From dcd559e7c76febb4c39f9feebd15e39e144738d4 Mon Sep 17 00:00:00 2001 From: atlas Date: Fri, 10 Jul 2026 21:15:06 +0200 Subject: [PATCH] =?UTF-8?q?fix(#2368):=20AGENT=5FRUNTIME=5FROOT=20?= =?UTF-8?q?=E2=86=92=20priv=5Fproto;=20fix=20stale=20priv=20comment;=20cro?= =?UTF-8?q?ss-ref=20lockstep?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Add `priv_proto::AGENT_RUNTIME_ROOT` to hive-sh4re as the shared single source for the per-agent runtime root path. hive-priv now imports it instead of carrying a local const with a stale comment that still pointed at `coordinator::AGENT_RUNTIME_ROOT` (removed in #2285/#2367 — moved to `paths::agent_runtime_root()`). - Add 'must stay in sync' cross-ref comments on both sides of the privsep boundary: · priv_proto::META_DIR ↔ paths::meta_root() · priv_proto::AGENT_STATE_ROOT ↔ paths::AGENTS_ROOT · priv_proto::AGENT_RUNTIME_ROOT ↔ paths::RUNTIME_ROOT + agent_runtime_root() · paths::AGENTS_ROOT ↔ priv_proto::AGENT_STATE_ROOT · paths::RUNTIME_ROOT ↔ priv_proto::AGENT_RUNTIME_ROOT The dep graph prevents a shared import (hive-sh4re is a leaf; both hive-c0re and hive-priv depend on it but not each other), so the lockstep comments are the enforced contract. --- hive-c0re/src/paths.rs | 4 ++++ hive-priv/src/main.rs | 10 +++------- hive-sh4re/src/priv_proto.rs | 12 ++++++++++++ 3 files changed, 19 insertions(+), 7 deletions(-) diff --git a/hive-c0re/src/paths.rs b/hive-c0re/src/paths.rs index ee3bb0b0..cbcf1a7e 100644 --- a/hive-c0re/src/paths.rs +++ b/hive-c0re/src/paths.rs @@ -31,6 +31,8 @@ pub const STATE_ROOT: &str = "/var/lib/hyperhive"; /// `/run/hyperhive` — hive-c0re's runtime root (host admin socket, the /// per-agent runtime dirs). Regenerated each boot; not persistent state. // nix: `RuntimeDirectory=hyperhive` on the hive-c0re service (hive-c0re.nix) — must match. +// sh4re: `hive_sh4re::priv_proto::AGENT_RUNTIME_ROOT` is `RUNTIME_ROOT + "/agents"` and must +// stay in sync; the privsep boundary prevents importing across the crate. pub const RUNTIME_ROOT: &str = "/run/hyperhive"; /// Default host admin socket (`/run/hyperhive/host.sock`). Exposed as a @@ -152,6 +154,8 @@ pub fn agent_sockets_file() -> PathBuf { /// dashboard state-file allow-list uses it for `strip_prefix` / /// `starts_with` checks), so it stays a const; [`agents_root`] wraps it. // nix: agent container bind-mount source (harness-base.nix / agent-base.nix) — must match. +// sh4re: `hive_sh4re::priv_proto::AGENT_STATE_ROOT` is the same value and must stay in sync; +// the privsep boundary prevents importing across the crate. pub const AGENTS_ROOT: &str = "/var/lib/hyperhive/agents"; #[must_use] diff --git a/hive-priv/src/main.rs b/hive-priv/src/main.rs index 615e0794..93293183 100644 --- a/hive-priv/src/main.rs +++ b/hive-priv/src/main.rs @@ -21,9 +21,9 @@ use std::path::{Path, PathBuf}; use anyhow::{Context as _, Result, bail}; use hive_sh4re::priv_proto::{ - AGENT_PREFIX, AGENT_STATE_ROOT, BindMount, CredentialMount, InfraAction, InfraContainer, - JournalQuery, META_DIR, NetworkIsolation, PRIV_SOCK, PrivEvent, PrivRequest, PrivResponse, - PrivStream, PrivStreamLine, SIBLING_CONTAINERS, + AGENT_PREFIX, AGENT_RUNTIME_ROOT, AGENT_STATE_ROOT, BindMount, CredentialMount, InfraAction, + InfraContainer, JournalQuery, META_DIR, NetworkIsolation, PRIV_SOCK, PrivEvent, PrivRequest, + PrivResponse, PrivStream, PrivStreamLine, SIBLING_CONTAINERS, }; use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader}; use tokio::net::unix::OwnedWriteHalf; @@ -33,10 +33,6 @@ use tokio::process::Command; /// Root of the per-agent unix-socket dirs on the host. const SOCKET_DIR_ROOT: &str = "/run/hive-agent"; -/// Root of the per-agent MCP socket dirs on the host. -/// Matches `coordinator::AGENT_RUNTIME_ROOT` in hive-c0re. -const AGENT_RUNTIME_ROOT: &str = "/run/hyperhive/agents"; - #[tokio::main] async fn main() -> Result<()> { tracing_subscriber::fmt() diff --git a/hive-sh4re/src/priv_proto.rs b/hive-sh4re/src/priv_proto.rs index 5ca0268e..89fef768 100644 --- a/hive-sh4re/src/priv_proto.rs +++ b/hive-sh4re/src/priv_proto.rs @@ -101,14 +101,26 @@ impl std::str::FromStr for InfraContainer { /// Host path of the meta flake. The flake ref for agent `` is /// `{META_DIR}#{name}`, derived by `hive-priv` — never passed over the wire. +/// Must stay in sync with `hive-c0re::paths::meta_root()` (`STATE_ROOT + +/// "/meta"`); the privsep boundary prevents importing across the crate. pub const META_DIR: &str = "/var/lib/hyperhive/meta"; /// Root of per-agent state directories on the host. /// Subdirectory layout: `//state/`. /// Used by `WriteAgentStateFile` to derive the write path so the /// exact path is never passed over the wire. +/// Must stay in sync with `hive-c0re::paths::AGENTS_ROOT`; the privsep +/// boundary prevents importing across the crate. pub const AGENT_STATE_ROOT: &str = "/var/lib/hyperhive/agents"; +/// Root of per-agent runtime directories on the host (regenerated each boot +/// by `hive-priv` tmpfiles.d; not persistent). Used by `hive-priv` when +/// creating per-agent subdirs via `nsenter` / tmpfiles. +/// Must stay in sync with `hive-c0re::paths::agent_runtime_root()` +/// (`RUNTIME_ROOT + "/agents"`); the privsep boundary prevents importing +/// across the crate. +pub const AGENT_RUNTIME_ROOT: &str = "/run/hyperhive/agents"; + /// Output format for `ReadContainerJournal`. Maps to journalctl /// `--output=<...>`. Restricted to the two formats hive callers use so /// the wire type can't smuggle an arbitrary `--output` value.