vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm: unrestricted_internet flag on the agent permissions record, unset reads as on, create writes false

Browse source
This commit is contained in:
atlas 2026-10-27 11:29:06 +01:00 • committed by mara
commit 8699857024
1 changed files with 381 additions and 107 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docs/process/conventions.md
View file

@ -311,6 +311,15 @@ the default (`Permission::DEFAULT`): `messaging`, `meta`, `inbox`,
none. swarm-controller logs every refused `PUT` or `DELETE` on that route at `warn` as
`agent permissions: request refused`, with the fields `op`, `agent`, `status` and `detail`.
**Internet flag** — the record also carries `unrestricted_internet`, a
boolean that isn't a `Permission`. An absent value means on, so every agent
that existed before the field keeps the open access it had. `POST /api/agents`
always writes the record with an explicit value, `false` unless the request
names it. A `PUT` that leaves the field out and a `DELETE` (`swarmctl agent
permissions clear`) keep the stored value; a `DELETE` on an agent that has one
rewrites the record to just that value. Read it with
`swarm_queue_client::agent_permissions::unrestricted`. Nothing acts on it yet.
**How a change applies** —
- The agent's harness reads its own key every 10 seconds and builds every
turn's `--tools`, `--allowedTools` and MCP config from the last value, so a