fix: validate Sub2API pool key through admin API

.agents/skills/unidesk-sub2api/references/codex-pool.md

@@ -40,7 +40,7 @@ bun scripts/cli.ts platform-infra sub2api codex-pool cleanup-probes --target D60
 - `manualAccounts.protected`: 已在 Sub2API 手动创建/维护、且必须排除在 UniDesk-managed Codex pool credentials 和 sentinel 控制之外的账号。默认不得改 credentials/status/schedulable/priority/capacity/loadFactor；只有显式声明 `proxyBinding` 时，`sync --confirm` 才允许把该账号的 `proxy_id` 对齐到 YAML 目标的 egress proxy；只有显式声明 `groupBinding.source: pool-group` 时，才允许把该账号加入统一消费 API key 使用的 pool group。`targetIds` 可选；省略表示所有 target 都保护该账号，设置后只在匹配 target 上纳入 proxy/group 窄同步和 sentinel-probe 拒绝列表，避免 PK01-only 手动账号漂移卡住 JD01 pool。
 - Sentinel 配置、marker-only 判定、镜像、report/probe 和远端 job/poll 边界见 [sentinel.md](sentinel.md)。
 
-`sync --confirm` 会登录 Sub2API admin、创建/更新 group、创建/更新 YAML 中的 `unidesk-codex-*` accounts，并创建/复用统一 API key。k3s target 还会写入统一 API key Secret 并部署/更新哨兵资源；PK01 host-Docker target 只写 Sub2API runtime 和 host-Docker env 文件。`sync` 不把既有 managed account 直接恢复为 `schedulable=true`。恢复只由哨兵在读取 Sub2API runtime `schedulable=false` 后触发 recovery probe，并在 marker 命中时执行。`sync` 默认不删除 YAML 中缺席的 managed account。只有明确退役上游时才使用 `sync --confirm --prune-removed` 删除缺席且 `extra.unidesk_managed=true` 的 `unidesk-codex-*` account。对 `manualAccounts.protected`，`sync` 只执行 YAML 显式允许的窄同步；当前允许项是从目标 `egressProxy` 创建/更新 Sub2API internal proxy 记录并绑定 `proxy_id`，以及把受保护手动账号加入当前 `pool.groupName`。它仍不接管该账号凭据、status、schedulable、priority/capacity/loadFactor 或哨兵状态。若受保护手动账号在运行面缺失，`sync`/`validate` 会报告 manual account drift；不要自动创建、删除、接管或从 YAML 移除该账号。
+`sync --confirm` 会登录 Sub2API admin、创建/更新 group、创建/更新 YAML 中的 `unidesk-codex-*` accounts，并创建/复用统一 API key。k3s target 还会写入统一 API key Secret 并部署/更新哨兵资源；PK01 host-Docker target 只写 Sub2API runtime 和 host-Docker env 文件。host-Docker `validate` 也先使用 env 中的 Sub2API admin 凭据登录管理 API；如果 env 的统一 `API_KEY` 缺失或不匹配，但管理 API 已返回名为 YAML `pool.apiKeyName` 的现有 key，`validate` 只恢复该现有 key 到 host-Docker env 后继续校验，不创建新 key。`sync` 不把既有 managed account 直接恢复为 `schedulable=true`。恢复只由哨兵在读取 Sub2API runtime `schedulable=false` 后触发 recovery probe，并在 marker 命中时执行。`sync` 默认不删除 YAML 中缺席的 managed account。只有明确退役上游时才使用 `sync --confirm --prune-removed` 删除缺席且 `extra.unidesk_managed=true` 的 `unidesk-codex-*` account。对 `manualAccounts.protected`，`sync` 只执行 YAML 显式允许的窄同步；当前允许项是从目标 `egressProxy` 创建/更新 Sub2API internal proxy 记录并绑定 `proxy_id`，以及把受保护手动账号加入当前 `pool.groupName`。它仍不接管该账号凭据、status、schedulable、priority/capacity/loadFactor 或哨兵状态。若受保护手动账号在运行面缺失，`sync`/`validate` 会报告 manual account drift；不要自动创建、删除、接管或从 YAML 移除该账号。
 
