improvement(agent): remove permission mode feature flag

Author: j15z

apps/realtime/src/database/agent-tool-permissions.test.ts

@@ -1,10 +1,8 @@
 /** @vitest-environment node */
 import {
   BLOCK_OPERATIONS,
-  BLOCKS_OPERATIONS,
   OPERATION_TARGETS,
   SUBBLOCK_OPERATIONS,
-  WORKFLOW_OPERATIONS,
 } from '@sim/realtime-protocol/constants'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
@@ -46,21 +44,10 @@ vi.mock('drizzle-orm/postgres-js', () => ({ drizzle: () => ({ transaction: mockT
 vi.mock('postgres', () => ({ default: vi.fn() }))
 vi.mock('@/env', () => ({
   env: { DATABASE_URL: 'postgres://localhost/test' },
-  getInternalApiBaseUrl: () => 'http://localhost:3000',
 }))
 
-import { mergeSubBlockValues } from '@sim/workflow-persistence/subblocks'
-import { afterEach } from 'vitest'
 import { persistWorkflowOperation } from '@/database/operations'
 
-const mockFetch = vi.fn()
-beforeEach(() => {
-  vi.stubGlobal('fetch', mockFetch)
-  mockFetch.mockReset()
-  mockFetch.mockImplementation(async () => Response.json({ agentToolPermissionModeEnabled: true }))
-})
-afterEach(() => vi.unstubAllGlobals())
-
 const transaction = {
   select: () => ({ from: () => ({ where: mockSelectWhere }) }),
   update: () => ({ set: mockSet }),
@@ -141,7 +128,7 @@ describe('search replacement persistence', () => {
   })
 })
 
-describe('variable permissions at every realtime transaction write boundary', () => {
+describe('atomic tool reordering', () => {
   const block = {
     id: 'agent-1',
     type: 'agent',
@@ -170,53 +157,9 @@ describe('variable permissions at every realtime transaction write boundary', ()
         }
       )
     )
-    mockFetch.mockImplementation(async () =>
-      Response.json({ agentToolPermissionModeEnabled: false })
-    )
-  })
-
-  it.each([
-    {
-      operation: WORKFLOW_OPERATIONS.REPLACE_STATE,
-      target: OPERATION_TARGETS.WORKFLOW,
-      payload: { state: { blocks: { 'agent-1': block } } },
-    },
-    {
-      operation: BLOCK_OPERATIONS.UPDATE_CANONICAL_MODE,
-      target: OPERATION_TARGETS.BLOCK,
-      payload: { id: 'agent-1', canonicalId: '0:agentToolUsageControl', canonicalMode: 'advanced' },
-    },
-    {
-      operation: BLOCK_OPERATIONS.REPLACE_CANONICAL_MODES,
-      target: OPERATION_TARGETS.BLOCK,
-      payload: {
-        id: 'agent-1',
-        data: { canonicalModes: { '0:agentToolUsageControl': 'advanced' } },
-      },
-    },
-    {
-      operation: BLOCKS_OPERATIONS.BATCH_ADD_BLOCKS,
-      target: OPERATION_TARGETS.BLOCKS,
-      payload: { blocks: [block] },
-    },
-    {
-      operation: SUBBLOCK_OPERATIONS.BATCH_UPDATE,
-      target: OPERATION_TARGETS.SUBBLOCK,
-      payload: {
-        updates: [{ blockId: 'agent-1', subblockId: 'tools', value: block.subBlocks.tools.value }],
-      },
-    },
-  ])('refuses $operation before changing any block rows', async (operation) => {
-    vi.mocked(mergeSubBlockValues).mockReturnValue(block.subBlocks)
-    await expect(
-      persistWorkflowOperation('workflow-1', { ...operation, timestamp: Date.now() })
-    ).rejects.toThrow('disabled')
-    expect(mockSet).toHaveBeenCalledTimes(1)
-    expect(transaction.delete).not.toHaveBeenCalled()
-    expect(transaction.insert).not.toHaveBeenCalled()
   })
 
