remove the list_containers and request_update_meta_inputs MCP tools
Both agent-facing tools go away end to end, with no replacement. This is an intentional capability removal: agents can no longer enumerate their own subtree, and can no longer queue a meta-flake input bump. The system prompt and docs/tools/lifecycle.md land in this same commit on purpose. A tool named in the prompt but absent from the server makes agents confidently call something that doesn't exist, and the failure then surfaces far from its cause. Removed: - MCP registrations and bodies (hive-agent-mcp), plus the now-unused UpdateMetaInputsArgs. - Wire variants Request::ListDescendants, Request::RequestUpdateMetaInputs and Response::Containers, plus ContainerInfo, whose only consumer was that response. - hive-c0re's handle_list_descendants (its whole module) and handle_request_update_meta_inputs, the two dispatch arms, and the require_group(agent, "approvals", ...) gate on the meta-inputs verb. - The stream_enrich emoji entry and argument formatter. - docs/tools/lifecycle.md (both tools it documented are gone), its two referrers, the tool-group tables and the agent-hierarchy prose. Tool groups are kept, deliberately. ToolGroup::Lifecycle listed exactly one tool and now lists none — it is vestigial, but the variant stays so existing meta/capabilities.json grants still parse; retiring it is a separate decision. ToolGroup::Approvals also listed exactly one tool, but the group is NOT dead: check_can_cancel_approval still gates cancel_loose_end's approval-cancel arm on it server-side. ApprovalKind::UpdateMetaInputs stays too. Nothing in production code produces it any more, but pre-existing approval rows may still carry it, and the operator's own path to a meta update is unaffected — the dashboard's POST /api/meta-update inserts the meta_update job directly, bypassing approvals entirely. The two format_ack tests in hive-agent-mcp that named request_update_meta_inputs were only using it as a label string while exercising the generic OkWarn/Ok renderer, so they are retargeted to a surviving tool rather than deleted. Note hive-c0re's priv_client::list_containers is a different thing (the host-side privileged container listing behind hive-priv) and is untouched. Closes #4591
This commit is contained in:
atlas
mara
parent
8614cb2613
commit
b88a5b2430
18 changed files with 74 additions and 356 deletions
|
|
@ -96,7 +96,6 @@ umount-old / mount-new / restart-cascade step.
|
|||
| config change via forge PR (any descendant's config) | any ancestor |
|
||||
| moderate reminders (cancel any open thread of a descendant) | any ancestor |
|
||||
| `send` / `recv` routing | parent ↔ same-parent siblings ↔ self ↔ descendants; explicit allow-list for anyone else |
|
||||
| `request_update_meta_inputs` (bump meta lock) | root agents only (today: just `manager`) |
|
||||
|
||||
"Ancestor" walks `ContainerView.parent` chains; a visited-set guards against
|
||||
cycles at dispatch time (a malformed `topology.json` can't lock
|
||||
|
|
@ -116,14 +115,11 @@ other agents don't:
|
|||
approval step — every other agent goes through a `Spawn` approval.
|
||||
Topology-wise, `ruth` is still just another root agent.
|
||||
- **Wire-protocol** — the privileged `Request` variants
|
||||
(`Kill` / `Start` / `Restart` / `Update`;
|
||||
`GetLogs`; `RequestUpdateMetaInputs`) — marked `*(privileged)*` in
|
||||
`hive-core-agent-sock`'s unified `Request` enum — are reachable only
|
||||
from the manager's socket flavour today. Planned rule for each is in the
|
||||
table above ("any ancestor" for lifecycle/logs);
|
||||
`RequestUpdateMetaInputs` stays
|
||||
a root-only capability even post-milestone, not a topology rule.
|
||||
One exception: `Wake` (inject a `from: <X>` message into the
|
||||
(`Kill` / `Start` / `Restart` / `Update`; `GetLogs`) — marked
|
||||
`*(privileged)*` in `hive-core-agent-sock`'s unified `Request` enum —
|
||||
are reachable only from the manager's socket flavour today. Planned
|
||||
rule for each is in the table above ("any ancestor" for
|
||||
lifecycle/logs). One exception: `Wake` (inject a `from: <X>` message into the
|
||||
caller's own inbox) isn't really privileged — every per-agent daemon
|
||||
(for example `hive-forge-notify`) needs it, and sub-agents already have the
|
||||
equivalent on their own socket.
