| Filename | Latest commit message | Latest commit date |
|---|---|---|
11097ed336
swarm-logs covers every host-tier unit this tool could reach, so the second, capability-gated path into host journald earns nothing and is removed outright rather than disabled behind a flag. Removed end to end: the MCP tool definition + handler, the GetHostJournal/HostJournal wire variants, hive-c0re's dispatch_host_journal handler, the ReadHostJournal capability, and the harness-side capability->--allowedTools gate. get_host_journal was the only capability that mapped to an MCP tool, so allowed_capability_tools could only ever return an empty vec; it goes too rather than linger as a function that provably does nothing. capabilities::has_cap/caps_for stay: #4624 gave ManageRootAgent's bind-mount enforcement (hive-c0re/src/lifecycle/host_config.rs) a second caller of has_cap, so they're no longer callerless once this lands on top of it. hive-sh4re's journal module (JournalPriority) had no consumer outside this tool and is deleted. An existing capabilities.json still naming read_host_journal does not error: capabilities::prune_unknown drops unrecognised names with a warn!, and an agent left with no capabilities has its entry removed. No migration step is needed. Untouched: hive-c0re/src/dashboard/journal.rs's read_host_journal_response, which matches the name but is the private helper behind the operator-only GET /api/journal-host dashboard route and carries no capability check. |
||
| .. | ||
| src | ||
| Cargo.toml | ||
| README.md | ||
hive-core-agent-sock
Wire types for the per-agent + manager socket (/run/hive/mcp.sock) — the
unified Request / Response protocol spoken between an agent's in-container
harness (and the manager) and the hive-c0re daemon.
Why it's its own crate
Re-homed out of hive-sh4re so this one socket owns its protocol crate,
mirroring the hive-host-sock / hive-priv-sock splits. The shared payload
types it references (Message, LooseEnd, Approval, …) stay in hive-sh4re,
which this crate depends on — this crate is just the request/response envelope
for this socket.
Not to be confused with hive-agent-sock
This is the host-served protocol: the harness talks out to hive-c0re
over /run/hive/mcp.sock (broker sends, approvals, lifecycle).
hive-agent-sock is the separate in-container socket the harness serves to
its own local producers — that one never leaves the container. See
docs/trust-boundary/boundary.md for the socket topology.