Rebrand: TeamClaw -> Clawmates (clawmates.work)

Full-depth rename per the approved plan; the 'claw' product vocabulary (claws, /claws routes, clawId, Claw Chat) stays — it is now the brand. - Display brand: Clawmates (manifest, titles, hero, login/rail logo 'clawmates'); default host app.clawmates.work; registry ghcr.io/clawmates - Crates tc-* -> cm-* (16 crates + all imports); binaries clawmates-server/broker/bundler; images clawmates/*; env prefix CLAWMATES_* (+ CM_TEST_DATABASE_URL / CM_LIVE_LLM); config clawmates.toml; helm chart deploy/helm/clawmates with clawmates-* resources; db names clawmates*; sockets /run/clawmates; cookie cm_session; kind cluster clawmates-test; seccomp node profile clawmates-agent-profile.json - All 9 Playwright brand assertions updated in lockstep; historical spec document left untouched as the only remaining 'TeamClaw' - Local env migrated: dev pg clawmates-dev-pg/clawmates_dev, shared test server clawmates-test-pg, kind cluster recreated with image + profile, compose images rebuilt under clawmates/* Verified end to end: 161 Rust + 68 frontend tests, 29 Playwright journeys, 4 live kind tests, helm/install/LOC/placeholder gates, and the clean-room install rehearsal serving the clawmates login page from a signed bundle of the rebuilt images. Co-Authored-By: Claude Fable 5 <[email protected]>
2026-06-10 12:31:25 -05:00
parent 8046853feb
commit add4f79fed
209 changed files with 1429 additions and 1422 deletions
@@ -0,0 +1,93 @@
+use axum::extract::{Path, State};
+use axum::Json;
+use cm_safety::{approvals, Approval, Decision, ResumeReady, SafetyError};
+use serde_json::{json, Value};
+use uuid::Uuid;
+
+use crate::{ApiError, AppState, Authed};
+
+impl From<SafetyError> for ApiError {
+    fn from(err: SafetyError) -> Self {
+        match err {
+            SafetyError::NotFound => ApiError::NotFound,
+            SafetyError::AlreadyDecided => ApiError::Conflict,
+            _ => ApiError::Internal,
+        }
+    }
+}
+
+/// Loads an approval, hiding other workspaces' approvals entirely.
+async fn workspace_approval(
+    state: &AppState,
+    user: &cm_auth::AuthedUser,
+    id: Uuid,
+) -> Result<Approval, ApiError> {
+    let approval = approvals::get(&state.pool, id).await?;
+    if approval.workspace_id != user.workspace_id {
+        return Err(ApiError::NotFound);
+    }
+    Ok(approval)
+}
+
+/// GET /api/approvals — the pending review queue (§10), oldest first.
+pub async fn list(
+    State(state): State<AppState>,
+    Authed(user): Authed,
+) -> Result<Json<Vec<Approval>>, ApiError> {
+    let pending = approvals::list_pending(&state.pool, user.workspace_id).await?;
+    Ok(Json(pending))
+}
+
+/// GET /api/approvals/{id}
+pub async fn get(
+    State(state): State<AppState>,
+    Authed(user): Authed,
+    Path(id): Path<Uuid>,
+) -> Result<Json<Approval>, ApiError> {
+    Ok(Json(workspace_approval(&state, &user, id).await?))
+}
+
+async fn decide(
+    state: AppState,
+    user: cm_auth::AuthedUser,
+    id: Uuid,
+    decision: Decision,
+) -> Result<Json<Value>, ApiError> {
+    workspace_approval(&state, &user, id).await?;
+    let approval = approvals::decide(&state.pool, id, user.user_id, decision).await?;
+
+    // Kick the resume immediately; the sweeper remains the durable
+    // fallback if this process dies first.
+    let runtime = state.runtime.clone();
+    let ready = ResumeReady {
+        run_id: approval.run_id,
+        approval_id: approval.id,
+        approved: decision == Decision::Approve,
+    };
+    tokio::spawn(async move {
+        let _ = runtime.resume_run(ready).await;
+    });
+
+    Ok(Json(
+        json!({ "id": approval.id, "status": approval.status }),
+    ))
+}
+
+/// POST /api/approvals/{id}/approve — executes the gated action (§15:
+/// approve-only execution, idempotent, audited).
+pub async fn approve(
+    State(state): State<AppState>,
+    Authed(user): Authed,
+    Path(id): Path<Uuid>,
+) -> Result<Json<Value>, ApiError> {
+    decide(state, user, id, Decision::Approve).await
+}
+
+/// POST /api/approvals/{id}/reject — the agent learns the refusal in-band.
+pub async fn reject(
+    State(state): State<AppState>,
+    Authed(user): Authed,
+    Path(id): Path<Uuid>,
+) -> Result<Json<Value>, ApiError> {
+    decide(state, user, id, Decision::Reject).await
+}