|
||||
|
|
@ -135,9 +131,10 @@ other agents don't:
|
|||
deploy log). Planned: each agent gets RW to `/agents/<descendant>/`
|
||||
for just its own subtree — the manager's full-forest RW becomes the
|
||||
"root's subtree is everything" case of that same rule. hive-c0re will
|
||||
gate RO `/meta` access on a "meta read" capability; only
|
||||
`request_update_meta_inputs` writes `flake.lock`, gated by its own
|
||||
capability.
|
||||
gate RO `/meta` access on a "meta read" capability; no agent-facing
|
||||
path writes `flake.lock` any more — `request_update_meta_inputs` was
|
||||
removed, leaving the operator dashboard's `POST
|
||||
/api/meta-update` as the only entry point.
|
||||
- **Prompt/tools** — the system prompt uses `<!-- role:agent -->` /
|
||||
`<!-- role:manager -->` marker blocks, and a `Flavor::{Agent,
|
||||
Manager}` switch picks the MCP tool allow-list claude sees. Both are
|
||||
|
|
|
|||
|
|
@ -310,8 +310,8 @@ binary flavor.
|
|||
| `meta` | `get_agent_meta` (`set_status` is always-on, see below) |
|
||||
| `inbox` | `get_loose_ends`, `cancel_loose_end`, `remind` |
|
||||
| `execution` | vestigial — `mcp__bash__run` / `mcp__bash__status` are always available unconditionally via `extraMcpServers`; this group's entries expand to non-existent `mcp__hyperhive__run` / `mcp__hyperhive__status` and have no effect. See `docs/tools/bash.md`. |
|
||||
| `lifecycle` | `list_containers` *(privileged)* |
|
||||
| `approvals` | `request_update_meta_inputs` *(privileged)* |
|
||||
| `lifecycle` | none — `list_containers` no longer exists, with no replacement; the variant survives only so existing grants parse. |
|
||||
| `approvals` | none — `request_update_meta_inputs` no longer exists, with no replacement. Still a live server-side gate: `cancel_loose_end`'s approval-cancel arm requires it. |
|
||||
| `scheduling` | `request_schedule_prompt`, `fire_schedule_now`, `cancel_schedule`, `edit_schedule`, `list_schedules` *(privileged)* |
|
||||
| `forge` | `create_repo` — create git repos through hive-c0re (operator-gated merge) |
|
||||
| `web_tools` | none (gates the Claude built-ins `WebFetch`/`WebSearch`, not an MCP tool) |
|
||||
|
|
@ -391,7 +391,7 @@ bypass the operator approval gate.
|
|||
`hive-sh4re/src/permissions.rs` + an arm to `as_str`. Add it to `Capability::ALL`
|
||||
(the source of truth for the permissions UI columns). Implement the access
|
||||
check in the relevant handler (`hive-c0re/src/socket_server/mod.rs`,
|
||||
`hive-c0re/src/socket_server/lifecycle_handlers.rs`, `coordinator.rs`, or a
|
||||
`hive-c0re/src/socket_server/schedules.rs`, `coordinator.rs`, or a
|
||||
handler under `hive-c0re/src/dashboard/`).
|
||||
|
||||
## Async forms
|
||||
|
|
|
|||
|
|
@ -40,8 +40,6 @@ debug agent behavior.
|
|||
- **[forge-cli](forge-cli.md)** — the exhaustive, autogenerated
|
||||
flag-by-flag reference for `hive-forge`, kept in lockstep with the
|
||||
binary by CI the same way `hivectl-cli.md` is.
|
||||
- **[lifecycle](lifecycle.md)** — listing the agents in a caller's own
|
||||
subtree, plus the approval-gated config-change tools.
|
||||
- **[matrix](matrix.md)** — the matrix MCP tool surface
|
||||
(`mcp__matrix__*`) for agents with a matrix account, multiple
|
||||
accounts per agent, and declaring extra MCP servers generally.
|
||||
|
|
|
|||
|
|
@ -1,58 +0,0 @@
|
|||
# Lifecycle and approvals tools
|
||||
|
||||
Two tool groups govern agent lifecycle management and config changes.
