vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity
hyperhive/docs/tools
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
atlas f0844f6da3 agent permissions: one set, tool groups included, set at agent creation 
mara on #5170: "dont split caps and perms. its all perms. / dont include
the now empty tool groups / nothing set -> default / also add perms to
agent creation screen".

- hive-sh4re: one `Permission` enum (messaging, meta, inbox, execution,
  web_tools, manage_root_agent) replaces `ToolGroup` and `Capability`;
  `lifecycle`/`forge` are gone. `Permission::default_for` is the default
  for an agent the swarm sets nothing for.
- The record is `{ "permissions": [...] }`. Missing key, unset field or
  no successful read yet = default; `[]` = none; a failed read after a
  good one keeps the last value.
- hive-agent reads its own key every 10s and builds each turn's --tools,
  --allowedTools and MCP config (rewritten before every turn) from it;
  the subagent daemon reads it on each start/continue. Agents get a
  read-only grant on their own key.
- hive-c0re restarts an agent only when its manage_root_agent changes.
  The import now merges meta/capabilities.json and meta/tool-groups.json
  into one list per agent and deletes both; the "import pending, don't
  read" decision is `ImportOutcome::read_allowed`, table-tested.
- swarm-controller: `GET /api/permissions` (names + default) and an
  optional `permissions` on `POST /api/agents`, stored before the job is
  queued. swarm-ui's create-agent form gets a permissions field.
- Deleted: HIVE_TOOL_GROUPS and its forward to the subagent daemon,
  tool_groups.rs, ruth's tool-group seed, the permissions rebuild job
  (PermPayload/WritePermFile/perm_change), the dashboard permissions tab
  and its stale-entries panel.

Part of #5170.
2026-10-15 18:01:40 +02:00
..
bash.md agent permissions: one set, tool groups included, set at agent creation 2026-10-15 18:01:40 +02:00
forge-cli.md hive-forge: pr edit --base retargets a PR 2026-10-13 08:37:13 +02:00
forge.md repo-search: don't tell the caller to raise --limit once the forge has already clamped 2026-10-14 19:37:43 +02:00
hivectl-cli.md hive-c0re: the per-agent resource limit override is gone 2026-10-15 08:28:10 +02:00
hivectl.md hive-c0re: the per-agent resource limit override is gone 2026-10-15 08:28:10 +02:00
matrix.md hive-matrix-mcp: fix list_rooms/list_invites docs to say room_id, not id 2026-10-04 20:40:15 +02:00
README.md docs: scheduled prompts are swarm-level; the hive page is a read-only list 2026-10-04 21:23:31 +02:00
subagent.md agent permissions: one set, tool groups included, set at agent creation 2026-10-15 18:01:40 +02:00
swarm-logs-cli.md docs: gate write-good.Passive on CI 2026-09-20 16:24:11 +02:00
swarmctl-cli.md agent permissions: one set, tool groups included, set at agent creation 2026-10-15 18:01:40 +02:00

README.md

Tools

hivectl is your tool — the operator's own host CLI. Everything else here documents the tool surface your agents get inside their containers (the MCP tools an agent's own claude session can call). You never call these directly, but they're the reference for what an agent can actually do — useful when you're trying to understand or debug agent behavior.

For the operator

  • hivectl — the curated guide: provisioning forge and matrix accounts, gateway htpasswd management, container lifecycle shortcuts, interactive agent shell access.
  • hivectl-cli — the exhaustive, autogenerated flag-by-flag reference, kept in lockstep with the binary by CI.

For the swarm operator

  • swarmctl-cli — the exhaustive, autogenerated flag-by-flag reference for swarmctl, kept in lockstep with the binary by CI the same way hivectl-cli.md is. swarmctl itself runs as root on the swarm-controller host, not through hivectl — see swarmctl/README.md for why. Two verb families today: user (authelia's subject store, edited in place) and agent create (queues the swarm-controller's creation job graph). No curated guide yet; add one here if/when that grows.

What your agents can do

  • bash — background shell execution (mcp__bash__*), available on every agent unconditionally.
  • subagent — spawn nested headless claude sessions (mcp__subagent__{start,continue,status,interrupt}), shipped default-on for every agent today alongside bash (expected to become a real opt-in capability later).
  • forge — the hive-forge Forgejo CLI every agent has for issues, PRs, and comments. Not an MCP tool — a binary agents shell out to instead of ad-hoc curl.
  • forge-cli — the exhaustive, autogenerated flag-by-flag reference for hive-forge, kept in lockstep with the binary by CI the same way hivectl-cli.md is.
  • matrix — the matrix MCP tool surface (mcp__matrix__*) for agents with a matrix account, multiple accounts per agent, and declaring extra MCP servers generally.