fix: 支持 AgentRun render-only REST 入口 (#170)

Co-authored-by: AgentRun Codex <agentrun-codex@users.noreply.github.com>

src/selftest/cases/10-manager-memory.ts

@@ -18,13 +18,36 @@ const selfTest: SelfTestCase = async () => {
     assert.equal(((health.runnerWorkReady as { valuesPrinted?: unknown } | undefined)?.valuesPrinted), false);
     assert.ok((((health.runnerWorkReady as { requiredImageTools?: string[] } | undefined)?.requiredImageTools) ?? []).includes("npm"));
     assert.equal(health.secretRefs?.valuesPrinted, false);
+    await assertManagerAuthBoundary();
     await assertLongResultUsesTerminalAssistant(client, store);
-    return { name: "manager-memory", tests: ["manager-memory-lifecycle", "manager-result-long-trace"] };
+    return { name: "manager-memory", tests: ["manager-memory-lifecycle", "manager-auth-boundary", "manager-result-long-trace"] };
   } finally {
     await new Promise<void>((resolve) => server.server.close(() => resolve()));
   }
 };
 
+async function assertManagerAuthBoundary(): Promise<void> {
+  const store = new MemoryAgentRunStore();
+  const server = await startManagerServer({ port: 0, host: "127.0.0.1", sourceCommit: "self-test", store, auth: { apiKey: "self-test-secret", source: "self-test" } });
+  try {
+    const healthResponse = await fetch(new URL("/health/readiness", server.baseUrl));
+    assert.equal(healthResponse.status, 200);
+    const healthEnvelope = await healthResponse.json() as JsonRecord;
+    assert.equal(healthEnvelope.ok, true);
+    const deniedResponse = await fetch(new URL("/api/v1/queue/tasks", server.baseUrl));
+    assert.equal(deniedResponse.status, 401);
+    const deniedEnvelope = await deniedResponse.json() as JsonRecord;
+    assert.equal(deniedEnvelope.ok, false);
+    assert.equal(deniedEnvelope.failureKind, "auth-failed");
+    assert.equal((deniedEnvelope.message as string).includes("Bearer"), true);
+    const client = new ManagerClient(server.baseUrl, { apiKey: "self-test-secret" });
+    const page = await client.get("/api/v1/queue/tasks") as JsonRecord;
+    assert.equal(Array.isArray(page.items), true);
+  } finally {
+    await new Promise<void>((resolve) => server.server.close(() => resolve()));
+  }
+}
+
 async function assertLongResultUsesTerminalAssistant(client: ManagerClient, store: MemoryAgentRunStore): Promise<void> {
   const run = store.createRun({
     tenantId: "unidesk",

src/selftest/harness.ts

@@ -33,6 +33,10 @@ type SelfTestRunContext = Pick<SelfTestContext, "workspace" | "codexHome"> & Par
 export async function createSelfTestContext(root: string): Promise<SelfTestContext> {
   const tmp = await mkdtemp(path.join(os.tmpdir(), "agentrun-selftest-"));
   const previousSelftestWorkReadyBinPath = process.env.AGENTRUN_SELFTEST_WORK_READY_BIN_PATH;
+  const previousAgentRunApiKey = process.env.AGENTRUN_API_KEY;
+  const previousAgentRunApiKeyFile = process.env.AGENTRUN_API_KEY_FILE;
+  delete process.env.AGENTRUN_API_KEY;
+  delete process.env.AGENTRUN_API_KEY_FILE;
   const codexHome = path.join(tmp, "codex-home");
   const deepseekHome = path.join(tmp, "deepseek-home");
   const minimaxM3Home = path.join(tmp, "minimax-m3-home");
@@ -67,6 +71,10 @@ export async function createSelfTestContext(root: string): Promise<SelfTestConte
     cleanup: async () => {
       if (previousSelftestWorkReadyBinPath === undefined) delete process.env.AGENTRUN_SELFTEST_WORK_READY_BIN_PATH;
       else process.env.AGENTRUN_SELFTEST_WORK_READY_BIN_PATH = previousSelftestWorkReadyBinPath;
+      if (previousAgentRunApiKey === undefined) delete process.env.AGENTRUN_API_KEY;
+      else process.env.AGENTRUN_API_KEY = previousAgentRunApiKey;
+      if (previousAgentRunApiKeyFile === undefined) delete process.env.AGENTRUN_API_KEY_FILE;
+      else process.env.AGENTRUN_API_KEY_FILE = previousAgentRunApiKeyFile;
       await rm(tmp, { recursive: true, force: true });
     },
   };