[fix] Show effective integration permissions

[Aman-goel-04]

Summary

The integration permission drawer showed Follow agent policy for both read-only and write/delete tools when the integration used the Ask for write and delete preset.

The root cause was that the drawer displayed the stored inherit value without resolving it against the agent-level permission policy. The runner already resolves this correctly, but the drawer did not show the effective result.

The drawer now resolves inherited permissions for display:

• Read-only tools follow allow_reads as runs automatically.
• Write, delete, and unknown tools follow allow_reads as asks first.
• Explicit Allow, Ask, and Deny permissions remain unchanged.

Fixes #6346

Testing

Verified locally

• Ran pnpm --filter @agenta/entity-ui lint.
• Ran pnpm --filter @agenta/entity-ui build.
• Verified the real local app with the Text to PDF integration.
• Set the integration default to Ask for write and delete.
• Confirmed the drawer shows:
  • Read-only: runs automatically
  • Write and delete: asks first

Added or updated tests

Added unit coverage for:

• Inherited permissions under allow_reads.
• Unknown tool access hints defaulting to Ask.
• Inherited permissions under Allow, Ask, and Deny policies.
• Explicit integration permissions remaining unchanged.
• Read-only and write/delete group rollups.

The focused test suite passes: 20 tests.

QA follow-up

N/A

Demo

Attach screenshots or videos captured from the real app running this branch:

• Before: both groups show follows agent policy.

• After: read-only shows runs automatically, and write and delete shows asks first.

Checklist

• Demo shows the real app running this branch, not a mock-up or recreated UI
• Relevant tests pass locally
• Relevant linting and formatting pass locally
• I have signed the CLA, or I will sign it when the bot prompts me

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[vercel]

@Aman-goel-04 is attempting to deploy a commit to the agenta projects Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 5ae3bcf9-365b-4c1e-afb0-5395185eda47

📥 Commits

Reviewing files that changed from the base of the PR and between 4b474bf and 617ccc6.

📒 Files selected for processing (3)

• web/packages/agenta-entity-ui/src/DrillInView/SchemaControls/agentTemplate/IntegrationPermissionDrawer.tsx
• web/packages/agenta-entity-ui/src/DrillInView/SchemaControls/integrationPolicy.ts
• web/packages/agenta-entity-ui/tests/unit/integrationPresets.test.ts

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes

  • Improved integration permission displays when permissions are inherited from an agent policy.
  • Group summaries now accurately reflect effective permissions for read-only and writable tools.
  • Updated permission labels to clearly indicate whether actions run automatically or require approval.

• Tests

  • Added coverage for inherited permissions and group-level permission labels.

Walkthrough

The change resolves inherited integration permissions for display, passes agent policy data into tool group rollups, and adds tests for effective permissions and group labels.

Changes

Integration permission display

Layer / File(s)	Summary
Effective permission resolution web/packages/agenta-entity-ui/src/DrillInView/SchemaControls/integrationPolicy.ts	Adds display-only resolution for inherited permissions and effective rollups for tool groups.
Drawer policy integration web/packages/agenta-entity-ui/src/DrillInView/SchemaControls/agentTemplate/IntegrationPermissionDrawer.tsx	Passes agentPolicy to both tool groups and uses rollupEffectiveGroupPermission.
Effective permission validation web/packages/agenta-entity-ui/tests/unit/integrationPresets.test.ts	Tests inherited permission resolution, explicit permission preservation, group rollups, and labels.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 617cc

This update makes inherited integration permissions display their effective read and write/delete behavior without changing enforcement or saved permissions. No actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: displaying effective integration permissions.
Description check	✅ Passed	The description directly explains the permission-resolution bug, the implemented fix, and the related tests.
Linked Issues check	✅ Passed	The changes resolve inherited permissions against the agent policy and display read-only tools as "runs automatically" and write/delete tools as "asks first," matching issue #6346. The added tests cov…
Out of Scope Changes check	✅ Passed	The changes are limited to permission-resolution logic, drawer integration, and focused unit tests. No unrelated code changes are evident.
Docstring Coverage	✅ Passed	Docstring coverage is 80.00% which is sufficient. The required threshold is 60.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 3 files.

Full details: Linked Issues check

Explanation

The changes resolve inherited permissions against the agent policy and display read-only tools as "runs automatically" and write/delete tools as "asks first," matching issue #6346. The added tests cover the effective resolution and group labels.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}