Compare commits
29 changed files with 1167 additions and 85 deletions
|
|
@ -365,6 +365,7 @@ that allows the underlying resource access.
|
|||
| `manage_root_agent` | may lifecycle-manage the root/manager agent via `kill`/`start`/`restart` |
|
||||
| `read_host_journal` | `get_host_journal` MCP tool is registered + `GET /journal-host` requests are served |
|
||||
| `query_agent_state` | may call `get_loose_ends` / `CountPendingReminders` targeting non-child agents |
|
||||
| `infra_admin` | may call `restart(name)` on hive infrastructure containers (`hive-ci`, `hive-forge`, `hive-matrix` — **not** `hive-gateway`, which is the host's nginx and is operator-only); each restart is logged to the dashboard AUDIT trail |
|
||||
|
||||
**Config storage** — per-agent capabilities live in
|
||||
`/var/lib/hyperhive/meta/capabilities.json` alongside `tool-groups.json`.
|
||||
|
|
|
|||
|
|
@ -106,7 +106,7 @@ Passive / rare-interaction state. No longer a dashboard tab — it's a
|
|||
standalone page reached from the **Core** tile on the H0M3 hub (served at
|
||||
`/core.html`), with the same minimal chrome as `/logs.html`: a `← home`
|
||||
back-link + a `createTabStrip` sub-tab nav (**K3PT ST4T3** default,
|
||||
then **C0NT41N3R L04D**). The page is its own esbuild bundle (`core.js`)
|
||||
then **C0NT41N3R L04D**, then **1NFR4**). The page is its own esbuild bundle (`core.js`)
|
||||
that cold-loads `/api/state` and subscribes to `/api/dashboard/stream` for
|
||||
`tombstones_changed`, `capabilities_changed`, and `tool_groups_changed`
|
||||
(the latter two re-render the stale-perms sub-section when permission
|
||||
|
|
@ -159,10 +159,27 @@ omitted — agents share the host netns, so there is no per-container net
|
|||
counter (per-agent network needs the netns-isolation roadmap in
|
||||
`docs/network.md`).
|
||||
|
||||
Hive infrastructure services (`hive-ci`, `hive-forge`, `hive-gateway`,
|
||||
`hive-matrix`) have no dashboard panel — `hivectl stop`/`start`/`restart`
|
||||
is the only control surface, a separate host-admin-socket path with no
|
||||
HTTP route and no agent-facing equivalent.
|
||||
**1NFR4** — start / stop / restart the four hive infrastructure services
|
||||
(`hive-ci`, `hive-forge`, `hive-gateway`, `hive-matrix`) directly from the
|
||||
dashboard, without needing an `infra_admin` agent's `restart` MCP tool.
|
||||
Three are containers; `hive-gateway` is the host's `nginx.service`, and is
|
||||
the one an agent may **not** restart — this panel is the way it gets
|
||||
bounced. One row per service: name, a `badge-ok`/`badge-fail`
|
||||
running/stopped dot, and `↺ R3ST4RT` + `■ ST0P` (running) or `▶ ST4RT`
|
||||
(stopped) buttons, same themed-confirm pattern as the K3PT ST4T3
|
||||
tombstone actions. Backed by
|
||||
`POST /api/infra-container/{name}/{action}` (`action` ∈
|
||||
`start|stop|restart`), which calls the same
|
||||
`priv_client::control_infra_container` helper the agent-facing
|
||||
`infra_admin` path uses — no new privileged-helper surface, no
|
||||
capability check (the dashboard is already operator-authenticated).
|
||||
Every attempt is written to the audit log (actor `"operator"`, action
|
||||
`start_infra`/`stop_infra`/`restart_infra`) alongside agent-driven infra
|
||||
restarts. Status rows ride the `infra_containers` field on
|
||||
`GET /api/state`'s `StateSnapshot` (`{name, running}`, live
|
||||
`systemctl is-active container@<unit>.service` read); `core.js` polls
|
||||
`/api/state` every 5 s only while the 1NFR4 sub-tab is active, same
|
||||
cadence/lifecycle as C0NT41N3R L04D's polling.
|
||||
|
||||
## BU1LDS page (`/builds.html`)
|
||||
|
||||
|
|
@ -423,6 +440,7 @@ The current capabilities are:
|
|||
| `manage_root_agent` | allows the `set_status` / lifecycle tools on the root agent |
|
||||
| `read_host_journal` | unlocks `get_host_journal` to read journald from inside a container |
|
||||
| `query_agent_state` | allows `get_loose_ends(agent: "<name>")` calls targeting other agents |
|
||||
| `infra_admin` | allows `restart` on hive infrastructure containers (`hive-ci`, `hive-forge`, `hive-matrix`; the gateway is operator-only); each restart is logged to the AUDIT trail |
|
||||
|
||||
Each row is one agent. Columns are the capability names returned by
|
||||
`GET /api/capabilities` as `caps: Vec<String>`. Checking or unchecking
|
||||
|
|
@ -712,7 +730,7 @@ navigation.
|
|||
A dedicated log-viewer page (not a tab pane — a separate HTML page),
|
||||
reachable from the Logs tile on the H0M3 hub. Minimal chrome:
|
||||
a `← home` back link and a three-item sub-tab strip. Tab
|
||||
routing is hash-based (`#agent`, `#infra`, `#system`); default is
|
||||
routing is hash-based (`#agent`, `#system`, `#audit`); default is
|
||||
`#agent`. (Build log history has moved to the BU1LDS page — see above.)
|
||||
|
||||
**AGENT sub-tab** — per-container journald viewer. Two selects: agent
|
||||
|
|
@ -728,16 +746,6 @@ deep-link directly to a specific agent's journal. A "fetched N ago"
|
|||
chip appears after the `↻ refresh` button following each successful
|
||||
fetch and ticks every 30 s.
|
||||
|
||||
**INFRA sub-tab** — journald viewer for the four hive infrastructure
|
||||
containers (`hive-ci`, `hive-forge`, `hive-gateway`, `hive-matrix`), a
|
||||
fixed client-side list (`INFRA_NAMES` in `logs.js` — no dashboard API
|
||||
exposes just the name list). No unit filter (infra containers don't run
|
||||
the per-agent hive daemons) — always the full machine journal (or, for
|
||||
the gateway, the host journal filtered to its own unit). Fetches
|
||||
`GET /api/journal/{name}?lines=500`, same "fetched N ago" ticker as
|
||||
AGENT. A `?agent=<name>` deep-link routes here instead of AGENT when
|
||||
the name is one of the four infra containers.
|
||||
|
||||
**SYSTEM sub-tab** — host-side service logs. Unit selector
|
||||
(`hive-c0re.service` / `hive-priv.service`). Fetches
|
||||
`GET /api/journal-host?unit=<unit>&lines=500` on activation
|
||||
|
|
@ -746,6 +754,24 @@ chip ticks every 30 s. Available to the operator unconditionally (not
|
|||
capability-gated — the endpoint lives on the hive-c0re dashboard,
|
||||
behind the gateway).
|
||||
|
||||
**AUDIT sub-tab** — operator-visible trail of agent-initiated
|
||||
privileged actions (e.g. infra-container restarts via `infra_admin`).
|
||||
Lazy-fetched on tab show (like SYSTEM) from `GET /api/audit-log`, which
|
||||
returns `{ entries, total }` — `entries` newest-first, server-clamped to
|
||||
the latest 500; `total` drives a "latest 500 of N" count so the clamp is
|
||||
never silent. Rendered as a filterable table (when / agent / action /
|
||||
target / outcome / detail); the filter box is a client-side substring
|
||||
match over the cached rows. The outcome badge colours `ok` green and
|
||||
`err` red, with an `err` whose `detail` starts `denied:` (a capability
|
||||
refusal) shown amber and labelled `denied` so it reads apart from an
|
||||
execution failure. `ts_unix` is an RFC 3339 string; a 30 s ticker keeps the
|
||||
relative "ago" column honest while the tab is in view. The backing
|
||||
`audit_log` store records every privileged-action attempt (ok / err /
|
||||
denied). New entries live-append without a refresh: an `audit_entry_added`
|
||||
event on `/api/dashboard/stream` (the flattened row) is prepended to the table
|
||||
and the "latest N of M" count bumped, de-duped by id against the cold
|
||||
fetch.
