add changes

[elirazpevz]

Summary by CodeRabbit

• New Features

  • Expanded agent testing configuration with table, extractor, skills, execution mode, and HITL controls.
  • Added improved agent trace and chat API support.
  • Added structured schema planning and richer table profile information.

• Bug Fixes

  • Improved HITL resume and interruption handling.
  • Prevented duplicate table creation with clearer validation messages.
  • Avoided plausibility checks when query execution already failed.
  • Improved error reporting for failed data writes.

• API Updates

  • Updated generated API definitions and routes to support expanded agent, evaluation, authentication, and management features.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR updates agent HITL interruption handling, adds structured schema-planning models, enforces fully qualified table uniqueness, expands API contracts, and refactors the agent testing page around validated form state and typed resume payloads.

Changes

Agent workflow updates

Layer / File(s)	Summary
Agent node contracts and execution checks agent/src/agent/nodes/*	Schema planning is typed with Pydantic models, profile summaries retain fully qualified names, refinement receives the user query, ESCA failures are always logged, and plausibility checks skip queries with execution errors.
Interrupt detection and resume flow agent/src/agent/mcp_server.py	Resume handling distinguishes node-level and task-level interrupts, and interrupted results extract details from either state representation.

Table identity enforcement

Layer / File(s)	Summary
Database and backend duplicate enforcement core/src/core/models/models.py, backend/alembic/versions/..., backend/app/routers/tables.py	Tables gain composite fully qualified-name uniqueness, with migration reversibility and a backend conflict check before insertion.
Frontend duplicate validation frontend/src/components/tables/TableList.tsx, frontend/src/components/wizard/OnboardingWizard.tsx	Table creation forms reject duplicate source identifiers and qualified-name variants before mutation submission.

API contracts and agent testing UI

Layer / File(s)	Summary
API schemas and generated client types frontend/openapi.json, frontend/src/api/schema.d.ts, frontend/src/api/agent.ts	API routes are aligned to /api/..., agent endpoints and schemas are added, and shared generated types replace local agent interfaces.
Agent endpoint typing and configuration backend/app/config.py, backend/app/routers/agent.py	Trace responses are typed, Langfuse requests use a configurable timeout, and chat forwards active skills and execution mode.
Form-driven agent testing and resume UI frontend/src/pages/AgentTestingPage.tsx	Agent configuration uses React Hook Form and Zod, table metadata comes from TanStack Query, and approval or rejection sends typed resume values.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant AgentTestingPage
  participant AgentRouter
  participant chat_with_agent
  participant agent_graph
  AgentTestingPage->>AgentRouter: submit configuration or resume value
  AgentRouter->>chat_with_agent: forward tool arguments
  chat_with_agent->>agent_graph: inspect saved interrupt state
  chat_with_agent->>agent_graph: resume or update state
  agent_graph-->>chat_with_agent: final state or interruption
  chat_with_agent-->>AgentRouter: return result and interrupt details

Loading

Possibly related PRs

• StavPonte11/text2sql-onboarding#10: Introduced the agent nodes and runtime areas updated here.
• StavPonte11/text2sql-onboarding#13: Also modified MCP chat interruption handling.
• StavPonte11/text2sql-onboarding#15: Also updated the schema explorer contract and validation flow.

Suggested reviewers: yuvalkh

Poem

I’m a rabbit reviewing code,
Hopping through each schema road.
Interrupts resume, tables stay neat,
Typed forms make the flow complete.
Carrots for contracts—what a feat!

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 44.44% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The title is too generic and doesn't describe the actual change set.	Use a concise title that names the main change, such as adding agent chat, schema, and table uniqueness updates.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch eliraz/agent-ui

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 7

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (3)

agent/src/agent/nodes/schema_explorer.py (1)

611-617: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Populate the error field when structured output parsing fails.

The error field was recently added to SchemaExplorerOutput, but it is not being populated in the fallback object when an exception is caught. Including the exception details here prevents the error from being silently swallowed downstream.

🐛 Proposed fix

     except Exception as e:
         print(f"Structured output parsing failed in schema explorer: {e}")
         data = SchemaExplorerOutput(
             schema_plan=None,
             ambiguity_detected=False,
             ambiguity_message="",
             candidate_options=[],
+            error=str(e),
         )

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@agent/src/agent/nodes/schema_explorer.py` around lines 611 - 617, Update the
SchemaExplorerOutput fallback construction in the exception handler to populate
its error field with the caught exception details, while preserving the existing
default values for schema_plan, ambiguity_detected, ambiguity_message, and
candidate_options.

backend/app/routers/tables.py (1)

223-224: 🩺 Stability & Availability | 🔴 Critical | ⚡ Quick win

Race condition on concurrent table creation.

There is a Time-of-Check to Time-of-Use (TOCTOU) race condition between the select check above and this commit. If two identical creation requests execute concurrently, both will pass the select check. The second request's commit will then violate the new database-level UniqueConstraint and throw an unhandled IntegrityError, resulting in a 500 Internal Server Error crash instead of the intended 409 Conflict.

Catch the IntegrityError to safely fall back to the 409 Conflict response.

🔒️ Proposed fix to handle concurrency gracefully

+    from sqlalchemy.exc import IntegrityError
+
     session.add(table)
-    session.commit()
+    try:
+        session.commit()
+    except IntegrityError:
+        session.rollback()
+        raise HTTPException(
+            status_code=409,
+            detail=f"Table '{catalog_name}.{schema_name}.{name}' already exists."
+        )

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@backend/app/routers/tables.py` around lines 223 - 224, Update the
table-creation flow around session.add(table) and session.commit() to catch the
database IntegrityError caused by concurrent duplicate inserts, roll back the
session, and return the existing 409 Conflict response instead of propagating a
500 error. Preserve the current pre-insert select check and successful commit
behavior.

frontend/src/pages/AgentTestingPage.tsx (1)

1372-1381: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

isResuming is always false when this renders, and the 300ms delay leaves a double-submission window.

The parent only mounts this branch when chatResponse && !chatMutation.isPending (unchanged, line 1373), but is then given isResuming={chatMutation.isPending} (line 1378) — which is therefore always false for the lifetime of this mount. Combined with handleApprove/handleReject (lines 1123-1145) calling chatMutation.mutate() inside an un-guarded setTimeout(..., 300), the Approve/Reject buttons in AgentApprovalForm (lines 590-598, disabled/loading={isResuming}) never actually disable during that 300ms window, so a fast double-click can queue two mutate() calls resuming the same thread_id — a non-idempotent external call to the agent.

Tracking submission state locally (set synchronously on click, independent of chatMutation.isPending) would close this window, e.g.:

🔒️ Illustrative fix (needs matching change to the outer render-guard too)

+  const [isSubmittingResume, setIsSubmittingResume] = useState(false);
+
   const handleApprove = (resumeValue?: ResumeValue) => {
     if (!threadId) return;
     const config = watch();
+    setIsSubmittingResume(true);
     setTimeout(() => {
       chatMutation.mutate({
         thread_id: threadId,
         resume_value: resumeValue !== undefined ? resumeValue : { approved: true },
         hitl_enabled: config.hitlEnabled,
-      });
+      }, { onSettled: () => setIsSubmittingResume(false) });
     }, 300);
   };

Then pass isResuming={isSubmittingResume} at line 1378 instead of chatMutation.isPending.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@frontend/src/pages/AgentTestingPage.tsx` around lines 1372 - 1381, Track
resume submission locally in the AgentTestingPage approval flow, setting the
state synchronously when handleApprove or handleReject is triggered and
preventing subsequent submissions until completion. Update the AnimatePresence
render guard and the AgentApprovalForm isResuming prop to use this local
isSubmittingResume state, so the form remains mounted while submitting and its
buttons disable immediately through the delayed chatMutation call.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@agent/src/agent/nodes/schema_explorer.py`:
- Around line 172-175: Update the error field definition to use default=None
instead of default_factory=str, preserving its Optional[str] type and existing
description.

In `@backend/app/routers/agent.py`:
- Around line 70-79: Update the TraceSpan construction and its response model
handling so a missing Langfuse observation name/type never produces a None
span_name or response validation failure. Provide a non-null fallback label when
both values are absent, preserving the existing name/type preference and
ensuring all entries returned by the trace endpoint satisfy TraceSpan.span_name:
str.

In `@frontend/openapi.json`:
- Line 1: Confirm that the intentional migration of all endpoints to the /api
prefix has no consumers outside the generated TypeScript client; if external
consumers exist, preserve legacy routes or add a documented deprecation window
before removing them. Track the separate OpenAPI hygiene findings for global
security declarations and maxItems constraints on array schemas, without
expanding this prefix-migration change unless required.
- Line 1: The OpenAPI snapshot and generated frontend types are stale.
Regenerate the spec and frontend types from the current backend models so
`/api/agent/traces/{trace_id}` references the proper `TraceSpan` response schema
and `QueryApproval` contains only `approved` and `feedback`, removing
`rejection_category` and `suggested_fix`.

In `@frontend/src/components/tables/TableList.tsx`:
- Around line 86-91: Update duplicate validation around isDuplicate in TableList
to read the complete fetched table collection from the global query cache rather
than the filtered data variable. Mirror the cache-access pattern used by
OnboardingWizard, then preserve the existing oasis_source_id and composite-name
comparisons against all cached tables.

