mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-28 20:21:50 +01:00
feat(connections): complete saved setup guidance and coverage maps
Keep the saved human authentication UI, product contracts, and operation maps together. Distinguish provider ingress, local host administration, fixture evidence, and unverified operations. Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
DottaandPaperclip committed
1 parent
2d90f92137
commit
57522de03e
20 files changed
+2629
-685
No files matched your search
@@ -391,3 +391,11 @@ operation logs retain their app authorization. Workspace `_issuePrivacySources`
|
||||
operation privacy metadata protect app-record disclosure; they do not grant or deny
|
||||
filesystem execution or task-bound file browsing. Current trust and sandbox policy,
|
||||
publication receipts, binding checks, and lifecycle locks remain authoritative.
|
||||
|
||||
## Agent connection administration (2026-10-13)
|
||||
|
||||
Standard agents can configure connections through the same domain APIs used by the app, bounded by their grants and their responsible user's current authority. Fresh standard agents for default Operators can manage app/tool connections, chat/email channels, AI accounts and pools, profiles and gateways without additional grants. Existing grants are not backfilled; explicit restrictions persist. Gateway administration retains the responsible human's administrative permission and does not grant agents blanket `tools:admin`.
|
||||
|
||||
The agent performs authorized setup, reuses saved accounts and drafts, and hands off only required human authentication, consent, credential entry or identity confirmation. Saved handoffs resume through existing task continuation after current authority is rechecked. Management, tool execution and approval remain separate. Private accounts, host commands and stored credentials retain their boundaries; agent-issued gateway clients preserve issuer and responsible-user restrictions at use time.
|
||||
|
||||
The implementation, operation inventory, permission matrix and fixture qualification are recorded in [Agent API parity for connection configuration](plans/2026-10-13-connection-api-parity.md). Provider fixtures establish API behavior; they do not constitute live provider setup or an empirical agent-success claim.
|
||||
@@ -2612,3 +2612,11 @@ Company-managed [Prompt Injection Prevention](prompt-injection-prevention.md)
|
||||
optionally classifies existing tool-result boundaries through a shared OpenRouter
|
||||
connection. Settings → Connections is permanent; valid model verdicts take
|
||||
precedence and dependency failures use the original built-in detector.
|
||||
|
||||
## Agent connection administration (2026-10-13)
|
||||
|
||||
Standard agents can configure connections through the same domain APIs used by the app, bounded by their grants and their responsible user's current authority. Fresh standard agents for default Operators can manage app/tool connections, chat/email channels, AI accounts and pools, profiles and gateways without additional grants. Existing grants are not backfilled; explicit restrictions persist. Gateway administration retains the responsible human's administrative permission and does not grant agents blanket `tools:admin`.
|
||||
|
||||
The agent performs authorized setup, reuses saved accounts and drafts, and hands off only required human authentication, consent, credential entry or identity confirmation. Saved handoffs resume through existing task continuation after current authority is rechecked. Management, tool execution and approval remain separate. Private accounts, host commands and stored credentials retain their boundaries; agent-issued gateway clients preserve issuer and responsible-user restrictions at use time.
|
||||
|
||||
The implementation, operation inventory, permission matrix and fixture qualification are recorded in [Agent API parity for connection configuration](plans/2026-10-13-connection-api-parity.md). Provider fixtures establish API behavior; they do not constitute live provider setup or an empirical agent-success claim.
|
||||
@@ -864,3 +864,11 @@ Company-managed [Prompt Injection Prevention](prompt-injection-prevention.md)
|
||||
optionally classifies existing tool-result boundaries through a shared OpenRouter
|
||||
connection. Settings → Connections is permanent; valid model verdicts take
|
||||
precedence and dependency failures use the original built-in detector.
|
||||
|
||||
## Agent connection administration (2026-10-13)
|
||||
|
||||
Standard agents can configure connections through the same domain APIs used by the app, bounded by their grants and their responsible user's current authority. Fresh standard agents for default Operators can manage app/tool connections, chat/email channels, AI accounts and pools, profiles and gateways without additional grants. Existing grants are not backfilled; explicit restrictions persist. Gateway administration retains the responsible human's administrative permission and does not grant agents blanket `tools:admin`.
|
||||
|
||||
The agent performs authorized setup, reuses saved accounts and drafts, and hands off only required human authentication, consent, credential entry or identity confirmation. Saved handoffs resume through existing task continuation after current authority is rechecked. Management, tool execution and approval remain separate. Private accounts, host commands and stored credentials retain their boundaries; agent-issued gateway clients preserve issuer and responsible-user restrictions at use time.
|
||||
|
||||
The implementation, operation inventory, permission matrix and fixture qualification are recorded in [Agent API parity for connection configuration](plans/2026-10-13-connection-api-parity.md). Provider fixtures establish API behavior; they do not constitute live provider setup or an empirical agent-success claim.
|
||||
@@ -29,3 +29,11 @@ Agent-authenticated callers cannot set process adapter configuration or switch a
|
||||
The new direct grants are withheld from low trust agents and managed built-in agents. Low trust run or project policies can also deny privileged actions even if an agent has a grant. There is no permission backfill or upgrade migration for existing agents. A standard pending new hire receives the new default set when approved and activated. Invitation approval retains the set when it replaces a new agent's grants and preserves any explicitly scoped default grant. Existing scoped grants stay unchanged. A grant removed by an operator stays removed; ordinary updates and startup do not reapply it.
|
||||
|
||||
The standard agent configuration default supports the agent setup in the linked runner task. Enabling a warm runtime can still depend on the target agent's adapter and runtime configuration, provider availability, and any responsible-user or approval checks.
|
||||
|
||||
## Connection administration (2026-10-13)
|
||||
|
||||
The five default tool grants are usable through the existing connection APIs and default native `search_api`/`call_api`. A fresh standard agent for a normally provisioned Operator can configure app/tool, chat/email and AI connections, profiles and gateways without additional agent grants. Gateway management uses the agent's `tools:manage_connections` grant and still requires `tools:admin` on the responsible human. It does not grant blanket agent administration.
|
||||
|
||||
Connection management always intersects the current human's authority, including in responsible-user shadow mode. Personal self-service remains available where the human setup surface permits it; sharing and assignments require authority over their targets. Current run/work-mode/trust restrictions, scoped grants and explicit grant removal remain effective. No existing-agent permissions are backfilled. Agent-issued gateway clients preserve this delegation at every use, even after the setup run ends.
|
||||
|
||||
See [the authorization and qualification record](plans/2026-10-13-connection-api-parity.md) and the operation-reviewed [agent access maps](../maps/agent-access-map/connection-setup.md). Human consent, credential entry and identity confirmation remain bounded handoffs to saved setup.
|
||||
@@ -0,0 +1,112 @@
|
||||
# Agent API parity for connection configuration
|
||||
|
||||
Dated 2026-10-13. Implementation and qualification record for the connection-management change based on `e43af9770a36ff92e14cf0e31ee16fa238310f76`.
|
||||
|
||||
## Outcome
|
||||
|
||||
A newly created standard agent can administer connections using its existing default grants and its responsible user's authority. The default Operator has the human permissions needed for these operations. API reachability includes app/tool connections, chat/email endpoints, GitHub and Slack setup, AI accounts and pools, profiles, named gateways and gateway clients. Human authentication and trusted-host operations retain their explicit boundaries.
|
||||
|
||||
No agent grant backfill is performed. An existing missing or scoped grant remains missing or scoped. An operator can explicitly change those grants through the existing permission-management surface. Agents do not acquire `tools:admin` by default and cannot edit their own principal permissions or approve their own governed requests.
|
||||
|
||||
## Authorization contract
|
||||
|
||||
`server/src/services/connection-management.ts` resolves authenticated management context and invokes the existing authorization evaluator. `server/src/routes/connection-management-authz.ts` resolves route resources and all referenced targets, then supplies that context to services. Capability reporting calls the same evaluator; every mutation checks authority again.
|
||||
|
||||
| Operation | Agent grant | Responsible-user ceiling |
|
||||
| --- | --- | --- |
|
||||
| Configure connections, channels and AI accounts | `tools:manage_connections` | Existing personal/creator authority or connection management |
|
||||
| Profiles, assignments and action policies | `tools:manage_profiles` | Corresponding profile and target-agent authority; changes to connection audience also require connection management |
|
||||
| Named gateways and client tokens | `tools:manage_connections` | `tools:admin`; bindings also require profile and target authority |
|
||||
| Audit | `tools:view_audit` | Audit and resource visibility |
|
||||
| Start/stop runtimes | `tools:manage_runtime` | Runtime and resource authority |
|
||||
| Test actions | `tools:use` | Credential access, target-agent authority and ordinary tool/action policy |
|
||||
|
||||
The acting principal, responsible user, credential owner and target agent remain distinct. Personal credentials belong to the responsible human. Activity records identify the actual agent, responsible user, run or API key, resource and authorization reason. API parameters cannot select a responsible user or forge ownership attribution.
|
||||
|
||||
Agent keys resolve their saved responsible user. Run JWTs require current run identity and assignment. Both fail closed on absent user context, inactive membership, foreign companies, unavailable personal credentials, invalid scopes or low trust. Connection authorization enforces the human ceiling even when general responsible-user authorization runs in shadow mode. `skill_test` and `task_bridge` cannot administer connections. Ask and Plan contexts cannot mutate configuration. Connection/profile/gateway/provider/purpose/operation grant scopes apply to resolved resources, including plural policy selectors and affected targets.
|
||||
|
||||
Services recheck management context after asynchronous provider work before sensitive persistence. Existing revisions, transaction locks, credential leases, vault storage, duplicate prevention and cleanup stay authoritative. Reads filter private accounts, referenced profile/pool resources and task activity. Configuration authority is separate from use: an allowed policy change does not bypass Off/Ask first/Allowed execution policy.
|
||||
|
||||
Binding and audience authorization checks field presence, including `null`, `false` and empty arrays. Clearing an assignment or reducing an audience remains a profile-management operation after an explicit grant revocation. Gateway binding changes check both the saved and replacement profile/project/task contexts; reauthorization reloads the saved side after asynchronous work. Referenced resources require each applicable connection and profile permission, including the replacement side of a project binding.
|
||||
|
||||
## Saved authentication and delegation
|
||||
|
||||
Agent setup responses retain their browser fields and add `requiredUserAction` where a human step is needed. It identifies the addressed user, saved resource, setup destination, reason and continuation. Chat handoffs reuse the saved endpoint and existing connection-intent delivery. AI login handoffs reopen the saved sign-in intent in the existing credential UI. Completion is based on server state; the UI does not ask a human to certify setup success.
|
||||
|
||||
Generic app OAuth returns the saved setup destination without creating agent-bound provider state; the human browser starts the existing session-bound authorization flow. Its `expiresAt` is null until that human step creates an expiring provider session. Slack/GitHub provider callbacks preserve human subject and state checks. Agent-created GitHub setup binds its browser session when the addressed human opens it. Identity callbacks validate the current human and session before consuming state, and revalidate authority before saving identity. Wrong-user callbacks leave the rightful user's flow intact. Continuation rechecks task state and current authority after a yielding run; cancelled tasks and revoked access cannot be revived by a late provider result.
|
||||
|
||||
Agent-issued durable gateway clients store `responsible_user_id` alongside `created_by_agent_id`. Token use reevaluates issuer/user authority, gateway/profile scope, target constraints, credential access and action restrictions. The responsible-user marker remains after deletion clears the issuer foreign key, so an orphaned delegated token fails closed instead of becoming a system client. It does not inherit the lifetime of the setup run. Heartbeat tokens remain bound to their authenticated run. Legacy agent-issued clients without a responsible user fail closed; existing board-issued clients retain their behavior. Migration `0378_slim_nehzno.sql` is additive and does not infer legacy identity or modify agent grants.
|
||||
|
||||
## Discovery and guidance
|
||||
|
||||
OpenAPI carries explicit REST transport and connection-management authorization metadata. JSON authorization initiation and status are callable through default `search_api`/`call_api`; OAuth callbacks, redirects, MCP and WebSocket sessions retain their protocols. There is no new administration tool family.
|
||||
|
||||
The shared connection guidance is delivered by the runtime prompt, search tools and existing adapter/CLI consumers. It tells agents to distinguish tool/channel/AI purposes, configure what the user requested when authorized, suggest relevant missing connections, reuse saved drafts and hand off only missing decisions, credentials, consent or authority. It prohibits silently relaxing policy after failed execution and distinguishes saved, authenticated, usable and verified states. Native API setup secrets and gateway credentials use protected replay receipts and redacted history.
|
||||
|
||||
## Operation inventory
|
||||
|
||||
The existing maps are the checklist, not a second runtime registry:
|
||||
|
||||
| Inventory | Coverage |
|
||||
| --- | --- |
|
||||
| [Connection setup](../../maps/agent-access-map/connection-setup.md) | Catalog/method discovery, preflight, drafts, authentication, connection intents and host boundaries |
|
||||
| [App permissions](../../maps/agent-access-map/app-permissions.md) | Account lifecycle, installations/grants, policy, catalog, action tests and activity |
|
||||
| [Chat channels](../../maps/agent-access-map/chat-channels.md) | Endpoint/provider setup, settings, defaults, destination access, GitHub/Slack registration and identity, email, tests and lifecycle |
|
||||
| [Gateways and profiles](../../maps/agent-access-map/gateways-profiles.md) | Profiles/bindings, gateway configuration, client tokens, runtime controls, protocol and audit |
|
||||
| [Model accounts](../../maps/agent-access-map/runs-adapters.md#model-accounts) | AI discovery, key/login setup, reconnect/defaults, managed agent bindings, pools and lifecycle |
|
||||
|
||||
The route inventory was reconciled against the production `tools`, `chatEndpoints`, `email`, `ai-connections`, `ai-connection-pools` and relevant `agents` UI API clients. Human-only operations remain individually classified: browser callback/identity confirmation and credential entry, principal approvals, arbitrary local configuration import/host-template authoring, cloud instance enrollment, and manual chat publication/replay that does not run through the governed agent tool path. Approved template use and ordinary authorized remote configuration remain delegable. Catalog/provider availability gates still apply.
|
||||
|
||||
## Qualification
|
||||
|
||||
`server/src/__tests__/connection-management.integration.test.ts` runs the assembled server, production bearer authentication, real database/vault persistence and deterministic provider responses. It creates each standard agent with an actual human-authenticated `POST /companies/:companyId/agents`; it provisions the human using normal Operator role defaults. It adds no special agent grants and does not inject `req.actor`. Only fixture sign-in throttling is disabled. GitHub/Slack/OpenAI/AgentMail responses are fixtures, not live provider proof.
|
||||
|
||||
The suite exercises:
|
||||
|
||||
- Fresh default app connections, profiles, chat settings, AI account/binding/pool and named gateway/token creation; no default `tools:admin` grant.
|
||||
- Actual persistent API keys and run JWTs, native discovery/calls, and delivery of the new built-in guidance.
|
||||
- Correct human ownership and actual-agent audit attribution, including personal grant delegation and revocation; persisted settings and optimistic revision conflicts.
|
||||
- Slack configured credentials and test messages under ordinary action policy; repeated request IDs do not resend.
|
||||
- GitHub app import, repository/verification configuration and real-session identity handoff; wrong-user and replay rejection.
|
||||
- Saved chat handoff reuse and existing task continuation; late credential promotion after yield, cancellation and user revocation.
|
||||
- User restrictions with legitimate personal self-service, missing/scoped agent grants, foreign companies/accounts, forged identity, invalid responsible users, bridge keys, low trust and work-mode restrictions.
|
||||
- Durable gateway use after the setup run finishes, purpose-scoped grants, denial after membership or issuer-grant revocation and in the persisted cleared-issuer state, encrypted native token receipts, redacted history and retry without a second token.
|
||||
|
||||
Focused neighboring tests cover existing human routes, callback behavior, provider setup, device/setup-token sign-in, native API policy, secret redaction, saved setup UI and connection-intent behavior. Maps distinguish individually executed fixture operations from source-reviewed operations. Scripted evidence proves reachability and behavior, not an empirical LLM success rate.
|
||||
|
||||
Required final checks are `node scripts/check-maps.mjs`, `pnpm -r typecheck`, `pnpm test:run`, `pnpm build`, database migration validation and UI token gates. The final handoff records their actual results. Live provider setup, a new chatbot skill and redesigned setup workflows are outside this delivery.
|
||||
|
||||
## Historical validation record (2026-10-13)
|
||||
|
||||
- Focused connection, AI hiring, native API and OpenAPI suites: **2,533 passed**, including **16 assembled-server acceptance scenarios** using production authentication and default agent creation.
|
||||
- Final fresh-process connection qualification: **618 passed across five suites**, including **all 18 assembled-server acceptance scenarios**, 418 tool-access tests, 87 gateway acceptance tests, 73 authorization tests and 22 decision-model tests. This covers binding/audience revocation, both sides of profile/project scope changes, current membership authority and gateway-token ownership metadata.
|
||||
- Chat compatibility regression selection: **49 passed** (Slack tests, resource auditing, manager boundaries and Teams activity/projections).
|
||||
- Saved setup UI, canonical guidance and native history redaction: passed in the neighboring focused run; its three outdated API transport/security assertions were corrected and included in the 2,533-test passing run.
|
||||
- `pnpm -r typecheck`: passed.
|
||||
- `pnpm build`: passed.
