| Filename | Latest commit message | Latest commit date |
|---|---|---|
170fd817ea
The agents root is 0700 and owned by the daemon's user, so hivectl's client-side existence guard hit EACCES on traversal for anyone not root. It reported that as "this command needs root; re-run with sudo", which turned three verbs' pre-flight check into a permission error about the wrong thing: `choom`, `subvol upgrade` and `subvol snapshot create` all failed at the guard rather than at whatever they actually needed. The daemon runs as the owning user and already answers this question for its own provisioning paths, so expose it on the host socket as `AgentExists` and have hivectl ask. Operators reach that socket through the `hive-admin` group, so the guard now works without sudo. `choom` still needs root for `machinectl shell` — we ship no polkit rule granting those actions — so it now checks the effective uid and says so directly instead of failing later inside systemd's authorisation. |
||
| .. | ||
| src | ||
| Cargo.toml | ||
| README.md | ||
hivectl
The operator-facing host CLI. A thin client for the hive-c0re
daemon — speaks the host admin socket protocol (hive-host-sock) and
does not link the daemon crate. Container lifecycle, the approval
queue, and provisioning verbs all forward to the daemon and need it
running; a few (wg/peer-config, choom) work off local host state
instead.
When to use it
Reach for this crate when adding an operator-run host command — agents
talk to the daemon over their own MCP tool surface
(hive-agent-mcp), not this binary. hivectl is what a human operator
(or a host-side script) runs.
Shape
One module per subcommand family; main.rs is just the clap parse +
dispatch:
agents.rs— container lifecycle (spawn/kill/rebuild/restart/…).approvals.rs— the config/init-config/meta-input approval queue.dag_progress.rs— rebuild-queue progress rendering.power.rs— restart/start/stop at the container level.choom.rs— drop into an interactive claude session in a container.forge.rs,matrix.rs,github.rs,gateway.rs— per-integration account/token provisioning.wg.rs— WireGuard mesh helpers.subvol.rs— btrfs state-subvolume ops.quota.rs,util.rs,completions.rs,open.rs— shared helpers, shell completions, browser-open.
Full verb reference: docs/tools/hivectl.md.