vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(#2399): agent containers get daemonBins, not the full hivectl/hive-forge bundle

Browse source 
Agent containers pulled in `pkgs.hyperhive` (packages.default: daemonBins +
hivectlPkg + hiveForgePkg) via environment.systemPackages and every
harness ExecStart. That shipped hivectl (a host-admin CLI dialing the
host admin socket, unreachable from inside a container, wrapped with
wireguard-tools for `hivectl wg`) plus a redundant second hive-forge
copy (already provided separately via hive-forge-tools.nix) into every
single agent's closure.

Expose the existing daemonBins split as packages.<system>.daemonBins
(mara: 'there should be split nix outputs already, use those' — no new
grouping derivation) + a hyperhive-daemon overlay entry, and repoint
harness-base.nix's systemPackages entry and all agent-run ExecStarts
(hive-agent, hive-agent-mcp, hive-bash-daemon, hive-matrix-daemon) plus
the bash/matrix MCP bridge commands at it instead of the full bundle.

nix flake check: daemonBins + agent-base-toplevel + ruth-toplevel all
evaluate cleanly (docs derivation failure is a preexisting dirty-tree
issue, unrelated).
This commit is contained in:
atlas 2026-07-13 17:32:29 +02:00 • committed by mara
commit 5c08abc1b2
2 changed files with 32 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

15
flake.nix
View file

@ -257,6 +257,17 @@
# only want the CLI(s) without the daemon binaries.
hivectl = hivectlPkg;
hive-forge = hiveForgePkg;
# The daemon/harness/MCP bins alone, no `hivectl` and no second
# `hive-forge` copy. Agent containers use this (via the
# `hyperhive-daemon` overlay output below) instead of `default` —
# they need `hive-agent{,-mcp,-wake}` /
# `hive-bash-{daemon,mcp}` / `hive-matrix-{daemon,mcp}`, never
# the operator-only `hivectl` (dials the *host* admin socket,
# unreachable from inside a container, and drags in
# `wireguard-tools` as a wrapper dep) or a redundant `hive-forge`
# (already on agent PATH via `hive-forge-tools.nix`) — this is
# the fix for the agent-derivation-bloat report.
daemonBins = daemonBins;
# Bundled browser assets — see ./nix/frontend.nix. Output is
# $out/{dashboard,agent}/ which the Rust binaries serve via
# tower_http::ServeDir.
@ -316,6 +327,10 @@
overlays = {
default = final: prev: {
hyperhive = self.packages.${prev.stdenv.hostPlatform.system}.default;
# Agent-scoped subset of `hyperhive` — daemon/harness/MCP bins
# only, no `hivectl` / no redundant `hive-forge` copy. See
# `packages.<system>.daemonBins` above.
hyperhive-daemon = self.packages.${prev.stdenv.hostPlatform.system}.daemonBins;
# Bundled frontend dist (see ./nix/frontend.nix). Output is
# $out/{dashboard,agent}/; consumers pick the surface they
# need. Exposed via the overlay so containers' nix evaluations

24
nix/templates/harness-base.nix
View file

@ -1276,7 +1276,7 @@ in
hyperhive.extraMcpServers = lib.mkMerge [
{
bash = lib.mkDefault {
command = "${pkgs.hyperhive}/bin/hive-bash-mcp";
command = "${pkgs.hyperhive-daemon}/bin/hive-bash-mcp";
args = [ ];
env.HIVE_BASH_SOCKET = "/run/hive-bash/socket";
allowedTools = [ "*" ];
@ -1284,7 +1284,7 @@ in
}
(lib.mkIf config.hyperhive.matrix.enable {
matrix = lib.mkDefault {
command = "${pkgs.hyperhive}/bin/hive-matrix-mcp";
command = "${pkgs.hyperhive-daemon}/bin/hive-matrix-mcp";
args = [ ];
# Same socket path the hive-matrix-daemon service binds
# via its `RuntimeDirectory = "hive-matrix"`. Keeps the
@ -1636,7 +1636,17 @@ in
environment.systemPackages =
with pkgs;
[
hyperhive
# Agent-scoped subset of `pkgs.hyperhive` — daemon/harness/MCP
# bins the harness itself execs (see the ExecStarts above) plus
# whatever else lands on PATH for claude's Bash tool. Deliberately
# NOT the full `pkgs.hyperhive` bundle: that also carries `hivectl`
# (a host-admin CLI that dials the *host* admin socket — useless
# and unreachable from inside a container — wrapped with
# `wireguard-tools` for `hivectl wg`) and a second, redundant
# `hive-forge` copy (already provided below via
# `hive-forge-tools.nix`) — closure bloat + dead surface with no
# functional upside inside a container.
hyperhive-daemon
claude-code
bashInteractive
coreutils-full
@ -1946,7 +1956,7 @@ in
HIVE_ICON_PNG = "${iconPng}";
};
serviceConfig = {
ExecStart = "${pkgs.hyperhive}/bin/hive-matrix-daemon";
ExecStart = "${pkgs.hyperhive-daemon}/bin/hive-matrix-daemon";
SyslogIdentifier = "hive-matrix-daemon";
Restart = "on-failure";
RestartSec = 5;
@ -2002,7 +2012,7 @@ in
# less robust if the two vars ever diverge.
};
serviceConfig = {
ExecStart = "${pkgs.hyperhive}/bin/hive-bash-daemon";
ExecStart = "${pkgs.hyperhive-daemon}/bin/hive-bash-daemon";
SyslogIdentifier = "hive-bash-daemon";
Restart = "on-failure";
RestartSec = 3;
@ -2036,7 +2046,7 @@ in
before = [ "hive-ag3nt.service" ];
environment.RUST_LOG = "info";
serviceConfig = {
ExecStart = "${pkgs.hyperhive}/bin/hive-agent-mcp --http 127.0.0.1:${toString config.hyperhive.mcp.httpPort}";
ExecStart = "${pkgs.hyperhive-daemon}/bin/hive-agent-mcp --http 127.0.0.1:${toString config.hyperhive.mcp.httpPort}";
SyslogIdentifier = "hive-mcp-http";
# `always` (not `on-failure`): this endpoint is load-bearing — the
# sole hyperhive-MCP transport, so a down window is total
@ -2167,7 +2177,7 @@ in
HIVE_EXTRA_WEB_PROXIES = builtins.toJSON config.hyperhive.extraWebProxies;
};
serviceConfig = {
ExecStart = "${pkgs.hyperhive}/bin/${binary}";
ExecStart = "${pkgs.hyperhive-daemon}/bin/${binary}";
# Pin the journal identity to the binary name (otherwise systemd
# derives SyslogIdentifier from the ExecStart basename).
SyslogIdentifier = binary;