vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

refactor(#2431): extract hive-priv-sock crate from hive-sh4re

Browse source 
Split the priv-socket wire types (PrivRequest/PrivResponse/PrivEvent and
friends) out of hive-sh4re into their own hive-priv-sock crate, mirroring
the existing hive-host-sock split. hive-priv — the root-privileged
helper — now depends on just this narrow protocol crate instead of the
much larger daemon-shared crate, shrinking its dependency surface and
making the privsep boundary easier to audit. No server/client
implementation lives here, only the wire contract; hive-c0re still
depends on hive-sh4re directly for everything else.
This commit is contained in:
atlas 2026-07-14 19:52:12 +02:00 • committed by mara
commit e0461e1af6
18 changed files with 52 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

4
hive-c0re/src/socket_server/lifecycle_handlers.rs
View file

@ -44,7 +44,7 @@ pub(super) async fn handle_restart(
// same restart tool. The `InfraContainer` enum parse both recognises
// these (never agent children, so disjoint from the child path below)
// and yields the typed value the restart path needs.
if let Ok(container) = name.parse::<hive_sh4re::priv_proto::InfraContainer>() {
if let Ok(container) = name.parse::<hive_priv_sock::InfraContainer>() {
return handle_restart_infra(coord, agent, container).await;
}
if let Some(err) = require_descendant(agent, name, "restart") {
@ -68,7 +68,7 @@ pub(super) async fn handle_restart(
async fn handle_restart_infra(
coord: &Arc<Coordinator>,
agent: &str,
container: hive_sh4re::priv_proto::InfraContainer,
container: hive_priv_sock::InfraContainer,
) -> AgentResponse {
let name = container.unit_name();
// Record the attempt in the operator-visible privileged-action audit

4
hive-c0re/src/socket_server/mod.rs
View file

@ -875,7 +875,7 @@ pub async fn dispatch_host_journal(agent: &str, args: HostJournalArgs<'_>) -> Ag
tracing::info!(%agent, machine = %c, %n, "get_host_journal (container)");
return match crate::priv_client::read_container_journal(
c,
hive_sh4re::priv_proto::JournalQuery {
hive_priv_sock::JournalQuery {
lines: n,
unit: unit.clone(),
priority: priority.as_ref().map(|p| p.as_str().to_owned()),
@ -1059,7 +1059,7 @@ async fn handle_get_logs(agent: &str, lines: Option<u32>) -> AgentResponse {
tracing::info!(%agent, %machine, %n, "manager: get_logs");
match crate::priv_client::read_container_journal(
&machine,
hive_sh4re::priv_proto::JournalQuery {
hive_priv_sock::JournalQuery {
lines: n,
..Default::default()
},