30be7cd632
The operator-inbox handler landed with an unformatted long match line (`match state.coord.broker.unread_for_recipient(...)`) that rustfmt wants wrapped. It was force-merged during the CI outage so the formatting gate didn't catch it, and now the treefmt check fails for every PR based on current main. Pure formatting, no logic change.
3122 lines
123 KiB
Rust
3122 lines
123 KiB
Rust
//! Hyperhive dashboard. Lists managed containers (with deep-links to each
|
|
//! container's web UI), pending approvals (with unified diff vs the applied
|
|
//! repo, plus approve/deny buttons), and the manager.
|
|
|
|
use std::convert::Infallible;
|
|
use std::net::SocketAddr;
|
|
use std::path::{Path, PathBuf};
|
|
use std::sync::Arc;
|
|
|
|
use anyhow::{Context, Result};
|
|
use axum::extract::Form;
|
|
use axum::{
|
|
Router,
|
|
extract::{Path as AxumPath, State},
|
|
http::{HeaderMap, StatusCode},
|
|
response::{
|
|
IntoResponse, Response,
|
|
sse::{Event, KeepAlive, Sse},
|
|
},
|
|
routing::{get, post},
|
|
};
|
|
use hive_sh4re::Approval;
|
|
use serde::{Deserialize, Serialize};
|
|
use tokio_stream::wrappers::{BroadcastStream, ReceiverStream};
|
|
use tokio_stream::{Stream, StreamExt};
|
|
use tower_http::services::ServeDir;
|
|
|
|
use crate::actions;
|
|
use crate::container_view::{ContainerView, claude_has_session};
|
|
use crate::coordinator::Coordinator;
|
|
use crate::lifecycle::{self, MANAGER_NAME};
|
|
|
|
#[derive(Clone)]
|
|
struct AppState {
|
|
coord: Arc<Coordinator>,
|
|
}
|
|
|
|
pub async fn serve(port: u16, coord: Arc<Coordinator>) -> Result<()> {
|
|
let static_dir: PathBuf = std::env::var_os("HIVE_STATIC_DIR")
|
|
.map(PathBuf::from)
|
|
.context(
|
|
"HIVE_STATIC_DIR env var not set — point it at the bundled \
|
|
dashboard dist (see services.hive-c0re.frontend in nix)",
|
|
)?;
|
|
if !static_dir.is_dir() {
|
|
anyhow::bail!(
|
|
"HIVE_STATIC_DIR ({}) is not a directory",
|
|
static_dir.display()
|
|
);
|
|
}
|
|
tracing::info!(static_dir = %static_dir.display(), "dashboard static dir resolved");
|
|
let app = Router::new()
|
|
.route("/api/state", get(api_state))
|
|
.route("/approve/{id}", post(post_approve))
|
|
.route("/deny/{id}", post(post_deny))
|
|
.route("/destroy/{name}", post(post_destroy))
|
|
.route("/kill/{name}", post(post_kill))
|
|
.route("/restart/{name}", post(post_restart))
|
|
.route("/start/{name}", post(post_start))
|
|
.route("/rebuild/{name}", post(post_rebuild))
|
|
.route("/update-all", post(post_update_all))
|
|
.route("/answer-question/{id}", post(post_answer_question))
|
|
.route("/cancel-question/{id}", post(post_cancel_question))
|
|
.route("/purge-tombstone/{name}", post(post_purge_tombstone))
|
|
.route("/api/journal/{name}", get(get_journal))
|
|
.route("/api/journal-host", get(get_journal_host))
|
|
.route("/api/approval-diff/{id}", get(get_approval_diff))
|
|
.route("/api/state-file", get(get_state_file))
|
|
.route("/api/reminders", get(api_reminders))
|
|
.route("/api/operator-inbox", get(api_operator_inbox))
|
|
.route("/api/stats-hive", get(api_stats_hive))
|
|
.route("/api/container-resources", get(api_container_resources))
|
|
.route("/api/build-logs", get(get_build_logs_all))
|
|
.route("/api/build-logs/{agent}", get(get_build_logs_agent))
|
|
.route("/api/build-logs/id/{id}", get(get_build_log_full))
|
|
.route("/api/build-logs/id/{id}/stream", get(get_build_log_stream))
|
|
.route("/api/build-logs/id/{id}/raw", get(get_build_log_raw))
|
|
.route("/api/agent/{name}/mark-all-read", post(post_mark_all_read))
|
|
.route("/cancel-reminder/{id}", post(post_cancel_reminder))
|
|
.route("/retry-reminder/{id}", post(post_retry_reminder))
|
|
.route("/request-spawn", post(post_request_spawn))
|
|
.route("/api/topology/set-parent", post(post_set_parent))
|
|
.route("/api/topology/set-parent-bulk", post(post_set_parent_bulk))
|
|
.route("/api/tool-groups", get(get_tool_groups))
|
|
.route("/api/tool-groups/{agent}", post(post_tool_groups))
|
|
.route("/api/capabilities", get(get_capabilities))
|
|
.route("/api/capabilities/{agent}", post(post_capabilities))
|
|
.route("/op-send", post(post_op_send))
|
|
.route("/meta-update", post(post_meta_update))
|
|
.route("/api/schedules", get(api_schedules).post(post_schedule_new))
|
|
.route("/api/schedules/{id}", axum::routing::patch(patch_schedule))
|
|
.route("/api/schedules/{id}/cancel", post(post_schedule_cancel))
|
|
.route("/api/schedules/{id}/fire-now", post(post_schedule_fire_now))
|
|
.route(
|
|
"/api/rebuild-queue/{id}/cancel",
|
|
post(post_rebuild_queue_cancel),
|
|
)
|
|
.route("/dashboard/stream", get(dashboard_stream))
|
|
.route("/dashboard/history", get(dashboard_history))
|
|
.route("/webhook/knowledge", post(post_webhook_knowledge))
|
|
// Anything not matched by the dynamic routes above falls
|
|
// through to the bundled dashboard dist (GET / →
|
|
// dist/index.html, /favicon.svg → dist/favicon.svg,
|
|
// /static/dashboard.css → dist/static/dashboard.css, etc.).
|
|
.fallback_service(ServeDir::new(&static_dir))
|
|
.with_state(AppState { coord });
|
|
// Binds loopback-only; external access via gateway.
|
|
// Rationale: docs/gateway.md::Firewall posture.
|
|
let addr = SocketAddr::from(([127, 0, 0, 1], port));
|
|
let listener = bind_with_retry(addr).await?;
|
|
tracing::info!(%addr, "dashboard listening");
|
|
axum::serve(listener, app).await?;
|
|
Ok(())
|
|
}
|
|
|
|
// SPA shape + SSE channels: docs/web-ui/shape.md.
|
|
|
|
/// `SO_REUSEADDR` bind with retry. Retry mechanics, attempt-cap
|
|
/// rationale, and log-level cadence: `docs/web-ui/shape.md::Listener bind`.
|
|
async fn bind_with_retry(addr: SocketAddr) -> Result<tokio::net::TcpListener> {
|
|
let mut delay_ms = 250u64;
|
|
let mut attempts = 0u32;
|
|
loop {
|
|
match try_bind(addr) {
|
|
Ok(l) => {
|
|
if attempts > 0 {
|
|
tracing::info!(
|
|
%addr, attempts,
|
|
"dashboard: bind succeeded after retry"
|
|
);
|
|
}
|
|
return Ok(l);
|
|
}
|
|
Err(e) if e.kind() == std::io::ErrorKind::AddrInUse => {
|
|
let attempt = attempts + 1;
|
|
if attempt <= 12 {
|
|
tracing::warn!(
|
|
%addr, attempt,
|
|
"dashboard: AddrInUse, retrying in {delay_ms}ms"
|
|
);
|
|
} else {
|
|
tracing::info!(
|
|
%addr, attempt,
|
|
"dashboard: AddrInUse still holding, retrying in {delay_ms}ms"
|
|
);
|
|
}
|
|
tokio::time::sleep(std::time::Duration::from_millis(delay_ms)).await;
|
|
attempts += 1;
|
|
delay_ms = (delay_ms * 2).min(2000);
|
|
}
|
|
Err(e) => {
|
|
return Err(e).with_context(|| format!("bind dashboard on {addr}"));
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
fn try_bind(addr: SocketAddr) -> std::io::Result<tokio::net::TcpListener> {
|
|
let sock = match addr {
|
|
SocketAddr::V4(_) => tokio::net::TcpSocket::new_v4()?,
|
|
SocketAddr::V6(_) => tokio::net::TcpSocket::new_v6()?,
|
|
};
|
|
sock.set_reuseaddr(true)?;
|
|
sock.bind(addr)?;
|
|
sock.listen(1024)
|
|
}
|
|
|
|
#[allow(clippy::struct_excessive_bools)]
|
|
#[derive(Serialize)]
|
|
struct StateSnapshot {
|
|
/// Broker seq at the moment this snapshot was assembled. Clients
|
|
/// dedupe their buffered SSE traffic against this value: any
|
|
/// `MessageEvent` with `seq <= snapshot.seq` is already reflected in
|
|
/// the snapshot (or pre-dates it); anything with `seq > snapshot.seq`
|
|
/// is post-snapshot and should be applied. Set to 0 in the
|
|
/// pre-emit case (no events ever fired) — clients treat that as
|
|
/// "apply everything you've buffered".
|
|
seq: u64,
|
|
hostname: String,
|
|
manager_port: u16,
|
|
any_stale: bool,
|
|
containers: Vec<ContainerView>,
|
|
transients: Vec<TransientView>,
|
|
approvals: Vec<ApprovalView>,
|
|
/// Last 30 resolved approvals (approved / denied / failed), newest-
|
|
/// first. Drives the "history" tab on the approvals section.
|
|
approval_history: Vec<ApprovalHistoryView>,
|
|
/// Pending operator-targeted questions (`target IS NULL`). Any
|
|
/// agent can `ask` the operator and `ask` returns immediately with
|
|
/// the id; on `/answer-question` we mark the row answered and
|
|
/// fire `HelperEvent::QuestionAnswered` back into the asker's
|
|
/// inbox. Peer-to-peer questions live in the same table but never
|
|
/// surface here (see `OperatorQuestions::pending`).
|
|
questions: Vec<QuestionView>,
|
|
/// Last 20 answered questions, newest-first.
|
|
question_history: Vec<QuestionView>,
|
|
/// State dirs (config history + claude creds + /state/ notes) that
|
|
/// survive after a destroy-without-purge. The operator can re-spawn
|
|
/// with the same name to resume, or PURG3 to wipe them.
|
|
tombstones: Vec<TombstoneView>,
|
|
/// Sub-agents whose FNV-1a hashed web UI port collides with at
|
|
/// least one other agent. Operator resolves by renaming. The
|
|
/// dashboard renders a banner at the top listing each cluster.
|
|
port_conflicts: Vec<PortConflict>,
|
|
/// Inputs in `meta/flake.lock` the operator can selectively
|
|
/// `nix flake update`. Hyperhive first, then `agent-<n>` rows.
|
|
meta_inputs: Vec<MetaInputView>,
|
|
/// True while a dashboard-triggered `meta-update` (flake lock bump +
|
|
/// agent rebuild ripple) is running in the background. Lets a
|
|
/// client that cold-loads mid-update render the META INPUTS panel's
|
|
/// disabled "updating…" state; live transitions arrive via the
|
|
/// `MetaUpdateRunning` event.
|
|
meta_update_running: bool,
|
|
/// Current state of the global rebuild queue — pending + running
|
|
/// long-lived ops (rebuild / meta-update / spawn) plus the most
|
|
/// recent few terminal entries the queue retains for history.
|
|
/// Live transitions arrive via the `RebuildQueueChanged` event.
|
|
/// See `rebuild_queue.rs`.
|
|
rebuild_queue: Vec<crate::rebuild_queue::QueueEntry>,
|
|
/// Whether the hive-forge container is up. When true the dashboard
|
|
/// links each container's config + each approval's commit into the
|
|
/// forge's `agent-configs` repos.
|
|
forge_present: bool,
|
|
/// Whether the matrix GUI is reachable at `/matrix/`. Sourced from
|
|
/// `HIVE_MATRIX_GUI_ENABLED` env var (set by the c0re NixOS module
|
|
/// when `services.hyperhive.matrix.gui.enable` is on). The gateway
|
|
/// (hive-gateway.nix) does the actual `/matrix/` static serving;
|
|
/// this flag is just an availability signal for iris's dashboard
|
|
/// chrome so the `M4TR1X →` tab doesn't flash when the GUI is off.
|
|
matrix_gui_enabled: bool,
|
|
/// Whether `hive-gateway` is in front of this dashboard. Sourced
|
|
/// from `HIVE_GATEWAY_ENABLED` env var (set by the c0re NixOS
|
|
/// module when `services.hyperhive.gateway.enable` is on). When
|
|
/// true the dashboard frontend builds same-origin
|
|
/// `/agent/<name>/` links to the per-agent web UI (the gateway
|
|
/// routes them via the runtime-generated `agents.conf` include
|
|
/// file — see `gateway_nginx.rs`); when false it falls back to
|
|
/// direct `http://<hostname>:<port>/` TCP links so gateway-off /
|
|
/// local-dev deploys keep working. See `docs/gateway.md::Vhost
|
|
/// map`.
|
|
gateway_enabled: bool,
|
|
/// Public URL of the forge vhost served by hive-gateway (e.g.
|
|
/// `"https://forge.pr1ma.darkest.space"`). Sourced from the
|
|
/// `HIVE_FORGE_PUBLIC_URL` env var, which the c0re NixOS module
|
|
/// sets when `forge.behindGateway = true`. `None` when absent —
|
|
/// the frontend falls back to `http://<hostname>:3000`.
|
|
forge_public_url: Option<String>,
|
|
/// Human name of this single-host hive instance (e.g. `"pr1ma"`).
|
|
/// Sourced from `HYPERHIVE_HIVE_NAME` env var, set by the c0re
|
|
/// NixOS module from `services.hyperhive.hiveName`. `None` when
|
|
/// the option is unset — chrome falls back to `hostname`.
|
|
hive_name: Option<String>,
|
|
/// Human name of the wider swarm this hive belongs to (e.g.
|
|
/// `"constellat1on"`). Sourced from `HYPERHIVE_SWARM_NAME` env
|
|
/// var, set from `services.hyperhive.swarmName`. `None` when
|
|
/// unset — chrome omits the swarm segment of the breadcrumb.
|
|
swarm_name: Option<String>,
|
|
/// Peer hives in the same swarm. Parsed from `HYPERHIVE_PEERS`
|
|
/// (JSON array of `{domain,cert_fingerprint}` objects, emitted by
|
|
/// the c0re NixOS module from `services.hyperhive.swarm.peers`).
|
|
/// Empty on single-hive deploys. Feeds the P33RS dashboard tab.
|
|
peer_hives: Vec<PeerHiveView>,
|
|
}
|
|
|
|
/// One peer hive for the P33RS dashboard tab. Derived from
|
|
/// `HYPERHIVE_PEERS` env; `url` is the peer's HTTPS dashboard root.
|
|
/// `cert_fingerprint` is `Some("sha256:<hex64>")` when the peer uses a
|
|
/// self-signed cert and the operator pinned its fingerprint in
|
|
/// `services.hyperhive.swarm.peers`.
|
|
#[derive(Serialize)]
|
|
struct PeerHiveView {
|
|
name: String,
|
|
url: String,
|
|
cert_fingerprint: Option<String>,
|
|
}
|
|
|
|
/// `OpQuestion` + computed `question_refs` / `answer_refs`. Built
|
|
/// from the snapshot read; the live channel attaches the same
|
|
/// fields directly on `QuestionAdded` / `QuestionResolved`.
|
|
#[derive(Serialize)]
|
|
struct QuestionView {
|
|
#[serde(flatten)]
|
|
inner: crate::operator_questions::OpQuestion,
|
|
#[serde(skip_serializing_if = "Vec::is_empty")]
|
|
question_refs: Vec<String>,
|
|
#[serde(skip_serializing_if = "Vec::is_empty")]
|
|
answer_refs: Vec<String>,
|
|
}
|
|
|
|
impl QuestionView {
|
|
fn from_question(q: crate::operator_questions::OpQuestion) -> Self {
|
|
let question_refs = scan_validated_paths(&q.question);
|
|
let answer_refs = q
|
|
.answer
|
|
.as_deref()
|
|
.map(scan_validated_paths)
|
|
.unwrap_or_default();
|
|
Self {
|
|
inner: q,
|
|
question_refs,
|
|
answer_refs,
|
|
}
|
|
}
|
|
}
|
|
|
|
#[derive(Serialize)]
|
|
struct PortConflict {
|
|
port: u16,
|
|
/// All agent names sharing this port (sorted, ≥2 entries).
|
|
agents: Vec<String>,
|
|
}
|
|
|
|
#[derive(Serialize, Clone, Debug)]
|
|
pub struct TombstoneView {
|
|
pub name: String,
|
|
/// Bytes used by the state dir tree. Cheap-ish to compute; let the
|
|
/// operator know how much they're holding onto.
|
|
pub state_bytes: u64,
|
|
/// Mtime (unix seconds) of the state dir; rough "last seen".
|
|
pub last_seen: i64,
|
|
pub has_creds: bool,
|
|
}
|
|
|
|
#[derive(Serialize)]
|
|
struct TransientView {
|
|
name: String,
|
|
kind: &'static str,
|
|
secs: u64,
|
|
}
|
|
|
|
#[derive(Serialize)]
|
|
struct ApprovalHistoryView {
|
|
id: i64,
|
|
agent: String,
|
|
kind: &'static str,
|
|
/// First 12 chars of the canonical sha (preferred) or
|
|
/// manager-supplied ref. None for resolved spawn approvals.
|
|
sha_short: Option<String>,
|
|
/// `approved` / `denied` / `failed`.
|
|
status: &'static str,
|
|
/// Unix seconds. Renders as a relative time on the dashboard.
|
|
resolved_at: i64,
|
|
/// Operator-supplied deny reason (for `denied`) or build error
|
|
/// (for `failed`). None on `approved`.
