vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

feat(#493): api-key backend support (useApiKey + backendEnvironmentFile)

Browse source
This commit is contained in:
damocles 2026-08-26 22:22:47 +02:00 • committed by mara
commit 535ba0c11c
6 changed files with 197 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

43
hive-c0re/src/container_view.rs
View file

@ -130,9 +130,23 @@ pub async fn build_all(hive: &crate::coordinator::HiveEnv) -> Vec<ContainerView>
// (boot-time / fresh container) OR the harness wrote the auth-failed
// sentinel because a turn hit 401. Cleared for stopped containers —
// stale sentinel state is not meaningful when the harness isn't up.
//
// The first half doesn't apply to an api-key agent
// (`hyperhive.useApiKey`, stamped as `api_key_mode` in the
// consolidated state file by `hive_agent::harness_state::write_api_key_mode`):
// its `~/.claude/` is empty by design (no OAuth flow to complete),
// so an empty dir there means nothing — only the auth-failed
// sentinel (a real 401, meaning the configured key itself is bad)
// still counts.
//
// One `read_harness_flags` call for both fields, not a wrapper per
// field: this is the only call site that needs more than one, and
// a wrapper each would read the file twice per agent per sweep for
// no reason.
let (_, needs_login_sentinel, is_api_key) = read_harness_flags(&logical);
let needs_login = running
&& (!claude_has_session(&Coordinator::agent_claude_dir(&logical))
|| auth_failed_sentinel(&logical));
&& ((!is_api_key && !claude_has_session(&Coordinator::agent_claude_dir(&logical)))
|| needs_login_sentinel);
// Read the active model from the harness state file. Only surfaced
// when the container is running — stale model info from a stopped
// agent is misleading (the model may change on next boot).
@ -180,11 +194,14 @@ pub fn claude_has_session(dir: &Path) -> bool {
.any(|e| e.file_type().is_ok_and(|t| t.is_file()))
}
/// Read `rate_limited` + `needs_login` (auth-failed sentinel) from
/// the consolidated `hyperhive-harness.json`. Falls back to the legacy
/// individual sentinel files written by older harness builds so in-place
/// upgrades don't lose state during the transition window.
fn read_harness_flags(name: &hive_types::Ident) -> (bool, bool) {
/// Read `rate_limited` + `needs_login` (auth-failed sentinel) +
/// `api_key_mode` from the consolidated `hyperhive-harness.json`. Falls
/// back to the legacy individual sentinel files written by older harness
/// builds so in-place upgrades don't lose state during the transition
/// window — `api_key_mode` has no legacy equivalent (it postdates the
/// consolidated file), so that fallback just says `false`, the correct
/// answer for any harness build old enough to have never written it.
fn read_harness_flags(name: &hive_types::Ident) -> (bool, bool, bool) {
let dir = Coordinator::agent_notes_dir(name);
if let Ok(raw) = std::fs::read_to_string(dir.join("hyperhive-harness.json"))
&& let Ok(v) = serde_json::from_str::<serde_json::Value>(&raw)
@ -197,16 +214,16 @@ fn read_harness_flags(name: &hive_types::Ident) -> (bool, bool) {
.get("needs_login")
.and_then(serde_json::Value::as_bool)
.unwrap_or(false);
return (rl, nl);
let akm = v
.get("api_key_mode")
.and_then(serde_json::Value::as_bool)
.unwrap_or(false);
return (rl, nl, akm);
}
// Legacy fallback: presence of individual sentinel files.
let rate_limited = dir.join("hyperhive-rate-limited").exists();
let needs_login = dir.join("hyperhive-needs-login").exists();
(rate_limited, needs_login)
}
fn auth_failed_sentinel(name: &hive_types::Ident) -> bool {
read_harness_flags(name).1
(rate_limited, needs_login, false)
}
/// Read the agent's free-text status and the Unix timestamp when it was last set