From 1919373c09e57dbacec50b1ad2f1690d28fc4f83 Mon Sep 17 00:00:00 2001 From: "Codex (Delicious233)" Date: Thu, 30 Jul 2026 21:08:18 +0800 Subject: [PATCH 1/4] chore(id): retire legacy issuer defaults --- .env.example | 4 ++-- app/desktop/scripts/manual-chat-flow-check.mjs | 2 +- .../src/__e2e__/teamrun-ui-evidence.spec.ts | 2 +- app/desktop/src/api/hubAuth.test.ts | 4 ++-- app/mobile-rn/app.config.ts | 2 +- app/mobile-rn/src/integrations/deepLinking.test.ts | 6 +++--- app/shared/src/testing/e2eDataModeContract.test.ts | 2 +- app/shared/src/testing/e2eDataModeContract.ts | 2 +- app/web/scripts/manual-chat-flow-check.mjs | 2 +- deployments/production/docker-compose.yml | 2 +- hub-server/configs/config.yaml | 2 +- hub-server/deployments/.env.production.example | 2 +- hub-server/deployments/docker-compose.prod.yml | 2 +- hub-server/deployments/docker-compose.us1.yml | 2 +- hub-server/deployments/hk2/.env.hk2.example | 4 ++-- hub-server/deployments/hk2/docker-compose.hk2.yml | 2 +- hub-server/internal/config/config_tokendance.go | 2 +- hub-server/tests/oidc/oidc_smoke_test.go | 2 +- .../verify-token-dance-id-login-readiness.ps1 | 14 +++++++------- 19 files changed, 30 insertions(+), 30 deletions(-) diff --git a/.env.example b/.env.example index 48c1a3bd3..76a545ce2 100644 --- a/.env.example +++ b/.env.example @@ -51,7 +51,7 @@ AGENTHUB_UPLOAD_MAX_SIZE=10485760 # Hub Server is the AgentHub relying party. Register the exact Hub callback # and public Web callback in TokenDance ID before enabling this in a shared # environment. Keep the client secret in the local/ops secret store only. -AGENTHUB_TOKENDANCE_ID_ISSUER_URL=https://id.vectorcontrol.tech +AGENTHUB_TOKENDANCE_ID_ISSUER_URL=https://id.tokendancelab.com AGENTHUB_TOKENDANCE_ID_JWKS_URI= AGENTHUB_TOKENDANCE_ID_CLIENT_ID= AGENTHUB_TOKENDANCE_ID_CLIENT_SECRET= @@ -66,7 +66,7 @@ AGENTHUB_TOKENDANCE_ID_ALLOWED_REDIRECT_URIS=http://127.0.0.1/callback,http://lo # ── TokenDance ID no-secret login readiness ─ # These values are script metadata for scripts/verify/verify-token-dance-id-login-readiness.ps1. # They are not Hub runtime secrets and do not replace AGENTHUB_TOKENDANCE_ID_*. -AGENTHUB_TDID_LOGIN_ISSUER_URL=https://id.vectorcontrol.tech +AGENTHUB_TDID_LOGIN_ISSUER_URL=https://id.tokendancelab.com AGENTHUB_TDID_LOGIN_CLIENT_ID= AGENTHUB_TDID_LOGIN_TEST_ACCOUNT_REF= # Optional local OIDC discovery JSON fixture for script contract tests only. diff --git a/app/desktop/scripts/manual-chat-flow-check.mjs b/app/desktop/scripts/manual-chat-flow-check.mjs index 58f09fe37..e377e6794 100644 --- a/app/desktop/scripts/manual-chat-flow-check.mjs +++ b/app/desktop/scripts/manual-chat-flow-check.mjs @@ -14,7 +14,7 @@ fs.mkdirSync(outputDir, { recursive: true }); const liveBackendHosts = new Set([ 'api.hub.vectorcontrol.tech', 'hub.vectorcontrol.tech', - 'id.vectorcontrol.tech', + 'id.tokendancelab.com', 'api.vectorcontrol.tech', 'localhost:8080', '127.0.0.1:8080', diff --git a/app/desktop/src/__e2e__/teamrun-ui-evidence.spec.ts b/app/desktop/src/__e2e__/teamrun-ui-evidence.spec.ts index 557b2ec33..3d056df70 100644 --- a/app/desktop/src/__e2e__/teamrun-ui-evidence.spec.ts +++ b/app/desktop/src/__e2e__/teamrun-ui-evidence.spec.ts @@ -3,7 +3,7 @@ import { expect, test, type Page, type TestInfo } from '@playwright/test'; const LIVE_BACKEND_HOSTS = new Set([ 'api.hub.vectorcontrol.tech', 'hub.vectorcontrol.tech', - 'id.vectorcontrol.tech', + 'id.tokendancelab.com', 'api.vectorcontrol.tech', 'localhost:8080', '127.0.0.1:8080', diff --git a/app/desktop/src/api/hubAuth.test.ts b/app/desktop/src/api/hubAuth.test.ts index 8075ca503..a1be0b2c2 100644 --- a/app/desktop/src/api/hubAuth.test.ts +++ b/app/desktop/src/api/hubAuth.test.ts @@ -124,7 +124,7 @@ describe('Hub OIDC API contract (mocked)', () => { it('oidcAuthorize sends correct payload to Hub', async () => { const mockResponse = { state: 'hub-generated-state', - authorization_url: 'https://id.vectorcontrol.tech/oidc/auth?response_type=code&client_id=hub&redirect_uri=http://localhost:8080/callback&code_challenge=abc&code_challenge_method=S256&state=hub-generated-state', + authorization_url: 'https://id.tokendancelab.com/oidc/auth?response_type=code&client_id=hub&redirect_uri=http://localhost:8080/callback&code_challenge=abc&code_challenge_method=S256&state=hub-generated-state', }; const fetchMock = vi.fn().mockResolvedValue({ @@ -152,7 +152,7 @@ describe('Hub OIDC API contract (mocked)', () => { const data = await res.json(); expect(data.state).toBe('hub-generated-state'); - expect(data.authorization_url).toContain('id.vectorcontrol.tech'); + expect(data.authorization_url).toContain('id.tokendancelab.com'); const [, authorizeInit] = fetchMock.mock.calls[0] as [string, RequestInit]; const sent = JSON.parse(authorizeInit.body as string); expect(sent.redirect_uri).toBe('http://127.0.0.1:49152/callback'); diff --git a/app/mobile-rn/app.config.ts b/app/mobile-rn/app.config.ts index 79b6e94c0..677a8b68f 100644 --- a/app/mobile-rn/app.config.ts +++ b/app/mobile-rn/app.config.ts @@ -69,7 +69,7 @@ const config = { ], extra: { hubBaseUrl: resolveDefaultHubBaseUrl(), - oidcIssuer: env?.EXPO_PUBLIC_TOKENDANCE_ID_ISSUER ?? 'https://id.vectorcontrol.tech', + oidcIssuer: env?.EXPO_PUBLIC_TOKENDANCE_ID_ISSUER ?? 'https://id.tokendancelab.com', }, } as ExpoConfig; diff --git a/app/mobile-rn/src/integrations/deepLinking.test.ts b/app/mobile-rn/src/integrations/deepLinking.test.ts index ceefaad3f..3f9371e74 100644 --- a/app/mobile-rn/src/integrations/deepLinking.test.ts +++ b/app/mobile-rn/src/integrations/deepLinking.test.ts @@ -17,7 +17,7 @@ describe('AgentHub mobile deep links', () => { expect(isAgentHubAuthCallback('agenthub://auth/callback?code=abc&state=123')).toBe(true); expect(isAgentHubAuthCallback('agenthub://runs/123')).toBe(false); expect(isAgentHubAuthCallback('agenthub://auth/callback-extra?code=abc&state=123')).toBe(false); - expect(isAgentHubAuthCallback('https://id.vectorcontrol.tech/callback')).toBe(false); + expect(isAgentHubAuthCallback('https://id.tokendancelab.com/callback')).toBe(false); }); it('parses