codeSplitters: verify the API end to end through Executor on the live site #389

Activity

1. QuinnsCode commented on Oct 10, 2026

   

   QuinnsCode

   on Oct 10, 2026

   OwnerAuthor

   More actions

   Checked end to end through Executor 1.6.10 (local CLI), against a local codeSplitters built from main with a real write token:

   • Load: previewSpec and addSpec read all 45 operations and picked up the token bearer scheme. Tools are grouped by tag with camelCase names, e.g. codesplitters.<owner>.<connection>.files.readFile.
   • Read: files.readFile returned the file's lines (200).
   • Write: sharing.shareLines returned 201, and the share's by is the token's owner.
   • Policy: Executor's default already pauses every non-GET call for approval. I set codesplitters.* to approve, then require_approval on repos.deleteRepo, branches.mergeBranch, files.commitFile and deploys.deploy. Afterwards branches.startBranch went straight through, and files.commitFile paused. I declined it, and nothing was committed.

   Executor quirks

   • previewSpec takes spec as a URL string, but addSpec needs {kind: "url", url}.
   • Executor wants tokens added through its web UI's Add account flow (connections.createHandoff), not through an agent. For the local check I passed the 1-day token as a static headers.Authorization on addSpec instead. For the live site, use Add account.

   Still to do: the same against the live site once it's released (/api/openapi.json 404s there today). Make a token on your profile page, add https://codesplitters.notryanquinn.workers.dev/api/openapi.json in Executor, add the token with Add account, and set the four policies above.
2. QuinnsCode commented on Oct 10, 2026

   

   QuinnsCode

   on Oct 10, 2026

   OwnerAuthor

   More actions

   Verified live on https://codesplitters.notryanquinn.workers.dev after the release, with a real read-and-write token ("claude code"), read from 1Password and never printed:

   • GET /api/session returns {mode: "token", user: "quinn", scope: "write"}.
   • Read: the profile (3 repos), rustybuns's tree, and README.md's lines (rev 146).
   • Write: POST /api/repos/quinn/rustybuns/shares (lines 1–2) returned 201, by: quinn. I deleted the share right away (200), and it now returns 404.
   • Never an admin: /api/admin/limits and /api/tokens with the token both return 403, even though quinn is an admin.
   • A bad token returns 401. The spec at /api/openapi.json lists all 45 operations.

   The Executor half was verified earlier against a local build (comment above): it loaded the spec, did a read and a write, and the approval policies gated commitFile. Pointing Executor at the live spec is the same steps, and optional.
3. QuinnsCode

   closed this as completedon Oct 10, 2026