In `@frontend/src/pages/AgentTestingPage.tsx`:
- Around line 39-64: Replace the hand-written object variant in ResumeValue with
the existing QueryApproval type exported from ../api/agent, while preserving the
string and empty-record variants. Update the import in AgentTestingPage.tsx to
include QueryApproval and derive ResumeValue from that schema type so future
QueryApproval changes remain reflected automatically.
- Around line 1105-1120: The chat mutation setup in the AgentTestingPage
currently applies tableMode only to allowed_statuses while always forwarding
allowedTables. Wire tableMode into the ChatRequest so Exclusive mode excludes
the selected tables, or explicitly rename/reposition the control if it is
intended to govern statuses only; also simplify the redundant allowed_statuses
empty-length expression while preserving the request’s expected empty-array
behavior.

---

Outside diff comments:
In `@agent/src/agent/nodes/schema_explorer.py`:
- Around line 611-617: Update the SchemaExplorerOutput fallback construction in
the exception handler to populate its error field with the caught exception
details, while preserving the existing default values for schema_plan,
ambiguity_detected, ambiguity_message, and candidate_options.

In `@backend/app/routers/tables.py`:
- Around line 223-224: Update the table-creation flow around session.add(table)
and session.commit() to catch the database IntegrityError caused by concurrent
duplicate inserts, roll back the session, and return the existing 409 Conflict
response instead of propagating a 500 error. Preserve the current pre-insert
select check and successful commit behavior.

In `@frontend/src/pages/AgentTestingPage.tsx`:
- Around line 1372-1381: Track resume submission locally in the AgentTestingPage
approval flow, setting the state synchronously when handleApprove or
handleReject is triggered and preventing subsequent submissions until
completion. Update the AnimatePresence render guard and the AgentApprovalForm
isResuming prop to use this local isSubmittingResume state, so the form remains
mounted while submitting and its buttons disable immediately through the delayed
chatMutation call.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e384fa67-0f2d-4f66-b8db-0dfa0ee21015

📥 Commits

Reviewing files that changed from the base of the PR and between 45b5194 and da97353.

📒 Files selected for processing (16)

• agent/src/agent/mcp_server.py
• agent/src/agent/nodes/query_builder.py
• agent/src/agent/nodes/refiner.py
• agent/src/agent/nodes/satisfaction_check.py
• agent/src/agent/nodes/schema_explorer.py
• backend/alembic/versions/70e8a34ff877_add_unique_constraint_to_tables.py
• backend/app/config.py
• backend/app/routers/agent.py
• backend/app/routers/tables.py
• core/src/core/models/models.py
• frontend/openapi.json
• frontend/src/api/agent.ts
• frontend/src/api/schema.d.ts
• frontend/src/components/tables/TableList.tsx
• frontend/src/components/wizard/OnboardingWizard.tsx
• frontend/src/pages/AgentTestingPage.tsx

[coderabbitai]

📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Set default to None for optional fields.

Since error is typed as Optional[str], using default_factory=str initializes it to an empty string "" instead of None. It is more idiomatic and semantically accurate to use default=None for optional error fields.

♻️ Proposed refactor

     error: Optional[str] = Field(
-        default_factory=str, 
+        default=None, 
         description="Error message if any"
     )

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	error: Optional[str] = Field(
	default_factory=str,
	description="Error message if any"
	)
	error: Optional[str] = Field(
	default=None,
	description="Error message if any"
	)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@agent/src/agent/nodes/schema_explorer.py` around lines 172 - 175, Update the
error field definition to use default=None instead of default_factory=str,
preserving its Optional[str] type and existing description.

[coderabbitai]

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

span_name can be None from Langfuse data, but the model requires str — one bad observation 500s the whole endpoint.

obs.get("name") or obs.get("type") returns None if both are missing/falsy, but TraceSpan.span_name: str has no default and isn't Optional. Since the endpoint uses response_model=list[TraceSpan], FastAPI will raise a ResponseValidationError (500) when serializing the response if any observation hits this case, breaking the trace timeline for the whole trace instead of just skipping/labeling that one span.

🛡️ Proposed fix

             timeline.append(
                 {
-                    "span_name": obs.get("name") or obs.get("type"),
+                    "span_name": obs.get("name") or obs.get("type") or "unknown",

Also applies to: 304-316

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@backend/app/routers/agent.py` around lines 70 - 79, Update the TraceSpan
construction and its response model handling so a missing Langfuse observation
name/type never produces a None span_name or response validation failure.
Provide a non-null fallback label when both values are absent, preserving the
existing name/type preference and ensuring all entries returned by the trace
endpoint satisfy TraceSpan.span_name: str.

[coderabbitai]

🔒 Security & Privacy | 🔵 Trivial

Static-analysis findings on the regenerated spec worth a second look.

