Skip to content

Final done-check residuals (Spec 108/109 UX effort) #1466

Closed
#1484
Closed
Final done-check residuals (Spec 108/109 UX effort)#1466
#1484
Labels
kind/bugSomething isn't workingpriority/lowNice to have; address when bandwidth allowstriage/acceptedTriaged and accepted for the backlog

Description

@Dumbris
Dumbris
opened on Oct 2, 2026

Low-severity residuals from the final definition-of-done check on main d7efa80 (Spec 108/109 UX effort). The medium items are being fixed in dedicated PRs.

  • Access explainer, PATCH /config and retrieve_tools:
    • PATCH /config returns "No configuration changes detected" even when the change was applied.
    • retrieve_tools returns profile: null when nothing is hidden.
  • connect codex writes the credential as ?apikey= in the URL. Check whether Codex supports a header and use that instead.
  • Client rows still use emoji instead of logos (O3 residual).
  • Home still says "Browse Registry", and Settings headings still carry emoji (N7 residual).
  • Tool definitions aren't captured automatically for a newly imported quarantined server, and the Tools tab still points to a "Security tab" (S2 residual). This is handled in the review-screen PR if a safe path exists.
  • The expandable Clients row gives no visual hint that it expands; its Activity, Sessions, Tools and Usage links are hidden inside.
  • Activity: the "Success" text is visible to screen readers only, and the Scope column disappears at 900 px.
  • The lock warning in the Connect dialog's "Require authentication…" navigates away and loses the half-done connect.
  • Copy glitches: "finish this step.2 imported servers"; "No importable servers found" shown next to "2 servers imported".
  • Flakes:
    • test-api-e2e.sh launcher-test reconnect check fails intermittently (also at baseline 638fa80).
    • shellwrap tests time out under load.
    • The activity-views vitest test timed out once.
  • Follow-ups from Spec 108-c client credentials review (#1389) #1395 item 4 looks stale (fixed at mcp.go:541); verify it and close it.

Activity

  1. Dumbris
    added
    kind/bugSomething isn't working
    priority/lowNice to have; address when bandwidth allows
    triage/acceptedTriaged and accepted for the backlog
    on Oct 2, 2026

  2. Dumbris commented on Oct 2, 2026

    @Dumbris
    Dumbris
    on Oct 2, 2026
    MemberAuthor

    Remaining lows from #1467:

    • frontend/src/views/Activity.vue:2062 (showBlockedOffer): "Show N blocked attempts" does nothing when an explicit type override excludes policy_decision.
    • frontend/src/views/Home.vue:47: on a fresh instance the usage strip flashes before the servers store loads.
    • frontend/src/views/ServerDetail.vue:1931/1963: after an optimistic disable or quarantine, the Health tile still reads "Online" until the next refresh.
    • native/macos/MCPProxy/MCPProxyTests/HomeTokenSavingsBadgeTests.swift:54: the test checks the whole source file, so it can't detect the card losing its shared estimate label.
    • Opening /servers/<disabled server> logs a console error from a 500 ("Failed to get logs: server not found").

  3. Dumbris commented on Oct 2, 2026

    @Dumbris
    Dumbris
    on Oct 2, 2026
    MemberAuthor

    Remaining lows from catalog ranking PR #1469:

    • internal/registries/listing_cache.go:146 matchCachedEntry matches literal substrings only, so a multi-word query like "github actions" misses hyphenated names in the cached fallback.
    • internal/registries/catalog.go:585 namespaceOwner skips second-level suffixes without checking the first label is a country code (com.org.github/x → owner "github"). This feeds Verified and stars.
    • internal/registries/catalog.go:496: residual Verified-badge spoofing via generic domain labels (labs/tools/mcp). Narrower than before the PR, and not a regression.
    • docs/api/rest-api.md:1004 and docs/cli/catalog-commands.md:37: the "verified" wording doesn't cover the trusted Docker/reference exception.
    • specs/109-ux-navigation-consistency/quickstart.md:130: the recipe says 3 official requests per typed search, but its multi-word step makes 4.

  4. Dumbris commented on Oct 2, 2026

    @Dumbris
    Dumbris
    on Oct 2, 2026
    MemberAuthor

    Remaining lows from review-screen PR #1470:

    • internal/runtime/review.go:341-347 with internal/server/review_capture.go:49: coverage matches scan to record by tool name only. A server serving a benign definition to the scanner and a poisoned one at capture can read "clean". Fix: store per-tool definition hashes (or export time) in ScanContext. The approval gate re-scans independently, so this is a documented residual.
    • cmd/mcpproxy/review_cmd.go:259-264: with no scan.coverage (older core), the CLI prints no Scan line, while Web and macOS read it as "none".
    • specs/109-ux-navigation-consistency/contracts/mcp-tools.md:8: the server_summary.scan coverage sentence only holds on the captured branch of inspect_quarantined/inspect_tools.
    • frontend/src/components/ReviewScreen.vue:95-98,131: an in-flight rescan error from server A can overwrite server B's state after switching servers. Fix: capture the server name at call time.

