Setup user page: add an "AI Assistants" tab that shows and revokes the assistants a person authorized

domain:ui#3 · os-tesla · session_01L9qibxW6qraU2Z3mwupUGp

Filing gate: ③ the maintainer's order that names this work: #30894 (「都同意，立卡」, 2026-11-06). Its Expected says "An administrator can see and revoke them for a person they manage". ⛔ Not a claim. Triage sets the grade and the lane. Suggested grade: p1 (#30894's grade; this is the half that closes it).

Business reason. A person who lost a laptop with Claude Desktop on it may not be able to sign in and withdraw it themselves, and an administrator handling a departure or role change needs to see and end what acts as that person. The server doors exist (#31048, PR #31073) and the console widget is built (PR #31084), but no page shows it, so an administrator still cannot find it.

Reader. The lane that owns packages/platform-objects page metadata (domain:server), then the domain:ui seat holding #30894.

Dedupe. sys-user.page.ts tab (only the page's own history), authorized-assistants (#30918, #31048, both closed, #30894 open), admin revoke assistant user page (none). New.

What exists

GET /api/v1/auth/admin/authorized-clients?userId= and POST /api/v1/auth/admin/authorized-clients/withdraw { userId, id }, platform-admin gated (feat(plugin-auth): read the AI assistants a person has authorized, and when each was last used #30946, feat(auth): withdraw an authorized AI assistant, for the person and for a platform administrator #31073); client oauth.authorizedClients.listForUser / withdrawForUser.
PR feat(console): revoke an authorized AI assistant from Connect an Agent, and an admin widget for a person's assistants #31084 (Part of #30894) registers the SDUI widget mcp:authorized-assistants in @object-ui/app-shell. It takes no props and reads the bound record through useRecordContext(). That record must be a sys_user with an id; anywhere else it renders nothing. It lists that person's assistants with a confirm-first Revoke. A caller who is not a platform admin sees the server's 403 as a failed read.
packages/platform-objects/src/pages/sys-user.page.ts is kind: 'full' and owns a curated page:tabs strip (Details, Positions, Permission Sets, Business Units, Sessions, OAuth Apps, API Keys, Preferences, Security). The console has no ui-side door to add a tab there.

Wanted

One page:tabs item in sys-user.page.ts, "AI Assistants" (with the page's inline label locales), whose body is { type: 'mcp:authorized-assistants', properties: {} }.
Whether the tab is shown only to a platform administrator, and how, is this lane's call. The server refuses anyone else either way.
Lands after PR feat(console): revoke an authorized AI assistant from Connect an Agent, and an admin widget for a person's assistants #31084 (the widget must be registered before a page names it). This card's PR says Fixes #30894.

Related: #30894, #31048 (PR #31073), PR #31084, #30918 (PR #30946).

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: audit · p1 · `domain:server` · 2026-11-07T04:53Z

⛔ Not a claim.

The last piece of The OAuth consent page promises you can revoke access from your account settings, but no page lists the AI assistants you authorized #30894 (the maintainer's 「都同意，立卡」): an "AI Assistants" tab on Setup's user page (packages/platform-objects/src/pages/sys-user.page.ts, page:tabs) that mounts the mcp:authorized-assistants widget from PR feat(console): revoke an authorized AI assistant from Connect an Agent, and an admin widget for a person's assistants #31084. The server doors (Auth: the console cannot withdraw an authorized AI assistant: /oauth2/delete-consent has no ledger row or client method, and no admin door #31048, closed) and the widget exist, but no page shows them.
p1, inheriting The OAuth consent page promises you can revoke access from your account settings, but no page lists the AI assistants you authorized #30894's grade. Lane domain:server, because the page metadata lives in platform-objects. pm:queue.
Serial: the tab needs PR feat(console): revoke an authorized AI assistant from Connect an Agent, and an admin widget for a person's assistants #31084's widget registered. Take it after that PR lands, or in step with it. A tab that mounts an unregistered widget renders nothing.
The tab is visible to administrators who can open the user page. The widget's reads stay platform-admin gated on the server, so the tab widens nothing.

