mirrors/pikasTech-HWLAB
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: require explicit AgentRun tool Secret names

Browse Source
This commit is contained in:
root
2026-07-17 05:10:20 +02:00
parent f0dd4c8339
commit e2a1670736
4 changed files with 46 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/cloud/code-agent-agentrun-adapter.ts
+20 -5
View File
@@ -1344,35 +1344,50 @@ function namespaceForAgentRunRuntimeLane(lane) {
return null;
}
function agentRunRuntimeAuthorityError(code, message) {
function agentRunRuntimeAuthorityError(code, message, details = {}) {
return Object.assign(new Error(message), {
code,
statusCode: 500,
details,
valuesPrinted: false
});
}
function agentRunToolCredentials(env = process.env, toolCapabilities = null) {
const namespace = firstNonEmpty(env.HWLAB_CODE_AGENT_AGENTRUN_TOOL_SECRET_NAMESPACE, env.HWLAB_CODE_AGENT_AGENTRUN_SECRET_NAMESPACE, DEFAULT_RUNNER_NAMESPACE);
const githubSecretName = firstNonEmpty(env.HWLAB_CODE_AGENT_AGENTRUN_GITHUB_TOOL_SECRET_NAME, "agentrun-v01-tool-github-pr");
const githubSecretKey = firstNonEmpty(env.HWLAB_CODE_AGENT_AGENTRUN_GITHUB_TOOL_SECRET_KEY, "GH_TOKEN");
const unideskSecretName = firstNonEmpty(env.HWLAB_CODE_AGENT_AGENTRUN_UNIDESK_SSH_TOOL_SECRET_NAME, "agentrun-v01-tool-unidesk-ssh");
const credentials = [];
if (toolCapabilityAllowed(toolCapabilities, "github_pr")) credentials.push({
if (toolCapabilityAllowed(toolCapabilities, "github_pr")) {
const githubSecretName = requireAgentRunToolSecretName(env, "HWLAB_CODE_AGENT_AGENTRUN_GITHUB_TOOL_SECRET_NAME", "github");
credentials.push({
tool: "github",
purpose: "pull-request",
secretRef: { namespace, name: githubSecretName, keys: [githubSecretKey] },
projection: { kind: "env", envName: githubSecretKey, secretKey: githubSecretKey }
});
if (toolCapabilityAllowed(toolCapabilities, "unidesk_ssh")) credentials.push({
}
if (toolCapabilityAllowed(toolCapabilities, "unidesk_ssh")) {
const unideskSecretName = requireAgentRunToolSecretName(env, "HWLAB_CODE_AGENT_AGENTRUN_UNIDESK_SSH_TOOL_SECRET_NAME", "unidesk-ssh");
credentials.push({
tool: "unidesk-ssh",
purpose: "ssh-passthrough",
secretRef: { namespace, name: unideskSecretName, keys: ["UNIDESK_SSH_CLIENT_TOKEN"] },
projection: { kind: "env", envName: "UNIDESK_SSH_CLIENT_TOKEN", secretKey: "UNIDESK_SSH_CLIENT_TOKEN" }
});
}
return credentials;
}
function requireAgentRunToolSecretName(env, envName, tool) {
const secretName = text(env[envName]);
if (secretName) return secretName;
throw agentRunRuntimeAuthorityError(
"agentrun_tool_secret_not_configured",
`${envName} is required when the ${tool} capability is enabled`,
{ tool, envName, valuesPrinted: false }
);
}
async function resolveToolCapabilities({ params = {}, options = {} } = {}) {
const ownerUserId = text(params.ownerUserId);
const accessController = options.accessController;