mcp: remove the restart/kill/start/update/get_logs agent verbs
Container lifecycle from inside an agent goes away: an agent no longer starts, stops, restarts or rebuilds a container in its subtree, and no longer reads another container's journal. Those are operator actions — the dashboard and hivectl keep their own paths to the same job-queue and hive-priv plumbing, which is why none of that machinery is removed here, only the five MCP verbs and what they alone reached. What went with them: the `Request` variants and `Response::Logs` on the agent socket, the five tool definitions and their arg structs, the four lifecycle handlers plus `handle_get_logs`, and `require_descendant` — the topology guard those five were the only remaining callers of. `ToolGroup::Diagnostics` goes too: `get_logs` was its only tool, so it would otherwise be a grantable group that grants nothing. `lifecycle` stays, now carrying `list_containers` alone. An agent that gets a `needs_update` or `container_crash` helper event has no remedy of its own left, so the system prompt and the docs now send it to the operator instead of to a tool that no longer exists. Refs #4480
This commit is contained in:
atlas
mara
parent
c5f60fd58f
commit
87970a8c93
17 changed files with 48 additions and 450 deletions
|
|
@ -89,9 +89,7 @@ umount-old / mount-new / restart-cascade step.
|
|||
|
||||
| operation | who can do it |
|
||||
| ----------------------------------------------------------- | --------------------------------------------------------------------------------------- |
|
||||
| `kill` / `start` / `restart` / `update` (any descendant) | any ancestor |
|
||||
| config change via forge PR (any descendant's config) | any ancestor |
|
||||
| `get_logs` (any descendant) | any ancestor |
|
||||
| moderate reminders (cancel any open thread of a descendant) | any ancestor |
|
||||
| `send` / `recv` routing | parent ↔ same-parent siblings ↔ self ↔ descendants; explicit allow-list for anyone else |
|
||||
| `request_update_meta_inputs` (bump meta lock) | root agents only (today: just `manager`) |
|
||||
|
|
|
|||
|
|
@ -617,10 +617,10 @@ root agent. Variants (`hive_sh4re::manager::HelperEvent`):
|
|||
tombstone, three `POLL_INTERVAL`s — closes the race where a
|
||||
lifecycle op finishes between two crash-watch polls and the
|
||||
container shows briefly as "stopped without transient" before
|
||||
the next start). The root agent can `start` it again or escalate.
|
||||
the next start). The root agent escalates to the operator, who
|
||||
starts it again from the dashboard.
|
||||
- `NeedsUpdate { agent }` — sub-agent's recorded flake rev is
|
||||
stale. The root agent calls `update(name)` to rebuild — idempotent,
|
||||
no approval required.
|
||||
stale. The operator rebuilds it from the dashboard.
|
||||
|
||||
The remaining lower-urgency lifecycle notices — `Rebuilt`, `Killed`,
|
||||
`Destroyed`, `NeedsLogin`, `LoggedIn` — are "FYI, check
|
||||
|
|
|
|||
|
|
@ -310,10 +310,9 @@ binary flavor.
|
|||
| `meta` | `get_agent_meta` (`set_status` is always-on, see below) |
|
||||
| `inbox` | `get_loose_ends`, `cancel_loose_end`, `remind` |
|
||||
| `execution` | vestigial — `mcp__bash__run` / `mcp__bash__status` are always available unconditionally via `extraMcpServers`; this group's entries expand to non-existent `mcp__hyperhive__run` / `mcp__hyperhive__status` and have no effect. See `docs/tools/bash.md`. |
|
||||
| `lifecycle` | `kill`, `start`, `restart`, `update`, `list_containers` *(privileged)* |
|
||||
| `lifecycle` | `list_containers` *(privileged)* |
|
||||
| `approvals` | `request_update_meta_inputs` *(privileged)* |
|
||||
| `scheduling` | `request_schedule_prompt`, `fire_schedule_now`, `cancel_schedule`, `edit_schedule`, `list_schedules` *(privileged)* |
|
||||
| `diagnostics` | `get_logs` *(privileged)* |
|
||||
| `forge` | `create_repo` — create git repos through hive-c0re (operator-gated merge) |
|
||||
| `web_tools` | none (gates the Claude built-ins `WebFetch`/`WebSearch`, not an MCP tool) |
|
||||
|
||||
|
|
|
|||
|
|
@ -40,12 +40,10 @@ debug agent behavior.
