Repository navigation
[Agent Lee] Refresh overview, complete rename, document access controls - #33648
Merged
Merged
Conversation
kale-stew
requested review from
a team,
Brayden,
ethulia,
kflansburg,
mchenco,
shridhar-cf and
superhighfives
as code owners
September 24, 2026 04:34
github-actions
Bot
added
product:ai
🚀 Deploying Preview to Cloudflare 🚀Preview URL: https://kylie-docs-agent-lee-audit.previews.developers.cloudflare.com (commit 4facfbb)This URL reflects your latest Preview deploymentPreview Deployments by commit
|
Contributor
AI Review✅ Reviewed 👉 Fix in your agent 👈Fix the following review findings in PR #33648 (https://github.com/cloudflare/cloudflare-docs/pull/33648).
Before making changes, review each finding and present a brief summary table:
- For each finding, state whether you agree, disagree, or need clarification.
- If you disagree, explain why.
- If you need clarification before deciding, ask those questions.
- Then share your plan for which issues to tackle and in what order.
After triaging, follow this order:
1. Post a comment on this PR for any findings you are skipping, with the finding ID and your reasoning.
2. Then commit the fixes for the legitimate findings.
The comment must come before the commit because the next review reads PR comments.
## Style Guide
- S-1e7eda59 | src/content/docs/agent-lee/manage-access.mdx:53 | Replace `see [link]` with `refer to [link]`
The line uses `see [Review the tokens Agent Lee holds](#review-the-tokens-agent-lee-holds)` before a link. Per the links style rule, `see [link]` must be replaced with `refer to [link]`.
- S-0f306257 | src/content/docs/agent-lee/manage-access.mdx:112 | Semicolon joins two independent clauses
`Deleting the token the assistant is currently using revokes its access immediately; you are asked to grant permissions again...` joins two independent clauses with a semicolon. Per the writing style rule, break them into two sentences.Style GuideSkipped: no new docs content changes since the last review.
Not reviewed (2)
Commands
|
kale-stew
force-pushed
the
kylie/docs/agent-lee-audit
branch
from
September 24, 2026 05:28
3278f2e to
07c321d
Compare
kale-stew
force-pushed
the
kylie/docs/CFSA-903-take-home-code
branch
from
September 24, 2026 17:45
a0ddba4 to
eb926e8
Compare
kale-stew
force-pushed
the
kylie/docs/agent-lee-audit
branch
from
September 24, 2026 17:45
07c321d to
4facfbb
Compare
ahaywood
approved these changes
Sep 24, 2026
Base automatically changed from
kylie/docs/CFSA-903-take-home-code
to
production
September 24, 2026 18:17
Audit of the Agent Lee docs against the implementation (cloudflare-agent @ 7966d6f3). The overview had drifted since the beta page was written, and the rename from "Cloudflare Agent" left the old name on user-facing surfaces. Naming: - Rename ai/related-products/cloudflare-agent.mdx to agent-lee.mdx and retitle it. It still read "Cloudflare Agent" and pointed at /cloudflare-agent/, taking readers through a 301 to reach the page. - Point the RelatedProduct cards in ai/index.mdx and ai/related-products/index.mdx at /agent-lee/ with product="agent-lee". src/icons/agent-lee.svg was added by the rename but never wired up, so both cards were still resolving the old icon name. - Delete src/icons/cloudflare-agent.svg, byte-identical to agent-lee.svg and now unreferenced. - Drop the stray products: browser-run from the related-products entry; every sibling lists ai alone. - Note the former name on the overview so searches for "Cloudflare Agent" still land. The /cloudflare-agent/ 301 already covers the old URL and that path never had sub-routes, so no new redirect is needed. Redirect fix: - /workers/ai/ pointed at /agent-lee/, sending the legacy Workers AI URL to the dashboard assistant. It entered as /workers/ai/ -> /cloudflare-agent/ in 377142d ("[Chore] tech cleanup", #29194) with no stated rationale, and the