From a4b7089ac68ea9e19e8cd21eb45ecaf8d44a5052 Mon Sep 17 00:00:00 2001 From: Dave Date: Thu, 1 Oct 2026 00:36:55 +0200 Subject: [PATCH] docs(giellie): document args-aware policy, trust semantics, env and PB rules Also log the upstream assertBrowserSession 401s for orders.review, orders.find_duplicates and dashboard.daily_summary as an open MCP request. Co-Authored-By: Claude Sonnet 5.5 --- AGENTS.md | 17 ++++++++++++++++- src/app/api/mcp/FEATURE-REQUESTS.md | 8 ++++++++ 2 files changed, 24 insertions(+), 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index 562fb24..10c1067 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -137,6 +137,7 @@ hook utils — add new auto-updated fields there. The hook files are deployed by hand into the PB server's `pb_hooks/` (like select values, it's a manual step on the live instance). + # Giellie agent (`/giellie`) — tools come from the MCP, policy lives in one file The sidebar "Giellie Agent" is a MiniMax chat agent (`src/lib/server/giellie-*.ts`, @@ -154,5 +155,19 @@ in-process — a new MCP tool is automatically available to Giellie. without that check. - Config (key, model, base URL, on/off) is the existing `/settings/ai` row; Giellie uses its own system prompt in `giellie-system-prompt.ts`. +- Classification is **args-aware**: use `classifyToolCall(name, input)` (not bare + `classifyTool`) for routing. A plain write whose input carries a contact-routing key + (`email*`, `bcc`, `cc`, `sender`, `recipient`, any depth ≤ 4) is escalated to "confirm". + `quotes.re_run_ai` is denied (it wipes every quote item); `orders.cancel`, + `delivery_notes.cancel` and `delivery_notes.combine` always ask. +- The "Trust this chat" toggle is **per chat** and only auto-approves ordinary writes. + It never covers confirm-class actions: email/PO sends, cancels/merges, and changes to + email/contact fields. +- Env: `AGENT_API_KEY` (server-side MCP auth, required) and, in containers, + `AGENT_API_BASE_URL` (a full `https://` origin) so the MCP's loopback calls reach the + app; scheme-less values like `localhost:4001` are ignored. - The `giellie_chats` collection is created by `npm run pb:migrate:giellie-chats` - (manual step on the live PB, like select values and pb_hooks). + (manual step on the live PB, like select values and pb_hooks). Its API rules are + stricter than the original spec: users may list/view their own chats only; + create/update/delete are null (all writes go through the admin client in + `giellie-chat-store.ts`). diff --git a/src/app/api/mcp/FEATURE-REQUESTS.md b/src/app/api/mcp/FEATURE-REQUESTS.md index 59fb27e..c610810 100644 --- a/src/app/api/mcp/FEATURE-REQUESTS.md +++ b/src/app/api/mcp/FEATURE-REQUESTS.md @@ -20,6 +20,14 @@ When one ships, move it to **Implemented** with a one-line commit/PR reference. ## Open requests +### `orders.review`, `orders.find_duplicates`, `dashboard.daily_summary` 401 through the MCP +- **Surfaced:** 2026-10-01 — whole-branch review of the Giellie agent. These three MCP handlers fetch upstream routes (`/api/v1/orders/[id]/review`, `/api/v1/orders/duplicates`, `/api/v1/dashboard`) that are guarded by `assertBrowserSession` (expects a PocketBase user token), but the MCP forwards `Bearer AGENT_API_KEY`, so the upstream call 401s. Affects both Hermes and Giellie. +- **Workaround:** none through the MCP; the operator uses the dashboard pages directly. +- **Severity:** now — `dashboard.daily_summary` and `orders.find_duplicates` are routinely asked for. +- **Suggested fix:** let those routes accept the agent key (`assertAgentAuth`, as other `/api/v1` routes called by the MCP do), or have the MCP handlers call the underlying services directly instead of looping back over HTTP. +- **Schema needs:** none +- **Open questions:** should the agent key be accepted in addition to, or instead of, the browser session on these routes? + ### ~~Orders: filter by customer~~ **Resolved 2026-08-16 (Phase H).** `orders.list({customer, createdAfter, createdBefore, status})` shipped — see Implemented.