[Defend Workflows][Osquery] Multiple fixes for pack management (elastic#241655)

This PR combines three separate osquery pack management fixes:

1. **Fix global packs not preserving policy references**: Resolves
issues where global packs would lose references to existing policies
when creating new osquery integrations or deleting policies. Fixed by
including `pack.references` in SavedObject mapping and correcting the
filter logic in the delete callback.

https://github.com/user-attachments/assets/452b52b3-198a-428f-a63e-e33857bfa930

2. **Fix pack edit cancel button**: Fixes the cancel button on the pack
edit page that was redirecting to `/packs/undefined` instead of the
correct pack details page.

3. **Update pack confirmation modal**: Improves the confirmation modal
to clearly display both the number of agent policies and the number of
agents that will be affected by pack updates.

<img width="581" height="300" alt="Screenshot 2025-10-31 at 16 47 11"
src="https://github.com/user-attachments/assets/fa14067f-de8f-4377-8898-411a0454fe91"
/>

Closes elastic/security-team#14422
Closes elastic/security-team#14423
Closes elastic/security-team#14424

(cherry picked from commit eebbf7b)

Author: szwarckonrad

x-pack/platform/plugins/private/translations/translations/de-DE.json

@@ -30972,7 +30972,6 @@
     "xpack.osquery.agent.attachedQuery": "angehängte Abfrage",
     "xpack.osquery.agentDetails.fetchError": "Fehler beim Abrufen von Agentendetails",
     "xpack.osquery.agentPolicy.confirmModalCalloutDescription": "Fleet hat festgestellt, dass die ausgewählte {agentPolicyCount, plural, one {agent policy} other {Agent Policies}} bereits von einigen Ihrer Agenten verwendet wird. Als Ergebnis dieser Aktion wird Fleet Updates an alle Agenten bereitstellen, die diese {agentPolicyCount, plural, one {agent policy} other {Agent Policies}} verwenden.",
-    "xpack.osquery.agentPolicy.confirmModalCalloutTitle": "Diese Aktion wird {agentCount, plural, one {# agent} other {# Agenten}} aktualisieren",
     "xpack.osquery.agentPolicy.confirmModalCancelButtonLabel": "Abbrechen",
     "xpack.osquery.agentPolicy.confirmModalConfirmButtonLabel": "Änderungen speichern und bereitstellen",
     "xpack.osquery.agentPolicy.confirmModalDescription": "Möchten Sie wirklich fortfahren?",

x-pack/platform/plugins/private/translations/translations/fr-FR.json

@@ -31153,7 +31153,6 @@
     "xpack.osquery.agent.attachedQuery": "requête attachée",
     "xpack.osquery.agentDetails.fetchError": "Erreur lors de la récupération des détails des agents",
     "xpack.osquery.agentPolicy.confirmModalCalloutDescription": "Fleet a détecté que {agentPolicyCount, plural, one {la politique d'agent sélectionnée est} other {les politiques d'agent sélectionnées sont}} déjà en cours d'utilisation par certains de vos agents. Par conséquent, Fleet déploiera des mises à jour pour tous les agents utilisant {agentPolicyCount, plural, one {cette politique d'agent} other {ces politiques d'agent}}.",
-    "xpack.osquery.agentPolicy.confirmModalCalloutTitle": "Cette action mettra à jour {agentCount, plural, one {# agent} other {# agents}}",
     "xpack.osquery.agentPolicy.confirmModalCancelButtonLabel": "Annuler",
     "xpack.osquery.agentPolicy.confirmModalConfirmButtonLabel": "Enregistrer et déployer les modifications",
     "xpack.osquery.agentPolicy.confirmModalDescription": "Voulez-vous vraiment continuer ?",

x-pack/platform/plugins/private/translations/translations/ja-JP.json

@@ -31192,7 +31192,6 @@
     "xpack.osquery.agent.attachedQuery": "関連付けられたクエリー",
     "xpack.osquery.agentDetails.fetchError": "エージェント詳細の取得中にエラーが発生しました",
     "xpack.osquery.agentPolicy.confirmModalCalloutDescription": "選択した{agentPolicyCount, plural, one {agent policy} other {エージェントポリシー}}が一部のエージェントですでに使用されていることをFleetが検出しました。このアクションの結果、Fleetはこの{agentPolicyCount, plural, one {agent policy} other {エージェントポリシー}}を使用するすべてのエージェントにアップデートをデプロイします。",
-    "xpack.osquery.agentPolicy.confirmModalCalloutTitle": "このアクションは {agentCount, plural, one {# agent} other {# 個のエージェント}} を更新します。",
     "xpack.osquery.agentPolicy.confirmModalCancelButtonLabel": "キャンセル",
     "xpack.osquery.agentPolicy.confirmModalConfirmButtonLabel": "変更を保存してデプロイ",
     "xpack.osquery.agentPolicy.confirmModalDescription": "続行していいですか？",