Generated by Claude Code

domain:server#3 · marchtian · session_017ihL2dFb2QdZEHEJ83cR2B

Claim: PM loop round 1 · 2026-11-07T12:24Z
Session: session_017ihL2dFb2QdZEHEJ83cR2B
Account: marchtian
Branch: claude/project-thread-le4ala
Worktree: objectstack-issue-31085 (the card thread's own checkout)
Domain: domain:server
Seat: domain:server#3
File surface: packages/platform-objects/** (sys-user.page.ts, its tests, generated files) (stop on breach; explain in the report)
Container & model: S · p1, mode:thread (card thread cmsg_01VmuUhXU9SSUzqJYyXSmYSiHv1cxwTdeSxGB8eq53bzeB of this account's project), model: TIER_DEFAULT — dispatch-gates --tier: no path-derived mandate, effort: session default — card-thread effort is set by the maintainer only; the seat's reading is xhigh (p1)
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card
Thread-read: 6702489619
Premise: holds — read at origin/main 5f00374: sys-user.page.ts has a curated page:tabs strip and 0 hits for authorized-assistants
Serial constraints cleared: PR #31084 (the widget this tab mounts) MERGED 2026-11-07T06:35Z; no open domain:server claim names sys-user.page.ts; sibling claims #31032 and #31029 (this seat) touch other platform-objects files — shared generated translation files, if any, are ordinary concurrency, the later lander resolves

The dispatch order is the card thread's opening message (files server-seat-3/orders/_standing.md + server-seat-3/orders/31085.md in this account's project); slot granted by the project coordinator.

