ServerKit

admin/ServerKit

0 Fork 0

mirror of https://github.com/jhd3197/ServerKit.git synced 2026-11-09 05:24:49 +09:00

Files

T

History

Juan DenisandClaude Opus 4.7 d528d27296 Bypass per-server ACL for control-plane actions; add diagnostic logs

The Refresh button on the System Status card was returning 403
because the per-server permissions allowlist (e.g. 'docker_manager'
profile) doesn't include 'agent:recapabilities' and the scope
expander has no rule for the agent: namespace. The action is purely
panel-driven discovery — it doesn't mutate the host — so it
shouldn't be subject to the same ACL as install/exec actions.

- Add Server.CONTROL_PLANE_ACTIONS bypass set: agent:recapabilities,
  agent:update. has_permission() returns True for these unconditionally;
  JWT auth at the API layer is what gates access.
- /poll endpoint now logs the keys it received in metrics / system_info
  / capabilities so we can debug "panel says N/A" failure modes from
  the panel logs without instrumenting the agent.
- Agent's sendCapabilities now logs at INFO with sudo mode + capability
  count + runtime count so the agent.log shows whether the periodic
  resend is firing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-01 06:17:31 -04:00