[Piggidragon]

Step B7 of #152, on main after B6 (#179). Part of #152.

The desktop app gets a Capabilities page (Ctrl+9). It shows what the node offers, switches it per center, lists the programs allowed as providers, and declares the capabilities of node.toml in a form. The switches leave Permissions and the provider allow list leaves Settings › Advanced (owner decision Q23).

• The overview (cap ls --json, per center):
  • every built-in, program and config capability with its source;
  • each action, state key, event and stream with its effect and summary;
  • a unit the node leaves out, with its reason and a "left out" mark;
  • while the node runs, whether the chosen center may use a unit now ("Usable now").
• Switches: On, Off and Hidden per capability and per action, through cap set … --center.
  • A unit without its own switch shows its capability's, marked "like its capability".
  • With neither chosen, no segment is selected and the mode decides. Permissions used to show "On" there, which was wrong for sense and actuate.
• Programs: the allowed providers, each marked attached or not. A program is allowed with a path and Choose…, or removed (cap provider allow/rm).
• Your capabilities: the [[capability]] entries of node.toml, with Add a capability…, Edit and Remove. Remove asks first.
  • The form takes the name, the effect, a summary, the command, the arguments' and the result's JSON Schema, a time limit and the platform.
  • It checks while you type: each schema through nerve_proto::schema::check, showing where and why a schema falls outside the subset, and the rest through ConfigCapability::validate. The time limit is checked against the node's limits.max_timeout_secs.
  • Save runs cap add or cap edit, with the schema on stdin. The node checks again, and what it refuses stays in the form with its reason. Enter saves.
  • There is no account field: config capabilities run as nerve-run (B5).
• Where they are not offered:
  • A node run by hand says it offers no config capabilities.
  • On Windows the page says that neither programs nor node.toml capabilities are offered there yet (Windows: the desktop app is the only way to the node #176). It hides Add and the program row, but keeps Edit, Remove and the removal of programs, so old entries can be cleaned up.
• Elsewhere in the app:
  • The help and reference rows point to the page for all eight cap commands.
  • Ctrl+1 to Ctrl+8 keep their pages.
  • The Arguments and Result boxes scroll and select like text fields.
• Docs: docs/user/desktop.md gets a Capabilities section, Ctrl+9 in the keyboard table, and Settings and Permissions without what moved. config-capabilities.md and providers.md point to the page. The CHANGELOG gets two bullets in the Architecture: two MCP tools (list, execute) and capabilities of your own (providers on the installed node, config capabilities, state and streams) #152 section.

Tests

• tests/caps.rs (unix) runs a real node in process:
  • it adds a capability through the dialog; a oneOf schema shows its pointer and reason and saves nothing;
  • the node refuses a time limit above its own, and the refusal stays in the dialog;
  • edit and remove;
  • the switches across two centers, a pick, and an unpairing.
• tests/app.rs:
  • the switches and the inherited value;
  • the provider list, including a relative path refused with the CLI's reason;
  • Choose…;
  • the notes on Windows and on a node run by hand.
• tests/fit.rs:
  • the dialog at 1280×800 with an error at every field;
  • the sidebar at 900×580 opening all nine pages;
  • wheel, drag and keys in the schema boxes;
  • Enter in each one-line field.
• keys.rs (Ctrl+9), view.rs (rows, notes, form checks, cap add/cap edit arguments) and reference.rs (places).
• Shots, light and dark: the page, the dialogs (also at 1280×800), a broken schema, the node's refusal, by hand and the Windows note.

Review and checks

• 5 rounds (correctness, spec). The first had 3 mediums and 3 lows; the last had 2 lows, both fixed.
• cargo fmt --check, clippy and cargo xwin clippy: clean.
• cargo test --workspace: 1703 passed, 0 failed.
• Mutation sets: 42 mutations, all fail their tests as expected. Three stale entries were rewritten against the current code.
• Windows VM, the CI windows recipe: 1353 passed, 0 failed. The app builds there and shows the Windows notes.

🤖 Generated with Claude Code