vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-ui: edit an agent's permissions on its detail panel

Browse source 
The detail panel had editors for inference, instructions, resource caps and
accounts, but nothing for the permissions the swarm grants, which could only
be set at create time or with swarmctl. A permissions row shows the grant
(the default set, none, or the list) and an edit dialog ticks the catalogue
from GET /api/permissions and saves with PUT /api/agents/{agent}/permissions.
Ticking exactly the default set sends the DELETE, as the create form sends no
list for it.
This commit is contained in:
iris 2026-10-24 23:25:31 +02:00 • committed by mara
commit 78c48272ee
5 changed files with 339 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

31
docs/swarm/ui.md
View file

@ -11,7 +11,7 @@ domain, covers host-level detail for one hive.
| ---------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `/` | the start page: the swarm's name over a digital-rain backdrop, plus a paperclip offering to set up an agent while no `ruth` exists (it opens the create form with `ruth` filled in); the swarm name in the header links here |
| `/hives` | the hive directory, each hive with its last reported status |
| `/agents` | every agent: status, config PR, wanted state, inference settings, resource caps; create agents (with their permissions, optionally from an [archetype](archetypes.md)), link forge, matrix and GitHub accounts |
| `/agents` | every agent: status, config PR, wanted state, inference settings, resource caps, permissions; create agents (with their permissions, optionally from an [archetype](archetypes.md)), link forge, matrix and GitHub accounts |
| `/agents/<name>/terminal` | one agent's live terminal |
| `/agents/<name>/subagents/<subagent>/terminal` | one of that agent's subagents' live terminal |
| `/alerts` | the alerts the swarm's Grafana holds now: the firing ones, with a button for the pending, no-data and error ones and a link to Grafana's own alert list; read through the controller with a Viewer service-account token |
@ -77,7 +77,7 @@ with no icon keeps the hyperhive mark.
The tab also has an agent badge, with the agent's icon and name, ahead of the
connection badge. It opens the agent's details in a popover under the badge:
the same status, wanted state, inference settings, resource caps and linked accounts as the
the same status, wanted state, inference settings, resource caps, permissions and linked accounts as the
panel on `/agents`, without the terminal preview. The popover doesn't dim the
page. Selecting outside it, or Escape, closes it. From the keyboard, opening a
popover moves focus into it, and Escape puts focus back on the badge. The filter
@ -503,6 +503,30 @@ row shows the new value before the agent runs under it. The panel reads
reason and a **retry** button. [hivectl](../tools/hivectl.md#per-agent-resource-limits)
sets the hive's own limits.
### Permissions
The agent's detail panel shows what the swarm grants it under **permissions**:
the default set, none, or a count with one badge per permission. A swarm
grant is the agent's whole set, so it follows the agent to whichever hive runs
it. **edit** opens a dialog with one checkbox per permission the controller
knows (`GET /api/permissions`), ticked as the grant stands, or on the default
set when the swarm sets none.
Saving does a `PUT /api/agents/{agent}/permissions` of the ticked boxes. A
`PUT` replaces the stored list whole, so an unticked box revokes that
permission, and ticking nothing grants nothing. Ticking exactly the default set sends the
`DELETE` instead, as the create form sends no list for it, so the agent follows
the default if it changes. **use the default** sends the `DELETE` too. The
dialog shows a refusal's reason under the boxes and leaves them as you ticked
them.
A saved change isn't instant. The hive reads the grant about every 30 seconds
and the agent takes it at its next turn. A change to `manage_root_agent`
restarts the agent after its current turn. The panel reads
`GET /api/agents/{agent}/permissions`; when that read fails, the panel shows
the reason and a **retry** button. `swarmctl agent permissions set` sets the
same grant from a shell.
### Settings at creation
The **+ agent** dialog has two collapsed sections, **resource caps** and
@ -549,7 +573,8 @@ The agent's detail panel lists its linked accounts under **accounts**, one row
per account: kind, name and host. Opening an agent makes one request,
`GET /api/hives/{hive}/agents/{agent}/linked-accounts`, which returns every
account of that agent as names and hosts and never a credential. When the panel
fails to read the accounts, the inference settings or the resource caps, it
fails to read the accounts, the inference settings, the resource caps or the
permissions, it
shows the reason as text. A list the panel already loaded stays on screen
beneath the error.