f8c8805f26
Mirrors agent-runtimes audit + fix. All three M22 Phase 9 wrapper-script
auth paths were broken since the cutover: each one ran as the agent UID
trying to `cat` a 0400 root-only ESO mount. Same root cause we hit on
minimax/z-ai earlier today.
Changes:
1. anthropic-cloud-paul-oauth/v1 (NEW in framework)
- Mirrors agent-runtimes — was previously only present there.
- init.sh stages oauth_token into ~/.claude/.credentials.json (Claude
Code's native subscription-OAuth schema). No env, no apiKeyHelper,
no wrapper. Restores the equivalent of what harness_init.py used to
do for the legacy SOPS path.
- The legacy `bin/anthropic-wrapper.sh` was dead code (never wired).
2. gitea-https/v1
- init.sh stages the token to $HOME/.config/git/gitea-https-token
(0600 agent:agent) and points the per-host git credential helper at
the staged copy. Previously the helper `cat`d the ESO mount path
and silently failed at every git invocation.
3. gitea-admin/v1
- init.sh stages the token to $HOME/.config/gitea-admin/token
(0600 agent:agent). Wrapper updated to read from the staged copy.
- Removes stale `requires: anthropic-cloud/v1` (the only anthropic
harness in agent-runtimes is anthropic-cloud-paul-oauth/v1).
Pattern matches gitea-ssh / minimax / z-ai: ESO mount stays root-only,
init.sh runs as root and `install -m 0600 -o agent -g agent`s a single
explicit copy. Per-secret enumeration; future ESO Secret keys remain
inaccessible by default.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
50 lines
2.1 KiB
Bash
Executable File
50 lines
2.1 KiB
Bash
Executable File
#!/bin/bash
|
|
# gitea-admin-wrapper.sh — reads the agent-staged gitea-admin token at exec
|
|
# time and prefixes it as a transient env var to the underlying tool.
|
|
#
|
|
# M22 Phase 9 staging pattern: init.sh runs as root and `install`s a 0600
|
|
# agent-owned copy of the ESO-mounted token into $HOME/.config/gitea-admin/
|
|
# token. This wrapper reads the staged copy, not the ESO mount path, so
|
|
# the `cat` succeeds under the agent UID. The brief presence of the token
|
|
# in /proc/<tool_pid>/environ of the exec'd tool is the accepted floor
|
|
# (per H-SECRET-4 / SR-DISP-7); the wrapper's parent shell never sees it.
|
|
|
|
set -euo pipefail
|
|
|
|
TOKEN_FILE="$HOME/.config/gitea-admin/token"
|
|
|
|
# git-credential-helper subcommand: read token and emit git credential format.
|
|
# Git invokes us as `gitea-admin-wrapper.sh git-credential-helper get` and
|
|
# expects key=value lines on stdout terminated by a blank line.
|
|
git_credential_helper() {
|
|
if [[ ! -r "$TOKEN_FILE" ]]; then
|
|
echo "gitea-admin-wrapper: staged token not readable at $TOKEN_FILE" >&2
|
|
echo "gitea-admin-wrapper: did init.sh run? (it stages the token from the ESO mount)" >&2
|
|
exit 1
|
|
fi
|
|
local base_url="${GITEA_BASE_URL:-https://gitea.oreillyit.nz}"
|
|
local host
|
|
host=$(echo "$base_url" | sed 's|https\?://||')
|
|
# Trailing blank line per git credential-helper protocol.
|
|
printf 'protocol=https\nhost=%s\nusername=git\npassword=%s\n\n' "$host" "$(cat "$TOKEN_FILE")"
|
|
exit 0
|
|
}
|
|
|
|
case "${1:-}" in
|
|
git-credential-helper)
|
|
git_credential_helper
|
|
;;
|
|
*)
|
|
if [[ ! -r "$TOKEN_FILE" ]]; then
|
|
echo "gitea-admin-wrapper: staged token not readable at $TOKEN_FILE" >&2
|
|
echo "gitea-admin-wrapper: did init.sh run? (it stages the token from the ESO mount)" >&2
|
|
exit 1
|
|
fi
|
|
# `exec env VAR=...` keeps the secret out of the wrapper's parent shell
|
|
# — it lands only in the exec'd tool's /proc/<pid>/environ. NEVER use
|
|
# `export VAR=` here, which would leak the secret to the wrapper's
|
|
# ancestors (H-SECRET-4 violation).
|
|
exec env GITEA_ADMIN_TOKEN="$(cat "$TOKEN_FILE")" "$@"
|
|
;;
|
|
esac
|