Fix Agents send principal attribution

[KyleAMathews]

Fixes Electric Agents sends from the CLI and web UI by removing client-supplied legacy from attribution. CLI requests now always include a useful default Electric-Principal header (system:cli-<os-username>), so the server can keep deriving sender attribution from the authenticated principal.

Root Cause

The Agents send endpoint validates that any request body from value matches the authenticated Electric-Principal. Current clients could still send stale/display-level attribution (from: "user" in the UI repro, and the CLI's identity string), which does not match the server principal and produced 400 Request from must match Electric-Principal.

Approach

• Stop sending from in electric-ax agents send; the request body now contains only payload and optional type.
• Give the CLI a default principal header of system:cli-<os-username> when ELECTRIC_AGENTS_PRINCIPAL is not set.
• Stop the web UI send helper from resolving and posting a from value; optimistic local rendering still uses the active principal locally, while server writes are attributed by the server.
• Keep server validation strict instead of adding backward-compatible aliases.

Key Invariants

• Request body from, when present, must match the authenticated principal.
• First-party clients should not post from for normal user sends.
• Server-side attribution remains the source of truth for persisted inbox messages.

Non-goals

• No compatibility shim for old clients that still send from: "user".
• No changes to server-side authorization or principal validation semantics.

Trade-offs

I initially considered accepting from: "user" server-side as a compatibility alias, but that weakens the clarity of the send invariant. Since backwards compatibility is not required here, updating the current clients keeps the contract simpler.

Verification

cd packages/electric-ax
pnpm exec vitest run test/cli.test.ts

cd ../agents-server-ui
pnpm run typecheck

Also ran the changeset checker:

GITHUB_BASE_REF=main node scripts/check-changeset.mjs

Files changed

• .changeset/fix-cli-principal-send.md — patch changeset for electric-ax and @electric-ax/agents-server-ui.
• packages/electric-ax/src/index.ts — default CLI principal header and no from field in sends.
• packages/electric-ax/test/cli.test.ts — coverage for default CLI principal and send request body.
• packages/agents-server-ui/src/lib/sendMessage.ts — remove send-body principal resolution and from posting.

---

Fixes #4602

[github-actions]

Electric Agents Desktop Builds

Build artifacts for commit 2bcd913.

Platform	Status	Artifact
macOS Apple Silicon	Passed	DMG
macOS Intel	Passed	DMG
Windows x64	Passed	Installer
Linux x64	Passed	AppImage / deb

Workflow run

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 35.46%. Comparing base (e6171a9) to head (2bcd913).
✅ All tests successful. No failed tests found.

❗ There is a different number of reports uploaded between BASE (e6171a9) and HEAD (2bcd913). Click for more details.

HEAD has 21 uploads less than BASE

Flag	BASE (e6171a9)	HEAD (2bcd913)
unit-tests	11	4
packages/start	1	0
typescript	11	4
packages/y-electric	1	0
packages/agents	1	0
packages/react-hooks	1	0
packages/typescript-client	1	0
packages/agents-runtime	1	0
packages/experimental	1	0

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #4604       +/-   ##
===========================================
- Coverage   58.41%   35.46%   -22.96%     
===========================================
  Files         365      246      -119     
  Lines       41478    21001    -20477     
  Branches    11962     7423     -4539     
===========================================
- Hits        24228     7447    -16781     
+ Misses      17177    13520     -3657     
+ Partials       73       34       -39     

Flag	Coverage Δ
packages/agents	?
packages/agents-mobile	80.67% <ø> (ø)
packages/agents-runtime	?
packages/agents-server	75.29% <ø> (ø)
packages/agents-server-ui	7.51% <ø> (+0.01%)	⬆️
packages/electric-ax	47.62% <100.00%> (+1.19%)	⬆️
packages/experimental	?
packages/react-hooks	?
packages/start	?
packages/typescript-client	?
packages/y-electric	?
typescript	35.46% <100.00%> (-22.96%)	⬇️
unit-tests	35.46% <100.00%> (-22.96%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Electric Agents Mobile Build

Local mobile checks ran for commit 2bcd913.

The EAS Android preview build was skipped because the mobile-eas-build label is not present.
Add the mobile-eas-build label to this PR to produce an installable preview build.

Workflow run