TokenDance ID OIDC authorization code callbacks', () => { @@ -50,7 +50,7 @@ describe('AgentHub mobile deep links', () => { }); it('rejects non-AgentHub callbacks and malformed URLs', () => { - expect(parseOidcCallback('https://id.vectorcontrol.tech/callback?code=abc&state=123')).toEqual({ + expect(parseOidcCallback('https://id.tokendancelab.com/callback?code=abc&state=123')).toEqual({ kind: 'invalid', reason: 'invalid_callback', }); @@ -131,7 +131,7 @@ describe('AgentHub mobile deep links', () => { kind: 'invalid', reason: 'invalid_url', }); - expect(parseAgentHubDeepLink('https://id.vectorcontrol.tech/callback')).toEqual({ + expect(parseAgentHubDeepLink('https://id.tokendancelab.com/callback')).toEqual({ kind: 'invalid', reason: 'invalid_scheme', }); diff --git a/app/shared/src/testing/e2eDataModeContract.test.ts b/app/shared/src/testing/e2eDataModeContract.test.ts index d5237582f..8364856f5 100644 --- a/app/shared/src/testing/e2eDataModeContract.test.ts +++ b/app/shared/src/testing/e2eDataModeContract.test.ts @@ -212,7 +212,7 @@ describe('e2e data-mode contract', () => { it('classifies backend requests by stable platform boundary', () => { expect(classifyE2ERequest('http://localhost:8080/client/auth/me')).toBe('hub'); expect(classifyE2ERequest('http://127.0.0.1:3210/v1/runs')).toBe('local-edge'); - expect(classifyE2ERequest('https://id.vectorcontrol.tech/oauth/authorize')).toBe('tokendance-id'); + expect(classifyE2ERequest('https://id.tokendancelab.com/oauth/authorize')).toBe('tokendance-id'); expect(classifyE2ERequest('https://api.vectorcontrol.tech/v1/chat/completions')).toBe('gateway'); expect(classifyE2ERequest('http://127.0.0.1:5174/')).toBe('app'); }); diff --git a/app/shared/src/testing/e2eDataModeContract.ts b/app/shared/src/testing/e2eDataModeContract.ts index e791ca4ee..fdba6db77 100644 --- a/app/shared/src/testing/e2eDataModeContract.ts +++ b/app/shared/src/testing/e2eDataModeContract.ts @@ -295,7 +295,7 @@ const LOCAL_EDGE_HOSTS = new Set([ ]); const TOKEN_DANCE_ID_HOSTS = new Set([ - 'id.vectorcontrol.tech', + 'id.tokendancelab.com', ]); const GATEWAY_HOSTS = new Set([ diff --git a/app/web/scripts/manual-chat-flow-check.mjs b/app/web/scripts/manual-chat-flow-check.mjs index 29331fa06..7c7f87ed0 100644 --- a/app/web/scripts/manual-chat-flow-check.mjs +++ b/app/web/scripts/manual-chat-flow-check.mjs @@ -17,7 +17,7 @@ fs.mkdirSync(outputDir, { recursive: true }); const blockedHosts = new Set([ 'api.hub.vectorcontrol.tech', 'hub.vectorcontrol.tech', - 'id.vectorcontrol.tech', + 'id.tokendancelab.com', 'api.vectorcontrol.tech', 'localhost:3210', '127.0.0.1:3210', diff --git a/deployments/production/docker-compose.yml b/deployments/production/docker-compose.yml index 4ba3a4053..6dc983043 