feat(agentex-ui): account picker via same-origin BFF proxy

[erichwoo-scale]

Summary

First of a 2-PR stack bringing account scoping + OIDC login to agentex-ui. This base PR routes the SDK through a same-origin BFF and adds an account switcher. Chart + deploy side lives in scaleapi/sgp#3961.

• Routes the agentex SDK through a same-origin BFF (/api/agentex) instead of calling the API directly from the browser — the upstream URL and credentials never reach client JS.
• Shared applyBffCredentials forwards x-selected-account-id, drops any client-sent Authorization, and strips the account-scoped _jwt cookie so SGP honors the selected account rather than the one you linked in with (identity stays via _identityJwt). The proxy also strips Location on upstream 3xx so internal redirect targets don't leak.
• Account selection is driven by the account_id query param (no cookie), injected on every SDK request via a synchronous ref. Switching accounts resets the open task + selected agent to the account's home grid, and resetQueries drops the previous account's cached data so it never briefly renders the old agents.
• /api/user-info fetches the caller's accounts; the picker bootstraps to the first when the param is missing/stale, shows a disabled/empty loading state (not a skeleton), renders single-account as static context, and lives in the sidebar footer (collapsed → icon-only).
• Env-gated on the platform API being configured (SGP_API_URL / NEXT_PUBLIC_SGP_APP_URL); no-op otherwise.

Env: NEXT_PUBLIC_AGENTEX_API_BASE_URL → server-only AGENTEX_API_URL.

In this PR the BFF runs in default (cookie) mode — no auth dependency. The token-hiding Bearer path arrives in the stacked PR.

Stack

1. This PR — account picker + same-origin BFF proxy → main
2. feat(agentex-ui): OIDC login with server-side access token #351 — OIDC login with server-side access token → stacked on this branch
3. scaleapi/sgp#3961 — Helm chart + system-manager pack (deploy side)

Test plan

• npm run typecheck / npm run lint — clean
• Runtime: switching accounts re-scopes agents/tasks (and SGP calls via the _jwt strip); single / multi / no-account render; loading state; no stale-account flash

🤖 Generated with Claude Code

Greptile Summary

This PR routes the Agentex SDK through a same-origin BFF proxy (/api/agentex) so the upstream URL and credentials stay server-side, and adds an account picker driven by the account_id query param. A new shared applyBffCredentials helper manages cookie stripping (_jwt) and header hygiene across the BFF routes; a scoped /api/user-info endpoint bootstraps and switches accounts without exposing arbitrary platform endpoints.

• BFF proxy (app/api/agentex/[...path]/route.ts): streams all HTTP methods through to the upstream, strips hop-by-hop and credential headers, and drops location on upstream 3xx so internal redirect targets don't escape.
• Account picker (components/account-picker/account-picker.tsx): bootstraps to the first account when account_id is absent, resets account-scoped React Query cache on switch (preserving user-info), and renders as an icon-only tile in the collapsed sidebar rail.
• Provider (components/providers/agentex-provider.tsx): injects x-selected-account-id on every SDK request via a synchronous ref to avoid a race between URL navigation and the next fetch.

Confidence Score: 4/5

Safe to merge after fixing the bootstrap/localAgentName regression in agentex-ui-root.tsx.

The account-switch detection in agentex-ui-root.tsx treats the initial bootstrap (null → first account on a fresh URL load) the same as an explicit switch, causing setLocalAgentName(undefined) to permanently erase the user's stored agent preference on every fresh-tab or direct-URL visit. Users with a single account — the most common deployment — would lose their last-used agent selection on every new session. The BFF proxy, credential stripping, and account picker logic are otherwise well-structured.

agentex-ui/components/agentex-ui-root.tsx — the bootstrap path needs to be distinguished from an explicit account switch before the localStorage clear runs.