|
|||
- **[forge-cli](forge-cli.md)** — the exhaustive, autogenerated
|
||||
flag-by-flag reference for `hive-forge`, kept in lockstep with the
|
||||
binary by CI the same way `hivectl-cli.md` is.
|
||||
- **[lifecycle](lifecycle.md)** — kill/start/restart/update for the
|
||||
agents in a caller's own subtree, plus the approval-gated
|
||||
config-change tools.
|
||||
- **[lifecycle](lifecycle.md)** — listing the agents in a caller's own
|
||||
subtree, plus the approval-gated config-change tools.
|
||||
- **[matrix](matrix.md)** — the matrix MCP tool surface
|
||||
(`mcp__matrix__*`) for agents with a matrix account, multiple
|
||||
accounts per agent, and declaring extra MCP servers generally.
|
||||
- **[scheduling](scheduling.md)** — scheduled prompts (operator
|
||||
approval required) and the diagnostics tools (`get_logs`,
|
||||
`get_host_journal`).
|
||||
approval required) and the `get_host_journal` diagnostics tool.
|
||||
|
|
|
|||
|
|
@ -11,25 +11,6 @@ everything sits under it.
|
|||
|
||||
No operator approval required. The caller's own subtree.
|
||||
|
||||
### `kill(name)`
|
||||
|
||||
Graceful stop. Container state is preserved; recreating the agent
|
||||
reuses prior config and credentials.
|
||||
|
||||
### `start(name)`
|
||||
|
||||
Start a stopped sub-agent.
|
||||
|
||||
### `restart(name)`
|
||||
|
||||
Stop + start in one call.
|
||||
|
||||
### `update(name)`
|
||||
|
||||
Rebuild: re-applies the current hyperhive flake + `agent.nix`,
|
||||
then restarts. Idempotent — safe to call repeatedly. Used in response
|
||||
to `needs_update` system events.
|
||||
|
||||
### `list_containers()`
|
||||
|
||||
List the caller's whole **subtree** with running status — children,
|
||||
|
|
@ -60,16 +41,15 @@ flake. Pass specific input names (for example `["bitburner-agent"]`) or omit
|
|||
/ pass `[]` for all inputs. Returns immediately; the lock update runs
|
||||
on operator approval.
|
||||
|
||||
**Doesn't** trigger container rebuilds — call `update(name)` on affected
|
||||
**Doesn't** trigger container rebuilds — the operator rebuilds affected
|
||||
agents after the approval resolves.
|
||||
|
||||
## Boundary summary
|
||||
|
||||
| Operation | Requires approval? | Scope |
|
||||
| --------------------------------------- | ------------------ | ---------------------------- |
|
||||
| `kill` / `start` / `restart` / `update` | No | Own subtree |
|
||||
| `list_containers` | No | Own subtree, caller included |
|
||||
| `request_update_meta_inputs` | Yes (MetaUpdate) | Meta flake (global) |
|
||||
| Operation | Requires approval? | Scope |
|
||||
| ---------------------------- | ------------------ | ---------------------------- |
|
||||
| `list_containers` | No | Own subtree, caller included |
|
||||
| `request_update_meta_inputs` | Yes (MetaUpdate) | Meta flake (global) |
|
||||
|
||||
## See also
|
||||
|
||||
|
|
|
|||
|
|
@ -61,17 +61,6 @@ and `last_result`, `next_fire_at_unix`, `interval_seconds`. Use to
|
|||
look up an id before cancelling, or to audit upcoming wake-ups in
|
||||
your subtree.
|
||||
|
||||
## `diagnostics` tool group
|
||||
|
||||
### `get_logs(agent, lines?)`
|
||||
|
||||
Fetch recent journal lines for a sub-agent container. Useful for
|
||||
diagnosing MCP-registration failures, startup crashes, plugin install
|
||||
errors, or any harness issue you can't see from inside the container.
