HivemindOS manual

Fleet Machine Permissions

You can add a spare or borrowed computer to your hive as a collector node, without running a second dashboard on it. Your main hub then decides what agents on that machine may use and when Queen Bee may send it work.

Add a collector-only machine

  1. On the extra computer, run setup from the HivemindOS checkout.

    macOS or Linux:

    ./setup.sh --collector-only

    Windows PowerShell:

    powershell -ExecutionPolicy Bypass -File setup.ps1 -CollectorOnly
  2. Setup prints a Tailscale authorization link. Open it on the main HivemindOS hub, or on any device signed into the same Tailscale account as the main hub, and approve the collector.
  3. Return to My Hive on the main hub. The machine appears as a Collector Node once it connects. You don’t need an IP address, port forwarding, or a pasted URL.
  4. Select the machine and open Settings.

Collector-only setup automatically enables Hivemind Link on macOS, Linux, and Windows, unless you choose system Tailscale or local-only mode. It installs Go with the system package manager if needed (winget on Windows).

Collector-only mode sticks through normal updates. To turn the computer into a full hub later, run setup with --full (macOS/Linux) or -Full (Windows).

Set permissions

Each collector has an Allow, Ask, or Deny choice for:

  • Shared Brain
  • Shared env
  • Chat history
  • Apps and services on other machines
  • Messaging channels
  • HiveDrop and fleet file transfers

Shared env starts as Allow, so agents can use your configured credentials without interruptions. Everything else starts as Ask. Chat history set to Ask is still shared with the computer’s master hub, because that hub is the one you would ask, and so with the phone you paired to it. Deny keeps it from everyone. On a borrowed or restricted machine you can set Shared env to Ask or Deny. HivemindOS then stops before starting any runtime that needs a shared credential and tells you the machine policy blocked it.

When an agent hits an Ask capability, its Work board card moves to Needs You with three choices:

  • Allow 15 min grants access that expires automatically.
  • Always allow sets the capability to Allow on that machine.
  • Deny sets it to Deny.

The agent resumes after the collector applies your choice. If the collector can’t be reached, the task waits.

Master hub authority

The first hub to claim a machine in the Authority tab becomes its master hub. Only that hub can change the machine’s policy; other hubs see the settings as read-only. Releasing authority is a separate, confirmed action that keeps existing settings and lets another hub claim the machine.

Performance routing

The Performance tab controls whether Queen Bee may send new work to the machine:

  • Ignore this machine stops all new delegation.
  • Automatic usage limits pause new work when CPU, RAM, or storage use goes above the percentage you set. The machine becomes eligible again once usage drops back under every limit.

These controls affect only new work. They don’t stop an agent or game that is already running.

Change settings on the computer itself

HivemindOS Link has its own Settings screen, so you can adjust a collector node without installing the complete app on it. Open HivemindOS Link on that computer: once it is linked, it opens on Settings.

Link stays in the menu bar after you close its window (the system tray on Windows and Linux). Its menu shows whether the computer is taking new work and has Pause new work, so you can pause or resume without opening anything.

  • Permissions shows the same Allow, Ask, and Deny choices and the wallet choice.
  • Work & limits pauses or resumes new work and sets the usage limits.
  • What it offers lists the computer’s hardware, agent runtimes, and services.

What you can change there depends on which computer is in charge:

  • No computer is in charge yet. Choose Put this computer in charge to decide its settings from Link, or claim it from My Hive on your main hub.
  • This computer is in charge. Everything can be changed from Link. Hand this back lets your main hub take charge; the settings stay as they are.
  • Another hub is in charge. You can pause or resume work and change usage limits at any time. Access and wallets can only get stricter from Link; opening them up happens on the hub in charge.

Security on a borrowed computer

These permissions govern work launched through HivemindOS. The collector withholds denied credentials, limits Shared Brain access, and blocks denied chat history. They are not an operating-system sandbox: they can’t protect against the machine’s administrator or other software already running on it.

On a borrowed computer:

  • Run the collector under a separate operating-system account with access only to the intended project folders.
  • Don’t sync secrets or personal files that machine should never have.
  • Keep it behind Hivemind Link or Tailscale. Never expose its collector port publicly.
Expanded image Scroll to pan · Esc to close
100%