-  it('persists a reordered tool array and its mode map in one write while the flag is off', async () => {
+  it('persists a reordered tool array and its mode map in one write', async () => {
     const first = { type: 'function', usageControlExpression: 'auto' }
     const second = { type: 'function', usageControlExpression: 'force' }
     const original = {
@@ -239,7 +182,6 @@ describe('variable permissions at every realtime transaction write boundary', ()
         payload: { id: block.id, subBlocks, data: { canonicalModes } },
       })
     ).resolves.toBeUndefined()
-    expect(mockFetch).not.toHaveBeenCalled()
     expect(mockSet).toHaveBeenLastCalledWith(
       expect.objectContaining({ subBlocks, data: { canonicalModes } })
     )

apps/realtime/src/database/operations.test.ts

@@ -40,7 +40,6 @@ import {
 import { and, eq, inArray, isNull, or, sql } from 'drizzle-orm'
 import { drizzle } from 'drizzle-orm/postgres-js'
 import postgres from 'postgres'
-import { assertAgentToolPermissionModeEnabled } from '@/database/workflow-authoring'
 import { env } from '@/env'
 
 const logger = createLogger('SocketDatabase')
@@ -782,12 +781,7 @@ async function handleBlockOperationTx(
       }
 
       const existingBlock = await tx
-        .select({
-          id: workflowBlocks.id,
-          type: workflowBlocks.type,
-          subBlocks: workflowBlocks.subBlocks,
-          data: workflowBlocks.data,
-        })
+        .select({ data: workflowBlocks.data })
         .from(workflowBlocks)
         .where(and(eq(workflowBlocks.id, payload.id), eq(workflowBlocks.workflowId, workflowId)))
         .limit(1)
@@ -799,18 +793,6 @@ async function handleBlockOperationTx(
         [payload.canonicalId]: payload.canonicalMode,
       }
 
-      if (existingBlock[0]) {
-        await assertAgentToolPermissionModeEnabled(
-          [
-            {
-              ...existingBlock[0],
-              data: { ...currentData, canonicalModes },
-            },
-          ],
-          existingBlock
-        )
-      }
-
       const updateResult = await tx
         .update(workflowBlocks)
         .set({
@@ -842,7 +824,6 @@ async function handleBlockOperationTx(
         .select({
           id: workflowBlocks.id,
           locked: workflowBlocks.locked,
-          type: workflowBlocks.type,
           subBlocks: workflowBlocks.subBlocks,
           data: workflowBlocks.data,
         })
@@ -863,19 +844,6 @@ async function handleBlockOperationTx(
 
       const subBlocks = { ...(existingBlock[0]?.subBlocks || {}), ...(payload.subBlocks || {}) }
 
-      if (existingBlock[0]) {
-        await assertAgentToolPermissionModeEnabled(
-          [
-            {
-              ...existingBlock[0],
-              subBlocks,
-              data: { ...currentData, canonicalModes: payload.data.canonicalModes },
-            },
-          ],
-          existingBlock
-        )
-      }
-
       const updateResult = await tx
         .update(workflowBlocks)
         .set({
@@ -968,13 +936,7 @@ async function handleBlocksOperationTx(
       if (blocks && blocks.length > 0) {
         // Fetch existing blocks to check for locked parents
         const existingBlocks = await tx
-          .select({
-            id: workflowBlocks.id,
-            type: workflowBlocks.type,
-            subBlocks: workflowBlocks.subBlocks,
-            data: workflowBlocks.data,
-            locked: workflowBlocks.locked,
-          })
+          .select({ id: workflowBlocks.id, locked: workflowBlocks.locked })
           .from(workflowBlocks)
           .where(eq(workflowBlocks.workflowId, workflowId))
 
@@ -1030,8 +992,6 @@ async function handleBlocksOperationTx(
           }
         })
 
-        await assertAgentToolPermissionModeEnabled(blockValues, existingBlocks)
-
         await tx
           .insert(workflowBlocks)
           .values(blockValues)
@@ -2063,7 +2023,6 @@ async function handleSubblockOperationTx(
       const allBlocks = await tx
         .select({
           id: workflowBlocks.id,
-          type: workflowBlocks.type,
           subBlocks: workflowBlocks.subBlocks,
           locked: workflowBlocks.locked,
           data: workflowBlocks.data,
@@ -2103,10 +2062,6 @@ async function handleSubblockOperationTx(
           ? { ...currentSubBlock, value }
           : { id: subblockId, type: 'unknown', value }
 
-        if (subblockId === 'tools') {
-          await assertAgentToolPermissionModeEnabled([{ ...block, subBlocks }], [block])
-        }
-
         await tx
           .update(workflowBlocks)
           .set({
@@ -2218,16 +2173,6 @@ async function handleWorkflowOperationTx(
       }
 
       const { blocks, edges, loops, parallels } = payload.state
-      const previousBlocks = await tx
-        .select({
-          id: workflowBlocks.id,
-          type: workflowBlocks.type,
-          subBlocks: workflowBlocks.subBlocks,
-          data: workflowBlocks.data,
-        })
-        .from(workflowBlocks)
-        .where(eq(workflowBlocks.workflowId, workflowId))
-      await assertAgentToolPermissionModeEnabled(Object.values(blocks || {}), previousBlocks)
 
       logger.info(`Replacing workflow state for ${workflowId}`, {
         blockCount: Object.keys(blocks || {}).length,