devin-ai-integration[bot] d7e6154863 fix(mcp): resolve team-granted toolsets for non-admin keys and dashboard sessions (#43908) ... * fix(mcp): expand team and dashboard grants when listing and serving toolsets Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(mcp): honor team toolset grants on the responses gateway path and expose a public team permission lookup Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * chore(mcp): drop the toolset route docstring tweak so the OpenAPI snapshot stays unchanged Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(mcp): scope inherited toolset grants by the key's own MCP ceiling A key that declares any MCP grant of its own keeps only its own toolsets, one that declares none inherits its team's, and require_key_mcp_access_defined stops a virtual key inheriting while dashboard sessions and admitted users still do. Adds the direct, no-grant, admin and key-ceiling integration cases and makes the LLM gateway toolset case discriminate a scoped toolset from the aggregate grant Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(mcp): resolve toolset grants per admitted source and enforce the live team roster Dashboard sessions and gateway-admitted users now expand into the admitted subject's per-team sources when resolving toolset grants, so a team-granted toolset is not capped by the user's own MCP row and is reachable on the namespaced route. A cached team id no longer grants a toolset unless the live roster still lists the user, a team lookup fault only drops that team's inherited grant, and /team/member_add evicts the cached team object so the new member is authoritative immediately Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(mcp): read a key's named object permission before letting it inherit team toolsets Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * refactor(mcp): inject the toolset grant resolver into scope helpers so tests stop patching MCPRequestHandler Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(mcp): drop the duplicate admitted_subject_sources wrapper after merging main and follow its renamed resolvers Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(mcp): honour fresh policy and the session resource scope on pinned toolsets A pinned toolset scope now reads the toolset through the writer when the admitted session requires fresh policy, so a tool revoked from the toolset is gone on the next request. A gateway bearer scoped to one server can only open a toolset that names that server Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(mcp): keep operator-open servers out of toolset gateway urls Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * test(mcp): audit cells for team-granted toolsets across every surface Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * test(mcp): bound toolset edit convergence by both cache layers Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * test(mcp): drop toolset integration cells that test behavior this PR does not change Repeat-read byte identity, 20 concurrent calls, a stopped peer and a killed worker are covered generically by test_mcp_resilience.py and test_mcp_user_env_vars.py. The toolset edit cell asserts pre-existing cache propagation and flaked locally with connection resets while polling * chore(mcp): drop mutable-ok suppressions that main's LIT013 now flags as unused * chore(mcp): keep the require_key_mcp_access_defined read from adding an unknown-argument type error --------- Co-authored-by: ryan <ryan@berri.ai> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>		2026-10-01 14:15:06 -07:00
..
litellm_completion_transformation	fix(responses): emit the reasoning item on streaming /v1/responses for signature-only thinking (#43414)	2026-09-27 04:51:56 +00:00
mcp	fix(mcp): resolve team-granted toolsets for non-admin keys and dashboard sessions (#43908)	2026-10-01 14:15:06 -07:00
__init__.py
test_additional_tools.py
test_custom_tool_call.py
test_dispatch.py	feat(rust): connect Python inference bindings to shared routes (#43465)	2026-09-27 19:05:39 -07:00
test_metadata_codex_callback.py
test_no_duplicate_spend_logs.py
test_null_test_fix.py
test_responses_api_bridge_flag.py	fix(params): validate stream_chunk_size once, before any provider call (#43222)	2026-09-26 23:01:20 +00:00
test_responses_api_request_body.py
test_responses_prompt_management.py	feat(guardrails): scan retrieved vector store chunks with the request's pre-call guardrails (#43271)	2026-09-26 14:18:38 -07:00
test_responses_router_cooldown.py
test_responses_streaming_iterator.py
test_responses_supported_endpoints_passthrough.py
test_responses_utils.py
test_responses_websocket_all_providers.py
test_rust_bridge_websocket.py
test_sse_output_recovery.py
test_streaming_iterator.py	fix(responses): run stream failure and success hooks on the iterating loop instead of blocking it (#43270)	2026-09-26 12:22:22 -07:00
test_streaming_iterator_error_events.py
test_text_format_conversion.py