agent permissions: one set, tool groups included, set at agent creation
mara on #5170: "dont split caps and perms. its all perms. / dont include the now empty tool groups / nothing set -> default / also add perms to agent creation screen". - hive-sh4re: one `Permission` enum (messaging, meta, inbox, execution, web_tools, manage_root_agent) replaces `ToolGroup` and `Capability`; `lifecycle`/`forge` are gone. `Permission::default_for` is the default for an agent the swarm sets nothing for. - The record is `{ "permissions": [...] }`. Missing key, unset field or no successful read yet = default; `[]` = none; a failed read after a good one keeps the last value. - hive-agent reads its own key every 10s and builds each turn's --tools, --allowedTools and MCP config (rewritten before every turn) from it; the subagent daemon reads it on each start/continue. Agents get a read-only grant on their own key. - hive-c0re restarts an agent only when its manage_root_agent changes. The import now merges meta/capabilities.json and meta/tool-groups.json into one list per agent and deletes both; the "import pending, don't read" decision is `ImportOutcome::read_allowed`, table-tested. - swarm-controller: `GET /api/permissions` (names + default) and an optional `permissions` on `POST /api/agents`, stored before the job is queued. swarm-ui's create-agent form gets a permissions field. - Deleted: HIVE_TOOL_GROUPS and its forward to the subagent daemon, tool_groups.rs, ruth's tool-group seed, the permissions rebuild job (PermPayload/WritePermFile/perm_change), the dashboard permissions tab and its stale-entries panel. Part of #5170.
This commit is contained in:
atlas
mara
parent
f862354e43
commit
f0844f6da3
73 changed files with 1578 additions and 2742 deletions
|
|
@ -1,17 +1,16 @@
|
|||
//! Per-agent configuration registries: tool groups, resource limits,
|
||||
//! topology (JSON files under `/var/lib/hyperhive/meta/`), the capabilities
|
||||
//! the swarm grants (outside the meta repo) and the shared wire-protocol size
|
||||
//! limits. Each submodule is re-exported at the crate root, so
|
||||
//! `crate::topology::…` etc. keep working unchanged.
|
||||
//! Per-agent configuration registries: resource limits, topology (JSON files
|
||||
//! under `/var/lib/hyperhive/meta/`), the permissions the swarm grants
|
||||
//! (outside the meta repo) and the shared wire-protocol size limits. Each
|
||||
//! submodule is re-exported at the crate root, so `crate::topology::…` etc.
|
||||
//! keep working unchanged.
|
||||
//!
|
||||
//! Note the two similarly-named modules: [`limits`] caps inline
|
||||
//! *message body* sizes on the sockets, while [`resource_limits`] holds
|
||||
//! per-agent CPU/memory caps for the container drop-in.
|
||||
|
||||
pub mod capabilities;
|
||||
pub mod limits;
|
||||
pub mod permissions;
|
||||
pub mod resource_limits;
|
||||
pub mod tool_groups;
|
||||
pub mod topology;
|
||||
|
||||
use std::io::{self, Write as _};
|
||||
|
|
|
|||
|
|
@ -1,20 +1,22 @@
|
|||
//! The capabilities the swarm grants this hive's agents, as last read from the
|
||||
//! The permissions the swarm grants this hive's agents, as last read from the
|
||||
//! `agent-permissions` bucket by `workers::swarm_permissions`. Stored at
|
||||
//! `/var/lib/hyperhive/swarm-agent-permissions.json`, outside the meta repo:
|
||||
//! the swarm is the record, this file is the hive's last read of it.
|
||||
//!
|
||||
//! Format: agent name → the stored
|
||||
//! [`swarm_queue_client::agent_permissions::AgentPermissions`]. An agent with
|
||||
//! no entry, or an entry with `capabilities` unset, holds its default
|
||||
//! ([`default_for`]); `"capabilities": []` holds none.
|
||||
//! no entry, or an entry with `permissions` unset, holds
|
||||
//! [`Permission::default_for`]; `"permissions": []` holds none.
|
||||
//!
