Ettore Di Giacinto c5400edd3f feat(addons): add the /api/addons/host-grants routes ...

Seven routes: read the host access state, preview an install, install or
upgrade with an approval, edit or revoke the grants of an add-on, change the
blanket approval and change the deny rules (with a dry run).

Reads take an administrator session or API key. Every write takes only the
administrator's own browser session: same-origin fetch and the confirm
header equal to the operation ID. An API key, bearer token, MCP session or
tool call gets 403 not_human_surface. The dry run of a deny change is a read.

The first path segment host-grants is reserved as an add-on ID, and the
routes are listed in the feature registry.

Assisted-by: Claude:claude-sonnet-5-5 go gofmt ginkgo

2026-11-03 21:55:38 +00:00

..

contract

feat(addons): add the /api/addons/host-grants routes

2026-11-03 21:55:38 +00:00

model

feat(addons): declare typed host capabilities (#13034)

2026-11-02 23:50:40 +00:00

packaging

feat(addons): declare the connector file operations in Slack and Telegram

2026-11-03 21:50:00 +00:00