Prevent wrong-scope GitOps agent deletion

[cursor]

Description

Fixes a destructive scope-resolution bug in gitops_agent deletion. Because GitOps agents use raw identifiers and support account, org, and project scope, omitting resource_scope caused the registry's scopeOptional behavior to omit configured org/project defaults and issue an account-scoped DELETE. A project-context deletion could therefore remove an account agent with the same identifier.

The operation now requires explicit resource_scope, rejects empty required params, documents safe account/org/project calls, and includes registry and public-handler regression coverage.

Type of Change

• Bug fix
• New feature
• Refactor
• Documentation
• Other

Checklist

• pnpm test passes
• pnpm typecheck passes
• pnpm build passes
• pnpm standards:check passes (architecture guardrails — see docs/coding-standards.md)
• pnpm docs:check passes (if registry/tool counts changed)

Coding Standards (registry-driven MCP model)

If this PR adds or changes Harness API coverage:

• No new server.registerTool() calls — only toolset definitions in src/registry/toolsets/
• Toolset registered in ALL_TOOLSETS and ToolsetName union
• operationPolicy on every new/changed endpoint
• Shared response extractors from src/registry/extractors.ts (no raw passthrough on real endpoints)
• identifierFields and scope declared on new resources
• No console.log() in src/ (stdio JSON-RPC safety)

  

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cursor]

Risk Assessment: Low

Decision: Eligible for approval — no additional reviewers required. (GitHub blocked bot self-approval on this PR.)

Evidence (from diff only)

Area	Change	Impact
src/registry/toolsets/gitops.ts	resource_scope made required for gitops_agent delete; docs updated	Fixes wrong-scope DELETE when org/project defaults are suppressed
src/registry/index.ts	Required-param validation also rejects empty strings	Fail-closed guard; prevents resource_scope: "" bypass
Tests	Registry + harness_delete regressions for omitted/empty/explicit scopes	Strong coverage for the fixed path
tasks/todo.md	Internal task notes	No runtime impact

Rationale

• Blast radius: Narrow — primary behavior change is GitOps agent deletion; the registry one-liner is defensive validation on an existing required-param check.
• Complexity: Low; logic is easy to follow and well tested.
• Operational risk: Reduces risk (prevents accidental account-scoped deletion of a project agent with the same raw ID).
• Breaking change: Callers omitting resource_scope will now error instead of issuing a destructive wrong-scope request — intentional and correct.

No CODEOWNERS gate detected. No reviewers assigned.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Inline comment autofix — no comments to address

Triggered on ready_for_review for PR #647. Checked GitHub review threads and inline review comments via API — none found from human reviewers.

No code changes were made on this run. When inline review comments are left on the diff, this automation will attempt a minimal fix and reply on each thread.

  

_{Sent by Cursor Automation: Autofix PR review comments}

[thisrohangupta]

Closing as superseded. This overlaps the GitOps agent-delete scope fix in #666, which is the newest and only mergeable attempt in this cluster (this one is CONFLICTING against main). Consolidating on #666.