update_meta_inputs: require operator approval, rename to request_update_meta_inputs

hive-c0re/src/actions.rs

@@ -69,6 +69,14 @@ pub async fn approve(coord: Arc<Coordinator>, id: i64) -> Result<()> {
             .await;
             finish_approval(&coord, &approval, result, None)
         }
+        ApprovalKind::UpdateMetaInputs => {
+            // Decode the inputs from the commit_ref field (stored as JSON
+            // by submit_apply_commit's counterpart in manager_server.rs).
+            let inputs: Vec<String> =
+                serde_json::from_str(&approval.commit_ref).unwrap_or_default();
+            let result = crate::meta::lock_update(&inputs).await;
+            finish_approval(&coord, &approval, result, None)
+        }
         ApprovalKind::Spawn => {
             // Run the spawn in the background so the approve POST returns
             // immediately. The dashboard reads `transient` to render a spinner.
@@ -158,6 +166,7 @@ fn finish_approval(
         ApprovalKind::Spawn => "spawn",
         ApprovalKind::ApplyCommit => "apply_commit",
         ApprovalKind::InitConfig => "init_config",
+        ApprovalKind::UpdateMetaInputs => "update_meta_inputs",
     };
     let sha_short = approval
         .fetched_sha
@@ -199,6 +208,9 @@ fn finish_approval(
             sha: approval.fetched_sha.clone(),
             tag: terminal_tag,
         }),
+        // UpdateMetaInputs: ApprovalResolved already carries the result.
+        // No separate lifecycle event needed.
+        ApprovalKind::UpdateMetaInputs => {}
     }
     result
 }
@@ -462,6 +474,7 @@ pub async fn deny(coord: &Coordinator, id: i64, note: Option<&str>) -> Result<()
             ApprovalKind::Spawn => "spawn",
             ApprovalKind::ApplyCommit => "apply_commit",
             ApprovalKind::InitConfig => "init_config",
+            ApprovalKind::UpdateMetaInputs => "update_meta_inputs",
         };
         let sha_short = sha.as_deref().map(|s| s[..s.len().min(12)].to_owned());
         let description = a.description.clone();

hive-c0re/src/approvals.rs

@@ -285,6 +285,7 @@ fn row_to_approval(row: &rusqlite::Row<'_>) -> rusqlite::Result<Approval> {
         "apply_commit" => ApprovalKind::ApplyCommit,
         "spawn" => ApprovalKind::Spawn,
         "init_config" => ApprovalKind::InitConfig,
+        "update_meta_inputs" => ApprovalKind::UpdateMetaInputs,
         other => {
             return Err(rusqlite::Error::FromSqlConversionFailure(
                 2,
@@ -326,6 +327,7 @@ fn kind_to_str(kind: ApprovalKind) -> &'static str {
         ApprovalKind::ApplyCommit => "apply_commit",
         ApprovalKind::Spawn => "spawn",
         ApprovalKind::InitConfig => "init_config",
+        ApprovalKind::UpdateMetaInputs => "update_meta_inputs",
     }
 }
 
@@ -334,6 +336,7 @@ fn kind_from_str(s: &str) -> Result<ApprovalKind> {
         "apply_commit" => ApprovalKind::ApplyCommit,
         "spawn" => ApprovalKind::Spawn,
         "init_config" => ApprovalKind::InitConfig,
+        "update_meta_inputs" => ApprovalKind::UpdateMetaInputs,
         other => bail!("unknown approval kind '{other}'"),
     })
 }

hive-c0re/src/dashboard.rs

@@ -575,6 +575,7 @@ fn history_view(a: Approval) -> ApprovalHistoryView {
         hive_sh4re::ApprovalKind::ApplyCommit => "apply_commit",
         hive_sh4re::ApprovalKind::Spawn => "spawn",
         hive_sh4re::ApprovalKind::InitConfig => "init_config",
+        hive_sh4re::ApprovalKind::UpdateMetaInputs => "update_meta_inputs",
     };
     ApprovalHistoryView {
         id: a.id,
@@ -623,6 +624,14 @@ async fn build_approval_views(approvals: Vec<Approval>) -> Vec<ApprovalView> {
                 diff: None,
                 description: a.description,
             },
+            hive_sh4re::ApprovalKind::UpdateMetaInputs => ApprovalView {
+                id: a.id,
+                agent: a.agent,
+                kind: "update_meta_inputs",
+                sha_short: None,
+                diff: None,
+                description: a.description,
+            },
         });
     }
     out

hive-c0re/src/manager_server.rs

@@ -311,21 +311,47 @@ async fn dispatch(req: &ManagerRequest, coord: &Arc<Coordinator>) -> ManagerResp
                 },
             }
         }
-        ManagerRequest::UpdateMetaInputs { inputs } => {
+        ManagerRequest::RequestUpdateMetaInputs {
+            inputs,
+            description,
+        } => {
             let label = if inputs.is_empty() {
                 "all inputs".to_string()
             } else {
                 inputs.join(", ")
             };
-            tracing::info!(%label, "manager: update_meta_inputs");
-            // Treat empty list as "update all" by passing the full list
-            // to lock_update; it calls bare `nix flake update` when empty.
-            match crate::meta::lock_update(inputs).await {
-                Ok(()) => ManagerResponse::Ok,
-                Err(e) => ManagerResponse::Err {
-                    message: format!("update_meta_inputs({label}): {e:#}"),
-                },
-            }
+            tracing::info!(%label, "manager: request_update_meta_inputs");
+            // Encode the inputs list as JSON and store it in commit_ref
+            // (there's no git commit involved; the field carries the
+            // payload for the approval handler to decode at run time).
+            let commit_ref = serde_json::to_string(inputs).unwrap_or_default();
+            let id = match coord
+                .approvals
+                .submit_kind(
+                    hive_sh4re::MANAGER_AGENT,
+                    hive_sh4re::ApprovalKind::UpdateMetaInputs,
+                    &commit_ref,
+                    description.as_deref(),
+                )
+                .map_err(|e| anyhow::anyhow!("{e:#}"))
+            {
+                Ok(id) => id,
+                Err(e) => {
+                    return ManagerResponse::Err {
+                        message: format!("queue update_meta_inputs approval: {e:#}"),
+                    }
+                }
+            };
+            tracing::info!(%id, %label, "update_meta_inputs approval queued");
+            coord.emit_approval_added(
+                id,
+                hive_sh4re::MANAGER_AGENT,
+                "update_meta_inputs",
+                None,
+                None,
+                description.clone(),
+            );
+            ManagerResponse::Ok
         }
         ManagerRequest::Ask {
             question,