From ddbf9aec90a39d87306da7b27bb12d7e617c65e9 Mon Sep 17 00:00:00 2001 From: weichen Date: Wed, 21 Oct 2026 14:04:07 +0000 Subject: [PATCH 1/6] Record the task card for fix-svc-superadmin-envfile-surface-conv Why: establish the authorized task workspace and its initial baseline. Evidence: preserved precheck receipt in .task/fix-svc-superadmin-envfile-surface-conv.md; R0=d9e9c0560a2767539f4415b579adbeff86a22ba6. Impact: task metadata only; the feature workspace starts at d9e9c0560a2767539f4415b579adbeff86a22ba6. Refs: .task/fix-svc-superadmin-envfile-surface-conv.md --- ...fix-svc-superadmin-envfile-surface-conv.md | 91 +++++++++++++++++++ 1 file changed, 91 insertions(+) create mode 100644 .task/fix-svc-superadmin-envfile-surface-conv.md diff --git a/.task/fix-svc-superadmin-envfile-surface-conv.md b/.task/fix-svc-superadmin-envfile-surface-conv.md new file mode 100644 index 00000000..1c1a6573 --- /dev/null +++ b/.task/fix-svc-superadmin-envfile-surface-conv.md @@ -0,0 +1,91 @@ +# fix/svc-superadmin-envfile-surface-conv 任务卡 + +任务主记录：；状态：进行中；owner：weichen + +- 权威仓：ssh://git@192.168.3.2:2222/weichen/Agent-System-Dev.git；目标分支：main；R0（initial_base_sha）= d9e9c0560a2767539f4415b579adbeff86a22ba6 +- 工作区：/home/weichen/projects/Agent-System-Dev-wt-fix-svc-superadmin-envfile-surface-conv（worktree）；分支：fix/svc-superadmin-envfile-surface-conv +- 分支类型：standalone；root_target：main；immediate_target：main；accepting_requirements：false +- 需求分流：verdict=NEW；selected_initiative=无；requirement_sha256=1c2e2ec0089a4a524959716deb24ea3e48312199979f87e70337c4b40197747b；triage_receipt=/tmp/svc-sa-surface-20261021/triage.json；receipt_sha256=2adcb48f6e44ae1996bb1e0b09ba34860e4e0a2ae3e5b3dce4e0a84a19a6375e + +- 授权与交付终点：<本次允许的动作与终点；未授权事项写明> +- 交付模式：goal-first（目标、范围和交付终点一次确认；范围内连续推进） +- 实施执行：agent-per-unit（配置：AGENT-EXECUTION.md） +- 合入执行：agent（已授权交付范围内，Review 通过、冲突解决且当前 HEAD 的 CI 通过后合入） +- 流程依据：仓库根目录 policy/delivery.md（归档后仍按仓库根目录定位） + +## 目标与非目标 + +<预期结果、受影响入口/模块/契约；明确不做什么。> + +## Agent 实施收据 + +路由与 fail-stop 规则见根目录 AGENT-EXECUTION.md 与 policy/delivery.md；每次尝试一行，原始日志留在源码外收据路径。 + +| 单元 ID | 预期范围 | 配置摘要 | 角色 | 候选顺序 | attempt | CLI/模型 | 终态 | transport | fallback | 源码外收据路径 | +|---|---|---|---|---|---|---|---|---|---|---| +| 待定义 | — | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | — | + +## 同步记录 + +| 节点 | sync_base_sha | tested_head_sha | checked_at | +|---|---|---|---| +| 启动 | d9e9c0560a2767539f4415b579adbeff86a22ba6 | d9e9c0560a2767539f4415b579adbeff86a22ba6 | 2026-10-21T14:04:06Z | + +## 证据（Evidence） + + +| 时间(UTC) | 命令 | 被测HEAD | exit | 来源 | sha256(16) | +|---|---|---|---|---|---| + +## 结果与验证（完成后填写） + +- 结果： +- 验证：<结论摘要 PASS/FAIL/SKIP/NOT_RUN 逐项；逐条证据由 make evidence 写入上方证据表> +- 影响与剩余项： + +## 合入与清理 + +- Review 记录：NOT_RUN（审阅智能体/平台身份、base/head、结论、问题闭合及重放依据） +- 冲突记录：NOT_RUN（最新目标同步、冲突处置、组合兼容核验及复审/补测） +- CI 记录：NOT_RUN（当前 HEAD 完整 SHA、全部必需检查、运行链接、执行身份及 GATE 结果） +- 合入记录：NOT_RUN（交付授权范围、PR、被核验 HEAD、合入 SHA、目标分支及内容核验） +- 清理记录：NOT_RUN（授权依据、写者退出确认、worktree/分支/任务卡处置） + + +```json +{ + "summary_schema": 1, + "source": "SELF", + "timestamp": "2026-10-21T14:03:32.182767+00:00", + "command": "make precheck", + "exit_code": 0, + "cwd": "/home/weichen/projects/Agent-System-Dev", + "before_head": "d9e9c0560a2767539f4415b579adbeff86a22ba6", + "after_head": "d9e9c0560a2767539f4415b579adbeff86a22ba6", + "branch": "main", + "target_branch": "main", + "target_head": "d9e9c0560a2767539f4415b579adbeff86a22ba6", + "root_target": "main", + "immediate_target": "main", + "before_tracked_diff_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "after_tracked_diff_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "output_tail": [ + "make[1]: Entering directory '/home/weichen/projects/Agent-System-Dev'", + "[repo] branch=main head=d9e9c0560a", + "[remote] origin/main=d9e9c0560a ahead=0 behind=0", + "[tree] clean submodules_drift=0 uninit=0", + "[worktrees] linked=3", + "[initiatives] local cards (not authoritative): none", + "[hooks] core.hooksPath=scripts/hooks（pre-commit/post-merge 