Each agent row on the hive dashboard, and the agent page's link menu, linked
to the agent's forge profile and its config repo. Both are gone, with what
only they used:
- hive-agent no longer builds the two links, the `Forge` link kind, or the
`forge_public_url` field of its state, and no longer reads
`HIVE_FORGE_PUBLIC_URL`. The agent page's link menu and the dashboard row's
icon strip (which skips a forge link an agent not yet rebuilt still sends)
drop their forge handling.
- hive-c0re's dashboard state no longer carries `forge_public_url`.
- `HIVE_FORGE_PUBLIC_URL` is no longer forwarded to agents through the meta
flake (the forwarded-variable list, its test fixture, the controller's
settings and the VM test), so the next meta flake render differs by that
one line. hive-c0re still reads it for the forge URL a hive publishes, so
`swarm.forge.publicUrl` stays, with its description corrected.
- The docs stop describing the links.
The handbook's sections were agent-lifecycle, integrations, swarm, tools,
trust-boundary and web-ui, which do not follow how the system is built, so a
reader could not tell which layer a page is about. Its pages now sit in
swarm/, hives/ and agents/, with the accounts an agent can hold outside the
system in external-accounts/.
- swarm/: forge, matrix and the knowledge repo join the swarm pages, and so
does the swarmctl reference.
- hives/: the dashboard, hivectl and its reference, and the operator/agent
boundary, with a README that takes over the old web-ui and tools pages.
- agents/: the roster, persistence, config changes, the agent's own web page
(was web-ui/agent) and the security model, with a README.
- external-accounts/: GitHub and GitLab.
Pages are moved whole; none is split yet. Every reference follows: relative
links in the docs, `docs/2-handbook/...` paths in code comments, the nix
checks that regenerate the CLI references and the ignore list, and docs/README.md,
whose handbook section is now by layer.
The labels and reviewers columns had no sort, so "every column sorts" was
false; both now sort on their joined text.
A branch protection rule's name is a glob the forge compiles with `/` as its
separator, which also takes `?`, `[a-z]`, `[!a-z]`, `{a,b}` and a backslash
escape. The report read only `*` and `**`, so a rule such as `{main,release}`
matched nothing and its PRs showed as protected by no rule, needing no
approvals. It now reads all of them.
The reports tab holds cards, so a card named "issue report" repeats the word.
The card is now "issues", beside "pull requests", and the handbook says the
same.
The pull requests card gets a diff column, the lines a PR adds and removes
(`+120 −8`), sortable on the total. The controller takes the counts from the
forge's pull request list, so no call is added. The column that said "has all
approvals" is now headed "approved".
The reports tab gets a "pull requests" card under the issue report. It lists
the open PRs of every repo, or of one picked in a repo select, with the
columns a reviewer or merger filters on: author, labels, requested
reviewers, base branch, WIP (the forge's draft flag), approvals against the
base branch's protection rule, has all approvals, conflicts, protected base
and CI. Every column sorts, the small-set columns filter by picking values,
and the browser keeps the filters and the repo. No filter applies at first.
swarm-controller resolves each row so the page makes no calls of its own:
GET /api/pr-report and GET /api/repos/{org}/{repo}/pr-report. The required
approvals come from the first matching branch protection rule (an
unprotected base asks for none); an approval counts when it is the
reviewer's latest decision, on the current head, neither stale nor
dismissed and official.
A free-text table cell gets a minimum width, so a table with many columns
scrolls sideways instead of wrapping a title to a word a line.
The expiry test only built entries sized for ten classifications, so a run
whose deadline was ignored or fixed at the default would pass. It now checks
that a run of a hundred is still held when ten would have expired, and drops
at its own deadline.
The limit was a constant of ten in swarm-wire, so a repo with eleven rules
could not be reviewed and nothing short of a rebuild changed it. It is now
`max_classifications` in the classifier settings, beside
`max_concurrent_reviews`: 1 to 1000, ten until set, and a document stored
before the field decodes with the default. The classifier settings form in
the swarm UI gets a "rules per review" field, and the try-out's add button
stops at the saved limit instead of a hard-coded ten.
