spectra agent allow: let one agent post in another project's channel 87f601ccce6d

//! `spectra agent allow` (spec §8.4): the owner lets one agent post in

//! another project's channel, and can take it back; an agent cannot grant

//! itself anything.

mod common;

use common::{run, setup, text, Serving};

use serde_json::{json, Value};

use spectra_core::keys::KeyPair;

use spectra_mcp::client::{rpc_result, Client};

async fn say(c: &Client, channel: &str) -> Value {

    let req = json!({ "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "say", "arguments": { "body": format!("hello {channel}"), "channel": channel } } });

    rpc_result(&c.mcp("2025-11-25", &req).await.unwrap()).unwrap()["result"].clone()

}

#[tokio::test]

async fn the_owner_opens_one_channel_to_one_agent() {

    let dir = setup();

    let d = dir.path();

    assert!(run(d, &["project", "add", "bubblebobble"]).status.success());

    let home = d.join("agents/claude-mg");

    let o =

        run(d, &["agent", "add", "claude-mg", "--kind", "claude-code", "--project", "oxygen", "--home", home.to_str().unwrap(), "--yes"]);

    assert!(o.status.success(), "{}", text(&o));

    let srv = Serving::start(d);

    let c = Client::new(&srv.socket, Some(KeyPair::load_home(&home).unwrap()));

    let r = say(&c, "bubblebobble").await;

    assert_eq!(r["isError"], true);

    assert!(r["content"][0]["text"].as_str().unwrap().contains("spectra agent allow NAME --channel bubblebobble"), "{r}");

    let o = run(d, &["agent", "allow", "claude-mg", "--channel", "#bubblebobble"]);

    assert!(o.status.success(), "{}", text(&o));

    assert_eq!(say(&c, "bubblebobble").await["isError"], false, "allowed");

    assert_eq!(say(&c, "oxygen").await["isError"], false, "its own channel still");

    assert!(run(d, &["agent", "allow", "claude-mg", "--channel", "bubblebobble", "--remove"]).status.success());

    assert_eq!(say(&c, "bubblebobble").await["isError"], true, "taken back");

    assert!(!run(d, &["agent", "allow", "claude-mg", "--channel", "Not A Channel"]).status.success());

    // An agent cannot grant itself: its key signing agent.scoped fails verify.

    let me = KeyPair::load_home(&home).unwrap();

    let forged = spectra_core::principals::signed_event(

        &me,

        "agent:claude-mg",

        "agent.scoped",

        json!({ "name": "claude-mg", "scope": "projects:all" }),

    );

    let w = spectra_core::daemon::WireEvent::from_new(&forged);

    let r = c.send("POST", "/api/v1/ledger/events", &[], serde_json::to_vec(&vec![w]).unwrap()).await.unwrap();

    assert_eq!(r.status, 403, "{}", String::from_utf8_lossy(&r.body));

    assert_eq!(say(&c, "bubblebobble").await["isError"], true);

    srv.stop();

    for args in [["admin", "verify"], ["admin", "check"], ["admin", "rebuild"]] {

        let o = run(d, &args);

        assert!(o.status.success(), "{args:?}: {}", text(&o));

    }

}

- **Added: `spectra agent allow NAME --channel CHANNEL [--remove]`.** The owner lets one agent post in another project's channel, and can take it back; it is a signed `agent.scoped` event that no agent can make for itself. An agent refused a channel is told this command.

            let granted = format!("channel:{}", ch.name);

            if ch.project.as_deref() == Some(project) || scopes.iter().any(|s| s == "projects:all" || *s == granted) {

                Err(format!(

                    "{} belongs to another project; post in #{project} or #general, mention its agents from there, or ask the owner to run `spectra agent allow NAME --channel {}`",

                    ch.display(),

                    ch.name

                ))

pub const OWNER_KINDS: &[&str] = &[

    "identity.rotated",

    "agent.added",

    "agent.disabled",

    "agent.scoped",

    "project.added",

    "project.linked",

    "project.unlinked",

    "brief.set",

];

                .events_of_kinds(

                    from,

                    &["identity.owner", "identity.rotated", "identity.instance", "agent.added", "agent.disabled", "agent.scoped"],

                    1000,

                )

            // The owner grants or takes back one scope (spec §8.4), such

            // as `channel:NAME` to post in another project's channel.