Important Files Changed

Filename	Overview
agentex-ui/app/api/_lib/bff.ts	New shared BFF helper: strips _jwt cookie, deletes authorization, forwards x-selected-account-id. Logic is correct; async signature is forward-compatible with the stacked PR's Bearer path.
agentex-ui/app/api/agentex/[...path]/route.ts	Catch-all BFF proxy: strips hop-by-hop headers, calls applyBffCredentials, drops location on upstream 3xx. Streaming via unbuffered body is correct. Previous authorization and location issues from prior review round are fixed.
agentex-ui/app/api/user-info/route.ts	Scoped BFF endpoint for account list. Missing try/catch around upstream fetch means a network failure returns an unstructured 500, unlike the feedback route which has proper error handling.
agentex-ui/components/agentex-ui-root.tsx	Adds account-switch detection via accountRef. The bootstrap (null → first account) is indistinguishable from an explicit switch, causing localAgentName to be permanently cleared and the restore-from-localStorage path to be skipped on every fresh-URL page load.
agentex-ui/components/providers/agentex-provider.tsx	SDK re-routed to same-origin BFF; account ID injected via a ref to avoid race between URL navigation and the next fetch. useMemo([]) with ref access is the correct pattern here.
agentex-ui/components/account-picker/account-picker.tsx	Account picker with bootstrap, collapsed/expanded modes, and single-account static display. resetAccountScoped correctly preserves user-info while clearing other account-scoped query cache.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant Browser
    participant BFF as Next.js BFF<br/>(same-origin)
    participant Agentex as Agentex API
    participant SGP as SGP Platform API

    Note over Browser,SGP: Account bootstrap (first load, no account_id in URL)
    Browser->>BFF: GET /api/user-info (cookies)
    BFF->>SGP: GET /user-info (cookies minus _jwt)
    SGP-->>BFF: "{ access_profiles: [...] }"
    BFF-->>Browser: "{ access_profiles: [...] }"
    Browser->>Browser: "router.replace(?account_id=first)"

    Note over Browser,Agentex: SDK request with selected account
    Browser->>BFF: GET /api/agentex/v1/agents x-selected-account-id: abc
    BFF->>BFF: applyBffCredentials() drop authorization strip _jwt cookie forward x-selected-account-id
    BFF->>Agentex: GET /v1/agents x-selected-account-id: abc
    Agentex-->>BFF: 200 agents[]
    BFF-->>Browser: 200 agents[] (streamed)

    Note over Browser,SGP: Account switch
    Browser->>Browser: "onAccountChange resetQueries router.push(?account_id=new-id)"
    Browser->>BFF: GET /api/agentex/v1/agents x-selected-account-id: new-id
    BFF->>Agentex: GET /v1/agents x-selected-account-id: new-id
    Agentex-->>BFF: 200 agents[] (new account)
    BFF-->>Browser: 200 agents[]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant Browser
    participant BFF as Next.js BFF<br/>(same-origin)
    participant Agentex as Agentex API
    participant SGP as SGP Platform API

    Note over Browser,SGP: Account bootstrap (first load, no account_id in URL)
    Browser->>BFF: GET /api/user-info (cookies)
    BFF->>SGP: GET /user-info (cookies minus _jwt)
    SGP-->>BFF: "{ access_profiles: [...] }"
    BFF-->>Browser: "{ access_profiles: [...] }"
    Browser->>Browser: "router.replace(?account_id=first)"

    Note over Browser,Agentex: SDK request with selected account
    Browser->>BFF: GET /api/agentex/v1/agents x-selected-account-id: abc
    BFF->>BFF: applyBffCredentials() drop authorization strip _jwt cookie forward x-selected-account-id
    BFF->>Agentex: GET /v1/agents x-selected-account-id: abc
    Agentex-->>BFF: 200 agents[]
    BFF-->>Browser: 200 agents[] (streamed)

    Note over Browser,SGP: Account switch
    Browser->>Browser: "onAccountChange resetQueries router.push(?account_id=new-id)"
    Browser->>BFF: GET /api/agentex/v1/agents x-selected-account-id: new-id
    BFF->>Agentex: GET /v1/agents x-selected-account-id: new-id
    Agentex-->>BFF: 200 agents[] (new account)
    BFF-->>Browser: 200 agents[]

