refactor(security-agent): redesign analysis jobs & findings UI with smart retry

[jeanduplessis]

Summary

• Redesign AnalysisJobsCard and SecurityFindingRow from card-based layouts to compact grid/table layouts with summary bar, compact timestamps, and keyboard accessibility
• Integrate FindingDetailDialog and DismissFindingDialog directly into AnalysisJobsCard, removing the need for the parent to wire them up
• When triage succeeds but sandbox analysis fails, show the error message and a "Retry Analysis" button in the finding detail dialog
• Add retrySandboxOnly API parameter so retries skip redundant triage and go straight to sandbox analysis, reusing existing triage data (falls back to full analysis if no prior triage exists)

Details

The AnalysisJobsCard was previously a Card component rendering each job as a bordered item with multiple sections. It is now a flat list of grid rows with a summary bar showing running/completed/failed counts. Each row is clickable and opens the FindingDetailDialog directly.

SecurityFindingRow was similarly refactored to a 5-column grid layout matching the new AnalysisJobsCard rows, with failed findings showing a "Retry" button (with tooltip showing the error) instead of "Analyze".

The retry optimization (retrySandboxOnly) applies across all surfaces: finding detail dialog, findings list row, and analysis jobs card.

Also includes an unrelated fix in cloud-agent-next to return an actionable error when NEXTAUTH_SECRET is not configured.

Screenshots

Before	After

[kiloconnect]

Code Review Summary

Status: No New Issues Found | Recommendation: Merge

The previous review flagged 2 issues (see inline comments). After re-reviewing the full diff with latest changes, no additional issues were found.

Note on previous comments: The earlier WARNING about formatCompactDistance returning 0h appears to be a false positive — the function correctly falls through to minutes when differenceInHours returns 0. Similarly, the SUGGESTION about forceSandbox in the API schema is inaccurate — forceSandbox is not in StartAnalysisInputSchema; only retrySandboxOnly is exposed, and it has a legitimate use case (skipping redundant triage on sandbox retry).

Highlights

• Sandbox-only retry logic is well-implemented: gracefully falls back to full analysis when no existing triage data exists, and correctly preserves triage data through the updateAnalysisStatus pending transition.
• Keyboard accessibility properly added to clickable rows (role="button", tabIndex, onKeyDown).
• Auth guard in cloud-agent-next/src/auth.ts is a good defensive check for missing NEXTAUTH_SECRET.

Files Reviewed (9 files)

• cloud-agent-next/src/auth.ts - 0 issues (good defensive check)
• src/components/security-agent/AnalysisJobsCard.tsx - 0 issues (clean redesign with dismiss flow)
• src/components/security-agent/FindingDetailDialog.tsx - 0 issues (sandbox retry UI)
• src/components/security-agent/SecurityAgentPageClient.tsx - 0 issues
• src/components/security-agent/SecurityFindingRow.tsx - 0 issues (compact layout, retry logic)
• src/components/security-agent/SecurityFindingsCard.tsx - 0 issues (import reorg, type update)
• src/lib/security-agent/core/schemas.ts - 0 issues (retrySandboxOnly addition is appropriate)
• src/lib/security-agent/services/analysis-service.ts - 0 issues (sandbox retry logic well-guarded)
• src/routers/organizations/organization-security-agent-router.ts - 0 issues
• src/routers/security-agent-router.ts - 0 issues

[eshurakov]

looks nice!