Repository navigation
[#823] Bundle atomic install no longer blanket-rejects {workspace} MCP placeholders - #1061
Merged
Merged
Conversation
四条随包套件(bundle:office/research/dev/design)此前全部装不上。勘破(实读,非推断):
- bundle:office/research/dev 的必需成员(mcp:filesystem/git/alpha-excel)全带 {workspace}
占位,撞在 classifyBundleChild 一条继承自 REQ-100(2026-07-13)落地时旧语义的早退分支上——
彼时 deriveMcpConfig 要求 {workspace} 必须由调用方显式传 grant,bundle 安装无 grant 通道,
故预先短路拒绝。REQ-134(#1011,2026-08-18)把语义改成「{workspace} 留字面量写盘、引擎在
spawn 时按当前 instance 目录替换」之后,deriveMcpConfig(spec, {}) 对该占位不再需要任何
grant、也不会失败——这条早退分支从此不再拦截任何 deriveMcpConfig 真会失败的东西,只是把
合法安装挡在一句过期文案后面。单装(global scope)路径已经不做这个检查、直接靠
applyMcpWritePolicy(同一份策略闸)校验,bundle 路径此前没跟进这个变化。
- issue 提到的 "mcp:excel ... secret/Excel MCP not supported" 经隔离测试证实与上面是同一条
根因(workspace-policy 早退),不是一条独立的具名拒绝——alpha-excel 没有 requiredEnvVars,
从未触发过 secret-bearing 分支。
- bundle:design 的必需成员是两个远程技能、不含 MCP,从未受此 bug 影响,一直能通过
authorize→confirm 装成;只是复测面顺带把它也钉进新回归测试。
- #697(mixed Bundle,secret MCP 一次授权一次事务)只改了新的 package-envelope 路径
(package-admission.ts),从未触碰这个 legacy bundleItems[] 路径,所以这里的 "phase 1"
没有被那次改动隐式解除——需要本票显式清掉。
修复:classifyBundleChild 移除 {workspace}/isWorkspacePolicyMcp 的早退拒绝,让 bundle 内的
MCP 子项和单装一样只靠 applyMcpWritePolicy 把关(该函数已经正确处理字面量占位与 Alpha
Office 身份/安全校验,行为与移除前逐字节一致——只是不再提前短路)。secret-bearing 早退
(claimMcpSecretVersionDir/writeMcpSecretVersioned 发生在事务边界外)原样保留不动,四条
套件的必需成员都不需要它。
验证:
- 用真实 alpha-catalog.json 驱动 installCatalog 端到端跑通全部四条套件(新增回归
describe 块,固定在 ext-install-planner.test.ts 末尾)。
- 修正一条断言旧行为的既有用例(REQ-133 workspace registry),改为断言「合规条目现在装得上」
+「伪造/畸形条目仍被 applyMcpWritePolicy 挡」两个 case,证明移除早退分支没有削弱 REQ-133
的身份/安全校验。
- ext-install-planner.test.ts 全量 132 pass / 0 fail;tsgo -b 全仓 typecheck 通过。
Fixes #823
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UuSREGt99fbojBb1gWZYR9
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix bundle-child install planner so catalog suites with `{workspace}` placeholders can install when granted.
Fixes #823
Test plan
Made with Cursor