Feature/agentic

Dockerfile

@@ -35,6 +35,7 @@ RUN if [ "$VERSION" != "0.0.0" ]; then mkdir gitdocs && cd gitdocs && \
 RUN npm install jest jest-environment-jsdom --global
 
 RUN if [ -f "src2/prompt_system.md" ]; then echo "compressing system prompt"; gzip -c src2/prompt_system.md > server/modules/assistant/SOSystemPrompt.bin; fi
+RUN if [ -d "src2/agentic" ]; then for f in src2/agentic/*.md; do jq -Rs --arg key "$(basename "$f" .md)" '{($key): .}' "$f"; done | jq -s 'add' | gzip -nc > server/modules/assistant/SOAgenticPrompts.bin; fi
 RUN ./build.sh "$VERSION"
 
 

html/css/modern.css

@@ -1139,4 +1139,32 @@ dfn {
 
 .v-data-table-footer__items-per-page > .v-select {
   width: 7rem;
-}
+}
+/* ============================================================
+   Assistant — delegated sub-agent (nested) rendering
+   ============================================================ */
+
+.delegation-child {
+  border-left: 2px solid rgba(var(--v-theme-primary), 0.5);
+  padding-left: 0.75rem;
+  margin-left: 0.25rem;
+}
+
+.delegation-child-header {
+  display: flex;
+  align-items: center;
+  font-weight: 500;
+}
+
+.delegation-child-thoughts {
+  white-space: pre-wrap;
+}
+
+.delegation-child-raw-result {
+  white-space: pre-wrap;
+  max-height: 300px;
+  width: 100%;
+  max-width: 100%;
+  overflow-x: auto;
+  overflow-y: auto;
+}

html/index.html

@@ -496,11 +496,17 @@ <h2 v-if="i18n[$route.name]" class="app-bar-title" v-text="i18n[$route.name]"></
     <script src="js/components/detection-panel.js?v=VERSION_PLACEHOLDER"></script>
     <script src="js/components/case-details-col.js?v=VERSION_PLACEHOLDER"></script>
     <script src="js/components/detection-details-col.js?v=VERSION_PLACEHOLDER"></script>
+    <script src="js/components/tool-use-card.js?v=VERSION_PLACEHOLDER"></script>
+    <script src="js/components/delegation-child.js?v=VERSION_PLACEHOLDER"></script>
     <script src="js/routes/case.js?v=VERSION_PLACEHOLDER"></script>
     <script src="js/routes/clients.js?v=VERSION_PLACEHOLDER"></script>
     <script src="js/routes/config.js?v=VERSION_PLACEHOLDER"></script>
     <script src="js/routes/downloads.js?v=VERSION_PLACEHOLDER"></script>
     <script src="js/routes/home.js?v=VERSION_PLACEHOLDER"></script>
+    <script src="js/routes/assistant.sessions.js?v=VERSION_PLACEHOLDER"></script>
+    <script src="js/routes/assistant.streaming.js?v=VERSION_PLACEHOLDER"></script>
+    <script src="js/routes/assistant.tools.js?v=VERSION_PLACEHOLDER"></script>
+    <script src="js/routes/assistant.utils.js?v=VERSION_PLACEHOLDER"></script>
     <script src="js/routes/assistant.js?v=VERSION_PLACEHOLDER"></script>
     <script src="js/routes/hunt.js?v=VERSION_PLACEHOLDER"></script>
     <script src="js/routes/jobs.js?v=VERSION_PLACEHOLDER"></script>

html/js/components/delegation-child.js

@@ -0,0 +1,20 @@
+// Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
+// or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
+// https://securityonion.net/license; you may not use this file except in compliance with the
+// Elastic License 2.0.
+
+loadPageTemplate('component-delegation-child', 'pages/delegation-child.html');
+
+// Renders a delegated sub-agent's transcript (its reasoning and tool calls) for a
+// delegate tool_use that has a childSession. Each tool call is rendered by
+// `tool-use-card`; a tool call that is itself a delegation renders this component
+// again via that card -- so delegations that delegate nest to any depth. Page
+// state/helpers are reached through the injected `ctx` (the assistant page instance,
+// provided as `delegationCtx`).
+components.push({
+	name: "delegation-child", component: {
+		props: { toolUse: { type: Object, required: true } },
+		inject: { ctx: { from: 'delegationCtx' } },
+		template: '#component-delegation-child',
+	}
+});