|
||||
|
||||
## Container row
|
||||
|
||||
A full-height **square agent icon** (5em, capped) on the left. The
|
||||
|
|
@ -1182,6 +1208,12 @@ below — some endpoints aren't in it yet.
|
|||
build logs.
|
||||
- `GET /api/journal/{name}?unit=&lines=` — journalctl viewer for
|
||||
a managed container; rendered in the side panel.
|
||||
- `GET /api/audit-log` — agent-initiated privileged-action audit
|
||||
trail. Returns `{ entries, total }`: `entries` is a `Vec<AuditEntry>`
|
||||
(`id`, `ts_unix` as RFC 3339, `agent`, `action`, `target`, `outcome`
|
||||
`"ok"`/`"err"`, `detail` nullable), newest first, server-clamped to
|
||||
500; `total` is the full row count for a "latest 500 of N" header.
|
||||
Backs the LOGS page AUDIT sub-tab.
|
||||
- `GET /static/marked.js` serves the vendored `marked` bundle used
|
||||
for markdown previews.
|
||||
- `GET /api/state-file?path=<host-or-container-path>` — bounded
|
||||
|
|
@ -1222,6 +1254,16 @@ below — some endpoints aren't in it yet.
|
|||
a background `du -sxb` of the agent's state dir + container writable
|
||||
rootfs every ~5 min, `-x` excluding the shared read-only nix store.
|
||||
`null` until the first sample lands.
|
||||
- `POST /api/infra-container/{name}/{action}` — start / stop / restart a
|
||||
hive infra service (C0R3 › 1NFR4 panel). `name` parses into the
|
||||
`InfraContainer` allowlist (`hive-ci`/`hive-forge`/`hive-gateway`/
|
||||
`hive-matrix`, 400 on unknown), and the variant decides the unit —
|
||||
`container@<name>.service`, or `nginx.service` for the gateway.
|
||||
`action` ∈ `start|stop|restart`. Calls
|
||||
the same `priv_client::control_infra_container` helper the
|
||||
`infra_admin` agent path uses; records an `audit_log` entry
|
||||
(`start_infra`/`stop_infra`/`restart_infra`, actor `"operator"`) either
|
||||
way.
|
||||
- `POST /api/cancel-reminder/{id}` — hard-delete a pending reminder.
|
||||
- `POST /api/retry-reminder/{id}` — re-arm a reminder whose delivery
|
||||
failed (clears the failure state so the scheduler retries).
|
||||
|
|
@ -1387,6 +1429,10 @@ payload):
|
|||
- `meta_update_running` (running: bool) — emitted when a
|
||||
`nix flake update` ripple starts or completes. BU1LDS M3T4 1NPUTS
|
||||
tab uses this to show/hide the "⏳ meta-update running" banner.
|
||||
- `audit_entry_added` (flattened `AuditEntry` fields: id, ts_unix,
|
||||
agent, action, target, outcome, detail) — a single new audit-log
|
||||
row. L0GS AUDIT sub-tab live-prepends the row and bumps the
|
||||
"latest N of M" count, de-duped by id against the cold fetch.
|
||||
|
||||
`/api/state` is **only fetched on cold-load and on the few
|
||||
forms that mutate non-event-derived state** (PURG3 +
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
// dist/dashboard.html the operator dashboard SPA — served
|
||||
// at GET /dashboard.html
|
||||
// dist/flow.html served at GET /flow.html
|
||||
// dist/logs.html served at GET /logs.html (AGENT/INFRA/SYSTEM)
|
||||
// dist/logs.html served at GET /logs.html (AGENT/SYSTEM/AUDIT)
|
||||
// dist/core.html served at GET /core.html (C0R3: kept
|
||||
// state / container load)
|
||||
// dist/builds.html served at GET /builds.html (BU1LDS:
|
||||
|
|
@ -18,7 +18,7 @@
|
|||
// tab routing + refreshState
|
||||
// dist/static/flow.js /flow.html entry — broker terminal +
|
||||
// @-mention composer
|
||||
// dist/static/logs.js /logs.html entry — agent/infra/system
|
||||
// dist/static/logs.js /logs.html entry — agent/system/audit
|
||||
// log viewer sub-tabs
|
||||
// dist/static/builds.js /builds.html entry — rebuild queue,
|
||||
// meta inputs, build log history
|
||||
|
|
|
|||
|
|
@ -22,11 +22,11 @@ body.core-shell {
|
|||
panes; ensure it wins over any inherited display. */
|
||||
.core-pane[hidden] { display: none; }
|
||||
|
||||
/* ─── K3PT ST4T3 container cards ────────────────────────────────────
|
||||
/* ─── K3PT ST4T3 + 1NFR4 container cards ────────────────────────────
|
||||
core.html doesn't load dashboard.css (that's the operator SPA),
|
||||
so the .container-row card styles aren't inherited. Redefine them
|
||||
here so tombstone entries look like proper cards (similar to agent
|
||||
cards on the main dashboard) rather than bare list items. */
|
||||
here so tombstone and infra entries look like proper cards (similar
|
||||
to agent cards on the main dashboard) rather than bare list items. */
|
||||
.containers {
|
||||
list-style: none;
|
||||
padding: 0;
|
||||
|
|
|
|||
|
|
@ -16,14 +16,12 @@
|
|||
/core.html) carved out of the dashboard's old SYST3M tab so the
|
||||
dashboard tab strip stays lean. Same minimal chrome as
|
||||
/logs.html — a `← home` back-link to the H0M3 hub + a
|
||||
<hive-tab-strip> sub-tab nav. Two sub-tabs: kept state (tombstones)
|
||||
and container load. Rebuild queue + meta inputs have moved to
|
||||
<hive-tab-strip> sub-tab nav. Three sub-tabs: kept state (tombstones),
|
||||
container load, and infra containers (start/stop/restart the four
|
||||
hive infra containers). Rebuild queue + meta inputs have moved to
|
||||
/builds.html (the build lifecycle hub). Default tab: K3PT ST4T3.
