feat(agents): capture a terminal session's tenant at creation (#16975)

[mrveiss]

Stacked on #16965 (#16947) -- targets that branch, not main, since this needs AgentPresenceRegistry/sync_session_presence to exist. Rebase onto main once #16965 merges.

Problem

A terminal session had no tenant, and none could be recovered after the fact -- presence (#16947) had to report every session as UNKNOWN_TENANT, so no session could be discovered or addressed within its own tenant.

The route that looked like it might work does not exist (investigated and reported back during #16947's review rather than picking something else):

• conversation_id is a log-linkage id only, everywhere it's used.
• chat_history's session/conversation stores (base.py, session.py, security.py) carry no user/tenant field anywhere.
• The authenticated creator's owner (username) is threaded through SessionManager.create_session, but only for PTY registration -- never persisted on the session for a later lookup to recover.

Fix

Capture the tenant at creation, while the authenticated principal is still in hand:

1. AgentTerminalSession gains an explicit tenant_id field.
2. Threaded through SessionManager.create_session -> AgentTerminalService.create_session -> the one real call site with authenticated context: POST /api/agent-terminal/sessions, which already resolves owner from current_user.get("username") for the WebSocket ownership gate (fix(remote-control): authenticate the VNC and terminal websockets, deny unknown terminal sessions #14989/Terminal WebSocket accepts unauthenticated connections #14960). tenant_id is current_user.get("org_id") alongside it -- the JWT claim only. TerminalCreateSessionRequest has no org_id/tenant_id field, so a caller cannot supply one through this route's request body.
3. sync_session_presence now reads session.tenant_id, falling back to UNKNOWN_TENANT only when it's unset.
4. Sessions created via a path with no authenticated context (the chat-tool's internal session creation in tools/terminal_tool.py, which passes neither owner nor tenant_id) are untouched by this PR and correctly keep reporting UNKNOWN_TENANT -- not guessed.

Acceptance criteria (from #16975)

• A newly created session carries the tenant of the principal who created it -- session_manager_tenant_16975_test.py
• The tenant is resolved from the authenticated principal, never a caller-supplied value -- current_user.get("org_id") (JWT claim), and the request schema has no field a caller could use to override it
• Presence reports a session under its real tenant, and a session whose tenant cannot be determined stays UNKNOWN_TENANT
• A test showing a session is discoverable within its own tenant and invisible to another -- test_a_session_with_a_known_tenant_is_discoverable_within_it_only
• Sessions that already exist are handled explicitly -- left UNKNOWN_TENANT, not guessed (the session.tenant_id or UNKNOWN_TENANT fallback)

Test plan

• 6 new tests (2 in session_manager_tenant_16975_test.py, 4 in agent_presence_feeds_test.py) -- all passing
• services/agent_terminal/ full suite -- 68/68 passing, no regressions
• black, isort, flake8, bandit -- clean (pre-existing, untouched-by-this-diff E402s left alone, same convention as feat(agents): live presence — one registry of named agents with busy/idle state, across all three kinds #16947)
• scripts/check_python_file_size.py --audit-ceilings -- clean; service.py's ratchet lowered 962 -> 959 after landing below ceiling
• pipeline-scripts/detect-hardcoded-values.sh -- zero new findings
• .secrets.baseline -- scoped scan confirms zero new findings; baseline untouched

Refs #16975

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (2)

• main
• release

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 23c91402-a13f-499e-b19e-5c9241db807e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Notice: 29 open PRs — past the runaway threshold (25)

There is no PR queue limit, and this is not a request to defer this PR. Work proceeds one issue at a time without a cap on open PRs; review capacity is the constraint.

This notice only means the count is high enough to be worth a glance for a runaway — something opening PRs in a loop, or a merge pipeline that has stalled so nothing is draining.

