5f85d895c1
The CRS-served harnesses still carried `secrets_files: [{encrypted: true}]`
which now hard-fails on H-SECRET-1 ("SOPS-encrypted secrets_files entries
are no longer permitted") in the dispatcher's harness validator. Sync the
8 provider harnesses with the agent-runtimes copies: same `secrets_required`
shape, same `init.sh` (ESO-mounted file paths), same `bin/` wrappers.
Use bare `account_ref: "<provider>"` (not `<provider>.cp:cp` — that
scope-kind isn't valid per SR-DISP-1-FIELD).
Provider key names follow the per-provider schema as emitted by the CP
provisioner: minimax/airouter/z-ai → api_key; gitea-https/gitea-admin →
{token,base_url,username}; gitea-ssh* → {host,private_key}.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
30 lines
1.0 KiB
Bash
Executable File
30 lines
1.0 KiB
Bash
Executable File
#!/bin/bash
|
|
# airouter init — Phase 9 ESO-managed secret mount.
|
|
#
|
|
# Verifies the ESO-mounted secret files exist; the wrapper
|
|
# (`bin/anthropic-compat-wrapper.sh`) reads them at exec time.
|
|
#
|
|
# Per H-SECRET-4: NO `export` of credentials here. The earlier draft of this
|
|
# file exported ANTHROPIC_AUTH_TOKEN and ANTHROPIC_BASE_URL from this script,
|
|
# which runs as root under uid-wrapper.sh — even though the export was
|
|
# subshell-scoped, the secret was briefly resident in /proc/<pid>/environ of
|
|
# a root process. The wrapper's `exec env VAR=...` pattern is the only
|
|
# acceptable credential delivery point.
|
|
set -euo pipefail
|
|
|
|
SECRETS_DIR="/run/agent/secrets/airouter"
|
|
|
|
if [ ! -d "$SECRETS_DIR" ]; then
|
|
echo "ERROR: Secret directory $SECRETS_DIR not found. ESO mount may have failed." >&2
|
|
exit 1
|
|
fi
|
|
|
|
for f in auth_token base_url; do
|
|
if [ ! -r "$SECRETS_DIR/$f" ]; then
|
|
echo "ERROR: $SECRETS_DIR/$f not readable. Check ESO ExternalSecret for airouter." >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
echo "airouter secrets verified at $SECRETS_DIR"
|