|
||||
- Database migration numbering/safety validation: passed through typecheck/build; existing historical safety findings remain covered by the repository baseline.
|
||||
- `node scripts/check-maps.mjs`: passed, 35 areas / 176 capability IDs; structural consistency only.
|
||||
- UI token gates: passed.
|
||||
- Broad UI run: 8,210 passed / 5 failed under contention; both failing suites passed serially (82 tests).
|
||||
- Shared contracts and catalog: 941 passed. Adapter utilities: 1,740 passed / 5 failed under contention; all five failing suites passed serially (217 tests).
|
||||
- Remaining source-only adapter/plugin projects: 2,087 passed / 1 macOS temporary-path assertion failed; that suite passed with the repository runner’s canonical temporary directory (14 tests).
|
||||
- Serialized route/auth suites without embedded PostgreSQL: 1,849 passed / 22 failures in two empty-database fixtures; after adding the resource/membership fixture rows, both suites passed (25 tests). Their authentication, isolation and provider-error assertions remain exercised.
|
||||
- Email address/provider regression suite: 10 passed after supplying resource and membership rows to its old empty-database fixture. HTTP log redaction: 66 passed in a fresh process after a sweep timeout.
|
||||
- CLI suites without embedded PostgreSQL: 462 passed across 63 files. The three database-backed suites produced 62 passes and three embedded-PostgreSQL initialization failures in `worktree.test.ts`. The host was at its 32/32 shared-memory segment limit; these worktree tests need additional concurrent clusters. Other chats' databases and system limits were not modified.
|
||||
- Database package: 194 passed across 50 files.
|
||||
- Database-backed serialized routes: 1,208 passed / two failed / 73 skipped. Seven suites hit their 20-second database startup limit; the failures were an outdated AI-pool role fixture and a routine test timeout. All affected suites passed fresh-process reruns.
|
||||
- Final isolated gateway/service/route reruns: **320 passed across 13 suites**, including the startup failures, skill cleanup deadlock, AI-pool membership fixture and routine timeout. The stale-lock route suite initially skipped its 14 tests after a failed database availability probe; a final isolated retry executed and passed all 14.
|
||||
- Final assembled-server acceptance after the gateway scope and orphaned-token fixes: **18 passed**. The orphaned-token case models the token foreign key's persisted `ON DELETE SET NULL` state without deleting protected historical audit references; token use still traverses the real public gateway endpoint.
|
||||
- Final workspace typecheck/build, migration checks, maps, token gates and `git diff --check`: passed. The generated migration retains exactly the five newest schema snapshots.
|
||||
- `pnpm test:run`: the general server sweep finished with 19,282 passed / 15 failed / 381 skipped across 914 files (898 passed, 10 failed, 6 skipped). Four suites could not start their databases; other failures included two gateway tests loaded against earlier transformed authorization code, outdated role/resource fixtures, a cleanup deadlock, an HTTP timeout and a socket hang-up. All reported server failures and blocked startup suites subsequently passed fresh reruns. Workspace and serialized groups were executed separately after the runner's fail-fast exit. The original sweep is not represented as a clean pass.
|
||||
|
||||
Qualification is complete for the connection feature and its provider fixtures. The repository-wide test result remains **not fully green** because the three CLI worktree tests could not initialize their additional PostgreSQL clusters at the host's shared-memory limit. They require rerunning on a host with spare PostgreSQL capacity. Live provider verification remains outside this delivery.
|
||||
|
||||
## PR qualification (2026-10-26)
|
||||
|
||||
The implementation was rebased onto `a1f77821b9cd5c9c846fdf7a0fa5cc620ad2b6bb`. Connection-service changes were ported into the current extracted modules. The historical checks above describe the October 13 snapshot; fresh PR qualification is recorded separately below.
|
||||
|
||||
- Fresh Node 24.22.1 / pnpm 9.15.4 workspace typecheck and build passed. Migration safety, module boundaries, and UI token gates passed.
|
||||
- Local database acceptance could not run: the first install lacked native library links; after package setup, a direct `initdb` reproduction reported the host semaphore limit (`semget`: No space left on device). No shared databases or kernel limits were changed. The broad local test attempt is not a clean pass.
|
||||
- First Linux CI exposed a duplicate user fixture, a lost viewer restriction, a host-template visibility gap, an integration fixture race with production harness verification, and the prompt-bound Copilot identity. These are tracked and fixed separately from the local host limit. Current-head CI remains the completion gate.
|
||||
- Harness verification uses a deterministic lifecycle driver fixture; agent creation, grant defaults, bearer authentication, authorization, and persistence remain production paths.
|
||||
@@ -1,191 +1,601 @@
|
||||
# App access, action permissions, and testing — agent access
|
||||
|
||||
Product map: [App access, action permissions, and
|
||||
testing](../feature-map/app-permissions.md).
|
||||
Product map: [app-permissions](../feature-map/app-permissions.md).
|
||||
|
||||
Feature ID: `app-permissions`.
|
||||
|
||||
Review date: 2026-10-12. Source commit: `f981fa3cc10cb8663a87dec60345fbff46d54d0a`.
|
||||
Review date: 2026-10-26. Source base: `a1f77821b9cd5c9c846fdf7a0fa5cc620ad2b6bb`; implementation: [#17737](https://github.com/paperclipai/paperclip/pull/17737).
|
||||
|
||||
This is a source-reviewed baseline of representative operations and known gaps.
|
||||
Each capability needs operation-level review before its entire scope can be
|
||||
qualified. No live agent execution is claimed. Follow the [map contract](../README.md)
|
||||
for format, permission checks, evidence and maintenance.
|
||||
Connection operations reviewed in this working tree. The inventory was reconciled
|
||||
against production UI clients, REST registrations and service entry points; it is
|
||||
a review checklist, not a runtime registry. [Authorization and evidence contract](../../doc/plans/2026-10-13-connection-api-parity.md).
|
||||
Fixture evidence is separate from live provider qualification and from empirical
|
||||
LLM success. Source-only entries have a reviewed agent path or an explicit boundary,
|
||||
but do not claim an individually executed HTTP test.
|
||||
|
||||
## `agent-access`
|
||||
|
||||
Capability ID: `app-permissions/agent-access`.
|
||||
|
||||
Review: `baseline`.
|
||||
Review: `operation-reviewed`.
|
||||
|
||||
API: `present` — representative operation IDs:
|
||||
### `get-tool-connections-grants`
|
||||
|
||||
- `PUT /api/tool-connections/{connectionId}/installs`.
|
||||
Capability ID: `app-permissions/get-tool-connections-grants`.
|
||||
|
||||
Agent access: `restricted` — Board management API; agents use their resulting assigned
|
||||
app tools.
|
||||
API: `present` — `GET /api/tool-connections/{connectionId}/grants`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
Policy: Connection/profile/policy management routes require a board user; tool use
|
||||
separately evaluates agent grants and action policies.
|
||||
### `put-tool-connections-grants-members`
|
||||
|
||||
Evidence: `source-only` — [implementation](../../server/src/routes/tool-access.ts#L517)
|
||||
at the reviewed commit above.
|
||||
Capability ID: `app-permissions/put-tool-connections-grants-members`.
|
||||
|
||||
Verification: `not-run` — assert the documented agent denial with an owned test fixture;
|
||||
verify any listed agent request/result path separately. A delegated operation needs its
|
||||
own policy and access review.
|
||||
API: `present` — `PUT /api/tool-connections/{connectionId}/grants/{grantId}/members`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_profiles` and `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
Gaps: Granting access is distinct from using access. No equivalent agent management path
|
||||
exists in these routes.
|
||||
### `post-tool-connections-grants-installations`
|
||||
|
||||
The owning lifecycle plugin can read bounded standing connection and active
|
||||
profile assignments with `ctx.agents.getRuntime`. It requires the existing
|
||||
`agents.lifecycle.manage` capability and agent ownership checks. Committed
|
||||
assignment changes use the opt-in `agent_runtime` stream. These inputs contain
|
||||
no grant credentials and do not authorize a task's tool calls. See the
|
||||
[runtime contract](../../doc/plugins/AGENT_RUNTIME_SYNC.md#standing-connection-assignments).
|
||||
Capability ID: `app-permissions/post-tool-connections-grants-installations`.
|
||||
|
||||
API: `present` — `POST /api/tool-connections/{connectionId}/grants/installations`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_profiles` and `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `delete-tool-connections-grants`
|
||||
|
||||
Capability ID: `app-permissions/delete-tool-connections-grants`.
|
||||
|
||||
API: `present` — `DELETE /api/tool-connections/{connectionId}/grants/{grantId}`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-tool-connections-grants-delegations`
|
||||
|
||||
Capability ID: `app-permissions/post-tool-connections-grants-delegations`.
|
||||
|
||||
API: `present` — `POST /api/tool-connections/{connectionId}/grants/{grantId}/delegations`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_profiles` and `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `verified` — [authenticated integration fixtures](../../server/src/__tests__/connection-management.integration.test.ts) passed through production authentication and database persistence.
|
||||
Verification: `passed` — deterministic local fixture; no live provider qualification.
|
||||
Gaps: Provider fixtures do not qualify live provider setup or availability.
|
||||
|
||||
### `delete-tool-connections-grants-delegations`
|
||||
|
||||
Capability ID: `app-permissions/delete-tool-connections-grants-delegations`.
|
||||
|
||||
API: `present` — `DELETE /api/tool-connections/{connectionId}/grants/{grantId}/delegations/{delegationId}`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_profiles` and `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `verified` — [authenticated integration fixtures](../../server/src/__tests__/connection-management.integration.test.ts) passed through production authentication and database persistence.
|
||||
Verification: `passed` — deterministic local fixture; no live provider qualification.
|
||||
Gaps: Provider fixtures do not qualify live provider setup or availability.
|
||||
|
||||
### `get-tool-connections-installs`
|
||||
|
||||
Capability ID: `app-permissions/get-tool-connections-installs`.
|
||||
|
||||
API: `present` — `GET /api/tool-connections/{connectionId}/installs`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_profiles`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `put-tool-connections-installs`
|
||||
|
||||
Capability ID: `app-permissions/put-tool-connections-installs`.
|
||||
|
||||
API: `present` — `PUT /api/tool-connections/{connectionId}/installs`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_profiles` and `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
## `action-policy`
|
||||
|
||||
Capability ID: `app-permissions/action-policy`.
|
||||
|
||||
Review: `baseline`.
|
||||
Review: `operation-reviewed`.
|
||||
|
||||
API: `present` — representative operation IDs:
|
||||
### `get-companies-tools-trust-rules`
|
||||
|
||||
- `POST /api/tool-profiles/{profileId}/entries`.
|
||||
Capability ID: `app-permissions/get-companies-tools-trust-rules`.
|
||||
|
||||
Agent access: `restricted` — Board management API; agent execution follows
|
||||
off/ask/allowed.
|
||||
API: `present` — `GET /api/companies/{companyId}/tools/trust-rules`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_profiles`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
Policy: Connection/profile/policy management routes require a board user; tool use
|
||||
separately evaluates agent grants and action policies.
|
||||
### `get-companies-tools-policies`
|
||||
|
||||
Evidence: `source-only` — [implementation](../../server/src/routes/tool-access.ts#L517)
|
||||
at the reviewed commit above.
|
||||
Capability ID: `app-permissions/get-companies-tools-policies`.
|
||||
|
||||
Verification: `not-run` — assert the documented agent denial with an owned test fixture;
|
||||
verify any listed agent request/result path separately. A delegated operation needs its
|
||||
own policy and access review.
|
||||
API: `present` — `GET /api/companies/{companyId}/tools/policies`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_profiles`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
Gaps: An agent cannot authorize itself by editing the policy. Decide whether any
|
||||
explicitly delegated administration should be supported.
|
||||
### `post-companies-tools-policies-reorder`
|
||||
|
||||
Braintrust's reviewed classifier treats retrieval as read, dataset row edits and
|
||||
automation-status changes as destructive, and other mutations, billable
|
||||
execution, and unknown tools as write. Provider hints cannot lower a reviewed
|
||||
mutation's risk. The classifier grants no authority: shared Allowed defaults
|
||||
and explicit Off/Ask-first policies still govern each agent's actual run-bound
|
||||
call. See [Braintrust](../../doc/connections/BRAINTRUST.md#actions-and-governance).
|
||||
Live US OAuth bounded reads and a synthetic dataset insert/readback passed
|
||||
through actual process-agent runs and run-scoped gateway sessions; local removal
|
||||
then denied further use. This does not establish live Off/Ask-first policy
|
||||
behavior, which is covered with provider fixtures. US API-key and both EU
|
||||
methods remain `not-run` against real accounts; board Test calls do not
|
||||
establish agent execution evidence.
|
||||
Capability ID: `app-permissions/post-companies-tools-policies-reorder`.
|
||||
|
||||
API: `present` — `POST /api/companies/{companyId}/tools/policies/reorder`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_profiles`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-companies-tools-policies`
|
||||
|
||||
Capability ID: `app-permissions/post-companies-tools-policies`.
|
||||
|
||||
API: `present` — `POST /api/companies/{companyId}/tools/policies`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_profiles`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-companies-tools-policies-duplicate`
|
||||
|
||||
Capability ID: `app-permissions/post-companies-tools-policies-duplicate`.
|
||||
|
||||
API: `present` — `POST /api/companies/{companyId}/tools/policies/{policyId}/duplicate`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_profiles`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `patch-companies-tools-policies`
|
||||
|
||||
Capability ID: `app-permissions/patch-companies-tools-policies`.
|
||||
|
||||
API: `present` — `PATCH /api/companies/{companyId}/tools/policies/{policyId}`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_profiles`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `delete-companies-tools-policies`
|
||||
|
||||
Capability ID: `app-permissions/delete-companies-tools-policies`.
|
||||
|
||||
API: `present` — `DELETE /api/companies/{companyId}/tools/policies/{policyId}`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_profiles`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-companies-tools-trust-rules-revoke`
|
||||
|
||||
Capability ID: `app-permissions/post-companies-tools-trust-rules-revoke`.
|
||||
|
||||
API: `present` — `POST /api/companies/{companyId}/tools/trust-rules/{policyId}/revoke`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_profiles`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-companies-tools-policy-test`
|
||||
|
||||
Capability ID: `app-permissions/post-companies-tools-policy-test`.
|
||||
|
||||
API: `present` — `POST /api/companies/{companyId}/tools/policy/test`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
## `catalog-change`
|
||||
|
||||
Capability ID: `app-permissions/catalog-change`.
|
||||
|
||||
Review: `baseline`.
|
||||
Review: `operation-reviewed`.
|
||||
|
||||
API: `present` — representative operation IDs:
|
||||
### `post-tool-connections-catalog-refresh`
|
||||
|
||||
- `POST /api/tool-profiles/{profileId}/new-tools/review`.
|
||||
Capability ID: `app-permissions/post-tool-connections-catalog-refresh`.
|
||||
|
||||
Agent access: `restricted` — Board catalog-review API; agents can discover authorized
|
||||
tools.
|
||||
API: `present` — `POST /api/tool-connections/{connectionId}/catalog/refresh`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
Policy: Connection/profile/policy management routes require a board user; tool use
|
||||
separately evaluates agent grants and action policies.
|
||||
### `get-tool-connections-catalog`
|
||||
|
||||
Evidence: `source-only` — [implementation](../../server/src/routes/tool-access.ts#L517)
|
||||
at the reviewed commit above.
|
||||
Capability ID: `app-permissions/get-tool-connections-catalog`.
|
||||
|
||||
Verification: `not-run` — assert the documented agent denial with an owned test fixture;
|
||||
verify any listed agent request/result path separately. A delegated operation needs its
|
||||
own policy and access review.
|
||||
API: `present` — `GET /api/tool-connections/{connectionId}/catalog`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
Gaps: Catalog refresh/review and quarantined-action enablement are management
|
||||
operations.
|
||||
### `get-tool-profiles-new-tools`
|
||||
|
||||
Braintrust enables changed-tool quarantine after initial discovery and preserves
|
||||
it through reconnect and refresh. Agents cannot approve newly quarantined tools
|
||||
or bypass a changed schema by reusing its old name. Verify the quarantined call
|
||||
denial through a real run-scoped gateway separately from board catalog review;
|
||||
the [provider qualification record](../../doc/connections/BRAINTRUST.md#qualification-record)
|
||||
records live US OAuth catalog refresh and reconnect preserving the regional
|
||||
method and quarantine setting. Live changed-tool denial remains outstanding;
|
||||
fixtures cover that denial and policy preservation across refresh/reconnect.
|
||||
US API-key and both EU methods have no account-bound qualification. Live token
|
||||
expiry/refresh, remote OAuth revocation, and native CLI automatic capability
|
||||
delivery also remain unqualified.
|
||||
Capability ID: `app-permissions/get-tool-profiles-new-tools`.
|
||||
|
||||
Daytona also checks its deployed native contract on the board's
|
||||
`GET /api/tool-connections/{connectionId}/catalog`. A changed saved catalog
|
||||
refreshes under the viewing human's credential context. Retired tools are
|
||||
hidden even if refresh fails. Agent discovery and dispatch reject retired names
|
||||
and stale same-name contracts before refresh; new/changed tools stay quarantined until reviewed. The
|
||||
[database-backed Daytona fixtures](../../server/src/__tests__/daytona-connection.test.ts)
|
||||
exercise this boundary through real run-bound gateway sessions with fixture
|
||||
provider responses. They do not qualify a live Daytona account or agent model.
