Runtime settings: admin-gate config writes + confirm destructive tool-reset#18
Merged
Merged
Conversation
…eset runtime.create/update write `config` — the host tool policy (modeToolProfiles / localWorkspaceTools) that decides whether an agent gets terminal/filesystem/git on the host. They were `workspaceProcedure` (any member) while the same runtime's secrets/repos/githubApp and the MCP `runtimes.configure` mirror are ADMIN, and `/settings` has no role gate — so a non-admin member could widen an agent's host access from Settings → Runtimes. Gate both at `adminProcedure`. Daemon self-registration (`register`) and read/diagnostic paths are unchanged. Also wrap the "Local workspace tools enabled" master toggle's OFF path in `useConfirm()` — it silently wiped `toolCapabilities` and every `modeToolProfiles` entry (incl. RESEARCH/REVIEW read grants). On-path unchanged; controlled checkbox reverts on cancel. Regression: runtime-admin-gating.test.ts — OWNER can update; MEMBER gets FORBIDDEN on create + update; row untouched. typecheck + lint clean; runtime + dispatch + mcp suites green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two fixes from auditing the runtimes settings surface (found while fixing
rt_hermes_gateway's empty RESEARCH/REVIEW tool profiles).1. Admin-gate runtime config writes (privilege boundary)
runtime.create/runtime.updatewereworkspaceProcedure(any workspace member), but they writeconfig— the host tool policy (modeToolProfiles/localWorkspaceTools) that decides whether an agent gets terminal/filesystem/git on the host. Meanwhile the same runtime's secrets, repos, and GitHub link areadminProcedure, the MCPruntimes.configuremirror is ADMIN-scoped, and the/settingslayout has no role gate — so a non-admin member could reach Settings → Runtimes and widen an agent's host access.create/update→adminProcedureregister) staysworkspaceProcedure(local-daemon onboarding uses an agent-linked member key)list,heartbeat,verifyConnection,runSelfTest) unchanged2. Confirm before the destructive "Local workspace tools" toggle
Switching the Local workspace tools enabled master checkbox OFF wiped
toolCapabilities→[]and reset everymodeToolProfilesentry to empty — silently dropping RESEARCH/REVIEW read grants, no confirm. Now wrapped inuseConfirm()(destructive variant) when there's a non-empty policy to lose. On-path unchanged; the controlled checkbox reverts on cancel.Verification
typecheck+lintcleanruntime-admin-gating.test.ts: OWNER can update; MEMBER getsFORBIDDENon create + update; row untouchedruntime-admin-gating(2) ·runtime-secrets(5) ·runtime-github-app(8) ·runtime-dispatch-contract(10) ·action-request-accept(15) ·mcp(120)useConfirmpattern; not live-clicked (no prod login from this runtime). Happy to Playwright-verify againstdev:localif wanted.Deploy held per request — more changes coming before any deploy.
🤖 Generated with Claude Code