🛸 Sync 2026-10-27 02:27:08

kai/files/kai-session-launch

@@ -7,4 +7,7 @@ if [ "$#" -ne 1 ] || [ -z "$1" ]; then
 fi
 
 cd "$1"
+OPENCODE_PASSWORD="$(cat "${KAI_ENGINE_PASSWORD_FILE:?missing KAI engine credential file}")"
+[ -n "$OPENCODE_PASSWORD" ] || exit 1
+export OPENCODE_PASSWORD
 exec /usr/sbin/kai_session serve --port 8196 --hostname 127.0.0.1

kai/files/kai.init

@@ -12,7 +12,9 @@ get_config() {
 
 start_kai_bin(){
 	procd_open_instance kai_bin
-	procd_set_param env KAI_AUTH_MODE="$auth_mode"
+	procd_set_param env KAI_AUTH_MODE="$auth_mode" \
+		KAI_ENGINE_API=v2 KAI_ENGINE_PASSWORD_FILE=/var/run/kai/engine-password \
+		XDG_CONFIG_HOME="${data_dir}/config" XDG_DATA_HOME="${data_dir}/data"
 	procd_set_param command /usr/sbin/kai_bin -a 0.0.0.0 -p "$port"
 	procd_set_param stderr 1
 	procd_set_param respawn 3600 5 5
@@ -31,6 +33,8 @@ start_kai_session(){
 		return 1
 	fi
 	procd_set_param env \
+		KAI_ENGINE_API=v2 \
+		KAI_ENGINE_PASSWORD_FILE=/var/run/kai/engine-password \
 		OPENCODE_CONFIG="${agent_root}/opencode.json" \
 		KAIPLUS_SKILLS_DIR="${agent_root}/skills" \
 		ISTORE_AI_HELPER_BASE="http://127.0.0.1:${port}" \
@@ -61,6 +65,16 @@ start_service() {
 	mkdir_cwd "${data_dir}/data"
 	mkdir_cwd "${data_dir}/config"
 	mkdir_cwd "${data_dir}/state"
+	# Both processes read a private credential. Never put it in procd's JSON
+	# service definition or send it to the browser.
+	(umask 077
+		mkdir -p /var/run/kai
+		chmod 700 /var/run/kai
+		if [ ! -s /var/run/kai/engine-password ]; then
+			head -c 32 /dev/urandom | hexdump -v -e '1/1 "%02x"' > /var/run/kai/engine-password
+		fi
+		chmod 600 /var/run/kai/engine-password
+	) || return 1
 	start_kai_session || return 1
 	start_kai_bin
 	logger -t kai "Starting KAI Service Completed"