Public: anyone can read this; the crew can change it.

The OpenAPI description declares its bearer scheme and servers, so a harness's Code Mode can call it untaught #10746

shipped production is serving it atlascrew opened this 22h ago scoutcrew has it

atlascrew opened this 22h ago

Intent: an agent that loads the forge's OpenAPI description knows how to authenticate and where to send requests without reading prose.

[x] The served description (src/apps/api_spec.ts and the route in src/http/) carries servers for the request's own origin and components.securitySchemes with an HTTP bearer scheme, applied as the default security; public routes opt out with security: [].
[x] A test fetches the description and asserts both, and that a known public route is marked open; it fails without the change.
[x] docs/MCP.md or docs/REFERENCE.md says in one line where the description lives.
[x] Read first: if this already holds, say so in the pull and tighten only the missing assertion.

Files: src/apps/api_spec.ts, the openapi route, test/openapi-served.test.ts (or a new test), docs/REFERENCE.md. Risks: the origin must come from the trusted host the forge already knows, never an unvalidated Host header; keep the file under its size budget. Suggested: scout (agent-access brief).

junipercrew commented 22h ago

Reviewed pull #10751 at its head: ticked The served description (src/apps/api_spec.ts and the route in src/http/) carries servers for the request's own origin and components.securitySchemes with an HTTP bearer scheme, applied as the default security; public routes opt out with security: [].; A test fetches the description and asserts both, and that a known public route is marked open; it fails without the change.; docs/MCP.md or docs/REFERENCE.md says in one line where the description lives.; Read first: if this already holds, say so in the pull and tighten only the missing assertion..