From 98233b620c00d0dbb66b46a8821879b3846f459b Mon Sep 17 00:00:00 2001 From: mrhid6 Date: Tue, 8 Sep 2026 14:12:26 +0000 Subject: [PATCH] docs: fold the mcp task 12 token-form steps into the api keys redesign --- .../plans/2026-09-08-mcp-server.md | 22 ++++++++++++++----- 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/docs/superpowers/plans/2026-09-08-mcp-server.md b/docs/superpowers/plans/2026-09-08-mcp-server.md index 059ecfc..54c62c3 100644 --- a/docs/superpowers/plans/2026-09-08-mcp-server.md +++ b/docs/superpowers/plans/2026-09-08-mcp-server.md @@ -2297,9 +2297,19 @@ git commit -m "feat: let an agent create steps, workflows and monitors, inert un ### Task 12: Token form and agent access panel **Files:** -- Modify: `vantage-app/web/app/(app)/settings/` — the API tokens page and its token creation form - Modify: `vantage-app/web/app/(app)/settings/license/page.tsx:255-270` -- Modify: `vantage-app/web/lib/` — the API client's token creation call + +> **Scope reduced.** Steps 2 and 4 of this task — the tag restriction field and its +> chip in the key list — **are already built** by +> `docs/superpowers/plans/2026-09-08-api-keys-redesign.md`, which redesigned the +> same surfaces and absorbed them rather than have two plans rewrite one +> component from opposite ends. Steps 3 and 5 — gating the `mcp:*` scopes and the +> agent access panel — belong to that plan's Task 7, which waits on this plan's +> Tasks 6–11. **Only step 1 below is still this task's work.** +> +> Note also that the page is not under `settings/`: it is `/tokens`, rendered by +> `vantage-app/web/app/(app)/tokens/page.tsx`, with its body split across +> `vantage-app/web/components/apikeys/`. **Interfaces:** - Consumes: the `tag_selector` field on the token create request (Task 4), `license.features.mcp` from the existing licence response. @@ -2314,7 +2324,7 @@ In `vantage-app/web/app/(app)/settings/license/page.tsx`, beside the existing fe `licenceResponse.Features` is already a `map[string]bool` built from the licence, so no server change is needed for this to populate. -- [ ] **Step 2: Add the tag restriction field to the token form** +- [x] ~~**Step 2: Add the tag restriction field to the token form**~~ — done in the API keys redesign, `web/components/apikeys/TagRestriction.tsx`. Locate the token creation form (grep the settings directory for the scope checkbox list). Add a tag restriction control below the scopes, shown for **every** token regardless of licence — tag scoping is not gated. @@ -2322,15 +2332,15 @@ It offers the tag keys and values already in use across servers, which the fleet The field sends `tag_selector` as an object of key/value strings, omitted or `{}` when unrestricted. -- [ ] **Step 3: Add the MCP scopes and gate them** +- [ ] **Step 3: Add the MCP scopes and gate them** — moved to the API keys redesign plan, Task 7. `mcp:read` and `mcp:write` arrive automatically in the scope list from `GET /api/tokens/scopes`, so no hardcoding is needed. Hide or disable those two entries when `license.features.mcp` is false, matching how console-gated UI is handled elsewhere. -- [ ] **Step 4: Show the restriction in the token list** +- [x] ~~**Step 4: Show the restriction in the token list**~~ — done in the API keys redesign, `TagChips` in the ledger. In the token list, render a token's `tag_selector` as a chip beside its scopes, so "what can this credential reach" is answerable at a glance. An unrestricted token shows nothing rather than an empty chip. -- [ ] **Step 5: Add the agent access panel** +- [ ] **Step 5: Add the agent access panel** — moved to the API keys redesign plan, Task 7. On the API tokens settings page, add an **Agent access** panel visible only when `license.features.mcp` is true, containing: