M2 audit: excise the Computer Hub stack — Kigi's last remote-cloud surface
Removed root-and-branch for the zero-egress guarantee (the hub was xAI's remote-workspace/cloud-sandbox service): - Crates deleted: kigi-computer-hub-core, kigi-computer-hub-sdk, kigi-computer-hub-mcp-adapter, kigi-workspace-client (hub-proxied workspace RPC client), and kigi-tracing (its sole network path was the OTLP gRPC exporter; zero consumers remained). kigi-tracing-macros (purely local) stays. - kigi-workspace: every hub surface deleted — hub server/channel/auth, HITL-over-hub permissions, donation/metrics pumps, file upload RPCs, hub tool-snapshot merge (resolve pipeline is MCP-only now), WorkspaceOps::Proxy. Local worktrees, sessions, leader IPC, MCP, and the ACP permission prompt path are untouched; LocalRegistry re-homed into kigi-tool-runtime on the existing ToolDyn types so in-process tool dispatch is unchanged. - kigi-shell: leader workspace-exposure control surface (incl. the wss://computer-hub... URL), [hub] config, ObservabilityBridge, hub WebSocket proxy, dead OTLP config knobs. ClientMode::Headless (never constructed) removed. - kigi-tui/bin: hidden `kigi workspace` command removed (`kigi worktree` stays). - Renames: --xai-api-base-url → --api-base-url / KIGI_API_BASE_URL / [endpoints] api_base_url (serde alias keeps old configs working; the flag feeds BYOK/custom-endpoint routing, not main inference); grok_version → kigi_version in inspect/models-cache/trace metadata (old caches self-heal via version-mismatch refetch). - Dependency tree: dropped fastrace*, opentelemetry-otlp/http/proto, tokio-tungstenite from the workspace; fixed the 4 real useless_format violations the fastrace lint allowance was masking and removed the allowance. - marketplaceAllowlist kept: it gates the LOCAL plugin-marketplace feature, not an xAI service. Known §9 leftover (deliberate, for the M3 sweep): the BYOK default base URL string. Gates: workspace check/clippy 0/0, fmt, deny ok; suites green (workspace 1042, shell 4918, tui 6634, tools 2608, tool-runtime 47, mcp 154).
This commit is contained in:
@@ -820,6 +820,10 @@ fn session_grant_pre_decision(
|
||||
|
||||
/// Spawns the permission manager actor, returning a handle and the telemetry
|
||||
/// event receiver.
|
||||
///
|
||||
/// `remember_tool_approvals` — resolved gate: shows the per-tool always-allow
|
||||
/// options and lets an explicit grant satisfy an `ask` rule (ask once, remember).
|
||||
#[allow(clippy::too_many_arguments)]
|
||||
pub fn spawn_permission_manager(
|
||||
session_id: acp::SessionId,
|
||||
gateway: GatewaySender,
|
||||
@@ -833,45 +837,7 @@ pub fn spawn_permission_manager(
|
||||
web_fetch_allowed_domains: Vec<String>,
|
||||
initial_yolo: bool,
|
||||
client_identifier: Option<String>,
|
||||
) -> (PermissionHandle, mpsc::UnboundedReceiver<PermissionEvent>) {
|
||||
spawn_permission_manager_with_hub(
|
||||
session_id,
|
||||
gateway,
|
||||
cwd,
|
||||
client_type,
|
||||
permission_config,
|
||||
deny_read_globs,
|
||||
web_fetch_allowed_domains,
|
||||
initial_yolo,
|
||||
client_identifier,
|
||||
// Legacy/test entry point: preserve the full option set. Production uses
|
||||
// `spawn_permission_manager_with_hub` with the resolved gate.
|
||||
true,
|
||||
None,
|
||||
)
|
||||
}
|
||||
|
||||
/// Like [`spawn_permission_manager`] but routes the permission prompt to chat
|
||||
/// over the server (the HITL live path) when `hub_permission` is `Some`. The
|
||||
/// caller builds the transport only when [`hitl_permission_live_enabled`] and a
|
||||
/// server is connected; `None` keeps the local ACP prompt.
