feat: 支持 runner tool credential 装配

src/common/types.ts

@@ -68,6 +68,16 @@ export interface ExecutionPolicy extends JsonRecord {
       profile: BackendProfile | string;
       secretRef: SecretRef;
     }>;
+    toolCredentials?: Array<{
+      tool: string;
+      purpose?: string;
+      secretRef: SecretRef;
+      projection: {
+        kind: "env";
+        envName: string;
+        secretKey?: string;
+      };
+    }>;
     allowCredentialEcho?: false;
   };
 }

src/common/validation.ts

@@ -122,8 +122,10 @@ export function validateExecutionPolicy(record: JsonRecord): ExecutionPolicy {
       if (!keys.includes(requiredKey)) throw new AgentRunError("schema-invalid", `provider credential ${profile} secretRef.keys must include ${requiredKey}`, { httpStatus: 400 });
     }
   }
+  const toolCredentials = validateToolCredentials(secretScope.toolCredentials);
   const secretScopeResult: ExecutionPolicy["secretScope"] = { allowCredentialEcho: false };
   if (providerCredentials.length > 0) secretScopeResult.providerCredentials = providerCredentials as NonNullable<ExecutionPolicy["secretScope"]["providerCredentials"]>;
+  if (toolCredentials.length > 0) secretScopeResult.toolCredentials = toolCredentials;
   return {
     sandbox: requiredString(record, "sandbox"),
     approval: requiredString(record, "approval"),
@@ -133,6 +135,37 @@ export function validateExecutionPolicy(record: JsonRecord): ExecutionPolicy {
   };
 }
 
+function validateToolCredentials(value: unknown): NonNullable<ExecutionPolicy["secretScope"]["toolCredentials"]> {
+  if (value === undefined) return [];
+  if (!Array.isArray(value)) throw new AgentRunError("schema-invalid", "toolCredentials must be an array", { httpStatus: 400 });
+  if (value.length > 8) throw new AgentRunError("schema-invalid", "toolCredentials must contain at most 8 entries", { httpStatus: 400 });
+  const seen = new Set<string>();
+  return value.map((credential, index) => {
+    const item = asRecord(credential, `toolCredentials[${index}]`);
+    const tool = requiredString(item, "tool");
+    if (tool !== "github") throw new AgentRunError("schema-invalid", `tool credential ${tool} is not supported in v0.1`, { httpStatus: 400, details: { allowedTools: ["github"] } });
+    const purpose = optionalString(item.purpose);
+    const secretRef = validateSecretRef(asRecord(item.secretRef, `toolCredentials[${index}].secretRef`));
+    const keys = secretRef.keys ?? [];
+    if (keys.length === 0) throw new AgentRunError("schema-invalid", `tool credential ${tool} secretRef.keys must not be empty`, { httpStatus: 400 });
+    const projection = asRecord(item.projection, `toolCredentials[${index}].projection`);
+    const kind = requiredString(projection, "kind");
+    if (kind !== "env") throw new AgentRunError("schema-invalid", "toolCredentials[].projection.kind must be env in v0.1", { httpStatus: 400 });
+    const envName = requiredString(projection, "envName");
+    validateEnvName(envName, `toolCredentials[${index}].projection.envName`);
+    const secretKey = optionalString(projection.secretKey) ?? keys[0];
+    if (!secretKey || !keys.includes(secretKey)) throw new AgentRunError("schema-invalid", `tool credential ${tool} projection.secretKey must be included in secretRef.keys`, { httpStatus: 400 });
+    const identity = `${tool}:${purpose ?? ""}:${envName}`;
+    if (seen.has(identity)) throw new AgentRunError("schema-invalid", `tool credential projection ${identity} is duplicated`, { httpStatus: 400 });
+    seen.add(identity);
+    return { tool, ...(purpose ? { purpose } : {}), secretRef, projection: { kind: "env", envName, secretKey } };
+  });
+}
+
+export function validateEnvName(name: string, fieldName: string): void {
+  if (!/^[A-Z_][A-Z0-9_]{0,63}$/u.test(name)) throw new AgentRunError("schema-invalid", `${fieldName} must be an uppercase env name`, { httpStatus: 400 });
+}
+
 function validateSecretRef(record: JsonRecord): SecretRef {
   const name = requiredString(record, "name");
   const result: SecretRef = { name };

