vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-c0re stops owning scheduled prompts; agents lose the schedule tools

Browse source 
Scheduled prompts are swarm-level now (swarmctl schedule, #4936). The hive
keeps the rows it has only so the operator can copy them over.

- hive-c0re no longer fires anything: the scheduled-prompts worker is gone,
  and with it every create/edit/cancel/pause/resume/fire path (dashboard
  endpoints, agent-socket verbs, the SchedulePrompt approval kind and its
  approve handler). The store keeps open + list; GET /api/schedules stays.
- A v6 approvals migration drops schedule_prompt rows.
- Nothing submits approvals any more, so the submit path goes too:
  Approvals::submit_kind (now a test fixture), the ApprovalAdded dashboard
  event and its emitter.
- Coordinator::push_todo, whose only caller was the worker, goes, and with
  it hive_host_sock::agent_todo_socket and hive-c0re's hive-agent-sock /
  hive-sock-client deps.
- The schedules_changed dashboard event goes; nothing mutates the rows.
- Agents lose request_schedule_prompt, cancel_schedule, fire_schedule_now,
  edit_schedule and list_schedules, the `scheduling` tool group, their
  system-prompt line and their transcript formatters. `remind` is unchanged.
This commit is contained in:
atlas 2026-10-04 21:23:18 +02:00
commit c3a54bbdd0
31 changed files with 273 additions and 3124 deletions
Download patch file Download diff file Expand all files Collapse all files

4
hive-agent-mcp/README.md
View file

@ -9,8 +9,8 @@ would hit. HTTP is the sole transport; there is no stdio mode here.
## When to use it
This is where the core hyperhive tool surface lives: `send`, `recv`,
`remind`, `get_loose_ends`, `set_status`,
`get_agent_meta`, scheduling, and the approval-request tools. Reach
`remind`, `get_loose_ends`, `set_status`
and `get_agent_meta`. Reach
for this crate when you're adding or changing a built-in tool rather
than an `extraMcpServers` add-on — those are separate stdio bridges
(see `hive-bash-mcp`, `hive-matrix-mcp`) that dial the harness socket

88
hive-agent-mcp/src/mcp/args.rs
View file

@ -94,7 +94,7 @@ pub struct CompactArgs {
}
// -----------------------------------------------------------------------------
// Privileged tool arg types (lifecycle, approvals, scheduling)
// Privileged tool arg types (lifecycle, approvals)
// -----------------------------------------------------------------------------
#[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
@ -123,89 +123,3 @@ pub struct CancelLooseEndArgs {
/// Row id from the matching `get_loose_ends` entry.
pub id: i64,
}
#[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
pub struct RequestSchedulePromptArgs {
/// Recipient agents — one schedule fires to many inboxes at the
/// scheduled time. `operator` is not a valid target — she isn't a
/// container with a todo inbox to push a wake into, and this is
/// for fanning a prompt out to agents, not scheduling something
/// at her.
pub targets: Vec<String>,
/// Message body delivered to each target's inbox at fire time.
/// Same size budget as `send` bodies.
pub body: String,
/// Absolute unix timestamp (seconds) for the FIRST fire. For
/// recurring schedules the worker re-arms in
/// `interval_seconds` steps from this point on.
pub first_fire_at_unix: i64,
/// `None` / absent = one-shot. `Some(n > 0)` = recurring every
/// `n` seconds. The worker clamps catch-up so a long downtime
/// fires ONCE on resume (skipped-cycle count surfaces in the
/// per-target `last_result`), not N delayed pulses in a row.
#[serde(default)]
pub interval_seconds: Option<u64>,
/// Optional description shown on the dashboard approval card +
/// preserved on the schedule row for later operator reference.
#[serde(default)]
pub description: Option<String>,
}
#[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
pub struct FireScheduleNowArgs {
/// Schedule id to fire out of band. Get this from a prior
/// `list_schedules` call or the approval-resolved event for
/// the originating `request_schedule_prompt`.
pub id: i64,
}
#[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
pub struct CancelScheduleArgs {
/// Schedule id from a prior `list_schedules` call or the
/// approval-resolved event for a `request_schedule_prompt`.
pub id: i64,
/// Optional target list. `None` / empty = cancel the entire
/// schedule. `Some(["alice", "bob"])` = cancel just those
/// recipients (the schedule keeps firing for any remaining
/// active targets, and auto-cancels its parent row when every
/// target is gone).
#[serde(default)]
pub targets: Option<Vec<String>>,
}
#[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
pub struct EditScheduleArgs {
/// Schedule id from a prior `list_schedules` call or the
/// approval-resolved event for a `request_schedule_prompt`.
pub id: i64,
/// New body text. Omit to keep the existing one.
#[serde(default)]
pub body: Option<String>,
/// New description. Omit to keep the existing one. (To CLEAR
/// the description, use the dashboard PATCH endpoint
/// directly — the agent surface intentionally keeps the args
/// flat / non-nullable to dodge the doubly-wrapped Option
/// schemars quirk; clearing fields is rare and operator-side.)
#[serde(default)]
pub description: Option<String>,
/// Recurring interval in seconds. Omit to keep the existing
/// cadence; pass an explicit value to set a new one. Toggling
/// recurring↔one-shot (clearing the interval) is operator-only
/// for the same reason as `description` above.
#[serde(default)]
pub interval_seconds: Option<u64>,
/// New absolute unix timestamp for the next fire. Omit to
/// leave the schedule on its current cadence.
#[serde(default)]
pub next_fire_at_unix: Option<i64>,
/// Names of new targets to add. Replace-on-conflict: re-adding
/// a previously cancelled target resets its history (operator
/// intent on re-add = "this target is active again").
#[serde(default)]
pub targets_add: Option<Vec<String>>,
/// Names of targets to cancel. Tombstones preserve per-target
/// audit; when no active targets remain the schedule
/// auto-cancels.
#[serde(default)]
pub targets_remove: Option<Vec<String>>,
}

158
hive-agent-mcp/src/mcp/mod.rs
View file

@ -24,9 +24,8 @@ mod args;
mod render;
pub use args::{
AckUntilArgs, CancelLooseEndArgs, CancelScheduleArgs, CompactArgs, EditScheduleArgs,
FireScheduleNowArgs, GetAgentMetaArgs, MarkTodosDoneArgs, RecvArgs, RemindArgs,
RequestSchedulePromptArgs, SendArgs, SetStatusArgs,
AckUntilArgs, CancelLooseEndArgs, CompactArgs, GetAgentMetaArgs, MarkTodosDoneArgs, RecvArgs,
RemindArgs, SendArgs, SetStatusArgs,
};
pub use render::{annotate_retries, format_ack, format_agent_meta, format_recv};
@ -519,159 +518,6 @@ impl AgentServer {
})
.await
}
#[tool(
description = "Queue an approval to add a scheduled prompt — one body delivered to \
N agent inboxes at a target time, optionally recurring every `interval_seconds`. \
The operator approves; on approve hive-c0re inserts the schedule and the worker \
fans it out. Even self-targeted schedules go through this flow (the operator pays \
for the wake-up tokens); the existing `remind` MCP tool stays the quick \
no-approval self-wake path. \n\n\
Catch-up clamp: if hive-c0re is down across multiple intervals, only ONE delayed \
fire happens on resume (per recurring schedule). The skipped-cycle count surfaces \
in the per-target `last_result` for the operator's audit trail. \n\n\
Per-target failure: a target name that doesn't resolve to a live agent → operator \
gets a one-line advisory `Message` from `system`; the schedule keeps firing for \
the other (live) targets."
)]
async fn request_schedule_prompt(
&self,
Parameters(args): Parameters<RequestSchedulePromptArgs>,
) -> String {
let log = format!("{args:?}");
run_tool_envelope("request_schedule_prompt", log, async move {
let target_count = args.targets.len();
let (resp, retries) = self
.dispatch(hive_core_agent_sock::Request::RequestSchedulePrompt(
hive_sh4re::manager::SchedulePromptPayload {
targets: args.targets,
body: args.body,
first_fire_at_unix: args.first_fire_at_unix,
interval_seconds: args.interval_seconds,
description: args.description,
},
))
.await;
annotate_retries(
format_ack(
resp,
"request_schedule_prompt",
format!("approval queued: {target_count} target(s)"),
),
retries,
)
})
.await
}
#[tool(
description = "Fire a scheduled prompt out of band — runs the per-target fan-out \
once immediately without disturbing the schedule's cadence. Recurring schedules \
keep their next_fire_at unchanged (the manual fire is additive). One-shot \
schedules are CONSUMED by the manual fire (cancelled afterwards): the operator's \
intent on a one-shot is 'send this now, the scheduled time was wrong'. \n\n\
Authorization mirrors `cancel_schedule`: you can fire any schedule, whoever owns it."
)]
async fn fire_schedule_now(&self, Parameters(args): Parameters<FireScheduleNowArgs>) -> String {
let log = format!("{args:?}");
run_tool_envelope("fire_schedule_now", log, async move {
let id = args.id;
let (resp, retries) = self
.dispatch(hive_core_agent_sock::Request::FireScheduleNow { id })
.await;
annotate_retries(
format_ack(resp, "fire_schedule_now", format!("fired #{id} now")),
retries,
)
})
.await
}
#[tool(
description = "Cancel a scheduled prompt. With no `targets` field, cancels the \
whole schedule (all recipients flipped). With a non-empty `targets` list, cancels \
just those recipients; the schedule keeps firing for any remaining active targets \
and auto-cancels its parent row when every target is cancelled. \n\n\
Authorization: you can cancel any schedule, whoever owns it."
)]
async fn cancel_schedule(&self, Parameters(args): Parameters<CancelScheduleArgs>) -> String {
let log = format!("{args:?}");
run_tool_envelope("cancel_schedule", log, async move {
let id = args.id;
let (resp, retries) = self
.dispatch(hive_core_agent_sock::Request::CancelSchedule {
id: args.id,
targets: args.targets,
})
.await;
annotate_retries(
format_ack(resp, "cancel_schedule", format!("cancelled #{id}")),
retries,
)
})
.await
}
#[tool(
description = "Edit an existing scheduled prompt's mutable fields. Pass only \
the fields you want to change — anything omitted keeps its current value. Editable: \
`body`, `description`, `interval_seconds` (positive only via this tool; flipping \
recurring→one-shot is operator-only via the dashboard), `next_fire_at_unix`, and \
the target set via `targets_add` / `targets_remove`. Both target lists are \
applied in the same transaction with removes-before-adds, so a single edit can \
swap a target atomically. Re-adding a previously-removed target starts a fresh \
per-target history (drops the tombstone). Draining all targets auto-cancels the \
parent schedule. \n\n\
Authorization mirrors `cancel_schedule` / `fire_schedule_now`: you can edit any \
schedule, whoever owns it. \
Refuses cancelled schedules (the row's terminal — submit a fresh one)."
)]
async fn edit_schedule(&self, Parameters(args): Parameters<EditScheduleArgs>) -> String {
let log = format!("{args:?}");
run_tool_envelope("edit_schedule", log, async move {
let id = args.id;
let (resp, retries) = self
.dispatch(hive_core_agent_sock::Request::EditSchedule {
id: args.id,
body: args.body,
description: args.description.map(Some),
interval_seconds: args.interval_seconds.map(Some),
next_fire_at_unix: args.next_fire_at_unix,
targets_add: args.targets_add,
targets_remove: args.targets_remove,
})
.await;
annotate_retries(
format_ack(resp, "edit_schedule", format!("edited #{id}")),
retries,
)
})
.await
}
#[tool(
description = "List every scheduled prompt in the hive, whoever owns it — active and \
cancelled-but-not-yet-reaped. Returns schedule id, owner, body, target set with \
per-target last_fired_at + last_result, next fire time, recurring interval. \
Use this to look up an id before calling `cancel_schedule`, or to audit what \
the hive is going to be woken up about next."
)]
async fn list_schedules(&self) -> String {
run_tool_envelope("list_schedules", String::new(), async move {
let (resp, retries) = self
.dispatch(hive_core_agent_sock::Request::ListSchedules)
.await;
let body = match resp {
Ok(hive_core_agent_sock::Response::Schedules { schedules }) => {
serde_json::to_string(&schedules)
.unwrap_or_else(|e| format!("list_schedules: serialise: {e:#}"))
}
other => reply_err(other, "list_schedules"),
};
annotate_retries(body, retries)
})
.await
}
}
#[tool_handler(

