f8c8805f26
Mirrors agent-runtimes audit + fix. All three M22 Phase 9 wrapper-script
auth paths were broken since the cutover: each one ran as the agent UID
trying to `cat` a 0400 root-only ESO mount. Same root cause we hit on
minimax/z-ai earlier today.
Changes:
1. anthropic-cloud-paul-oauth/v1 (NEW in framework)
- Mirrors agent-runtimes — was previously only present there.
- init.sh stages oauth_token into ~/.claude/.credentials.json (Claude
Code's native subscription-OAuth schema). No env, no apiKeyHelper,
no wrapper. Restores the equivalent of what harness_init.py used to
do for the legacy SOPS path.
- The legacy `bin/anthropic-wrapper.sh` was dead code (never wired).
2. gitea-https/v1
- init.sh stages the token to $HOME/.config/git/gitea-https-token
(0600 agent:agent) and points the per-host git credential helper at
the staged copy. Previously the helper `cat`d the ESO mount path
and silently failed at every git invocation.
3. gitea-admin/v1
- init.sh stages the token to $HOME/.config/gitea-admin/token
(0600 agent:agent). Wrapper updated to read from the staged copy.
- Removes stale `requires: anthropic-cloud/v1` (the only anthropic
harness in agent-runtimes is anthropic-cloud-paul-oauth/v1).
Pattern matches gitea-ssh / minimax / z-ai: ESO mount stays root-only,
init.sh runs as root and `install -m 0600 -o agent -g agent`s a single
explicit copy. Per-secret enumeration; future ESO Secret keys remain
inaccessible by default.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
33 lines
789 B
YAML
33 lines
789 B
YAML
kind: context
|
|
name: gitea-admin
|
|
version: 1
|
|
description: "Gitea admin: SSH, git identity, API token for skynet org"
|
|
requires: []
|
|
provides: [gitea-admin]
|
|
|
|
git_identity:
|
|
name: "agent-runtimes"
|
|
email: "agent@oreillyit.nz"
|
|
|
|
ssh_hosts:
|
|
- alias: gitea.oreillyit.nz-ai-enablement
|
|
hostname: gitea.oreillyit.nz
|
|
user: git
|
|
identity_secret: SSH_KEY_AI_ENABLEMENT
|
|
|
|
secrets_required:
|
|
# ESO-managed gitea-admin token (M22 Phase 9)
|
|
- name: gitea-admin
|
|
account_ref: "admin.space:platform"
|
|
mount_path: /run/agent/secrets/gitea-admin
|
|
mode: "0400"
|
|
# Legacy SSH key (file-based, already delivered as mount)
|
|
- name: SSH_KEY_AI_ENABLEMENT
|
|
mount: /home/agent/.ssh/id_ed25519
|
|
mode: "0600"
|
|
|
|
env:
|
|
GITEA_BASE_URL: "https://gitea.oreillyit.nz"
|
|
|
|
scripts:
|
|
init: ./init.sh |