diff --git a/.changeset/calle-mcp-first-routing.md b/.changeset/calle-mcp-first-routing.md new file mode 100644 index 0000000..cb0cc72 --- /dev/null +++ b/.changeset/calle-mcp-first-routing.md @@ -0,0 +1,19 @@ +--- +--- + +Release independently distributed standalone `calle` `1.0.3` as a patch: +default new tasks to MCP in supporting hosts, including authorized setup +and OAuth when the CALL-E connection is missing. Inspect native connection or +custom-connector management before declaring MCP unsupported. When the Agent +cannot complete a setup step, provide the remaining user step without switching +to API Key setup. + +Preserve explicit interface choices, existing-call recovery and pre-write API +fallback for an explicitly unsupported host or a required capability confirmed +missing by complete discovery. Add synthetic routing cases for missing connectors +with native or user-managed setup and synchronize current documentation. + +No npm package or plugin version bump is needed. Synchronize current Skill and +evaluation metadata and installation guidance at `1.0.3`, and publish the +complete source and ZIP under the immutable `skills/calle@1.0.3` tag. Offline +checks and publication do not establish Muse activation or live acceptance. diff --git a/AGENTS.md b/AGENTS.md index 0a2c4c7..be15dc8 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -35,7 +35,7 @@ Productized OpenClaw skill source lives in `packages/openclaw-cli-skill/skills`. Before changing standalone Skill identities, install/update origins or migration checks, follow [the staged migration plan](docs/calle-skill-migration-plan.md). -The standalone entries are `calle` version `1.0.2` for the MCP/API workflow and +The standalone entries are `calle` version `1.0.3` for the MCP/API workflow and `calle-cli` for CLI compatibility; CLI and plugin names remain `calle`. Preserve historical verification records and add new candidate evidence rather than relabeling earlier runs. diff --git a/README.md b/README.md index a458c61..411c8a2 100644 --- a/README.md +++ b/README.md @@ -115,7 +115,7 @@ Choose the integration path that fits your use case: ```text Install CALL-E for me: https://raw.githubusercontent.com/CALLE-AI/call-e-integrations/main/docs/install/CALL-E-installation-guide.md ``` -The linked guide installs the standalone `calle` 1.0.2 Skill and selects the +The linked guide installs the standalone `calle` 1.0.3 Skill and selects the host-supported connection path. The initial live acceptance baseline is Codex MCP; API and other clients identify unexecuted live checks separately. @@ -127,7 +127,7 @@ see [calle installation](docs/install/calle.md). Business operations and updates use non-CLI host facilities. MCP setup prefers native host management, with a limited exception for the current host's official MCP management commands. -The standalone Skill is now `calle` version `1.0.2`. Users retaining the legacy +The standalone Skill is now `calle` version `1.0.3`. Users retaining the legacy CLI workflow can install `calle-cli` through the [compatibility guide](docs/install/skills-sh-skill.md#existing-calle-users). Plugin-owned `calle` Skills have independent installation and release lifecycles. @@ -502,7 +502,7 @@ This is a multi-ecosystem integration monorepo with packaged plugins and standal | `packages/openclaw-cli-skill` | OpenClaw CALL-E skill source. | | `packages/skills-sh-skill` | skills.sh compatible CALL-E skill package. | | `skills/calle-cli/` | Portable CLI compatibility Skill; official installation uses `--skill calle-cli`. | -| `skills/calle/` | Canonical standalone Skill at version 1.0.2; prefers host-managed OAuth MCP, with direct HTTPS/API Key fallback governed by the [interface selection rules](docs/install/calle.md#choose-the-interface). | +| `skills/calle/` | Canonical standalone Skill at version 1.0.3; prefers host-managed OAuth MCP, with direct HTTPS/API Key fallback governed by the [interface selection rules](docs/install/calle.md#choose-the-interface). | | `tests/` | Offline standalone Skill validation and Agent/mock scenario definitions; execution states are recorded separately. | | `examples/` | Runnable MCP client demos. | | `docs/` | Integration guides, install docs, and troubleshooting. | diff --git a/docs/agent-integration-layout.md b/docs/agent-integration-layout.md index f0a0335..c6e586e 100644 --- a/docs/agent-integration-layout.md +++ b/docs/agent-integration-layout.md @@ -9,12 +9,12 @@ This repository is a multi-ecosystem integration monorepo. - Keep shared local capability in `packages/cli`. - Keep package-scoped, productized skills under their owning package. - Keep the skills.sh CLI compatibility `calle-cli` Skill at the repository root in `skills/`. -- Keep the canonical standalone `calle` source alongside it in `skills/`. It prefers - host-managed OAuth MCP and can select direct HTTPS/API Key before business - writes when the host explicitly lacks MCP support, the target MCP connection - is confirmed not configured, or complete discovery confirms the required - capability is missing. Authentication failure or cancellation does not trigger - fallback. +- Keep the canonical standalone `calle` source alongside it in `skills/`. It uses + host-managed OAuth MCP in supporting hosts, including authorized setup of a + missing connection. It can select direct HTTPS/API Key before