实际接线）", + "[facts] policy/facts.md 6 条事实均在有效期内", + "[required-reading] core/baseline.md, workflows/delivery.md §1, policy/delivery.md", + "[R0] d9e9c0560a（完整：d9e9c0560a2767539f4415b579adbeff86a22ba6）", + "[worktree] before-sync: recursive component checks passed", + "[verdict] READY — 保留本次 precheck receipt 后建任务工作区：PRECHECK_RECEIPT=/tmp/task-precheck.json make task-start NAME=feature/your-branch", + "make[1]: Leaving directory '/home/weichen/projects/Agent-System-Dev'" + ], + "output_sha256": "d56c09db1d3fa308d17976569429fb7ab950587f2a97e9438432c21db6de7f25", + "receipt_sha256": "ec446f0a238e6f6c64167ff09c23059b47bf08df92852d1ac12ee540348affed", + "receipt_path": "/home/weichen/.cache/agent-system-dev/evidence/ec446f0a238e6f6c64167ff09c23059b47bf08df92852d1ac12ee540348affed.json" +} +``` From 1edf326448f21a18caf3a71982758bd0508a3588 Mon Sep 17 00:00:00 2001 From: agent-exec-transport Date: Wed, 21 Oct 2026 14:10:20 +0000 Subject: [PATCH 2/6] Remember the super-admin credential file path in svc Auth-on agent services need super-admin credentials at every launch, but svc only forwarded them from the current environment, and recover/watchdog relaunch with a cleared environment, so a bare restart or recovery failed closed. svc now records only the absolute path of AGENT_SYSTEM_ENV_FILE as superadmin_envfile= after checking it is a regular, owner-only (0600) file before stopping anything, and forwards that path when no explicit credentials are set. An empty AGENT_SYSTEM_ENV_FILE clears the record. The file content is never read, copied or printed. Why: prod restarts and recovery required re-exporting AGENT_SYSTEM_ENV_FILE. Evidence: agent-exec unit dev-svc-superadmin-envfile-persist (cursor, attempt 1, terminal=success); unittest test_svc_superadmin_envfile + test_svc_recover + test_svc_identity: 51 OK (1 skipped). Impact: svc.sh agent launch and svc.env gain superadmin_envfile; docs/svc.md 4.2 note. Refs: Dev task fix/svc-superadmin-envfile-surface-conv. Co-authored-by: Cursor --- docs/svc.md | 6 + scripts/svc.sh | 61 +++++++++ tests/test_svc_superadmin_envfile.py | 194 +++++++++++++++++++++++++++ 3 files changed, 261 insertions(+) create mode 100644 tests/test_svc_superadmin_envfile.py diff --git a/docs/svc.md b/docs/svc.md index 4f2fc58a..4c878c14 100644 --- a/docs/svc.md +++ b/docs/svc.md @@ -189,6 +189,12 @@ scripts/svc.sh status # 单服务详情 - 显式给任何运行参数（或 `--config` 文件、`SVC_*` 变量）时**整体重建**参数； - agent/static 换端口：`restart --port N`（进程与登记同步更新）； - postgres 换端口：`set --apply`（见 §7.4）或 `restart --port N` 同样有效。 +- **超级管理员凭据文件（agent，`superadmin_envfile=`）**：在 deploy/start/restart 时传一次 + `AGENT_SYSTEM_ENV_FILE=<文件>`，svc 先校验（普通文件、属当前用户、权限 0600 即无组/其他位， + 不合格则在停旧服务前拒绝），再只把**绝对路径**记入 svc.env（从不读取、复制或打印文件内容）； + 此后裸 `restart`、`recover`/watchdog 拉起都复用该路径。本次环境显式设置的 + `SUPER_ADMIN_OWNER`/`SUPER_ADMIN_PASSWORD`/`AGENT_SYSTEM_ENV_FILE` 优先于登记； + `AGENT_SYSTEM_ENV_FILE=`（空值）清除登记；登记文件已不存在时告警且不转发（serve 按缺凭据拒启）。 `status` 输出示例（postgres）： diff --git a/scripts/svc.sh b/scripts/svc.sh index 3caba848..546c41e5 100755 --- a/scripts/svc.sh +++ b/scripts/svc.sh @@ -942,6 +942,7 @@ svc_merge_tags() { # （托管绑定不重复存 DSN，外部直连存受保护 dsn=）；未走解析的调用保持旧值。 record_state() { local pid prev_src prev_dbref prev_conffile prev_db prev_dsn prev_envfile prev_plugins plugins_out merged_tags + local prev_saenv pid="$(read_pid)" prev_src="" [ -f "$ENV_DIR/svc.env" ] && prev_src="$(svc_get source)" @@ -950,6 +951,7 @@ record_state() { prev_db="$(svc_get db)" prev_dsn="$(svc_get dsn)" prev_envfile="$(svc_get envfile)" + prev_saenv="$(svc_get superadmin_envfile)" prev_plugins="$(svc_get plugins)" plugins_out="$prev_plugins" # 只有激活校验和 UI 探活都通过之后才提交新的 plugins=。