            "agent.scoped" => {

                self.owner_signed(e)?;

                let name = text(&p, "name")?;

                let scope = text(&p, "scope")?;

                if !grantable(&scope) {

                    return Err(format!("{scope} is not a scope an agent may be given"));

                }

                let grant = p.get("grant").and_then(Json::as_bool).unwrap_or(true);

                let key = *self.by_name.get(&name).ok_or("an unknown agent")?;

                if let Some(a) = self.agents.get_mut(&key) {

                    a.scopes.retain(|s| s != &scope);

                    if grant {

                        a.scopes.push(scope);

                    }

                }

            }

            "identity.owner" | "identity.rotated" | "identity.instance" | "agent.added" | "agent.disabled" | "agent.scoped" => {

                .execute(&mut *conn)

                .await?;

        }

        "agent.scoped" if e.actor == "human" => {

            let (Some(name), Some(scope)) = (p.get("name").and_then(Json::as_str), p.get("scope").and_then(Json::as_str)) else {

                return Ok(());

            };

            if !grantable(scope) {

                return Ok(());

            }

            let grant = p.get("grant").and_then(Json::as_bool).unwrap_or(true);

            let current: Option<String> =

                sqlx::query_scalar("SELECT scopes FROM agents WHERE name = ?").bind(name).fetch_optional(&mut *conn).await?;

            let mut scopes: Vec<String> = current.and_then(|s| serde_json::from_str(&s).ok()).unwrap_or_default();

            scopes.retain(|s| s != scope);

            if grant {

                scopes.push(scope.to_string());

            }

            sqlx::query("UPDATE agents SET scopes = ? WHERE name = ?")

                .bind(serde_json::to_string(&scopes).unwrap_or_default())

                .bind(name)

}

/// A scope the owner may give an agent (spec §8.4): never the owner's own

/// authority, only reach.

pub fn grantable(scope: &str) -> bool {

    match scope.strip_prefix("channel:") {

        Some(ch) => !ch.is_empty() && ch.len() <= 64 && ch.bytes().all(|b| b.is_ascii_lowercase() || b.is_ascii_digit() || b == b'-'),

        None => matches!(scope, "projects:all" | "schedule:any" | "webhooks:read"),

    }

/// `spectra agent allow NAME --channel CHANNEL [--remove]`: the owner lets

/// an agent post in another project's channel (spec §8.4).

pub async fn allow(ctx: &Ctx, name: &str, channel: &str, remove: bool, owner_home_flag: Option<PathBuf>) -> Result<i32> {

    let channel = channel.trim_start_matches('#');

    let scope = format!("channel:{channel}");

    if !spectra_core::principals::grantable(&scope) {

        bail!("{channel} is not a channel name");

    }

    let home = owner_home(ctx, owner_home_flag);

    let w = ctx.owner_writer(&home).await?;

    agent_key(&w, name).await?.with_context(|| format!("no agent named {name}"))?;

    let mut events: Vec<_> = w.refresh_event(&home).await?.into_iter().collect();

    let owner = KeyPair::load_home(&home)?;

    events.push(signed_event(&owner, "human", "agent.scoped", serde_json::json!({ "name": name, "scope": scope, "grant": !remove })));

    w.append(events).await?;

    if remove {

        println!("{} {} {}", ui::done("Removed"), ui::subject(name), ui::dim(format!("may no longer post in #{channel}")));

    } else {

        println!("{} {} {}", ui::done("Allowed"), ui::subject(name), ui::dim(format!("may post in #{channel}")));

    }

    Ok(0)

}

    /// Let an agent post in another project's channel (or take it back)

    Allow {

        name: String,

        /// The channel, without the #

        #[arg(long)]

        channel: String,

        /// Take the permission back

        #[arg(long)]

        remove: bool,

        #[arg(long)]

        owner_home: Option<PathBuf>,

    },

                AgentCmd::Allow { name, channel, remove, owner_home } => agent::allow(&ctx, &name, &channel, remove, owner_home).await,