From c34fa25b86c14ab0851c2104d96d570b000d8a34 Mon Sep 17 00:00:00 2001 From: limityan Date: Fri, 24 Jul 2026 15:06:42 +0800 Subject: [PATCH] fix(external-sources): default integrations to disabled --- .../assembly/core/src/external_sources.rs | 27 +++++++++++--- .../src/external_integration_policy.rs | 6 ++-- .../tests/external_source_contracts.rs | 36 ++++++++++++++++++- .../components/ExternalSourcesConfig.test.tsx | 27 ++++++++++++++ .../components/ExternalSourcesConfig.tsx | 4 +-- 5 files changed, 90 insertions(+), 10 deletions(-) diff --git a/src/crates/assembly/core/src/external_sources.rs b/src/crates/assembly/core/src/external_sources.rs index 0d49b1c033..eb0a804504 100644 --- a/src/crates/assembly/core/src/external_sources.rs +++ b/src/crates/assembly/core/src/external_sources.rs @@ -5616,8 +5616,14 @@ mod tests { #[test] fn opencode_registry_owns_low_friction_defaults_and_safety_ceilings() { - let policy = integration_policy_snapshot(&ExternalSourcesConfig::default(), None) - .expect("built-in policy is valid"); + let mut config = ExternalSourcesConfig::default(); + config + .integration_policy + .known_mut() + .expect("the built-in policy schema is known") + .user_defaults + .enabled = true; + let policy = integration_policy_snapshot(&config, None).expect("built-in policy is valid"); let descriptor = policy .registered_ecosystems .iter() @@ -5662,8 +5668,15 @@ mod tests { #[test] fn active_capability_sets_are_scoped_per_ecosystem_for_every_asset_kind() { - let mut policy = integration_policy_snapshot(&ExternalSourcesConfig::default(), None) - .expect("built-in policy is valid"); + let mut config = ExternalSourcesConfig::default(); + config + .integration_policy + .known_mut() + .expect("the built-in policy schema is known") + .user_defaults + .enabled = true; + let mut policy = + integration_policy_snapshot(&config, None).expect("built-in policy is valid"); let template_descriptor = policy.registered_ecosystems[0].clone(); let template_effective = policy .effective @@ -6022,6 +6035,12 @@ mod tests { approved_tool_targets: BTreeSet::from([approval_key.to_string()]), ..ExternalSourcesConfig::default() }; + config + .integration_policy + .known_mut() + .expect("the built-in policy schema is known") + .user_defaults + .enabled = true; config.suppressed_source_keys.push(source.preference_key()); assert!(!external_tool_invocation_is_authorized_by( diff --git a/src/crates/contracts/product-domains/src/external_integration_policy.rs b/src/crates/contracts/product-domains/src/external_integration_policy.rs index 65cf7271c2..721c97edc0 100644 --- a/src/crates/contracts/product-domains/src/external_integration_policy.rs +++ b/src/crates/contracts/product-domains/src/external_integration_policy.rs @@ -196,7 +196,7 @@ pub struct ExternalIntegrationPolicySettings { impl Default for ExternalIntegrationPolicySettings { fn default() -> Self { Self { - enabled: true, + enabled: false, ecosystems: BTreeMap::new(), extensions: BTreeMap::new(), } @@ -453,11 +453,11 @@ impl Default for ExternalIntegrationPolicySnapshot { ), workspace_override: None, global_effective: EffectiveExternalIntegrationPolicy { - enabled: true, + enabled: false, ecosystems: BTreeMap::new(), }, effective: EffectiveExternalIntegrationPolicy { - enabled: true, + enabled: false, ecosystems: BTreeMap::new(), }, registered_ecosystems: Vec::new(), diff --git a/src/crates/contracts/product-domains/tests/external_source_contracts.rs b/src/crates/contracts/product-domains/tests/external_source_contracts.rs index 9027d8a3bf..147b7ab12f 100644 --- a/src/crates/contracts/product-domains/tests/external_source_contracts.rs +++ b/src/crates/contracts/product-domains/tests/external_source_contracts.rs @@ -969,7 +969,7 @@ fn test_external_integration_ecosystems() -> Vec { expect(toolRow?.textContent).not.toContain('policy.access.auto'); }); + it('fails closed when an older host omits the stored enabled flag', async () => { + getSnapshotMock.mockResolvedValue({ + ...snapshot, + integrationPolicy: { + ...integrationPolicy, + userDefaults: { + ...integrationPolicy.userDefaults, + enabled: undefined, + }, + workspaceOverride: { + enabled: undefined, + ecosystems: {}, + }, + }, + }); + + await act(async () => { + root.render(); + await Promise.resolve(); + }); + + const policyToggle = container.querySelector( + '.bitfun-external-sources-config__policy-card input[type="checkbox"]', + ) as HTMLInputElement; + expect(policyToggle.checked).toBe(false); + }); + it('requires one explicit conflict choice and persists source toggles', async () => { await act(async () => { root.render(); diff --git a/src/web-ui/src/infrastructure/config/components/ExternalSourcesConfig.tsx b/src/web-ui/src/infrastructure/config/components/ExternalSourcesConfig.tsx index f3ebc94e47..2e06eede74 100644 --- a/src/web-ui/src/infrastructure/config/components/ExternalSourcesConfig.tsx +++ b/src/web-ui/src/infrastructure/config/components/ExternalSourcesConfig.tsx @@ -819,8 +819,8 @@ const ExternalSourcesConfig: React.FC = () => { || Boolean(workspace?.connectionId); const policy = snapshot?.integrationPolicy; const selectedPolicyEnabled = policyScope === 'workspace' - ? policy?.workspaceOverride?.enabled ?? policy?.userDefaults.enabled ?? true - : policy?.userDefaults.enabled ?? true; + ? policy?.workspaceOverride?.enabled ?? policy?.userDefaults.enabled ?? false + : policy?.userDefaults.enabled ?? false; const selectedPolicyEffective = policyScope === 'workspace' ? policy?.effective : policy?.globalEffective;