diff --git a/hive-c0re/src/forge.rs b/hive-c0re/src/forge.rs index 9ae7bc34..fd8c69ad 100644 --- a/hive-c0re/src/forge.rs +++ b/hive-c0re/src/forge.rs @@ -1,8 +1,6 @@ //! Optional Forgejo wiring — per-agent user + token provisioning, -//! config-repo mirroring, meta read-access grants. Also seeds -//! `internal/docs` — a private repo every agent gets read-only -//! collaborator access to for operator-curated shared content. -//! No-op when `hive-forge` isn't running. Full design: `docs/forge.md`. +//! config-repo mirroring, meta read-access grants. No-op when +//! `hive-forge` isn't running. Full design: `docs/forge.md`. use std::path::{Path, PathBuf}; @@ -40,18 +38,9 @@ const CONFIG_ORG_AVATAR_MARKER: &str = "/var/lib/hyperhive/forge-agent-configs-a /// applied repos stay hive-c0re-owned on disk; this org is just a /// mirror target core pushes to. const CONFIG_ORG: &str = "agent-configs"; -/// Forgejo org hosting the operator-curated shared docs/skills repo -/// that every agent gets read-only access to. Agents use it as a -/// common reference without the operator having to bake content into -/// the system prompt or rely on `/shared`. Only the manager + operator -/// (i.e. `core` user) can push. -const SHARED_ORG: &str = "internal"; -/// The shared docs repo inside `SHARED_ORG`. Cloneable by every agent -/// at `{FORGE_HTTP}/internal/docs.git`. -const SHARED_DOCS_REPO: &str = "docs"; /// Forgejo orgs hive-c0re ensures on startup. The meta repo lives at /// `core/meta` (the `core` user's own namespace — no org needed). -const SEEDED_ORGS: &[&str] = &[CONFIG_ORG, SHARED_ORG]; +const SEEDED_ORGS: &[&str] = &[CONFIG_ORG]; /// Per-agent token scopes (broad-but-not-admin). See /// `docs/forge.md::Token scopes` for the per-scope rationale. const TOKEN_SCOPES: &str = "read:user,write:user,read:notification,write:notification,write:repository,write:issue,write:organization,write:misc"; @@ -540,54 +529,6 @@ pub async fn ensure_config_repo(name: &str) -> Result<()> { ensure_org_repo(CONFIG_ORG, name, &token).await } -/// Ensure the `internal/docs` repo exists. Called once at startup -/// after `ensure_org(SHARED_ORG)`. Idempotent — `ensure_org_repo` -/// treats 409 as success. -pub async fn ensure_shared_docs_repo(core_token: &str) -> Result<()> { - ensure_org_repo(SHARED_ORG, SHARED_DOCS_REPO, core_token).await -} - -/// Grant agent `name` read-only collaborator access to `internal/docs`. -/// Idempotent: HTTP 204 (already a collaborator) is treated as success. -/// Mirrors `meta_read_access` so agents can clone the shared docs repo -/// without authentication hassle. -pub async fn shared_docs_access(name: &str, core_token: &str) -> Result<()> { - let url = format!( - "{FORGE_HTTP}/api/v1/repos/{SHARED_ORG}/{SHARED_DOCS_REPO}/collaborators/{name}" - ); - let body = r#"{"permission":"read"}"#; - let out = Command::new("curl") - .args([ - "-sS", - "-o", - "/dev/null", - "-w", - "%{http_code}", - "-X", - "PUT", - "-H", - "Content-Type: application/json", - "-H", - &format!("Authorization: token {core_token}"), - "-d", - body, - &url, - ]) - .output() - .await - .context("invoke curl PUT internal/docs/collaborators")?; - let code = String::from_utf8_lossy(&out.stdout).trim().to_owned(); - match code.as_str() { - "204" => { - tracing::info!(%name, "forge: granted shared-docs read access"); - Ok(()) - } - other => anyhow::bail!( - "PUT {SHARED_ORG}/{SHARED_DOCS_REPO}/collaborators/{name} returned HTTP {other}" - ), - } -} - /// Grant agent `name` read-only collaborator access to `core/meta` on /// the forge so the agent can clone/fetch the meta flake. Idempotent: /// HTTP 204 (already a collaborator) is treated as success. @@ -760,13 +701,6 @@ pub async fn sync_agent(name: &str, core_token: Option<&str>) { if let Err(e) = ensure_meta_remote(name).await { tracing::warn!(%name, error = ?e, "forge: ensure_meta_remote failed"); } - // Grant read-only access to internal/docs so the agent can clone - // the operator-curated shared skills/runbook repo. Best-effort. - if let Some(token) = core_token - && let Err(e) = shared_docs_access(name, token).await - { - tracing::warn!(%name, error = ?e, "forge: shared_docs_access failed"); - } } /// Sweep every existing container (manager + sub-agents) and ensure @@ -800,11 +734,6 @@ pub async fn ensure_all() { if let Err(e) = ensure_repo("meta", token).await { tracing::warn!(error = ?e, "forge: ensure_repo core/meta failed"); } - // Seed the shared docs repo. internal is already in - // SEEDED_ORGS above so the org exists; ensure the repo itself. - if let Err(e) = ensure_shared_docs_repo(token).await { - tracing::warn!(error = ?e, "forge: ensure_shared_docs_repo failed"); - } if let Err(e) = ensure_core_avatar(token).await { tracing::warn!(error = ?e, "forge: ensure_core_avatar failed"); }