Currently open:

• feat(security): bound every Company OS run by its org role, per adapter (#16950) #16974 feat(security): bound every Company OS run by its org role, per adapter (security(agents): an agent refused an action can get another agent to do it — no per-peer identity #16950)
• fix(ci): unblock main — secrets baseline (#16960) + fragmentation ratchet (#16875, partial) #16973 fix(ci): unblock main — secrets baseline (fix(security): .secrets.baseline on main is missing 2 audited entries, blocking every PR's whole-tree secret scan #16960) + fragmentation ratchet (feat(admin): MCP server admin CRUD + live model pricing GUI (#16825) #16875, partial)
• fix(deploy): the user-frontend build sites publish through a staged swap (#15603) #16970 fix(deploy): the user-frontend build sites publish through a staged swap (bug(deploy): the user-frontend build sites still publish their own failures, and three SLM build sites sit outside the shared staged publish #15603)
• fix(security): A2A trust keyed on the verified pair, capabilities enforced where they apply (#16957, #16950) #16969 fix(security): A2A trust keyed on the verified pair, capabilities enforced where they apply (security(a2a): three of four trust-matrix capabilities are enforced nowhere — a level that denies them denies nothing #16957, security(agents): an agent refused an action can get another agent to do it — no per-peer identity #16950)
• fix(security): a delegated agent inherits its parent's authority; the originator survives relays (#16950) #16966 fix(security): a delegated agent inherits its parent's authority; the originator survives relays (security(agents): an agent refused an action can get another agent to do it — no per-peer identity #16950)
• feat(agents): live presence registry, one query across all three agent kinds (#16947) #16965 feat(agents): live presence registry, one query across all three agent kinds (feat(agents): live presence — one registry of named agents with busy/idle state, across all three kinds #16947)
• feat(agents): wire QuotaHeadroomStore's read side, add provider/cpu/queue claim kinds (#16951) #16964 feat(agents): wire QuotaHeadroomStore's read side, add provider/cpu/queue claim kinds (feat(agents): coordinate agents competing for shared resources — API limits, CPU time, queues #16951)
• fix(ci): audit 2 missing .secrets.baseline entries blocking every PR (#16960) #16961 fix(ci): audit 2 missing .secrets.baseline entries blocking every PR (fix(security): .secrets.baseline on main is missing 2 audited entries, blocking every PR's whole-tree secret scan #16960)
• fix(infra): gate doc-sync to main-at-origin-tip, move it off post-commit (#16934) #16959 fix(infra): gate doc-sync to main-at-origin-tip, move it off post-commit (bug(kb): the doc-sync commit hook re-embeds every doc into the live KB from any worktree, because its hash cache is per-checkout #16934)
• test(security): a delegated subagent runs a write its parent is held from (#16950) #16958 test(security): a delegated subagent runs a write its parent is held from (security(agents): an agent refused an action can get another agent to do it — no per-peer identity #16950)
• test(security): the ungated-router list may only shrink, so a new entry fails (#16375) #16955 test(security): the ungated-router list may only shrink, so a new entry fails (security(api): 44 config-registered routers declare no auth gate, triaged by exposure (found by widening the router-auth guard, #16368) #16375)
• fix(multimodal): the response says whether a result was stored, and if not, why (#16926) #16954 fix(multimodal): the response says whether a result was stored, and if not, why (bug(multimodal): a tenancy-refused write still returns HTTP 200 success — the persisted flag has no consumer #16926)
• fix(tests): prune SKIP dirs during the walk, not after rglob returns (#16601) #16952 fix(tests): prune SKIP dirs during the walk, not after rglob returns (ci(python-suite): intermittent hang in shard 10 — one of the 223 modules it runs on main (hit #16284 and batch 2b) #16601)
• fix(admin): add the missing adminMenuItems entries for pricing/mcp-servers (#16933) #16944 fix(admin): add the missing adminMenuItems entries for pricing/mcp-servers (bug(admin): the MCP-servers and pricing admin screens merged unreachable — no admin menu entry #16933)
• security(websocket): every authenticated WebSocket echoes the bearer subprotocol through one helper (#16457) #16939 security(websocket): every authenticated WebSocket echoes the bearer subprotocol through one helper (security(websocket): auth token travels in the URL query string, not a header/subprotocol #16457)
