sonarr, radarr: tool runtime container + self-detect API key from config.xml (ADR 0052)

Mirrors plex: a broker-bound runtime that serves the module's tools, discovering
the app's API key from its own config.xml under a read-only config-dir mount, URL
defaulting to the server on the node. Proven in the mesh-lab: assigned-sonarr green
(key detected, tools served under the scoped account, no live Sonarr needed).

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

modules/radarr/client.ts

@@ -3,6 +3,9 @@
 // change to Radarr's API rebuilds only radarr and nothing else. Both this module's tools and its
 // events entrypoint import it, and nothing outside radarr does.
 
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
 // Radarr speaks the v3 API; its content is "movie".
 const API_VERSION = "v3";
 const CONTENT_ENDPOINT = "movie";
@@ -42,20 +45,34 @@ export class RadarrClient {
   }
 
   /**
-   * Build from the module's resolved environment. URL and key are read from MESH_RADARR_URL and
-   * MESH_RADARR_API_KEY; both must be present — an unconfigured Radarr throws rather than pretend to
-   * be reachable, so the tools/events simply do not load (the harness treats the throw as "exposes
+   * Build from the module's resolved environment. The URL defaults to the server on this node (the
+   * runtime shares its network), and the API key is read from MESH_RADARR_API_KEY or, failing that,
+   * discovered from the server's own config.xml under MESH_RADARR_CONFIG_DIR — the same file Radarr
+   * writes it to, so a running server needs nothing configured by hand. Throws when no key can be
+   * found, so the tools/events simply do not load (the harness treats the throw as "exposes
    * nothing").
    */
   static fromEnv(env: NodeJS.ProcessEnv = process.env): RadarrClient {
-    const url = env.MESH_RADARR_URL;
-    const apiKey = env.MESH_RADARR_API_KEY;
-    if (!url || !apiKey) {
-      throw new Error("Radarr not configured — set MESH_RADARR_URL and MESH_RADARR_API_KEY");
+    const url = env.MESH_RADARR_URL ?? `http://127.0.0.1:${env.MESH_RADARR_PORT ?? "7878"}`;
+    const configDir = env.MESH_RADARR_CONFIG_DIR ?? "/config";
+    const apiKey = env.MESH_RADARR_API_KEY ?? RadarrClient.detectApiKey(configDir);
+    if (!apiKey) {
+      throw new Error("Radarr not configured — set MESH_RADARR_API_KEY or make the config dir readable");
     }
     return new RadarrClient(url, apiKey);
   }
 
+  /** Discover the API key from the server's config.xml, falling back to null. Every Servarr app
+   *  writes <ApiKey> into config.xml at the root of its config directory. */
+  static detectApiKey(configDir: string): string | null {
+    const config = join(configDir, "config.xml");
+    if (existsSync(config)) {
+      const match = readFileSync(config, "utf8").match(/<ApiKey>([^<]+)<\/ApiKey>/);
+      if (match) return match[1];
+    }
+    return null;
+  }
+
   private async get(endpoint: string, params?: Record<string, string>): Promise<unknown> {
     const url = new URL(`${this.baseUrl}/api/${API_VERSION}/${endpoint}`);
     if (params) {

modules/radarr/module.json

@@ -66,6 +66,22 @@
         "/services/media/movies:/movies",
         "/services/media/downloads:/downloads"
       ]
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-radarr",
+      "image": "mesh-runtime-radarr@sha256:0000000000000000000000000000000000000000000000000000000000000000",
+      "network": "host",
+      "volumes": [
+        "/var/lib/mesh/radarr/broker:/run/secrets/broker:ro",
+        "/services/radarr/config:/var/lib/radarr/config:ro"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_RADARR_URL": "http://127.0.0.1:7878",
+        "MESH_RADARR_CONFIG_DIR": "/var/lib/radarr/config"
+      }
     }
   ]
 }