From b3ccd1500c9e9608e66201b26adf6d4c7a5048d0 Mon Sep 17 00:00:00 2001 From: iris Date: Tue, 2 Jun 2026 10:05:39 +0200 Subject: [PATCH 1/6] docs(web-ui): document P3RM1SS10NS tab and tool-groups/capabilities endpoints --- docs/web-ui/dashboard.md | 71 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 71 insertions(+) diff --git a/docs/web-ui/dashboard.md b/docs/web-ui/dashboard.md index 92116fe9..03278ba9 100644 --- a/docs/web-ui/dashboard.md +++ b/docs/web-ui/dashboard.md @@ -119,6 +119,57 @@ age + claude-creds badge). Two actions: `⊕ R3V1V3` (queues a Spawn approval; existing state is reused), `PURG3` (wipes state + applied dirs; `POST /purge-tombstone/{name}`). +## P3RM1SS10NS tab + +Per-agent permission configuration. Two sections, each rendered as a +column-driven checkbox matrix: rows are agents, columns are the +permission names fetched from the backend. The column list is +authoritative — adding a new tool-group or capability to the backend +requires no UI change; the new column appears automatically. + +Fetches fire on tab activation (not page-load) to avoid unnecessary +work when the operator never visits this tab. + +**C4P4B1L1T13S** — per-agent capability grants. Capabilities unlock +gated MCP tools and system-level access beyond the default agent +surface. A saving POST queues a rebuild for the affected agent so the +new `HIVE_CAPABILITIES` env var takes effect in the next session. + +The current capabilities are: + +| Name | Effect | +|------|--------| +| `manage_root_agent` | allows the `set_status` / lifecycle tools on the root manager | +| `read_host_journal` | unlocks `get_host_journal` to read journald from inside a container | +| `query_agent_state` | allows `get_loose_ends(agent: "")` calls targeting other agents | + +Each row is one agent. Columns are the capability names returned by +`GET /api/capabilities` as `caps: Vec`. Checking or unchecking +boxes changes only the in-browser state; the `S4V3` button on the +right edge POSTs the full capability set for that agent to +`POST /api/capabilities/{agent}` as `{ caps: ["name", …] }` and +queues a rebuild. Absent agents in the assignment map have no extra +capabilities. + +**T00L GR0UPS** — per-agent tool-group permissions. Tool groups are +named buckets of MCP tools; each agent starts with a role default +(agents: `messaging`, `meta`, `inbox`, `execution`; manager: all +groups). Checking / unchecking and saving changes which groups are +active for the agent. Backed by `GET /api/tool-groups` (columns) and +`POST /api/tool-groups/{agent}` (save). A rebuild is queued after +each save so `HIVE_TOOL_GROUPS` takes effect. + +The current tool groups are: `messaging`, `meta`, `inbox`, `lifecycle`, +`approvals`, `scheduling`, `diagnostics`, `execution`. All listed in +`ToolGroup::ALL` in `hive-sh4re`. + +Both tables share the same visual shape: `.cap-table-wrap` / +`.tg-table-wrap` outer scroll container, `thead` with a label column +(`.cap-agent-col` / `.tg-agent-col`) + one column per permission +(`.cap-col` / `.tg-group-col`) + a save column (`.cap-save-col` / +`.tg-save-col`). Each tbody row is one agent: a name cell, checkbox +cells, and the `S4V3` button. + ## SCH3DUL3S tab Anything that fires at a future time. Operator-set schedules @@ -682,6 +733,26 @@ that's a browser-level decision, not ours. - `POST /cancel-reminder/{id}` — hard-delete a pending