src/mgr/kubernetes-runner-job.ts

@@ -4,7 +4,7 @@ import { redactJson, redactText } from "../common/redaction.js";
 import { isTerminalCommandState, isTerminalRunStatus, summarizeResourceBundleRef, summarizeSessionRef } from "./store.js";
 import type { AgentRunStore } from "./store.js";
 import type { JsonRecord } from "../common/types.js";
-import { stableHash } from "../common/validation.js";
+import { stableHash, validateEnvName } from "../common/validation.js";
 import { renderRunnerJobManifest } from "../runner/k8s-job.js";
 import type { RunnerTransientEnv } from "../runner/k8s-job.js";
 
@@ -106,6 +106,7 @@ export async function createKubernetesRunnerJob(options: { store: AgentRunStore;
       logPath: `kubectl -n ${render.namespace} logs job/${render.jobName}`,
     },
     secretRefs: render.secretRefs.map((item) => ({ profile: item.profile, name: item.secretRef.name, namespace: item.secretRef.namespace ?? render.namespace, keys: item.secretRef.keys ?? [], mountPath: item.runtimeMountPath, projectionPath: item.projectionMountPath, writableCopy: true, valuesPrinted: false })),
+    toolCredentials: summarizeToolCredentials(render.toolCredentials, render.namespace),
     transientEnv: summarizeTransientEnv(transientEnv),
     retention: {
       ttlSecondsAfterFinished: render.ttlSecondsAfterFinished,
@@ -148,6 +149,7 @@ export async function createKubernetesRunnerJob(options: { store: AgentRunStore;
     jobName: saved.jobName,
     idempotencyKey: idempotencyKey ? "present" : null,
     transientEnv: summarizeTransientEnv(transientEnv),
+    toolCredentials: summarizeToolCredentials(render.toolCredentials, render.namespace),
     sessionRef: summarizeSessionRef(run.sessionRef ?? null),
     resourceBundleRef: summarizeResourceBundleRef(run.resourceBundleRef ?? null),
   });
@@ -163,7 +165,8 @@ function transientEnvField(value: unknown): RunnerTransientEnv[] {
     if (!entry || typeof entry !== "object" || Array.isArray(entry)) throw new AgentRunError("schema-invalid", `transientEnv[${index}] must be an object`, { httpStatus: 400 });
     const record = entry as JsonRecord;
     const name = stringField(record, "name");
-    if (!/^[A-Z_][A-Z0-9_]{0,63}$/u.test(name)) throw new AgentRunError("schema-invalid", `transientEnv[${index}].name must be an uppercase env name`, { httpStatus: 400 });
+    validateEnvName(name, `transientEnv[${index}].name`);
+    if (name === "GH_TOKEN" || name === "GITHUB_TOKEN" || name === "OPENAI_API_KEY" || name === "CODEX_API_KEY") throw new AgentRunError("tenant-policy-denied", `transientEnv ${name} must use tool/provider credential assembly instead`, { httpStatus: 403 });
     if (seen.has(name)) throw new AgentRunError("schema-invalid", `transientEnv name ${name} is duplicated`, { httpStatus: 400 });
     seen.add(name);
     const rawValue = record.value;
@@ -173,6 +176,22 @@ function transientEnvField(value: unknown): RunnerTransientEnv[] {
   });
 }
 
+function summarizeToolCredentials(items: Array<{ tool: string; purpose: string | null; secretRef: { namespace?: string; name: string; keys?: string[] }; envName: string; secretKey: string }>, namespace: string): JsonRecord {
+  return {
+    count: items.length,
+    items: items.map((item) => ({
+      tool: item.tool,
+      purpose: item.purpose,
+      name: item.secretRef.name,
+      namespace: item.secretRef.namespace ?? namespace,
+      keys: item.secretRef.keys ?? [],
+      projection: { kind: "env", envName: item.envName, secretKey: item.secretKey },
+      valuesPrinted: false,
+    })),
+    valuesPrinted: false,
+  };
+}
+
 function summarizeTransientEnv(items: RunnerTransientEnv[]): JsonRecord {
   return {
     count: items.length,

src/runner/k8s-job.ts

@@ -33,6 +33,14 @@ interface CredentialProjection {
   projectionMountPath: string;
 }
 
