Unify agent configuration in Agent Studio

[Codename-11]

What changed

• makes Agent Studio the source of truth for identity, prompt, base capabilities, and one primary execution runtime
• synchronizes profile identity/execution edits to active workspace bindings without overwriting workspace-local policy
• aggregates multiple linked MCP clients per binding and deep-links into client creation with the binding preselected
• collapses workspace binding policy by default and repairs the phone-width action layout
• consolidates MCP clients and credential lifecycle under Agent access; legacy Agent Clients routes now redirect
• preserves Instance Administration as governance and Mission Control as read-only operations
• adds a screenshot-backed desktop/mobile UX audit, product documentation, router coverage, and Playwright journeys

Why

Agent setup was split across profile, runtime, API access, developer-client, workspace, instance-admin, and Mission Control surfaces. The underlying ownership model was sound, but the UI blurred execution runtimes with MCP credentials and made workspace policy unnecessarily dense.

Validation

• pnpm lint
• pnpm typecheck
• pnpm test --no-file-parallelism — 1,318 passed, 1 intentional live-connector skip
• fresh production Playwright build — 45/45 journeys passed, including desktop/mobile audit and accessibility coverage

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7906c7e208

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Avoid resubmitting unchanged runtime IDs

When the user edits any identity field, this mutation always includes the current runtimeId. Because the router revalidates any present runtime against the actor's available runtimes, profiles whose assigned runtime is not in that set (for example legacy runtime rows without ownerId, archived-but-still-assigned runtimes, or a profile created for an owner by an admin using the admin's private runtime) cannot save a name/description/capability edit even though the runtime wasn't changed. Only send runtimeId when it changes, or have the server permit the profile's current runtime.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Gate client-key metadata by workspace access

For instance-shared profiles, this resolver is visible to any signed-in user, but this new include returns linked API key names, prefixes, scopes, and usage timestamps for every active binding. In a multi-workspace instance, a user who can view the shared profile but is not a member/admin of another workspace can inspect that workspace's MCP credential metadata; filter these apiKeys to workspaces the caller is allowed to see/manage, or include them only for profile editors/admins.

Useful? React with 👍 / 👎.