reminder. - `POST /retry-reminder/{id}` — re-arm a reminder whose delivery failed (clears the failure state so the scheduler retries). +- `GET /api/tool-groups` — returns `{ groups: Vec, + assignments: BTreeMap> }`. `groups` is the + ordered list of all known tool-group names (drives the column + headers in the P3RM1SS10NS tab); `assignments` is the per-agent + override map (absent agents use the role default). +- `POST /api/tool-groups/{agent}` — body `{ groups: ["name", …] }`. + Writes the tool-group set for `{agent}` to + `/var/lib/hyperhive/meta/tool-groups.json` and queues a rebuild so + `HIVE_TOOL_GROUPS` takes effect. Agent name validated; + `guard_agent_name` applied. +- `GET /api/capabilities` — returns `{ caps: Vec, + assignments: BTreeMap> }`. `caps` is the + ordered list of all known capability names; `assignments` is the + per-agent grant map (absent agents have no extra capabilities). +- `POST /api/capabilities/{agent}` — body `{ caps: ["name", …] }`. + Writes the capability set for `{agent}` to + `/var/lib/hyperhive/meta/capabilities.json` and queues a rebuild so + `HIVE_CAPABILITIES` takes effect. Agent name validated; + unknown capability strings are rejected (400). `guard_agent_name` + applied. - `GET /api/schedules` — list all schedules (active and recently cancelled) for the SYST3M scheduled-prompts panel. - `POST /api/schedules` — operator-direct schedule create: From f55d3baa0ae545f5da25b56d6f0096d13654f830 Mon Sep 17 00:00:00 2001 From: iris Date: Tue, 2 Jun 2026 10:07:01 +0200 Subject: [PATCH 2/6] docs(web-ui): add P3RM1SS10NS to tab strip list and URL hash list --- docs/web-ui/dashboard.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/web-ui/dashboard.md b/docs/web-ui/dashboard.md index 03278ba9..99aea322 100644 --- a/docs/web-ui/dashboard.md +++ b/docs/web-ui/dashboard.md @@ -6,7 +6,7 @@ The dashboard (`/`) has a fixed chrome header at the top and a `
` that shows exactly one tab pane at a time. The URL hash -(`#swarm`, `#call`, `#system`, `#schedules`, `#peers`, `#settings`) +(`#swarm`, `#call`, `#system`, `#permissions`, `#schedules`, `#peers`, `#settings`) drives which pane is active; hash changes don't reload the page. FL0W is a separate full-page terminal at `/flow.html` — its tab-strip entry is a cross-page link (`◆ FL0W ◆ →`), not a pane @@ -14,7 +14,7 @@ swap. **Chrome header** (fixed, overlays the active tab pane): - **Tab strip**: `◆ SW4RM ◆`, `◆ Y3R C4LL ◆`, `◆ SYST3M ◆`, - `◆ SCH3DUL3S ◆`, `◆ P33RS ◆` (hidden when `swarm.peers` is empty), + `◆ P3RM1SS10NS ◆`, `◆ SCH3DUL3S ◆`, `◆ P33RS ◆` (hidden when `swarm.peers` is empty), `◆ M4TR1X ◆ →` (optional page link, see below), `◆ FL0W ◆ →` (page link), and `◆ S3TT1NGS ◆`. Count pills on SW4RM (container count), Y3R C4LL (pending approvals + questions), and SCH3DUL3S From 834d9cb2c480ba0133de92906e6c9f65c69c572a Mon Sep 17 00:00:00 2001 From: iris Date: Tue, 2 Jun 2026 10:14:50 +0200 Subject: [PATCH 3/6] docs(web-ui): update CSS bundle description for split stylesheet layout --- docs/web-ui/shape.