 `trace --request-id <requestId>` 是只读 request 追溯报表，不触发 probe、不修改账号。默认输出请求开始/最终状态、failover、`account_select_failed`、窗口内 `account_temp_unschedulable`、admin schedulable 写入计数和当前账号快照；`reason=failover-attempted-no-candidate` 表示 Sub2API 已进入自动切号，但排除当前失败账号后没有可用候选。需要机器处理时使用 `--raw`，需要原始匹配行时加 `--show-lines`。
 

config/platform-infra/sub2api.yaml

@@ -82,7 +82,7 @@ targets:
     redisReplicas: 1
     image:
       repository: docker.1panel.live/weishaw/sub2api
-      tag: 0.1.147
+      tag: 0.1.146
       pullPolicy: IfNotPresent
     dependencyImages:
       redis: docker.m.daocloud.io/library/redis:8-alpine

scripts/src/platform-infra-sub2api-codex/remote-python-sync.ts

@@ -1070,15 +1070,77 @@ def generate_api_key():
     alphabet = string.ascii_letters + string.digits
     return "sk-unidesk-codex-" + "".join(secrets.choice(alphabet) for _ in range(48))
 
+def sub2api_key_value(item):
+    if not isinstance(item, dict):
+        return None
+    key = item.get("key")
+    return key if isinstance(key, str) and key else None
+
+def find_pool_key_by_name(keys):
+    return next((item for item in keys if isinstance(item, dict) and item.get("name") == POOL_API_KEY_NAME), None)
+
 def existing_sub2api_pool_api_key(token):
     try:
-        existing = next((item for item in list_user_keys(token) if item.get("name") == POOL_API_KEY_NAME), None)
+        existing = find_pool_key_by_name(list_user_keys(token))
     except Exception:
         return None
-    if not isinstance(existing, dict):
-        return None
-    key = existing.get("key")
-    return key if isinstance(key, str) and key else None
+    return sub2api_key_value(existing)
+
+def resolve_pool_api_key_for_validate(token):
+    secret_value = None
+    secret_error = None
+    try:
+        secret_value = decode_secret_value(POOL_API_KEY_SECRET_NAME, POOL_API_KEY_SECRET_KEY)
+    except Exception as exc:
+        if RUNTIME_MODE != "host-docker":
+            raise
+        secret_error = str(exc)
+    keys = list_user_keys(token)
+    matched_item = None
+    if secret_value:
+        matched_item = next((item for item in keys if isinstance(item, dict) and item.get("key") == secret_value), None)
+        if isinstance(matched_item, dict) and matched_item.get("name") == POOL_API_KEY_NAME:
+            return secret_value, matched_item, {
+                "ok": True,
+                "source": pool_api_key_secret_location(),
+                "sourceAction": "kept-existing",
+                "secretPresent": True,
+                "lookup": "matched-by-value",
+                "hostEnvAction": "none",
+                "valuesPrinted": False,
+            }
+    if RUNTIME_MODE == "host-docker":
+        named_item = find_pool_key_by_name(keys)
+        named_key = sub2api_key_value(named_item)
+        if named_key:
+            host_env_action = write_host_env_value(POOL_API_KEY_SECRET_KEY, named_key)
+            return named_key, named_item, {
+                "ok": True,
+                "source": "sub2api-admin-api",
+                "sourceAction": "recovered-missing" if not secret_value else "repaired-mismatch",
+                "secretPresent": bool(secret_value),
+                "lookup": "matched-by-name",
+                "hostEnvAction": host_env_action,
+                "hostEnvPath": HOST_DOCKER_ENV_PATH,
+                "hostEnvKey": POOL_API_KEY_SECRET_KEY,
+                "valuesPrinted": False,
+            }
+        if not secret_value:
+            detail = f"; envReadError={secret_error}" if secret_error else ""
+            raise RuntimeError(f"{pool_api_key_secret_location()} missing and Sub2API admin API key named {POOL_API_KEY_NAME} did not return a recoverable key{detail}")
+        matched_name = matched_item.get("name") if isinstance(matched_item, dict) else None
+        raise RuntimeError(f"{pool_api_key_secret_location()} present but does not match pool key {POOL_API_KEY_NAME}; matchedName={matched_name or '-'}; admin API did not return a recoverable named key")
+    if not secret_value:
+        raise RuntimeError(f"{POOL_API_KEY_SECRET_NAME}.{POOL_API_KEY_SECRET_KEY} missing")
+    return secret_value, matched_item, {
+        "ok": isinstance(matched_item, dict) and matched_item.get("name") == POOL_API_KEY_NAME,
+        "source": pool_api_key_secret_location(),
+        "sourceAction": "kept-existing",
+        "secretPresent": True,
+        "lookup": "matched-by-value" if matched_item else "missing-in-admin-api",
+        "hostEnvAction": "not-applicable",
+        "valuesPrinted": False,
+    }
 
