| Filename | Latest commit message | Latest commit date |
|---|---|---|
de09628c7c
`Coordinator::set_paused` wrote the marker directly with `std::fs::write`
from hive-c0re, which runs as the unprivileged `hive-core` user. The
agent's harness dir is chowned to the agent user on every container boot
(`user.nix`'s activation chown), mode 0755 — so hive-core can stat the
marker but gets EACCES creating or unlinking it. Pause therefore only
ever worked on an agent that had never booted; the read side works
because a stat needs traverse, not write, which is why the paused pill
and `is_paused` looked healthy.
Route both directions through hive-priv, the root helper that already
owns the other writes into agent-owned directories:
- `PrivRequest::SetAgentPaused { agent_name, paused }`, with the marker
filename constant moved to hive-priv-sock. That is the narrowest crate
all three sides share (hive-priv deliberately does not depend on
hive-sh4re, which re-exports it for the in-container resolver). A
private copy on any one side would break pause silently, since every
reader just sees "no marker".
- `write_agent_state_file` generalised to `write_agent_dir_file`, taking
the target directory: `state/` and `harness/` are both agent-owned,
which is the same reason both need root.
- resume unlinks via `remove_file`, which acts on the leaf and never
follows a symlink — an agent could otherwise plant a link at the
marker path and have root delete an arbitrary file.
`Coordinator::set_paused` becomes an async round-trip; its three call
sites were already async. Both directions stay idempotent because the
dashboard toggle and `hivectl pause|resume` fire without reading the
current state first.
|
||
| .. | ||
| src | ||
| Cargo.toml | ||
| README.md | ||
hive-sh4re
The shared payload vocabulary between hive-c0re and the in-container
harness — the common types (Message, Approval, LooseEnd, HelperEvent, …)
that the per-socket wire protocols are built from. The request/response
envelopes themselves now live in the per-socket crates (below); this crate
holds the payloads they carry.
Where it sits
This is the shared payload crate; the per-socket protocol envelopes have been
split into their own smaller crates so specialised binaries don't have to pull
in all of hive-sh4re:
hive-host-sock— host admin socket (hivectl↔hive-c0re)hive-core-agent-sock— per-agent/manager socket (/run/hive/mcp.sock)hive-priv-sock— the privileged-helper socket
Those crates re-export or reference the payload types that still live here
(Approval, Message, LooseEnd, …).
Modules
jobs— the job-queue wire types (DagView) surfaced to the dashboard SSE stream + hivectl.wire_time— the timestamp convention: wire fields arechrono::DateTime<Utc>(serialized RFC 3339), while sqlite storage + input args stay unix-epochi64; this module owns the two boundary conversions.paths— well-known on-disk path helpers.assets— resolves bundled runtime asset paths (branding, prompts) underHIVE_ASSETS_DIR.
Agent-name fields are typed as hive_types::Ident for serde-validated parsing at
the socket boundary.