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/web-ui/shape.md b/docs/web-ui/shape.md index 29dce188..054f771a 100644 --- a/docs/web-ui/shape.md +++ b/docs/web-ui/shape.md @@ -15,7 +15,9 @@ - `GET /static/*` → bundled CSS + JS produced by esbuild (`frontend/packages/{dashboard,agent}/build.mjs`). Both pages pull the shared terminal pane + Catppuccin palette + typography - from `@hive/shared` (was `hive-fr0nt`); the CSS bundle inlines + from `@hive/shared` (was `hive-fr0nt`); the dashboard ships four + CSS bundles (`common.css` loaded by every page, plus per-page + `dashboard.css` / `flow.css` / `logs.css`); `common.css` inlines `base.css` + `terminal.css` via esbuild's `@import` resolution. `terminal.js` exports `{ create, linkify }` as ES module members (no more `window.HiveTerminal` global outside the From de8c446a3a47b11609ce566568e13883c7bf111d Mon Sep 17 00:00:00 2001 From: iris Date: Tue, 2 Jun 2026 10:41:11 +0200 Subject: [PATCH 4/6] docs: document web_tools capability in turn-loop and dashboard --- docs/turn-loop.md | 7 ++++++- docs/web-ui/dashboard.md | 1 + 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/docs/turn-loop.md b/docs/turn-loop.md index 3ec1bd0a..e556d8aa 100644 --- a/docs/turn-loop.md +++ b/docs/turn-loop.md @@ -574,8 +574,10 @@ status hint moved to the wake prompt + UI header. ### Tool whitelist (`mcp::ALLOWED_BUILTIN_TOOLS`) - Allowed built-ins: `Edit`, `Glob`, `Grep`, `Read`, `Write`. +- Capability-gated built-ins: `WebFetch`, `WebSearch` (added when the + `web_tools` capability is granted — see P3RM1SS10NS tab). - Denied by omission or `claude-settings.json` deny list: `Bash`, - `WebFetch`, `WebSearch`, `Task`, `NotebookEdit`, `TodoWrite`. + `Task`, `NotebookEdit`, `TodoWrite`. - Allowed MCP tools: as listed above per flavor. `Bash` is disallowed — shell execution goes through @@ -583,3 +585,6 @@ status hint moved to the wake prompt + UI header. task-id tracking) instead of an interactive shell. The `bash_run` / `bash_status` MCP tools are always in the `--allowedTools` list. +`WebFetch` / `WebSearch` are off by default; grant the `web_tools` +capability in the P3RM1SS10NS tab and rebuild the agent to enable them. + diff --git a/docs/web-ui/dashboard.md b/docs/web-ui/dashboard.md index 99aea322..b3f02c1a 100644 --- a/docs/web-ui/dashboard.md +++ b/docs/web-ui/dashboard.md @@ -142,6 +142,7 @@ The current capabilities are: | `manage_root_agent` | allows the `set_status` / lifecycle tools on the root manager | | `read_host_journal` | unlocks `get_host_journal` to read journald from inside a container | | `query_agent_state` | allows `get_loose_ends(agent: "")` calls targeting other agents | +| `web_tools` | adds Claude's built-in `WebFetch` (fetch a URL) and `WebSearch` (web search) to the agent's `--tools` list; off by default | Each row is one agent. Columns are the capability names returned by `GET /api/capabilities` as `caps: Vec`. Checking or unchecking From 91ad9877dcc304eadb53d8f2ad7e7ccd18c8aa2a Mon Sep 17 00:00:00 2001 From: iris Date: Tue, 2 Jun 2026 11:07:37 +0200 Subject: [PATCH 5/6] docs(web-ui): add P3RM1SS10NS to dashboard tab list in index --- docs/web-ui.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/web-ui.md b/docs/web-ui.md index 052b4357..b251c5a1 100644 --- a/docs/web-ui.md +++ b/docs/web-ui.md @@ -13,7 +13,7 @@ This doc has been split for readability. Pick the section you need: per-agent relative paths, `data-async` form pattern, side panel, atomic repaint. - **[Dashboard layout](web-ui/dashboard.md)** — tab contents - (SW4RM, Y3R C4LL, SYST3M, SCH3DUL3S, P33RS, S3TT1NGS), container row, + (SW4RM, Y3R C4LL, SYST3M, P3RM1SS10NS, SCH3DUL3S, P33RS, S3TT1NGS), container row, topology tree, selection bar, approval