中途 record_state @@ -999,6 +1001,11 @@ record_state() { elif [ -n "$prev_envfile" ]; then printf 'envfile=%s\n' "$prev_envfile" fi + if [ -n "${SUPERADMIN_ENVFILE_NEW:-}" ]; then + printf 'superadmin_envfile=%s\n' "$SUPERADMIN_ENVFILE_NEW" + elif [ "${SUPERADMIN_ENVFILE_CLEAR:-0}" != 1 ] && [ -n "$prev_saenv" ]; then + printf 'superadmin_envfile=%s\n' "$prev_saenv" + fi [ -n "$plugins_out" ] && printf 'plugins=%s\n' "$plugins_out" [ $# -gt 0 ] && printf '%s\n' "$@" } > "$tmp" @@ -1529,6 +1536,38 @@ svc_write_serve_env() { chmod 0600 "$f" 2>/dev/null || true } +# svc_superadmin_envfile_check：agent 的 start/restart/deploy 在停旧服务前校验本次 +# AGENT_SYSTEM_ENV_FILE（只看路径与元数据，绝不读内容）。非空须为当前用户所有、 +# 无组/其他权限位的普通文件，通过后由 record_state 记为 superadmin_envfile=； +# 已设置但为空则清除登记。 +SUPERADMIN_ENVFILE_NEW="" +SUPERADMIN_ENVFILE_CLEAR=0 +svc_superadmin_envfile_check() { + [ -n "${AGENT_SYSTEM_ENV_FILE+x}" ] || return 0 + if [ -z "$AGENT_SYSTEM_ENV_FILE" ]; then + SUPERADMIN_ENVFILE_CLEAR=1 + return 0 + fi + local f="$AGENT_SYSTEM_ENV_FILE" dir meta owner mode + dir="$(cd "$(dirname "$f")" 2>/dev/null && pwd)" || dir="" + [ -n "$dir" ] && f="${dir%/}/$(basename "$f")" + if [ -z "$dir" ] || [ ! -f "$f" ]; then + c_err "[$ENV_NAME] 超级管理员凭据文件不存在或不是普通文件：$f（运行中的服务未改动）" + return 1 + fi + meta="$(stat -L -c '%u %a' "$f" 2>/dev/null)" || meta="" + owner="${meta%% *}"; mode="${meta##* }" + if [ -z "$meta" ] || [ "$owner" != "$(id -u)" ]; then + c_err "[$ENV_NAME] 超级管理员凭据文件不属于当前用户：$f（运行中的服务未改动）" + return 1 + fi + if [ $(( 8#$mode & 8#077 )) -ne 0 ]; then + c_err "[$ENV_NAME] 超级管理员凭据文件权限过宽（$mode）：$f，须 chmod 600（运行中的服务未改动）" + return 1 + fi + SUPERADMIN_ENVFILE_NEW="$f" +} + # svc_launch_serve ARGS：env -i 只带 serve.env 与本次构造的 guard_env。 svc_launch_serve() { local exec_args="$1" @@ -1558,11 +1597,25 @@ svc_launch_serve() { args+=("RDM_DISABLE_EXEC_TOOLS=$RDM_DISABLE_EXEC_TOOLS") fi # 超级管理员凭据只从本次环境转发，不写入 serve.env；缺失时由 serve 自行 fail closed。 + # 本次环境三者皆未设置时回落到 svc.env 登记的 superadmin_envfile=（只转发路径）， + # recover/watchdog 的清空环境子进程因此也能拉起认证实例。 + local sa_explicit=0 sa_file for k in SUPER_ADMIN_OWNER SUPER_ADMIN_PASSWORD AGENT_SYSTEM_ENV_FILE; do if [ -n "${!k+x}" ]; then args+=("$k=${!k}") + sa_explicit=1 fi done + if [ "$sa_explicit" = 0 ]; then + sa_file="$(svc_get superadmin_envfile)" + if [ -n "$sa_file" ]; then + if [ -f "$sa_file" ]; then + args+=("AGENT_SYSTEM_ENV_FILE=$sa_file") + else + c_warn "[$ENV_NAME] 登记的超级管理员凭据文件已不存在：$sa_file（不转发，serve 将按缺凭据拒启）" + fi + fi + fi # shellcheck disable=SC2086 nohup "${args[@]}" "$ENV_BIN" serve $exec_args >> "$ENV_DIR/svc.log" 2>&1 9>&- & } @@ -5576,6 +5629,8 @@ env_status_detail() { cfile="$(svc_get conffile)" [ -z "$cfile" ] && cfile="$(printf '%s' "$(svc_get exec)" | sed -n 's/.*--config \([^ ]*\).*/\1/p')" printf ' 配置文件 %s\n' "${cfile:-无（命令行参数形态； config 绑定）}" + local saf; saf="$(svc_get superadmin_envfile)" + [ -n "$saf" ] && printf ' 超管凭据文件 %s（仅登记路径）\n' "$saf" printf ' 监听守卫 insecureListen=%s allowedHosts=%s\n' \ "$(env_var "$ENV_NAME" INSECURE_LISTEN)" \ "$(env_var "$ENV_NAME" ALLOWED_HOSTS)" @@ -6452,6 +6507,12 @@ main() { exit 2 fi env_config "$ENV_NAME" + case "$action" in + start|restart|deploy) + if [ "$SVC_KIND" = agent ]; then + svc_superadmin_envfile_check || exit 1 + fi ;; + esac # 生命周期动作持 .start.lock（wait 模式；进程退出自动释放）——deploy 全程含 # 构建窗口，防 recover/并发 start 在停机-换产物间隙抢跑。只读动作不加锁。 case "$action" in diff --git a/tests/test_svc_superadmin_envfile.py b/tests/test_svc_superadmin_envfile.py new file mode 100644 index 00000000..00239488 --- /dev/null +++ b/tests/test_svc_superadmin_envfile.py @@ -0,0 +1,194 @@ +"""svc.sh 超级管理员凭据文件路径登记回归（superadmin_envfile=）。 + +deploy/start/restart 时传一次 AGENT_SYSTEM_ENV_FILE：svc 校验（普通文件、属当前用户、 +无组/其他权限位）后只登记路径；裸 restart 与 recover（清空环境的生命周期子进程） +复用该路径转发给 serve；权限过宽在停旧服务前拒绝；空值清除登记；svc.env/svc.log +绝不出现文件内容。桩二进制与夹具复用 tests/test_svc_recover.py。 +""" +import importlib.util +import os +import shutil +import unittest +from pathlib import Path + +SOURCE = Path(__file__).resolve().parents[1] + +_spec = importlib.util.spec_from_file_location("tsr", SOURCE / "tests" / "test_svc_recover.py") +tsr = importlib.util.module_from_spec(_spec) +_spec.loader.exec_module(tsr) + +# 桩 serve 额外记录实际收到的 AGENT_SYSTEM_ENV_FILE（未设置记 ）。 +_ANCHOR = '> "$trace_dir/serve.txt"\n' +assert _ANCHOR in tsr.STUB +STUB = tsr.STUB.replace( + _ANCHOR, + _ANCHOR + r""" printf 'AGENT_SYSTEM_ENV_FILE=%s\n' "${AGENT_SYSTEM_ENV_FILE-}" >> "$trace_dir/serve.txt" +""", 1) + +PASSWORD = "Dummy-SA-Pw-9f4c2e71-do-not-leak" +UNSET = "" + + +class SuperAdminEnvfileTests(tsr.SvcAutoRecoverTests): + def setUp(self): + super().setUp() + shutil.copy2(SOURCE / "scripts" / "svc_manifest.py", + self.root / "scripts" / "svc_manifest.py") + self.stub.write_text(STUB) + for key in ("AGENT_SYSTEM_ENV_FILE", "SUPER_ADMIN_OWNER", "SUPER_ADMIN_PASSWORD"): + self.env.pop(key, None) + self.secrets = self.root / "secrets" + self.secrets.mkdir(mode=0o700) + self.cred = self.make_cred("sa.env", 0o600) + + # ---- 夹具 ---- + + def make_cred(self, name, mode): + p = self.secrets / name + p.write_text("SUPER_ADMIN_OWNER=op\nSUPER_ADMIN_PASSWORD=%s\n" % PASSWORD) + p.chmod(mode) + return p + + def env_with(self, **extra): + env = dict(self.env) + env.update(extra) + return env + + def served_envfile(self): + for line in (self.trace / "serve.txt").read_text().splitlines(): + if line.startswith("AGENT_SYSTEM_ENV_FILE="): + return line.split("=", 1)[1] + return None + + def fresh_trace(self): + f = self.trace / "serve.txt" + if f.exists(): + f.unlink() + + def assert_same_path(self, recorded, expected): + self.assertIsNotNone(recorded) + self.assertTrue(os.path.isabs(recorded), recorded) + self.assertEqual(os.path.realpath(recorded), os.path.realpath(expected)) + + def assert_no_secret(self, name, *outputs): + for fname in ("svc.env", "svc.log", "manifest.json", "serve.env", "history.jsonl"): + p = self.runtime(name) / fname + if p.exists(): + self.assertNotIn(PASSWORD, p.read_text(errors="replace"), fname) + for out in outputs: + self.assertNotIn(PASSWORD, out) + + def start_with_cred(self, name, cred=None): + result = self.svc(name, "start", + env=self.env_with(AGENT_SYSTEM_ENV_FILE=str(cred or self.cred))) + self.assertIn("已启动", result.stdout) + return result + + # ---- 用例 ---- + + def test_sa_start_records_path_and_bare_restart_reuses_it(self): + self.seed_agent("dev", tsr.free_fixture_port()) + r1 = self.start_with_cred("dev") + self.assert_same_path(self.kv("dev", "superadmin_envfile"), self.cred) + self.assert_same_path(self.served_envfile(), self.cred) + status = self.svc("dev", "status") + self.assertIn("超管凭据文件", status.stdout) + self.fresh_trace() + r2 = self.svc("dev", "restart") # 环境里不再有 AGENT_SYSTEM_ENV_FILE + self.assertIn("已启动", r2.stdout) + self.assert_same_path(self.served_envfile(), self.cred) + self.assert_same_path(self.kv("dev", "superadmin_envfile"), self.cred) + self.assert_no_secret("dev", r1.stdout, r2.stdout, status.stdout) + + def test_sa_relative_path_recorded_absolute(self): + self.seed_agent("dev", tsr.free_fixture_port()) + result = self.svc("dev", "start", + env=self.env_with(AGENT_SYSTEM_ENV_FILE="secrets/sa.env")) + self.assertIn("已启动", result.stdout) + self.assert_same_path(self.kv("dev", "superadmin_envfile"), self.cred) + + def test_sa_recover_forwards_recorded_path(self): + self.seed_agent("dev", tsr.free_fixture_port()) + self.start_with_cred("dev") + old_pid = self.kill9("dev") + self.fresh_trace() + result = self.svc("recover", "--quiet") + self.assertIn("recover 汇总：拉回 1", result.stdout) + new_pid = self.pid_of("dev") + self.assertTrue(self.pid_alive(new_pid)) + self.assertNotEqual(new_pid, old_pid) + self.assert_same_path(self.served_envfile(), self.cred) + self.assert_same_path(self.kv("dev", "superadmin_envfile"), self.cred) + self.assert_no_secret("dev", result.stdout) + + def test_sa_loose_permissions_refused_before_stop(self): + self.seed_agent("dev", tsr.free_fixture_port()) + self.start_ok("dev") + pid = self.pid_of("dev") + before = (self.runtime("dev") / "svc.env").read_bytes() + loose = self.make_cred("loose.env", 0o644) + result = self.svc("dev", "restart", check=False, + env=self.env_with(AGENT_SYSTEM_ENV_FILE=str(loose))) + self.assertNotEqual(result.returncode, 