From 4b98e256871f17a83210da8383f7413e946bb180 Mon Sep 17 00:00:00 2001 From: weichen Date: Sun, 11 Oct 2026 14:58:36 +0000 Subject: [PATCH] Seed settings with an auto-minted temporary key when auth is on Why: seed_settings PUTs /api/settings/user without credentials, so under the PG tier's always-on auth the seed always 401s and model config silently never lands (reproduced on the dev instance 2026-10-11; settings had to be written by hand). Evidence: make test-governance && make test exit=0 (receipt 8ffc3a89); tests/test_svc.py adds three stub-based cases - auth-on seeds with a Bearer header and create/revoke around the PUT, --seed-owner skips account lookup, auth-off stays credential-free; 14/14 svc tests green. Impact: deployments that pass SVC_MODEL_*/SVC_TAVILY_KEYS now seed reliably regardless of auth mode; a temporary apikey (name=svc-seed) is minted for the first admin (or --seed-owner/SVC_SEED_OWNER) and revoked right after; auth-off path unchanged. Refs: task card feature-svc-seed-auth. --- .task/feature-svc-seed-auth.md | 38 ++++++++++++ scripts/svc.sh | 43 ++++++++++++- tests/test_svc.py | 108 ++++++++++++++++++++++++++++++++- 3 files changed, 186 insertions(+), 3 deletions(-) diff --git a/.task/feature-svc-seed-auth.md b/.task/feature-svc-seed-auth.md index 833aab2e..8987ca63 100644 --- a/.task/feature-svc-seed-auth.md +++ b/.task/feature-svc-seed-auth.md @@ -126,3 +126,41 @@ "receipt_sha256": "4ae5a0f67520322ebf88f0d7f0121266c947fb75c24f8363ea898d9cf89a765c" } ``` + + +```json +{ + "schema": 1, + "source": "SELF", + "timestamp": "2026-10-11T14:56:27.298790+00:00", + "command": "make test-governance && make test", + "command_sha256": "da1213499ef74418e6c39aeeca5981115ccc077b673fd4cda2dcb7fe6b2a4abe", + "cwd": "/home/weichen/projects/Agent-System-Dev-wt-feature-svc-seed-auth", + "common_dir": "/home/weichen/projects/Agent-System-Dev/.git", + "before": { + "head": "66756c4a51e0a27227865a652672f0f8a937357e", + "branch": "feature/svc-seed-auth", + "target_branch": "main", + "target_head": "f382544ec7829abec379b9d1bba04c4ddaac52b7", + "status": " M scripts/svc.sh\n M tests/test_svc.py\n", + "tracked_diff_sha256": "5ad9b2c3f0e4b8c5809b90d7d61b8043cb91966fcf63d0005cab53b646e2f09b", + "untracked": {}, + "submodules": " 4f583ca3eeeb07a56a714c5086de84dcd6ad2980 deps/agent-command (heads/main)\n ed2af3e6048928b1fd0ba6da1f9d0c1bafec82d4 deps/agent-command/deps/development-guidelines (remotes/origin/feature/delivery-mechanism-5-ged2af3e)\n 343b1e6d9a5b58e47bf7e594826221036ae8175c deps/agent-intent (heads/main)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-intent/deps/development-guidelines (26b562d)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 deps/agent-intent/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-intent/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 deps/agent-intent/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-intent/deps/logging-system/deps/development-guidelines (26b562d)\n c348441691e8bdab784a03aa9be64d53dacff341 deps/agent-native (heads/main)\n 343b1e6d9a5b58e47bf7e594826221036ae8175c deps/agent-native/deps/agent-intent (heads/main)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-native/deps/agent-intent/deps/development-guidelines (26b562d)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 deps/agent-native/deps/agent-intent/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-native/deps/agent-intent/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 deps/agent-native/deps/agent-intent/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-native/deps/agent-intent/deps/logging-system/deps/development-guidelines (26b562d)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-native/deps/development-guidelines (26b562d)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 deps/agent-native/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-native/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 deps/agent-native/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-native/deps/logging-system/deps/development-guidelines (26b562d)\n 490b0b2dfa1567cb16ff7a7230fd78e52bc2938e deps/agent-squad (heads/main)\n 343b1e6d9a5b58e47bf7e594826221036ae8175c deps/agent-squad/deps/agent-intent (heads/main)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-squad/deps/agent-intent/deps/development-guidelines (26b562d)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 deps/agent-squad/deps/agent-intent/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-squad/deps/agent-intent/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 deps/agent-squad/deps/agent-intent/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-squad/deps/agent-intent/deps/logging-system/deps/development-guidelines (26b562d)\n c348441691e8bdab784a03aa9be64d53dacff341 deps/agent-squad/deps/agent-native (heads/main)\n 343b1e6d9a5b58e47bf7e594826221036ae8175c deps/agent-squad/deps/agent-native/deps/agent-intent (heads/main)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-squad/deps/agent-native/deps/agent-intent/deps/development-guidelines (26b562d)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 deps/agent-squad/deps/agent-native/deps/agent-intent/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-squad/deps/agent-native/deps/agent-intent/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 deps/agent-squad/deps/agent-native/deps/agent-intent/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-squad/deps/agent-native/deps/agent-intent/deps/logging-system/deps/development-guidelines (26b562d)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-squad/deps/agent-native/deps/development-guidelines (26b562d)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 deps/agent-squad/deps/agent-native/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-squad/deps/agent-native/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 deps/agent-squad/deps/agent-native/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-squad/deps/agent-native/deps/logging-system/deps/development-guidelines (26b562d)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-squad/deps/development-guidelines (26b562d)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 deps/agent-squad/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-squad/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 deps/agent-squad/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-squad/deps/logging-system/deps/development-guidelines (26b562d)\n af199eeaa23c5b39e08b4649f2513d7572dc5274 deps/development-guidelines (heads/main)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/logging-system/deps/development-guidelines (26b562d)\n eb12f102f23d8d026c3458be7ea8b2fef07ada93 modules/backend (v0.3.0-70-geb12f10)\n 4f583ca3eeeb07a56a714c5086de84dcd6ad2980 modules/backend/deps/agent-command (heads/main)\n ed2af3e6048928b1fd0ba6da1f9d0c1bafec82d4 modules/backend/deps/agent-command/deps/development-guidelines (remotes/origin/feature/delivery-mechanism-5-ged2af3e)\n 343b1e6d9a5b58e47bf7e594826221036ae8175c modules/backend/deps/agent-intent (heads/main)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-intent/deps/development-guidelines (26b562d)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 modules/backend/deps/agent-intent/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-intent/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 modules/backend/deps/agent-intent/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-intent/deps/logging-system/deps/development-guidelines (26b562d)\n c348441691e8bdab784a03aa9be64d53dacff341 modules/backend/deps/agent-native (heads/main)\n 343b1e6d9a5b58e47bf7e594826221036ae8175c modules/backend/deps/agent-native/deps/agent-intent (heads/main)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-native/deps/agent-intent/deps/development-guidelines (26b562d)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 modules/backend/deps/agent-native/deps/agent-intent/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-native/deps/agent-intent/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 modules/backend/deps/agent-native/deps/agent-intent/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-native/deps/agent-intent/deps/logging-system/deps/development-guidelines (26b562d)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-native/deps/development-guidelines (26b562d)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 modules/backend/deps/agent-native/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-native/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 modules/backend/deps/agent-native/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-native/deps/logging-system/deps/development-guidelines (26b562d)\n 490b0b2dfa1567cb16ff7a7230fd78e52bc2938e modules/backend/deps/agent-squad (heads/main)\n 343b1e6d9a5b58e47bf7e594826221036ae8175c modules/backend/deps/agent-squad/deps/agent-intent (heads/main)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-squad/deps/agent-intent/deps/development-guidelines (26b562d)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 modules/backend/deps/agent-squad/deps/agent-intent/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-squad/deps/agent-intent/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 modules/backend/deps/agent-squad/deps/agent-intent/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-squad/deps/agent-intent/deps/logging-system/deps/development-guidelines (26b562d)\n c348441691e8bdab784a03aa9be64d53dacff341 modules/backend/deps/agent-squad/deps/agent-native (heads/main)\n 343b1e6d9a5b58e47bf7e594826221036ae8175c modules/backend/deps/agent-squad/deps/agent-native/deps/agent-intent (heads/main)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-squad/deps/agent-native/deps/agent-intent/deps/development-guidelines (26b562d)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 modules/backend/deps/agent-squad/deps/agent-native/deps/agent-intent/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-squad/deps/agent-native/deps/agent-intent/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 modules/backend/deps/agent-squad/deps/agent-native/deps/agent-intent/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-squad/deps/agent-native/deps/agent-intent/deps/logging-system/deps/development-guidelines (26b562d)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-squad/deps/agent-native/deps/development-guidelines (26b562d)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 modules/backend/deps/agent-squad/deps/agent-native/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-squad/deps/agent-native/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 modules/backend/deps/agent-squad/deps/agent-native/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-squad/deps/agent-native/deps/logging-system/deps/development-guidelines (26b562d)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-squad/deps/development-guidelines (26b562d)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 modules/backend/deps/agent-squad/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-squad/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 modules/backend/deps/agent-squad/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-squad/deps/logging-system/deps/development-guidelines (26b562d)\n 89f3906c390027512ef47b5333088c3d3a019e84 modules/backend/deps/agent-system-core (v0.3.0-9-g89f3906)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 modules/backend/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 modules/backend/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/logging-system/deps/development-guidelines (26b562d)\n 89f3906c390027512ef47b5333088c3d3a019e84 modules/core (v0.3.0-9-g89f3906)\n 75ddd65c6910320186a8a1104eb2d94cd42b7610 modules/documents (heads/main)\n 2c56054861709ae00e33e23845d5ac18b0060ab2 modules/frontend (v0.3.0-18-g2c56054)\n f2331b02d6a7d09e6eaad5cfb4cfa9e51dd71ef2 modules/ui (v0.3.0-16-gf2331b0)\n" + }, + "after": { + "head": "66756c4a51e0a27227865a652672f0f8a937357e", + "branch": "feature/svc-seed-auth", + "target_branch": "main", + "target_head": "f382544ec7829abec379b9d1bba04c4ddaac52b7", + "status": " M scripts/svc.sh\n M tests/test_svc.py\n", + "tracked_diff_sha256": "5ad9b2c3f0e4b8c5809b90d7d61b8043cb91966fcf63d0005cab53b646e2f09b", + "untracked": {}, + "submodules": " 4f583ca3eeeb07a56a714c5086de84dcd6ad2980 deps/agent-command (heads/main)\n ed2af3e6048928b1fd0ba6da1f9d0c1bafec82d4 deps/agent-command/deps/development-guidelines (remotes/origin/feature/delivery-mechanism-5-ged2af3e)\n 343b1e6d9a5b58e47bf7e594826221036ae8175c deps/agent-intent (heads/main)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-intent/deps/development-guidelines (26b562d)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 deps/agent-intent/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-intent/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 deps/agent-intent/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-intent/deps/logging-system/deps/development-guidelines (26b562d)\n c348441691e8bdab784a03aa9be64d53dacff341 deps/agent-native (heads/main)\n 343b1e6d9a5b58e47bf7e594826221036ae8175c deps/agent-native/deps/agent-intent (heads/main)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-native/deps/agent-intent/deps/development-guidelines (26b562d)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 deps/agent-native/deps/agent-intent/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-native/deps/agent-intent/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 deps/agent-native/deps/agent-intent/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-native/deps/agent-intent/deps/logging-system/deps/development-guidelines (26b562d)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-native/deps/development-guidelines (26b562d)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 deps/agent-native/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-native/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 deps/agent-native/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-native/deps/logging-system/deps/development-guidelines (26b562d)\n 490b0b2dfa1567cb16ff7a7230fd78e52bc2938e deps/agent-squad (heads/main)\n 343b1e6d9a5b58e47bf7e594826221036ae8175c deps/agent-squad/deps/agent-intent (heads/main)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-squad/deps/agent-intent/deps/development-guidelines (26b562d)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 deps/agent-squad/deps/agent-intent/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-squad/deps/agent-intent/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 deps/agent-squad/deps/agent-intent/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-squad/deps/agent-intent/deps/logging-system/deps/development-guidelines (26b562d)\n c348441691e8bdab784a03aa9be64d53dacff341 deps/agent-squad/deps/agent-native (heads/main)\n 343b1e6d9a5b58e47bf7e594826221036ae8175c deps/agent-squad/deps/agent-native/deps/agent-intent (heads/main)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-squad/deps/agent-native/deps/agent-intent/deps/development-guidelines (26b562d)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 deps/agent-squad/deps/agent-native/deps/agent-intent/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-squad/deps/agent-native/deps/agent-intent/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 deps/agent-squad/deps/agent-native/deps/agent-intent/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-squad/deps/agent-native/deps/agent-intent/deps/logging-system/deps/development-guidelines (26b562d)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-squad/deps/agent-native/deps/development-guidelines (26b562d)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 deps/agent-squad/deps/agent-native/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-squad/deps/agent-native/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 deps/agent-squad/deps/agent-native/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-squad/deps/agent-native/deps/logging-system/deps/development-guidelines (26b562d)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-squad/deps/development-guidelines (26b562d)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 deps/agent-squad/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-squad/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 deps/agent-squad/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/agent-squad/deps/logging-system/deps/development-guidelines (26b562d)\n af199eeaa23c5b39e08b4649f2513d7572dc5274 deps/development-guidelines (heads/main)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 deps/logging-system/deps/development-guidelines (26b562d)\n eb12f102f23d8d026c3458be7ea8b2fef07ada93 modules/backend (v0.3.0-70-geb12f10)\n 4f583ca3eeeb07a56a714c5086de84dcd6ad2980 modules/backend/deps/agent-command (heads/main)\n ed2af3e6048928b1fd0ba6da1f9d0c1bafec82d4 modules/backend/deps/agent-command/deps/development-guidelines (remotes/origin/feature/delivery-mechanism-5-ged2af3e)\n 343b1e6d9a5b58e47bf7e594826221036ae8175c modules/backend/deps/agent-intent (heads/main)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-intent/deps/development-guidelines (26b562d)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 modules/backend/deps/agent-intent/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-intent/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 modules/backend/deps/agent-intent/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-intent/deps/logging-system/deps/development-guidelines (26b562d)\n c348441691e8bdab784a03aa9be64d53dacff341 modules/backend/deps/agent-native (heads/main)\n 343b1e6d9a5b58e47bf7e594826221036ae8175c modules/backend/deps/agent-native/deps/agent-intent (heads/main)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-native/deps/agent-intent/deps/development-guidelines (26b562d)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 modules/backend/deps/agent-native/deps/agent-intent/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-native/deps/agent-intent/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 modules/backend/deps/agent-native/deps/agent-intent/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-native/deps/agent-intent/deps/logging-system/deps/development-guidelines (26b562d)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-native/deps/development-guidelines (26b562d)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 modules/backend/deps/agent-native/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-native/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 modules/backend/deps/agent-native/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-native/deps/logging-system/deps/development-guidelines (26b562d)\n 490b0b2dfa1567cb16ff7a7230fd78e52bc2938e modules/backend/deps/agent-squad (heads/main)\n 343b1e6d9a5b58e47bf7e594826221036ae8175c modules/backend/deps/agent-squad/deps/agent-intent (heads/main)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-squad/deps/agent-intent/deps/development-guidelines (26b562d)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 modules/backend/deps/agent-squad/deps/agent-intent/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-squad/deps/agent-intent/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 modules/backend/deps/agent-squad/deps/agent-intent/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-squad/deps/agent-intent/deps/logging-system/deps/development-guidelines (26b562d)\n c348441691e8bdab784a03aa9be64d53dacff341 modules/backend/deps/agent-squad/deps/agent-native (heads/main)\n 343b1e6d9a5b58e47bf7e594826221036ae8175c modules/backend/deps/agent-squad/deps/agent-native/deps/agent-intent (heads/main)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-squad/deps/agent-native/deps/agent-intent/deps/development-guidelines (26b562d)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 modules/backend/deps/agent-squad/deps/agent-native/deps/agent-intent/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-squad/deps/agent-native/deps/agent-intent/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 modules/backend/deps/agent-squad/deps/agent-native/deps/agent-intent/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-squad/deps/agent-native/deps/agent-intent/deps/logging-system/deps/development-guidelines (26b562d)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-squad/deps/agent-native/deps/development-guidelines (26b562d)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 