agent permissions: one set, tool groups included, set at agent creation

mara on #5170: "dont split caps and perms. its all perms. / dont include
the now empty tool groups / nothing set -> default / also add perms to
agent creation screen".

- hive-sh4re: one `Permission` enum (messaging, meta, inbox, execution,
  web_tools, manage_root_agent) replaces `ToolGroup` and `Capability`;
  `lifecycle`/`forge` are gone. `Permission::default_for` is the default
  for an agent the swarm sets nothing for.
- The record is `{ "permissions": [...] }`. Missing key, unset field or
  no successful read yet = default; `[]` = none; a failed read after a
  good one keeps the last value.
- hive-agent reads its own key every 10s and builds each turn's --tools,
  --allowedTools and MCP config (rewritten before every turn) from it;
  the subagent daemon reads it on each start/continue. Agents get a
  read-only grant on their own key.
- hive-c0re restarts an agent only when its manage_root_agent changes.
  The import now merges meta/capabilities.json and meta/tool-groups.json
  into one list per agent and deletes both; the "import pending, don't
  read" decision is `ImportOutcome::read_allowed`, table-tested.
- swarm-controller: `GET /api/permissions` (names + default) and an
  optional `permissions` on `POST /api/agents`, stored before the job is
  queued. swarm-ui's create-agent form gets a permissions field.
- Deleted: HIVE_TOOL_GROUPS and its forward to the subagent daemon,
  tool_groups.rs, ruth's tool-group seed, the permissions rebuild job
  (PermPayload/WritePermFile/perm_change), the dashboard permissions tab
  and its stale-entries panel.

Part of #5170.

swarmctl/src/permissions.rs

@@ -1,12 +1,12 @@
-//! `swarmctl agent permissions` — the capabilities the swarm grants one
+//! `swarmctl agent permissions` — the permissions the swarm grants one
 //! agent, through swarm-controller's `/api/agents/{name}/permissions` routes.
 //!
-//! The hive running the agent reads its key every 30 seconds and restarts the
-//! agent, after its current turn, when its capabilities change. Unset leaves
-//! the agent on its hive's default; an empty list grants nothing.
+//! The agent applies its tool permissions at its next turn; the hive running
+//! it restarts it, after its current turn, when `manage_root_agent` changes.
+//! Unset leaves the agent on the default set; an empty list grants nothing.
 //!
 //! The shape below mirrors the controller's `Permissions`, for the reason
-//! [`crate::agent`]'s module doc gives. Capability names are checked by the
+//! [`crate::agent`]'s module doc gives. Permission names are checked by the
 //! controller, which answers 422 for one it does not know.
 
 use anyhow::{Context as _, Result};
@@ -19,7 +19,7 @@ use crate::remote::Target;
 #[derive(Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
 struct Permissions {
     #[serde(default, skip_serializing_if = "Option::is_none")]
-    capabilities: Option<Vec<String>>,
+    permissions: Option<Vec<String>>,
 }
 
 fn runtime() -> Result<tokio::runtime::Runtime> {
@@ -50,26 +50,26 @@ pub(crate) fn get(target: &Target, agent: &str) -> Result<()> {
     Ok(())
 }
 
-/// Run `swarmctl agent permissions set`: store the given capabilities, which
+/// Run `swarmctl agent permissions set`: store the given permissions, which
 /// replace the agent's record whole.
-pub(crate) fn set(target: &Target, agent: &str, capabilities: Vec<String>) -> Result<()> {
+pub(crate) fn set(target: &Target, agent: &str, permissions: Vec<String>) -> Result<()> {
     let uri = member(agent)?;
     let stored: Permissions = runtime()?.block_on(send(
         target,
         hyper::Method::PUT,
         &uri,
-        Some(&with_capabilities(capabilities)),
+        Some(&with_permissions(permissions)),
         "permissions-set",
     ))?;
     print!("{}", render(&stored));
     Ok(())
 }
 
-/// The record granting `capabilities`. An empty name, as `--capabilities ''`
+/// The record granting `permissions`. An empty name, as `--permissions ''`
 /// gives, is dropped, so that spelling grants nothing.
-fn with_capabilities(capabilities: Vec<String>) -> Permissions {
+fn with_permissions(permissions: Vec<String>) -> Permissions {
     Permissions {
-        capabilities: Some(capabilities.into_iter().filter(|c| !c.is_empty()).collect()),
+        permissions: Some(permissions.into_iter().filter(|c| !c.is_empty()).collect()),
     }
 }
 
@@ -83,17 +83,17 @@ pub(crate) fn clear(target: &Target, agent: &str) -> Result<()> {
         None,
         "permissions-clear",
     ))?;
-    println!("cleared; {agent} goes back to its hive's default");
+    println!("cleared; {agent} goes back to the default");
     Ok(())
 }
 
 fn render(p: &Permissions) -> String {
-    let caps = match p.capabilities.as_deref() {
-        None => "(not set; the hive's default)".to_owned(),
+    let caps = match p.permissions.as_deref() {
+        None => "(not set; the default)".to_owned(),
         Some([]) => "(none)".to_owned(),
         Some(caps) => caps.join(", "),
     };
-    format!("capabilities: {caps}\n")
+    format!("permissions: {caps}\n")
 }
 
 #[cfg(test)]
@@ -103,24 +103,21 @@ mod tests {
     #[test]
     fn get_tells_unset_from_none() {
         let unset: Permissions = serde_json::from_str("{}").unwrap();
-        assert_eq!(
-            render(&unset),
-            "capabilities: (not set; the hive's default)\n"
-        );
-        let none: Permissions = serde_json::from_str(r#"{"capabilities":[]}"#).unwrap();
-        assert_eq!(render(&none), "capabilities: (none)\n");
+        assert_eq!(render(&unset), "permissions: (not set; the default)\n");
+        let none: Permissions = serde_json::from_str(r#"{"permissions":[]}"#).unwrap();
+        assert_eq!(render(&none), "permissions: (none)\n");
         let ruth: Permissions =
-            serde_json::from_str(r#"{"capabilities":["manage_root_agent"]}"#).unwrap();
-        assert_eq!(render(&ruth), "capabilities: manage_root_agent\n");
+            serde_json::from_str(r#"{"permissions":["manage_root_agent"]}"#).unwrap();
+        assert_eq!(render(&ruth), "permissions: manage_root_agent\n");
     }
 
-    /// `--capabilities ''` stores an empty list, not one empty name.
+    /// `--permissions ''` stores an empty list, not one empty name.
     #[test]
     fn an_empty_list_flag_grants_nothing() {
-        let set = with_capabilities(vec![String::new()]);
+        let set = with_permissions(vec![String::new()]);
         assert_eq!(
             serde_json::to_string(&set).unwrap(),
-            r#"{"capabilities":[]}"#
+            r#"{"permissions":[]}"#
         );
     }
 }