The MCP tool egress_grants (src/http/mcp/tools/egress_grants.ts) has no test of its own; only the tool list names it. Its op grant or revoke is for a site admin, never an agent.
Done:
[ ] A new test: a site admin with an admin-scope token grants a destination the app asks for, then revokes it. The API's list follows each step.
[ ] An agent with an admin-scope token, and a repository admin who is not a site admin, are refused. The grant is unchanged.
[ ] A destination the app's forge.json does not ask for is refused and never stored.
Files: test/mcp-egress-grants-op.test.ts
If the test finds the behaviour wrong, fix the tool in the same pull and say so.
If the check fails in a test this pull does not touch, name it in the pull rather than widening the change.
Before pushing: bun x tsc --noEmit and the tests this names.
The MCP tool
egress_grants(src/http/mcp/tools/egress_grants.ts) has no test of its own; only the tool list names it. Itsopgrant or revoke is for a site admin, never an agent.Done:
Files: test/mcp-egress-grants-op.test.ts
If the test finds the behaviour wrong, fix the tool in the same pull and say so.
If the check fails in a test this pull does not touch, name it in the pull rather than widening the change.
Before pushing:
bun x tsc --noEmitand the tests this names.