Add gcp_oauth federation provider (per-user OAuth, zero service accou…

…nts) (hoophq#1526)

* add: gcp google

* add: bq google auth

* fix duplicate migration

* fix cli for federation bq

[Feat Oracle Native] hoop (client + agent + gateway wiring) (hoophq#1523

)

* add: oracle protocol native

* add logs and ff for native oracle

* Update agent/controller/oracle.go

* fix oss lib stub

feat: add AI agent management functionality (hoophq#1472)

* feat(webapp_v2): add AI Agents Identities page

Frontend for the AI Agents feature introduced in hoophq#1472. Mirrors the
existing API Keys flow since both use the same hpk_ token format,
schema, and admin-only role gating.

Pages under /features/ai-agents-identities:
- List with masked_key truncation, active/revoked states, kebab menu
- Create form (name + groups multi-select)
- Configure form (same shape, edit-only)
- Created screen with key reveal, MCP and CLI snippets pre-filled
  using the api_url from /serverinfo (falls back to window.location.origin)

Sidebar entry added at the top of Discover (above Access Request)
with the Bot icon, gated by adminOnly. Routes wrapped in
<ProtectedRoute adminOnly>.

Refactor: truncateKey moved from the API Keys list page to
src/utils/maskedKey.js so both pages share the helper.

useUserStore now also exposes apiUrl from serverInfo so the Created
screen can build absolute URLs for the MCP/CLI snippets.

https://claude.ai/code/session_012srgmjoD5s3EYtU4n6iYAs

* fix(webapp_v2): align snackbar, popover, tooltip and modal title with v1

Visual feedback from review on the new AI Agents Identities page — all
issues also affected the existing API Keys page since both share the
same wrappers.

ActionMenu (kebab popover): removed the CSS module overrides that
forced extra padding on dropdown and items. Mantine defaults give a
more compact, idiomatic look; the `danger` variant now uses Mantine's
built-in `color="red"` prop on Menu.Item instead of a custom class.

Tooltip: the wrapper now defaults to `color="dark"` so hover tooltips
render with a high-contrast near-black background instead of the pale
translucent gray. List pages updated to import from
`@/components/Tooltip` instead of raw Mantine so the default applies.

Modal title: removed the `color: gray-9` override in Modal.module.css.
Titles now inherit `--mantine-color-text` (near-black) so they sit at
the same weight as page titles.

Snackbar: the legacy CLJS app shows toasts via `sonner` through a
`:show-snackbar` re-frame event. Mantine `notifications.show()` looks
completely different. Added sonner as a webapp_v2 dependency, mounted a
single `<Toaster>` in `App.jsx`, and added `src/utils/snackbar.js` as a
thin `showSnackbar({ level, text, description })` wrapper that mirrors
the CLJS event shape. AI Agents and API Keys pages now use it.
Documented the rule in `CLAUDE.md` and `COMPONENTS.md` so future code
doesn't reintroduce a third snackbar style.

https://claude.ai/code/session_012srgmjoD5s3EYtU4n6iYAs

* fix(webapp_v2): port v1 toast component and fix danger menu item color

Two follow-up issues from the review of the AI Agents Identities page,
both also fixing the existing API Keys page since they share wrappers.

ActionMenu danger item: switching to Mantine's `color="red"` prop on
Menu.Item rendered the "light variant" (a desaturated red that looked
like reduced opacity). Restored a minimal CSS module that pins the
text color and hover background to `var(--mantine-color-red-8)`
(saturated Radix red-9). No padding overrides — Mantine's defaults
for sizing still apply, so the popover stays compact.

Toast: replaced sonner's default `toast.success/error/info` with
`toast.custom()` rendering a new `<Toast>` component that mirrors the
legacy CLJS `webapp.components.toast` one-to-one — white rounded card
with shadow + 1px black/5 outline, 364px width, 16px padding, lucide
icon (CheckCircle / AlertCircle / Clock) tinted with the matching
semantic color, title + optional description in near-black text, and
an expandable "View / Hide details" panel for errors with structured
key/value details rendered on a dark background using amber keys and
sky values, matching v1's `format-json-colored`.