• fix(ci): chain formatter dispatch after the branch guard in pre-commit (#16923) #16938 fix(ci): chain formatter dispatch after the branch guard in pre-commit (ci(hooks): no local hook runs black/isort/ruff — formatting is first checked in CI #16923)
• fix(security): match injection patterns against what a model reads, not the raw text (#16354) #16937 fix(security): match injection patterns against what a model reads, not the raw text (security(detector): detect_injection matches its patterns before stripping invisible Unicode, so a zero-width character inside a phrase defeats the match #16354)
• fix(ci): size the trailer gate's fetch to the PR so a release is scanned whole (#16931) #16932 fix(ci): size the trailer gate's fetch to the PR so a release is scanned whole (ci(trailers): the trailer gate cannot see a release promotion — fixed fetch-depth 100 vs 808 commits #16931)
• security(rag): route the chat's RAG path through the content firewall (#16771) #16930 security(rag): route the chat's RAG path through the content firewall (security(rag): the chat RAG path builds the prompt from KB text without the content firewall #16771)
• test(api): stop racing the clock in the last completion test (#16928) #16929 test(api): stop racing the clock in the last completion test (test(api): test_completion_performance races the real clock, the defect #15861 already fixed in its siblings #16928)
• fix(security): break-glass repair of a genuinely unreachable knowledge fact or envelope secret, through each type's own service (#15779, #16940) #16927 fix(security): admin break-glass repair for unreachable null-scope resources (bug(scoping): a null-scope resource is denied to every principal including admin — un-repairable in-app #15779)
• docs(ci): the two PR gates name their importer, because pre-push cannot warn you (#16859) #16922 docs(ci): the two PR gates name their importer, because pre-push cannot warn you (ci(process): PR body requirements are undiscoverable before push — gh --body-file never loads the template, and the gate's author failed it twice #16859)
• fix(backend): resolve 4 duplicate route registrations (#16908) #16918 fix(backend): resolve 4 duplicate route registrations (bug(api): four endpoints are registered twice — the second registration is dead code #16908)
• fix(kb): the RAPTOR tree is built at all, and its nodes cite their chunks (#14968) #16916 fix(kb): the RAPTOR tree is built at all, and its nodes cite their chunks (RAPTOR tree nodes are built with an empty source_chunk_ids, so no tree node can cite its sources #14968)
• fix(chat): the init stops at its first await once the component unmounts (#16274) #16911 fix(chat): the init stops at its first await once the component unmounts (fix(chat): ChatInterface's init keeps running after unmount, so a slow-init test crashes a later test's fallback #16274)
• security(ai-ml): pin HuggingFace model revisions and verify weight integrity (#13034) #16899 security(ai-ml): pin HuggingFace model revisions and verify weight integrity (security(models): no revision pinning or weight integrity verification — 18 suppressed B615 findings (#13030) #13034)
• security(api): gate captcha, metrics and diagnostics routers (#16375) #16896 security(api): gate captcha, metrics and diagnostics routers (security(api): 44 config-registered routers declare no auth gate, triaged by exposure (found by widening the router-auth guard, #16368) #16375)
• security(secrets): content-scanning credential redactor -- catches a credential in free text (#13708) #16895 security(secrets): content-scanning credential redactor -- catches a credential in free text (security(secrets): credential redaction is name-keyed and cannot see credentials in free text — add content scanning before mail is indexed #13708)
• fix(ci): python-paths covers the shell wrappers python-suite tests (#16249) #16892 fix(ci): python-paths covers the shell wrappers python-suite tests (python-paths: a change to only check-pre-commit-hook-pr.sh skips the tests that exercise it #16249)

If the queue is draining normally, ignore this. Otherwise:

1. Check whether CI is dispatching at all — see the ci-dispatch-watchdog status on these PRs
2. Merge the ones whose CI has finished and review has passed: gh pr merge <number> --squash --delete-branch
3. Look for a loop opening near-identical PRs

Warn-only runaway detector — .github/workflows/pr-queue-gate.yml. It never blocks a merge.