Skip to content

docs(#4697): extend @visibility guidance to entity provider packages - #4700

Open
fullsend-ai-coder[bot] wants to merge 1 commit into
mainfrom
agent/4697-extend-visibility-guidance
Open

docs(#4697): extend @visibility guidance to entity provider packages#4700
fullsend-ai-coder[bot] wants to merge 1 commit into
mainfrom
agent/4697-extend-visibility-guidance

Conversation

@fullsend-ai-coder

Copy link
Copy Markdown
Contributor

Add a "Config declarations in entity provider packages" subsection to the boost AGENTS.md, placed after the existing "Adding new config fields" section. This covers ogx-entity-provider and kagenti-entity-provider, which maintain their own config.d.ts files outside the centralized Zod schema system.

The new guidance instructs agents to: 1. Declare every field the config reader reads in config.d.ts 2. Add @visibility backend/secret annotations on sensitive fields 3. Reuse utilities from boost-connector-utils instead of duplicating

This addresses the gap where the code agent omitted @visibility annotations on security-sensitive fields in PR #4574 because the existing guidance was scoped only to boost-backend.

Co-Authored-By: Claude Opus 4.6 noreply@anthropic.com


Closes #4697

Post-script verification

  • Branch is not main/master (agent/4697-extend-visibility-guidance)
  • Secret scan passed (gitleaks — 6199e863193f683e7175922f87c8124dd5502b20..HEAD)
  • Pre-commit hooks passed (authoritative run on runner)
  • Tests ran inside sandbox

Add a "Config declarations in entity provider packages" subsection to
the boost AGENTS.md, placed after the existing "Adding new config
fields" section. This covers ogx-entity-provider and
kagenti-entity-provider, which maintain their own config.d.ts files
outside the centralized Zod schema system.

The new guidance instructs agents to:
1. Declare every field the config reader reads in config.d.ts
2. Add @visibility backend/secret annotations on sensitive fields
3. Reuse utilities from boost-connector-utils instead of duplicating

This addresses the gap where the code agent omitted @visibility
annotations on security-sensitive fields in PR #4574 because the
existing guidance was scoped only to boost-backend.

Closes #4697

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@fullsend-ai-coder fullsend-ai-coder Bot added the ready-for-review Agent PR ready for human review label Sep 10, 2026
@sonarqubecloud

Copy link
Copy Markdown

@codecov

codecov Bot commented Sep 10, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.63%. Comparing base (6199e86) to head (0e22722).
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #4700   +/-   ##
=======================================
  Coverage   62.63%   62.63%           
=======================================
  Files        2635     2635           
  Lines      105225   105225           
  Branches    29539    29551   +12     
=======================================
  Hits        65909    65909           
  Misses      37462    37462           
  Partials     1854     1854           
Flag Coverage Δ *Carryforward flag
adoption-insights 84.77% <ø> (ø) Carriedforward from 6199e86
ai-integrations 78.80% <ø> (ø) Carriedforward from 6199e86
app-defaults 53.07% <ø> (ø) Carriedforward from 6199e86
augment 46.67% <ø> (ø) Carriedforward from 6199e86
boost 83.46% <ø> (ø)
bulk-import 73.12% <ø> (ø) Carriedforward from 6199e86
cost-management 13.35% <ø> (ø) Carriedforward from 6199e86
dcm 73.47% <ø> (ø) Carriedforward from 6199e86
e2e-adoption-insights 60.00% <ø> (ø) Carriedforward from 6199e86
e2e-extensions 62.31% <ø> (ø) Carriedforward from 6199e86
e2e-global-header 49.71% <ø> (ø) Carriedforward from 6199e86
e2e-homepage 61.11% <ø> (ø) Carriedforward from 6199e86
e2e-intelligent-assistant 46.74% <ø> (ø) Carriedforward from 6199e86
e2e-orchestrator 49.52% <ø> (ø) Carriedforward from 6199e86
e2e-orchestrator-plugin 49.51% <ø> (ø) Carriedforward from 6199e86
e2e-quickstart 55.21% <ø> (ø) Carriedforward from 6199e86
e2e-scorecard 50.05% <ø> (ø) Carriedforward from 6199e86
e2e-theme 16.36% <ø> (ø) Carriedforward from 6199e86
extensions 57.37% <ø> (ø) Carriedforward from 6199e86
global-floating-action-button 71.18% <ø> (ø) Carriedforward from 6199e86
global-header 67.88% <ø> (ø) Carriedforward from 6199e86
homepage 48.48% <ø> (ø) Carriedforward from 6199e86
install-dynamic-plugins 71.94% <ø> (ø) Carriedforward from 6199e86
intelligent-assistant 76.51% <ø> (ø) Carriedforward from 6199e86
konflux 91.98% <ø> (ø) Carriedforward from 6199e86
lightspeed 69.02% <ø> (ø) Carriedforward from 6199e86
mcp-integrations 84.46% <ø> (ø) Carriedforward from 6199e86
orchestrator 72.02% <ø> (ø) Carriedforward from 6199e86
quickstart 63.74% <ø> (ø) Carriedforward from 6199e86
sandbox 79.56% <ø> (ø) Carriedforward from 6199e86
scorecard 88.20% <ø> (ø) Carriedforward from 6199e86
theme 87.91% <ø> (ø) Carriedforward from 6199e86
translations 5.12% <ø> (ø) Carriedforward from 6199e86
x2a 77.18% <ø> (ø) Carriedforward from 6199e86

