vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

agent-modules: hand an api-key agent's subagent daemon the backend file

Browse source 
A claude agent with useApiKey gets ANTHROPIC_API_KEY through
backendEnvironmentFile, but only the harness unit loaded that file;
hive-subagent-daemon loaded it for ACP agents alone. The daemon's nested
claude inherits the daemon's environment (hive-claude adds to it, never
clears it), and an api-key agent has no OAuth session in ~/.claude, so
its claude subagents started with no credentials.

hive-subagent-daemon now loads backendEnvironmentFile when the agent is
ACP (unchanged) or has useApiKey set. Module-eval covers the api-key
claude arm; the existing claude arm (file set, useApiKey unset) still
asserts no EnvironmentFile.

Closes #5088
This commit is contained in:
atlas 2026-10-10 00:36:47 +02:00 • committed by mara
commit a5448c81c4
4 changed files with 25 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

9
nix/agent-modules/mcp.nix
View file

@ -494,13 +494,14 @@ in
//
lib.optionalAttrs
(
config.services.hyperhive.agent.runtime == "acp"
(config.services.hyperhive.agent.runtime == "acp" || config.services.hyperhive.agent.useApiKey)
&& config.services.hyperhive.agent.backendEnvironmentFile != null
)
{
# An ACP subagent authenticates to its provider with the same
# credentials as the harness's ACP agent. Claude subagents are
# not handed this file.
# A subagent authenticates with the same credentials as the
# harness: an ACP subagent to its provider, a claude subagent of
# an api-key agent with `ANTHROPIC_API_KEY`, as it has no OAuth
# session to fall back on.
EnvironmentFile = "-${config.services.hyperhive.agent.backendEnvironmentFile}";
};
};