 def ensure_api_key_secret(group_id, token):
     existing = None
@@ -2614,6 +2676,7 @@ def run_sync():
         "webSocketsV2": ws_v2_status,
         "tempUnschedulable": temp_unschedulable_status,
         "apiKey": {
+            "ok": True,
             "name": POOL_API_KEY_NAME,
             "secret": pool_api_key_secret_location(),
             "secretAction": secret_action,
@@ -2633,11 +2696,9 @@ def run_sync():
     }
 
 def run_validate():
-    api_key = decode_secret_value(POOL_API_KEY_SECRET_NAME, POOL_API_KEY_SECRET_KEY)
-    if not api_key:
-        raise RuntimeError(f"{POOL_API_KEY_SECRET_NAME}.{POOL_API_KEY_SECRET_KEY} missing")
     admin_email, token, admin_compliance = login()
-    key_item = next((item for item in list_user_keys(token) if item.get("key") == api_key), None)
+    api_key, key_item, api_key_source = resolve_pool_api_key_for_validate(token)
+    api_key_ok = isinstance(key_item, dict) and key_item.get("name") == POOL_API_KEY_NAME
     owner_balance = None
     owner_concurrency = None
     if key_item is not None and key_item.get("user_id") is not None:
@@ -2656,7 +2717,7 @@ def run_validate():
     runtime_capabilities = validate_runtime_capabilities(token)
     sentinel = sentinel_runtime_status()
     return {
-        "ok": gateway["ok"] is True and responses_smoke["ok"] is True and (owner_concurrency is None or owner_concurrency["ok"] is True) and capacity_status["ok"] is True and load_factor_status["ok"] is True and ws_v2_status["ok"] is True and temp_unschedulable_status["ok"] is True and manual_account_protections.get("ok") is True and sentinel.get("ok") is True and runtime_capabilities.get("ok") is True,
+        "ok": api_key_ok is True and gateway["ok"] is True and responses_smoke["ok"] is True and (owner_concurrency is None or owner_concurrency["ok"] is True) and capacity_status["ok"] is True and load_factor_status["ok"] is True and ws_v2_status["ok"] is True and temp_unschedulable_status["ok"] is True and manual_account_protections.get("ok") is True and sentinel.get("ok") is True and runtime_capabilities.get("ok") is True,
         "degraded": bool(responses_smoke.get("degraded")) or bool(compact_evidence.get("degraded")) or bool(responses_evidence.get("degraded")) or runtime_capabilities.get("ok") is not True,
         "mode": "validate",
         "namespace": NAMESPACE,
@@ -2664,7 +2725,10 @@ def run_validate():
         "appPod": APP_POD,
         "admin": {"email": admin_email, "tokenPrinted": False, "compliance": admin_compliance},
         "apiKey": {
+            "ok": api_key_ok,
+            "name": POOL_API_KEY_NAME,
             "secret": pool_api_key_secret_location(),
+            "source": api_key_source,
             "sub2apiId": key_item.get("id") if isinstance(key_item, dict) else None,
             "userId": key_item.get("user_id") if isinstance(key_item, dict) else None,
             "groupId": key_item.get("group_id") if isinstance(key_item, dict) else None,

scripts/src/platform-infra/apply-script.ts

@@ -258,6 +258,7 @@ export function applyScript(
         appSourcePath: secretMaterial.appSourcePath,
         sourceAction: secretMaterial.action,
         fingerprint: secretMaterial.fingerprint,
+        adminEmail: secretMaterial.adminEmail,
         valuesPrinted: false,
       }))})`;
   const exposureSecretFile = publicExposureSecretMaterial === null