+interface ToolCredentialProjection {
+  tool: string;
+  purpose: string | null;
+  secretRef: SecretRef;
+  envName: string;
+  secretKey: string;
+}
+
 export function renderRunnerJobDryRun(options: RunnerJobRenderOptions): JsonRecord {
   const render = renderRunnerJobManifest({ ...options, dryRun: true });
   const manifest = redactTransientEnvInManifest(render.manifest, options.transientEnv ?? []);
@@ -56,6 +64,7 @@ export function renderRunnerJobDryRun(options: RunnerJobRenderOptions): JsonReco
       sourceCommit: render.sourceCommit,
     },
     secretRefs: render.secretRefs.map((item) => ({ profile: item.profile, name: item.secretRef.name, namespace: item.secretRef.namespace ?? render.namespace, keys: item.secretRef.keys ?? [], mountPath: item.runtimeMountPath, projectionPath: item.projectionMountPath, writableCopy: true, valuesPrinted: false })),
+    toolCredentials: summarizeToolCredentials(render.toolCredentials, render.namespace),
     transientEnv: summarizeTransientEnv(options.transientEnv ?? []),
     retention: {
       ttlSecondsAfterFinished: render.ttlSecondsAfterFinished,
@@ -69,7 +78,7 @@ export function renderRunnerJobDryRun(options: RunnerJobRenderOptions): JsonReco
   };
 }
 
-export function renderRunnerJobManifest(options: RunnerJobRenderOptions): { manifest: JsonRecord; namespace: string; jobName: string; runnerId: string; attemptId: string; sourceCommit: string; serviceAccountName: string; secretRefs: CredentialProjection[]; warnings: string[]; ttlSecondsAfterFinished: number } {
+export function renderRunnerJobManifest(options: RunnerJobRenderOptions): { manifest: JsonRecord; namespace: string; jobName: string; runnerId: string; attemptId: string; sourceCommit: string; serviceAccountName: string; secretRefs: CredentialProjection[]; toolCredentials: ToolCredentialProjection[]; warnings: string[]; ttlSecondsAfterFinished: number } {
   const namespace = options.namespace ?? "agentrun-v01";
   const attemptId = options.attemptId ?? `attempt_${Date.now().toString(36)}`;
   const runnerId = options.runnerId ?? `runner_${shortHash(`${options.run.id}:${attemptId}:${options.commandId}`)}`;
@@ -78,9 +87,10 @@ export function renderRunnerJobManifest(options: RunnerJobRenderOptions): { mani
   const ttlSecondsAfterFinished = options.ttlSecondsAfterFinished ?? 86_400;
   const jobName = `agentrun-v01-runner-${shortDnsHash(options.run.id, attemptId)}`;
   const secretRefs = credentialProjections(options.run, namespace);
+  const toolCredentials = toolCredentialProjections(options.run, namespace);
   const warnings: string[] = [];
   if (secretRefs.length === 0) warnings.push("run executionPolicy.secretScope 未声明 provider SecretRef；runner 将按 secret-unavailable 上报，而不会降级直连外部凭据");
-  const env = runnerEnv(options, { namespace, jobName, runnerId, attemptId, sourceCommit, secretRefs });
+  const env = runnerEnv(options, { namespace, jobName, runnerId, attemptId, sourceCommit, secretRefs, toolCredentials });
   const manifest: JsonRecord = {
     apiVersion: "batch/v1",
     kind: "Job",
@@ -136,10 +146,10 @@ export function renderRunnerJobManifest(options: RunnerJobRenderOptions): { mani
       },
     },
   };
-  return { manifest, namespace, jobName, runnerId, attemptId, sourceCommit, serviceAccountName, secretRefs, warnings, ttlSecondsAfterFinished };
+  return { manifest, namespace, jobName, runnerId, attemptId, sourceCommit, serviceAccountName, secretRefs, toolCredentials, warnings, ttlSecondsAfterFinished };
 }
 
