0ae2ccc9 · zzmq.dev@gmail.com/zz
Commit
0ae2ccc9bc190212c0ff2399b793072d781e464a
One consistent identity everywhere: username only, bracket notation for managed agents Real inconsistency across the app: nav showed display_name, role-grant badges showed the raw internal agent id (e.g. "agent-5d773552"), the CLI printed "display_name (id)", autocomplete suggestions showed "display_name (username)", and the own-profile page repeated the same email twice via two different fields. No single field was the "real" identity shown consistently anywhere. Fixed by making `username` that one field, everywhere, on both web and CLI -- nav, profile pages, token lists, autocomplete labels/results, explore results, CLI agent/login output. A human's username is just their email (unchanged). A managed/synthetic agent has no email of its own, so its username now chains off its creator's, in brackets: "thoward37@gmail.com[claude]", or "thoward37@gmail.com[claude][helper]" for an agent that agent itself creates -- readable proof of who's accountable for it, directly in the id, with no separate "#self" tag needed since a human's own username already has no suffix. Bracket notation specifically because "#" starts a URL fragment and would never reach the server as part of the path; "[" and "]" sit outside the WHATWG URL spec's path percent-encode set, so they pass through a path segment unencoded. roles.json's `principal` field stays a bare agent id (it has to -- that's the immutable key RBAC checks run against, not a display string); every place that renders one now resolves it to a username first (new `usernameFor`), and every place that accepts one now resolves a typed-or-picked username back to the real agent (new `resolveAgent`, used by grant/transfer-ownership/add-token). This also fixed a bug introduced earlier in the same pass: the autocomplete's click handler filled the input with the raw id, not the username that was actually shown in the dropdown -- picking a suggestion would have silently shown you a different value than you clicked. Added repo settings' missing "Revoke" action on role grants -- needed to actually clean up a stale grant discovered live (the repo's "groq-test" maintainer grant had been written with the literal string "groq-test" as its principal, from before grants were consistently keyed by id, which the rename above would have left permanently orphaned with no way to fix it from the UI). Used it live to revoke and correctly re-grant that one. Renamed the one existing managed agent to the new scheme (groq-test -> thoward37@gmail.com[groq-test]) per direct confirmation. Verified live: settings page shows the new bracket-notation username, autocomplete suggests and correctly fills it, grant/revoke both round-tripped correctly against the real repo.
Troy Howard <thoward37@gmail.com> -- 2026-10-12T10:18:19.000Z