|
||||
API: `present` — `GET /api/tool-profiles/{profileId}/new-tools`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_profiles`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
Unikraft uses the same native-catalog contract: stale same-name saved entries are
|
||||
rejected before refresh and new or changed actions stay quarantined. Its
|
||||
[database-backed fixtures](../../server/src/__tests__/unikraft-connection.test.ts)
|
||||
cover this through real run-bound gateway sessions with fixture provider
|
||||
responses, not a live Unikraft account.
|
||||
### `post-tool-profiles-new-tools-review`
|
||||
|
||||
Capability ID: `app-permissions/post-tool-profiles-new-tools-review`.
|
||||
|
||||
API: `present` — `POST /api/tool-profiles/{profileId}/new-tools/review`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_profiles`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
## `test-action`
|
||||
|
||||
Capability ID: `app-permissions/test-action`.
|
||||
|
||||
Review: `baseline`.
|
||||
Review: `operation-reviewed`.
|
||||
|
||||
API: `present` — representative operation IDs:
|
||||
### `get-companies-tools-action-requests`
|
||||
|
||||
- `POST /api/tool-connections/{connectionId}/test-calls`.
|
||||
Capability ID: `app-permissions/get-companies-tools-action-requests`.
|
||||
|
||||
Agent access: `restricted` — Board test-as-agent API; agent executes its own assigned
|
||||
tools normally.
|
||||
API: `present` — `GET /api/companies/{companyId}/tools/action-requests`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
Policy: Connection/profile/policy management routes require a board user; tool use
|
||||
separately evaluates agent grants and action policies.
|
||||
### `get-tool-connections-test-agents`
|
||||
|
||||
Evidence: `source-only` — [implementation](../../server/src/routes/tool-access.ts#L517)
|
||||
at the reviewed commit above.
|
||||
Capability ID: `app-permissions/get-tool-connections-test-agents`.
|
||||
|
||||
Verification: `not-run` — assert the documented agent denial with an owned test fixture;
|
||||
verify any listed agent request/result path separately. A delegated operation needs its
|
||||
own policy and access review.
|
||||
API: `present` — `GET /api/tool-connections/{connectionId}/test-agents`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
Gaps: A board test performed as an agent is not proof the agent can manage or invoke the
|
||||
testing endpoint.
|
||||
### `get-tool-connections-test-agents-access`
|
||||
|
||||
Capability ID: `app-permissions/get-tool-connections-test-agents-access`.
|
||||
|
||||
API: `present` — `GET /api/tool-connections/{connectionId}/test-agents/{agentId}/access`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-tool-connections-test-calls`
|
||||
|
||||
Capability ID: `app-permissions/post-tool-connections-test-calls`.
|
||||
|
||||
API: `present` — `POST /api/tool-connections/{connectionId}/test-calls`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:use`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `get-tool-connections-test-calls`
|
||||
|
||||
Capability ID: `app-permissions/get-tool-connections-test-calls`.
|
||||
|
||||
API: `present` — `GET /api/tool-connections/{connectionId}/test-calls/{actionRequestId}`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:use`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-companies-tools-action-requests-trust-rule`
|
||||
|
||||
Capability ID: `app-permissions/post-companies-tools-action-requests-trust-rule`.
|
||||
|
||||
API: `present` — `POST /api/companies/{companyId}/tools/action-requests/{actionRequestId}/trust-rule`; JSON REST.
|
||||
Agent access: `restricted` — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
|
||||
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
|
||||
|
||||
### `post-tool-gateway-action-requests-approve`
|
||||
|
||||
Capability ID: `app-permissions/post-tool-gateway-action-requests-approve`.
|
||||
|
||||
API: `present` — `POST /api/tool-gateway/action-requests/{id}/approve`; JSON REST.
|
||||
Agent access: `restricted` — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
|
||||
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-gateway.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
|
||||
|
||||
### `post-tool-gateway-action-requests-decline`
|
||||
|
||||
Capability ID: `app-permissions/post-tool-gateway-action-requests-decline`.
|
||||
|
||||
API: `present` — `POST /api/tool-gateway/action-requests/{id}/decline`; JSON REST.
|
||||
Agent access: `restricted` — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
|
||||
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-gateway.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
|
||||
## `account-maintenance`
|
||||
|
||||
Capability ID: `app-permissions/account-maintenance`.
|
||||
|
||||
Review: `baseline`.
|
||||
Review: `operation-reviewed`.
|
||||
|
||||
API: `present` — representative operation IDs:
|
||||
### `get-companies-tools-apps-attention`
|
||||
|
||||
- `POST /api/tool-connections/{connectionId}/reconnect`.
|
||||
- `GET /api/tool-connections/{connectionId}/activity`.
|
||||
Capability ID: `app-permissions/get-companies-tools-apps-attention`.
|
||||
|
||||
Agent access: `restricted` — Board account management; native
|
||||
connections_search/connection_request can request human setup.
|
||||
API: `present` — `GET /api/companies/{companyId}/tools/apps/attention`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
Policy: Connection/profile/policy management routes require a board user; tool use
|
||||
separately evaluates agent grants and action policies.
|
||||
### `get-companies-tools-applications`
|
||||
|
||||
Evidence: `source-only` — [implementation](../../server/src/routes/tool-access.ts#L517)
|
||||
at the reviewed commit above.
|
||||
Capability ID: `app-permissions/get-companies-tools-applications`.
|
||||
|
||||
Verification: `not-run` — assert the documented agent denial with an owned test fixture;
|
||||
verify any listed agent request/result path separately. A delegated operation needs its
|
||||
own policy and access review.
|
||||
API: `present` — `GET /api/companies/{companyId}/tools/applications`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
Gaps: Agent requests and continued tool use exist; reconnect/revoke/audit management are
|
||||
human paths.
|
||||
### `post-companies-tools-applications`
|
||||
|
||||
Capability ID: `app-permissions/post-companies-tools-applications`.
|
||||
|
||||
API: `present` — `POST /api/companies/{companyId}/tools/applications`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `patch-tool-applications`
|
||||
|
||||
Capability ID: `app-permissions/patch-tool-applications`.
|
||||
|
||||
API: `present` — `PATCH /api/tool-applications/{applicationId}`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `delete-tool-applications`
|
||||
|
||||
Capability ID: `app-permissions/delete-tool-applications`.
|
||||
|
||||
API: `present` — `DELETE /api/tool-applications/{applicationId}`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `get-companies-tools-connections`
|
||||
|
||||
Capability ID: `app-permissions/get-companies-tools-connections`.
|
||||
|
||||
API: `present` — `GET /api/companies/{companyId}/tools/connections`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `verified` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above. [Authenticated fixtures](../../server/src/__tests__/connection-management.integration.test.ts) passed with database persistence and actual bearer/session middleware.
|
||||
Verification: `passed` — deterministic provider fixtures / local assembled server; no live provider qualification.
|
||||
Gaps: Provider fixtures do not qualify live provider setup or availability.
|
||||
|
||||
### `get-tool-connections`
|
||||
|
||||
Capability ID: `app-permissions/get-tool-connections`.
|
||||
|
||||
API: `present` — `GET /api/tool-connections/{connectionId}`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `verified` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above. [Authenticated fixtures](../../server/src/__tests__/connection-management.integration.test.ts) passed with database persistence and actual bearer/session middleware.
|
||||
Verification: `passed` — deterministic provider fixtures / local assembled server; no live provider qualification.
|
||||
Gaps: Provider fixtures do not qualify live provider setup or availability.
|
||||
|
||||
### `post-tool-connections-railway-ssh`
|
||||
|
||||
Capability ID: `app-permissions/post-tool-connections-railway-ssh`.
|
||||
|
||||
API: `present` — `POST /api/tool-connections/{connectionId}/railway/ssh`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `get-tool-connections-usage`
|
||||
|
||||
Capability ID: `app-permissions/get-tool-connections-usage`.
|
||||
|
||||
API: `present` — `GET /api/tool-connections/{connectionId}/usage`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `get-tool-connections-aggregator-apps`
|
||||
|
||||
Capability ID: `app-permissions/get-tool-connections-aggregator-apps`.
|
||||
|
||||
API: `present` — `GET /api/tool-connections/{connectionId}/aggregator/apps`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-tool-connections-aggregator-apps-sync`
|
||||
|
||||
Capability ID: `app-permissions/post-tool-connections-aggregator-apps-sync`.
|
||||
|
||||
API: `present` — `POST /api/tool-connections/{connectionId}/aggregator/apps/sync`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-tool-connections-aggregator-apps-refresh`
|
||||
|
||||
Capability ID: `app-permissions/post-tool-connections-aggregator-apps-refresh`.
|
||||
|
||||
API: `present` — `POST /api/tool-connections/{connectionId}/aggregator/apps/refresh`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `put-tool-connections-aggregator-discovery`
|
||||
|
||||
Capability ID: `app-permissions/put-tool-connections-aggregator-discovery`.
|
||||
|
||||
API: `present` — `PUT /api/tool-connections/{connectionId}/aggregator/discovery`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `get-tool-connections-composio-apps`
|
||||
|
||||
Capability ID: `app-permissions/get-tool-connections-composio-apps`.
|
||||
|
||||
API: `present` — `GET /api/tool-connections/{connectionId}/composio/apps`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-tool-connections-composio-apps-sync`
|
||||
|
||||
Capability ID: `app-permissions/post-tool-connections-composio-apps-sync`.
|
||||
|
||||
API: `present` — `POST /api/tool-connections/{connectionId}/composio/apps/sync`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-tool-connections-composio-apps-refresh`
|
||||
|
||||
Capability ID: `app-permissions/post-tool-connections-composio-apps-refresh`.
|
||||
|
||||
API: `present` — `POST /api/tool-connections/{connectionId}/composio/apps/refresh`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-tool-connections-composio-apps-accounts`
|
||||
|
||||
Capability ID: `app-permissions/post-tool-connections-composio-apps-accounts`.
|
||||
|
||||
API: `present` — `POST /api/tool-connections/{connectionId}/composio/apps/{toolkit}/accounts`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-tool-connections-composio-apps-setup`
|
||||
|
||||
Capability ID: `app-permissions/post-tool-connections-composio-apps-setup`.
|
||||
|
||||
API: `present` — `POST /api/tool-connections/{connectionId}/composio/apps/{toolkit}/setup`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `patch-tool-connections`
|
||||
|
||||
Capability ID: `app-permissions/patch-tool-connections`.
|
||||
|
||||
API: `present` — `PATCH /api/tool-connections/{connectionId}`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `verified` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above. [Authenticated fixtures](../../server/src/__tests__/connection-management.integration.test.ts) passed with database persistence and actual bearer/session middleware.
|
||||
Verification: `passed` — deterministic provider fixtures / local assembled server; no live provider qualification.
|
||||
Gaps: Provider fixtures do not qualify live provider setup or availability.
|
||||
|
||||
### `delete-tool-connections`
|
||||
|
||||
Capability ID: `app-permissions/delete-tool-connections`.
|
||||
|
||||
API: `present` — `DELETE /api/tool-connections/{connectionId}`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-tool-connections-health-check`
|
||||
|
||||
Capability ID: `app-permissions/post-tool-connections-health-check`.
|
||||
|
||||
API: `present` — `POST /api/tool-connections/{connectionId}/health-check`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `get-tool-connections-activity`
|
||||
|
||||
Capability ID: `app-permissions/get-tool-connections-activity`.
|
||||
|
||||
API: `present` — `GET /api/tool-connections/{connectionId}/activity`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:view_audit`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
File diff suppressed because it is too large.
Load diff
@@ -1,15 +1,17 @@
|
||||
# Connection setup — agent access
|
||||
|
||||
Product map: [Connection setup](../feature-map/connection-setup.md).
|
||||
Product map: [connection-setup](../feature-map/connection-setup.md).
|
||||
|
||||
Feature ID: `connection-setup`.
|
||||
|
||||
Review date: 2026-10-12. Source commit: `f981fa3cc10cb8663a87dec60345fbff46d54d0a`.
|
||||
Review date: 2026-10-26. Source base: `a1f77821b9cd5c9c846fdf7a0fa5cc620ad2b6bb`; implementation: [#17737](https://github.com/paperclipai/paperclip/pull/17737).
|
||||
|
||||
This is a source-reviewed baseline of representative operations and known gaps.
|
||||
Each capability needs operation-level review before its entire scope can be
|
||||
qualified. No live agent execution is claimed. Follow the [map contract](../README.md)
|
||||
for format, permission checks, evidence and maintenance.
|
||||
Connection operations reviewed in this working tree. The inventory was reconciled
|
||||
against production UI clients, REST registrations and service entry points; it is
|
||||
a review checklist, not a runtime registry. [Authorization and evidence contract](../../doc/plans/2026-10-13-connection-api-parity.md).
|
||||
Fixture evidence is separate from live provider qualification and from empirical
|
||||
LLM success. Source-only entries have a reviewed agent path or an explicit boundary,
|
||||
but do not claim an individually executed HTTP test.
|
||||
|
||||
Prompt Injection Prevention reuses shared OpenRouter API-key setup directly from
|
||||
Settings → Connections. It adds no Apps provider or transport. Credential ownership
|
||||
@@ -19,298 +21,442 @@ does not activate the service. See [service configuration](../../doc/prompt-inje
|
||||
1Password adds a service-account catalog method. Agents request access through
|
||||
the existing connection tools and invoke its reviewed item actions through the
|
||||
run-scoped gateway. The service-account token stays in the selected user/company
|
||||
vault; vault boundaries are enforced by 1Password. Setup remains board-owned.
|
||||
vault; vault boundaries are enforced by 1Password. Authorized API setup uses the shared connection-management policy; credential entry remains a human step when needed.
|
||||
Evidence and limits: [1Password connector](../../doc/connections/1PASSWORD.md).
|
||||
|
||||
## `catalog`
|
||||
|
||||
Capability ID: `connection-setup/catalog`.
|
||||
|
||||
Review: `baseline`.
|
||||
Review: `operation-reviewed`.
|
||||
|
||||
API: `present` — representative operation IDs:
|
||||
### `get-companies-tools-gallery`
|
||||
|
||||
- `POST /runtime-tools/connections/search`.
|
||||
Capability ID: `connection-setup/get-companies-tools-gallery`.
|
||||
|
||||
Agent access: `available` — Native connections_search / run-bound runtime-tools MCP.
|
||||
API: `present` — `GET /api/companies/{companyId}/tools/gallery`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
Policy: Setup and credentials belong to the addressed authorized human; active-run tools
|
||||
can search/request access.
|
||||
### `get-companies-tools-apps-preflight`
|
||||
|
||||
Evidence: `source-only` —
|
||||
[implementation](../../server/src/routes/connection-intents.ts#L130) at the reviewed
|
||||
commit above.
|
||||
Capability ID: `connection-setup/get-companies-tools-apps-preflight`.
|
||||
|
||||
Verification: `not-run` — exercise a listed permitted operation with actual agent
|
||||
credentials/run context; inspect its result and applicable persistence/attribution.
|
||||
Assert the relevant denied actor, owner, company or mode from Policy. Review the
|
||||
remaining operations before qualifying the whole capability.
|
||||
API: `present` — `GET /api/companies/{companyId}/tools/apps/{galleryKey}/preflight`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
Gaps: Runtime tool broker searches available services without granting connection
|
||||
administration.
|
||||
### `get-companies-tools-examples`
|
||||
|
||||
Notebook is internally gated by `enablePaperclipNotebook` (default off, no settings toggle). Disabled instances hide setup/discovery and deny curated Notebook dispatch and publishing; local removal and grant revocation remain available.
|
||||
Capability ID: `connection-setup/get-companies-tools-examples`.
|
||||
|
||||
The connector catalog declares the feature key. Shared availability checks use
|
||||
the saved application identity. Notebook owns publication and file uploads;
|
||||
Paperclip uses its existing MCP tools and OAuth flow.
|
||||
API: `present` — `GET /api/companies/{companyId}/tools/examples`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
Notebook source addition: `paperclip-notebook` is discoverable through
|
||||
`connections_search` and requestable through `connection_request`. Its standard
|
||||
personal authorization requests read, write, share, and delete scopes. Notebook
|
||||
page ownership remains enforced by the remote service; a client-supplied agent
|
||||
label grants no authority. The direct MCP connection requires no Cloud instance
|
||||
enrollment. Notebook fixture evidence: `verified` against disposable PostgreSQL 18
|
||||
with controlled MCP responses — [Notebook integration](../../doc/connections/PAPERCLIP-NOTEBOOK.md)
|
||||
and [generic OAuth fixture](../../server/src/__tests__/generic-mcp-connection.test.ts).
|
||||
Ordinary MCP calls retain assignment and Allowed / Ask first / Off policy.
|
||||
Live deployed publication and hosted/self-hosted OAuth remain release checks.
|
||||
### `post-companies-tools-examples-install`
|
||||
|
||||
Capability ID: `connection-setup/post-companies-tools-examples-install`.
|
||||
|
||||
API: `present` — `POST /api/companies/{companyId}/tools/examples/{id}/install`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-companies-tools-examples-smoke`
|
||||
|
||||
Capability ID: `connection-setup/post-companies-tools-examples-smoke`.