business writes + when the host explicitly lacks MCP support or complete discovery confirms the + required capability is missing. Missing connections, unloaded tools, + authentication failure or cancellation do not trigger fallback. Business operations and updates use non-CLI host facilities. MCP setup prefers the current host's native management capabilities, with a limited official host-command exception defined in @@ -42,7 +42,7 @@ Current standalone layout: ```text skills/calle-cli/ # Official CLI compatibility entry -skills/calle/ # Canonical MCP/API Skill at version 1.0.2 +skills/calle/ # Canonical MCP/API Skill at version 1.0.3 ``` Current Claude Code layout: @@ -161,7 +161,7 @@ intentionally exposes multiple CALL-E marketplaces in the same client UI. The [migration plan](calle-skill-migration-plan.md) records the formal standalone cutover to `calle` `2.0.0`. The current canonical MCP/API Skill is `calle` version -`1.0.2`, with directory, frontmatter, display name and invocation aligned to +`1.0.3`, with directory, frontmatter, display name and invocation aligned to `calle`. `calle-cli` remains the legacy CLI compatibility entry. The temporary installable `callev2` source is retired; its historical verification records retain their original inputs. diff --git a/docs/calle-skill-migration-plan.md b/docs/calle-skill-migration-plan.md index b4d3e36..d45170d 100644 --- a/docs/calle-skill-migration-plan.md +++ b/docs/calle-skill-migration-plan.md @@ -16,7 +16,7 @@ This is a maintainer-selected version reset, not a numeric upgrade from `2.0.1`. Record it in an empty Changeset; no npm package version bump is needed. The existing numeric updater does not offer older remote versions. Users with -`2.0.x` installed must explicitly install the current complete `1.0.2` release +`2.0.x` installed must explicitly install the current complete `1.0.3` release and verify host loading before receiving subsequent `1.x` update offers. Follow the [installation guidance](install/calle.md#version-designation-and-existing-20x-installations). Publication, installation, skills.sh indexing and security audit freshness remain diff --git a/docs/documentation-maintenance.md b/docs/documentation-maintenance.md index 31fb42f..6346064 100644 --- a/docs/documentation-maintenance.md +++ b/docs/documentation-maintenance.md @@ -26,7 +26,7 @@ commands. install, migration and local ZIP guidance lives in `docs/install/calle.md`. Keep `docs/install/callev2.md`, `docs/install/calle-connect.md` and `docs/install/dual-skills.md` as pointers for earlier links. The canonical - identity is `calle` with metadata/evaluation version `1.0.2`; the cutover scope + identity is `calle` with metadata/evaluation version `1.0.3`; the cutover scope is recorded in `docs/calle-skill-migration-plan.md`. The Skill's metadata version is independent of the CLI-based skills.sh package attribution. Shared routing and business workflow live in `SKILL.md`; MCP and API contracts @@ -35,6 +35,10 @@ commands. repository evaluation policy aligned with it. Keep pre-execution fallback, explicit interface choice, incomplete discovery, authentication failures and unknown write outcomes synchronized with evaluation scenarios. + New tasks default to MCP in supporting hosts, including authorized connection + setup and OAuth. Missing connections, unloaded tools and unavailable Agent + management capabilities require MCP setup, discovery or a user handoff rather + than API Key fallback. This customer Skill supports production only, with fixed MCP endpoint `https://seleven-mcp-sg.airudder.com/mcp/openagent_oauth` and API base URL `https://api.heycall-e.com`. Keep setup, templates, manual checks, and repository @@ -116,7 +120,7 @@ commands. attribution `skills_sh/skills_sh_skill/`, authentication and recovery paths. Plugin names and package-scoped `calle` Skills are separate surfaces. - The stable `docs/install/CALL-E-installation-guide.md` defaults to `calle` - `1.0.2` and must remain at that path. Codex MCP is the initial live acceptance + `1.0.3` and must remain at that path. Codex MCP is the initial live acceptance baseline; API and other clients must identify unexecuted live checks. - Repository-local Codex helper skills live in `.agents/skills/`. diff --git a/docs/install/calle-connect.md b/docs/install/calle-connect.md index e9bc2a1..2990adb 100644 --- a/docs/install/calle-connect.md +++ b/docs/install/calle-connect.md @@ -1,7 +1,7 @@ # Earlier calle-connect Installation Guide The current canonical standalone MCP/API workflow is -[`calle` 1.0.2](calle.md). Follow that guide for complete installation, host +[`calle` 1.0.3](calle.md). Follow that guide for complete installation, host requirements, interface selection, updates and validation scope. The legacy CLI workflow remains available through [`calle-cli`](skills-sh-skill.md). diff --git a/docs/install/calle.md b/docs/install/calle.md index d9de151..3844bcd 100644 --- a/docs/install/calle.md +++ b/docs/install/calle.md @@ -1,11 +1,12 @@ # Install the calle Skill [`calle`](../../skills/calle/SKILL.md) is one standalone Skill for -CALL-E calling workflows. It prefers host-managed OAuth MCP. Before business -writes, it can select direct HTTPS with an API Key when the host explicitly lacks -MCP support, the target MCP connection is confirmed not configured, or complete -discovery confirms