88674eb63a
The agent's state/AGENTS.md stays the truth and its harness the only writer. The harness mirrors the file into a new `agents-md` KV bucket, and swarm-controller serves that copy, so a read works while the agent is stopped. An edit is a unified diff plus the revision it was made against, sent over the agent's existing control subject; the harness refuses a stale base, applies the diff with `git apply --check` then `git apply` to a temp copy, and writes the file only when both pass. Fixes #5519. Files: - swarm-queue-client/src/agents_md.rs, lib.rs: the bucket name and subject, the mirror value, the `ApplyAgentsMd` control command and its reply. `AgentControl` loses `Copy` because the new variant carries text. - hive-agent/src/swarm_agents_md.rs, main.rs: the mirror task (start, 10 s re-read, immediate republish after an edit) and the apply. - hive-agent/src/swarm_input.rs: the control loop answers both commands. - hive-agent/src/claude_md_watch.rs: its AGENTS.md path is shared. - hive-agent/Cargo.toml, Cargo.lock: sha1 for the git blob id (already in the lock), tempfile moves from dev to runtime for the apply directory. - swarm-controller/src/agents_md.rs, main.rs: the bucket reader and GET/PUT /api/agents/{name}/agents-md; test AppState literals get the new field. - swarm-controller/src/agent_control.rs: the sink hands back raw reply bytes, so each command decodes its own reply type. - swarm-controller-api/src/agents_md.rs: the route bodies, shared with swarmctl. - swarmctl/src/agents_md.rs, main.rs: `swarmctl agent agents-md get|apply`. - nix/host-modules/swarm-nats.nix, nix/module-eval/nats-authelia.nix: the agent's publish grant on its own `$KV.agents-md.<agent>` key. git needs no new package: agent containers enable programs.git, and the harness unit's PATH includes /run/current-system/sw.
76 lines
2.6 KiB
TOML
76 lines
2.6 KiB
TOML
[package]
|
|
name = "hive-agent"
|
|
edition.workspace = true
|
|
version.workspace = true
|
|
readme = "README.md"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
anyhow.workspace = true
|
|
# Named directly for the client type the publishers hold, and for `jetstream`,
|
|
# which the icon publisher's acked write needs. The connect and the credential
|
|
# handling live in `swarm-queue-client` below.
|
|
async-nats = { workspace = true, features = ["jetstream"] }
|
|
axum.workspace = true
|
|
backon.workspace = true
|
|
chrono.workspace = true
|
|
reqwest.workspace = true
|
|
hyper.workspace = true
|
|
hyper-util.workspace = true
|
|
http-body-util.workspace = true
|
|
futures-util = "0.3"
|
|
clap.workspace = true
|
|
hive-claude.workspace = true
|
|
hive-runtime.workspace = true
|
|
hive-agent-sock.workspace = true
|
|
hive-core-agent-sock.workspace = true
|
|
hive-log.workspace = true
|
|
hive-sh4re.workspace = true
|
|
hive-sock-client.workspace = true
|
|
libc.workspace = true
|
|
opentelemetry.workspace = true
|
|
opentelemetry_sdk.workspace = true
|
|
opentelemetry-otlp.workspace = true
|
|
rmcp.workspace = true
|
|
rusqlite.workspace = true
|
|
schemars.workspace = true
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
# The git blob id of AGENTS.md, the revision an edit from the swarm names.
|
|
sha1 = "0.10"
|
|
# `agent-schedules`, `agent-inference` and `operator-profiles`: the schedule
|
|
# ticker and the inference poller each read their own key, and the prompt
|
|
# renderer the operator list, with one direct get.
|
|
# `kv`/`notices` name buckets and streams this harness opens neither end of,
|
|
# and the terminal publisher is a plain core-subject publish.
|
|
swarm-queue-client = { workspace = true, features = [
|
|
"agent-schedules",
|
|
"agent-inference",
|
|
"agent-permissions",
|
|
"operator-profiles",
|
|
] }
|
|
# This agent's own queue secret, read from the store under its own certificate.
|
|
swarm-secret-client.workspace = true
|
|
# The directory an AGENTS.md edit is applied in, and the file it is written
|
|
# through.
|
|
tempfile = "3"
|
|
tokio.workspace = true
|
|
tokio-stream.workspace = true
|
|
tower-http.workspace = true
|
|
tracing.workspace = true
|
|
|
|
# `test-util` for `#[tokio::test(start_paused = true)]`: `swarm_agent_state`'s
|
|
# refresh test waits out its one-minute interval on paused time.
|
|
[dev-dependencies]
|
|
tokio = { workspace = true, features = ["test-util"] }
|
|
tower = { version = "0.5", features = ["util"] }
|
|
# A layer that captures `swarm_queue`'s exhausted-connect log event in a test.
|
|
tracing-subscriber.workspace = true
|
|
|
|
# Single harness serve-loop binary: `hive-agent` (from `src/main.rs`).
|
|
# The sibling MCP server is its own bin crate now (`hive-agent-mcp`).
|
|
# Privilege boundary is enforced server-side at the socket (tool
|
|
# groups / manager surface).
|
|
# See `docs/turn-loop/README.md::Harness binary shape`.
|