253b147a39
The ESO-mounted secret is root-owned mode 0400 (correct — init.sh runs as root before the gosu drop to the agent user). The original version of this context pointed CP_SERVICE_TOKEN_FILE directly at that raw mount, which the agent process (uid 1000) can never read. Confirmed live 2026-09-03: a real scope-decompose-sonnet@1 dispatch against concept 7666d278-ae58-4f12-990d-c4959a3e19a9 hit exactly this — the agent correctly diagnosed 'cp_cli invocation can't proceed... token is root-owned mode 0400 so it's not readable by the agent user', wrote its decompose plan, but could never actually call cp-cli to create the child tasks. The trigger engine's new side-effect verification (finalize.py, bug 9dffc5b8) correctly caught this and refused to advance flow_state — so this was a visible, retriable failure rather than another silent false-positive. Fix: init.sh restages the secret to /run/agent/cp-service-token/token, mode 0600, owned by the agent user — mirrors anthropic-cloud-paul-oauth/v1/init.sh's existing pattern. CP_SERVICE_TOKEN_FILE now points at the restaged copy.
40 lines
1.4 KiB
Bash
Executable File
40 lines
1.4 KiB
Bash
Executable File
#!/bin/bash
|
|
# cp-service-token init — restage the ESO-mounted secret to an agent-owned
|
|
# copy.
|
|
#
|
|
# Threat model: keep the ESO mount root-only (mode 0400) so the agent user
|
|
# cannot directly `cat` /run/agent/secrets/cp-service-token/*. init.sh runs
|
|
# as root (in uid-wrapper.sh, before the gosu drop) and writes a restaged
|
|
# copy at /run/agent/cp-service-token/token with mode 0600 owned by the
|
|
# agent user. This mirrors anthropic-cloud-paul-oauth/v1/init.sh's pattern.
|
|
#
|
|
# Bug discovered live 2026-09-03: without this restaging step, cp-cli
|
|
# (invoked by the agent user, uid 1000) could not read the raw 0400
|
|
# root-owned mount at all — "cp_cli invocation can't proceed... token is
|
|
# root-owned mode 0400 so it's not readable by the agent user". The context
|
|
# originally set CP_SERVICE_TOKEN_FILE directly at the raw ESO mount path,
|
|
# which is the mistake this init.sh fixes.
|
|
|
|
set -euo pipefail
|
|
|
|
ESO_TOKEN="/run/agent/secrets/cp-service-token/value"
|
|
|
|
if [ ! -r "$ESO_TOKEN" ]; then
|
|
echo "ERROR: $ESO_TOKEN not readable. Check ESO ExternalSecret acct-1d963673." >&2
|
|
exit 1
|
|
fi
|
|
|
|
AGENT_USER="${AGENT_USER:-agent}"
|
|
|
|
DEST_DIR="/run/agent/cp-service-token"
|
|
mkdir -p "$DEST_DIR"
|
|
|
|
DEST_FILE="$DEST_DIR/token"
|
|
cp "$ESO_TOKEN" "$DEST_FILE"
|
|
|
|
chown "$AGENT_USER:" "$DEST_DIR" "$DEST_FILE" 2>/dev/null || true
|
|
chmod 0700 "$DEST_DIR"
|
|
chmod 0600 "$DEST_FILE"
|
|
|
|
echo "cp-service-token: restaged into $DEST_FILE (0600 $AGENT_USER:$AGENT_USER)"
|