f0844f6da3
mara on #5170: "dont split caps and perms. its all perms. / dont include the now empty tool groups / nothing set -> default / also add perms to agent creation screen". - hive-sh4re: one `Permission` enum (messaging, meta, inbox, execution, web_tools, manage_root_agent) replaces `ToolGroup` and `Capability`; `lifecycle`/`forge` are gone. `Permission::default_for` is the default for an agent the swarm sets nothing for. - The record is `{ "permissions": [...] }`. Missing key, unset field or no successful read yet = default; `[]` = none; a failed read after a good one keeps the last value. - hive-agent reads its own key every 10s and builds each turn's --tools, --allowedTools and MCP config (rewritten before every turn) from it; the subagent daemon reads it on each start/continue. Agents get a read-only grant on their own key. - hive-c0re restarts an agent only when its manage_root_agent changes. The import now merges meta/capabilities.json and meta/tool-groups.json into one list per agent and deletes both; the "import pending, don't read" decision is `ImportOutcome::read_allowed`, table-tested. - swarm-controller: `GET /api/permissions` (names + default) and an optional `permissions` on `POST /api/agents`, stored before the job is queued. swarm-ui's create-agent form gets a permissions field. - Deleted: HIVE_TOOL_GROUPS and its forward to the subagent daemon, tool_groups.rs, ruth's tool-group seed, the permissions rebuild job (PermPayload/WritePermFile/perm_change), the dashboard permissions tab and its stale-entries panel. Part of #5170.
31 lines
1.1 KiB
JavaScript
31 lines
1.1 KiB
JavaScript
// The create-agent form's permissions field: what a toggle does and what the
|
|
// create request carries. Run by `npm test` with Node's type stripping.
|
|
import assert from "node:assert/strict";
|
|
import { test } from "node:test";
|
|
import {
|
|
requestPermissions,
|
|
togglePermission,
|
|
} from "../src/pages/CreateAgentPermissions.ts";
|
|
|
|
const defaults = ["messaging", "meta", "inbox", "execution"];
|
|
|
|
test("a toggle adds a missing permission and removes a present one", () => {
|
|
assert.deepEqual(togglePermission(["meta"], "inbox"), ["meta", "inbox"]);
|
|
assert.deepEqual(togglePermission(["meta", "inbox"], "meta"), ["inbox"]);
|
|
});
|
|
|
|
test("the default set, in any order, sends no permissions", () => {
|
|
assert.equal(
|
|
requestPermissions([...defaults].reverse(), defaults),
|
|
undefined,
|
|
);
|
|
});
|
|
|
|
test("a changed set is sent, an empty one included", () => {
|
|
assert.deepEqual(requestPermissions(["messaging"], defaults), ["messaging"]);
|
|
assert.deepEqual(requestPermissions([], defaults), []);
|
|
assert.deepEqual(requestPermissions([...defaults, "web_tools"], defaults), [
|
|
...defaults,
|
|
"web_tools",
|
|
]);
|
|
});
|