vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

agents: persistent /agents/<n>/work dir outside state/

Browse source 
Agents keep git worktrees and cargo target dirs under /home/<agent>,
which lives in the container rootfs and is deleted on destroy. They
can't move them under state/, because a claude started there walks up
into state/CLAUDE.md and takes on the agent's identity.

Add a per-agent work/ dir next to state/ on the host
(/var/lib/hyperhive/agents/<n>/work), bind-mounted RW at
/agents/<n>/work. hive-c0re creates it in ensure_state_dir and in
set_nspawn_flags (the rebuild path reaches only the latter), the
agent's activation chowns it to the agent user like state/ and
harness/, and measure_agent_disk counts it. destroy never touches the
agent root, so work/ survives it; purge removes the whole root, so
work/ goes with it.

Closes #4977
This commit is contained in:
atlas 2026-10-05 12:56:02 +02:00
commit 89a5d65119
8 changed files with 123 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

5
nix/agent-modules/user.nix
View file

@ -195,7 +195,7 @@ in
: > "$marker"
fi
fi
# Scope state + harness chowns to THIS container's own dirs only.
# Scope state + harness + work chowns to THIS container's own dirs only.
# The glob `/agents/*/state` also matches other agents' state dirs
# bind-mounted into a `ManageRootAgent` holder's container, which
# would clobber the ownership those dirs' own activation scripts set
@ -209,6 +209,9 @@ in
if [ -d "/agents/$userName/harness" ]; then
chown -hR "$userName:$userName" "/agents/$userName/harness" 2>/dev/null || true
fi
if [ -d "/agents/$userName/work" ]; then
chown -hR "$userName:$userName" "/agents/$userName/work" 2>/dev/null || true
fi
# The socket dir is bind-mounted from the host, where hive-priv creates
# it `0751 root`. The harness binds its sockets here as this user; the
# 0751 is what lets hive-c0re and nginx dial them without listing

6
nix/module-eval/agent-user.nix
View file

@ -26,6 +26,12 @@ let
(agentWith { services.hyperhive.agent.user.name = "iris"; })
.system.activationScripts.hive-agent-user-migrate.text;
cases = [
{
# hive-c0re creates the host work dir as hive-core; this activation is
# the only thing that lets the agent write to it.
name = "the agent's activation hands its own work dir to the agent user";
ok = lib.hasInfix ''chown -hR "$userName:$userName" "/agents/$userName/work"'' migrate;
}
{
# hive-priv creates the host socket dir `0751 root` and never chowns it,
# so this activation is the only thing that lets the harness bind there.