Let the coordinator manage skills, MCP servers and tools, behind a confirm card

- Coordinator tools in its own chat (super admin only): list_extensions, set_extension_access, delete_extension, and update_skill / update_mcp_server / update_custom_tool for what can't change where anything is sent (on/off, names, arguments, left-out tools) - Adding a skill, MCP server or tool, or changing a skill's words, a server's URL or headers or a tool's kind or config, goes through propose_skill / propose_mcp_server / propose_custom_tool: stored in extension_proposals with the bot's background check, shown as a [proposal:ID] chip that opens a card with Confirm and Reject - The card's facts are worked out by the app from what Confirm saves: the host, every {{env.KEY}} and whether it's saved, the config; for a skill its links, hosts, tool names, mentions of secrets and a diff against the saved runbook - Confirming decides once and checks again; a server or tool missing a key is saved switched off, and the outcome is posted to the bot in chat - Never from a bot: stdio servers, a URL whose host a template decides, envs in a prompt tool, a key's value Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-25 06:08:09 +01:00
parent e6c278198b
commit fefc295d15
77 changed files with 3307 additions and 12 deletions
@@ -0,0 +1,76 @@
+import { describe, expect, test } from "bun:test";
+import extensionEnvUses from "./extension-env-uses";
+
+describe("extensionEnvUses", () => {
+    test("reads an MCP server's host and the envs its URL and headers send", () => {
+        expect(
+            extensionEnvUses({
+                kind: "mcp",
+                data: {
+                    name: "GitHub",
+                    description: "",
+                    transport: "remote",
+                    url: "https://api.githubcopilot.com/mcp/?region={{env.REGION}}",
+                    headers: { Authorization: "Bearer {{ env.GITHUB_TOKEN }}", Accept: "application/json" },
+                    command: "",
+                    setup_command: "",
+                    env: {},
+                    excluded_tools: [],
+                    enabled: true,
+                    all_bots: false,
+                },
+            }),
+        ).toEqual({
+            host: "api.githubcopilot.com",
+            sends: [
+                { key: "REGION", where: "URL" },
+                { key: "GITHUB_TOKEN", where: "header Authorization" },
+            ],
+        });
+    });
+
+    test("reads an HTTP tool's URL, headers and body", () => {
+        expect(
+            extensionEnvUses({
+                kind: "tool",
+                data: {
+                    name: "weather",
+                    description: "d",
+                    parameters: { type: "object" },
+                    enabled: true,
+                    all_bots: false,
+                    kind: "http",
+                    config: {
+                        method: "POST",
+                        url: "https://api.weather.example/v1?key={{env.WEATHER_KEY}}",
+                        headers: {},
+                        body: `{"token":"{{env.WEATHER_KEY}}","city":"{{args.city}}"}`,
+                    },
+                },
+            }),
+        ).toEqual({
+            host: "api.weather.example",
+            sends: [
+                { key: "WEATHER_KEY", where: "URL" },
+                { key: "WEATHER_KEY", where: "body" },
+            ],
+        });
+    });
+
+    test("a script sends nothing from the app", () => {
+        expect(
+            extensionEnvUses({
+                kind: "tool",
+                data: {
+                    name: "count",
+                    description: "d",
+                    parameters: { type: "object" },
+                    enabled: true,
+                    all_bots: false,
+                    kind: "script",
+                    config: { language: "bash", code: "echo {{env.X}}" },
+                },
+            }),
+        ).toEqual({ host: null, sends: [] });
+    });
+});