f0844f6da3
mara on #5170: "dont split caps and perms. its all perms. / dont include the now empty tool groups / nothing set -> default / also add perms to agent creation screen". - hive-sh4re: one `Permission` enum (messaging, meta, inbox, execution, web_tools, manage_root_agent) replaces `ToolGroup` and `Capability`; `lifecycle`/`forge` are gone. `Permission::default_for` is the default for an agent the swarm sets nothing for. - The record is `{ "permissions": [...] }`. Missing key, unset field or no successful read yet = default; `[]` = none; a failed read after a good one keeps the last value. - hive-agent reads its own key every 10s and builds each turn's --tools, --allowedTools and MCP config (rewritten before every turn) from it; the subagent daemon reads it on each start/continue. Agents get a read-only grant on their own key. - hive-c0re restarts an agent only when its manage_root_agent changes. The import now merges meta/capabilities.json and meta/tool-groups.json into one list per agent and deletes both; the "import pending, don't read" decision is `ImportOutcome::read_allowed`, table-tested. - swarm-controller: `GET /api/permissions` (names + default) and an optional `permissions` on `POST /api/agents`, stored before the job is queued. swarm-ui's create-agent form gets a permissions field. - Deleted: HIVE_TOOL_GROUPS and its forward to the subagent daemon, tool_groups.rs, ruth's tool-group seed, the permissions rebuild job (PermPayload/WritePermFile/perm_change), the dashboard permissions tab and its stale-entries panel. Part of #5170.
53 lines
2.5 KiB
Markdown
53 lines
2.5 KiB
Markdown
# hive-agent
|
|
|
|
The in-container harness serve-loop binary — one instance per agent.
|
|
Long-polls the broker inbox and drives one turn per inbox message
|
|
through `hive-runtime`, on the agent's runtime (`claude --print` by
|
|
default, or an ACP agent). It has one role
|
|
(agent); the `Surface` trait + `AgentSurface` zero-sized type tag keep
|
|
the turn loop generic and testable for future roles without a
|
|
parallel copy of the loop.
|
|
|
|
## When to use it
|
|
|
|
You don't call into this crate from elsewhere — it's the top-level
|
|
binary systemd starts per agent container. Look here when you need to
|
|
understand or change: what happens between a message landing in the
|
|
inbox and the agent's reply, how the harness bootstraps login/auth,
|
|
how it serves the per-agent web UI, or how turn/event stats get
|
|
recorded. Architecture detail lives in
|
|
[`docs/turn-loop/`](../docs/turn-loop/README.md); this README is just the
|
|
map of the module tree.
|
|
|
|
## Shape
|
|
|
|
- **`main.rs`** — the serve loop and the `Surface` trait; broker calls
|
|
(inbox poll, ack, send) go through `hive-sock-client` with
|
|
`hive-core-agent-sock` wire types.
|
|
- **`turn.rs`** — the turn-loop policy layer: renders the system
|
|
prompt + MCP config, runs the turn through `hive-runtime`, classifies
|
|
the outcome, and feeds the event/turn-stats sinks.
|
|
- **`login.rs` / `login_session.rs`** — first-run and session-resume
|
|
auth flow for the `claude` CLI.
|
|
- **`mcp_config.rs`** — renders the per-turn `--mcp-config` /
|
|
`--allowedTools` blob from the agent's permissions.
|
|
- **`todos.rs` / `reminders.rs` / `todo_server.rs`** — the harness-local
|
|
loose-ends v2 stores (sqlite-backed) and the in-agent socket server
|
|
extra MCP daemons + `hive-agent-mcp` dial into for todo/reminder ops.
|
|
- **`vacuum.rs`** — periodic sqlite vacuum sweep for the harness-local
|
|
stores.
|
|
- **`events.rs` / `turn_stats.rs` / `stats.rs`** — append-only event
|
|
sink and per-turn telemetry recording (context usage, cost, tool
|
|
favorites) under `harness/`.
|
|
- **`prompt.rs`** — system-prompt renderer (persona + tool docs +
|
|
environment facts).
|
|
- **`web_ui/`** — the per-agent dashboard (terminal pane, status,
|
|
schedules) served over the built-in `hive-agent` web port.
|
|
- **`paths.rs`** — canonical path resolution for state/harness dirs and
|
|
the harness-local sqlite files.
|
|
|
|
Siblings: **`hive-agent-mcp`** (the MCP server this loop points the
|
|
agent at every turn) and **`hive-runtime`** (the library a turn runs
|
|
through).
|
|
[`docs/turn-loop/::Harness binary shape`](../docs/turn-loop/README.md#harness-binary-shape)
|
|
covers all three together.
|