Skip to content

feat(approval): endpoint declaration schema, matcher and path cleaning - #457

Open
nhuelstng wants to merge 4 commits into
mainfrom
feat/455-1-ask-declaration
Open

nhuelstng wants to merge 4 commits into
mainfrom
feat/455-1-ask-declaration

Conversation

@nhuelstng

@nhuelstng nhuelstng commented Nov 2, 2026 •

Copy link
Copy Markdown
Contributor

Issue: Refs #455

What

Why

Decision for #455: with an approvals block, unlisted routes ask instead of being refused. The field keeps its name approval to avoid churn.

Verification

  • go vet ./... clean. go test ./... on the top of the stack: all packages ok except internal/sandboxrun, where TestIntegrationWorkflowInterpretersRunnable, TestIntegrationWorktreeKnownLimitations and the flaky TestDenyScanCache* tests fail the same way on plain main in this VM (bwrap: execvp node).

Follow-up

🤖 Generated with Claude Code

@nhuelstng
nhuelstng force-pushed the feat/455-1-ask-declaration branch 2 times, most recently from 60f78ab to aa38875 Compare November 2, 2026 20:45
@nhuelstng nhuelstng changed the title feat(approval): declare routes that ask with ask feat(approval): endpoint declaration schema, matcher and path cleaning Nov 2, 2026
@nhuelstng
nhuelstng force-pushed the feat/455-1-ask-declaration branch from aa38875 to e421fcd Compare November 2, 2026 20:52
Mathias Burger and others added 4 commits November 2, 2026 21:55
…t declarations

Pure package: <METHOD|ANY> <path> patterns with {name} and trailing **,
most-specific-wins lookup, registration-time validation (no none on a
catch-all, no duplicate shape), CleanPath for dot segments, //, encoded
forms and a kept trailing slash, and method-override header stripping.

Refs #428

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Signed-off-by: Niclas Hülsmann <niclas.huelsmann@tngtech.com>
The block is decoded with unknown keys refused and validated at load, so a
misspelled key cannot weaken the declaration. Version 1 only; skills
without the block are unchanged.

Refs #428

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Signed-off-by: Niclas Hülsmann <niclas.huelsmann@tngtech.com>
…r the approval gate

Records what a sidecar receives today for dot-segment, encoded and
override-header requests, that a held request still streams SSE, that a
chunked upload is not buffered, and that a client disconnect is visible
for a held GET but not for a POST with an unread body.

Refs #428

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Signed-off-by: Niclas Hülsmann <niclas.huelsmann@tngtech.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Signed-off-by: Niclas Hülsmann <niclas.huelsmann@tngtech.com>
@nhuelstng
nhuelstng force-pushed the feat/455-1-ask-declaration branch from e421fcd to 1938b39 Compare November 2, 2026 20:55
@nhuelstng
nhuelstng added this pull request to stack #461 November 2, 2026 20:57

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant