b1e3ee7052
The airouter ESO ExternalSecret materialises a single key `api_key` (matching the provider schema in agent-runtimes M22 Phase 8e cutover, acct-59b7fb0b). The harness init script was checking for `auth_token` + `base_url` (an Anthropic-compat shape that never existed in real Vault state) and failing on every dispatch: ERROR: /run/agent/secrets/airouter/auth_token not readable. Check ESO ExternalSecret for airouter. Surfaced as the second blocker for the M16 Wave A1 dogfood (the first was the airouter dispatcher missing CRS sync; that fix went into agent-runtimes-deploy@0f11cd1). Same shape of bug as the minimax + gitea-ssh init scripts that landed during the same M22 phase — those were fixed at the time, airouter was not. Changes: - init.sh: verify the single `api_key` file (root-only, 0400 ESO mount). Stage to /var/agent-secrets/airouter/api_key with mode 0600 agent-owned (mirrors minimax pattern). H-SECRET-4 compliant — no exports. - harness.yaml: add OPENAI_API_KEY_FILE pointing at the staged path. Agentic runner reads the file at request time per entrypoint/runners/agentic.py:146 (OPENAI_API_KEY_FILE precedence). - Delete dead bin/anthropic-compat-wrapper.sh — confirmed unused per agent-runtimes/memory/log/2026-05-07.214249.md (post-M22-Phase-9 cleanup found these per-provider wrappers were never invoked; runner only prepends /opt/agent/claude-wrapper.sh). CRS picks this up automatically on next CP poll; no agent-runtimes image rebuild needed. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
40 lines
1.6 KiB
Bash
Executable File
40 lines
1.6 KiB
Bash
Executable File
#!/bin/bash
|
|
# airouter init — Phase 9 ESO-managed secret + agentic-runner staging.
|
|
#
|
|
# The airouter ESO ExternalSecret materialises a single key, `api_key`,
|
|
# matching the airouter provider schema. The previous version of this
|
|
# script verified `auth_token` + `base_url` (Anthropic-compat shape, dead
|
|
# code per the M22 Phase 9 cleanup) and never matched a real ESO Secret.
|
|
#
|
|
# Threat model: ESO mount is root-only (mode 0400) — agent CANNOT read
|
|
# /run/agent/secrets/airouter/api_key directly. init.sh runs as root
|
|
# (under uid-wrapper.sh, before the gosu drop) and installs a per-agent
|
|
# copy of the api_key at a fixed path the agentic runner reads via
|
|
# OPENAI_API_KEY_FILE. Same pattern as minimax/v1/init.sh.
|
|
#
|
|
# Per H-SECRET-4: no `export` of the credential value here — the staged
|
|
# file path is referenced from harness env (OPENAI_API_KEY_FILE), and the
|
|
# agentic runner reads the file at request time.
|
|
set -euo pipefail
|
|
|
|
ESO_API_KEY="/run/agent/secrets/airouter/api_key"
|
|
|
|
if [ ! -r "$ESO_API_KEY" ]; then
|
|
echo "ERROR: $ESO_API_KEY not readable. Check ESO ExternalSecret acct-<airouter-id>." >&2
|
|
exit 1
|
|
fi
|
|
|
|
AGENT_USER="${AGENT_USER:-agent}"
|
|
|
|
# Stage to a fixed path that harness.yaml env can reference. Outside the
|
|
# read-only ESO mount so we can set ownership/mode.
|
|
STAGED_DIR="/var/agent-secrets/airouter"
|
|
STAGED_KEY="$STAGED_DIR/api_key"
|
|
mkdir -p "$STAGED_DIR"
|
|
chown "$AGENT_USER:" "$STAGED_DIR" 2>/dev/null || true
|
|
chmod 0700 "$STAGED_DIR"
|
|
install -m 0600 -o "$AGENT_USER" -g "$AGENT_USER" "$ESO_API_KEY" "$STAGED_KEY"
|
|
|
|
echo "airouter api_key staged at $STAGED_KEY (0600 $AGENT_USER:$AGENT_USER)"
|
|
echo "airouter OPENAI_API_KEY_FILE set via harness.yaml env"
|