c5b21403a6
An opencode ACP agent got its provider API key only from the hand-placed backendEnvironmentFile. It now also reads it from the swarm secret store at swarm/agents/<agent>/acp-provider, field api_key, under its own certificate, and sets it in the spawned ACP agent's environment only. Nothing is written to disk. Precedence: a value already in the process environment (the env file) wins and the store is not asked. Otherwise the stored key is used when present. With no store, nothing stored, or a failed read, the agent is spawned without the key as before, and one line is logged without the value. The variable name comes from the existing per-agent option acp.opencode.provider.apiKeyEnv, exported as HIVE_ACP_API_KEY_ENV on the harness only for the opencode preset. Other ACP commands are unchanged. The read lives in hive-runtime, where the ACP child is spawned, so both hive-agent and hive-subagent-daemon use it. The subagent daemon unit gets the key name and, when the agent has a store, the agent's store identity (the same credentials queue-identity.nix gives the harness). No new option or setting. Closes #4841.
22 lines
468 B
TOML
22 lines
468 B
TOML
[package]
|
|
name = "hive-runtime"
|
|
edition.workspace = true
|
|
version.workspace = true
|
|
readme = "README.md"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
hive-claude.workspace = true
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
# The ACP agent's provider key, read under the agent's own certificate
|
|
# (`acp::provider_key`).
|
|
swarm-secret-client.workspace = true
|
|
thiserror.workspace = true
|
|
tokio.workspace = true
|
|
tracing.workspace = true
|
|
|
|
[dev-dependencies]
|
|
tempfile = "3"
|