always-on mark_todos_done: no ToolGroup ever exposed it, blocking every agent

This commit is contained in:
damocles 2026-08-03 19:08:52 +02:00
commit 8a16d4ca7e
3 changed files with 39 additions and 8 deletions

View file

@ -332,13 +332,16 @@ binary flavor.
| `scheduling` | `request_schedule_prompt`, `fire_schedule_now`, `cancel_schedule`, `edit_schedule`, `list_schedules` *(privileged)* |
| `diagnostics` | `get_logs` *(privileged)* |
**Always-on tools** — `set_status` is exposed to every agent regardless of
which groups it holds (`ToolGroup::ALWAYS_ON_TOOLS`). The operator dashboard
depends on every agent being able to report its status chip, and the
server-side `SetStatus` handler has no tool-group check (only length
validation), so gating it would only desync the `--allowedTools` list from
what the host actually accepts. Revoking `meta` therefore drops
`get_agent_meta` but never `set_status`.
**Always-on tools** — `set_status`, `compact`, and `mark_todos_done` are
exposed to every agent regardless of which groups it holds
(`ToolGroup::ALWAYS_ON_TOOLS`). The operator dashboard depends on every agent
being able to report its status chip, and the server-side `SetStatus` handler
has no tool-group check (only length validation), so gating it would only
desync the `--allowedTools` list from what the host actually accepts.
Revoking `meta` therefore drops `get_agent_meta` but never `set_status`.
`mark_todos_done` is here because todos are pushed to an agent independent of
whether it holds `inbox` — an agent without that group still needs a way to
clear them.
**Config storage** — per-agent tool groups live in
`/var/lib/hyperhive/meta/tool-groups.json` (hive-c0re-owned, committed to the