Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

node-agent/src/modelforge_node_agent/__init__.py

@@ -1 +1 @@
-__version__ = "1.2.2"
+__version__ = "1.3.0-rc.1"

node-agent/src/modelforge_node_agent/state.py

@@ -5,6 +5,8 @@ import os
 from dataclasses import asdict, dataclass
 from pathlib import Path
 
+CREDENTIAL_SHARED_READ_MODE = 0o640
+
 
 @dataclass
 class AgentPersistentState:
@@ -36,11 +38,17 @@ class AgentStateStore:
     def credential(self) -> str | None:
         try:
             value = self.credential_file.read_text(encoding="utf-8").strip()
-            return value or None
+            if not value:
+                return None
+            # The runtime worker has a separate non-root identity. It joins the dedicated agent
+            # group solely to read this credential from the shared, read-only state volume.
+            # Normalising an older 0600 credential here makes ordinary Agent upgrades safe too.
+            os.chmod(self.credential_file, CREDENTIAL_SHARED_READ_MODE)
+            return value
         except OSError:
             return None
 
     def save_credential(self, credential: str) -> None:
         self.credential_file.parent.mkdir(parents=True, exist_ok=True)
         self.credential_file.write_text(credential, encoding="utf-8")
-        os.chmod(self.credential_file, 0o600)
+        os.chmod(self.credential_file, CREDENTIAL_SHARED_READ_MODE)