100644 --- a/deployments/production/docker-compose.yml +++ b/deployments/production/docker-compose.yml @@ -80,7 +80,7 @@ services: AGENTHUB_UPLOAD_DIR: /app/uploads AGENTHUB_UPLOAD_MAX_SIZE: "10485760" # TokenDance ID OIDC - AGENTHUB_TOKENDANCE_ID_ISSUER_URL: https://id.vectorcontrol.tech + AGENTHUB_TOKENDANCE_ID_ISSUER_URL: https://id.tokendancelab.com AGENTHUB_TOKENDANCE_ID_CLIENT_ID: ${AGENTHUB_TOKENDANCE_ID_CLIENT_ID:-} AGENTHUB_TOKENDANCE_ID_CLIENT_SECRET: ${AGENTHUB_TOKENDANCE_ID_CLIENT_SECRET:-} AGENTHUB_TOKENDANCE_ID_REDIRECT_URI: https://hub.vectorcontrol.tech/auth/tokendance/callback diff --git a/hub-server/configs/config.yaml b/hub-server/configs/config.yaml index ab92fb6fd..4132cf7cf 100644 --- a/hub-server/configs/config.yaml +++ b/hub-server/configs/config.yaml @@ -57,7 +57,7 @@ agent_team: max_team_run_budget_tokens: 200000 max_team_run_budget_usage_pct: 95 tokendance_id: - issuer_url: "https://id.vectorcontrol.tech" + issuer_url: "https://id.tokendancelab.com" jwks_uri: "" client_id: "" client_secret: "" diff --git a/hub-server/deployments/.env.production.example b/hub-server/deployments/.env.production.example index 923bbf59b..d63ea9aa5 100644 --- a/hub-server/deployments/.env.production.example +++ b/hub-server/deployments/.env.production.example @@ -72,7 +72,7 @@ AGENTHUB_CORS_ORIGINS=https://hub.tokendancelab.com,https://hub.vectorcontrol.te # Hub still exchanges the code through POST /client/auth/oidc/callback after # Web/Desktop sends code, state, PKCE verifier, device, and redirect_uri. # Keep http://127.0.0.1/callback only for Desktop/native dynamic loopback ports. -# AGENTHUB_TOKENDANCE_ID_ISSUER_URL=https://id.vectorcontrol.tech +# AGENTHUB_TOKENDANCE_ID_ISSUER_URL=https://id.tokendancelab.com # AGENTHUB_TOKENDANCE_ID_JWKS_URI= # AGENTHUB_TOKENDANCE_ID_CLIENT_ID= # AGENTHUB_TOKENDANCE_ID_CLIENT_SECRET= diff --git a/hub-server/deployments/docker-compose.prod.yml b/hub-server/deployments/docker-compose.prod.yml index 4f97990a1..cc103a9b7 100644 --- a/hub-server/deployments/docker-compose.prod.yml +++ b/hub-server/deployments/docker-compose.prod.yml @@ -143,7 +143,7 @@ services: # Web browser callback; Hub-owned code exchange remains # POST /client/auth/oidc/callback. Keep 127.0.0.1/callback only for # Desktop/native dynamic loopback ports. - AGENTHUB_TOKENDANCE_ID_ISSUER_URL: ${AGENTHUB_TOKENDANCE_ID_ISSUER_URL:-https://id.vectorcontrol.tech} + AGENTHUB_TOKENDANCE_ID_ISSUER_URL: ${AGENTHUB_TOKENDANCE_ID_ISSUER_URL:-https://id.tokendancelab.com} AGENTHUB_TOKENDANCE_ID_JWKS_URI: ${AGENTHUB_TOKENDANCE_ID_JWKS_URI:-} AGENTHUB_TOKENDANCE_ID_CLIENT_ID: ${AGENTHUB_TOKENDANCE_ID_CLIENT_ID:-} AGENTHUB_TOKENDANCE_ID_CLIENT_SECRET: ${AGENTHUB_TOKENDANCE_ID_CLIENT_SECRET:-} diff --git a/hub-server/deployments/docker-compose.us1.yml b/hub-server/deployments/docker-compose.us1.yml index 1ac244dc5..b24da492e 100644 --- a/hub-server/deployments/docker-compose.us1.yml +++ b/hub-server/deployments/docker-compose.us1.yml @@ -136,7 +136,7 @@ services: # CORS AGENTHUB_CORS_ORIGINS: ${AGENTHUB_CORS_ORIGINS:-https://hub.vectorcontrol.tech,https://tauri.localhost} # TokenDance ID OIDC - AGENTHUB_TOKENDANCE_ID_ISSUER_URL: ${AGENTHUB_TOKENDANCE_ID_ISSUER_URL:-https://id.vectorcontrol.tech} + AGENTHUB_TOKENDANCE_ID_ISSUER_URL: ${AGENTHUB_TOKENDANCE_ID_ISSUER_URL:-https://id.tokendancelab.com} AGENTHUB_TOKENDANCE_ID_JWKS_URI: ${AGENTHUB_TOKENDANCE_ID_JWKS_URI:-} AGENTHUB_TOKENDANCE_ID_CLIENT_ID: ${AGENTHUB_TOKENDANCE_ID_CLIENT_ID:-} AGENTHUB_TOKENDANCE_ID_CLIENT_SECRET: ${AGENTHUB_TOKENDANCE_ID_CLIENT_SECRET:-} diff --git a/hub-server/deployments/hk2/.env.hk2.example b/hub-server/deployments/hk2/.env.hk2.example index 50f698887..8565fbae8 100644 --- a/hub-server/deployments/hk2/.env.hk2.example +++ b/hub-server/deployments/hk2/.env.hk2.example @@ -86,9 +86,9 @@ AGENTHUB_CORS_ORIGINS=https://hub.vectorcontrol.tech,https://tauri.localhost # ── TokenDance ID OIDC ──────────────────────── # Register/retrieve from TokenDance ID admin panel at: -# https://id.vectorcontrol.tech +# https://id.tokendancelab.com # Production Web callback; Desktop uses http://127.0.0.1/callback loopback. -# AGENTHUB_TOKENDANCE_ID_ISSUER_URL=https://id.vectorcontrol.tech +# AGENTHUB_TOKENDANCE_ID_ISSUER_URL=https://id.tokendancelab.com # AGENTHUB_TOKENDANCE_ID_JWKS_URI= # AGENTHUB_TOKENDANCE_ID_CLIENT_ID= # AGENTHUB_TOKENDANCE_ID_CLIENT_SECRET= diff --git a/hub-server/deployments/hk2/docker-compose.hk2.yml b/hub-server/deployments/hk2/docker-compose.hk2.yml index 5abcd63c9..df26ed97a 100644 --- a/hub-server/deployments/hk2/docker-compose.hk2.yml +++ b/hub-server/deployments/hk2/docker-compose.hk2.yml @@ -138,7 +138,7 @@ services: # CORS AGENTHUB_CORS_ORIGINS: ${AGENTHUB_CORS_ORIGINS:-https://hub.vectorcontrol.tech,https://tauri.localhost} # TokenDance ID OIDC - AGENTHUB_TOKENDANCE_ID_ISSUER_URL: ${AGENTHUB_TOKENDANCE_ID_ISSUER_URL:-https://id.vectorcontrol.tech} + AGENTHUB_TOKENDANCE_ID_ISSUER_URL: ${AGENTHUB_TOKENDANCE_ID_ISSUER_URL:-https://id.tokendancelab.com} AGENTHUB_TOKENDANCE_ID_JWKS_URI: ${AGENTHUB_TOKENDANCE_ID_JWKS_URI:-} AGENTHUB_TOKENDANCE_ID_CLIENT_ID: ${AGENTHUB_TOKENDANCE_ID_CLIENT_ID:-} AGENTHUB_TOKENDANCE_ID_CLIENT_SECRET: ${AGENTHUB_TOKENDANCE_ID_CLIENT_SECRET:-} diff --git a/hub-server/internal/config/config_tokendance.go b/hub-server/internal/config/config_tokendance.go index 3709f3530..c4719ef7c 100644 --- a/hub-server/internal/config/config_tokendance.go +++ b/hub-server/internal/config/config_tokendance.go @@ -6,7 +6,7 @@ import "log/slog" // TokenDanceIDConfig holds OIDC/OAuth2 configuration for TokenDance ID integration. type TokenDanceIDConfig struct { - // IssuerURL is the TokenDance ID issuer base URL (e.g. https://id.vectorcontrol.tech). + // IssuerURL is the TokenDance ID issuer base URL (e.g. https://id.tokendancelab.com). IssuerURL string `mapstructure:"issuer_url"` // JWKSURI