[APPS-2958] Add: list each backend function's action calls in the debugBundle response - #607

P1 / post-GA follow-up: the upfront consent prompt isn't needed for GA.

Motivation

• APPS-2958: lets the host page that frames a dev-served app list the actions a preview's backend functions can call, for an upfront-consent UX before any call runs.
• Stacked on [APPS-2947 Fix: fail the build on connection IDs read from objects that calls or aliases write to]([APPS-2947] Fix: fail the build on connection IDs read from objects that calls or aliases write to #619), which builds on the merged [APPS-2947 Add: return connection IDs from debugBundle and attach the bundle to framed backend calls]([APPS-2947] Add: return connection IDs from debugBundle and attach the bundle to framed backend calls #566).

Architecture

flowchart LR
    REQ["POST /__dd/debugBundle, Accept: application/json"] --> NB["Nested Vite build of the function"]
    NB --> MG["Module-graph collector: app module records"]
    NB --> FQ["FQN collector: catalog export to fqn"]
    MG --> W["Action-catalog calls, one walk"]
    FQ --> W
    W --> IDS["allowedConnectionIds"]
    W --> ACT["actions, grouped by fqn"]
    IDS --> RES["code, allowedConnectionIds, actions?"]
    ACT --> RES
    RES --> DC["Dev client"] --> T["Transport"] --> MSG["run-query bundle, validated copy"]

interface DebugBundleResponse {
    code: string;
    allowedConnectionIds: string[];
    // UX hint, not a security boundary
    actions?: Array<{ fqn: string; connectionIds: string[] }>;
}

• Covers the calls allowedConnectionIds covers; each FQN comes from the loaded catalog module, not the import path (143 of 3,132 exports in @datadog/action-catalog@0.0.7 differ), and actions is omitted when any call's FQN is unknown.

Changes

QA Instructions

• Gates and live dev-server checks pass; no verified sha is recorded, so head e8815371 is unconfirmed. Setup: Local QA without npm link.

yarn build:all
# Expected: exit 0

TMPDIR=<a dir under /private/tmp> yarn test:unit packages/plugins/apps/src --testPathIgnorePatterns network-guard
# Expected: Test Suites: 44 passed; Tests: 979 passed (macOS needs a TMPDIR outside /var; CI on Linux doesn't)

yarn test:unit packages/plugins/apps/src/vite/network-guard.test.ts
# Expected: Tests: 129 passed, 129 total (run without TMPDIR set)

yarn lint && yarn typecheck:all && yarn cli integrity
# Expected: all exit 0, integrity leaves no extra changes

import { createAgent } from '@datadog/action-catalog/aws/agent';
import * as chat from '@datadog/action-catalog/slack/chat';

const SLACK_CONNECTION_ID = 'conn-slack';

export async function notify(channel: string) {
    await chat.deleteChat({ inputs: { channel, ts: '1' }, connectionId: SLACK_CONNECTION_ID });
    await chat.deleteChat({ inputs: { channel, ts: '2' }, connectionId: 'conn-slack-backup' });
    return createAgent({ inputs: { agentName: 'qa' } as never, connectionId: 'conn-aws' });
}

// Starts a real Vite dev server for qa-app with the vite plugin built from the worktree.
import { createRequire } from 'module';
import path from 'path';
import { pathToFileURL } from 'url';

const [worktree, appRoot, port] = process.argv.slice(2);
const requireFromWorktree = createRequire(path.join(worktree, 'package.json'));
const { createServer } = await import(pathToFileURL(requireFromWorktree.resolve('vite')).href);
const { datadogVitePlugin } = await import(
    pathToFileURL(path.join(worktree, 'packages/published/vite-plugin/dist/src/index.mjs')).href
);

const server = await createServer({
    configFile: false,
    root: appRoot,
    logLevel: 'info',
    server: { port: Number(port), strictPort: true },
    plugins: [datadogVitePlugin({ apps: {} })],
});
await server.listen();
console.log(`qa-server listening on ${port}`);

node qa-server.mjs "$WORKTREE" "$PWD/qa-app" 5281 &
QN=$(curl -s http://localhost:5281/backend/notify.backend.ts | grep -o '[0-9a-f]\{64\}\.notify' | head -1)

curl -s -o qa-json.txt -w "HTTP %{http_code} %{content_type}\n" -X POST http://localhost:5281/__dd/debugBundle \
  -H 'Content-Type: application/json' -H 'Accept: application/json' -d "{\"functionName\":\"$QN\"}"
# Expected: HTTP 200 application/json; keys [code, allowedConnectionIds, actions] ✅ VERIFIED

curl -s -o qa-plain.txt -w "HTTP %{http_code} %{content_type}\n" -X POST http://localhost:5281/__dd/debugBundle \
  -H 'Content-Type: application/json' -d "{\"functionName\":\"$QN\"}"
grep -o 'com\.datadoghq\.[A-Za-z.]*' qa-plain.txt | sort -u
# Expected: HTTP 200 text/plain; code === qa-json.txt's code; exactly the two FQNs listed in actions ✅ VERIFIED

{
  "code": "<2212 chars, identical to the text/plain response>",
  "allowedConnectionIds": ["conn-aws", "conn-slack", "conn-slack-backup"],
  "actions": [
    { "fqn": "com.datadoghq.aws.bedrock.agent.createAgent", "connectionIds": ["conn-aws"] },
    { "fqn": "com.datadoghq.slack.chat.deleteChat", "connectionIds": ["conn-slack", "conn-slack-backup"] }
  ]
}

Blast Radius

• Low: dev server only. actions is optional on the JSON debugBundle response and the framed bundle; the plain-text response, the production build and allowedConnectionIds are unchanged.
• No feature flag: the field is additive and dev-only.
• Each dev bundle also parses the loaded modules that contain a com.datadoghq. string.

Out of Scope / Follow-ups

Documentation

• The response shape is documented on DebugBundleResponse in packages/plugins/apps/src/backend/protocol.ts.

🤖 Generated with Claude Code