feat: Add workbench actions by maciaszczykm · Pull Request #3910 · pluralsh/console

maciaszczykm · 2026-07-24T13:18:56Z

Fixes PROD-5073 too.

Test Plan

Test environment: https://console.plrl-dev-aws.onplural.sh/

Checklist

I have added a meaningful title and summary to convey the impact of this PR to a user.
If required, I have updated the Plural documentation accordingly.
I have added tests to cover my changes.
I have deployed the agent to a test environment and verified that it works as expected (required only when changing agent code).

Plural Flow: console

linear · 2026-07-24T13:18:58Z

PROD-5064

PROD-5073

soffi-ai · 2026-07-24T13:19:19Z

Soffi AI Summary

This PR adds workbench actions — a new approval/supervision workflow for AI workbench tool invocations that require human review before execution. It addresses PROD-5073.

The core change introduces an "Actions" tab in the workbench UI that surfaces pending tool calls waiting for human approval or denial. Key motivations and changes include:

Approval setting per tool: A new "Approvals" step is added to the workbench tool configuration form (alongside "Configuration" and "Access Policy") for tools that support it (cloud functions like Lambda, Cloud Run, Azure Functions, and others). This lets operators require human sign-off before the AI agent executes sensitive operations.
Awaiting Review workflow: The existing AwaitingReviewPanel and context are enhanced to handle workbench activity items — users can now approve or deny pending AI agent actions, optionally providing a denial reason. A new AwaitingReviewWorkbenchActivityItem component drives this interaction with a deny modal and status chip.
Cloud function tool form improvements: The tool form now correctly handles cloud function types (Lambda, Cloud Run, Azure Functions) including validation of required fields (ARN/identifier, description, input schema) and cloud connection provider selection. Previously, cloud connection fields were only shown for the generic Cloud tool type.
New icons: Three new icons added to the design system — LambdaIcon, GoogleCloudRunIcon, and MicrosoftActionsIcon — supporting the new cloud function tool types.
WorkbenchFormSteps: A new WorkbenchFormSteps component consolidates step navigation for workbench creation/editing flows.
DiffViewer improvements: The DiffViewer design system component gets minor refinements (with a new Storybook story added).
Client regeneration: GraphQL client is regenerated multiple times across commits to pick up schema changes supporting the new approval field on workbench tools and related query updates.

Commits

Commit	Summary
`35ddfc2`	Initial GraphQL client update to pick up new schema fields needed for workbench actions.
`c7c4bd9`	Added new icons to the design system: LambdaIcon, GoogleCloudRunIcon, and MicrosoftActionsIcon for cloud function tool types.
`37132d1`	Scaffolded the new custom workbench actions tab and related UI components.
`a415135`	Added the 'approval' setting to the workbench tool form, introducing a new 'Approvals' step in the tool configuration wizard for supported tool types.
`4c6f719`	Added a missing GraphQL query needed to support fetching workbench action/activity data.
`d6fd2b4`	Updated the Awaiting Review panel to surface workbench activity items alongside existing agent run items.
`67f9547`	Regenerated GraphQL client after schema/query changes.
`127ccff`	Another client regeneration pass to sync generated types with updated operations.
`1bf2924`	Fixed server-side code supporting the workbench actions feature.
`6c31ece`	Updated a GraphQL query (likely for actions or activity feed) to include additional fields.
`045f9b6`	Improved workbench tooltip copy or display.
`f7ec888`	Updated the Lightning icon in the design system (visual refinement).
`7dcfef0`	Initialized the Actions tab in the workbench UI, providing the entry point for the approval workflow.
`240d8df`	Fixed a bug in panel content presence check to correctly show/hide the actions panel.
`8a6af64`	Added filtering support for the workbench activity feed (e.g., filter by status or type).
`cfc1e7c`	Added a pending actions icon/indicator to surface unreviewed actions to the user.
`6f1acd6`	Fixed a bug where activity rejection was not handled correctly.
`2a54607`	Implemented the initial list view for workbench actions, showing pending tool invocations awaiting approval.
`8db02ce`	Fixed a bug in the tool configuration form affecting form state or validation.
`1c86a2c`	Updated the approve/deny action buttons in the actions panel.
`f78c536`	Added a status chip to action items to display the current action state (pending, approved, denied, etc.).
`a2724c6`	Added a deny modal with an optional reason field, allowing users to provide context when rejecting an AI agent action.
`032513f`	Conditionally shows the Actions tab only when there are actions present.
`2220bed`	Styling refinements for the actions/approvals UI.
`29260db`	Additional styling polish for the workbench actions panel.
`e21a27f`	Updated an icon used in the actions or workbench UI.
`7cf6469`	Extended action status handling to cover all possible states in the UI.
`53360c8`	Added action cards rendered inline in the chat view for pending approvals.
`add8584`	General updates and fixes to the actions workflow.
`c98c2b5`	Refactored components for better structure and reuse across the workbench actions feature.