0, result.stdout) + self.assertIn("权限过宽", result.stdout) + self.assertIn(str(loose), result.stdout) + self.assertEqual(self.pid_of("dev"), pid) + self.assertTrue(self.pid_alive(pid), "拒绝时不得停掉运行中的服务") + self.assertEqual((self.runtime("dev") / "svc.env").read_bytes(), before) + self.assert_no_secret("dev", result.stdout) + + def test_sa_missing_file_refused_before_stop(self): + self.seed_agent("dev", tsr.free_fixture_port()) + self.start_ok("dev") + pid = self.pid_of("dev") + result = self.svc("dev", "restart", check=False, + env=self.env_with(AGENT_SYSTEM_ENV_FILE=str(self.secrets / "nope.env"))) + self.assertNotEqual(result.returncode, 0, result.stdout) + self.assertIn("nope.env", result.stdout) + self.assertTrue(self.pid_alive(pid)) + self.assertEqual(self.pid_of("dev"), pid) + + def test_sa_empty_value_clears_key(self): + self.seed_agent("dev", tsr.free_fixture_port()) + self.start_with_cred("dev") + self.assertIsNotNone(self.kv("dev", "superadmin_envfile")) + self.fresh_trace() + self.svc("dev", "restart", env=self.env_with(AGENT_SYSTEM_ENV_FILE="")) + self.assertIsNone(self.kv("dev", "superadmin_envfile")) + self.assertEqual(self.served_envfile(), "") + self.fresh_trace() + self.svc("dev", "restart") + self.assertEqual(self.served_envfile(), UNSET) + + def test_sa_explicit_environment_overrides_record(self): + self.seed_agent("dev", tsr.free_fixture_port()) + self.start_with_cred("dev") + self.fresh_trace() + r = self.svc("dev", "restart", env=self.env_with(SUPER_ADMIN_OWNER="op")) + self.assertEqual(self.served_envfile(), UNSET, "显式凭据环境优先，不回落登记路径") + self.assert_same_path(self.kv("dev", "superadmin_envfile"), self.cred) + other = self.make_cred("other.env", 0o600) + self.fresh_trace() + self.svc("dev", "restart", env=self.env_with(AGENT_SYSTEM_ENV_FILE=str(other))) + self.assert_same_path(self.served_envfile(), other) + self.assert_same_path(self.kv("dev", "superadmin_envfile"), other) + self.assert_no_secret("dev", r.stdout) + + def test_sa_recorded_file_gone_warns_and_skips(self): + self.seed_agent("dev", tsr.free_fixture_port()) + self.start_with_cred("dev") + self.cred.unlink() + self.fresh_trace() + result = self.svc("dev", "restart") + self.assertIn("已不存在", result.stdout) + self.assertEqual(self.served_envfile(), UNSET) + + +# 只跑本文件用例；继承来的自恢复用例由 tests/test_svc_recover.py 负责。 +for _name in dir(tsr.SvcAutoRecoverTests): + if _name.startswith("test_") and _name not in SuperAdminEnvfileTests.__dict__: + setattr(SuperAdminEnvfileTests, _name, None) + + +if __name__ == "__main__": + unittest.main() From 0194c5d847e4336c1234e6f539f564b7e9991b1d Mon Sep 17 00:00:00 2001 From: weichen Date: Wed, 21 Oct 2026 15:05:22 +0000 Subject: [PATCH 3/6] Record goals and agent receipts on the svc/surface followups card Why: the card must state authorization, goals and unit receipts including the failed-unknown and authorized Backend rerun. Evidence: agent-exec receipts under /tmp/svc-sa-surface-20261021. Impact: task card only. Refs: fix/svc-superadmin-envfile-surface-conv. Co-authored-by: Cursor --- ...fix-svc-superadmin-envfile-surface-conv.md | 41 +++++++++++++++++-- 1 file changed, 38 insertions(+), 3 deletions(-) diff --git a/.task/fix-svc-superadmin-envfile-surface-conv.md b/.task/fix-svc-superadmin-envfile-surface-conv.md index 1c1a6573..a4ccb1c8 100644 --- a/.task/fix-svc-superadmin-envfile-surface-conv.md +++ b/.task/fix-svc-superadmin-envfile-surface-conv.md @@ -7,7 +7,7 @@ - 分支类型：standalone；root_target：main；immediate_target：main；accepting_requirements：false - 需求分流：verdict=NEW；selected_initiative=无；requirement_sha256=1c2e2ec0089a4a524959716deb24ea3e48312199979f87e70337c4b40197747b；triage_receipt=/tmp/svc-sa-surface-20261021/triage.json；receipt_sha256=2adcb48f6e44ae1996bb1e0b09ba34860e4e0a2ae3e5b3dce4e0a84a19a6375e -- 授权与交付终点：<本次允许的动作与终点；未授权事项写明> +- 授权与交付终点：用户 2026-10-21「未处理的其他记录也解决修复一下」（svc 不持久化超级管理员凭据；`POST /api/surfaces` 接受空 `conversationId`）；Backend 单元 failed-unknown 后用户选择「全新重跑一次」。终点：Backend 与 Dev 经 PR 合入，并以 `AGENT_SYSTEM_ENV_FILE` 重启 prod 一次登记凭据路径。