14
hive-agent-mcp/src/mcp/render.rs
View file

@ -643,12 +643,12 @@ mod tests {
Ok(hive_core_agent_sock::Response::OkWarn {
warnings: vec!["name is reserved".to_owned(), "second thing".to_owned()],
}),
"request_schedule_prompt",
"schedule approval queued".to_owned(),
"send",
"sent to iris".to_owned(),
);
// The operation HAPPENED — dropping the success line would read as a
// failure and invite a retry that queues a second approval.
assert!(out.starts_with("schedule approval queued"));
// failure and invite a retry that sends a second message.
assert!(out.starts_with("sent to iris"));
assert!(out.contains("⚠️ name is reserved"));
assert!(out.contains("⚠️ second thing"));
}
@ -659,10 +659,10 @@ mod tests {
// warning marker would pass the test above.
let out = format_ack(
Ok(hive_core_agent_sock::Response::Ok),
"request_schedule_prompt",
"queued".to_owned(),
"send",
"sent".to_owned(),
);
assert_eq!(out, "queued");
assert_eq!(out, "sent");
assert!(!out.contains('⚠'));
}
}

3
hive-agent/prompts/system.md
View file

@ -4,7 +4,6 @@ Tools (hyperhive surface). Full signature + behavior for each comes from the too
- **Inbox / messaging** (always available): `mcp__hyperhive__recv`, `mcp__hyperhive__ack_until`, `mcp__hyperhive__send`, `mcp__hyperhive__get_loose_ends`, `mcp__hyperhive__cancel_loose_end`, `mcp__hyperhive__mark_todos_done`, `mcp__hyperhive__remind`, `mcp__hyperhive__set_status`, `mcp__hyperhive__get_agent_meta`. One habit worth internalizing beyond the tool descriptions themselves: prefer ending the turn over repeatedly polling `recv` when idle (only turn-boundaries observe in-container todo wakes — bash-task completions, matrix unread, forge activity — and ending the turn is also your checkpoint). For a large todo backlog (`get_loose_ends` caps at 40 rows), clear reviewed ids in bulk with `mark_todos_done` rather than cancelling one at a time — there's no blind range-clear, only ids you've actually looked at.
- **Extra MCP tools** (some agents only): `mcp__<server>__<tool>` — agent-specific (matrix client, scraper, db connector, etc.) declared in your `agent.nix` under `hyperhive.extraMcpServers`. First-class tools, already operator-approved at deploy time.
- **Scheduling** (_requires `scheduling` tool group_): `request_schedule_prompt` (queues an approval), `cancel_schedule`, `fire_schedule_now`, `edit_schedule`, `list_schedules` (these four don't need approval — you can manage any schedule, whoever owns it).
Need new packages, env vars, or other NixOS config for yourself? You can't edit your own config directly — open a PR on your `agent-configs/<name>` repo, or contact the operator directly. Config repos live at `/agents/{label}/config/` (read-only inside your container). All changes flow through operator-approved commits.
@ -16,7 +15,7 @@ Messages from sender `system` are hyperhive helper events (JSON body, `event` fi
- `needs_update` — agent's flake rev is stale. Ask the operator to rebuild it.
- `container_crash` — ask the operator to start it again; if it keeps crashing, say so with what you saw.
- `approval_resolved` — one of your own submitted approvals (a scheduled prompt, …) was approved, denied, or failed; the body carries the resolution.
- `approval_resolved` — one of your own submitted approvals was approved, denied, or failed; the body carries the resolution.
Lifecycle notices that don't need an immediate turn — a new agent spawned, a container rebuilt/killed/destroyed, or its login state changing — surface as todos instead of messages now. Call `get_loose_ends` to see them.

16
hive-agent/src/schedule_timer.rs
View file

@ -4,9 +4,8 @@
//! `agent-schedules` KV bucket. This task reads that key every
//! [`POLL_INTERVAL`] with the one subject the agent's own queue credential is
//! granted there (`swarm_queue_client::agent_schedules::read_own`), and fires
//! each due schedule as the same `schedule`-subsystem todo, keyed
//! `schedule:<id>`, that hive-c0re's schedule worker pushes. The wake path
//! is the todo store's.
//! each due schedule as a `schedule`-subsystem todo, keyed `schedule:<id>`.
//! The wake path is the todo store's.
//!
//! **Fire times come from the schedule alone**: `anchor + k * interval`
//! ([`Schedule::latest_slot`]). Rewriting the list, or changing a body,
@ -43,7 +42,7 @@ use crate::todos::Todos;
/// longest a fire can lag its slot, and a change can take to reach the agent.
const POLL_INTERVAL: Duration = Duration::from_secs(10);
/// The todo subsystem and source hive-c0re's schedule worker uses.
/// The todo subsystem and source a schedule fire carries.
const SUBSYSTEM: &str = "schedule";
const SOURCE: &str = "scheduled";
@ -161,7 +160,7 @@ fn tick(
}
}
/// Push `schedule` as the todo hive-c0re's worker pushes, and wake the turn
/// Push `schedule` as a todo, and wake the turn
/// loop when it is new or reopened.
fn push_todo(todos: &Todos, wake: &Notify, schedule: &Schedule) -> bool {
let key = format!("schedule:{}", schedule.id);
@ -364,11 +363,10 @@ mod tests {
assert_eq!(fired(&l, &slots, 1005), ["a body"]);
}
/// The same todo hive-c0re's worker pushes, so the wake path does not
/// change: subsystem `schedule`, key `schedule:<id>`, source
/// `scheduled`, and a reopen once the agent acked the previous fire.
/// A fire is subsystem `schedule`, key `schedule:<id>`, source
/// `scheduled`, and reopens once the agent acked the previous fire.
#[test]
fn a_fire_is_the_hive_c0re_schedule_todo() {
fn a_fire_is_the_schedule_todo() {
let todos = Todos::open(Path::new(":memory:")).unwrap();
let wake = Notify::new();
let s = schedule("abcdefgh", 1000, Some(100));

2
hive-c0re/Cargo.toml
View file

@ -40,8 +40,6 @@ hive-jobq.workspace = true
hive-jobq-wire.workspace = true
hive-log.workspace = true
hive-priv-sock.workspace = true
hive-agent-sock.workspace = true
hive-sock-client.workspace = true
hive-types.workspace = true
libc.workspace = true
listenfd = "1"

46
hive-c0re/src/actions.rs
View file

@ -21,7 +21,7 @@ use crate::lifecycle;
///
/// Every queued kind resolves its approval row via
/// [`resolve_approval_dag`] when the DAG settles terminal.
pub async fn approve(coord: Arc<Coordinator>, id: i64) -> Result<()> {
pub fn approve(coord: &Arc<Coordinator>, id: i64) -> Result<()> {
let approval = coord.approvals.mark_approved(id)?;
tracing::info!(
%approval.id,
@ -50,19 +50,6 @@ pub async fn approve(coord: Arc<Coordinator>, id: i64) -> Result<()> {
coord.emit_rebuild_queue_snapshot();
Ok(())
}
ApprovalKind::SchedulePrompt => {
// No queue card for SchedulePrompt — the work is a single
// sqlite insert, the actual "running" lifetime lives on
// the scheduled-prompts surface itself (worker fires it
// at the scheduled time). Run inline + fire
// `ApprovalResolved` so the approval row leaves Pending
// immediately.
let result = run_approval_schedule_prompt(&coord, approval).await;
if result.is_ok() {
coord.emit_schedules_snapshot();
}
result
}
}
}
@ -162,37 +149,6 @@ pub(crate) async fn post_rev_deploy_failure_to_pr(agent: &str, rev: &str, err: &
}
}
/// Inline (non-queued) handler for `ApprovalKind::SchedulePrompt`.
/// On approve, decode the `SchedulePromptPayload` JSON from the
/// approval's `commit_ref`, insert a row into `scheduled_prompts`
/// (with `source = Approval { id }`), and fire `ApprovalResolved`.
/// The worker takes over from here — fan-out at fire time.
async fn run_approval_schedule_prompt(
coord: &Coordinator,
approval: hive_sh4re::approvals::Approval,
) -> Result<()> {
let result: Result<()> = async {
let payload: hive_sh4re::manager::SchedulePromptPayload =
serde_json::from_str(&approval.commit_ref)
.context("decode SchedulePromptPayload from approval.commit_ref")?;
coord
.scheduled_prompts
.submit(&crate::scheduled_prompts::NewSchedule {
owner: approval.agent.to_string(),
targets: payload.targets,
body: payload.body,
first_fire_at_unix: payload.first_fire_at_unix,
interval_seconds: payload.interval_seconds,
description: payload.description,
source: crate::scheduled_prompts::ScheduleSource::Approval { id: approval.id },
})
.map(|_| ())
.context("insert scheduled prompt")
}
.await;
finish_approval(coord, &approval, result)
}
/// Resolve an approval row from how its DAG's work ended — the body of the
/// [`NodeKind::ResolveApproval`] tail node. Every approval-carrying template
/// resolves here: the pipeline is ordinary queue nodes,