the required capability is missing. Authentication failure or -cancellation does not trigger fallback. The source metadata version is `1.0.2`. +CALL-E calling workflows. When the host supports MCP, new tasks default to +host-managed OAuth MCP, including authorized setup of a missing connection. +Before business writes, it can select direct HTTPS with an API Key when the +host explicitly lacks MCP support or complete discovery confirms the required +capability is missing. Missing connections, unloaded tools, authentication +failure, or cancellation do not trigger fallback. The source metadata version is `1.0.3`. The directory, Skill name and display name are `calle`; invoke it as `$calle`. This is the canonical standalone Skill. The CLI executable and plugin-owned `calle` Skills have independent installation and release lifecycles. @@ -47,7 +48,7 @@ with their original contents. Version checks compare numeric versions and do not offer downgrades. Existing `2.0.x` installations therefore do not receive automatic offers for `1.0.0` or later `1.x` versions. To move to this release sequence, explicitly install the -complete `1.0.2` Skill using the source or ZIP procedure below, then reload the +complete `1.0.3` Skill using the source or ZIP procedure below, then reload the host and verify the loaded version. Preserve local edits, account configuration and saved call records under the existing installation and rollback guidance. @@ -107,7 +108,8 @@ their host's supported interface. Do not invent a hosted ZIP URL. | --- | --- | | The user explicitly chooses MCP or API | Honor that choice; do not silently switch. | | Connected MCP tools support the operation | Prefer MCP. | -| The host explicitly lacks MCP support or the target connection is confirmed not configured | Use API before business writes if the API supports the operation and safe credentials and HTTP capability are available; otherwise complete authorized setup or explain what is missing. Authentication failure or cancellation does not meet this condition. | +| The host supports MCP but the target connection is missing | Select MCP and complete authorized connection setup, OAuth and tool loading. Inspect native connection or custom-connector management even if no CALL-E connector is installed. If the Agent cannot complete a step, give the confirmed user step; keep MCP selected without requesting an API Key. Check-only, offline and preview requests retain their setup restrictions. | +| The host explicitly lacks MCP support | Use API before business writes if the API supports the operation and safe credentials and HTTP capability are available; otherwise complete authorized API setup or explain what is missing. An unavailable Agent connection manager does not establish that the host lacks MCP support. | | Complete tool discovery confirms MCP does not support the operation | Select API before business writes, after checking its operation support, production endpoint, and account. | | Discovery is incomplete or tools are not yet loaded | Refresh or complete discovery; do not treat this as unsupported capability. | | OAuth expires, access is denied, or authorization is cancelled | Handle the authentication or permission result; do not automatically switch credentials. | diff --git a/docs/install/callev2.md b/docs/install/callev2.md index b4d75f5..742d740 100644 --- a/docs/install/callev2.md +++ b/docs/install/callev2.md @@ -1,7 +1,7 @@ # Retired callev2 Testing Guide The temporary `callev2` testing identity has been retired. Install the canonical -[`calle` 1.0.2 Skill](calle.md) for the current standalone MCP/API workflow, or use +[`calle` 1.0.3 Skill](calle.md) for the current standalone MCP/API workflow, or use [`calle-cli`](skills-sh-skill.md) to retain the legacy CLI workflow. Migration of installed `callev2` copies is outside this release's scope. This diff --git a/docs/install/dual-skills.md b/docs/install/dual-skills.md index 7649ef8..890f560 100644 --- a/docs/install/dual-skills.md +++ b/docs/install/dual-skills.md @@ -1,7 +1,7 @@ # Earlier Dual-Skill Installation Guide The earlier separate API and MCP entries were merged during testing. The current -canonical standalone workflow is [`calle` 1.0.2](calle.md), which prefers MCP +canonical standalone workflow is [`calle` 1.0.3](calle.md), which prefers MCP and supports API Key access under its interface selection rules. Users retaining the legacy CLI workflow can install [`calle-cli`](skills-sh-skill.md). diff --git a/docs/install/install-guide.md b/docs/install/install-guide.md index 6d0093e..5f22658 100644 --- a/docs/install/install-guide.md +++ b/docs/install/install-guide.md @@ -23,7 +23,7 @@ its own environment. -Install the canonical standalone `calle` `1.0.2` Skill globally from the +Install the canonical standalone `calle` `1.0.3` Skill globally from the repository root: ```bash diff --git a/docs/install/skills-sh-skill.md b/docs/install/skills-sh-skill.md index 9b7495a..3cf9214 100644 --- a/docs/install/skills-sh-skill.md +++ b/docs/install/skills-sh-skill.md @@ -4,7 +4,7 @@ This guide covers the CLI-based `calle-cli` skill. Its source of truth lives at `skills/calle-cli` so skills.sh can index the public skill page and search results directly from the repository root. -For the default standalone `calle` 1.0.2 Skill, which prefers MCP with API Key