fix(secrets): injector wrapper must replace the entrypoint #119
Reference in New Issue
Block a user
Delete Branch "fix/injector-entrypoint"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Pod crashlooped with
cannot open /vault/secrets/...because the wrapper landed in k8sargs, so the runner image ENTRYPOINT still ran:npx -y /bin/sh -c .... The agent had rendered the file correctly; nothing sourced it.Adds ContainerSpec.entrypoint (maps to k8s
command, replacing the image entrypoint) and foldsnpx -y/uvxinto the wrapped argv. Two regression tests.Caught migrating a real server: the pod crashlooped with `.: cannot open /vault/secrets/grafana-creds`, and the reason was in the generated spec: args: ["/bin/sh","-c",". /vault/secrets/grafana-creds; exec \"$0\" \"$@\"", "@leval/mcp-grafana"] mcpd deliberately maps ContainerSpec.command -> k8s `args` so a package server keeps its runner image's ENTRYPOINT (`npx -y`, `uvx`). Putting the sourcing wrapper there meant the pod actually ran `npx -y /bin/sh -c '...'` — npx trying to resolve a package called /bin/sh. The agent had rendered the file correctly; nothing ever sourced it. Adds `ContainerSpec.entrypoint`, which maps to k8s `command` and so REPLACES the image entrypoint, and has wrapCommand fold that entrypoint into the argv it returns (`npx -y` / `uvx` for package servers, the server's own `entrypoint` field for dockerImage servers — already required at validation for exactly this reason). Two tests pin it: a wrapped server emits `command` and no `args`; an unwrapped one still emits `args` and no `command`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018vybEitX4FykeMatKe5Xki