Merge feature/agent-detail-view (#444) and resolve conflicts, keeping the
PR's backend-driven detail page (API endpoint, audit scoping, tests) and
our enhanced agents list view (search, card headers, claim badges).
Also fixes three review issues:
- Add 403 guard for non-admin audit identity filter (prevents querying
events for identities the caller does not own)
- Add idx_audit_events_identity index via migration v2
- Update test assertions for new 403 behavior and migration count
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
When two processes with the same private key race to register, the loser
gets a 409 from the identity server. Re-resolve the handle by DID and
continue instead of failing startup.
Co-authored-by: Cursor <cursoragent@cursor.com>
Unifies first-run setup into a single idempotent command that registers
identity, completes claim, and imports API keys from env. Persists
--base-url in client config for remote daemon connections.
Closes#434
Co-authored-by: Cursor <cursoragent@cursor.com>
Adds `env: Literal["prod", "dev", "test"]` to `AuthsomeConfig` (read from
`AUTHSOME_ENV`) so the runtime environment is a first-class config concern
shared across client and server.
Gates `analytics_enabled` on `env == "prod"` in `ServerConfig` so PostHog
is never initialised in dev or test — preventing the background consumer
thread from blocking pytest process exit and causing CI jobs to hang until
the 6-hour GitHub Actions timeout.
Test suite now sets `AUTHSOME_ENV=test` at module level and in the
`_disable_analytics` autouse fixture. The CI workflow also sets it as
defence-in-depth and adds `timeout-minutes: 10` so runaway jobs fail fast.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Manoj Bajaj