|
||||
|
||||
API: `present` — `POST /api/companies/{companyId}/tools/examples/{id}/smoke`; JSON REST.
|
||||
Agent access: `operator-only` — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
|
||||
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
|
||||
|
||||
### `get-companies-tools-stdio-templates`
|
||||
|
||||
Capability ID: `connection-setup/get-companies-tools-stdio-templates`.
|
||||
|
||||
API: `present` — `GET /api/companies/{companyId}/tools/stdio-templates`; JSON REST.
|
||||
Agent access: `operator-only` — a board user reads host command templates. Agents select approved provider templates through the catalog.
|
||||
Policy: board actor and `tools:admin`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
|
||||
|
||||
### `post-companies-tools-stdio-templates`
|
||||
|
||||
Capability ID: `connection-setup/post-companies-tools-stdio-templates`.
|
||||
|
||||
API: `present` — `POST /api/companies/{companyId}/tools/stdio-templates`; JSON REST.
|
||||
Agent access: `operator-only` — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
|
||||
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
|
||||
|
||||
### `post-companies-tools-stdio-templates-disable`
|
||||
|
||||
Capability ID: `connection-setup/post-companies-tools-stdio-templates-disable`.
|
||||
|
||||
API: `present` — `POST /api/companies/{companyId}/tools/stdio-templates/{templateId}/disable`; JSON REST.
|
||||
Agent access: `operator-only` — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
|
||||
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
|
||||
|
||||
### `post-companies-tools-mcp-import-json`
|
||||
|
||||
Capability ID: `connection-setup/post-companies-tools-mcp-import-json`.
|
||||
|
||||
API: `present` — `POST /api/companies/{companyId}/tools/mcp/import-json`; JSON REST.
|
||||
Agent access: `operator-only` — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
|
||||
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
|
||||
|
||||
### `post-runtime-tools-connections-search`
|
||||
|
||||
Capability ID: `connection-setup/post-runtime-tools-connections-search`.
|
||||
|
||||
API: `present` — `POST /runtime-tools/connections/search`; JSON REST.
|
||||
Agent access: `available` — existing REST/native runtime tool or scoped gateway client, as documented by the linked route.
|
||||
Policy: Existing run-bound tool, scoped credential lease, execution policy, or assigned-email-agent checks; connection-management grants do not bypass these controls.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/connection-intents.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
## `identity-and-access`
|
||||
|
||||
Capability ID: `connection-setup/identity-and-access`.
|
||||
|
||||
Review: `baseline`.
|
||||
Review: `operation-reviewed`.
|
||||
|
||||
API: `present` — representative operation IDs:
|
||||
### `post-companies-tools-apps-connect`
|
||||
|
||||
- `POST /api/companies/{companyId}/tools/connections`.
|
||||
Capability ID: `connection-setup/post-companies-tools-apps-connect`.
|
||||
|
||||
Agent access: `restricted` — Board setup API plus agent connection_request.
|
||||
API: `present` — `POST /api/companies/{companyId}/tools/apps/connect`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
Policy: Setup and credentials belong to the addressed authorized human; active-run tools
|
||||
can search/request access.
|
||||
### `post-companies-tools-connections`
|
||||
|
||||
Evidence: `source-only` —
|
||||
[implementation](../../server/src/routes/connection-intents.ts#L130) at the reviewed
|
||||
commit above.
|
||||
|
||||
Verification: `not-run` — assert the documented agent denial with an owned test fixture;
|
||||
verify any listed agent request/result path separately. A delegated operation needs its
|
||||
own policy and access review.
|
||||
|
||||
Gaps: Selecting account ownership/eligible agents is management; an agent can request
|
||||
the intended connection.
|
||||
Capability ID: `connection-setup/post-companies-tools-connections`.
|
||||
|
||||
API: `present` — `POST /api/companies/{companyId}/tools/connections`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `verified` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above. [Authenticated fixtures](../../server/src/__tests__/connection-management.integration.test.ts) passed with database persistence and actual bearer/session middleware.
|
||||
Verification: `passed` — deterministic provider fixtures / local assembled server; no live provider qualification.
|
||||
Gaps: Provider fixtures do not qualify live provider setup or availability.
|
||||
## `credentials`
|
||||
|
||||
Capability ID: `connection-setup/credentials`.
|
||||
|
||||
Review: `baseline`.
|
||||
Review: `operation-reviewed`.
|
||||
|
||||
API: `present` — representative operation IDs:
|
||||
### `post-agents-me-connections-start-authorization`
|
||||
|
||||
- `POST /api/agents/me/connections/{connectionId}/start-authorization`.
|
||||
Capability ID: `connection-setup/post-agents-me-connections-start-authorization`.
|
||||
|
||||
Agent access: `partial` — Scoped start-authorization/request flow; human provider login.
|
||||
API: `present` — `POST /api/agents/me/connections/{connectionId}/start-authorization`; JSON REST.
|
||||
Agent access: `available` — existing REST/native runtime tool or scoped gateway client, as documented by the linked route.
|
||||
Policy: `tools:manage_connections`, an active run, and the server-derived responsible user matching the authorization subject; shared scope/trust/user checks apply. Human authentication remains a handoff, with the actual agent retained for audit. JSON authorization initiation is explicitly REST-callable.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
Policy: Setup and credentials belong to the addressed authorized human; active-run tools
|
||||
can search/request access.
|
||||
### `post-agents-me-connections-token`
|
||||
|
||||
Evidence: `source-only` —
|
||||
[implementation](../../server/src/routes/connection-intents.ts#L130) at the reviewed
|
||||
commit above.
|
||||
Capability ID: `connection-setup/post-agents-me-connections-token`.
|
||||
|
||||
Verification: `not-run` — exercise a listed permitted operation with actual agent
|
||||
credentials/run context; inspect its result and applicable persistence/attribution.
|
||||
Assert the relevant denied actor, owner, company or mode from Policy. Review the
|
||||
remaining operations before qualifying the whole capability.
|
||||
API: `present` — `POST /api/agents/me/connections/{connectionId}/token`; JSON REST.
|
||||
Agent access: `available` — existing REST/native runtime tool or scoped gateway client, as documented by the linked route.
|
||||
Policy: Existing run-bound tool, scoped credential lease, execution policy, or assigned-email-agent checks; connection-management grants do not bypass these controls.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
Gaps: An initiation endpoint exists; it is not authorization to complete the person's
|
||||
credential flow.
|
||||
### `post-companies-tools-connections-start-authorization`
|
||||
|
||||
Braintrust uses the existing setup/request path for US and EU OAuth and API-key
|
||||
methods. OAuth requests only `mcp`; provider authorization follows the selected
|
||||
account's permissions. Personal invocation credentials must belong to their
|
||||
user, while shared identities use company credentials. Region and explicit
|
||||
method survive resume and reconnect. Agents use assigned tools through the
|
||||
run-scoped gateway and receive no Braintrust token. See
|
||||
[Braintrust](../../doc/connections/BRAINTRUST.md) for method keys and the
|
||||
qualification matrix. Separate live US OAuth proof passed browser authorization,
|
||||
49-tool discovery, bounded read, synthetic dataset insert/readback through actual
|
||||
process-agent runs and gateway sessions, catalog refresh, OAuth reconnect, local
|
||||
removal, post-removal denial, and structural API/log redaction. US API-key and
|
||||
both EU methods remain `not-run` against real accounts. Live token expiry/refresh,
|
||||
remote OAuth revocation, and native CLI automatic capability delivery remain
|
||||
unqualified. Public metadata probes performed no registration or account
|
||||
authorization; fixtures do not establish live proof for the remaining methods.
|
||||
Capability ID: `connection-setup/post-companies-tools-connections-start-authorization`.
|
||||
|
||||
Daytona native setup uses an organization API key in the selected personal or
|
||||
company vault grant. It does not borrow sandbox-provider credentials or CLI
|
||||
login tokens. Agents use assigned provider tools through the normal run-bound
|
||||
gateway; they cannot export the key. [Database-backed fixtures](../../server/src/__tests__/daytona-connection.test.ts)
|
||||
cover selected vault ownership and gateway reads/writes with provider responses
|
||||
replaced by fixtures. Real provider authentication remains unqualified.
|
||||
API: `present` — `POST /api/companies/{companyId}/tools/connections/{connectionId}/start-authorization`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
Unikraft native setup uses an organization API token in the selected personal or
|
||||
company vault grant. It does not borrow `unikraft login` state or `UKC_TOKEN`.
|
||||
Agents use assigned provider tools through the run-bound gateway, limited to the
|
||||
published metro hosts, and cannot export the token. [Database-backed fixtures](../../server/src/__tests__/unikraft-connection.test.ts)
|
||||
cover vault ownership and gateway reads, writes and sandbox commands with
|
||||
fixture provider responses. Real provider authentication remains unqualified.
|
||||
### `post-tools-oauth-start`
|
||||
|
||||
Capability ID: `connection-setup/post-tools-oauth-start`.
|
||||
|
||||
API: `present` — `POST /api/tools/oauth/{connectionId}/start`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user. Returns the saved setup without issuing agent-bound OAuth state; the human browser initiates provider consent.
|
||||
Evidence: `verified` — [authenticated integration fixtures](../../server/src/__tests__/connection-management.integration.test.ts) passed through production authentication and database persistence.
|
||||
Verification: `passed` — deterministic local fixture; no live provider qualification.
|
||||
Gaps: Provider fixtures do not qualify live provider setup or availability.
|
||||
|
||||
### `post-runtime-tools-github-credentials`
|
||||
|
||||
Capability ID: `connection-setup/post-runtime-tools-github-credentials`.
|
||||
|
||||
API: `present` — `POST /runtime-tools/github/credentials`; JSON REST.
|
||||
Agent access: `available` — existing REST/native runtime tool or scoped gateway client, as documented by the linked route.
|
||||
Policy: Existing run-bound tool, scoped credential lease, execution policy, or assigned-email-agent checks; connection-management grants do not bypass these controls.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/connection-intents.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
## `handoff`
|
||||
|
||||
Capability ID: `connection-setup/handoff`.
|
||||
|
||||
Review: `baseline`.
|
||||
Review: `operation-reviewed`.
|
||||
|
||||
API: `present` — representative operation IDs:
|
||||
### `get-tools-oauth-cloud-connector-enrollment`
|
||||
|
||||
- `POST /api/connection-intents/{interactionId}/complete`.
|
||||
Capability ID: `connection-setup/get-tools-oauth-cloud-connector-enrollment`.
|
||||
|
||||
Agent access: `restricted` — Addressed-user completion; server wakes the agent with
|
||||
updated access.
|
||||
API: `present` — `GET /api/tools/oauth/cloud-connector/enrollment`; JSON REST.
|
||||
Agent access: `operator-only` — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
|
||||
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
|
||||
|
||||
Policy: Setup and credentials belong to the addressed authorized human; active-run tools
|
||||
can search/request access.
|
||||
### `post-tools-oauth-cloud-connector-enrollment`
|
||||
|
||||
Evidence: `source-only` —
|
||||
[implementation](../../server/src/routes/connection-intents.ts#L130) at the reviewed
|
||||
commit above.
|
||||
Capability ID: `connection-setup/post-tools-oauth-cloud-connector-enrollment`.
|
||||
|
||||
Verification: `not-run` — assert the documented agent denial with an owned test fixture;
|
||||
verify any listed agent request/result path separately. A delegated operation needs its
|
||||
own policy and access review.
|
||||
API: `present` — `POST /api/tools/oauth/cloud-connector/enrollment`; JSON REST.
|
||||
Agent access: `operator-only` — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
|
||||
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
|
||||
|
||||
Gaps: OAuth/callback and addressed-user checks are deliberate separate boundaries.
|
||||
### `get-tools-oauth-cloud-connector-enrollment-callback`
|
||||
|
||||
Capability ID: `connection-setup/get-tools-oauth-cloud-connector-enrollment-callback`.
|
||||
|
||||
API: `present` — `GET /api/tools/oauth/cloud-connector/enrollment-callback`; JSON REST.
|
||||
Agent access: `operator-only` — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
|
||||
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
|
||||
|
||||
### `get-tools-oauth-cloud-connector-callback`
|
||||
|
||||
Capability ID: `connection-setup/get-tools-oauth-cloud-connector-callback`.
|
||||
|
||||
API: `present` — `GET /api/tools/oauth/cloud-connector/callback`; browser/provider/MCP protocol.
|
||||
Agent access: `restricted` — browser authentication return.
|
||||
Policy: Provider state/signature or gateway-token verification, company and resource binding; browser returns require the configuring human. Agent-issued durable gateway tokens retain both issuer and responsible-user authority.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
|
||||
|
||||
### `get-tools-oauth-paperclip-id-callback`
|
||||
|
||||
Capability ID: `connection-setup/get-tools-oauth-paperclip-id-callback`.
|
||||
|
||||
API: `present` — `GET /api/tools/oauth/paperclip-id/callback`; browser/provider/MCP protocol.
|
||||
Agent access: `restricted` — browser authentication return.
|
||||
Policy: Provider state/signature or gateway-token verification, company and resource binding; browser returns require the configuring human. Agent-issued durable gateway tokens retain both issuer and responsible-user authority.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
|
||||
|
||||
### `get-tools-vercel-connect-callback`
|
||||
|
||||
Capability ID: `connection-setup/get-tools-vercel-connect-callback`.
|
||||
|
||||
API: `present` — `GET /api/tools/vercel-connect/callback`; browser/provider/MCP protocol.
|
||||
Agent access: `restricted` — browser authentication return.
|
||||
Policy: Provider state/signature or gateway-token verification, company and resource binding; browser returns require the configuring human. Agent-issued durable gateway tokens retain both issuer and responsible-user authority.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
|
||||
|
||||
### `get-tools-oauth-callback`
|
||||
|
||||
Capability ID: `connection-setup/get-tools-oauth-callback`.
|
||||
|
||||
API: `present` — `GET /api/tools/oauth/callback`; browser/provider/MCP protocol.
|
||||
Agent access: `restricted` — browser authentication return.
|
||||
Policy: Provider state/signature or gateway-token verification, company and resource binding; browser returns require the configuring human. Agent-issued durable gateway tokens retain both issuer and responsible-user authority.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
|
||||
|
||||
### `get-mcp-runtime-tools`
|
||||
|
||||
Capability ID: `connection-setup/get-mcp-runtime-tools`.
|
||||
|
||||
API: `present` — `GET /mcp/runtime-tools`; browser/provider/MCP protocol.
|
||||
Agent access: `available` — existing authenticated MCP/provider protocol; not callable as JSON REST.
|
||||
Policy: Provider state/signature or gateway-token verification, company and resource binding; browser returns require the configuring human. Agent-issued durable gateway tokens retain both issuer and responsible-user authority.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/connection-intents.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-mcp-runtime-tools`
|
||||
|
||||
Capability ID: `connection-setup/post-mcp-runtime-tools`.
|
||||
|
||||
API: `present` — `POST /mcp/runtime-tools`; browser/provider/MCP protocol.
|
||||
Agent access: `available` — existing authenticated MCP/provider protocol; not callable as JSON REST.
|
||||
Policy: Provider state/signature or gateway-token verification, company and resource binding; browser returns require the configuring human. Agent-issued durable gateway tokens retain both issuer and responsible-user authority.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/connection-intents.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `get-connection-intents-setup-options`
|
||||
|
||||
Capability ID: `connection-setup/get-connection-intents-setup-options`.
|
||||
|
||||
API: `present` — `GET /api/connection-intents/{interactionId}/setup-options`; JSON REST.
|
||||
Agent access: `restricted` — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
|
||||
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/connection-intents.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
|
||||
|
||||
### `post-connection-intents-phase`
|
||||
|
||||
Capability ID: `connection-setup/post-connection-intents-phase`.
|
||||
|
||||
API: `present` — `POST /api/connection-intents/{interactionId}/phase`; JSON REST.
|
||||
Agent access: `restricted` — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
|
||||
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/connection-intents.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
|
||||
|
||||
### `post-connection-intents-complete`
|
||||
|
||||
Capability ID: `connection-setup/post-connection-intents-complete`.
|
||||
|
||||
API: `present` — `POST /api/connection-intents/{interactionId}/complete`; JSON REST.
|
||||
Agent access: `restricted` — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
|
||||
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/connection-intents.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
|
||||
## `draft-recovery`
|
||||
|
||||
Capability ID: `connection-setup/draft-recovery`.
|
||||
|
||||
Review: `baseline`.
|
||||
Review: `operation-reviewed`.
|
||||
|
||||
API: `present` — representative operation IDs:
|
||||
### `post-companies-tools-apps-finalize-oauth-access`
|
||||
|
||||
- `POST /api/connection-intents/{interactionId}/phase`.
|
||||
- `POST /api/tool-connections/{connectionId}/reconnect`.
|
||||
Capability ID: `connection-setup/post-companies-tools-apps-finalize-oauth-access`.
|
||||
|
||||
Agent access: `restricted` — Human setup/resume APIs; agent request state and
|
||||
continuation.
|
||||
API: `present` — `POST /api/companies/{companyId}/tools/apps/{connectionId}/finalize-oauth-access`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
Policy: Setup and credentials belong to the addressed authorized human; active-run tools
|
||||
can search/request access.
|
||||
### `post-companies-tools-apps-finish`
|
||||
|
||||
Evidence: `source-only` —
|
||||
[implementation](../../server/src/routes/connection-intents.ts#L130) at the reviewed
|
||||
commit above.
