SILVER/NODEDC_PLATFORM
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

feat: wire Launcher AI Workspace entitlements

Browse Source
This commit is contained in:
Codex
2026-06-24 22:19:40 +03:00
parent e11f9bd7e7
commit f35cd34167
3 changed files with 197 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/ai-workspace-assistant/README.md
+10
View File
@@ -86,6 +86,16 @@ NDC_LAUNCHER_INTERNAL_ACCESS_TOKEN=...
If `NDC_LAUNCHER_INTERNAL_ACCESS_TOKEN` is not set, the service falls back to `NODEDC_INTERNAL_ACCESS_TOKEN`.
Launcher entitlement adapter configuration:
```text
AI_WORKSPACE_LAUNCHER_ENTITLEMENT_URL=http://launcher:5173/api/ai-workspace/internal/v1/entitlements
AI_WORKSPACE_LAUNCHER_ENTITLEMENT_TOKEN=...
AI_WORKSPACE_LAUNCHER_ENTITLEMENT_REQUIRED=true
```
The Launcher adapter is evaluated after app-owned adapters and may return `launcher`, `ops`, and `engine` app grants. A Launcher denial is the top-level service-access decision and clears MCP servers for that app in the run profile; app-owned adapters still own app-local scopes and runtime tokens.
The first HUB action ids exposed to assistants are:
- `hub.user.read_admin_summary`