From 091f8eaf06cad29dede922ef86544e82ea8985b7 Mon Sep 17 00:00:00 2001
From: robert <robert@microcash.local>
Date: Sat, 23 May 2026 13:32:25 -0400
Subject: [PATCH] Use secret-backed agent builder runtime

---
 agent.py                  |  2 +-
 agent_builder/config.py   |  8 +++++---
 agent_builder/tools.py    |  5 +++++
 deploy/20-deployment.yaml | 12 +++++++++---
 requirements.txt          |  2 +-
 5 files changed, 21 insertions(+), 8 deletions(-)

diff --git a/agent.py b/agent.py
index cc14d20..65d25d8 100644
--- a/agent.py
+++ b/agent.py
@@ -256,4 +256,4 @@ def _find_url(value: Any) -> str | None:
         m = _URL_RE.search(value)
         return m.group(0) if m else None
     return None
-# rebuild against a2a-pack 0.1.16 for nullable LLM extra_body handling
+# rebuild against a2a-pack 0.1.17 for nullable LLM extra_body handling
diff --git a/agent_builder/config.py b/agent_builder/config.py
index dcc98e8..c124385 100644
--- a/agent_builder/config.py
+++ b/agent_builder/config.py
@@ -9,6 +9,7 @@ from dataclasses import dataclass
 class Settings:
     sandbox_url: str
     sandbox_timeout_s: int
+    sandbox_token: str | None
     deploy_wait_timeout_s: int
     litellm_url: str
     litellm_key: str
@@ -26,11 +27,12 @@ def load_settings() -> Settings:
             "SANDBOX_URL", "http://sandbox.sandbox.svc.cluster.local:8000"
         ),
         sandbox_timeout_s=int(os.environ.get("SANDBOX_TIMEOUT_S", "1200")),
+        sandbox_token=os.environ.get("A2A_SANDBOX_TOKEN") or os.environ.get("SANDBOX_TOKEN"),
         deploy_wait_timeout_s=int(os.environ.get("DEPLOY_WAIT_TIMEOUT_S", "900")),
         litellm_url=os.environ.get(
             "A2A_LITELLM_URL", "http://litellm.llm.svc.cluster.local:4000"
         ),
-        litellm_key=os.environ.get("A2A_LITELLM_KEY", "sk-microcash-local"),
+        litellm_key=os.environ.get("A2A_LITELLM_KEY", ""),
         litellm_model=os.environ.get("A2A_LITELLM_MODEL", "gpt-5.5"),
         cp_url=os.environ.get(
             "A2A_CP_URL", "http://control-plane.control-plane.svc.cluster.local"
@@ -39,7 +41,7 @@ def load_settings() -> Settings:
             "A2A_MINIO_ENDPOINT",
             "http://microcash-infra-minio.microcash-infra.svc.cluster.local:9000",
         ),
-        minio_access_key=os.environ.get("A2A_MINIO_ACCESS_KEY", "minioadmin"),
-        minio_secret_key=os.environ.get("A2A_MINIO_SECRET_KEY", "minioadmin"),
+        minio_access_key=os.environ.get("A2A_MINIO_ACCESS_KEY", ""),
+        minio_secret_key=os.environ.get("A2A_MINIO_SECRET_KEY", ""),
         image=os.environ.get("AGENT_BUILDER_IMAGE", "python:3.11-slim"),
     )
diff --git a/agent_builder/tools.py b/agent_builder/tools.py
index 57632c5..6564d6c 100644
--- a/agent_builder/tools.py
+++ b/agent_builder/tools.py
@@ -305,9 +305,14 @@ def build_tools(ctx: ToolContext) -> list[Any]:
             "echo '--- card ---'\n"
             "a2a card --project .\n"
         )
+        headers = (
+            {"authorization": f"Bearer {settings.sandbox_token}"}
+            if settings.sandbox_token else None
+        )
         async with httpx.AsyncClient(timeout=settings.sandbox_timeout_s + 30) as c:
             r = await c.post(
                 f"{settings.sandbox_url}/v1/run_shell",
+                headers=headers,
                 json={
                     "bucket": bucket, "script": script,
                     "image": settings.image, "memory_mib": 512,
diff --git a/deploy/20-deployment.yaml b/deploy/20-deployment.yaml
index 7f3ded0..8ec4677 100644
--- a/deploy/20-deployment.yaml
+++ b/deploy/20-deployment.yaml
@@ -39,7 +39,8 @@ spec:
             - name: A2A_LITELLM_URL
               value: http://litellm.llm.svc.cluster.local:4000
             - name: A2A_LITELLM_KEY
-              value: sk-microcash-local
+              valueFrom:
+                secretKeyRef: {name: litellm-credentials, key: api_key}
             - name: A2A_LITELLM_MODEL
               value: gpt-5.5
             - name: A2A_CP_URL
@@ -47,9 +48,14 @@ spec:
             - name: A2A_MINIO_ENDPOINT
               value: http://microcash-infra-minio.microcash-infra.svc.cluster.local:9000
             - name: A2A_MINIO_ACCESS_KEY
-              value: minioadmin
+              valueFrom:
+                secretKeyRef: {name: minio-credentials, key: access_key}
             - name: A2A_MINIO_SECRET_KEY
-              value: minioadmin
+              valueFrom:
+                secretKeyRef: {name: minio-credentials, key: secret_key}
+            - name: A2A_SANDBOX_TOKEN
+              valueFrom:
+                secretKeyRef: {name: sandbox-auth, key: token}
           readinessProbe:
             httpGet: {path: /healthz, port: 8000}
             initialDelaySeconds: 8
diff --git a/requirements.txt b/requirements.txt
index cbba95d..06db5cc 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,4 +1,4 @@
-a2a-pack>=0.1.16
+a2a-pack>=0.1.17
 httpx>=0.27
 boto3>=1.34
 deepagents>=0.5.0