|
||||
Capability ID: `connection-setup/post-companies-tools-apps-finish`.
|
||||
|
||||
Verification: `not-run` — assert the documented agent denial with an owned test fixture;
|
||||
verify any listed agent request/result path separately. A delegated operation needs its
|
||||
own policy and access review.
|
||||
API: `present` — `POST /api/companies/{companyId}/tools/apps/{connectionId}/finish`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
Gaps: Board setup recovery exists. Browser-only navigation state is not automatically an
|
||||
agent API gap.
|
||||
### `post-tool-connections-reconnect`
|
||||
|
||||
Capability ID: `connection-setup/post-tool-connections-reconnect`.
|
||||
|
||||
API: `present` — `POST /api/tool-connections/{connectionId}/reconnect`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
## `task-request`
|
||||
|
||||
Capability ID: `connection-setup/task-request`.
|
||||
|
||||
Review: `baseline`.
|
||||
Review: `operation-reviewed`.
|
||||
|
||||
API: `present` — representative operation IDs:
|
||||
### `post-runtime-tools-connections-request`
|
||||
|
||||
- `POST /runtime-tools/connections/request`.
|
||||
Capability ID: `connection-setup/post-runtime-tools-connections-request`.
|
||||
|
||||
Agent access: `available` — Native connection_request / run-bound runtime-tools MCP.
|
||||
API: `present` — `POST /runtime-tools/connections/request`; JSON REST.
|
||||
Agent access: `available` — existing REST/native runtime tool or scoped gateway client, as documented by the linked route.
|
||||
Policy: Existing run-bound tool, scoped credential lease, execution policy, or assigned-email-agent checks; connection-management grants do not bypass these controls.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/connection-intents.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
Policy: Setup and credentials belong to the addressed authorized human; active-run tools
|
||||
can search/request access.
|
||||
### `post-connection-intents-decline`
|
||||
|
||||
Evidence: `source-only` —
|
||||
[implementation](../../server/src/routes/connection-intents.ts#L130) at the reviewed
|
||||
commit above.
|
||||
|
||||
Verification: `not-run` — exercise a listed permitted operation with actual agent
|
||||
credentials/run context; inspect its result and applicable persistence/attribution.
|
||||
Assert the relevant denied actor, owner, company or mode from Policy. Review the
|
||||
remaining operations before qualifying the whole capability.
|
||||
|
||||
Gaps: This is the existing agent bridge for human-required setup; do not invent a second
|
||||
approval system.
|
||||
Capability ID: `connection-setup/post-connection-intents-decline`.
|
||||
|
||||
API: `present` — `POST /api/connection-intents/{interactionId}/decline`; JSON REST.
|
||||
Agent access: `restricted` — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
|
||||
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/connection-intents.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
|
||||
## `channel-setup`
|
||||
|
||||
Capability ID: `connection-setup/channel-setup`.
|
||||
|
||||
Review: `baseline`.
|
||||
Review: `operation-reviewed`.
|
||||
|
||||
API: `present` — representative operation IDs:
|
||||
### `post-companies-chat-endpoints`
|
||||
|
||||
- `POST /api/companies/{companyId}/chat-endpoints`.
|
||||
|
||||
Agent access: `restricted` — Board channel management; agent requests required setup.
|
||||
|
||||
Policy: Setup and credentials belong to the addressed authorized human; active-run tools
|
||||
can search/request access.
|
||||
|
||||
Evidence: `source-only` —
|
||||
[implementation](../../server/src/routes/connection-intents.ts#L130) at the reviewed
|
||||
commit above.
|
||||
|
||||
Verification: `not-run` — assert the documented agent denial with an owned test fixture;
|
||||
verify any listed agent request/result path separately. A delegated operation needs its
|
||||
own policy and access review.
|
||||
|
||||
Gaps: Provider endpoint, represented agent and linked sender are operator choices today.
|
||||
|
||||
Internal recovery: Telegram discovery walks bounded pages at startup. Configuration
|
||||
commits only queue the changed connection; durable maintenance rows supply retry deadlines. Inactive subscription
|
||||
repair is parked until an endpoint or connection change. This creates no agent
|
||||
management permission or new API. Local database-backed provider-fixture tests in
|
||||
[channel integration](../../server/src/__tests__/chat-channels.integration.test.ts)
|
||||
cover recovery, rollback, retries and idle query silence; they do not establish
|
||||
live provider or agent access.
|
||||
Capability ID: `connection-setup/post-companies-chat-endpoints`.
|
||||
|
||||
API: `present` — `POST /api/companies/{companyId}/chat-endpoints`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `verified` — [route](../../server/src/routes/chat-channels.ts); reviewed in the working tree based on the source commit above. [Authenticated fixtures](../../server/src/__tests__/connection-management.integration.test.ts) passed with database persistence and actual bearer/session middleware.
|
||||
Verification: `passed` — deterministic provider fixtures / local assembled server; no live provider qualification.
|
||||
Gaps: Provider fixtures do not qualify live provider setup or availability.
|
||||
## `failure`
|
||||
|
||||
Capability ID: `connection-setup/failure`.
|
||||
|
||||
Review: `baseline`.
|
||||
Review: `operation-reviewed`.
|
||||
|
||||
API: `present` — representative operation IDs:
|
||||
### `post-tool-connections-health-check`
|
||||
|
||||
- `POST /api/tool-connections/{connectionId}/health-check`.
|
||||
Capability ID: `connection-setup/post-tool-connections-health-check`.
|
||||
|
||||
Agent access: `partial` — Agent observes connection tool errors; board repair APIs.
|
||||
|
||||
Policy: Setup and credentials belong to the addressed authorized human; active-run tools
|
||||
can search/request access.
|
||||
|
||||
Evidence: `source-only` —
|
||||
[implementation](../../server/src/routes/connection-intents.ts#L130) at the reviewed
|
||||
commit above.
|
||||
|
||||
Verification: `not-run` — exercise a listed permitted operation with actual agent
|
||||
credentials/run context; inspect its result and applicable persistence/attribution.
|
||||
Assert the relevant denied actor, owner, company or mode from Policy. Review the
|
||||
remaining operations before qualifying the whole capability.
|
||||
|
||||
Gaps: Error reporting and human repair exist; no generic agent permission to reconnect
|
||||
accounts.
|
||||
|
||||
Supabase and Vercel deployment methods (2026-10-22) reuse human-authorized setup
|
||||
and assigned run-scoped tools. Native Supabase calls use the saved project;
|
||||
native Vercel calls use the saved team and validate project ownership. Tokens
|
||||
remain in the selected personal/company vault grant and cannot be exported by
|
||||
`mintConnectionTokenForAgent`. Action policies, changed-schema quarantine,
|
||||
responsible-user access and immediate removal apply to deployment/configuration
|
||||
calls. Database/provider-fixture evidence lives in
|
||||
[deployment connector governance](../../server/src/__tests__/deployment-connections.test.ts).
|
||||
It does not establish authenticated provider deployment, OAuth consent or remote
|
||||
revocation. See [Supabase](../../doc/connections/SUPABASE.md) and
|
||||
[Vercel](../../doc/connections/vercel.md) for the remaining live-proof matrix.
|
||||
|
||||
Native delivery (2026-10-23): reviewed REST connections are admitted in connection
|
||||
readiness, native runtime snapshots, and runtime gateway preparation. The real
|
||||
Codex walkthrough initially failed at all three despite a successful board test;
|
||||
the database-backed lifecycle regression now covers ready search/request,
|
||||
existing-card completion, assigned-tool search/call, and inactive/unrecognized
|
||||
connection denial for both providers. After repair, a real Codex agent deployed
|
||||
and configured both services. Supabase's Dashboard invocation returned the marker,
|
||||
and Vercel's signed-in browser served the preview. The Vercel first-deployment
|
||||
production exception remains recorded as a separate failed outcome; default
|
||||
preview now requires an existing deployment and reports target mismatches for
|
||||
reconciliation. See the provider documents for the external-deletion race limit.
|
||||
API: `present` — `POST /api/tool-connections/{connectionId}/health-check`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
@@ -1,217 +1,403 @@
|
||||
# Tool gateways and access profiles — agent access
|
||||
|
||||
Product map: [Tool gateways and access profiles](../feature-map/gateways-profiles.md).
|
||||
Product map: [gateways-profiles](../feature-map/gateways-profiles.md).
|
||||
|
||||
Feature ID: `gateways-profiles`.
|
||||
|
||||
Review date: 2026-10-12. Source commit: `58e16dbddfc9c8d0cf60867f9d9847f0feda055b`.
|
||||
Native REST transport reconciled in this change; see the
|
||||
[shared transport contract](README.md#native-rest-transport).
|
||||
Review date: 2026-10-26. Source base: `a1f77821b9cd5c9c846fdf7a0fa5cc620ad2b6bb`; implementation: [#17737](https://github.com/paperclipai/paperclip/pull/17737).
|
||||
|
||||
This is a source-reviewed baseline of representative operations and known gaps.
|
||||
Each capability needs operation-level review before its entire scope can be
|
||||
qualified. No live agent execution is claimed. Follow the [map contract](../README.md)
|
||||
for format, permission checks, evidence and maintenance.
|
||||
Connection operations reviewed in this working tree. The inventory was reconciled
|
||||
against production UI clients, REST registrations and service entry points; it is
|
||||
a review checklist, not a runtime registry. [Authorization and evidence contract](../../doc/plans/2026-10-13-connection-api-parity.md).
|
||||
Fixture evidence is separate from live provider qualification and from empirical
|
||||
LLM success. Source-only entries have a reviewed agent path or an explicit boundary,
|
||||
but do not claim an individually executed HTTP test.
|
||||
|
||||
## `gateway`
|
||||
|
||||
Capability ID: `gateways-profiles/gateway`.
|
||||
|
||||
Review: `baseline`.
|
||||
Review: `operation-reviewed`.
|
||||
|
||||
API: `present` — representative operation IDs:
|
||||
### `get-companies-tools-gateways`
|
||||
|
||||
- `POST /api/companies/{companyId}/tools/gateways`.
|
||||
Capability ID: `gateways-profiles/get-companies-tools-gateways`.
|
||||
|
||||
Agent access: `restricted` — Board tools:admin REST; CLI connections/configuration where
|
||||
supported.
|
||||
API: `present` — `GET /api/companies/{companyId}/tools/gateways`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections (responsible user: tools:admin)`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `verified` — [route](../../server/src/routes/tool-gateway.ts); [authenticated fixtures](../../server/src/__tests__/connection-management.integration.test.ts) inspect the saved gateway after a denied binding change.
|
||||
Verification: `passed` — local assembled server and real database; gateway visibility and unchanged target assignment after profile-grant revocation. No live provider qualification.
|
||||
Gaps: Provider fixtures do not qualify live provider setup or availability.
|
||||
|
||||
Policy: Named gateway/profile administration and credentials are board tools:admin;
|
||||
agent sessions/tool use use separate scoped authority.
|
||||
### `post-companies-tools-gateways`
|
||||
|
||||
Evidence: `source-only` — [implementation](../../server/src/routes/tool-gateway.ts#L353)
|
||||
at the reviewed commit above.
|
||||
Capability ID: `gateways-profiles/post-companies-tools-gateways`.
|
||||
|
||||
Verification: `not-run` — assert the documented agent denial with an owned test fixture;
|
||||
verify any listed agent request/result path separately. A delegated operation needs its
|
||||
own policy and access review.
|
||||
API: `present` — `POST /api/companies/{companyId}/tools/gateways`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections (responsible user: tools:admin)`; bindings also require `tools:manage_profiles`. [Shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `verified` — [route](../../server/src/routes/tool-gateway.ts); reviewed in the working tree based on the source commit above. [Authenticated fixtures](../../server/src/__tests__/connection-management.integration.test.ts) passed with database persistence and actual bearer/session middleware.
|
||||
Verification: `passed` — deterministic provider fixtures / local assembled server; no live provider qualification.
|
||||
Gaps: Provider fixtures do not qualify live provider setup or availability.
|
||||
|
||||
Gaps: No agent named-gateway management path; assigned tool use exists separately.
|
||||
### `patch-tool-gateway-gateways`
|
||||
|
||||
Capability ID: `gateways-profiles/patch-tool-gateway-gateways`.
|
||||
|
||||
API: `present` — `PATCH /api/tool-gateway/gateways/{gatewayId}`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections (responsible user: tools:admin)`; setting or clearing bindings also requires `tools:manage_profiles`. [Shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `verified` — [route](../../server/src/routes/tool-gateway.ts); [authenticated fixtures](../../server/src/__tests__/connection-management.integration.test.ts) exercise persisted binding changes and revoked/scoped authority.
|
||||
Verification: `passed` — local assembled server and real database. Clearing a binding requires retained profile authority; replacement profile/project changes require access to both saved and replacement resources. Authorized changes persist. No live provider qualification.
|
||||
Gaps: Provider fixtures do not qualify live provider setup or availability.
|
||||
## `profiles`
|
||||
|
||||
Capability ID: `gateways-profiles/profiles`.
|
||||
|
||||
Review: `baseline`.
|
||||
Review: `operation-reviewed`.
|
||||
|
||||
API: `present` — representative operation IDs:
|
||||
### `get-companies-tools-profiles`
|
||||
|
||||
- `POST /api/companies/{companyId}/tools/profiles`.
|
||||
- `PATCH /api/tool-profiles/{profileId}`.
|
||||
Capability ID: `gateways-profiles/get-companies-tools-profiles`.
|
||||
|
||||
Agent access: `restricted` — Board management REST; agent receives effective tool
|
||||
assignment.
|
||||
API: `present` — `GET /api/companies/{companyId}/tools/profiles`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_profiles`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
Policy: Named gateway/profile administration and credentials are board tools:admin;
|
||||
agent sessions/tool use use separate scoped authority.
|
||||
### `post-companies-tools-profiles`
|
||||
|
||||
Evidence: `source-only` — [implementation](../../server/src/routes/tool-gateway.ts#L353)
|
||||
at the reviewed commit above.
|
||||
Capability ID: `gateways-profiles/post-companies-tools-profiles`.
|
||||
|
||||
Verification: `not-run` — assert the documented agent denial with an owned test fixture;
|
||||
verify any listed agent request/result path separately. A delegated operation needs its
|
||||
own policy and access review.
|
||||
API: `present` — `POST /api/companies/{companyId}/tools/profiles`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_profiles`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `verified` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above. [Authenticated fixtures](../../server/src/__tests__/connection-management.integration.test.ts) passed with database persistence and actual bearer/session middleware.
|
||||
Verification: `passed` — deterministic provider fixtures / local assembled server; no live provider qualification.
|
||||
Gaps: Provider fixtures do not qualify live provider setup or availability.
|
||||
|
||||
Gaps: Agent access to tools does not permit profile editing.
|
||||
### `get-companies-tools-profiles-effective-agents`
|
||||
|
||||
Backend evidence: [profile entry validation](../../server/src/__tests__/tool-profile-entry-validation.test.ts)
|
||||
covers company-scoped selector references and bounded reads for a large immutable
|
||||
runtime assignment. Batched validation retains the checks before profile and
|
||||
entry writes. It grants no profile-management authority to agents.
|
||||
Capability ID: `gateways-profiles/get-companies-tools-profiles-effective-agents`.
|
||||
|
||||
API: `present` — `GET /api/companies/{companyId}/tools/profiles/effective/agents/{agentId}`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_profiles`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `patch-tool-profiles`
|
||||
|
||||
Capability ID: `gateways-profiles/patch-tool-profiles`.
|
||||
|
||||
API: `present` — `PATCH /api/tool-profiles/{profileId}`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_profiles`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-tool-profiles-duplicate`
|
||||
|
||||
Capability ID: `gateways-profiles/post-tool-profiles-duplicate`.
|
||||
|
||||
API: `present` — `POST /api/tool-profiles/{profileId}/duplicate`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_profiles`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `delete-tool-profiles`
|
||||
|
||||
Capability ID: `gateways-profiles/delete-tool-profiles`.
|
||||
|
||||
API: `present` — `DELETE /api/tool-profiles/{profileId}`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_profiles`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-tool-profiles-entries`
|
||||
|
||||
Capability ID: `gateways-profiles/post-tool-profiles-entries`.
|
||||
|
||||
API: `present` — `POST /api/tool-profiles/{profileId}/entries`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_profiles`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `patch-tool-profile-entries`
|
||||
|
||||
Capability ID: `gateways-profiles/patch-tool-profile-entries`.
|
||||
|
||||
API: `present` — `PATCH /api/tool-profile-entries/{entryId}`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_profiles`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `delete-tool-profile-entries`
|
||||
|
||||
Capability ID: `gateways-profiles/delete-tool-profile-entries`.
|
||||
|
||||
API: `present` — `DELETE /api/tool-profile-entries/{entryId}`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_profiles`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-companies-tools-profiles-bind`
|
||||
|
||||
Capability ID: `gateways-profiles/post-companies-tools-profiles-bind`.
|
||||
|
||||
API: `present` — `POST /api/companies/{companyId}/tools/profiles/{profileId}/bind`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_profiles`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `verified` — [route](../../server/src/routes/tool-access.ts); [authenticated fixtures](../../server/src/__tests__/connection-management.integration.test.ts) bind a saved profile to a company project before configuring its gateway.
