ack_until was added to the messaging group by the ack_until feature
but was missing from the turn-loop.md MCP surface documentation
entirely. Add it to:
- Messaging group signature list
- recv bullet: mention that each row is prefixed with [msg #<id>]
so agents know what id to pass to ack_until
- New ack_until bullet explaining recipient-scoped bulk-triage use case
- Wake prompt section: mention the [msg #<id>] prefix and its purpose
The edit_schedule MCP tool accepts interval_seconds as Option<u64>
(positive values only), mapping None→leave-alone and Some(v)→set.
The handler wraps this as .map(Some) before dispatching, so there
is no way to express Some(None) = clear via the agent surface.
The old doc said 'Clearing interval_seconds to null flips
recurring → one-shot' which is only true for the dashboard
PATCH endpoint (which uses the full double-Option form).
Corrected: interval_seconds is positive-only via the MCP tool;
toggling recurring→one-shot is operator-only via the dashboard.
The allowed-tools note only named run/status; kill is also always
available since the bash MCP server uses allowedTools = ["*"].
Reword to name all three and explain the wildcard mechanism.
The kill tool (previous commit) produces the 'killed' terminal status,
but the status tool docs listed only pending/running/done/timed_out/
interrupted. Add 'killed' to complete the enum.
feat b16629801b added the kill tool to
hive-bash-mcp but docs/tools/bash.md wasn't updated. The tool was
described only in the MCP server tool-description string; add a proper
section to the reference doc.
kill(id, force?) fires SIGINT (force: false, default) or SIGKILL
(force: true) to the task's process group. Fire-and-forget — the
completion wake fires as usual. A pending task is cancelled outright.
Escalation pattern: SIGINT first, then force: true if it doesn't exit.
feat 3c853c2b58 added active bash tasks
to the get_loose_ends response but only updated the MCP server tool
description string; the docs/turn-loop.md entry for the tool still only
mentioned questions and reminders.
Add 'active local tasks published by external MCP daemons (e.g. running
bash tasks from hive-bash-mcp)' to the tool description so agents
reading the reference docs see the full picture.
hive-forge comments on a PR now merges review bodies (the summary
text from approve / request-changes / comment reviews) into the
comment listing, fixed in 1cff77f5. The verb list inline comment and
the 'Which read verb when' table row both said 'only the comments'
which was stale. Updated both to reflect the review-body inclusion.
When hyperhive.mcp.httpPort is set in agent.nix, the hive-mcp-http
systemd daemon runs the embedded MCP server as a persistent streamable-
HTTP service; claude-mcp-config.json points at the HTTP URL instead of
spawning a stdio child per turn. Document both modes in the subcommand
list and the on-boot files section.
Both loose-ends flyout and ask-bind prose referenced the bare path
without the /api/ prefix. The code was fixed in 98b5e976 to use the
correct path; dashboard.md already documents it correctly as
POST /api/answer-question/{id}. Align agent.md to match.
The broker's recent_for was fixed to filter acked_at IS NULL (commit
5264828091), so the agent inbox flyout
now shows only unread messages and empties after 'mark all read'.
The agent.md prose still described the old behaviour ('shows the
most-recent N regardless of ack state; the list stays put after drain').
Update it to match: unread-only, list empties on reload after drain.
The schedule pause/resume button (added in PR #2053) was missing from
the dashboard.md SCH3DUL3S tab docs. The action column listed only three
actions (fire-now, edit, cancel); the pause/resume toggle was undocumented.
Add the full action-column breakdown with the pause/resume semantics:
- paused rows show a 'paused' badge in the next column
- sorted middle bucket (after active, before cancelled)
- fire-now button is disabled while paused
- routes to /api/schedules/{id}/pause or /resume
The QueueKind enum has graceful_stop, start, and stop variants but the
dashboard QUEUE_KIND_GLYPH map only covered rebuild/meta_update/spawn/
destroy/restart/startup_sweep/perm_change — the three missing kinds
rendered as '?' in the build queue UI.
This became visible with the deferred start-after-rebuild change: a fast-lane
Start entry now appears as a child of its Rebuild parent, but showed the
fallback '?' glyph.
Glyphs assigned: graceful_stop=⏹, start=▶, stop=■.
Also update the dashboard.md kind-glyph list to include all nine kinds and
note that deferred start-after-rebuild entries also use parent_id grouping.
The human-readable matrix MCP reference was missing three behaviours
documented only in the MCP server instructions string:
- send_file / download_file tools (issues 1829, 1830)
- [file:]/[image:]/[audio:]/[video:] attachment markers in read_room (issue 1830)
- unread guard: send_message, send_dm, send_file, send_reply all
reject if the room has unread messages (issue 1828)
- send_redact (omitted from the tool list entirely)
Add all four to docs/tools/matrix.md to match the MCP server
instructions added in the previous commit.
When a tool call fails, claude wraps the result text in
<tool_use_error>...</tool_use_error> XML tags. The terminal was
displaying these raw, producing output like:
'<tool_use_error>File has not been read yet.</tool_use_error>'
Fix renderToolResult in app.js:
- Check c.is_error on the tool_result content block.
- Strip the <tool_use_error>...</tool_use_error> wrapper from the text.
- Render error results with a '✗' prefix under '.tool-result.error'
(flat, ≤120c) or '.tool-result-block.error' (<details>, longer text).
Add .live .tool-result.error { color: var(--red); } to terminal.css
so error results are visually distinct (red, same as turn-end-fail).
Update terminal-rendering.md row taxonomy to document the two new
error row classes.
Closes#2104.
Part of the #1802 hive-forge audit: the read verbs (view / issue / pr /
comments / comment-show / timeline / diff / pr-status / pr-reviews) look
overlapping but each has a distinct output shape. Add a selection table +
rule-of-thumb so agents pick the right one (esp. 'view first' to clear the
read-before-comment guard) instead of guessing. Zero blast radius — pure
docs, no verb changes (the audit concluded the CLI is structurally clean
and renames/removals aren't worth the caller breakage).
Per mara (verified in forge.rs): agents have max_repo_creation=0, so every
internal-forge repo is core-created with branch protection on by default
(merge restricted to operators team + required operators-team approval via
apply_operator_branch_protection / the config-repo equivalent), and agents
(write collaborators, not admins) can't change it or self-merge. So it's
technically enforced there, not just convention — only external VCS (GitHub)
is unprotected. Corrects my prior over-correction.
Per mara: branch protection isn't a blanket enforced check, and it's not
set up for external VCS (GitHub). Reframe the bullet as the operator-merge
*convention* — technically enforced only on the core-managed config repos,
and explicitly NOT wired up for GitHub/external VCS (process + accepted
risk there, not a control).
The trust-model insert accidentally consumed the
'## State-file endpoint security model' heading, leaving that section
floating under the new one. Re-add the heading and collapse the extra
blank lines (argus review).
Add an 'Agent trust model' framing section at the top of docs/security.md
covering the conceptual model the existing mechanism-level sections serve:
- trust boundary = the container, not credential storage (agents have
passwordless sudo by default; isolating creds from the agent itself is
not a goal — cross-tenant leakage is)
- scoped per-agent forge/matrix tokens bound the blast radius
- threat model: prompt injection -> confused deputy (untrusted input is
the adversary; the agent + its tools are trusted)
- branch protection (agents push, operator merges) as the human-in-loop
checkpoint, incl. external VCS
- capability = accepted risk ('don't grant what you can't afford to lose')
- no auto-sandboxing of external tokens (operator-accepted scope)
Emerged from the 2026-06-24 security discussion. Updates the CLAUDE.md
pointer for findability.