|
||||
///
|
||||
/// [`hitl_permission_live_enabled`]: crate::permission::hitl_permission_live_enabled
|
||||
#[allow(clippy::too_many_arguments)]
|
||||
pub fn spawn_permission_manager_with_hub(
|
||||
session_id: acp::SessionId,
|
||||
gateway: GatewaySender,
|
||||
cwd: AbsPathBuf,
|
||||
client_type: ClientType,
|
||||
permission_config: Option<crate::permission::types::PermissionConfig>,
|
||||
deny_read_globs: Vec<String>,
|
||||
web_fetch_allowed_domains: Vec<String>,
|
||||
initial_yolo: bool,
|
||||
client_identifier: Option<String>,
|
||||
// Resolved `remember_tool_approvals` gate: shows the per-tool always-allow
|
||||
// options and lets an explicit grant satisfy an `ask` rule (ask once, remember).
|
||||
remember_tool_approvals: bool,
|
||||
hub_permission: Option<Arc<dyn crate::permission::PermissionHookTransport>>,
|
||||
) -> (PermissionHandle, mpsc::UnboundedReceiver<PermissionEvent>) {
|
||||
// Read the pin ONCE (file I/O) and cache it; never re-read per tool-call.
|
||||
// Every yolo ingestion path funnels through construction or SetYoloMode.
|
||||
@@ -887,7 +853,6 @@ pub fn spawn_permission_manager_with_hub(
|
||||
client_identifier,
|
||||
remember_tool_approvals,
|
||||
crate::permission::resolution::yolo_disabled_by_policy(),
|
||||
hub_permission,
|
||||
)
|
||||
}
|
||||
|
||||
@@ -905,7 +870,6 @@ fn spawn_permission_manager_with_pin(
|
||||
client_identifier: Option<String>,
|
||||
remember_tool_approvals: bool,
|
||||
yolo_pin: Option<&'static str>,
|
||||
hub_permission: Option<Arc<dyn crate::permission::PermissionHookTransport>>,
|
||||
) -> (PermissionHandle, mpsc::UnboundedReceiver<PermissionEvent>) {
|
||||
let (tx, mut rx) = mpsc::unbounded_channel::<PermissionCommand>();
|
||||
let (event_tx, event_rx) = mpsc::unbounded_channel::<PermissionEvent>();
|
||||
@@ -969,7 +933,6 @@ fn spawn_permission_manager_with_pin(
|
||||
}
|
||||
|
||||
let prompter = AcpPrompter::new(session_id.clone(), gateway.clone(), client_type)
|
||||
.with_hub_permission(hub_permission)
|
||||
.with_remember_tool_approvals(remember_tool_approvals);
|
||||
let mut yolo_mode = initial_yolo;
|
||||
let mut auto_mode = seed_auto;
|
||||
@@ -1849,7 +1812,6 @@ mod tests {
|
||||
None,
|
||||
true,
|
||||
yolo_pin,
|
||||
None,
|
||||
)
|
||||
}
|
||||
|
||||
@@ -1871,7 +1833,6 @@ mod tests {
|
||||
None,
|
||||
true,
|
||||
None,
|
||||
None,
|
||||
)
|
||||
}
|
||||
|
||||
@@ -1939,187 +1900,6 @@ mod tests {
|
||||
.await;
|
||||
}
|
||||
|
||||
/// Like [`test_manager`] but routes prompts through a hub permission transport.
|
||||
fn test_manager_with_hub(
|
||||
cwd: &AbsPathBuf,
|
||||
hub_permission: Arc<dyn crate::permission::PermissionHookTransport>,
|
||||
) -> (PermissionHandle, mpsc::UnboundedReceiver<PermissionEvent>) {
|
||||
let (tx, _rx) = mpsc::unbounded_channel();
|
||||
spawn_permission_manager_with_pin(
|
||||
acp::SessionId::new(Arc::from("test-session")),
|
||||
GatewaySender::new(tx),
|
||||
cwd.clone(),
|
||||
ClientType::Generic,
|
||||
None,
|
||||
vec![],
|
||||
vec![],
|
||||
false,
|
||||
None,
|
||||
true,
|
||||
None,
|
||||
Some(hub_permission),
|
||||
)
|
||||
}
|
||||
|
||||
/// Records every emitted payload and replies with a canned decision, so the
|
||||
/// hub permission prompt path is exercised without a live hub.