|
||||
The server scopes both to the caller's **own subtree** (topology-enforced
|
||||
per `topology.json`: a child, a child's child, every agent below them —
|
||||
plus the caller itself). No privileged class exists to belong to; the
|
||||
root agent reaches every agent purely because the check is transitive and
|
||||
everything sits under it.
|
||||
|
||||
## `lifecycle` tool group
|
||||
|
||||
No operator approval required. The caller's own subtree.
|
||||
|
||||
### `list_containers()`
|
||||
|
||||
List the caller's whole **subtree** with running status — children,
|
||||
their children, every agent below them. The calling agent is part of its
|
||||
own subtree, so it appears in its own listing; a leaf agent gets a
|
||||
one-row answer naming itself.
|
||||
|
||||
## `approvals` tool group
|
||||
|
||||
Meta-flake input bumps route through the operator approval queue.
|
||||
|
||||
Creating a new agent is **not** in this group — agents have no tool for
|
||||
it. The swarm controller's `InitAgentConfigRepo` job scaffolds a new
|
||||
agent's config repo (`POST /api/agents`, see
|
||||
`swarm-controller/`), and the operator spawns the container from the
|
||||
dashboard (`◆ R3QU3ST SP4WN` / `Spawn` approval, routed via
|
||||
`HostRequest::RequestSpawn`).
|
||||
|
||||
Config changes on an existing agent go through a **forge PR** on the
|
||||
agent's `agent-configs/<name>` repo (queues a `MergeConfigPr` approval
|
||||
on open/update — no MCP tool involved), not a tool call. See
|
||||
`docs/agent-lifecycle/approvals.md`.
|
||||
|
||||
### `request_update_meta_inputs(inputs?, description?)`
|
||||
|
||||
Queue an approval to run `nix flake update [inputs...]` on the meta
|
||||
flake. Pass specific input names (for example `["bitburner-agent"]`) or omit
|
||||
/ pass `[]` for all inputs. Returns immediately; the lock update runs
|
||||
on operator approval.
|
||||
|
||||
**Doesn't** trigger container rebuilds — the operator rebuilds affected
|
||||
agents after the approval resolves.
|
||||
|
||||
## Boundary summary
|
||||
|
||||
| Operation | Requires approval? | Scope |
|
||||
| ---------------------------- | ------------------ | ---------------------------- |
|
||||
| `list_containers` | No | Own subtree, caller included |
|
||||
| `request_update_meta_inputs` | Yes (MetaUpdate) | Meta flake (global) |
|
||||
|
||||
## See also
|
||||
|
||||
- [`docs/agent-lifecycle/approvals.md`](../agent-lifecycle/approvals.md) — full approval flow, kinds,
|
||||
helper events (`approval_resolved`), flake.lock
|
||||
validation.
|
||||
|
|
@ -130,9 +130,13 @@ hive_name?, swarm_name?, matrix_accounts? }`. `matrix_accounts` is a
|
|||
- **Subagent spawning** — headless claude sub-instances as background
|
||||
tasks, shipped default-on like bash execution (no tool group gates it
|
||||
yet). See [`docs/tools/subagent.md`](../tools/subagent.md).
|
||||
- **Lifecycle + config** (`lifecycle`, `approvals`) — list the child
|
||||
agents in your own subtree, apply config commits. See
|
||||
[`docs/tools/lifecycle.md`](../tools/lifecycle.md).
|
||||
- **Lifecycle + config** (`lifecycle`, `approvals`) — neither group
|
||||
carries an MCP tool any more: `list_containers` and
|
||||
`request_update_meta_inputs` no longer exist, with no
|
||||
replacement. `approvals` survives as a server-side gate on
|
||||
`cancel_loose_end`'s approval-cancel arm; `lifecycle` gates nothing.
|
||||
Config changes go through a forge PR on `agent-configs/<name>` — see
|
||||
[`docs/agent-lifecycle/approvals.md`](../agent-lifecycle/approvals.md).
|
||||
- **Scheduling** (`scheduling`) — scheduled prompts. See
|
||||
[`docs/tools/scheduling.md`](../tools/scheduling.md).
|
||||
- **Forge repos** (`forge`) — `create_repo` — the only agent path to
|
||||
|
|
|
|||
Loading…
Reference in a new issue