feat: AI Agents

[nimish-ks]

Summary

Adds Agents: AI coding agents (Claude Code, Codex, Cursor, and others) can use an organisation's Integration Credentials through the Phase CLI proxy without ever seeing the real secrets. The agent is handed decoy values; the proxy swaps in the real credential on the way out and reports what it did back to the console.

This PR is the console side: data model, APIs, access control and UI. AWS and PostgreSQL are the first supported services.

Backend

• Data model: 11 new models and migration 0141_agents: Agent, AgentWorkflow, AgentMembership, AgentWorkflowMembership, AgentConnection, AgentWorkflowGrant, AgentToken, AgentSession, AgentDecoy, AgentRequest, AgentEvent. It also adds ProviderCredentials.revision (backfilled per row) and three audit-log resource types.
• Service registry (api/utils/agent_config): JSON definitions for AWS and PostgreSQL. Each definition is validated when the module loads, and the registry publishes the capabilities a CLI must support.
• Runtime REST API (/v1/agents/) for the CLI proxy:
  • sessions: open, refresh, discover, rotate, revoke
  • service capabilities and agent context
  • proxy activity events
  • Agent requests, where an agent asks a human to set up or replace a credential
  • Agent tokens
• GraphQL management API for the console: Agents, Workflows, members, Connections, grants, tokens, sessions, requests and the activity log.
• Access control:
  • Roles gain an agent_permissions section.
  • Agent tokens are scoped to one Workflow.
  • Network access policies apply to Agent tokens.
  • Org SSO enforcement covers Agent operations.
  • Agent endpoints are rate limited.
• Offboarding: removing, deactivating (SCIM) or deleting a member revokes the Agent tokens and sessions they created.
• Audit log: Agent, Connection and request management actions are logged.

Integration credentials

• Sealed secrets. Secret fields are write-only: the API returns only non-sensitive fields (hosts, IDs, regions) and the names of stored secrets. Leaving a secret blank on edit keeps it.
• Moving a secret requires re-entering it. Changing a field that decides where a secret is sent (such as a Postgres host or Vault address) requires re-entering the secret.
• AWS External ID: the edit form offers Generate/Regenerate with Copy, since the stored value can't be shown.
• New PostgreSQL credential type, used by Agents.
• Update rules:
  • An edit is rejected if the credential changed since the form loaded.
  • Names are capped at 64 characters.
  • PostgreSQL fields are validated.
  • PostgreSQL Agent Connections follow their credential's host, port and database.
  • Running Agent sessions refresh so rotated secrets reach them.
  • A credential used by an Agent Connection can't be deleted.

Frontend

• Agents section: overview, Agents, Connections and Requests tabs. Each Agent has a page with tabs for Workflows, Sessions, Logs, Tokens and Members.
• Integrations page moved: /[team]/integrations/credentials is now /[team]/integrations, and the tab is renamed "Integrations". A temporary redirect keeps old links working, including query strings.
• Credential editor with sealed fields.
• Role editor: new Agent permissions section.

Reviewer notes

Agents

• Own permission section. Roles now have three maps: organisation (permissions), app (app_permissions) and agent (agent_permissions). Agents, AgentConnections and AgentRequests are organisation-level. AgentWorkflows, AgentMemberships, AgentTokens and AgentSessions are agent-level, which leaves room for team-owned Agents later. See permission_key_for in api/utils/access/roles.py.
• Roles stay backwards compatible. agent_permissions is optional when creating or updating a role, so existing API clients keep working. A custom role without it grants nothing within Agents. Managed roles come from the Python templates, so no data migration is needed; their meta.version was bumped.
• Starting an Agent runtime requires AgentSessions: create plus assignment to that Workflow; Owner and Admin don't need the assignment. Both are re-checked each time credentials are handed to a running session. There is no separate execute permission.
• Network access policies. Agent REST endpoints use the same IsIPAllowed check as the rest of the API. The only change is that Agent tokens now resolve to their organisation (3 lines in api/utils/access/middleware.py, with a test).
• Open-source code, not ee/:
  • REST: api/views/agents/
  • GraphQL: backend/graphene/agents/
  • Service definitions: api/utils/agent_config/services/v1/*.json
• _same_text_id() in api/models.py backs the checks that related Agent rows belong to the same organisation or Workflow. IDs are TextField(default=uuid4), so an unsaved object's id is a UUID while a loaded one is a str, and plain == would say they differ.
• Activity events are scrubbed by the CLI before they are sent. The console validates their shape and size but doesn't scrub them again.

Integration credentials

• Sealed-field lists. Each provider in api/services.py lists its non_sensitive_credentials (shown and editable) and endpoint_credentials (fields that decide where the secret is sent). Every other field is sealed. The frontend reads the same lists from the API (utils/syncing/general.ts).
• PostgreSQL Connections copy their endpoint from the credential. Editing a credential that Connections use updates those Connections in the same save, with a new host-rule version, and refreshes their sessions.

Integrations page

• Old links redirect. The redirect lives in frontend/next.config.js. The docs still use the old "Third-party credentials" wording; update them, then remove the redirect.