feat: docs and ui tweaks

surfsense_backend/tests/unit/agents/multi_agent_chat/subagents/shared/test_subagent_builder.py

@@ -25,6 +25,7 @@ from app.agents.chat.multi_agent_chat.shared.permissions.middleware.core import
     PermissionMiddleware,
 )
 from app.agents.chat.multi_agent_chat.subagents.shared.subagent_builder import (
+    append_today_utc,
     pack_subagent,
 )
 
@@ -104,6 +105,35 @@ async def test_subagent_recovers_when_primary_llm_fails():
     assert final.content == "recovered via fallback"
 
 
+def test_packed_subagent_prompt_carries_todays_utc_date():
+    """Subagents must inherit the main agent's clock, not guess the date."""
+    from datetime import UTC, datetime
+
+    today = datetime.now(UTC).date().isoformat()
+
+    result = pack_subagent(
+        name="date_test",
+        description="test",
+        system_prompt="be helpful",
+        tools=[],
+        ruleset=Ruleset(origin="date_test", rules=[]),
+        dependencies={"flags": AgentFeatureFlags()},
+    )
+
+    prompt = result.spec["system_prompt"]
+    assert prompt.startswith("be helpful")
+    assert f"Today (UTC): {today}" in prompt
+
+
+def test_append_today_utc_is_idempotent_shape():
+    """Helper appends exactly one dated line and preserves the original body."""
+    from datetime import UTC, datetime
+
+    today = datetime.now(UTC).date().isoformat()
+    out = append_today_utc("body")
+    assert out == f"body\n\nToday (UTC): {today}\n"
+
+
 def _extract_permission_mw(spec) -> PermissionMiddleware:
     """Find the lone PermissionMiddleware in a subagent's middleware list."""
     matches = [m for m in spec["middleware"] if isinstance(m, PermissionMiddleware)]

surfsense_backend/tests/unit/agents/multi_agent_chat/test_mcp_allowlist_fallback.py

@@ -0,0 +1,52 @@
+"""Allowlist filtering in ``_load_http_mcp_tools``.
+
+Covers the fallback added after Notion renamed its MCP tools ("notion-"
+prefix) and a stale allowlist silently disabled the connector: when the
+allowlist matches zero advertised tools, load everything (HITL-gated)
+instead of nothing.
+"""
+
+from datetime import UTC, datetime
+
+from app.agents.chat.multi_agent_chat.shared.tools.mcp.cache import (
+    CachedMCPTools,
+)
+from app.agents.chat.multi_agent_chat.shared.tools.mcp.tool import (
+    _load_http_mcp_tools,
+)
+
+_CACHED = CachedMCPTools(
+    discovered_at=datetime.now(UTC),
+    tools=[
+        {"name": "notion-search", "description": "search", "input_schema": {}},
+        {"name": "notion-update-page", "description": "write", "input_schema": {}},
+    ],
+)
+_SERVER_CONFIG = {"url": "https://example.com/mcp", "headers": {}}
+
+
+async def test_allowlist_match_filters_and_flags_readonly():
+    tools = await _load_http_mcp_tools(
+        1,
+        "Notion",
+        _SERVER_CONFIG,
+        allowed_tools=["notion-search"],
+        readonly_tools=frozenset({"notion-search"}),
+        cached_tools=_CACHED,
+    )
+    assert [t.name for t in tools] == ["notion-search"]
+    assert tools[0].metadata["hitl"] is False
+
+
+async def test_stale_allowlist_falls_back_to_all_tools_hitl_gated():
+    tools = await _load_http_mcp_tools(
+        1,
+        "Notion",
+        _SERVER_CONFIG,
+        allowed_tools=["search", "update-page"],  # server renamed everything
+        readonly_tools=frozenset({"search"}),
+        cached_tools=_CACHED,
+    )
+    assert sorted(t.name for t in tools) == ["notion-search", "notion-update-page"]
+    # Renamed tools match no readonly entry -> every tool requires approval.
+    assert all(t.metadata["hitl"] is True for t in tools)