overrides the JWKS endpoint. Derived from issuer_url/oidc/jwks when empty. JWKSURI string `mapstructure:"jwks_uri"` diff --git a/hub-server/tests/oidc/oidc_smoke_test.go b/hub-server/tests/oidc/oidc_smoke_test.go index 0666362af..bc7c367a4 100644 --- a/hub-server/tests/oidc/oidc_smoke_test.go +++ b/hub-server/tests/oidc/oidc_smoke_test.go @@ -108,7 +108,7 @@ func TestOIDCSmoke(t *testing.T) { jwtSecret := "test-secret-at-least-32-bytes-long!!" mockSvc := &mockOIDCService{ - authorizeURL: "https://id.vectorcontrol.tech/oidc/authorize", + authorizeURL: "https://id.tokendancelab.com/oidc/authorize", state: "test-state-" + uuid.NewString(), accessToken: "", refreshToken: "mock-refresh-" + uuid.NewString(), diff --git a/tests/contract/scripts/verify-token-dance-id-login-readiness.ps1 b/tests/contract/scripts/verify-token-dance-id-login-readiness.ps1 index ca9d7271a..db6ecb63c 100644 --- a/tests/contract/scripts/verify-token-dance-id-login-readiness.ps1 +++ b/tests/contract/scripts/verify-token-dance-id-login-readiness.ps1 @@ -96,7 +96,7 @@ try { $blocked = Invoke-RepoScript @( $scriptPath, "-RepoRoot", $RepoRoot, - "-DiscoveryDocumentPath", (New-DiscoveryFixture $tmpRoot "blocked-discovery.json" '{"issuer":"https://id.vectorcontrol.tech","authorization_endpoint":"https://id.vectorcontrol.tech/oidc/authorize","token_endpoint":"https://id.vectorcontrol.tech/oidc/token","jwks_uri":"https://id.vectorcontrol.tech/oidc/jwks"}') + "-DiscoveryDocumentPath", (New-DiscoveryFixture $tmpRoot "blocked-discovery.json" '{"issuer":"https://id.tokendancelab.com","authorization_endpoint":"https://id.tokendancelab.com/oidc/authorize","token_endpoint":"https://id.tokendancelab.com/oidc/token","jwks_uri":"https://id.tokendancelab.com/oidc/jwks"}') ) Assert-True ($blocked.ExitCode -ne 0) "default run blocks when approved env is absent" $blocked.Output Assert-True ($blocked.Output -match "Status: BLOCKED") "blocked run reports BLOCKED" $blocked.Output @@ -106,10 +106,10 @@ try { $badDiscovery = Invoke-RepoScript @( $scriptPath, "-RepoRoot", $RepoRoot, - "-IssuerUrl", "https://id.vectorcontrol.tech", + "-IssuerUrl", "https://id.tokendancelab.com", "-ClientId", "agenthub-approved-client", "-TestAccountRef", "approved-test-account:agenthub-login-smoke", - "-DiscoveryDocumentPath", (New-DiscoveryFixture $tmpRoot "bad-discovery.json" '{"issuer":"https://wrong.example","authorization_endpoint":"https://id.vectorcontrol.tech/oidc/authorize","token_endpoint":"https://id.vectorcontrol.tech/oidc/token","jwks_uri":"https://id.vectorcontrol.tech/oidc/jwks"}') + "-DiscoveryDocumentPath", (New-DiscoveryFixture $tmpRoot "bad-discovery.json" '{"issuer":"https://wrong.example","authorization_endpoint":"https://id.tokendancelab.com/oidc/authorize","token_endpoint":"https://id.tokendancelab.com/oidc/token","jwks_uri":"https://id.tokendancelab.com/oidc/jwks"}') ) Assert-True ($badDiscovery.ExitCode -ne 0) "issuer mismatch blocks