Use secret-backed agent builder runtime

agent.py

@@ -256,4 +256,4 @@ def _find_url(value: Any) -> str | None:
         m = _URL_RE.search(value)
         return m.group(0) if m else None
     return None
-# rebuild against a2a-pack 0.1.16 for nullable LLM extra_body handling
+# rebuild against a2a-pack 0.1.17 for nullable LLM extra_body handling

agent_builder/config.py

@@ -9,6 +9,7 @@ from dataclasses import dataclass
 class Settings:
     sandbox_url: str
     sandbox_timeout_s: int
+    sandbox_token: str | None
     deploy_wait_timeout_s: int
     litellm_url: str
     litellm_key: str
@@ -26,11 +27,12 @@ def load_settings() -> Settings:
             "SANDBOX_URL", "http://sandbox.sandbox.svc.cluster.local:8000"
         ),
         sandbox_timeout_s=int(os.environ.get("SANDBOX_TIMEOUT_S", "1200")),
+        sandbox_token=os.environ.get("A2A_SANDBOX_TOKEN") or os.environ.get("SANDBOX_TOKEN"),
         deploy_wait_timeout_s=int(os.environ.get("DEPLOY_WAIT_TIMEOUT_S", "900")),
         litellm_url=os.environ.get(
             "A2A_LITELLM_URL", "http://litellm.llm.svc.cluster.local:4000"
         ),
-        litellm_key=os.environ.get("A2A_LITELLM_KEY", "sk-microcash-local"),
+        litellm_key=os.environ.get("A2A_LITELLM_KEY", ""),
         litellm_model=os.environ.get("A2A_LITELLM_MODEL", "gpt-5.5"),
         cp_url=os.environ.get(
             "A2A_CP_URL", "http://control-plane.control-plane.svc.cluster.local"
@@ -39,7 +41,7 @@ def load_settings() -> Settings:
             "A2A_MINIO_ENDPOINT",
             "http://microcash-infra-minio.microcash-infra.svc.cluster.local:9000",
         ),
-        minio_access_key=os.environ.get("A2A_MINIO_ACCESS_KEY", "minioadmin"),
+        minio_access_key=os.environ.get("A2A_MINIO_ACCESS_KEY", ""),
-        minio_secret_key=os.environ.get("A2A_MINIO_SECRET_KEY", "minioadmin"),
+        minio_secret_key=os.environ.get("A2A_MINIO_SECRET_KEY", ""),
         image=os.environ.get("AGENT_BUILDER_IMAGE", "python:3.11-slim"),
     )

agent_builder/tools.py

@@ -305,9 +305,14 @@ def build_tools(ctx: ToolContext) -> list[Any]:
             "echo '--- card ---'\n"
             "a2a card --project .\n"
         )
+        headers = (
+            {"authorization": f"Bearer {settings.sandbox_token}"}
+            if settings.sandbox_token else None
+        )
         async with httpx.AsyncClient(timeout=settings.sandbox_timeout_s + 30) as c:
             r = await c.post(
                 f"{settings.sandbox_url}/v1/run_shell",
+                headers=headers,
                 json={
                     "bucket": bucket, "script": script,
                     "image": settings.image, "memory_mib": 512,

deploy/20-deployment.yaml

@@ -39,7 +39,8 @@ spec:
             - name: A2A_LITELLM_URL
               value: http://litellm.llm.svc.cluster.local:4000
             - name: A2A_LITELLM_KEY
-              value: sk-microcash-local
+              valueFrom:
+                secretKeyRef: {name: litellm-credentials, key: api_key}
             - name: A2A_LITELLM_MODEL
               value: gpt-5.5
             - name: A2A_CP_URL
@@ -47,9 +48,14 @@ spec:
             - name: A2A_MINIO_ENDPOINT
               value: http://microcash-infra-minio.microcash-infra.svc.cluster.local:9000
             - name: A2A_MINIO_ACCESS_KEY
-              value: minioadmin
+              valueFrom:
+                secretKeyRef: {name: minio-credentials, key: access_key}
             - name: A2A_MINIO_SECRET_KEY
-              value: minioadmin
+              valueFrom:
+                secretKeyRef: {name: minio-credentials, key: secret_key}
+            - name: A2A_SANDBOX_TOKEN
+              valueFrom:
+                secretKeyRef: {name: sandbox-auth, key: token}
           readinessProbe:
             httpGet: {path: /healthz, port: 8000}
             initialDelaySeconds: 8

requirements.txt

@@ -1,4 +1,4 @@
-a2a-pack>=0.1.16
+a2a-pack>=0.1.17
 httpx>=0.27
 boto3>=1.34
 deepagents>=0.5.0