kind: context
name: z-ai
version: 1
description: "Z.ai — Anthropic-API-compatible endpoint"
requires: []
provides: [claude-code]

# Auth is wired by init.sh via Claude Code's apiKeyHelper (settings.json).
# No credential env vars: the secret stays in the mounted file and is read
# only by the helper command at request time.
env:
  ANTHROPIC_BASE_URL: "https://api.z.ai/v1"
  CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS: "1"
  CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
  DISABLE_PROMPT_CACHING: "1"

secrets_required:
  - name: z-ai
    account_ref: "z-ai"
    mount_path: /run/agent/secrets/z-ai
    # 0400 (root-only) — defense in depth. The agent user CANNOT read this
    # mount. init.sh runs as root and `install`s a per-secret copy into the
    # agent's home with mode 0600 owned by agent; only that copy is exposed
    # to the runtime. Matches the gitea-ssh pattern. If the ESO Secret
    # later grows additional keys, they remain inaccessible by default.
    mode: "0400"

scripts:
  init: ./init.sh