REMOTE-1601 Add named agent API key support behind FeatureFlag::NamedAgents by jasonkeung · Pull Request #10390 · warpdotdev/warp

jasonkeung · 2026-05-07T18:35:20Z

Description

Add support for creating API keys scoped to named agent identities in the Oz Cloud API Keys settings page, gated behind FeatureFlag::NamedAgents (dogfood-enabled).

When the flag is enabled, the "Team" option in the key-type selector is replaced with "Agent". Users can select which named agent the key authenticates as from a dropdown populated via GET /api/v1/agent/identities. If no agents exist, an empty state links to oz.warp.dev/agents to create one.

Changes

crates/warp_features: Add FeatureFlag::NamedAgents to dogfood
crates/warp_graphql_schema + crates/graphql: Add agentUid: ID to GenerateApiKeyInput
app/src/server/server_api/auth.rs: Add AgentIdentity type, list_agent_identities(), and agent_uid param to create_api_key()
app/src/settings_view/platform/create_api_key_modal.rs: Agent type selector, dropdown, empty state, create flow
app/src/settings_view/platform_page.rs: Scope column displays "Agent" when flag is on

Oz conversation · Plan

Linked Issue

The linked issue is labeled ready-to-spec or ready-to-implement.
Where appropriate, screenshots or a short video of the implementation are included below (especially for user-visible or UI changes).
https://www.loom.com/share/636237a795c34e1ca1806761b5018160

Testing

Feature is behind FeatureFlag::NamedAgents (dogfood only). Verified compilation of warp_features and warp_graphql crates. Full app compilation blocked by pre-existing http_client error unrelated to this change.

Agent Mode

Warp Agent Mode - This PR was created via Warp's AI Agent Mode

Co-Authored-By: Oz oz-agent@warp.dev

- Add taskGitCredentials types to schema.graphql (verified against staging) and add to clientQueries allowlist in client-schema.ts - Add task_git_credentials.rs GraphQL query file (cynic) following the task_secrets pattern - Add GitCredential struct and get_task_git_credentials to AIClient trait with a ServerApi implementation Co-Authored-By: Oz <oz-agent@warp.dev>

- Add driver/git_credentials.rs: atomic writes to ~/.git-credentials and ~/.config/gh/hosts.yaml, one-time git config setup (credential.helper store, url.insteadOf), git identity configuration, and refresh_loop() which re-fetches credentials every 50 minutes - Extend fetch_secrets_and_attachments to call taskGitCredentials in parallel at startup; writes credential files and git config - Add futures::select! refresh loop in run_internal, racing the harness execution against the infinite refresh loop for both Oz and ThirdParty harnesses Co-Authored-By: Oz <oz-agent@warp.dev>

- Write ~/.git-credentials and ~/.config/gh/hosts.yaml temp files with 0600 permissions (mode + set_permissions) matching the existing pattern in write_codex_auth_json, preventing other users from reading tokens - Add run_git_config_add (--add flag) so multi-value insteadOf entries coexist instead of the second overwriting the first - Derive SSH→HTTPS URL rewrites from credential hosts rather than hardcoding github.com, using --add for both scp-style and ssh:// forms per host Co-Authored-By: Oz <oz-agent@warp.dev>

Co-Authored-By: Oz <oz-agent@warp.dev>

On transient failure, retry up to 3 times with 1min, 2min, 4min delays, keeping all retries within the ~10-minute buffer before token expiry. Co-Authored-By: Oz <oz-agent@warp.dev>

…tion Co-Authored-By: Oz <oz-agent@warp.dev>

Co-Authored-By: Oz <oz-agent@warp.dev>

When enabled, the API key creation modal replaces the Team option with Agent, letting users select a named agent identity to scope the key to. Agents are fetched from GET /api/v1/agent/identities and the selected agent UID is sent via the existing agentUid field on GenerateApiKeyInput. Changes: - Add FeatureFlag::NamedAgents (dogfood-enabled) - Add agentUid to GraphQL schema and codegen GenerateApiKeyInput - Add AgentIdentity type and list_agent_identities to AuthClient - Add agent_uid parameter to create_api_key - Update CreateApiKeyModal with agent dropdown and empty-state linking to oz.warp.dev/agents - Show Scope column as Agent (not Team) when flag is enabled Co-Authored-By: Oz <oz-agent@warp.dev>

oz-for-oss · 2026-05-07T19:18:02Z

@jasonkeung

I'm starting a first review of this pull request.

You can view the conversation on Warp.

I completed the review and no human review was requested for this pull request.

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

oz-for-oss

Overview

This PR adds named-agent API key UI/API plumbing, but the diff also includes new cloud git credential management code. The changed Rust currently has compile errors, and there are correctness issues in the settings UI around API-key scope labeling and agent-list failures.

