From 0e22722e0d9ca3969290616bed5e03db172ab72e Mon Sep 17 00:00:00 2001 From: fullsend-code <278716306+fullsend-ai-coder[bot]@users.noreply.github.com> Date: Thu, 10 Sep 2026 21:12:29 +0000 Subject: [PATCH] docs(#4697): extend @visibility guidance to entity provider packages Add a "Config declarations in entity provider packages" subsection to the boost AGENTS.md, placed after the existing "Adding new config fields" section. This covers ogx-entity-provider and kagenti-entity-provider, which maintain their own config.d.ts files outside the centralized Zod schema system. The new guidance instructs agents to: 1. Declare every field the config reader reads in config.d.ts 2. Add @visibility backend/secret annotations on sensitive fields 3. Reuse utilities from boost-connector-utils instead of duplicating This addresses the gap where the code agent omitted @visibility annotations on security-sensitive fields in PR #4574 because the existing guidance was scoped only to boost-backend. Closes #4697 Co-Authored-By: Claude Opus 4.6 --- workspaces/boost/AGENTS.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/workspaces/boost/AGENTS.md b/workspaces/boost/AGENTS.md index fd2f829629c..21b02e57349 100644 --- a/workspaces/boost/AGENTS.md +++ b/workspaces/boost/AGENTS.md @@ -159,6 +159,25 @@ failures or config-surface drift. When reviewing PRs that add or modify `boost.*` config keys, verify all five registration steps above were completed. +### Config declarations in entity provider packages + +The `ogx-entity-provider` and `kagenti-entity-provider` packages each +maintain their own `config.d.ts` (they do not use the centralized Zod +schema system in `boost-backend`). When adding or modifying config +fields in these packages: + +1. Declare **every** field that the package's config reader function + reads (e.g., `readOgxEntityProviderConfig`) in the package's + `config.d.ts`. Backstage uses `config.d.ts` for config validation + and visibility enforcement — undeclared fields bypass both. +2. Add `@visibility backend` to any field that holds secrets or + security-sensitive data (API keys, certificates, TLS bypass flags). + Add `@visibility secret` to fields that must never appear in + frontend config (e.g., `apiKey`). +3. Check `boost-connector-utils` for reusable TLS and HTTP utilities + (`isValidPem`, `createHttpsAgent`, `safeGetOptionalString`) before + implementing equivalents locally. + ### Wiring startup logic When adding a new initialization, migration, or validation method to