readiness" $badDiscovery.Output Assert-True ($badDiscovery.Output -match "discovery issuer") "issuer mismatch is explicit" $badDiscovery.Output @@ -119,10 +119,10 @@ try { $secretRun = Invoke-RepoScript @( $scriptPath, "-RepoRoot", $RepoRoot, - "-IssuerUrl", "https://id.vectorcontrol.tech", + "-IssuerUrl", "https://id.tokendancelab.com", "-ClientId", $secretLike, "-TestAccountRef", "approved-test-account:agenthub-login-smoke", - "-DiscoveryDocumentPath", (New-DiscoveryFixture $tmpRoot "secret-discovery.json" '{"issuer":"https://id.vectorcontrol.tech","authorization_endpoint":"https://id.vectorcontrol.tech/oidc/authorize","token_endpoint":"https://id.vectorcontrol.tech/oidc/token","jwks_uri":"https://id.vectorcontrol.tech/oidc/jwks"}') + "-DiscoveryDocumentPath", (New-DiscoveryFixture $tmpRoot "secret-discovery.json" '{"issuer":"https://id.tokendancelab.com","authorization_endpoint":"https://id.tokendancelab.com/oidc/authorize","token_endpoint":"https://id.tokendancelab.com/oidc/token","jwks_uri":"https://id.tokendancelab.com/oidc/jwks"}') ) Assert-True ($secretRun.ExitCode -ne 0) "secret-like client input fails closed" $secretRun.Output Assert-True ($secretRun.Output -match "secret-like") "secret-like failure is generic" $secretRun.Output @@ -132,10 +132,10 @@ try { $ready = Invoke-RepoScript @( $scriptPath, "-RepoRoot", $RepoRoot, - "-IssuerUrl", "https://id.vectorcontrol.tech", + "-IssuerUrl", "https://id.tokendancelab.com", "-ClientId", "agenthub-approved-client", "-TestAccountRef", "approved-test-account:agenthub-login-smoke", - "-DiscoveryDocumentPath", (New-DiscoveryFixture $tmpRoot "ready-discovery.json" '{"issuer":"https://id.vectorcontrol.tech","authorization_endpoint":"https://id.vectorcontrol.tech/oidc/authorize","token_endpoint":"https://id.vectorcontrol.tech/oidc/token","jwks_uri":"https://id.vectorcontrol.tech/oidc/jwks","response_types_supported":["code"],"code_challenge_methods_supported":["S256"]}'), + "-DiscoveryDocumentPath", (New-DiscoveryFixture $tmpRoot "ready-discovery.json" '{"issuer":"https://id.tokendancelab.com","authorization_endpoint":"https://id.tokendancelab.com/oidc/authorize","token_endpoint":"https://id.tokendancelab.com/oidc/token","jwks_uri":"https://id.tokendancelab.com/oidc/jwks","response_types_supported":["code"],"code_challenge_methods_supported":["S256"]}'), "-OutputPath", $outputPath ) Assert-True ($ready.ExitCode -eq 0) "approved metadata and discovery report READY_FOR_OPERATOR" $ready.Output From b9dbcb55e924664c629005b6f01be190ff89e4ae Mon Sep 17 00:00:00 2001 From: "Codex (Delicious233)" Date: Sun, 2 Aug 2026 01:43:18 +0800 Subject: [PATCH 2/4] chore(id): rename hk2 env example to .env.example (secret guard allowlist) check-secrets.sh only allowlists .env.example / .env.production.example paths; .env.hk2.example tripped the .env-style file rule on validate. The hk2 directory already distinguishes the file, so the rename keeps semantics