More workbench improvements

[michaeljguarino]

Forgot to add tool calls to extract files for services+stacks

Test Plan

n/a

Checklist

• If required, I have updated the Plural documentation accordingly.
• I have added tests to cover my changes.
• I have added a meaningful title and summary to convey the impact of this PR to a user.

Plural Flow: console

[greptile-apps]

Greptile Summary

This PR extends the workbench AI feature with several improvements: adds built-in Plural observability tools (log querying, log aggregation, log facets, Prometheus metrics), adds Kubernetes tools (kube_get, kube_list) and service/stack file extraction tools to the infrastructure subagent, introduces a WorkbenchPrompt schema for saving prompts, stores the creating user on WorkbenchCron so cron jobs run as the owner rather than an admin bot, adds an MCP legacy client for SSE protocol compatibility, and adds a GraphQL introspection guard for unauthenticated requests.

Key changes:

• New infrastructure tools: ServiceFiles, StackFiles, KubeGet, KubeList wired into the infrastructure subagent
• New observability tools: Plrl.Logs, Plrl.LogsAggregate, Plrl.LogLabels, Plrl.Metrics wired into the observability subagent
• WorkbenchPrompt: New schema, migration, GraphQL CRUD, RBAC delegation
• WorkbenchCron user attribution: Cron now stores user_id and runs jobs as that user instead of an admin bot
• Resilience fixes: Defensive JSON.decode instead of JSON.decode! in provider base, missing process/1 fallthrough for WorkbenchJobActivityCreated, better MCP tool discovery error handling
• @derive Jason.Encoder added to AggregationBucket and Line so log results can be returned as tool output
• Bug: to_time/1 in plrl_logs.ex pattern-matches on %__MODULE__{} (the parent Logs struct) but receives the extracted embedded TimeRange value — the first clause never matches and user-supplied time ranges are always silently replaced with a hardcoded 30-minute window

Confidence Score: 4/5

Mostly safe to merge; one definite P1 logic bug in plrl_logs.ex causes all log tool queries to ignore user-supplied time ranges, always using a 30-minute default.

The to_time/1 bug in plrl_logs.ex is a confirmed present defect — the pattern match is on the wrong struct type, so time ranges are silently dropped for all three Plrl log tools. The Plrl.Metrics arity inconsistency is P2 since it may work fine if dispatched as a plain module atom. All other changes are clean.

lib/console/ai/tools/workbench/observability/plrl_logs.ex (to_time bug), lib/console/ai/tools/workbench/observability/plrl_metrics.ex (arity inconsistency)

Important Files Changed

Filename	Overview
lib/console/ai/tools/workbench/observability/plrl_logs.ex	New Plural-native log query tool; to_time/1 pattern-matches on %MODULE{} (parent Logs struct) instead of the embedded TimeRange value, so user-provided time ranges are always silently ignored
lib/console/ai/tools/workbench/observability/plrl_metrics.ex	New Prometheus metrics wrapper; uses 0-arity callbacks inconsistently with other new Plrl tools that use 1-arity dispatch arguments
lib/console/ai/tools/workbench/infrastructure/service_files.ex	New tool to extract files for a Plural service using ServiceFixer; authorization chain intact
lib/console/ai/tools/workbench/infrastructure/stack_files.ex	New tool to extract terraform files for a stack using EEx template rendering; authorization chain intact
lib/console/ai/tools/workbench/infrastructure/kube_get.ex	New tool to fetch a K8s resource via Kazan; secrets blacklisted; user passed for RBAC via control_plane/2
lib/console/ai/tools/workbench/infrastructure/kube_list.ex	New tool to list K8s resources; delegates kube_request/3 to KubeGet; same secrets blacklist
lib/console/ai/workbench/subagents/infrastructure.ex	Adds ServiceFiles, StackFiles, KubeGet, KubeList to infrastructure subagent; passes user to k8s_tools for embedded RBAC
lib/console/ai/tools/workbench/observability/plrl_logs_aggregate.ex	New log aggregation count tool; reuses plrl_logs.json schema; delegates query building to Logs module
lib/console/ai/tools/workbench/observability/plrl_logs_labels.ex	New log facets/labels tool with extra field parameter for field-specific filtering
lib/console/ai/workbench/subagents/observability.ex	Adds Plrl log/metric tools to observability subagent; fixes obs_tools filter to exclude MCP tools by tool type
lib/console/ai/tools/workbench/coding_agent.ex	Adds workbench config validation for read-only mode and repo allowlist; switches to 2-arg callback pattern
lib/console/deployments/workbenches.ex	Adds WorkbenchPrompt CRUD; stores user_id on WorkbenchCron; fixes update_workbench_cron ordering
lib/console/schema/workbench_prompt.ex	New schema for saved workbench prompts with binary prompt field and workbench FK
lib/console/schema/workbench_cron.ex	Adds user_id FK to WorkbenchCron; updates default preloads to include :user
lib/console/graphql/deployments/workbench.ex	GraphQL types and mutations for WorkbenchPrompt CRUD with read-access scope
lib/console/graphql/resolvers/deployments/workbench.ex	Resolvers for WorkbenchPrompt list, create, update, and delete delegating to Workbenches context
lib/console/deployments/policies/rbac.ex	Adds RBAC evaluation and preload support for WorkbenchPrompt delegating to parent workbench
priv/repo/migrations/20260405194233_add_workbench_prompts.exs	Migration adding workbench_prompts table and nullable user_id FK to workbench_crons
lib/console/pipelines/ai/workbench_cron/pipeline.ex	Cron pipeline now uses stored user (with groups preloaded) instead of admin bot user for job creation
lib/console/graphql/introspection.ex	New Absinthe plugin blocking schema introspection for unauthenticated requests in production
lib/console/ai/mcp/client.ex	Adds LegacyClient for older SSE MCP protocol version (2024-11-05)
lib/console/ai/provider/base.ex	Defensive JSON decode for tool call arguments replacing the crashing JSON.decode!
lib/console/deployments/pubsub/recurse.ex	Adds missing fallthrough clause for non-user WorkbenchJobActivityCreated events

_{Reviews (3): Last reviewed commit: "add built-in plural observability tools" | Re-trigger Greptile}

[michaeljguarino]

@greptileai

[michaeljguarino]

@greptileai