-function runnerEnv(options: RunnerJobRenderOptions, context: { namespace: string; jobName: string; runnerId: string; attemptId: string; sourceCommit: string; secretRefs: CredentialProjection[] }): JsonRecord[] {
+function runnerEnv(options: RunnerJobRenderOptions, context: { namespace: string; jobName: string; runnerId: string; attemptId: string; sourceCommit: string; secretRefs: CredentialProjection[]; toolCredentials: ToolCredentialProjection[] }): JsonRecord[] {
   const selectedSecret = context.secretRefs.find((item) => item.profile === options.run.backendProfile);
   const codexHome = selectedSecret?.runtimeMountPath ?? defaultRuntimeHome(options.run.backendProfile);
   return [
@@ -161,10 +171,23 @@ function runnerEnv(options: RunnerJobRenderOptions, context: { namespace: string
     { name: "HOME", value: "/home/agentrun" },
     { name: "CODEX_HOME", value: codexHome },
     ...(selectedSecret ? [{ name: "AGENTRUN_CODEX_SECRET_HOME", value: selectedSecret.projectionMountPath }] : []),
+    ...toolCredentialEnvVars(context.toolCredentials),
     ...transientEnvVars(options.transientEnv ?? []),
   ];
 }
 
+function toolCredentialEnvVars(items: ToolCredentialProjection[]): JsonRecord[] {
+  return items.map((item) => ({
+    name: item.envName,
+    valueFrom: {
+      secretKeyRef: {
+        name: item.secretRef.name,
+        key: item.secretKey,
+      },
+    },
+  }));
+}
+
 function transientEnvVars(items: RunnerTransientEnv[]): JsonRecord[] {
   return items.map((item) => ({ name: item.name, value: item.value }));
 }
@@ -177,6 +200,22 @@ function summarizeTransientEnv(items: RunnerTransientEnv[]): JsonRecord {
   };
 }
 
+function summarizeToolCredentials(items: ToolCredentialProjection[], namespace: string): JsonRecord {
+  return {
+    count: items.length,
+    items: items.map((item) => ({
+      tool: item.tool,
+      purpose: item.purpose,
+      name: item.secretRef.name,
+      namespace: item.secretRef.namespace ?? namespace,
+      keys: item.secretRef.keys ?? [],
+      projection: { kind: "env", envName: item.envName, secretKey: item.secretKey },
+      valuesPrinted: false,
+    })),
+    valuesPrinted: false,
+  };
+}
+
 function redactTransientEnvInManifest(manifest: JsonRecord, items: RunnerTransientEnv[]): JsonRecord {
   if (items.length === 0) return manifest;
   const names = new Set(items.map((item) => item.name));
@@ -206,6 +245,18 @@ function credentialProjections(run: RunRecord, namespace: string): CredentialPro
   }));
 }
 
+function toolCredentialProjections(run: RunRecord, namespace: string): ToolCredentialProjection[] {
+  const policy: ExecutionPolicy = run.executionPolicy;
+  const credentials = policy.secretScope.toolCredentials ?? [];
+  return credentials.map((item) => ({
+    tool: item.tool,
+    purpose: item.purpose ?? null,
+    secretRef: item.secretRef.namespace ? item.secretRef : { ...item.secretRef, namespace },
+    envName: item.projection.envName,
+    secretKey: item.projection.secretKey ?? item.secretRef.keys?.[0] ?? item.projection.envName,
+  }));
+}
+
 function secretVolume(item: CredentialProjection): JsonRecord {
   const secret: JsonRecord = {
     secretName: item.secretRef.name,

