vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

matrix: the agent's daemon pulls its linked accounts from bao itself

Browse source 
hive-matrix-daemon now learns which external matrix accounts it has from
the swarm secret store, under the agent's own certificate, and the hive
push chain for matrix is gone.

The daemon lists swarm/agents/<agent>/matrix/ (the `list` its policy
grants on its own metadata subtree), reads each account's homeserver
from its credential, and brings the accounts up with their tokens from
the store. Every two minutes it lists again and exits with 75 when the
set of linked accounts changed; the unit restarts on 75 without counting
a failure. A listed name whose credential reads as absent is skipped and
logged once. At start it removes the matrix-token-<a> /
matrix-account-<a>.json pairs a hive delivered (a sidecar marks a pair
as delivered; a declared tokenFile keeps its token).

Removed: CredentialNotice and the $SWARM.credential.* subject and NATS
grant, the controller's publish and its queue precondition on the PUT
route, hive-c0re's credential subscription arm and workers/credential.rs,
priv_client::write_agent_matrix_token, hive-priv's WriteAgentMatrixToken
and its helpers, and the daemon's state-dir account discovery.

Kept: WriteAgentGithubToken and the external-forge path
(WriteAgentExtraForgeAccount, extra_forges.rs) are untouched, and a
declared matrixAccounts tokenFile is still read when the store has no
token for that account.

Refs #4348
This commit is contained in:
atlas 2026-10-01 17:41:20 +02:00
commit 97fb76ce99
22 changed files with 553 additions and 813 deletions
Download patch file Download diff file Expand all files Collapse all files

10
frontend/packages/swarm-ui/src/pages/LinkMatrixAccountForm.tsx
View file

@ -6,9 +6,9 @@
// (required, here) homeserver itself and stores the token
// that comes back. The password is sent once, over this
// PUT, straight to swarm-controller — never held here past
// the request, never sent to the hive.
// the request, never stored.
// PUTs `/api/hives/{hive}/agents/{agent}/matrix-accounts/{account}` —
// 200 (`{ user_id? }`) on success, 400/503/500 on the documented failure
// 200 (`{ user_id? }`) on success, 400/500 on the documented failure
// arms — all handled generically via `readApiError`/`ApiErrorPanel`,
// same as every other form here, since the response is `problem+json`
// regardless of which arm fired.
@ -138,9 +138,9 @@ export function LinkMatrixAccountForm({
onClose={onClose}
>
<p>
Writes the credential to the swarm secret store and notifies{" "}
<strong>{hive}</strong> to deliver it. The agent's own matrix daemon
picks it up next — nothing here restarts anything directly.
Writes the credential to the swarm secret store. The agent's own matrix
daemon reads it from there within two minutes — nothing here restarts
anything directly.
</p>
<form class="link-matrix-account-form" onSubmit={submit}>
<TextField