|
|
#[serde(skip_serializing_if = "Option::is_none")]
|
|
note: Option<String>,
|
|
}
|
|
|
|
#[derive(Serialize)]
|
|
struct ApprovalView {
|
|
id: i64,
|
|
agent: String,
|
|
kind: &'static str,
|
|
/// First 12 chars of the `commit_ref`, for `ApplyCommit` only.
|
|
sha_short: Option<String>,
|
|
/// Raw unified diff text, for `ApplyCommit` only. The client splits
|
|
/// on `\n` and per-line classifies (`+` / `-` / `@@` / `--- ` / `+++ `
|
|
/// → diff-add / diff-del / diff-hunk / diff-file). Shipping raw
|
|
/// instead of pre-rendered HTML saves bytes on the wire (no
|
|
/// per-line `<span>` markup) and removes the only HTML-escape
|
|
/// surface from the snapshot.
|
|
diff: Option<String>,
|
|
/// Manager-supplied description shown on the approval card.
|
|
#[serde(skip_serializing_if = "Option::is_none")]
|
|
description: Option<String>,
|
|
/// Unix seconds the approval was queued. Rendered as a relative
|
|
/// time on the card so the operator can spot a stale request.
|
|
requested_at: i64,
|
|
}
|
|
|
|
/// Replace silent `.unwrap_or_default()` on the data sources behind
|
|
/// `/api/state` so that whichever query degrades surfaces in journald
|
|
/// instead of leaving the operator staring at an empty list. The
|
|
/// dashboard still degrades to a sensible default value; the warn
|
|
/// is just the diagnostic breadcrumb the old code swallowed.
|
|
fn log_default<T, E>(what: &str, result: std::result::Result<T, E>) -> T
|
|
where
|
|
T: Default,
|
|
E: std::fmt::Debug,
|
|
{
|
|
match result {
|
|
Ok(v) => v,
|
|
Err(e) => {
|
|
tracing::warn!(target: "api_state", source = %what, error = ?e, "snapshot source failed; using default");
|
|
T::default()
|
|
}
|
|
}
|
|
}
|
|
|
|
async fn api_state(headers: HeaderMap, State(state): State<AppState>) -> axum::Json<StateSnapshot> {
|
|
let host = headers
|
|
.get("host")
|
|
.and_then(|h| h.to_str().ok())
|
|
.unwrap_or("localhost");
|
|
let hostname = host.split(':').next().unwrap_or(host).to_owned();
|
|
|
|
// Capture the unified dashboard-channel seq *before* any read so the
|
|
// dedupe contract is "events with seq > snapshot.seq are
|
|
// post-snapshot, never missed." An event landing during snapshot
|
|
// construction may be doubly applied (snapshot caught the write +
|
|
// client also applies the SSE frame) — that's a renderer's problem
|
|
// to make idempotent, not ours to avoid here.
|
|
let seq = state.coord.current_seq();
|
|
|
|
// Refresh the coordinator's cached container snapshot before
|
|
// reading. Cold-load clients then see whatever the latest rescan
|
|
// produced; live clients converge via the matching
|
|
// `ContainerStateChanged` / `ContainerRemoved` events the rescan
|
|
// emits.
|
|
state.coord.rescan_containers_and_emit().await;
|
|
let containers = state.coord.containers_snapshot().await;
|
|
let any_stale = containers.iter().any(|c| c.needs_update);
|
|
let transient_snapshot = state.coord.transient_snapshot();
|
|
let pending_approvals = gc_orphans(
|
|
&state.coord,
|
|
log_default("approvals.pending", state.coord.approvals.pending()),
|
|
);
|
|
let transients = build_transient_views(&containers, &transient_snapshot);
|
|
let approvals = build_approval_views(pending_approvals).await;
|
|
let approval_history = log_default(
|
|
"approvals.recent_resolved",
|
|
state.coord.approvals.recent_resolved(30),
|
|
)
|
|
.into_iter()
|
|
.map(history_view)
|
|
.collect();
|
|
let tombstones = build_tombstone_views(&state.coord, &containers, &transient_snapshot);
|
|
let port_conflicts = build_port_conflicts(&containers);
|
|
|
|
// operator_inbox used to be served here as a 50-row array; the
|
|
// dashboard now derives it client-side from the message stream
|
|
// (terminal backfill + live SSE), so the snapshot stops shipping it.
|
|
// Both operator-targeted and peer threads now surface on the
|
|
// dashboard. Client filters by target client-side. Each row is
|
|
// wrapped in QuestionView so the snapshot carries the same
|
|
// file_refs the live event variants attach.
|
|
let questions: Vec<QuestionView> =
|
|
log_default("questions.pending_all", state.coord.questions.pending_all())
|
|
.into_iter()
|
|
.map(QuestionView::from_question)
|
|
.collect();
|
|
let question_history: Vec<QuestionView> = log_default(
|
|
"questions.recent_answered_all",
|
|
state.coord.questions.recent_answered_all(20),
|
|
)
|
|
.into_iter()
|
|
.map(QuestionView::from_question)
|
|
.collect();
|
|
|
|
axum::Json(StateSnapshot {
|
|
seq,
|
|
hostname,
|
|
manager_port: lifecycle::agent_web_port(MANAGER_NAME),
|
|
any_stale,
|
|
containers,
|
|
transients,
|
|
approvals,
|
|
approval_history,
|
|
meta_inputs: read_meta_inputs(),
|
|
meta_update_running: state.coord.meta_update_in_progress(),
|
|
questions,
|
|
question_history,
|
|
tombstones,
|
|
port_conflicts,
|
|
rebuild_queue: state.coord.rebuild_queue.snapshot(),
|
|
forge_present: crate::forge::is_present().await,
|
|
matrix_gui_enabled: std::env::var_os("HIVE_MATRIX_GUI_ENABLED").is_some_and(|v| {
|
|
// Accept any truthy string ("1", "true", "yes") since the
|
|
// env var is set by NixOS module wiring with the literal
|
|
// "1"; defensive parse so manual overrides also work.
|
|
let s = v.to_string_lossy().to_ascii_lowercase();
|
|
matches!(s.as_str(), "1" | "true" | "yes")
|
|
}),
|
|
gateway_enabled: std::env::var_os("HIVE_GATEWAY_ENABLED").is_some_and(|v| {
|
|
// Same truthy-string parse as `matrix_gui_enabled`; the
|
|
// env var is set by the c0re NixOS module to the literal
|
|
// "1" when `services.hyperhive.gateway.enable` is on.
|
|
let s = v.to_string_lossy().to_ascii_lowercase();
|
|
matches!(s.as_str(), "1" | "true" | "yes")
|
|
}),
|
|
forge_public_url: std::env::var("HIVE_FORGE_PUBLIC_URL")
|
|
.ok()
|
|
.filter(|s| !s.is_empty()),
|
|
hive_name: std::env::var("HYPERHIVE_HIVE_NAME")
|
|
.ok()
|
|
.filter(|s| !s.is_empty()),
|
|
swarm_name: std::env::var("HYPERHIVE_SWARM_NAME")
|
|
.ok()
|
|
.filter(|s| !s.is_empty()),
|
|
peer_hives: parse_peer_hives(),
|
|
})
|
|
}
|
|
|
|
/// Parse `HYPERHIVE_PEERS` env var into dashboard-ready `PeerHiveView`
|
|
/// entries. The env var is a JSON array of `{domain, cert_fingerprint}`
|
|
/// objects emitted by the c0re NixOS module from
|
|
/// `services.hyperhive.swarm.peers`. Each entry becomes
|
|
/// `{ name: domain, url: "https://domain/" }` for the P33RS tab.
|
|
/// Returns empty vec when unset (single-hive deploy).
|
|
fn parse_peer_hives() -> Vec<PeerHiveView> {
|
|
#[derive(serde::Deserialize)]
|
|
struct Raw {
|
|
domain: String,
|
|
cert_fingerprint: Option<String>,
|
|
}
|
|
let Ok(json) = std::env::var("HYPERHIVE_PEERS") else {
|
|
return Vec::new();
|
|
};
|
|
let Ok(raw): Result<Vec<Raw>, _> = serde_json::from_str(&json) else {
|
|
tracing::warn!("HYPERHIVE_PEERS is not valid JSON; ignoring");
|
|
return Vec::new();
|
|
};
|
|
raw.into_iter()
|
|
.map(|r| {
|
|
let cert_fingerprint = r.cert_fingerprint.and_then(|fp| {
|
|
if validate_cert_fingerprint(&fp) {
|
|
Some(fp)
|
|
} else {
|
|
tracing::warn!(
|
|
domain = %r.domain,
|
|
fingerprint = %fp,
|
|
"HYPERHIVE_PEERS: invalid cert_fingerprint format \
|
|
(expected `sha256:<64 hex chars>`); ignoring fingerprint"
|
|
);
|
|
None
|
|
}
|
|
});
|
|
PeerHiveView {
|
|
name: r.domain.clone(),
|
|
url: format!("https://{}/", r.domain),
|
|
cert_fingerprint,
|
|
}
|
|
})
|
|
.collect()
|
|
}
|
|
|
|
/// Validate a TLS certificate fingerprint string from `HYPERHIVE_PEERS`.
|
|
/// Accepts `sha256:<64 hex chars>` (upper or lower case).
|
|
fn validate_cert_fingerprint(fp: &str) -> bool {
|
|
let Some(hex) = fp.strip_prefix("sha256:") else {
|
|
return false;
|
|
};
|
|
hex.len() == 64 && hex.chars().all(|c| c.is_ascii_hexdigit())
|
|
}
|
|
|
|
/// Group live containers by their assigned web UI port; clusters with
|
|
/// more than one member are port-hash collisions the operator needs
|
|
/// to resolve by renaming. Manager (fixed at 8000) and sub-agents
|
|
/// (8100..8999) can't collide with each other — collisions are
|
|
/// strictly between sub-agents.
|
|
fn build_port_conflicts(containers: &[ContainerView]) -> Vec<PortConflict> {
|
|
let mut by_port: std::collections::BTreeMap<u16, Vec<String>> =
|
|
std::collections::BTreeMap::new();
|
|
for c in containers {
|
|
by_port.entry(c.port).or_default().push(c.name.clone());
|
|
}
|
|
by_port
|
|
.into_iter()
|
|
.filter(|(_, agents)| agents.len() > 1)
|
|
.map(|(port, mut agents)| {
|
|
agents.sort();
|
|
PortConflict { port, agents }
|
|
})
|
|
.collect()
|
|
}
|
|
|
|
#[derive(Serialize, Clone, Debug)]
|
|
pub struct MetaInputView {
|
|
/// Input key in meta's `flake.nix` — `hyperhive`, `agent-<n>`, etc.
|
|
pub name: String,
|
|
/// Full locked sha. Not displayed verbatim; the dashboard
|
|
/// truncates to the first 12 chars for the chip.
|
|
pub rev: String,
|
|
/// Unix seconds — `locked.lastModified`. Drives the relative
|
|
/// "2h ago" timestamp on each input row.
|
|
pub last_modified: i64,
|
|
/// `original.url` if available, for the tooltip / row meta text.
|
|
#[serde(skip_serializing_if = "Option::is_none")]
|
|
pub url: Option<String>,
|
|
}
|
|
|
|
/// Walk `flake.lock`'s `nodes` graph from `root` and emit one
|
|
/// `MetaInputView` per fetched input, at **every** depth. That
|
|
/// surfaces the direct meta inputs (`hyperhive`, `agent-<n>`), the
|
|
/// agent flakes' own inputs (`agent-dmatrix/mcp-matrix`,
|
|
/// `hyperhive/nixpkgs`), and any deeper transitive inputs — so the
|
|
/// operator can bump any of them individually. Names are
|
|
/// slash-separated paths from root, the syntax `nix flake update`
|
|
/// accepts for transitive inputs.
|
|
///
|
|
/// Filtering:
|
|
/// - Inputs that resolve via a `follows` chain (lock value is an
|
|
/// array) are skipped — they alias another node, not their own
|
|
/// fetched derivation, so updating them does nothing.
|
|
/// - A node is emitted only when it carries a `locked.rev`.
|
|
/// - Each fetched node is walked exactly once (a `visited` set):
|
|
/// the lock graph shares nodes (many flakes reference one
|
|
/// nixpkgs), so without this a shared subtree re-walks per parent
|
|
/// and a cycle would recurse forever. The result is a spanning
|
|
/// tree — every input shown once, at its shallowest path.
|
|
fn read_meta_inputs() -> Vec<MetaInputView> {
|
|
let mut out = Vec::new();
|
|
let Ok(raw) = std::fs::read_to_string("/var/lib/hyperhive/meta/flake.lock") else {
|
|
return out;
|
|
};
|
|
let Ok(json) = serde_json::from_str::<serde_json::Value>(&raw) else {
|
|
return out;
|
|
};
|
|
let Some(nodes) = json.get("nodes").and_then(|v| v.as_object()) else {
|
|
return out;
|
|
};
|
|
let Some(root_name) = json.get("root").and_then(|v| v.as_str()) else {
|
|
return out;
|
|
};
|
|
let mut visited = std::collections::HashSet::new();
|
|
visited.insert(root_name.to_owned());
|
|
walk_meta_inputs(nodes, root_name, "", &mut visited, &mut out);
|
|
// hyperhive first, then alphabetical. String-sorting the
|
|
// slash-paths puts every node directly above its own children
|
|
// (`agent-foo`, `agent-foo/bar`, `agent-foo/bar/baz`), so the
|
|
// result is a pre-order traversal the tree renderer can consume.
|
|
out.sort_by(|a, b| match (a.name.as_str(), b.name.as_str()) {
|
|
("hyperhive", _) => std::cmp::Ordering::Less,
|
|
(_, "hyperhive") => std::cmp::Ordering::Greater,
|
|
_ => a.name.cmp(&b.name),
|
|
});
|
|
out
|
|
}
|
|
|
|
fn walk_meta_inputs(
|
|
nodes: &serde_json::Map<String, serde_json::Value>,
|
|
node_name: &str,
|
|
prefix: &str,
|
|
visited: &mut std::collections::HashSet<String>,
|
|
out: &mut Vec<MetaInputView>,
|
|
) {
|
|
let Some(node) = nodes.get(node_name) else {
|
|
return;
|
|
};
|
|
let Some(inputs_map) = node.get("inputs").and_then(|v| v.as_object()) else {
|
|
return;
|
|
};
|
|
// Two passes: claim (and emit) every direct input of this node
|
|
// before descending into any of them. A shallow input that a
|
|
// deeper flake also references then keeps its shallow path
|
|
// rather than being captured first by the deep walk.
|
|
let mut to_recurse: Vec<(String, String)> = Vec::new();
|
|
for (alias, target) in inputs_map {
|
|
// Inputs map value is either a string (node name) or an
|
|
// array (a `follows` chain). The latter just aliases another
|
|
// node — we can't `nix flake update` it directly, so skip.
|
|
let serde_json::Value::String(target_name) = target else {
|
|
continue;
|
|
};
|
|
// Walk each fetched node once — guards shared subtrees and
|
|
// cycles, and keeps the panel free of duplicate rows.
|
|
if !visited.insert(target_name.clone()) {
|
|
continue;
|
|
}
|
|
let Some(target_node) = nodes.get(target_name) else {
|
|
continue;
|
|
};
|
|
let path = if prefix.is_empty() {
|
|
alias.clone()
|
|
} else {
|
|
format!("{prefix}/{alias}")
|
|
};
|
|
if let Some(rev) = target_node
|
|
.get("locked")
|
|
.and_then(|v| v.get("rev"))
|
|
.and_then(|v| v.as_str())
|
|
{
|
|
let last_modified = target_node
|
|
.get("locked")
|
|
.and_then(|v| v.get("lastModified"))
|
|
.and_then(serde_json::Value::as_i64)
|
|
.unwrap_or(0);
|
|
let url = target_node
|
|
.get("original")
|
|
.and_then(|v| v.get("url"))
|
|
.and_then(|v| v.as_str())
|
|
.map(str::to_owned);
|
|
out.push(MetaInputView {
|
|
name: path.clone(),
|
|
rev: rev.to_owned(),
|
|
last_modified,
|
|
url,
|
|
});
|
|
}
|
|
to_recurse.push((target_name.clone(), path));
|
|
}
|
|
// Recurse hyperhive's subtree before any agent's — without this,
|
|
// when meta's top-level `nixpkgs` is a `follows` alias the
|
|
// `String` check above skips it, and the alphabetical BTreeMap
|
|
// iteration descends into `agent-*` first. The agent walk then
|
|
// claims `nixpkgs` at `agent-X/nixpkgs` instead of
|
|
// `hyperhive/nixpkgs`, which is where the operator expects it.
|
|
// Sort by the same "hyperhive first, then alpha"
|
|
// priority `read_meta_inputs` uses for the final output.
|
|
to_recurse.sort_by(|(a, _), (b, _)| match (a.as_str(), b.as_str()) {
|
|
("hyperhive", _) => std::cmp::Ordering::Less,
|
|
(_, "hyperhive") => std::cmp::Ordering::Greater,
|
|
_ => a.cmp(b),
|
|
});
|
|
for (target_name, path) in to_recurse {
|
|
walk_meta_inputs(nodes, &target_name, &path, visited, out);
|
|
}
|
|
}
|
|
|
|
/// Transient state for agents whose container does NOT yet exist
|
|
/// (`Spawning`). Lifecycle ops on existing containers surface as
|
|
/// `ContainerView.pending` inline; this list only catches pre-creation.
|
|
fn build_transient_views(
|
|
containers: &[ContainerView],
|
|
transient_snapshot: &std::collections::HashMap<String, crate::coordinator::TransientState>,
|
|
) -> Vec<TransientView> {
|
|
transient_snapshot
|
|
.iter()
|
|
.filter(|(name, _)| !containers.iter().any(|c| &c.name == *name))
|
|
.map(|(name, st)| TransientView {
|
|
name: name.clone(),
|
|
kind: transient_label(st.kind),
|
|
secs: st.since.elapsed().as_secs(),
|
|
})
|
|
.collect()
|
|
}
|
|
|
|
/// Render each pending approval into its dashboard view (short sha +
|
|
/// unified diff for `ApplyCommit`, just the name for `Spawn`).
