feat: give every new agent identity hook ingestion and make its servers optional

Closed
MF
1d ago
+1819-102

Why

Agent identities should send hook events from the Speakeasy observability plugin by default, but no dashboard flow granted or requested org:hooks_ingest, so no dashboard-issued key could send them.

What changed

Before: new agents needed an MCP server and got only mcp:connect.

After:

  • Every new agent gets org:hooks_ingest bounded to its project, and its first key requests it, when the creator holds it. Otherwise the server step says it will not send hook events.
  • Server selection is optional. With none, the agent gets org:hooks_ingest and org:device_agent_sync, signs with an API key, and Install shows the SPEAKEASY_AI_HOOKS_* environment.
  • Issue a key offers hook events, project-bounded and selected by default, when the agent can delegate them. Continue without servers issues a hooks-only replacement key and shows the hooks environment.
  • A failed permissions lookup never adds an unconfirmed hook grant to agent creation.
  • docs/rbac.md updated. Platform MCP key issuance is intentionally excluded: it returns a plaintext secret that must stay in the dashboard's one-time display and the runtime's secret storage. Existing MCP tools do not create agents or keys. No demo seed change: seeded agents have no project.
  • Command K already indexes agent identities; this changes credential setup within existing pages, so no new candidate is needed.

Recording

Narrated before/after demonstration of a hooks-only agent issuing a replacement key. Before, the server step blocks progress. After, Continue without servers reaches project-bounded hook access and key review, with zero MCP servers. The capture stops before showing a secret. Narration is AI-generated with eSpeak NG.

Validation

132 focused frontend tests and dashboard type-check pass after reconciling the merged server-reach checks. The 3 agent-key backend tests and production build also passed before that reconciliation. Hook ingestion without project:read also requires #8086.

Gutternote review steps

  1. Identities → Agents → New agent identity: name it, tick a server, Continue. Grants reads mcp:connect, org:hooks_ingest. Create agent.
  2. On its page, Issue a key → pick the server → Access: Send hook events is ticked.
  3. Repeat step 1 with no server. Install shows the hooks environment.
  4. For a newly created agent with no servers, open Credentials → Issue a key → Continue without servers. Review and create the key; the install step shows the hooks environment, with no MCP access.

https://github.com/user-attachments/assets/bb665d17-9275-43c6-8735-b4f8bfdefb0c