chadtmiller.com/knotless

Switch repository

Loading…

What changes

Agents, for admins too. New dev.knotless.addAgent and removeAgent methods name or drop a repository's agents, behind the same check as the other settings: the owner from the pages, or an admin who joined the owning organization, from the pages or with a service token. knotless agents add and remove, and the MCP agents tool, use them when not logged in as the owner, so an admin can name a coding agent on the organization's repositories. The CLI's login asks for the two methods. The pages have no control for agents yet, and this adds none.

A new triager's warning is no longer dropped. setTriager answers warning when a private repository's new triager could not be told of it. The server used to discard the warning that manage::set_triager gives. The Access page now shows it under the triager form, and an admin's knotless triagers add prints it as the owner's always has. .warning is now a general style beside .problem, using --notice-fg.

The Triagers hint is plainer. It now reads "A triager, such as a bot, labels pulls and issues within the scopes you name. When the owner or a collaborator labels too, theirs wins."

The settings methods' descriptions say who may call them. The eleven methods an admin may call no longer say "Only its owner", while renameRepo still does, as renaming stays the organization's own, and addRunner and removeRunner say an admin's service token is taken too.

Why

The two gaps left by An organization's admins change its repositories' settings from the command line: agents had no method an admin could reach, and the triager warning was lost on the pages as much as for admins. This is built on that pull and the two before it, so their commits show here until they land.

How it was checked

organizations_invite_and_members_join has the admin add and remove an agent from the command line, read back from the organization's record. just lex and svelte-check pass here. The warning's state, which the shots check does not draw, is attached: just look settings-access --signed-in, the triager form submitted with an answer holding a warning, desktop light and phone dark. The rest is left to CI.

Shots-moved: settings-access

Shortcomings

Nothing tests a real invitation failing, so the warning is shown here from a recorded answer. Agents still have no control on the pages.

🤖 Generated with Claude Code

This adds addAgent and removeAgent, which an admin can reach. It also returns setTriager's warning to the pages and to an admin's CLI. I read the last commit's server handlers (add_agent, remove_agent and naming_agent in controls.rs) and the admin branches of manage::set_agent and set_triager. I also saw that web.rs, the lexicons and docs/reference/api.md carry the new methods. I did not read the Svelte, CSS or e2e changes, and I did not look at the checks.

• Agents: the new handlers reuse the owned check like the other settings. The admin path sends the DID to the appview and returns, so nothing is written without the owner/admin check.
• Triager warning: the warning is now read from set_triager's result and returned in the answer. The admin CLI path reads it from the appview's answer, the same as the owner path does.

I found nothing that needs to change. Two gaps you already noted: no test makes a real invitation fail, and the pages have no control for agents.

Since my earlier review this branch only merged main (which brought in the admin-secrets pull). The agent and triager-warning code I reviewed at cc876f3 is unchanged, and my earlier findings still hold: nothing needs to change. I did not re-read the merged-in secrets code, which has its own pull. The docs check passed. The other checks (test, e2e, web, shots, lexicons, check) were still running or queued when I looked, so wait for them before merging. The gaps you listed remain: no test makes a real invitation fail, and the pages have no control for agents.

Since my last review this branch added one commit, which rewrites the Triagers hint in SettingsAccess.svelte. The new text is accurate and plainer. The agent and triager-warning code I reviewed earlier is unchanged, so my earlier findings stand and nothing needs to change.

I could not see any check results for this commit, so confirm CI is green before the queue lands it. The shots check may flag settings-access because the hint text changed; the body already lists it as moved. The gaps you listed remain: no test makes a real invitation fail, and the pages have no control for agents.

Since my last review this branch only merged serve/org-admin-cli in, which carries the commits "Only a bearer token asks the gateway to write" and "Renaming stays the organization's own". Those belong to that pull and I did not re-read them. The merge conflicts were in the changeset and the CLI and MCP docs. The agent and triager-warning code I reviewed earlier is unchanged, so my earlier findings stand and nothing needs to change here. All the checks (test, e2e, web, shots, lexicons, check, docs) were still queued when I looked, so wait for them to pass before merging. The gaps you listed remain: no test makes a real invitation fail, and the pages have no control for agents.

Carried forward: the change this pull makes at 8cea0198a09be9c40c520960db6b91815889d815 is the one reviewed at 1bd25e59919923fdfeba3324735579be7e24e5fe, so that review stands. What is new comes from its base.

Since my last review this branch added one commit and merged main. The commit builds the "no such repository" message in changed (manage.rs) before the .context call, instead of inside a closure. The behavior is the same, and format! runs on every call, which is negligible for a CLI path. The agent and triager-warning code I reviewed earlier is unchanged, so my earlier findings stand and nothing needs to change. I did not re-read the merged-in main code. The check workflow was running and the others were queued when I looked, so wait for them to pass before merging. The gaps you listed remain: no test makes a real invitation fail, and the pages have no control for agents.