fix: 保留 Aipod 服务端默认值

scripts/src/agentrun.test.ts

@@ -1123,6 +1123,18 @@ describe("AgentRun YAML tool credential binding", () => {
       expect(renderBodies).toHaveLength(2);
       expect(submittedBodies).toHaveLength(2);
       expect(submittedBodies[1]).toEqual(renderedTask());
+
+      credentialMode = "conflict";
+      const rejected = await runAgentRunCommand(null, ["create", "task", "--aipod", "Artificer", "--prompt", "fixture", "-o", "json"]);
+      expect(rejected.ok).toBe(false);
+      expect(submittedBodies).toHaveLength(2);
+      expect(renderedTextOf(rejected)).toContain("github/github-ssh keys conflict");
+
+      credentialMode = "unknown";
+      const unknownRejected = await runAgentRunCommand(null, ["create", "task", "--aipod", "Artificer", "--prompt", "fixture", "-o", "json"]);
+      expect(unknownRejected.ok).toBe(false);
+      expect(submittedBodies).toHaveLength(2);
+      expect(renderedTextOf(unknownRejected)).toContain("artifact-store/publish is not declared by YAML lane");
     } finally {
       server.stop(true);
       if (previousConfig === undefined) delete process.env.AGENTRUN_CLIENT_CONFIG;

scripts/src/agentrun/rest-bridge.ts

@@ -703,8 +703,20 @@ export async function sessionRunBodyFromArgs(sessionId: string, args: string[],
 
 export function normalizeAipodRenderedQueueTask(task: Record<string, unknown>, args: string[], aipod: string): Record<string, unknown> {
   if (Object.keys(task).length === 0) return task;
+  const backendProfile = stringOrNull(task.backendProfile);
+  if (backendProfile !== null) {
+    const sessionPolicy = readAgentRunClientConfig().client.sessionPolicy;
+    const policyTarget = resolveAgentRunSessionPolicyTarget();
+    if (agentRunProviderCredentialRefs(policyTarget.spec, backendProfile).length === 0) {
+      throw new AgentRunRestError("validation-failed", `${policyTarget.configPath} has no providerCredential Secret binding for AipodSpec ${aipod} backendProfile=${backendProfile} on ${policyTarget.spec.nodeId}/${policyTarget.spec.lane}`);
+    }
+    const basePolicy = record(task.executionPolicy);
+    defaultAgentRunExecutionPolicy(backendProfile, sessionPolicy, policyTarget, {
+      includeToolCredentials: true,
+      basePolicy,
+    });
+  }
   void args;
-  void aipod;
   return { ...task };
 }