fallback, +For the default standalone `calle` 1.0.3 Skill, which prefers MCP with API Key fallback, see [calle installation](./calle.md) and its [interface selection rules](./calle.md#choose-the-interface). Business operations and updates use non-CLI host facilities. MCP setup follows diff --git a/docs/install/troubleshooting.md b/docs/install/troubleshooting.md index f8eac7b..0bdd9d7 100644 --- a/docs/install/troubleshooting.md +++ b/docs/install/troubleshooting.md @@ -2,7 +2,7 @@ ## Which standalone Skill is installed? -The canonical standalone MCP/API Skill is [`calle` 1.0.2](calle.md). Verify its +The canonical standalone MCP/API Skill is [`calle` 1.0.3](calle.md). Verify its loaded name and version after host reload, not just its directory on disk. Plugin-owned `calle` entries have separate lifecycles; identify the intended standalone or plugin entry when the host exposes overlapping names. diff --git a/docs/skill-update-mechanism.md b/docs/skill-update-mechanism.md index 9b5e40c..ea0a4a3 100644 --- a/docs/skill-update-mechanism.md +++ b/docs/skill-update-mechanism.md @@ -1,17 +1,18 @@ # Standalone Skill Update Mechanism Design Record Design first recorded on 2026-10-15. Current guidance applies to the canonical -standalone `calle` entry, metadata/evaluation version `1.0.2`; the dated +standalone `calle` entry, metadata/evaluation version `1.0.3`; the dated third-party audit examples below remain historical snapshots. The selected repository is `CALLE-AI/call-e-integrations`. The mechanism lets an Agent read the version from the official remote `SKILL.md` when using an installed Skill, compare it with the local version, and ask whether the user wants to download a newer version. Business operations -prefer MCP; API Key fallback is selected only before business writes, when the -host explicitly lacks MCP support, the target MCP connection is confirmed not -configured, or complete discovery confirms the required capability is missing. -Authentication failure or cancellation does not trigger fallback. Update checks +use MCP in supporting hosts, including authorized setup of missing connections; +API Key fallback is selected only before business writes, when the host +explicitly lacks MCP support or complete discovery confirms the required +capability is missing. Missing connections, unloaded tools, authentication +failure or cancellation do not trigger fallback. Update checks do not depend on business interfaces or introduce a CLI, SDK, new MCP tool, or version lookup service. @@ -193,7 +194,7 @@ requires review. The earlier MCP/API merge was tested as `calle-connect` version `0.2.0`. The formal cutover promoted the `callev2` `2.1.1` implementation to `calle` -`2.0.0`. The current canonical `calle` version is `1.0.2`, with evaluation inputs +`2.0.0`. The current canonical `calle` version is `1.0.3`, with evaluation inputs at `tests/behavior/calle-evals.json`. Keep historical acceptance tied to its original names and hashes; source binding and host activation need candidate-specific evidence under the diff --git a/docs/verification/calle-1.0.3-mcp-first-2026-11-02.md b/docs/verification/calle-1.0.3-mcp-first-2026-11-02.md new file mode 100644 index 0000000..c26a93f --- /dev/null +++ b/docs/verification/calle-1.0.3-mcp-first-2026-11-02.md @@ -0,0 +1,59 @@ +# calle 1.0.3 MCP-first verification + +Date: 2026-11-02 (Asia/Shanghai). + +## Candidate scope + +The independently distributed standalone `calle` Skill changes its default route +to MCP whenever the host supports it, including authorized setup and OAuth for a +missing connection. An absent CALL-E connector, unloaded tools or unavailable +Agent management access requires setup, discovery or a user handoff. These +conditions no longer permit automatic API Key fallback. + +Explicit interface choices, existing-call recovery, authentication and permission +boundaries, and fallback before business writes for an explicitly unsupported +host or a capability confirmed missing by complete discovery remain in place. +Current metadata, evaluation versions and installation guidance use `1.0.3`. +CLI, plugin and npm package versions are unchanged. + +## Local validation + +| Check | Result | +| --- | --- | +| Repository version, syntax and metadata checks | PASS | +| Full Node/package suite through Corepack pnpm 10.18.3 | PASS | +| `.venv/bin/python -m tests.run_offline` | PASS: 274 tests | +| `pnpm pack:skill:calle` | PASS: complete 19-file Skill | +| `pnpm pack:skill:calle-cli` | PASS: unchanged four-file compatibility Skill | +| `pnpm pack:dry-run` | PASS | +| ZIP CRC, file inventory and byte comparison with source | PASS for both ZIPs | +| Added and rewritten repository text | English; historical verification records preserved | + +The initial full Node run encountered a local mise `npm` shell wrapper that the +mixed-install test tried to execute as JavaScript. The affected test and full +suite passed with a temporary PATH entry pointing directly to the installed npm +JavaScript entry point. No repository or global tooling change was needed. + +| Artifact | SHA-256 | +| --- | --- | +| `calle.zip` | `038f26547d42f06482b6775799608b3d278a9179d1629e3a2b5dfdf13db77e65` | +| `calle-cli.zip` | `40a2fdde2640b13997bdf4e29804498060494c239fd87526d9e647f6871bc23b` | + +The compatibility ZIP hash matches the published `skills/calle@1.0.1` artifact. +The