|
||||
//! Read path: `lifecycle::host_config::set_nspawn_flags`, on every container
|
||||
//! start, which is why a change takes a restart.
|
||||
//! hive-c0re enforces one member, [`Permission::ManageRootAgent`]: read by
|
||||
//! `lifecycle::host_config::set_nspawn_flags` on every container start, which
|
||||
//! is why a change to it takes a restart. The agent reads the tool members
|
||||
//! itself.
|
||||
|
||||
use std::collections::BTreeMap;
|
||||
use std::path::{Path, PathBuf};
|
||||
|
||||
use hive_sh4re::permissions::Capability;
|
||||
use hive_sh4re::permissions::Permission;
|
||||
use swarm_queue_client::agent_permissions::AgentPermissions;
|
||||
|
||||
const FILE: &str = "swarm-agent-permissions.json";
|
||||
|
|
@ -37,32 +39,21 @@ pub fn write_at(path: &Path, stored: &Stored) -> std::io::Result<()> {
|
|||
super::write_map(path, stored)
|
||||
}
|
||||
|
||||
/// The capabilities an agent holds when the swarm sets none: `ruth` recovers
|
||||
/// the other agents, every other agent holds nothing.
|
||||
/// The permissions `agent` holds under `record`.
|
||||
#[must_use]
|
||||
pub fn default_for(agent: &str) -> Vec<Capability> {
|
||||
if agent == crate::lifecycle::MANAGER_NAME {
|
||||
vec![Capability::ManageRootAgent]
|
||||
} else {
|
||||
Vec::new()
|
||||
}
|
||||
}
|
||||
|
||||
/// The capabilities `agent` holds under `record`.
|
||||
#[must_use]
|
||||
pub fn effective(agent: &str, record: Option<&AgentPermissions>) -> Vec<Capability> {
|
||||
pub fn effective(agent: &str, record: Option<&AgentPermissions>) -> Vec<Permission> {
|
||||
record
|
||||
.and_then(|r| r.capabilities.clone())
|
||||
.unwrap_or_else(|| default_for(agent))
|
||||
.and_then(|r| r.permissions.clone())
|
||||
.unwrap_or_else(|| Permission::default_for(agent))
|
||||
}
|
||||
|
||||
/// Whether `agent` holds `cap` per the file at `path` (normally [`path`]).
|
||||
/// Whether `agent` holds `perm` per the file at `path` (normally [`path`]).
|
||||
///
|
||||
/// # Errors
|
||||
///
|
||||
/// As [`read_at`].
|
||||
pub fn holds(path: &Path, agent: &str, cap: Capability) -> std::io::Result<bool> {
|
||||
Ok(effective(agent, read_at(path)?.get(agent)).contains(&cap))
|
||||
pub fn holds(path: &Path, agent: &str, perm: Permission) -> std::io::Result<bool> {
|
||||
Ok(effective(agent, read_at(path)?.get(agent)).contains(&perm))
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
|
|
@ -75,19 +66,16 @@ mod tests {
|
|||
|
||||
#[test]
|
||||
fn unset_is_the_default_and_an_empty_list_is_none() {
|
||||
assert_eq!(effective("ruth", None), vec![Capability::ManageRootAgent]);
|
||||
assert_eq!(
|
||||
effective("ruth", Some(&record("{}"))),
|
||||
vec![Capability::ManageRootAgent]
|
||||
);
|
||||
assert!(effective("ruth", Some(&record(r#"{"capabilities":[]}"#))).is_empty());
|
||||
assert!(effective("atlas", None).is_empty());
|
||||
assert!(effective("ruth", None).contains(&Permission::ManageRootAgent));
|
||||
assert!(effective("ruth", Some(&record("{}"))).contains(&Permission::ManageRootAgent));
|
||||