domain:server#3 · marchtian · session_017ihL2eYx57mhWjgoaqt2rM
os-dev-report

{
  "issue": 31085,
  "status": "done",
  "branch": "claude/project-thread-le4ala",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/31125",
  "head": "d18d554e0bff9cab7da1e1a11b0ced63e9965a6d",
  "session": "session_017ihL2eYx57mhWjgoaqt2rM",
  "premise_still_valid": true,
  "summary": "sys_user_detail gains one page:tabs item 'AI Assistants' (en/zh-CN/ja-JP/es-ES/zh-Hant), placed after API Keys (both are credentials acting as this user), whose only child is { type: 'mcp:authorized-assistants', properties: {} }. Visibility: the page already has an item-level gate mechanism (the Security tab's visibleWhen in the P CEL envelope, fail-closed, omits header and panel), so the tab carries the ADR-0095 D3 rung current_user.isPlatformAdmin == true, spelled as the object's platform-admin actions spell it (platform-admin-affordance-standing.test.ts STANDING); no new key. The canonical-expression-envelopes door-3 precondition went red because the widget has no ComponentPropsMap row in packages/spec; per the lint detector's header the consumer records the exemption in its own assert: UNMAPPED_TYPE_EXEMPTIONS, held to an empty properties bag at the node's path, plus a liveness test that reds when the type gains a spec row or no page mounts it. Card assignee not written; PR opened draft with no assignees or reviewers.",
  "tests": "head d18d554e: `pnpm --filter @objectstack/platform-objects build && pnpm --filter @objectstack/platform-objects test && pnpm --filter @objectstack/platform-objects typecheck` :: exit 0 (lock VERDICT command-exit 0) — Test Files 118 passed (118), Tests 1650 passed (1650), check:test-typecheck OK. First run without platform-objects dist: 2 files red on '@objectstack/platform-objects/system' not found (cross-package import of unbuilt dist), green after build. Ablations via scripts/ablation-replace.mjs over the 3 page test files (31 tests), each restored blob==HEAD and git diff HEAD empty: A1 gate deleted -> 8 failed; A2 standing read from positions -> 3 failed; A3 widget authors props {title:'x'} -> 2 failed (body pin + door-3 exemption). No dist/build involved: tests import ./sys-user.page.js from src.",
  "gates": "dispatch-gates --commands derived 60 for head d18d554e; all 60 final exit 0 (list in PR body). First pass: 4 exited 3 (prerequisite): check-plugin-teardown-shape --self-test (shallow clone -> git fetch --unshallow origin main, rerun exit 0); check:dual-build-cjs-loads, check:i18n, check:lean-entry-closure (no dist -> pnpm exec turbo run build 120/120, rerun exit 0 each). `dispatch-gates --ran`: 60 derived, 60 run, 0 NOT-MEASURED, 0 UNRUN. Lint: platform-objects has no lint script; `eslint --no-inline-config` on the 4 touched .ts files :: exit 0. CI check-runs: in_progress at report time (PR just opened).",
  "line_budget": "223 changed lines (+217/-6), 5 files, under the 3000 human-merge threshold",
  "deviations": [
    "Lint run as eslint on the touched files, since @objectstack/platform-objects declares no lint script; repo-wide `pnpm lint` left to CI.",
    "Edited canonical-expression-envelopes.test.ts (in surface) to record the door-3 exemption; not named in the order, needed because the widget type has no spec ComponentPropsMap row."
  ],
  "files_changed": [
    ".changeset/31085-user-page-ai-assistants-tab.md",
    "packages/platform-objects/src/pages/canonical-expression-envelopes.test.ts",
    "packages/platform-objects/src/pages/sys-user-ai-assistants-tab.test.ts",
    "packages/platform-objects/src/pages/sys-user-security-tab-own-record.test.ts",
    "packages/platform-objects/src/pages/sys-user.page.ts"
  ],
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
  "mcp_calls": "0",
  "api_writes": "2 — fleet-write relay pr_create (repository_dispatch -> run 42375759010, PR #31125); this report comment via post-stamped.mjs. Plus git push (not a REST write).",
  "open_questions": [
    {
      "question": "Should mcp:authorized-assistants get a ComponentPropsMap row in packages/spec (emptyProps, like mcp:connect-agent), retiring the platform-objects exemption?",
      "options": [
        "A: leave the held exemption (this PR); the liveness test tells whoever adds the row to drop it",
        "B: a follow-up spec card adds emptyProps('mcp:authorized-assistants') (spec change, Fable review per project rule)"
      ],
      "recommendation": "A for this card; B is optional tidy-up, the seat's call to file."
    }
  ],
  "security_findings": "none",
  "out_of_scope_findings": [
    "carrier: none · noted, not filed — mcp:authorized-assistants has a UI zod arm (@object-ui/types) but no packages/spec ComponentPropsMap row; mcp namespace is not enum-reserved so it parses on the open arm; recorded in PR Acceptance notes · dedupe words: ComponentPropsMap mcp:authorized-assistants, emptyProps mcp"
  ]
}

domain:server#3 · marchtian · session_017ihL2dFb2QdZEHEJ83cR2B

Landed · 2026-11-07T14:06Z

reading	value
PR #31125	MERGED 2026-11-07T14:04:44Z through the merge queue, head `d18d554e0b`
this card	closed by that PR's `Fixes #31085`

State: pm:dispatched removed.

Navigation Menu

Repository navigation

Setup user page: add an "AI Assistants" tab that shows and revokes the assistants a person authorized #31085

What exists

Wanted

Triage: audit · p1 · `domain:server` · 2026-11-07T04:53Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Setup user page: add an "AI Assistants" tab that shows and revokes the assistants a person authorized #31085

Description

What exists

Wanted

Activity

objectstack-fleet commented on Nov 7, 2026

Triage: audit · p1 · domain:server · 2026-11-07T04:53Z

objectstack-fleet commented on Nov 7, 2026

objectstack-fleet commented on Nov 7, 2026

objectstack-fleet commented on Nov 7, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: audit · p1 · `domain:server` · 2026-11-07T04:53Z