src/selftest/cases/20-runner-k8s-job.ts

@@ -12,7 +12,13 @@ const selfTest: SelfTestCase = async (context) => {
   const server = await startManagerServer({ port: 0, host: "127.0.0.1", sourceCommit: "self-test", store: new MemoryAgentRunStore() });
   try {
     const client = new ManagerClient(server.baseUrl);
-    const item = await createRunWithCommand(client, context, "job smoke", "selftest-job-render", 15_000);
+    const githubToolCredentials = [{
+      tool: "github",
+      purpose: "pull-request",
+      secretRef: { name: "agentrun-v01-tool-github-pr", keys: ["GH_TOKEN"] },
+      projection: { kind: "env", envName: "GH_TOKEN", secretKey: "GH_TOKEN" },
+    }];
+    const item = await createRunWithCommand(client, { ...context, toolCredentials: githubToolCredentials }, "job smoke", "selftest-job-render", 15_000);
     const rendered = renderRunnerJobDryRun({
       run: await client.get(`/api/v1/runs/${item.runId}`) as RunRecord,
       commandId: item.commandId,
@@ -27,6 +33,7 @@ const selfTest: SelfTestCase = async (context) => {
     assert.equal(((rendered.retention as JsonRecord).ttlSecondsAfterFinished), 86_400);
     assert.equal((rendered.jobIdentity as { serviceAccountName?: string }).serviceAccountName, "agentrun-v01-runner");
     assertRunnerJobUsesWritableCodexHome(rendered.manifest as JsonRecord, context.codexHome, "codex-0", "/var/run/agentrun/secrets/codex-0");
+    assertRunnerJobUsesToolCredential(rendered, "GH_TOKEN", "agentrun-v01-tool-github-pr", "GH_TOKEN");
     assert.equal(runnerEnvValue(rendered.manifest as JsonRecord, "HWLAB_DEVICE_POD_SESSION_TOKEN"), "REDACTED");
     assert.deepEqual((((rendered.transientEnv as JsonRecord).names) as string[]), ["HWLAB_DEVICE_POD_SESSION_TOKEN"]);
     assertNoSecretLeak(rendered);
@@ -70,7 +77,7 @@ console.log(JSON.stringify({ apiVersion: manifest.apiVersion, kind: manifest.kin
     });
     try {
       const jobClient = new ManagerClient(serverWithKubectl.baseUrl);
-      const jobItem = await createRunWithCommand(jobClient, context, "job create smoke", "selftest-job-create", 15_000);
+      const jobItem = await createRunWithCommand(jobClient, { ...context, toolCredentials: githubToolCredentials }, "job create smoke", "selftest-job-create", 15_000);
       const created = await jobClient.post(`/api/v1/runs/${jobItem.runId}/runner-jobs`, {
         commandId: jobItem.commandId,
         attemptId: "attempt_selftest_create",
@@ -86,11 +93,12 @@ console.log(JSON.stringify({ apiVersion: manifest.apiVersion, kind: manifest.kin
       assert.equal((manifest.spec as JsonRecord).ttlSecondsAfterFinished, 86_400);
       assert.equal(runnerEnvValue(manifest, "HWLAB_DEVICE_POD_SESSION_TOKEN"), "test-token-material");
       assert.equal(runnerEnvValue(manifest, "HWLAB_CLOUD_API_URL"), "http://cloud.test");
+      assertRunnerJobUsesToolCredential({ manifest, toolCredentials: (created as JsonRecord).toolCredentials } as JsonRecord, "GH_TOKEN", "agentrun-v01-tool-github-pr", "GH_TOKEN");
       assertNoSecretLeak(created);
     } finally {
       await new Promise<void>((resolve) => serverWithKubectl.server.close(() => resolve()));
     }
-    return { name: "runner-k8s-job", tests: ["runner-k8s-job-dry-run", "runner-k8s-job-deepseek-profile-dry-run", "runner-k8s-job-create-api", "runner-k8s-job-retention-ttl", "runner-job-transient-env"] };
+    return { name: "runner-k8s-job", tests: ["runner-k8s-job-dry-run", "runner-k8s-job-deepseek-profile-dry-run", "runner-k8s-job-create-api", "runner-k8s-job-retention-ttl", "runner-job-transient-env", "runner-job-tool-credential-env"] };
   } finally {
     await new Promise<void>((resolve) => server.server.close(() => resolve()));
   }
@@ -108,6 +116,27 @@ function runnerEnvValue(manifest: JsonRecord, name: string): unknown {
   return env.find((item) => item.name === name)?.value;
 }
 
