feat(agent-runtime): 补全测试替身编排闭环

common/exceptions.py

@@ -15,3 +15,7 @@ class DuplicateOperation(DomainError):
 
 class PermissionDenied(DomainError):
     """操作者无权执行领域命令。"""
+
+
+class AgentConfigurationError(DomainError):
+    """真实 Agent 执行所需配置缺失或不合法。"""

common/logging.py

@@ -12,6 +12,15 @@ request_id_context: contextvars.ContextVar[str] = contextvars.ContextVar(
 SENSITIVE_KEYS = {"api_key", "authorization", "cookie", "password", "secret", "token"}
 
 
+def _is_sensitive_key(key: object) -> bool:
+    """识别常见秘密字段，同时避免把 `token_count` 等统计字段误判为秘密。"""
+
+    normalized = str(key).strip().lower().replace("-", "_")
+    if normalized in SENSITIVE_KEYS:
+        return True
+    return normalized.endswith(("_api_key", "_password", "_secret", "_cookie", "_token"))
+
+
 class RequestContextFilter(logging.Filter):
     """向每条日志补充请求关联标识，后台任务没有请求时使用短横线。"""
 
@@ -25,7 +34,7 @@ def sanitize_summary(value: Any) -> Any:
 
     if isinstance(value, Mapping):
         return {
-            str(key): "***" if str(key).lower() in SENSITIVE_KEYS else sanitize_summary(item)
+            str(key): "***" if _is_sensitive_key(key) else sanitize_summary(item)
             for key, item in value.items()
         }
     if isinstance(value, list):

common/tests.py

@@ -0,0 +1,44 @@
+"""公共日志与请求上下文测试。"""
+
+from django.test import SimpleTestCase
+from django.urls import reverse
+
+from .logging import request_id_context, sanitize_summary
+
+
+class LoggingTests(SimpleTestCase):
+    """验证敏感摘要递归脱敏，且统计字段不会被误删。"""
+
+    def test_nested_sensitive_values_are_masked(self):
+        result = sanitize_summary(
+            {
+                "access_token": "secret",
+                "nested": {"password": "secret", "token_count": 12},
+                "items": [{"api-key": "secret"}],
+            }
+        )
+        self.assertEqual(result["access_token"], "***")
+        self.assertEqual(result["nested"]["password"], "***")
+        self.assertEqual(result["nested"]["token_count"], 12)
+        self.assertEqual(result["items"][0]["api-key"], "***")
+
+
+class RequestContextMiddlewareTests(SimpleTestCase):
+    """验证入站关联标识的复用、非法值替换和请求结束后的上下文清理。"""
+
+    def test_valid_request_id_is_returned(self):
+        response = self.client.get(
+            reverse("accounts:login"),
+            headers={"X-Request-ID": "request-123"},
+        )
+        self.assertEqual(response.headers["X-Request-ID"], "request-123")
+        self.assertEqual(request_id_context.get(), "-")
+
+    def test_invalid_request_id_is_replaced(self):
+        response = self.client.get(
+            reverse("accounts:login"),
+            headers={"X-Request-ID": "invalid value"},
+        )
+        generated = response.headers["X-Request-ID"]
+        self.assertNotEqual(generated, "invalid value")
+        self.assertEqual(len(generated), 32)