[PR #370] [MERGED] Add tiered/redacted agent activity responses and gated Detailed approvals UI #675

New issue

Closed

opened 2026-03-13 21:03:11 +03:00 by kerem · 0 comments

kerem commented

2026-03-13 21:03:11 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/AJaySi/ALwrity/pull/370
Author: @AJaySi
Created: 3/2/2026
Status: ✅ Merged
Merged: 3/3/2026
Merged by: @AJaySi

Base: main ← Head: codex/implement-response-tiers-for-activity-details

📝 Commits (1)

4f19b99 Add tiered agent activity responses with redaction and UI toggle

📊 Changes

3 files changed (+243 additions, -64 deletions)

View changed files

📝 backend/api/agents_api.py (+55 -59)
➕ backend/services/agent_activity_serializers.py (+146 -0)
📝 frontend/src/pages/ApprovalsPage.tsx (+42 -5)

📄 Description

Motivation

Provide configurable backend activity response tiers (summary, detailed, debug) so the frontend can request different levels of detail for agent activity.
Ensure sensitive data (tokens, raw prompts, credential-bearing URLs, PII) is redacted consistently before sending activity data to clients.
Expose a safe frontend control for Basic/Detailed views and gate advanced data behind user role or feature flag.

Description

Added a new backend serializer module backend/services/agent_activity_serializers.py implementing summary, detailed, and debug tiers, recursive redaction (redact_sensitive_data), URL query sanitization, and serialize_{alert,run,event,approval} helpers.
Updated backend/api/agents_api.py to accept a detail_tier query param on activity endpoints and to use the new serializers instead of returning raw fields; implemented _can_access_advanced_activity and _resolve_detail_tier to restrict debug access to admin/internal or flagged users (and to allow auth-disabled dev mode).
Frontend: updated frontend/src/pages/ApprovalsPage.tsx to add a Basic/Detailed ToggleButtonGroup, use useUser() metadata to gate the Detailed option, pass detail_tier to the backend request, and render an expanded payload block only when Detailed is active.
All non-debug serializations redact sensitive values for prompts, tokens, secret query params and common PII keys; debug remains backend-protected and will fall back to summary for unauthorized users.

Testing

Ran Python compilation for modified backend modules with python -m py_compile backend/api/agents_api.py backend/services/agent_activity_serializers.py, which succeeded.
Attempted frontend type-check with cd frontend && npx tsc --noEmit --pretty false, which reported missing type definitions (@types/jest and @types/node) in this environment and therefore failed to fully validate the TypeScript build (environment issue, not code logic in this PR).
Attempted a Playwright screenshot of http://localhost:3000/approvals to validate UI changes, but the frontend server was not running in the environment (ERR_EMPTY_RESPONSE).

Codex Task

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/AJaySi/ALwrity/pull/370 **Author:** [@AJaySi](https://github.com/AJaySi) **Created:** 3/2/2026 **Status:** ✅ Merged **Merged:** 3/3/2026 **Merged by:** [@AJaySi](https://github.com/AJaySi) **Base:** `main` ← **Head:** `codex/implement-response-tiers-for-activity-details` --- ### 📝 Commits (1) - [`4f19b99`](https://github.com/AJaySi/ALwrity/commit/4f19b993b40ed36034d9f92a4f3b9a6cbf6c80fb) Add tiered agent activity responses with redaction and UI toggle ### 📊 Changes **3 files changed** (+243 additions, -64 deletions) <details> <summary>View changed files</summary> 📝 `backend/api/agents_api.py` (+55 -59) ➕ `backend/services/agent_activity_serializers.py` (+146 -0) 📝 `frontend/src/pages/ApprovalsPage.tsx` (+42 -5) </details> ### 📄 Description ### Motivation - Provide configurable backend activity response tiers (`summary`, `detailed`, `debug`) so the frontend can request different levels of detail for agent activity. - Ensure sensitive data (tokens, raw prompts, credential-bearing URLs, PII) is redacted consistently before sending activity data to clients. - Expose a safe frontend control for Basic/Detailed views and gate advanced data behind user role or feature flag. ### Description - Added a new backend serializer module `backend/services/agent_activity_serializers.py` implementing `summary`, `detailed`, and `debug` tiers, recursive redaction (`redact_sensitive_data`), URL query sanitization, and `serialize_{alert,run,event,approval}` helpers. - Updated `backend/api/agents_api.py` to accept a `detail_tier` query param on activity endpoints and to use the new serializers instead of returning raw fields; implemented `_can_access_advanced_activity` and `_resolve_detail_tier` to restrict `debug` access to admin/internal or flagged users (and to allow auth-disabled dev mode). - Frontend: updated `frontend/src/pages/ApprovalsPage.tsx` to add a Basic/Detailed `ToggleButtonGroup`, use `useUser()` metadata to gate the Detailed option, pass `detail_tier` to the backend request, and render an expanded payload block only when Detailed is active. - All non-`debug` serializations redact sensitive values for prompts, tokens, secret query params and common PII keys; `debug` remains backend-protected and will fall back to `summary` for unauthorized users. ### Testing - Ran Python compilation for modified backend modules with `python -m py_compile backend/api/agents_api.py backend/services/agent_activity_serializers.py`, which succeeded. - Attempted frontend type-check with `cd frontend && npx tsc --noEmit --pretty false`, which reported missing type definitions (`@types/jest` and `@types/node`) in this environment and therefore failed to fully validate the TypeScript build (environment issue, not code logic in this PR). - Attempted a Playwright screenshot of `http://localhost:3000/approvals` to validate UI changes, but the frontend server was not running in the environment (`ERR_EMPTY_RESPONSE`). ------ [Codex Task](https://chatgpt.com/codex/tasks/task_e_69a5b39a7bcc832885ea021fe201e60c) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

kerem

2026-03-13 21:03:11 +03:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/ALwrity#675

No description provided.

Rows
Columns