Merge current Backend main into project decision work

Why: Integrate Backend origin/main 7aa6243 while retaining the product's mandatory trusted project-context startup contract.

Evidence: go test ./pkg/extension/... ./internal/app -count=1; go vet ./...; go test ./... -count=1; go build ./...; CGO_ENABLED=0 go build ./cmd/agent-system.

Impact: Keep the appOptions helper and exec-environment fallbacks while forwarding RequireProjectContext without loss.

Refs: 92f9286e6c4004074f014902f8b04554287ddfb2; 7aa624370a

pkg/extension/extension.go

@@ -235,6 +235,12 @@ type Options struct {
 	// 仅会话工作目录与技能目录挂载、进程数限额、超时杀整个沙箱）。
 	// DisableExecTools 优先级高于此选择。
 	ExecBackend string
+	// ExecDepsDir、ExecWorkspace、ExecEnvRoot 与基座 serve 同名。
+	// 产品入口不解析这三项旗标时留空，link 改读同名环境变量
+	//（AGENT_SYSTEM_EXEC_DEPS_DIR / AGENT_SYSTEM_EXEC_WORKSPACE / AGENT_SYSTEM_EXEC_ENV_ROOT）。
+	ExecDepsDir   string
+	ExecWorkspace string
+	ExecEnvRoot   string
 }
 
 var (

pkg/extension/link/link.go

@@ -3,20 +3,38 @@
 package link
 
 import (
+	"os"
+
 	"agent-system-backend/internal/app"
 	"agent-system-backend/pkg/extension"
 )
 
 func init() {
 	extension.SetRunner(func(opt extension.Options) error {
-		return app.Run(app.Options{
-			Addr: opt.Addr, DataDir: opt.DataDir, PluginsDir: opt.PluginsDir, ForceMock: opt.Mock,
-			StorageDSN: opt.StorageDSN, ArtifactsDir: opt.ArtifactsDir, AuthMode: opt.AuthMode,
-			RequireProjectContext: opt.RequireProjectContext,
-			DisableUploadIndexing: opt.DisableUploadIndexing,
-			DisableConvCardMirror: opt.DisableConvCardMirror,
-			DisableExecTools:      opt.DisableExecTools,
-			ExecBackend:           opt.ExecBackend,
-		})
+		return app.Run(appOptions(opt))
 	})
 }
+
+// appOptions 把产品启动参数映射到基座。执行环境三项产品旗标留空时读环境变量，
+// 与 cmd/agent-system 的 config 键一致，这样 svc 注入环境即可，不必改产品 main。
+func appOptions(opt extension.Options) app.Options {
+	return app.Options{
+		Addr: opt.Addr, DataDir: opt.DataDir, PluginsDir: opt.PluginsDir, ForceMock: opt.Mock,
+		StorageDSN: opt.StorageDSN, ArtifactsDir: opt.ArtifactsDir, AuthMode: opt.AuthMode,
+		RequireProjectContext: opt.RequireProjectContext,
+		DisableUploadIndexing: opt.DisableUploadIndexing,
+		DisableConvCardMirror: opt.DisableConvCardMirror,
+		DisableExecTools:      opt.DisableExecTools,
+		ExecBackend:           opt.ExecBackend,
+		ExecDepsDir:           firstSet(opt.ExecDepsDir, os.Getenv("AGENT_SYSTEM_EXEC_DEPS_DIR")),
+		ExecWorkspace:         firstSet(opt.ExecWorkspace, os.Getenv("AGENT_SYSTEM_EXEC_WORKSPACE")),
+		ExecEnvRoot:           firstSet(opt.ExecEnvRoot, os.Getenv("AGENT_SYSTEM_EXEC_ENV_ROOT")),
+	}
+}
+
+func firstSet(explicit, fromEnv string) string {
+	if explicit != "" {
+		return explicit
+	}
+	return fromEnv
+}

pkg/extension/link/link_test.go

@@ -0,0 +1,38 @@
+package link
+
+import (
+	"testing"
+
+	"agent-system-backend/pkg/extension"
+)
+
+func TestAppOptionsPrefersExplicitExecPaths(t *testing.T) {
+	t.Setenv("AGENT_SYSTEM_EXEC_DEPS_DIR", "/from/env/deps")
+	t.Setenv("AGENT_SYSTEM_EXEC_WORKSPACE", "overlay")
+	t.Setenv("AGENT_SYSTEM_EXEC_ENV_ROOT", "/from/env/root")
+	got := appOptions(extension.Options{
+		ExecDepsDir:   "/explicit/deps",
+		ExecWorkspace: "direct",
+		ExecEnvRoot:   "/explicit/root",
+	})
+	if got.ExecDepsDir != "/explicit/deps" || got.ExecWorkspace != "direct" || got.ExecEnvRoot != "/explicit/root" {
+		t.Fatalf("explicit paths lost: %+v", got)
+	}
+}
+
+func TestAppOptionsReadsExecEnvWhenUnset(t *testing.T) {
+	t.Setenv("AGENT_SYSTEM_EXEC_DEPS_DIR", "/from/env/deps")
+	t.Setenv("AGENT_SYSTEM_EXEC_WORKSPACE", "overlay")
+	t.Setenv("AGENT_SYSTEM_EXEC_ENV_ROOT", "/from/env/root")
+	got := appOptions(extension.Options{ExecBackend: "sandbox"})
+	if got.ExecBackend != "sandbox" || got.ExecDepsDir != "/from/env/deps" || got.ExecWorkspace != "overlay" || got.ExecEnvRoot != "/from/env/root" {
+		t.Fatalf("env fallback: %+v", got)
+	}
+}
+
+func TestAppOptionsPreservesProjectContextRequirement(t *testing.T) {
+	got := appOptions(extension.Options{RequireProjectContext: true})
+	if !got.RequireProjectContext {
+		t.Fatal("required project context was dropped at the product entry")
+	}
+}