Loading

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
agentex-ui/components/agentex-ui-root.tsx:41-53
**Bootstrap mistaken for account switch, permanently clears stored agent name**

When a user loads the page without `?account_id` in the URL, `accountRef.current` is initialized to `null`. The `AccountPicker` effect bootstraps the first account (via `router.replace`), changing `sgpAccountID` from `null` → `'first-account-id'`. On the next render, this effect fires because `sgpAccountID` is in its deps, sees `null !== 'first-account-id'`, and treats it as an explicit account switch — calling `setLocalAgentName(undefined)` (which overwrites localStorage) and returning before the restore-from-localStorage logic can run. Every fresh navigation to `/` without `?account_id` permanently erases the user's saved agent preference. Single-account users (the most common case) are affected on every new tab or bookmarked-root visit.

A simple guard fixes it: skip the clear when `accountRef.current` is `null` (first load, no prior account) and only apply it when there is a known previous account being replaced.

_{Reviews (9): Last reviewed commit: "Merge branch 'main' into feat/agentex-ui..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

[erichwoo-scale]

Addressed the Greptile findings in bb2eb06:

• P1 — authorization not managed: applyBffCredentials now deletes any client-supplied Authorization header before forwarding, so a client can't inject its own bearer token to the upstream. (The proxy comment is now accurate — credentials really are managed there.)
• P2 — upstream Location leak: the proxy strips Location from upstream 3xx responses so internal redirect targets don't reach the browser.

Also, per UX design feedback, moved the account picker out of the header/collapsed-top rail into the sidebar footer (below Give Feedback) — top of the sidebar is untouched.

[declan-scale]

Will we need to update the sgp repo to pass in the AGENTEX_API_URL instead of NEXT_PUBLIC_AGENTEX_API_BASE_URL?

[erichwoo-scale]

Will we need to update the sgp repo to pass in the AGENTEX_API_URL instead of NEXT_PUBLIC_AGENTEX_API_BASE_URL?

yup working on the corresponding sgp PR, and will hold off on merging until thats ready

[greptile-apps]

Bootstrap mistaken for account switch, permanently clears stored agent name

When a user loads the page without ?account_id in the URL, accountRef.current is initialized to null. The AccountPicker effect bootstraps the first account (via router.replace), changing sgpAccountID from null → 'first-account-id'. On the next render, this effect fires because sgpAccountID is in its deps, sees null !== 'first-account-id', and treats it as an explicit account switch — calling setLocalAgentName(undefined) (which overwrites localStorage) and returning before the restore-from-localStorage logic can run. Every fresh navigation to / without ?account_id permanently erases the user's saved agent preference. Single-account users (the most common case) are affected on every new tab or bookmarked-root visit.

A simple guard fixes it: skip the clear when accountRef.current is null (first load, no prior account) and only apply it when there is a known previous account being replaced.

Prompt To Fix With AI

This is a comment left during a code review.
Path: agentex-ui/components/agentex-ui-root.tsx
Line: 41-53

Comment:
**Bootstrap mistaken for account switch, permanently clears stored agent name**

When a user loads the page without `?account_id` in the URL, `accountRef.current` is initialized to `null`. The `AccountPicker` effect bootstraps the first account (via `router.replace`), changing `sgpAccountID` from `null` → `'first-account-id'`. On the next render, this effect fires because `sgpAccountID` is in its deps, sees `null !== 'first-account-id'`, and treats it as an explicit account switch — calling `setLocalAgentName(undefined)` (which overwrites localStorage) and returning before the restore-from-localStorage logic can run. Every fresh navigation to `/` without `?account_id` permanently erases the user's saved agent preference. Single-account users (the most common case) are affected on every new tab or bookmarked-root visit.

A simple guard fixes it: skip the clear when `accountRef.current` is `null` (first load, no prior account) and only apply it when there is a known previous account being replaced.

How can I resolve this? If you propose a fix, please make it concise.