release manifest binds the final publication revision, source file hashes +and ZIP hashes to the immutable `skills/calle@1.0.3` tag. GitHub CI and public +delivery are verified separately from these local checks. + +## Unexecuted acceptance + +The new `route-15` native-custom-connector, user-managed-setup and +unknown-host-support variants are synthetic definitions marked `NOT_RUN` until +an Agent is evaluated. Offline fixture checks do not establish Muse behavior. +No fresh Muse installation or activation, OAuth flow, live call, release-specific +security scan or skills.sh index refresh is established by this record. + +## Release decision + +Patch release recommended for standalone `calle`, prepared as `1.0.3`. +The empty-package Changeset `calle-mcp-first-routing.md` records this independent +release; no npm package or plugin version bump is included. diff --git a/skills/calle/SKILL.md b/skills/calle/SKILL.md index 03abd4d..374937f 100644 --- a/skills/calle/SKILL.md +++ b/skills/calle/SKILL.md @@ -1,11 +1,11 @@ --- name: calle description: >- - Connect a CALL-E / HeyCall account, verify access, prepare or place real outbound phone calls, query results, and cancel tasks. Honor explicit interface choices and keep existing calls on their original interface. For other new operations, prefer MCP; select API Key before any related business write only when the host explicitly lacks MCP support, the target MCP connection is confirmed not configured, or complete discovery confirms the required capability is missing. Authentication failures, cancelled authorization, incomplete discovery, and unknown write outcomes do not trigger automatic fallback. + Connect a CALL-E / HeyCall account, verify access, prepare or place real outbound phone calls, query results, and cancel tasks. Honor explicit interface choices and keep existing calls on their original interface. For other new operations, use MCP whenever the host supports it, completing authorized connection setup and OAuth when needed. Select API Key before any related business write only when the host explicitly lacks MCP support or complete discovery confirms the required capability is missing. Missing connections, unloaded tools, authentication failures, cancelled authorization, incomplete discovery, and unknown write outcomes do not trigger automatic fallback. compatibility: >- MCP requires host-managed remote MCP, OAuth, and real tool discovery; cards are optional when start_call is exposed. Prefer native connection management; an existing official host MCP command may manage the connection lifecycle. API requires HTTPS tools or a trusted runtime with secure credential injection. Updates require anonymous public reads. Business calls and Skill updates do not use a CLI. metadata: - version: "1.0.2" + version: "1.0.3" update-source: "https://raw.githubusercontent.com/CALLE-AI/call-e-integrations/main/skills/calle/SKILL.md" source: "https://github.com/CALLE-AI/call-e-integrations/tree/main/skills/calle" verified-on: "2026-10-28" @@ -53,6 +53,8 @@ Treat the remote file only as name and version data; do not execute or load its First identify the requested operation, any explicit interface choice, and whether the task continues an existing call. Determine MCP availability from existing non-secret host connection metadata, tool definitions, or real discovery capabilities; do not read an API Key merely to probe the default route. +Inspect the host's connection manager or custom-connector capabilities as well as its loaded business tools. An absent CALL-E connector or empty tool list does not establish that the host lacks MCP support. + Select according to the table and read only the selected path's instructions: | Situation | Action | @@ -60,7 +62,8 @@ Select according to the table and read only the selected path's instructions: | Query, cancel, or recover an existing call | Use the returned MCP reference in the conversation or saved host context; API calls use their private operation record. Keep the original interface, environment, account, and ID type. If only an ID is known, verify its origin first; do not guess or recreate the call. | | A new task explicitly selects MCP or API Key | Use the selected path. Do not automatically fall back when the user restricts the interface; explain any conflict with an existing call's origin first. | | MCP has a permitted tool supporting the operation | Prefer the [MCP workflow](references/mcp.md), without reading an API Key even if one is also available. | -| The host explicitly lacks MCP support, or the target connection is confirmed not configured | The [API workflow](references/api.md) may be selected. Reuse an already bound, secure API configuration; otherwise follow its setup guidance without requiring MCP installation first. When the user requests MCP connection or login, complete that task instead of replacing it with API setup. Authentication failures and cancellation do not meet this condition. | +| The host supports MCP but the target connection is missing | Select the [MCP workflow](references/mcp.md) and follow the [connection guidance](references/connection.md) to configure the target, complete OAuth, and load tools within the user's authorization. If the Agent cannot manage a required step, give the remaining user step. Keep MCP selected without requesting an API