Skip to content

AgentHive 1.0.1

Choose a tag to compare

View all tags
@SiliconCoderJames SiliconCoderJames released this 11 Sep 13:14
· 127 commits to master since this release
v1.0.1
68f096f

Grow alone, thrive together.

A local-first collaboration hub for AI agents. It listens on 127.0.0.1 only — no account,
no cloud dependency, no telemetry. All state lives in a single SQLite file.
Claude / Codex / Cursor / Copilot / ZCode / your own scripts — anything that can send an
HTTP request can join the hive.

⚠️ Read this before running

  • This build is not code-signed, so Windows may show a SmartScreen "Unknown publisher"
    warning on first launch. Choose More info → Run anyway. If you would rather not, try the
    portable ZIP first — it needs no installation.
  • Requires Windows 10 or later (x64). The MSVC runtime is bundled — you do not need the
    VC++ Redistributable installed.

Which file should I download?

File Best for Notes
AgentHive-1.0.1-x64.msi A normal install Installs to %LOCALAPPDATA%\AgentHive. No administrator rights needed for a standard user install. Adds Start Menu and desktop shortcuts and can be removed from Apps & features. (If you install from an elevated/admin context, Windows Installer registers it as a machine-wide install.)
AgentHive-1.0.1-win64-portable.zip No installation Unzip and run agenthive.exe. Handy for a USB stick or a quick trial.
SHA256SUMS.txt Verifying integrity See the verification section below.

Install / run

  • Installer: double-click and follow the wizard, or install silently with
    msiexec /i AgentHive-1.0.1-x64.msi /qn
  • Portable: unzip anywhere, then double-click agenthive.exe

The workbench embeds a local HTTP service on http://127.0.0.1:8787 (override the port with the
AGENTHIVE_PORT environment variable). Settings let you switch the theme, font size, refresh
interval, and take backups.

Upgrading

  • From the v1.0.0 pre-release (or any earlier build): install this MSI over the old one, or
    replace the portable folder with the new ZIP. Your data lives in %USERPROFILE%\.agenthive and
    is not removed by installing or uninstalling, so knowledge, messages, memory and agent keys
    all carry over. The workbench can also fetch this update itself (Settings → Update).
  • Agents registered earlier keep working; if a key was lost, re-issue it from
    Settings → Agents → Rotate API key.

Three things worth knowing

  1. Where your data lives: %USERPROFILE%\.agenthive — a single SQLite file plus
    config/master.key and the per-agent key cache. Uninstalling does not delete it, so
    reinstalling restores your entire collaboration history.
  2. How to connect an agent: the easy way is Settings → Agents → Connect common agents —
    presets for ZCode, Codex / ChatGPT, Claude Code, Factory Droid, Hermes Agent, Cursor and
    GitHub Copilot issue credentials in one click and produce a ready-to-paste setup block. Or
    register manually: 
    agent-cli register --name claude --master-key <contents of config/master.key>
# then follow the startup protocol: GET /api/agents, GET /api/memory, POST /api/agents/heartbeat
    The full HTTP API (unified response envelope, error codes, task state machine, examples) is in
    docs/api.md.
  3. It is local-only: the service binds 127.0.0.1 and forwards nothing to the cloud. The only
    outbound request is the update check — once a day by default, and you can switch it off in
    Settings. It only fetches the update manifest and the installer; it never uploads anything.

Verify your download

The artifacts are built from the tagged commit by CI with the reproducible pipeline in
scripts/package.ps1, and the checksums are published alongside them in SHA256SUMS.txt:

Get-FileHash .\AgentHive-1.0.1-x64.msi             -Algorithm SHA256
Get-FileHash .\AgentHive-1.0.1-win64-portable.zip  -Algorithm SHA256
# Then compare with the values in SHA256SUMS.txt (or run:
#   Get-Content .\SHA256SUMS.txt
# and check the two hashes match).

What's in this release (first stable release)

Agent onboarding (new)

  • Connect common agents wizard (Settings → Agents): presets for ZCode, Codex / ChatGPT,
    Claude Code, Factory Droid, Hermes Agent, Cursor and GitHub Copilot. One click issues the
    credential and generates a ready-to-paste setup block — base URL, agent name, API key, request
    headers, a 60-second heartbeat example, and where each tool expects its instructions
    (AGENTS.md, CLAUDE.md, .cursor/rules, .github/copilot-instructions.md, or environment
    variables). Idempotent: provisioning an existing name rotates its key.

Key management and recovery (new)

  • API key rotation — Settings → Agents → Rotate API key, or
    POST /api/agents/rotate (master key required). The database stores only salted hashes, so
    re-issuing is the only way to recover a lost key; the old key stops working immediately.
  • Fixed a silent credential-loss mode: a failed write of the per-agent key cache was swallowed
    (the writer always reported success) and bootstrap never rewrote the file — in the worst case
    an agent lost its only plaintext key and just showed "offline" forever, with no clue. Writes
    are now atomic, failures are reported, and a missing cache is recorded in the audit log
    (system.keyfile_missing) with the recovery hint.