rename only retargeted it. src/content/docs/workers/ai/ has never existed in repo history, so this reads as a copy-paste of the wrong product. Retargeted to /workers-ai/. Corrections: - Availability was "only available to accounts on a Free plan". There is no plan gate in the implementation; it is Free plus select Enterprise. Points Enterprise readers at their account team. - "Does not currently reference previous conversation context" and "cannot remember previous conversations" are both false since CFSA-1042 shipped list/search/get/summarize over your own conversations, ungated. - Retention is measured from last activity, not creation, so an active conversation is not purged mid-use (agent.ts:5609-5619). - Generative UI said charts render inline in the chat panel. Only the artifact card does; everything else is a card that opens the full-screen view. - Softened the support limitation, which flatly denied what the support-case handoff now does. Additions, all verified in the implementation: - Undo a change (prepareRevert), live in production per wrangler.jsonc:320. - Support case handoff, with confirmation and eligibility framed by support entitlement rather than plan name. - Dashboard page search, entitlement and plan-tier lookups, product skills and changelog-grounded answers. - AI Gateway in the "Built on Cloudflare" table; model requests go through it (model.ts:26-30). Deliberately not documented: the decision rail, which is disabled in production (DECISION_RAIL_ENABLED false, wrangler.jsonc:321), and image attachments, which are still a draft spec with no inbound image path.
Adds agent-lee/manage-access, covering controls that exist today and were completely undocumented: hiding the assistant, permission templates, custom scopes, when permission changes take effect, the admin write restriction, and auditing the API tokens Agent Lee holds. Links it from the overview's write-operations section and related resources. Verified against stratus and cloudflare-agent rather than carried over from an earlier draft. Corrections made while verifying: - Shortcuts are Cmd//Ctrl+/ and the `t` `a` sequence (AuthenticatedApp.tsx:195, DashHotkeys/constants.ts:96-101). The draft listed only the first and only for macOS. - Custom scopes are a curated list across eight categories with independent read/write toggles, not per-product, and not the full API-token catalogue. - Four areas are hard-denied for write regardless of selection: account settings, membership, billing, API tokens (api/token.ts DENIED_WRITE_PATTERNS). - The admin indicator reads "Write off" with a tooltip, not "Write disabled by admin". - Permission changes apply on the next message in the same conversation (agent.ts:3593-3599). The draft claimed the current conversation keeps the old permissions, which is wrong. Wording chosen to stay true in the failure cases: - Opt-out "attempts to delete" the API token rather than guaranteeing revocation, because the client path is fire-and-forget and can no-op when the token id read is stale (useLeeEnabledSetting.ts:217-223). - Permission changes say both tokens "may exist briefly" rather than claiming atomic replacement; the flow creates the new token before revoking the old (PermissionStore.ts:523-539). - Both cases point the reader at My Profile > API Tokens, which is the reliable way to confirm access is gone. Not documented, because they are internal rather than customer-facing: the account-wide disable API (CFSA-596, no dashboard UI, internal Flagship flag) and account write policies (CFSA-1044, AX-team-only admin app behind Cloudflare Access). The preferences card is still labelled "Cloudflare Agent" in the dashboard (common.json:38) while the sidebar says "Agent Lee". The page uses the on-screen label so readers can find the control, and notes the discrepancy. Resolving it needs a product-side string change.
