chore: init commit

in worker.../repo/GITFOLDER.zip is the .git folder.

worker-toolkit-stocks-in-the-future/scripts/lib/harness-credentials.sh

@@ -0,0 +1,92 @@
+#!/bin/bash
+# Read the harness registry and derive per-harness credentials from it.
+#
+# Source it — the whole point is exporting into the caller's environment, which a subshell
+# would lose:
+#
+#     HARNESS_SCRIPTS_DIR=/workspace/scripts . /workspace/scripts/lib/harness-credentials.sh
+#     harness_setup_credentials
+#
+# Two callers: `harbor-run`, which needs only this, and `setup-harnesses.sh`, which sources
+# it and adds installs, config writing and launchers on top.
+#
+# No -e here — this file is SOURCED, and shell options belong to the caller's shell (both
+# post-creates run with -e). An unguarded failure below therefore aborts container
+# creation, which is why every failure site is individually guarded rather than relying on
+# this line.
+set -uo pipefail
+
+_HARNESS_REGISTRY_DIR="${HARNESS_SCRIPTS_DIR:-/workspace/scripts}"
+
+# The registry is read with tomllib (stdlib from 3.11), and `python3` is not always new
+# enough — macOS ships 3.9, and a container may symlink an older managed interpreter. Pick
+# the first one that can actually import it rather than assuming.
+_raccoon_python() {
+    local p
+    for p in "${RACCOON_PYTHON:-}" python3 python3.13 python3.12 python3.11; do
+        [ -n "$p" ] || continue
+        command -v "$p" >/dev/null 2>&1 || continue
+        if "$p" -c "import tomllib" >/dev/null 2>&1; then
+            printf '%s' "$p"
+            return 0
+        fi
+    done
+    return 1
+}
+
+_harness_query() {
+    local py
+    py=$(_raccoon_python) || return 1
+    "$py" "$_HARNESS_REGISTRY_DIR/resolve_harness.py" "$@"
+}
+
+# The proxy root: the worker's ANTHROPIC_BASE_URL minus its provider path.
+_harness_proxy_root() {
+    local base_url="${ANTHROPIC_BASE_URL:-}"
+    [ -n "$base_url" ] || return 1
+    base_url="${base_url%"${base_url##*[!/]}"}"
+    # ".../api/llm_proxy/raccoon" -> ".../api/llm_proxy". Requires a path to strip: a base
+    # URL that is a bare host with no path — a provider's own API root rather than the
+    # proxy — would yield "https:/", handed to codex as a base URL and failing obscurely.
+    case "${base_url#*://}" in
+        */*) printf '%s' "${base_url%/*}" ;;
+        *) return 2 ;;
+    esac
+}
+
+harness_setup_credentials() {
+    # `|| rc=$?` and not a bare assignment: this is sourced into a `set -e` shell (see the
+    # note at the top), and a bare failing assignment would exit the caller's post-create
+    # outright — silently, since the failure paths below are what do the explaining.
+    local root rc=0
+    root="$(_harness_proxy_root)" || rc=$?
+    if [ "$rc" -ne 0 ]; then
+        if [ "$rc" -eq 2 ]; then
+            echo "harness-setup: ANTHROPIC_BASE_URL (${ANTHROPIC_BASE_URL:-}) has no provider" >&2
+            echo "harness-setup:   path, so it is not the proxy URL other harnesses derive their" >&2
+            echo "harness-setup:   credentials from. claude will work; codex will not be" >&2
+            echo "harness-setup:   authenticated. Use the base URL you were given." >&2
+        else
+            echo "harness-setup: ANTHROPIC_BASE_URL unset — skipping credential derivation" >&2
+        fi
+        return 0
+    fi
+    local key="${ANTHROPIC_API_KEY:-}"
+    if [ -z "$key" ]; then
+        echo "harness-setup: ANTHROPIC_API_KEY unset — skipping credential derivation" >&2
+        return 0
+    fi
+
+    local id key_env base_url_env proxy_path
+    while IFS=$'\t' read -r id key_env base_url_env proxy_path; do
+        [ -n "$key_env" ] || continue
+        # ${!name} is an indirect expansion. Only set when empty: an explicit key wins.
+        if [ -z "${!key_env:-}" ]; then
+            export "$key_env=$key"
+        fi
+        if [ -n "$base_url_env" ] && [ -n "$proxy_path" ] && [ -z "${!base_url_env:-}" ]; then
+            export "$base_url_env=$root/$proxy_path"
+        fi
+        echo "harness-setup: $id credentials ready ($key_env, ${base_url_env:-no base url})" >&2
+    done < <(_harness_query --authoring-credentials 2>/dev/null || true)
+}