assert!(effective("ruth", Some(&record(r#"{"permissions":[]}"#))).is_empty());
|
||||
assert_eq!(effective("atlas", None), Permission::DEFAULT.to_vec());
|
||||
assert_eq!(
|
||||
effective(
|
||||
"atlas",
|
||||
Some(&record(r#"{"capabilities":["manage_root_agent"]}"#))
|
||||
Some(&record(r#"{"permissions":["manage_root_agent"]}"#))
|
||||
),
|
||||
vec![Capability::ManageRootAgent]
|
||||
vec![Permission::ManageRootAgent]
|
||||
);
|
||||
}
|
||||
|
||||
|
|
@ -95,15 +83,15 @@ mod tests {
|
|||
fn a_missing_file_holds_the_defaults() {
|
||||
let dir = tempfile::tempdir().expect("tempdir");
|
||||
let path = dir.path().join(FILE);
|
||||
assert!(holds(&path, "ruth", Capability::ManageRootAgent).expect("missing is empty"));
|
||||
assert!(!holds(&path, "atlas", Capability::ManageRootAgent).expect("missing is empty"));
|
||||
assert!(holds(&path, "ruth", Permission::ManageRootAgent).expect("missing is empty"));
|
||||
assert!(!holds(&path, "atlas", Permission::ManageRootAgent).expect("missing is empty"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn a_corrupt_file_is_an_error() {
|
||||
let dir = tempfile::tempdir().expect("tempdir");
|
||||
let path = dir.path().join(FILE);
|
||||
std::fs::write(&path, "{\n \"ruth\": {\"capabilities\": [\"manage_root_ag").expect("seed");
|
||||
holds(&path, "ruth", Capability::ManageRootAgent).expect_err("truncated JSON");
|
||||
std::fs::write(&path, "{\n \"ruth\": {\"permissions\": [\"manage_root_ag").expect("seed");
|
||||
holds(&path, "ruth", Permission::ManageRootAgent).expect_err("truncated JSON");
|
||||
}
|
||||
}
|
||||
|
|
@ -3,7 +3,7 @@
|
|||
//!
|
||||
//! The swarm caps are stored at
|
||||
//! `/var/lib/hyperhive/meta/swarm-resource-limits.json` alongside
|
||||
//! `topology.json` and `tool-groups.json`.
|
||||
//! `topology.json`.
|
||||
//!
|
||||
//! Format: a JSON object mapping agent name to an object with optional
|
||||
//! `cpu_quota` / `memory_max` strings, passed verbatim to systemd's
|
||||
|
|
|
|||
|
|
@ -1,245 +0,0 @@
|
|||
//! Per-agent tool-group configuration. Stored at
|
||||
//! `/var/lib/hyperhive/meta/tool-groups.json` alongside `topology.json`
|
||||
//! and the meta `flake.nix`.
|
||||
//!
|
||||
//! Format: a JSON object mapping agent name to an array of
|
||||
//! `hive_sh4re::permissions::ToolGroup` `snake_case` strings:
|
||||
//!
|
||||
//! ```json
|
||||
//! {
|
||||
//! "alice": ["messaging", "meta", "inbox", "lifecycle"],
|
||||
//! "bob": ["messaging", "meta", "inbox"]
|
||||
//! }
|
||||
//! ```
|
||||
//!
|
||||
//! An absent entry (or an absent file) means "use the harness default"
|
||||
//! (`AGENT_DEFAULT`: `messaging + meta + inbox + execution`). `render_flake`
|
||||
//! in `meta.rs` reads this file and injects `HIVE_TOOL_GROUPS` into each
|
||||
//! agent's systemd service env; agents with no entry get no env var and the
|
||||
//! harness falls back to `AGENT_DEFAULT`.
|
||||
//!
|
||||
//! Write path: `set_groups` is called from the dashboard action handler
|
||||
//! that the operator uses to grant/revoke tool groups per agent.
