fix(minimax,z-ai): stage api_key as root, restore mount mode 0400

Mirrors agent-runtimes commit 6f20b51. CRS serves these harness files to
dispatchers, so this repo must match.

Switches from "mount mode 0444 so the agent user can `cat` the ESO file"
to the gitea-ssh staging pattern: keep the ESO mount root-only (0400),
init.sh as root `install`s a per-secret 0600 agent-owned copy, and
apiKeyHelper points at the staged copy. Stronger blast-radius guarantee
— if the ESO Secret later grows additional keys, they remain root-only
unless the harness explicitly stages them.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

harnesses/contexts/minimax/v1/init.sh

@@ -1,43 +1,50 @@
 #!/bin/bash
-# minimax init — write ~/.claude/settings.json with apiKeyHelper.
+# minimax init — stage the api_key for the agent user and wire apiKeyHelper.
 #
-# The MiniMax API key is mounted by ESO at /run/agent/secrets/minimax/api_key
-# (mode 0400, secrets_required entry in harness.yaml). Claude Code's
-# `apiKeyHelper` setting names a command that prints the key on stdout when
-# the CLI needs it for an API request — the value never enters this process'
-# environment, never appears in /proc/<pid>/environ of the claude subprocess,
-# and is read fresh on each invocation so ESO secret rotations are picked up
-# without a process restart.
+# Threat model: keep the ESO mount root-only (mode 0400) so the agent user
+# cannot directly `cat` /run/agent/secrets/minimax/api_key. init.sh runs as
+# root (in uid-wrapper.sh, before the gosu drop) and stages a per-secret
+# copy into the agent's home with mode 0600 owned by agent. apiKeyHelper
+# points at the COPY. This is the gitea-ssh pattern — only the file the
+# harness explicitly grants is reachable by the runtime.
 #
-# Why settings.json (not --settings inline or env vars):
-#  - ANTHROPIC_AUTH_TOKEN / ANTHROPIC_API_KEY in env exposes the secret in
-#    /proc/<pid>/environ, log aggregators, ps. The H-SECRET-4 rule disallows
-#    credential-shaped env vars for that reason.
-#  - --settings on the runner CLI line couples the runner to the harness
-#    layout. Per-harness settings.json keeps auth a harness concern.
-#  - The helper command (`cat <file>`) re-reads on each call, so secret
-#    rotation propagates without rewriting the config file.
+# Rotation handling: this is a one-shot copy at container start. For
+# ephemeral container agents (one task = one container) every task starts
+# with the latest secret. Long-running sessions don't refresh the copy
+# until a future scripts.control_loop hook lands (planning E1-M3).
+#
+# Auth wire-up: apiKeyHelper output is sent as `Authorization: Bearer
+# <value>` when ANTHROPIC_BASE_URL is non-anthropic.com — exactly what
+# api.minimax.io/anthropic requires. The secret value never enters this
+# process' env, the claude subprocess' env, or /proc/<pid>/environ.
 
 set -euo pipefail
 
-API_KEY_FILE="/run/agent/secrets/minimax/api_key"
+ESO_API_KEY="/run/agent/secrets/minimax/api_key"
 
-if [ ! -r "$API_KEY_FILE" ]; then
-    echo "ERROR: $API_KEY_FILE not readable. Check ESO ExternalSecret acct-<minimax-id>." >&2
+if [ ! -r "$ESO_API_KEY" ]; then
+    echo "ERROR: $ESO_API_KEY not readable. Check ESO ExternalSecret acct-<minimax-id>." >&2
     exit 1
 fi
 
-# init.sh runs as root in uid-wrapper.sh BEFORE gosu drops privileges to the
-# agent user — so $HOME here is /root, not the agent home. Claude Code will
-# run as the agent user and read its config from $AGENT_HOME/.claude. Resolve
-# the agent home explicitly so settings.json lands where claude looks.
+# Resolve the agent user's home (init.sh's $HOME is /root before gosu drop).
 AGENT_USER="${AGENT_USER:-agent}"
 AGENT_HOME=$(getent passwd "$AGENT_USER" | cut -d: -f6)
 if [ -z "$AGENT_HOME" ] || [ ! -d "$AGENT_HOME" ]; then
     AGENT_HOME="/home/$AGENT_USER"
 fi
 
-# CLAUDE_CONFIG_DIR overrides ~/.claude when set.
+# Stage the api_key into a per-secret path owned by agent, mode 0600.
+# install(1) handles ownership/mode atomically; the destination is outside
+# the read-only ESO mount so we can chmod/chown freely.
+STAGED_KEY_DIR="$AGENT_HOME/.claude/secrets"
+STAGED_KEY="$STAGED_KEY_DIR/minimax-api-key"
+mkdir -p "$STAGED_KEY_DIR"
+chown "$AGENT_USER:" "$STAGED_KEY_DIR" 2>/dev/null || true
+chmod 0700 "$STAGED_KEY_DIR"
+install -m 0600 -o "$AGENT_USER" -g "$AGENT_USER" "$ESO_API_KEY" "$STAGED_KEY"
+
+# Wire apiKeyHelper to the staged copy in the agent's settings.json.
 CONFIG_DIR="${CLAUDE_CONFIG_DIR:-$AGENT_HOME/.claude}"
 mkdir -p "$CONFIG_DIR"
 chown "$AGENT_USER:" "$CONFIG_DIR" 2>/dev/null || true
@@ -45,25 +52,25 @@ chmod 0755 "$CONFIG_DIR"
 
 SETTINGS_FILE="$CONFIG_DIR/settings.json"
 
-# If a settings.json already exists from another harness layer, merge
-# apiKeyHelper into it; otherwise create a minimal file. jq is in the base
-# image; fall back to a clean overwrite if it isn't available for any reason.
+# Merge into an existing settings.json (from another harness layer) when
+# possible; otherwise create a fresh one.
 if [ -f "$SETTINGS_FILE" ] && command -v jq >/dev/null 2>&1; then
     TMP=$(mktemp)
-    jq --arg helper "cat $API_KEY_FILE" \
+    jq --arg helper "cat $STAGED_KEY" \
        '. + {apiKeyHelper: $helper}' \
        "$SETTINGS_FILE" > "$TMP"
     mv "$TMP" "$SETTINGS_FILE"
 else
     cat > "$SETTINGS_FILE" <<EOF
 {
-  "apiKeyHelper": "cat $API_KEY_FILE"
+  "apiKeyHelper": "cat $STAGED_KEY"
 }
 EOF
 fi
 
-# settings.json holds the helper command (a path), not a credential value.
-# It must be readable by the agent user that runs claude.
+# settings.json holds a command (a path), not a credential value.
 chown "$AGENT_USER:" "$SETTINGS_FILE" 2>/dev/null || true
 chmod 0644 "$SETTINGS_FILE"
-echo "minimax api_key wired via apiKeyHelper at $SETTINGS_FILE (agent_user=$AGENT_USER)"
+
+echo "minimax api_key staged at $STAGED_KEY (0600 $AGENT_USER:$AGENT_USER)"
+echo "minimax apiKeyHelper wired in $SETTINGS_FILE"