vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity
hyperhive/nix/module-eval
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
atlas 4356dc82a4 swarm-bao: let the controller list linked-account dirs 
OpenBao checks a LIST against the directory with a trailing slash, so
the controller's LIST on secret/metadata/swarm/agents/<a>/matrix is
checked as .../matrix/. Its empty last segment matches the `+` in the
delete stanza .../agents/+/matrix/+ (added by bbf93120), which then is
the only non-exact rule matching, and its ["delete"] denies the LIST
before acl.go's trimmed-path fallback reaches .../+/matrix ["list"].
The forge directory fails the same way against .../+/forge/+.

Writing the list stanzas as .../+/matrix/ and .../+/forge/ makes them
match the slashed request too, and with one `+` segment against two
they outrank the delete stanzas. Deletes on .../matrix/<id> still
resolve to .../+/matrix/+, which the slashed list path does not match.

Reproduced by iris against a local bao server -dev with a non-root
token: list stanza alone allowed, plus the delete stanza denied, list
stanza with trailing slash plus the delete stanza allowed.

Closes #4919
2026-10-04 17:23:36 +02:00
..
agent-forge-bao.nix forge: external forge accounts live in swarm bao; the agent fetches them itself 2026-10-01 18:05:33 +02:00
agent-github-bao.nix github swarm bao: address argus review on #4892 2026-10-02 17:54:45 +02:00
agent-icon.nix nix: split module-eval into per-subsystem checks 2026-09-20 04:25:54 +02:00
agent-matrix.nix hive-matrix-mcp: read the main account's token from the store too 2026-09-25 08:31:01 +02:00
agent-memory.nix nix: split module-eval into per-subsystem checks 2026-09-20 04:25:54 +02:00
agent-otel.nix module-eval: assert the severity table once, not once per tier 2026-09-20 14:23:56 +02:00
agent-plugins.nix nix: split module-eval into per-subsystem checks 2026-09-20 04:25:54 +02:00
agent-queue-bao.nix hive-agent: read the per-agent queue secret from bao in process 2026-09-29 10:18:07 +02:00
agent-runtime.nix module-eval: pin a claude agent's subagent store identity 2026-10-03 01:34:01 +02:00
agent-user.nix hive-priv: create agent socket dirs on start; drop hyperhive-agents.conf 2026-09-27 18:55:33 +02:00
bao-basics.nix bao: serve the browser UI to admins via a loopback-only listener 2026-09-28 19:31:02 +02:00
bao-controller.nix ops: update option pointer after hive-matrix split 2026-10-01 13:00:25 +02:00
bao-grants.nix swarm-bao: let the controller list linked-account dirs 2026-10-04 17:23:36 +02:00
bao-matrix-reader.nix swarm-otel: ship the whole host journal, drop user sessions after it 2026-09-30 23:01:49 +02:00
bao-otel-collector.nix swarm-otel: ship the whole host journal, drop user sessions after it 2026-09-30 23:01:49 +02:00
core-toggle.nix forge: always behind the gateway; drop behindGateway 2026-10-02 18:50:42 +02:00
forge-placement.nix hive-forge: a first authelia login creates the forge account 2026-09-25 08:29:56 +02:00
grafana.nix swarm-bao: stamp collector's service.name as "bao" 2026-09-25 08:30:25 +02:00
hive-otel.nix swarm-bao: give the store's collector an explicit self-telemetry port 2026-09-23 18:04:33 +02:00
hive-tls.nix hive-tls: fail swarm-services-cert when the store identity is absent 2026-10-04 14:37:50 +02:00
journald-severity.nix module-eval: assert the severity table once, not once per tier 2026-09-20 14:23:56 +02:00
lib.nix nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable 2026-09-26 01:19:49 +02:00
matrix-core.nix nix: split module-eval into per-subsystem checks 2026-09-20 04:25:54 +02:00
name-guards.nix swarm-bao: write every swarm-* grant as a bao granter, not with a 24h token 2026-09-27 22:57:46 +02:00
nats-authelia.nix swarm-controller: make authelia's operators matrix homeserver admins 2026-10-04 16:45:08 +02:00
nats-tls.nix swarm-controller: read the queue client secret from the store, drop the file 2026-09-28 19:01:05 +02:00
secret-publisher.nix bao: OIDC login to the browser UI via authelia, as a metadata-only viewer 2026-09-28 19:56:38 +02:00
swarm-otel-core.nix swarm-otel: ship the whole host journal, drop user sessions after it 2026-09-30 23:01:49 +02:00
swarm-otel-identity.nix swarm-bao: refuse a remote reader that named seven of the eight leaves 2026-09-23 10:11:42 +02:00
swarm-services-switch.nix swarm-ui: build the forge link from swarm.forge.domain 2026-10-02 20:02:02 +02:00