x-pack/platform/plugins/private/translations/translations/zh-CN.json

@@ -31174,7 +31174,6 @@
     "xpack.osquery.agent_status.fetchError": "提取代理状态时出错",
     "xpack.osquery.agent.attachedQuery": "已附加查询",
     "xpack.osquery.agentDetails.fetchError": "提取代理详细信息时出错",
-    "xpack.osquery.agentPolicy.confirmModalCalloutTitle": "此操作将更新 {agentCount, plural, one {# 个代理} other {# 个代理}}",
     "xpack.osquery.agentPolicy.confirmModalCancelButtonLabel": "取消",
     "xpack.osquery.agentPolicy.confirmModalConfirmButtonLabel": "保存并部署更改",
     "xpack.osquery.agentPolicy.confirmModalDescription": "是否确定要继续？",

x-pack/platform/plugins/shared/osquery/public/packs/form/confirmation_modal.tsx

@@ -56,18 +56,17 @@ const ConfirmDeployAgentPolicyModalComponent: React.FC<ConfirmDeployAgentPolicyM
         iconType="info"
         title={i18n.translate('xpack.osquery.agentPolicy.confirmModalCalloutTitle', {
           defaultMessage:
-            'This action will update {agentCount, plural, one {# agent} other {# agents}}',
+            'This action will update {agentPolicyCount, plural, one {# agent policy} other {# agent policies}} affecting {agentCount, plural, one {# agent} other {# agents}}',
           values: {
             agentCount,
+            agentPolicyCount,
           },
         })}
       >
         <div className="eui-textBreakWord">
           <FormattedMessage
             id="xpack.osquery.agentPolicy.confirmModalCalloutDescription"
-            defaultMessage="Fleet has detected that the selected {agentPolicyCount, plural, one {agent policy} other {agent policies}}, is already in use by
-              some of your agents. As a result of this action, Fleet will deploy updates to all agents
-              that use this {agentPolicyCount, plural, one {agent policy} other {agent policies}}."
+            defaultMessage="Fleet will deploy updates to all agents that use the selected {agentPolicyCount, plural, one {agent policy} other {agent policies}}."
             // eslint-disable-next-line react-perf/jsx-no-new-object-as-prop
             values={{
               agentPolicyCount,

