Summary

Follow-up to #2766. That PR closed the chat-thread cross-user IDOR but left agent.getRuns's Chats tab as a hardcoded stub ({ chats: [] }) with a comment claiming it was waiting on chat_threads.agent_id , a column that, per docs/agent-workspace.md's Phase 8, already existed and was fully wired everywhere else. Investigating why an org admin's report ("a teammate's chat silently fails to load") wasn't actually fixed by #2766 turned up two things:

1. The Chats tab itself was never implemented, independent of any authorization gap , agent.ts's getRuns unconditionally returned { executions: [], chats: [] } for kind: 'chats', and the frontend (AgentView.tsx) only ever queried kind: 'executions', so AgentRunsTab's chats prop was always undefined. Fixed: a new getAgentChats query (mirrors getAgentRuns's shape , one query for threads, one grouped follow-up for message counts, using the existing getPrimaryConversation helper for the subject binding) and a second useQuery in AgentView.tsx alongside the executions one, since the router answers one half of the union per kind.
2. Admin-view isn't safe here yet. The embedded chat viewer (ChatRow's openChatThread → store.switchThread → loadThreadMessages → chat.getMessages) has no concept of an admin-scoped viewing target anywhere in the store , it always loads by the session user's own id. Listing a teammate's chats in the tab would only produce a list that breaks the moment a row is clicked, recreating the original bug one layer deeper. So this PR scopes chats to SELF only, deliberately not admin-viewable:
   • authorize.ts's chat_thread:user policy tightened from SELF_OR_ORG_ADMIN (added in #2766) to SELF.
   • agent.ts's getRuns guards the chats branch directly (actorUserId === ctx.sessionUser.id) since it resolves its actor through subagent_execution, not chat_thread , the policy table alone doesn't reach it.

An org admin viewing a teammate's agent now sees an honest empty Chats tab instead of a broken one. Widening this back to admin-viewable is future work once the chat store carries a real viewing scope.

Test plan

• pnpm --filter @zero/server run types , clean
• pnpm --filter @zero/mail run types , clean
• chat-router-org-admin.test.ts , the four admin-CAN cases flipped to admin-CANNOT (SELF policy refuses everyone but the owner)
• agent-router-org-admin.test.ts , two new cases: an admin viewing a teammate's agent gets [] for chats even though the stub genuinely has a row for that thread (proves the guard fires, not that data happened to be absent); the teammate viewing their own agent still gets their real chats back
• agent-router-auth.test.ts , real coverage of getAgentChats's query + mapping (previously only exercised the vacuous empty-stub path)
• All 54 tests across the four touched server suites pass; 22/22 AgentRunsTab tests pass

🤖 Generated with Claude Code

https://claude.ai/code/session_0187itFj1uakga2xd7kPk4qp

Greptile Summary

This PR replaces the Agent Workspace Chats stub with real, owner-scoped chat history and narrows chat-thread authorization to self access until the embedded viewer supports administered-user scope.

• Adds a second agent.getRuns query and supplies chat summaries to the Previous Runs UI.
• Queries agent-bound threads and grouped message counts on the server.
• Prevents organization administrators from listing or opening teammates' chats through the incomplete viewer path.
• Updates authorization and router tests for the self-only contract.
• Conversation-scoped chat history currently fails to apply the supplied conversation filter, and independent request loading unnecessarily blocks both history sub-tabs.

Confidence Score: 4/5

The PR should not merge until conversation-scoped Chats results are restricted to the selected conversati