Paul O'Reilly 455d8d135b fix(z-ai): wire auth_token via apiKeyHelper, never via env ...

Mirrors the minimax fix to z-ai. Replaces bin/anthropic-compat-wrapper.sh
(which did `exec env ANTHROPIC_AUTH_TOKEN="$(cat ...)" claude "$@"`,
exposing the secret in the claude subprocess' /proc/<pid>/environ) with
init.sh that writes ~/.claude/settings.json with:

  apiKeyHelper: "cat /run/agent/secrets/z-ai/auth_token"

Claude Code routes apiKeyHelper output to `Authorization: Bearer <value>`
when ANTHROPIC_BASE_URL is non-anthropic.com — exactly what the Z.ai
proxy at api.z.ai/api/anthropic requires.

The legacy K8s Secret may still ship a `base_url` file; it is
intentionally ignored by init.sh (the base URL is not a credential and
lives in harness.yaml).

Mirrors agent-runtimes commit (z-ai apiKeyHelper). CRS serves these
harness files to dispatchers, so this repo must match.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

2026-05-07 13:47:52 +12:00

1.8 KiB

Executable File

Raw Blame History

View Raw