[arteeh]

Owners currently need environment variables to control anonymous Knowledge MCP access. This adds sharing controls to the Knowledge header and Settings, with an enable confirmation, tag scope, endpoint URL/copy, and read-only status for other viewers.

Authenticated GET /api/knowledge/public reports the effective settings; verified-owner PUT persists them through runtime config and the Kubernetes dashboard overlay. Explicit settings override environment variables, including disabled/empty values. Each MCP request uses a settings snapshot; subsequent requests stop immediately after disabling. Successful changes are audited and failed saves restore the prior runtime value.

Validation: gofmt -l is clean. Added regression tests for authorization, persistence/overlay restoration, environment precedence, public tag filtering, immediate disable, save failure, and UI confirmation cancellation. Tests were not run locally per AGENTS.md; CI owns execution.

Fixes #10676

— hive: backend=codex model=gpt-6-astra effort=medium

---

🐝 Hive Agent: contributor | SHA: c9a30f3ef

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign nicholasjackson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Open PR overlap check

Base branch: v5

Conflicts are checked with every PR merged onto the current tip of v5, so a PR that only needs a rebase is not reported as conflicting with its siblings.

PR	Title	Relation	Files
#10675	🐛 sync issue claim labels	same files	src/pkg/dashboard/static/index.html
#10678	✨ knowledge: owner toggle for the public read-only MCP endpoint in dashboard	CONFLICT	src/docs/env-vars.md src/docs/public-knowledge-mcp.md src/pkg/config/knowledge_config.go src/pkg/dashboard/mcp_knowledge.go src/pkg/dashboard/static/index.html

[hivecommons-hive]

Conflicts with #10678 (same issue #10676), and the dashboard toggle alone does not open the endpoint through the auth middleware.

Duplicate/conflict. #10678 adds the same GET/PUT /api/knowledge/public routes, the same knowledge.public config key and the same response shape. I read both diffs in full; the Go types differ (*PublicKnowledgeConfig here vs struct-with-*bool there) and source reports "config" here vs "setting" there, so they cannot both merge. Flagging for a maintainer: one should be closed. I have not closed anything.

Verified defect — isPublicPath still reads only the env (high). This PR switches handlePublicKnowledgeMCP to s.publicKnowledgeSettings() (src/pkg/dashboard/mcp_knowledge.go), but src/pkg/dashboard/server.go:1854 at this head is unchanged: case path == publicKnowledgeMCPPath && publicKnowledgeEnabled(): — the env-only function. authenticate (server.go:1508-1512) only short-circuits to next.ServeHTTP for public paths; otherwise the request falls through to the token/identity checks. So on a spoke with DASHBOARD_AUTH_TOKEN set and HIVE_PUBLIC_KNOWLEDGE unset, an owner who enables sharing from the dashboard gets a UI that says "enabled" and a URL that anonymous MCP clients cannot reach. #10678 makes isPublicPath a Server method and fixes this (server.go:1853 in that PR).

Conversely, this PR correctly adopts Knowledge.Public in loadWithDashboardOverlay (src/pkg/config/config.go:5444-5447), which #10678 lacks — each PR has half the fix. A maintainer should pick one branch to carry both halves.

Minor: PublicKnowledgeConfig.Enabled bool + pointer-to-struct means the overlay cannot express "explicitly disabled" vs "unset" at the field level, but the pointer on the struct handles it; fine as written.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Supersession sweep found that this PR's claimed issue is already closed by another merged PR.

• Claimed issue: hive#10676
• Closing PR: #10678

A different merged PR closed the claimed issue. Leaving this contributor PR open for a human to review.

This comment is edited in place by the supersession sweep; it is not duplicated.

[clubanderson]

Thanks @arteeh — this landed via #10678 (same scope: GET/PUT /api/knowledge/public, owner-only dashboard toggle, env fallback), which also carried the OpenAPI/api-reference updates. Closing as superseded; #10676 is covered.