vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

hive-c0re: scope list_schedules to what the requester can actually act on

Browse source 
handle_list_schedules took no requester and returned every schedule
unfiltered, unlike cancel_schedule/edit_schedule/fire_schedule_now
which all gate on the shared ownership predicate (self, operator, or
subtree via topology::is_descendant_of). list_schedules now filters
through the same predicate, renamed cancel_authorized ->
schedule_authorized since it backs all four verbs now, not just
cancel.

Fixed five stale 'every schedule' / 'unfiltered' claims found while in
here: filter_ghost_schedule_targets's doc comment, the list_schedules
MCP tool description, docs/tools/scheduling.md's per-verb section
(already self-contradicting its own top-of-file subtree-scoping claim
before this fix), and hive-core-agent-sock's ListSchedules/Schedules
wire-type doc comments (including a stale '(privileged)' marker from
the pre-topology-subtree model).

Credit to atlas: independently found the same fix while finishing
PR #4233 (which documents this bug per mara's 'fix it, don't document
it' ruling) and caught two stale doc spots I'd missed
(hive-core-agent-sock's comments) plus proposed the
schedule_authorized rename. Compared diffs directly before either of
us pushed; he dropped his scheduling.rs changes so we didn't collide.

fixes #4237
This commit is contained in:
damocles 2026-09-11 17:25:45 +02:00 • committed by mara
commit 79c43a15d8
5 changed files with 75 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

7
hive-core-agent-sock/src/lib.rs
View file

@ -191,7 +191,9 @@ pub enum Request {
#[serde(default, skip_serializing_if = "Option::is_none")]
targets: Option<Vec<String>>,
},
/// *(privileged)* List every schedule in the queue.
/// List the schedules the requester is authorized to see: its own,
/// plus any owned by an agent in its subtree (everything, for the
/// operator).
ListSchedules,
/// List the calling agent's subtree — children, their children, and so
/// on down, plus the caller itself, which is part of its own subtree.
@ -294,7 +296,8 @@ pub enum Response {
/// requested filters. Returned on the agent socket when the agent
/// holds the `read_host_journal` capability.
HostJournal { content: String },
/// `ListSchedules` result. Snapshot of every schedule.
/// `ListSchedules` result. Snapshot of the schedules the requester is
/// authorized to see — see `ListSchedules`'s own doc comment.
/// Returned on the manager socket only.
Schedules { schedules: Vec<WireSchedule> },
/// `CreateRepo` result: the new repo's full name (`agents/<repo>`)