*This pull request uses carry forward flags. Click here to find out more.


Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 6199e86...0e22722. Read the comment docs.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@fullsend-ai-review

fullsend-ai-review Bot commented Sep 10, 2026

Copy link
Copy Markdown

🤖 Review · ⚠️ Cancelled · Started 9:15 PM UTC · Ended 9:15 PM UTC

Commit: 0e22722 · View workflow run →

@fullsend-ai-review

fullsend-ai-review Bot commented Sep 10, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 9:17 PM UTC · Completed 9:22 PM UTC

Commit: 0e22722 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Cost: $1.01

@fullsend-ai-review

Copy link
Copy Markdown

Review — approve

Scope: Documentation-only change — 19 lines added to workspaces/boost/AGENTS.md.

What this PR does

Adds a "Config declarations in entity provider packages" subsection to the boost workspace AGENTS.md, placed after the existing "Adding new config fields" section. The new guidance instructs agents to:

  1. Declare every config field read by the package's config reader in config.d.ts
  2. Add @visibility backend/@visibility secret annotations on sensitive fields
  3. Reuse utilities from boost-connector-utils instead of duplicating

This addresses a gap identified in issue #4697 where the code agent omitted @visibility annotations on security-sensitive fields in PR #4574 because the existing guidance was scoped only to boost-backend.

Verification

  • ogx-entity-provider/config.d.ts exists and already contains proper @visibility annotations
  • readOgxEntityProviderConfig function exists in ogx-entity-provider/src/module.ts
  • boost-connector-utils exports isValidPem, createHttpsAgent, safeGetOptionalString
  • ✅ Subsection placement is correct (after line 160, before "Wiring startup logic")
  • ✅ Change aligns with issue Extend config.d.ts @visibility guidance to entity provider packages in boost AGENTS.md #4697 scope and proposed text

Findings

[low · docs-accuracy] workspaces/boost/AGENTS.md — The new subsection states "The ogx-entity-provider and kagenti-entity-provider packages each maintain their own config.d.ts". This is accurate for ogx-entity-provider but not for kagenti-entity-provider, which has no config.d.ts. The boost-backend-module-kagenti package has one, but that's a different package. kagenti-entity-provider reads config fields (boost.entityProviders.kagenti.baseUrl, namespaces, agentRefreshIntervalSeconds, toolRefreshIntervalSeconds) that are not declared in any config.d.ts within that package — which is precisely the gap this guidance aims to close.

Suggested rewording: "The ogx-entity-provider package maintains its own config.d.ts; kagenti-entity-provider should follow the same pattern (it currently lacks one)."

This inaccuracy is non-blocking — the guidance is still directionally correct and valuable. An agent working on kagenti-entity-provider would discover the missing file and the numbered steps still correctly instruct creating/updating the declarations.


When reviewing PRs that add or modify `boost.*` config keys, verify all five registration steps above were completed.

### Config declarations in entity provider packages

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] docs-accuracy

States kagenti-entity-provider maintains its own config.d.ts, but this package has no config.d.ts file. Only ogx-entity-provider has one. kagenti-entity-provider reads config fields (boost.entityProviders.kagenti.*) not declared in any config.d.ts within the package.

Suggested fix: Reword to: The ogx-entity-provider package maintains its own config.d.ts; kagenti-entity-provider should follow the same pattern (it currently lacks one).

@fullsend-ai-review fullsend-ai-review Bot added the ready-for-merge All reviewers approved — ready to merge label Sep 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ready-for-merge All reviewers approved — ready to merge ready-for-review Agent PR ready for human review

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Extend config.d.ts @visibility guidance to entity provider packages in boost AGENTS.md

0 participants