Repository navigation
Org-managed Dashboards: define, assign, and render granted MCP App dashboards - #4056
Merged
Merged
Conversation
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
reachjalil
enabled auto-merge (squash)
August 25, 2026 00:55
reachjalil
disabled auto-merge
August 25, 2026 00:55
![diff-warden[bot]](https://avatars.githubusercontent.com/u/118544361?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Warden security clearance: clear. No blocking findings (security or desktop↔den sync) in this diff (d113c5d86c990e1271f158332e5f0c0825691dce). 1 advisory desktop↔den sync note(s) were posted as review comments; they do not affect clearance. Automated clearance satisfies the required-review gate only — a human still reviews and merges. Analysis run
… mcp-apps endpoint dev retired DEN_REMOTE_MCP_APPS_ENABLED and the per-org remoteMcpApps capability (#4053), so the new /v1/mcp-connections/:id/mcp-apps route is now available whenever the caller is an org admin, matching the rest of the MCP Apps surface.
…nvokes The consent id for a granted dashboard element now fingerprints every material launch field (connection, tool, projected tool, resource URI, launch arguments), so editing any of them discards the member's stored approval and auto-launch and the changed app must be run manually again.
Regenerated with db:generate against dev's 0077 snapshot; the SQL is byte-identical to the previous 0077_warm_carlie_cooper migration and a rerun reports no schema changes.
Replace the 32-bit fingerprint with the URI-encoded canonical encoding of the element's launch-material fields, so no crafted element edit can collide with a previously approved identity, and fold requiresApproval in so an approval-policy change also resets stored consent.
reachjalil
force-pushed
the
feature/org-managed-dashboards
branch
from
August 25, 2026 16:47
d113c5d to
9cb7381
Compare
Contributor
There was a problem hiding this comment.
Warden security clearance: clear. No blocking findings (security or desktop↔den sync) in this diff (9cb7381e586fae973dbf98956b3c7fc86a603067). 1 advisory desktop↔den sync note(s) were posted as review comments; they do not affect clearance. Automated clearance satisfies the required-review gate only — a human still reviews and merges. Analysis run
This was referenced Aug 25, 2026
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #4045: the org-managed side of the MCP Apps dashboard. Organizations define Dashboards (ordered lists of MCP App elements), assign them to members and teams through the same grants mechanism connector assignment uses, and signed-in desktop users see the granted dashboards rendered above their own local tiles.
Den data model + API (
den-db,den-api)dashboardtable (org-owned: name, orderedelements_json, creator/created/updated audit fields, soft delete) anddashboard_access_granttable — an exact structural mirror ofconnector_instance_access_grant(one oforgMembershipId|teamId|orgWide=trueper row,role,removedAtsoft revoke, the same unique indexes). Migration0078generated withdb:generate(renumbered after dev's0077_drop_memory_bank);dsb/dsgtypeid prefixes appended.serverName, optionalconnectionId,toolName,projectedToolName,resourceUri(must beui://),title, optionallaunchArguments, optionalrequiresApproval. Per-user consent is never stored in Den.routes/org/dashboards.ts(all admin-gated withorgRoleRoute(["admin"])except the member listing):GET/POST /v1/dashboards,GET/PATCH/DELETE /v1/dashboards/:dashboardIdGET/POST /v1/dashboards/:dashboardId/access,DELETE .../access/:grantId— the same exactly-one-subject write schema, in-org target validation, and revoke/reactivate lifecycle the plugin-arch grants useGET /v1/me/dashboards— dashboards granted to the caller directly, via team, or org-wide (orgMemberRoute()+ member-teams resolution), consumed by the desktopGET /v1/mcp-connections/:connectionId/mcp-apps(inmcp-connections.ts, beside the/toolsinspector): enumerates a connection's app-visible MCP App launch tools in the exact element reference shape, mirroring the desktop app-host rules (gateway tools excluded, tool policy respected,ui://resource binding required, the single approval rule reported). Admin-only; theremoteMcpAppsEnabledrollout gate was dropped after dev retired that flag in feat(den): enable Code Mode and MCP Apps by default, retiring their rollout flags #4053 (MCP Apps are enabled by default now). Nothing is built on the internal capability catalog.Den web Manage section (
den-web)/dashboard/dashboards: list + create dialog./dashboard/dashboards/[dashboardId]: rename, add apps (per-connector picker backed by the newmcp-appsendpoint, with JSON launch input for apps that require it), reorder/remove elements, delete.Desktop consumption (
apps/app)createDenClient().listGrantedDashboards(orgId)→GET /v1/me/dashboardswith strict payload parsing (DenGrantedDashboard/DenDashboardElementwire types).autoLaunchunlocked only after this user's first successful manual run),requiresApprovalelements stay run-on-request, andcallMcpAppTool's server-side approval enforcement still backstops everything — a grant never bypasses launch approval. Consent lives in a localdashboardGrantedConsentstore scoped to Den user + org, mirroring the local entry scoping.onRemovebecame optional onMcpAppTile/DashboardTileShell, anddashboard-page.tsxgained the granted sections.Proof
ee/apps/den-api:bun test test/dashboards.test.ts— 6 pass (CRUD + element validation, admin-only management, exactly-one-subject + cross-org target rejection, grant list/revoke/reactivate lifecycle, and/v1/me/dashboardspositive and negative visibility across direct/team/org-wide/revoked/deleted).bun test test/mcp-connection-apps.test.ts— 4 pass (desktop naming convention parity, app-audience visibility rule, required-input detection).tsc --noEmitforee/apps/den-api,den-web(pnpm typecheck),@openwork/app,openwork-server;@openwork-ee/den-db+@openwork-ee/utilsrebuilt;db:generatereruns clean ("No schema changes").apps/app+apps/servertypecheck green;bun --conditions=development test src/mcp-app-host.test.ts— 23 pass.den-web: fullpnpm testsuite (including the updated sidebar IA test) — 138 pass.test/route-access-policy.test.ts/test/route-guard-policy.test.tsflag only pre-existing registrations in untouched files (codemode-scripts.ts,codemode-runs.ts,automations/index.ts, etc.) that flag identically ondev.Manual test steps (Manage flow)
ui://app bindings): open Manage → Dashboards, create a dashboard.openwork.mcpAppsDashboardflag (Settings → Advanced → Developer), and open Dashboard: the granted dashboard appears above the local tiles, labeled with its name, without Remove controls.Out of scope, per plan: manifest export/import, layout/drag-drop, per-element grant overrides, pinned-panel changes, end-user editing of granted dashboards.