x-pack/platform/plugins/shared/osquery/public/packs/form/index.test.tsx

@@ -0,0 +1,148 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { __IntlProvider as IntlProvider } from '@kbn/i18n-react';
+import { render } from '@testing-library/react';
+import { QueryClientProvider } from '@kbn/react-query';
+import type { EuiThemeComputed } from '@elastic/eui';
+import { EuiProvider } from '@elastic/eui';
+import { ThemeProvider } from '@emotion/react';
+
+import { PackForm } from '.';
+import { queryClient } from '../../query_client';
+
+const mockUseRouterNavigate = jest.fn();
+
+jest.mock('../../common/lib/kibana', () => ({
+  ...jest.requireActual('../../common/lib/kibana'),
+  useRouterNavigate: (path: string) => {
+    mockUseRouterNavigate(path);
+
+    return {
+      onClick: jest.fn(),
+      href: path,
+    };
+  },
+}));
+
+jest.mock('../../agent_policies', () => ({
+  useAgentPolicies: () => ({
+    data: {
+      agentPoliciesById: {},
+    },
+  }),
+}));
+
+jest.mock('../use_create_pack', () => ({
+  useCreatePack: () => ({
+    mutateAsync: jest.fn(),
+  }),
+}));
+
+jest.mock('../use_update_pack', () => ({
+  useUpdatePack: () => ({
+    mutateAsync: jest.fn(),
+  }),
+}));
+
+const renderWithContext = (Element: React.ReactElement) =>
+  render(
+    <EuiProvider>
+      <ThemeProvider
+        theme={{
+          euiTheme: {
+            colors: { primary: '#006BB4' },
+            border: { width: { thin: '1px' } },
+            size: { base: '16px' },
+          } as unknown as EuiThemeComputed<{}>,
+        }}
+      >
+        <IntlProvider locale={'en'}>
+          <QueryClientProvider client={queryClient}>{Element}</QueryClientProvider>
+        </IntlProvider>
+      </ThemeProvider>
+    </EuiProvider>
+  );
+
+describe('PackForm', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('should use packId for cancel button navigation in edit mode when provided', async () => {
+    const testPackId = 'test-pack-id-123';
+    const defaultValue = {
+      id: 'different-id',
+      saved_object_id: 'saved-object-id',
+      name: 'Test Pack',
+      description: 'Test Description',
+      enabled: true,
+      queries: {},
+      created_at: '2024-01-01',
+      created_by: 'test-user',
+      updated_at: '2024-01-01',
+      updated_by: 'test-user',
+      policy_ids: [],
+      references: [],
+    };
+
+    renderWithContext(<PackForm editMode={true} defaultValue={defaultValue} packId={testPackId} />);
+
+    expect(mockUseRouterNavigate).toHaveBeenCalledWith(`packs/${testPackId}`);
+  });
+
+  it('should fallback to defaultValue.id for cancel button navigation when packId not provided', async () => {
+    const defaultValue = {
+      id: 'fallback-id',
+      saved_object_id: 'saved-object-id',
+      name: 'Test Pack',
+      description: 'Test Description',
+      enabled: true,
+      queries: {},
+      created_at: '2024-01-01',
+      created_by: 'test-user',
+      updated_at: '2024-01-01',
+      updated_by: 'test-user',
+      policy_ids: [],
+      references: [],
+    };
+
+    renderWithContext(<PackForm editMode={true} defaultValue={defaultValue} />);
+
+    expect(mockUseRouterNavigate).toHaveBeenCalledWith(`packs/${defaultValue.id}`);
+  });
+
+  it('should use empty string for cancel button navigation in create mode', async () => {
+    renderWithContext(<PackForm editMode={false} />);
+
+    expect(mockUseRouterNavigate).toHaveBeenCalledWith('packs/');
+  });
+
+  it('should prioritize packId over defaultValue.id when both are provided', async () => {
+    const testPackId = 'priority-pack-id';
+    const defaultValue = {
+      id: 'should-not-be-used',
+      saved_object_id: 'saved-object-id',
+      name: 'Test Pack',
+      description: 'Test Description',
+      enabled: true,
+      queries: {},
+      created_at: '2024-01-01',
+      created_by: 'test-user',
+      updated_at: '2024-01-01',
+      updated_by: 'test-user',
+      policy_ids: [],
+      references: [],
+    };
+
+    renderWithContext(<PackForm editMode={true} defaultValue={defaultValue} packId={testPackId} />);
+
+    expect(mockUseRouterNavigate).toHaveBeenCalledWith(`packs/${testPackId}`);
+    expect(mockUseRouterNavigate).not.toHaveBeenCalledWith(`packs/${defaultValue.id}`);
+  });
+});

x-pack/platform/plugins/shared/osquery/public/packs/form/index.tsx

@@ -51,12 +51,14 @@ interface PackFormProps {
   defaultValue?: PackItem;
   editMode?: boolean;
   isReadOnly?: boolean;
+  packId?: string;
 }
 
 const PackFormComponent: React.FC<PackFormProps> = ({
   defaultValue,
   editMode = false,
   isReadOnly = false,
+  packId,
 }) => {
   const [shardsToggleState, setShardsToggleState] =
     useState<EuiAccordionProps['forceState']>('closed');
@@ -70,7 +72,9 @@ const PackFormComponent: React.FC<PackFormProps> = ({
 
   const { data: { agentPoliciesById } = {} } = useAgentPolicies();
 
-  const cancelButtonProps = useRouterNavigate(`packs/${editMode ? defaultValue?.id : ''}`);
+  const cancelButtonProps = useRouterNavigate(
+    `packs/${editMode ? packId ?? defaultValue?.id : ''}`
+  );
 
   const { mutateAsync: createAsync } = useCreatePack({
     withRedirect: true,

x-pack/platform/plugins/shared/osquery/public/routes/packs/edit/index.tsx

@@ -133,7 +133,7 @@ const EditPackPageComponent = () => {
       {!data ? (
         <EuiSkeletonText lines={10} />
       ) : (
-        <PackForm editMode={true} defaultValue={data} isReadOnly={isReadOnly} />
+        <PackForm editMode={true} defaultValue={data} isReadOnly={isReadOnly} packId={packId} />
       )}
       {isDeleteModalVisible ? (
         <EuiConfirmModal