• oasdiff flags ~50 paths as "removed without deprecation" (e.g. POST /admin/login, GET /tables, POST /tables/{table_id}/eval/run). These all correspond to paths that were simply reprefixed with /api/..., which matches this PR's intended prefix migration — but for any consumer not using the generated TS client (docs, Postman collections, other-language SDKs, external integrations), this is a genuine breaking change with no deprecation window. Worth confirming there are no such external consumers before merging.
• Checkov also flags no global security scheme/operations (CKV_OPENAPI_4/5) and arrays without maxItems (CKV_OPENAPI_21) across many schemas (e.g. allowed_tables, coverage_tags). These are lower-priority hygiene gaps for an internal API but worth tracking if this spec is ever used for external-facing docs or codegen.

🧰 Tools

🪛 Checkov (3.3.8)

[high] 1: Ensure that the global security field has rules defined

(CKV_OPENAPI_4)

---

[high] 1: Ensure that security operations is not empty.

(CKV_OPENAPI_5)

---

[medium] 1: Ensure that arrays have a maximum number of items

(CKV_OPENAPI_21)

🪛 oasdiff (1.23.0)

[error] ~1-~1: api path removed without deprecation (POST /admin/login, section: paths, fingerprint: 2759666b2583)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /admin/tables/pending, section: paths, fingerprint: 5e85732b34b3)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /admin/tables/{table_id}/approve, section: paths, fingerprint: 1c283e376497)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /admin/tables/{table_id}/reject, section: paths, fingerprint: 1e8012be427a)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /audit/queries, section: paths, fingerprint: eff8254b2af2)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /eval/batch/{promotion_run_id}, section: paths, fingerprint: 01f2fd7fb4b2)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /eval/readiness, section: paths, fingerprint: 6bcee4db1f02)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /eval/runs/all, section: paths, fingerprint: 1237f53eb62e)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /eval/{run_id}, section: paths, fingerprint: a6dce4b89ad4)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /eval/{run_id}/regression-diff, section: paths, fingerprint: 086d107232dd)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /eval/{run_id}/report, section: paths, fingerprint: a6d65b63584f)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /eval/{run_id}/results, section: paths, fingerprint: af257c0f1a70)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /evaluations/alerts, section: paths, fingerprint: f88dbff231e0)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /evaluations/alerts/{alert_id}/acknowledge, section: paths, fingerprint: 6214d0ce6167)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /evaluations/analytics/tables, section: paths, fingerprint: 3b2a6260b1ae)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /evaluations/analytics/trends, section: paths, fingerprint: 85483129adc2)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /evaluations/compare, section: paths, fingerprint: c81fa982bb08)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /evaluations/run, section: paths, fingerprint: dc79feefa5c3)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /evaluations/runs, section: paths, fingerprint: 8b95774d7d8a)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /evaluations/runs/{run_id}, section: paths, fingerprint: 6f29bda06819)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /evaluations/runs/{run_id}/report, section: paths, fingerprint: 0173e5c298d2)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /evaluations/schedules, section: paths, fingerprint: 30121406599d)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /evaluations/schedules, section: paths, fingerprint: c4866ce58b1b)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (DELETE /evaluations/schedules/{schedule_id}, section: paths, fingerprint: 2de5a0004f2c)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (PUT /evaluations/schedules/{schedule_id}, section: paths, fingerprint: f1c13b9efba1)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /evaluations/system-health, section: paths, fingerprint: c4cf03c5408c)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /feedback, section: paths, fingerprint: 85b15c5cf6d8)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /feedback/query/{query_id}, section: paths, fingerprint: b064ce64f72b)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /feedback/table/{table_id}, section: paths, fingerprint: 4f1f62f4cf78)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /health/all, section: paths, fingerprint: 701cd4faf71a)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /scopes, section: paths, fingerprint: f7c4a8c32d3a)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /scopes, section: paths, fingerprint: 8c0e13f20548)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /scopes/{scope_id}/activate, section: paths, fingerprint: 346e4981ca18)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /tables, section: paths, fingerprint: 76500138535f)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /tables, section: paths, fingerprint: 1b3f63295784)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /tables/all/profile/run, section: paths, fingerprint: 48aec25271b5)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /tables/{table_id}, section: paths, fingerprint: a44bf0920021)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /tables/{table_id}/columns/{column}/profile, section: paths, fingerprint: 5a1ae6a194bb)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /tables/{table_id}/cross-profile, section: paths, fingerprint: a4e43d44c518)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /tables/{table_id}/cross-profile, section: paths, fingerprint: 2d275d067db5)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /tables/{table_id}/enrichment, section: paths, fingerprint: 531e9962bf89)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /tables/{table_id}/enrichment/latest, section: paths, fingerprint: 98278a6bcdf1)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /tables/{table_id}/eval/run, section: paths, fingerprint: 173951454ac9)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /tables/{table_id}/eval/runs, section: paths, fingerprint: 214244deadad)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /tables/{table_id}/health, section: paths, fingerprint: 9dd6e4850cd0)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /tables/{table_id}/health/recompute, section: paths, fingerprint: 8922bb9f39ad)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /tables/{table_id}/profile, section: paths, fingerprint: 05fdb4e4560e)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /tables/{table_id}/profile/columns, section: paths, fingerprint: 9c8242d2a41c)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /tables/{table_id}/profile/context, section: paths, fingerprint: 6faf52f7f154)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /tables/{table_id}/profile/run, section: paths, fingerprint: 98f1e54e51eb)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /tables/{table_id}/publish, section: paths, fingerprint: 1aec71000185)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /tables/{table_id}/questions, section: paths, fingerprint: 1b07e6905985)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /tables/{table_id}/questions, section: paths, fingerprint: 919d5aad6644)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /tables/{table_id}/questions/upload, section: paths, fingerprint: 585235c3a7ad)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (DELETE /tables/{table_id}/questions/{question_id}, section: paths, fingerprint: 2a9afa751245)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (PATCH /tables/{table_id}/status, section: paths, fingerprint: b4f5953ffb45)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /tables/{table_id}/sync-schema, section: paths, fingerprint: 792107022ecf)

