From c05b27de6aa97411b0bd799ead146e8139c3942a Mon Sep 17 00:00:00 2001 From: chenchen Date: Fri, 5 Jun 2026 00:28:53 +0800 Subject: [PATCH] revert: drop outbound env-key logging; root cause was AM stale prod image MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Token IS transmitted by HM (confirmed); the agent didn't enforce it because AM hadn't deployed the image containing the §5 check to production. So the debug log is unnecessary — removed. Contract §0.1 updated: token-check is "code-ready, pending AM prod image", not a HM gap. UI access-token/direct-URL display kept. Co-Authored-By: Claude Opus 4.8 --- docs/integration/heicode-am-contract.md | 4 ++-- heicode/controller/agent_template_runtime.go | 10 ---------- 2 files changed, 2 insertions(+), 12 deletions(-) diff --git a/docs/integration/heicode-am-contract.md b/docs/integration/heicode-am-contract.md index c3020efb..b4cd358e 100644 --- a/docs/integration/heicode-am-contract.md +++ b/docs/integration/heicode-am-contract.md @@ -25,11 +25,11 @@ | **agent 直连(A2A)** | ✅ **可达**:`GET /health` 200 healthy、`/.well-known/agent.json` 拿到 agent card(旧版连不上已解决) | | **对令牌调用** `POST /message/send` (带正确 `X-Agent-Access-Token`) | ✅ 通:task `completed`、模型真实跑通 | | **模型调用** | ✅ HM 现签 `OPENAI_API_KEY` 打 `/v1`(gpt-5.4)正常 | -| **令牌校验(① 本地比对)** | ❌ **未生效**:**无 `X-Agent-Access-Token` 仍返回 200**(应 401);agent card `auth_required=None`。运行中的 agent 没有真正按 §3.1/§5 做本地比对 | +| **令牌校验(① 本地比对)** | 🟡 **代码已写、生产镜像待更新**:复测时无令牌仍 200(应 401),根因为 AM 含校验逻辑的新镜像未发到生产;更新后即生效 | | **直连通道加密** | ⚠️ **HTTP 明文**:`access_info.domain_url` 为 `http://…`,`X-Agent-Access-Token` 与 `api_key` 明文传输 | > **AM 侧剩余待办(2 条,均不阻断功能,但阻断安全目标)**: -> 1. 🔴 **让 agent 真正启用令牌校验**。HM 确已在 `POST /agents` 的 `env` 里下发 `AGENT_ACCESS_TOKEN`(= 返回给客户端的 `access_token`,同一把),且 agent 能读 env(`AGENT_INSTRUCTION_TEXT` 已生效)。但无令牌请求被放行、`auth_required=None`,疑似 §5.3「未注入 `AGENT_ACCESS_TOKEN` 则兼容放行」被触发——请确认 agent 进程是否真的从 create 的 `env` 读到了 `AGENT_ACCESS_TOKEN`,以及部署的镜像是否已含 §5 校验代码。**不开校验 = 任一有效 `api_key` 可驱动任意用户的 agent、读走其挂载资源**,等于没做按用户隔离。 +> 1. 🟡 **令牌校验:代码已写、待生产镜像更新**。已查明:HM 确实在 `POST /agents` 的 `env` 里下发了 `AGENT_ACCESS_TOKEN`(= 返回客户端的 `access_token`,同一把);复测当时无令牌仍 200、`auth_required=None`,**根因是 AM 含 §5 校验逻辑的新镜像未发布到生产**(跑的是旧镜像)。AM 把新镜像更到生产后即生效。届时请复测:无令牌→401、错令牌→403、对令牌→放行。**在生效前 = 任一有效 `api_key` 可驱动任意用户的 agent、读走其挂载资源**。 > 2. ⚠️ **子域名上 HTTPS/TLS**。当前 `http://` 明文,令牌与 `api_key` 可被嗅探;通道加密是这套方案的前提(HM 不中转,靠 TLS)。 > > 其余(创建/状态/停止/删除/直连/模型)HM 已全部生产验证通过。 diff --git a/heicode/controller/agent_template_runtime.go b/heicode/controller/agent_template_runtime.go index ed4d9a94..5bf1cc99 100644 --- a/heicode/controller/agent_template_runtime.go +++ b/heicode/controller/agent_template_runtime.go @@ -8,7 +8,6 @@ import ( "io" "net/http" "net/url" - "sort" "strings" "time" @@ -184,15 +183,6 @@ func amStartTemplateAgent(ctx context.Context, args amStartArgs) (amStartResult, }, "env": env, } - // Operational log: which env KEYS we send to AM (names only, never values) — - // lets us confirm e.g. AGENT_ACCESS_TOKEN is actually transmitted without - // leaking any secret. - envKeys := make([]string, 0, len(env)) - for k := range env { - envKeys = append(envKeys, k) - } - sort.Strings(envKeys) - common.SysLog("amStartTemplateAgent name=" + name + " env_keys=[" + strings.Join(envKeys, ",") + "]") data, err := amTemplateDo(ctx, http.MethodPost, agentTemplateStartPath(), payload, agentTemplateStartTimeout()) if err != nil { return amStartResult{}, err