|
||||
Verification: `passed` — local assembled server, production agent authentication and database persistence; the saved project binding participates in subsequent gateway authorization.
|
||||
Gaps: Provider fixtures do not qualify live provider setup or availability.
|
||||
|
||||
### `post-companies-tools-profiles-unbind`
|
||||
|
||||
Capability ID: `gateways-profiles/post-companies-tools-profiles-unbind`.
|
||||
|
||||
API: `present` — `POST /api/companies/{companyId}/tools/profiles/{profileId}/unbind`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_profiles`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
## `client-connect`
|
||||
|
||||
Capability ID: `gateways-profiles/client-connect`.
|
||||
|
||||
Review: `baseline`.
|
||||
Review: `operation-reviewed`.
|
||||
|
||||
API: `present` — representative operation IDs:
|
||||
### `get-mcp-gateways`
|
||||
|
||||
- `GET /api/tool-gateway/gateways/{gatewayId}/mcp`.
|
||||
- `POST /api/tool-gateway/sessions`.
|
||||
Capability ID: `gateways-profiles/get-mcp-gateways`.
|
||||
|
||||
Agent access: `partial` — Agent REST / native `call_api` for scoped session creation
|
||||
and revocation; existing MCP client protocol and assigned native app tools.
|
||||
API: `present` — `GET /mcp/gateways/{gatewayPublicId}`; browser/provider/MCP protocol.
|
||||
Agent access: `available` — existing authenticated MCP/provider protocol; not callable as JSON REST.
|
||||
Policy: Provider state/signature or gateway-token verification, company and resource binding; browser returns require the configuring human. Agent-issued durable gateway tokens retain both issuer and responsible-user authority.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-gateway.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
Policy: Named gateway/profile administration and credentials are board tools:admin;
|
||||
agent sessions/tool use use separate scoped authority.
|
||||
### `post-mcp-gateways`
|
||||
|
||||
Evidence: `source-only` — [implementation](../../server/src/routes/tool-gateway.ts#L353)
|
||||
at the reviewed commit above.
|
||||
Capability ID: `gateways-profiles/post-mcp-gateways`.
|
||||
|
||||
Verification: `not-run` — exercise a listed permitted operation with actual agent
|
||||
credentials/run context; inspect its result and applicable persistence/attribution.
|
||||
Assert the relevant denied actor, owner, company or mode from Policy. Review the
|
||||
remaining operations before qualifying the whole capability.
|
||||
API: `present` — `POST /mcp/gateways/{gatewayPublicId}`; browser/provider/MCP protocol.
|
||||
Agent access: `available` — existing authenticated MCP/provider protocol; not callable as JSON REST.
|
||||
Policy: Provider state/signature or gateway-token verification, company and resource binding; browser returns require the configuring human. Agent-issued durable gateway tokens retain both issuer and responsible-user authority.
|
||||
Evidence: `verified` — [route](../../server/src/routes/tool-gateway.ts); reviewed in the working tree based on the source commit above. [Authenticated fixtures](../../server/src/__tests__/connection-management.integration.test.ts) passed with database persistence and actual bearer/session middleware.
|
||||
Verification: `passed` — local assembled server and actual gateway-token authentication. Durable clients survive setup-run completion, honor purpose scopes, and reject revoked user/issuer authority and a cleared issuer foreign key. No live provider qualification.
|
||||
Gaps: Provider fixtures do not qualify live provider setup or availability.
|
||||
|
||||
Gaps: Scoped sessions remain agent/run-bound. MCP requires its existing protocol
|
||||
client; named gateways and gateway-token management retain board permissions.
|
||||
### `get-tool-gateway-gateways-mcp`
|
||||
|
||||
Native assigned-tool results above 500,000 encoded bytes are stored as scoped response assets.
|
||||
`read_tool_result` reads bounded JSON pages without repeating the upstream call,
|
||||
including when generic `call_api` is disabled.
|
||||
Each encoded page is at most 500,000 bytes and continues by byte offset until the
|
||||
entire result has been read. Current run authority, same task
|
||||
and agent, and asset/responsible-user access remain required. Provider content
|
||||
stays untrusted. The
|
||||
[response integration tests](../../server/src/services/native-runtime/runner-api.integration.test.ts)
|
||||
cover full Unicode reconstruction after controller recreation, low-trust access,
|
||||
foreign assets, paused agents, and one upstream execution. The
|
||||
[native PRP regression](../../server/src/services/native-runtime/runner-tool-results-prp.integration.test.ts)
|
||||
also verifies complete delivery of escape-heavy pages through native Runner,
|
||||
including a text wrapper larger than the PRP command limit that is decoded before
|
||||
command serialization. The
|
||||
[opt-in live probe](../../server/src/__tests__/helpers/verify-assigned-tool-results-live.ts)
|
||||
uses real Codex and Runner with a synthetic large upstream response; it does not
|
||||
publish to an external service.
|
||||
Capability ID: `gateways-profiles/get-tool-gateway-gateways-mcp`.
|
||||
|
||||
Discovery collapses identical descriptors with the same gateway name across
|
||||
providers, including native assigned-tool startup and fresh searches. Conflicting
|
||||
definitions remain an error. Distinct names and the normal invocation grants,
|
||||
approvals and revocation checks remain independent. Regression coverage lives in
|
||||
[gateway tests](../../server/src/__tests__/tool-gateway.test.ts) and
|
||||
[assigned-tool tests](../../server/src/services/native-runtime/assigned-mcp-tools.test.ts);
|
||||
these fixtures do not certify a live external-client journey.
|
||||
API: `present` — `GET /api/tool-gateway/gateways/{gatewayId}/mcp`; browser/provider/MCP protocol.
|
||||
Agent access: `available` — existing authenticated MCP/provider protocol; not callable as JSON REST.
|
||||
Policy: Provider state/signature or gateway-token verification, company and resource binding; browser returns require the configuring human. Agent-issued durable gateway tokens retain both issuer and responsible-user authority.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-gateway.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
Native assigned tools return bounded input-schema repair guidance after argument
|
||||
validation fails. Rejection creates no execution receipt and discloses no submitted
|
||||
values or unknown keys. Corrected calls keep the same authorization checks.
|
||||
[Runner regressions](../../packages/paperclip-runner/runner/crates/runner-core/src/tests/provider_assigned_tool_validation.rs)
|
||||
cover discovery repair and unauthorized calls; the
|
||||
[Codex transport fixture](../../packages/paperclip-runner/runner/crates/runner-core/tests/support/codex_assigned_tool_validation.rs)
|
||||
covers rejection, corrected dispatch, and completion with a simulated provider.
|
||||
This does not establish live model or GitHub access.
|
||||
### `post-tool-gateway-gateways-mcp`
|
||||
|
||||
Remote invocation regressions preserve access to authorized sibling tools after
|
||||
a fetch failure, timeout, non-authentication HTTP error, or JSON-RPC rejection.
|
||||
HTTP 401/403 and insufficient-scope errors keep their connection gates. The
|
||||
gateway records each failed invocation and never automatically replays it.
|
||||
This covers the gateway service with synthetic providers and a local HTTP
|
||||
server, not a live external provider or all client surfaces.
|
||||
Capability ID: `gateways-profiles/post-tool-gateway-gateways-mcp`.
|
||||
|
||||
API: `present` — `POST /api/tool-gateway/gateways/{gatewayId}/mcp`; browser/provider/MCP protocol.
|
||||
Agent access: `available` — existing authenticated MCP/provider protocol; not callable as JSON REST.
|
||||
Policy: Provider state/signature or gateway-token verification, company and resource binding; browser returns require the configuring human. Agent-issued durable gateway tokens retain both issuer and responsible-user authority.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-gateway.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `get-tool-gateway-tools`
|
||||
|
||||
Capability ID: `gateways-profiles/get-tool-gateway-tools`.
|
||||
|
||||
API: `present` — `GET /api/tool-gateway/tools`; JSON REST.
|
||||
Agent access: `available` — existing REST/native runtime tool or scoped gateway client, as documented by the linked route.
|
||||
Policy: Existing run-bound tool, scoped credential lease, execution policy, or assigned-email-agent checks; connection-management grants do not bypass these controls.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-gateway.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-tool-gateway-tools-call`
|
||||
|
||||
Capability ID: `gateways-profiles/post-tool-gateway-tools-call`.
|
||||
|
||||
API: `present` — `POST /api/tool-gateway/tools/call`; JSON REST.
|
||||
Agent access: `available` — existing REST/native runtime tool or scoped gateway client, as documented by the linked route.
|
||||
Policy: Existing run-bound tool, scoped credential lease, execution policy, or assigned-email-agent checks; connection-management grants do not bypass these controls.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-gateway.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
## `tokens`
|
||||
|
||||
Capability ID: `gateways-profiles/tokens`.
|
||||
|
||||
Review: `baseline`.
|
||||
Review: `operation-reviewed`.
|
||||
|
||||
API: `present` — representative operation IDs:
|
||||
### `post-tool-gateway-gateways-tokens`
|
||||
|
||||
- `POST /api/tool-gateway/gateways/{gatewayId}/tokens`.
|
||||
- `POST /api/tool-gateway/gateway-tokens/{tokenId}/revoke`.
|
||||
Capability ID: `gateways-profiles/post-tool-gateway-gateways-tokens`.
|
||||
|
||||
Agent access: `restricted` — Board tools:admin token management.
|
||||
API: `present` — `POST /api/tool-gateway/gateways/{gatewayId}/tokens`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections (responsible user: tools:admin)`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `verified` — [route](../../server/src/routes/tool-gateway.ts); reviewed in the working tree based on the source commit above. [Authenticated fixtures](../../server/src/__tests__/connection-management.integration.test.ts) passed with database persistence and actual bearer/session middleware.
|
||||
Verification: `passed` — deterministic provider fixtures / local assembled server; no live provider qualification.
|
||||
Gaps: Provider fixtures do not qualify live provider setup or availability.
|
||||
|
||||
Policy: Named gateway/profile administration and credentials are board tools:admin;
|
||||
agent sessions/tool use use separate scoped authority.
|
||||
### `post-tool-gateway-gateway-tokens-revoke`
|
||||
|
||||
Evidence: `source-only` — [implementation](../../server/src/routes/tool-gateway.ts#L353)
|
||||
at the reviewed commit above.
|
||||
Capability ID: `gateways-profiles/post-tool-gateway-gateway-tokens-revoke`.
|
||||
|
||||
Verification: `not-run` — assert the documented agent denial with an owned test fixture;
|
||||
verify any listed agent request/result path separately. A delegated operation needs its
|
||||
own policy and access review.
|
||||
API: `present` — `POST /api/tool-gateway/gateway-tokens/{tokenId}/revoke`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections (responsible user: tools:admin)`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-gateway.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
Gaps: Gateway-token management requires board tools:admin at the HTTP route.
|
||||
A grant to use an app does not create this authority; native `call_api` preserves
|
||||
the denial.
|
||||
### `post-tool-gateway-sessions`
|
||||
|
||||
Capability ID: `gateways-profiles/post-tool-gateway-sessions`.
|
||||
|
||||
API: `present` — `POST /api/tool-gateway/sessions`; JSON REST.
|
||||
Agent access: `available` — existing REST/native runtime tool or scoped gateway client, as documented by the linked route.
|
||||
Policy: Existing run-bound tool, scoped credential lease, execution policy, or assigned-email-agent checks; connection-management grants do not bypass these controls.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-gateway.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-tool-gateway-sessions-revoke`
|
||||
|
||||
Capability ID: `gateways-profiles/post-tool-gateway-sessions-revoke`.
|
||||
|
||||
API: `present` — `POST /api/tool-gateway/sessions/{sessionId}/revoke`; JSON REST.
|
||||
Agent access: `available` — existing REST/native runtime tool or scoped gateway client, as documented by the linked route.
|
||||
Policy: Existing run-bound tool, scoped credential lease, execution policy, or assigned-email-agent checks; connection-management grants do not bypass these controls.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-gateway.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
## `activity`
|
||||
|
||||
Capability ID: `gateways-profiles/activity`.
|
||||
|
||||
Review: `baseline`.
|
||||
Review: `operation-reviewed`.
|
||||
|
||||
API: `present` — representative operation IDs:
|
||||
### `get-companies-tools-runtime-slots`
|
||||
|
||||
- `GET /api/tool-gateway/audit`.
|
||||
Capability ID: `gateways-profiles/get-companies-tools-runtime-slots`.
|
||||
|
||||
Agent access: `restricted` — Board tools:view_audit; agent receives its own tool
|
||||
receipts/errors.
|
||||
API: `present` — `GET /api/companies/{companyId}/tools/runtime-slots`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_runtime`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
Policy: Named gateway/profile administration and credentials are board tools:admin;
|
||||
agent sessions/tool use use separate scoped authority.
|
||||
### `post-companies-tools-runtime-slots-stop`
|
||||
|
||||
Evidence: `source-only` — [implementation](../../server/src/routes/tool-gateway.ts#L353)
|
||||
at the reviewed commit above.
|
||||
Capability ID: `gateways-profiles/post-companies-tools-runtime-slots-stop`.
|
||||
|
||||
Verification: `not-run` — assert the documented agent denial with an owned test fixture;
|
||||
verify any listed agent request/result path separately. A delegated operation needs its
|
||||
own policy and access review.
|
||||
API: `present` — `POST /api/companies/{companyId}/tools/runtime-slots/{id}/stop`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_runtime`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
Gaps: Audit management API exists but broad audit visibility is not an agent use-path
|
||||
guarantee.
|
||||
### `post-companies-tools-runtime-slots-restart`
|
||||
|
||||
### Execution-host stdio assignments
|
||||
Capability ID: `gateways-profiles/post-companies-tools-runtime-slots-restart`.
|
||||
|
||||
Runner registers verified, session-local stdio servers from the execution host
|
||||
with native Codex and through the shared ACPX runtime. ACPX clients must support
|
||||
stdio MCP assignments. The transport uses each implementation's own schemas and
|
||||
responses. Each binding requires a private Unix socket to identify the shared
|
||||
resource whose calls are serialized. This is a separate binding alongside the
|
||||
HTTP gateway; it does not create gateway/profile administration
|
||||
authority. Tasks cannot supply these reserved environment inputs. Read-only
|
||||
sessions omit them.
|
||||
ACPX adapters use their applicable ACPX permission policy. Host-assigned native
|
||||
Codex tools run without a new per-call prompt, matching existing execution-host shell
|
||||
utilities. Explicit deny/prompt rules remain effective; requested approvals use
|
||||
PRP with active thread/turn checks and one-time decisions. Preconfigured Claude
|
||||
rejects interactive approval requests. See the [Runner contract](../../packages/paperclip-runner/README.md#assigned-local-mcp-servers).
|
||||
API: `present` — `POST /api/companies/{companyId}/tools/runtime-slots/{id}/restart`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_runtime`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
Local fixture coverage: [binding validation](../../packages/paperclip-runner/src/drivers/stdio-mcp.test.ts),
|
||||
[relay processes and cancellation](../../packages/paperclip-runner/runner/crates/runner-core/tests/stdio_mcp.rs),
|
||||
and [approval projection](../../packages/paperclip-runner/src/drivers/codex/codex-question-adapter.test.ts).
|
||||
Provider-client image and approval smoke tests used native Codex and Claude SDK;
|
||||
that coverage is not an exhaustive adapter compatibility test.
|
||||
Vendor-client evidence belongs in the PR. These checks do not
|
||||
certify live external credentials, deployment isolation or gateway revocation.
|
||||
### `get-companies-tools-runtime-health`
|
||||
|
||||
Capability ID: `gateways-profiles/get-companies-tools-runtime-health`.
|
||||
|
||||
API: `present` — `GET /api/companies/{companyId}/tools/runtime-health`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_runtime`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `get-companies-tools-runs-decisions`
|
||||
|
||||
Capability ID: `gateways-profiles/get-companies-tools-runs-decisions`.
|
||||
|
||||
API: `present` — `GET /api/companies/{companyId}/tools/runs/{runId}/decisions`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:view_audit`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-access.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `get-tool-gateway-runtime-slots`
|
||||
|
||||
Capability ID: `gateways-profiles/get-tool-gateway-runtime-slots`.
|
||||
|
||||
API: `present` — `GET /api/tool-gateway/runtime-slots`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_runtime`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-gateway.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-tool-gateway-runtime-slots-stop`
|
||||
|
||||
Capability ID: `gateways-profiles/post-tool-gateway-runtime-slots-stop`.
|
||||
|
||||
API: `present` — `POST /api/tool-gateway/runtime-slots/{slotId}/stop`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_runtime`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-gateway.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-tool-gateway-runtime-slots-restart`
|
||||
|
||||
Capability ID: `gateways-profiles/post-tool-gateway-runtime-slots-restart`.
|
||||
|
||||
API: `present` — `POST /api/tool-gateway/runtime-slots/{slotId}/restart`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_runtime`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-gateway.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `get-tool-gateway-audit`
|
||||
|
||||
Capability ID: `gateways-profiles/get-tool-gateway-audit`.
|
||||
|
||||
API: `present` — `GET /api/tool-gateway/audit`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:view_audit`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/tool-gateway.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
@@ -1,17 +1,17 @@
|
||||
# Runs, harnesses, and model accounts — agent access
|
||||
|
||||
Product map: [Runs, harnesses, and model accounts](../feature-map/runs-adapters.md).
