From 173a97302f2d580163bac8115b8c1dcd03dfe90e Mon Sep 17 00:00:00 2001
From: Ettore Di Giacinto <mudler@localai.io>
Date: Tue, 3 Nov 2026 22:03:32 +0000
Subject: [PATCH] feat(config): record where the startup host grants came from

The startup log of the host grants names the source of the policy
(flag, environment or file) and never a path.

Assisted-by: Claude:claude-sonnet-5-5 go
---
 core/cli/run.go                   | 1 +
 core/config/addon_host_ops.go     | 7 +++++++
 core/config/application_config.go | 3 +++
 3 files changed, 11 insertions(+)

diff --git a/core/cli/run.go b/core/cli/run.go
index f3cdbc86c2..7c7ccaad26 100644
--- a/core/cli/run.go
+++ b/core/cli/run.go
@@ -391,6 +391,7 @@ func (r *RunCMD) Run(ctx *cliContext.Context) (result error) {
 	}
 	opts := []config.AppOption{
 		config.WithAddonHostOps(hostOps.Grants),
+		config.WithAddonHostOpsSource(hostOps.Source),
 		config.WithAddonHostDeny(hostOps.Deny),
 		config.WithAddonHostBlanket(blanket),
 		config.WithAddonHostUIGrantsLocked(!r.AddonHostUIGrants),
diff --git a/core/config/addon_host_ops.go b/core/config/addon_host_ops.go
index 4a8a2345a6..2767591a64 100644
--- a/core/config/addon_host_ops.go
+++ b/core/config/addon_host_ops.go
@@ -122,6 +122,13 @@ func WithAddonHostDeny(deny map[string][]string) AppOption {
 	return func(o *ApplicationConfig) { o.AddonHostDeny = CloneAddonHostOps(snapshot) }
 }
 
+// WithAddonHostOpsSource records where the startup grants came from, for the
+// startup log. A path after a colon is dropped.
+func WithAddonHostOpsSource(source string) AppOption {
+	kind, _, _ := strings.Cut(source, ":")
+	return func(o *ApplicationConfig) { o.AddonHostOpsSource = kind }
+}
+
 // WithAddonHostBlanket sets the deployment blanket mode ("" leaves it to the UI).
 func WithAddonHostBlanket(mode string) AppOption {
 	return func(o *ApplicationConfig) { o.AddonHostBlanket = mode }
diff --git a/core/config/application_config.go b/core/config/application_config.go
index d84d0405eb..fe55a5da40 100644
--- a/core/config/application_config.go
+++ b/core/config/application_config.go
@@ -101,6 +101,9 @@ type ApplicationConfig struct {
 	// call. It is startup-only. Nil or empty means no add-on gets a host
 	// operation endpoint.
 	AddonHostOps map[string][]string `json:"-" yaml:"-"`
+	// AddonHostOpsSource names where the startup grants came from: flag,
+	// environment, policy or empty. It never holds a path.
+	AddonHostOpsSource string `json:"-" yaml:"-"`
 	// AddonHostDeny maps an add-on ID, or "*" for all, to host operation
 	// prefixes, exact names or "*" that no grant may enable. Startup-only;
 	// deny set in the UI is stored separately and applies live.