weichen/Agent-System-Dev
1
0
Fork 0
Code Issues 1 Pull Requests 5 Actions 2 Packages Projects Releases Wiki Activity

agent-exec transport 71865509d360ea4e44027c7530f107e0/119993e4d4f8
ci / svc-realcombo (pull_request) Successful in 2m36s
Details
ci / test (pull_request) Successful in 9m5s
Details
ci / test-pg (pull_request) Successful in 11m57s
Details

Browse Source
This commit is contained in:
agent-exec-transport
2026-10-23 01:29:43 +00:00
parent 7434a7f2a9
commit 2068d0a630
2 changed files with 18 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/facts-verify.sh
+2 -2
View File
@@ -4,7 +4,7 @@
# 用法：make facts-verify [ARGS=--update] （--update：把 PASS 项 last_verified 刷为当天并写回）
# 表内验证命令约定不含竖线；含 "\|" 转义时按字面还原后执行。
# 登记表引用的探针子命令（单独运行时在 stderr 说明判定，不输出凭据）：
# api-token URL URL 须逐字等于登记端点 https://git-home.u1680832.nyat.app:30319/api/v1/user，
# api-token URL URL 须逐字等于登记端点 https://gitea.naitangbaobao.cn/api/v1/user，
# 校验通过后才进程内读 ~/.secrets/gitea HOME 段 ACCESS_TOKEN 并 GET（不跟随重定向）；
# 0=接受 3=缺失 4=格式不符 5=请求失败/被拒/重定向 6=非登记端点
# tls-handshake-fails HOST PORT 仅当 TCP 已连通且 TLS 层握手报错时 0；
@@ -20,7 +20,7 @@ import sys, urllib.request
sys.path.insert(0, sys.argv[1])
import task_triage
ENDPOINT = "https://git-home.u1680832.nyat.app:30319/api/v1/user"
ENDPOINT = "https://gitea.naitangbaobao.cn/api/v1/user"
if sys.argv[2] != ENDPOINT:
print("api-token: URL 不是 policy/facts.md F2 登记端点，拒绝发送凭据", file=sys.stderr)
sys.exit(6)
tests/test_facts_verify.py
+16 -15
View File
@@ -256,7 +256,7 @@ class FactsVerifyTests(unittest.TestCase):
self.assert_status(result.stdout, "F2", "PASS")
requests = self.stub_events("http")
self.assertEqual(len(requests), 1, requests)
self.assertEqual(requests[0]["url"], "https://git-home.u1680832.nyat.app:30319/api/v1/user")
self.assertEqual(requests[0]["url"], "https://gitea.naitangbaobao.cn/api/v1/user")
self.assertEqual(requests[0]["authorization"], "token " + HOME_TOKEN)
self.assertEqual(self.dates(), {"F2": self.today, "F8": self.today, "F9": OLD_DATE})
self.assertTrue(receipt.exists(), result.stderr)
@@ -285,7 +285,7 @@ class FactsVerifyTests(unittest.TestCase):
self.assert_status(result.stdout, "F2", "FAIL")
self.assertEqual(self.stub_events("http"), [], "no request without a valid HOME token")
self.assertEqual(self.dates()["F2"], OLD_DATE)
direct = self.run_script("api-token", "https://git-home.u1680832.nyat.app:30319/api/v1/user")
direct = self.run_script("api-token", "https://gitea.naitangbaobao.cn/api/v1/user")
self.assertNotEqual(direct.returncode, 0)
self.assertIn("ACCESS_TOKEN", direct.stderr)
self.assert_no_secrets(result.stdout, result.stderr, direct.stdout, direct.stderr,
@@ -299,7 +299,7 @@ class FactsVerifyTests(unittest.TestCase):
result = self.run_script("--update", http=http)
self.assert_status(result.stdout, "F2", "FAIL")
self.assertEqual(self.dates(), {"F2": OLD_DATE, "F8": self.today, "F9": OLD_DATE})
direct = self.run_script("api-token", "https://git-home.u1680832.nyat.app:30319/api/v1/user",
direct = self.run_script("api-token", "https://gitea.naitangbaobao.cn/api/v1/user",
http=http)
self.assertNotEqual(direct.returncode, 0)
self.assertNotIn("Authorization", direct.stderr)
@@ -307,17 +307,18 @@ class FactsVerifyTests(unittest.TestCase):
def test_f2_rejects_unregistered_destination_before_reading_credentials(self):
bad_urls = [
"http://git-home.u1680832.nyat.app:30319/api/v1/user",
"http://gitea.naitangbaobao.cn/api/v1/user",
"https://evil.invalid/api/v1/user",
"https://git-home.u1680832.nyat.app:30320/api/v1/user",
"https://git-home.u1680832.nyat.app/api/v1/user",
"https://user:pw@git-home.u1680832.nyat.app:30319/api/v1/user",
"https://git-home.u1680832.nyat.app:30319@evil.invalid/api/v1/user",
"https://git-home.u1680832.nyat.app:30319/api/v1/user#frag",
"https://git-home.u1680832.nyat.app:30319/api/v1/user?next=https://evil.invalid",
"https://git-home.u1680832.nyat.app:30319/api/v1/users",
"https://git-home.u1680832.nyat.app:30319/api/v1/user/../admin",
"https://git-home.u1680832.nyat.app:30319/api/v1/user ",
"https://git-home.u1680832.nyat.app:30319/api/v1/user",
"https://gitea.naitangbaobao.cn:30320/api/v1/user",
"https://gitea.naitangbaobao.cn:443/api/v1/user",
"https://user:pw@gitea.naitangbaobao.cn/api/v1/user",
"https://gitea.naitangbaobao.cn@evil.invalid/api/v1/user",
"https://gitea.naitangbaobao.cn/api/v1/user#frag",
"https://gitea.naitangbaobao.cn/api/v1/user?next=https://evil.invalid",
"https://gitea.naitangbaobao.cn/api/v1/users",
"https://gitea.naitangbaobao.cn/api/v1/user/../admin",
"https://gitea.naitangbaobao.cn/api/v1/user ",
]
for secrets_present in (True, False):
if not secrets_present:
@@ -337,12 +338,12 @@ class FactsVerifyTests(unittest.TestCase):
for code in ("301", "302", "303", "307", "308"):
with self.subTest(code):
self.stub_log.unlink(missing_ok=True)
direct = self.run_script("api-token", "https://git-home.u1680832.nyat.app:30319/api/v1/user",
direct = self.run_script("api-token", "https://gitea.naitangbaobao.cn/api/v1/user",
http=code)
self.assertEqual(direct.returncode, 5, direct.stderr)
requests = self.stub_events("http")
self.assertEqual([r["url"] for r in requests],
["https://git-home.u1680832.nyat.app:30319/api/v1/user"], "no follow-up request")
["https://gitea.naitangbaobao.cn/api/v1/user"], "no follow-up request")
self.assertNotIn("redirect-target", direct.stdout + direct.stderr)
self.assert_no_secrets(direct.stdout, direct.stderr)