|
||||
struct FakeHubTransport {
|
||||
reply: serde_json::Value,
|
||||
seen: std::sync::Mutex<Vec<serde_json::Value>>,
|
||||
}
|
||||
|
||||
#[async_trait::async_trait]
|
||||
impl crate::permission::PermissionHookTransport for FakeHubTransport {
|
||||
async fn request_permission(
|
||||
&self,
|
||||
payload: serde_json::Value,
|
||||
) -> Result<serde_json::Value, String> {
|
||||
self.seen.lock().unwrap().push(payload);
|
||||
Ok(self.reply.clone())
|
||||
}
|
||||
}
|
||||
|
||||
fn fake_hub(reply: serde_json::Value) -> Arc<FakeHubTransport> {
|
||||
Arc::new(FakeHubTransport {
|
||||
reply,
|
||||
seen: std::sync::Mutex::new(Vec::new()),
|
||||
})
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn hub_permission_approve_allows_and_emits_payload() {
|
||||
let local = tokio::task::LocalSet::new();
|
||||
local
|
||||
.run_until(async {
|
||||
let tmp = tempfile::tempdir().unwrap();
|
||||
let cwd = AbsPathBuf::new(tmp.path().to_path_buf()).unwrap();
|
||||
let transport = fake_hub(serde_json::json!({ "outcome": "approve" }));
|
||||
let (mgr, _e) = test_manager_with_hub(&cwd, transport.clone());
|
||||
let d = mgr
|
||||
.request(
|
||||
AccessKind::Edit("src/main.rs".into()),
|
||||
tool_call(),
|
||||
None,
|
||||
None,
|
||||
None,
|
||||
)
|
||||
.await;
|
||||
assert_eq!(d, Decision::Allow);
|
||||
let seen = transport.seen.lock().unwrap();
|
||||
assert_eq!(seen.len(), 1, "exactly one permission hook emitted");
|
||||
assert_eq!(seen[0]["tool_call_id"], "tc");
|
||||
assert_eq!(seen[0]["tool_name"], "search_replace");
|
||||
assert_eq!(seen[0]["description"], "Edit src/main.rs");
|
||||
assert_eq!(seen[0]["scope"], "write");
|
||||
assert_eq!(
|
||||
seen[0]["edit_file_paths"],
|
||||
serde_json::json!(["src/main.rs"])
|
||||
);
|
||||
})
|
||||
.await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn hub_permission_reject_aborts() {
|
||||
let local = tokio::task::LocalSet::new();
|
||||
local
|
||||
.run_until(async {
|
||||
let tmp = tempfile::tempdir().unwrap();
|
||||
let cwd = AbsPathBuf::new(tmp.path().to_path_buf()).unwrap();
|
||||
let (mgr, _e) = test_manager_with_hub(
|
||||
&cwd,
|
||||
fake_hub(serde_json::json!({ "outcome": "reject" })),
|
||||
);
|
||||
let d = mgr
|
||||
.request(
|
||||
AccessKind::Edit("a.rs".into()),
|
||||
tool_call(),
|
||||
None,
|
||||
None,
|
||||
None,
|
||||
)
|
||||
.await;
|
||||
assert!(
|
||||
matches!(d, Decision::Reject(_)),
|
||||
"reject must abort, got {d:?}"
|
||||
);
|
||||
})
|
||||
.await;
|
||||
}
|
||||
|
||||
/// `cancelled` reply (turn-end drain) → abort, distinct from a user reject.
|
||||
#[tokio::test]
|
||||
async fn hub_permission_cancelled_aborts_distinctly() {
|
||||
let local = tokio::task::LocalSet::new();
|
||||
local
|
||||
.run_until(async {
|
||||
let tmp = tempfile::tempdir().unwrap();
|
||||
let cwd = AbsPathBuf::new(tmp.path().to_path_buf()).unwrap();
|
||||
let (mgr, _e) = test_manager_with_hub(
|
||||
&cwd,
|
||||
fake_hub(serde_json::json!({ "outcome": "cancelled" })),
|
||||
);
|
||||
let d = mgr
|
||||
.request(
|
||||
AccessKind::Edit("a.rs".into()),
|
||||
tool_call(),
|
||||
None,
|
||||
None,
|
||||
None,
|
||||
)
|
||||
.await;
|
||||
assert_eq!(d, Decision::Cancelled);
|
||||
})
|
||||
.await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn hub_permission_always_approve_persists_scope() {
|
||||
let local = tokio::task::LocalSet::new();
|
||||
local
|
||||
.run_until(async {
|
||||
let tmp = tempfile::tempdir().unwrap();
|
||||
let cwd = AbsPathBuf::new(tmp.path().to_path_buf()).unwrap();
|
||||
let transport = fake_hub(serde_json::json!({
|
||||
"outcome": "always_approve",
|
||||
"scope": { "kind": "server_prefix", "value": "linear" },
|
||||
}));
|
||||
let (mgr, _e) = test_manager_with_hub(&cwd, transport.clone());
|
||||
let first = mgr
|
||||
.request(
|
||||
AccessKind::MCPTool {
|
||||
name: "linear__list".into(),
|
||||
input: serde_json::Value::Null,
|
||||
},
|
||||
tool_call(),
|
||||
None,
|
||||
None,
|
||||
None,
|
||||
)
|
||||
.await;
|
||||
assert_eq!(first, Decision::Allow);
|
||||
let second = mgr
|
||||
.request(
|
||||
AccessKind::MCPTool {
|
||||
name: "linear__create".into(),
|
||||
input: serde_json::Value::Null,
|
||||
},
|
||||
tool_call(),
|
||||
None,
|
||||
None,
|
||||
None,
|
||||
)
|
||||
.await;
|
||||
assert_eq!(second, Decision::Allow);
|
||||
assert_eq!(
|
||||
transport.seen.lock().unwrap().len(),
|
||||
1,
|
||||
"always_approve must persist so the second call needs no hook"
|
||||
);
|
||||
})
|
||||
.await;
|
||||
}
|
||||
|
||||
/// A managed `Ask` rule on a direct `Read`/`Grep` must reach the prompt, not
|
||||
/// the unconditional auto-allow. With no responder wired, that surfaces as a
|
||||
/// non-`Allow` decision; a non-ask read still auto-allows.