|
|
/// Project a resolved sqlite row into the lean shape the dashboard
|
|
/// history tab consumes — no `diff_html` (rendering 30 of them
|
|
/// per /api/state poll would mean 30 git diffs per refresh).
|
|
fn history_view(a: Approval) -> ApprovalHistoryView {
|
|
let displayed = a.fetched_sha.as_deref().unwrap_or(&a.commit_ref);
|
|
let sha_short = if displayed.is_empty() {
|
|
None
|
|
} else {
|
|
Some(displayed[..displayed.len().min(12)].to_owned())
|
|
};
|
|
let status = match a.status {
|
|
hive_sh4re::ApprovalStatus::Approved => "approved",
|
|
hive_sh4re::ApprovalStatus::Denied => "denied",
|
|
hive_sh4re::ApprovalStatus::Failed => "failed",
|
|
hive_sh4re::ApprovalStatus::Cancelled => "cancelled",
|
|
// Pending shouldn't appear in recent_resolved, but be defensive.
|
|
hive_sh4re::ApprovalStatus::Pending => "pending",
|
|
};
|
|
let kind = match a.kind {
|
|
hive_sh4re::ApprovalKind::ApplyCommit => "apply_commit",
|
|
hive_sh4re::ApprovalKind::Spawn => "spawn",
|
|
hive_sh4re::ApprovalKind::InitConfig => "init_config",
|
|
hive_sh4re::ApprovalKind::UpdateMetaInputs => "update_meta_inputs",
|
|
hive_sh4re::ApprovalKind::SchedulePrompt => "schedule_prompt",
|
|
};
|
|
ApprovalHistoryView {
|
|
id: a.id,
|
|
agent: a.agent,
|
|
kind,
|
|
sha_short,
|
|
status,
|
|
resolved_at: a.resolved_at.unwrap_or(0),
|
|
note: a.note,
|
|
}
|
|
}
|
|
|
|
async fn build_approval_views(approvals: Vec<Approval>) -> Vec<ApprovalView> {
|
|
let mut out = Vec::with_capacity(approvals.len());
|
|
for a in approvals {
|
|
out.push(match a.kind {
|
|
hive_sh4re::ApprovalKind::ApplyCommit => {
|
|
// Prefer the canonical fetched sha from applied;
|
|
// commit_ref is only the manager's claim and may be
|
|
// amended out from under us.
|
|
let displayed = a.fetched_sha.as_deref().unwrap_or(&a.commit_ref);
|
|
let sha = displayed[..displayed.len().min(12)].to_owned();
|
|
let diff = approval_diff(&a.agent, a.id).await;
|
|
ApprovalView {
|
|
id: a.id,
|
|
agent: a.agent.clone(),
|
|
kind: "apply_commit",
|
|
sha_short: Some(sha),
|
|
diff: Some(diff),
|
|
description: a.description,
|
|
requested_at: a.requested_at,
|
|
}
|
|
}
|
|
hive_sh4re::ApprovalKind::Spawn => ApprovalView {
|
|
id: a.id,
|
|
agent: a.agent,
|
|
kind: "spawn",
|
|
sha_short: None,
|
|
diff: None,
|
|
description: a.description,
|
|
requested_at: a.requested_at,
|
|
},
|
|
hive_sh4re::ApprovalKind::InitConfig => ApprovalView {
|
|
id: a.id,
|
|
agent: a.agent,
|
|
kind: "init_config",
|
|
sha_short: None,
|
|
diff: None,
|
|
description: a.description,
|
|
requested_at: a.requested_at,
|
|
},
|
|
hive_sh4re::ApprovalKind::UpdateMetaInputs => ApprovalView {
|
|
id: a.id,
|
|
agent: a.agent,
|
|
kind: "update_meta_inputs",
|
|
sha_short: None,
|
|
diff: None,
|
|
description: a.description,
|
|
requested_at: a.requested_at,
|
|
},
|
|
hive_sh4re::ApprovalKind::SchedulePrompt => ApprovalView {
|
|
id: a.id,
|
|
agent: a.agent,
|
|
kind: "schedule_prompt",
|
|
sha_short: None,
|
|
diff: None,
|
|
description: a.description,
|
|
requested_at: a.requested_at,
|
|
},
|
|
});
|
|
}
|
|
out
|
|
}
|
|
|
|
/// State-dir names that don't appear in the live container list (and
|
|
/// aren't the manager). Each one surfaces in the dashboard as a row
|
|
/// with R3V1V3 + PURG3 actions.
|
|
fn build_tombstone_views(
|
|
coord: &Coordinator,
|
|
containers: &[ContainerView],
|
|
transient_snapshot: &std::collections::HashMap<String, crate::coordinator::TransientState>,
|
|
) -> Vec<TombstoneView> {
|
|
let _ = coord; // kept_state_names is a free fn but takes &self by future plan
|
|
let live: std::collections::HashSet<&str> = containers
|
|
.iter()
|
|
.map(|c| c.name.as_str())
|
|
.chain(transient_snapshot.keys().map(String::as_str))
|
|
.collect();
|
|
Coordinator::kept_state_names()
|
|
.into_iter()
|
|
.filter(|name| name != MANAGER_NAME && !live.contains(name.as_str()))
|
|
.map(|name| {
|
|
let root = Coordinator::agent_state_root(&name);
|
|
let state_bytes = dir_size_bytes(&root);
|
|
let last_seen = std::fs::metadata(&root)
|
|
.and_then(|m| m.modified())
|
|
.ok()
|
|
.and_then(|t| t.duration_since(std::time::UNIX_EPOCH).ok())
|
|
.and_then(|d| i64::try_from(d.as_secs()).ok())
|
|
.unwrap_or(0);
|
|
let has_creds = claude_has_session(&Coordinator::agent_claude_dir(&name));
|
|
TombstoneView {
|
|
name,
|
|
state_bytes,
|
|
last_seen,
|
|
has_creds,
|
|
}
|
|
})
|
|
.collect()
|
|
}
|
|
|
|
/// Sum the byte size of every regular file under `root`. Cheap to compute
|
|
/// for typical agent state (config repo + claude creds + notes file —
|
|
/// usually a few MB); fine to do inline on each /api/state. Returns 0 on
|
|
/// any error.
|
|
fn dir_size_bytes(root: &Path) -> u64 {
|
|
fn walk(p: &Path, acc: &mut u64) {
|
|
let Ok(rd) = std::fs::read_dir(p) else { return };
|
|
for entry in rd.flatten() {
|
|
let Ok(ft) = entry.file_type() else { continue };
|
|
if ft.is_dir() {
|
|
walk(&entry.path(), acc);
|
|
} else if ft.is_file()
|
|
&& let Ok(meta) = entry.metadata()
|
|
{
|
|
*acc += meta.len();
|
|
}
|
|
}
|
|
}
|
|
let mut total = 0u64;
|
|
walk(root, &mut total);
|
|
total
|
|
}
|
|
|
|
async fn dashboard_history(State(state): State<AppState>) -> Response {
|
|
// Backfill source for the dashboard terminal. Returns up to ~200
|
|
// historical broker messages (no other event kinds are persisted)
|
|
// converted to `DashboardEvent::Sent` JSON so the client can replay
|
|
// through the same dispatch path as live frames. Wrapped in
|
|
// `{ seq, events }`: the seq is the dashboard channel's high-water
|
|
// mark at fetch time. Clients use it to dedupe their buffered live
|
|
// SSE traffic (drop anything with `seq <= history_seq`) so a frame
|
|
// that lands between SSE-subscribe and history-fetch isn't shown
|
|
// twice and isn't lost. Historical rows carry `seq = 0`; the
|
|
// boundary seq is what closes the dedupe window.
|
|
const HISTORY_LIMIT: u64 = 200;
|
|
let seq = state.coord.current_seq();
|
|
match state.coord.broker.recent_all(HISTORY_LIMIT) {
|
|
Ok(mut messages) => {
|
|
messages.reverse();
|
|
let events: Vec<crate::dashboard_events::DashboardEvent> = messages
|
|
.into_iter()
|
|
.filter_map(|m| match m {
|
|
crate::broker::MessageEvent::Sent {
|
|
id,
|
|
from,
|
|
to,
|
|
body,
|
|
at,
|
|
in_reply_to,
|
|
} => {
|
|
let file_refs = scan_validated_paths(&body);
|
|
Some(crate::dashboard_events::DashboardEvent::Sent {
|
|
seq: 0,
|
|
id,
|
|
from,
|
|
to,
|
|
body,
|
|
at,
|
|
in_reply_to,
|
|
file_refs,
|
|
})
|
|
}
|
|
crate::broker::MessageEvent::Delivered {
|
|
id,
|
|
from,
|
|
to,
|
|
body,
|
|
at,
|
|
in_reply_to,
|
|
} => {
|
|
let file_refs = scan_validated_paths(&body);
|
|
Some(crate::dashboard_events::DashboardEvent::Delivered {
|
|
seq: 0,
|
|
id,
|
|
from,
|
|
to,
|
|
body,
|
|
at,
|
|
in_reply_to,
|
|
file_refs,
|
|
})
|
|
}
|
|
// Ping events are never persisted to sqlite — this arm is
|
|
// unreachable in practice but required for exhaustiveness.
|
|
crate::broker::MessageEvent::Ping { .. } => None,
|
|
})
|
|
.collect();
|
|
axum::Json(serde_json::json!({ "seq": seq, "events": events })).into_response()
|
|
}
|
|
Err(e) => error_response(&format!("dashboard/history failed: {e:#}")),
|
|
}
|
|
}
|
|
|
|
/// `/dashboard/stream` query string. Today's only field is `kinds`:
|
|
/// a comma-separated allow-list of event-`kind` strings.
|
|
/// Empty / absent ⇒ no filter (current behaviour, all variants
|
|
/// forwarded). Set ⇒ only the named kinds reach the subscriber,
|
|
/// non-matches are skipped before the JSON serialise cost.
|
|
///
|
|
/// Useful for narrow pages (e.g. `flow.js` only cares about `sent`
|
|
/// / `delivered` / `container_state_changed` / `container_removed`)
|
|
/// that want to drop the dispatch overhead on every unrelated mutation.
|
|
#[derive(Deserialize, Default)]
|
|
struct DashboardStreamQuery {
|
|
/// Comma-separated event kinds to forward. Each token is
|
|
/// trimmed; unknown kinds are silently ignored on lookup
|
|
/// (subscriber sees nothing instead of an error).
|
|
kinds: Option<String>,
|
|
}
|
|
|
|
async fn dashboard_stream(
|
|
State(state): State<AppState>,
|
|
axum::extract::Query(q): axum::extract::Query<DashboardStreamQuery>,
|
|
) -> Sse<impl Stream<Item = Result<Event, Infallible>>> {
|
|
let rx = state.coord.dashboard_subscribe();
|
|
// Pre-parse the allow-list once at subscription time, so the
|
|
// per-event hot path is just a `HashSet::contains` on a
|
|
// `&'static str` — no string churn per frame.
|
|
let kind_filter: Option<std::collections::HashSet<String>> = q.kinds.and_then(|raw| {
|
|
let set: std::collections::HashSet<String> = raw
|
|
.split(',')
|
|
.map(str::trim)
|
|
.filter(|s| !s.is_empty())
|
|
.map(str::to_owned)
|
|
.collect();
|
|
if set.is_empty() { None } else { Some(set) }
|
|
});
|
|
let stream = BroadcastStream::new(rx).filter_map(move |res| {
|
|
// Drop lagged frames. Browsers reconnect; the seq dedupe on
|
|
// reconnect skips any frame already reflected in the snapshot.
|
|
let event = res.ok()?;
|
|
if let Some(filter) = kind_filter.as_ref()
|
|
&& !filter.contains(event.kind_tag())
|
|
{
|
|
return None;
|
|
}
|
|
let json = serde_json::to_string(&event).ok()?;
|
|
Some(Ok(Event::default().data(json)))
|
|
});
|
|
Sse::new(stream).keep_alive(KeepAlive::default())
|
|
}
|
|
|
|
async fn post_approve(State(state): State<AppState>, AxumPath(id): AxumPath<i64>) -> Response {
|
|
match actions::approve(state.coord.clone(), id).await {
|
|
// 200 instead of 303 — `actions::approve` fires
|
|
// `ApprovalResolved` (success path) or the eventual failure
|
|
// event, both of which the dashboard's derived store applies
|
|
// live. The matching form carries `data-no-refresh`.
|
|
Ok(()) => (StatusCode::OK, "ok").into_response(),
|
|
Err(e) => error_response(&format!("approve {id} failed: {e:#}")),
|
|
}
|
|
}
|
|
|
|
#[derive(Deserialize, Default)]
|
|
struct DenyForm {
|
|
#[serde(default)]
|
|
note: Option<String>,
|
|
}
|
|
|
|
async fn post_deny(
|
|
State(state): State<AppState>,
|
|
AxumPath(id): AxumPath<i64>,
|
|
Form(form): Form<DenyForm>,
|
|
) -> Response {
|
|
let note = form
|
|
.note
|
|
.as_deref()
|
|
.map(str::trim)
|
|
.filter(|s| !s.is_empty());
|
|
match actions::deny(&state.coord, id, note).await {
|
|
Ok(()) => (StatusCode::OK, "ok").into_response(),
|
|
Err(e) => error_response(&format!("deny {id} failed: {e:#}")),
|
|
}
|
|
}
|
|
|
|
#[derive(Deserialize)]
|
|
struct RequestSpawnForm {
|
|
name: String,
|
|
}
|
|
|
|
/// `POST /api/topology/set-parent` body. `child` is required.
|
|
/// `new_parent` may be:
|
|
/// - absent or empty / whitespace-only → promote to root,
|
|
/// - non-empty → new parent's logical name.
|
|
///
|
|
/// (The CLI surface gates "no parent specified" behind an explicit
|
|
/// `--root` flag for safety; the HTTP surface is permissive
|
|
/// because the dashboard form encodes "no value" as the empty
|
|
/// string for the optional radio-group input.)
|
|
#[derive(Deserialize)]
|
|
struct SetParentForm {
|
|
child: String,
|
|
new_parent: Option<String>,
|
|
}
|
|
|
|
/// One entry in a `POST /api/topology/set-parent-bulk` JSON array.
|
|
/// `new_parent`: absent/null/empty-string all mean "promote to root".
|
|
#[derive(Deserialize)]
|
|
struct SetParentBulkEntry {
|
|
child: String,
|
|
#[serde(default)]
|
|
new_parent: Option<String>,
|
|
}
|
|
|
|
#[derive(Deserialize)]
|
|
struct AnswerForm {
|
|
answer: String,
|
|
}
|
|
|
|
/// Attach a permissive CORS header so the per-agent web UI — served on
|
|
/// a different port — can POST an operator answer here and read the
|
|
/// result. The dashboard has no auth, so `*` exposes nothing a plain
|
|
/// cross-origin form-POST couldn't already reach. This shim disappears
|
|
/// once the unifying gateway makes the agent page same-origin; see
|
|
/// `docs/boundary.md`.
|
|
fn with_cors(mut resp: Response) -> Response {
|
|
resp.headers_mut().insert(
|
|
axum::http::header::ACCESS_CONTROL_ALLOW_ORIGIN,
|
|
axum::http::HeaderValue::from_static("*"),
|
|
);
|
|
resp
|
|
}
|
|
|
|
async fn post_answer_question(
|
|
State(state): State<AppState>,
|
|
AxumPath(id): AxumPath<i64>,
|
|
Form(form): Form<AnswerForm>,
|
|
) -> Response {
|
|
let answer = form.answer.trim();
|
|
if answer.is_empty() {
|
|
return with_cors(error_response("answer: required"));
|
|
}
|
|
let resp = match state
|
|
.coord
|
|
.questions
|
|
.answer(id, answer, hive_sh4re::OPERATOR_RECIPIENT)
|
|
{
|
|
Ok((question, asker, target)) => {
|
|
tracing::info!(%id, %asker, "operator answered question");
|
|
state.coord.notify_agent(
|
|
&asker,
|
|
&hive_sh4re::HelperEvent::QuestionAnswered {
|
|
id,
|
|
question,
|
|
answer: answer.to_owned(),
|
|
answerer: hive_sh4re::OPERATOR_RECIPIENT.to_owned(),
|
|
},
|
|
);
|
|
state.coord.emit_question_resolved(
|
|
id,
|
|
answer,
|
|
hive_sh4re::OPERATOR_RECIPIENT,
|
|
false,
|
|
target.as_deref(),
|
|
);
|
|
(StatusCode::OK, "ok").into_response()
|
|
}
|
|
Err(e) => error_response(&format!("answer {id} failed: {e:#}")),
|
|
};
|
|
with_cors(resp)
|
|
}
|
|
|
|
/// Resolve a pending operator question with a sentinel answer when
|
|
/// the operator decides not to / can't answer. The asker harness
|
|
/// receives a `QuestionAnswered` event with `answer = "[cancelled]"`
|
|
/// so it can fall back on whatever default it had. Same code path as
|
|
/// a real answer — just lets the operator close the loop instead of
|
|
/// letting the question dangle forever.
|
|
async fn post_cancel_question(
|
|
State(state): State<AppState>,
|
|
AxumPath(id): AxumPath<i64>,
|
|
) -> Response {
|
|
const SENTINEL: &str = "[cancelled]";
|
|
match state
|
|
.coord
|
|
.questions
|
|
.answer(id, SENTINEL, hive_sh4re::OPERATOR_RECIPIENT)
|
|
{
|
|
Ok((question, asker, target)) => {
|
|
tracing::info!(%id, %asker, "operator cancelled question");
|
|
state.coord.emit_question_resolved(
|
|
id,
|
|
SENTINEL,
|
|
hive_sh4re::OPERATOR_RECIPIENT,
|
|
true,
|
|
target.as_deref(),
|
|
);
|
|
state.coord.notify_agent_from(
|
|
hive_sh4re::OPERATOR_RECIPIENT,
|
|
&asker,
|
|
&hive_sh4re::HelperEvent::QuestionAnswered {
|
|
id,
|
|
question,
|
|
answer: SENTINEL.to_owned(),
|
|
answerer: hive_sh4re::OPERATOR_RECIPIENT.to_owned(),
|
|
},
|
|
);
|
|
(StatusCode::OK, "ok").into_response()
|
|
}
|
|
Err(e) => error_response(&format!("cancel-question {id} failed: {e:#}")),
|
|
}
|
|
}
|
|
|
|
#[derive(Deserialize)]
|
|
struct JournalQuery {
|
|
/// Optional systemd unit filter — e.g. `hive-ag3nt.service`. When
|
|
/// omitted, returns the full machine journal.
|
|
#[serde(default)]
|
|
unit: Option<String>,
|
|
/// Number of trailing lines to return. Capped at 5000.
|
|
#[serde(default)]
|
|
lines: Option<u32>,
|
|
}
|
|
|
|
/// Read `journalctl -M <container> -b` and return its text output.
|
|
/// Operator-only by virtue of the dashboard being host-bound. hive-c0re
|
|
/// runs unprivileged (privsep), so the `-M` read — which enters the
|
|
/// container namespace and needs root — is delegated to hive-priv.
|
|
async fn get_journal(
|
|
AxumPath(name): AxumPath<String>,
|
|
axum::extract::Query(q): axum::extract::Query<JournalQuery>,
|
|
) -> Response {
|
|
// Defense-in-depth format check so weird chars never reach the
|
|
// shellout below — the `lifecycle::list()` existence check would
|
|
// catch them anyway, but rejecting at the boundary keeps the
|
|
// failure mode crisp.
|
|
if let Some(reason) = validate_agent_name(&name) {
|
|
return (StatusCode::BAD_REQUEST, format!("bad agent name: {reason}")).into_response();
|
|
}
|
|
// Validate the container name against the list of managed
|
|
// containers so we don't shell out with arbitrary input.
|
|
let container = strip_container_prefix(&name);
|
|
let prefixed = format!("{}{container}", lifecycle::AGENT_PREFIX);
|
|
let live = lifecycle::list().await.unwrap_or_default();
|
|
if !live.iter().any(|c| c == &prefixed) {
|
|
return error_response(&format!("journal: no managed container {prefixed:?}"));
|
|
}
|
|
let lines = q.lines.unwrap_or(500).min(5000);
|
|
let unit = match q.unit.as_deref().filter(|s| !s.is_empty()) {
|
|
Some(u) => {
|
|
// accept hive-ag3nt[.service] — anything else refused.
|
|
let allowed = ["hive-ag3nt.service"];
|
|
let unit = if u.ends_with(".service") {
|
|
u.to_owned()
|
|
} else {
|
|
format!("{u}.service")
|
|
};
|
|
if !allowed.contains(&unit.as_str()) {
|
|
return error_response(&format!("journal: unknown unit {unit:?}"));
|
|
}
|
|
Some(unit)
|
|
}
|
|
None => None,
|
|
};
|
|
match crate::priv_client::read_container_journal(
|
|
&prefixed,
|
|
lines,
|
|
true,
|
|
hive_sh4re::priv_proto::JournalOutput::ShortIso,
|
|
unit,
|
|
None,
|
|
None,
|
|
None,
|
|
None,
|
|
)
|
|
.await
|
|
{
|
|
Ok((stdout, stderr)) => {
|
|
// Combine stdout + stderr — journalctl emits to both on errors.
|
|
let mut body = stdout;
|
|
if !stderr.is_empty() {
|
|
body.push_str("\n--- stderr ---\n");
|
|
body.push_str(&stderr);
|
|
}
|
|
([("content-type", "text/plain; charset=utf-8")], body).into_response()
|
|
}
|
|
Err(e) => error_response(&format!("journal read: {e:#}")),
|
|
}
|
|
}
|
|
|
|
#[derive(Deserialize)]
|
|
struct JournalHostQuery {
|
|
/// Service unit name to filter to. If omitted, returns all logs.
|
|
#[serde(default)]
|
|
unit: Option<String>,
|
|
/// Number of trailing lines. Capped at 5000. Default 500.
|
|
#[serde(default)]
|
|
lines: Option<u32>,
|
|
}
|
|
|
|
/// `GET /api/journal-host?unit=<unit>&lines=N` — host-side journald (no
|
|
/// `-M` container flag). Restricted to an allow-list of known host services
|
|
/// so arbitrary unit names can't be probed. Operator-only by virtue of the
|
|
/// dashboard binding to a host-only port.
|
|
async fn get_journal_host(
|
|
axum::extract::Query(q): axum::extract::Query<JournalHostQuery>,
|
|
) -> Response {
|
|
let lines = q.lines.unwrap_or(500).min(5000);
|
|
let allowed = ["hive-c0re.service"];
|
|
let mut cmd = tokio::process::Command::new("journalctl");
|
|
cmd.args(["--no-pager", "--output=short-iso", "--lines"])
|
|
.arg(lines.to_string());
|
|
if let Some(u) = q.unit.as_deref().filter(|s| !s.is_empty()) {
|
|
let unit = if u.ends_with(".service") {
|
|
u.to_owned()
|
|
} else {
|
|
format!("{u}.service")
|
|
};
|
|
if !allowed.contains(&unit.as_str()) {
|
|
return error_response(&format!("journal-host: unknown unit {unit:?}"));
|
|
}
|
|
cmd.args(["-u", &unit]);
|
|
}
|
|
match cmd.output().await {
|
|
Ok(out) => {
|
|
let mut body = String::from_utf8_lossy(&out.stdout).into_owned();
|
|
if !out.status.success() {
|
|
body.push_str("\n--- stderr ---\n");
|
|
body.push_str(&String::from_utf8_lossy(&out.stderr));
|
|
}
|
|
([("content-type", "text/plain; charset=utf-8")], body).into_response()
|
|
}
|
|
Err(e) => error_response(&format!("journalctl spawn: {e}")),
|
|
}
|
|
}
|
|
|
|
#[derive(Deserialize)]
|
|
struct BuildLogsAllQuery {
|
|
/// Max rows to return. Capped at 100. Default 30.
|
|
#[serde(default)]
|
|
limit: Option<usize>,
|
|
}
|
|
|
|
/// `GET /api/build-logs?limit=N` — most-recent build log headers across
|
|
/// all agents, newest first. Same JSON shape as the per-agent endpoint.
|
|
async fn get_build_logs_all(
|
|
State(state): State<AppState>,
|
|
axum::extract::Query(q): axum::extract::Query<BuildLogsAllQuery>,
|
|
) -> Response {
|
|
let limit = q.limit.unwrap_or(30);
|
|
match state.coord.build_logs.list_recent_all(limit) {
|
|
Ok(rows) => axum::Json(rows).into_response(),
|
|
Err(e) => error_response(&format!("build-logs all: {e:#}")),
|
|
}
|
|
}
|
|
|
|
#[derive(Deserialize)]
|
|
struct StateFileQuery {
|
|
path: String,
|
|
}
|
|
|
|
/// Resolve a caller-supplied path against the allow-listed roots
|
|
/// (`agents/<n>/state/` and `shared/`). Applies defense-in-depth
|
|
/// symlink + traversal checks before serving. Security model and
|
|
/// all five layers: `docs/security.md::State-file endpoint`.
|
|
fn resolve_state_path(
|
|
raw: &str,
|
|
) -> std::result::Result<(std::path::PathBuf, std::fs::Metadata), String> {
|
|
use std::os::unix::fs::PermissionsExt as _;
|
|
const AGENTS_ROOT: &str = "/var/lib/hyperhive/agents";
|
|
const SHARED_ROOT: &str = "/var/lib/hyperhive/shared";
|
|
let raw = raw.trim();
|
|
let (mapped, root): (std::path::PathBuf, &str) =
|
|
if let Some(rest) = raw.strip_prefix("/agents/") {
|
|
(
|
|
std::path::PathBuf::from(format!("{AGENTS_ROOT}/{rest}")),
|
|
AGENTS_ROOT,
|
|
)
|
|
} else if let Some(rest) = raw.strip_prefix("/shared/") {
|
|
(
|
|
std::path::PathBuf::from(format!("{SHARED_ROOT}/{rest}")),
|
|
SHARED_ROOT,
|
|
)
|
|
} else if let Some(rest) = raw.strip_prefix(&format!("{AGENTS_ROOT}/")) {
|
|
(
|
|
std::path::PathBuf::from(format!("{AGENTS_ROOT}/{rest}")),
|
|
AGENTS_ROOT,
|
|
)
|
|
} else if let Some(rest) = raw.strip_prefix(&format!("{SHARED_ROOT}/")) {
|
|
(
|
|
std::path::PathBuf::from(format!("{SHARED_ROOT}/{rest}")),
|
|
SHARED_ROOT,
|
|
)
|
|
} else {
|
|
return Err(format!("path not in allow-list: {raw}"));
|
|
};
|
|
reject_symlinks_below(std::path::Path::new(root), &mapped)?;
|
|
let canonical =
|
|
std::fs::canonicalize(&mapped).map_err(|e| format!("{}: {e}", mapped.display()))?;
|
|
if !(canonical.starts_with(AGENTS_ROOT) || canonical.starts_with(SHARED_ROOT)) {
|
|
return Err(format!(
|
|
"resolved path escapes allow-list: {}",
|
|
canonical.display()
|
|
));
|
|
}
|
|
if let Ok(rel) = canonical.strip_prefix(AGENTS_ROOT) {
|
|
let mut components = rel.components();
|
|
let _agent = components.next();
|
|
let dir = components.next().and_then(|c| c.as_os_str().to_str());
|
|
if dir != Some("state") {
|
|
return Err(format!(
|
|
"only per-agent state/ is readable here ({} dir not allowed)",
|
|
dir.unwrap_or("(root)")
|
|
));
|
|
}
|
|
}
|
|
let meta =
|
|
std::fs::metadata(&canonical).map_err(|e| format!("stat {}: {e}", canonical.display()))?;
|
|
if meta.is_file() {
|
|
let mode = meta.permissions().mode();
|
|
if mode & 0o004 == 0 {
|
|
return Err(format!(
|
|
"{} not world-readable (mode 0{:o}); refusing to proxy non-public file",
|
|
canonical.display(),
|
|
mode & 0o777,
|
|
));
|
|
}
|
|
}
|
|
Ok((canonical, meta))
|
|
}
|
|
|
|
/// Walk every path component under `root` and refuse if any of
|
|
/// them is a symlink. The roots themselves (`AGENTS_ROOT`,
|
|
/// `SHARED_ROOT`) are hive-c0re-owned and assumed trusted; only
|
|
/// the parts the agent / operator can plant matter. Components
|
|
/// that don't exist yet are skipped — `canonicalize` reports
|
|
/// non-existence separately, and missing-component checks would
|
|
/// just race the filesystem.
|
|
fn reject_symlinks_below(
|
|
root: &std::path::Path,
|
|
mapped: &std::path::Path,
|
|
) -> std::result::Result<(), String> {
|
|
let Ok(rel) = mapped.strip_prefix(root) else {
|
|
return Ok(());
|
|
};
|
|
let mut cumulative = root.to_path_buf();
|
|
for component in rel.components() {
|
|
match component {
|
|
std::path::Component::Normal(name) => {
|
|
cumulative.push(name);
|
|
match std::fs::symlink_metadata(&cumulative) {
|
|
Ok(m) if m.file_type().is_symlink() => {
|
|
return Err(format!(
|
|
"symlink at {} not allowed (canonicalize would resolve it past the \
|
|
allow-list check; refuse outright)",
|
|
cumulative.display()
|
|
));
|
|
}
|
|
Ok(_) | Err(_) => {}
|
|
}
|
|
}
|
|
std::path::Component::ParentDir => {
|
|
return Err(format!(
|
|
"path contains `..` traversal below {}; refuse outright",
|
|
root.display()
|
|
));
|
|
}
|
|
_ => {}
|
|
}
|
|
}
|
|
Ok(())
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
use std::os::unix::fs::symlink;
|
|
|
|
/// Make a unique tmp subdir for the calling test. Caller is responsible
|
|
/// for cleanup (we leak on panic, fine for ephemeral CI runs).
|
|
fn tmproot(tag: &str) -> std::path::PathBuf {
|
|
let ts = std::time::SystemTime::now()
|
|
.duration_since(std::time::UNIX_EPOCH)
|
|
.map_or(0, |d| d.as_nanos());
|
|
let p = std::env::temp_dir().join(format!("hyperhive-test-{tag}-{ts}"));
|
|
std::fs::create_dir_all(&p).unwrap();
|
|
p
|
|
}
|
|
|
|
#[test]
|
|
fn walk_meta_inputs_keeps_nixpkgs_under_hyperhive_post_follows_refactor() {
|
|
// Reproduce the shape where meta has
|
|
// `nixpkgs.follows = "hyperhive/nixpkgs"` at the top level
|
|
// (rendered as an array — `["hyperhive" "nixpkgs"]` — which
|
|
// walk_meta_inputs skips because we can't `nix flake update`
|
|
// a follows alias). The remaining top-level inputs are
|
|
// `hyperhive` (string) and `agent-z` (string). Without the
|
|
// hyperhive-first recursion sort, the BTreeMap alphabetical
|
|
// order descends into `agent-z` first and claims
|
|
// `nixpkgs` at `agent-z/nixpkgs`.
|
|
let raw = r#"{
|
|
"root": "root",
|
|
"version": 7,
|
|
"nodes": {
|
|
"root": {
|
|
"inputs": {
|
|
"hyperhive": "hyperhive",
|
|
"nixpkgs": ["hyperhive", "nixpkgs"],
|
|
"agent-z": "agent-z"
|
|
}
|
|
},
|
|
"hyperhive": {
|
|
"inputs": { "nixpkgs": "nixpkgs" },
|
|
"locked": {"rev": "hhrev", "lastModified": 1},
|
|
"original": {"url": "git+file:///tmp/hyperhive"}
|
|
},
|
|
"agent-z": {
|
|
"inputs": { "nixpkgs": "nixpkgs" },
|
|
"locked": {"rev": "azrev", "lastModified": 2},
|
|
"original": {"url": "git+file:///tmp/agent-z"}
|
|
},
|
|
"nixpkgs": {
|
|
"locked": {"rev": "npkrev", "lastModified": 3},
|
|
"original": {"url": "github:NixOS/nixpkgs/nixos-26.05"}
|
|
}
|
|
}
|
|
}"#;
|
|
let json: serde_json::Value = serde_json::from_str(raw).unwrap();
|
|
let nodes = json.get("nodes").unwrap().as_object().unwrap();
|
|
let root_name = json.get("root").unwrap().as_str().unwrap();
|
|
let mut visited = std::collections::HashSet::new();
|
|
visited.insert(root_name.to_owned());
|
|
let mut out = Vec::new();
|
|
walk_meta_inputs(nodes, root_name, "", &mut visited, &mut out);
|
|
|
|
let nixpkgs = out
|
|
.iter()
|
|
.find(|v| v.rev == "npkrev")
|
|
.expect("nixpkgs node should be emitted exactly once");
|
|
assert_eq!(
|
|
nixpkgs.name, "hyperhive/nixpkgs",
|
|
"nixpkgs should be claimed under hyperhive, not under agent-z. \
|
|
got: {:?}",
|
|
nixpkgs.name
|
|
);
|
|
// And the agent-z path should NOT also carry a nixpkgs entry —
|
|
// the spanning-tree visited set guarantees it's claimed once.
|
|
assert!(
|
|
!out.iter().any(|v| v.name == "agent-z/nixpkgs"),
|
|
"agent-z/nixpkgs should not be emitted (already claimed under hyperhive)"
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn validate_agent_name_accepts_canonical_shapes() {
|
|
assert!(validate_agent_name("damocles").is_none());
|
|
assert!(validate_agent_name("hm1nd").is_none());
|
|
assert!(validate_agent_name("agent-with-dashes").is_none());
|
|
assert!(validate_agent_name("snake_case").is_none());
|
|
assert!(validate_agent_name("mixed_2-3").is_none());
|
|
let max = "a".repeat(63);
|
|
assert!(
|
|
validate_agent_name(&max).is_none(),
|
|
"63-char name should pass"
|
|
);
|
|
}
|
|
|
|
// The two-axis guard (`guard_agent_name`) wires `validate_agent_name`
|
|
// + an async coordinator lookup. The lookup needs a populated
|
|
// `Coordinator`, which needs sqlite + tokio runtime; rather than
|
|
// build that scaffolding for an integration-flavoured test we cover
|
|
// the format axis here (the existence axis is enforced by the
|
|
// shared `containers_snapshot` API, tested in `coordinator.rs`'s
|
|
// own suite). 9 cases below cover the boundary-length case and
|
|
// other expected rejects to make the contract explicit.
|
|
#[test]
|
|
fn validate_agent_name_rejects_bad_input() {
|
|
assert!(validate_agent_name("").is_some());
|
|
let too_long = "a".repeat(64);
|
|
assert!(validate_agent_name(&too_long).is_some());
|
|
// Path-traversal attempts.
|
|
assert!(validate_agent_name("../etc/passwd").is_some());
|
|
assert!(validate_agent_name("alice/bob").is_some());
|
|
// Uppercase rejected — canonical lowercase convention.
|
|
assert!(validate_agent_name("Alice").is_some());
|
|
// No spaces, dots, special chars.
|
|
assert!(validate_agent_name("alice bob").is_some());
|
|
assert!(validate_agent_name("alice.bob").is_some());
|
|
assert!(validate_agent_name("alice;DROP TABLE messages").is_some());
|
|
// Non-ASCII (incl. unicode homoglyphs of ASCII dash).
|
|
assert!(validate_agent_name("damóclès").is_some());
|
|
assert!(validate_agent_name("alice\u{2013}bob").is_some()); // en-dash
|
|
}
|
|
|
|
#[test]
|
|
fn reject_symlinks_below_accepts_plain_dirs_and_files() {
|
|
let root = tmproot("symlink-ok");
|
|
std::fs::create_dir_all(root.join("alice/state")).unwrap();
|
|
std::fs::write(root.join("alice/state/notes.md"), b"hi").unwrap();
|
|
assert!(reject_symlinks_below(&root, &root.join("alice/state/notes.md")).is_ok());
|
|
}
|
|
|
|
#[test]
|
|
fn reject_symlinks_below_rejects_leaf_symlink() {
|
|
let root = tmproot("symlink-leaf");
|
|
std::fs::create_dir_all(root.join("alice/state")).unwrap();
|
|
// Plant a symlink that points anywhere; resolve_state_path's
|
|
// canonicalize would happily resolve it past the allow-list
|
|
// check, so we have to refuse at the un-canonical layer.
|
|
symlink("/etc/shadow", root.join("alice/state/peek")).unwrap();
|
|
let err = reject_symlinks_below(&root, &root.join("alice/state/peek")).unwrap_err();
|
|
assert!(err.contains("symlink at"), "msg = {err}");
|
|
assert!(err.contains("peek"), "msg = {err}");
|
|
}
|
|
|
|
#[test]
|
|
fn reject_symlinks_below_rejects_directory_symlink_in_middle() {
|
|
let root = tmproot("symlink-mid");
|
|
std::fs::create_dir_all(root.join("real/state")).unwrap();
|
|
std::fs::write(root.join("real/state/secret.md"), b"hi").unwrap();
|
|
// alice's "state" dir is actually a symlink to real/state — a
|
|
// sub-agent shouldn't be able to plant this and proxy real's
|
|
// private files via the dashboard.
|
|
std::fs::create_dir_all(root.join("alice")).unwrap();
|
|
symlink(root.join("real/state"), root.join("alice/state")).unwrap();
|
|
let err = reject_symlinks_below(&root, &root.join("alice/state/secret.md")).unwrap_err();
|
|
assert!(err.contains("symlink at"), "msg = {err}");
|
|
}
|
|
|
|
#[test]
|
|
fn reject_symlinks_below_rejects_parent_dir_traversal() {
|
|
let root = tmproot("symlink-dotdot");
|
|
// `..` doesn't survive canonicalize anyway, but we want a
|
|
// friendlier error than "path escapes allow-list" — refusing
|
|
// upfront also avoids walking ancestors with `symlink_metadata`.
|
|
let p = root.join("alice/state/../escape");
|
|
let err = reject_symlinks_below(&root, &p).unwrap_err();
|
|
assert!(err.contains("`..`"), "msg = {err}");
|
|
}
|
|
|
|
#[test]
|
|
fn reject_symlinks_below_passes_through_when_path_not_under_root() {
|
|
// resolve_state_path's earlier allow-list check would reject
|
|
// this; reject_symlinks_below stays a no-op so the caller
|
|
// surfaces the better-fit error.
|
|
let root = std::path::Path::new("/var/lib/hyperhive/agents");
|
|
assert!(reject_symlinks_below(root, std::path::Path::new("/etc/shadow")).is_ok());
|
|
}
|
|
}
|
|
|
|
/// Snapshot the current tombstone list and emit a
|
|
/// `TombstonesChanged` event. Call after any mutation that could
|
|
/// add or remove a tombstone (`actions::destroy`,
|
|
/// `post_purge_tombstone`, spawn finalisation). Cheap — the list
|
|
/// is tiny.
|
|
pub(crate) async fn emit_tombstones_snapshot(coord: &Arc<Coordinator>) {
|
|
let containers = coord.containers_snapshot().await;
|
|
let transient_snapshot = coord.transient_snapshot();
|
|
let tombstones = build_tombstone_views(coord, &containers, &transient_snapshot);
|
|
coord.emit_dashboard_event(crate::dashboard_events::DashboardEvent::TombstonesChanged {
|
|
seq: coord.next_seq(),
|
|
tombstones,
|
|
});
|
|
}
|
|
|
|
/// Snapshot meta/flake.lock's root inputs + emit
|
|
/// `MetaInputsChanged`. Call after any mutation that bumps a lock
|
|
/// (`run_meta_update`, `auto_update::rebuild_agent`).
|
|
pub(crate) fn emit_meta_inputs_snapshot(coord: &Coordinator) {
|
|
let inputs = read_meta_inputs();
|
|
coord.emit_dashboard_event(crate::dashboard_events::DashboardEvent::MetaInputsChanged {
|
|
seq: coord.next_seq(),
|
|
inputs,
|
|
});
|
|
}
|
|
|
|
/// Scan `body` for path-shaped tokens and return those that pass the
|
|
/// allow-list + `is_file` check via `resolve_state_path`. Called at
|
|
/// broker-message ingest so the dashboard event already carries the
|
|
/// verified set; security rules stay in sync with the read endpoint.
|
|
pub fn scan_validated_paths(body: &str) -> Vec<String> {
|
|
const PREFIXES: [&str; 4] = [
|
|
"/agents/",
|
|
"/shared/",
|
|
"/var/lib/hyperhive/agents/",
|
|
"/var/lib/hyperhive/shared/",
|
|
];
|
|
let mut out = Vec::<String>::new();
|
|
for raw in body.split(|c: char| c.is_whitespace()) {
|
|
// Trim trailing natural-language punctuation that wouldn't
|
|
// be part of any real path. Inline rather than via a regex
|
|
// dep — the set is small and the call is hot.
|
|
let token = raw.trim_end_matches([',', ';', ':', ')', ']', '}', '.', '\'', '"']);
|
|
if token.is_empty() {
|
|
continue;
|
|
}
|
|
if !PREFIXES.iter().any(|p| token.starts_with(p)) {
|
|
continue;
|
|
}
|
|
// Cheap dedupe — typical message has 0-3 refs.
|
|
if out.iter().any(|s| s == token) {
|
|
continue;
|
|
}
|
|
if let Ok((_canonical, meta)) = resolve_state_path(token)
|
|
&& meta.is_file()
|
|
{
|
|
out.push(token.to_owned());
|
|
}
|
|
}
|
|
out
|
|
}
|
|
|
|
async fn get_state_file(axum::extract::Query(q): axum::extract::Query<StateFileQuery>) -> Response {
|
|
const MAX_BYTES: usize = 1 << 20; // 1 MiB
|
|
let (canonical, meta) = match resolve_state_path(&q.path) {
|
|
Ok(pair) => pair,
|
|
Err(e) => return error_response(&format!("state-file: {e}")),
|
|
};
|
|
if !meta.is_file() {
|
|
return error_response(&format!(
|
|
"state-file: {} is not a regular file",
|
|
canonical.display()
|
|
));
|
|
}
|
|
let size = meta.len();
|
|
let bytes = match std::fs::read(&canonical) {
|
|
Ok(b) => b,
|
|
Err(e) => return error_response(&format!("state-file: read {}: {e}", canonical.display())),
|
|
};
|
|
// Raster images: serve the raw bytes with their real content-type
|
|
// so the dashboard can render them in an <img>. Not truncated —
|
|
// a clipped binary is corrupt, so over-cap images are rejected
|
|
// instead. (SVG stays on the text path: it's text, and the client
|
|
// renders it via a data: URI.)
|
|
if let Some(ct) = image_content_type(&canonical) {
|
|
if bytes.len() > MAX_BYTES {
|
|
return error_response(&format!(
|
|
"state-file: image {} is {size} bytes, over the {MAX_BYTES}-byte preview cap",
|
|
canonical.display()
|
|
));
|
|
}
|
|
return ([("content-type", ct)], bytes).into_response();
|
|
}
|
|
let truncated = bytes.len() > MAX_BYTES;
|
|
let body_bytes = if truncated {
|
|
&bytes[..MAX_BYTES]
|
|
} else {
|
|
&bytes[..]
|
|
};
|
|
let mut body = String::from_utf8_lossy(body_bytes).into_owned();
|
|
if truncated {
|
|
use std::fmt::Write as _;
|
|
let _ = write!(
|
|
body,
|
|
"\n\n--- truncated at {MAX_BYTES} of {size} bytes ---\n"
|
|
);
|
|
}
|
|
([("content-type", "text/plain; charset=utf-8")], body).into_response()
|
|
}
|
|
|
|
/// Content-type for a raster image the dashboard can preview in an
|
|
/// `<img>`, keyed off the file extension. `None` for non-image, SVG,
|
|
/// and text files (SVG is served on the text path and rendered
|
|
/// client-side via a `data:` URI).
|
|
fn image_content_type(path: &Path) -> Option<&'static str> {
|
|
let ext = path.extension()?.to_str()?.to_ascii_lowercase();
|
|
Some(match ext.as_str() {
|
|
"png" => "image/png",
|
|
"jpg" | "jpeg" => "image/jpeg",
|
|
"gif" => "image/gif",
|
|
"webp" => "image/webp",
|
|
"bmp" => "image/bmp",
|
|
"ico" => "image/x-icon",
|
|
"avif" => "image/avif",
|
|
_ => return None,
|
|
})
|
|
}
|
|
|
|
async fn api_reminders(State(state): State<AppState>) -> Response {
|
|
match state.coord.broker.list_pending_reminders() {
|
|
Ok(rows) => axum::Json(rows).into_response(),
|
|
Err(e) => error_response(&format!("reminders: {e:#}")),
|
|
}
|
|
}
|
|
|
|
/// Unread operator-directed messages for the dashboard's Y3R C4LL inbox
|
|
/// (#1469). Returns messages addressed to `"operator"` that haven't been
|
|
/// acked yet (the operator clears them via the existing
|
|
/// `POST /api/agent/operator/mark-all-read`). Newest-first; path-shaped
|
|
/// tokens are validated so the client renders file links like the
|
|
/// terminal does. Shape: `{ "messages": [{ id, from, body, at,
|
|
/// in_reply_to, file_refs }] }`.
|
|
async fn api_operator_inbox(State(state): State<AppState>) -> Response {
|
|
const INBOX_LIMIT: u64 = 100;
|
|
match state
|
|
.coord
|
|
.broker
|
|
.unread_for_recipient("operator", INBOX_LIMIT)
|
|
{
|
|
Ok(messages) => {
|
|
let items: Vec<serde_json::Value> = messages
|
|
.into_iter()
|
|
.filter_map(|m| match m {
|
|
crate::broker::MessageEvent::Sent {
|
|
id,
|
|
from,
|
|
body,
|
|
at,
|
|
in_reply_to,
|
|
..
|
|
} => {
|
|
let file_refs = scan_validated_paths(&body);
|
|
Some(serde_json::json!({
|
|
"id": id,
|
|
"from": from,
|
|
"body": body,
|
|
"at": at,
|
|
"in_reply_to": in_reply_to,
|
|
"file_refs": file_refs,
|
|
}))
|
|
}
|
|
crate::broker::MessageEvent::Delivered { .. }
|
|
| crate::broker::MessageEvent::Ping { .. } => None,
|
|
})
|
|
.collect();
|
|
axum::Json(serde_json::json!({ "messages": items })).into_response()
|
|
}
|
|
Err(e) => error_response(&format!("operator-inbox failed: {e:#}")),
|
|
}
|
|
}
|
|
|
|
#[derive(Deserialize)]
|
|
struct StatsHiveQuery {
|
|
window: Option<String>,
|
|
}
|
|
|
|
/// Hive-wide turn-stats rollup for the dashboard swarm-stats view.
|
|
/// Aggregates every agent's `hyperhive-turn-stats.sqlite` read-only
|
|
/// (skips missing/unreadable ones). Window defaults to `24h`.
|
|
async fn api_stats_hive(axum::extract::Query(q): axum::extract::Query<StatsHiveQuery>) -> Response {
|
|
let window = crate::hive_stats::Window::parse(q.window.as_deref().unwrap_or("24h"));
|
|
axum::Json(crate::hive_stats::hive_snapshot(window)).into_response()
|
|
}
|
|
|
|
/// Live per-agent-container CPU + memory load from cgroup v2. Samples
|
|
/// CPU over a short interval (~200 ms), so this call briefly awaits.
|
|
async fn api_container_resources() -> Response {
|
|
axum::Json(crate::container_stats::gather().await).into_response()
|
|
}
|
|
|
|
#[derive(Deserialize)]
|
|
struct BuildLogsQuery {
|
|
/// Maximum number of rows to return. Capped server-side at 50
|
|
/// (see `build_logs::list_recent_for_agent`). Default 10.
|
|
#[serde(default)]
|
|
limit: Option<usize>,
|
|
}
|
|
|
|
/// `GET /api/build-logs/{agent}?limit=N` — most-recent build log
|
|
/// headers for one agent, newest first. Returns
|
|
/// `Vec<BuildLogHeader>` (JSON). Limit defaults to 10, server-side
|
|
/// cap at 50. Backs the per-agent log chip in the agent card and
|
|
/// the side-panel header list.
|
|
async fn get_build_logs_agent(
|
|
State(state): State<AppState>,
|
|
AxumPath(name): AxumPath<String>,
|
|
axum::extract::Query(q): axum::extract::Query<BuildLogsQuery>,
|
|
) -> Response {
|
|
if let Some(reason) = validate_agent_name(&name) {
|
|
return (StatusCode::BAD_REQUEST, format!("bad agent name: {reason}")).into_response();
|
|
}
|
|
let limit = q.limit.unwrap_or(10);
|
|
match state.coord.build_logs.list_recent_for_agent(&name, limit) {
|
|
Ok(rows) => axum::Json(rows).into_response(),
|
|
Err(e) => error_response(&format!("build-logs {name}: {e:#}")),
|
|
}
|
|
}
|
|
|
|
/// `GET /api/build-logs/id/{id}` — full build log row (stdout +
|
|
/// stderr concatenated) by id. Returns `BuildLogFull` (JSON), or
|
|
/// HTTP 404 when the id doesn't exist (vacuum-reaped, or the
|
|
/// operator passed a stale id from a refresh race).
|
|
async fn get_build_log_full(
|
|
State(state): State<AppState>,
|
|
AxumPath(id): AxumPath<i64>,
|
|
) -> Response {
|
|
match state.coord.build_logs.get_full(id) {
|
|
Ok(Some(log)) => axum::Json(log).into_response(),
|
|
Ok(None) => (StatusCode::NOT_FOUND, format!("build log #{id} not found")).into_response(),
|
|
Err(e) => error_response(&format!("build-log {id}: {e:#}")),
|
|
}
|
|
}
|
|
|
|
/// JSON frame sent on the `/api/build-logs/id/{id}/stream` SSE channel.
|
|
/// `stdout_append` / `stderr_append` carry only the new bytes since the
|
|
/// last frame; `done = true` means the build finished and the stream
|
|
/// will close after this frame.
|
|
#[derive(Serialize)]
|
|
struct BuildLogFrame {
|
|
stdout_append: String,
|
|
stderr_append: String,
|
|
#[serde(skip_serializing_if = "Option::is_none")]
|
|
status: Option<String>,
|
|
done: bool,
|
|
}
|
|
|
|
/// `GET /api/build-logs/id/{id}/stream` — SSE stream that delivers
|
|
/// incremental stdout/stderr as a build runs. The client connects when
|
|
/// it opens a running-build panel; the stream closes automatically once
|
|
/// the build finishes (or the row disappears due to a vacuum).
|
|
///
|
|
/// Each frame is a JSON-serialised `BuildLogFrame`. The first frame
|
|
/// always carries the full accumulated log so far (cursors start at 0);
|
|
/// subsequent frames carry only new bytes. `done: true` on the final
|
|
/// frame signals the browser to close the `EventSource`.
|
|
async fn get_build_log_stream(
|
|
State(state): State<AppState>,
|
|
AxumPath(id): AxumPath<i64>,
|
|
) -> Sse<impl Stream<Item = Result<Event, Infallible>>> {
|
|
let (tx, rx) = tokio::sync::mpsc::channel::<Result<Event, Infallible>>(32);
|
|
let logs = state.coord.build_logs.clone();
|
|
|
|
tokio::spawn(async move {
|
|
let mut notify_rx = logs.subscribe_notifications();
|
|
let mut stdout_cursor = 0usize;
|
|
let mut stderr_cursor = 0usize;
|
|
|
|
// ── initial snapshot ──────────────────────────────────────────
|
|
match logs.get_progress(id, stdout_cursor, stderr_cursor) {
|
|
Ok(Some(prog)) => {
|
|
stdout_cursor += prog.stdout_append.len();
|
|
stderr_cursor += prog.stderr_append.len();
|
|
let done = prog.finished_at.is_some();
|
|
if let Ok(json) = serde_json::to_string(&BuildLogFrame {
|
|
stdout_append: prog.stdout_append,
|
|
stderr_append: prog.stderr_append,
|
|
status: prog.status,
|
|
done,
|
|
}) {
|
|
let _ = tx.send(Ok(Event::default().data(json))).await;
|
|
}
|
|
if done {
|
|
return;
|
|
}
|
|
}
|
|
Ok(None) => {
|
|
// Row missing — send a single error event and exit.
|
|
let _ = tx
|
|
.send(Ok(Event::default()
|
|
.event("error")
|
|
.data(format!("build log #{id} not found"))))
|
|
.await;
|
|
return;
|
|
}
|
|
Err(e) => {
|
|
let _ = tx
|
|
.send(Ok(Event::default()
|
|
.event("error")
|
|
.data(format!("build log #{id}: {e:#}"))))
|
|
.await;
|
|
return;
|
|
}
|
|
}
|
|
|
|
// ── live delta loop ───────────────────────────────────────────
|
|
loop {
|
|
match notify_rx.recv().await {
|
|
// Notification for a different build — ignore and wait
|
|
// for the next one.
|
|
Ok(notif_id) if notif_id != id => {}
|
|
Ok(_) => {
|
|
match logs.get_progress(id, stdout_cursor, stderr_cursor) {
|
|
Ok(Some(prog)) => {
|
|
stdout_cursor += prog.stdout_append.len();
|
|
stderr_cursor += prog.stderr_append.len();
|
|
let done = prog.finished_at.is_some();
|
|
if let Ok(json) = serde_json::to_string(&BuildLogFrame {
|
|
stdout_append: prog.stdout_append,
|
|
stderr_append: prog.stderr_append,
|
|
status: prog.status,
|
|
done,
|
|
}) && tx.send(Ok(Event::default().data(json))).await.is_err()
|
|
{
|
|
return; // browser disconnected
|
|
}
|
|
if done {
|
|
return;
|
|
}
|
|
}
|
|
Ok(None) | Err(_) => return, // vacuum reaped row / channel closed
|
|
}
|
|
}
|
|
Err(tokio::sync::broadcast::error::RecvError::Lagged(_)) => {}
|
|
Err(tokio::sync::broadcast::error::RecvError::Closed) => return,
|
|
}
|
|
}
|
|
});
|
|
|
|
Sse::new(ReceiverStream::new(rx)).keep_alive(KeepAlive::default())
|
|
}
|
|
|
|
/// `GET /api/build-logs/id/{id}/raw` — full log as `text/plain` for
|
|
/// download. Stdout and stderr are concatenated with a `--- stderr ---`
|
|
/// separator (same layout the JS side-panel renders). The
|
|
/// `Content-Disposition` header triggers a browser download with a
|
|
/// descriptive filename so the operator can save and share the log.
|
|
async fn get_build_log_raw(State(state): State<AppState>, AxumPath(id): AxumPath<i64>) -> Response {
|
|
match state.coord.build_logs.get_full(id) {
|
|
Ok(Some(log)) => {
|
|
let mut text = log.stdout;
|
|
if !log.stderr.is_empty() {
|
|
text.push_str("\n--- stderr ---\n");
|
|
text.push_str(&log.stderr);
|
|
}
|
|
(
|
|
StatusCode::OK,
|
|
[
|
|
("content-type", "text/plain; charset=utf-8".to_string()),
|
|
(
|
|
"content-disposition",
|
|
format!(
|
|
"attachment; filename=\"build-log-{}-{}.txt\"",
|
|
log.header.agent, id
|
|
),
|
|
),
|
|
],
|
|
text,
|
|
)
|
|
.into_response()
|
|
}
|
|
Ok(None) => (StatusCode::NOT_FOUND, format!("build log #{id} not found")).into_response(),
|
|
Err(e) => error_response(&format!("build-log {id}: {e:#}")),
|
|
}
|
|
}
|
|
|
|
/// `GET /api/schedules` — snapshot of every schedule for the
|
|
/// scheduled-prompts tab. Returns the wire shape directly
|
|
/// so the frontend can render without an extra translation layer.
|
|
async fn api_schedules(State(state): State<AppState>) -> Response {
|
|
match state.coord.scheduled_prompts.list() {
|
|
Ok(rows) => axum::Json(
|
|
rows.into_iter()
|
|
.map(crate::manager_server::schedule_to_wire_public)
|
|
.collect::<Vec<_>>(),
|
|
)
|
|
.into_response(),
|
|
Err(e) => error_response(&format!("scheduled_prompts list: {e:#}")),
|
|
}
|
|
}
|
|
|
|
/// `POST /api/schedules` — operator-direct schedule creation
|
|
/// (mara: "user can add them manually"). Accepts the same
|
|
/// `SchedulePromptPayload` shape as the manager request flow but
|
|
/// skips the approval gate — the operator click *is* the
|
|
/// approval. The schedule lands directly with
|
|
/// `source = Operator` and the worker picks it up at fire time.
|
|
async fn post_schedule_new(
|
|
State(state): State<AppState>,
|
|
axum::Json(payload): axum::Json<hive_sh4re::SchedulePromptPayload>,
|
|
) -> Response {
|
|
if payload.targets.is_empty() {
|
|
return error_response("schedule must have at least one target");
|
|
}
|
|
if payload.body.trim().is_empty() {
|
|
return error_response("schedule body must be non-empty");
|
|
}
|
|
if let Some(0) = payload.interval_seconds {
|
|
return error_response("interval_seconds must be > 0 (use None for one-shot)");
|
|
}
|
|
let new = crate::scheduled_prompts::NewSchedule {
|
|
owner: hive_sh4re::OPERATOR_RECIPIENT.to_owned(),
|
|
targets: payload.targets,
|
|
body: payload.body,
|
|
first_fire_at_unix: payload.first_fire_at_unix,
|
|
interval_seconds: payload.interval_seconds,
|
|
description: payload.description,
|
|
source: crate::scheduled_prompts::ScheduleSource::Operator,
|
|
};
|
|
match state.coord.scheduled_prompts.submit(&new) {
|
|
Ok(id) => {
|
|
state.coord.emit_schedules_snapshot();
|
|
axum::Json(serde_json::json!({"id": id})).into_response()
|
|
}
|
|
Err(e) => error_response(&format!("schedule submit: {e:#}")),
|
|
}
|
|
}
|
|
|
|
/// `POST /api/schedules/{id}/fire-now` — operator-initiated
|
|
/// out-of-band fire of a scheduled prompt. Runs the
|
|
/// per-target fan-out once immediately and reports per-target
|
|
/// outcome counts. Does NOT touch `next_fire_at_unix` on
|
|
/// recurring schedules (their cadence stays intact); one-shot
|
|
/// schedules are consumed (cancelled) by a manual fire — the
|
|
/// operator's intent is "send this now, the scheduled time was
|
|
/// wrong."
|
|
async fn post_schedule_fire_now(
|
|
State(state): State<AppState>,
|
|
AxumPath(id): AxumPath<i64>,
|
|
) -> Response {
|
|
match crate::scheduled_prompts_worker::fire_now(&state.coord, id).await {
|
|
Ok(report) => {
|
|
state.coord.emit_schedules_snapshot();
|
|
axum::Json(report).into_response()
|
|
}
|
|
Err(e) => error_response(&format!("fire schedule {id} now: {e:#}")),
|
|
}
|
|
}
|
|
|
|
/// `POST /api/rebuild-queue/{id}/cancel` — drop a `Queued` entry
|
|
/// from the rebuild queue. Refuses `Running` / terminal
|
|
/// entries: an in-flight rebuild owns the agent's nix store +
|
|
/// nixos-container update lock and can't be safely interrupted
|
|
/// from the queue side. Always returns 200; the body is
|
|
/// `{"cancelled": true}` on a successful flip from Queued →
|
|
/// Cancelled, `{"cancelled": false}` when the row was Running /
|
|
/// terminal / gone. On success a fresh `RebuildQueueChanged`
|
|
/// snapshot fires so the row's state flip surfaces live.
|
|
async fn post_rebuild_queue_cancel(
|
|
State(state): State<AppState>,
|
|
AxumPath(id): AxumPath<u64>,
|
|
) -> Response {
|
|
let cancelled = state.coord.rebuild_queue.cancel(id);
|
|
if cancelled {
|
|
state.coord.emit_rebuild_queue_snapshot();
|
|
axum::Json(serde_json::json!({"cancelled": true})).into_response()
|
|
} else {
|
|
axum::Json(serde_json::json!({"cancelled": false})).into_response()
|
|
}
|
|
}
|
|
|
|
#[derive(serde::Deserialize, Default)]
|
|
struct CancelScheduleForm {
|
|
/// `None` / absent / empty array → cancel whole schedule.
|
|
#[serde(default)]
|
|
targets: Option<Vec<String>>,
|
|
}
|
|
|
|
#[derive(serde::Deserialize, Default)]
|
|
#[allow(
|
|
clippy::option_option,
|
|
reason = "double-Option carries three-state PATCH semantics on the wire \
|
|
(missing key = leave alone, JSON null = clear, value = set); \
|
|
collapsing to a single Option would lose the 'clear' state"
|
|
)]
|
|
struct EditScheduleForm {
|
|
#[serde(default)]
|
|
body: Option<String>,
|
|
/// Double-`Option` semantics on the wire: missing key = leave
|
|
/// alone, explicit `null` = clear, value = set. serde's
|
|
/// `deserialize_with` trick to distinguish missing from null:
|
|
/// we wrap each editable field in its own helper. Simpler
|
|
/// here — keep them plain `Option<Option<_>>` and document
|
|
/// that the dashboard caller passes JSON `null` to clear.
|
|
#[serde(default, deserialize_with = "deserialize_some")]
|
|
description: Option<Option<String>>,
|
|
#[serde(default, deserialize_with = "deserialize_some")]
|
|
interval_seconds: Option<Option<u64>>,
|
|
#[serde(default)]
|
|
next_fire_at_unix: Option<i64>,
|
|
/// New targets to add. Replace-on-conflict: re-adding a
|
|
/// previously-cancelled target drops the tombstone and the
|
|
/// target starts fresh (operator intent on re-add = "this
|
|
/// target is active again, fresh start").
|
|
#[serde(default)]
|
|
targets_add: Option<Vec<String>>,
|
|
/// Targets to cancel. Same path as `cancel_targets`:
|
|
/// tombstones preserve audit and the parent schedule
|
|
/// auto-cancels when no active targets remain.
|
|
#[serde(default)]
|
|
targets_remove: Option<Vec<String>>,
|
|
}
|
|
|
|
/// serde adaptor: turns missing-key into `None`, explicit-null
|
|
/// into `Some(None)`, value into `Some(Some(v))`. Standard trick
|
|
/// for distinguishing "field absent" from "field set to null" in
|
|
/// JSON PATCH bodies.
|
|
fn deserialize_some<'de, T, D>(deserializer: D) -> Result<Option<T>, D::Error>
|
|
where
|
|
T: serde::Deserialize<'de>,
|
|
D: serde::Deserializer<'de>,
|
|
{
|
|
T::deserialize(deserializer).map(Some)
|
|
}
|
|
|
|
/// `PATCH /api/schedules/{id}` — partial update of an existing
|
|
/// schedule. Mutable fields: `body`, `description`,
|
|
/// `interval_seconds`, `next_fire_at_unix`, plus the target set
|
|
/// via `targets_add` / `targets_remove`. Both target lists
|
|
/// are applied in the same transaction as the scalar fields with
|
|
/// removes-before-adds; re-adding a previously-removed target
|
|
/// resets per-target history (fresh start); draining all targets
|
|
/// auto-cancels the parent schedule. JSON body uses missing-key
|
|
/// = "leave alone", explicit null = "clear" for `description` +
|
|
/// `interval_seconds`. Cancelled schedules are refused — submit
|
|
/// a new one instead. Returns the updated `WireSchedule` so the
|
|
/// caller's post-edit refresh has the new state inline.
|
|
async fn patch_schedule(
|
|
State(state): State<AppState>,
|
|
AxumPath(id): AxumPath<i64>,
|
|
axum::Json(form): axum::Json<EditScheduleForm>,
|
|
) -> Response {
|
|
let patch = crate::scheduled_prompts::UpdateSchedule {
|
|
body: form.body,
|
|
description: form.description,
|
|
interval_seconds: form.interval_seconds,
|
|
next_fire_at_unix: form.next_fire_at_unix,
|
|
targets_add: form.targets_add,
|
|
targets_remove: form.targets_remove,
|
|
};
|
|
if let Err(e) = state.coord.scheduled_prompts.update(id, patch) {
|
|
return error_response(&format!("edit schedule {id}: {e:#}"));
|
|
}
|
|
match state.coord.scheduled_prompts.get(id) {
|
|
Ok(Some(s)) => {
|
|
let wire = crate::manager_server::schedule_to_wire_public(s);
|
|
state.coord.emit_schedules_snapshot();
|
|
axum::Json(wire).into_response()
|
|
}
|
|
Ok(None) => error_response(&format!("edit schedule {id}: row vanished post-update")),
|
|
Err(e) => error_response(&format!("re-read schedule {id}: {e:#}")),
|
|
}
|
|
}
|
|
|
|
/// `POST /api/schedules/{id}/cancel` — operator-side cancel
|
|
/// (whole schedule when no `targets` field, partial when one is
|
|
/// provided). Operator bypasses the topology check; the manager
|
|
/// surface enforces it for agent callers.
|
|
async fn post_schedule_cancel(
|
|
State(state): State<AppState>,
|
|
AxumPath(id): AxumPath<i64>,
|
|
body: Option<axum::Json<CancelScheduleForm>>,
|
|
) -> Response {
|
|
let targets = body
|
|
.and_then(|axum::Json(b)| b.targets)
|
|
.filter(|t| !t.is_empty());
|
|
let result = match targets.as_deref() {
|
|
Some(list) => state.coord.scheduled_prompts.cancel_targets(id, list),
|
|
None => state.coord.scheduled_prompts.cancel_all(id),
|
|
};
|
|
match result {
|
|
Ok(()) => {
|
|
state.coord.emit_schedules_snapshot();
|
|
(StatusCode::OK, "ok").into_response()
|
|
}
|
|
Err(e) => error_response(&format!("cancel schedule {id}: {e:#}")),
|
|
}
|
|
}
|
|
|
|
async fn post_cancel_reminder(
|
|
State(state): State<AppState>,
|
|
AxumPath(id): AxumPath<i64>,
|
|
) -> Response {
|
|
match state.coord.broker.cancel_reminder(id) {
|
|
Ok(0) => error_response(&format!("reminder {id} not pending (already delivered?)")),
|
|
Ok(_) => {
|
|
tracing::info!(%id, "operator cancelled reminder");
|
|
state.coord.emit_reminders_snapshot();
|
|
(StatusCode::OK, "ok").into_response()
|
|
}
|
|
Err(e) => error_response(&format!("cancel reminder {id} failed: {e:#}")),
|
|
}
|
|
}
|
|
|
|
/// Reset a pending reminder's failure state so the scheduler
|
|
/// retries it on the next tick. Useful when the failure was
|
|
/// transient (sqlite lock contention, disk full → freed up) and
|
|
/// the operator wants delivery to resume immediately instead of
|
|
/// the row sitting in attempt-count-capped purgatory.
|
|
async fn post_retry_reminder(
|
|
State(state): State<AppState>,
|
|
AxumPath(id): AxumPath<i64>,
|
|
) -> Response {
|
|
match state.coord.broker.reset_reminder_failure(id) {
|
|
Ok(0) => error_response(&format!("reminder {id} not pending (already delivered?)")),
|
|
Ok(_) => {
|
|
tracing::info!(%id, "operator reset reminder failure for retry");
|
|
state.coord.emit_reminders_snapshot();
|
|
(StatusCode::OK, "ok").into_response()
|
|
}
|
|
Err(e) => error_response(&format!("retry reminder {id} failed: {e:#}")),
|
|
}
|
|
}
|
|
|
|
/// Validate that a path-param agent name conforms to the hyperhive
|
|
/// naming whitelist: 1-63 chars of `[a-z0-9_-]`. Rejects empty,
|
|
/// uppercase, slashes, dots, and any non-ASCII (incl. unicode
|
|
/// homoglyphs of dash/underscore). Returns `None` on accept, `Some(reason)`
|
|
/// on reject — caller wraps the reason in a 400 response. Conservative
|
|
/// whitelist matching `nixos-container` basename rules and the existing
|
|
/// agent-name convention across the codebase.
|
|
fn validate_agent_name(name: &str) -> Option<&'static str> {
|
|
if name.is_empty() {
|
|
return Some("agent name must not be empty");
|
|
}
|
|
if name.len() > 63 {
|
|
return Some("agent name must be 63 characters or fewer");
|
|
}
|
|
if !name
|
|
.bytes()
|
|
.all(|b| b.is_ascii_lowercase() || b.is_ascii_digit() || b == b'-' || b == b'_')
|
|
{
|
|
return Some("agent name must contain only [a-z0-9_-]");
|
|
}
|
|
None
|
|
}
|
|
|
|
/// Two-axis path-param guard for write routes. Combines:
|
|
///
|
|
/// 1. **format validation** (`validate_agent_name`) — rejects path
|
|
/// traversal / unicode homoglyphs / empty + too-long names with
|
|
/// HTTP 400.
|
|
/// 2. **existence check** — looks up `name` in the coordinator's
|
|
/// container snapshot; unknown name → HTTP 404 with a clear
|
|
/// "no such agent" message. catches the operator-typo case where
|
|
/// a destructive POST would otherwise hit silently (mark-all-read
|
|
/// returning 0) or hit downstream lifecycle code that fails with
|
|
/// a confusing nspawn error.
|
|
///
|
|
/// Returns `None` when both checks pass (caller proceeds), `Some(Response)`
|
|
/// when the request should be rejected. Use at the top of every write
|
|
/// handler taking a name path-param. Read-only GET handlers and
|
|
/// handlers that legitimately operate on tombstoned agents (e.g.
|
|
/// `mark-all-read` on broker rows for a destroyed agent) call
|
|
/// `validate_agent_name` directly and skip the existence check.
|
|
async fn guard_agent_name(state: &AppState, name: &str) -> Option<Response> {
|
|
if let Some(reason) = validate_agent_name(name) {
|
|
return Some(
|
|
(StatusCode::BAD_REQUEST, format!("bad agent name: {reason}")).into_response(),
|
|
);
|
|
}
|
|
let snapshot = state.coord.containers_snapshot().await;
|
|
if !snapshot.iter().any(|c| c.name == name) {
|
|
return Some((StatusCode::NOT_FOUND, format!("no such agent: {name}")).into_response());
|
|
}
|
|
None
|
|
}
|
|
|
|
/// Operator-driven "clear this agent's inbox" — backs the side-panel
|
|
/// "mark all read" button. Marks every message addressed to the
|
|
/// agent as acked (backfilling `delivered_at` for any still-pending
|
|
/// rows so vacuum can collect them). Returns `{ "marked": N }` so the
|
|
/// frontend can show "cleared N messages" feedback without an extra
|
|
/// fetch.
|
|
async fn post_mark_all_read(
|
|
State(state): State<AppState>,
|
|
AxumPath(name): AxumPath<String>,
|
|
) -> Response {
|
|
if let Some(reason) = validate_agent_name(&name) {
|
|
return (StatusCode::BAD_REQUEST, format!("bad agent name: {reason}")).into_response();
|
|
}
|
|
match state.coord.broker.mark_all_read(&name) {
|
|
Ok(n) => {
|
|
tracing::info!(%name, marked = n, "operator marked all messages read");
|
|
axum::Json(serde_json::json!({ "marked": n })).into_response()
|
|
}
|
|
Err(e) => error_response(&format!("mark-all-read {name} failed: {e:#}")),
|
|
}
|
|
}
|
|
|
|
async fn post_purge_tombstone(
|
|
State(state): State<AppState>,
|
|
AxumPath(name): AxumPath<String>,
|
|
) -> Response {
|
|
// Format guard FIRST so a name like `..` can't traverse into the
|
|
// parent of `/var/lib/hyperhive/agents/{name}` and have
|
|
// `remove_dir_all` wipe `/var/lib/hyperhive/` itself. Existing
|
|
// manager + live-container checks below don't catch `..` — only
|
|
// the whitelist does. Existence check via
|
|
// `containers_snapshot()` is deliberately NOT used here:
|
|
// tombstoned agents are gone from the snapshot by design; that's
|
|
// the whole point of this endpoint.
|
|
if let Some(reason) = validate_agent_name(&name) {
|
|
return (StatusCode::BAD_REQUEST, format!("bad agent name: {reason}")).into_response();
|
|
}
|
|
// Sanity: refuse to purge if a live container still exists with this
|
|
// name. The dashboard already filters tombstones to non-live names,
|
|
// but the operator could send a stale POST.
|
|
let live = lifecycle::list().await.unwrap_or_default();
|
|
if live
|
|
.iter()
|
|
.any(|c| c == &format!("{}{name}", lifecycle::AGENT_PREFIX) || c == &name)
|
|
{
|
|
return error_response(&format!(
|
|
"refusing to purge {name}: container still exists — use DESTR0Y first"
|
|
));
|
|
}
|
|
let mut errors = Vec::new();
|
|
for dir in [
|
|
Coordinator::agent_state_root(&name),
|
|
Coordinator::agent_applied_dir(&name),
|
|
] {
|
|
if dir.exists()
|
|
&& let Err(e) = std::fs::remove_dir_all(&dir)
|
|
{
|
|
errors.push(format!("{}: {e}", dir.display()));
|
|
}
|
|
}
|
|
let _ = state
|
|
.coord
|
|
.approvals
|
|
.fail_pending_for_agent(&name, "agent state purged");
|
|
if errors.is_empty() {
|
|
tracing::info!(%name, "tombstone purged");
|
|
// Fire the post-purge tombstones snapshot so dashboards
|
|
// drop the row live; matching form carries
|
|
// `data-no-refresh`.
|
|
emit_tombstones_snapshot(&state.coord).await;
|
|
(StatusCode::OK, "ok").into_response()
|
|
} else {
|
|
error_response(&format!("purge {name} partial: {}", errors.join(", ")))
|
|
}
|
|
}
|
|
|
|
/// Operator-side compose form on the dashboard terminal. Drops a
|
|
/// message into the broker as `{from: "operator", to, body}`. Same
|
|
/// shape that per-agent web UIs use via `OperatorMsg`, but here the
|
|
/// operator picks the recipient explicitly with `@name`. No
|
|
/// validation that `to` resolves to a known agent — broker accepts
|
|
/// arbitrary recipients (and the agent's inbox grows whether or not
|
|
/// they exist, which is fine for spawn-then-greet flows).
|
|
#[derive(Deserialize)]
|
|
struct OpSendForm {
|
|
to: String,
|
|
body: String,
|
|
}
|
|
|
|
/// Form for `POST /meta-update`. Inputs ride in as a comma-separated
|
|
/// list under the `inputs` field — the JS submitter joins the
|
|
/// checked boxes since axum's `Form` extractor doesn't natively
|
|
/// decode repeated keys without a helper.
|
|
#[derive(Deserialize)]
|
|
struct MetaUpdateForm {
|
|
inputs: String,
|
|
}
|
|
|
|
/// Bulk-update selected meta flake inputs, then rebuild the affected
|
|
/// agents in the background. Idempotent w.r.t. selection — choosing
|
|
/// an input that's already at the latest sha is a no-op (no commit,
|
|
/// no rebuild ripple). Returns immediately after queueing the work;
|
|
/// dashboard polls for progress via container `pending` spinners +
|
|
/// the meta-inputs row sha update.
|
|
async fn post_meta_update(
|
|
State(state): State<AppState>,
|
|
Form(form): Form<MetaUpdateForm>,
|
|
) -> Response {
|
|
let inputs: Vec<String> = form
|
|
.inputs
|
|
.split(',')
|
|
.map(|s| s.trim().to_owned())
|
|
.filter(|s| !s.is_empty())
|
|
.collect();
|
|
if inputs.is_empty() {
|
|
return error_response("meta-update: no inputs selected");
|
|
}
|
|
let inputs_label = inputs.join(", ");
|
|
let parent_id = state.coord.rebuild_queue.enqueue_with_inputs(
|
|
crate::rebuild_queue::QueueKind::MetaUpdate,
|
|
"hyperhive".to_owned(),
|
|
crate::rebuild_queue::QueueSource::Manual,
|
|
format!("meta-update via dashboard ({inputs_label})"),
|
|
None,
|
|
inputs.clone(),
|
|
);
|
|
// Pre-enqueue cascade rebuilds NOW so they're visible in the queue
|
|
// alongside the parent. The worker's MetaUpdate arm
|
|
// no longer enqueues children — it just runs the lock bump and
|
|
// (on failure) cancels these pre-queued children.
|
|
let cascade_agents = crate::rebuild_queue::meta_update_cascade_agents(&inputs).await;
|
|
let cascade_reason = format!("meta-update cascade ({inputs_label})");
|
|
for name in cascade_agents {
|
|
state.coord.rebuild_queue.enqueue(
|
|
crate::rebuild_queue::QueueKind::Rebuild,
|
|
name,
|
|
crate::rebuild_queue::QueueSource::MetaUpdate,
|
|
cascade_reason.clone(),
|
|
Some(parent_id),
|
|
);
|
|
}
|
|
state.coord.emit_rebuild_queue_snapshot();
|
|
(StatusCode::OK, "ok").into_response()
|
|
}
|
|
|
|
async fn post_op_send(State(state): State<AppState>, Form(form): Form<OpSendForm>) -> Response {
|
|
let to = form.to.trim().to_owned();
|
|
let body = form.body.trim().to_owned();
|
|
if to.is_empty() {
|
|
return error_response("op-send: `to` required");
|
|
}
|
|
if body.is_empty() {
|
|
return error_response("op-send: `body` required");
|
|
}
|
|
if to == "*" {
|
|
let errors = state
|
|
.coord
|
|
.broadcast_send(hive_sh4re::OPERATOR_RECIPIENT, &body);
|
|
if !errors.is_empty() {
|
|
return error_response(&format!(
|
|
"op-send broadcast partial fail: {}",
|
|
errors.join("; ")
|
|
));
|
|
}
|
|
} else if let Err(e) = state.coord.broker.send(&hive_sh4re::Message {
|
|
from: hive_sh4re::OPERATOR_RECIPIENT.to_owned(),
|
|
to: to.clone(),
|
|
body,
|
|
in_reply_to: None,
|
|
}) {
|
|
return error_response(&format!("op-send to {to} failed: {e:#}"));
|
|
}
|
|
// 200 instead of 303 → the client doesn't refetch /api/state. The
|
|
// broker `send` already emitted a `MessageEvent` which the
|
|
// dashboard channel forwarder mirrors as `DashboardEvent::Sent`,
|
|
// and the page's terminal + inbox derive from that stream — so the
|
|
// operator's send shows up the same way an agent's send does, with
|
|
// no full-state refresh in between.
|
|
(axum::http::StatusCode::OK, "ok").into_response()
|
|
}
|
|
|
|
async fn post_request_spawn(
|
|
State(state): State<AppState>,
|
|
Form(form): Form<RequestSpawnForm>,
|
|
) -> Response {
|
|
let name = form.name.trim().to_owned();
|
|
if name.is_empty() {
|
|
return error_response("spawn: `name` required");
|
|
}
|
|
match state
|
|
.coord
|
|
.approvals
|
|
.submit_kind(&name, hive_sh4re::ApprovalKind::Spawn, "", None)
|
|
{
|
|
Ok(id) => {
|
|
tracing::info!(%id, %name, "operator: spawn approval queued via dashboard");
|
|
// Phase 5b: notify the dashboard event channel so live
|
|
// subscribers can append the row without a snapshot
|
|
// refetch. Spawn approvals carry no diff/sha.
|
|
state
|
|
.coord
|
|
.emit_approval_added(id, &name, "spawn", None, None, None);
|
|
(StatusCode::OK, "ok").into_response()
|
|
}
|
|
Err(e) => error_response(&format!("request-spawn {name} failed: {e:#}")),
|
|
}
|
|
}
|
|
|
|
/// `POST /api/topology/set-parent` — operator-driven parent move.
|
|
/// Form fields: `child` (required, agent name), `new_parent`
|
|
/// (optional — empty / absent string ⇒ promote to root). Refuses
|
|
/// cycles and unknown agents. The manager is reparentable like any
|
|
/// other agent — its privileges come from the privileged MCP socket,
|
|
/// not its tree position. On success
|
|
/// re-emits container snapshots so the dashboard tree repaints
|
|
/// without a refresh.
|
|
async fn post_set_parent(
|
|
State(state): State<AppState>,
|
|
Form(form): Form<SetParentForm>,
|
|
) -> Response {
|
|
let child = form.child.trim().to_owned();
|
|
if child.is_empty() {
|
|
return error_response("set-parent: `child` required");
|
|
}
|
|
// Empty / whitespace-only `new_parent` ⇒ promote to root. Web
|
|
// forms submit the empty string for a "no value" radio button,
|
|
// so this is the ergonomic encoding.
|
|
let new_parent = form
|
|
.new_parent
|
|
.as_deref()
|
|
.map(str::trim)
|
|
.filter(|s| !s.is_empty())
|
|
.map(str::to_owned);
|
|
// `reparent_with_notify` wraps `topology::set_parent` with the
|
|
// three notification messages + the ContainerView rescan.
|
|
// Idempotent same-parent calls skip both the messages and the
|
|
// disk write per the topology fast-path.
|
|
match state
|
|
.coord
|
|
.reparent_with_notify(&child, new_parent.as_deref())
|
|
.await
|
|
{
|
|
Ok(()) => {
|
|
tracing::info!(
|
|
child = %child,
|
|
new_parent = ?new_parent,
|
|
"operator: set-parent via dashboard"
|
|
);
|
|
(StatusCode::OK, "ok").into_response()
|
|
}
|
|
Err(e) => error_response(&format!("set-parent {child} failed: {e}")),
|
|
}
|
|
}
|
|
|
|
/// `POST /api/topology/set-parent-bulk` — move multiple agents in a single
|
|
/// request, producing **one** git commit. JSON body: `[{"child":"name",
|
|
/// "new_parent":"target-or-null"}, ...]`. Empty array is a no-op (200 OK).
|
|
/// First validation error aborts the whole batch.
|
|
async fn post_set_parent_bulk(
|
|
State(state): State<AppState>,
|
|
axum::Json(body): axum::Json<Vec<SetParentBulkEntry>>,
|
|
) -> Response {
|
|
if body.is_empty() {
|
|
return (StatusCode::OK, "ok").into_response();
|
|
}
|
|
// Collect borrows for the coordinator call.
|
|
let moves: Vec<(&str, Option<&str>)> = body
|
|
.iter()
|
|
.map(|e| {
|
|
let child: &str = &e.child;
|
|
let parent: Option<&str> = e.new_parent.as_deref().filter(|s| !s.is_empty());
|
|
(child, parent)
|
|
})
|
|
.collect();
|
|
match state.coord.reparent_bulk_with_notify(&moves).await {
|
|
Ok(()) => {
|
|
let names: Vec<&str> = body.iter().map(|e| e.child.as_str()).collect();
|
|
tracing::info!(agents = ?names, "operator: set-parent-bulk via dashboard");
|
|
(StatusCode::OK, "ok").into_response()
|
|
}
|
|
Err(e) => error_response(&format!("set-parent-bulk failed: {e}")),
|
|
}
|
|
}
|
|
|
|
// ── tool-group endpoints ──────────────────────────────────
|
|
|
|
#[derive(Serialize)]
|
|
struct ToolGroupsSnapshot {
|
|
/// Ordered list of all known tool-group names. Drives the column
|
|
/// headers in the capabilities table — the UI does not hard-code them.
|
|
groups: Vec<&'static str>,
|
|
/// Short description for each group name. Keys match `groups` entries.
|
|
descriptions: std::collections::BTreeMap<&'static str, &'static str>,
|
|
/// Per-agent assignment map. Absent agents use the role default
|
|
/// (agents: messaging+meta+inbox+execution; manager: all groups).
|
|
assignments: std::collections::BTreeMap<String, Vec<String>>,
|
|
}
|
|
|
|
async fn get_tool_groups(State(_state): State<AppState>) -> axum::Json<ToolGroupsSnapshot> {
|
|
let groups = hive_sh4re::ToolGroup::ALL
|
|
.iter()
|
|
.map(|g| g.as_str())
|
|
.collect();
|
|
let descriptions = hive_sh4re::ToolGroup::ALL
|
|
.iter()
|
|
.map(|g| (g.as_str(), g.description()))
|
|
.collect();
|
|
let assignments = crate::tool_groups::read();
|
|
axum::Json(ToolGroupsSnapshot {
|
|
groups,
|
|
descriptions,
|
|
assignments,
|
|
})
|
|
}
|
|
|
|
#[derive(Deserialize)]
|
|
struct SetToolGroupsBody {
|
|
groups: Vec<String>,
|
|
}
|
|
|
|
async fn post_tool_groups(
|
|
State(state): State<AppState>,
|
|
AxumPath(name): AxumPath<String>,
|
|
axum::Json(body): axum::Json<SetToolGroupsBody>,
|
|
) -> Response {
|
|
let logical = strip_container_prefix(&name);
|
|
if let Some(reject) = guard_agent_name(&state, &logical).await {
|
|
return reject;
|
|
}
|
|
// Validate group names before queuing — fail fast so the operator
|
|
// sees the error immediately rather than waiting for the worker.
|
|
if let Err(e) = crate::tool_groups::validate_groups(&body.groups) {
|
|
return error_response(&format!("invalid tool-groups for {logical}: {e}"));
|
|
}
|
|
// Enqueue a PermChange so the JSON file write is serialised through
|
|
// the FIFO worker. Prevents concurrent batch-apply actions for
|
|
// different agents from racing on the shared tool-groups.json.
|
|
state.coord.rebuild_queue.enqueue_with_perm(
|
|
logical.clone(),
|
|
crate::rebuild_queue::QueueSource::Manual,
|
|
"tool-group change via permissions UI".to_owned(),
|
|
crate::rebuild_queue::PermPayload::ToolGroups {
|
|
groups: body.groups.clone(),
|
|
},
|
|
);
|
|
state.coord.emit_rebuild_queue_snapshot();
|
|
tracing::info!(agent = %logical, groups = ?body.groups, "operator: set tool-groups via dashboard");
|
|
(StatusCode::OK, "ok").into_response()
|
|
}
|
|
|
|
// ── capability endpoints ──────────────────────────────────────────────────
|
|
|
|
#[derive(Serialize)]
|
|
struct CapabilitiesSnapshot {
|
|
/// Ordered list of all known capability names. Drives the column
|
|
/// headers in the capabilities table — the UI does not hard-code them.
|
|
caps: Vec<&'static str>,
|
|
/// Short description for each capability name. Keys match `caps` entries.
|
|
descriptions: std::collections::BTreeMap<&'static str, &'static str>,
|
|
/// Per-agent capability grant map. Absent agents have no extra caps.
|
|
assignments: std::collections::BTreeMap<String, Vec<String>>,
|
|
}
|
|
|
|
async fn get_capabilities(State(_state): State<AppState>) -> axum::Json<CapabilitiesSnapshot> {
|
|
use hive_sh4re::Capability;
|
|
let caps = Capability::ALL.iter().map(|c| c.as_str()).collect();
|
|
let descriptions = Capability::ALL
|
|
.iter()
|
|
.map(|c| (c.as_str(), c.description()))
|
|
.collect();
|
|
let assignments = crate::capabilities::read();
|
|
axum::Json(CapabilitiesSnapshot {
|
|
caps,
|
|
descriptions,
|
|
assignments,
|
|
})
|
|
}
|
|
|
|
#[derive(Deserialize)]
|
|
struct SetCapabilitiesBody {
|
|
caps: Vec<String>,
|
|
}
|
|
|
|
async fn post_capabilities(
|
|
State(state): State<AppState>,
|
|
AxumPath(name): AxumPath<String>,
|
|
axum::Json(body): axum::Json<SetCapabilitiesBody>,
|
|
) -> Response {
|
|
let logical = strip_container_prefix(&name);
|
|
if let Some(reject) = guard_agent_name(&state, &logical).await {
|
|
return reject;
|
|
}
|
|
let known: Vec<&str> = hive_sh4re::Capability::ALL
|
|
.iter()
|
|
.map(|c| c.as_str())
|
|
.collect();
|
|
for cap in &body.caps {
|
|
if !known.contains(&cap.as_str()) {
|
|
return error_response(&format!("unknown capability: {cap}"));
|
|
}
|
|
}
|
|
// Enqueue a PermChange so the JSON file write is serialised through
|
|
// the FIFO worker. Prevents concurrent batch-apply actions for
|
|
// different agents from racing on the shared capabilities.json.
|
|
state.coord.rebuild_queue.enqueue_with_perm(
|
|
logical.clone(),
|
|
crate::rebuild_queue::QueueSource::Manual,
|
|
"capability change via dashboard".to_owned(),
|
|
crate::rebuild_queue::PermPayload::Capabilities {
|
|
caps: body.caps.clone(),
|
|
},
|
|
);
|
|
state.coord.emit_rebuild_queue_snapshot();
|
|
tracing::info!(agent = %logical, caps = ?body.caps, "operator: set capabilities via dashboard");
|
|
(StatusCode::OK, "ok").into_response()
|
|
}
|
|
|
|
async fn post_rebuild(State(state): State<AppState>, AxumPath(name): AxumPath<String>) -> Response {
|
|
let logical = strip_container_prefix(&name);
|
|
if let Some(reject) = guard_agent_name(&state, &logical).await {
|
|
return reject;
|
|
}
|
|
state.coord.rebuild_queue.enqueue(
|
|
crate::rebuild_queue::QueueKind::Rebuild,
|
|
logical,
|
|
crate::rebuild_queue::QueueSource::Manual,
|
|
"manual via dashboard ↻ R3BU1LD button".to_owned(),
|
|
None,
|
|
);
|
|
state.coord.emit_rebuild_queue_snapshot();
|
|
(StatusCode::OK, "ok").into_response()
|
|
}
|
|
|
|
/// Common shape for the simple lifecycle action handlers (start /
|
|
/// stop / restart / rebuild): strip the container prefix, mark
|
|
/// transient for the duration so the dashboard can spinner, run the
|
|
/// lifecycle op, clear transient, redirect on success or surface the
|
|
/// error. `verb` only appears in the error message; `extra` runs on
|
|
/// success after `clear_transient` for handlers that need follow-up
|
|
/// (e.g. `kill` also unregisters the agent + fires `HelperEvent`).
