Refactor installation and runner scripts for enhanced usability and security

- Updated the installation script to clarify that production wrappers do not include fixed test secrets, improving user guidance for local testing.
- Modified the jiggablend-manager and jiggablend-runner scripts to remove fixed test configurations, emphasizing the use of local test credentials via `make init-test`.
- Enhanced error handling in the runner script to ensure that an API key is provided, improving security and user feedback.
- Added new flags and options for the runner, including sandboxing capabilities and GPU ray tracing control, enhancing flexibility for users.
- Improved README documentation to reflect changes in usage and configuration, ensuring users have clear instructions for setup and execution.

installer.sh

@@ -2,8 +2,9 @@
 
 set -euo pipefail
 
-# Simple script to install the latest jiggablend binary for Linux AMD64
-# and create wrapper scripts for manager and runner using test setup
+# Install the latest jiggablend binary for Linux AMD64 and create wrapper scripts.
+# Production wrappers do NOT install fixed test secrets. For local test credentials,
+# use `make init-test` from a development checkout.
 
 # Dependencies: curl, jq, tar, sha256sum, sudo (for installation to /usr/local/bin)
 
@@ -54,18 +55,17 @@ cat << 'EOF' > jiggablend-manager.sh
 
 set -euo pipefail
 
-# Wrapper to run jiggablend manager with test setup
-# Run this in a directory where you want the db, storage, and logs
+# Wrapper to run jiggablend manager.
+# Does NOT set fixed/test API keys or default admin passwords.
+# Bootstrap (one-time, local admin):
+#   jiggablend manager config enable localauth
+#   jiggablend manager config add user you@example.com 'strong-password' --admin
+#   jiggablend manager config add apikey my-runner --scope manager
+# For local development only: use `make init-test` from a source checkout.
 
 mkdir -p logs
 rm -f logs/manager.log
 
-# Initialize test configuration
-jiggablend manager config enable localauth
-jiggablend manager config set fixed-apikey jk_r0_test_key_123456789012345678901234567890 -f -y
-jiggablend manager config add user test@example.com testpassword --admin -f -y
-
-# Run manager
 jiggablend manager -l logs/manager.log
 EOF
 chmod +x jiggablend-manager.sh
@@ -78,10 +78,9 @@ cat << 'EOF' > jiggablend-runner.sh
 
 set -euo pipefail
 
-# Wrapper to run jiggablend runner with test setup
-# Usage: jiggablend-runner [MANAGER_URL] [RUNNER_FLAGS...]
-# Default MANAGER_URL: http://localhost:8080
-# Run this in a directory where you want the logs
+# Wrapper to run jiggablend runner.
+# Usage: jiggablend-runner [MANAGER_URL] --api-key <key> [RUNNER_FLAGS...]
+# Or set JIGGABLEND_API_KEY. Default MANAGER_URL: http://localhost:8080
 
 MANAGER_URL="http://localhost:8080"
 if [[ $# -gt 0 && "$1" != -* ]]; then
@@ -91,11 +90,29 @@ fi
 
 EXTRA_ARGS=("$@")
 
+API_KEY="${JIGGABLEND_API_KEY:-}"
+# Allow --api-key in EXTRA_ARGS; if not present and env empty, fail clearly
+HAS_KEY=0
+for arg in "${EXTRA_ARGS[@]+"${EXTRA_ARGS[@]}"}"; do
+  case "$arg" in
+    --api-key|--api-key=*|-k) HAS_KEY=1 ;;
+  esac
+done
+
+if [[ -z "$API_KEY" && "$HAS_KEY" -eq 0 ]]; then
+  echo "Error: provide a runner API key via JIGGABLEND_API_KEY or --api-key." >&2
+  echo "Create one with: jiggablend manager config add apikey <name> --scope manager" >&2
+  exit 1
+fi
+
 mkdir -p logs
 rm -f logs/runner.log
 
-# Run runner
-jiggablend runner -l logs/runner.log --api-key=jk_r0_test_key_123456789012345678901234567890 --manager "$MANAGER_URL" "${EXTRA_ARGS[@]}"
+if [[ -n "$API_KEY" && "$HAS_KEY" -eq 0 ]]; then
+  jiggablend runner -l logs/runner.log --api-key="$API_KEY" --manager "$MANAGER_URL" "${EXTRA_ARGS[@]+"${EXTRA_ARGS[@]}"}"
+else
+  jiggablend runner -l logs/runner.log --manager "$MANAGER_URL" "${EXTRA_ARGS[@]+"${EXTRA_ARGS[@]}"}"
+fi
 EOF
 chmod +x jiggablend-runner.sh
 sudo install -m 0755 jiggablend-runner.sh /usr/local/bin/jiggablend-runner
@@ -107,7 +124,7 @@ rm -f "$ASSET_NAME" checksums.txt jiggablend
 echo "Installation complete!"
 echo "Binary: jiggablend"
 echo "Wrappers: jiggablend-manager, jiggablend-runner"
-echo "Run 'jiggablend-manager' to start the manager with test config."
-echo "Run 'jiggablend-runner [url] [runner flags...]' to start the runner."
-echo "Example: jiggablend-runner http://your-manager:8080 --force-cpu-rendering"
-echo "Note: Depending on whether you're running the manager or runner, additional dependencies like Blender, ImageMagick, or FFmpeg may be required. See the project README for details."
+echo "Run 'jiggablend-manager' to start the manager (no fixed test secrets)."
+echo "Run 'jiggablend-runner [url] --api-key <key>' to start a runner."
+echo "Local dev only: use 'make init-test' from a source checkout for test credentials."
+echo "Note: Blender, ImageMagick, or FFmpeg may be required. See README."