12c2172835
Mirrors agent-runtimes commit 6f20b51. CRS serves these harness files to dispatchers, so this repo must match. Switches from "mount mode 0444 so the agent user can `cat` the ESO file" to the gitea-ssh staging pattern: keep the ESO mount root-only (0400), init.sh as root `install`s a per-secret 0600 agent-owned copy, and apiKeyHelper points at the staged copy. Stronger blast-radius guarantee — if the ESO Secret later grows additional keys, they remain root-only unless the harness explicitly stages them. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
28 lines
916 B
YAML
28 lines
916 B
YAML
kind: context
|
|
name: z-ai
|
|
version: 1
|
|
description: "Z.ai GLM coding plan — Anthropic-compatible proxy"
|
|
requires: []
|
|
provides: [claude-code]
|
|
|
|
env:
|
|
ANTHROPIC_BASE_URL: "https://api.z.ai/api/anthropic"
|
|
CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS: "1"
|
|
CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
|
|
DISABLE_PROMPT_CACHING: "1"
|
|
|
|
secrets_required:
|
|
- name: z-ai
|
|
account_ref: "z-ai"
|
|
mount_path: /run/agent/secrets/z-ai
|
|
# 0400 (root-only) — defense in depth. The agent user cannot read this
|
|
# mount. init.sh runs as root and stages the auth_token into the agent's
|
|
# home with mode 0600. apiKeyHelper points at the staged copy. Matches
|
|
# the gitea-ssh pattern; if the ESO Secret later carries additional
|
|
# files (e.g. base_url is already there), they remain inaccessible.
|
|
mode: "0400"
|
|
|
|
scripts:
|
|
init: "./init.sh"
|
|
|
|
# TODO: Add network_hosts for api.z.ai when context harnesses support it |