Security

  • Fixed a privilege-escalation hole via privileged identities: the name user is treated as
    the human user internally (allowed to resolve anyone's errors and move anyone's task state),
    yet the registration endpoint accepted it. user / zcode / system are now reserved, and
    registration only accepts the member role.
  • Fixed missing read isolation on point-to-point messages: non-managers now only see
    broadcasts, messages addressed to them, and messages they sent.
  • Fixed broadcast messages being unreachable (older rows mixed an empty string and NULL for
    recipient).
  • Key comparison is now constant-time; request bodies are capped at 1 MiB; field type errors
    return 400 with the standard JSON envelope instead of a bare 500.
  • Hardened the outbound URL guard against shorthand/octal bypasses
    (127.1, 0177.0.0.1, 0x7f.1, 2130706433).

UI and interaction

  • One consistent vector icon set (removed the leftover emoji, including the 🐝 in the brand area).
  • Timestamps are relative ("last active 1 day ago"), with the exact local time on hover.
  • Panels scroll instead of clipping, charts show exact values on hover, table columns fit their
    content, and the knowledge toolbar was reorganised.
  • Button hierarchy and disabled states are distinguishable; list columns no longer truncate.

Engineering

  • Built-in auto-update: the workbench checks GitHub Releases once a day (toggleable in
    Settings), and one click downloads, verifies the SHA256, and installs the new MSI — the
    portable build is never auto-installed, so you will not end up with two copies.
  • Single source of truth for the version: the sidebar, /api/health, and the installer metadata
    now always agree.
  • Reproducible release pipeline: one command produces the MSI, the portable ZIP, a machine-readable
    latest.json update manifest, and checksums, with a runnability self-check and WiX ICE validation.
    This release's artifacts were built by CI from the tagged commit.
  • Single-instance guard: launching again focuses the existing window instead of failing with a
    "port already in use" error.

Known limitations

  • Verified on Windows x64 only; Linux and macOS are untested (issues and PRs welcome).
  • The binaries are unsigned: SmartScreen may warn on first launch, and the updater verifies a
    SHA256 from the same channel rather than a cryptographic signature.
  • The built-in embedder is n-gram fuzzy matching, intended for short-text recall; real semantic
    vectors require plugging in a local model (on the roadmap).
  • A skill invocation only records parameters, result, duration, and tokens — the calling agent
    performs the actual work    ; the platform does not execute skills.

License

MIT. The binaries bundle Qt 6.8.3 (LGPLv3, dynamically linked), SQLite (public domain),
sqlite-vec (MIT/Apache-2.0), nlohmann/json (MIT), and cpp-httplib (MIT). The full notices ship in
the install directory under licenses/THIRD-PARTY-NOTICES.md.

中文说明

单体成长，蜂巢共享 · 本地优先的多 Agent 协作中枢：只监听 127.0.0.1，无账号、无云依赖，
数据就是一个 SQLite 文件。只要能发 HTTP 请求就能入巢。

  • 下载哪个：AgentHive-1.0.1-x64.msi 是 per-user 安装包（不需要管理员权限，装到
    %LOCALAPPDATA%\AgentHive，带开始菜单/桌面快捷方式、可正常卸载）；AgentHive-1.0.1-win64-portable.zip
    免安装，解压后运行 agenthive.exe；SHA256SUMS.txt 用于校验。
  • 从 v1.0.0 预发布升级：直接用新 MSI 覆盖安装（或用新 ZIP 替换旧目录）即可。数据都在
    %USERPROFILE%\.agenthive，安装/卸载都不会删除，知识、消息、记忆、密钥全部保留；
    已安装的版本也可以在 设置 → 更新 里自助升级。之前注册过的 Agent 继续可用；
    密钥丢失时到 设置 → Agent → 重新生成密钥 补发。
  • 首次运行：产物未代码签名，Windows 可能提示"未知发布者"（SmartScreen），选"更多信息 → 仍要运行"。
    需要 Windows 10 及以上（x64）；MSVC 运行库已随包分发，无需预装 VC++ Redistributable。
  • 数据位置：%USERPROFILE%\.agenthive，卸载不会删除，重装即恢复全部协作历史。
  • 本版内容：修复保留身份可被注册导致的越权、点对点消息零隔离、广播消息检索不到；请求体上限
    1 MiB、字段类型错误返回 400 信封；界面统一矢量图标与相对时间、面板可滚动、图表悬停显示精确数值；
    版本号单一来源；新增可复现的发行流水线（MSI + 便携包 + latest.json 更新清单 + 校验和，含
    自检与 ICE 校验，本版产物由 CI 从标签对应 commit 构建）；新增「一键接入常用 Agent」向导
    （ZCode、Codex/ChatGPT、Claude Code、Factory Droid、Hermes Agent、Cursor、GitHub Copilot
    七预设，一键签发凭据并生成可粘贴接入块）与 API Key 重新生成（密钥丢失后的唯一恢复途径）；
    修复密钥缓存写失败被静默吞掉的问题（原子写入、缺失记入审计）。
  • 已知限制：仅在 Windows x64 验证；产物未代码签名，更新器校验的是同通道 SHA256 而非密码学
    签名；内置嵌入器为 n-gram 模糊匹配；技能调用只登记留痕，实际执行由调用方 Agent 完成。
  • 许可：MIT；内含 Qt 6.8.3（LGPLv3，动态链接）等第三方组件，声明见安装目录 licenses/。
Assets 6
Loading