mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-09-20 00:11:34 +00:00
199cf0822e
Fabro run tools are now gated behind an explicit per-run opt-in so workflow agents only receive those capabilities when the run requests them. ## What changed - **`fabro_tools` setting** (`run.agent.fabro_tools`, default `false`) is resolved through the existing TOML config layer stack. - **Worker JWT scope** adds `agent:run_tools` only when the resolved setting is `true`; default worker tokens carry only `run:worker`. - **Worker tool registration** derives from the worker JWT scope claim. The CLI worker locally decodes the token payload and registers `FabroRunToolServices` only when the scope includes both `run:worker` and `agent:run_tools`. - **Server-side authorization remains authoritative**. The worker-side decode is only a local tool-registration gate; the server still validates token signature and scopes before accepting run-tool API calls. > **Behavior change:** existing runs that relied on Fabro run tools being always available must add `[run.agent] fabro_tools = true` to their workflow config. ## Verification ```sh cargo +nightly-2026-04-14 fmt --all cargo test -p fabro-cli fabro_run_tools_enabled_token_requires_run_tools_scope cargo test -p fabro-server worker_command_ cargo test -p fabro-static cargo +nightly-2026-04-14 clippy -p fabro-cli -p fabro-server -p fabro-static --all-targets -- -D warnings git diff --check ``` --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com> |
||
|---|---|---|
| .. | ||
| src | ||
| tests | ||
| build.rs | ||
| Cargo.toml | ||