feat(#1004,#1006): capability system + read_host_journal / get_host_journal MCP tool

hive-c0re/src/capabilities.rs

@@ -0,0 +1,95 @@
+//! Per-agent capability configuration. Stored at
+//! `/var/lib/hyperhive/meta/capabilities.json` alongside `topology.json`
+//! and `tool-groups.json`.
+//!
+//! Format: a JSON object mapping agent name to an array of
+//! `hive_sh4re::Capability` snake_case strings:
+//!
+//! ```json
+//! {
+//!   "atlas": ["read_host_journal"],
+//!   "root":  ["manage_root_agent"]
+//! }
+//! ```
+//!
+//! An absent entry (or an absent file) means "no extra capabilities".
+//! `render_flake` in `meta.rs` reads this file and injects
+//! `HIVE_CAPABILITIES` into each agent's systemd service env; absent
+//! entries emit no env var so agents without capabilities don't trigger
+//! a spurious rebuild.
+//!
+//! Write path: `set_caps` is called from the dashboard action handler
+//! that the operator uses to grant/revoke capabilities per agent.
+
+use std::collections::BTreeMap;
+use std::path::PathBuf;
+
+const CAPABILITIES_FILE: &str = "capabilities.json";
+
+#[must_use]
+pub fn capabilities_path() -> PathBuf {
+    crate::meta::meta_dir().join(CAPABILITIES_FILE)
+}
+
+/// Read the per-agent capability map. Returns an empty map when the
+/// file is absent or unparsable — callers treat a missing entry as
+/// "no extra capabilities".
+#[must_use]
+pub fn read() -> BTreeMap<String, Vec<String>> {
+    let path = capabilities_path();
+    let Ok(raw) = std::fs::read_to_string(&path) else {
+        return BTreeMap::new();
+    };
+    serde_json::from_str(&raw).unwrap_or_default()
+}
+
+/// Look up the configured capabilities for one agent. Returns an empty
+/// vec when the agent has no entry.
+#[must_use]
+pub fn caps_for(name: &str) -> Vec<String> {
+    read().get(name).cloned().unwrap_or_default()
+}
+
+/// Check whether an agent holds a specific capability.
+#[must_use]
+pub fn has_cap(name: &str, cap: hive_sh4re::Capability) -> bool {
+    caps_for(name)
+        .iter()
+        .any(|s| s.eq_ignore_ascii_case(cap.as_str()))
+}
+
+/// Persist the full capability map. Sorted JSON output keeps diffs
+/// minimal. Best-effort — returns `io::Error` so callers decide
+/// whether to abort or log.
+pub fn write(map: &BTreeMap<String, Vec<String>>) -> std::io::Result<()> {
+    let path = capabilities_path();
+    if let Some(parent) = path.parent() {
+        std::fs::create_dir_all(parent)?;
+    }
+    let text = serde_json::to_string_pretty(map)
+        .map_err(|e| std::io::Error::new(std::io::ErrorKind::InvalidData, e))?;
+    std::fs::write(&path, format!("{text}\n"))
+}
+
+/// Set the capabilities for one agent and persist the map. An empty
+/// `caps` vec removes the entry (agent has no capabilities).
+pub fn set_caps(name: &str, caps: &[String]) -> std::io::Result<()> {
+    let mut current = read();
+    if caps.is_empty() {
+        current.remove(name);
+    } else {
+        current.insert(name.to_owned(), caps.to_vec());
+    }
+    write(&current)
+}
+
+/// Remove an agent from the capability map entirely. Called by
+/// `meta::sync_agents` when an agent is deprovisioned so stale entries
+/// don't accumulate. No-op if the agent has no entry.
+pub fn remove_agent(name: &str) -> std::io::Result<()> {
+    let mut current = read();
+    if current.remove(name).is_some() {
+        write(&current)?;
+    }
+    Ok(())
+}