|
||||
Product map: [runs-adapters](../feature-map/runs-adapters.md).
|
||||
|
||||
Feature ID: `runs-adapters`.
|
||||
|
||||
Review date: 2026-10-12. Source commit: `58e16dbddfc9c8d0cf60867f9d9847f0feda055b`.
|
||||
Native REST transport reconciled in this change; see the
|
||||
[shared transport contract](README.md#native-rest-transport).
|
||||
Review date: 2026-10-26. Source base: `a1f77821b9cd5c9c846fdf7a0fa5cc620ad2b6bb`; implementation: [#17737](https://github.com/paperclipai/paperclip/pull/17737).
|
||||
|
||||
This is a source-reviewed baseline of representative operations and known gaps.
|
||||
Each capability needs operation-level review before its entire scope can be
|
||||
qualified. No live agent execution is claimed. Follow the [map contract](../README.md)
|
||||
for format, permission checks, evidence and maintenance.
|
||||
Connection operations reviewed in this working tree. The inventory was reconciled
|
||||
against production UI clients, REST registrations and service entry points; it is
|
||||
a review checklist, not a runtime registry. [Authorization and evidence contract](../../doc/plans/2026-10-13-connection-api-parity.md).
|
||||
Fixture evidence is separate from live provider qualification and from empirical
|
||||
LLM success. Source-only entries have a reviewed agent path or an explicit boundary,
|
||||
but do not claim an individually executed HTTP test.
|
||||
|
||||
Scoped runner-default source review: 2026-10-12 at
|
||||
`eee0534154eaf5d0d3f2bbc97c1e24d86f34a5a5`, limited to runner discovery,
|
||||
@@ -35,7 +35,7 @@ API: `present` — representative operation IDs:
|
||||
- `GET /api/companies/{companyId}/adapters/{type}/models`.
|
||||
|
||||
Agent access: `partial` — Agent company-model REST / native `call_api` discovery and
|
||||
bound runtime context; adapter/account inventories remain board-only.
|
||||
bound runtime context; instance adapter inventory remains board-only; model-account management is enumerated below.
|
||||
|
||||
Policy: Run/cost visibility and agent configuration policy; adapter installation/account
|
||||
login/session control require board/admin.
|
||||
@@ -98,7 +98,7 @@ API: `present` — representative operation IDs:
|
||||
- `POST /api/companies/{companyId}/adapters/{type}/test-environment`.
|
||||
|
||||
Agent access: `partial` — Permitted agent-creation validation through REST / native
|
||||
`call_api` / CLI; account login requires its operator.
|
||||
`call_api` / CLI; supported account-login initiation has the delegated path below.
|
||||
|
||||
Policy: Run/cost visibility and agent configuration policy; adapter installation/account
|
||||
login/session control require board/admin.
|
||||
@@ -332,3 +332,340 @@ release. Unconfirmed termination stays blocked. Existing fake-peer and delayed
|
||||
read controls are source evidence; this changes no actor, company, account or
|
||||
session-reset permission. Operation-level verification remains `not-run` and
|
||||
the failed Test setup does not qualify successful live cleanup.
|
||||
|
||||
|
||||
## `model-accounts`
|
||||
|
||||
Capability ID: `runs-adapters/model-accounts`.
|
||||
|
||||
Review: `operation-reviewed`.
|
||||
|
||||
### `get-companies-ai-connection-pools`
|
||||
|
||||
Capability ID: `runs-adapters/get-companies-ai-connection-pools`.
|
||||
|
||||
API: `present` — `GET /api/companies/{companyId}/ai-connection-pools`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/ai-connections.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `get-companies-ai-connection-pools-inspection`
|
||||
|
||||
Capability ID: `runs-adapters/get-companies-ai-connection-pools-inspection`.
|
||||
|
||||
API: `present` — `GET /api/companies/{companyId}/ai-connection-pools/{poolId}/inspection`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/ai-connections.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-companies-ai-connection-pools`
|
||||
|
||||
Capability ID: `runs-adapters/post-companies-ai-connection-pools`.
|
||||
|
||||
API: `present` — `POST /api/companies/{companyId}/ai-connection-pools`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `verified` — [route](../../server/src/routes/ai-connections.ts); reviewed in the working tree based on the source commit above. [Authenticated fixtures](../../server/src/__tests__/connection-management.integration.test.ts) passed with database persistence and actual bearer/session middleware.
|
||||
Verification: `passed` — deterministic provider fixtures / local assembled server; no live provider qualification.
|
||||
Gaps: Provider fixtures do not qualify live provider setup or availability.
|
||||
|
||||
### `delete-companies-ai-connection-pools`
|
||||
|
||||
Capability ID: `runs-adapters/delete-companies-ai-connection-pools`.
|
||||
|
||||
API: `present` — `DELETE /api/companies/{companyId}/ai-connection-pools/{poolId}`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `verified` — [route](../../server/src/routes/ai-connections.ts); reviewed in the working tree based on the source commit above. [Authenticated fixtures](../../server/src/__tests__/connection-management.integration.test.ts) passed with database persistence and actual bearer/session middleware.
|
||||
Verification: `passed` — deterministic provider fixtures / local assembled server; no live provider qualification.
|
||||
Gaps: Provider fixtures do not qualify live provider setup or availability.
|
||||
|
||||
### `post-companies-ai-connections-local-attempts`
|
||||
|
||||
Capability ID: `runs-adapters/post-companies-ai-connections-local-attempts`.
|
||||
|
||||
API: `present` — `POST /api/companies/{companyId}/ai-connections/local/attempts`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/ai-connections.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-companies-ai-connections-local-check`
|
||||
|
||||
Capability ID: `runs-adapters/post-companies-ai-connections-local-check`.
|
||||
|
||||
API: `present` — `POST /api/companies/{companyId}/ai-connections/local/check`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/ai-connections.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `delete-companies-ai-connections-local-attempts`
|
||||
|
||||
Capability ID: `runs-adapters/delete-companies-ai-connections-local-attempts`.
|
||||
|
||||
API: `present` — `DELETE /api/companies/{companyId}/ai-connections/local/attempts/{sessionId}`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/ai-connections.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-companies-ai-connections-local-attempts-code`
|
||||
|
||||
Capability ID: `runs-adapters/post-companies-ai-connections-local-attempts-code`.
|
||||
|
||||
API: `present` — `POST /api/companies/{companyId}/ai-connections/local/attempts/{sessionId}/code`; JSON REST.
|
||||
Agent access: `restricted` — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
|
||||
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/ai-connections.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
|
||||
|
||||
### `get-companies-ai-connections`
|
||||
|
||||
Capability ID: `runs-adapters/get-companies-ai-connections`.
|
||||
|
||||
API: `present` — `GET /api/companies/{companyId}/ai-connections`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `verified` — [route](../../server/src/routes/ai-connections.ts); reviewed in the working tree based on the source commit above. [Authenticated fixtures](../../server/src/__tests__/connection-management.integration.test.ts) passed with database persistence and actual bearer/session middleware.
|
||||
Verification: `passed` — deterministic provider fixtures / local assembled server; no live provider qualification.
|
||||
Gaps: Provider fixtures do not qualify live provider setup or availability.
|
||||
|
||||
### `get-companies-ai-connections-usage`
|
||||
|
||||
Capability ID: `runs-adapters/get-companies-ai-connections-usage`.
|
||||
|
||||
API: `present` — `GET /api/companies/{companyId}/ai-connections/{connectionId}/usage`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/ai-connections.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `get-companies-ai-connections-active-runs`
|
||||
|
||||
Capability ID: `runs-adapters/get-companies-ai-connections-active-runs`.
|
||||
|
||||
API: `present` — `GET /api/companies/{companyId}/ai-connections/{connectionId}/active-runs`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/ai-connections.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-companies-ai-connections`
|
||||
|
||||
Capability ID: `runs-adapters/post-companies-ai-connections`.
|
||||
|
||||
API: `present` — `POST /api/companies/{companyId}/ai-connections`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `verified` — [route](../../server/src/routes/ai-connections.ts); reviewed in the working tree based on the source commit above. [Authenticated fixtures](../../server/src/__tests__/connection-management.integration.test.ts) passed with database persistence and actual bearer/session middleware.
|
||||
Verification: `passed` — deterministic provider fixtures / local assembled server; no live provider qualification.
|
||||
Gaps: Provider fixtures do not qualify live provider setup or availability.
|
||||
|
||||
### `post-companies-ai-connections-local`
|
||||
|
||||
Capability ID: `runs-adapters/post-companies-ai-connections-local`.
|
||||
|
||||
API: `present` — `POST /api/companies/{companyId}/ai-connections/local`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/ai-connections.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `put-companies-ai-connections-default`
|
||||
|
||||
Capability ID: `runs-adapters/put-companies-ai-connections-default`.
|
||||
|
||||
API: `present` — `PUT /api/companies/{companyId}/ai-connections/default`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/ai-connections.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `get-companies-ai-connections-login-setup`
|
||||
|
||||
Capability ID: `runs-adapters/get-companies-ai-connections-login-setup`.
|
||||
|
||||
API: `present` — `GET /api/companies/{companyId}/ai-connections/login/{sessionId}/setup`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/ai-connections.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `get-companies-ai-connections-login`
|
||||
|
||||
Capability ID: `runs-adapters/get-companies-ai-connections-login`.
|
||||
|
||||
API: `present` — `GET /api/companies/{companyId}/ai-connections/login/{sessionId}`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/ai-connections.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `get-companies-adapters-models`
|
||||
|
||||
Capability ID: `runs-adapters/get-companies-adapters-models`.
|
||||
|
||||
API: `present` — `GET /api/companies/{companyId}/adapters/{type}/models`; JSON REST.
|
||||
Agent access: `available` — existing REST/native runtime tool or scoped gateway client, as documented by the linked route.
|
||||
Policy: Existing run-bound tool, scoped credential lease, execution policy, or assigned-email-agent checks; connection-management grants do not bypass these controls.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/agents.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-companies-adapters-login-sessions`
|
||||
|
||||
Capability ID: `runs-adapters/post-companies-adapters-login-sessions`.
|
||||
|
||||
API: `present` — `POST /api/companies/{companyId}/adapters/{type}/login-sessions`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/agents.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `get-companies-adapters-login-sessions-active`
|
||||
|
||||
Capability ID: `runs-adapters/get-companies-adapters-login-sessions-active`.
|
||||
|
||||
API: `present` — `GET /api/companies/{companyId}/adapters/{type}/login-sessions/active`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/agents.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `get-companies-adapters-login-sessions`
|
||||
|
||||
Capability ID: `runs-adapters/get-companies-adapters-login-sessions`.
|
||||
|
||||
API: `present` — `GET /api/companies/{companyId}/adapters/{type}/login-sessions/{sessionId}`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/agents.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-companies-adapters-login-sessions-cancel`
|
||||
|
||||
Capability ID: `runs-adapters/post-companies-adapters-login-sessions-cancel`.
|
||||
|
||||
API: `present` — `POST /api/companies/{companyId}/adapters/{type}/login-sessions/{sessionId}/cancel`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/agents.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-agents-claude-login`
|
||||
|
||||
Capability ID: `runs-adapters/post-agents-claude-login`.
|
||||
|
||||
API: `present` — `POST /api/agents/{id}/claude-login`; JSON REST.
|
||||
Agent access: `operator-only` — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
|
||||
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/agents.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
|
||||
|
||||
### `post-companies-setup-token-login-sessions`
|
||||
|
||||
Capability ID: `runs-adapters/post-companies-setup-token-login-sessions`.
|
||||
|
||||
API: `present` — `POST /api/companies/{companyId}/setup-token-login-sessions`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/agents.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `get-companies-setup-token-login-sessions-active`
|
||||
|
||||
Capability ID: `runs-adapters/get-companies-setup-token-login-sessions-active`.
|
||||
|
||||
API: `present` — `GET /api/companies/{companyId}/setup-token-login-sessions/active`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/agents.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `get-companies-setup-token-login-sessions`
|
||||
|
||||
Capability ID: `runs-adapters/get-companies-setup-token-login-sessions`.
|
||||
|
||||
API: `present` — `GET /api/companies/{companyId}/setup-token-login-sessions/{sessionId}`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/agents.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `get-companies-setup-token-login-sessions-prompt`
|
||||
|
||||
Capability ID: `runs-adapters/get-companies-setup-token-login-sessions-prompt`.
|
||||
|
||||
API: `present` — `GET /api/companies/{companyId}/setup-token-login-sessions/{sessionId}/prompt`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/agents.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-companies-setup-token-login-sessions-code`
|
||||
|
||||
Capability ID: `runs-adapters/post-companies-setup-token-login-sessions-code`.
|
||||
|
||||
API: `present` — `POST /api/companies/{companyId}/setup-token-login-sessions/{sessionId}/code`; JSON REST.
|
||||
Agent access: `restricted` — existing human setup or approval surface; agent can identify the saved setup and inspect the result.
|
||||
Policy: Human consent, identity confirmation, action approval, or trusted-host administration. This endpoint does not delegate human identity or self-approval to an agent.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/agents.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: Agent invocation is denied by the stated policy. The authorized human or operator must perform this step; this entry does not claim delegated execution.
|
||||
|
||||
### `post-companies-setup-token-login-sessions-completion`
|
||||
|
||||
Capability ID: `runs-adapters/post-companies-setup-token-login-sessions-completion`.
|
||||
|
||||
API: `present` — `POST /api/companies/{companyId}/setup-token-login-sessions/{sessionId}/completion`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/agents.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `post-companies-setup-token-login-sessions-cancel`
|
||||
|
||||
Capability ID: `runs-adapters/post-companies-setup-token-login-sessions-cancel`.
|
||||
|
||||
API: `present` — `POST /api/companies/{companyId}/setup-token-login-sessions/{sessionId}/cancel`; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: `tools:manage_connections`; [shared management policy](../../doc/plans/2026-10-13-connection-api-parity.md#authorization-contract). Resolved resources and every affected target are checked; personal ownership remains the responsible user.
|
||||
Evidence: `source-only` — [route](../../server/src/routes/agents.ts); reviewed in the working tree based on the source commit above.
|
||||
Verification: `not-run` — individual operation not executed in this audit; shared authorization and representative family flows are exercised by the authenticated integration suite. Follow the route schema, inspect persistence/audit, and assert owner, scope and revoked-authority denial.
|
||||
Gaps: This individual operation has source review but no recorded HTTP verification. Provider availability and live setup remain unqualified.
|
||||
|
||||
### `update-agent-ai-binding`
|
||||
|
||||
Capability ID: `runs-adapters/update-agent-ai-binding`.
|
||||
|
||||
API: `present` — `PATCH /api/agents/{id}` with a managed AI binding in runtime configuration; JSON REST.
|
||||
Agent access: `available` — agent REST and default native `search_api` / `call_api`.
|
||||
Policy: existing agent configuration permission plus `tools:manage_profiles`, current responsible-user authority, resolved account/pool access and target-agent authority. Pool members retain their credential audience.
|
||||
Evidence: `verified` — the production-authenticated [integration suite](../../server/src/__tests__/connection-management.integration.test.ts) saves a personal account and binds it to the fresh standard agent; provider response is a fixture.
|
||||
Verification: `passed` — binding persistence and loss of profile-management authority tested with actual agent credentials. Other adapter/provider combinations remain source-reviewed.
|
||||
Gaps: live provider setup is outside this delivery.
|
||||
@@ -107,3 +107,18 @@ Scope: ui
|
||||
Storybook: Mount PermissionsPanel/AppDetail with quarantined actions, selection/review, refresh pending, empty and failed discovery states. Existing auto-allowed NewToolsAllowed examples are not quarantine review.
|
||||
Production: Exercise catalog refresh and new-tool review with permitted/denied actors; unreviewed actions stay quarantined, prior Off/Ask choices survive refresh, and approved review persists.
|
||||
Sources: Source: [PermissionsPanel.tsx](../../ui/src/pages/apps/app-detail/PermissionsPanel.tsx), [AppDetail.tsx](../../ui/src/pages/apps/AppDetail.tsx), [tool-access.ts](../../server/src/routes/tool-access.ts). Tests: [AppDetail.test.tsx](../../ui/src/pages/apps/AppDetail.test.tsx), [tool-access-service.test.ts](../../server/src/__tests__/tool-access-service.test.ts), [tool-access-policy-service.test.ts](../../server/src/__tests__/tool-access-policy-service.test.ts)
|
||||
### `delegated-configuration`
|
||||
|
||||
A fresh standard agent can use the existing REST API and default native
|
||||
`search_api` / `call_api` to perform requested configuration within its responsible
|
||||
user's authority. Personal ownership stays with that user; audit attribution stays
|
||||
with the acting agent. Existing agents retain their explicit grants and restrictions.
|
||||
Human authentication and identity confirmation open the exact saved setup; local
|
||||
host administration and action approval retain their own boundaries. See the
|
||||
operation inventory in the companion and the [qualification record](../../doc/plans/2026-10-13-connection-api-parity.md).
|
||||
|
||||
Automated: [agent-authenticated integration](../../server/src/__tests__/connection-management.integration.test.ts)
|
||||
uses normal creation defaults, persistent agent keys, run JWTs, native tool bindings,
|
||||
real database persistence, and deterministic provider fixtures. It separately checks
|
||||
user/agent revocation, trust, company/ownership scope, work modes and attribution.
