starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-09-21 16:02:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: restore the covered API-catalog names for the raw-app endpoints

Browse Source 
`COVERED_ENDPOINTS` is matched against `EndpointTool.name`, which openapi.yaml
overrides with `x-mcp-tool-name` for these two operations: `createAppRawSource`
and `updateAppRawSource` are served as `createApp` and `updateApp`
(`mcp/auto_generated_endpoints.rs`). Keying them by operationId left both raw-app
POST endpoints discoverable and callable through the API catalog tools. Restore
the exposed names and record why they differ from the operationIds.
This commit is contained in:
AlexRV12
2026-09-09 14:20:20 +02:00
parent baaa7c10d2
commit 9e753479a3
2 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/src/lib/components/copilot/chat/global/apiCatalogTools.ts
+6 -3
View File
@@ -45,9 +45,12 @@ const COVERED_ENDPOINTS: Record<string, string> = {
createScript: 'write_script',
createFlow: 'write_flow',
updateFlow: 'patch_flow_json or write_flow',
// The catalog exposes the raw-source app endpoints, not `createApp`/`updateApp`.
createAppRawSource: 'init_app and the app draft tools',
updateAppRawSource: 'write_app_file / write_app_runnable',
// Keyed by the name the catalog exposes (`EndpointTool.name`), which is the
// `x-mcp-tool-name` override where openapi.yaml sets one — not the operationId.
// These two are the only overrides: operations `createAppRawSource` /
// `updateAppRawSource`, served as `createApp` / `updateApp`.
createApp: 'init_app and the app draft tools',
updateApp: 'write_app_file / write_app_runnable',
createVariable: 'write_variable',
updateVariable: 'write_variable',
createResource: 'write_resource',
frontend/src/lib/components/copilot/chat/global/sessionToolset.ts
+3 -5
View File
@@ -59,11 +59,9 @@ export const SESSION_TOOL_POLICIES: Record<string, SessionToolPolicy> = {
exec_datatable_sql: RUN_PREVIEW,
// ── API catalog and MCP ─────────────────────────────────────────────────
// No capability needed: COVERED_ENDPOINTS in apiCatalogTools refuses the authoring
// and delete endpoints for everyone, leaving reads and run-by-path. That list is
// keyed by operationId and the server serves the catalog unfiltered, so it holds
// only as long as it tracks the catalog — the server, not this table, is what
// actually refuses a call that slips through.
// No capability needed: every endpoint these can reach is a read or a run-by-path.
// The authoring and delete endpoints are refused for everyone by COVERED_ENDPOINTS
// in apiCatalogTools, so there is no per-role cut left to make here.
search_api_endpoints: NONE,
call_api_get: NONE,
call_api_endpoint: NONE,