ak-agent-desktop: list previous local authorizations

Cargo.toml

@@ -50,6 +50,7 @@ ak-ee-wcp-wire = { path = "ee/wcp/wire" }
 ak-flow-executor = { path = "ak-flow-executor" }
 ak-meta = { path = "ak-meta" }
 ak-platform = { path = "ak-platform" }
+ak-platform-authz = { path = "ak-platform-authz" }
 ak-platform-keyring = { path = "ak-platform-keyring" }
 authentik-client = { git = "https://github.com/goauthentik/client-rust", rev = "d608f835c32c64346ebeb199cb48810080890123", version = "2026.11.0-rc1", default-features = false, features = [
     "rustls",

ak-agent-desktop/src-tauri/Cargo.toml

@@ -20,6 +20,7 @@ ak-agent = { workspace = true }
 eyre = { workspace = true }
 hex = { workspace = true }
 ak-platform = { workspace = true }
+ak-platform-authz = { workspace = true }
 ak-platform-keyring = { workspace = true }
 ak-meta = { workspace = true }
 authentik-client = { workspace = true }

ak-agent-desktop/src-tauri/src/cmd/authz.rs

@@ -0,0 +1,6 @@
+use ak_platform_authz::AuthRecord;
+
+#[tauri::command]
+pub fn recent_authorizations() -> Vec<AuthRecord> {
+    ak_platform_authz::history()
+}

ak-agent-desktop/src-tauri/src/cmd/mod.rs

@@ -1,3 +1,4 @@
+pub mod authz;
 pub mod page;
 pub mod profile;
 pub mod ssh;

ak-agent-desktop/src-tauri/src/lib.rs

@@ -72,6 +72,7 @@ pub fn start_tauri(guard: ClientInitGuard) -> Result<()> {
             Ok(())
         })
         .invoke_handler(tauri::generate_handler![
+            cmd::authz::recent_authorizations,
             cmd::page::take_pending_page,
             cmd::profile::get_user_info,
             cmd::profile::list_profiles,

ak-agent-desktop/src-tauri/src/ui/mod.rs

@@ -28,7 +28,7 @@ pub fn show_main(app: &tauri::AppHandle) {
         None => {
             let b = WebviewWindowBuilder::new(app, WINDOW_LABEL, WebviewUrl::default())
                 .title(WINDOW_TITLE)
-                .inner_size(870.0, 640.0);
+                .inner_size(1376.0, 850.0);
             #[cfg(target_os = "macos")]
             let b = b
                 .hidden_title(true)

ak-agent-desktop/src/bridge.ts

@@ -119,6 +119,29 @@ export async function deleteProfile(name: string): Promise<void> {
     return await invoke("delete_profile", { name });
 }
 
+export type AuthOutcome = "allowed" | "denied" | "failed";
+
+export interface AuthRecord {
+    time: Date;
+    action: string;
+    /** Application, service or host access was requested for. */
+    target: string;
+    pid: number;
+    cmdline?: string;
+    parentCmdline?: string;
+    outcome: AuthOutcome;
+    /** Answered from an earlier prompt's result. */
+    cached: boolean;
+}
+
+/** Newest first. */
+export async function recentAuthorizations(): Promise<AuthRecord[]> {
+    const records =
+        await invoke<(Omit<AuthRecord, "time"> & { time: number })[]>("recent_authorizations");
+
+    return records.map((r) => ({ ...r, time: new Date(r.time) }));
+}
+
 /** Page requested by a deep link, if any. Cleared once taken. */
 export async function takePendingPage(): Promise<string | null> {
     return await invoke<string | null>("take_pending_page");

ak-agent-desktop/src/elements/app-shell.ts

@@ -1,4 +1,5 @@
 import "./header.js";
+import "../pages/authorizations.js";
 import "../pages/mcp-instructions.js";
 import "../pages/profile-status.js";
 import "../pages/ssh-agent.js";
@@ -25,6 +26,7 @@ import { css, html, LitElement, nothing } from "lit";
 import { customElement, state } from "lit/decorators.js";
 
 const PAGES = [
+    ["authorizations", "Authorizations"],
     ["profiles", "Profiles"],
     ["ssh", "SSH Agent"],
     ["mcp", "MCP Server"],
@@ -101,7 +103,7 @@ export class AppShell extends LitElement {
     `;
 
     @state()
-    private page: Page = "profiles";
+    private page: Page = "authorizations";
 
     @state()
     private user?: SessionUser;
@@ -190,6 +192,11 @@ export class AppShell extends LitElement {
                 return html`<ak-ssh-agent .sshStatus=${this.sshStatus}></ak-ssh-agent>`;
             case "mcp":
                 return html`<ak-mcp-instructions></ak-mcp-instructions>`;
+            case "authorizations":
+                return html`<ak-authorizations
+                    .profile=${this.profiles?.find((p) => p.name === this.activeProfile)}
+                    .user=${this.user}
+                ></ak-authorizations>`;
         }
     }