Deploy in Soffi

Updated: 2026-07-28 18:08 UTC

Preserve upstream rejected activity status and MCP subagent selection, keep deny user attribution and k8s modes GraphQL. Co-authored-by: Cursor <cursoragent@cursor.com>

maciaszczykm · 2026-07-28T14:35:19Z

@greptileai

greptile-apps · 2026-07-28T14:38:57Z

Greptile Summary

The PR adds supervised workbench actions and their review workflow.

Adds approval and denial flows for function and Kubernetes workbench actions.
Adds server-side Kubernetes Secret redaction and safe diff retrieval.
Adds workbench action cards, status displays, denial controls, and Kubernetes diff rendering.
Extends GraphQL schemas, generated clients, tests, and design-system components supporting the workflow.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
lib/console/deployments/workbenches.ex	Adds transactional approval and rejection execution with row locking to serialize concurrent decisions.
lib/console/graphql/resolvers/deployments/workbench.ex	Adds action mutations and server-side redaction and retrieval logic for Kubernetes request diffs.
assets/src/graph/workbench.graphql	Adds workbench action mutations and a focused query for Kubernetes request diff data.
assets/src/components/workbenches/workbench/job/WorkbenchJobActionDetail.tsx	Implements the action-review UI and approval or denial interactions.
assets/src/components/workbenches/workbench/job/WorkbenchJobKubeUpdateDiff.tsx	Renders Kubernetes action diffs while suppressing Secret details in the UI.
test/console/deployments/workbenches_test.exs	Covers workbench action execution, including serialized concurrent approvals.
test/console/graphql/queries/deployments/workbench_queries_test.exs	Covers GraphQL retrieval and server-side redaction of Kubernetes Secret request bodies.

_{Reviews (2): Last reviewed commit: "fix build" | Re-trigger Greptile}

maciaszczykm · 2026-07-28T15:01:11Z

@greptileai

maciaszczykm · 2026-07-28T15:07:12Z

plural review this

plural-copilot

Nice feature set overall, and the prior Secret-body exposure issue looks addressed. I found two remaining issues before this is ready:

reject_job_activity/3 still allows an approve/reject race that can mark an already-executed action as rejected.
Kubernetes update action titles drop the object name, which makes the new action UIs ambiguous when multiple resources of the same kind are present.

Requesting changes for those.

plural-copilot · 2026-07-28T15:13:14Z

+
+export function formatKubeKindLabel(
+  resource: string | undefined
+): string | undefined {


getKubeActionTitle() only includes the resource name for delete actions. For update actions this collapses every item in a collection to the same title (e.g. every Deployment shows as just Deployments), which makes the new inline/action-list UI much harder to scan once there are multiple pending updates in the same namespace. Please include parsed.name for update actions too, similar to the delete case.

plural-copilot · 2026-07-28T15:13:14Z

-    get_workbench_job_activity!(activity_id)
-    |> allow(user, :approve)
-    |> when_ok(fn activity ->
+    start_transaction()


There’s still a race on rejection. reject_job_activity/3 now locks the row, but unlike approve_job_activity/2 it never verifies that the activity is still in :needs_approval before updating it. After one reviewer approves and releases the lock, a concurrent reject can acquire the lock and overwrite the now-successful activity to :rejected, leaving state inconsistent with the already-executed external action. Please guard reject the same way approval is effectively guarded, so only activities currently awaiting approval can transition to rejected.

michaeljguarino · 2026-07-28T15:18:41Z

+    |> paginate(args)
+  end
+
+  def function_call_tool(%{tool_id: id}, _, _) when is_binary(id),


the changes in this module are pretty clunky i'll try to make a few style improvements.

