feat(#513): inject HIVE_TOOL_GROUPS from meta tool-groups.json per agent

hive-c0re/src/tool_groups.rs

@@ -0,0 +1,88 @@
+//! Per-agent tool-group configuration. Stored at
+//! `/var/lib/hyperhive/meta/tool-groups.json` alongside `topology.json`
+//! and the meta `flake.nix`.
+//!
+//! Format: a JSON object mapping agent name to an array of
+//! `hive_sh4re::ToolGroup` snake_case strings:
+//!
+//! ```json
+//! {
+//!   "alice": ["messaging", "meta", "inbox", "lifecycle"],
+//!   "bob":   ["messaging", "meta", "inbox"]
+//! }
+//! ```
+//!
+//! An absent entry (or an absent file) means "use the harness role
+//! default" — agents get `messaging + meta + inbox`, the manager gets
+//! all groups. `render_flake` in `meta.rs` reads this file and
+//! injects `HIVE_TOOL_GROUPS` into each agent's systemd service env;
+//! agents with no entry get no env var and the harness falls back.
+//!
+//! Write path: `set_groups` is called from the dashboard action handler
+//! that the operator uses to grant/revoke tool groups per agent.
+//! The manager may also request group changes via an approval; hive-c0re
+//! applies the change on approval, commits the file, and cascades a rebuild.
+
+use std::collections::BTreeMap;
+use std::path::PathBuf;
+
+const TOOL_GROUPS_FILE: &str = "tool-groups.json";
+
+#[must_use]
+pub fn tool_groups_path() -> PathBuf {
+    crate::meta::meta_dir().join(TOOL_GROUPS_FILE)
+}
+
+/// Read the per-agent tool-group map. Returns an empty map when the
+/// file is absent or unparsable — callers treat a missing entry as
+/// "use role default".
+#[must_use]
+pub fn read() -> BTreeMap<String, Vec<String>> {
+    let path = tool_groups_path();
+    let Ok(raw) = std::fs::read_to_string(&path) else {
+        return BTreeMap::new();
+    };
+    serde_json::from_str(&raw).unwrap_or_default()
+}
+
+/// Look up the configured tool groups for one agent. Returns an empty
+/// vec when the agent has no entry — callers should treat this as
+/// "use the harness role default."
+#[must_use]
+pub fn groups_for(name: &str) -> Vec<String> {
+    read().get(name).cloned().unwrap_or_default()
+}
+
+/// Persist the full tool-groups map. Sorted JSON output keeps diffs
+/// minimal. Best-effort — returns `io::Error` so callers decide
+/// whether to abort or log.
+pub fn write(map: &BTreeMap<String, Vec<String>>) -> std::io::Result<()> {
+    let path = tool_groups_path();
+    if let Some(parent) = path.parent() {
+        std::fs::create_dir_all(parent)?;
+    }
+    let text = serde_json::to_string_pretty(map)
+        .map_err(|e| std::io::Error::new(std::io::ErrorKind::InvalidData, e))?;
+    std::fs::write(&path, format!("{text}\n"))
+}
+
+/// Set the tool groups for one agent and persist the map. An empty
+/// `groups` vec removes the entry (agent reverts to role default).
+pub fn set_groups(name: &str, groups: &[String]) -> std::io::Result<()> {
+    let mut current = read();
+    if groups.is_empty() {
+        current.remove(name);
+    } else {
+        current.insert(name.to_owned(), groups.to_vec());
+    }
+    write(&current)
+}
+
+/// Drop the entry for an agent that is being destroyed. Idempotent.
+pub fn remove_agent(name: &str) -> std::io::Result<()> {
+    let mut current = read();
+    if current.remove(name).is_some() {
+        write(&current)?;
+    }
+    Ok(())
+}