dead update_agentic_project_share
client method and the include_groups=False special-case.

Found while prepping live staging test scenarios for the clone tool.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CsGrHbs5SWmQkKqiimg6CF

Author: chandrasekharan-zipstack

src/unstract/clone/client.py

@@ -845,19 +845,6 @@ def create_agentic_project(self, payload: dict[str, Any]) -> dict[str, Any]:
         """Create an agentic project. Returns the created row (carries ``id``)."""
         return self._request("POST", "agentic/projects/", json=payload)
 
-    def update_agentic_project_share(
-        self, project_id: str, payload: dict[str, Any]
-    ) -> dict[str, Any]:
-        """Replicate share state onto an agentic project via its detail PATCH.
-
-        ``payload`` carries ``shared_to_org`` + ``shared_users`` (target user
-        pks). ``shared_groups`` is polymorphic/read-only on this serializer and
-        is handled by the share helper's group-omission warning.
-        """
-        return self._request(
-            "PATCH", f"agentic/projects/{project_id}/", json=payload
-        )
-
     def list_agentic_prompt_versions(
         self, *, project_id: str | None = None
     ) -> list[dict[str, Any]]:

src/unstract/clone/phases/agentic_studio.py

@@ -41,7 +41,7 @@
 from unstract.clone.exceptions import NameConflictError
 from unstract.clone.phases.base import Phase, build_post_payload
 from unstract.clone.report import CloneReport, PhaseResult
-from unstract.clone.sharing import replicate_share
+from unstract.clone.sharing import apply_share_state
 
 logger = logging.getLogger(__name__)
 
@@ -216,23 +216,18 @@ def _replicate_share(
         result: PhaseResult,
         lock: threading.Lock,
     ) -> None:
-        # The project list/detail share the same serializer, so the source row
-        # already carries shared_users (target-mappable user pks), shared_to_org
-        # and created_by — no detail fetch needed.
-        # Group sharing isn't replicated: shared_groups is polymorphic/read-only
-        # on the project serializer (the detail PATCH only reaches shared_users +
-        # shared_to_org), so include_groups is off and a source group share
-        # yields a single warning.
-        replicate_share(
+        # The list row already carries shared_users / shared_groups /
+        # shared_to_org, so no detail fetch is needed. Share axes are read-only
+        # on the serializer (a detail PATCH is a silent no-op); they're written
+        # via the dedicated share action, which handles the polymorphic group
+        # axis too — so groups replicate like every other shared resource.
+        apply_share_state(
             self.ctx,
-            apply_fn=lambda p: self.ctx.target.update_agentic_project_share(
-                tgt_project_id, p
-            ),
+            share_path=f"agentic/projects/{tgt_project_id}/share/",
             entity_label=f"agentic project '{name}'",
             src=src,
             result=result,
             lock=lock,
-            include_groups=False,
         )
 
     # ----- prompt versions -----

tests/clone/test_agentic_studio_phase.py

@@ -79,9 +79,9 @@ def create_agentic_project(self, payload):
         self.created_projects.append(new)
         return new
 
-    def update_agentic_project_share(self, project_id, payload):
-        self.shared_projects.append((project_id, payload))
-        return {"id": project_id, **payload}
+    def share_resource(self, share_path, payload):
+        self.shared_projects.append((share_path, payload))
+        return payload
 
     # ----- users (share replication) -----
 
@@ -403,32 +403,35 @@ def test_share_replicated_with_mapped_users_and_org_flag():
 
     tgt_pid = tgt.created_projects[0]["id"]
     assert len(tgt.shared_projects) == 1
-    pid, payload = tgt.shared_projects[0]
-    assert pid == tgt_pid
+    share_path, payload = tgt.shared_projects[0]
+    assert share_path == f"agentic/projects/{tgt_pid}/share/"
     assert payload["shared_to_org"] is True
     assert payload["shared_users"] == [42]  # owner dropped, alice remapped
-    assert "shared_groups" not in payload  # include_groups=False
+    assert payload["shared_groups"] == []  # no source groups, axis still sent
 
 
-def test_source_group_share_warns_without_failure():
+def test_source_group_share_replicated_via_remap():
+    # Group sharing IS supported on agentic projects (via the share action),
+    # so a source group share maps through the `group` remap onto the target.
     src = FakeClient(
         projects=[
             {
                 "id": "src-p",
                 "name": "Receipts",
                 "description": "d",
                 "created_by": 1,
-                "shared_groups": [7],  # unsupported via the project PATCH
+                "shared_groups": [7],
             }
         ],
         users=[{"id": 1, "email": "owner@x.com"}],
     )
     tgt = FakeClient()
     ctx = _ctx(src, tgt)
+    ctx.remap.record("group", "7", "70")
 
     result = AgenticStudioPhase(ctx).run(CloneReport())
 
     assert result.failed == 0
-    assert sum("group share(s) not supported" in w for w in result.warnings) == 1
-    # No shareable axes remained, so no PATCH fires.
-    assert tgt.shared_projects == []
+    assert len(tgt.shared_projects) == 1
+    _, payload = tgt.shared_projects[0]
+    assert payload["shared_groups"] == [70]