The controller checks a try-out, and a requested review's rules file, against
the setting where the run starts. The rules file itself may hold up to the
1000 the setting allows, so raising the limit needs no change to a repo.
A review whose rules exceed the limit posts a no-verdict comment saying so.
A run's reply deadline was a constant that covered ten classifications, a
minute plus three each. It is now computed from the run's own size, so a
bigger run waits as long as it needs and a default-sized one still waits 31
minutes. The classifier's answer window in the queue permissions covers the
biggest run the setting allows.
a re-created cache signs with a new key; the fact was only created once, so
every hive then rejected the swarm's closures. the cache's grant gains update
on that one leaf, and a store that refuses it leaves the key as it was.
Closes#6181
On the jobs, builds and hives cards the picker was alone on the first line of
the body. DisclosureAction puts a body's control in the header of the
disclosure it is in, beside the chevron and outside the toggle, so it costs no
row and pressing it does not fold the card.
A meta build whose attic push failed (attic or its token not up yet) is
recorded with cached false and the deploy goes ahead. Nothing sent that
build again until internal/meta moved, so the create for that agent
failed on every hive and a rebuild was silently never pending.
The controller's cache-miss pass now also takes a record from the head
with cached false: it sends the same build without asking the cache, with
the pass's existing backoff (30 min doubling to 12 h), and rewrites the
record with cached true once the push lands, under the same
compare-and-set guard as a path change. The push.rs module doc no longer
claims the next build pushes again.
Mixed versions: controller-only, same wire type and builder request. An
old controller leaves an uncached record as before; a builder needs no
change.
Closes#6173
Reads GET /api/agents/{name}/term/stream over the controller socket or the
gateway and prints one line per row. The gateway path uses a client without
the total-request timeout so the stream isn't cut after 30 seconds.
Closes#6160
preact 11's types reject the side panel's role=dialog on an aside, which the
nix agent-typecheck check runs. The drawer is a div, whose CSS is
class-based, so nothing else changes.
All four packages move from preact 10.29.8 to 11.2.0. The new types need four
small changes in swarm-ui and the shared dropdown: a ref that may be empty is
typed RefObject<T | null>, HTMLAttributes is imported from preact instead of
read from the JSX namespace, and TextField's type is the five kinds it is
used with, asserted once for the input's new union. npm-deps-hash follows the
lockfile.
Both pollers wait about ten minutes for the agent's token, then exit 0.
Under Restart=on-failure that exit is final, and nothing started them
again, so a token minted or placed after the window left the agent
without notifications until its container restarted.
Add a path unit per poller with PathChanged on the token file(s) the
poller reads, the shape forge-avatar-sync already uses. A path unit
starts its service only when it is not running, so a poller that found
its token is untouched. The github path unit is gated on
github.enable like its service.
Container-side: it ships with the agent's next rebuild, and an agent on
an older rev keeps the old behaviour.
Closes#6179
Wraps PUT /api/hives/{hive}/agents/{agent}/state, the route the swarm UI's
state menu uses. States come from swarm_wire::wanted::AgentState; destroyed
needs --yes.
Closes#6159
chart.js 4.5.1 to 4.6.1, marked 18.0.6 to 18.1.3, wouter-preact 3.10.0 to
3.13.0 and esbuild 0.28.1 to 0.28.2 (the pins), and the lockfile's dompurify
3.4.12 to 3.4.17, which clears the audit's one critical advisory (npm audit
reports 0 vulnerabilities now). preact stays on 10.29.8: 11 is a major
release. npm-deps-hash follows the lockfile.
the page picked the top-level hyperhive attr, which stopped existing when the
agent namespace moved under services.hyperhive.agent, so it rendered no
options. the pick now uses the new root and asserts model, user.privateUsers
and nixBuilds are present. the acp preset submodule options get the
descriptions the now-rendered page requires.
Closes#6136
The docs sections moved the crate reference index to 4-implementation/crates,
but the derivation still wrote the per-crate pages to crates/ at the top of the
tree, so the website showed a separate top-level crates group. They now land
beside the index, and the links back into docs/ get one more ../.