|
||||
@@ -2484,7 +2264,6 @@ mod tests {
|
||||
None,
|
||||
true,
|
||||
None,
|
||||
None,
|
||||
);
|
||||
assert_eq!(
|
||||
handle.deny_read_globs(),
|
||||
@@ -2654,7 +2433,6 @@ mod tests {
|
||||
None,
|
||||
remember_tool_approvals,
|
||||
None,
|
||||
None,
|
||||
)
|
||||
}
|
||||
|
||||
@@ -3386,7 +3164,6 @@ mod tests {
|
||||
None,
|
||||
true,
|
||||
None,
|
||||
None,
|
||||
);
|
||||
let PermissionHandle::Actor { ref cmd_tx, .. } = mgr else {
|
||||
panic!("manager must be actor-backed");
|
||||
@@ -3577,7 +3354,6 @@ mod tests {
|
||||
None,
|
||||
true,
|
||||
None,
|
||||
None,
|
||||
);
|
||||
|
||||
// Request A parks in the gated prompt; B then arrives and overlaps it.
|
||||
|
||||
@@ -1,6 +1,5 @@
|
||||
pub mod auto_mode;
|
||||
pub mod claude_settings;
|
||||
mod hub_permission;
|
||||
mod manager;
|
||||
mod policy;
|
||||
mod prompter;
|
||||
@@ -19,19 +18,7 @@ pub use auto_mode::{
|
||||
classifier_output_json_schema, default_auto_mode_classifier, is_auto_mode_allowlisted_access,
|
||||
is_auto_mode_allowlisted_tool_name, parse_classifier_model_text, permission_decision_args,
|
||||
};
|
||||
pub use hub_permission::{
|
||||
PermissionHookTransport, ToolServerPermissionTransport, access_kind_for_hub_tool,
|
||||
hitl_permission_live_enabled, prompt_outcome_allows, request_permission_via_hub,
|
||||
};
|
||||
|
||||
/// Zero-init this module's metric families. See [`crate::init_metrics`].
|
||||
pub(crate) fn init_metrics() {
|
||||
hub_permission::init_metrics();
|
||||
}
|
||||
pub use manager::{
|
||||
PermissionHandle, default_always_allow_scope, spawn_permission_manager,
|
||||
spawn_permission_manager_with_hub,
|
||||
};
|
||||
pub use manager::{PermissionHandle, default_always_allow_scope, spawn_permission_manager};
|
||||
pub use policy::CompiledPolicy;
|
||||
pub use prompter::{
|
||||
ALLOW_EDITS_SESSION_OPTION_ID, AcpPrompter, BashCommandPermission, BashCommandSelectedTerms,
|
||||
|
||||
@@ -321,9 +321,6 @@ pub struct AcpPrompter {
|
||||
/// at decision-time through it. `EventWriter::noop()` when events recording
|
||||
/// is disabled (the default for the permission scaffolding's own tests).
|
||||
event_writer: EventWriter,
|
||||
/// Server permission transport: when set, [`request`](Self::request) asks chat for the
|
||||
/// decision over the server; `None` keeps the local prompt.