143
hive-c0re/src/coordinator.rs
View file

@ -31,9 +31,9 @@ const LAST_STOPPED_RUNNING_KEY: &str = "last_stopped_running";
pub struct Coordinator {
pub broker: Arc<Broker>,
pub approvals: Arc<Approvals>,
/// Scheduled-prompts queue. One sqlite connection,
/// internal mutex; the worker drains due rows and the manager
/// handlers insert / cancel through the same handle.
/// Scheduled-prompt rows, read-only: the dashboard lists them so the
/// operator can recreate them with `swarmctl schedule`. Nothing on
/// the hive writes or fires them.
pub scheduled_prompts: Arc<crate::scheduled_prompts::ScheduledPrompts>,
/// Full build-log capture. `lifecycle::run` /
/// `lifecycle::prebuild_toplevel` `start()` a row per attempt,
@ -426,17 +426,6 @@ pub struct ApprovalResolved<'a> {
pub description: Option<String>,
}
/// Field-named payload for [`Coordinator::emit_approval_added`].
/// Mirrors the `ApprovalAdded` dashboard-event fields. `agent`
/// borrows from the caller; `approval_kind` is a compile-time
/// constant.
pub struct ApprovalAdded<'a> {
pub id: i64,
pub agent: &'a str,
pub approval_kind: &'static str,
pub description: Option<String>,
}
/// The two ways [`Coordinator::set_paused_by_name`] can fail. See its own
/// doc comment for why this is a distinct type rather than one
/// `anyhow::Error` (`Write` already wraps one, `BadName` never needs to).
@ -587,42 +576,11 @@ impl Coordinator {
});
}
/// Emit a `SchedulesChanged` snapshot event. Called from every
/// schedule mutation site (operator API handlers + the worker
/// after each tick that fires or rearms a row) so the dashboard's
/// scheduled-prompts tab updates live without polling.
pub fn emit_schedules_snapshot(self: &Arc<Self>) {
let mut schedules: Vec<hive_sh4re::schedule::WireSchedule> =
match self.scheduled_prompts.list() {
Ok(rows) => rows
.into_iter()
.map(crate::socket_server::schedule_to_wire_public)
.collect(),
Err(e) => {
tracing::warn!(error = ?e, "emit_schedules_snapshot: list failed");
return;
}
};
// Strip ghost targets (destroyed agents) so the dashboard doesn't
// render dead columns. Best-effort: if the roster cache is
// momentarily contended we emit unfiltered rather than block this
// sync path — the next snapshot / page reload corrects it.
if let Some(live) = self.live_container_names_blocking() {
crate::socket_server::filter_ghost_schedule_targets(&mut schedules, &live);
}
self.emit_dashboard_event(DashboardEvent::SchedulesChanged {
seq: self.next_seq(),
schedules,
});
}
/// Best-effort synchronous snapshot of live container names (the
/// logical agent names from the last `nixos-container list` scan).
/// Returns `None` when the roster cache lock is momentarily
/// contended, so a transient miss is treated as "roster unknown,
/// don't filter" rather than hiding live schedule targets. The async
/// `containers_snapshot` is the reliable path for request handlers;
/// this exists for the sync `emit_schedules_snapshot` SSE emit.
/// contended. The async `containers_snapshot` is the reliable path
/// for request handlers; this exists for the sync SSE snapshot emits.
#[must_use]
pub fn live_container_names_blocking(&self) -> Option<HashSet<String>> {
self.last_containers
@ -772,24 +730,6 @@ impl Coordinator {
self.meta_updates_active.load(Ordering::SeqCst) > 0
}
/// Emit `ApprovalAdded` immediately after the row is inserted in
/// sqlite.
pub fn emit_approval_added(&self, ev: ApprovalAdded<'_>) {
let ApprovalAdded {
id,
agent,
approval_kind,
description,
} = ev;
self.emit_dashboard_event(DashboardEvent::ApprovalAdded {
seq: self.next_seq(),
id,
agent: agent.to_owned(),
approval_kind,
description,
});
}
/// Emit `ApprovalResolved` after `mark_approved` / `mark_denied` /
/// `mark_failed` lands. `resolved_at` is stamped from the system
/// clock here so call sites don't repeat the conversion; if you
@ -904,7 +844,7 @@ impl Coordinator {
.with_context(|| format!("create agent dir {}", agent_dir.display()))?;
let socket_path = Self::socket_path(name);
// Hand the full Coordinator to the per-agent socket — it needs
// more than just the broker (approvals, scheduled_prompts, ...).
// more than just the broker (approvals, ...).
let socket = socket_server::start(name, &socket_path, self.clone())?;
self.agents.lock().unwrap().insert(name.to_owned(), socket);
Ok(agent_dir)
@ -1176,77 +1116,6 @@ impl Coordinator {
.unwrap_or_else(|| hive_sh4re::manager::MANAGER_AGENT.to_owned())
}
/// Push a todo directly into `agent`'s in-container todo store — a
/// best-effort *live* dial of its `hive-agent-sock` socket
/// (`hive_host_sock::agent_todo_socket`), same `UpsertTodo` request
/// shape the built-in in-container producers (matrix/bash/forge-notify)
/// already send — `subsystem` isn't restricted to that set, any
/// producer can use the same shape. This is the migration target for
/// `HelperEvent` variants that are pure "FYI, check when convenient" notices: the
/// event stops being a broker `Message` (which always drives an
/// immediate turn) and becomes a todo instead, with the same
/// dedup-by-key semantics as any other producer.
///
/// Deliberately push, not queue: if the agent's container is down
/// (socket file absent) or the dial otherwise fails, this is a
/// silent no-op (logged at `debug`/`warn`) — no retry, no fallback
/// delivery. An agent that's down doesn't need a todo about
/// something it'll never see appear this way; whatever mechanism
/// resurfaces its state on the next boot is unrelated to this path.
///
/// Returns `Ok(())` on a successful push and `Err(reason)` — a
/// short human-readable string, already logged at `debug`/`warn`
/// by this function — on any of the silent-no-op cases below.
/// Most callers are pure fire-and-forget notices and ignore it
/// (`let _ = coord.push_todo(...).await;`); callers that track a
/// per-target delivery outcome (e.g. the scheduled-prompts worker's
/// `last_result` column) use it instead of assuming success.
/// `reopen_if_acked` forwards to `UpsertTodo` (see its doc comment) —
/// `false` for every caller here except the scheduled-prompts worker.
pub async fn push_todo(
&self,
agent: &str,
subsystem: &str,
key: Option<String>,
summary: String,
source: Option<String>,
reopen_if_acked: bool,
) -> Result<(), String> {
let Ok(ident) = hive_types::Ident::parse(agent) else {
tracing::warn!(%agent, "push_todo: not a valid agent ident, skipping");
return Err(format!("'{agent}' is not a valid agent ident"));
};
let path = hive_host_sock::agent_todo_socket(&ident);
if !path.exists() {
tracing::debug!(%agent, path = %path.display(), "push_todo: agent socket not present (offline?), skipping");
return Err(format!("agent '{agent}' socket not present (offline?)"));
}
let req = hive_agent_sock::Request::UpsertTodo {
subsystem: subsystem.to_owned(),
key,
summary,
source,
reopen_if_acked,
};
match hive_sock_client::request::<_, hive_agent_sock::Response>(
&path,
&req,
hive_sock_client::Retry::None,
)
.await
{
Ok(hive_agent_sock::Response::Err { message }) => {
tracing::warn!(%agent, %message, "push_todo: agent rejected the todo");
Err(format!("agent '{agent}' rejected the todo: {message}"))
}
Err(e) => {
tracing::warn!(%agent, error = ?e, "push_todo: dial failed");
Err(format!("push_todo dial to '{agent}' failed: {e:#}"))
}
Ok(_) => Ok(()),
}
}
/// Push a `HelperEvent` into an arbitrary agent's inbox. Encoded
/// the same way as `notify_manager` (sender = `SYSTEM_SENDER`,
/// body = JSON-encoded event) — e.g. `ContainerCrash`, `NeedsUpdate`.

2
hive-c0re/src/dashboard/approvals.rs
View file

@ -31,7 +31,7 @@ pub(super) async fn post_approve(
State(state): State<AppState>,
AxumPath(id): AxumPath<i64>,
) -> Response {
match actions::approve(state.coord.clone(), id).await {
match actions::approve(&state.coord, id) {
// 200 instead of 303 — `actions::approve` fires
// `ApprovalResolved` (success path) or the eventual failure
// event, both of which the dashboard's derived store applies

25
hive-c0re/src/dashboard/mod.rs
View file

@ -41,7 +41,7 @@ use crate::lifecycle;
(name = "meta_inputs", description = "bulk flake-input update for the meta flake"),
(name = "misc_api", description = "operator inbox, compose, spawn-request, hive stats"),
(name = "permissions", description = "tool-group + capability assignment for agents"),
(name = "schedules", description = "scheduled-prompt + rebuild-queue CRUD"),
(name = "schedules", description = "read-only scheduled-prompt list + rebuild-queue cancel"),
(name = "state_files", description = "proxied reads of allow-listed per-agent state files"),
(name = "state_snapshot", description = "cold-load dashboard snapshot"),
(name = "tombstones", description = "purge of retained state for destroyed agents"),
@ -112,8 +112,7 @@ pub async fn serve(port: u16, coord: Arc<Coordinator>) -> Result<()> {
// GET-vs-GET or POST-vs-POST pairs across different paths do. Each
// call below is therefore scoped to exactly one path — two handlers
// in the same call only when they genuinely share a path with
// different methods (`schedules::api_schedules`/`post_schedule_new`
// on `/api/schedules`) — chained via
// different methods — chained via
// repeated `.routes(...)` calls instead of one giant `routes!(...)`
// with everything in it.
let (router, api) = OpenApiRouter::<AppState>::with_openapi(ApiDoc::openapi())
@ -141,15 +140,7 @@ pub async fn serve(port: u16, coord: Arc<Coordinator>) -> Result<()> {
.routes(routes!(permissions::post_permissions))
.routes(routes!(permissions::get_stale_permissions))
.routes(routes!(permissions::delete_agent_permissions))
.routes(routes!(
schedules::api_schedules,
schedules::post_schedule_new
))
.routes(routes!(schedules::patch_schedule))
.routes(routes!(schedules::post_schedule_cancel))
.routes(routes!(schedules::post_schedule_pause))
.routes(routes!(schedules::post_schedule_resume))
.routes(routes!(schedules::post_schedule_fire_now))
.routes(routes!(schedules::api_schedules))
.routes(routes!(schedules::post_rebuild_queue_cancel))
.routes(routes!(approvals::post_approve))
.routes(routes!(approvals::post_deny))
@ -367,15 +358,7 @@ mod router_build_probe {
.routes(routes!(permissions::post_permissions))
.routes(routes!(permissions::get_stale_permissions))
.routes(routes!(permissions::delete_agent_permissions))
.routes(routes!(
schedules::api_schedules,
schedules::post_schedule_new
))
.routes(routes!(schedules::patch_schedule))
.routes(routes!(schedules::post_schedule_cancel))
.routes(routes!(schedules::post_schedule_pause))
.routes(routes!(schedules::post_schedule_resume))
.routes(routes!(schedules::post_schedule_fire_now))
.routes(routes!(schedules::api_schedules))
.routes(routes!(schedules::post_rebuild_queue_cancel))
.routes(routes!(approvals::post_approve))
.routes(routes!(approvals::post_deny))

