From 18bc3ec6c8e806445db21314fd44be5cfe54dc73 Mon Sep 17 00:00:00 2001
From: engigu <sayheya@qq.com>
Date: Fri, 27 Mar 2026 17:33:37 +0800
Subject: [PATCH] fix: agent secret masking

---
 agent/agent.go                              | 13 ++++++++++---
 internal/models/agent.go                    |  5 +++++
 internal/services/agent_service.go          |  6 ++++--
 internal/services/tasks/executor_service.go |  5 +++--
 4 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/agent/agent.go b/agent/agent.go
index 8689a18..4858cdc 100644
--- a/agent/agent.go
+++ b/agent/agent.go
@@ -53,6 +53,7 @@ type AgentTask struct {
 	Envs        string              `json:"envs"`
 	Languages   []map[string]string `json:"languages"`
 	RandomRange int                 `json:"random_range"`
+	Secrets     []string            `json:"secrets"`
 	Enabled     bool                `json:"enabled"`
 }
 
@@ -84,6 +85,10 @@ func (t *AgentTask) GetEnvVars() []string {
 	return nil
 }
 
+func (t *AgentTask) GetSecrets() []string {
+	return t.Secrets
+}
+
 func (t *AgentTask) GetLanguages() []map[string]string {
 	return t.Languages
 }
@@ -491,9 +496,10 @@ func (a *Agent) handleTasks(data json.RawMessage) {
 
 func (a *Agent) handleExecute(data json.RawMessage) {
 	var req struct {
-		TaskID string `json:"task_id"`
-		LogID  string `json:"log_id"`
-		Envs   string `json:"envs"`
+		TaskID  string   `json:"task_id"`
+		LogID   string   `json:"log_id"`
+		Envs    string   `json:"envs"`
+		Secrets []string `json:"secrets"`
 	}
 	if err := json.Unmarshal(data, &req); err != nil {
 		logger.Errorf("解析立即执行请求失败: %v", err)
@@ -524,6 +530,7 @@ func (a *Agent) handleExecute(data json.RawMessage) {
 		Command:   task.Command,
 		WorkDir:   task.WorkDir,
 		Envs:      executor.ParseEnvVars(envs),
+		Secrets:   req.Secrets,
 		Timeout:   task.Timeout,
 		Languages: task.Languages,
 		UseMise:   task.UseMise(),
diff --git a/internal/models/agent.go b/internal/models/agent.go
index 2b044d1..7ee19cf 100644
--- a/internal/models/agent.go
+++ b/internal/models/agent.go
@@ -61,6 +61,7 @@ type AgentTask struct {
 	Envs      string              `json:"envs"`
 	Languages   []map[string]string `json:"languages"`
 	RandomRange int                 `json:"random_range"`
+	Secrets     []string            `json:"secrets"`
 	Enabled     bool                `json:"enabled"`
 }
 
@@ -84,6 +85,10 @@ func (t AgentTask) GetRandomRange() int {
 	return t.RandomRange
 }
 
+func (t AgentTask) GetSecrets() []string {
+	return t.Secrets
+}
+
 // AgentTaskResult Agent 上报的任务执行结果
 type AgentTaskResult struct {
 	TaskID    string `json:"task_id"`
diff --git a/internal/services/agent_service.go b/internal/services/agent_service.go
index e700763..f728017 100644
--- a/internal/services/agent_service.go
+++ b/internal/services/agent_service.go
@@ -335,10 +335,11 @@ func (s *AgentService) GetTasks(agentID string) []models.AgentTask {
 			}
 		}
 
+		var secrets []string
 		if allEnvs {
-			envVars = envService.GetAllEnvVars()
+			envVars, secrets = envService.GetAllEnvVarsAndSecrets()
 		} else if string(task.Envs) != "" {
-			envVars = envService.GetEnvVarsByIDs(string(task.Envs))
+			envVars, secrets = envService.GetEnvVarsAndSecretsByIDs(string(task.Envs))
 		}
 
 		envVarsStr := executor.FormatEnvVars(envVars)
@@ -353,6 +354,7 @@ func (s *AgentService) GetTasks(agentID string) []models.AgentTask {
 			Envs:        envVarsStr,
 			Languages:   []map[string]string(task.Languages),
 			RandomRange: task.RandomRange,
+			Secrets:     secrets,
 			Enabled:     task.Enabled,
 		}
 	}
diff --git a/internal/services/tasks/executor_service.go b/internal/services/tasks/executor_service.go
index 68f5741..050d240 100644
--- a/internal/services/tasks/executor_service.go
+++ b/internal/services/tasks/executor_service.go
@@ -456,7 +456,7 @@ func (es *ExecutorService) ExecuteDispatcher(ctx context.Context, req *executor.
 	// 远程任务
 	if task.AgentID != nil && *task.AgentID != "" {
 		// 将请求中已包含的环境变量（已合并）传递给 Agent
-		return es.ExecuteRemoteForScheduler(task, req.LogID, executor.FormatEnvVars(req.Envs))
+		return es.ExecuteRemoteForScheduler(task, req.LogID, executor.FormatEnvVars(req.Envs), req.Secrets)
 	}
 
 	// 本地任务
@@ -859,7 +859,7 @@ func (es *ExecutorService) RemoveRunningGo(taskID string, goid int64) {
 }
 
 // ExecuteRemoteForScheduler 供 Scheduler 调用，执行远程任务并等待结果
-func (es *ExecutorService) ExecuteRemoteForScheduler(task *models.Task, logID string, envs string) (*executor.Result, error) {
+func (es *ExecutorService) ExecuteRemoteForScheduler(task *models.Task, logID string, envs string, secrets []string) (*executor.Result, error) {
 	agentID := *task.AgentID
 	logger.Infof("[Executor] 远程执行任务 #%s: %s (Agent #%s, LogID: %s)", task.ID, task.Name, agentID, logID)
 
@@ -885,6 +885,7 @@ func (es *ExecutorService) ExecuteRemoteForScheduler(task *models.Task, logID st
 		"task_id": task.ID,
 		"log_id":  logID,
 		"envs":    envs,
+		"secrets": secrets,
 	})
 	if err != nil {
 		return nil, fmt.Errorf("发送执行命令失败: %v", err)