|
||||
hub_permission: Option<Arc<dyn crate::permission::PermissionHookTransport>>,
|
||||
/// When `false` (default, fail-safe), the per-tool "Always allow …" options
|
||||
/// are stripped (see [`REMEMBER_TOOL_APPROVALS_GATED_IDS`]).
|
||||
remember_tool_approvals: bool,
|
||||
@@ -496,7 +493,6 @@ impl AcpPrompter {
|
||||
// must NOT double-emit. A workspace-server-side caller that owns the
|
||||
// per-session `events.jsonl` opts in via [`with_event_writer`].
|
||||
event_writer: EventWriter::noop(),
|
||||
hub_permission: None,
|
||||
// Fail-safe default; opt in via `with_remember_tool_approvals`.
|
||||
remember_tool_approvals: false,
|
||||
}
|
||||
@@ -509,16 +505,6 @@ impl AcpPrompter {
|
||||
self
|
||||
}
|
||||
|
||||
/// Route the permission prompt to chat over the server when `Some`;
|
||||
/// `None` keeps the local prompt.
|
||||
pub fn with_hub_permission(
|
||||
mut self,
|
||||
hub_permission: Option<Arc<dyn crate::permission::PermissionHookTransport>>,
|
||||
) -> Self {
|
||||
self.hub_permission = hub_permission;
|
||||
self
|
||||
}
|
||||
|
||||
/// Attach a per-session `events.jsonl` writer so [`request`](Self::request)
|
||||
/// records `PermissionRequested` / `PermissionResolved`. Used by the
|
||||
/// workspace-server permission path (which owns the session log); the shell
|
||||
@@ -737,41 +723,29 @@ impl AcpPrompter {
|
||||
prompt_start,
|
||||
};
|
||||
|
||||
let outcome = match &self.hub_permission {
|
||||
// Route the prompt to chat over the server (see
|
||||
// `ToolServerPermissionTransport` for the await/release contract).
|
||||
Some(transport) => {
|
||||
crate::permission::hub_permission::request_permission_via_hub(
|
||||
transport.as_ref(),
|
||||
access,
|
||||
tool_call_update.tool_call_id.0.as_ref(),
|
||||
)
|
||||
.await
|
||||
}
|
||||
None => {
|
||||
let permission_options = self.build_options(access);
|
||||
let req = acp::RequestPermissionRequest::new(
|
||||
self.session_id.clone(),
|
||||
tool_call_update.clone(),
|
||||
permission_options.values().cloned().collect(),
|
||||
)
|
||||
.meta(self.bash_selection_meta(access));
|
||||
match self.gateway.request_permission(req).await {
|
||||
Ok(resp) => match resp.outcome {
|
||||
acp::RequestPermissionOutcome::Cancelled => PromptOutcome::Cancelled,
|
||||
acp::RequestPermissionOutcome::Selected(selected) => map_selected_outcome(
|
||||
&permission_options,
|
||||
&selected.option_id,
|
||||
resp.meta.as_ref(),
|
||||
access,
|
||||
),
|
||||
// TODO(acp-0.10): `RequestPermissionOutcome` is #[non_exhaustive].
|
||||
_ => PromptOutcome::Error("unknown permission outcome".to_owned()),
|
||||
},
|
||||
Err(e) => {
|
||||
tracing::error!(?e, "failed to request permission");
|
||||
PromptOutcome::Error("failed to request permission".to_owned())
|
||||
}
|
||||
let outcome = {
|
||||
let permission_options = self.build_options(access);
|
||||
let req = acp::RequestPermissionRequest::new(
|
||||
self.session_id.clone(),
|
||||
tool_call_update.clone(),
|
||||
permission_options.values().cloned().collect(),
|
||||
)
|
||||
.meta(self.bash_selection_meta(access));
|
||||
match self.gateway.request_permission(req).await {
|
||||
Ok(resp) => match resp.outcome {
|
||||
acp::RequestPermissionOutcome::Cancelled => PromptOutcome::Cancelled,
|
||||
acp::RequestPermissionOutcome::Selected(selected) => map_selected_outcome(
|
||||
&permission_options,
|
||||
&selected.option_id,
|
||||
resp.meta.as_ref(),
|
||||
access,
|
||||
),
|
||||
// TODO(acp-0.10): `RequestPermissionOutcome` is #[non_exhaustive].
|
||||
_ => PromptOutcome::Error("unknown permission outcome".to_owned()),
|
||||
},
|
||||
Err(e) => {
|
||||
tracing::error!(?e, "failed to request permission");
|
||||
PromptOutcome::Error("failed to request permission".to_owned())
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
Reference in New Issue
Block a user