feat(dashboard): the agent chat confirms held actions and shows minted keys once (WP-D client, lands with #381)

[LamaSu]

Draft: the client half of gateway WP-D (#381, board N9). Land it together with #381. Stacked on #354 (the route model: /agent renders this chat) and #368 (authorizedFetch). Base: master.

What changes in OnboardChatPage (/agent and /onboard/chat)

• Who the chat runs as. /agent runs the conversation as the signed-in user: its requests go through authorizedFetch, so the key reaches only the configured gateway. Public /onboard/chat stays anonymous and sends no key, even when someone is signed in.

• Held actions (pendingActions). Each renders with:

  • the gateway's own summary, the method and target;
  • for a credential-minting call, whose credential it creates (bindsTo), shown prominently.

  Nothing runs until the person presses Confirm. That sends one {conversationId, confirmActionId}, and a synchronous guard blocks a second send. The outcome shown is the gateway's confirmedAction (tool and HTTP status):

  • a refusal shows its reason;
  • a reply that doesn't say whether the action ran reads as unknown, never done;
  • an expired action offers no Confirm.

• Revealed secrets. Each renders once, with boundTo and "shown once". It lives only in component memory and is never written to storage; the gateway never replays it.

• Gateway URL. The health check and the anonymous chat use the validated gateway URL, not the raw VITE_PCC_URL.

• Copy. The agent intro now says the agent acts as you and that changes wait for your Confirm. The onboarding intro says nothing is created until you confirm it.

Tests

• agent-chat-held-actions.test.tsx (9 tests). 7 of the first 8 fail against fix(dashboard): one route model (the URL decides), real Agent mode, retire AgentChatPage #354's page; the one that passes asserts that onboarding sends no key, which was already true.
• Dashboard 297/297; tsc is clean.

Browser-verified against #381: 14/14 (returns/pcc-shell-work/e2e-wpd-20260924/)

Setup:

• a gateway built from fix(gateway): onboard chat keeps secrets out of history, runs as the caller, holds writes for confirmation (N9, WP-D) #381 (NODE_ENV=production, fresh DB);
• a local stub of the Anthropic Messages API via ANTHROPIC_BASE_URL, which scripts the model's tool calls. No real key was used, nothing was spent, and nothing left the machine.

Anonymous /onboard/chat:

• provision_api_key is held, with "This creates a credential for maker@example.test.";
• the POST carries no key;
• one Confirm request runs it, and the page shows "Done: the gateway ran provision_api_key and it answered 201";
• the new key (and the Ed25519 private key) are shown once, with whose they are;
• neither key is in any browser storage, and they are gone after a reload;
• GET /api/onboard/chat/:id never replays the key, and the revealed key validates.

Signed-in /agent:

• the POST carries the user's key, to the gateway;
• list_kernels runs directly;
• create_kernel is held, and nothing is created until Confirm (kernels 0 → 0 → 1);
• the page shows "create_kernel … answered 201".

The run found a bug, now fixed at 1577eb6. A new conversation sent conversationId: null. #381 looks up any conversationId it is sent, so it answered 404 and no chat could start. The client now omits the field until it has an id, and a new test covers it (9 tests; 1 fails with the old body).

🤖 Generated with Claude Code

https://claude.ai/code/session_01VU6exGFC7uLukeDF2GBUpQ