Repository navigation
[browser][platform] Creator capability write-path API — gated on the trust model #76
Description
[browser][platform] Creator capability write-path API — gated on the trust model
Today no API lets a creator set config.capabilities (surfaces/runtime/workflow/tools) — POST/PUT /v1/agents don't touch it; only migrations do (agent-capabilities.ts resolves it read-only). This issue adds the write-path so agents become self-service. Blocked on the trust model.
Do
PUT /v1/agents/:id/capabilitiesaccepting a sanitizedcapabilitiesblock (extend the existingsanitizeCapabilities/sanitizeSettingsSchema), allowlistingsurfaces,tools, andruntime/workflowonly to values the trust model permits for the creator's tier.- Enforce the permission scope from the trust model (domain/action allowlists travel with the capability).
- Audit every capability change.
Acceptance
- A creator can declare a permitted agent type via API (within their tier), sanitized + audited.
-
runtime:"browser"is grantable ONLY under the trust model's scoping/consent; ungated attempts are rejected. - Tests for sanitize + gate + audit.
Part of the open-browser-agents epic. Depends on the trust-model issue. Pairs with #58.
Activity
serge-ivo commentedon Aug 6, 2026
Premise is now stale. This says "Today no API lets a creator set
config.capabilities—POST/PUT /v1/agentsdon't touch it; only migrations do". That was fixed by #141:workers/api/src/routes/agents.ts:350—sanitizeDeclaredCapabilities(body.capabilities):380—lintAgentClaims({ description, capabilities: { runtime, workflow } })So the write-path exists and validates. What remains unbuilt is the trust gating (#142), not the API.
Worth rescoping this to whatever is genuinely still missing (browser-specific capability grants?) or closing it in favour of #142 + #75 — otherwise it reads as blocking work that has already landed.
serge-ivo commentedon Aug 6, 2026
Closing: the premise is no longer true. The creator capability write-path exists —
routes/agents.ts:350runssanitizeDeclaredCapabilities(body.capabilities)on create and update, withlintAgentClaimsat:380. That landed in #141.What this issue was really protecting — that the write-path must not be exposed to non-operators without a trust model — is #142, which is still open and now the live gap (the path shipped, the gate did not). Tracking it there rather than in a ticket whose stated task is done.