Error toasts inherit v1's 10-second auto-dismiss; other levels use
sonner's default. `snackbar.js` was renamed to `.jsx` so Vite's React
plugin processes the JSX it now returns. COMPONENTS.md updated.

https://claude.ai/code/session_012srgmjoD5s3EYtU4n6iYAs

* refactor(webapp_v2): drop pages/Features wrapper and /features route prefix

The Features/ subfolder was a holdover from the CLJS organization where
"features" meant a specific cluster of feature-flagged pages. In the
React app every page is conceptually a feature, so the extra level only
adds noise.

Moved pages/Features/AiAgentsIdentities/ up one level to
pages/AiAgentsIdentities/ and removed the /features prefix from its
route — now /ai-agents-identities. Sidebar entry and the page's own
LIST_PATH / NEW_PATH / CREATED_PATH constants updated accordingly.

The other Features/ entries (AccessControl, DataMasking, Runbooks)
were unwired one-line stubs that nothing imported — deleted along with
the now-empty Features/ directory. CLJS routes under /features/* are
untouched: this change is React-only, and CLJS pages keep their paths
until they are individually migrated.

https://claude.ai/code/session_012srgmjoD5s3EYtU4n6iYAs

* feat: add AI agent management functionality

* bump webapp dependencies (hoophq#1487)

* fix vulnerability from transitive dependency

* bump webapp v1 too

* feat: rulepacks (hoophq#1450)

* feat: rulepack base implementation

* feat: Add rulepack ID support across various models and services

* feat: Enhance Rulepack structure with new rules

* feat(rulepacks): Introduce RulepackApplyRequest and apply functionality

* feat: Implement rulepacks feature with list, detail, and configuration views

* docs: remove some endpoints from doc

* feat: Add rulepacks feature with database migrations and sidebar integration

* feat: Implement routing and components for Rulepacks feature in webapp v2

* refactor: OpenAPI types to remove RulepackID from multiple structures and update related functions

* refactor: Remove RulepackID from various models and update related functions

* refactor: Remove RulepackID from MachineIdentity and simplify AccessRequestRulesFilterOption

* refactor: re-implement rulepack ownership checks in data masking and guardrail APIs

* refactor: update error responses for rulepack ownership in data masking and guardrail APIs

* refactor: adjust styling for RulepackRow component layout and button icon

* refactor: implement rulepack name prefixing for data masking and guardrail rules

* feat: add default rulepacks seeding functionality for organizations

* refactor: update guardrail rules listing and apply logic for OSS license restrictions

* fix: adjust gap size in SidebarCollapsed component for improved layout

* refactor: remove legacy components and implement new UI

* refactor: change migration number

* refactor: change migration number

* fix(webapp_v2): add type field to MCP server config snippet

Claude Code only infers stdio transport from command-based servers.
For remote URL-based servers the transport is ambiguous and must be
declared explicitly, otherwise the MCP server fails to load.

https://claude.ai/code/session_01SpL9PUjsV1c8jiTUm5rotZ

* feat(webapp_v2): add gray variant to CodeSnippet

CodeSnippet now accepts a variant prop with two values: 'black' (default,
preserves the existing terminal look used by the Agent deployment page)
and 'gray' (light surface for inline config blocks). The AI Agents
Identities Created page opts into the gray variant for both MCP and CLI
snippets.

https://claude.ai/code/session_01SpL9PUjsV1c8jiTUm5rotZ

* chore: regenerate OpenAPI docs

* chore: update migration number

---------

Co-authored-by: Rogerio Moura <roger0.rm@gmail.com>
Co-authored-by: p3rotto <emmanuelperotto@gmail.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

feat(helm/gateway): add configurable pod and container securityContext (

hoophq#1513)

fix(client): recommend OS-agnostic version manager on version mismatch (

hoophq#1524)

The `hoop connect` version-mismatch warning hard-coded Homebrew upgrade
instructions, which are useless on Windows and Linux (hoophq#1516).