未授权：prod 业务角色配置、高后果 git 操作 - 交付模式：goal-first（目标、范围和交付终点一次确认；范围内连续推进） - 实施执行：agent-per-unit（配置：AGENT-EXECUTION.md） - 合入执行：agent（已授权交付范围内，Review 通过、冲突解决且当前 HEAD 的 CI 通过后合入） @@ -15,7 +15,9 @@ ## 目标与非目标 -<预期结果、受影响入口/模块/契约；明确不做什么。> +- 目标 1（`scripts/svc.sh`）：agent 服务新增登记键 `superadmin_envfile=`，只存凭据文件绝对路径。deploy/start/restart 时若环境给出 `AGENT_SYSTEM_ENV_FILE`，先在停旧服务前校验（普通文件、属当前用户、无组/其他权限位），通过后登记；空值清除登记。拉起 serve 时本次环境未显式给超管凭据则转发登记路径，recover/watchdog 的清空环境子进程因此也能拉起认证实例。`status` 显示登记路径；`docs/svc.md` §4.2 补说明；新增 `tests/test_svc_superadmin_envfile.py`。 +- 目标 2（Backend）：`POST /api/surfaces` 新建页面（无 `surfaceId`）时要求本人存在的 `conversationId`：空值 400，不存在或他人会话 404；修订语义不变。原因：空/未知会话使页面无项目归属，动作接口随之跳过项目生命周期检查。 +- 非目标：svc 读取或复制凭据内容；surfacesvc/模型工具路径改动；prod 业务角色配置。 ## Agent 实施收据 @@ -23,7 +25,9 @@ | 单元 ID | 预期范围 | 配置摘要 | 角色 | 候选顺序 | attempt | CLI/模型 | 终态 | transport | fallback | 源码外收据路径 | |---|---|---|---|---|---|---|---|---|---|---| -| 待定义 | — | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | — | +| dev-svc-superadmin-envfile-persist | scripts/svc.sh、tests/test_svc_superadmin_envfile.py、docs/svc.md | AGENT-EXECUTION.md | implementation | 按配置 | 1（fresh_session） | cursor | success | apply 快进 0e6453b | 未用 | /tmp/svc-sa-surface-20261021/dev-run.json | +| backend-surface-submit-conversation-required | Backend internal/server/platform_api.go、surface_api_test.go | Backend AGENT-EXECUTION.md | implementation | 按配置 | 1（fresh_session） | pi | failed-unknown（隔离区执行 `git submodule update --init` 致 local_config 变化，违反单元约束；源 worktree 未变，现场保留）→ fail-stop | 无 | 未用 | /tmp/svc-sa-surface-20261021/backend-run-attempt1-failed-unknown.json | +| backend-surface-submit-conversation-required（用户批准全新重跑，单元补子模块初始化与配置逐字节恢复约束） | 同上 | Backend AGENT-EXECUTION.md | implementation | 按配置 | 1（fresh_session） | pi | success | apply 快进 1e73822→954e744（amend 规范提交，tree 不变） | 未用 | /tmp/svc-sa-surface-20261021/backend-run.json | ## 同步记录 @@ -89,3 +93,34 @@ "receipt_path": "/home/weichen/.cache/agent-system-dev/evidence/ec446f0a238e6f6c64167ff09c23059b47bf08df92852d1ac12ee540348affed.json" } ``` + + +```json +{ + "summary_schema": 1, + "source": "SELF", + "timestamp": "2026-10-21T14:22:12.910602+00:00", + "command": "PYTHONDONTWRITEBYTECODE=1 python3 -m unittest tests.test_svc_superadmin_envfile tests.test_svc_recover tests.test_svc_identity", + "exit_code": 0, + "cwd": "/home/weichen/projects/Agent-System-Dev-wt-fix-svc-superadmin-envfile-surface-conv", + "before_head": "0e6453bd530feedd973ccfb05f587c5d9d9a6ffc", + "after_head": "0e6453bd530feedd973ccfb05f587c5d9d9a6ffc", + "branch": "fix/svc-superadmin-envfile-surface-conv", + "target_branch": "main", + "target_head": "d9e9c0560a2767539f4415b579adbeff86a22ba6", + "root_target": "main", + "immediate_target": "main", + "before_tracked_diff_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "after_tracked_diff_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "output_tail": [ + "......................................s............", + "----------------------------------------------------------------------", + "Ran 51 tests in 52.867s", + "", + "OK (skipped=1)" + ], + "output_sha256": "5cde79b38a542c3831ae872cd4d7a2b9cd0ba84b0b129442ded6d4adea577a27", + "receipt_sha256": "3d71bc9d4f8e5ed81db87aae76cc3e649dd90f09ee17dafc1bb8ab494725a5ce", + "receipt_path": "/home/weichen/.cache/agent-system-dev/evidence/3d71bc9d4f8e5ed81db87aae76cc3e649dd90f09ee17dafc1bb8ab494725a5ce.json" +} +``` From 3c0faf76b06b999855733bc2a452476793c5d2a0 Mon Sep 17 00:00:00 2001 From: agent-exec-transport Date: Wed, 21 Oct 2026 15:11:02 +0000 Subject: [PATCH 4/6] Pin Backend to require conversation on surface create Move modules/backend to 528e3a4 (Backend #239), which rejects empty or foreign conversationId when creating a surface via POST /api/surfaces. Why: Dev must carry the Backend conversation-required fix. Evidence: Backend #239 CI success at 954e744; agent-exec unit dev-svc-superadmin-surface-backend-repin (cursor, authorized