Use secret-backed agent builder runtime

agent_builder/config.py

@@ -9,6 +9,7 @@ from dataclasses import dataclass
 class Settings:
     sandbox_url: str
     sandbox_timeout_s: int
+    sandbox_token: str | None
     deploy_wait_timeout_s: int
     litellm_url: str
     litellm_key: str
@@ -26,11 +27,12 @@ def load_settings() -> Settings:
             "SANDBOX_URL", "http://sandbox.sandbox.svc.cluster.local:8000"
         ),
         sandbox_timeout_s=int(os.environ.get("SANDBOX_TIMEOUT_S", "1200")),
+        sandbox_token=os.environ.get("A2A_SANDBOX_TOKEN") or os.environ.get("SANDBOX_TOKEN"),
         deploy_wait_timeout_s=int(os.environ.get("DEPLOY_WAIT_TIMEOUT_S", "900")),
         litellm_url=os.environ.get(
             "A2A_LITELLM_URL", "http://litellm.llm.svc.cluster.local:4000"
         ),
-        litellm_key=os.environ.get("A2A_LITELLM_KEY", "sk-microcash-local"),
+        litellm_key=os.environ.get("A2A_LITELLM_KEY", ""),
         litellm_model=os.environ.get("A2A_LITELLM_MODEL", "gpt-5.5"),
         cp_url=os.environ.get(
             "A2A_CP_URL", "http://control-plane.control-plane.svc.cluster.local"
@@ -39,7 +41,7 @@ def load_settings() -> Settings:
             "A2A_MINIO_ENDPOINT",
             "http://microcash-infra-minio.microcash-infra.svc.cluster.local:9000",
         ),
-        minio_access_key=os.environ.get("A2A_MINIO_ACCESS_KEY", "minioadmin"),
-        minio_secret_key=os.environ.get("A2A_MINIO_SECRET_KEY", "minioadmin"),
+        minio_access_key=os.environ.get("A2A_MINIO_ACCESS_KEY", ""),
+        minio_secret_key=os.environ.get("A2A_MINIO_SECRET_KEY", ""),
         image=os.environ.get("AGENT_BUILDER_IMAGE", "python:3.11-slim"),
     )

agent_builder/tools.py

@@ -305,9 +305,14 @@ def build_tools(ctx: ToolContext) -> list[Any]:
             "echo '--- card ---'\n"
             "a2a card --project .\n"
         )
+        headers = (
+            {"authorization": f"Bearer {settings.sandbox_token}"}
+            if settings.sandbox_token else None
+        )
         async with httpx.AsyncClient(timeout=settings.sandbox_timeout_s + 30) as c:
             r = await c.post(
                 f"{settings.sandbox_url}/v1/run_shell",
+                headers=headers,
                 json={
                     "bucket": bucket, "script": script,
                     "image": settings.image, "memory_mib": 512,