f0844f6da3
mara on #5170: "dont split caps and perms. its all perms. / dont include the now empty tool groups / nothing set -> default / also add perms to agent creation screen". - hive-sh4re: one `Permission` enum (messaging, meta, inbox, execution, web_tools, manage_root_agent) replaces `ToolGroup` and `Capability`; `lifecycle`/`forge` are gone. `Permission::default_for` is the default for an agent the swarm sets nothing for. - The record is `{ "permissions": [...] }`. Missing key, unset field or no successful read yet = default; `[]` = none; a failed read after a good one keeps the last value. - hive-agent reads its own key every 10s and builds each turn's --tools, --allowedTools and MCP config (rewritten before every turn) from it; the subagent daemon reads it on each start/continue. Agents get a read-only grant on their own key. - hive-c0re restarts an agent only when its manage_root_agent changes. The import now merges meta/capabilities.json and meta/tool-groups.json into one list per agent and deletes both; the "import pending, don't read" decision is `ImportOutcome::read_allowed`, table-tested. - swarm-controller: `GET /api/permissions` (names + default) and an optional `permissions` on `POST /api/agents`, stored before the job is queued. swarm-ui's create-agent form gets a permissions field. - Deleted: HIVE_TOOL_GROUPS and its forward to the subagent daemon, tool_groups.rs, ruth's tool-group seed, the permissions rebuild job (PermPayload/WritePermFile/perm_change), the dashboard permissions tab and its stale-entries panel. Part of #5170.
61 lines
2.2 KiB
TOML
61 lines
2.2 KiB
TOML
[package]
|
|
name = "hive-subagent-mcp"
|
|
edition.workspace = true
|
|
version.workspace = true
|
|
readme = "README.md"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
anyhow.workspace = true
|
|
# The swarm-queue client for publishing subagent terminals (`swarm_term`).
|
|
async-nats.workspace = true
|
|
axum.workspace = true
|
|
clap.workspace = true
|
|
hive-agent-sock.workspace = true
|
|
hive-claude.workspace = true
|
|
hive-runtime.workspace = true
|
|
# `permissions::subagent_builtin_tools_for` — the same `--tools` resolution the parent
|
|
# harness spawns its own claude with, so a subagent's built-in surface is its
|
|
# parent's rather than a second list that drifts. See `session::build_config`.
|
|
# Also `term_msg`/`stream_enrich`, the rows `swarm_term` publishes.
|
|
hive-sh4re.workspace = true
|
|
hive-sock-client.workspace = true
|
|
hive-types.workspace = true
|
|
libc.workspace = true
|
|
rmcp.workspace = true
|
|
schemars.workspace = true
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
# `subagent_term`: the subject each subagent's rows are published on.
|
|
# `agent-inference`: this agent's `subagent_models`, read with one direct get.
|
|
swarm-queue-client = { workspace = true, features = [
|
|
"agent-inference",
|
|
"agent-permissions",
|
|
] }
|
|
# The agent's own queue credential, read under its store identity.
|
|
swarm-secret-client.workspace = true
|
|
tokio.workspace = true
|
|
tracing.workspace = true
|
|
tracing-subscriber.workspace = true
|
|
# Signal-route tokens. `Uuid::new_v4` draws from the OS CSPRNG (getrandom),
|
|
# which is the property the per-session URL rests on — see
|
|
# `session::State::mint_signal_url`.
|
|
uuid.workspace = true
|
|
|
|
# `test-util` for `#[tokio::test(start_paused = true)]`: the `continue`
|
|
# resume-grace tests assert what happens when the bound is actually reached,
|
|
# and paused time gets that answer without a five-second unit test.
|
|
[dev-dependencies]
|
|
tokio = { workspace = true, features = ["test-util"] }
|
|
|
|
# `hive-subagent-daemon` — long-running per-agent claude-subagent runner.
|
|
# Independent of `hive-bash-mcp` (own crate, own binary, own MCP server) —
|
|
# see lib.rs's module doc for why. Serves its MCP tools (`start`/
|
|
# `continue`/`status`/`interrupt`, plus the subagent-facing
|
|
# `goal_reached`/`need_help` route) directly over streamable-http — no
|
|
# stdio bridge.
|
|
[[bin]]
|
|
name = "hive-subagent-daemon"
|
|
path = "src/main.rs"
|