Concerns

The new git credential fetch code calls Duration::from_mins, which is not available on std::time::Duration, in two changed files.
Existing team-owned API keys are shown as Agent whenever FeatureFlag::NamedAgents is enabled because the UI maps every OwnerType::Team to ApiKeyScope::Agent.
Agent identity load failures are swallowed, so users see a no-agents empty state and disabled create flow instead of a load error or retry path.
Manual testing is required for changes that can be manually tested. Please include screenshots or a screen recording that show the API key modal/list changes working end to end, or justify why manual testing is not possible.

Verdict

Found: 2 critical, 3 important, 0 suggestions

Request changes

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

- Fix Duration::from_mins (doesn't exist) to Duration::from_secs(5 * 60) - Always map Team-owned API keys to Team scope, not Agent - Surface error toast on failed list_agent_identities instead of silently ignoring Co-Authored-By: Oz <oz-agent@warp.dev>

…nt-api-keys # Conflicts: # app/src/ai/agent_sdk/driver/git_credentials.rs # app/src/ai/agent_sdk/mod.rs

Co-Authored-By: Oz <oz-agent@warp.dev>

…n Agent variant Co-Authored-By: Oz <oz-agent@warp.dev>

jasonkeung · 2026-05-07T23:25:07Z

@oz-agent fix conflicts

oz-for-oss · 2026-05-07T23:25:16Z

@jasonkeung

I'm working on changes requested in this PR (responding to a PR conversation comment).

You can view the conversation on Warp.

I pushed changes to this PR based on the comment.

Next steps:

Review the changes pushed to this PR.
Follow up with another comment if further adjustments are needed.

Powered by Oz

ianhodge · 2026-05-07T23:28:09Z

Nice! Could we also update the list view to have the name of the agent that the key is associated with as a part of this PR? Might need to consult design about it

jasonkeung · 2026-05-07T23:36:01Z

Nice! Could we also update the list view to have the name of the agent that the key is associated with as a part of this PR? Might need to consult design about it

@ianhodge Currently the server API for these keys only returns them as team or personal, so to do that, we'd need to make some api and server changes to resolve the service account to an agent and change the response.

I thought about doing that, but do you think it could wait to be with the rest of the named agents work? or would the time to do this be now

ianhodge · 2026-05-07T23:53:04Z

makes sense, let's land this for now but we should def try and get that change in before launch if possible

right now it's kinda confusing to know the association for the keys

oz-for-oss · 2026-05-08T04:45:54Z

@jasonkeung

I'm starting a first review of this pull request.

You can view the conversation on Warp.

I completed the review and no human review was requested for this pull request.

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

oz-for-oss

Overview

This PR adds the named-agent API key creation path behind FeatureFlag::NamedAgents, including API/schema plumbing, fetching agent identities, and new modal UI.

Concerns

Agent-scoped keys are not actually represented in the settings table because ApiKeyScope::Agent is added only as a dead-code display variant; newly created and fetched keys still map scope from owner_type, which the PR notes does not distinguish agents from teams.

Verdict

Found: 0 critical, 1 important, 0 suggestions

Request changes

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

oz-for-oss · 2026-05-08T04:52:52Z

 enum ApiKeyScope {
    Personal,
    Team,
+    /// Not yet constructed — the server doesn't distinguish agent-scoped keys


⚠️ [IMPORTANT] ApiKeyScope::Agent is never constructed: both fetched keys and the just-created key still derive scope from owner_type, which this comment says the server reports as team, so agent-scoped keys will render as Team instead of Agent. Pass the selected key type through the create event or add server-provided agent scope before showing the Scope column as agent-aware.

see above convo, we will aim to land the server side change before launch

…Agents (warpdotdev#10390) ## Description Add support for creating API keys scoped to named agent identities in the Oz Cloud API Keys settings page, gated behind `FeatureFlag::NamedAgents` (dogfood-enabled). When the flag is enabled, the "Team" option in the key-type selector is replaced with "Agent". Users can select which named agent the key authenticates as from a dropdown populated via `GET /api/v1/agent/identities`. If no agents exist, an empty state links to `oz.warp.dev/agents` to create one. ### Changes - **`crates/warp_features`**: Add `FeatureFlag::NamedAgents` to dogfood - **`crates/warp_graphql_schema`** + **`crates/graphql`**: Add `agentUid: ID` to `GenerateApiKeyInput` - **`app/src/server/server_api/auth.rs`**: Add `AgentIdentity` type, `list_agent_identities()`, and `agent_uid` param to `create_api_key()` - **`app/src/settings_view/platform/create_api_key_modal.rs`**: Agent type selector, dropdown, empty state, create flow - **`app/src/settings_view/platform_page.rs`**: Scope column displays "Agent" when flag is on [Oz conversation](https://staging.warp.dev/conversation/d5027d88-07f2-482e-a2eb-39879d66fc9e) · [Plan](https://staging.warp.dev/drive/notebook/OC5WmSrFQZwF9BAYEhWMM6) ## Linked Issue - [ ] The linked issue is labeled `ready-to-spec` or `ready-to-implement`. - [x] Where appropriate, screenshots or a short video of the implementation are included below (especially for user-visible or UI changes). https://www.loom.com/share/636237a795c34e1ca1806761b5018160 ## Testing Feature is behind `FeatureFlag::NamedAgents` (dogfood only). Verified compilation of `warp_features` and `warp_graphql` crates. Full app compilation blocked by pre-existing `http_client` error unrelated to this change. ## Agent Mode - [x] Warp Agent Mode - This PR was created via Warp's AI Agent Mode Co-Authored-By: Oz <oz-agent@warp.dev> --------- Co-authored-by: Oz <oz-agent@warp.dev>

