Shared env values

Save credentials in PassBook so HivemindOS can use them for connected services and approved agent tasks. Values never go into the Obsidian vault or chat. Notes in Operations/Secure/ may list key names and whether they are set, never the values.

Add a credential in HivemindOS

1. Open Brain, choose Settings, then Secrets, and select Set up secure keys. A task that needs a key can also open setup for you.
2. Choose a workspace. On a fresh install, HivemindOS (your existing keys) secures keys you already saved. If you already use PassBook, pick its workspace or Create a HivemindOS workspace to keep these keys separate.
3. Enter your PassBook password, or create one for a new vault. Keep it safe; you need it to unlock and recover.
4. Review Keep approved tasks running in the background, then choose Connect PassBook. Connecting authorizes HivemindOS and its services. Agents still need their own permission.
5. Under Workspace keys, choose Add key, enter the name and value, confirm your password, and choose Save key. Saving does not give any agent access. Replace key asks you to confirm.

In the desktop app or a local browser you can instead choose Authorize in PassBook app, then Prepare app authorization and Open PassBook to authorize. Check that the code matches in both windows before approving. Your password stays in PassBook. If the app cannot open, use the password form.

Approve an agent’s work

Key requests appear under Needs your approval in the Inbox. Check the agent, workspace, device, keys, operation, destination, and expiry, then choose Review access.

• For this task is the default. Once allows a single use.
• Remember for … and this key keeps permission for that agent and those keys. It starts unchecked.
• More access options → Allow this agent to use all keys in this workspace includes future keys. It starts unchecked. Other agents and workspaces are never included.

Confirm with your PassBook password or an enrolled passkey. If a key is missing, Add key and review opens a secure input, and Save key and allow saves and approves in one step without the value touching chat.

The task then resumes. Denied, expired, or cancelled requests grant nothing. Closing the popup or marking the notification read does not approve it.

Understand a key’s state

A key whose value is hidden may still work through an approved operation. If setup offers Finish PassBook update, run it and retry.

Keep approved tasks running

Background access lets this device use already approved keys while you are away. It needs secure storage and working background startup on the device. A connection warning means startup needs attention.

Open Review connection to Pause background access, check Agent permissions, or Revoke access. Disconnect this application stops new access from this install and leaves your keys in PassBook. None of these can undo an operation that already ran.

Use keys on another machine

1. On the receiving device, choose Use keys from another machine.
2. Pick a linked source machine and the destination workspace, then choose Review keys.
3. Select the keys and confirm both PassBook passwords.
4. Confirm Connect HivemindOS to this workspace and receive these keys, then choose Connect and receive keys.

Values move encrypted, never through chat. Keep these keys updated from this machine is on by default and covers only the keys you picked. If this device has lost the profile needed to open its keys, setup asks for every listed recovery key rather than creating an empty workspace.

Limits on ongoing updates:

• Updates flow one way from the source, about every 10 minutes while both devices are available.
• Permission lasts 30 days. Connected key sources shows its expiry; use Review connection to renew or Stop updates to end it.
• Usable local keys and later local edits are kept, not overwritten.
• Removing a key at the source, stopping updates, expiry, or disconnecting leaves received keys in place. Remove unwanted copies in PassBook.
• Receiving a key does not let an agent use it. That is a separate approval.

What stays in your control

• Managed agents use keys through credential tools for approved HTTPS operations. They never get the secret as a shell variable.
• Supported HivemindOS launches of Hermes and JCode can use a selected catalog model without inheriting its provider key. Other runtimes follow their own setup.
• Managed workspaces refuse plaintext exports and commands that would hand keys to an agent process. Don’t work around a refusal by copying keys into files.
• These controls govern supported operations. They do not isolate unrestricted code running under your operating-system account.

hive-env-add OPENAI_API_KEY
hive-env-check OPENAI_API_KEY
hive-env-remove OPENAI_API_KEY
hive-env-delete OPENAI_API_KEY
hive-env-run -- pnpm dev