modules/backend/deps/agent-squad/deps/agent-native/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-squad/deps/agent-native/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 modules/backend/deps/agent-squad/deps/agent-native/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-squad/deps/agent-native/deps/logging-system/deps/development-guidelines (26b562d)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-squad/deps/development-guidelines (26b562d)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 modules/backend/deps/agent-squad/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-squad/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 modules/backend/deps/agent-squad/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/agent-squad/deps/logging-system/deps/development-guidelines (26b562d)\n 89f3906c390027512ef47b5333088c3d3a019e84 modules/backend/deps/agent-system-core (v0.3.0-9-g89f3906)\n a3ee67bba269e1276c14e22c026171ecf2cf6190 modules/backend/deps/error-code-system (a3ee67b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/error-code-system/deps/development-guidelines (26b562d)\n 49b5d8be604d05e4246dffa0d10fa1c2b7ad45d7 modules/backend/deps/logging-system (49b5d8b)\n 26b562d2e34fbc560711296a309c91c74ffc55b1 modules/backend/deps/logging-system/deps/development-guidelines (26b562d)\n 89f3906c390027512ef47b5333088c3d3a019e84 modules/core (v0.3.0-9-g89f3906)\n 75ddd65c6910320186a8a1104eb2d94cd42b7610 modules/documents (heads/main)\n 2c56054861709ae00e33e23845d5ac18b0060ab2 modules/frontend (v0.3.0-18-g2c56054)\n f2331b02d6a7d09e6eaad5cfb4cfa9e51dd71ef2 modules/ui (v0.3.0-16-gf2331b0)\n" + }, + "after_error": null, + "exit_code": 0, + "output": "make[1]: Entering directory '/home/weichen/projects/Agent-System-Dev-wt-feature-svc-seed-auth'\nPYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tests -p 'test_*.py' -v\ntest_candidate_cannot_read_checkout_credentials (test_ci_credentials.CheckoutTests.test_candidate_cannot_read_checkout_credentials) ... ok\ntest_candidate_submodule_update_commands_are_rejected (test_ci_credentials.CheckoutTests.test_candidate_submodule_update_commands_are_rejected) ... ok\ntest_credential_destination_confined_to_injected_server (test_ci_credentials.CheckoutTests.test_credential_destination_confined_to_injected_server) ... ok\ntest_external_or_unlisted_urls_are_rejected_before_component_fetch (test_ci_credentials.CheckoutTests.test_external_or_unlisted_urls_are_rejected_before_component_fetch) ... ok\ntest_inherited_template_hook_does_not_execute_with_credentials (test_ci_credentials.CheckoutTests.test_inherited_template_hook_does_not_execute_with_credentials) ... ok\ntest_nested_external_url_is_rejected_before_authenticated_fetch (test_ci_credentials.CheckoutTests.test_nested_external_url_is_rejected_before_authenticated_fetch) ... ok\ntest_recursive_gitlinks_materialize_exact_sha_without_persisting_credentials (test_ci_credentials.CheckoutTests.test_recursive_gitlinks_materialize_exact_sha_without_persisting_credentials) ... ok\ntest_redirects_do_not_forward_credential_or_fetch_unlisted_target (test_ci_credentials.CheckoutTests.test_redirects_do_not_forward_credential_or_fetch_unlisted_target) ... ok\ntest_after_snapshot_failure_keeps_command_exit_and_output (test_evidence.EvidenceTests.test_after_snapshot_failure_keeps_command_exit_and_output) ... ok\ntest_all_persisted_and_displayed_text_is_sanitized (test_evidence.EvidenceTests.test_all_persisted_and_displayed_text_is_sanitized) ... ok\ntest_authorization_forms_are_redacted_in_capture_console_and_import (test_evidence.EvidenceTests.test_authorization_forms_are_redacted_in_capture_console_and_import) ... ok\ntest_authorization_forms_are_redacted_on_direct_card_capture (test_evidence.EvidenceTests.test_authorization_forms_are_redacted_on_direct_card_capture) ... ok\ntest_before_after_heads_do_not_relabel_changed_command (test_evidence.EvidenceTests.test_before_after_heads_do_not_relabel_changed_command) ... ok\ntest_capture_does_not_overwrite_an_existing_receipt (test_evidence.EvidenceTests.test_capture_does_not_overwrite_an_existing_receipt) ... ok\ntest_capture_without_card_and_import_without_rerun (test_evidence.EvidenceTests.test_capture_without_card_and_import_without_rerun) ... ok\ntest_child_failure_code_is_preserved (test_evidence.EvidenceTests.test_child_failure_code_is_preserved) ... ok\ntest_command_line_token_arguments_are_redacted (test_evidence.EvidenceTests.test_command_line_token_arguments_are_redacted) ... ok\ntest_dirty_and_untracked_contents_have_object_digests (test_evidence.EvidenceTests.test_dirty_and_untracked_contents_have_object_digests) ... ok\ntest_failed_child_exit_survives_receipt_write_failure (test_evidence.EvidenceTests.test_failed_child_exit_survives_receipt_write_failure) ... ok\ntest_full_output_is_preserved_not_only_tail (test_evidence.EvidenceTests.test_full_output_is_preserved_not_only_tail) ... ok\ntest_import_missing_card_fails_without_losing_receipt (test_evidence.EvidenceTests.test_import_missing_card_fails_without_losing_receipt) ... ok\ntest_import_rejects_unredacted_authorization_with_valid_checksums (test_evidence.EvidenceTests.test_import_rejects_unredacted_authorization_with_valid_checksums) ... ok\ntest_import_retry_is_idempotent (test_evidence.EvidenceTests.test_import_retry_is_idempotent) ... ok\ntest_invalid_field_types_and_forged_source_are_rejected (test_evidence.EvidenceTests.test_invalid_field_types_and_forged_source_are_rejected) ... ok\ntest_known_secret_environment_value_is_redacted_without_label (test_evidence.EvidenceTests.test_known_secret_environment_value_is_redacted_without_label) ... ok\ntest_linked_worktree_import_preserves_source_identity (test_evidence.EvidenceTests.test_linked_worktree_import_preserves_source_identity) ... ok\ntest_missing_card_does_not_execute (test_evidence.EvidenceTests.test_missing_card_does_not_execute) ... ok\ntest_missing_required_snapshot_fields_are_rejected (test_evidence.EvidenceTests.test_missing_required_snapshot_fields_are_rejected) ... ok\ntest_nested_cwd_records_untracked_files_from_repository_root (test_evidence.EvidenceTests.test_nested_cwd_records_untracked_files_from_repository_root) ... ok\ntest_output_digest_checked_even_if_receipt_digest_recomputed (test_evidence.EvidenceTests.test_output_digest_checked_even_if_receipt_digest_recomputed) ... ok\ntest_pipeline_failure_is_recorded_and_returned (test_evidence.EvidenceTests.test_pipeline_failure_is_recorded_and_returned) ... ok\ntest_quoted_credentials_with_spaces_are_fully_redacted (test_evidence.EvidenceTests.test_quoted_credentials_with_spaces_are_fully_redacted) ... ok\ntest_receipt_write_failure_cannot_claim_success (test_evidence.EvidenceTests.test_receipt_write_failure_cannot_claim_success) ... ok\ntest_recorder_environment_does_not_leak_into_nested_commands (test_evidence.EvidenceTests.test_recorder_environment_does_not_leak_into_nested_commands) ... ok\ntest_source_cannot_be_promoted_by_environment (test_evidence.EvidenceTests.test_source_cannot_be_promoted_by_environment) ... ok\ntest_tamper_is_rejected_before_card_append (test_evidence.EvidenceTests.test_tamper_is_rejected_before_card_append) ... ok\ntest_unrelated_repo_cannot_import (test_evidence.EvidenceTests.test_unrelated_repo_cannot_import) ... ok\ntest_validate_precheck_checks_result_and_current_base (test_evidence.EvidenceTests.test_validate_precheck_checks_result_and_current_base) ... ok\ntest_validate_precheck_rejects_successful_arbitrary_command (test_evidence.EvidenceTests.test_validate_precheck_rejects_successful_arbitrary_command) ... ok\ntest_addr_change_keeps_database_and_auth (test_svc.SvcDbRecoveryTests.test_addr_change_keeps_database_and_auth) ... ok\ntest_auth_preflight_aligns_with_effective_env_dsn (test_svc.SvcDbRecoveryTests.test_auth_preflight_aligns_with_effective_env_dsn) ... ok\ntest_dbref_binding_survives_bare_restart_and_redeploy (test_svc.SvcDbRecoveryTests.test_dbref_binding_survives_bare_restart_and_redeploy) ... ok\ntest_explicit_unbind_blocks_residual_env_dsn (test_svc.SvcDbRecoveryTests.test_explicit_unbind_blocks_residual_env_dsn) ... ok\ntest_external_dsn_and_conffile_recover_on_bare_start (test_svc.SvcDbRecoveryTests.test_external_dsn_and_conffile_recover_on_bare_start) ... ok\ntest_legacy_exec_dsn_survives_consecutive_restarts (test_svc.SvcDbRecoveryTests.test_legacy_exec_dsn_survives_consecutive_restarts) ... ok\ntest_mock_conflict_and_legacy_binary_refuse (test_svc.SvcDbRecoveryTests.test_mock_conflict_and_legacy_binary_refuse) ... ok\ntest_refusals_keep_registration_without_sqlite_fallback (test_svc.SvcDbRecoveryTests.test_refusals_keep_registration_without_sqlite_fallback) ... ok\ntest_restart_refusal_happens_before_stopping_running_service (test_svc.SvcDbRecoveryTests.test_restart_refusal_happens_before_stopping_running_service) ... ok\ntest_seed_owner_override_skips_account_lookup (test_svc.SvcDbRecoveryTests.test_seed_owner_override_skips_account_lookup) ... ok\ntest_seed_puts_with_temporary_bearer_key_when_auth_on (test_svc.SvcDbRecoveryTests.test_seed_puts_with_temporary_bearer_key_when_auth_on) ... ok\ntest_seed_puts_without_credentials_when_auth_off (test_svc.SvcDbRecoveryTests.test_seed_puts_without_credentials_when_auth_off) ... ok\ntest_sequential_restarts_no_cross_dsn_and_no_secret_leak (test_svc.SvcDbRecoveryTests.test_sequential_restarts_no_cross_dsn_and_no_secret_leak) ... ok\ntest_update_preserves_binding (test_svc.SvcDbRecoveryTests.test_update_preserves_binding) ... ok\ntest_addr_defaults_to_default_addr (test_svc_precheck.AgentListenRejectedPrecheck.test_addr_defaults_to_default_addr) ... ok\ntest_incident_combo_not_rejected (test_svc_precheck.AgentListenRejectedPrecheck.test_incident_combo_not_rejected) ... ok\ntest_insecure_not_rejected (test_svc_precheck.AgentListenRejectedPrecheck.test_insecure_not_rejected) ... ok\ntest_loopback_not_rejected (test_svc_precheck.AgentListenRejectedPrecheck.test_loopback_not_rejected) ... ok\ntest_nonloop_auth_off_with_dsn_rejected (test_svc_precheck.AgentListenRejectedPrecheck.test_nonloop_auth_off_with_dsn_rejected) ... ok\ntest_nonloop_no_dsn_rejected (test_svc_precheck.AgentListenRejectedPrecheck.test_nonloop_no_dsn_rejected) ... ok\ntest_auth_off_beats_dsn (test_svc_precheck.DbAuthEnabledMatrix.test_auth_off_beats_dsn) ... ok\ntest_auth_on_explicit (test_svc_precheck.DbAuthEnabledMatrix.test_auth_on_explicit) ... ok\ntest_auto_with_effective_dsn_is_authed (test_svc_precheck.DbAuthEnabledMatrix.test_auto_with_effective_dsn_is_authed) ... ok\ntest_auto_without_dsn_is_denied (test_svc_precheck.DbAuthEnabledMatrix.test_auto_without_dsn_is_denied) ... ok\ntest_no_auth_no_dsn_denied (test_svc_precheck.DbAuthEnabledMatrix.test_no_auth_no_dsn_denied) ... ok\ntest_broken_dbref_refuses (test_svc_precheck.ResolveDbConfigFixtures.test_broken_dbref_refuses) ... ok\ntest_legacy_exec_dsn_migrates_to_recoverable_keys (test_svc_precheck.ResolveDbConfigFixtures.test_legacy_exec_dsn_migrates_to_recoverable_keys) ... ok\ntest_legacy_exec_dsn_without_instance_goes_to_dsn_key (test_svc_precheck.ResolveDbConfigFixtures.test_legacy_exec_dsn_without_instance_goes_to_dsn_key) ... ok\ntest_migration_is_idempotent (test_svc_precheck.ResolveDbConfigFixtures.test_migration_is_idempotent) ... ok\ntest_no_dsn_no_dbref_is_sqlite (test_svc_precheck.ResolveDbConfigFixtures.test_no_dsn_no_dbref_is_sqlite) ... ok\ntest_post_g17_exec_restores_dsn_from_dbref (test_svc_precheck.ResolveDbConfigFixtures.test_post_g17_exec_restores_dsn_from_dbref) ... ok\ntest_env_config_resets_resolver_state (test_svc_precheck.ResolverStateIsolation.test_env_config_resets_resolver_state) ... ok\ntest_ide_lock_in_git_dir_does_not_block_finish (test_task.FinishGuardFixTests.test_ide_lock_in_git_dir_does_not_block_finish) ... ok\ntest_local_default_branch_at_origin_main_does_not_block (test_task.FinishGuardFixTests.test_local_default_branch_at_origin_main_does_not_block)\n克隆默认分支停在 origin/main 顶端（pin 为 feature 顶端时不在其历史内） ... ok\ntest_local_unique_commit_still_preserved (test_task.FinishGuardFixTests.test_local_unique_commit_still_preserved) ... ok\ntest_real_git_lock_still_blocks_finish (test_task.FinishGuardFixTests.test_real_git_lock_still_blocks_finish) ... ok\ntest_remote_tracking_refs_do_not_block_finish (test_task.FinishGuardFixTests.test_remote_tracking_refs_do_not_block_finish) ... ok\ntest_finish_abandon_retains_local_remote_tips_and_reason (test_task.TaskLifecycleTests.test_finish_abandon_retains_local_remote_tips_and_reason) ... ok\ntest_finish_abandon_without_reason_preserves_checkout_and_refs (test_task.TaskLifecycleTests.test_finish_abandon_without_reason_preserves_checkout_and_refs) ... ok\ntest_finish_clean_worktree_has_accurate_remote_result (test_task.TaskLifecycleTests.test_finish_clean_worktree_has_accurate_remote_result) ... ok\ntest_finish_deletes_only_merged_remote_branch (test_task.TaskLifecycleTests.test_finish_deletes_only_merged_remote_branch) ... ok\ntest_finish_preserves_component_commits_off_the_pinned_head (test_task.TaskLifecycleTests.test_finish_preserves_component_commits_off_the_pinned_head) ... ok\ntest_finish_preserves_component_untracked_file (test_task.TaskLifecycleTests.test_finish_preserves_component_untracked_file) ... ok\ntest_finish_preserves_linked_component_worktrees_at_the_pinned_head (test_task.TaskLifecycleTests.test_finish_preserves_linked_component_worktrees_at_the_pinned_head) ... ok\ntest_finish_preserves_linked_nested_component_worktree (test_task.TaskLifecycleTests.test_finish_preserves_linked_nested_component_worktree) ... ok\ntest_finish_preserves_locked_worktree (test_task.TaskLifecycleTests.test_finish_preserves_locked_worktree) ... ok\ntest_finish_preserves_main_and_active_index_lock (test_task.TaskLifecycleTests.test_finish_preserves_main_and_active_index_lock) ... ok\ntest_finish_preserves_modified_untracked_and_ignored_files (test_task.TaskLifecycleTests.test_finish_preserves_modified_untracked_and_ignored_files) ... ok\ntest_finish_preserves_remote_unmerged_tip (test_task.TaskLifecycleTests.test_finish_preserves_remote_unmerged_tip) ... ok\ntest_finish_recycles_clean_submodule_without_shared_config_changes (test_task.TaskLifecycleTests.test_finish_recycles_clean_submodule_without_shared_config_changes) ... ok\ntest_finish_rejects_subdirectory_without_deleting_it (test_task.TaskLifecycleTests.test_finish_rejects_subdirectory_without_deleting_it) ... ok\ntest_finish_remote_deletion_lease_preserves_concurrent_update (test_task.TaskLifecycleTests.test_finish_remote_deletion_lease_preserves_concurrent_update) ... ok\ntest_finish_requires_writer_exit_confirmation (test_task.TaskLifecycleTests.test_finish_requires_writer_exit_confirmation) ... ok\ntest_post_merge_is_silent_outside_main_checkout (test_task.TaskLifecycleTests.test_post_merge_is_silent_outside_main_checkout) ... ok\ntest_post_merge_main_merge_only_reminds_owner (test_task.TaskLifecycleTests.test_post_merge_main_merge_only_reminds_owner) ... ok\ntest_post_merge_main_pull_only_reminds_owner (test_task.TaskLifecycleTests.test_post_merge_main_pull_only_reminds_owner) ... ok\ntest_precheck_feature_behind_requires_sync (test_task.TaskLifecycleTests.test_precheck_feature_behind_requires_sync) ... ok\ntest_precheck_rejects_unreachable_authority (test_task.TaskLifecycleTests.test_precheck_rejects_unreachable_authority) ... ok\ntest_precheck_routes_existing_project_delivery_policy (test_task.TaskLifecycleTests.test_precheck_routes_existing_project_delivery_policy) ... ok\ntest_start_imports_precheck_and_creates_four_part_commit (test_task.TaskLifecycleTests.test_start_imports_precheck_and_creates_four_part_commit) ... ok\ntest_start_offline_does_not_create_worktree (test_task.TaskLifecycleTests.test_start_offline_does_not_create_worktree) ... ok\ntest_start_preserves_merged_local_and_remote_branch_names (test_task.TaskLifecycleTests.test_start_preserves_merged_local_and_remote_branch_names) ... ok\ntest_start_rejects_receipt_when_authoritative_base_changed (test_task.TaskLifecycleTests.test_start_rejects_receipt_when_authoritative_base_changed) ... ok\ntest_start_requires_precheck_receipt_before_creating_worktree (test_task.TaskLifecycleTests.test_start_requires_precheck_receipt_before_creating_worktree) ... ok\ntest_start_stacked_branch_records_parent_and_main_baseline (test_task.TaskLifecycleTests.test_start_stacked_branch_records_parent_and_main_baseline) ... ok\ntest_sync_commit_failure_never_reports_synced (test_task.TaskLifecycleTests.test_sync_commit_failure_never_reports_synced) ... ok\ntest_sync_does_not_execute_json_receipt_command (test_task.TaskLifecycleTests.test_sync_does_not_execute_json_receipt_command) ... ok\ntest_sync_keeps_json_evidence_fresh_after_metadata_only_changes (test_task.TaskLifecycleTests.test_sync_keeps_json_evidence_fresh_after_metadata_only_changes) ... ok\ntest_sync_keeps_unchanged_component_branch (test_task.TaskLifecycleTests.test_sync_keeps_unchanged_component_branch) ... ok\ntest_sync_materializes_nested_detached_components (test_task.TaskLifecycleTests.test_sync_materializes_nested_detached_components) ... ok\ntest_sync_materializes_updated_component (test_task.TaskLifecycleTests.test_sync_materializes_updated_component) ... ok\ntest_sync_preserves_component_feature_branch (test_task.TaskLifecycleTests.test_sync_preserves_component_feature_branch) ... ok\ntest_sync_preserves_dirty_child (test_task.TaskLifecycleTests.test_sync_preserves_dirty_child) ... ok\ntest_sync_preserves_nested_feature_branch_when_parent_pin_changes (test_task.TaskLifecycleTests.test_sync_preserves_nested_feature_branch_when_parent_pin_changes) ... ok\ntest_sync_reads_legacy_commands_with_escaped_pipes (test_task.TaskLifecycleTests.test_sync_reads_legacy_commands_with_escaped_pipes) ... ok\ntest_sync_still_warns_for_stale_legacy_table_evidence (test_task.TaskLifecycleTests.test_sync_still_warns_for_stale_legacy_table_evidence) ... ok\ntest_sync_warns_for_malformed_json_evidence (test_task.TaskLifecycleTests.test_sync_warns_for_malformed_json_evidence) ... ok\ntest_sync_warns_for_missing_json_receipt_fields_even_with_valid_checksum (test_task.TaskLifecycleTests.test_sync_warns_for_missing_json_receipt_fields_even_with_valid_checksum) ... ok\ntest_sync_warns_for_unresolved_json_evidence_head (test_task.TaskLifecycleTests.test_sync_warns_for_unresolved_json_evidence_head) ... ok\ntest_sync_warns_for_unresolved_legacy_evidence_head (test_task.TaskLifecycleTests.test_sync_warns_for_unresolved_legacy_evidence_head) ... ok\ntest_sync_warns_when_json_after_state_contains_uncommitted_code (test_task.TaskLifecycleTests.test_sync_warns_when_json_after_state_contains_uncommitted_code) ... ok\ntest_sync_warns_when_json_before_state_contains_uncommitted_code (test_task.TaskLifecycleTests.test_sync_warns_when_json_before_state_contains_uncommitted_code) ... ok\ntest_sync_warns_when_json_evidence_predates_noncard_changes (test_task.TaskLifecycleTests.test_sync_warns_when_json_evidence_predates_noncard_changes) ... ok\ntest_verify_rejects_recursive_drift_even_when_root_has_local_edits (test_task.TaskLifecycleTests.test_verify_rejects_recursive_drift_even_when_root_has_local_edits) ... ok\ntest_verify_rejects_uninitialized_component (test_task.TaskLifecycleTests.test_verify_rejects_uninitialized_component) ... ok\ntest_deleting_main_symlink_to_outside_is_denied (test_write_guard.WriteGuardTests.test_deleting_main_symlink_to_outside_is_denied) ... ok\ntest_detached_and_bad_branches_are_denied (test_write_guard.WriteGuardTests.test_detached_and_bad_branches_are_denied) ... ok\ntest_every_patch_file_and_move_destination_is_checked (test_write_guard.WriteGuardTests.test_every_patch_file_and_move_destination_is_checked) ... ok\ntest_feature_missing_parent_is_allowed (test_write_guard.WriteGuardTests.test_feature_missing_parent_is_allowed) ... ok\ntest_invalid_json_is_denied (test_write_guard.WriteGuardTests.test_invalid_json_is_denied) ... ok\ntest_missing_parent_on_main_is_denied (test_write_guard.WriteGuardTests.test_missing_parent_on_main_is_denied) ... ok\ntest_missing_unknown_and_malformed_write_input_are_denied (test_write_guard.WriteGuardTests.test_missing_unknown_and_malformed_write_input_are_denied) ... ok\ntest_non_git_destination_is_explicitly_outside_scope (test_write_guard.WriteGuardTests.test_non_git_destination_is_explicitly_outside_scope) ... ok\ntest_nonwrite_tools_are_outside_scope (test_write_guard.WriteGuardTests.test_nonwrite_tools_are_outside_scope) ... ok\ntest_relative_path_uses_hook_cwd_not_process_cwd (test_write_guard.WriteGuardTests.test_relative_path_uses_hook_cwd_not_process_cwd) ... ok\ntest_symlink_into_main_with_missing_parents_is_denied (test_write_guard.WriteGuardTests.test_symlink_into_main_with_missing_parents_is_denied) ... ok\ntest_valid_multi_file_patch_on_feature_is_allowed (test_write_guard.WriteGuardTests.test_valid_multi_file_patch_on_feature_is_allowed) ... ok\n\n----------------------------------------------------------------------\nRan 136 tests in 37.940s\n\nOK\nmake[1]: Leaving directory '/home/weichen/projects/Agent-System-Dev-wt-feature-svc-seed-auth'\nmake[1]: Entering directory '/home/weichen/projects/Agent-System-Dev-wt-feature-svc-seed-auth'\npython3 scripts/check-worktree.py verify\n[worktree] verify: recursive component checks passed\nPYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tests -p 'test_*.py' -v\ntest_candidate_cannot_read_checkout_credentials (test_ci_credentials.CheckoutTests.test_candidate_cannot_read_checkout_credentials) ... ok\ntest_candidate_submodule_update_commands_are_rejected (test_ci_credentials.CheckoutTests.test_candidate_submodule_update_commands_are_rejected) ... ok\ntest_credential_destination_confined_to_injected_server (test_ci_credentials.CheckoutTests.test_credential_destination_confined_to_injected_server) ... ok\ntest_external_or_unlisted_urls_are_rejected_before_component_fetch (test_ci_credentials.CheckoutTests.test_external_or_unlisted_urls_are_rejected_before_component_fetch) ... ok\ntest_inherited_template_hook_does_not_execute_with_credentials (test_ci_credentials.CheckoutTests.test_inherited_template_hook_does_not_execute_with_credentials) ... ok\ntest_nested_external_url_is_rejected_before_authenticated_fetch (test_ci_credentials.CheckoutTests.test_nested_external_url_is_rejected_before_authenticated_fetch) ... ok\ntest_recursive_gitlinks_materialize_exact_sha_without_persisting_credentials (test_ci_credentials.CheckoutTests.test_recursive_gitlinks_materialize_exact_sha_without_persisting_credentials) ... ok\ntest_redirects_do_not_forward_credential_or_fetch_unlisted_target (test_ci_credentials.CheckoutTests.test_redirects_do_not_forward_credential_or_fetch_unlisted_target) ... ok\ntest_after_snapshot_failure_keeps_command_exit_and_output (test_evidence.EvidenceTests.test_after_snapshot_failure_keeps_command_exit_and_output) ... ok\ntest_all_persisted_and_displayed_text_is_sanitized (test_evidence.EvidenceTests.test_all_persisted_and_displayed_text_is_sanitized) ... ok\ntest_authorization_forms_are_redacted_in_capture_console_and_import (test_evidence.EvidenceTests.test_authorization_forms_are_redacted_in_capture_console_and_import) ... ok\ntest_authorization_forms_are_redacted_on_direct_card_capture (test_evidence.EvidenceTests.test_authorization_forms_are_redacted_on_direct_card_capture) ... ok\ntest_before_after_heads_do_not_relabel_changed_command (test_evidence.EvidenceTests.test_before_after_heads_do_not_relabel_changed_command) ... ok\ntest_capture_does_not_overwrite_an_existing_receipt (test_evidence.EvidenceTests.test_capture_does_not_overwrite_an_existing_receipt) ... ok\ntest_capture_without_card_and_import_without_rerun (test_evidence.EvidenceTests.test_capture_without_card_and_import_without_rerun) ... ok\ntest_child_failure_code_is_preserved (test_evidence.EvidenceTests.test_child_failure_code_is_preserved) ... ok\ntest_command_line_token_arguments_are_redacted (test_evidence.EvidenceTests.test_command_line_token_arguments_are_redacted) ... ok\ntest_dirty_and_untracked_contents_have_object_digests (test_evidence.EvidenceTests.test_dirty_and_untracked_contents_have_object_digests) ... ok\ntest_failed_child_exit_survives_receipt_write_failure (test_evidence.EvidenceTests.test_failed_child_exit_survives_receipt_write_failure) ... ok\ntest_full_output_is_preserved_not_only_tail (test_evidence.EvidenceTests.test_full_output_is_preserved_not_only_tail) ... ok\ntest_import_missing_card_fails_without_losing_receipt (test_evidence.EvidenceTests.test_import_missing_card_fails_without_losing_receipt) ... ok\ntest_import_rejects_unredacted_authorization_with_valid_checksums (test_evidence.EvidenceTests.test_import_rejects_unredacted_authorization_with_valid_checksums) ... ok\ntest_import_retry_is_idempotent (test_evidence.EvidenceTests.test_import_retry_is_idempotent) ... ok\ntest_invalid_field_types_and_forged_source_are_rejected (test_evidence.EvidenceTests.test_invalid_field_types_and_forged_source_are_rejected) ... ok\ntest_known_secret_environment_value_is_redacted_without_label (test_evidence.EvidenceTests.test_known_secret_environment_value_is_redacted_without_label) ... ok\ntest_linked_worktree_import_preserves_source_identity (test_evidence.EvidenceTests.test_linked_worktree_import_preserves_source_identity) ... ok\ntest_missing_card_does_not_execute (test_evidence.EvidenceTests.test_missing_card_does_not_execute) ... ok\ntest_missing_required_snapshot_fields_are_rejected (test_evidence.EvidenceTests.test_missing_required_snapshot_fields_are_rejected) ... ok\ntest_nested_cwd_records_untracked_files_from_repository_root (test_evidence.EvidenceTests.test_nested_cwd_records_untracked_files_from_repository_root) ... ok\ntest_output_digest_checked_even_if_receipt_digest_recomputed (test_evidence.EvidenceTests.test_output_digest_checked_even_if_receipt_digest_recomputed) ... ok\ntest_pipeline_failure_is_recorded_and_returned (test_evidence.EvidenceTests.test_pipeline_failure_is_recorded_and_returned) ... ok\ntest_quoted_credentials_with_spaces_are_fully_redacted (test_evidence.EvidenceTests.test_quoted_credentials_with_spaces_are_fully_redacted) ... ok\ntest_receipt_write_failure_cannot_claim_success (test_evidence.EvidenceTests.test_receipt_write_failure_cannot_claim_success) ... ok\ntest_recorder_environment_does_not_leak_into_nested_commands (test_evidence.EvidenceTests.test_recorder_environment_does_not_leak_into_nested_commands) ... ok\ntest_source_cannot_be_promoted_by_environment (test_evidence.EvidenceTests.test_source_cannot_be_promoted_by_environment) ... ok\ntest_tamper_is_rejected_before_card_append (test_evidence.EvidenceTests.test_tamper_is_rejected_before_card_append) ... ok\ntest_unrelated_repo_cannot_import (test_evidence.EvidenceTests.test_unrelated_repo_cannot_import) ... ok\ntest_validate_precheck_checks_result_and_current_base (test_evidence.EvidenceTests.test_validate_precheck_checks_result_and_current_base) ... ok\ntest_validate_precheck_rejects_successful_arbitrary_command (test_evidence.EvidenceTests.test_validate_precheck_rejects_successful_arbitrary_command) ... ok\ntest_addr_change_keeps_database_and_auth (test_svc.SvcDbRecoveryTests.test_addr_change_keeps_database_and_auth) ... ok\ntest_auth_preflight_aligns_with_effective_env_dsn (test_svc.SvcDbRecoveryTests.test_auth_preflight_aligns_with_effective_env_dsn) ... ok\ntest_dbref_binding_survives_bare_restart_and_redeploy (test_svc.SvcDbRecoveryTests.test_dbref_binding_survives_bare_restart_and_redeploy) ... ok\ntest_explicit_unbind_blocks_residual_env_dsn (test_svc.SvcDbRecoveryTests.test_explicit_unbind_blocks_residual_env_dsn) ... ok\ntest_external_dsn_and_conffile_recover_on_bare_start (test_svc.SvcDbRecoveryTests.test_external_dsn_and_conffile_recover_on_bare_start) ... ok\ntest_legacy_exec_dsn_survives_consecutive_restarts (test_svc.SvcDbRecoveryTests.test_legacy_exec_dsn_survives_consecutive_restarts) ... ok\ntest_mock_conflict_and_legacy_binary_refuse (test_svc.SvcDbRecoveryTests.test_mock_conflict_and_legacy_binary_refuse) ... ok\ntest_refusals_keep_registration_without_sqlite_fallback (test_svc.SvcDbRecoveryTests.test_refusals_keep_registration_without_sqlite_fallback) ... ok\ntest_restart_refusal_happens_before_stopping_running_service (test_svc.SvcDbRecoveryTests.test_restart_refusal_happens_before_stopping_running_service) ... ok\ntest_seed_owner_override_skips_account_lookup (test_svc.SvcDbRecoveryTests.test_seed_owner_override_skips_account_lookup) ... ok\ntest_seed_puts_with_temporary_bearer_key_when_auth_on (test_svc.SvcDbRecoveryTests.test_seed_puts_with_temporary_bearer_key_when_auth_on) ... ok\ntest_seed_puts_without_credentials_when_auth_off (test_svc.SvcDbRecoveryTests.test_seed_puts_without_credentials_when_auth_off) ... ok\ntest_sequential_restarts_no_cross_dsn_and_no_secret_leak (test_svc.SvcDbRecoveryTests.test_sequential_restarts_no_cross_dsn_and_no_secret_leak) ... ok\ntest_update_preserves_binding (test_svc.SvcDbRecoveryTests.test_update_preserves_binding) ... ok\ntest_addr_defaults_to_default_addr (test_svc_precheck.AgentListenRejectedPrecheck.test_addr_defaults_to_default_addr) ... ok\ntest_incident_combo_not_rejected (test_svc_precheck.AgentListenRejectedPrecheck.test_incident_combo_not_rejected) ... ok\ntest_insecure_not_rejected (test_svc_precheck.AgentListenRejectedPrecheck.test_insecure_not_rejected) ... ok\ntest_loopback_not_rejected (test_svc_precheck.AgentListenRejectedPrecheck.test_loopback_not_rejected) ... ok\ntest_nonloop_auth_off_with_dsn_rejected (test_svc_precheck.AgentListenRejectedPrecheck.test_nonloop_auth_off_with_dsn_rejected) ... ok\ntest_nonloop_no_dsn_rejected (test_svc_precheck.AgentListenRejectedPrecheck.test_nonloop_no_dsn_rejected) ... ok\ntest_auth_off_beats_dsn (test_svc_precheck.DbAuthEnabledMatrix.test_auth_off_beats_dsn) ... ok\ntest_auth_on_explicit (test_svc_precheck.DbAuthEnabledMatrix.test_auth_on_explicit) ... ok\ntest_auto_with_effective_dsn_is_authed (test_svc_precheck.DbAuthEnabledMatrix.test_auto_with_effective_dsn_is_authed) ... ok\ntest_auto_without_dsn_is_denied (test_svc_precheck.DbAuthEnabledMatrix.test_auto_without_dsn_is_denied) ... ok\ntest_no_auth_no_dsn_denied (test_svc_precheck.DbAuthEnabledMatrix.test_no_auth_no_dsn_denied) ... ok\ntest_broken_dbref_refuses (test_svc_precheck.ResolveDbConfigFixtures.test_broken_dbref_refuses) ... ok\ntest_legacy_exec_dsn_migrates_to_recoverable_keys (test_svc_precheck.ResolveDbConfigFixtures.test_legacy_exec_dsn_migrates_to_recoverable_keys) ... ok\ntest_legacy_exec_dsn_without_instance_goes_to_dsn_key (test_svc_precheck.ResolveDbConfigFixtures.test_legacy_exec_dsn_without_instance_goes_to_dsn_key) ... ok\ntest_migration_is_idempotent (test_svc_precheck.ResolveDbConfigFixtures.test_migration_is_idempotent) ... ok\ntest_no_dsn_no_dbref_is_sqlite (test_svc_precheck.ResolveDbConfigFixtures.test_no_dsn_no_dbref_is_sqlite) ... ok\ntest_post_g17_exec_restores_dsn_from_dbref (test_svc_precheck.ResolveDbConfigFixtures.test_post_g17_exec_restores_dsn_from_dbref) ... ok\ntest_env_config_resets_resolver_state (test_svc_precheck.ResolverStateIsolation.test_env_config_resets_resolver_state) ... ok\ntest_ide_lock_in_git_dir_does_not_block_finish (test_task.FinishGuardFixTests.test_ide_lock_in_git_dir_does_not_block_finish) ... ok\ntest_local_default_branch_at_origin_main_does_not_block (test_task.FinishGuardFixTests.test_local_default_branch_at_origin_main_does_not_block)\n克隆默认分支停在 origin/main 顶端（pin 为 feature 顶端时不在其历史内） ... ok\ntest_local_unique_commit_still_preserved (test_task.FinishGuardFixTests.test_local_unique_commit_still_preserved) ... ok\ntest_real_git_lock_still_blocks_finish (test_task.FinishGuardFixTests.test_real_git_lock_still_blocks_finish) ... ok\ntest_remote_tracking_refs_do_not_block_finish (test_task.FinishGuardFixTests.test_remote_tracking_refs_do_not_block_finish) ... ok\ntest_finish_abandon_retains_local_remote_tips_and_reason (test_task.TaskLifecycleTests.test_finish_abandon_retains_local_remote_tips_and_reason) ... ok\ntest_finish_abandon_without_reason_preserves_checkout_and_refs (test_task.TaskLifecycleTests.test_finish_abandon_without_reason_preserves_checkout_and_refs) ... ok\ntest_finish_clean_worktree_has_accurate_remote_result (test_task.TaskLifecycleTests.test_finish_clean_worktree_has_accurate_remote_result) ... ok\ntest_finish_deletes_only_merged_remote_branch (test_task.TaskLifecycleTests.test_finish_deletes_only_merged_remote_branch) ... ok\ntest_finish_preserves_component_commits_off_the_pinned_head (test_task.TaskLifecycleTests.test_finish_preserves_component_commits_off_the_pinned_head) ... ok\ntest_finish_preserves_component_untracked_file (test_task.TaskLifecycleTests.test_finish_preserves_component_untracked_file) ... ok\ntest_finish_preserves_linked_component_worktrees_at_the_pinned_head (test_task.TaskLifecycleTests.test_finish_preserves_linked_component_worktrees_at_the_pinned_head) ... ok\ntest_finish_preserves_linked_nested_component_worktree (test_task.TaskLifecycleTests.test_finish_preserves_linked_nested_component_worktree) ... ok\ntest_finish_preserves_locked_worktree (test_task.TaskLifecycleTests.test_finish_preserves_locked_worktree) ... ok\ntest_finish_preserves_main_and_active_index_lock (test_task.TaskLifecycleTests.test_finish_preserves_main_and_active_index_lock) ... ok\ntest_finish_preserves_modified_untracked_and_ignored_files (test_task.TaskLifecycleTests.test_finish_preserves_modified_untracked_and_ignored_files) ... ok\ntest_finish_preserves_remote_unmerged_tip (test_task.TaskLifecycleTests.test_finish_preserves_remote_unmerged_tip) ... ok\ntest_finish_recycles_clean_submodule_without_shared_config_changes (test_task.TaskLifecycleTests.test_finish_recycles_clean_submodule_without_shared_config_changes) ... ok\ntest_finish_rejects_subdirectory_without_deleting_it (test_task.TaskLifecycleTests.test_finish_rejects_subdirectory_without_deleting_it) ... ok\ntest_finish_remote_deletion_lease_preserves_concurrent_update (test_task.TaskLifecycleTests.test_finish_remote_deletion_lease_preserves_concurrent_update) ... ok\ntest_finish_requires_writer_exit_confirmation (test_task.TaskLifecycleTests.test_finish_requires_writer_exit_confirmation) ... ok\ntest_post_merge_is_silent_outside_main_checkout (test_task.TaskLifecycleTests.test_post_merge_is_silent_outside_main_checkout) ... ok\ntest_post_merge_main_merge_only_reminds_owner (test_task.TaskLifecycleTests.test_post_merge_main_merge_only_reminds_owner) ... ok\ntest_post_merge_main_pull_only_reminds_owner (test_task.TaskLifecycleTests.test_post_merge_main_pull_only_reminds_owner) ... ok\ntest_precheck_feature_behind_requires_sync (test_task.TaskLifecycleTests.test_precheck_feature_behind_requires_sync) ... ok\ntest_precheck_rejects_unreachable_authority (test_task.TaskLifecycleTests.test_precheck_rejects_unreachable_authority) ... ok\ntest_precheck_routes_existing_project_delivery_policy (test_task.TaskLifecycleTests.test_precheck_routes_existing_project_delivery_policy) ... ok\ntest_start_imports_precheck_and_creates_four_part_commit (test_task.TaskLifecycleTests.test_start_imports_precheck_and_creates_four_part_commit) ... ok\ntest_start_offline_does_not_create_worktree (test_task.TaskLifecycleTests.test_start_offline_does_not_create_worktree) ... ok\ntest_start_preserves_merged_local_and_remote_branch_names (test_task.TaskLifecycleTests.test_start_preserves_merged_local_and_remote_branch_names) ... ok\ntest_start_rejects_receipt_when_authoritative_base_changed (test_task.TaskLifecycleTests.test_start_rejects_receipt_when_authoritative_base_changed) ... ok\ntest_start_requires_precheck_receipt_before_creating_worktree (test_task.TaskLifecycleTests.test_start_requires_precheck_receipt_before_creating_worktree) ... ok\ntest_start_stacked_branch_records_parent_and_main_baseline (test_task.TaskLifecycleTests.test_start_stacked_branch_records_parent_and_main_baseline) ... ok\ntest_sync_commit_failure_never_reports_synced (test_task.TaskLifecycleTests.test_sync_commit_failure_never_reports_synced) ... ok\ntest_sync_does_not_execute_json_receipt_command (test_task.TaskLifecycleTests.test_sync_does_not_execute_json_receipt_command) ... ok\ntest_sync_keeps_json_evidence_fresh_after_metadata_only_changes (test_task.TaskLifecycleTests.test_sync_keeps_json_evidence_fresh_after_metadata_only_changes) ... ok\ntest_sync_keeps_unchanged_component_branch (test_task.TaskLifecycleTests.test_sync_keeps_unchanged_component_branch) ... ok\ntest_sync_materializes_nested_detached_components (test_task.TaskLifecycleTests.test_sync_materializes_nested_detached_components) ... ok\ntest_sync_materializes_updated_component (test_task.TaskLifecycleTests.test_sync_materializes_updated_component) ... ok\ntest_sync_preserves_component_feature_branch (test_task.TaskLifecycleTests.test_sync_preserves_component_feature_branch) ... ok\ntest_sync_preserves_dirty_child (test_task.TaskLifecycleTests.test_sync_preserves_dirty_child) ... ok\ntest_sync_preserves_nested_feature_branch_when_parent_pin_changes (test_task.TaskLifecycleTests.test_sync_preserves_nested_feature_branch_when_parent_pin_changes) ... ok\ntest_sync_reads_legacy_commands_with_escaped_pipes (test_task.TaskLifecycleTests.test_sync_reads_legacy_commands_with_escaped_pipes) ... ok\ntest_sync_still_warns_for_stale_legacy_table_evidence (test_task.TaskLifecycleTests.test_sync_still_warns_for_stale_legacy_table_evidence) ... ok\ntest_sync_warns_for_malformed_json_evidence (test_task.TaskLifecycleTests.test_sync_warns_for_malformed_json_evidence) ... ok\ntest_sync_warns_for_missing_json_receipt_fields_even_with_valid_checksum (test_task.TaskLifecycleTests.test_sync_warns_for_missing_json_receipt_fields_even_with_valid_checksum) ... ok\ntest_sync_warns_for_unresolved_json_evidence_head (test_task.TaskLifecycleTests.test_sync_warns_for_unresolved_json_evidence_head) ... ok\ntest_sync_warns_for_unresolved_legacy_evidence_head (test_task.TaskLifecycleTests.test_sync_warns_for_unresolved_legacy_evidence_head) ... ok\ntest_sync_warns_when_json_after_state_contains_uncommitted_code (test_task.TaskLifecycleTests.test_sync_warns_when_json_after_state_contains_uncommitted_code) ... ok\ntest_sync_warns_when_json_before_state_contains_uncommitted_code (test_task.TaskLifecycleTests.test_sync_warns_when_json_before_state_contains_uncommitted_code) ... ok\ntest_sync_warns_when_json_evidence_predates_noncard_changes (test_task.TaskLifecycleTests.test_sync_warns_when_json_evidence_predates_noncard_changes) ... ok\ntest_verify_rejects_recursive_drift_even_when_root_has_local_edits (test_task.TaskLifecycleTests.test_verify_rejects_recursive_drift_even_when_root_has_local_edits) ... ok\ntest_verify_rejects_uninitialized_component (test_task.TaskLifecycleTests.test_verify_rejects_uninitialized_component) ... ok\ntest_deleting_main_symlink_to_outside_is_denied (test_write_guard.WriteGuardTests.test_deleting_main_symlink_to_outside_is_denied) ... ok\ntest_detached_and_bad_branches_are_denied (test_write_guard.WriteGuardTests.test_detached_and_bad_branches_are_denied) ... ok\ntest_every_patch_file_and_move_destination_is_checked (test_write_guard.WriteGuardTests.test_every_patch_file_and_move_destination_is_checked) ... ok\ntest_feature_missing_parent_is_allowed (test_write_guard.WriteGuardTests.test_feature_missing_parent_is_allowed) ... ok\ntest_invalid_json_is_denied (test_write_guard.WriteGuardTests.test_invalid_json_is_denied) ... ok\ntest_missing_parent_on_main_is_denied (test_write_guard.WriteGuardTests.test_missing_parent_on_main_is_denied) ... ok\ntest_missing_unknown_and_malformed_write_input_are_denied (test_write_guard.WriteGuardTests.test_missing_unknown_and_malformed_write_input_are_denied) ... ok\ntest_non_git_destination_is_explicitly_outside_scope (test_write_guard.WriteGuardTests.test_non_git_destination_is_explicitly_outside_scope) ... ok\ntest_nonwrite_tools_are_outside_scope (test_write_guard.WriteGuardTests.test_nonwrite_tools_are_outside_scope) ... ok\ntest_relative_path_uses_hook_cwd_not_process_cwd (test_write_guard.WriteGuardTests.test_relative_path_uses_hook_cwd_not_process_cwd) ... ok\ntest_symlink_into_main_with_missing_parents_is_denied (test_write_guard.WriteGuardTests.test_symlink_into_main_with_missing_parents_is_denied) ... ok\ntest_valid_multi_file_patch_on_feature_is_allowed (test_write_guard.WriteGuardTests.test_valid_multi_file_patch_on_feature_is_allowed) ... ok\n\n----------------------------------------------------------------------\nRan 136 tests in 38.016s\n\nOK\nbash scripts/lint-boundaries.sh\narchitecture ok (81 edges)\narchitecture negative ok\nboundaries ok\nbash scripts/check-pins.sh\nok modules/backend agent-command\nok modules/backend agent-intent\nok modules/backend agent-native\nok modules/backend agent-squad\nok modules/backend agent-system-core\nok modules/backend error-code-system\nok modules/backend logging-system\nok deps/agent-native agent-intent\nwarn: deps/agent-native deps/development-guidelines is 26b562d2e34f, Dev is af199eeaa23c\nok deps/agent-native error-code-system\nok deps/agent-native logging-system\nok deps/agent-squad agent-intent\nok deps/agent-squad agent-native\nwarn: deps/agent-squad deps/development-guidelines is 26b562d2e34f, Dev is af199eeaa23c\nok deps/agent-squad error-code-system\nok deps/agent-squad logging-system\nwarn: deps/agent-intent deps/development-guidelines is 26b562d2e34f, Dev is af199eeaa23c\nok deps/agent-intent error-code-system\nok deps/agent-intent logging-system\npins ok\ncd deps/agent-intent && GOWORK=off go vet ./... && GOWORK=off go test -count=1 ./...