fresh rerun, terminal=success). Impact: documentation pin / gitlink only. Refs: Dev task fix/svc-superadmin-envfile-surface-conv. Co-authored-by: Cursor --- modules/backend | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/backend b/modules/backend index f084d10a..528e3a4c 160000 --- a/modules/backend +++ b/modules/backend @@ -1 +1 @@ -Subproject commit f084d10aa5ea2e4ad2ab4e6eb1268d3e83c6e991 +Subproject commit 528e3a4c1ff9b59c4df998f4fffb39f0b52dbbcd From 965f520ee7d8cdb3341c83417f66e2f7b6d8049b Mon Sep 17 00:00:00 2001 From: weichen Date: Wed, 21 Oct 2026 15:13:47 +0000 Subject: [PATCH 5/6] Record results, review and pin receipts on the task card Why: the card must carry results, evidence and the authorized rerun receipts before closing. Evidence: make evidence for svc unittest suite (51 OK, 1 skipped) on HEAD 3c0faf76. Impact: task card only. Refs: fix/svc-superadmin-envfile-surface-conv. Co-authored-by: Cursor --- ...fix-svc-superadmin-envfile-surface-conv.md | 41 +++++++++++++++++-- 1 file changed, 37 insertions(+), 4 deletions(-) diff --git a/.task/fix-svc-superadmin-envfile-surface-conv.md b/.task/fix-svc-superadmin-envfile-surface-conv.md index a4ccb1c8..f531adbc 100644 --- a/.task/fix-svc-superadmin-envfile-surface-conv.md +++ b/.task/fix-svc-superadmin-envfile-surface-conv.md @@ -28,6 +28,8 @@ | dev-svc-superadmin-envfile-persist | scripts/svc.sh、tests/test_svc_superadmin_envfile.py、docs/svc.md | AGENT-EXECUTION.md | implementation | 按配置 | 1（fresh_session） | cursor | success | apply 快进 0e6453b | 未用 | /tmp/svc-sa-surface-20261021/dev-run.json | | backend-surface-submit-conversation-required | Backend internal/server/platform_api.go、surface_api_test.go | Backend AGENT-EXECUTION.md | implementation | 按配置 | 1（fresh_session） | pi | failed-unknown（隔离区执行 `git submodule update --init` 致 local_config 变化，违反单元约束；源 worktree 未变，现场保留）→ fail-stop | 无 | 未用 | /tmp/svc-sa-surface-20261021/backend-run-attempt1-failed-unknown.json | | backend-surface-submit-conversation-required（用户批准全新重跑，单元补子模块初始化与配置逐字节恢复约束） | 同上 | Backend AGENT-EXECUTION.md | implementation | 按配置 | 1（fresh_session） | pi | success | apply 快进 1e73822→954e744（amend 规范提交，tree 不变） | 未用 | /tmp/svc-sa-surface-20261021/backend-run.json | +| dev-svc-superadmin-surface-backend-repin | modules/backend → 528e3a4（Backend #239） | AGENT-EXECUTION.md | implementation | 按配置 | 1（fresh_session） | cursor | failed-unknown（worker 改动正确但终态记录未从信封解出；源 worktree 未变，隔离现场保留）→ fail-stop | 无 | 未用 | /tmp/svc-sa-surface-20261021/repin-run-attempt1-failed-unknown.json | +| dev-svc-superadmin-surface-backend-repin（用户批准全新重跑） | 同上 | AGENT-EXECUTION.md | implementation | 按配置 | 1（fresh_session） | cursor | success | apply 快进 → 3c0faf76（amend 规范提交，tree 不变） | 未用 | /tmp/svc-sa-surface-20261021/repin-run.json | ## 同步记录 @@ -43,13 +45,13 @@ ## 结果与验证（完成后填写） -- 结果： -- 验证：<结论摘要 PASS/FAIL/SKIP/NOT_RUN 逐项；逐条证据由 make evidence 写入上方证据表> -- 影响与剩余项： +- 结果：两项完成。(1) svc.sh 登记 `superadmin_envfile=`（只存路径），deploy/start/restart 校验后登记，裸 restart/recover 自动转发；(2) Backend #239 合入（`528e3a4`），`POST /api/surfaces` 新建页要求本人会话；本分支 gitlink 已钉到该提交。合入后将以 `AGENT_SYSTEM_ENV_FILE` 重启 prod 一次以登记路径。 +- 验证：`tests.test_svc_superadmin_envfile`+`test_svc_recover`+`test_svc_identity` 51 项 OK（1 跳过，SELF，见证据表）；`bash -n scripts/svc.sh` 通过；Backend #239 CI success（GATE，954e744）；本 PR 当前 HEAD 的 CI 为合入依据。 +- 影响与剩余项：svc 成功路径不变，只增路径登记与转发；Backend 只改新建页校验。剩余（非目标）：prod 无业务角色时 `admin` 仍不能新建项目。 ## 合入与清理 -- Review 记录：NOT_RUN（审阅智能体/平台身份、base/head、结论、问题闭合及重放依据） +- Review 记录：当前主模型（host，非实施会话）审阅实际 diff：svc.sh/docs/测试、Backend handler+测试（经 #239）、gitlink；结论通过，无阻塞项；重放依据为上方测试证据与 Backend CI。 - 冲突记录：NOT_RUN（最新目标同步、冲突处置、组合兼容核验及复审/补测） - CI 记录：NOT_RUN（当前 HEAD 完整 SHA、全部必需检查、运行链接、执行身份及 GATE 结果） - 合入记录：NOT_RUN（交付授权范围、PR、被核验 HEAD、合入 SHA、目标分支及内容核验） @@ -124,3 +126,34 @@ "receipt_path": "/home/weichen/.cache/agent-system-dev/evidence/3d71bc9d4f8e5ed81db87aae76cc3e649dd90f09ee17dafc1bb8ab494725a5ce.json" } ``` + + +```json +{ + "summary_schema": 1, + "source": "SELF", + "timestamp": "2026-10-21T15:12:21.352177+00:00", + "command": "PYTHONDONTWRITEBYTECODE=1 python3 -m unittest tests.test_svc_superadmin_envfile tests.test_svc_recover tests.test_svc_identity", + "exit_code": 0, + "cwd": "/home/weichen/projects/Agent-System-Dev-wt-fix-svc-superadmin-envfile-surface-conv", + "before_head": "3c0faf76b06b999855733bc2a452476793c5d2a0", + "after_head": "3c0faf76b06b999855733bc2a452476793c5d2a0", + "branch": "fix/svc-superadmin-envfile-surface-conv", + "target_branch": "main", + "target_head": "d9e9c0560a2767539f4415b579adbeff86a22ba6", + "root_target": "main", + "immediate_target": "main", + "before_tracked_diff_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "after_tracked_diff_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "output_tail": [ + "......................................s............", + "----------------------------------------------------------------------", + "Ran 51 tests in 54.457s", + "", + "OK (skipped=1)" + ], + "output_sha256": "28f0a1224bc1d46a43b8faad062d463820003eb8fd3b4c688f06cd8173380a22", + "receipt_sha256": "ebaf7682157339ba8813c1ff743a25fa6c0a85eedd8e06cdba3d22c208c242e8", + "receipt_path": "/home/weichen/.cache/agent-system-dev/evidence/ebaf7682157339ba8813c1ff743a25fa6c0a85eedd8e06cdba3d22c208c242e8.json" +} +``` From b3af918cb25463108695839094d21df026375079 Mon Sep 17 00:00:00 2001 From: weichen Date: Wed, 21 Oct 2026 15:13:48 +0000 Subject: [PATCH 6/6] Fold-close the task card before merge MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Why: close the task card inside its own PR so landing it needs no post-merge backfill or separate close PR. Evidence: .task/fix-svc-superadmin-envfile-surface-conv.md -> .task/archive/fix-svc-superadmin-envfile-surface-conv.md; status 已完成（合入前闭合）; PR #683 https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Dev/pulls/683. Impact: task metadata only; the card is archived within PR #683 and lands with its merge commit. Refs: task.sh close --self --- .../fix-svc-superadmin-envfile-surface-conv.md | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) rename .task/{ => archive}/fix-svc-superadmin-envfile-surface-conv.md (96%) diff --git a/.task/fix-svc-superadmin-envfile-surface-conv.md b/.task/archive/fix-svc-superadmin-envfile-surface-conv.md similarity index 96% rename from .task/fix-svc-superadmin-envfile-surface-conv.md rename to .task/archive/fix-svc-superadmin-envfile-surface-conv.md index f531adbc..72973b89 100644 --- a/.task/fix-svc-superadmin-envfile-surface-conv.md +++ b/.task/archive/fix-svc-superadmin-envfile-surface-conv.md @@ -1,6 +1,6 @@ # fix/svc-superadmin-envfile-surface-conv 任务卡 -任务主记录：；状态：进行中；owner：weichen +任务主记录：PR #683 https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Dev/pulls/683；状态：已完成（合入前闭合）；owner：weichen - 权威仓：ssh://git@192.168.3.2:2222/weichen/Agent-System-Dev.git；目标分支：main；R0（initial_base_sha）= d9e9c0560a2767539f4415b579adbeff86a22ba6 - 工作区：/home/weichen/projects/Agent-System-Dev-wt-fix-svc-superadmin-envfile-surface-conv（worktree）；分支：fix/svc-superadmin-envfile-surface-conv @@ -43,7 +43,7 @@ | 时间(UTC) | 命令 | 被测HEAD | exit | 来源 | sha256(16) | |---|---|---|---|---|---| -## 结果与验证（完成后填写） +## 结果与验证 - 结果：两项完成。(1) svc.sh 登记 `superadmin_envfile=`（只存路径），deploy/start/restart 校验后登记，裸 restart/recover 自动转发；(2) Backend #239 合入（`528e3a4`），`POST /api/surfaces` 新建页要求本人会话；本分支 gitlink 已钉到该提交。合入后将以 `AGENT_SYSTEM_ENV_FILE` 重启 prod 一次以登记路径。 - 验证：`tests.test_svc_superadmin_envfile`+`test_svc_recover`+`test_svc_identity` 51 项 OK（1 跳过，SELF，见证据表）；`bash -n scripts/svc.sh` 通过；Backend #239 CI success（GATE，954e744）；本 PR 当前 HEAD 的 CI 为合入依据。 @@ -157,3 +157,9 @@ "receipt_path": "/home/weichen/.cache/agent-system-dev/evidence/ebaf7682157339ba8813c1ff743a25fa6c0a85eedd8e06cdba3d22c208c242e8.json" } ``` + +## 闭合记录（合入前折叠） + +- 本卡在 PR #683（https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Dev/pulls/683）合入前闭合并归档，随该 PR 一同合入。 +- 该 PR 的合并提交即本任务的落地记录。 +- 合入后无需回填，也无需单独的闭合 PR。