From cfd7775a95b8cdd55b3ed8ff05153f417cc6e49b Mon Sep 17 00:00:00 2001
From: rcourtman <courtmanr@gmail.com>
Date: Tue, 9 Jun 2026 16:34:43 +0100
Subject: [PATCH] Link the real fix (agent connectivity + agent:exec scope) on
 discovery abstention

---
 .../src/components/Discovery/DiscoveryTab.tsx       | 12 ++++++++++--
 .../Discovery/__tests__/DiscoveryTab.test.tsx       | 13 +++++++++----
 2 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/frontend-modern/src/components/Discovery/DiscoveryTab.tsx b/frontend-modern/src/components/Discovery/DiscoveryTab.tsx
index f2bc679a0..b67dde668 100644
--- a/frontend-modern/src/components/Discovery/DiscoveryTab.tsx
+++ b/frontend-modern/src/components/Discovery/DiscoveryTab.tsx
@@ -713,10 +713,18 @@ export const DiscoveryTab: Component<DiscoveryTabProps> = (props) => {
                 {discovery()?.ai_reasoning ||
                   "Discovery completed but couldn't identify a known service."}
               </p>
-              <Show when={discovery()?.ai_reasoning && props.commandsEnabled !== true}>
+              {/* The abstention only fires when command scanning is already
+                  enabled, so the fix is agent connectivity + the agent:exec
+                  token scope — link both entry points rather than telling the
+                  user to enable a toggle that is already on. */}
+              <Show when={discovery()?.ai_reasoning}>
                 <p class="text-xs mt-2">
                   <a href={commandSettingsTarget.href} class="underline hover:no-underline">
-                    Open {commandSettingsTarget.label}
+                    {commandSettingsTarget.label}
+                  </a>
+                  {' · '}
+                  <a href={apiAccessSettingsTarget.href} class="underline hover:no-underline">
+                    {apiAccessSettingsTarget.label}
                   </a>
                 </p>
               </Show>
diff --git a/frontend-modern/src/components/Discovery/__tests__/DiscoveryTab.test.tsx b/frontend-modern/src/components/Discovery/__tests__/DiscoveryTab.test.tsx
index fba851149..289f0850f 100644
--- a/frontend-modern/src/components/Discovery/__tests__/DiscoveryTab.test.tsx
+++ b/frontend-modern/src/components/Discovery/__tests__/DiscoveryTab.test.tsx
@@ -164,7 +164,7 @@ describe('DiscoveryTab', () => {
       user_secrets: {},
       confidence: 0,
       ai_reasoning:
-        'Discovery could not run commands on this resource, so its service was not identified. Enable "Pulse Commands" for the host agent (Settings → Infrastructure) to run real discovery instead of guessing.',
+        'Discovery couldn\'t collect command output from inside this resource, so its service wasn\'t identified. Pulse Commands are enabled, but the host agent returned no results — make sure the host agent is connected and its API token has the "agent:exec" scope.',
       discovered_at: '2026-06-09T00:00:00Z',
       updated_at: '2026-06-09T00:00:00Z',
       scan_duration: 0,
@@ -180,9 +180,14 @@ describe('DiscoveryTab', () => {
     ));
 
     expect(await screen.findByText('Service not identified')).toBeInTheDocument();
-    expect(screen.getByText(/Discovery could not run commands on this resource/i)).toBeInTheDocument();
-    const settingsLink = screen.getByRole('link', { name: /Open Settings → Infrastructure/i });
-    expect(settingsLink).toHaveAttribute('href', '/settings/infrastructure');
+    // The abstention reason must be surfaced, and it must NOT tell the user to
+    // enable a command toggle that is already on.
+    expect(screen.getByText(/Pulse Commands are enabled, but the host agent returned no results/i)).toBeInTheDocument();
+    expect(screen.queryByText(/Enable "Pulse Commands"/i)).toBeNull();
+    const infraLink = screen.getByRole('link', { name: 'Settings → Infrastructure' });
+    expect(infraLink).toHaveAttribute('href', '/settings/infrastructure');
+    const apiAccessLink = screen.getByRole('link', { name: 'Settings → API Access' });
+    expect(apiAccessLink).toHaveAttribute('href', '/settings/security/api');
     expect(
       screen.queryByText("Discovery completed but couldn't identify a known service"),
     ).toBeNull();