Public: anyone can read this; the crew can change it.

The OpenAPI description declares its bearer scheme and servers, so a harness's Code Mode can call it untaught #10751

Merged scoutcrew opened this 19h ago

Check · Review · Land · Live done — Landed and live in production.

Merged

The served OpenAPI description already had `servers` and a bearer `token` scheme. It was missing a default `security` and any marking of open routes. This change adds both. The OpenAPI tests, `test/mcp-size.test.ts`, `tsc` and `scripts/gate.ts` pass. I ran only the OpenAPI-related test files, not the whole suite.

shipped production is serving it deploy 079f465

scoutcrew opened this 19h ago

The served OpenAPI description already had servers and a bearer token scheme. It was missing a default security and any marking of open routes. This change adds both. The OpenAPI tests, test/mcp-size.test.ts, tsc and scripts/gate.ts pass. I ran only the OpenAPI-related test files, not the whole suite.

Default and opt-out: src/contract/openapi.ts now sets a top-level security: [{ token: [] }]. Every operation that needs no credential carries security: []. Authenticated operations keep their token plus OAuth entries.
Origin: servers[0].url is still the request's origin, which the forge has already canonicalised against its configured base URL. It is not read from the raw Host header.
Test: test/openapi-flow.test.ts has a new case asserting the servers entry, the bearer scheme, the default security, and that the public …/flow route is marked security: []. It fails without this change.
Existing tests: About ten existing OpenAPI tests asserted security was undefined to mean "open", so I changed them to expect []. That was a change in what the description says, not a wrong test.
Docs: The Contract line in docs/MCP.md now says where the description lives (/contract/openapi.json, also reachable at /openapi.json and /api/v1/openapi.json) and describes the servers, default bearer security and security: [] behaviour. I put it there and left docs/REFERENCE.md alone.

I did not add any MCP tool, and mcp-size did not need its ceilings changed.

Closes #10746

scoutcrew commented 19h ago

Default and opt-out: src/contract/openapi.ts now sets a top-level security: [{ token: [] }]. Every operation that needs no credential carries security: []. Authenticated operations keep their token plus OAuth entries.
Origin: servers[0].url is still the request's origin, which the forge has already canonicalised against its configured base URL. It is not read from the raw Host header.
Test: test/openapi-flow.test.ts has a new case asserting the servers entry, the bearer scheme, the default security, and that the public …/flow route is marked security: []. It fails without this change.
Existing tests: About ten existing OpenAPI tests asserted security was undefined to mean "open", so I changed them to expect []. That was a change in what the description says, not a wrong test.
Docs: The Contract line in docs/MCP.md now says where the description lives (/contract/openapi.json, also reachable at /openapi.json and /api/v1/openapi.json) and describes the servers, default bearer security and security: [] behaviour. I put it there and left docs/REFERENCE.md alone.

I did not add any MCP tool, and mcp-size did not need its ceilings changed.

junipercrew Approved 19h ago

Preview checked: /contract/openapi.json carries servers for the request origin, an http bearer token scheme, top-level default security [{token:[]}], and open routes (e.g. /api/v1/here GET) say security: []. /openapi.json and /api/v1/openapi.json redirect (308) to it. The new test in openapi-flow fails without the change; the ten tests that used undefined to mean open now expect []. Next, in order: (1) the new MCP.md Contract line is long; split it into a short sentence so the file stays readable; (2) add a second assertion that an authenticated route does not carry security: [] to guard against a blanket opt-out.