428
hive-c0re/src/dashboard/schedules.rs
View file

@ -1,41 +1,31 @@
//! Scheduled-prompt + rebuild-queue endpoints for the dashboard.
//! Scheduled-prompt list + rebuild-queue cancel endpoints for the dashboard.
//!
//! Operator-direct schedule CRUD (`/api/schedules` GET/POST, `{id}` PATCH,
//! `{id}/cancel` + `{id}/fire-now`) — the operator click *is* the approval,
//! so these skip the manager approval gate. Also the co-located
//! `/api/schedules` is read-only: it lists the rows still in the hive's
//! `scheduled_prompts` table so the operator can recreate them with
//! `swarmctl schedule` (`docs/swarm/schedules.md`). Nothing on the hive
//! writes or fires those rows. Also the co-located
//! `/api/rebuild-queue/{id}/cancel` endpoint.
use axum::{
extract::{Path as AxumPath, State},
http::StatusCode,
response::{IntoResponse, Response},
};
use problem_details::ProblemDetails;
use crate::scheduled_prompts::ScheduleNotFoundOrCancelled;
use crate::scheduled_prompts_worker::FireNowReport;
use super::{AppState, error_problem, error_response};
#[derive(serde::Serialize, utoipa::ToSchema)]
pub(super) struct NewScheduleBody {
id: i64,
}
use super::{AppState, error_response};
#[derive(serde::Serialize, utoipa::ToSchema)]
pub(super) struct CancelResultBody {
cancelled: bool,
}
/// Snapshot of every schedule for the
/// Snapshot of every schedule row for the
/// scheduled-prompts tab.
///
/// Returns the wire shape directly so the frontend can render
/// without an extra translation layer.
// `hive_sh4re::schedule::WireSchedule` (the actual body) has no `ToSchema` — adding
// one would pull `utoipa` into the wire-types crate for a single dashboard
// endpoint. `serde_json::Value` placeholder; see the batch report.
// endpoint. `serde_json::Value` placeholder.
#[utoipa::path(
get,
path = "/api/schedules",
@ -48,13 +38,8 @@ pub(super) struct CancelResultBody {
pub(super) async fn api_schedules(State(state): State<AppState>) -> Response {
match state.coord.scheduled_prompts.list() {
Ok(rows) => {
let mut wire: Vec<hive_sh4re::schedule::WireSchedule> = rows
.into_iter()
.map(crate::socket_server::schedule_to_wire_public)
.collect();
// Drop ghost targets (agents that no longer exist) so the
// table never shows dead columns. Uses the reliable async
// roster snapshot here on the request path.
let mut wire: Vec<hive_sh4re::schedule::WireSchedule> =
rows.into_iter().map(schedule_to_wire).collect();
let live: std::collections::HashSet<String> = state
.coord
.containers_snapshot()
@ -62,117 +47,56 @@ pub(super) async fn api_schedules(State(state): State<AppState>) -> Response {
.into_iter()
.map(|c| c.name)
.collect();
crate::socket_server::filter_ghost_schedule_targets(&mut wire, &live);
filter_ghost_schedule_targets(&mut wire, &live);
axum::Json(wire).into_response()
}
Err(e) => error_response(&format!("scheduled_prompts list: {e:#}")),
}
}
/// Operator-direct schedule creation
/// (mara: "user can add them manually").
///
/// Accepts the same `SchedulePromptPayload` shape as the manager
/// request flow but skips the approval gate — the operator click
/// *is* the approval. The schedule lands directly with
/// `source = Operator` and the worker picks it up at fire time.
#[utoipa::path(
post,
path = "/api/schedules",
// `hive_sh4re::manager::SchedulePromptPayload` (the actual body) has no `ToSchema` —
// same reasoning as the `Vec<serde_json::Value>` placeholder on
// `api_schedules` above.
request_body(content = serde_json::Value, description = "SchedulePromptPayload wire shape"),
responses(
(status = 200, description = "created; body carries the new row id", body = NewScheduleBody),
(status = 400, description = "no targets, empty body, or interval_seconds == 0"),
(status = 500, description = "submit failed"),
),
tag = "schedules"
)]
pub(super) async fn post_schedule_new(
State(state): State<AppState>,
axum::Json(payload): axum::Json<hive_sh4re::manager::SchedulePromptPayload>,
) -> Result<Response, ProblemDetails> {
if payload.targets.is_empty() {
return Err(ProblemDetails::from_status_code(StatusCode::BAD_REQUEST)
.with_detail("schedule must have at least one target"));
/// Drop schedule targets that point at agents which no longer exist, so
/// the schedule table doesn't render ghost columns for destroyed agents.
/// `live` is the set of logical agent names from the last
/// `nixos-container list` scan (stopped agents included, destroyed ones
/// absent). A view filter: the rows keep every target.
fn filter_ghost_schedule_targets(
schedules: &mut [hive_sh4re::schedule::WireSchedule],
live: &std::collections::HashSet<String>,
) {
for s in schedules.iter_mut() {
s.targets.retain(|t| live.contains(&t.target));
}
if payload
}
fn schedule_to_wire(s: crate::scheduled_prompts::Schedule) -> hive_sh4re::schedule::WireSchedule {
hive_sh4re::schedule::WireSchedule {
id: s.id,
owner: s.owner,
body: s.body,
interval_seconds: s.interval_seconds,
next_fire_at_unix: s.next_fire_at_unix,
created_at_unix: s.created_at_unix,
source: match s.source {
crate::scheduled_prompts::ScheduleSource::Operator => {
hive_sh4re::schedule::WireScheduleSource::Operator
}
crate::scheduled_prompts::ScheduleSource::Approval { id } => {
hive_sh4re::schedule::WireScheduleSource::Approval { id }
}
},
cancelled_at_unix: s.cancelled_at_unix,
paused_at_unix: s.paused_at_unix,
description: s.description,
targets: s
.targets
.iter()
.any(|t| t == hive_sh4re::manager::OPERATOR_RECIPIENT)
{
return Err(ProblemDetails::from_status_code(StatusCode::BAD_REQUEST)
.with_detail("operator is not a valid schedule target"));
}
if payload.body.trim().is_empty() {
return Err(ProblemDetails::from_status_code(StatusCode::BAD_REQUEST)
.with_detail("schedule body must be non-empty"));
}
if let Some(0) = payload.interval_seconds {
return Err(ProblemDetails::from_status_code(StatusCode::BAD_REQUEST)
.with_detail("interval_seconds must be > 0 (use None for one-shot)"));
}
let new = crate::scheduled_prompts::NewSchedule {
owner: hive_sh4re::manager::OPERATOR_RECIPIENT.to_owned(),
targets: payload.targets,
body: payload.body,
first_fire_at_unix: payload.first_fire_at_unix,
interval_seconds: payload.interval_seconds,
description: payload.description,
source: crate::scheduled_prompts::ScheduleSource::Operator,
};
match state.coord.scheduled_prompts.submit(&new) {
Ok(id) => {
state.coord.emit_schedules_snapshot();
Ok(axum::Json(NewScheduleBody { id }).into_response())
}
Err(e) => Err(error_problem(&format!("schedule submit: {e:#}"))),
}
}
/// Optional JSON body for `fire-now`. Absent / empty body ⇒
/// `reset_timer = false` (back-compat: cadence stays intact).
#[derive(serde::Deserialize, Default, utoipa::ToSchema)]
pub(super) struct FireNowBody {
#[serde(default)]
reset_timer: bool,
}
/// Operator-initiated
/// out-of-band fire of a scheduled prompt.
///
/// Runs the per-target fan-out once immediately and reports
/// per-target outcome counts. One-shot schedules are consumed
/// (cancelled) by a manual fire — the operator's intent is "send
/// this now, the scheduled time was wrong." For recurring schedules
/// the cadence stays intact unless the body carries
/// `{"reset_timer": true}`, in which case the countdown is re-armed
/// from now (`next_fire_at = now + interval`).
#[utoipa::path(
post,
path = "/api/schedules/{id}/fire-now",
params(("id" = i64, Path, description = "schedule row id")),
request_body(content = FireNowBody, description = "optional; absent body means reset_timer = false"),
responses(
(status = 200, description = "fired; per-target outcome counts", body = FireNowReport),
(status = 500, description = "schedule missing, cancelled, or fully drained"),
),
tag = "schedules"
)]
pub(super) async fn post_schedule_fire_now(
State(state): State<AppState>,
AxumPath(id): AxumPath<i64>,
body: Option<axum::Json<FireNowBody>>,
) -> Response {
let reset_timer = body.is_some_and(|axum::Json(b)| b.reset_timer);
match crate::scheduled_prompts_worker::fire_now(&state.coord, id, reset_timer).await {
Ok(report) => {
state.coord.emit_schedules_snapshot();
axum::Json(report).into_response()
}
Err(e) => error_response(&format!("fire schedule {id} now: {e:#}")),
.into_iter()
.map(|t| hive_sh4re::schedule::WireScheduleTarget {
target: t.target,
cancelled_at_unix: t.cancelled_at_unix,
last_fired_at_unix: t.last_fired_at_unix,
last_result: t.last_result,
})
.collect(),
}
}
@ -212,213 +136,55 @@ pub(super) async fn post_rebuild_queue_cancel(
}
}
#[derive(serde::Deserialize, Default, utoipa::ToSchema)]
pub(super) struct CancelScheduleForm {
/// `None` / absent / empty array → cancel whole schedule.
#[serde(default)]
targets: Option<Vec<String>>,
}
#[cfg(test)]
mod tests {
use super::*;
#[derive(serde::Deserialize, Default, utoipa::ToSchema)]
#[allow(
clippy::option_option,
reason = "double-Option carries three-state PATCH semantics on the wire \
(missing key = leave alone, JSON null = clear, value = set); \
collapsing to a single Option would lose the 'clear' state"
)]
pub(super) struct EditScheduleForm {
#[serde(default)]
body: Option<String>,
/// Double-`Option` semantics on the wire: missing key = leave
/// alone, explicit `null` = clear, value = set. serde's
/// `deserialize_with` trick to distinguish missing from null:
/// we wrap each editable field in its own helper. Simpler
/// here — keep them plain `Option<Option<_>>` and document
/// that the dashboard caller passes JSON `null` to clear.
#[serde(default, deserialize_with = "deserialize_some")]
description: Option<Option<String>>,
#[serde(default, deserialize_with = "deserialize_some")]
interval_seconds: Option<Option<u64>>,
#[serde(default)]
next_fire_at_unix: Option<i64>,
/// New targets to add. Replace-on-conflict: re-adding a
/// previously-cancelled target drops the tombstone and the
/// target starts fresh (operator intent on re-add = "this
/// target is active again, fresh start").
#[serde(default)]
targets_add: Option<Vec<String>>,
/// Targets to cancel. Same path as `cancel_targets`:
/// tombstones preserve audit and the parent schedule
/// auto-cancels when no active targets remain.
#[serde(default)]
targets_remove: Option<Vec<String>>,
}
fn target(name: &str) -> hive_sh4re::schedule::WireScheduleTarget {
hive_sh4re::schedule::WireScheduleTarget {
target: name.to_owned(),
cancelled_at_unix: None,
last_fired_at_unix: None,
last_result: None,
}
}
/// serde adaptor: turns missing-key into `None`, explicit-null
/// into `Some(None)`, value into `Some(Some(v))`. Standard trick
/// for distinguishing "field absent" from "field set to null" in
/// JSON PATCH bodies.
fn deserialize_some<'de, T, D>(deserializer: D) -> Result<Option<T>, D::Error>
where
T: serde::Deserialize<'de>,
D: serde::Deserializer<'de>,
{
T::deserialize(deserializer).map(Some)
}
fn schedule(targets: &[&str]) -> hive_sh4re::schedule::WireSchedule {
hive_sh4re::schedule::WireSchedule {
id: 1,
owner: "operator".to_owned(),
body: "ping".to_owned(),
interval_seconds: None,
next_fire_at_unix: hive_sh4re::wire_time::from_secs(0),
created_at_unix: hive_sh4re::wire_time::from_secs(0),
source: hive_sh4re::schedule::WireScheduleSource::Operator,
cancelled_at_unix: None,
paused_at_unix: None,
description: None,
targets: targets.iter().map(|t| target(t)).collect(),
}
}
/// Partial update of an existing
/// schedule.
///
/// Mutable fields: `body`, `description`, `interval_seconds`,
/// `next_fire_at_unix`, plus the target set via `targets_add` /
/// `targets_remove`. Both target lists are applied in the same
/// transaction as the scalar fields with removes-before-adds;
/// re-adding a previously-removed target resets per-target history
/// (fresh start); draining all targets auto-cancels the parent
/// schedule. JSON body uses missing-key = "leave alone", explicit
/// null = "clear" for `description` + `interval_seconds`. Cancelled
/// schedules are refused — submit a new one instead. Returns the
/// updated `WireSchedule` so the caller's post-edit refresh has the
/// new state inline.
#[utoipa::path(
patch,
path = "/api/schedules/{id}",
params(("id" = i64, Path, description = "schedule row id")),
responses(
(status = 200, description = "updated, wire shape", body = serde_json::Value),
(status = 500, description = "update failed (cancelled, not found, ...)"),
),
tag = "schedules"
)]
pub(super) async fn patch_schedule(
State(state): State<AppState>,
AxumPath(id): AxumPath<i64>,
axum::Json(form): axum::Json<EditScheduleForm>,
) -> Response {
let patch = crate::scheduled_prompts::UpdateSchedule {
body: form.body,
description: form.description,
interval_seconds: form.interval_seconds,
next_fire_at_unix: form.next_fire_at_unix,
targets_add: form.targets_add,
targets_remove: form.targets_remove,
};
if let Err(e) = state.coord.scheduled_prompts.update(id, patch) {
return error_response(&format!("edit schedule {id}: {e:#}"));
#[test]
fn ghost_filter_drops_dead_agents_keeps_live() {
let live: std::collections::HashSet<String> = ["iris".to_owned(), "damocles".to_owned()]
.into_iter()
.collect();
let mut schedules = vec![schedule(&["iris", "ghost", "damocles"])];
filter_ghost_schedule_targets(&mut schedules, &live);
let kept: Vec<&str> = schedules[0]
.targets
.iter()
.map(|t| t.target.as_str())
.collect();
assert_eq!(kept, vec!["iris", "damocles"]);
}
match state.coord.scheduled_prompts.get(id) {
Ok(Some(s)) => {
let wire = crate::socket_server::schedule_to_wire_public(s);
state.coord.emit_schedules_snapshot();
axum::Json(wire).into_response()
}
Ok(None) => error_response(&format!("edit schedule {id}: row vanished post-update")),
Err(e) => error_response(&format!("re-read schedule {id}: {e:#}")),
}
}
/// Pause a schedule so the worker
/// skips it until explicitly resumed.
///
/// Idempotent; no-op on an already-paused row. Returns 404 when the
/// schedule is cancelled or not found.
#[utoipa::path(
post,
path = "/api/schedules/{id}/pause",
params(("id" = i64, Path, description = "schedule row id")),
responses(
(status = 200, description = "paused", body = String),
(status = 404, description = "schedule cancelled or not found"),
(status = 500, description = "pause failed"),
),
tag = "schedules"
)]
pub(super) async fn post_schedule_pause(
State(state): State<AppState>,
AxumPath(id): AxumPath<i64>,
) -> Response {
match state.coord.scheduled_prompts.pause(id) {
Ok(()) => {
state.coord.emit_schedules_snapshot();
(StatusCode::OK, "ok").into_response()
}
Err(e) => {
if e.downcast_ref::<ScheduleNotFoundOrCancelled>().is_some() {
(StatusCode::NOT_FOUND, format!("{e}")).into_response()
} else {
error_response(&format!("pause schedule {id}: {e:#}"))
}
}
}
}
/// Resume a paused schedule.
///
/// Idempotent; no-op on an already-active row. Returns 404 when the
/// schedule is cancelled or not found.
#[utoipa::path(
post,
path = "/api/schedules/{id}/resume",
params(("id" = i64, Path, description = "schedule row id")),
responses(
(status = 200, description = "resumed", body = String),
(status = 404, description = "schedule cancelled or not found"),
(status = 500, description = "resume failed"),
),
tag = "schedules"
)]
pub(super) async fn post_schedule_resume(
State(state): State<AppState>,
AxumPath(id): AxumPath<i64>,
) -> Response {
match state.coord.scheduled_prompts.resume(id) {
Ok(()) => {
state.coord.emit_schedules_snapshot();
(StatusCode::OK, "ok").into_response()
}
Err(e) => {
if e.downcast_ref::<ScheduleNotFoundOrCancelled>().is_some() {
(StatusCode::NOT_FOUND, format!("{e}")).into_response()
} else {
error_response(&format!("resume schedule {id}: {e:#}"))
}
}
}
}
/// Operator-side cancel
/// (whole schedule when no `targets` field, partial when one is
/// provided).
///
/// Operator bypasses the topology check; the manager surface
/// enforces it for agent callers.
#[utoipa::path(
post,
path = "/api/schedules/{id}/cancel",
params(("id" = i64, Path, description = "schedule row id")),
responses(
(status = 200, description = "cancelled (whole or partial)", body = String),
(status = 500, description = "cancel failed"),
),
tag = "schedules"
)]
pub(super) async fn post_schedule_cancel(
State(state): State<AppState>,
AxumPath(id): AxumPath<i64>,
body: Option<axum::Json<CancelScheduleForm>>,
) -> Response {
let targets = body
.and_then(|axum::Json(b)| b.targets)
.filter(|t| !t.is_empty());
let result = match targets.as_deref() {
Some(list) => state.coord.scheduled_prompts.cancel_targets(id, list),
None => state.coord.scheduled_prompts.cancel_all(id),
};
match result {
Ok(()) => {
state.coord.emit_schedules_snapshot();
(StatusCode::OK, "ok").into_response()
}
Err(e) => error_response(&format!("cancel schedule {id}: {e:#}")),
#[test]
fn ghost_filter_can_empty_targets_when_all_dead() {
let live: std::collections::HashSet<String> = std::collections::HashSet::new();
let mut schedules = vec![schedule(&["gone1", "gone2"])];
filter_ghost_schedule_targets(&mut schedules, &live);
assert!(schedules[0].targets.is_empty());
}
}

3
hive-c0re/src/dashboard/state_snapshot.rs
View file

@ -152,8 +152,7 @@ struct ApprovalView {
#[serde(skip_serializing_if = "Option::is_none")]
description: Option<String>,
/// Raw `commit_ref` payload for `UpdateMetaInputs` (JSON-encoded
/// `Vec<String>` of input names; `"[]"` = all inputs) and
/// `SchedulePrompt` (JSON-encoded `SchedulePromptPayload`). The
/// `Vec<String>` of input names; `"[]"` = all inputs). The
/// frontend parses this to render a human-readable card body.
commit_ref: String,
/// RFC 3339 UTC time the approval was queued. Rendered as a

46
hive-c0re/src/dashboard_events.rs
View file

@ -48,24 +48,14 @@ pub enum DashboardEvent {
#[serde(default, skip_serializing_if = "Vec::is_empty")]
file_refs: Vec<String>,
},
/// A new approval landed in the pending queue. Payload carries
/// enough to render the dashboard row without a `/api/state`
/// refetch.
///
/// The approval's own kind (`"schedule_prompt"` / `"update_meta_inputs"`) lives
/// on `approval_kind` rather than `kind` because the latter is taken
/// by the serde tag identifying which `DashboardEvent` variant
/// this is.
ApprovalAdded {
seq: u64,
id: i64,
agent: String,
approval_kind: &'static str,
description: Option<String>,
},
/// A pending approval transitioned to a terminal state
/// (approved / denied / failed). Clients move the row out of the
/// pending list and into history.
///
/// The approval's own kind (`"update_meta_inputs"`) lives
/// on `approval_kind` rather than `kind` because the latter is taken
/// by the serde tag identifying which `DashboardEvent` variant
/// this is.
ApprovalResolved {
seq: u64,
id: i64,
@ -170,17 +160,6 @@ pub enum DashboardEvent {
/// (transients, container state, approvals), and a poll loop would be
/// slower for the same information.
RebuildQueueChanged { seq: u64 },
/// Full snapshot of all scheduled prompts. Emitted after every
/// operator mutation (new / edit / cancel / fire-now) and after the
/// worker fires or rearms a row. Same snapshot-shape rationale as
/// `TombstonesChanged` / `MetaInputsChanged` — the list is small and the
/// client's
/// per-target `last_result` / `last_fired_at_unix` fields are most
/// naturally re-derived from the full list.
SchedulesChanged {
seq: u64,
schedules: Vec<hive_sh4re::schedule::WireSchedule>,
},
/// Full snapshot of capability grants (per-agent `Vec<cap_name>`).
/// Emitted from the rebuild-queue worker after a `PermChange`
/// `Capabilities` entry commits the JSON file. Lets the P3RM1SS10NS
@ -235,7 +214,6 @@ impl DashboardEvent {
match self {
DashboardEvent::Sent { .. } => "sent",
DashboardEvent::Delivered { .. } => "delivered",
DashboardEvent::ApprovalAdded { .. } => "approval_added",
DashboardEvent::ApprovalResolved { .. } => "approval_resolved",
DashboardEvent::TransientSet { .. } => "transient_set",
DashboardEvent::TransientCleared { .. } => "transient_cleared",
@ -245,7 +223,6 @@ impl DashboardEvent {
DashboardEvent::MetaInputsChanged { .. } => "meta_inputs_changed",
DashboardEvent::MetaUpdateRunning { .. } => "meta_update_running",
DashboardEvent::RebuildQueueChanged { .. } => "rebuild_queue_changed",
DashboardEvent::SchedulesChanged { .. } => "schedules_changed",
DashboardEvent::CapabilitiesChanged { .. } => "capabilities_changed",
DashboardEvent::ToolGroupsChanged { .. } => "tool_groups_changed",
}
@ -294,18 +271,11 @@ mod tests {
in_reply_to: None,
file_refs: Vec::new(),
},
DashboardEvent::ApprovalAdded {
seq: 1,
id: 1,
agent: "x".into(),
approval_kind: "schedule_prompt",
description: None,
},
DashboardEvent::ApprovalResolved {
seq: 1,
id: 1,
agent: "x".into(),
approval_kind: "schedule_prompt",
approval_kind: "update_meta_inputs",
status: "approved",
resolved_at: hive_sh4re::wire_time::from_secs(0),
note: None,
@ -339,10 +309,6 @@ mod tests {
running: false,
},
DashboardEvent::RebuildQueueChanged { seq: 1 },
DashboardEvent::SchedulesChanged {
seq: 1,
schedules: Vec::new(),
},
DashboardEvent::CapabilitiesChanged {
seq: 1,
caps: Vec::new(),

4
hive-c0re/src/job_queue/exec.rs
View file

@ -383,10 +383,6 @@ async fn run_destroy_bookkeeping(coord: &Arc<Coordinator>, agent: &str, purge: b
// (gained one on destroy, lost one on purge — recompute either way).
coord.rescan_containers_and_emit().await;
crate::dashboard::emit_tombstones_snapshot(coord).await;
// Re-emit the schedules snapshot: the rescan above refreshed the live
// roster, so any schedule that still targets the just-destroyed agent now
// drops that ghost column live (no page reload needed).
coord.emit_schedules_snapshot();
}
/// Emit this agent's rebuild-complete todo. `ok` is not computed — it is which

10
hive-c0re/src/main.rs
View file

@ -45,9 +45,7 @@ mod workers;
pub(crate) use agent_config::{capabilities, limits, resource_limits, tool_groups, topology};
pub(crate) use stats::{container_stats, hive_stats, host_stats, otel_metrics, warnings};
pub(crate) use stores::{approvals, broker, build_logs, db, power, scheduled_prompts};
pub(crate) use workers::{
agent_sockets, auto_update, crash_watch, knowledge, mcp_sockets, scheduled_prompts_worker,
};
pub(crate) use workers::{agent_sockets, auto_update, crash_watch, knowledge, mcp_sockets};
use coordinator::{Coordinator, HiveEnv, ServeConfig};
@ -240,7 +238,7 @@ fn submit_periodic_sweep(
}
/// Start the coordinator daemon: open the broker, run migrations, spawn
/// background tasks (auto-update, vacuums, crash-watcher, scheduled-prompts,
/// background tasks (auto-update, vacuums, crash-watcher,
/// dashboard), then serve the admin socket until a signal arrives.
#[allow(
clippy::too_many_lines,
@ -433,10 +431,6 @@ async fn cmd_serve(
// run_reconcile call register_agent on start; kill/destroy call
// unregister_agent. No recurring poll needed — c0re owns the listeners.
mcp_sockets::sync_on_start(coord.clone()).await;
// Scheduled-prompts worker: drains due scheduled_prompts rows
// and fans the body out to each active target's inbox. See
// scheduled_prompts_worker.rs.
scheduled_prompts_worker::spawn(coord.clone());
// Job-queue scheduler: drives the global DAG queue (rebuild /
// meta-update / spawn / power ops). Concurrency comes from the
// build-slot count + per-agent leases inside the queue, not from

2
hive-c0re/src/server.rs
View file

@ -186,7 +186,7 @@ async fn dispatch(req: &HostRequest, coord: Arc<Coordinator>) -> HostResponse {
HostRequest::Urls => HostResponse::urls(hive_urls()),
HostRequest::Pending => HostResponse::pending(coord.approvals.pending()?),
HostRequest::Approve { id } => {
actions::approve(coord.clone(), *id).await?;
actions::approve(&coord, *id)?;
HostResponse::success()
}
HostRequest::Deny { id } => {

155
hive-c0re/src/socket_server/mod.rs
View file

@ -3,8 +3,8 @@
//! authenticates the caller: connecting to `<.../agents/foo/mcp.sock>` means
//! you are `foo`; the manager socket simply serves as `ruth`. There is no
//! privilege flag — both transports run the same [`serve`] / [`dispatch`]
//! code, and authority derives uniformly from the caller's identity:
//! tool-group membership for the orchestration verbs. An agent-targeting
//! code, and authority derives uniformly from the caller's identity
//! (tool-group membership for cancelling an approval). An agent-targeting
//! verb may name any agent, so `ruth` reaches every agent exactly the way
//! every other agent does, not via any hardcoded name match.
@ -21,16 +21,6 @@ use tokio::task::JoinHandle;
use crate::coordinator::Coordinator;
mod schedules;
pub(crate) use schedules::filter_ghost_schedule_targets;
pub use schedules::schedule_to_wire_public;
use schedules::{
EditSchedulePatch, handle_cancel_schedule, handle_edit_schedule, handle_fire_schedule_now,
handle_list_schedules, handle_request_schedule_prompt,
};
pub struct AgentSocket {
pub path: PathBuf,
pub handle: JoinHandle<()>,
@ -275,21 +265,15 @@ pub(crate) fn recv_timeout(wait_seconds: Option<u64>) -> std::time::Duration {
}
}
/// Handle the subset of `Request` variants that are identical on both
/// the agent socket and the manager socket. Returns `Some(response)` for
/// every variant it handles; returns `None` for the remaining variants —
/// `GetLooseEnds` and the orchestration verbs (schedules), which need
/// per-verb tool-group gating — or for host-admin / unknown requests
/// invalid on either socket.
///
/// The unified `dispatch` calls this first; the remaining arms (which gate
/// on topology / capabilities / tool-groups) are handled there.
pub(crate) async fn dispatch_shared(
/// Unified dispatch for every socket connection — per-agent sockets and the
/// (now pure-transport) manager socket alike. There is no privilege bit;
/// authority derives uniformly from the caller's identity.
async fn dispatch(
req: &hive_core_agent_sock::Request,
agent: &str,
coord: &Arc<Coordinator>,
) -> Option<hive_core_agent_sock::Response> {
Some(match req {
) -> hive_core_agent_sock::Response {
match req {
hive_core_agent_sock::Request::Send {
to,
body,
@ -331,9 +315,8 @@ pub(crate) async fn dispatch_shared(
coord.clear_pause_pending(agent);
hive_core_agent_sock::Response::Ok
}
// Not a shared variant.
_ => return None,
})
hive_core_agent_sock::Request::GetLooseEnds => handle_get_loose_ends(coord, agent),
}
}
/// `Recv` — long-poll the broker for up to `max` messages (capped at
@ -572,104 +555,6 @@ fn handle_requeue_inflight(
}
}
/// Unified dispatch for every socket connection — per-agent sockets and the
/// (now pure-transport) manager socket alike. There is no privilege bit;
/// authority derives uniformly from the caller's identity: hive-wide
/// orchestration verbs (schedules) require the matching tool-group (the
/// grantable capability).
async fn dispatch(req: &Request, agent: &str, coord: &Arc<Coordinator>) -> Response {
if let Some(resp) = dispatch_shared(req, agent, coord).await {
return resp;
}
match req {
Request::GetLooseEnds => handle_get_loose_ends(coord, agent),
// Orchestration verbs — gated per-verb on tool-group membership
// (see `dispatch_orchestration`).
_ => dispatch_orchestration(req, agent, coord).await,
}
}
/// Handle the hive-wide orchestration verbs (scheduling). No blanket socket
/// gate: each verb gates on the grantable capability that authorises it —
/// the matching tool-group (`scheduling`). Any other variant is a
/// host-admin / unknown request invalid on either socket.
async fn dispatch_orchestration(req: &Request, agent: &str, coord: &Arc<Coordinator>) -> Response {
match req {
Request::RequestSchedulePrompt(payload) => {
if let Some(err) = require_group(agent, "scheduling", "schedule a prompt") {
return err;
}
handle_request_schedule_prompt(coord, agent, payload)
}
Request::CancelSchedule { id, targets } => {
if let Some(err) = require_group(agent, "scheduling", "cancel a schedule") {
return err;
}
handle_cancel_schedule(coord, agent, *id, targets.as_deref())
}
Request::EditSchedule {
id,
body,
description,
interval_seconds,
next_fire_at_unix,
targets_add,
targets_remove,
} => {
if let Some(err) = require_group(agent, "scheduling", "edit a schedule") {
return err;
}
handle_edit_schedule(
coord,
agent,
*id,
EditSchedulePatch {
body: body.clone(),
description: description.clone(),
interval_seconds: *interval_seconds,
next_fire_at_unix: *next_fire_at_unix,
targets_add: targets_add.clone(),
targets_remove: targets_remove.clone(),
},
)
}
Request::ListSchedules => {
if let Some(err) = require_group(agent, "scheduling", "list schedules") {
return err;
}
handle_list_schedules(coord, agent)
}
Request::FireScheduleNow { id } => {
if let Some(err) = require_group(agent, "scheduling", "fire a schedule") {
return err;
}
handle_fire_schedule_now(coord, agent, *id).await
}
// Host-admin-only / unknown variants: never valid on either socket.
_ => Response::Err {
message: "request not handled on this socket".to_owned(),
},
}
}
/// Capability guard for the hive-wide orchestration verbs: the caller must
/// hold the given tool-group. The tool-group (c0re-owned `tool_groups.json`,
/// read server-side via [`crate::tool_groups::groups_for`]) is the grantable
/// capability — granting it to an orchestrator (e.g. the root) authorises
/// these verbs without any positional/hardcoded privilege. `action` is the
/// verb phrase for the message.
fn require_group(agent: &str, group: &str, action: &str) -> Option<Response> {
match crate::tool_groups::groups_for(agent) {
Ok(groups) if groups.iter().any(|g| g == group) => None,
Ok(_) => Some(Response::Err {
message: format!("agent `{agent}` cannot {action}: requires the `{group}` tool group"),
}),
Err(e) => Some(Response::Err {
message: format!("agent `{agent}` cannot {action}: {e}"),
}),
}
}
/// `GetLooseEnds` — always the caller's own loose ends.
fn handle_get_loose_ends(coord: &Arc<Coordinator>, agent: &str) -> Response {
match crate::loose_ends::for_agent(coord, agent) {
@ -767,10 +652,9 @@ fn check_can_cancel_approval(canceller: &str) -> Result<(), String> {
}
}
/// Common Send handler shared between dispatch arms. Applies the
/// `Send` handler. Applies the
/// 4 KiB body cap, then routes broadcast (`to == "*"`) / unicast through
/// their respective broker calls.
/// `pub(crate)` so `dispatch_shared` can use it across both socket paths.
pub(crate) fn handle_send(
coord: &Arc<Coordinator>,
agent: &str,
@ -837,6 +721,21 @@ pub(crate) fn handle_send(
mod tests {
use super::*;
/// A real `Coordinator` over a throwaway sqlite dir. `serve` takes an
/// `Arc<Coordinator>`, so there is no lighter way in; `open` touches
/// nothing outside the db path it is handed.
fn coordinator() -> (tempfile::TempDir, Arc<Coordinator>) {
let dir = tempfile::tempdir().expect("tempdir");
let coord = Coordinator::open(
&dir.path().join("broker.sqlite"),
crate::coordinator::HiveEnv::default(),
crate::hive_stats::PriceTable::new(),
1,
)
.expect("open coordinator");
(dir, Arc::new(coord))
}
#[test]
fn approval_cancel_rejects_callers_without_the_approvals_group() {
// A caller that doesn't hold the `approvals` tool-group must not be
@ -869,7 +768,7 @@ mod tests {
#[tokio::test]
async fn serve_answers_an_over_long_line_with_an_error_and_closes() {
let (_dir, coord) = schedules::tests::coordinator();
let (_dir, coord) = coordinator();
let (client, server) = UnixStream::pair().expect("socketpair");
let handler = tokio::spawn(serve(server, "iris".to_owned(), coord));
let (read, mut write) = client.into_split();

485
hive-c0re/src/socket_server/schedules.rs
View file

@ -1,485 +0,0 @@
//! Scheduled-prompt request handlers (`ListSchedules` /
//! `RequestSchedulePrompt` / `CancelSchedule` / `EditSchedule` /
//! `FireScheduleNow`) and the
//! schedule-to-wire mapping reused by the dashboard
//! (`schedule_to_wire_public` / `filter_ghost_schedule_targets`).
use std::sync::Arc;
use hive_core_agent_sock::Response;
use crate::coordinator::Coordinator;
/// `ListSchedules` — snapshot every scheduled prompt. Ownership no longer
/// narrows the view: `CancelSchedule`/`EditSchedule`/`FireScheduleNow` accept
/// any requester, so filtering the listing would only hide rows the requester
/// can act on anyway.
pub(super) fn handle_list_schedules(coord: &Arc<Coordinator>, requester: &str) -> Response {
tracing::debug!(%requester, "list schedules");
match coord.scheduled_prompts.list() {
Ok(schedules) => Response::Schedules {
schedules: schedules.into_iter().map(schedule_to_wire).collect(),
},
Err(e) => Response::Err {
message: format!("list scheduled prompts: {e:#}"),
},
}
}
/// Submit a `RequestSchedulePrompt` payload as an `ApprovalKind::SchedulePrompt`
/// row. Encodes the payload into the approval's `commit_ref` so the
/// approve handler can re-parse it without a side table. Validates
/// inputs (non-empty targets, non-empty body, sane interval) at
/// submit time — the operator should never see a malformed schedule
/// pending approval.
pub(super) fn handle_request_schedule_prompt(
coord: &Arc<Coordinator>,
requester: &str,
payload: &hive_sh4re::manager::SchedulePromptPayload,
) -> Response {
if payload.targets.is_empty() {
return Response::Err {
message: "schedule must have at least one target".into(),
};
}
if payload
.targets
.iter()
.any(|t| t == hive_sh4re::manager::OPERATOR_RECIPIENT)
{
return Response::Err {
message: "operator is not a valid schedule target".into(),
};
}
if payload.body.trim().is_empty() {
return Response::Err {
message: "schedule body must be non-empty".into(),
};
}
if let Some(0) = payload.interval_seconds {
return Response::Err {
message: "interval_seconds must be > 0 (use None for one-shot)".into(),
};
}
let commit_ref = match serde_json::to_string(payload) {
Ok(s) => s,
Err(e) => {
return Response::Err {
message: format!("encode SchedulePromptPayload: {e:#}"),
};
}
};
let id = match coord.approvals.submit_kind(
requester,
hive_sh4re::approvals::ApprovalKind::SchedulePrompt,
&commit_ref,
payload.description.as_deref(),
requester,
) {
Ok(id) => id,
Err(e) => {
return Response::Err {
message: format!("queue schedule_prompt approval: {e:#}"),
};
}
};
tracing::info!(
%id,
requester,
targets = ?payload.targets,
first_fire_at = payload.first_fire_at_unix,
interval = ?payload.interval_seconds,
"schedule_prompt approval queued"
);
coord.emit_approval_added(crate::coordinator::ApprovalAdded {
id,
agent: requester,
approval_kind: "schedule_prompt",
description: payload.description.clone(),
});
Response::Ok
}
/// Cancel a schedule (whole or per-target). Any requester may cancel any
/// schedule, whoever owns it.
pub(super) fn handle_cancel_schedule(
coord: &Arc<Coordinator>,
requester: &str,
schedule_id: i64,
targets: Option<&[String]>,
) -> Response {
// Existence check only — it buys the caller a clean "not found" instead
// of whatever the cancel itself would say about an absent row.
if let Some(err) = require_schedule(coord, schedule_id) {
return err;
}
tracing::info!(%requester, %schedule_id, "cancel schedule");
let result = match targets {
Some(list) if !list.is_empty() => coord
.scheduled_prompts
.cancel_targets(schedule_id, list)
.map_err(|e| format!("cancel targets: {e:#}")),
_ => coord
.scheduled_prompts
.cancel_all(schedule_id)
.map_err(|e| format!("cancel all: {e:#}")),
};
match result {
Ok(()) => {
coord.emit_schedules_snapshot();
Response::Ok
}
Err(message) => Response::Err { message },
}
}
/// Dispatch a `FireScheduleNow` request. Same rule as `CancelSchedule`: any
/// requester, any schedule. The actual fan-out lives in
/// `scheduled_prompts_worker::fire_now`.
pub(super) async fn handle_fire_schedule_now(
coord: &Arc<Coordinator>,
requester: &str,
schedule_id: i64,
) -> Response {
if let Some(err) = require_schedule(coord, schedule_id) {
return err;
}
tracing::info!(%requester, %schedule_id, "fire schedule now");
// MCP fire_schedule_now stays no-reset (cadence intact); the
// reset-timer option is a dashboard-dialog affordance.
match crate::scheduled_prompts_worker::fire_now(coord, schedule_id, false).await {
Ok(_report) => {
coord.emit_schedules_snapshot();
Response::Ok
}
Err(e) => Response::Err {
message: format!("fire schedule {schedule_id} now: {e:#}"),
},
}
}
/// Field-named PATCH payload for [`handle_edit_schedule`]. Every
/// field is "leave alone" when `None`; the double-`Option` fields
/// additionally distinguish clear (`Some(None)`) from set
/// (`Some(Some(v))`).
#[allow(
clippy::option_option,
reason = "double-Option carries three-state PATCH semantics: outer None = \
leave alone, Some(None) = clear, Some(Some(v)) = set"
)]
pub(super) struct EditSchedulePatch {
pub(super) body: Option<String>,
pub(super) description: Option<Option<String>>,
pub(super) interval_seconds: Option<Option<u64>>,
pub(super) next_fire_at_unix: Option<i64>,
pub(super) targets_add: Option<Vec<String>>,
pub(super) targets_remove: Option<Vec<String>>,
}
/// Dispatch an `EditSchedule` patch. Same rule as `CancelSchedule`: any
/// requester, any schedule. Forwards the partial payload to
/// `ScheduledPrompts::update` which enforces the cancelled-row /
/// zero-interval validation. Returns `Ok` on a clean update;
/// `Err` with the underlying message on any validation
/// failure so the dashboard can surface it verbatim.
pub(super) fn handle_edit_schedule(
coord: &Arc<Coordinator>,
requester: &str,
schedule_id: i64,
patch: EditSchedulePatch,
) -> Response {
let EditSchedulePatch {
body,
description,
interval_seconds,
next_fire_at_unix,
targets_add,
targets_remove,
} = patch;
if let Some(err) = require_schedule(coord, schedule_id) {
return err;
}
tracing::info!(%requester, %schedule_id, "edit schedule");
let patch = crate::scheduled_prompts::UpdateSchedule {
body,
description,
interval_seconds,
next_fire_at_unix,
targets_add,
targets_remove,
};
match coord.scheduled_prompts.update(schedule_id, patch) {
Ok(()) => {
coord.emit_schedules_snapshot();
Response::Ok
}
Err(e) => Response::Err {
message: format!("edit schedule {schedule_id}: {e:#}"),
},
}
}
/// Shared existence guard for the three schedule-mutating verbs: `None` when
/// the row is there, `Some(Err)` to short-circuit when it isn't or the read
/// failed. Not a permission check — any requester may act on any schedule.
fn require_schedule(coord: &Arc<Coordinator>, schedule_id: i64) -> Option<Response> {
match coord.scheduled_prompts.get(schedule_id) {
Ok(Some(_)) => None,
Ok(None) => Some(Response::Err {
message: format!("schedule {schedule_id} not found"),
}),
Err(e) => Some(Response::Err {
message: format!("read schedule {schedule_id}: {e:#}"),
}),
}
}
/// Map a `scheduled_prompts::Schedule` to its public wire shape.
/// Field-by-field copy — the two types are intentionally identical;
/// the separation keeps hive-sh4re free of hive-c0re-internal types.
/// Public alias `schedule_to_wire_public` re-exports for
/// `dashboard.rs::api_schedules` without crossing the module
/// boundary into the socket-server file.
pub fn schedule_to_wire_public(
s: crate::scheduled_prompts::Schedule,
) -> hive_sh4re::schedule::WireSchedule {
schedule_to_wire(s)
}
/// Drop schedule targets that point at agents which no longer exist, so
/// the dashboard's schedule table doesn't render ghost columns for
/// destroyed agents. `live` is the set of logical agent names from the
/// last `nixos-container list` scan (stopped agents included, destroyed
/// ones absent). Applied only to the dashboard wire paths
/// (`api_schedules` + the `SchedulesChanged` SSE emit) — `list_schedules`
/// doesn't apply this filter (it still returns every live target, ghost
/// or not, on the schedules the requester is authorized to see) so an
/// agent can still see and cancel its own stale targets. This is a view
/// filter: the underlying schedule rows keep every target, so a
/// re-spawned agent's targets reappear on their own.
pub(crate) fn filter_ghost_schedule_targets(
schedules: &mut [hive_sh4re::schedule::WireSchedule],
live: &std::collections::HashSet<String>,
) {
for s in schedules.iter_mut() {
s.targets.retain(|t| live.contains(&t.target));
}
}
fn schedule_to_wire(s: crate::scheduled_prompts::Schedule) -> hive_sh4re::schedule::WireSchedule {
hive_sh4re::schedule::WireSchedule {
id: s.id,
owner: s.owner,
body: s.body,
interval_seconds: s.interval_seconds,
next_fire_at_unix: s.next_fire_at_unix,
created_at_unix: s.created_at_unix,
source: match s.source {
crate::scheduled_prompts::ScheduleSource::Operator => {
hive_sh4re::schedule::WireScheduleSource::Operator
}
crate::scheduled_prompts::ScheduleSource::Approval { id } => {
hive_sh4re::schedule::WireScheduleSource::Approval { id }
}
},
cancelled_at_unix: s.cancelled_at_unix,
paused_at_unix: s.paused_at_unix,
description: s.description,
targets: s
.targets
.into_iter()
.map(|t| hive_sh4re::schedule::WireScheduleTarget {
target: t.target,
cancelled_at_unix: t.cancelled_at_unix,
last_fired_at_unix: t.last_fired_at_unix,
last_result: t.last_result,
})
.collect(),
}
}
#[cfg(test)]
pub(super) mod tests {
use super::*;
fn target(name: &str) -> hive_sh4re::schedule::WireScheduleTarget {
hive_sh4re::schedule::WireScheduleTarget {
target: name.to_owned(),
cancelled_at_unix: None,
last_fired_at_unix: None,
last_result: None,
}
}
fn schedule(targets: &[&str]) -> hive_sh4re::schedule::WireSchedule {
hive_sh4re::schedule::WireSchedule {
id: 1,
owner: "operator".to_owned(),
body: "ping".to_owned(),
interval_seconds: None,
next_fire_at_unix: hive_sh4re::wire_time::from_secs(0),
created_at_unix: hive_sh4re::wire_time::from_secs(0),
source: hive_sh4re::schedule::WireScheduleSource::Operator,
cancelled_at_unix: None,
paused_at_unix: None,
description: None,
targets: targets.iter().map(|t| target(t)).collect(),
}
}
#[test]
fn ghost_filter_drops_dead_agents_keeps_live() {
let live: std::collections::HashSet<String> = ["iris".to_owned(), "damocles".to_owned()]
.into_iter()
.collect();
let mut schedules = vec![schedule(&["iris", "ghost", "damocles"])];
filter_ghost_schedule_targets(&mut schedules, &live);
let kept: Vec<&str> = schedules[0]
.targets
.iter()
.map(|t| t.target.as_str())
.collect();
// `ghost` (destroyed) dropped; live agents kept.
assert_eq!(kept, vec!["iris", "damocles"]);
}
#[test]
fn ghost_filter_can_empty_targets_when_all_dead() {
let live: std::collections::HashSet<String> = std::collections::HashSet::new();
let mut schedules = vec![schedule(&["gone1", "gone2"])];
filter_ghost_schedule_targets(&mut schedules, &live);
assert!(schedules[0].targets.is_empty());
}
// -----------------------------------------------------------------------
// The scheduling surface permits an unrelated requester
//
// These pin the *decision* the deleted `schedule_authorized` used to make,
// inverted: a requester with no relation to a schedule's owner reaches the
// handler's effect instead of a refusal. They live at the handler level
// because the predicate, its pure `_in` form and all three wrappers are
// gone — the handler is the lowest layer where the decision still exists
// to be observed.
//
// `OWNER` and `STRANGER` are names no hive has, so no `topology.json` on
// any machine running these tests can relate them. Any ancestry check
// reintroduced between the two — disk-reading or pure — therefore answers
// "unrelated", and every assertion below flips from the handler's effect
// to a refusal.
// -----------------------------------------------------------------------
/// Owner of the schedule under test.
const OWNER: &str = "schedule-owner-with-no-relations";
/// Requester acting on it: not the owner, not the operator, and not
/// anybody's ancestor or descendant.
const STRANGER: &str = "requester-with-no-relations";
/// A real `Coordinator` over a throwaway sqlite dir. The socket-server
/// handlers take `&Arc<Coordinator>`, so there is no lighter way in;
/// `open` touches nothing outside the db path it is handed.
pub(crate) fn coordinator() -> (tempfile::TempDir, Arc<Coordinator>) {
let dir = tempfile::tempdir().expect("tempdir");
let coord = Coordinator::open(
&dir.path().join("broker.sqlite"),
crate::coordinator::HiveEnv::default(),
crate::hive_stats::PriceTable::new(),
1,
)
.expect("open coordinator");
(dir, Arc::new(coord))
}
/// Insert a schedule owned by [`OWNER`], returning its id.
fn submit_owned_by_other(coord: &Arc<Coordinator>) -> i64 {
coord
.scheduled_prompts
.submit(&crate::scheduled_prompts::NewSchedule {
owner: OWNER.to_owned(),
targets: vec!["iris".to_owned()],
body: "ping".to_owned(),
first_fire_at_unix: 100,
interval_seconds: None,
description: None,
source: crate::scheduled_prompts::ScheduleSource::Operator,
})
.expect("submit")
}
#[test]
fn cancel_schedule_permits_unrelated_requester() {
let (_dir, coord) = coordinator();
let id = submit_owned_by_other(&coord);
let resp = handle_cancel_schedule(&coord, STRANGER, id, None);
assert!(
matches!(resp, Response::Ok),
"unrelated requester must be allowed to cancel; got {resp:?}"
);
// Ok alone could be a refusal that forgot to say so — check the row.
let row = coord
.scheduled_prompts
.get(id)
.expect("read back")
.expect("row present");
assert!(
row.cancelled_at_unix.is_some(),
"cancel must have taken effect, not just answered Ok"
);
}
#[test]
fn edit_schedule_permits_unrelated_requester() {
let (_dir, coord) = coordinator();
let id = submit_owned_by_other(&coord);
let resp = handle_edit_schedule(
&coord,
STRANGER,
id,
EditSchedulePatch {
body: Some("edited by a stranger".to_owned()),
description: None,
interval_seconds: None,
next_fire_at_unix: None,
targets_add: None,
targets_remove: None,
},
);
assert!(
matches!(resp, Response::Ok),
"unrelated requester must be allowed to edit; got {resp:?}"
);
let row = coord
.scheduled_prompts
.get(id)
.expect("read back")
.expect("row present");
assert_eq!(row.body, "edited by a stranger");
}
#[tokio::test]
async fn fire_schedule_now_permits_unrelated_requester() {
let (_dir, coord) = coordinator();
let id = submit_owned_by_other(&coord);
let resp = handle_fire_schedule_now(&coord, STRANGER, id).await;
// The fan-out itself is allowed to find no live target (this test has
// no containers) — that is reported inside the report, not as an Err.
assert!(
matches!(resp, Response::Ok),
"unrelated requester must be allowed to fire; got {resp:?}"
);
}
#[test]
fn list_schedules_shows_a_schedule_owned_by_someone_else() {
let (_dir, coord) = coordinator();
let id = submit_owned_by_other(&coord);
let Response::Schedules { schedules } = handle_list_schedules(&coord, STRANGER) else {
panic!("expected a Schedules response");
};
// The deleted filter dropped every row the requester was unrelated to,
// which for this requester is all of them.
assert!(
schedules.iter().any(|s| s.id == id && s.owner == OWNER),
"unrelated requester must see another agent's schedule; got {schedules:?}"
);
}
}

