Role-aware managed-config paths in ucode configure (AIGTWY-4338) - #404
Open
tt-le wants to merge 2 commits into
Open
Role-aware managed-config paths in ucode configure (AIGTWY-4338)#404tt-le wants to merge 2 commits into
ucode configure (AIGTWY-4338)#404tt-le wants to merge 2 commits into
Conversation
Make `ucode configure` branch on the caller's role and whether the workspace
already publishes a managed coding-agent config, per the AIGTWY-4329 epic. All
new behavior is gated by ENABLE_MANAGED_AGENT_CONFIG; with the flag unset,
`configure` runs the existing manual flow unchanged.
Once the target workspace is resolved and authenticated (up front, so the config
read is fresh and admin detection is reliable on an expired session):
- No managed config, admin -> drop straight into the `ucode setup` authoring
flow (configure is replacing setup) and exit with its code.
- No managed config, non-admin (or admin status unverifiable) -> run the normal
manual configure flow.
- Managed config, admin -> drop into setup, whose existing-config menu offers
Adopt (confirm it's in force) / re-author / delete.
- Managed config, non-admin -> confirm it's in force and point at `ucode`.
Adopt is a confirmation, not a local write: the launch path already applies the
managed config (agents, MCP servers, skills) on every `ucode` run, so both the
non-admin path and setup's Adopt choice share `_confirm_managed_config_in_force`.
When configure routes an admin into setup it hands setup the same token the admin
check already used, so setup's admin gate can't disagree with the routing decision
(a second token fetch could resolve a different identity right after a credential
switch, wrongly rejecting a caller configure just treated as an admin).
Also: the workspace picker and the setup flow's section headers now brand
themselves to the invoking command ("ucode configure" vs "ucode setup") via a
threaded label, so a configure user never sees stray "ucode setup" headers.
Admin status is a best-effort workspace-admin check (SCIM `Me` group membership),
mirroring the server-side authority; failures fall through safely.
Tests cover all four role/config paths, the flag-off no-op, the auth ordering,
the token reuse, the command-label branding, and setup's Adopt option.
Co-authored-by: Isaac <no-reply@databricks.com>
Collaborator
|
can you test against a workspace that doesn't have the functionality enabled yet and put a screenshot? if the workspace does not have the functionality enabled yet due to server side flag, then the admin flow should be same as non-admin flow. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Make
ucode configurebranch on the caller's role and whether the workspace already publishes a managed coding-agent config. All new behavior is gated by ENABLE_MANAGED_AGENT_CONFIG; with the flag unset,configureruns the existing manual flow unchanged.Once the target workspace is resolved and authenticated (up front, so the config read is fresh and admin detection is reliable on an expired session):
ucodeto startAlso: the workspace picker and the setup flow's section headers now brand themselves to the invoking command ("ucode configure" vs "ucode setup") via a threaded label, so a configure user never sees stray "ucode setup" headers. Admin status is a best-effort workspace-admin check (SCIM
Megroup membership), mirroring the server-side authority; failures fall through safely.Tests cover all four role/config paths, the flag-off no-op, the auth ordering, the command-label branding, and setup's Adopt option.
On non enabled workspaces:
As workspace admin:
Non workspace admin: