xhigh and max are distinct reasoning-effort levels (see EFFORT_LEVELS
in events.rs); labelling xhigh as '(max)' implied they were the same
level, per issue #2258.
Per argus review: correct routing subject from 'root/manager agent' to
'submitting agent (root agent for top-level containers; approvals-group
agent for its own subtree)', and drop the deprecated 'manager' term.
The messaging section listed the MCP tools for send/recv/ask/answer/ack_until
but didn't mention the system events agents receive from sender 'system' —
lifecycle events (spawned, rebuilt, killed, etc.) routed to the root agent and
Q&A events (question_asked, question_answered) delivered to any agent. Add a
brief paragraph that names the events and links to the canonical reference in
docs/approvals.md where the full payload shapes and routing logic live.
Agents in private netns can't reach host loopback directly; they
use forge.<domain> and matrix.<domain> via the gateway. Update four
locations that still claimed direct loopback access:
- hive-forge.nix: module header + openFirewall description
- hive-matrix.nix: openFirewall description
- docs/matrix.md: container design bullet + openFirewall section
Agents in private netns reach the forge at forge.<domain> via the
gateway, not via localhost directly. The conclusion (firewall only
matters for external access) is correct; the mechanism description
was stale from the pre-isolation era.
- Option doc: 'Default points at the in-host tuwunel (shared netns)'
→ updated to reflect that c0re forwards the gateway URL at runtime
- DNS oneshot comment: 'inert in shared-netns mode' → removed since
isolation is always on; oneshot always runs
Agents run in private netns (always-on isolation) and can't reach
host loopback directly. hive-c0re forwards HIVE_MATRIX_URL set to
`matrix.<domain>` via the gateway. Update two places that still
referenced the removed shared-netns path.
The TCP fallback was removed from gateway_nginx.rs in the previous
commit. Update docs/gateway.md to match:
- Step 4: remove 'TCP loopback for agents not yet rebuilt' — always UDS now
- Remove the 'TCP loopback fallback' subsection entirely
Agents run in private netns (always-on isolation). The TCP fallback
to 127.0.0.1:<port> was unreachable from the gateway's host netns
regardless of whether the per-agent socket marker existed.
Remove the conditional entirely: always use the unix socket path.
If the socket is not yet bound, nginx returns 502 which is already
handled by the error_page 502 503 504 = /__hive_agent_unreachable
directive in every location block.
Also removes the unused lifecycle::agent_web_port call and the
now-misleading '.bound state' mention from the render doc comment.
The option is a no-op (marked DEPRECATED — ignored); the Prerequisite,
Migration, and Rust counterpart sections all described the migration that
already completed. Strip to just the deprecation notice.
Also fix the bridgeIp description: 'once netns isolation lands' is past
tense — isolation is unconditional now. Rephrase to present tense.
The parenthetical was backwards — this rule opens bridge ports so
*isolated* agents (in private netns, connected via veth) can reach
nginx. Remove the misleading '(shared netns)' tag, replace with the
accurate description.
privsep is complete and always on. the phased-rollout framing
is historical — drop it from the inline comments, keeping the
accurate description of what the user + delegation actually do.
All three area:ops pillars are now complete: network isolation is
always on (private netns, no shared-netns mode), the gateway is live,
and hive-c0re runs as the unprivileged hive-core user.
- Rewrite the intro to say the boundary is enforced, not aspirational
- Update 'Why network isolation is the load-bearing step' section to
use past tense for the shared-netns world and note completion
- Mark network isolation as Complete in the sequencing list
The two-phase network rollout (bridge-first, then isolateContainers) is
complete. Both options are now deprecated no-ops — isolation is always on.
Update the doc to reflect current state:
- Drop the phased-rollout intro ('off by default during rollout') and the
v1/v2 comparison table; keep a brief historical note
- Remove 'Why ship before netns isolation' section (rollout is done)
- Update configuration example: network.enable is no longer needed
- Merge firewall description into a single table (80/443 always open)
- Remove 'Prerequisites before flipping on' and 'Migration behaviour'
subsections (isolation was a one-time flip; no longer a toggle)
- Simplify resolver wiring: hive-priv always drops the marker; remove
'only when isolated' conditional framing
The test's invalid-values list included "low" which was valid before
this PR but is now a legitimate effort level. Replace with "lowest"
(still invalid) so the test keeps its coverage without false-failing.
claude --effort now accepts low, medium, high, xhigh, max.
Expand EFFORT_LEVELS from 3 to 5, update NixOS enum + description,
and fix the stale doc comment in web_ui.rs.
Closes#2220
Agents cannot create repos directly via their forge token (no Create
scope; push-to-create disabled). Document the two paths:
- mcp__hyperhive__create_repo (forge tool group): creates under agents/
org via hive-c0re, adds write-collaborator access, enables branch
protection. The standard agent path.
- hive-forge repo-create / repo-add-collaborator (CLI): use the agent's
own token; repo lands under agent's user account or org.
The 'Privileged tools (by tool group)' section listed execution,
lifecycle/approvals, scheduling/diagnostics, capability-gated, and
matrix but was missing:
- forge (create_repo) — the only agent path to create a repo under the
agents/ org; direct token creation is disabled for agents. Opt-in,
not in any default preset.
- web_tools — enables Claude built-in WebFetch/WebSearch tools. Off by
default. The tool whitelist section already mentioned these but the
group was absent from the privileged-tools list.
The prettier markdown formatter (8406a452) converted a prose '+' into
a markdown list marker '-', splitting 'fires a wake...and the exit code
+ last stdout lines' into a dangling incomplete sentence followed by an
orphaned list item. Rewrite the sentence to avoid the pattern entirely.
open_dm(user_id) resolves (find-or-create) the DM room and returns
its room id without sending anything. It is the counterpart to
send_dm for cases where you need a room id to pass to a room-based
tool such as send_file or send_message.
The tool was present in hive-matrix-mcp (mcp.rs, handlers.rs,
protocol.rs) and the terminal-rendering icon table but was missing
from the tools/matrix.md reference doc.
The heading was inserted between items 3 and 4, breaking GFM ordered
list numbering (Forgejo renders items 4+ restarting at 1). Move the
subsection to after item 5 and update the in-prose reference to use
an anchor link instead of 'see table below'.
Replace the sparse 3-line prose description of fmtToolUse with a full
reference table covering every tool case added over the past several
PRs. Adds a new subsection listing the short-name convention (* suffix),
all Claude built-ins (Read/Write/Edit/Glob/Grep/Bash/TodoWrite), the
full hyperhive MCP surface (recv/send/ask/answer/remind/set_status/
get_loose_ends/get_agent_meta/cancel_loose_end/ack_until/kill/restart/
start/update/get_logs/get_host_journal/request_apply_commit/
request_init_config/request_update_meta_inputs), all scheduling tools
(list_schedules/cancel_schedule/fire_schedule_now/edit_schedule/
request_schedule_prompt — added in the previous PR), bash MCP tools
(run/status/kill), and matrix MCP tools (send_message/send_dm/
send_reply/send_reaction/read_room/mark_read/join_room/open_dm/
invite_user/download_file).
The docs evaluation referenced self.nixosConfigurations.agent-base and
self.nixosModules.default — both tied to self's full flake store path.
Every commit produces a new self hash (even when only Rust or frontend
files change), so docs drvs change on every commit and the remote
builder (muede-pc2) must rebuild them from scratch each time.
Fix: use builtins.path on the nix/ directory with
builtins.unsafeDiscardStringContext to produce a content-addressed store
path (nixSrc) that only changes when .nix files change. Evaluate both
hostEval and agentEval from nixSrc using stub package args (pkgs.emptyFile /
pkgs.emptyDirectory) instead of self.overlays.default, which avoids
pulling in the Rust and frontend build closures.
Now docs drvs only change when a .nix file changes. PRs that touch only
Rust or frontend code hit the remote builder cache instead of forcing a
rebuild. Closes the disk-pressure-induced CI failure loop on muede-pc2.
Forge URLs in transformOptions updated to prepend nix/ prefix correctly
(nixSrc is a copy of nix/, so stripped paths need nix/ re-added).
Wraps check-issue-refs.sh and check-comment-blocks.sh so a push that
would fail the tracker-tag or comment-block CI jobs is caught locally
before it reaches the remote — eliminating the fix-and-repush round-trip.
Install once per clone:
ln -sf ../../scripts/pre-push .git/hooks/pre-push
Also adds a one-liner hint to CLAUDE.md so it surfaces in every
agent's context at session start.
Three references to the effort level set in docs/web-ui/agent.md still
listed the old three-item set (medium/high/xhigh). Update all three to
match the expanded set added by PR 2221: low/medium/high/xhigh/max.
Closes#2220 (docs side).
Empty arrays are truthy in JS so 'if (input.targets_add)' would emit
'+0 tgt' for an explicit []. Add .length guard so zero-element lists
are silently skipped — consistent with fmtArgsGeneric's [N] handling.
The MCP schema defaults both fields to null, making this theoretical,
but the guard is cleaner.
Scheduling tools and the two remaining request_* tools fell through to
fmtArgsGeneric. They already had appropriate icons (⏱️ / 📦) but the
arg display was multi-field verbose.
New fmtToolUse cases:
- request_init_config: 'request_init_config* iris'
- request_update_meta_inputs: 'request_update_meta_inputs* [nixpkgs, …]'
(or 'all' when inputs list is empty)
- list_schedules: 'list_schedules*()' (no args, explicit)
- cancel_schedule: 'cancel_schedule* #42 all' or '#42 [iris, dmatrix]'
- fire_schedule_now: 'fire_schedule_now* #42'
- edit_schedule: 'edit_schedule* #42 · body · interval · +2 tgt'
(lists which fields are being changed, not their values)
- request_schedule_prompt: 'request_schedule_prompt* → iris at 14:00Z +3600s'
Closes#2201
The 'How does the per-agent terminal render tool calls?' reading path
was pointing only at web-ui/agent.md. terminal-rendering.md is the
authoritative reference (added recently with the full row taxonomy
table). Update the pointer to send readers there first, with a
note that web-ui/agent.md has the high-level summary.
The 'system' bullet was stale — it only mentioned the drop list
(init/result/rate_limit_event) and omitted the five specific handlers
added recently: plugin_install (muted note), commands_changed
(expandable details), compact_boundary (compact summary note),
thinking_tokens (in-place counter), and the generic catch-all.
Expand the bullet to cover the full dispatch shape, and add a
cross-reference to docs/terminal-rendering.md which has the
authoritative row taxonomy table and full dispatch walkthrough.
The selection bar's M0V3 action uses two different endpoints:
- single agent: POST /api/topology/set-parent (form-encoded)
- multiple agents: POST /api/topology/set-parent-bulk (JSON array)
The previous text said 'POSTs to /api/topology/set-parent ... once
per selected agent' — wrong on both counts for multi-agent moves.
The bulk endpoint lands all moves in one topology.json commit.
The option was only mentioned in passing in the system-prompt render
section. Add a proper ### section (following the pattern of Agent icon,
user.passwordlessSudo, etc.) with the nix snippet, default, effect on
$HIVE_DOCS_DIR + system prompt, and a note on the narrow docs flake
input that avoids full container rebuilds on doc edits.