80
hive-c0re/src/stores/approvals.rs
View file

@ -1,10 +1,9 @@
//! Approval queue. Requests are submitted by an agent
//! (`RequestSchedulePrompt`); the user approves/denies via the host admin
//! CLI; on approval the host runs the corresponding action.
//! Approval queue. The user approves/denies via the host admin CLI; on
//! approval the host runs the corresponding action.
//!
//! `UpdateMetaInputs` rows are legacy: the MCP tool that queued them was
//! removed and nothing produces the kind any more. The variant and
//! its (de)serialization stay so pre-existing rows still read back.
//! Nothing submits approvals any more. `UpdateMetaInputs`, the only kind
//! left, is legacy: the MCP tool that queued it was removed. The variant
//! and its (de)serialization stay so pre-existing rows still read back.
use std::path::Path;
use std::sync::Mutex;
@ -64,6 +63,13 @@ const MIGRATIONS: &[Migration] = &[
sql: "DELETE FROM approvals WHERE kind = 'merge_config_pr'",
adds_column: None,
},
// v6: drop `schedule_prompt` rows. Scheduled prompts are swarm-level, so
// no approval of that kind can be acted on, and `row_to_approval` rejects
// the kind.
Migration {
sql: "DELETE FROM approvals WHERE kind = 'schedule_prompt'",
adds_column: None,
},
];
pub struct Approvals {
@ -81,7 +87,8 @@ impl Approvals {
})
}
/// Insert a new pending approval row.
/// Test fixture: insert a new pending approval row.
#[cfg(test)]
pub fn submit_kind(
&self,
agent: &str,
@ -354,7 +361,6 @@ fn row_to_approval(row: &rusqlite::Row<'_>) -> rusqlite::Result<Approval> {
let kind: String = row.get(2)?;
let kind = match kind.as_str() {
"update_meta_inputs" => ApprovalKind::UpdateMetaInputs,
"schedule_prompt" => ApprovalKind::SchedulePrompt,
other => {
return Err(rusqlite::Error::FromSqlConversionFailure(
2,
@ -404,7 +410,6 @@ fn row_to_approval(row: &rusqlite::Row<'_>) -> rusqlite::Result<Approval> {
fn kind_from_str(s: &str) -> Result<ApprovalKind> {
Ok(match s {
"update_meta_inputs" => ApprovalKind::UpdateMetaInputs,
"schedule_prompt" => ApprovalKind::SchedulePrompt,
other => bail!("unknown approval kind '{other}'"),
})
}
@ -421,17 +426,6 @@ mod tests {
(dir, path, db)
}
#[test]
fn mixed_kinds_all_listed() {
let (_dir, _path, db) = open_temp();
db.submit_kind("b", ApprovalKind::SchedulePrompt, "", None, "b")
.unwrap();
db.submit_kind("c", ApprovalKind::UpdateMetaInputs, "[]", None, "c")
.unwrap();
let pending = db.pending().expect("pending");
assert_eq!(pending.len(), 2, "both kinds must be visible");
}
#[test]
fn mark_cancelled_transitions_pending_row() {
// Manager withdraws a pending approval. Row leaves pending(),
@ -441,8 +435,8 @@ mod tests {
let id = db
.submit_kind(
"bitburner",
ApprovalKind::SchedulePrompt,
"{}",
ApprovalKind::UpdateMetaInputs,
"[]",
Some("test"),
"bitburner",
)
@ -464,7 +458,7 @@ mod tests {
// final — re-cancelling errors instead of silently overwriting.
let (_dir, _path, db) = open_temp();
let id = db
.submit_kind("a", ApprovalKind::SchedulePrompt, "{}", None, "a")
.submit_kind("a", ApprovalKind::UpdateMetaInputs, "[]", None, "a")
.unwrap();
db.mark_cancelled(id, "manager").expect("first cancel");
let err = db
@ -479,7 +473,7 @@ mod tests {
// whole list — collect_lenient skips it instead of failing.
let (_dir, path, db) = open_temp();
let good = db
.submit_kind("good", ApprovalKind::SchedulePrompt, "{}", None, "good")
.submit_kind("good", ApprovalKind::UpdateMetaInputs, "[]", None, "good")
.unwrap();
let raw = Connection::open(&path).unwrap();
raw.execute(
@ -502,14 +496,20 @@ mod tests {
// fall back to the root agent.
let (_dir, path, db) = open_temp();
let id = db
.submit_kind("child", ApprovalKind::SchedulePrompt, "{}", None, "parent")
.submit_kind(
"child",
ApprovalKind::UpdateMetaInputs,
"[]",
None,
"parent",
)
.unwrap();
assert_eq!(db.submitter_of(id).unwrap().as_deref(), Some("parent"));
let raw = Connection::open(&path).unwrap();
raw.execute(
"INSERT INTO approvals (agent, kind, commit_ref, requested_at, status)
VALUES ('old', 'schedule_prompt', '', 0, 'pending')",
VALUES ('old', 'update_meta_inputs', '', 0, 'pending')",
[],
)
.unwrap();
@ -524,7 +524,7 @@ mod tests {
fn a_pre_v5_merge_config_pr_row_is_dropped_on_open() {
let (_dir, path, db) = open_temp();
let kept = db
.submit_kind("iris", ApprovalKind::SchedulePrompt, "{}", None, "iris")
.submit_kind("iris", ApprovalKind::UpdateMetaInputs, "[]", None, "iris")
.unwrap();
drop(db);
let raw = Connection::open(&path).unwrap();
@ -546,4 +546,30 @@ mod tests {
assert!(db.recent_resolved(10).unwrap().is_empty());
assert!(db.get(old).unwrap().is_none());
}
/// A database written before v6 still holds `schedule_prompt` rows.
/// Opening it drops them and keeps every other row.
#[test]
fn a_pre_v6_schedule_prompt_row_is_dropped_on_open() {
let (_dir, path, db) = open_temp();
let kept = db
.submit_kind("iris", ApprovalKind::UpdateMetaInputs, "[]", None, "iris")
.unwrap();
drop(db);
let raw = Connection::open(&path).unwrap();
raw.execute_batch(
"INSERT INTO approvals (agent, kind, commit_ref, requested_at, status)
VALUES ('iris', 'schedule_prompt', '{}', 0, 'pending');
UPDATE schema_versions SET version = 5 WHERE store = 'approvals';",
)
.unwrap();
let old: i64 = raw.last_insert_rowid();
drop(raw);
let db = Approvals::open(&path).expect("a pre-v6 db opens");
let pending = db.pending().expect("pending");
assert_eq!(pending.len(), 1);
assert_eq!(pending[0].id, kept);
assert!(db.get(old).unwrap().is_none());
}
}

Some files were not shown because too many files have changed in this diff Show more