mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-runtime: read the ACP provider key from bao

Browse source 
An opencode ACP agent got its provider API key only from the hand-placed
backendEnvironmentFile. It now also reads it from the swarm secret store
at swarm/agents/<agent>/acp-provider, field api_key, under its own
certificate, and sets it in the spawned ACP agent's environment only.
Nothing is written to disk.

Precedence: a value already in the process environment (the env file)
wins and the store is not asked. Otherwise the stored key is used when
present. With no store, nothing stored, or a failed read, the agent is
spawned without the key as before, and one line is logged without the
value.

The variable name comes from the existing per-agent option
acp.opencode.provider.apiKeyEnv, exported as HIVE_ACP_API_KEY_ENV on the
harness only for the opencode preset. Other ACP commands are unchanged.

The read lives in hive-runtime, where the ACP child is spawned, so both
hive-agent and hive-subagent-daemon use it. The subagent daemon unit
gets the key name and, when the agent has a store, the agent's store
identity (the same credentials queue-identity.nix gives the harness).

No new option or setting. Closes #4841.
This commit is contained in:
atlas 2026-09-30 21:23:05 +02:00 • committed by mara
commit c5b21403a6
1 changed files with 486 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

14
hive-runtime/src/acp/mod.rs
View file

@ -5,6 +5,7 @@
//! reporting no usage fails with [`AcpError::EmptyEndTurn`]. An agent that
//! never reports usage therefore surfaces every such turn as that error.
mod provider_key;
mod rpc;
mod stream;
@ -418,7 +419,17 @@ impl<P: CompactionPolicy> AcpRuntime<P> {
async fn start(&self, config: &Config) -> Result<Live> {
let (_, servers) = mcp_servers(config)?;
let cwd = session_cwd(config);
let conn = Connection::spawn(&self.command, &cwd, self.permit.clone(), servers)?;
let key = match &self.command.api_key_env {
Some(name) => provider_key::resolve(name).await,
None => None,
};
let conn = Connection::spawn(
&self.command,
key.as_ref(),
&cwd,
self.permit.clone(),
servers,
)?;
let init = conn
.request(
"initialize",
@ -1164,6 +1175,7 @@ done
.iter()
.map(|(k, v)| ((*k).to_owned(), (*v).to_owned()))
.collect::<BTreeMap<_, _>>(),
api_key_env: None,
};
AcpRuntime::new(
command,