AgentFlow, inside the app
Not a clone of PropFlow — a section of it. /agents.
Why a section and not a clone. You asked for "ideally a one-for-one copy, so if we update prop flow we could just pull it in." A literal clone is the version of that which decays: two shells drift and the sync that keeps them together is a chore nobody runs. A route section has nothing to pull in, because the shell is the shell.
What was actually written. A roster→row adapter, the drawer's arrangement, and one genuine new component — the terminal, which has no equivalent anywhere else in the product. The table, the drawer, the expand, the rail, the top bar, the auth: all existing, all untouched.
The sessions table
The real app shell — SideNav, TopBar, PageBody — with the standard DataTable on top of it. Search, a State filter and a Repo filter, all baked into the table component; nothing hand-rolled. Needs-you sorts first, then Working, then Idle, and Last moved counts up between polls so a working session is legible at a glance.
Row click opens the house drawer
The same EntityDetailDrawer a conversation or a collections account opens into — rail geometry, header reflow and the expand caret all inherited. Inside: what the session is, the LIVE tmux pane, and the task's operator checkpoints. The terminal renders at the pane's true size and streams as the bytes are written.
Expand on top
The standard Expand ⇄ Collapse control grows the drawer into a full-page card in place. No navigation, no separate route. The terminal is real xterm — colours, cursor and all.
Side by side with Clara conversations
This is the proof that it is not a clone: /clara/conversations and /agents read as the same app because they literally are the same app. Same rail, same top bar, same table chrome, same Ask Clara dock.
Running through Cloudflare Access, with the service token
This is the deployed configuration, not the local one: the page is pointed at
https://agents.propflowai.co and authenticates with the Access service token, exactly as the Vercel
deployment does. 68 sessions, and the terminal is streaming live through the tunnel. The credential now exists
— Gera widened the API token, and the token, its Access policy and the Vercel env vars are all in place.
The one thing still not exercised here is Vercel's own runtime injecting those variables, which is why the
earlier caveat on the PR has been narrowed rather than deleted.
What it shows when the relay cannot be reached
Kept for the record, and still the state a reviewer should understand. Before the service token existed, this is what the deployed preview rendered. Rather than show an empty fleet — which would read as "nothing is running" — the page says which failure it is and what to set. Unreachable and Access-refused need different fixes, so it never conflates them.