jasonkeung and others added 9 commits May 5, 2026 11:56

Merge branch 'master' into jason/remote-1370-phase2-impl

fb5acde

Restore git credentials refresh interval to 50 minutes

4bdfe70

Co-Authored-By: Oz <oz-agent@warp.dev>

Add exponential backoff to git credentials refresh loop

a9fdc0f

On transient failure, retry up to 3 times with 1min, 2min, 4min delays, keeping all retries within the ~10-minute buffer before token expiry. Co-Authored-By: Oz <oz-agent@warp.dev>

Revert formatting changes in wake_driver, codex, and error_classifica…

138fd31

…tion Co-Authored-By: Oz <oz-agent@warp.dev>

Remove excessive comments from git_credentials, driver, and mod

b245722

Co-Authored-By: Oz <oz-agent@warp.dev>

cla-bot Bot added the cla-signed label May 7, 2026

jasonkeung marked this pull request as ready for review May 7, 2026 19:17

oz-for-oss Bot reviewed May 7, 2026

View reviewed changes

Comment thread app/src/ai/agent_sdk/mod.rs

Comment thread app/src/ai/agent_sdk/driver/git_credentials.rs Outdated

Comment thread app/src/settings_view/platform_page.rs Outdated

Comment thread app/src/settings_view/platform/create_api_key_modal.rs Outdated

jasonkeung and others added 4 commits May 7, 2026 17:15

Address PR review comments

42b1d6b

- Fix Duration::from_mins (doesn't exist) to Duration::from_secs(5 * 60) - Always map Team-owned API keys to Team scope, not Agent - Surface error toast on failed list_agent_identities instead of silently ignoring Co-Authored-By: Oz <oz-agent@warp.dev>

Merge branch 'master' of github.com:warpdotdev/warp into jason/oz-age…

e9f046f

…nt-api-keys # Conflicts: # app/src/ai/agent_sdk/driver/git_credentials.rs # app/src/ai/agent_sdk/mod.rs

Remove excessive comments from API key modal and platform page

47a3c6e

Co-Authored-By: Oz <oz-agent@warp.dev>

Fix clippy: remove unused ThirdPartyHarness import, allow dead_code o…

2c5547a

…n Agent variant Co-Authored-By: Oz <oz-agent@warp.dev>

jasonkeung requested a review from ianhodge May 7, 2026 23:16

jasonkeung changed the title ~~Add named agent API key support behind FeatureFlag::NamedAgents~~ REMOTE-1601 Add named agent API key support behind FeatureFlag::NamedAgents May 7, 2026

Merge branch 'master' into jason/oz-agent-api-keys

1899604

ianhodge approved these changes May 7, 2026

View reviewed changes

jasonkeung enabled auto-merge (squash) May 8, 2026 04:36

jasonkeung added cla-signed and removed cla-signed labels May 8, 2026

jasonkeung marked this pull request as draft May 8, 2026 04:45

auto-merge was automatically disabled May 8, 2026 04:45
Pull request was converted to draft

jasonkeung marked this pull request as ready for review May 8, 2026 04:45

oz-for-oss Bot reviewed May 8, 2026

View reviewed changes

empty commit to trigger cla bot

5a1c80d

jasonkeung enabled auto-merge (squash) May 8, 2026 15:23

jasonkeung merged commit 7f5a689 into master May 8, 2026
25 checks passed

jasonkeung deleted the jason/oz-agent-api-keys branch May 8, 2026 15:35

Uh oh!

Conversation

jasonkeung commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changes

Linked Issue

Testing

Agent Mode

Uh oh!

oz-for-oss Bot commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

oz-for-oss Bot left a comment

Choose a reason for hiding this comment

Overview

Concerns

Verdict

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jasonkeung commented May 7, 2026

Uh oh!

oz-for-oss Bot commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ianhodge commented May 7, 2026

Uh oh!

jasonkeung commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ianhodge commented May 7, 2026

Uh oh!

oz-for-oss Bot commented May 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

oz-for-oss Bot left a comment

Choose a reason for hiding this comment

Overview

Concerns

Verdict

Uh oh!

oz-for-oss Bot May 8, 2026

Choose a reason for hiding this comment

Uh oh!

jasonkeung May 8, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jasonkeung commented May 7, 2026 •

edited

Loading

oz-for-oss Bot commented May 7, 2026 •

edited

Loading

oz-for-oss Bot commented May 7, 2026 •

edited

Loading

jasonkeung commented May 7, 2026 •

edited

Loading

oz-for-oss Bot commented May 8, 2026 •

edited

Loading