identical. --- hub-server/deployments/hk2/{.env.hk2.example => .env.example} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename hub-server/deployments/hk2/{.env.hk2.example => .env.example} (100%) diff --git a/hub-server/deployments/hk2/.env.hk2.example b/hub-server/deployments/hk2/.env.example similarity index 100% rename from hub-server/deployments/hk2/.env.hk2.example rename to hub-server/deployments/hk2/.env.example From 91b8bb432ae9674839e9c0214b6e0893cff8dc70 Mon Sep 17 00:00:00 2001 From: "Codex (Delicious233)" Date: Sun, 2 Aug 2026 01:55:33 +0800 Subject: [PATCH 3/4] ci(verify): exempt *_URL endpoint assignments from secret-like scan MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit check-secrets.sh flags any assignment whose variable name contains "token" (e.g. AGENTHUB_TOKENDANCE_ID_ISSUER_URL) with a non-placeholder value. Public endpoint URLs are configuration, not credentials — skip *_URL assignments whose value contains :// (plain or ${VAR:-https://…} default form). CLIENT_SECRET / *_TOKEN assignments are unaffected. --- scripts/verify/check-secrets.sh | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/scripts/verify/check-secrets.sh b/scripts/verify/check-secrets.sh index 8881c898b..f78d9bbb8 100755 --- a/scripts/verify/check-secrets.sh +++ b/scripts/verify/check-secrets.sh @@ -162,6 +162,15 @@ check_added_line() { [[ -z "$trimmed" ]] && return [[ "$trimmed" == \#* || "$trimmed" == //* || "$trimmed" == \** || "$trimmed" == "/*"* ]] && return + # *_URL=…://… assignments are endpoint configuration (e.g. + # AGENTHUB_TOKENDANCE_ID_ISSUER_URL=https://id.example.com or the + # ${VAR:-https://…} default form in docker-compose files), not secrets. + # Without this, any variable name containing "token" (TOKENDANCE, + # TOKEN_EXCHANGE…) gets flagged for its public endpoint value. + if [[ "$trimmed" =~ ^[A-Za-z0-9_.-]*_URL[\"\']?[[:space:]]*[:=][[:space:]]*.*:// ]]; then + return + fi + if [[ "$trimmed" =~ -----BEGIN[[:space:]]+.*PRIVATE[[:space:]]+KEY----- ]]; then report "$path" "$line_no" "private key block detected" fi From 60d20929a84570e647f9b7e467d3195ddda81067 Mon Sep 17 00:00:00 2001 From: "Codex (Delicious233)" Date: Sun, 2 Aug 2026 02:08:21 +0800 Subject: [PATCH 4/4] docs(id): update hk2 env example copy instructions to renamed file --- hub-server/deployments/hk2/.env.example | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hub-server/deployments/hk2/.env.example b/hub-server/deployments/hk2/.env.example index 8565fbae8..ca16b0b63 100644 --- a/hub-server/deployments/hk2/.env.example +++ b/hub-server/deployments/hk2/.env.example @@ -2,7 +2,7 @@ # AgentHub Hub Server — hk2 Production Environment Template # ────────────────────────────────────────────── # Copy to .env.hk2 and fill in real values: -# cp .env.hk2.example .env.hk2 +# cp .env.example .env.hk2 # # IMPORTANT: This file contains secrets. Never commit to version control. # Production secrets should be stored in: