Skip to content

feat(cloud): return a link to enable direct access when it's disabled - #1363

Merged
Aaron ("AJ") Steers (aaronsteers) merged 6 commits into
release-candidate/v1from
devin/1791846541-direct-access-enable-link
Oct 13, 2026
Merged

Aaron ("AJ") Steers (aaronsteers) merged 6 commits into
release-candidate/v1from
devin/1791846541-direct-access-enable-link

Conversation

@aaronsteers

@aaronsteers Aaron ("AJ") Steers (aaronsteers) commented Oct 12, 2026 •

Copy link
Copy Markdown
Member

Overview

👉 TL;DR: When an agent calls a direct-action MCP tool on a Cloud connector that has direct access disabled, the tool now returns a normal result with status="error" and one entry in errors, which the agent is told to show the user as-is: Show the user this message as-is: Direct access is currently disabled for {name}. [Click here]({url}) to enable it.

The link comes back in the tool result rather than in exception text, so AgentErrorTextMiddleware doesn't rewrite it.

#1364 is stacked on this PR. Builds on the merged #1366. Part of AGENTIC-2340.

Changes

  • AirbyteExternalAccessNotEnabledError.enablement_url: str | None. The default guidance is unchanged.
  • CloudConnector._direct_access_enablement_url: a thin property over connector_url. _execute_direct_action passes it to _raise_if_feature_not_enabled(..., enablement_url=...).
  • ExternalApiExecuteResult.errors: list[str], following the existing errors / warnings pattern in other MCP results.
  • execute_external_api_query, execute_external_sql_query, and the unregistered _execute_external_api_action catch the error and return _direct_access_disabled_result(error, connector). The label is the cached connector name, or {connector_type} {connector_id} when there isn't one. If the error has no enablement_url, it is re-raised unchanged.
  • Tests: in core, enablement_url == connector_url. In MCP, the exact errors[0] text for both the cached-name and fallback-label cases, and the re-raise when there's no URL.

Review Spotlight

  • airbyte/mcp/cloud.py: _direct_access_disabled_result and the three try/except blocks.

Evidence

  • Checked live in Cloud: {workspace_url}/source/{id} opens the connector's Settings tab with the Agent Access toggle visible (screenshots are in the PR comments).

Risks

  • Output schema change: ExternalApiExecuteResult gets a new errors field. It's additive and defaults to empty.
  • Behavior change: when direct access is disabled, these tools now return a result with status="error" instead of raising a tool error. A caller that only checks isError will see success; agents act on the errors text.
  • The search tools and the no-Context-Layer-API path keep their existing guidance.

Link to Devin session: https://app.devin.ai/sessions/bb884d35f6d24ad993d7f494e660acbc
Open in Devin Desktop: https://app.devin.ai/desktop/session/bb884d35f6d24ad993d7f494e660acbc?variant=devin
Requested by: Aaron ("AJ") Steers (@aaronsteers)

@devin-ai-integration

Copy link
Copy Markdown
Contributor

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

  • Disable automatic comment, CI, and merge conflict monitoring

@linear-code

linear-code Bot commented Oct 12, 2026

Copy link
Copy Markdown

AGENTIC-2340

@github-actions

Copy link
Copy Markdown

👋 Greetings, Airbyte Team Member!

Here are some helpful tips and reminders for your convenience.

💡 Show Tips and Tricks

Testing This PyAirbyte Version

You can test this version of PyAirbyte using the following:

# Run PyAirbyte CLI from this branch:
uvx --from 'git+https://github.com/airbytehq/PyAirbyte.git@devin/1791846541-direct-access-enable-link' pyairbyte --help

# Install PyAirbyte from this branch for development:
pip install 'git+https://github.com/airbytehq/PyAirbyte.git@devin/1791846541-direct-access-enable-link'

PR Slash Commands

Airbyte Maintainers can execute the following slash commands on your PR:

  • /fix-pr - Fixes most formatting and linting issues
  • /uv-lock - Updates uv.lock file
  • /test-pr - Runs tests with the updated PyAirbyte
  • /prerelease - Builds and publishes a prerelease version to PyPI
📚 Show Repo Guidance

Helpful Resources

Community Support

Questions? Join the #pyairbyte channel in our Slack workspace.

📝 Edit this welcome message.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Agent-facing guidance interpolates an untrusted Cloud response value, and the fallback behavior lacks coverage.

2 open findings
What changed in this PR

Adds direct-access enablement guidance with a connector settings link when direct actions are disabled.

Changes:

  • Builds connector-specific disabled-access guidance.
  • Passes the guidance through direct-action errors.
  • Tests the generated message and link.
File Description
airbyte/​cloud/​connectors.py Generates and attaches settings guidance.
tests/​unit_tests/​test_cloud_direct_execute.py Verifies the guidance text.

🧠 Review effort: Balanced


💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread airbyte/cloud/connectors.py Outdated
Comment thread tests/unit_tests/test_cloud_direct_execute.py Outdated
@aaronsteers
Aaron ("AJ") Steers (aaronsteers) marked this pull request as ready for review October 12, 2026 23:15
@github-code-quality

github-code-quality Bot commented Oct 12, 2026 •

Copy link
Copy Markdown
Contributor

Code Coverage Overview

Languages: Python

Python / code-coverage/pytest-no-creds

The overall line coverage in commit cbf371d in the devin/1791846541-dir... branch is 79%. The line coverage in commit d9f652f in the release-candidate/v1 branch is 65%.