|
||||
|
||||
use std::collections::BTreeMap;
|
||||
use std::path::{Path, PathBuf};
|
||||
|
||||
use anyhow::Context as _;
|
||||
|
||||
const TOOL_GROUPS_FILE: &str = "tool-groups.json";
|
||||
|
||||
#[must_use]
|
||||
pub fn tool_groups_path() -> PathBuf {
|
||||
crate::paths::meta_root().join(TOOL_GROUPS_FILE)
|
||||
}
|
||||
|
||||
/// Read the per-agent tool-group map. An absent file is the empty map —
|
||||
/// callers treat a missing entry as "use role default". A file that
|
||||
/// exists but can't be read or parsed is an error. Any entry that isn't a
|
||||
/// recognised [`hive_sh4re::permissions::ToolGroup`] is dropped (with a
|
||||
/// `warn!`) from what's returned — a stale or renamed name is never
|
||||
/// honoured — but `read` itself never writes; unknown names stay on disk
|
||||
/// until the next `set_groups` rewrites the file.
|
||||
pub fn read() -> std::io::Result<BTreeMap<String, Vec<String>>> {
|
||||
read_from(&tool_groups_path())
|
||||
}
|
||||
|
||||
fn read_from(path: &Path) -> std::io::Result<BTreeMap<String, Vec<String>>> {
|
||||
let mut map = super::read_map(path)?;
|
||||
prune_unknown(&mut map);
|
||||
Ok(map)
|
||||
}
|
||||
|
||||
/// True if `name` matches a recognised [`hive_sh4re::permissions::ToolGroup`],
|
||||
/// case-insensitive (same comparison [`validate_groups`] uses, and the same
|
||||
/// comparison `capabilities::is_known` uses — a hand-edited `"Meta"` in the
|
||||
/// file should round-trip, not get pruned).
|
||||
fn is_known(name: &str) -> bool {
|
||||
hive_sh4re::permissions::ToolGroup::ALL
|
||||
.iter()
|
||||
.any(|g| name.eq_ignore_ascii_case(<&str>::from(*g)))
|
||||
}
|
||||
|
||||
/// Drop any tool-group string in `map` that isn't a recognised
|
||||
/// [`hive_sh4re::permissions::ToolGroup`], warning per dropped string so a
|
||||
/// stale or renamed grant doesn't look like it's still in effect. An agent
|
||||
/// left with no groups is removed entirely, matching [`set_groups`]'s
|
||||
/// empty-vec behaviour (reverts to the harness role default). Returns
|
||||
/// whether anything was dropped.
|
||||
fn prune_unknown(map: &mut BTreeMap<String, Vec<String>>) -> bool {
|
||||
let mut dropped_any = false;
|
||||
map.retain(|agent, groups| {
|
||||
groups.retain(|g| {
|
||||
let known = is_known(g);
|
||||
if !known {
|
||||
dropped_any = true;
|
||||
tracing::warn!(agent, tool_group = %g, "dropping unrecognised tool group");
|
||||
}
|
||||
known
|
||||
});
|
||||
!groups.is_empty()
|
||||
});
|
||||
dropped_any
|
||||
}
|
||||
|
||||
/// Look up the configured tool groups for one agent. Returns an empty
|
||||
/// vec when the agent has no entry — callers should treat this as
|
||||
/// "use the harness role default." Errors as [`read`] does.
|
||||
pub fn groups_for(name: &str) -> std::io::Result<Vec<String>> {
|
||||
Ok(read()?.get(name).cloned().unwrap_or_default())
|
||||
}
|
||||
|
||||
/// Validate a slice of group name strings against `ToolGroup::ALL`.
|
||||
/// Returns `Ok(())` when all names are known, or `Err` listing the
|
||||
/// unrecognised names so callers can surface a useful error message.
|
||||
pub fn validate_groups(groups: &[String]) -> anyhow::Result<()> {
|
||||
let unknown: Vec<&str> = groups
|
||||
.iter()
|
||||
.map(String::as_str)
|
||||
.filter(|s| !is_known(s))
|
||||
.collect();
|
||||
if unknown.is_empty() {
|
||||
Ok(())
|
||||
} else {
|
||||
anyhow::bail!(
|
||||
"unknown tool group(s): {}; valid names are: {}",
|
||||
unknown.join(", "),
|
||||
hive_sh4re::permissions::ToolGroup::ALL
|
||||
.iter()
|
||||
.map(|g| <&str>::from(*g))
|
||||
.collect::<Vec<_>>()
|
||||
.join(", ")
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
/// Set the tool groups for one agent and persist the map. An empty
|
||||
/// `groups` vec removes the entry (agent reverts to role default).
