Repository navigation
feat(handoff): add skill-gated handoff action, access control gating, and OAuth expiry fixes - #252
Tharickv75 wants to merge 3 commits into
Conversation
eldonm
left a comment
eldonm
left a comment
There was a problem hiding this comment.
Reviewed revision b1048b09c4206bc16c17fafb8ea564ee1df2e732 against dev. I found six actionable issues: four P1 authorization/privacy/data-preservation problems and two P2 queue/delivery reliability problems, detailed inline. I recommend addressing these before merging.
Validation: the existing affected regression slices passed (1,003 passed, one skipped across orchestrator, access control, leadgen, WhatsApp, Google, MCP OAuth, and tool-schema tests; the separate handoff/new WhatsApp slice also passed). Six focused failure-injection/integration reproductions fail on this revision and substantiate the inline findings. External messaging and provider calls were mocked in those reproductions.
eldonm
left a comment
eldonm
left a comment
There was a problem hiding this comment.
Reviewed current head 5230fc7 against dev, including the follow-up fixes for the six earlier findings. The affected regression suite passes, but three independent failure-injection cases still fail: OAuth credential forwarding across origins, service-key disclosure across origins, and cross-worker pending-question lost updates. I cannot clear this revision for merging. Details and remediation are inline. All HTTP requests used MockTransport; all credentials were synthetic; no external messages were sent.
eldonm
left a comment
eldonm
left a comment
There was a problem hiding this comment.
Re-reviewed the four follow-up commits through a2571cb. The prior three blockers are addressed: authenticated redirect chains now reject other origins and HTTPS downgrades before sending; independently persisted HandoffQuestion nodes avoid the old shared-list lost update. I also verified concurrent independent creates against the real JSON adapter.
Two new issues in the storage refactor prevent clearance: question-by-ID operations do not enforce agent ownership, and the legacy Action-list migration cannot read old fields after an actual database cold load. Details are inline.
Validation: 871 affected tests passed, one skipped; all seven current GitHub checks are green. Additional real-JSON boundary tests reproduced both findings; independent-node round-trip and concurrent-create checks passed. Customer delivery and knowledge ingestion in the ownership reproduction were mocked; no external messages were sent. No source changes, commits, pushes, or merges were made during this re-review.
… fixes Rebased onto main 0.1.8rc20. Keeps handoff/consult/transfer/observe modes, AccessControl skill gating, MCP OAuth expiry/binding fixes, and leadgen full_name / profile resolution work. Branch stays on 0.1.8rc20-dev1 with Dockerfile and auto-tag targeting dev-tj. Co-authored-by: Cursor <cursoragent@cursor.com>
…ase version 0.1.8rc20 - Changed the branch in Dockerfile.base from dev-tj to main for cloning jvagent. - Updated auto-tag workflow to trigger on pushes to the main branch instead of dev-tj. - Updated version in jvagent/version.py from 0.1.8rc20-dev1 to 0.1.8rc20.
… and spec - Simplified string concatenation in handoff_action.py for better clarity. - Reformatted boolean expression in leadgen engine.py for enhanced readability. - Adjusted the formatting of frozenset in leadgen spec.py to align with style guidelines.
Description
Summary
This pull request introduces the new skill-gated handoff capability (
jvagent/handoff_action), skill access control filtering, and improvements to Google OAuth credential handling and lead generation profile persistence.Key updates include:
jvagent/handoff_action): Adds human-support capability tools (handoff__direct_contact,handoff__notify,handoff__staff_inbox, andhandoff__resolve) supported by thejvagent/skills/handofflibrary skill. Enables single staff random routing across WhatsApp/email channels, pending question tracking, and automatic PageIndex Q&A ingestion tohandoff.md.access-actionandallowed-groups/denied-groupsin skill frontmatter to selectively hide or reveal skills in the catalog based onAccessControlAction.user_groups.GoogleActionto properly handle ISO string formats and avoidValueErrorduring token refresh, alongside fixing service binding retention.README.mdforhandoff_action, updated actions catalog and changelog, and updated Dockerfiles/workflows for release versioning (0.1.8rc20-dev1).Type of change
Checklist
CONTRIBUTING.mdand (for subsystem work) the localAGENTS.md.pre-commit run --all-filespasses.pytest tests/passes; I added/updated tests for new behavior.file:linein the description.CHANGELOG.mdupdated where relevant (entry under[Unreleased]).