Remote-safe: pipe/card/field/member/webhook/portal read tools

[mocha06]

Closes #441. Part of migrating the default-deny remote profile to expose the read tools that meet the remote-safe criteria (milestone: Hosted-safe tool surface). Stacked on rc-dev/feat/remote-safe-report-reads.

Motivation

Under --profile remote the server exposes only tools carrying meta=REMOTE (tracked by REMOTE_SEED); many pure read tools that reach the API with the request-scoped bearer and are fully governed by API permissions were still withheld. This exposes the remaining core relation/config/membership/portal reads.

Outcome

Marks 14 read tools remote-safe: get_card_relations, get_card_inbox_emails, get_field_condition, get_field_conditions, get_labels, get_pipe_members, get_pipe_relations, get_phase_allowed_move_targets, get_phase_cards_count, get_table_relations, get_webhooks, get_email_templates, get_portal, list_portals. Each tool carries meta=REMOTE and a matching REMOTE_SEED entry; the drift-guard test keeps the two in lockstep. No new tools, no behavior change under the local profile.

Remote-profile validation

The remote-safe read migration (this PR is part of the stack #437→#441) was verified end-to-end by running the code in --profile remote --transport http locally — behaving as a deployed instance — and connecting an MCP HTTP client with a valid RS256 Keycloak bearer. Measured on an integration branch that also carried the in-flight provider-write work (#434), so the withheld count includes those write tools:

#	Scenario	Observed	Verdict
1	Server in --profile remote --transport http	exposed 76, withheld 106 (default-deny)	✅
2	Unauthenticated request	401 (bearer required)	✅
3	tools/list with a valid RS256 bearer	exactly the 76 remote-safe tools	✅
4	Remote-safe reads present	get_organization, get_pipe, get_llm_providers, get_ai_agents	✅
5	Writes / local-file / raw GraphQL withheld	create_card, create_llm_provider, delete_card, upload_attachment_to_card, execute_graphql absent — 0 leaked	✅
6	Live authenticated tool call (per-request bearer → outbound)	get_organization executed (isError=false)	✅

The 76 remote-safe tools are the 23 pre-existing plus the 53 read tools this migration set (#437–#441) adds. Registration-time filtering is also covered by the test_remote_profile.py drift-guard and test_on_exposes_seed_and_withholds_the_rest.

[adriannoes]

Summary

LGTM for #441. The 14 read tools lockstep meta=REMOTE with REMOTE_SEED, local drift-guard is green, and mutations in the touched modules stay unmarked. No local-profile behavior change. Approving the allowlist slice.

What worked well

• Exact 14↔14 marker/seed match with the same drift-guard pattern as the rest of the #443→#447 stack.
• Write paths in the same files (create_webhook, portal CRUD, relation mutations, membership mutators) correctly left unmarked.

Also noted

• Please reword the new #441 REMOTE_SEED comment before merge: it says relation reads may hit Pipefy's Internal API, but get_pipe_relations, get_table_relations, and get_card_relations use public GraphQL only. Internal is for mutations such as delete_card_relation, which stay withheld. Prefer public GraphQL for those getters (and Interfaces for portal reads if you mention endpoints). Comment-only; allowlist membership is fine.
• Stack tip: merge after #443→#446 (or retarget the base). GitHub checks empty on this stacked head is process noise given local green.
• PR body "76 exposed" matches this tip's seed; withheld "106" is full-stack measurement (including #434 writes), not a tip defect.

Review path

• Checked out the PR tip, ran ruff on touched paths and test_remote_profile.py (7 passed) plus the remote-mode server seed test.
• Cross-checked sibling stack reviews (#443→#446): same APPROVE / 0-inline bar for marker-only slices; this tip's only surviving note is the seed-comment accuracy nit above.

The base branch was changed.

[adriannoes]

LGTM