It now recommends `hoop versions install <agentVersion> --use`, using the
exact agent version (normalized to strip any leading "v"). When the agent
version predates the version manager floor (1.74, or 1.86.1 on Windows),
it falls back to the cli-versions docs via ValidateInstallableVersion
instead of printing a command that would fail.

The warning also honors HOOP_DISABLE_VERSION_CHECK=true and surfaces a
silence hint, aligning it with the existing gateway-header warning.

fix: use unique id per command token to prevent wrong item deletion (h…

…oophq#1517)

When command args contain duplicate values (e.g. multiple `-o` flags),
react-select identified items by value rather than position, causing the
wrong token to be removed on delete. Each token now carries a unique id
so react-select can distinguish duplicates correctly.

feat(analytics): add session type and origin to session events (hooph…

…q#1508)

* feat(analytics): add session type and origin to session events

Add verb (connect/exec) and a product-level origin (cli, webapp, api,
mcp, runbooks, proxymanager, agent) to the hoop-session-created,
-finished and -reviewed analytics events (ENG-419).

Origin is persisted on a new sessions.origin column at creation time so
it is available when the finished/reviewed events reload the session
from the DB. It is set at every session-creation site that emits these
events:
- audit plugin (gRPC): mapped from the transport client origin
- REST POST /sessions: webapp when User-Client is webapp.core, else api
- MCP exec tool: mcp
- runbooks (v1/v2): runbooks

Both attributes are emitted from sessionUsageProperties so all event
call sites are covered consistently; empty origin reports as unknown.

* refactor(analytics): emit session origin verbatim from the session

Pass the persisted session.origin straight through to the event
properties instead of synthesizing "unknown" when it is empty. An
empty origin (e.g. rows created before the column existed) is now
emitted as an empty string, so the property always reflects exactly
what is stored on the session.

* feat(analytics): attribute native-client connect sessions to mint surface

Native clients connect through a protocol proxy, which stamps the
generic ConnectionOriginClient regardless of how the credential was
minted, so webapp "Open in native client" sessions were indistinguishable
from CLI ones (both reported origin=cli).

Record the originating surface on the credential-issuance session from the
User-Client/User-Agent header (webapp.core -> webapp, hoopcli -> cli, else
-> api) and, when a proxy connection is credential-backed, inherit that
origin onto the per-connection session via the existing credential-session
link. Direct CLI connects (no credential session) still resolve from the
transport origin.

- common/proto: add SessionOriginFromUserAgent + tests for both mappers
- connection_credentials: set issuance-session origin from the header
- audit: inherit origin from the credential session when present
- session: use the shared user-agent mapper (now also maps hoopcli -> cli)

* fix migration number

* chore(migration): match established session migration pattern

Wrap 000096_session_origin in BEGIN/COMMIT, set search_path to private
(unqualified table name), declare the column NULL, and use DROP COLUMN
IF EXISTS on the down — matching 000078_session_correlation_id and the
other recent migrations.

fix: re-add reviewed by info in session details (hoophq#1511)

feat: add GCP IAM Federation UI for BigQuery connections (hoophq#1495)

* feat: add GCP IAM Federation UI for BigQuery connections

* fix: update identity template placeholders from {user.email_local} to {user.email}

* feat: implement base64 encoding helper and enhance BigQuery federation UI

* add: lower email size error

* update: static impersonate for gcp

* make migration idempotent for iam gcp

* fix: remove experimental.iam_federation flag

* fix: handle fallback_policy properly in federation configuration

* refactor: simplify state updates in federation events using merge

* fix: allow switch from iam federation to manual input in bigquery role

---------

Co-authored-by: matheusfrancisco <matheusmachadoufsc@gmail.com>

[Fix] Hoop versions commands on Windows (hoophq#1509)

* add: fix cli on windows powershell

* fix cli for win