|
||||
The section <div> ids (tombstones-section, container-load-section)
|
||||
match what core.js's renderers target. Hive infra containers
|
||||
(`hive-ci`, `hive-forge`, `hive-gateway`, `hive-matrix`) have no
|
||||
dashboard panel — `hivectl stop`/`start`/`restart` is the only
|
||||
control surface. -->
|
||||
The section <div> ids (tombstones-section, container-load-section,
|
||||
infra-containers-section) match what core.js's renderers target. -->
|
||||
<header class="page-header">
|
||||
<a class="page-back" href="/">← home</a>
|
||||
<hive-tab-strip class="hive-tabbar core-tabbar" id="core-tabbar" prefix="core"
|
||||
|
|
@ -57,6 +55,19 @@
|
|||
</div>
|
||||
</section>
|
||||
|
||||
<!-- 1NFR4: start / stop / restart the four hive infrastructure
|
||||
containers (hive-ci, hive-forge, hive-gateway, hive-matrix)
|
||||
directly from the dashboard, mirroring what an infra_admin
|
||||
agent's `restart` tool already reaches. Status polled every 5s
|
||||
while this sub-tab is open, same cadence as C0NT41N3R L04D. -->
|
||||
<section class="core-pane" id="core-pane-infra" data-tab-pane="infra"
|
||||
role="tabpanel" aria-labelledby="core-tab-infra">
|
||||
<p class="meta">hive infrastructure containers — ci, forge, gateway, matrix. actions are logged to the AUDIT log same as agent-driven restarts.</p>
|
||||
<div id="infra-containers-section">
|
||||
<p class="meta">loading…</p>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
</main>
|
||||
|
||||
<script type="module" src="/static/core.js" defer></script>
|
||||
|
|
|
|||
|
|
@ -381,6 +381,68 @@ function stopContainerLoadPolling() {
|
|||
if (containerLoadTimer) { clearInterval(containerLoadTimer); containerLoadTimer = null; }
|
||||
}
|
||||
|
||||
// ─── infra containers (start/stop/restart the 4 hive infra containers) ────
|
||||
let infraTimer = null;
|
||||
|
||||
function renderInfraContainers(rows) {
|
||||
const root = $('infra-containers-section');
|
||||
if (!root) return;
|
||||
root.replaceChildren();
|
||||
if (!Array.isArray(rows) || !rows.length) {
|
||||
root.append(el('p', { class: 'meta' }, 'no infra container data'));
|
||||
return;
|
||||
}
|
||||
const ul = el('ul', { class: 'containers' });
|
||||
for (const c of rows) {
|
||||
const li = el('li', { class: 'container-row' });
|
||||
const head = el('div', { class: 'head' });
|
||||
head.append(
|
||||
el('span', { class: 'name' }, c.name),
|
||||
el('span', { class: 'hive-pill-sm ' + (c.running ? 'badge-ok' : 'badge-fail') },
|
||||
c.running ? 'running' : 'stopped'),
|
||||
);
|
||||
li.append(head);
|
||||
|
||||
const actions = el('div', { class: 'actions' });
|
||||
const base = '/api/infra-container/' + encodeURIComponent(c.name) + '/';
|
||||
if (c.running) {
|
||||
actions.append(form(base + 'restart', 'btn-restart', '↺ R3ST4RT',
|
||||
'restart ' + c.name + '?'));
|
||||
actions.append(form(base + 'stop', 'btn-stop', '■ ST0P',
|
||||
'stop ' + c.name + '?'));
|
||||
} else {
|
||||
actions.append(form(base + 'start', 'btn-start', '▶ ST4RT',
|
||||
'start ' + c.name + '?'));
|
||||
}
|
||||
li.append(actions);
|
||||
ul.append(li);
|
||||
}
|
||||
root.append(ul);
|
||||
}
|
||||
|
||||
async function refreshInfraContainers() {
|
||||
try {
|
||||
const resp = await fetch('/api/state');
|
||||
if (!resp.ok) throw new Error('http ' + resp.status);
|
||||
const s = await resp.json();
|
||||
renderInfraContainers(s.infra_containers || []);
|
||||
} catch (e) {
|
||||
const root = $('infra-containers-section');
|
||||
if (root) {
|
||||
root.replaceChildren();
|
||||
root.append(el('p', { class: 'meta' }, 'infra container fetch failed: ' + e));
|
||||
}
|
||||
}
|
||||
}
|
||||
function startInfraPolling() {
|
||||
refreshInfraContainers();
|
||||
if (infraTimer) return;
|
||||
infraTimer = setInterval(refreshInfraContainers, 5000);
|
||||
}
|
||||
function stopInfraPolling() {
|
||||
if (infraTimer) { clearInterval(infraTimer); infraTimer = null; }
|
||||
}
|
||||
|
||||
// ─── render-all (cold load + any full re-render) ──────────────────────────
|
||||
function renderAll() {
|
||||
renderTombstones({ tombstones: tombstonesState });
|
||||
|
|
@ -445,11 +507,14 @@ async function init() {
|
|||
tabs: [
|
||||
{ id: 'kept', label: 'K3PT ST4T3' },
|
||||
{ id: 'load', label: 'C0NT41N3R L04D' },
|
||||
{ id: 'infra', label: '1NFR4' },
|
||||
],
|
||||
defaultId: 'kept',
|
||||
onShow: (id) => {
|
||||
if (id === 'load') startContainerLoadPolling();
|
||||
else stopContainerLoadPolling();
|
||||
if (id === 'infra') startInfraPolling();
|
||||
else stopInfraPolling();
|
||||
// Lazy-load stale-perms on first K3PT ST4T3 activation; always
|
||||
// re-fetch on subsequent visits in case perms changed.
|
||||
if (id === 'kept') fetchAndRenderStalePerms();
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@
|
|||
<body class="cred-shell">
|
||||
|
||||
<!-- Minimal chrome: back link + sub-tab strip, same pattern as
|
||||
logs.html (MATRIX / GITHUB instead of AGENT/INFRA/SYSTEM). Back
|
||||
logs.html (MATRIX / GITHUB instead of AGENT/SYSTEM/AUDIT). Back
|
||||
link points to the H0M3 hub (served at /). -->
|
||||
<header class="page-header">
|
||||
<a class="page-back" href="/">← home</a>
|
||||
|
|
|
|||
|
|
@ -65,7 +65,7 @@
|
|||
<span class="home-tile-icon" aria-hidden="true">📜</span>
|
||||
<span class="home-tile-label">Logs</span>
|
||||
</span>
|
||||
<span class="home-tile-desc">agent · infra · system logs</span>
|
||||
<span class="home-tile-desc">agent · system logs · privileged-action audit</span>
|
||||
</a>
|
||||
|
||||
<a class="home-tile" href="/stats.html">
|
||||
|
|
|
|||
|
|
@ -41,6 +41,14 @@ body.logs-shell {
|
|||
flex-direction: column;
|
||||
padding-bottom: 1.2em;
|
||||
}
|
||||
/* The AUDIT tab uses a <div> for its list instead of a <pre>, so give
|
||||
it the same flex-grow + internal scroll that .journal-output already has. */
|
||||
#audit-list {
|
||||
flex: 1 1 0;
|
||||
min-height: 0;
|
||||
overflow-y: auto;
|
||||
}
|
||||
|
||||
.logs-toolbar {
|
||||
display: flex;
|
||||
gap: 0.6em;
|
||||
|
|
@ -194,3 +202,65 @@ body.logs-shell {
|
|||
|
||||
.build-logs-runtime { font-size: 0.85em; color: var(--muted); }
|
||||
|
||||
/* ─── AUDIT tab — privileged-actions audit trail table ──────────────── */
|
||||
.audit-filter {
|
||||
flex: 1 1 18em;
|
||||
min-width: 0;
|
||||
padding: 0.35em 0.6em;
|
||||
background: var(--bg-elev);
|
||||
color: var(--fg);
|
||||
border: 1px solid var(--border);
|
||||
border-radius: 4px;
|
||||
font-family: inherit;
|
||||
font-size: 0.9em;
|
||||
}
|
||||
.audit-table-wrap { overflow-x: auto; }
|
||||
.audit-table {
|
||||
width: 100%;
|
||||
border-collapse: collapse;
|
||||
font-size: 0.88em;
|
||||
}
|
||||
.audit-table th,
|
||||
.audit-table td {
|
||||
text-align: left;
|
||||
padding: 0.4em 0.7em;
|
||||
border-bottom: 1px solid var(--border);
|
||||
vertical-align: top;
|
||||
}
|
||||
.audit-table th {
|
||||
color: var(--muted);
|
||||
font-weight: bold;
|
||||
text-transform: uppercase;
|
||||
letter-spacing: 0.06em;
|
||||
font-size: 0.82em;
|
||||
white-space: nowrap;
|
||||
}
|
||||
.audit-table tbody tr:hover {
|
||||
background: color-mix(in srgb, var(--bg-elev) 45%, transparent);
|
||||
}
|
||||
.audit-when, .audit-when-th { white-space: nowrap; }
|
||||
.audit-agent { font-weight: bold; white-space: nowrap; }
|
||||
.audit-action { font-family: monospace; white-space: nowrap; }
|
||||
.audit-target { white-space: nowrap; }
|
||||
.audit-detail { word-break: break-word; }
|
||||
.audit-outcome-th, .audit-outcome-td { white-space: nowrap; }
|
||||
.audit-outcome {
|
||||
display: inline-block;
|
||||
padding: 0 0.5em;
|
||||
border-radius: 999px;
|
||||
font-size: 0.82em;
|
||||
font-weight: bold;
|
||||
white-space: nowrap;
|
||||
}
|
||||
.audit-outcome-ok {
|
||||
background: color-mix(in srgb, var(--green) 22%, transparent);
|
||||
color: var(--green);
|
||||
}
|
||||
.audit-outcome-err {
|
||||
background: color-mix(in srgb, var(--red) 22%, transparent);
|
||||
color: var(--red);
|
||||
}
|
||||
.audit-outcome-denied {
|
||||
background: color-mix(in srgb, var(--yellow) 22%, transparent);
|
||||
color: var(--yellow);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@
|
|||
<!-- Minimal chrome: back link + sub-tab strip.