Show a line coverage summary of the most impacted files.
File release-candidate/v1 d9f652f devin/1791846541-dir... cbf371d +/-
airbyte/mcp/cloud.py 52% 83% +31%
airbyte/_util/api_util.py 36% 68% +32%
airbyte/cloud/connectors.py 34% 75% +41%
airbyte/mcp/_datadog.py 0% 50% +50%
airbyte/mcp/_user_identity.py 0% 93% +93%
airbyte/_direct...ctors/models.py 0% 94% +94%
airbyte/mcp/_telemetry.py 0% 94% +94%
airbyte/mcp/_sso_auth.py 0% 96% +96%
airbyte/cloud/models.py 0% 97% +97%
airbyte/mcp/int...nc_status_ui.py 0% 97% +97%

Python / code-coverage/pytest

The overall line coverage in commit cbf371d in the devin/1791846541-dir... branch is 81%. The line coverage in commit d9f652f in the release-candidate/v1 branch is 71%.

Show a line coverage summary of the most impacted files.
File release-candidate/v1 d9f652f devin/1791846541-dir... cbf371d +/-
airbyte/cloud/connectors.py 51% 80% +29%
airbyte/mcp/cloud.py 52% 83% +31%
airbyte/mcp/_datadog.py 0% 50% +50%
airbyte/mcp/int..._registry_ui.py 0% 92% +92%
airbyte/mcp/_user_identity.py 0% 93% +93%
airbyte/_direct...ctors/models.py 0% 94% +94%
airbyte/mcp/_telemetry.py 0% 94% +94%
airbyte/mcp/_sso_auth.py 0% 96% +96%
airbyte/cloud/models.py 0% 97% +97%
airbyte/mcp/int...nc_status_ui.py 0% 97% +97%

Python / code-coverage/pytest-unit

The overall line coverage in commit cbf371d in the devin/1791846541-dir... branch is 76%. Line coverage data for the release-candidate/v1 branch is not yet available.

Show a line coverage summary of the most covered files.
File release-candidate/v1 devin/1791846541-dir... cbf371d +/-
airbyte/cloud/models.py — 97% —
airbyte/mcp/_sso_auth.py — 96% —
airbyte/_direct...ctors/models.py — 94% —
airbyte/cloud/client.py — 90% —
airbyte/exceptions.py — 89% —
airbyte/mcp/cloud.py — 83% —
airbyte/progress.py — 80% —
airbyte/cloud/connectors.py — 75% —
airbyte/_util/api_util.py — 68% —
airbyte/shared/...ql_processor.py — 68% —

Updated October 13, 2026 01:10 UTC

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Devin Review found 1 potential issue.

Devin Review

Comment thread airbyte/cloud/connectors.py Outdated
@devin-ai-integration

Copy link
Copy Markdown
Contributor

Live Cloud check (Devin's Sandbox workspace): the generated /workspaces/{workspace_id}/source/{source_id} URL opens the connector's Settings tab with Agent access visible, no extra clicks or scrolling. The org /organization/{org_id}/context-layer/agent-access page also renders.

Direct connector landing Org fallback restore failure
Connector URL and Agent access Fallback error

Caveat, outside this PR: the toggle round-trip didn't complete. After disabling, the UI showed errors.messageOnly but stayed off after reload. Re-enabling returned HTTP 403 ("Access to this resource is not permitted") from /api/v1/sources/{id}/enablement. I didn't capture the disable request's HTTP status.

Written by Devin

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Trusted custom-root URLs can bypass credential and sensitive-query redaction.

2 open findings

🧠 Review effort: Balanced

Comment thread airbyte/mcp/_error_handling.py Outdated
Comment thread airbyte/cloud/connectors.py Outdated
Comment thread airbyte/mcp/_error_handling.py Outdated

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks legit

@devin-ai-integration devin-ai-integration Bot changed the title feat(cloud): link to the connector's Agent Access toggle when direct access is disabled feat(cloud): return a link to enable direct access when it's disabled Oct 13, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Agent-visible output can expose secret arguments and credentials embedded in custom API-root URLs.

2 open findings
1 resolved since last review

🧠 Review effort: Balanced

Comment thread airbyte/mcp/_error_handling.py
Comment thread airbyte/mcp/cloud.py
devin-ai-integration Bot and others added 5 commits October 13, 2026 00:58
…access is disabled

Co-Authored-By: AJ Steers <aj@airbyte.io>
Co-Authored-By: AJ Steers <aj@airbyte.io>
Co-Authored-By: AJ Steers <aj@airbyte.io>
Co-Authored-By: AJ Steers <aj@airbyte.io>
Co-Authored-By: AJ Steers <aj@airbyte.io>
@devin-ai-integration
devin-ai-integration Bot force-pushed the devin/1791846541-direct-access-enable-link branch from 0873ddf to cbf371d Compare October 13, 2026 00:59
@aaronsteers
Aaron ("AJ") Steers (aaronsteers) merged commit 8b63058 into release-candidate/v1 Oct 13, 2026
29 checks passed
@aaronsteers
Aaron ("AJ") Steers (aaronsteers) deleted the devin/1791846541-direct-access-enable-link branch October 13, 2026 01:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants