fix(#1164,#1171): harness writes status file, c0re just rescans

hive-c0re/src/agent_server.rs

@@ -239,29 +239,13 @@ pub(crate) async fn dispatch_shared(
             if let Err(message) = crate::limits::check_status_text(text) {
                 return Some(hive_sh4re::Response::Err { message });
             }
-            let path =
-                crate::coordinator::Coordinator::agent_notes_dir(agent).join("hyperhive-status");
-            let result = if text.trim().is_empty() {
-                std::fs::remove_file(&path).or_else(|e| {
-                    if e.kind() == std::io::ErrorKind::NotFound {
-                        Ok(())
-                    } else {
-                        Err(e)
-                    }
-                })
-            } else {
-                std::fs::write(&path, format!("{}\n", text.trim()))
-            };
-            match result {
-                Ok(()) => {
-                    let coord2 = Arc::clone(coord);
-                    tokio::spawn(async move { coord2.rescan_containers_and_emit().await });
-                    hive_sh4re::Response::Ok
-                }
-                Err(e) => hive_sh4re::Response::Err {
-                    message: format!("set_status write failed: {e}"),
-                },
-            }
+            // The harness writes the status file to its own `state/` dir
+            // before sending this request (it runs as the agent user, so
+            // it has write access). We just trigger a dashboard rescan so
+            // the new value is reflected immediately.
+            let coord2 = Arc::clone(coord);
+            tokio::spawn(async move { coord2.rescan_containers_and_emit().await });
+            hive_sh4re::Response::Ok
         }
         hive_sh4re::Request::GetAgentMeta { name } => {
             let target = name.as_deref().unwrap_or(agent);

hive-c0re/src/container_view.rs

@@ -303,7 +303,17 @@ fn auth_failed_sentinel(name: &str) -> bool {
 pub fn read_agent_status(name: &str) -> (Option<String>, Option<i64>) {
     let path = Coordinator::agent_notes_dir(name).join("hyperhive-status");
     let meta = std::fs::metadata(&path).ok();
-    let s = std::fs::read_to_string(&path).ok();
+    // Read at most STATUS_MAX_CHARS * 4 + 2 bytes: 4 is the max UTF-8 byte
+    // width per char, +2 for the trailing newline. Guards against a
+    // pathologically large file written outside the harness validation path.
+    let s = {
+        use std::io::Read as _;
+        std::fs::File::open(&path).ok().and_then(|f| {
+            let cap = (crate::limits::STATUS_MAX_CHARS * 4 + 2) as u64;
+            let mut buf = String::new();
+            f.take(cap).read_to_string(&mut buf).ok().map(|_| buf)
+        })
+    };
     let text = s
         .as_deref()
         .map(str::trim)

hive-c0re/src/limits.rs

@@ -48,6 +48,9 @@ pub fn check_size(label: &str, body: &str) -> Result<(), String> {
 /// payload. Cap at 200 chars to fit the chip plus a little
 /// descriptive padding without forcing the operator to read a
 /// scrolling chunk.
+/// NOTE: `hive-ag3nt/src/mcp.rs::write_status_file` mirrors this constant
+/// client-side so invalid text is caught before the file is written.
+/// Keep in sync if this value changes.
 pub const STATUS_MAX_CHARS: usize = 200;
 
 /// Validate a `set_status` payload. Single-line + bounded so