You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This commit was created on GitHub.com and signed with GitHub’s verified signature.
Effective account authority reporting
Separate the authenticated account authority from the local daemon capability ceiling in remote diagnostics. server_info.authorization.effective_policy and effective_tools are now the authoritative account fields, while daemon.policy and daemon.tools are explicitly scoped as pre-role ceilings. The response also includes a deterministic authority summary and scope labels so clients cannot reasonably equate an editor account with a full daemon.
Make remote project_overview return the role-intersected policy and tools at its existing top-level fields, while preserving the daemon values separately as daemonPolicy and daemonTools. Add a Worker integration regression that authorizes an editor account against a canonical full daemon and proves shell/browser tools remain excluded at both reporting surfaces and at relay enforcement.
Update MCP initialization guidance, tool descriptions, operations diagnostics, architecture, client, account, testing, and generated tool-reference documentation to use the effective-account fields when diagnosing permissions.