blomios/IdeaSDK
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(mcp): synchronise les permissions MCP avec les tools réellement exposés

Browse Source 
Les permissions déclarées ne reflétaient pas toujours les tools
effectivement exposés aux agents (contexte requester/projet lié après
coup). Ajoute ToolInvoker::tools_for_bound_context/tools_for_context
pour exposer la liste effective au moment de l'injection dans une
requête OpenAI-compatible, et propage le calcul dans la policy MCP,
le serveur, la factory de session et l'adapter openai_compat.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Blomios
2026-07-29 15:57:45 +02:00
parent 5955ea37a2
commit 21a84ab8f2
8 changed files with 462 additions and 223 deletions
Download Patch File Download Diff File Expand all files Collapse all files

57
crates/backend/src/lib.rs
View File

@ -4967,59 +4967,14 @@ mod mcp_serve_peer_tests {
assert_eq!(resp["id"], json!(1));
let tools = resp["result"]["tools"].as_array().expect("tools array");
let names: Vec<&str> = tools.iter().map(|t| t["name"].as_str().unwrap()).collect();
for expected in [
"idea_list_agents",
"idea_ask_agent",
"idea_ask_agents",
"idea_run_in_background",
"idea_launch_agent",
"idea_stop_agent",
"idea_update_context",
"idea_create_skill",
// FileGuard-mediated context/memory tools (cadrage C7).
"idea_context_read",
"idea_context_propose",
"idea_memory_read",
"idea_memory_write",
// Skill-awareness : lecture à la demande du corps d'un skill.
"idea_skill_read",
// Conversation inter-agent headless : réponse inline capturée depuis le Final.
"idea_ask_agent",
// Live-state (programme live-state, lot LS4).
"idea_workstate_read",
"idea_workstate_set",
// Public ticket tools (Issue domain).
"idea_ticket_create",
"idea_ticket_read",
"idea_ticket_list",
"idea_ticket_update",
"idea_ticket_update_status",
"idea_ticket_update_priority",
"idea_ticket_bulk_update_status",
"idea_ticket_bulk_update_priority",
"idea_ticket_bulk_delete",
"idea_ticket_read_carnet",
"idea_ticket_update_carnet",
"idea_ticket_link",
"idea_ticket_unlink",
"idea_sprint_list",
// Public template tools.
"idea_template_list",
"idea_template_read",
"idea_template_create",
"idea_template_update",
"idea_template_delete",
] {
assert!(
names.contains(&expected),
"missing tool {expected}; got {names:?}"
);
}
let expected_names: Vec<&str> = infrastructure::orchestrator::mcp::catalogue()
.into_iter()
.map(|tool| tool.name)
.collect();
assert!(!names.contains(&"idea_reply"));
assert_eq!(
tools.len(),
34,
"exactly the thirty-four exposed idea_* tools; got {names:?}"
names, expected_names,
"tools/list must expose exactly the canonical MCP catalogue"
);
drop(client); // EOF ⇒ serve loop ends