(api-path-removed-without-deprecation)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@frontend/openapi.json` at line 1, Confirm that the intentional migration of
all endpoints to the /api prefix has no consumers outside the generated
TypeScript client; if external consumers exist, preserve legacy routes or add a
documented deprecation window before removing them. Track the separate OpenAPI
hygiene findings for global security declarations and maxItems constraints on
array schemas, without expanding this prefix-migration change unless required.

Source: Linters/SAST tools

---

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== files ==\n'
git ls-files 'backend/app/routers/agent.py' 'frontend/openapi.json' 'frontend/src/api/schema.d.ts' 'frontend/src/**/AgentTestingPage.tsx' | sed 's#^`#-` #'

for f in backend/app/routers/agent.py frontend/openapi.json frontend/src/api/schema.d.ts frontend/src/**/AgentTestingPage.tsx; do
  [ -e "$f" ] || continue
  printf '\n== %s (lines, size) ==\n' "$f"
  wc -l "$f"
done

printf '\n== agent router snippets ==\n'
sed -n '1,220p' backend/app/routers/agent.py

printf '\n== schema.d.ts snippets around TraceSpan / get_trace_timeline ==\n'
rg -n "TraceSpan|get_trace_timeline|QueryApproval" frontend/src/api/schema.d.ts

Repository: StavPonte11/text2sql-onboarding

Length of output: 8618

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== frontend/openapi.json TraceSpan / QueryApproval occurrences ==\n'
rg -n '"TraceSpan"|"QueryApproval"|/api/agent/traces/\{trace_id\}|rejection_category|suggested_fix' frontend/openapi.json

printf '\n== AgentTestingPage references ==\n'
rg -n 'rejection_category|suggested_fix|approved|feedback|QueryApproval' frontend/src/**/AgentTestingPage.tsx

Repository: StavPonte11/text2sql-onboarding

Length of output: 50387

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
import json
from pathlib import Path

spec = json.loads(Path("frontend/openapi.json").read_text())
paths = spec.get("paths", {})
schemas = spec.get("components", {}).get("schemas", {})

trace = paths.get("/api/agent/traces/{trace_id}", {}).get("get", {})
qapp = schemas.get("QueryApproval", {})

print("trace_200_schema:", trace.get("responses", {}).get("200", {}).get("content", {}).get("application/json", {}).get("schema"))
print("has_TraceSpan_schema:", "TraceSpan" in schemas)
print("QueryApproval_properties:", list(qapp.get("properties", {}).keys()))
PY

printf '\n-- backend/app/routers/agent.py relevant lines --\n'
rg -n 'class TraceSpan|class QueryApproval|response_model=list\[TraceSpan\]|response_model' backend/app/routers/agent.py

printf '\n-- frontend/src/api/schema.d.ts relevant lines --\n'
rg -n 'TraceSpan|get_trace_timeline|QueryApproval' frontend/src/api/schema.d.ts

Repository: StavPonte11/text2sql-onboarding

Length of output: 1062

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '1720,1742p' frontend/src/api/schema.d.ts

Repository: StavPonte11/text2sql-onboarding

Length of output: 879

---

Regenerate this OpenAPI snapshot — it’s out of sync with the backend contract: /api/agent/traces/{trace_id} still has an empty 200 schema and no TraceSpan component, and QueryApproval still includes rejection_category/suggested_fix even though the backend model only has approved and feedback. Rebuild the spec and the generated frontend types from the current backend models.

🧰 Tools

🪛 Checkov (3.3.8)

[high] 1: Ensure that the global security field has rules defined

(CKV_OPENAPI_4)

---

[high] 1: Ensure that security operations is not empty.