Okay, thank you.

michaeljguarino · 2026-07-28T18:09:12Z

@@ -0,0 +1,42 @@
+import createIcon from './createIcon'
+
+const icon =


embedding a png seems like the wrong approach here. You can either generate an svg from it with a tool or ask the ai to do that for you.

I've done a ton of these, I usually just prompt the ai to search for brand icons online, and generate the appropriate svg from them. It can normally figure it out, and often find one that's already availale online with web search.

maciaszczykm added 7 commits July 24, 2026 14:08

update client

35ddfc2

add icons

c7c4bd9

add new custom actions

37132d1

add approval setting

a415135

add missing query

4c6f719

update awaiting review panel

d6fd2b4

regenerate client

67f9547

maciaszczykm added the enhancement New feature or request label Jul 24, 2026

regenerate client

127ccff

maciaszczykm added 19 commits July 24, 2026 15:59

fix server code

1bf2924

update query

6c31ece

update workbench tooltip

045f9b6

update lightning icon

f7ec888

initialize actions tab

7dcfef0

fix panel content check

240d8df

allow activities filtering

8a6af64

add pending actions icon

cfc1e7c

fix activity rejection

6f1acd6

initial list action implementation

2a54607

fix tool form

8db02ce

update action buttons

1c86a2c

add status chip

f78c536

add deny modal with optional reason field

a2724c6

show action tab only if not empty

032513f

update styling

2220bed

update styling

29260db

update icon

e21a27f

handle all statuses

7cf6469

maciaszczykm and others added 17 commits July 27, 2026 16:22

refactor

c98c2b5

store info about user rejecting action

6d09bcb

add denial result

80e7b47

style error display

3d8ad0d

update cards

d48408b

update deny popover

5cfca4a

update card borders

f196497

add configure actions step

319824f

fix chip list

c8463d2

add checkboxes

4e75bcf

update awaiting review panel

4dd1949

Merge origin/master into prod-5064 branch.

420c56d

Preserve upstream rejected activity status and MCP subagent selection, keep deny user attribution and k8s modes GraphQL. Co-authored-by: Cursor <cursoragent@cursor.com>

add k8s cards

9d4a892

add k8s actions to actions panel

e216219

add delete variant

4d16056

move diff viewer to design system

be61aac

update memo display

ef44fc9

greptile-apps Bot reviewed Jul 28, 2026

View reviewed changes

Comment thread assets/src/graph/workbench.graphql

maciaszczykm added 3 commits July 28, 2026 16:47

protect secret bodies and make approval atomic

d45c101

regenrate schema

3b96441

fix build

12e13e2

plural-copilot Bot requested changes Jul 28, 2026

View reviewed changes

michaeljguarino reviewed Jul 28, 2026

View reviewed changes

michaeljguarino added 2 commits July 28, 2026 13:55

elixir cleanup

964a4d0

cleanup elixir changes

4f64e7e

michaeljguarino reviewed Jul 28, 2026

View reviewed changes

		@@ -0,0 +1,42 @@
		import createIcon from './createIcon'

		const icon =

Uh oh!

Conversation

maciaszczykm commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Plan

Checklist

Uh oh!

linear Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

soffi-ai Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Soffi AI Summary

Commits

Uh oh!

maciaszczykm commented Jul 28, 2026

Uh oh!

Uh oh!

greptile-apps Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

maciaszczykm commented Jul 28, 2026

Uh oh!

maciaszczykm commented Jul 28, 2026

Uh oh!

plural-copilot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

plural-copilot Bot Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

plural-copilot Bot Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

michaeljguarino Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

maciaszczykm Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

michaeljguarino Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

michaeljguarino Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

maciaszczykm commented Jul 24, 2026 •

edited

Loading

linear Bot commented Jul 24, 2026 •

edited

Loading

soffi-ai Bot commented Jul 24, 2026 •

edited

Loading

greptile-apps Bot commented Jul 28, 2026 •

edited

Loading