molecule-core/workspace-server/internal
Hongming Wang 7e3cd043c8 feat(provision): propagate workspace model into runtime env
Tenant's workspace provisioner now forwards payload.Model (set by
canvas Config tab when a user picks a model) through to the
workspace's runtime env as HERMES_DEFAULT_MODEL, so install.sh /
start.sh in the template can seed the right ~/.hermes/config.yaml
without any post-provision manual step.

Helper applyRuntimeModelEnv() is runtime-switched so each template
owns its own env contract — hermes uses HERMES_DEFAULT_MODEL, future
runtimes with different config schemas register their own cases.
Runtimes that read model from /configs/config.yaml instead (langgraph,
claude-code, deepagents) are unaffected: the switch has no case for
them, so this is a no-op in those paths.

Applied in both the Docker provisioner path (provisionWorkspaceOpts)
and the SaaS/CP path (provisionWorkspaceCP) so local dev and
production behave identically.

Combined with:
  - molecule-controlplane#231 (/opt/adapter/install.sh hook)
  - molecule-ai-workspace-template-hermes#8 (install.sh for bare-host)
  - molecule-ai-workspace-template-hermes#9 (derive-provider.sh)

this completes the MVP flow: customer creates a hermes workspace
in canvas with model = minimax/MiniMax-M2.7-highspeed + secret
MINIMAX_API_KEY = sk-cp-…, clicks Save, workspace provisions with
the MiniMax Token Plan hermes-agent gateway up and ready for the
first chat — no ops touch.

Foundation this builds on:
  - env injection works for every runtime
  - secret passthrough is generic (already via workspace_secrets)
  - per-runtime env-var contract encoded once (applyRuntimeModelEnv)
  - canvas Save button for later-edit remains a Files-API-over-EIC
    concern (tracked separately)

See internal/product/designs/workspace-backends.md for the broader
architectural direction this fits into.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-22 16:17:08 -07:00
..
artifacts fix(tenant-guard): allowlist /registry/register + /registry/heartbeat (#1236) 2026-04-21 02:47:27 +00:00
bundle fix(platform): unblock SaaS workspace registration end-to-end 2026-04-21 03:06:46 -07:00
channels fix(errcheck): suppress unchecked resp.Body.Close() across workspace-server (#1229) 2026-04-21 02:45:34 +00:00
crypto
db test: schema_migrations tracking — 4 cases (first boot, re-boot, mixed, down.sql filter) 2026-04-18 11:52:27 -07:00
envx
events
handlers feat(provision): propagate workspace model into runtime env 2026-04-22 16:17:08 -07:00
metrics
middleware fix(restart): support SaaS control-plane provisioner (unblocks Platform Go build too) (#1512) 2026-04-21 22:56:01 +00:00
models fix: CWE-78 rm scope, go vet failures, delegation idempotency 2026-04-21 18:22:30 +00:00
orgtoken fix: CWE-78 rm scope, go vet failures, delegation idempotency 2026-04-21 18:22:30 +00:00
plugins
provisioner feat(provisioner): pull workspace-template images from GHCR 2026-04-22 12:39:56 -07:00
registry fix(sweeper): emit WORKSPACE_PROVISION_FAILED so canvas updates UI 2026-04-20 20:38:41 -07:00
router Merge remote-tracking branch 'origin/staging' into feat/bootstrap-failed-and-console-proxy 2026-04-20 17:31:16 -07:00
scheduler fix: CWE-78 rm scope, go vet failures, delegation idempotency 2026-04-21 18:22:30 +00:00
supervised
ws
wsauth