(CKV_OPENAPI_5)

---

[medium] 1: Ensure that arrays have a maximum number of items

(CKV_OPENAPI_21)

🪛 oasdiff (1.23.0)

[error] ~1-~1: api path removed without deprecation (POST /admin/login, section: paths, fingerprint: 2759666b2583)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /admin/tables/pending, section: paths, fingerprint: 5e85732b34b3)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /admin/tables/{table_id}/approve, section: paths, fingerprint: 1c283e376497)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /admin/tables/{table_id}/reject, section: paths, fingerprint: 1e8012be427a)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /audit/queries, section: paths, fingerprint: eff8254b2af2)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /eval/batch/{promotion_run_id}, section: paths, fingerprint: 01f2fd7fb4b2)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /eval/readiness, section: paths, fingerprint: 6bcee4db1f02)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /eval/runs/all, section: paths, fingerprint: 1237f53eb62e)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /eval/{run_id}, section: paths, fingerprint: a6dce4b89ad4)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /eval/{run_id}/regression-diff, section: paths, fingerprint: 086d107232dd)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /eval/{run_id}/report, section: paths, fingerprint: a6d65b63584f)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /eval/{run_id}/results, section: paths, fingerprint: af257c0f1a70)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /evaluations/alerts, section: paths, fingerprint: f88dbff231e0)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /evaluations/alerts/{alert_id}/acknowledge, section: paths, fingerprint: 6214d0ce6167)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /evaluations/analytics/tables, section: paths, fingerprint: 3b2a6260b1ae)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /evaluations/analytics/trends, section: paths, fingerprint: 85483129adc2)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /evaluations/compare, section: paths, fingerprint: c81fa982bb08)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /evaluations/run, section: paths, fingerprint: dc79feefa5c3)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /evaluations/runs, section: paths, fingerprint: 8b95774d7d8a)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /evaluations/runs/{run_id}, section: paths, fingerprint: 6f29bda06819)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /evaluations/runs/{run_id}/report, section: paths, fingerprint: 0173e5c298d2)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /evaluations/schedules, section: paths, fingerprint: 30121406599d)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /evaluations/schedules, section: paths, fingerprint: c4866ce58b1b)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (DELETE /evaluations/schedules/{schedule_id}, section: paths, fingerprint: 2de5a0004f2c)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (PUT /evaluations/schedules/{schedule_id}, section: paths, fingerprint: f1c13b9efba1)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /evaluations/system-health, section: paths, fingerprint: c4cf03c5408c)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /feedback, section: paths, fingerprint: 85b15c5cf6d8)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /feedback/query/{query_id}, section: paths, fingerprint: b064ce64f72b)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /feedback/table/{table_id}, section: paths, fingerprint: 4f1f62f4cf78)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /health/all, section: paths, fingerprint: 701cd4faf71a)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /scopes, section: paths, fingerprint: f7c4a8c32d3a)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /scopes, section: paths, fingerprint: 8c0e13f20548)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /scopes/{scope_id}/activate, section: paths, fingerprint: 346e4981ca18)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /tables, section: paths, fingerprint: 76500138535f)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /tables, section: paths, fingerprint: 1b3f63295784)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /tables/all/profile/run, section: paths, fingerprint: 48aec25271b5)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /tables/{table_id}, section: paths, fingerprint: a44bf0920021)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /tables/{table_id}/columns/{column}/profile, section: paths, fingerprint: 5a1ae6a194bb)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /tables/{table_id}/cross-profile, section: paths, fingerprint: a4e43d44c518)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /tables/{table_id}/cross-profile, section: paths, fingerprint: 2d275d067db5)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /tables/{table_id}/enrichment, section: paths, fingerprint: 531e9962bf89)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /tables/{table_id}/enrichment/latest, section: paths, fingerprint: 98278a6bcdf1)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /tables/{table_id}/eval/run, section: paths, fingerprint: 173951454ac9)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /tables/{table_id}/eval/runs, section: paths, fingerprint: 214244deadad)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /tables/{table_id}/health, section: paths, fingerprint: 9dd6e4850cd0)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /tables/{table_id}/health/recompute, section: paths, fingerprint: 8922bb9f39ad)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /tables/{table_id}/profile, section: paths, fingerprint: 05fdb4e4560e)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /tables/{table_id}/profile/columns, section: paths, fingerprint: 9c8242d2a41c)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /tables/{table_id}/profile/context, section: paths, fingerprint: 6faf52f7f154)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /tables/{table_id}/profile/run, section: paths, fingerprint: 98f1e54e51eb)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /tables/{table_id}/publish, section: paths, fingerprint: 1aec71000185)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (GET /tables/{table_id}/questions, section: paths, fingerprint: 1b07e6905985)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /tables/{table_id}/questions, section: paths, fingerprint: 919d5aad6644)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /tables/{table_id}/questions/upload, section: paths, fingerprint: 585235c3a7ad)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (DELETE /tables/{table_id}/questions/{question_id}, section: paths, fingerprint: 2a9afa751245)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (PATCH /tables/{table_id}/status, section: paths, fingerprint: b4f5953ffb45)

