config: make skills_dir and agent_auth_path implicit under the state root #93

Closed

weiwen wants to merge 4 commits from fm/skills-auth-implicit into main

weiwen commented

2026-08-12 22:19:11 +08:00

Owner

pi.skills_dir and pi.agent_auth_path were configurable paths that every real deployment pointed back into the state root anyway. They are now derived - <state_dir>/skills and <state_dir>/auth.json - via Config::skills_dir()/Config::agent_auth_path(), like homes_dir and sessions_dir, so they can no longer disagree with state_dir.

Also adds $HOME/.evie to the state-root fallback chain ahead of the hardcoded /var/lib/evie, so a developer running the daemon by hand without systemd and without $XDG_STATE_HOME lands somewhere writable:

explicit -> $STATE_DIRECTORY -> $XDG_STATE_HOME/evie -> $HOME/.evie -> /var/lib/evie

Deploy-affecting: the provider credential is read at <state_dir>/auth.json now, so deploy/docker/docker-compose.yaml moves its bind target from /var/lib/evie/agent-auth.json to /var/lib/evie/auth.json (host-side secrets/agent-auth.json filename unchanged). An existing deployment that set agent_auth_path must rename the file in its state volume; a stale agent_auth_path/skills_dir left in config.toml is now an unknown key.

cargo check and cargo test (487 passed) both clean.

`pi.skills_dir` and `pi.agent_auth_path` were configurable paths that every real deployment pointed back into the state root anyway. They are now derived - `<state_dir>/skills` and `<state_dir>/auth.json` - via `Config::skills_dir()`/`Config::agent_auth_path()`, like `homes_dir` and `sessions_dir`, so they can no longer disagree with `state_dir`. Also adds `$HOME/.evie` to the state-root fallback chain ahead of the hardcoded `/var/lib/evie`, so a developer running the daemon by hand without systemd and without $XDG_STATE_HOME lands somewhere writable: `explicit -> $STATE_DIRECTORY -> $XDG_STATE_HOME/evie -> $HOME/.evie -> /var/lib/evie` **Deploy-affecting:** the provider credential is read at `<state_dir>/auth.json` now, so `deploy/docker/docker-compose.yaml` moves its bind target from `/var/lib/evie/agent-auth.json` to `/var/lib/evie/auth.json` (host-side `secrets/agent-auth.json` filename unchanged). An existing deployment that set `agent_auth_path` must rename the file in its state volume; a stale `agent_auth_path`/`skills_dir` left in config.toml is now an unknown key. `cargo check` and `cargo test` (487 passed) both clean.

weiwen added 4 commits

2026-08-12 22:19:11 +08:00

build: migrate from rustPlatform.buildRustPackage to crane for incremental nix builds 255d67b2f4

Replace the full-rebuild rustPlatform.buildRustPackage with crane's
two-stage approach: buildDepsOnly caches crate dependencies by
Cargo.lock hash, buildPackage reuses them and only recompiles
changed source files. A source-only change now rebuilds as fast as
cargo build inside a dev shell.

- Add crane input (github:ipetkov/crane)
- Swap rustPlatform for craneLib = (crane.mkLib pkgs).overrideToolchain
- commonArgs shared between buildDepsOnly and buildPackage
- cargoArtifacts (deps only, doCheck=false)
- evie (full build with postInstall wrapper + skills)
- Source filter preserves .md files (needed by include_str! for SYSTEM_PROMPT.md)
- Verified: first build 2m15s deps+evie, incremental build 33s (only evie crate)
- All 487 tests pass

config: derive skills_dir and agent_auth_path from the state root f6540c5d45

Both were configurable paths that every real deployment pointed back into the
state root anyway, so they are now derived like homes/ and sessions/ rather
than being two more knobs that can disagree with state_dir.

Also add $HOME/.evie to the state-root fallback chain, ahead of the hardcoded
/var/lib/evie, so a developer running the daemon by hand without systemd and
without $XDG_STATE_HOME lands somewhere writable.

main: pass the derived skills and agent-auth paths to the session manager 71a553bcb0

docs+deploy: document skills and provider credential as state-root-derived

CI / check (pull_request) Failing after 2m10s

Details

CI / publish (pull_request) Has been skipped

Details

PR Triage — label changes-requested reviews / triage-review (pull_request) Successful in 1s

Details

74cc564eb2

The docker compose bind target moves with the code: the credential is read at
<state_dir>/auth.json now, so the sample deploy would otherwise mount it at a
path nothing reads. The host-side secrets/agent-auth.json filename is
unchanged.

weiwen closed this pull request

2026-08-12 23:33:54 +08:00

weiwen commented

2026-08-12 23:34:02 +08:00

Author

Owner

Superceded by #94