Follow-up from PR #14196 (config-defined global agents), deferred from a Codex review round (P3).
Context. For a tenants: 'system' (tenantless) global agent with access.level: editor, the builder's canEdit comes from useResourcePermissions → the tenant-scoped effective-permissions endpoint keyed on the agent _id, which misses the tenantless ACL grant and stays false.
Problem. AgentPanel shows the Duplicate action for isSystem agents only when canEdit || isAdmin. Admins see it; non-admin editor-grant users do not, even though the duplicate route now authorizes system globals and creates a normal editable copy.
Fix direction. Give the effective-permissions endpoint (GET /api/permissions/agent/:id/effective, getUserEffectivePermissions) the same system-global fallback used elsewhere (build principals in the tenant context, run the ACL lookup under the system context for tenantless isSystem agents), so canEdit is correct for editor grants. Alternatively, surface an effective-edit flag on the agent VIEW response, or decide that any VIEW-er may fork a global into their own copy.
Follow-up from PR #14196 (config-defined global agents), deferred from a Codex review round (P3).
Context. For a
tenants: 'system'(tenantless) global agent withaccess.level: editor, the builder'scanEditcomes fromuseResourcePermissions→ the tenant-scoped effective-permissions endpoint keyed on the agent_id, which misses the tenantless ACL grant and staysfalse.Problem.
AgentPanelshows the Duplicate action forisSystemagents only whencanEdit || isAdmin. Admins see it; non-admin editor-grant users do not, even though the duplicate route now authorizes system globals and creates a normal editable copy.Fix direction. Give the effective-permissions endpoint (
GET /api/permissions/agent/:id/effective,getUserEffectivePermissions) the same system-global fallback used elsewhere (build principals in the tenant context, run the ACL lookup under the system context for tenantlessisSystemagents), socanEditis correct for editor grants. Alternatively, surface an effective-edit flag on the agent VIEW response, or decide that any VIEW-er may fork a global into their own copy.