修复运行时凭证与网络出口兼容性

main.py

@@ -14,13 +14,14 @@ import signal
 import threading
 from datetime import datetime, timezone
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-from typing import Any, Mapping
+from pathlib import Path
+from typing import Any, Callable, Mapping
 from urllib.parse import quote, urlencode, urlsplit
-from urllib.request import ProxyHandler, Request, build_opener
+from urllib.request import Request, build_opener
 
 
 AGENT_NAME = "xc-model-auto-adaptation-agent"
-AGENT_VERSION = "1.0.0"
+AGENT_VERSION = "1.0.1"
 TARGET_VENDOR = "天数智芯"
 TARGET_CARD = "天垓100"
 DEFAULT_TARGET_GPU = "Iluvatar_bi-100"
@@ -103,7 +104,10 @@ CONFIG_PARAMS = os.getenv("MODELHUB_CONFIG_PARAMS", DEFAULT_CONFIG_PARAMS)
 SECRET_ASSIGNMENT_RE = re.compile(
     r"(?i)(token|secret|password|api[_-]?key)=([^&\s]+)"
 )
-HTTP_OPENER = build_opener(ProxyHandler({}))
+# Keep urllib's standard proxy handling. The hosted runtime may provide its
+# outbound route through HTTP(S)_PROXY, so disabling proxies can isolate the
+# scanner even though the container itself remains healthy.
+HTTP_OPENER = build_opener()
 STATE_LOCK = threading.Lock()
 STOP = threading.Event()
 SCANNER_STATE: dict[str, Any] = {
@@ -125,15 +129,39 @@ class PlatformAPIError(RuntimeError):
     """Raised when ModelHub returns a non-success business response."""
 
 
-def resolve_runtime_token(environ: Mapping[str, str] | None = None) -> str:
-    """Resolve documented/compatible secret names without ever logging values."""
+TOKEN_PLACEHOLDERS = {"tmp", "placeholder", "changeme", "change-me", "test"}
+
+
+def _valid_runtime_token(value: str) -> bool:
+    value = value.strip()
+    return bool(value) and value.lower() not in TOKEN_PLACEHOLDERS
+
+
+def resolve_runtime_token(
+    environ: Mapping[str, str] | None = None,
+    read_text: Callable[[str], str] | None = None,
+) -> str:
+    """Resolve the platform credential without ever logging its value."""
 
     source = environ if environ is not None else os.environ
-    return (
-        source.get("MODELHUB_XC_TOKEN", "")
-        or source.get("EXTERNAL_SERVICE_TOKEN", "")
-        or source.get("XC_TOKEN", "")
-    )
+    token_file = source.get("XC_TOKEN_FILE", "").strip()
+    if token_file:
+        file_reader = read_text or (
+            lambda path: Path(path).read_text(encoding="utf-8")
+        )
+        try:
+            value = file_reader(token_file).strip()
+        except (OSError, UnicodeError):
+            return ""
+        return value if _valid_runtime_token(value) else ""
+
+    for name in ("MODELHUB_XC_TOKEN", "XC_TOKEN", "EXTERNAL_SERVICE_TOKEN"):
+        value = source.get(name, "").strip()
+        if _valid_runtime_token(value):
+            return value
+        if value:
+            return ""
+    return ""
 
 
 XC_TOKEN = resolve_runtime_token()
@@ -187,7 +215,10 @@ def _http_json(
     """Call one JSON endpoint without logging headers, bodies, or credentials."""
 
     body = None
-    headers = {"Accept": "application/json"}
+    headers = {
+        "Accept": "application/json",
+        "User-Agent": f"{AGENT_NAME}/{AGENT_VERSION}",
+    }
     if payload is not None:
         body = json.dumps(payload, ensure_ascii=False).encode("utf-8")
         headers["Content-Type"] = "application/json"