zesdex/apps/infrastructure/src/subagent/division.rs

//! Subagent division — access-tier tool filtering for subagent permissions.
//!
//! Flow: the calling code picks an `AccessTier` → `tools_for()` returns the
//! subset of all built-in tools allowed at that tier → those tools are passed
//! to `engine::run_agent` for the subagent's tool-execution loop.

use crate::tools::Tool;

pub use zesdex_domain::subagent::AccessTier;

/// Filter the available tools to match the given access tier.
///
/// Flow: `all_tools()` → filter by tier → return owned `Vec<Box<dyn Tool>>`.
///
/// Read tier: non-mutating introspection and utility tools only.
/// Write tier: everything except dangerous system/network/process tools.
/// Full tier: all 37 tools.
pub fn tools_for(access: &AccessTier) -> Vec<Box<dyn Tool>> {
    let all = crate::tools::all_tools();

    match access {
        AccessTier::Read => all
            .into_iter()
            .filter(|t| {
                let name = t.name();
                matches!(
                    name,
                    "read"
                        | "grep"
                        | "glob"
                        | "pong"
                        | "todowrite"
                        | "todofinish"
                        | "dir_list"
                        | "dir_cache_update"
                        | "cd"
                        | "remember"
                        | "recall"
                        | "forget"
                )
            })
            .collect(),

        AccessTier::Write => all
            .into_iter()
            .filter(|t| {
                let name = t.name();
                !matches!(
                    name,
                    "bash"
                        | "bash_output"
                        | "bash_kill"
                        | "git_operator"
                        | "git_worktree"
                        | "git_cred"
                        | "shell"
                        | "workflow_run"
                        | "note_finding"
                        | "read_findings"
                        | "hive_mind"
                        | "spawn_agents"
                        | "spawn_pipeline"
                        | "plan_enter"
                        | "plan_ready"
                        | "sequential_think"
                )
            })
            .collect(),

        AccessTier::Full => all, // everything
    }
}