From bed2eba52afeb044f904b91ef3b3ef653a02d961 Mon Sep 17 00:00:00 2001 From: lexis Date: Sat, 30 May 2026 23:29:33 +0200 Subject: [PATCH] docs: add hyperhive.user.name + passwordlessSudo to agent configuration (follow-up to #664) --- README.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/README.md b/README.md index 6650dd2d..017b7bf3 100644 --- a/README.md +++ b/README.md @@ -178,6 +178,14 @@ the container as environment variables. Common options: `/matrix-token` is absent (i.e., the host-level `hyperhive.matrix` tuwunel container hasn't provisioned the account yet). Set to `false` to opt a specific agent out of matrix. +- **`hyperhive.user.name`** — Unix username the agent runs as inside + the container (default: the agent's own label, injected by the + meta-flake). Agents no longer run as root. Stand-alone module eval + without the meta-flake falls back to `"agent"`. +- **`hyperhive.user.passwordlessSudo`** — Boolean (default `true`). + Grants the agent user `NOPASSWD: ALL` sudo so claude's `Bash` tool + can still escalate when needed — same surface as the old root-user + shape, just explicit. Set `false` for strictly unprivileged agents. See `nix/templates/harness-base.nix` for the full list of options and their descriptions.