scripts/src/platform-infra/entry.ts

@@ -287,6 +287,7 @@ export interface ExternalActiveSecretMaterial {
   appSourcePath: string;
   action: "create" | "update" | "none";
   fingerprint: string;
+  adminEmail: string;
   values: Record<typeof requiredSecretKeys[number], string>;
 }
 

scripts/src/platform-infra/host-docker.ts

@@ -91,7 +91,7 @@ export function hostDockerEnvFile(sub2api: Sub2ApiConfig, target: Sub2ApiTargetC
     REDIS_POOL_SIZE: "32",
     REDIS_MIN_IDLE_CONNS: "2",
     REDIS_ENABLE_TLS: "false",
-    ADMIN_EMAIL: "admin@sub2api.platform-infra.local",
+    ADMIN_EMAIL: secretMaterial.adminEmail,
     ADMIN_PASSWORD: secretMaterial.values.ADMIN_PASSWORD,
     JWT_SECRET: secretMaterial.values.JWT_SECRET,
     TOTP_ENCRYPTION_KEY: secretMaterial.values.TOTP_ENCRYPTION_KEY,
@@ -240,6 +240,7 @@ export function hostDockerApplyScript(sub2api: Sub2ApiConfig, target: Sub2ApiTar
     appSourcePath: secretMaterial.appSourcePath,
     sourceAction: secretMaterial.action,
     fingerprint: secretMaterial.fingerprint,
+    adminEmail: secretMaterial.adminEmail,
     valuesPrinted: false,
   };
   return `

scripts/src/platform-infra/secrets-and-egress.ts

@@ -64,6 +64,7 @@ export function prepareExternalActiveSecret(sub2api: Sub2ApiConfig): ExternalAct
   const existing = existedBefore ? parseEnvFile(readFileSync(appSourcePath, "utf8")) : {};
   const next = { ...existing };
   next.POSTGRES_PASSWORD = dbPassword;
+  if (next.ADMIN_EMAIL === undefined || next.ADMIN_EMAIL.length === 0) next.ADMIN_EMAIL = "admin@sub2api.platform-infra.local";
   if (next.ADMIN_PASSWORD === undefined || next.ADMIN_PASSWORD.length === 0) next.ADMIN_PASSWORD = randomBytes(16).toString("hex");
   if (next.JWT_SECRET === undefined || next.JWT_SECRET.length === 0) next.JWT_SECRET = randomBytes(32).toString("hex");
   if (next.TOTP_ENCRYPTION_KEY === undefined || next.TOTP_ENCRYPTION_KEY.length === 0) next.TOTP_ENCRYPTION_KEY = randomBytes(32).toString("hex");
@@ -75,12 +76,13 @@ export function prepareExternalActiveSecret(sub2api: Sub2ApiConfig): ExternalAct
   };
   const missing = requiredSecretKeys.filter((key) => values[key].length === 0);
   if (missing.length > 0) throw new Error(`external-active app secret source is missing ${missing.join(", ")}`);
+  const managedAppSourceKeys = [...requiredSecretKeys, "ADMIN_EMAIL"] as const;
   const action = !existedBefore
     ? "create"
-    : requiredSecretKeys.some((key) => existing[key] !== values[key])
+    : managedAppSourceKeys.some((key) => existing[key] !== next[key])
       ? "update"
       : "none";
-  if (action !== "none") writeEnvFile(appSourcePath, { ...existing, ...values });
+  if (action !== "none") writeEnvFile(appSourcePath, { ...existing, ...values, ADMIN_EMAIL: next.ADMIN_EMAIL });
   return {
     sourceRef: database.sourceRef,
     sourcePath: dbSource.sourcePathRedacted,
@@ -88,6 +90,7 @@ export function prepareExternalActiveSecret(sub2api: Sub2ApiConfig): ExternalAct
     appSourcePath: redactRepoPath(appSourcePath),
     action,
     fingerprint: fingerprintSecretValues(values, [...requiredSecretKeys]),
+    adminEmail: next.ADMIN_EMAIL,
     values,
   };
 }