card, browser notifications, dashboard endpoints + event channel. - **[Per-agent page](web-ui/agent.md)** — header, main terminal, From 0da736f2a1ed6803e4d307cd9936c8b9e663dd07 Mon Sep 17 00:00:00 2001 From: iris Date: Tue, 2 Jun 2026 11:34:21 +0200 Subject: [PATCH 6/6] fix(docs): web_tools is a tool group, not a capability Remove web_tools from the C4P4B1L1T13S table in dashboard.md and add it to the T00L GR0UPS section with a note that it gates Claude built-ins rather than MCP tools. Fix turn-loop.md to say 'tool-group-gated' and 'web_tools tool group' throughout. --- docs/turn-loop.md | 8 ++++---- docs/web-ui/dashboard.md | 8 +++++--- 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/docs/turn-loop.md b/docs/turn-loop.md index e556d8aa..e768e342 100644 --- a/docs/turn-loop.md +++ b/docs/turn-loop.md @@ -574,8 +574,8 @@ status hint moved to the wake prompt + UI header. ### Tool whitelist (`mcp::ALLOWED_BUILTIN_TOOLS`) - Allowed built-ins: `Edit`, `Glob`, `Grep`, `Read`, `Write`. -- Capability-gated built-ins: `WebFetch`, `WebSearch` (added when the - `web_tools` capability is granted — see P3RM1SS10NS tab). +- Tool-group-gated built-ins: `WebFetch`, `WebSearch` (added when the + `web_tools` tool group is enabled — see P3RM1SS10NS tab). - Denied by omission or `claude-settings.json` deny list: `Bash`, `Task`, `NotebookEdit`, `TodoWrite`. - Allowed MCP tools: as listed above per flavor. @@ -585,6 +585,6 @@ status hint moved to the wake prompt + UI header. task-id tracking) instead of an interactive shell. The `bash_run` / `bash_status` MCP tools are always in the `--allowedTools` list. -`WebFetch` / `WebSearch` are off by default; grant the `web_tools` -capability in the P3RM1SS10NS tab and rebuild the agent to enable them. +`WebFetch` / `WebSearch` are off by default; enable the `web_tools` +tool group in the P3RM1SS10NS tab and rebuild the agent to enable them. diff --git a/docs/web-ui/dashboard.md b/docs/web-ui/dashboard.md index b3f02c1a..79f56f86 100644 --- a/docs/web-ui/dashboard.md +++ b/docs/web-ui/dashboard.md @@ -142,7 +142,6 @@ The current capabilities are: | `manage_root_agent` | allows the `set_status` / lifecycle tools on the root manager | | `read_host_journal` | unlocks `get_host_journal` to read journald from inside a container | | `query_agent_state` | allows `get_loose_ends(agent: "")` calls targeting other agents | -| `web_tools` | adds Claude's built-in `WebFetch` (fetch a URL) and `WebSearch` (web search) to the agent's `--tools` list; off by default | Each row is one agent. Columns are the capability names returned by `GET /api/capabilities` as `caps: Vec`. Checking or unchecking @@ -161,8 +160,11 @@ active for the agent. Backed by `GET /api/tool-groups` (columns) and each save so `HIVE_TOOL_GROUPS` takes effect. The current tool groups are: `messaging`, `meta`, `inbox`, `lifecycle`, -`approvals`, `scheduling`, `diagnostics`, `execution`. All listed in -`ToolGroup::ALL` in `hive-sh4re`. +`approvals`, `scheduling`, `diagnostics`, `execution`, `web_tools`. All +listed in `ToolGroup::ALL` in `hive-sh4re`. The `web_tools` group is +special: it carries no MCP tools; instead it adds Claude's built-in +`WebFetch` and `WebSearch` to `--tools` / `--allowedTools` for that +agent session. Both tables share the same visual shape: `.cap-table-wrap` / `.tg-table-wrap` outer scroll container, `thead` with a label column