vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2
hyperhive/docs/tools
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
atlas d6c8cd5a6f subagent: hand a subagent its parent's built-in tools, and no others 
`build_config` spawned a subagent with `--dangerously-skip-permissions`
and no `--tools` at all, so it got claude's entire built-in set —
`SendMessage` and `ListAgents` (message peers, or the operator, as its
parent), `Task*` including `TaskStop`, which takes an *agent* id and so
reaches clean outside the run, `Cron*`, `RemoteTrigger` and
`EnterWorktree`/`ExitWorktree`. None of that is part of "do this bounded
task in this directory", and none of it is something the parent agent
itself can do: the harness has always passed `--tools`.

Pass the same one. The value comes from
`hive_sh4re::permissions::builtin_tools_arg()` — literally the function
the harness resolves its own session with — so the subagent's set is the
parent's set, `HIVE_TOOL_GROUPS` and all. That inheritance is the
requirement, not an implementation detail: a hardcoded subagent list
would hand `WebFetch`/`WebSearch` to the subagent of an agent without the
`web_tools` group, which is a privilege escalation, and would drift from
the parent's list the first time anyone added a tool to either.

`--tools` is the real gate: it holds under
`--dangerously-skip-permissions`, unlike `--allowedTools`, which only
auto-approves prompts. It does not filter MCP tools, so the
`goal_reached`/`need_help` signal surface is deliberately unnamed in it
and survives on `--strict-mcp-config` alone.

`build_config`'s doc comment claimed `strict_mcp_config` was *the* safety
property and that a subagent got "nothing implicit and nothing more".
That was false for built-ins, and is what hid this gap for as long as it
did; it now says which flag covers which half and that neither
substitutes for the other.

An empty `--tools` value parses as *unset* and grants more than omitting
the flag, so an empty resolution can only be a bug — `build_config`
asserts against it and a test pins the non-emptiness alongside the
subset-of-parent property.

Refs #4416
2026-09-15 17:40:27 +02:00
..
bash.md hive-sh4re, docs: fix the two docs argus flagged on ToolGroup::Execution 2026-09-11 19:01:31 +02:00
forge-cli.md docs: regenerate forge-cli.md for the --limit/--tail opt-in swap 2026-09-11 19:13:30 +02:00
forge.md docs: use pr status's positional form in the two remaining --pr examples 2026-09-11 17:27:49 +02:00
hivectl-cli.md hivectl, docs: choom is not root-only, and set-limits takes no agent name 2026-09-11 19:11:13 +02:00
hivectl.md hivectl, docs: choom is not root-only, and set-limits takes no agent name 2026-09-11 19:11:13 +02:00
lifecycle.md refactor(hive-c0re): drop the request_init_config tool and InitConfig approval 2026-09-14 19:03:44 +02:00
matrix.md docs/matrix: name the [acct:<name>] prefix a multi-account agent receives 2026-09-11 18:19:22 +02:00
README.md feat(swarmctl): add agent create, queueing the swarm-controller creation DAG 2026-09-14 19:40:23 +02:00
scheduling.md scheduling.md: drop the list_schedules prose, keep the approval-scope fix 2026-09-11 18:43:10 +02:00
subagent.md subagent: hand a subagent its parent's built-in tools, and no others 2026-09-15 17:40:27 +02:00
swarmctl-cli.md feat(swarmctl): add agent create, queueing the swarm-controller creation DAG 2026-09-14 19:40:23 +02:00

README.md

Tools

hivectl is your tool — the operator's own host CLI. Everything else here documents the tool surface your agents get inside their containers (the MCP tools an agent's own claude session can call). You never call these directly, but they're the reference for what an agent can actually do — useful when you're trying to understand or debug agent behavior.

For the operator

  • hivectl — the curated guide: provisioning forge and matrix accounts, gateway htpasswd management, container lifecycle shortcuts, interactive agent shell access.
  • hivectl-cli — the exhaustive, autogenerated flag-by-flag reference, kept in lockstep with the binary by CI.

For the swarm operator

  • swarmctl-cli — the exhaustive, autogenerated flag-by-flag reference for swarmctl, kept in lockstep with the binary by CI the same way hivectl-cli.md is. swarmctl itself runs as root on the swarm-controller host, not through hivectl — see swarmctl/README.md for why. Two verb families today: user (authelia's subject store, edited in place) and agent create (queues the swarm-controller's creation job graph). No curated guide yet; add one here if/when that grows.

What your agents can do

  • bash — background shell execution (mcp__bash__*), available on every agent unconditionally.
  • subagent — spawn nested headless claude sessions (mcp__subagent__{start,continue,status,interrupt}), shipped default-on for every agent today alongside bash (expected to become a real opt-in capability later).
  • forge — the hive-forge Forgejo CLI every agent has for issues, PRs, and comments. Not an MCP tool — a binary agents shell out to instead of ad-hoc curl.
  • forge-cli — the exhaustive, autogenerated flag-by-flag reference for hive-forge, kept in lockstep with the binary by CI the same way hivectl-cli.md is.
  • lifecycle — kill/start/restart/update for the agents in a caller's own subtree, plus the approval-gated config-change tools.
  • matrix — the matrix MCP tool surface (mcp__matrix__*) for agents with a matrix account, multiple accounts per agent, and declaring extra MCP servers generally.
  • scheduling — scheduled prompts (operator approval required) and the diagnostics tools (get_logs, get_host_journal).