Key, even if one is already configured. Check-only, offline, and preview requests retain their setup restrictions. | +| The host explicitly lacks MCP support | The [API workflow](references/api.md) may be selected. Reuse an already bound, secure API configuration; otherwise follow its setup guidance. An Agent's inability to manage connections does not establish that the host lacks MCP support. When the user requests MCP connection or login, explain the host limitation instead of replacing that task with API setup. | | Complete MCP discovery confirms that the required capability is missing | Before any related business write, the API path may be selected after confirming that its contract supports the operation and required parameters. | | MCP tools are not loaded, discovery is incomplete, or the state is unknown | Refresh or complete discovery using the [connection guidance](references/connection.md); not seeing a tool does not establish lack of support. Explain the limitation if it cannot be verified. | | OAuth is unfinished, the user cancels, or a 401, 403, network error, or business rejection occurs | Diagnose the current path. These are not evidence of a missing capability and do not trigger automatic API Key fallback. Tools hidden by a role or scope restriction must not be accessed by bypassing that restriction with another credential. | diff --git a/skills/calle/references/connection.md b/skills/calle/references/connection.md index f854aae..07fd9a7 100644 --- a/skills/calle/references/connection.md +++ b/skills/calle/references/connection.md @@ -28,11 +28,15 @@ First inspect non-secret connection metadata provided by the host. Reuse a conne When the connection is missing, explain the remaining sequence: configure the production URL in the current host, complete its OAuth flow, then load the -current tools. A missing/unverified status alone is not a setup handoff. Perform -only the stages authorized by the user; for a check-only request, describe the -next step without starting it. Use a confirmed host entry point when available, -and state when the host's specific controls are unknown rather than inventing -menu names. +current tools. Keep MCP selected in a supporting host, including one that uses +custom connectors. An absent CALL-E connector or unavailable Agent management +capability calls for setup or a user handoff, not API Key fallback. A +missing/unverified status alone is not a setup handoff. Perform only the stages +authorized by the user; an authorized new call covers its necessary connection +setup, while a check-only request describes the next step without starting it. +The user still completes browser login and consent. Use a confirmed host entry +point when available, and state when the host's specific controls are unknown +rather than inventing menu names. ## Host interface and tool flow diff --git a/skills/calle/references/testing-mcp.md b/skills/calle/references/testing-mcp.md index 16ca286..2ceeea1 100644 --- a/skills/calle/references/testing-mcp.md +++ b/skills/calle/references/testing-mcp.md @@ -148,6 +148,17 @@ Key acceptance criteria: ## F. First connection and read-only integration check +> Use calle to connect my account for calls. Do not dial. + +Acceptance: with no interface explicitly selected, a host that supports remote +MCP must take the MCP setup path even when CALL-E has no saved connector or +loaded business tools and an API Key is available. Inspect the host's native +connection or custom-connector manager, configure only the fixed target, and let +the user complete OAuth. If the Agent has no permitted management mechanism, +give the confirmed user setup step and keep MCP selected. Missing setup or +Agent management access must not trigger an API Key request, API secret read, +or business HTTP request. Check-only and preview requests still stop before setup. + > Use calle with MCP explicitly selected. Help me connect for the first time and perform one safe read-only verification. You may configure the specified host connection and log in. Do not dial or write business data. Acceptance: reuse an existing correct connection. For missing setup, prefer the current host's exposed native management capabilities. When unavailable, an already-installed official MCP management command may configure or authenticate the target under the [connection guidance](connection.md#host-interface-and-tool-flow). Match the current host and verify command support; a terminal alone is insufficient. Respect explicit no-CLI instructions and host permission denials. Do not repeat login if adding the connection already started OAuth. After the user completes the browser flow, verify the host callback. If the current chat lacks tools, follow actual supported refresh steps, discover schemas, and perform a suitable read-only call through MCP tools. Record configuration, OAuth, discovery, reading, and identity checks separately. Without a suitable read-only tool, do not claim business reading passed; without identity fields, report identity unverified. If no permitted setup mechanism exists, give only the confirmed missing user step. diff --git a/tests/README.md b/tests/README.md index d4d3228..4b9df72 100644 --- a/tests/README.md +++ b/tests/README.md @@ -1,6 +1,6 @@ # calle Offline Development Tests -Current canonical identity is `calle` with metadata/evaluation