vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity
hyperhive/docs/tools
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
atlas 2df19e4899 swarmctl: log in with the operator's own SSO account and reach the controller through the swarm domain 
`swarmctl --swarm https://<swarm> login` runs the OAuth 2.0
authorization-code flow with PKCE against the swarm's authelia as a new
public `swarmctl` client: a pushed authorization request, the browser login
and explicit consent, and the code delivered by form_post to a loopback
port. The access and refresh tokens are cached at mode 0600 under
$XDG_STATE_HOME/swarmctl/ and refreshed under a file lock, since authelia
rotates the refresh token and revokes the login when a used one is
presented again. With --swarm (or SWARMCTL_SWARM), the agent, schedule and
forge verbs send their requests to https://<swarm>/api/ with the bearer
token instead of over the controller's unix socket, which stays the default.

authelia registers the client on every authelia host with a swarm domain:
`kind = "native"`, public, no minted secret, scopes offline_access and
authelia.bearer.authz, audience https://<swarm>/api/ (matched as a URL
prefix), redirect http://127.0.0.1/callback (any loopback port). Every
field is one authelia 4.39.20's validator requires for a public client
holding the bearer scope.

The swarm apex's /api/ answers a refused caller that sent an
Authorization header with the 401 itself instead of the login redirect,
so the CLI can tell "log in again" apart from an answer; a browser still
gets the redirect. The bearer token is not forwarded to the controller.

Refs #4409 (mara: c94764, c94782).
2026-10-12 01:25:58 +02:00
..
bash.md docs: drop statements about absent things, state current behaviour 2026-10-02 11:43:10 +02:00
forge-cli.md hive-forge: comments --since --limit returns N, not at most 49 2026-10-09 21:46:14 +02:00
forge.md hive-forge: fetch issue comments in one request; the endpoint has no paging 2026-10-09 21:19:47 +02:00
hivectl-cli.md swarm-ci-runner: run the forge CI runner as a swarm service 2026-10-05 13:55:37 +02:00
hivectl.md docs: config changes are operator merges on the forge 2026-10-02 23:13:04 +02:00
matrix.md hive-matrix-mcp: fix list_rooms/list_invites docs to say room_id, not id 2026-10-04 20:40:15 +02:00
README.md docs: scheduled prompts are swarm-level; the hive page is a read-only list 2026-10-04 21:23:31 +02:00
subagent.md Merge forge/main into atlas/5034-s4-remove-hive-model 2026-10-11 03:42:22 +02:00
swarm-logs-cli.md docs: gate write-good.Passive on CI 2026-09-20 16:24:11 +02:00
swarmctl-cli.md swarmctl: log in with the operator's own SSO account and reach the controller through the swarm domain 2026-10-12 01:25:58 +02:00

README.md

Tools

hivectl is your tool — the operator's own host CLI. Everything else here documents the tool surface your agents get inside their containers (the MCP tools an agent's own claude session can call). You never call these directly, but they're the reference for what an agent can actually do — useful when you're trying to understand or debug agent behavior.

For the operator

  • hivectl — the curated guide: provisioning forge and matrix accounts, gateway htpasswd management, container lifecycle shortcuts, interactive agent shell access.
  • hivectl-cli — the exhaustive, autogenerated flag-by-flag reference, kept in lockstep with the binary by CI.

For the swarm operator

  • swarmctl-cli — the exhaustive, autogenerated flag-by-flag reference for swarmctl, kept in lockstep with the binary by CI the same way hivectl-cli.md is. swarmctl itself runs as root on the swarm-controller host, not through hivectl — see swarmctl/README.md for why. Two verb families today: user (authelia's subject store, edited in place) and agent create (queues the swarm-controller's creation job graph). No curated guide yet; add one here if/when that grows.

What your agents can do

  • bash — background shell execution (mcp__bash__*), available on every agent unconditionally.
  • subagent — spawn nested headless claude sessions (mcp__subagent__{start,continue,status,interrupt}), shipped default-on for every agent today alongside bash (expected to become a real opt-in capability later).
  • forge — the hive-forge Forgejo CLI every agent has for issues, PRs, and comments. Not an MCP tool — a binary agents shell out to instead of ad-hoc curl.
  • forge-cli — the exhaustive, autogenerated flag-by-flag reference for hive-forge, kept in lockstep with the binary by CI the same way hivectl-cli.md is.
  • matrix — the matrix MCP tool surface (mcp__matrix__*) for agents with a matrix account, multiple accounts per agent, and declaring extra MCP servers generally.