vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

agent-modules: hand an api-key agent's subagent daemon the backend file

Browse source 
A claude agent with useApiKey gets ANTHROPIC_API_KEY through
backendEnvironmentFile, but only the harness unit loaded that file;
hive-subagent-daemon loaded it for ACP agents alone. The daemon's nested
claude inherits the daemon's environment (hive-claude adds to it, never
clears it), and an api-key agent has no OAuth session in ~/.claude, so
its claude subagents started with no credentials.

hive-subagent-daemon now loads backendEnvironmentFile when the agent is
ACP (unchanged) or has useApiKey set. Module-eval covers the api-key
claude arm; the existing claude arm (file set, useApiKey unset) still
asserts no EnvironmentFile.

Closes #5088
This commit is contained in:
atlas 2026-10-10 00:36:47 +02:00 • committed by mara
commit a5448c81c4
4 changed files with 25 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

15
nix/module-eval/agent-runtime.nix
View file

@ -38,6 +38,13 @@ let
claude = agentOn "claude";
acp = agentOn "acp";
claudeApiKey = agentWith {
services.hyperhive.agent = {
runtime = "claude";
useApiKey = true;
backendEnvironmentFile = backendEnv;
};
};
# The opencode preset, with and without a secret store.
opencodeWith =
@ -148,9 +155,15 @@ let
name = "an ACP agent's subagent daemon loads the backend credentials";
ok = (subagent acp).serviceConfig.EnvironmentFile or null == "-${backendEnv}";
}
{
# The nested `claude` inherits the daemon's environment, so this file
# is where its `ANTHROPIC_API_KEY` comes from.
name = "an api-key claude agent's subagent daemon loads the backend credentials";
ok = (subagent claudeApiKey).serviceConfig.EnvironmentFile or null == "-${backendEnv}";
}
{
# Unset is what `RuntimeSpec` reads as claude, and a claude subagent
# is not handed the backend file.
# of an agent without `useApiKey` is not handed the backend file.
name = "a claude agent's subagent daemon has no runtime selection and no backend file";
ok =
lib.all (var: (subagent claude).environment.${var} or null == null) runtimeVars