feat(provision): propagate workspace model into runtime env (MVP hermes MiniMax flow) - #1685
Merged
Merged
Conversation
Tenant's workspace provisioner now forwards payload.Model (set by
canvas Config tab when a user picks a model) through to the
workspace's runtime env as HERMES_DEFAULT_MODEL, so install.sh /
start.sh in the template can seed the right ~/.hermes/config.yaml
without any post-provision manual step.
Helper applyRuntimeModelEnv() is runtime-switched so each template
owns its own env contract — hermes uses HERMES_DEFAULT_MODEL, future
runtimes with different config schemas register their own cases.
Runtimes that read model from /configs/config.yaml instead (langgraph,
claude-code, deepagents) are unaffected: the switch has no case for
them, so this is a no-op in those paths.
Applied in both the Docker provisioner path (provisionWorkspaceOpts)
and the SaaS/CP path (provisionWorkspaceCP) so local dev and
production behave identically.
Combined with:
- molecule-controlplane#231 (/opt/adapter/install.sh hook)
- molecule-ai-workspace-template-hermes#8 (install.sh for bare-host)
- molecule-ai-workspace-template-hermes#9 (derive-provider.sh)
this completes the MVP flow: customer creates a hermes workspace
in canvas with model = minimax/MiniMax-M2.7-highspeed + secret
MINIMAX_API_KEY = sk-cp-…, clicks Save, workspace provisions with
the MiniMax Token Plan hermes-agent gateway up and ready for the
first chat — no ops touch.
Foundation this builds on:
- env injection works for every runtime
- secret passthrough is generic (already via workspace_secrets)
- per-runtime env-var contract encoded once (applyRuntimeModelEnv)
- canvas Save button for later-edit remains a Files-API-over-EIC
concern (tracked separately)
See internal/product/designs/workspace-backends.md for the broader
architectural direction this fits into.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
HongmingWang-Rabbit
pushed a commit
that referenced
this pull request
Jun 12, 2026
…queue (unblock Reno Stars cron starvation) (#1685)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Customer creates a hermes workspace with `model=minimax/MiniMax-M2.7-highspeed` + secret `MINIMAX_API_KEY=sk-cp-…` in canvas → expects it to just work. Previously the model selection was dropped on the floor: `payload.Model` set the default in the workspace's `/configs/config.yaml` but didn't reach the runtime's installer, so template-hermes's `install.sh` (+ docker `start.sh`) seeded `~/.hermes/config.yaml` with the template default (nousresearch/hermes-4-70b) instead of MiniMax.
Fix
One helper, two call sites, no CP changes required:
`applyRuntimeModelEnv(envVars, runtime, model)` — runtime-switched helper. For hermes, sets `HERMES_DEFAULT_MODEL`. Other runtimes use their own config mechanism; the switch is empty for them.
Called in both:
The existing `envVars` map is already POSTed to CP as `{"env": ...}` and CP already `export`s each entry into workspace-EC2 user-data, so this change is fully contained to the tenant.
Pairs with
With all four merged, the end-to-end chain is:
```
Canvas Config tab (model + secret)
→ tenant workspace create handler
→ envVars populated from secrets + applyRuntimeModelEnv
→ CPProvisioner.Start POSTs to /cp/workspaces/provision
→ CP.ProvisionWorkspace bakes env into user-data
→ workspace EC2 boots, pip-installs, git-clones template
→ install.sh reads HERMES_DEFAULT_MODEL + MINIMAX_API_KEY from env
→ scripts/derive-provider.sh sets PROVIDER=minimax
→ ~/.hermes/config.yaml + .env seeded correctly
→ hermes gateway boots with MiniMax Token Plan as provider
→ molecule-runtime comes online
→ customer chats, MiniMax answers
```
Zero ops touch. Zero canvas-side Save-button dependency.
Design doc
Foundation for the broader WorkspaceBackend architecture tracked in `Molecule-AI/internal/product/designs/workspace-backends.md`. This PR is the last step-1 piece; steps 2-4 (formal interface, declarative manifest, first-new-backend) remain as follow-ups.
Test plan
🤖 Generated with Claude Code