vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

agents: login shells read the hive facts too; test the readers

Browse source 
Part of #5081. Follow-up to the review of #5131.

- Before this PR, claude read CLAUDE_REMOTE_CONTROL_SESSION_NAME_PREFIX
  from managed-settings.json in every context. The environment generator
  reaches every unit of the container's manager, including `machinectl
  shell` (hivectl choom): machined starts it as a transient
  container-shell@ unit (systemd 260.5 src/machine/machine.c:980-1004),
  and every unit's exec environment starts from the manager environment
  the generators fill (src/core/unit.c:5557, src/core/manager.c:3990-4001).
  Shells no unit starts do not get it: `nixos-container root-login` / `run`
  enter with nsenter + `su -l`, and getty logins go through login(1). So
  hive-facts.nix now also exports the generator's output from
  /etc/set-environment (environment.extraInit).
- The generator's read loop kept a last line only when it ended in a
  newline; it now keeps one without.
- checks.script-test-agent-hive-facts runs the rendered generator and the
  shell snippet (under dash and bash's sh) against sample files: both
  facts, a planted LD_PRELOAD/PATH line, a last line without a newline,
  an empty file and no file.
- identity.rs: hive_name()'s doc names the facts file as the source.
This commit is contained in:
atlas 2026-10-12 05:04:06 +02:00 • committed by mara
commit c8df666bf3
6 changed files with 172 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docs/process/conventions.md
View file

@ -40,10 +40,11 @@ Four env vars cover the identity surface, read by
Inside an agent container, the hive's name and domain don't come from the
agent's build. `hive-priv` writes them to `/etc/hyperhive-hive-facts` before
every container start, and the agent's environment generator
(`nix/agent-modules/hive-facts.nix`) passes them to every unit. Neither is
part of an agent's closure, and an agent started on another hive reports
that hive.
every container start. The agent's environment generator
(`nix/agent-modules/hive-facts.nix`) passes them to every unit, including
`hivectl choom` sessions, and `/etc/set-environment` exports them in login
shells that no unit starts (`nixos-container root-login`). Neither is part of
an agent's closure, and an agent started on another hive reports that hive.
`hive_name` + `swarm_name` are **distinct** from
`HYPERHIVE_HIVE_DOMAIN`: the domain may carry the hive name as