|
||||
/// Returns an error if any name is not in `ToolGroup::ALL`, or if the
|
||||
/// existing file can't be read or parsed — the file is then left
|
||||
/// untouched.
|
||||
pub fn set_groups(name: &str, groups: &[String]) -> anyhow::Result<()> {
|
||||
set_groups_at(&tool_groups_path(), name, groups)
|
||||
}
|
||||
|
||||
fn set_groups_at(path: &Path, name: &str, groups: &[String]) -> anyhow::Result<()> {
|
||||
if !groups.is_empty() {
|
||||
validate_groups(groups)?;
|
||||
}
|
||||
let mut current: BTreeMap<String, Vec<String>> = super::read_map(path)?;
|
||||
if groups.is_empty() {
|
||||
current.remove(name);
|
||||
} else {
|
||||
current.insert(name.to_owned(), groups.to_vec());
|
||||
}
|
||||
super::write_map(path, ¤t).with_context(|| format!("write tool-groups for {name}"))
|
||||
}
|
||||
|
||||
/// Drop the entry for an agent that is being destroyed. Idempotent.
|
||||
/// Fails without writing if the existing file can't be read or parsed.
|
||||
pub fn remove_agent(name: &str) -> std::io::Result<()> {
|
||||
remove_agent_at(&tool_groups_path(), name)
|
||||
}
|
||||
|
||||
fn remove_agent_at(path: &Path, name: &str) -> std::io::Result<()> {
|
||||
let mut current: BTreeMap<String, Vec<String>> = super::read_map(path)?;
|
||||
if current.remove(name).is_some() {
|
||||
super::write_map(path, ¤t)?;
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
const TRUNCATED: &str = "{\n \"alice\": [\"messaging\", \"meta\"],\n \"bob\": [\"mess";
|
||||
|
||||
fn corrupt_file() -> (tempfile::TempDir, PathBuf) {
|
||||
let dir = tempfile::tempdir().expect("tempdir");
|
||||
let path = dir.path().join(TOOL_GROUPS_FILE);
|
||||
std::fs::write(&path, TRUNCATED).expect("seed");
|
||||
(dir, path)
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn set_groups_leaves_a_corrupt_file_untouched() {
|
||||
let (_dir, path) = corrupt_file();
|
||||
let err = set_groups_at(&path, "ruth", &["messaging".to_owned()])
|
||||
.expect_err("a corrupt file must not be overwritten");
|
||||
let kind = err
|
||||
.downcast_ref::<std::io::Error>()
|
||||
.map(std::io::Error::kind);
|
||||
assert_eq!(kind, Some(std::io::ErrorKind::InvalidData));
|
||||
assert_eq!(std::fs::read(&path).expect("read"), TRUNCATED.as_bytes());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn remove_agent_leaves_a_corrupt_file_untouched() {
|
||||
let (_dir, path) = corrupt_file();
|
||||
let err =
|
||||
remove_agent_at(&path, "alice").expect_err("a corrupt file must not be overwritten");
|
||||
assert_eq!(err.kind(), std::io::ErrorKind::InvalidData);
|
||||
assert_eq!(std::fs::read(&path).expect("read"), TRUNCATED.as_bytes());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn set_groups_keeps_other_agents_entries() {
|
||||
let dir = tempfile::tempdir().expect("tempdir");
|
||||
let path = dir.path().join(TOOL_GROUPS_FILE);
|
||||
set_groups_at(&path, "alice", &["inbox".to_owned()]).expect("set on missing file");
|
||||
set_groups_at(&path, "ruth", &["messaging".to_owned()]).expect("set");
|
||||
let map: BTreeMap<String, Vec<String>> =
|
||||
crate::agent_config::read_map(&path).expect("read");
|
||||
assert_eq!(map["alice"], vec!["inbox".to_owned()]);
|
||||
assert_eq!(map["ruth"], vec!["messaging".to_owned()]);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn prune_unknown_keeps_known_name() {
|
||||
let mut map = BTreeMap::from([("alice".to_owned(), vec!["messaging".to_owned()])]);
|
||||
assert!(!prune_unknown(&mut map));
|
||||
assert_eq!(map["alice"], vec!["messaging".to_owned()]);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn prune_unknown_keeps_a_hand_edited_differently_cased_known_name() {
|
||||
let mut map = BTreeMap::from([("alice".to_owned(), vec!["Messaging".to_owned()])]);
|
||||
assert!(!prune_unknown(&mut map));
|
||||
assert_eq!(map["alice"], vec!["Messaging".to_owned()]);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn prune_unknown_drops_unrecognised_name() {
|
||||
let mut map = BTreeMap::from([("alice".to_owned(), vec!["diagnostics".to_owned()])]);
|
||||
assert!(prune_unknown(&mut map));
|
||||
assert!(!map.contains_key("alice"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn prune_unknown_keeps_known_and_drops_unknown_in_same_entry() {
|
||||
let mut map = BTreeMap::from([(
|
||||
"alice".to_owned(),
|
||||
vec!["messaging".to_owned(), "scheduling".to_owned()],
|
||||
)]);
|
||||
assert!(prune_unknown(&mut map));
|
||||
assert_eq!(map["alice"], vec!["messaging".to_owned()]);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn read_from_drops_an_unknown_name_still_on_disk_without_rewriting_the_file() {
|
||||
let dir = tempfile::tempdir().expect("tempdir");
|
||||
let path = dir.path().join(TOOL_GROUPS_FILE);
|
||||
std::fs::write(&path, r#"{"alice": ["messaging", "diagnostics"]}"#).expect("seed");
|
||||
|
||||
// Exercises `read()`'s own wiring, not a hand-rolled equivalent —
|
||||
// deleting the `prune_unknown` call inside `read_from` must fail
|
||||
// this assertion.
|
||||
let map = read_from(&path).expect("read_from");
|
||||
assert_eq!(map["alice"], vec!["messaging".to_owned()]);
|
||||
|
||||
// `read()` itself never writes — the stale name is still on disk.
|
||||
let on_disk = std::fs::read_to_string(&path).expect("read file");
|
||||
assert!(on_disk.contains("diagnostics"), "{on_disk}");
|
||||
}
|
||||
}
|
||||
|
|
@ -9,11 +9,11 @@
|
|||
//! dashboard's tree view. All of that is gone; what the file is
|
||||
//! *for* now is the one thing that survived the removal — naming every
|
||||
//! agent, which is the set a
|
||||
//! [`hive_sh4re::permissions::Capability::ManageRootAgent`] holder gets
|
||||
//! [`hive_sh4re::permissions::Permission::ManageRootAgent`] holder gets
|
||||
//! bind-mounted ([`all_agents`]).
|
||||
//!
|
||||
//! Broader-than-your-own bind-mount grants are **not** stored here: they
|
||||
//! hang off the `ManageRootAgent` capability the swarm grants
|
||||
//! hang off the `ManageRootAgent` permission the swarm grants
|
||||
//! (`swarm_permissions`). See
|
||||
//! `lifecycle::set_nspawn_flags`.
|
||||
|
||||
|
|
@ -65,7 +65,7 @@ fn read_from(path: &Path) -> std::io::Result<BTreeSet<String>> {
|
|||
}
|
||||
|
||||
/// Every agent the roster knows about, in name order. This is the set
|
||||
/// a [`hive_sh4re::permissions::Capability::ManageRootAgent`] holder gets
|
||||
/// a [`hive_sh4re::permissions::Permission::ManageRootAgent`] holder gets
|
||||
/// bind-mounted, and it is deliberately unfiltered: that capability means
|
||||
/// "may manage any agent", so the set is all of them.
|
||||
///
|
||||
|
|
|
|||
Loading…
Reference in a new issue