|
||||
|
||||
Pass the plain logical agent name (for example `"gui"`) — hive-c0re resolves
|
||||
the machine name (`h-<name>`). `lines` defaults to 50, host-capped at 500.
|
||||
|
||||
## `read_host_journal` capability
|
||||
|
||||
Capability-gated (not a tool group) — the operator enables it in the
|
||||
|
|
|
|||
|
|
@ -20,8 +20,8 @@ for what reaches a subagent's own `--mcp-config` and what doesn't.
|
|||
|
||||
Tool groups (`HIVE_TOOL_GROUPS`) gate tool access. The default
|
||||
preset (`AGENT_DEFAULT`) includes `messaging`, `meta`, `inbox`, and
|
||||
`execution`. Privileged groups (`lifecycle`, `approvals`, `scheduling`,
|
||||
`diagnostics`) are opt-in via the P3RM1SS10NS tab.
|
||||
`execution`. Privileged groups (`lifecycle`, `approvals`, `scheduling`)
|
||||
are opt-in via the P3RM1SS10NS tab.
|
||||
|
||||
## Core tools (always available)
|
||||
|
||||
|
|
@ -135,11 +135,10 @@ hive_name?, swarm_name?, matrix_accounts? }`. `matrix_accounts` is a
|
|||
- **Subagent spawning** — headless claude sub-instances as background
|
||||
tasks, shipped default-on like bash execution (no tool group gates it
|
||||
yet). See [`docs/tools/subagent.md`](../tools/subagent.md).
|
||||
- **Lifecycle + config** (`lifecycle`, `approvals`) — manage child
|
||||
agents, spawn new ones, apply config commits. See
|
||||
- **Lifecycle + config** (`lifecycle`, `approvals`) — list the child
|
||||
agents in your own subtree, apply config commits. See
|
||||
[`docs/tools/lifecycle.md`](../tools/lifecycle.md).
|
||||
- **Scheduling + diagnostics** (`scheduling`, `diagnostics`) —
|
||||
scheduled prompts, `get_logs`. See
|
||||
- **Scheduling** (`scheduling`) — scheduled prompts. See
|
||||
[`docs/tools/scheduling.md`](../tools/scheduling.md).
|
||||
- **Forge repos** (`forge`) — `create_repo` — the only agent path to
|
||||
create a repo under the `agents/` org (direct forge token creation is
|
||||
|
|
|
|||
|
|
@ -453,7 +453,7 @@ named buckets of MCP tools; each agent starts with a role default
|
|||
(sub-agents: `messaging`, `meta`, `inbox`, `execution` —
|
||||
`ToolGroup::AGENT_DEFAULT`; hive-c0re seeds the root agent to
|
||||
`ToolGroup::MANAGER_DEFAULT` — `messaging`, `meta`, `inbox`,
|
||||
`lifecycle`, `approvals`, `scheduling`, `diagnostics`, `execution`,
|
||||
`lifecycle`, `approvals`, `scheduling`, `execution`,
|
||||
that is, every group except `forge` and `web_tools`). Checking /
|
||||
unchecking stages which groups are active for the agent; the
|
||||
page-level **save all** button (below) commits it. Columns come from
|
||||
|
|
@ -461,7 +461,7 @@ page-level **save all** button (below) commits it. Columns come from
|
|||
takes effect.
|
||||
|
||||
The current tool groups are: `messaging`, `meta`, `inbox`, `lifecycle`,
|
||||
`approvals`, `scheduling`, `diagnostics`, `forge`, `execution`,
|
||||
`approvals`, `scheduling`, `forge`, `execution`,
|
||||
`web_tools`. All listed in `ToolGroup::ALL` in `hive-sh4re`. The
|
||||
`web_tools` group is special: it carries no MCP tools; instead it adds
|
||||
Claude's built-in `WebFetch` and `WebSearch` to `--tools` /
|
||||
|
|
|
|||
Loading…
Reference in a new issue