[Fleet] Agent actions menu redesign

[Supplementing]

Summary

Closes #238091

QA/Testing Table

Fleet Agent Actions - QA Testing Guide

Single Agent Actions

Action	Permission	License	Agent Version	Policy Restriction	Disabled When
View agent	—	—	—	—	—
Add/remove tags	allAgents	—	—	Not managed	Inactive
Assign to new policy	allAgents	—	—	Not managed	Inactive OR agentless
Upgrade agent	allAgents	—	—	Not managed	Not upgradeable OR agentless
Restart upgrade	allAgents	—	—	—	Not stuck updating
View agent JSON	—	—	—	—	—
Migrate agent	allAgents	Enterprise	≥9.2.0	Not protected, no Fleet Server	Inactive
Request diagnostics	readAgents	—	≥8.7.0	—	Inactive
Remove root privilege	allAgents + flag	—	≥9.3.0	No root integrations, no Fleet Server, privileged	Inactive
Unenroll agent	allAgents	—	—	Not managed	Inactive OR agentless
Force unenroll	allAgents	—	—	Not managed + unenrolling status	Inactive
Uninstall agent	allAgents	—	—	Not managed, not agentless, has policy	Inactive

Bulk Actions

Action	Permission	License
Add/remove tags	allAgents	—
Assign to new policy	allAgents	—
Upgrade agents	allAgents	—
Schedule upgrade	allAgents	Platinum
Restart upgrade	allAgents	—
Migrate agents	allAgents	Enterprise
Request diagnostics	readAgents	—
Export as CSV	readAgents	—
Remove root access	allAgents + flag	—
Unenroll agents	allAgents	—

Test each action with these combinations:

User permissions to test: allAgents · readAgents · None

License levels to test: Basic · Platinum · Enterprise

Agent configurations to test:

Version	Policy	State
9.3.0+	Standard	Online
8.6.0	Standard	Online
Any	Standard	Offline
Any	Standard	Unenrolling
Any	Standard	Stuck updating (2+ hrs)
Any	Managed	Online
9.2.0+	Protected	Online
Any	Fleet Server	Online
Any	Agentless	Online
9.3.0+	Standard	Online (unprivileged)
9.3.0+	Root-requiring integration	Online

---

Note: "flag" = enableAgentPrivilegeLevelChange feature flag enabled

This PR cleans up the agent actions menus in the agent table row, the bulk actions, and the agent details page to use nested menus.

The agent details and table row actions have been unified into a reusable hook that returns the menus and inconsistencies between the two have been corrected. This will allow us to maintain a consistent actions menu between the two more easily without needing to update two different context menus each time. Bulk actions have a different list, so they remain standalone.

Also, taking notice that EUI already handles menu-nesting, I decided to create a reusable actions menu component that wraps up the popover, trigger (button), and context menu. It renders the button (with the styling configurable via props), allows you to set popover direction, and automatically handles nesting of children items in the menus.

For single agent menus, we simply now can pass in the callbacks to the hook that we want to fire when the buttons are clicked and everything else will be handled, and for bulk actions, we no longer need to build the UI in the MenuItems array and can instead pass in Objects like:

      {
        id: 'upgrade-management',
        name: (
          <FormattedMessage
            id="xpack.fleet.agentBulkActions.upgradeManagement"
            defaultMessage="Upgrade management"
          />
        ),
        panelTitle: 'Upgrade management',
        children: [
          {
            id: 'schedule-upgrade',
            name: (
              <FormattedMessage
                id="xpack.fleet.agentBulkActions.scheduleUpgradeAgents"
                defaultMessage="Schedule upgrade for {agentCount, plural, one {# agent} other {# agents}}"
                values={{ agentCount }}
              />
            ),
            icon: 'timeRefresh',
            disabled: !authz.fleet.allAgents || !isLicenceAllowingScheduleUpgrade,
            onClick: () => {
              setUpgradeModalState({ isOpen: true, isScheduled: true, isUpdating: false });
            },
            'data-test-subj': 'agentBulkActionsScheduleUpgrade',
          },

Screen.Recording.2025-12-05.at.10.22.30.AM.mov

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
• This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
• Flaky Test Runner was used on any tests changed
• The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
• Review the backport guidelines and apply applicable backport:* labels.

Identify risks

Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss.

Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging.

• See some risk examples
• ...

Release Note

Redesigned single and bulk agent actions menus in Fleet. Commonly used actions are organized at the top level of the menus, while other actions are now organized into nested menus by use-case.

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[Supplementing]

@elasticmachine merge upstream

[jillguyonnet]

Nit: should the unenroll and uninstall icons be red like the designs suggest?

[jillguyonnet]

Another nit: should we hide the Upgrade management submenu if the upgrade action is hidden (for non upgradeable agents)?

[juliaElastic]

Should we add release_note:enhancement? It's quite a visible UI change.

[Supplementing]

Another nit: should we hide the Upgrade management submenu if the upgrade action is hidden (for non upgradeable agents)?

Good call, theres no use to show that menu for agents that arent going to be upgradeable anyway.

[Supplementing]

@elasticmachine merge upstream

[MichelLosier]

Looks great! Did some smoke testing with particular focus on the agentless rules and all seems to work well.

Just a note on the HierarchicalActionsMenu component. I think there is opportunity there to simplify it a bit.

[jillguyonnet]

LGTM 🚀 Can you please leave a comment in the issue with outstanding questions we might want to address in the future? Thanks for your work on this!

[elasticmachine]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: 876b7bb
• Cloud Deployment

Failed CI Steps

• FTR Configs #88

Test Failures

• [job] [logs] FTR Configs #88 / Standard Product intercept on initial page load presents all available navigable steps

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
fleet	1371	1373	+2

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
fleet	2.1MB	2.1MB	+1.2KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
fleet	179.0KB	179.0KB	+21.0B

History

• 💚 Build #370264 succeeded e02dddf
• 💔 Build #370149 failed 66b5d27
• 💔 Build #370082 failed eeb64fb
• 💔 Build #369801 failed 8a47003
• 💔 Build #369717 failed 7032ae1