(api-path-removed-without-deprecation)

---

[error] ~1-~1: api path removed without deprecation (POST /tables/{table_id}/sync-schema, section: paths, fingerprint: 792107022ecf)

(api-path-removed-without-deprecation)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@frontend/openapi.json` at line 1, The OpenAPI snapshot and generated frontend
types are stale. Regenerate the spec and frontend types from the current backend
models so `/api/agent/traces/{trace_id}` references the proper `TraceSpan`
response schema and `QueryApproval` contains only `approved` and `feedback`,
removing `rejection_category` and `suggested_fix`.

[coderabbitai]

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Client-side duplicate validation is bypassed when filters are active.

The data variable only contains tables matching the current search and status filters. If a duplicate table exists but is currently hidden by a filter, this check will incorrectly pass, causing the form validation to be bypassed and leading to an unexpected backend error message.

Use the global query cache to check against all fetched tables, mirroring the reliable approach used in the OnboardingWizard.

🐛 Proposed fix

   const onSubmit = (formData: CreateSchemaType) => {
-    const isDuplicate = data?.some(
-      (t) =>
-        t.oasis_source_id === formData.oasis_source_id ||
-        `${t.service}.${t.catalog}.${t.schema_name}.${t.name}` === formData.oasis_source_id ||
-        `${t.catalog}.${t.schema_name}.${t.name}` === formData.oasis_source_id
-    );
+    const queriesData = qc.getQueriesData<Table[]>({ queryKey: ['tables'] });
+    const existingTables = queriesData.flatMap(([_, d]) => d || []);
+
+    const isDuplicate = existingTables.some(
+      (t) =>
+        t.oasis_source_id === formData.oasis_source_id ||
+        `${t.service}.${t.catalog}.${t.schema_name}.${t.name}` === formData.oasis_source_id ||
+        `${t.catalog}.${t.schema_name}.${t.name}` === formData.oasis_source_id
+    );

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	const isDuplicate = data?.some(
	(t) =>
	t.oasis_source_id === formData.oasis_source_id ||
	`${t.service}.${t.catalog}.${t.schema_name}.${t.name}` === formData.oasis_source_id ||
	`${t.catalog}.${t.schema_name}.${t.name}` === formData.oasis_source_id
	);
	const onSubmit = (formData: CreateSchemaType) => {
	const queriesData = qc.getQueriesData<Table[]>({ queryKey: ['tables'] });
	const existingTables = queriesData.flatMap(([_, d]) => d || []);
	const isDuplicate = existingTables.some(
	(t) =>
	t.oasis_source_id === formData.oasis_source_id ||
	`${t.service}.${t.catalog}.${t.schema_name}.${t.name}` === formData.oasis_source_id ||
	`${t.catalog}.${t.schema_name}.${t.name}` === formData.oasis_source_id
	);

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@frontend/src/components/tables/TableList.tsx` around lines 86 - 91, Update
duplicate validation around isDuplicate in TableList to read the complete
fetched table collection from the global query cache rather than the filtered
data variable. Mirror the cache-access pattern used by OnboardingWizard, then
preserve the existing oasis_source_id and composite-name comparisons against all
cached tables.

[coderabbitai]

📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

ResumeValue re-declares a shape that already exists in the generated schema.

ResumeValue's object variant ({ approved: boolean; feedback?: string; }) is a hand-rolled subset of QueryApproval (already exported from ../api/agent, which also has optional rejection_category/suggested_fix). Since this PR is specifically about typed resume payloads, deriving ResumeValue from the schema instead of a manual copy avoids future drift if QueryApproval changes again.

♻️ Proposed refactor

-export type ResumeValue = 
-  | string 
-  | Record<string, never> 
-  | { approved: boolean; feedback?: string; };
+export type ResumeValue = NonNullable<ChatRequest['resume_value']>;

