P2 AI Agents integration surfaces

[jaeyunha]

Summary

• Require workspace agent policy checks before accepting or declining agent suggestions.
• Record explicit reviewer decisions on review gates for external agent actions.
• Make review transitions idempotent and preserve provider source/actor context in run history.

Verification

• npm test -- tests/agent-actions-route.test.ts tests/agent-runs-review-route.test.ts
• make check
• make:test attempted: blocked by local environment defaults from .env (app URL/DB/email env overrides conflict with tests that assert unset-env fallbacks).

Closes #591

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 647cf84dba

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Constrain API-key actions to the key workspace

When this endpoint is called with a workspace-scoped API key, getWorkspaceAccess(session, request) still honors x-workspace-slug/referer before the API key's workspaceId, so a key minted for workspace A can POST this route with a slug for any other workspace where the key owner is a member and create agent runs there. The endpoint should ignore request-selected workspaces for API-key sessions or verify access.workspaceId === session.apiKey.workspaceId before proceeding.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Verify mapped actors belong to this workspace

Because resolveIntegrationActorUserId looks up provider/accountId globally, using the resulting id directly here lets a caller supply an actor.externalUserId that matches an account from another workspace; resolveEffectiveAgentGuidance then reads that user's account personalization and the response includes it in run.promptConfig. Verify the mapped user is a member of access.workspaceId (and ideally belongs to the connected integration) before using it, otherwise fall back to the session user or no mapping.

Useful? React with 👍 / 👎.

[jaeyunha]

Controller intake: blocked before QA/merge.

Current blocker:

• PR P2 AI Agents integration surfaces #700 is based on stale pre-split paths and is currently GitHub-conflicting. It changes top-level src/ and tests/, which this repo's current architecture/PR-QA blocks; implementation belongs under apps/web/... and API contracts under the Go/OpenAPI stack as applicable.
• Merge simulation against origin/staging reports directory-rename/location conflicts for src/lib/agent-actions.ts, tests/agent-actions-route.test.ts, tests/agent-runs-review-route.test.ts, plus modify/delete conflicts for src/app/api/agent/runs/[id]/route.ts and src/lib/integration-attribution.ts.
• Scope also does not satisfy P2 AI Agents integration surfaces: Slack/Teams/support-provider actions and review gates #591's spec-prep acceptance as a complete close: no OpenAPI/SDK/migration updates are present, no provider-specific Go signed webhook/OAuth fixtures, and no Playwright setup/review-flow E2E evidence.

Evidence:

• PR P2 AI Agents integration surfaces #700 head 647cf84, base staging, mergeable=CONFLICTING; GitHub reports no checks.
• Changed paths are all legacy top-level src//tests/ plus existing moved equivalents under apps/web on staging.
• Worker-reported make check/focused npm tests are noted, but the PR cannot merge in this shape.

Required before merge:

• Rebase/port the work onto current staging paths (apps/web/..., and Go/OpenAPI/SDK surfaces where the API contract changes), resolve conflicts, and either add the missing P2 AI Agents integration surfaces: Slack/Teams/support-provider actions and review gates #591 acceptance coverage or narrow this PR so it does not claim to close P2 AI Agents integration surfaces: Slack/Teams/support-provider actions and review gates #591.

[jaeyunha]

⚠️ Not mergeable as-is — wrong architecture (needs regeneration, not conflict resolution).

This PR's changed files are on the pre-monorepo-split src/ layout, which no longer exists — business logic sits in old Next.js src/app/api/* routes instead of the Go API (apps/api) + packages/proto/openapi.yaml + generated SDK. So the CONFLICTING state isn't a normal merge conflict; every file targets a path that's gone. This is the same problem that sank the earlier batch of integration PRs.

Conflict resolution can't fix this — it needs to be rebuilt on the current architecture from the spec in #591 against current staging. Leaving this open for now (not closing), but it should not be merged in its current form. Issue #591 stays open as the source of truth.