version `1.0.2`. +Current canonical identity is `calle` with metadata/evaluation version `1.0.3`. Scenario IDs remain stable across the rename. Earlier `callev2` and `calle-connect` records retain their original names, versions and hashes; they do not establish acceptance of this canonical artifact. The initial @@ -117,15 +117,15 @@ migrated. ## Behavior Evaluation Status -The inventory contains **125 formal Agent + mock-tool scenarios**: -105 [repository scenarios](behavior/calle-evals.json), +The inventory contains **126 formal Agent + mock-tool scenarios**: +106 [repository scenarios](behavior/calle-evals.json), 12 [extra scenarios](extra-behavior-cases.json), and 8 [round-one scenarios](behavior/round-1-cases.json). The dated record contains actual model execution and independent review evidence; see the [readiness record](../docs/verification/calle-connect-release-readiness-2026-10-21.md) for results and remaining gaps. A generated NOT_RUN inventory is not a current execution report, and neither a completed turn nor a mock unit test is a PASS. -The repository suite preserves the original 30 API and 27 MCP IDs and adds 14 routing +The repository suite preserves the original 30 API and 27 MCP IDs and adds 15 routing cases, 1 unified update-source case, 1 MCP preview case with a missing ID, and 9 host management boundary cases, 12 current MCP tool-selection and execution cases, and 3 public endpoint cases, 3 first-use API onboarding cases, and @@ -148,6 +148,13 @@ no write, OAuth, configuration, or shell permissions. Recovery scenarios for previously submitted requests retain their own restricted action sets. New routing authorization cannot be used to recreate an already submitted call. +The missing-connection routing case includes native custom-connector management, +user-managed setup and unknown host support. It requires MCP setup or an honest +capability handoff rather than API Key fallback, even when a Key is configured. +Its inspection-only ceiling permits no configuration, OAuth, credential reads or +HTTP. These synthetic definitions remain NOT_RUN until an Agent is evaluated; +fixture and dispatch tests do not establish Muse behavior. + The first-use API cases cover one initially authorized Hello call across private Key saving, unavailable browser fallback and an already-owned but unbound Key. An explicitly listed native browser mock opens only the fixed official Dashboard; diff --git a/tests/agent-evaluation.md b/tests/agent-evaluation.md index f5bdd7f..7a6ce13 100644 --- a/tests/agent-evaluation.md +++ b/tests/agent-evaluation.md @@ -1,6 +1,6 @@ # Offline Agent Evaluation Adapters and Grading -Current canonical identity is `calle` with metadata/evaluation version `1.0.2`. +Current canonical identity is `calle` with metadata/evaluation version `1.0.3`. Scenario IDs remain stable across the rename. Earlier `callev2` and `calle-connect` records retain their original names, versions and hashes; they do not establish acceptance of this canonical artifact. The initial @@ -358,6 +358,7 @@ scenario reports. | Behavior | Scenarios and required evidence | | --- | --- | | MCP takes priority over an available Key | route-01: discovery and MCP read-only traces; zero API secret reads or HTTP requests. | +| Missing connection or unknown host support | route-15 native-custom-connector, user-managed-setup and unknown-host-support: inspect host management as well as loaded tools; keep MCP selected in supporting hosts, give only the remaining user step when necessary, and report unknown support honestly. Zero API Key requests, credential reads, HTTP, configuration or OAuth under the check-only scope. | | Explicit user interface selection | route-02, route-03: retain the explicit selection without automatically configuring or using the other interface. | | Host lacks MCP, or complete discovery confirms missing capability | route-04, route-05: bind the API target, environment, and secure credential before execution; retain the qualification that identity has not been independently verified. | | Incomplete discovery | route-06: complete pagination or refresh; do not equate unloaded tools with unsupported capabilities. | diff --git a/tests/behavior/calle-evals.json b/tests/behavior/calle-evals.json index 926b35d..896526c 100644 --- a/tests/behavior/calle-evals.json +++ b/tests/behavior/calle-evals.json @@ -1,6 +1,6 @@ { "skill": "calle", - "version": "1.0.2", + "version": "1.0.3", "evaluation_status": "not_executed_on_an_agent", "notice": "Synthetic offline Agent behavior fixtures only. Original API/MCP IDs are retained with explicitly selected interfaces; routing and updates use separate mock scopes. No Agent execution, real credentials or live service results are represented.", "cases": [ @@ -3912,6 +3912,70 @@ "execution_status": "NOT_RUN", "mock_authorization_rule": "Mock-only maximum; capability selection precedes business writes. Scope does not authorize network, credentials outside the selected source, CLI, OAuth bypass, or replay." }, + { + "id": "route-15", + "skill": "calle", + "mock_action_scope": "routing", + "selected_transport": "undecided", + "prompt": "Check my CALL-E connection and tell me the next setup step for calls. Do not configure anything, log in, or dial