vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity
hyperhive/hive-subagent-mcp
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
atlas 52037133e2 swarm-nats-auth: limit agent subscribe to its own inbox and input 
An agent's queue credential could subscribe to every subject in the swarm
account, so any agent could read every other agent's terminal, turn state,
operator input and request replies. Agents are the least trusted clients
on the queue (mara's ruling on #4901), so their grants now carry a
subscribe allow-list:

- an agent's own credential (the harness and its subagent daemon):
  `_INBOX.agent.<agent>.>` and `$SWARM.input.<agent>`
- the hive's shared agent client: `_INBOX.client.<client-id>.>`

Hive and swarm-controller grants are unchanged (no `sub` claim, so still
every subject).

The clients connect with the matching inbox prefix, so the replies they
rely on still arrive: the icon write's JetStream ack and the schedule
DIRECT.GET. `connect_with_token` takes the agent name and sets the prefix
itself; the hive-shared fallback uses the new
`connect_with_inbox_prefix`.

The harness no longer subscribes to its input subject when it fell back
to the hive's shared client: that identity names no agent, so it cannot
be granted one agent's input without all of them. It logs that and
skips, the same as the schedule reader on that path.

Refs #4901
2026-10-04 19:22:41 +02:00
..
src swarm-nats-auth: limit agent subscribe to its own inbox and input 2026-10-04 19:22:41 +02:00
Cargo.toml swarm-controller: create every agent's subagent stream 2026-10-03 01:34:01 +02:00
README.md subagent: give each run its own signal URL, and drop the name argument 2026-09-14 22:24:51 +02:00

README.md

hive-subagent-mcp

Per-agent daemon (hive-subagent-daemon) that spawns nested headless claude sessions on request and serves the tool surface (start/continue/status/interrupt, plus a separate subagent-facing goal_reached/need_help route, one per-session URL) directly over streamable-http. No stdio bridge, no per-turn respawn — an agent's claude reconnects to the same stable URL every turn.

Independent of hive-bash-mcp — a subagent spawns a full nested claude session, a much heavier capability than a bash command, worth its own deployable/restartable unit.

Shape

One bin (hive-subagent-daemon, src/main.rs) built from the crate's own lib (src/lib.rs):

  • session.rs — the actual claude-facing logic: Claude::spawn + RunningClaude::wait/cancel_handle (not InfiniteSession::run, which has no cancel handle to reach in — see the module doc for the v1 scope this trades away), the turn-continuation loop a goal switches on, and the in-memory maps that are the only state this daemon keeps (no task files — a restart stops whatever's running; the actual claude session is the durable store, found again by name via hive_claude::SessionStore).
  • mcp.rs — the rmcp tool routers (the parent's start/continue/status/interrupt on /mcp, the subagent's goal_reached/need_help on /signal/mcp/<token>) + serve_http. Neither signal tool takes a session name: the token in the path is minted per run and resolved to a session before dispatch, so a subagent has no way to name — and therefore no way to signal — a sibling. One route with a path parameter, because the Router is built once at startup and sessions come and go for the daemon's whole life.
  • paths.rs — the in-agent todo-socket path.