kale-stew
force-pushed
the
kylie/docs/agent-lee-audit
branch
from
September 24, 2026 18:20
4facfbb to
5a97c1d
Compare
Contributor
|
This PR changes current filenames or deletes current files. Make sure you have redirects set up to cover the following paths:
|
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
what
Audit of the Agent Lee docs against the implementation (
cloudflare-agent @ 7966d6f3,stratus). Three things: the overview had drifted since the beta page was written, the rename from "Cloudflare Agent" left the old name on user-facing surfaces, and the access/permission controls were entirely undocumented.naming
The rename shipped in #29901 (2026-04-15) moved the page and added the redirect, but missed the entry points:
ai/related-products/cloudflare-agent.mdx→agent-lee.mdxand retitle. It still read "Cloudflare Agent" and pointed at/cloudflare-agent/, so readers took a 301 to reach the page.RelatedProductcards inai/index.mdxandai/related-products/index.mdxat/agent-lee/withproduct="agent-lee".src/icons/agent-lee.svgwas added by the rename but never wired up — both cards were still resolving the old icon name.src/icons/cloudflare-agent.svg: byte-identical toagent-lee.svgand now unreferenced.products: browser-runfrom the related-products entry; every sibling listsaialone.No new redirect needed.
/cloudflare-agent/ → /agent-lee/already exists (__redirects:2453), andsrc/content/docs/cloudflare-agent/only ever containedindex.mdxacross the whole repo history, so there are no sub-routes to catch. I deliberately did not add a splat — it would mask genuine 404s on invented paths.redirect fix
/workers/ai/pointed at/agent-lee/, sending the legacy Workers AI URL to the dashboard assistant. It entered as/workers/ai/ → /cloudflare-agent/in377142dbda("[Chore] tech cleanup", #29194) with no stated rationale, and the rename only retargeted it.src/content/docs/workers/ai/has never existed in repo history, so this reads as a copy-paste of the wrong product. Retargeted to/workers-ai/.Please sanity-check this one — if someone parked that URL on the assistant on purpose, say so and I will drop the hunk.
corrections to the overview
agent.ts:2798-2812).agent.ts:5606-5615).Message.tsx:370-400).additions to the overview
All verified in the implementation, not the specs:
prepareRevert) — live in production perwrangler.jsonc:320.model.ts:26-30).new page: Manage access and permissions
agent-lee/manage-accessdocuments controls that exist today and were completely undocumented: hiding the assistant, permission templates, custom scopes, when changes take effect, the admin write restriction, and auditing the tokens it holds.Every claim was verified against the frontend, and several draft claims were corrected in the process:
Cmd/Ctrl+/and thetasequence (AuthenticatedApp.tsx:195,DashHotkeys/constants.ts:96-101).api/token.tsDENIED_WRITE_PATTERNS). Worth stating plainly; it is a genuine safety guarantee.agent.ts:3593-3599).Deliberately not documented, because they are internal rather than customer-facing:
one naming problem docs cannot fix
The dashboard preferences card is still labelled "Cloudflare Agent" (
common.json:38) while the sidebar says "Agent Lee" (ai-agent-sidebar.json:107-108). The new page tells users to look for "Cloudflare Agent" because that is what is on screen, and calls out the discrepancy in a note. This needs a product-side string change to actually resolve — flagging for whoever owns those strings.deliberately not documented
DECISION_RAIL_ENABLED: "false"in production (wrangler.jsonc:321).notes for reviewers
/rules/custom-errors/api-calls(Operation GET /zones/{zone_identifier}/custom_pages/{identifier} not found in schema). The API schema changed, and [Rules] Update Custom Errors API paths to use zone_id #33645 updated that page, but this stack was based on an olderproduction. Both branches are now rebased onto currentproductionwith no changes to their content. A localbuild:incrementalagainst a freshly fetched schema passes (9,103 pages). Thanks to Brayden for the logs.ci.ymlpasses locally on the failing tree:pnpm run check(0 errors),lint,format:check,bin/validate-redirects.ts,bin/check-component-docs.ts,test:prebuild(196 tests), fullpnpm run build(9082 pages, link check clean),test:postbuild(23 tests).agent-lee/index.mdx, so this branch is based on that one. Merge [Agent Lee] Document take-home code export #33647 first. Until then this PR's diff also shows [Agent Lee] Document take-home code export #33647's commit; review only the two[Agent Lee]commits after it.