weichen/Agent-System-Frontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Hide system actions from the role editor #129

Merged
weichen merged 2 commits from fix/role-editor-single-project-toggle into main 2026-10-23 10:31:08 +00:00
Conversation 0 Commits 2 Files Changed 1
+5 -1
2 Commits
Author SHA1 Message Date
weichen 551697d67d Merge remote-tracking branch 'origin/main' into fix/role-editor-single-project-toggle
governance / governance (pull_request) Successful in 15s
Details
ci / test-and-build (pull_request) Successful in 1m2s
Details
2026-10-23 10:29:27 +00:00
agent-exec-transport dca48a1d75 Hide system actions from the role editor
governance / governance (pull_request) Successful in 14s
Details
ci / test-and-build (pull_request) Successful in 37s
Details 
Why: Owner reported that creating a role showed system admin permissions. The
server rejects protected system-scope actions for role writes anyway; they are
only configurable per account in the users panel, so showing them in the role
editor is misleading.

Evidence: npm run build passes and npx vitest run passes (717 tests); the two
account-panel tests that assert system capability groups keep passing because the
filter lives at the role editor call site, not in buildCapabilityGroups. The
agent-exec transport diff matches the owner-accepted change.

Impact: the role editor builds capability groups without system.* actions; the
per-account explicit grant surface is unchanged.

Refs: fix/role-editor-single-project-toggle
 2026-10-23 10:27:02 +00:00