From a05d093d19599842a41ed5ec68adfe84d85b8c52 Mon Sep 17 00:00:00 2001 From: damocles Date: Wed, 1 Jul 2026 18:31:31 +0200 Subject: [PATCH] harden hive-mcp-http: restart=always + document failure-mode/port-collision (atlas review) --- nix/templates/harness-base.nix | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix index eb921254..e7b0fdb5 100644 --- a/nix/templates/harness-base.nix +++ b/nix/templates/harness-base.nix @@ -853,6 +853,17 @@ in `allowed_hosts` (`localhost` / `127.0.0.1` / `::1`) rejects Host headers from anywhere else, so no auth token is required for a container-local endpoint. + + Failure-mode note: enabling this flips the MCP surface from a + transient self-healing race (stdio child re-registers each turn) + to a hard dependency on the `hive-mcp-http` daemon's uptime — while + it's up there is no race ever, but while it's down claude hits a + dead URL with no stdio fallback until the unit restarts (guarded by + `Restart=always`, `RestartSec=3`). Net-better when up; operators + should know the signature flips from "flaps + recovers" to "dead + until the unit restarts". Also pick a port unique per host: two + agents sharing a host that both set the same `httpPort` collide on + bind and the loser Restart-loops. ''; }; @@ -1757,7 +1768,12 @@ in serviceConfig = { ExecStart = "${pkgs.hyperhive}/bin/hive mcp --http 127.0.0.1:${toString config.hyperhive.mcp.httpPort}"; SyslogIdentifier = "hive-mcp-http"; - Restart = "on-failure"; + # `always` (not `on-failure`): this endpoint is load-bearing when + # `httpPort` is set — a down window is total hyperhive-MCP loss with + # no stdio fallback and no per-turn self-heal (the URL just stays + # dead). `always` also covers any unforeseen clean-return path and + # restarts after a stray SIGTERM stops it out from under the harness. + Restart = "always"; RestartSec = 3; User = userName; Group = userName;