|
||||
Same pattern as flow.html — no full dashboard tabbar. Back link
|
||||
points to the H0M3 hub (served at /), not the dashboard.
|
||||
Three sub-tabs: AGENT, INFRA, SYSTEM. Build log history has
|
||||
Four sub-tabs: AGENT, INFRA, SYSTEM, AUDIT. Build log history has
|
||||
moved to /builds.html (the build lifecycle hub). -->
|
||||
<header class="page-header">
|
||||
<a class="page-back" href="/">← home</a>
|
||||
|
|
@ -75,6 +75,21 @@
|
|||
<pre id="system-output" class="journal-output">loading…</pre>
|
||||
</section>
|
||||
|
||||
<!-- AUDIT: operator-visible trail of agent-initiated privileged
|
||||
actions (infra-container restarts, etc.). Filterable table backed
|
||||
by GET /api/audit-log ({ entries, total }), newest first, server
|
||||
clamped to the latest 500. -->
|
||||
<section class="logs-pane" id="logs-pane-audit" data-tab-pane="audit"
|
||||
role="tabpanel" aria-labelledby="logs-tab-audit">
|
||||
<div class="logs-toolbar">
|
||||
<input type="text" id="audit-filter" class="audit-filter"
|
||||
placeholder="filter agent / action / target / detail…" autocomplete="off">
|
||||
<button type="button" class="btn btn-restart" id="audit-refresh">↻ refresh</button>
|
||||
<span id="audit-count" class="meta"></span>
|
||||
</div>
|
||||
<div id="audit-list"><p class="meta">loading…</p></div>
|
||||
</section>
|
||||
|
||||
</main>
|
||||
|
||||
<script type="module" src="/static/logs.js" defer></script>
|
||||
|
|
|
|||
|
|
@ -1,11 +1,13 @@
|
|||
// /logs.html entry point: log viewer with three sub-tabs (AGENT, INFRA,
|
||||
// SYSTEM). Build log history has moved to /builds.html.
|
||||
// /logs.html entry point: log viewer with four sub-tabs (AGENT, INFRA,
|
||||
// SYSTEM, AUDIT). Build log history has moved to /builds.html.
|
||||
// AGENT — per-container journald viewer, backed by GET /api/journal/{name}
|
||||
// INFRA — infra-container journald viewer (hive-ci, hive-forge, …),
|
||||
// same API but full machine journal only (no unit filter)
|
||||
// SYSTEM — host service logs, backed by GET /api/journal-host
|
||||
// AUDIT — agent-initiated privileged-action trail, GET /api/audit-log;
|
||||
// live-appends via the `audit_entry_added` /dashboard/stream event
|
||||
//
|
||||
// Tab routing via URL hash (#agent, #infra, #system). Default: #agent.
|
||||
// Tab routing via URL hash (#agent, #infra, #system, #audit). Default: #agent.
|
||||
//
|
||||
// URL params `?agent=name` and `?unit=svc` pre-select the agent + unit.
|
||||
// When `?agent=` names an infra container the INFRA tab is activated instead.
|
||||
|
|
@ -13,9 +15,10 @@
|
|||
// INFRA, and SYSTEM tabs so the operator knows how stale the output is.
|
||||
|
||||
import {
|
||||
$, fmtAgeSecs, initServerWarnings,
|
||||
$, fmtAgeSecs, openStream, initServerWarnings,
|
||||
} from './common.js';
|
||||
import { el } from '@hive/shared/dom.js';
|
||||
import { epochSec } from './util.js';
|
||||
import '@hive/shared/hive-tab-strip.js';
|
||||
|
||||
(() => {
|
||||
|
|
@ -124,25 +127,12 @@ import '@hive/shared/hive-tab-strip.js';
|
|||
if (infraSelect) infraSelect.addEventListener('change', fetchInfra);
|
||||
if (infraRefresh) infraRefresh.addEventListener('click', fetchInfra);
|
||||
|
||||
// Fixed allowlist — the four hive infra services never change at
|
||||
// runtime, and there's no dashboard API exposing just the name list
|
||||
// (the one that used to, `/api/state`'s `infra_containers` field, was
|
||||
// start/stop-panel-only and is gone). Mirrors `hive_priv_sock::InfraContainer::ALL`.
|
||||
const INFRA_NAMES = ['hive-ci', 'hive-forge', 'hive-gateway', 'hive-matrix'];
|
||||
|
||||
// ─── container list init ──────────────────────────────────────────────
|
||||
// Fetch /api/state once to populate the AGENT selector (agents only);
|
||||
// INFRA is a fixed list (see INFRA_NAMES). Also handles the ?agent= /
|
||||
// ?unit= deep-link, routing to the INFRA tab when the named container
|
||||
// is an infra container.
|
||||
// Fetch /api/state once and populate both the AGENT selector (agents only)
|
||||
// and the INFRA selector (infra containers only). Also handles the
|
||||
// ?agent= / ?unit= deep-link, routing to the INFRA tab when the named
|
||||
// container is an infra container.
|
||||
async function loadContainerLists() {
|
||||
if (infraSelect) {
|
||||
infraSelect.replaceChildren();
|
||||
infraSelect.append(el('option', { value: '' }, '— select container —'));
|
||||
for (const name of INFRA_NAMES) {
|
||||
infraSelect.append(el('option', { value: name }, name));
|
||||
}
|
||||
}
|
||||
try {
|
||||
const resp = await fetch('/api/state');
|
||||
if (!resp.ok) return;
|
||||
|
|
@ -157,11 +147,21 @@ import '@hive/shared/hive-tab-strip.js';
|
|||
}
|
||||
}
|
||||
|
||||
// Populate INFRA selector.
|
||||
const infraNames = new Set((state.infra_containers || []).map((c) => c.name));
|
||||
if (infraSelect) {
|
||||
infraSelect.replaceChildren();
|
||||
infraSelect.append(el('option', { value: '' }, '— select container —'));
|
||||
for (const name of infraNames) {
|
||||
infraSelect.append(el('option', { value: name }, name));
|
||||
}
|
||||
}
|
||||
|
||||
// Deep-link: honour ?agent= and ?unit= URL params.
|
||||
const urlAgent = new URLSearchParams(location.search).get('agent');
|
||||
const urlUnit = new URLSearchParams(location.search).get('unit');
|
||||
if (urlAgent) {
|
||||
if (INFRA_NAMES.includes(urlAgent)) {
|
||||
if (infraNames.has(urlAgent)) {
|
||||
// Route to INFRA tab.
|
||||
logTabs.show('infra');
|
||||
if (infraSelect) {
|
||||
|
|
@ -225,25 +225,180 @@ import '@hive/shared/hive-tab-strip.js';
|
|||
if (systemUnitSelect) systemUnitSelect.addEventListener('change', fetchSystem);
|
||||
if (systemRefresh) systemRefresh.addEventListener('click', fetchSystem);
|
||||
|
||||
// ─── AUDIT tab ──────────────────────────────────────────────────────
|
||||
// Operator-visible trail of agent-initiated privileged actions, backed
|
||||
// by GET /api/audit-log → { entries: [...], total: N } (entries
|
||||
// newest-first, server-clamped to 500; `total` drives "latest 500 of N").
|
||||
// Per-entry: { id, ts_unix (secs), agent, action, target, outcome, detail }.
|
||||
// outcome is 'ok' | 'err'; a capability denial is 'err' with detail
|
||||
// starting "denied:" — coloured amber to read apart from an execution
|
||||
// failure. Lazy-fetched on tab show (like SYSTEM); filter is a
|
||||
// client-side substring on the cached rows.
|
||||
|
||||
const auditList = $('audit-list');
|
||||
const auditFilter = $('audit-filter');
|
||||
const auditRefresh = $('audit-refresh');
|
||||
const auditCount = $('audit-count');
|
||||
|
||||
let auditEntries = [];
|
||||
let auditTotal = 0;
|
||||
let auditFetching = false;
|
||||
|
||||
// ts_unix arrives as an RFC 3339 string — fmtAgeSecs wants an age
|
||||
// in seconds, so normalize via epochSec first.
|
||||
function auditFmtWhen(ts) {
|
||||
if (!ts) return '';
|
||||
const age = Math.floor(Date.now() / 1000) - epochSec(ts);
|
||||
return fmtAgeSecs(Math.max(0, age)) + ' ago';
|
||||
}
|
||||
|
||||
// outcome → badge. 'ok' green; an 'err' whose detail starts "denied:" is a
|
||||
// capability refusal (amber, labelled "denied"); other 'err' red. The
|
||||
// literal outcome is the fallback label so a new value still renders.
|
||||
function auditOutcomeBadge(outcome, detail) {
|
||||
const denied = outcome === 'err'
|
||||
&& typeof detail === 'string' && detail.startsWith('denied:');
|
||||
const cls = outcome === 'ok'
|
||||
? 'audit-outcome audit-outcome-ok'
|
||||
: denied
|
||||
? 'audit-outcome audit-outcome-denied'
|
||||
: 'audit-outcome audit-outcome-err';
|
||||
return el('span', { class: cls }, denied ? 'denied' : (outcome || '?'));
|
||||
}
|
||||
|
||||
function auditMatches(e, q) {
|
||||
if (!q) return true;
|
||||
return `${e.agent || ''} ${e.action || ''} ${e.target || ''} ${e.detail || ''}`
|
||||
.toLowerCase().includes(q);
|
||||
}
|
||||
|
||||
function renderAudit() {
|
||||
if (!auditList) return;
|
||||
const q = (auditFilter ? auditFilter.value : '').trim().toLowerCase();
|
||||
const rows = auditEntries.filter((e) => auditMatches(e, q));
|
||||
|
||||
if (auditCount) {
|
||||
const shown = auditEntries.length;
|
||||
const clamped = auditTotal > shown;
|
||||
let txt = clamped
|
||||
? `latest ${shown} of ${auditTotal}`
|
||||
: `${shown} entr${shown === 1 ? 'y' : 'ies'}`;
|
||||
if (q) txt += ` · ${rows.length} match${rows.length === 1 ? '' : 'es'}`;
|
||||
auditCount.textContent = txt;
|
||||
}
|
||||
|
||||
auditList.replaceChildren();
|
||||
if (rows.length === 0) {
|
||||
auditList.append(el('p', { class: 'meta' },
|
||||
q ? '(no matching entries)' : '(no privileged actions recorded yet)'));
|
||||
return;
|
||||
}
|
||||
|
||||
const table = el('table', { class: 'audit-table' });
|
||||
table.append(el('thead', {},
|
||||
el('tr', {},
|
||||
el('th', { class: 'audit-when-th' }, 'when'),
|
||||
el('th', {}, 'agent'),
|
||||
el('th', {}, 'action'),
|
||||
el('th', {}, 'target'),
|
||||
el('th', { class: 'audit-outcome-th' }, 'outcome'),
|
||||
el('th', {}, 'detail'),
|
||||
)));
|
||||
const tbody = el('tbody', {});
|
||||
for (const e of rows) {
|
||||
tbody.append(el('tr', {},
|
||||
el('td', {
|
||||
class: 'audit-when meta',
|
||||
title: e.ts_unix ? new Date(e.ts_unix).toISOString() : '',
|
||||
}, auditFmtWhen(e.ts_unix)),
|
||||
el('td', { class: 'audit-agent' }, e.agent || ''),
|
||||
el('td', { class: 'audit-action' }, e.action || ''),
|
||||
el('td', { class: 'audit-target' }, e.target || ''),
|
||||
el('td', { class: 'audit-outcome-td' }, auditOutcomeBadge(e.outcome, e.detail)),
|
||||
el('td', { class: 'audit-detail meta' }, e.detail || ''),
|
||||
));
|
||||
}
|
||||
table.append(tbody);
|
||||
const wrap = el('div', { class: 'audit-table-wrap' });
|
||||
wrap.append(table);
|
||||
auditList.append(wrap);
|
||||
}
|
||||
|
||||
async function fetchAudit() {
|
||||
if (!auditList || auditFetching) return;
|
||||
auditFetching = true;
|
||||
try {
|
||||
const resp = await fetch('/api/audit-log');
|
||||
if (!resp.ok) throw new Error('http ' + resp.status);
|
||||
const data = await resp.json();
|
||||
auditEntries = Array.isArray(data.entries) ? data.entries : [];
|
||||
auditTotal = typeof data.total === 'number' ? data.total : auditEntries.length;
|
||||
renderAudit();
|
||||
} catch (err) {
|
||||
auditList.replaceChildren();
|
||||
auditList.append(el('p', { class: 'meta' }, 'fetch failed: ' + err));
|
||||
} finally {
|
||||
auditFetching = false;
|
||||
}
|
||||
}
|
||||
|
||||
if (auditRefresh) auditRefresh.addEventListener('click', fetchAudit);
|
||||
if (auditFilter) auditFilter.addEventListener('input', renderAudit);
|
||||
|
||||
// Live-append: an `audit_entry_added` event on /dashboard/stream carries a
|
||||
// new row flattened at the top level ({ kind, seq, id, ts_unix, agent,
|
||||
// action, target, outcome, detail }). Prepend it (newest-first), de-duped
|
||||
// by id against whatever the cold fetch already returned, and bump the
|
||||
// total so the "latest N of M" header stays right. Re-render only while
|
||||
// the AUDIT tab is in view; otherwise the next tab-show fetch is
|
||||
// authoritative anyway. Wired into the shared stream onmessage above.
|
||||
function onAuditEntryAdded(ev) {
|
||||
if (auditEntries.some((e) => e.id === ev.id)) return;
|
||||
auditEntries.unshift({
|
||||
id: ev.id, ts_unix: ev.ts_unix, agent: ev.agent, action: ev.action,
|
||||
target: ev.target, outcome: ev.outcome, detail: ev.detail,
|
||||
});
|
||||
auditTotal += 1;
|
||||
if (logTabs.active() === 'audit') renderAudit();
|
||||
}
|
||||
|
||||
// ─── init ─────────────────────────────────────────────────────────────
|
||||
|
||||
// Wire the shared tab strip now that fetchSystem + the element refs it
|
||||
// needs are defined. Its initial show() paints the active pane and, if
|
||||
// the deep-linked tab is SYSTEM, kicks off the lazy fetch via onShow.
|
||||
// the deep-linked tab is SYSTEM/AUDIT, kicks off the lazy fetch via onShow.
|
||||
// Default: AGENT (build logs moved to /builds.html).
|
||||
logTabs = document.getElementById('logs-tabbar').configure({
|
||||
tabs: [
|
||||
{ id: 'agent', label: 'AGENT' },
|
||||
{ id: 'infra', label: 'INFRA' },
|
||||
{ id: 'system', label: 'SYSTEM' },
|
||||
{ id: 'audit', label: 'AUDIT' },
|
||||
],
|
||||
defaultId: 'agent',
|
||||
onShow: (id) => {
|
||||
if (id === 'system') fetchSystem();
|
||||
else if (id === 'audit') fetchAudit();
|
||||
},
|
||||
});
|
||||
loadContainerLists();
|
||||
|
||||
// Subscribe to the dashboard SSE stream for audit live-appends.
|
||||
// kinds= narrows this from all 17 wire kinds down to the 1 this page
|
||||
// acts on. This page was one of 4 unfiltered `/api/dashboard/stream`
|
||||
// subscribers before this (subscription discipline, part 1 of the
|
||||
// dashboard-event-stream-split issue).
|
||||
{
|
||||
const es = openStream('/api/dashboard/stream?kinds=audit_entry_added');
|
||||
if (es) {
|
||||
es.onmessage = (e) => {
|
||||
let ev;
|
||||
try { ev = JSON.parse(e.data); } catch { return; }
|
||||
if (ev.kind === 'audit_entry_added') onAuditEntryAdded(ev);
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
// Tick the last-fetched timestamps every 30s so "fetched 1m ago" stays
|
||||
// accurate without a manual refresh.
|
||||
setInterval(() => {
|
||||
|
|
@ -256,6 +411,8 @@ import '@hive/shared/hive-tab-strip.js';
|
|||
if (systemLastFetch && systemFetchTs && !systemFetchTs.hidden) {
|
||||
systemFetchTs.textContent = fmtFetchTs(systemLastFetch);
|
||||
}
|
||||
// Keep the audit "ago" column honest while that tab is in view.
|
||||
if (auditEntries.length && logTabs.active() === 'audit') renderAudit();
|
||||
}, 30_000);
|
||||
|
||||
})();
|
||||
|
|
|
|||
|
|
@ -308,7 +308,7 @@ window.marked = marked;
|
|||
//
|
||||
// kinds= matches MUTATION_HANDLERS below verbatim, plus `sent`
|
||||
// (checked separately, just above, for the operator inbox) —
|
||||
// narrows this from all 15 wire kinds down to the 11 this page
|
||||
// narrows this from all 17 wire kinds down to the 11 this page
|
||||
// actually acts on. This page was one of 4 unfiltered
|
||||
// `/api/dashboard/stream` subscribers before this (subscription
|
||||
// discipline, part 1 of the dashboard-event-stream-split issue).
|
||||
|
|
|
|||
|
|
@ -564,7 +564,11 @@ impl AgentServer {
|
|||
#[tool(
|
||||
description = "Restart a direct child sub-agent container (stop + start). \
|
||||
Only succeeds if `name` is a direct child of this agent in the topology \
|
||||
tree — the server enforces this. No approval required."
|
||||
tree — the server enforces this. No approval required. \
|
||||
Agents holding the `infra_admin` capability may also pass a hive \
|
||||
infrastructure container name (`hive-ci`, `hive-forge`, `hive-matrix`) \
|
||||
to restart it directly via the privileged helper. The gateway is \
|
||||
not restartable by an agent — ask the operator."
|
||||
)]
|
||||
async fn restart(&self, Parameters(args): Parameters<RestartArgs>) -> String {
|
||||
let log = format!("{args:?}");
|
||||
|
|
|
|||
|
|
@ -59,6 +59,13 @@ fn allowed_capability_tools() -> Vec<String> {
|
|||
let t = token.trim().to_ascii_lowercase();
|
||||
match t.as_str() {
|
||||
"read_host_journal" => tools.push("get_host_journal".to_owned()),
|
||||
// infra_admin lets an agent restart hive infrastructure
|
||||
// containers (hive-ci / hive-forge / hive-matrix — not the
|
||||
// gateway) through the existing `restart` tool. Unlock it here so agents that hold
|
||||
// the capability without the full `lifecycle` group can still
|
||||
// call it; c0re re-checks the capability server-side and only
|
||||
// honours infra-container names via this path.
|
||||
"infra_admin" => tools.push("restart".to_owned()),
|
||||
// manage_root_agent / query_agent_state don't expose new MCP
|
||||
// tools: manage_root_agent gates existing lifecycle tools via
|
||||
// topology enforcement; query_agent_state unlocks the `agent`
|
||||
|
|
|
|||
|
|
@ -42,6 +42,9 @@ pub struct Coordinator {
|
|||
/// `get_full` for the per-card chip + side-panel viewer. See
|
||||
/// `build_logs.rs` for retention.
|
||||
pub build_logs: Arc<crate::build_logs::BuildLogs>,
|
||||
/// Audit trail of agent-initiated privileged actions (infra restart,
|
||||
/// …). See `audit_log.rs`. Same dir as `build_logs`.
|
||||
pub audit_log: Arc<crate::audit_log::AuditLog>,
|
||||
/// URL of the hyperhive flake (no fragment). Inlined into per-agent
|
||||
/// `flake.nix` files as `inputs.hyperhive.url`.
|
||||
pub hyperhive_flake: String,
|
||||
|
|
@ -477,6 +480,13 @@ impl Coordinator {
|
|||
// to thread an `Arc<BuildLogs>` through every public entry
|
||||
// point in the lifecycle surface.
|
||||
crate::build_logs::install(build_logs.clone());
|
||||
// Audit log shares the same db dir; install its process-wide
|
||||
// handle so privileged-action recording sites (e.g.
|
||||
// `socket_server::handle_restart_infra`) write without threading an
|
||||
// `Arc<AuditLog>` through the agent-request surface.
|
||||
let audit_log =
|
||||
Arc::new(crate::audit_log::AuditLog::open(build_logs_dir).context("open audit_log")?);
|
||||
crate::audit_log::install(audit_log.clone());
|
||||
let power = Arc::new(crate::power::PowerStore::open(db_path).context("open agent_power")?);
|
||||
let (dashboard_events, _) = broadcast::channel(DASHBOARD_CHANNEL);
|
||||
let (shutdown_tx, _) = watch::channel(false);
|
||||
|
|
@ -485,6 +495,7 @@ impl Coordinator {
|
|||
approvals: Arc::new(approvals),
|
||||
scheduled_prompts: Arc::new(scheduled_prompts),
|
||||
build_logs,
|
||||
audit_log,
|
||||
hyperhive_flake,
|
||||
hyperhive_docs_flake,
|
||||
nixpkgs_flake,
|
||||
|
|
@ -740,6 +751,18 @@ impl Coordinator {
|
|||
self.meta_updates_active.load(Ordering::SeqCst) > 0
|
||||
}
|
||||
|
||||
/// Emit `AuditEntryAdded` immediately after a privileged-action row
|
||||
/// is recorded, so the dashboard audit view live-appends it off
|
||||
/// `/dashboard/stream`. Pass the [`AuditEntry`](crate::audit_log::AuditEntry)
|
||||
/// returned by `audit_log::record` so the streamed event is the same
|
||||
/// canonical row that was stored.
|
||||
pub fn emit_audit_entry(&self, entry: crate::audit_log::AuditEntry) {
|
||||
self.emit_dashboard_event(DashboardEvent::AuditEntryAdded {
|
||||
seq: self.next_seq(),
|
||||
entry,
|
||||
});
|
||||
}
|
||||
|
||||
/// Emit `ApprovalAdded` immediately after the row is inserted in
|
||||
/// sqlite.
|
||||
pub fn emit_approval_added(&self, ev: ApprovalAdded<'_>) {
|
||||
|
|
|
|||
81
hive-c0re/src/dashboard/infra_containers.rs
Normal file
81
hive-c0re/src/dashboard/infra_containers.rs
Normal file
|
|
@ -0,0 +1,81 @@
|
|||
//! Dashboard endpoint for operator-driven infra lifecycle (start / stop /
|
||||
//! restart on `hive-ci`, `hive-forge`, `hive-gateway`, `hive-matrix`).
|
||||
//! Parallels the `infra_admin`-gated agent path in
|
||||
//! `socket_server/lifecycle_handlers.rs::handle_restart_infra`, but this one
|
||||
//! is reached from the dashboard — already fully operator-authenticated —
|
||||
//! so no capability check is needed here, just the same audit trail.
|
||||
//!
|
||||
//! The two surfaces cover different sets: this endpoint takes all four,
|
||||
//! while the agent path refuses the gateway — nginx on the host fronts
|
||||
//! every hive service, so bouncing it is the operator's call.
|
||||
|
||||
use axum::{
|
||||
extract::{Path as AxumPath, State},
|
||||
http::StatusCode,
|
||||
response::{IntoResponse, Response},
|
||||
};
|
||||
use hive_priv_sock::{InfraAction, InfraContainer};
|
||||
|
||||
use super::{AppState, error_response};
|
||||
|
||||
/// Start / stop / restart a
|
||||
/// hive infrastructure container from the dashboard.
|
||||
///
|
||||
/// `name` parses into [`InfraContainer`] (the allowlist; unrecognised
|
||||
/// names 400), `action` into `start` / `stop` / `restart`. Every attempt
|
||||
/// lands in the audit log (actor `"operator"`, action `start_infra` /
|
||||
/// `stop_infra` / `restart_infra`) and streams as an `AuditEntryAdded`
|
||||
/// event, so operator-driven and agent-driven (`infra_admin`) infra
|
||||
/// actions show up in the same AUDIT view.
|
||||
#[utoipa::path(
|
||||
post,
|
||||
path = "/api/infra-container/{name}/{action}",
|
||||
params(
|
||||
("name" = String, Path, description = "infra service name (hive-ci/hive-forge/hive-gateway/hive-matrix)"),
|
||||
("action" = String, Path, description = "start | stop | restart"),
|
||||
),
|
||||
responses(
|
||||
(status = 200, description = "action completed", body = String),
|
||||
(status = 500, description = "unknown container/action, or the systemd action failed"),
|
||||
),
|
||||
tag = "infra_containers"
|
||||
)]
|
||||
pub(super) async fn post_infra_container(
|
||||
State(state): State<AppState>,
|
||||
AxumPath((name, action)): AxumPath<(String, String)>,
|
||||
) -> Response {
|
||||
let Ok(container) = name.parse::<InfraContainer>() else {
|
||||
return error_response(&format!("unknown infra container: {name}"));
|
||||
};
|
||||
let (infra_action, action_label) = match action.as_str() {
|
||||
"start" => (InfraAction::Start, "start_infra"),
|
||||
"stop" => (InfraAction::Stop, "stop_infra"),
|
||||
"restart" => (InfraAction::Restart, "restart_infra"),
|
||||
other => {
|
||||
return error_response(&format!(
|
||||
"unknown action: {other} (want start|stop|restart)"
|
||||
));
|
||||
}
|
||||
};
|
||||
let target = container.name();
|
||||
tracing::info!(%target, %action, "dashboard: infra container action");
|
||||
let result = crate::priv_client::control_infra_container(container, infra_action).await;
|
||||
let outcome = if result.is_ok() {
|
||||
crate::audit_log::AuditOutcome::Ok
|
||||
} else {
|
||||
crate::audit_log::AuditOutcome::Err
|
||||
};
|
||||
let detail = result.as_ref().err().map(|e| format!("{e:#}"));
|
||||
if let Some(entry) =
|
||||
state
|
||||
.coord
|
||||
.audit_log
|
||||
.record("operator", action_label, target, outcome, detail.as_deref())
|
||||
{
|
||||
state.coord.emit_audit_entry(entry);
|
||||
}
|
||||
match result {
|
||||
Ok(()) => (StatusCode::OK, "ok").into_response(),
|
||||
Err(e) => error_response(&format!("{target}: {e:#}")),
|
||||
}
|
||||
}
|
||||
|
|
@ -1,6 +1,7 @@
|
|||
//! Remaining single-endpoint dashboard handlers: the operator inbox
|
||||
//! (`Y3R C4LL`) + mark-all-read, operator compose (`op-send`),
|
||||
//! spawn-request, hive-wide turn stats, and container resources.
|
||||
//! spawn-request, hive-wide turn stats, container resources, and the
|
||||
//! audit log.
|
||||
|
||||
use axum::{
|
||||
extract::{Form, Path as AxumPath, State},
|
||||
|
|
@ -11,6 +12,7 @@ use serde::{Deserialize, Serialize};
|
|||
use utoipa::{IntoParams, ToSchema};
|
||||
|
||||
use super::{AppState, Ident, error_response, scan_validated_paths};
|
||||
use crate::audit_log::AuditEntry;
|
||||
use crate::container_stats::ContainerResource;
|
||||
use crate::hive_stats::HiveStats;
|
||||
|
||||
|
|
@ -127,6 +129,40 @@ pub(super) async fn api_container_resources() -> Response {
|
|||
axum::Json(crate::container_stats::gather().await).into_response()
|
||||
}
|
||||
|
||||
#[derive(Serialize, ToSchema)]
|
||||
pub(super) struct AuditLogBody {
|
||||
entries: Vec<AuditEntry>,
|
||||
total: i64,
|
||||
}
|
||||
|
||||
/// Most-recent agent-initiated privileged-action
|
||||
/// audit entries, newest first (server-clamped to 500).
|
||||
///
|
||||
/// Backs the operator dashboard's audit view. `total` lets the UI show
|
||||
/// "latest 500 of N" rather than silently capping. `ts_unix` is in
|
||||
/// **seconds**.
|
||||
#[utoipa::path(
|
||||
get,
|
||||
path = "/api/audit-log",
|
||||
responses(
|
||||
(status = 200, description = "recent audit entries + total count", body = AuditLogBody),
|
||||
(status = 500, description = "sqlite read failed"),
|
||||
),
|
||||
tag = "misc_api"
|
||||
)]
|
||||
pub(super) async fn api_audit_log(State(state): State<AppState>) -> Response {
|
||||
const LIMIT: usize = 500;
|
||||
let entries = match state.coord.audit_log.list_recent(LIMIT) {
|
||||
Ok(rows) => rows,
|
||||
Err(e) => return error_response(&format!("audit-log: {e:#}")),
|
||||
};
|
||||
let total = match state.coord.audit_log.count_total() {
|
||||
Ok(n) => n,
|
||||
Err(e) => return error_response(&format!("audit-log count: {e:#}")),
|
||||
};
|
||||
axum::Json(AuditLogBody { entries, total }).into_response()
|
||||
}
|
||||
|
||||
#[derive(Serialize, ToSchema)]
|
||||
pub(super) struct MarkAllReadBody {
|
||||
marked: u64,
|
||||
|
|
|
|||
|
|
@ -38,10 +38,11 @@ use crate::lifecycle;
|
|||
(name = "approvals", description = "approve/deny pending approval rows"),
|
||||
(name = "build_logs", description = "build log headers, full rows, and raw text downloads"),
|
||||
(name = "extra_forges", description = "external (non-internal) forge account provisioning"),
|
||||
(name = "infra_containers", description = "start/stop/restart of hive infrastructure containers"),
|
||||
(name = "lifecycle_ops", description = "agent container lifecycle: rebuild/restart/start/stop/pause/limits"),
|
||||
(name = "matrix_accounts", description = "matrix + github account provisioning for agents"),
|
||||
(name = "meta_inputs", description = "bulk flake-input update for the meta flake"),
|
||||
(name = "misc_api", description = "operator inbox, compose, spawn-request, hive stats"),
|
||||
(name = "misc_api", description = "operator inbox, compose, spawn-request, hive stats, audit log"),
|
||||
(name = "permissions", description = "tool-group + capability assignment for agents"),
|
||||
(name = "schedules", description = "scheduled-prompt + rebuild-queue CRUD"),
|
||||
(name = "state_files", description = "proxied reads of allow-listed per-agent state files"),
|
||||
|
|
@ -62,6 +63,7 @@ mod extra_forges;
|
|||
// server reach it as `crate::dashboard::Ident`.
|
||||
pub(crate) use hive_types::Ident;
|
||||
mod health;
|
||||
mod infra_containers;
|
||||
mod journal;
|
||||
mod lifecycle_ops;
|
||||
mod matrix_accounts;
|
||||
|
|
@ -152,6 +154,7 @@ pub async fn serve(
|
|||
.routes(routes!(misc_api::api_operator_inbox))
|
||||
.routes(routes!(misc_api::api_stats_hive))
|
||||
.routes(routes!(misc_api::api_container_resources))
|
||||
.routes(routes!(misc_api::api_audit_log))
|
||||
.routes(routes!(misc_api::post_mark_all_read))
|
||||
.routes(routes!(misc_api::post_request_spawn))
|
||||
.routes(routes!(misc_api::post_op_send))
|
||||
|
|
@ -192,6 +195,7 @@ pub async fn serve(
|
|||
.routes(routes!(lifecycle_ops::post_resume))
|
||||
.routes(routes!(lifecycle_ops::post_resource_limits))
|
||||
.routes(routes!(lifecycle_ops::post_update_all))
|
||||
.routes(routes!(infra_containers::post_infra_container))
|
||||
.routes(routes!(tombstones::post_purge_tombstone))
|
||||
.routes(routes!(meta_inputs::post_meta_update))
|
||||
.routes(routes!(build_logs::get_build_log_stream))
|
||||
|
|
@ -393,6 +397,7 @@ mod router_build_probe {
|
|||
.routes(routes!(misc_api::api_operator_inbox))
|
||||
.routes(routes!(misc_api::api_stats_hive))
|
||||
.routes(routes!(misc_api::api_container_resources))
|
||||
.routes(routes!(misc_api::api_audit_log))
|
||||
.routes(routes!(misc_api::post_mark_all_read))
|
||||
.routes(routes!(misc_api::post_request_spawn))
|
||||
.routes(routes!(misc_api::post_op_send))
|
||||
|
|
@ -433,6 +438,7 @@ mod router_build_probe {
|
|||
.routes(routes!(lifecycle_ops::post_resume))
|
||||
.routes(routes!(lifecycle_ops::post_resource_limits))
|
||||
.routes(routes!(lifecycle_ops::post_update_all))
|
||||
.routes(routes!(infra_containers::post_infra_container))
|
||||
.routes(routes!(tombstones::post_purge_tombstone))
|
||||
.routes(routes!(meta_inputs::post_meta_update))
|
||||
.routes(routes!(build_logs::get_build_log_stream))
|
||||
|
|
|
|||
|
|
@ -117,6 +117,33 @@ pub(super) struct StateSnapshot {
|
|||
/// `host_stats::server_warnings`; the frontend renders this list
|
||||
/// generically, so new warning kinds need no frontend change.
|
||||
server_warnings: Vec<crate::host_stats::ServerWarning>,
|
||||
/// Live running/stopped status for the four hive infra containers
|
||||
/// (`hive-ci`, `hive-forge`, `hive-gateway`, `hive-matrix`). Feeds the
|
||||
/// C0R3 page's 1NFR4 sub-tab so the operator can start/stop/restart
|
||||
/// them without an `infra_admin` agent's `restart` tool.
|
||||
infra_containers: Vec<InfraContainerView>,
|
||||
}
|
||||
|
||||
/// One row for the C0R3 page's 1NFR4 sub-tab.
|
||||
#[derive(Serialize)]
|
||||
struct InfraContainerView {
|
||||
/// Container / systemd-unit name (e.g. `"hive-ci"`).
|
||||
name: &'static str,
|
||||
running: bool,
|
||||
}
|
||||
|
||||
/// Live running/stopped status for all four hive infra containers.
|
||||
/// Extracted out of [`api_state`] to keep it under clippy's
|
||||
/// `too_many_lines` limit.
|
||||
async fn infra_container_views() -> Vec<InfraContainerView> {
|
||||
let mut infra_containers = Vec::with_capacity(hive_priv_sock::InfraContainer::ALL.len());
|
||||
for container in hive_priv_sock::InfraContainer::ALL {
|
||||
infra_containers.push(InfraContainerView {
|
||||
name: container.name(),
|
||||
running: crate::lifecycle::infra_is_running(container).await,
|
||||
});
|
||||
}
|
||||
infra_containers
|
||||
}
|
||||
|
||||
#[derive(Serialize)]
|
||||
|
|
@ -301,6 +328,8 @@ pub(super) async fn api_state(
|
|||
w
|
||||
};
|
||||
|
||||
let infra_containers = infra_container_views().await;
|
||||
|
||||
axum::Json(StateSnapshot {
|
||||
seq,
|
||||
hostname,
|
||||
|
|
@ -339,6 +368,7 @@ pub(super) async fn api_state(
|
|||
.ok()
|
||||
.filter(|s| !s.is_empty()),
|
||||
server_warnings,
|
||||
infra_containers,
|
||||
})
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -13,6 +13,17 @@ use chrono::{DateTime, Utc};
|
|||
#[derive(Debug, Clone, Serialize)]
|
||||
#[serde(rename_all = "snake_case", tag = "kind")]
|
||||
pub enum DashboardEvent {
|
||||
/// A new agent-initiated privileged action was recorded in the audit
|
||||
/// log. The audit view (`/audit.html`) prepends `entry` live off
|
||||
/// `/dashboard/stream` instead of polling. The `AuditEntry` fields
|
||||
/// are flattened alongside the `kind` tag + `seq`, so the wire shape
|
||||
/// matches one row of the `/api/audit-log` `entries` array exactly
|
||||
/// (`{kind, seq, id, ts_unix, agent, action, target, outcome, detail}`).
|
||||
AuditEntryAdded {
|
||||
seq: u64,
|
||||
#[serde(flatten)]
|
||||
entry: crate::audit_log::AuditEntry,
|
||||
},
|
||||
/// Broker `Sent` event mirrored onto the dashboard channel.
|
||||
/// `file_refs` carries every path-shaped token in `body` that
|
||||
/// hive-c0re verified is a regular file under the allow-listed
|
||||
|
|
@ -259,6 +270,7 @@ impl DashboardEvent {
|
|||
DashboardEvent::SchedulesChanged { .. } => "schedules_changed",
|
||||
DashboardEvent::CapabilitiesChanged { .. } => "capabilities_changed",
|
||||
DashboardEvent::ToolGroupsChanged { .. } => "tool_groups_changed",
|
||||
DashboardEvent::AuditEntryAdded { .. } => "audit_entry_added",
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -373,6 +385,18 @@ mod tests {
|
|||
agents: Vec::new(),
|
||||
effective: std::collections::BTreeMap::new(),
|
||||
},
|
||||
DashboardEvent::AuditEntryAdded {
|
||||
seq: 1,
|
||||
entry: crate::audit_log::AuditEntry {
|
||||
id: 1,
|
||||
ts_unix: hive_sh4re::wire_time::from_secs(0),
|
||||
agent: "atlas".into(),
|
||||
action: "restart_infra".into(),
|
||||
target: "hive-ci".into(),
|
||||
outcome: "ok".into(),
|
||||
detail: None,
|
||||
},
|
||||
},
|
||||
];
|
||||
for ev in samples {
|
||||
let v: serde_json::Value = serde_json::to_value(&ev).expect("serialise");
|
||||
|
|
@ -383,4 +407,34 @@ mod tests {
|
|||
assert_eq!(ev.kind_tag(), serde_kind, "kind_tag() drift on {ev:?}");
|
||||
}
|
||||
}
|
||||
|
||||
/// The flattened `AuditEntry` fields must sit alongside `kind`/`seq`
|
||||
/// at the top level (not nested under `entry`) so the wire shape
|
||||
/// matches one `/api/audit-log` row — the audit view prepends it
|
||||
/// directly.
|
||||
#[test]
|
||||
fn audit_entry_added_flattens_to_top_level() {
|
||||
let ev = DashboardEvent::AuditEntryAdded {
|
||||
seq: 7,
|
||||
entry: crate::audit_log::AuditEntry {
|
||||
id: 42,
|
||||
ts_unix: hive_sh4re::wire_time::from_secs(1_700_000_000),
|
||||
agent: "atlas".into(),
|
||||
action: "restart_infra".into(),
|
||||
target: "hive-gateway".into(),
|
||||
outcome: "err".into(),
|
||||
detail: Some("denied: missing infra_admin capability".into()),
|
||||
},
|
||||
};
|
||||
let v: serde_json::Value = serde_json::to_value(&ev).expect("serialise");
|
||||
assert_eq!(v["kind"], "audit_entry_added");
|
||||
assert_eq!(v["seq"], 7);
|
||||
assert_eq!(v["id"], 42);
|
||||
assert_eq!(v["agent"], "atlas");
|
||||
assert_eq!(v["target"], "hive-gateway");
|
||||
assert_eq!(v["outcome"], "err");
|
||||
assert_eq!(v["detail"], "denied: missing infra_admin capability");
|
||||
// Not nested — there must be no `entry` sub-object.
|
||||
assert!(v.get("entry").is_none());
|
||||
}
|
||||
}
|
||||
|
|
|
|||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Reference in a new issue