fix: use PermissionMode.covers() instead of comparison operators

The PermissionMode enum intentionally does not implement PartialOrd
to prevent silent re-ranking of the privilege ladder. Use the explicit
covers() method for privilege comparisons instead of < and >=.
This commit is contained in:
clawdbot committed 2026-10-13 00:12:35 +00:00
1 parent 8938f53790
commit 8a19ecd7cc
1 file changed
+2 -2
+2 -2
View File
@@ -4234,12 +4234,12 @@ fn check_permission_health(permission_mode: PermissionModeProvenance) -> Diagnos
let specs = mvp_tool_specs();
let tools_satisfied = specs
.iter()
.filter(|spec| permission_mode.mode >= spec.required_permission)
.filter(|spec| permission_mode.mode.covers(spec.required_permission))
.map(|spec| spec.name)
.collect::<Vec<_>>();
let tools_gated = specs
.iter()
.filter(|spec| permission_mode.mode < spec.required_permission)
.filter(|spec| !permission_mode.mode.covers(spec.required_permission))
.map(|spec| spec.name)
.collect::<Vec<_>>();