95fdec335a
Promotes approvals to the default tier with a public API (requestApproval + registerApprovalHandler) that other modules consume. Self-modification (install_packages / request_rebuild / add_mcp_server) moves into a new optional module that registers delivery actions + matching approval handlers via the new API. ## Approvals (default tier) - Adds `src/modules/approvals/primitive.ts` exporting `requestApproval`, `registerApprovalHandler`, `notifyAgent`. Absorbs `pickApprover` / `pickApprovalDelivery` / `channelTypeOf` from the deleted `src/access.ts`. - Rewrites `response-handler.ts` to dispatch to registered approval handlers on approve (action-keyed Map). Reject path is centralized. - Drops the three self-mod-specific delivery-action registrations from `approvals/index.ts`; they belong to self-mod now. - `onecli-approvals.ts` now imports picks from the primitive instead of `src/access.ts`. ## Self-mod (optional tier) - New `src/modules/self-mod/` with request handlers (validate input + call requestApproval) and apply handlers (orchestration on approve). - `apply.ts` owns updateContainerConfig + buildAgentGroupImage + killContainer calls. Self-mod depends on approvals (via registerApprovalHandler + requestApproval + notifyAgent) and on core (container-runner, container-config). - Registers 3 delivery actions + 3 approval handlers at import time. ## Other changes - `src/access.ts` and `src/access.test.ts` deleted. Tests split across `src/modules/approvals/picks.test.ts` (approver selection) and `src/modules/permissions/permissions.test.ts` (access + roles + DM). - `src/modules/index.ts` barrel: approvals loads before self-mod so registerApprovalHandler is bound when self-mod registers at import time. ## Validation - `pnpm run build` clean - `pnpm test` — 137 host tests pass - `bun test` in container/agent-runner — 17 tests pass - Service starts; boot log shows `OneCLI approval handler started`, `NanoClaw running`; clean SIGTERM shutdown Resolves the transitional tier violation flagged in PR #5 where core imported from the permissions optional module via `src/access.ts`. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
37 lines
1.6 KiB
TypeScript
37 lines
1.6 KiB
TypeScript
/**
|
|
* Approvals module — admin approval primitive + response plumbing.
|
|
*
|
|
* Default-tier module. Ships with main. Other modules depend on it by
|
|
* importing `requestApproval` / `registerApprovalHandler` from this module.
|
|
*
|
|
* Registers:
|
|
* - A response handler that claims pending_approvals rows and dispatches
|
|
* to whatever module registered for the row's `action` string. Also
|
|
* resolves in-memory OneCLI credential approvals.
|
|
* - An adapter-ready callback that starts the OneCLI manual-approval handler
|
|
* once the delivery adapter is set.
|
|
* - A shutdown callback that stops the OneCLI handler cleanly.
|
|
*
|
|
* Self-mod flows (install_packages, request_rebuild, add_mcp_server) moved
|
|
* out to `src/modules/self-mod/` in PR #7 — they now register delivery
|
|
* actions + approval handlers via this module's public API.
|
|
*/
|
|
import { onDeliveryAdapterReady } from '../../delivery.js';
|
|
import { registerResponseHandler, onShutdown } from '../../response-registry.js';
|
|
import { handleApprovalsResponse } from './response-handler.js';
|
|
import { startOneCLIApprovalHandler, stopOneCLIApprovalHandler } from './onecli-approvals.js';
|
|
|
|
// Public API re-exports so consumers import from the module root.
|
|
export { requestApproval, registerApprovalHandler, notifyAgent } from './primitive.js';
|
|
export type { ApprovalHandler, ApprovalHandlerContext, RequestApprovalOptions } from './primitive.js';
|
|
|
|
registerResponseHandler(handleApprovalsResponse);
|
|
|
|
onDeliveryAdapterReady((adapter) => {
|
|
startOneCLIApprovalHandler(adapter);
|
|
});
|
|
|
|
onShutdown(() => {
|
|
stopOneCLIApprovalHandler();
|
|
});
|