fix(702): replace generic variants with specific ops in PrivRequest

hive-sh4re/src/priv_proto.rs

@@ -3,8 +3,6 @@
 //! Both `hive-priv` (server) and `hive-c0re` (client via `priv_client`)
 //! import these so the shapes stay in sync.
 
-use std::path::PathBuf;
-
 use serde::{Deserialize, Serialize};
 
 /// Default socket path for the privileged helper.
@@ -13,46 +11,72 @@ pub const PRIV_SOCK: &str = "/run/hive/priv.sock";
 /// A request to the privileged helper.
 ///
 /// Wire format: one JSON object per line over `/run/hive/priv.sock`.
+/// Every variant is a specific known operation — no pass-through
+/// shell commands or arbitrary paths. New privileged ops get new
+/// variants.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(tag = "op", rename_all = "snake_case")]
 pub enum PrivRequest {
-    /// Run `nixos-container <args>`.
+    // --- Container lifecycle ---
-    ///
+
-    /// The helper validates that the container argument (second positional
+    /// `nixos-container start <name>`
-    /// arg for verbs that take one) matches a hive-managed name
+    StartContainer { name: String },
-    /// (`h-*`, the manager container, or a known sibling service container).
+
-    ContainerRun { args: Vec<String> },
+    /// `nixos-container stop <name>`
+    StopContainer { name: String },
+
+    /// `nixos-container kill <name>`
+    KillContainer { name: String },
+
+    /// `nixos-container update <name> --flake <flake_ref>`
+    UpdateContainer { name: String, flake_ref: String },
+
+    /// `nixos-container create <name> --flake <flake_ref>`
+    CreateContainer { name: String, flake_ref: String },
+
+    /// `nixos-container destroy <name>`
+    DestroyContainer { name: String },
+
+    /// `nixos-container list`
+    ListContainers,
+
+    // --- Config file writes ---
+
+    /// Overwrite `/etc/nixos-containers/<container>.conf` with new content.
+    /// Written by `lifecycle::set_nspawn_flags` to inject `EXTRA_NSPAWN_FLAGS`.
+    WriteNspawnConf { container: String, content: String },
+
+    /// Write `/run/systemd/system/container@<container>.service.d/hyperhive-limits.conf`
+    /// with `[Service]\nMemoryMax=<memory_max>\nCPUQuota=<cpu_quota>\n`.
+    /// Written by `lifecycle::set_resource_limits`.
+    WriteResourceLimits {
+        container: String,
+        memory_max: String,
+        cpu_quota: String,
+    },
+
+    /// Remove `/run/systemd/system/container@<container>.service.d/` if present.
+    /// Called by `lifecycle::destroy` to clean up the resource-limits drop-in.
+    RemoveServiceDropin { container: String },
+
+    // --- System ---
 
     /// Run `systemctl daemon-reload`.
     DaemonReload,
 
-    /// Overwrite `/etc/nixos-containers/<container>.conf` with new content.
-    WriteNspawnConf { container: String, content: String },
-
-    /// Write a file into the drop-in dir for `container@<container>.service`.
-    ///
-    /// Creates `/run/systemd/system/container@<container>.service.d/<filename>`.
-    WriteSystemdDropin {
-        container: String,
-        filename: String,
-        content: String,
-    },
-
-    /// Remove the drop-in dir for `container@<container>.service`, if present.
-    ///
-    /// Removes `/run/systemd/system/container@<container>.service.d/`.
-    RemoveSystemdDropin { container: String },
-
-    /// `chown(2)` a path under a hive-managed prefix
-    /// (`/run/hive-agent/` or `/var/lib/hyperhive/`).
-    Chown { path: PathBuf, uid: u32, gid: u32 },
-
-    /// `chmod(2)` a path under a hive-managed prefix.
-    Chmod { path: PathBuf, mode: u32 },
-
     /// Reload nginx inside the `hive-gateway` container via
     /// `systemd-run --machine=hive-gateway nginx -s reload`.
     ReloadGatewayNginx,
+
+    // --- Socket dir ownership ---
+
+    /// Set ownership of `/run/hive-agent/<agent_name>/` to `uid:gid`.
+    /// Called by `lifecycle::set_nspawn_flags` after `create_dir_all`.
+    ChownSocketDir { agent_name: String, uid: u32, gid: u32 },
+
+    /// Set mode of `/run/hive-agent/<agent_name>/`.
+    /// Fallback when uid lookup returns `None` on first spawn.
+    ChmodSocketDir { agent_name: String, mode: u32 },
 }
 
 /// Response from the privileged helper.