|
||||
This is API reachability evidence, not a live provider setup or an LLM success rate.
|
||||
@@ -217,3 +217,18 @@ Sources: Source: [TaskChatBubble.tsx](../../ui/src/components/task-chat/TaskChat
|
||||
### Documentation scope: Chat and email channel setup
|
||||
|
||||
Shared recipes name provider checks; each provider transport/thread/identity/file-size/type combination needs separate live evidence and deeper instructions.
|
||||
### `delegated-configuration`
|
||||
|
||||
A fresh standard agent can use the existing REST API and default native
|
||||
`search_api` / `call_api` to perform requested configuration within its responsible
|
||||
user's authority. Personal ownership stays with that user; audit attribution stays
|
||||
with the acting agent. Existing agents retain their explicit grants and restrictions.
|
||||
Human authentication and identity confirmation open the exact saved setup; local
|
||||
host administration and action approval retain their own boundaries. See the
|
||||
operation inventory in the companion and the [qualification record](../../doc/plans/2026-10-13-connection-api-parity.md).
|
||||
|
||||
Automated: [agent-authenticated integration](../../server/src/__tests__/connection-management.integration.test.ts)
|
||||
uses normal creation defaults, persistent agent keys, run JWTs, native tool bindings,
|
||||
real database persistence, and deterministic provider fixtures. It separately checks
|
||||
user/agent revocation, trust, company/ownership scope, work modes and attribution.
|
||||
This is API reachability evidence, not a live provider setup or an LLM success rate.
|
||||
@@ -260,3 +260,18 @@ admission at those boundaries. Verify a served deployment and provider settings,
|
||||
not only the catalog action count. Vercel preview requires an existing deployment;
|
||||
its provider makes the first deployment production, so an empty-project preview
|
||||
must fail before submission and explain the explicit production prerequisite.
|
||||
### `delegated-configuration`
|
||||
|
||||
A fresh standard agent can use the existing REST API and default native
|
||||
`search_api` / `call_api` to perform requested configuration within its responsible
|
||||
user's authority. Personal ownership stays with that user; audit attribution stays
|
||||
with the acting agent. Existing agents retain their explicit grants and restrictions.
|
||||
Human authentication and identity confirmation open the exact saved setup; local
|
||||
host administration and action approval retain their own boundaries. See the
|
||||
operation inventory in the companion and the [qualification record](../../doc/plans/2026-10-13-connection-api-parity.md).
|
||||
|
||||
Automated: [agent-authenticated integration](../../server/src/__tests__/connection-management.integration.test.ts)
|
||||
uses normal creation defaults, persistent agent keys, run JWTs, native tool bindings,
|
||||
real database persistence, and deterministic provider fixtures. It separately checks
|
||||
user/agent revocation, trust, company/ownership scope, work modes and attribution.
|
||||
This is API reachability evidence, not a live provider setup or an LLM success rate.
|
||||
@@ -79,3 +79,18 @@ Scope: ui
|
||||
Storybook: Mount current TokensPanel with issue controls, once-only token reveal, expiry/actions, revocation confirmation and failures. Old GatewaysTab fixtures and assistant OAuth revocation are insufficient.
|
||||
Production: Issue bounded token via POST /tool-gateway/gateways/{id}/tokens; call allowed and excluded tools; revoke via /tool-gateway/gateway-tokens/{id}/revoke and verify denial using same client.
|
||||
Sources: Source: [TokensPanel.tsx](../../ui/src/pages/apps/gateways/panels/TokensPanel.tsx), [tool-gateway.ts](../../server/src/routes/tool-gateway.ts), [tools.ts](../../ui/src/api/tools.ts). Tests: [TokensPanel.test.tsx](../../ui/src/pages/apps/gateways/panels/TokensPanel.test.tsx), [tool-gateway-service.test.ts](../../server/src/__tests__/tool-gateway-service.test.ts), [tool-gateway.test.ts](../../server/src/__tests__/tool-gateway.test.ts)
|
||||
### `delegated-configuration`
|
||||
|
||||
A fresh standard agent can use the existing REST API and default native
|
||||
`search_api` / `call_api` to perform requested configuration within its responsible
|
||||
user's authority. Personal ownership stays with that user; audit attribution stays
|
||||
with the acting agent. Existing agents retain their explicit grants and restrictions.
|
||||
Human authentication and identity confirmation open the exact saved setup; local
|
||||
host administration and action approval retain their own boundaries. See the
|
||||
operation inventory in the companion and the [qualification record](../../doc/plans/2026-10-13-connection-api-parity.md).
|
||||
|
||||
Automated: [agent-authenticated integration](../../server/src/__tests__/connection-management.integration.test.ts)
|
||||
uses normal creation defaults, persistent agent keys, run JWTs, native tool bindings,
|
||||
real database persistence, and deterministic provider fixtures. It separately checks
|
||||
user/agent revocation, trust, company/ownership scope, work modes and attribution.
|
||||
This is API reachability evidence, not a live provider setup or an LLM success rate.
|
||||
@@ -14,6 +14,7 @@ Agent access: [companion](../agent-access-map/runs-adapters.md).
|
||||
|
||||
## Sub-features
|
||||
|
||||
- `model-accounts`: `runs-adapters/model-accounts` — configure AI accounts, login attempts, defaults, bindings, usage and pools through delegated connection APIs.
|
||||
- `availability`: `runs-adapters/availability` — discover installed adapters and available models/accounts.
|
||||
- `validation`: `runs-adapters/validation` — test an adapter in the selected execution environment and surface authentication failures.
|
||||
- `runs`: `runs-adapters/runs` — inspect run status, events, output, costs, and the source task.
|
||||
@@ -235,3 +236,19 @@ The existing transport and ingress suites exercise these conditions without a
|
||||
provider. Repeat the actual managed setup and useful task journey separately;
|
||||
the literal `651a3de64fc943216cc414b64b1443809f9499da` Test attempt failed
|
||||
cleanup before hire and retains its unconfirmed recovery state.
|
||||
|
||||
### `delegated-configuration`
|
||||
|
||||
A fresh standard agent can use the existing REST API and default native
|
||||
`search_api` / `call_api` to perform requested configuration within its responsible
|
||||
user's authority. Personal ownership stays with that user; audit attribution stays
|
||||
with the acting agent. Existing agents retain their explicit grants and restrictions.
|
||||
Human authentication and identity confirmation open the exact saved setup; local
|
||||
host administration and action approval retain their own boundaries. See the
|
||||
operation inventory in the companion and the [qualification record](../../doc/plans/2026-10-13-connection-api-parity.md).
|
||||
|
||||
Automated: [agent-authenticated integration](../../server/src/__tests__/connection-management.integration.test.ts)
|
||||
uses normal creation defaults, persistent agent keys, run JWTs, native tool bindings,
|
||||
real database persistence, and deterministic provider fixtures. It separately checks
|
||||
user/agent revocation, trust, company/ownership scope, work modes and attribution.
|
||||
This is API reachability evidence, not a live provider setup or an LLM success rate.
|
||||
@@ -1,6 +1,7 @@
|
||||
import type { AiConnectionList, AiConnectionUsage, CreateAiConnection, AiConnectionLoginIntent, LocalAiLoginAttempt, LocalAiLoginStatus } from "@paperclipai/shared";
|
||||
import { api } from "./client";
|
||||
export const aiConnectionsApi = {
|
||||
loginSetup: (companyId: string, sessionId: string) => api.get<{ sessionId: string; intent: AiConnectionLoginIntent; environmentId: string; status: string; connectionId: string | null; grantId: string | null }>(`/companies/${companyId}/ai-connections/login/${encodeURIComponent(sessionId)}/setup`),
|
||||
probeUsage: (companyId: string, connectionId: string, grantId?: string) => api.get<AiConnectionUsage>(`/companies/${companyId}/ai-connections/${connectionId}/usage${grantId ? `?grantId=${encodeURIComponent(grantId)}` : ""}`),
|
||||
startLocalLogin: (companyId: string, input: AiConnectionLoginIntent & { restart?: boolean }) => api.post<LocalAiLoginAttempt>(`/companies/${companyId}/ai-connections/local/attempts`, input),
|
||||
checkLocalLogin: (companyId: string, input: AiConnectionLoginIntent & { localSessionId?: string }) => api.post<LocalAiLoginStatus>(`/companies/${companyId}/ai-connections/local/check`, input),
|
||||
|
||||
@@ -237,6 +237,20 @@ afterEach(async () => {
|
||||
});
|
||||
|
||||
describe("ConnectionIntentInteractionBody states and audience", () => {
|
||||
it("opens the saved chat authentication step without another setup form", async () => {
|
||||
const interaction = { ...pendingConnectionIntentInteraction, payload: { ...pendingConnectionIntentInteraction.payload,
|
||||
purpose: "channel" as const, serviceSlug: "slack", serviceName: "Slack", phase: "authorizing" as const,
|
||||
savedSetup: { endpointId: "endpoint", connectionId: "connection" } } };
|
||||
setupOptionsMock.mockResolvedValue({ version: 1, interaction, requestedAgentId: interaction.payload.requestingAgentId,
|
||||
existingConnections: [], service: { service: "slack", name: "Slack", methods: [], state: "needs_user_action" },
|
||||
chatSetup: { endpointId: "endpoint", connectionId: "connection", path: "/ACME/apps/chat/connect?provider=slack&resume=endpoint" } });
|
||||
renderBody(interaction);
|
||||
await flush();
|
||||
expect(document.querySelector('a')?.getAttribute("href")).toBe("/ACME/apps/chat/connect?provider=slack&resume=endpoint");
|
||||
expect(document.querySelector('[data-testid="shared-connection-setup"]')).toBeNull();
|
||||
expect(completeMock).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it.each([
|
||||
[pendingConnectionIntentInteraction, "Connect"],
|
||||
[
|
||||
|
||||
@@ -64,6 +64,7 @@ export function ConnectionIntentInteractionBody({
|
||||
);
|
||||
const isPending = interaction.status === "pending";
|
||||
const isAi = interaction.payload.purpose === "ai";
|
||||
const isChatHandoff = Boolean(interaction.payload.savedSetup);
|
||||
const provider = isAi ? aiProviderSchema.safeParse(interaction.payload.serviceSlug).data : undefined;
|
||||
const serviceName = provider ? AI_CONNECTION_CAPABILITIES[provider].name : interaction.payload.serviceName;
|
||||
const isEmail = interaction.payload.purpose === "channel" && interaction.payload.serviceSlug === "agentmail";
|
||||
@@ -472,6 +473,7 @@ export function ConnectionIntentInteractionBody({
|
||||
? `${interaction.payload.requestingAgentName} needs your own AI connection. Connect here and the task will resume automatically.`
|
||||
: interaction.payload.purpose === "ai"
|
||||
? "This task can’t run until the agent has a valid AI connection. Connect here and the task will resume automatically."
|
||||
: isChatHandoff ? "Complete the human sign-in step in the saved setup. Your task continues when the connection is ready."
|
||||
: isEmail ? "Connect AgentMail to create an email address for this agent."
|
||||
: "Connect your identity or reuse an eligible connection. Access is added only for this agent."}
|
||||
</p>
|
||||
@@ -486,7 +488,10 @@ export function ConnectionIntentInteractionBody({
|
||||
</p>
|
||||
) : null}
|
||||
|
||||
{isEmail ? setupQuery.isLoading || setupQuery.isError ? <>
|
||||
{isChatHandoff ? <div className="mt-4 flex items-center justify-between gap-2">
|
||||
<Button type="button" variant="ghost" disabled={declineMutation.isPending} onClick={() => declineMutation.mutate()}>Not now</Button>
|
||||
{setupQuery.data?.chatSetup ? <Button asChild><a href={setupQuery.data.chatSetup.path} target="_blank" rel="noopener noreferrer">Continue authentication</a></Button> : setupContent}
|
||||
</div> : isEmail ? setupQuery.isLoading || setupQuery.isError ? <>
|
||||
{setupContent}
|
||||
<Button type="button" variant="ghost" disabled={declineMutation.isPending} onClick={() => declineMutation.mutate()}>Not now</Button>
|
||||
</> : <AgentMailIntentSetup
|
||||
|
||||
@@ -445,6 +445,28 @@ describe("AppsConnect — Connect with a link (M4 frame)", () => {
|
||||
expect(startOAuthMock).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("opens the saved AI sign-in and reuses a completed account", async () => {
|
||||
mockSearch.value = "aiLogin=saved-login";
|
||||
const setup = vi.spyOn(aiConnectionsApi, "loginSetup").mockResolvedValue({
|
||||
sessionId: "saved-login", environmentId: "local-env", status: "completed", connectionId: "saved-account", grantId: "saved-grant",
|
||||
intent: { provider: "openai", method: "subscription", name: "Saved account", ownership: "personal", agentIds: ["agent-1"], allAgents: false },
|
||||
});
|
||||
await render();
|
||||
expect(setup).toHaveBeenCalledWith("company-1", "saved-login");
|
||||
expect(container.textContent).toContain("This account is connected.");
|
||||
expect(connectAppMock).not.toHaveBeenCalled();
|
||||
await act(async () => buttonByText("View connection")?.click());
|
||||
expect(mockNavigate).toHaveBeenCalledWith("/apps/saved-account/permissions");
|
||||
});
|
||||
|
||||
it("shows an unavailable saved sign-in without creating a replacement", async () => {
|
||||
mockSearch.value = "aiLogin=another-users-login";
|
||||
vi.spyOn(aiConnectionsApi, "loginSetup").mockRejectedValue(new Error("Sign-in attempt not found"));
|
||||
await render();
|
||||
expect(container.querySelector('[role="alert"]')?.textContent).toBe("Sign-in attempt not found");
|
||||
expect(connectAppMock).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("keeps Honcho setup blocked until the provider workspace is supplied", async () => {
|
||||
const honcho = CONNECTABLE_APP_DEFINITIONS.find((app) => app.slug === "honcho")!;
|
||||
experimentalMock.mockResolvedValue({ enableMemoryConnectors: true });
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
import { useQuery } from "@tanstack/react-query";
|
||||
import { aiConnectionsApi } from "@/api/ai-connections";
|
||||
import { AiConnectionCredentialStep } from "@/components/ai-connections/AiConnectionCredentialStep";
|
||||
import { AiProviderSetup } from "@/components/ai-connections/AiProviderSetup";
|
||||
import { AiConnectionPoolConnector } from "@/components/ai-connections/AiConnectionPoolConnector";
|
||||
import { useEffect } from "react";
|
||||
@@ -27,6 +28,9 @@ export function AppsConnect({ byoOnly = false, credentialSource = "paperclip_vau
|
||||
const { appKey } = useParams<{ appKey?: string }>();
|
||||
const source = searchParams.get("source") ?? appKey ?? searchParams.get("appKey");
|
||||
const reconnectId = searchParams.get("reconnect");
|
||||
const aiLoginId = searchParams.get("aiLogin");
|
||||
const login = useQuery({ queryKey: ["ai-login-setup", selectedCompanyId, aiLoginId],
|
||||
queryFn: () => aiConnectionsApi.loginSetup(selectedCompanyId!, aiLoginId!), enabled: Boolean(selectedCompanyId && aiLoginId), retry: false });
|
||||
const preset = aiProviderSetupPreset(source);
|
||||
const aiReconnectRequested = Boolean(reconnectId && (preset || ["openai", "anthropic", "xai"].includes(source ?? "")));
|
||||
const aiAccounts = useQuery({ queryKey: ["ai-connections", selectedCompanyId], queryFn: () => aiConnectionsApi.list(selectedCompanyId!), enabled: Boolean(selectedCompanyId && aiReconnectRequested) });
|
||||
@@ -55,6 +59,16 @@ export function AppsConnect({ byoOnly = false, credentialSource = "paperclip_vau
|
||||
const path = selectedCompanyId && consumeSkillSourceReturn(selectedCompanyId);
|
||||
if (path) navigate(path);
|
||||
}
|
||||
if (aiLoginId && selectedCompanyId) {
|
||||
if (login.isPending) return <p role="status">Loading saved sign-in…</p>;
|
||||
if (!login.data) return <p role="alert">{login.error?.message ?? "This sign-in is unavailable."}</p>;
|
||||
const { intent, environmentId, connectionId, grantId } = login.data;
|
||||
if (connectionId && grantId) return <div className="space-y-4"><p role="status">This account is connected.</p><Button onClick={() => navigate(`/apps/${connectionId}/permissions`)}>View connection</Button></div>;
|
||||
return <AiConnectionCredentialStep key={aiLoginId} companyId={selectedCompanyId} {...intent}
|
||||
agentIds={intent.agentIds ?? []} allAgents={intent.allAgents ?? false} initialMethod={intent.method} fixedMethod
|
||||
environmentId={environmentId} hideName onCancel={() => navigate("/apps")}
|
||||
onComplete={binding => navigate(`/apps/${binding.connectionId}/permissions`)} />;
|
||||
}
|
||||
if (aiReconnectRequested && aiAccounts.isPending) return <p role="status">Loading connection…</p>;
|
||||
if (aiReconnectRequested && aiAccounts.isError) return <p role="alert">Could not load this connection. Refresh to try again.</p>;
|
||||
if (aiReconnectRequested && !aiReconnect) return <p role="alert">This connection is unavailable. Return to Connectors to choose an account.</p>;
|
||||
|
||||
Reference in new issue
Block a user