+function assertRunnerJobUsesToolCredential(rendered: JsonRecord, envName: string, secretName: string, secretKey: string): void {
+  const manifest = rendered.manifest as JsonRecord;
+  const spec = manifest.spec as JsonRecord;
+  const template = spec.template as JsonRecord;
+  const podSpec = template.spec as JsonRecord;
+  const containers = podSpec.containers as JsonRecord[];
+  const runner = containers[0] as JsonRecord;
+  const env = runner.env as JsonRecord[];
+  const entry = env.find((item) => item.name === envName) as JsonRecord | undefined;
+  assert.ok(entry, `${envName} env should be projected from a SecretRef`);
+  assert.equal(entry.value, undefined);
+  const valueFrom = entry.valueFrom as JsonRecord;
+  const secretKeyRef = valueFrom.secretKeyRef as JsonRecord;
+  assert.equal(secretKeyRef.name, secretName);
+  assert.equal(secretKeyRef.key, secretKey);
+
+  const summary = rendered.toolCredentials as JsonRecord;
+  assert.equal(summary.valuesPrinted, false);
+  assert.equal(summary.count, 1);
+}
+
 function assertRunnerJobUsesWritableCodexHome(manifest: JsonRecord, expectedCodexHome: string, volumeName: string, projectionPath: string): void {
   const spec = manifest.spec as JsonRecord;
   const template = spec.template as JsonRecord;

src/selftest/harness.ts

@@ -25,6 +25,8 @@ export interface SelfTestResult {
 
 export type SelfTestCase = (context: SelfTestContext) => Promise<SelfTestResult> | SelfTestResult;
 
+type SelfTestRunContext = Pick<SelfTestContext, "workspace" | "codexHome"> & Partial<Pick<SelfTestContext, "deepseekHome">> & { backendProfile?: BackendProfile; includeOnlyProfile?: BackendProfile; toolCredentials?: JsonRecord[] };
+
 export async function createSelfTestContext(root: string): Promise<SelfTestContext> {
   const tmp = await mkdtemp(path.join(os.tmpdir(), "agentrun-selftest-"));
   const codexHome = path.join(tmp, "codex-home");
@@ -52,7 +54,7 @@ export async function createSelfTestContext(root: string): Promise<SelfTestConte
   };
 }
 
-export async function createRunWithCommand(client: ManagerClient, context: Pick<SelfTestContext, "workspace" | "codexHome"> & Partial<Pick<SelfTestContext, "deepseekHome">> & { backendProfile?: BackendProfile; includeOnlyProfile?: BackendProfile }, prompt: string, idempotencyKey: string, timeoutMs: number): Promise<{ runId: string; commandId: string }> {
+export async function createRunWithCommand(client: ManagerClient, context: SelfTestRunContext, prompt: string, idempotencyKey: string, timeoutMs: number): Promise<{ runId: string; commandId: string }> {
   const backendProfile = context.backendProfile ?? "codex";
   const run = await client.post("/api/v1/runs", {
     tenantId: "unidesk",
@@ -65,7 +67,7 @@ export async function createRunWithCommand(client: ManagerClient, context: Pick<
       approval: "never",
       timeoutMs,
       network: "default",
-      secretScope: { allowCredentialEcho: false, providerCredentials: providerCredentials(context, backendProfile) },
+      secretScope: { allowCredentialEcho: false, providerCredentials: providerCredentials(context, backendProfile), ...toolCredentialScope(context) },
     },
     traceSink: null,
   }) as { id: string };
@@ -75,6 +77,10 @@ export async function createRunWithCommand(client: ManagerClient, context: Pick<
   return { runId: run.id, commandId: command.id };
 }
 
+function toolCredentialScope(context: { toolCredentials?: JsonRecord[] }): JsonRecord {
+  return context.toolCredentials ? { toolCredentials: context.toolCredentials } : {};
+}
+
 function providerCredentials(context: Pick<SelfTestContext, "codexHome"> & Partial<Pick<SelfTestContext, "deepseekHome">> & { includeOnlyProfile?: BackendProfile }, backendProfile: BackendProfile): JsonRecord[] {
   const profiles: BackendProfile[] = context.includeOnlyProfile ? [context.includeOnlyProfile] : [backendProfile];
   return profiles.map((profile) => ({