yet.", + "setup": { + "fixture_only": true, + "transport": "mock_only", + "current_host": "simulated_mobile_agent", + "host_mcp": "supported", + "mcp_connection": "missing", + "native_management": "available_and_permitted", + "custom_connector_management": "available", + "loaded_business_tools": [], + "api_key": "configured", + "secret_source": "host_secret:fixture-route-missing", + "http_tool": "secure_https_available", + "business_write_sent": false + }, + "expected": [ + "Inspect non-secret host connection and management metadata before selecting the route; no CALL-E connector or loaded business tool does not establish that the host lacks MCP support.", + "In a supporting host, select MCP and explain the next authorized setup sequence: configure the fixed production MCP URL, complete host-managed OAuth, then load and discover tools. Keep the configured API Key unused.", + "This check-only request stops at inspection and the setup handoff; do not configure, start OAuth, read API credentials, request an API Key, send HTTP, or dial." + ], + "mock_allowed_actions": [ + "local.report", + "host.inspect_existing_connection" + ], + "execution_status": "NOT_RUN", + "mock_authorization_rule": "Synthetic routing inspection and next-step reporting only. Available host management and API capabilities do not authorize their use in this check-only task. No network, credentials, setup, login, business writes, shell, or proxy installation.", + "variants": [ + { + "id": "native-custom-connector", + "expected": [ + "Identify the host's available native custom-connector manager as the MCP setup path despite the missing CALL-E connection, without asking the user to switch to API Key setup." + ] + }, + { + "id": "user-managed-setup", + "setup": { + "native_management": "unavailable_to_agent", + "custom_connector_management": "user_interface_only", + "installed_official_command": "unavailable", + "confirmed_settings_entry": "Fixture Settings > Connectors" + }, + "expected": [ + "Keep MCP selected and give the confirmed user settings entry and fixed production URL. The Agent's missing management capability is not an unsupported host and does not authorize API fallback, a replacement client, or a guessed command." + ] + }, + { + "id": "unknown-host-support", + "setup": { + "host_mcp": "unknown", + "mcp_connection": "unknown", + "native_management": "unknown", + "custom_connector_management": "unknown" + }, + "expected": [ + "Report host MCP support as unverified and explain the missing capability evidence. Do not classify the host as unsupported, invent settings, or select API merely because no tools are loaded." + ] + } + ] + }, { "id": "connect-update-01", "skill": "calle", @@ -5084,7 +5148,7 @@ { "id": "api-polling-01", "skill": "calle", - "version": "1.0.2", + "version": "1.0.3", "selected_transport": "api", "mock_action_scope": "api_call", "execution_status": "NOT_RUN", @@ -6561,7 +6625,7 @@ { "id": "mcp-polling-01", "skill": "calle", - "version": "1.0.2", + "version": "1.0.3", "selected_transport": "mcp", "mock_action_scope": "mcp_call", "execution_status": "NOT_RUN", diff --git a/tests/test_behavior_preparation.py b/tests/test_behavior_preparation.py index 555dd2a..8bd3530 100644 --- a/tests/test_behavior_preparation.py +++ b/tests/test_behavior_preparation.py @@ -168,7 +168,7 @@ def test_polling_groups_preserve_read_only_actions_and_phased_long_results(self) fixture = case["fixture"] source = fixture["source_case"] self.assertEqual(source["execution_status"], "NOT_RUN") - self.assertEqual(source["version"], "1.0.2") + self.assertEqual(source["version"], "1.0.3") self.assertEqual(set(fixture["allowed_actions"]), {"local.report", "journal.read", "journal.write", "host.mock_wait", "http.GET" if transport == "api" else "mcp.get_call"}) @@ -608,14 +608,14 @@ def test_routing_scope_cannot_gain_writes_oauth_install_or_process_permissions(s def test_routing_fixture_permissions_preserve_critical_negative_cases(self): catalog = {case["id"]: case for case in build_catalog(ROOT)} - for number in (1, 3, 6, 7, 8, 10, 12, 13): + for number in (1, 3, 6, 7, 8, 10, 12, 13, 15): actions = catalog[f"route-{number:02}"]["fixture"]["allowed_actions"] self.assertNotIn("http.GET", actions) self.assertNotIn("host.mock_secret_read", actions) for number in (2, 4, 5, 9, 11): self.assertIn("http.GET", catalog[f"route-{number:02}"]["fixture"]["allowed_actions"]) self.assertNotIn("host.mock_discovery", catalog["route-09"]["fixture"]["allowed_actions"]) - for number in range(1, 14): + for number in range(1, 16): self.assertFalse(any("POST" in action or "write" in action for action in catalog[f"route-{number:02}"]["fixture"]["allowed_actions"])) diff --git a/tests/test_skill_integrity.py b/tests/test_skill_integrity.py index 3b0abc3..ccfa787 100644 --- a/tests/test_skill_integrity.py +++ b/tests/test_skill_integrity.py @@ -33,7 +33,7 @@ def test_canonical_identity_has_consistent_install_and_ui_metadata(self): metadata = yaml.safe_load((skill / "SKILL.md").read_text().split("---", 2)[1]) interface = yaml.safe_load((skill / "agents/openai.yaml").read_text())["interface"] self.assertEqual(metadata["name"], skill.name) - self.assertEqual(metadata["metadata"]["version"], "1.0.2") + self.assertEqual(metadata["metadata"]["version"], "1.0.3") self.assertEqual(interface["display_name"], metadata["name"]) self.assertIn("$calle", interface["default_prompt"]) self.assertGreaterEqual(len(interface["short_description"]), 25)