  5. Dumbris commented on Oct 2, 2026

    @Dumbris
    Dumbris
    on Oct 2, 2026
    MemberAuthor

    Remaining lows from CLI/security PR #1472:

    • cmd/mcpproxy/registry_cmd.go:632: loadRegistryConfig swallows load errors. An explicit global -c pointing at a missing file isn't reported as CONFIG_NOT_FOUND for registry or catalog commands.
    • cmd/mcpproxy/cli_config.go:30-35: the "data-dir given, no config anywhere" branch uses DefaultConfig() and skips the MCPPROXY_LISTEN/TLS env overrides.
    • cmd/mcpproxy/doctor_redact.go:23: doctorURLPattern stops at an apostrophe, so a percent-encoded credential parameter after an apostrophe in the same URL escapes redaction (?label=Bob's&%74oken=...).

  6. Dumbris commented on Oct 2, 2026

    @Dumbris
    Dumbris
    on Oct 2, 2026
    MemberAuthor

    Remaining lows from Web user-test PR #1473:

    • frontend/src/components/OnboardingWizard.vue:901-904 and utils/onboardingServersStep.ts:44-47: "including the N you just imported" assumes this session's imports were quarantined, which isn't true when the quarantine box was unchecked.
    • frontend/src/components/ImportServers.vue:267: paste/file import emits names.length rather than summary.imported, so re-applying already-existing servers counts as new imports.
    • internal/httpapi/import.go:300-313: a {} config previewed without a format hint still returns 400, while the swagger text promises 200. Only the paste-mode Quick-import button hits this path.

  7. Dumbris commented on Oct 2, 2026

    @Dumbris
    Dumbris
    on Oct 2, 2026
    MemberAuthor

    Remaining lows from telemetry/macOS PR #1471:

    • frontend/src/components/TelemetryBanner.vue:116-118: the effective telemetry state is fetched only on mount, so a notice left open can show an obsolete mode.
    • specs/109-ux-navigation-consistency/parity-matrix.json:1566: row 28a cites telemetry_cmd_test.go for telemetry status, but that file doesn't assert it.
    • specs/109-ux-navigation-consistency/parity-matrix.json:1673: row 29a cites status_telemetry_test.go, which never asserts status.listen_addr.

  8. Dumbris commented on Oct 2, 2026

    @Dumbris
    Dumbris
    on Oct 2, 2026
    MemberAuthor

    From live QA of #1468: a nested call_tool to a server outside a profile-bound agent token's scope is refused by the token server check ("token does not have access to server 'fx'", ACCESS_DENIED). Its child tool_call record has no block_reason. A nested tier refusal correctly records block_reason=profile_tier. Server-scope refusals for profile-bound callers should probably carry a profile scope reason too, for consistent Activity filtering and the "Why?" view.

    • Add a block_reason for nested server-scope refusals of profile-bound tokens and client credentials.

  9. Dumbris commented on Oct 2, 2026

    @Dumbris
    Dumbris
    on Oct 2, 2026
    MemberAuthor

    Remaining lows from telemetry/macOS PR #1471:

    • frontend/src/utils/telemetryState.ts:55 and internal/httpapi/server.go:5675-5710: the Raw JSON telemetry lock is enforced only in the client. A duplicate case-variant key can store telemetry.enabled; at runtime the env override still forces it off. Enforce the lock on the server, or reject case-variant duplicates of locked keys.
    • native/macos/MCPProxy/MCPProxy/Settings/ConfigSettingsView.swift:121-126: adoptRunningListenIfBlank refills a deliberately cleared listen field on the next status refresh. It can also mark an unsaved typed value as clean when it happens to match the running address.

  10. Dumbris commented on Oct 2, 2026

    @Dumbris
    Dumbris
    on Oct 2, 2026
    MemberAuthor
  11. Dumbris
    added 16 commits that reference this issue on Oct 5, 2026

    fix(cli): CLI contract follow-ups (exit codes, stdout purity, scope v…

    39fd306

    fix(httpapi,runtime): API correctness follow-ups (404 logs, empty sco…

    e023d9f

    fix(web): Spec 109 UI lows (Activity blocked offer, Home flash, healt…

    75c98c2

    fix(macos): activity/home/settings follow-ups (sticky from/to, sessio…

    949d55e

    fix(registries): catalog matching, namespace owner, Verified wording …

    b1c5e8b

    fix(jsruntime): record block_reason profile_server_scope on nested se…

    b589634

    test(macos): make Swift guard tests able to fail (ToolTier golden, SC…

    c4b1f2b

    fix(registries): deny generic domain labels in Verified owner matching (

    40eabec

    fix(web): clients presence, upgrade done step, explainer scope and im…

    b20a347

    fix(macos): clientDetail route filter, connect binding fallback and l…

    bedbe4b

    fix: follow-ups from review of the catalog, telemetry and e2e cleanup…

    ed99a36

    docs(connect): document the Codex apikey query credential limitation (#…

    936edd0

    fix(frontend): catalog wording, review copy, clients expander and act…

    3b81d16

    fix(httpapi): empty import preview on paste/upload and stale-classifi…

    682e2af

    Merge origin/main and align smart-mcp-proxy#1466 tests with main's ho…

    6d41efb

    fix(review): bind scan coverage to per-tool definition hashes (#1533)

    53e541d
  12. Dumbris
    closed this as completedin #1484on Oct 10, 2026
  13. DScoNOIZ
    added a commit that references this issue on Oct 18, 2026

    fix: detect config changes for require_mcp_auth and handle residual e…

    8282c38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    kind/bugSomething isn't workingpriority/lowNice to have; address when bandwidth allowstriage/acceptedTriaged and accepted for the backlog

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions