f0844f6da3
mara on #5170: "dont split caps and perms. its all perms. / dont include the now empty tool groups / nothing set -> default / also add perms to agent creation screen". - hive-sh4re: one `Permission` enum (messaging, meta, inbox, execution, web_tools, manage_root_agent) replaces `ToolGroup` and `Capability`; `lifecycle`/`forge` are gone. `Permission::default_for` is the default for an agent the swarm sets nothing for. - The record is `{ "permissions": [...] }`. Missing key, unset field or no successful read yet = default; `[]` = none; a failed read after a good one keeps the last value. - hive-agent reads its own key every 10s and builds each turn's --tools, --allowedTools and MCP config (rewritten before every turn) from it; the subagent daemon reads it on each start/continue. Agents get a read-only grant on their own key. - hive-c0re restarts an agent only when its manage_root_agent changes. The import now merges meta/capabilities.json and meta/tool-groups.json into one list per agent and deletes both; the "import pending, don't read" decision is `ImportOutcome::read_allowed`, table-tested. - swarm-controller: `GET /api/permissions` (names + default) and an optional `permissions` on `POST /api/agents`, stored before the job is queued. swarm-ui's create-agent form gets a permissions field. - Deleted: HIVE_TOOL_GROUPS and its forward to the subagent daemon, tool_groups.rs, ruth's tool-group seed, the permissions rebuild job (PermPayload/WritePermFile/perm_change), the dashboard permissions tab and its stale-entries panel. Part of #5170.
30 lines
1.3 KiB
Markdown
30 lines
1.3 KiB
Markdown
# hive-host-sock
|
|
|
|
Wire types for the **host admin socket** (`/run/hyperhive/host.sock`) — the
|
|
host-control protocol spoken between the `hivectl` operator CLI and the
|
|
`hive-c0re` daemon.
|
|
|
|
## Why it's its own crate
|
|
|
|
Re-homed out of `hive-sh4re` so a standalone `hivectl` depends on **just this
|
|
protocol crate** instead of the whole daemon-shared crate. `hivectl` drives the
|
|
full hive (spawn / kill / destroy / rebuild / deploy) over this socket without
|
|
linking `hive-c0re`; keeping the request/response shapes here is what makes that
|
|
thin dependency possible.
|
|
|
|
## Shape
|
|
|
|
Serde-derived request/response enums for the host admin protocol. The larger
|
|
shared payload type some variants reference (`AgentStatusRow`) stays in
|
|
`hive-sh4re` — this crate is only the protocol envelope, no server or
|
|
client implementation.
|
|
|
|
Its own `jobs` module is the exception: the job-queue vocabulary `hivectl`
|
|
needs (`State`, `NodeId`) is protocol-local. The typed
|
|
`DagView`/`NodeView` projection that used to live there is gone — the queue is
|
|
served as a generic graph (`hive-jobq-wire`), not as a second hand-written
|
|
view.
|
|
|
|
See `docs/trust-boundary/boundary.md` (host admin socket access) for the trust model around who
|
|
may connect to the socket, and `hive-priv-sock` for the sibling split on the
|
|
privileged-helper socket.
|