|
|
async fn lifecycle_action<F, Fut>(
|
|
state: &AppState,
|
|
name: &str,
|
|
kind: crate::coordinator::TransientKind,
|
|
verb: &str,
|
|
body: F,
|
|
extra: impl FnOnce(&AppState, &str),
|
|
) -> Response
|
|
where
|
|
F: FnOnce(String) -> Fut,
|
|
Fut: std::future::Future<Output = anyhow::Result<()>>,
|
|
{
|
|
let logical = strip_container_prefix(name);
|
|
let guard = state.coord.transient_guard(&logical, kind);
|
|
let result = body(logical.clone()).await;
|
|
drop(guard);
|
|
match result {
|
|
Ok(()) => {
|
|
extra(state, &logical);
|
|
// Rescan so the running/needs_login/needs_update flip on
|
|
// the affected row lands on every dashboard's SSE channel
|
|
// without waiting for a snapshot poll. 200 + matching
|
|
// `data-no-refresh` on the form skip the post-submit
|
|
// /api/state refetch.
|
|
state.coord.rescan_containers_and_emit().await;
|
|
(StatusCode::OK, "ok").into_response()
|
|
}
|
|
Err(e) => error_response(&format!("{verb} {logical} failed: {e:#}")),
|
|
}
|
|
}
|
|
|
|
async fn post_kill(State(state): State<AppState>, AxumPath(name): AxumPath<String>) -> Response {
|
|
let logical = strip_container_prefix(&name);
|
|
if let Some(reject) = guard_agent_name(&state, &logical).await {
|
|
return reject;
|
|
}
|
|
// Manager is stoppable from the dashboard like any other
|
|
// agent. The host's dashboard server keeps running (it's
|
|
// hive-c0re, not the manager container), per-agent approvals
|
|
// submitted by other sub-agents still process through the
|
|
// host-side approval queue without the manager up, and
|
|
// operator-driven meta-input updates work from the dashboard
|
|
// either way. The MCP-surface self-kill guard in
|
|
// `manager_server.rs::ManagerRequest::Kill` stays in place: a
|
|
// manager calling Kill on its own container is self-suicide
|
|
// mid-call, not a legitimate operator action.
|
|
lifecycle_action(
|
|
&state,
|
|
&name,
|
|
crate::coordinator::TransientKind::Stopping,
|
|
"kill",
|
|
|n| async move { lifecycle::kill(&n).await },
|
|
|s, n| {
|
|
s.coord.unregister_agent(n);
|
|
s.coord.notify_manager(&hive_sh4re::HelperEvent::Killed {
|
|
agent: n.to_owned(),
|
|
});
|
|
},
|
|
)
|
|
.await
|
|
}
|
|
|
|
async fn post_restart(State(state): State<AppState>, AxumPath(name): AxumPath<String>) -> Response {
|
|
let logical = strip_container_prefix(&name);
|
|
if let Some(reject) = guard_agent_name(&state, &logical).await {
|
|
return reject;
|
|
}
|
|
state.coord.rebuild_queue.enqueue(
|
|
crate::rebuild_queue::QueueKind::Restart,
|
|
logical,
|
|
crate::rebuild_queue::QueueSource::Manual,
|
|
"manual via dashboard ↺ R3START button".to_owned(),
|
|
None,
|
|
);
|
|
state.coord.emit_rebuild_queue_snapshot();
|
|
(StatusCode::OK, "ok").into_response()
|
|
}
|
|
|
|
async fn post_start(State(state): State<AppState>, AxumPath(name): AxumPath<String>) -> Response {
|
|
let logical = strip_container_prefix(&name);
|
|
if let Some(reject) = guard_agent_name(&state, &logical).await {
|
|
return reject;
|
|
}
|
|
lifecycle_action(
|
|
&state,
|
|
&name,
|
|
crate::coordinator::TransientKind::Starting,
|
|
"start",
|
|
|n| async move { lifecycle::start(&n).await },
|
|
|s, n| s.coord.kick_agent(n, "container started"),
|
|
)
|
|
.await
|
|
}
|
|
|
|
async fn post_update_all(State(state): State<AppState>) -> Response {
|
|
let containers = lifecycle::list().await.unwrap_or_default();
|
|
for container in containers {
|
|
let Some(logical) = container
|
|
.strip_prefix(lifecycle::AGENT_PREFIX)
|
|
.map(str::to_owned)
|
|
else {
|
|
continue;
|
|
};
|
|
state.coord.rebuild_queue.enqueue(
|
|
crate::rebuild_queue::QueueKind::Rebuild,
|
|
logical,
|
|
crate::rebuild_queue::QueueSource::Manual,
|
|
"manual via dashboard 🌀 UPDATE ALL".to_owned(),
|
|
None,
|
|
);
|
|
}
|
|
state.coord.emit_rebuild_queue_snapshot();
|
|
(StatusCode::OK, "ok").into_response()
|
|
}
|
|
|
|
fn transient_label(k: crate::coordinator::TransientKind) -> &'static str {
|
|
use crate::coordinator::TransientKind::{
|
|
Destroying, Rebuilding, Restarting, Spawning, Starting, Stopping,
|
|
};
|
|
match k {
|
|
Spawning => "spawning",
|
|
Starting => "starting",
|
|
Stopping => "stopping",
|
|
Restarting => "restarting",
|
|
Rebuilding => "rebuilding",
|
|
Destroying => "destroying",
|
|
}
|
|
}
|
|
|
|
/// Convert either a logical name or a container name back to the logical
|
|
/// name. Sub-agents are `h-foo` → `foo`; manager stays `root`.
|
|
fn strip_container_prefix(name: &str) -> String {
|
|
name.strip_prefix(lifecycle::AGENT_PREFIX)
|
|
.unwrap_or(name)
|
|
.to_owned()
|
|
}
|
|
|
|
#[derive(Deserialize, Default)]
|
|
struct DestroyForm {
|
|
#[serde(default)]
|
|
purge: Option<String>,
|
|
}
|
|
|
|
async fn post_destroy(
|
|
State(state): State<AppState>,
|
|
AxumPath(name): AxumPath<String>,
|
|
Form(form): Form<DestroyForm>,
|
|
) -> Response {
|
|
if let Some(reject) = guard_agent_name(&state, &name).await {
|
|
return reject;
|
|
}
|
|
// Checkbox semantics: any non-empty value (axum sends "on") = purge.
|
|
let purge = form.purge.as_deref().is_some_and(|v| !v.is_empty());
|
|
// `actions::destroy` rescans the container list on success, so the
|
|
// `ContainerRemoved` event lands before we return 200. The matching
|
|
// form carries `data-no-refresh`.
|
|
match actions::destroy(&state.coord, &name, purge).await {
|
|
Ok(()) => (StatusCode::OK, "ok").into_response(),
|
|
Err(e) => error_response(&format!("destroy {name} failed: {e:#}")),
|
|
}
|
|
}
|
|
|
|
fn error_response(message: &str) -> Response {
|
|
// Plain text — the JS app surfaces this in an alert(), so HTML
|
|
// wrapping would just clutter the message.
|
|
(StatusCode::INTERNAL_SERVER_ERROR, message.to_owned()).into_response()
|
|
}
|
|
|
|
/// Filter out approvals whose agent state dir was wiped out from under us
|
|
/// (e.g. by a test script's cleanup). Marks them failed so they fall out of
|
|
/// `pending` on next render.
|
|
fn gc_orphans(coord: &Coordinator, approvals: Vec<Approval>) -> Vec<Approval> {
|
|
approvals
|
|
.into_iter()
|
|
.filter(|a| {
|
|
// Spawn and InitConfig approvals are for not-yet-existent agents;
|
|
// the proposed dir is supposed to be missing.
|
|
if matches!(
|
|
a.kind,
|
|
hive_sh4re::ApprovalKind::Spawn | hive_sh4re::ApprovalKind::InitConfig
|
|
) {
|
|
return true;
|
|
}
|
|
if Coordinator::agent_proposed_dir(&a.agent).exists() {
|
|
true
|
|
} else {
|
|
let note = "agent state dir missing";
|
|
let _ = coord.approvals.mark_failed(a.id, note);
|
|
tracing::info!(id = a.id, agent = %a.agent, "auto-failed orphan approval");
|
|
let sha_short = a
|
|
.fetched_sha
|
|
.as_deref()
|
|
.map(|s| s[..s.len().min(12)].to_owned());
|
|
coord.emit_approval_resolved(
|
|
a.id,
|
|
&a.agent,
|
|
"apply_commit",
|
|
sha_short,
|
|
"failed",
|
|
Some(note.to_owned()),
|
|
a.description.clone(),
|
|
);
|
|
false
|
|
}
|
|
})
|
|
.collect()
|
|
}
|
|
|
|
/// Multi-file unified diff between the currently-deployed tree and
|
|
/// the proposal for this approval. Runs against the applied repo
|
|
/// since the canonical proposal commit lives there (manager-side
|
|
/// amendments don't move it). Empty output means proposal == main —
|
|
/// a no-op approval.
|
|
///
|
|
/// `pub(crate)` so the manager-socket handler can pre-compute the
|
|
/// diff once at submission time and embed it in the `ApprovalAdded`
|
|
/// dashboard event (instead of forcing the dashboard to wait a
|
|
/// `/api/state` cycle to see the diff for newly-queued approvals).
|
|
pub(crate) async fn approval_diff(agent: &str, approval_id: i64) -> String {
|
|
let applied = Coordinator::agent_applied_dir(agent);
|
|
if !applied.join(".git").exists() {
|
|
return format!("(no applied git repo at {})", applied.display());
|
|
}
|
|
let proposal_ref = format!("refs/tags/proposal/{approval_id}");
|
|
match git_diff_refs(&applied, "refs/heads/main", &proposal_ref).await {
|
|
Ok(s) if s.is_empty() => "(proposal matches currently-deployed tree)".to_owned(),
|
|
Ok(s) => s,
|
|
Err(e) => format!("(error: {e:#})"),
|
|
}
|
|
}
|
|
|
|
async fn git_diff_refs(applied_dir: &Path, base_ref: &str, target_ref: &str) -> Result<String> {
|
|
let out = lifecycle::git_command()
|
|
.current_dir(applied_dir)
|
|
.args(["diff", &format!("{base_ref}..{target_ref}")])
|
|
.output()
|
|
.await
|
|
.with_context(|| format!("spawn `git diff` in {}", applied_dir.display()))?;
|
|
if !out.status.success() {
|
|
anyhow::bail!(
|
|
"git diff {base_ref}..{target_ref} failed: {}",
|
|
String::from_utf8_lossy(&out.stderr).trim()
|
|
);
|
|
}
|
|
Ok(String::from_utf8_lossy(&out.stdout).into_owned())
|
|
}
|
|
|
|
/// Numeric ids of `<prefix>/<n>` tags in the applied repo (e.g.
|
|
/// `proposal/3` → `3`). Unparseable suffixes are skipped. Used to
|
|
/// resolve the `approved` / `previous` diff bases for an approval.
|
|
async fn tag_ids(applied_dir: &Path, prefix: &str) -> Vec<i64> {
|
|
let Ok(out) = lifecycle::git_command()
|
|
.current_dir(applied_dir)
|
|
.args(["tag", "-l", &format!("{prefix}/*")])
|
|
.output()
|
|
.await
|
|
else {
|
|
return Vec::new();
|
|
};
|
|
if !out.status.success() {
|
|
return Vec::new();
|
|
}
|
|
let strip = format!("{prefix}/");
|
|
String::from_utf8_lossy(&out.stdout)
|
|
.lines()
|
|
.filter_map(|l| l.trim().strip_prefix(&strip))
|
|
.filter_map(|s| s.parse::<i64>().ok())
|
|
.collect()
|
|
}
|
|
|
|
#[derive(Deserialize)]
|
|
struct DiffBaseQuery {
|
|
/// `applied` (running tree — default), `approved` (most recent
|
|
/// earlier approved proposal), or `previous` (the prior queued
|
|
/// proposal for this agent).
|
|
base: Option<String>,
|
|
}
|
|
|
|
/// On-demand unified diff for one `ApplyCommit` approval against a
|
|
/// chosen base. `applied` = `applied/main` (what's running);
|
|
/// `approved` = the most recent earlier `approved/<n>` tag (the last
|
|
/// proposal the operator OK'd, even if its build then failed);
|
|
/// `previous` = the prior queued `proposal/<n>` (the incremental
|
|
/// delta when the manager chains proposals). Returns the raw diff
|
|
/// text — the dashboard classifies lines client-side.
|
|
async fn get_approval_diff(
|
|
State(state): State<AppState>,
|
|
AxumPath(id): AxumPath<i64>,
|
|
axum::extract::Query(q): axum::extract::Query<DiffBaseQuery>,
|
|
) -> Response {
|
|
let base = q.base.as_deref().unwrap_or("applied");
|
|
let approval = match state.coord.approvals.get(id) {
|
|
Ok(Some(a)) => a,
|
|
Ok(None) => return error_response(&format!("approval {id} not found")),
|
|
Err(e) => return error_response(&format!("approval {id}: {e:#}")),
|
|
};
|
|
if !matches!(approval.kind, hive_sh4re::ApprovalKind::ApplyCommit) {
|
|
return error_response("spawn approvals carry no commit to diff");
|
|
}
|
|
let applied = Coordinator::agent_applied_dir(&approval.agent);
|
|
if !applied.join(".git").exists() {
|
|
return plain_text(format!("(no applied git repo at {})", applied.display()));
|
|
}
|
|
let target = format!("refs/tags/proposal/{id}");
|
|
let base_ref = match base {
|
|
"applied" => Some("refs/heads/main".to_owned()),
|
|
"approved" => {
|
|
let ids = tag_ids(&applied, "approved").await;
|
|
ids.into_iter()
|
|
.filter(|&n| n != id)
|
|
.max()
|
|
.map(|n| format!("refs/tags/approved/{n}"))
|
|
}
|
|
"previous" => {
|
|
let ids = tag_ids(&applied, "proposal").await;
|
|
ids.into_iter()
|
|
.filter(|&n| n < id)
|
|
.max()
|
|
.map(|n| format!("refs/tags/proposal/{n}"))
|
|
}
|
|
other => return error_response(&format!("unknown diff base {other:?}")),
|
|
};
|
|
let Some(base_ref) = base_ref else {
|
|
return plain_text(match base {
|
|
"approved" => "(no earlier approved proposal to diff against)".to_owned(),
|
|
_ => "(no previous proposal to diff against)".to_owned(),
|
|
});
|
|
};
|
|
match git_diff_refs(&applied, &base_ref, &target).await {
|
|
Ok(s) if s.is_empty() => plain_text("(identical — no changes vs this base)".to_owned()),
|
|
Ok(s) => plain_text(s),
|
|
Err(e) => error_response(&format!("git diff: {e:#}")),
|
|
}
|
|
}
|
|
|
|
fn plain_text(body: String) -> Response {
|
|
(StatusCode::OK, body).into_response()
|
|
}
|
|
|
|
/// Minimal Forgejo push-webhook payload — only the fields we care about.
|
|
#[derive(Deserialize)]
|
|
struct PushWebhookPayload {
|
|
#[serde(rename = "ref")]
|
|
git_ref: Option<String>,
|
|
repository: Option<PushWebhookRepo>,
|
|
}
|
|
|
|
#[derive(Deserialize)]
|
|
struct PushWebhookRepo {
|
|
full_name: Option<String>,
|
|
}
|
|
|
|
/// POST `/webhook/knowledge` — Forgejo push webhook for
|
|
/// `internal/knowledge`. Runs `git pull` on the local clone so
|
|
/// agents see up-to-date documents on their next turn.
|
|
///
|
|
/// Expected Forgejo webhook configuration:
|
|
/// - URL: `http://127.0.0.1:<dashboard_port>/webhook/knowledge`
|
|
/// - Event: "Push" (fires on merge commits to main as well)
|
|
///
|
|
/// No signature verification for now; the endpoint is loopback-only
|
|
/// and only triggers a read-only `git pull` on an operator-curated repo.
|
|
async fn post_webhook_knowledge(
|
|
axum::extract::Json(payload): axum::extract::Json<PushWebhookPayload>,
|
|
) -> Response {
|
|
let expected_repo = format!("{}/{}", crate::knowledge::ORG, crate::knowledge::REPO);
|
|
let full_name = payload
|
|
.repository
|
|
.as_ref()
|
|
.and_then(|r| r.full_name.as_deref())
|
|
.unwrap_or("");
|
|
if full_name != expected_repo {
|
|
tracing::debug!(
|
|
full_name,
|
|
"webhook/knowledge: ignoring push from unexpected repo"
|
|
);
|
|
return (StatusCode::OK, "ignored").into_response();
|
|
}
|
|
let git_ref = payload.git_ref.as_deref().unwrap_or("");
|
|
if git_ref != "refs/heads/main" {
|
|
tracing::debug!(git_ref, "webhook/knowledge: ignoring non-main push");
|
|
return (StatusCode::OK, "ignored").into_response();
|
|
}
|
|
tracing::info!("webhook/knowledge: pull triggered by push to {expected_repo}");
|
|
tokio::spawn(async {
|
|
if let Err(e) = crate::knowledge::pull().await {
|
|
tracing::warn!(error = ?e, "webhook/knowledge: pull failed");
|
|
}
|
|
});
|
|
(StatusCode::OK, "ok").into_response()
|
|
}
|