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	import { tablesApi } from '../api/client';
	import type { ChatRequest, ChatResponse } from '../api/agent';
	import type { Table } from '../types';
	import type { components } from '../api/schema';
	export type TraceSpan = components['schemas']['TraceSpan'];
	export type ResumeValue =
	| string
	| Record<string, never>
	| { approved: boolean; feedback?: string; };
	import styles from './AgentTestingPage.module.css';
	const agentConfigSchema = z.object({
	allowedStatuses: z.array(z.string()),
	allowedTables: z.array(z.string()),
	tableMode: z.enum(['inclusive', 'exclusive']),
	hitlEnabled: z.boolean(),
	extractors: z.array(z.string()),
	activeSkills: z.array(z.string()),
	executionMode: z.string().optional(),
	});
	type AgentConfigValues = z.infer<typeof agentConfigSchema>;
	import { tablesApi } from '../api/client';
	import type { ChatRequest, ChatResponse } from '../api/agent';
	import type { Table } from '../types';
	import type { components } from '../api/schema';
	export type TraceSpan = components['schemas']['TraceSpan'];
	export type ResumeValue = NonNullable<ChatRequest['resume_value']>;
	import styles from './AgentTestingPage.module.css';
	const agentConfigSchema = z.object({
	allowedStatuses: z.array(z.string()),
	allowedTables: z.array(z.string()),
	tableMode: z.enum(['inclusive', 'exclusive']),
	hitlEnabled: z.boolean(),
	extractors: z.array(z.string()),
	activeSkills: z.array(z.string()),
	executionMode: z.string().optional(),
	});
	type AgentConfigValues = z.infer<typeof agentConfigSchema>;

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@frontend/src/pages/AgentTestingPage.tsx` around lines 39 - 64, Replace the
hand-written object variant in ResumeValue with the existing QueryApproval type
exported from ../api/agent, while preserving the string and empty-record
variants. Update the import in AgentTestingPage.tsx to include QueryApproval and
derive ResumeValue from that schema type so future QueryApproval changes remain
reflected automatically.

[coderabbitai]

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Map the relevant file and search for the request shape and table mode wiring.
git ls-files frontend/src/pages/AgentTestingPage.tsx frontend/src | sed -n '1,20p'
echo '--- AgentTestingPage outline ---'
ast-grep outline frontend/src/pages/AgentTestingPage.tsx --view expanded || true
echo '--- Search for tableMode / allowed_tables / allowed_statuses / ChatRequest ---'
rg -n "tableMode|allowed_tables|allowed_statuses|ChatRequest|Specific Tables|Table Mode|allowedTables|allowedStatuses" frontend/src -S

Repository: StavPonte11/text2sql-onboarding

Length of output: 3763

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect the exact section around the mutation and the nearby UI controls.
sed -n '430,490p' frontend/src/pages/AgentTestingPage.tsx
echo '---'
sed -n '1090,1135p' frontend/src/pages/AgentTestingPage.tsx

# Find the ChatRequest type definition and any server-side handling.
rg -n "type ChatRequest|interface ChatRequest|ChatRequest" frontend/src ../ -S --glob '!**/node_modules/**' || true

Repository: StavPonte11/text2sql-onboarding

Length of output: 50387

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect backend ChatRequest and how allowed_tables / allowed_statuses are used.
sed -n '1,260p' backend/app/routers/agent.py

echo '---'
rg -n "allowed_tables|allowed_statuses|tableMode|exclusive|inclusive" backend app agent frontend/openapi.json frontend/src/api/schema.d.ts -S \
  --glob '!**/node_modules/**' | head -n 120

Repository: StavPonte11/text2sql-onboarding

Length of output: 50387

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Focus on the request schema and exact handling, with bounded output.
python3 - <<'PY'
import json, re, pathlib
schema = json.loads(pathlib.Path('frontend/openapi.json').read_text())
chat = schema['components']['schemas']['ChatRequest']
print('ChatRequest keys:', sorted(chat['properties'].keys()))
print('required:', chat.get('required'))
for k in ['allowed_tables', 'allowed_statuses', 'hitl_enabled']:
    print(k, '=>', chat['properties'].get(k))
PY

echo '--- backend/app/routers/agent.py around ChatRequest ---'
sed -n '1,120p' backend/app/routers/agent.py

echo '--- repo search for tableMode / allowed tables semantics ---'
rg -n "tableMode|allowed_tables|allowed_statuses|exclusive|inclusive" backend frontend -S \
  --glob '!**/node_modules/**' --glob '!frontend/openapi.json' | head -n 120

Repository: StavPonte11/text2sql-onboarding

Length of output: 6109

---

“Table Mode” only gates statuses here, not tables. tableMode never reaches ChatRequest, and allowed_tables is forwarded unchanged in both modes. If Exclusive is meant to exclude the selected tables, this is missing the wire-up; otherwise, rename/reposition the control so the status-only behavior is explicit. allowed_statuses.length > 0 ? allowed_statuses : [] is redundant.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@frontend/src/pages/AgentTestingPage.tsx` around lines 1105 - 1120, The chat
mutation setup in the AgentTestingPage currently applies tableMode only to
allowed_statuses while always forwarding allowedTables. Wire tableMode into the
ChatRequest so Exclusive mode excludes the selected tables, or explicitly
rename/reposition the control if it is intended to govern statuses only; also
simplify the redundant allowed_statuses empty-length expression while preserving
the request’s expected empty-array behavior.