html/js/components/tool-use-card.js

@@ -0,0 +1,31 @@
+// Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
+// or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
+// https://securityonion.net/license; you may not use this file except in compliance with the
+// Elastic License 2.0.
+
+loadPageTemplate('component-tool-use-card', 'pages/tool-use-card.html');
+
+// Renders a single assistant tool call (parameters, approval, result, error). Used
+// both for the orchestrator's top-level tool calls on the page and, with `nested`,
+// for a delegated sub-agent's tool calls inside `delegation-child`. When the tool is
+// itself a delegation it renders `delegation-child`, which renders more tool-use-cards
+// -- so delegations that delegate nest to any depth through this mutual recursion.
+// Page state/helpers are reached through the injected `ctx` (the assistant page
+// instance, provided as `delegationCtx`).
+components.push({
+	name: "tool-use-card", component: {
+		props: {
+			toolUse: { type: Object, required: true },
+			nested: { type: Boolean, default: false },
+		},
+		inject: { ctx: { from: 'delegationCtx' } },
+		computed: {
+			// The status to render (see ctx.displayStatus): an executing delegate whose
+			// sub-agent awaits approval shows 'action_needed'. Computed so the derived
+			// value (and its tree walk) is evaluated once per render and cached by Vue,
+			// rather than recomputed at each of the template's status-icon/color/title uses.
+			displayStatus() { return this.ctx.displayStatus(this.toolUse); },
+		},
+		template: '#component-tool-use-card',
+	}
+});

html/js/i18n.js

@@ -196,6 +196,7 @@ const i18n = {
       actionGoogleHelp: 'Perform a Google search on this field',
       actionHunt: 'Hunt',
       actionHuntHelp: 'Hunt for this field',
+      actionNeeded: 'Action Needed',
       actionPcap: 'PCAP',
       actionPcapHelp: 'Show PCAP for this event',
       actionProcessAllInfo: 'Process All Info',
@@ -326,6 +327,8 @@ const i18n = {
       assistantChatNoResume: 'This session cannot be resumed.',
       assistantContextLimitPt1: 'Context length limit reached',
       assistantContextLimitPt2: 'You may try compressing your context to continue, or start a new chat.',
+      assistantDelegateAgent: 'Sub-agent',
+      assistantSubAgentApprovalRequest: 'Sub-agent {name} requests approval to run {tool}.',
       assistantDisabled: 'This feature is not enabled on this grid. Contact your Security Onion administrator.',
       assistantDisclaimerMessage: `Use of this feature requires AI requests which can contain event data and will be sent to the OnionAI API in the US.<br><br>No Query Logging: OnionAI API does not record or store input prompts, queries, or generated outputs. No context is stored on the API.<br><br>Token Tracking: The API tracks usage metrics limited to token counts for billing and operational purposes.<br><br>Local Retention: Prompts and responses are stored in the local grid's Elasticsearch data store.`,
       assistantDisclaimerTitle: 'Data Privacy Notice',
@@ -347,8 +350,7 @@ const i18n = {
       assistantSaveReadApprovalError: 'Failed to save read request approval setting',
       assistantToolUnknownError: 'An unknown error occurred during tool execution',
       assistantToolUseFail: 'Failed to execute approved tool',
-      assistantToolUseReject: 'Tool execution rejected by user',
-      assistantToolUseRejectMessage: 'Tool execution for "{toolName}" was rejected by the user.',
+      assistantToolUseReject: 'Tool execution was rejected by the user.',
       assistantToolParseInputError: 'Failed to parse tool input',
       alwaysApproveReadRequests: 'Always approve read requests from tools',
       assistantUnableToDeleteChat: 'Failed to delete chat',