\nok \tagent-intent/catalogcheck\t0.002s\nok \tagent-intent/cmd/intentctl\t0.002s\nok \tagent-intent/conformance\t0.002s\nok \tagent-intent/examples\t0.002s\nok \tagent-intent/intent\t0.005s\nok \tagent-intent/schema\t0.002s\ncd deps/agent-native && GOWORK=off go vet ./... && GOWORK=off go test -count=1 ./...\nok \tagent-native/adapters/native\t0.196s\nok \tagent-native/adapters/pitransport\t0.040s\nok \tagent-native/catalogcheck\t0.002s\n? \tagent-native/cmd/agent-native\t[no test files]\nok \tagent-native/conformance\t0.052s\nok \tagent-native/exec\t0.158s\nok \tagent-native/rpc\t0.005s\nok \tagent-native/runtime\t1.295s\nok \tagent-native/runtime/agentspec\t0.003s\nok \tagent-native/runtime/checkpoint\t0.004s\nok \tagent-native/runtime/codeorch\t0.084s\nok \tagent-native/runtime/ext\t0.024s\n? \tagent-native/runtime/ext/pkg\t[no test files]\nok \tagent-native/runtime/filestate\t0.022s\nok \tagent-native/runtime/gates\t0.003s\nok \tagent-native/runtime/guardrails\t0.002s\nok \tagent-native/runtime/hooks\t0.002s\nok \tagent-native/runtime/llm\t0.250s\nok \tagent-native/runtime/mcp\t13.244s\nok \tagent-native/runtime/memory\t0.003s\nok \tagent-native/runtime/policy\t0.002s\nok \tagent-native/runtime/promptx\t0.003s\nok \tagent-native/runtime/reminders\t0.002s\nok \tagent-native/runtime/resources\t0.003s\nok \tagent-native/runtime/session\t0.011s\nok \tagent-native/runtime/skills\t0.003s\nok \tagent-native/runtime/subagent\t0.004s\nok \tagent-native/runtime/telemetry\t0.003s\nok \tagent-native/runtime/tools\t11.278s\nok \tagent-native/schema\t0.002s\ncd deps/agent-squad && GOWORK=off go vet ./... && GOWORK=off go test -count=1 ./...\nok \tagent-squad/schema\t0.002s\nok \tagent-squad/squad\t0.961s\nok \tagent-squad/store\t0.003s\nok \tagent-squad/textextract\t0.002s\ncd deps/agent-squad/adapters/intent && GOWORK=off go vet ./... && GOWORK=off go test -count=1 ./...\nok \tagent-squad/adapters/intent\t0.007s\ncd deps/agent-squad/adapters/native && GOWORK=off go vet ./... && GOWORK=off go test -count=1 ./...\nok \tagent-squad/adapters/native\t0.003s\ncd deps/agent-squad/adapters/sqlite && GOWORK=off go vet ./... && GOWORK=off go test -count=1 ./...\nok \tagent-squad/adapters/sqlite\t0.014s\ncd deps/agent-squad/cmd/agent-squad && GOWORK=off go vet ./... && GOWORK=off go test -count=1 ./...\n? \tagent-squad/cmd/agent-squad\t[no test files]\nok \tagent-squad/cmd/agent-squad/cli\t0.003s\nok \tagent-squad/cmd/agent-squad/conformance\t0.005s\nok \tagent-squad/cmd/agent-squad/server\t0.568s\ncd modules/core && go test ./...\nok \tagent-system-core\t0.003s\ncd modules/backend && go test ./...\n? \tagent-system-backend/cmd/agent-system\t[no test files]\nok \tagent-system-backend/cmd/storage-migrate\t0.050s\nok \tagent-system-backend/eval\t0.003s\nok \tagent-system-backend/internal/app\t0.107s\nok \tagent-system-backend/internal/blobstore\t0.002s\nok \tagent-system-backend/internal/bus\t0.002s\nok \tagent-system-backend/internal/cardsvc\t0.085s\nok \tagent-system-backend/internal/cmdbus\t0.015s\nok \tagent-system-backend/internal/config\t0.003s\nok \tagent-system-backend/internal/ctxasm\t0.005s\nok \tagent-system-backend/internal/docgen\t0.005s\nok \tagent-system-backend/internal/evalgold\t0.002s\nok \tagent-system-backend/internal/genui\t0.034s\nok \tagent-system-backend/internal/hostapi\t0.024s\nok \tagent-system-backend/internal/ingest\t0.531s\nok \tagent-system-backend/internal/intentgate\t0.003s\nok \tagent-system-backend/internal/intentsem\t0.003s\nok \tagent-system-backend/internal/pgbus\t0.003s\nok \tagent-system-backend/internal/plugins\t0.176s\n? \tagent-system-backend/internal/profiles\t[no test files]\nok \tagent-system-backend/internal/prompts\t0.048s\nok \tagent-system-backend/internal/quality\t0.107s\nok \tagent-system-backend/internal/rag\t0.111s\nok \tagent-system-backend/internal/ratelimit\t0.254s\nok \tagent-system-backend/internal/route\t0.002s\nok \tagent-system-backend/internal/runmgr\t0.569s\nok \tagent-system-backend/internal/runtime\t1.228s\nok \tagent-system-backend/internal/server\t5.767s\nok \tagent-system-backend/internal/settings\t0.014s\nok \tagent-system-backend/internal/skills\t1.249s\nok \tagent-system-backend/internal/squadadapter\t0.094s\nok \tagent-system-backend/internal/store\t1.839s\nok \tagent-system-backend/internal/surfacesvc\t0.080s\nok \tagent-system-backend/internal/tools\t13.185s\nok \tagent-system-backend/internal/wfcompile\t0.040s\nok \tagent-system-backend/internal/workflow\t0.002s\nok \tagent-system-backend/pkg/extension\t0.003s\n? \tagent-system-backend/pkg/extension/link\t[no test files]\n? \tagent-system-backend/web\t[no test files]\ncp modules/core/ts/types.ts modules/frontend/src/contracts.ts.tmp\n{ echo \"// 从 Agent-System-Core ts/types.ts 同步（make contracts 生成；Core 为权威）。\"; cat modules/frontend/src/contracts.ts.tmp; } > modules/frontend/src/contracts.ts\nrm modules/frontend/src/contracts.ts.tmp\ncp modules/core/ts/types.ts modules/ui/src/contracts.ts.tmp\n{ echo \"// 从 Agent-System-Core ts/types.ts 同步（make contracts 生成；Core 为权威）。\"; cat modules/ui/src/contracts.ts.tmp; } > modules/ui/src/contracts.ts\nrm modules/ui/src/contracts.ts.tmp\ncd modules/frontend && npm ci --no-fund --no-audit && npx vitest run && node scripts/check-knip.mjs\nnpm warn deprecated uuid@10.0.0: uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).\n\nadded 173 packages in 1s\nnpm warn install-scripts 1 package has install scripts not yet covered by allowScripts:\nnpm warn install-scripts esbuild@0.25.12 (postinstall: node install.js)\nnpm warn install-scripts\nnpm warn install-scripts Run `npm install-scripts ls` to review, or `npm install-scripts approve ` to allow.\n\n RUN v4.1.11 /home/weichen/projects/Agent-System-Dev-wt-feature-svc-seed-auth/modules/frontend\n\n ✓ test/contracts.test.ts (5 tests) 4ms\n ✓ test/design-guard.test.ts (6 tests) 9ms\n ✓ src/surface_action.test.ts (1 test) 6ms\n ✓ test/html-sinks.test.ts (1 test) 4ms\n(node:2916830) ExperimentalWarning: localStorage is not available because --localstorage-file was not provided.\n(Use `node --trace-warnings ...` to show where the warning was created)\n ✓ test/preview-empty-state.test.ts (3 tests) 3ms\n ✓ test/previewtabs.test.ts (2 tests) 4ms\n ✓ test/tasklist.test.ts (6 tests) 6ms\n ✓ test/toolkind.test.ts (5 tests) 5ms\n ✓ test/previewfit.test.ts (4 tests) 6ms\n(node:2916879) ExperimentalWarning: localStorage is not available because --localstorage-file was not provided.\n(Use `node --trace-warnings ...` to show where the warning was created)\n ✓ test/messageparts.test.ts (11 tests) 8ms\n ✓ test/live.test.ts (19 tests) 9ms\n ✓ test/outbox.test.ts (3 tests) 5ms\n ✓ test/scrollsync.test.ts (2 tests) 3ms\n ✓ test/workspaces.test.ts (3 tests) 4ms\n(node:2916887) ExperimentalWarning: localStorage is not available because --localstorage-file was not provided.\n(Use `node --trace-warnings ...` to show where the warning was created)\n(node:2916883) ExperimentalWarning: localStorage is not available because --localstorage-file was not provided.\n(Use `node --trace-warnings ...` to show where the warning was created)\n(node:2916889) ExperimentalWarning: localStorage is not available because --localstorage-file was not provided.\n(Use `node --trace-warnings ...` to show where the warning was created)\n ✓ test/auth.test.ts (5 tests) 26ms\n ✓ test/theme.test.ts (3 tests) 3ms\n ✓ src/surface.test.ts (2 tests) 4ms\n ✓ test/send.test.ts (4 tests) 3ms\n ✓ test/loginpage.test.ts (6 tests) 3ms\n ✓ test/notice.test.ts (2 tests) 7ms\n ✓ src/runstate.test.ts (2 tests) 299ms\n\n Test Files 21 passed (21)\n Tests 95 passed (95)\n Start at 14:58:22\n Duration 535ms (transform 1.70s, setup 0ms, import 2.49s, tests 419ms, environment 2ms)\n\nknip unused exports 42 <= 43\ncd modules/ui && npm ci --no-fund --no-audit && npx tsc --noEmit && npx vitest run && node scripts/check-knip.mjs\nnpm warn deprecated whatwg-encoding@3.1.1: Use @exodus/bytes instead for a more spec-conformant and faster implementation\n\nadded 162 packages in 669ms\n\n RUN v4.1.11 /home/weichen/projects/Agent-System-Dev-wt-feature-svc-seed-auth/modules/ui\n\n ✓ test/contrast-guard.test.ts (19 tests) 9ms\n ✓ test/design-guard.test.ts (9 tests) 8ms\n ✓ test/html-sinks.test.ts (1 test) 5ms\n ✓ test/safe-html.test.tsx (3 tests) 52ms\n ✓ test/toolblock.test.tsx (4 tests) 78ms\n ✓ test/collapsible.test.tsx (5 tests) 84ms\n ✓ test/surfaceview.test.tsx (4 tests) 72ms\n ✓ test/ui.test.tsx (6 tests) 64ms\n ✓ test/overlay-host.test.tsx (6 tests) 68ms\nstderr | test/file-preview.test.tsx > OfficePreview 注入槽 > renders via injected loader and surfaces errors\n[preview:docx] 坏.docx Error: bad zip\n at docx (/home/weichen/projects/Agent-System-Dev-wt-feature-svc-seed-auth/modules/ui/test/file-preview.test.tsx:69:61)\n at /home/weichen/projects/Agent-System-Dev-wt-feature-svc-seed-auth/modules/ui/src/FilePreview.tsx:169:5\n at Object.react_stack_bottom_frame (/home/weichen/projects/Agent-System-Dev-wt-feature-svc-seed-auth/modules/ui/node_modules/react-dom/cjs/react-dom-client.development.js:28656:20)\n at runWithFiberInDEV (/home/weichen/projects/Agent-System-Dev-wt-feature-svc-seed-auth/modules/ui/node_modules/react-dom/cjs/react-dom-client.development.js:1048:13)\n at commitHookEffectListMount (/home/weichen/projects/Agent-System-Dev-wt-feature-svc-seed-auth/modules/ui/node_modules/react-dom/cjs/react-dom-client.development.js:13748:29)\n at commitHookPassiveMountEffects (/home/weichen/projects/Agent-System-Dev-wt-feature-svc-seed-auth/modules/ui/node_modules/react-dom/cjs/react-dom-client.development.js:13835:11)\n at commitPassiveMountOnFiber (/home/weichen/projects/Agent-System-Dev-wt-feature-svc-seed-auth/modules/ui/node_modules/react-dom/cjs/react-dom-client.development.js:16906:13)\n at recursivelyTraversePassiveMountEffects (/home/weichen/projects/Agent-System-Dev-wt-feature-svc-seed-auth/modules/ui/node_modules/react-dom/cjs/react-dom-client.development.js:16851:13)\n at commitPassiveMountOnFiber (/home/weichen/projects/Agent-System-Dev-wt-feature-svc-seed-auth/modules/ui/node_modules/react-dom/cjs/react-dom-client.development.js:17183:11)\n at recursivelyTraversePassiveMountEffects (/home/weichen/projects/Agent-System-Dev-wt-feature-svc-seed-auth/modules/ui/node_modules/react-dom/cjs/react-dom-client.development.js:16851:13)\n\n ✓ test/tabstrip.test.tsx (3 tests) 83ms\n ✓ test/inbox.test.tsx (13 tests) 90ms\n ✓ test/card-anchor.test.tsx (4 tests) 100ms\n ✓ test/file-preview.test.tsx (9 tests) 89ms\n ✓ test/inline-confirm.test.tsx (7 tests) 110ms\n ✓ test/capability.test.tsx (14 tests) 156ms\n\n Test Files 15 passed (15)\n Tests 107 passed (107)\n Start at 14:58:26\n Duration 668ms (transform 483ms, setup 0ms, import 1.55s, tests 1.07s, environment 3.85s)\n\nknip unused exports 57 <= 57\ncd deps/agent-command && go vet ./... && go test -count=1 ./...\nok \tagent-command\t0.002s\nok \tagent-command/conformance\t0.002s\nmake[1]: Leaving directory '/home/weichen/projects/Agent-System-Dev-wt-feature-svc-seed-auth'\n", + "output_sha256": "5b4f8b8341abd86bf7902ffcbd311cf927d5765372890b94d799a6fbc4802a39", + "receipt_sha256": "8ffc3a89631023f22e25ba3be03b15cda614142c2b7ab96fc6a96f6972d36246" +} +``` diff --git a/scripts/svc.sh b/scripts/svc.sh index aff3f6de..01bbb6cf 100755 --- a/scripts/svc.sh +++ b/scripts/svc.sh @@ -46,6 +46,7 @@ # config [--no-restart] agent 更换使用的配置文件（schema 校验通过才切换， # 运行中自动重启即时生效；--clear 移除；无参查看当前配置与生效值） # --model-base/--model-key/--model-name 与 --light-*/--tavily-keys 启动后播种设置 +# （认证开启时自动铸临时密钥完成写入，--seed-owner 指定目标账号） # -- <剩余参数> 原样透传给 agent-system serve（escape hatch） # db create：--user U（默认 agent）--password P（缺省自动生成）--db NAME --auth-mode scram-sha-256|md5 # db backup：--db X --out F db restore：--file F --db X --force @@ -410,7 +411,10 @@ dotenv 格式：KEY=VALUE，支持 # 注释、成对引号、export 前缀；只 SVC_MODEL_BASE/KEY/NAME 主模型（agent 启动健康后播种） SVC_LIGHT_BASE/KEY/NAME 轻量模型 SVC_TAVILY_KEYS Tavily 密钥池 + SVC_SEED_OWNER 播种目标账号（缺省取库内首个管理员） 播种幂等：设置持久化在 agent 数据目录，播过一次后续启动无需再传。 +认证开启（PG 档默认）时播种自动铸临时密钥（name=svc-seed，用后即回收）， +不依赖手动到设置页配置。 持久化语义： - deploy/start 成功（健康探测通过）后把当前态写入 svc.env（600，临时文件原子替换）； @@ -531,6 +535,7 @@ CLI_ADDR=""; CLI_HOST=""; CLI_PORT=""; CLI_DATA=""; CLI_DSN="" CLI_AUTH=""; CLI_MOCK=0; CLI_PLUGINS=""; CLI_EXTRA=""; CLI_LOGS_N="" CLI_MBASE=""; CLI_MKEY=""; CLI_MNAME="" CLI_LBASE=""; CLI_LKEY=""; CLI_LNAME=""; CLI_TAVILY="" +CLI_SEED_OWNER="" CLI_FROM=""; CLI_PICK=""; CLI_DRYRUN=0 CLI_KIND=""; CLI_DIR=""; CLI_PURGE=0; CLI_REVEAL=0 CLI_APPLY=0; CLI_FORCE=0; CLI_ONLINE=0; CLI_FILE=""; CLI_OUT="" @@ -558,6 +563,7 @@ parse_args() { --light-key) need_value "$@"; CLI_LKEY="$2"; shift 2 ;; --light-name) need_value "$@"; CLI_LNAME="$2"; shift 2 ;; --tavily-keys) need_value "$@"; CLI_TAVILY="$2"; shift 2 ;; + --seed-owner) need_value "$@"; CLI_SEED_OWNER="$2"; shift 2 ;; --from) need_value "$@"; CLI_FROM="$2"; shift 2 ;; --pick) CLI_PICK="dev" case "${2:-}" in dev|release) CLI_PICK="$2"; shift 2 ;; *) shift ;; esac ;; @@ -1193,6 +1199,9 @@ print_agent_plan() { } # seed_settings：把 CLI/环境变量给出的模型与搜索配置写入 settings（幂等）。 +# 认证开启（PG 档默认）时 PUT /api/settings/user 同样要求凭证：自动铸一把临时 +# API key（name=svc-seed）完成写入后立即回收；owner 缺省取库内首个管理员（回落 +# 首个账号），--seed-owner / SVC_SEED_OWNER 可指定。铸 key 失败维持无头 PUT（旧行为）。 seed_settings() { local host="$1" port="$2" local cb="${CLI_MBASE:-${SVC_MODEL_BASE:-}}" ck="${CLI_MKEY:-${SVC_MODEL_KEY:-}}" cn="${CLI_MNAME:-${SVC_MODEL_NAME:-}}" @@ -1220,8 +1229,38 @@ if tk: out["tools"] = {"tavily": {"apiKeys": tk}} print(json.dumps(out)) PY )" + # 认证开启时的播种凭证：临时 key，明文只存在于本函数局部变量，不回显、不落盘。 + # apikey 子命令不读环境 DSN，只能经 CLI 传递（进程列表短暂可见；serve 走 + # AGENT_SYSTEM_DSN 环境注入，此路对 CLI 子命令不可用）。 + local seed_key="" seed_owner="${CLI_SEED_OWNER:-${SVC_SEED_OWNER:-}}" + local -a seed_hdr=() seed_dbf=() + if db_auth_enabled; then + if [ "$DB_MODE" = pg ]; then seed_dbf=(--dsn "$DB_DSN"); else seed_dbf=(--data "$ENV_DATA"); fi + if [ -z "$seed_owner" ]; then + seed_owner="$("$ENV_BIN" user list ${seed_dbf[@]+"${seed_dbf[@]}"} 2>/dev/null | python3 -c 'import json, sys +try: + users = json.load(sys.stdin) +except Exception: + sys.exit(0) +for u in users: + if u.get("isAdmin"): + print(u["owner"]); break +else: + for u in users: + print(u["owner"]); break' 2>/dev/null || true)" + fi + if [ -n "$seed_owner" ]; then + seed_key="$("$ENV_BIN" apikey create ${seed_dbf[@]+"${seed_dbf[@]}"} --owner "$seed_owner" --name svc-seed 2>/dev/null || true)" + [ -n "$seed_key" ] && seed_hdr=(-H "Authorization: Bearer $seed_key") + fi + fi local resp - resp="$(curl -s -m 5 -X PUT "http://$host:$port/api/settings/user" -H 'Content-Type: application/json' -d "$payload")" + resp="$(curl -s -m 5 -X PUT "http://$host:$port/api/settings/user" -H 'Content-Type: application/json' ${seed_hdr[@]+"${seed_hdr[@]}"} -d "$payload")" + # 用后即回收；失败只提示吊销途径，不回显任何密钥材料。 + if [ -n "$seed_key" ]; then + "$ENV_BIN" apikey revoke ${seed_dbf[@]+"${seed_dbf[@]}"} --owner "$seed_owner" --name svc-seed >/dev/null 2>&1 \ + || c_warn "[$ENV_NAME] 临时播种密钥回收失败：请手动吊销 owner=$seed_owner name=svc-seed" + fi if echo "$resp" | grep -q '"ok": *true'; then local did="" [ -n "$cb$ck$cn" ] && did="主模型" @@ -1229,7 +1268,7 @@ PY [ -n "$tk" ] && did="${did:+$did、}Tavily" c_ok "[$ENV_NAME] 已播种设置：$did（持久化于 $ENV_DATA，后续启动无需再传）" else - c_warn "[$ENV_NAME] 设置播种未成功：${resp:-<无响应>}（若开启了 API key 认证，需在设置页手动配置）" + c_warn "[$ENV_NAME] 设置播种未成功：${resp:-<无响应>}（认证开启时需库内已有账号以铸临时密钥，或用 --seed-owner 指定；也可在设置页手动配置）" fi } diff --git a/tests/test_svc.py b/tests/test_svc.py index 67cd4ed1..c4957261 100644 --- a/tests/test_svc.py +++ b/tests/test_svc.py @@ -58,10 +58,49 @@ case "${1:-}" in done port="${addr##*:}"; host="${addr%:*}" trap 'kill "$child" 2>/dev/null; exit 0' TERM INT - python3 -m http.server "$port" --bind "$host" --directory "$trace_dir" >/dev/null 2>&1 & + # GET/HEAD 一律 200（健康探测语义与 http.server 等价）；PUT /api/* 捕获头与 + # 请求体到 trace/put.txt 供播种断言（settings 播种验证，2026-10-11）。 + python3 - "$port" "$host" "$trace_dir" <<'PYSRV' >/dev/null 2>&1 & +import sys +from http.server import BaseHTTPRequestHandler, HTTPServer +port, host, trace = int(sys.argv[1]), sys.argv[2], sys.argv[3] +class H(BaseHTTPRequestHandler): + def _ok(self, body=b'{"ok":true}'): + self.send_response(200) + self.send_header('Content-Type', 'application/json') + self.send_header('Content-Length', str(len(body))) + self.end_headers() + self.wfile.write(body) + def do_GET(self): + self._ok() + def do_HEAD(self): + self._ok(b'') + def do_PUT(self): + n = int(self.headers.get('Content-Length') or 0) + body = self.rfile.read(n).decode('utf-8', 'replace') + with open(trace + '/put.txt', 'a') as f: + f.write('AUTH=%s\nBODY=%s\n--\n' % (self.headers.get('Authorization') or '-', body)) + self._ok() + def log_message(self, *args): + pass +HTTPServer((host, port), H).serve_forever() +PYSRV child=$! wait "$child" ;; + user) + printf 'user %s\n' "$*" >> "$trace_dir/cli.txt" + case "${2:-}" in + list) echo '[{"owner":"op","name":"op","isAdmin":true,"mustChangePassword":false},{"owner":"plain","name":"plain","isAdmin":false,"mustChangePassword":false}]' ;; + esac + exit 0 ;; + apikey) + printf 'apikey %s\n' "$*" >> "$trace_dir/cli.txt" + case "${2:-}" in + create) echo "ask_stub_seed_key" ;; + revoke) echo "revoked" ;; + esac + exit 0 ;; *) exit 0 ;; esac @@ -563,5 +602,72 @@ class SvcDbRecoveryTests(unittest.TestCase): self.assertIn("AGENT_SYSTEM_DSN=%s" % dsn, self.serve_record()) + # ---- 12. 播种认证（2026-10-11 修复）：认证开启自动铸临时 key，用后回收 ---- + + def put_record(self): + f = self.trace / "put.txt" + return f.read_text() if f.exists() else "" + + def cli_record(self): + f = self.trace / "cli.txt" + return f.read_text() if f.exists() else "" + + def model_env(self, **extra): + env = dict(self.env) + env.update({ + "SVC_MODEL_BASE": "https://stub.example/v1", + "SVC_MODEL_KEY": "sk-stub-model", + "SVC_MODEL_NAME": "stub-model", + }) + env.update(extra) + return env + + def test_seed_puts_with_temporary_bearer_key_when_auth_on(self): + self.register_pg("pg1", 18831, password="seed-pw-1") + dsn = "postgresql://agent:seed-pw-1@127.0.0.1:18831/agent" + d = self.runtime("dev") + self.seed_agent("dev", 18832, + "--addr 127.0.0.1:18832 --data %s --plugins %s --auth auto --dsn %s" + % (d / "data", d / "plugins", dsn)) + result = self.svc("dev", "start", env=self.model_env()) + self.assertIn("已播种设置：主模型", result.stdout) + put = self.put_record() + self.assertIn("AUTH=Bearer ask_stub_seed_key", put) + body_part = put.split("BODY=", 1)[1] + self.assertIn('"model": "stub-model"', body_part) + self.assertNotIn("ask_stub_seed_key", body_part) # 临时 key 不进请求体 + cli = self.cli_record() + # owner 解析：user list 首个管理员（op）→ 铸 key → 播种后回收。 + self.assertIn("user list --dsn %s" % dsn, cli) + self.assertIn("apikey create --dsn %s --owner op --name svc-seed" % dsn, cli) + self.assertIn("apikey revoke --dsn %s --owner op --name svc-seed" % dsn, cli) + + def test_seed_owner_override_skips_account_lookup(self): + self.register_pg("pg1", 18833, password="seed-pw-2") + dsn = "postgresql://agent:seed-pw-2@127.0.0.1:18833/agent" + d = self.runtime("dev") + self.seed_agent("dev", 18834, + "--addr 127.0.0.1:18834 --data %s --plugins %s --auth auto --dsn %s" + % (d / "data", d / "plugins", dsn)) + result = self.svc("dev", "start", env=self.model_env(SVC_SEED_OWNER="boss")) + self.assertIn("已播种设置：主模型", result.stdout) + self.assertIn("AUTH=Bearer ask_stub_seed_key", self.put_record()) + cli = self.cli_record() + self.assertIn("--owner boss --name svc-seed", cli) + self.assertNotIn("user list", cli) # 显式指定即跳过账号解析 + + def test_seed_puts_without_credentials_when_auth_off(self): + d = self.runtime("dev") + self.seed_agent("dev", 18835, + "--addr 127.0.0.1:18835 --data %s --plugins %s --auth auto" + % (d / "data", d / "plugins")) + result = self.svc("dev", "start", env=self.model_env()) + self.assertIn("已播种设置：主模型", result.stdout) + put = self.put_record() + self.assertIn("AUTH=-", put) + self.assertIn('"model": "stub-model"', put.split("BODY=", 1)[1]) + self.assertNotIn("apikey", self.cli_record()) # 认证关闭不铸 key + + if __name__ == "__main__": unittest.main()