Module m4a_accounts 

Per-session m4a accounts assigned by the node at spawn (owner model: session = nick = one key = one role). When HATCHERY_M4A_AGENT_BIN and HATCHERY_M4A_ACCOUNTS_ROOT are set, every PTY spawn gets its own account: the node runs m4a-agent account provision (registry and vaults stay under the node’s accounts root, outside the session sandbox), reads the fresh capability from a one-shot 0600 file it removes at once, and injects ONLY M4A_NICK and M4A_SESSION_CAP into that session’s child environment. The capability is never logged.

Structs

M4aSessionAccounts

SessionAccount

One session’s account as handed to its child: nick and capability only.

Constants

ACCOUNTS_ROOT_ENV

AGENT_BIN_ENV

Functions

m4a_provider

g4a provider id -> the provider name m4a-agent accepts. g4a’s built-in catalog is claude, codex, grok, kimi; anything else (custom agents) gets no account.