PAD-12: per-terminal transport (direct Tailscale SSH or Warpgate, pre-session fallback, pinned host keys, agent key from Vault), one-call win10 launch and one-call collect, remote call timings, agentd ping

cron/agentd-tick-lxc.sh

@@ -1,13 +1,37 @@
 #!/usr/bin/env bash
 # LXC agentd-01 cron entry (*/2, root): one agentd tick under server-access exec (Plane tokens only in the
-# process env), with a lock. The outer flock skips a tick while the previous one still runs; agentd also holds
+# process env), with a lock. The flock skips a tick while the previous one still runs; agentd also holds
 # its own state lock. Logs: /var/log/plane-agentd/{agentd.log,cron.log}; state: /var/lib/plane-agentd.
 # Also the webhook receiver's tick command (agentd/webhook.py): exit 75 = lock held (flock -E 75, or agentd's own
 # state lock), the receiver then retries.
-exec flock -n -E 75 /var/lib/plane-agentd/cron.lock \
-  timeout 900 python3 -I /root/.local/share/server-access-client/agent-access.py \
-  --config https://nas.tail9531b.ts.net:8443/identity/agent.json exec \
-  --secret-env PLANE_OREGON_API_TOKEN=PLANE_OREGON_API_TOKEN \
-  --secret-env PLANE_WINDOW10_API_TOKEN=PLANE_WINDOW10_API_TOKEN --timeout 850 -- \
-  python3 /opt/plane-agentd/cli/agentd --config /opt/plane-agentd/config/agentd.yaml \
-  tick --once >> /var/log/plane-agentd/cron.log 2>&1
+# AGENTD_SSH_KEY = the direct-ssh key (PAD-12). agent-access.py has no optional secrets: when Vault cannot hand it
+# out (credential_unavailable / credential_invalid, nothing ran) the tick is repeated once without it, so the
+# direct-ssh terminals use their warpgate fallback instead of every tick failing. The tick's stderr is appended to
+# cron.log after its stdout (it has to be inspected for that error first).
+LOCK=/var/lib/plane-agentd/cron.lock
+LOG=/var/log/plane-agentd/cron.log
+CLIENT=(python3 -I /root/.local/share/server-access-client/agent-access.py --config https://nas.tail9531b.ts.net:8443/identity/agent.json)
+
+exec 9>>"$LOCK"
+flock -n -E 75 9 || exit $?
+
+tick() {   # "$@" = extra exec arguments; fd 9 (the lock) is not handed to the tick's children
+  timeout 900 "${CLIENT[@]}" exec \
+    --secret-env PLANE_OREGON_API_TOKEN=PLANE_OREGON_API_TOKEN \
+    --secret-env PLANE_WINDOW10_API_TOKEN=PLANE_WINDOW10_API_TOKEN \
+    "$@" --timeout 850 -- \
+    python3 /opt/plane-agentd/cli/agentd --config /opt/plane-agentd/config/agentd.yaml tick --once 9>&-
+}
+
+err=$(mktemp) || exit 1
+trap 'rm -f "$err"' EXIT
+tick --secret-env AGENTD_SSH_KEY=AGENTD_SSH_KEY >>"$LOG" 2>"$err"
+rc=$?
+cat "$err" >>"$LOG"
+case "$rc:$(cat "$err")" in
+  "1:access-hub: credential_unavailable" | "1:access-hub: credential_invalid")
+    echo "$(date -Is) AGENTD_SSH_KEY not available from Vault: tick repeated without it (direct-ssh terminals use their warpgate fallback)" >>"$LOG"
+    tick >>"$LOG" 2>&1
+    rc=$? ;;
+esac
+exit $rc