fix: restore MCP credentials for Studio debug runs

Author: yanan.zhangyn

tests/cli/test_generated_agent_backend_codegen_extended.py

@@ -1217,6 +1217,107 @@ async def fail_mcp_discovery(draft):
     assert response.json()["detail"] == original_detail
 
 
+def test_generated_debug_recovers_unchanged_published_mcp_credential_before_discovery(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    from agentkit.sdk.runtime.client import AgentkitRuntimeClient
+
+    credential_reference = "MCP_LEGACY_AGENT_JVMDIAG_AUTH_TOKEN"
+    credential_value = "server-retained-debug-secret"
+    published_draft = {
+        "name": "legacy_agent",
+        "description": "Existing Agent",
+        "instruction": "Use the diagnostic MCP.",
+        "mcpTools": [
+            {
+                "name": "jvmdiag",
+                "transport": "http",
+                "url": "https://8.8.8.8/mcp",
+                "authTokenEnv": credential_reference,
+            }
+        ],
+    }
+    runtime = SimpleNamespace(
+        runtime_id="runtime-debug-mcp",
+        runtime_name="legacy-agent-runtime",
+        current_version_number=3,
+        tags=[],
+        envs=[SimpleNamespace(key=credential_reference, value=credential_value)],
+        network_configurations=[
+            SimpleNamespace(
+                endpoint="https://runtime.example.com",
+                network_type="public",
+            )
+        ],
+        authorizer_configuration=SimpleNamespace(
+            key_auth=SimpleNamespace(api_key="runtime-api-key"),
+            custom_jwt_authorizer=None,
+        ),
+    )
+
+    monkeypatch.setattr(
+        AgentkitRuntimeClient,
+        "get_runtime",
+        lambda _self, _request: runtime,
+    )
+
+    captured_discovery_env: dict[str, str] = {}
+
+    async def capture_mcp_discovery(draft, env_values=None):
+        captured_discovery_env.update(env_values or {})
+        return draft
+
+    monkeypatch.setattr(
+        "veadk.cli.generated_agent_mcp.resolve_debug_mcp_endpoints",
+        capture_mcp_discovery,
+    )
+
+    class RuntimeDebugClient(_FakeAsyncClient):
+        async def request(self, _method: str, url: str, **_kwargs: Any):
+            if url.endswith("/list-apps"):
+                return _FakeResponse(json_data=["legacy_agent"])
+            if url.endswith("/web/agent-info/legacy_agent"):
+                return _FakeResponse(
+                    json_data={
+                        "name": "legacy_agent",
+                        "description": "Existing Agent",
+                        "draft": published_draft,
+                    }
+                )
+            raise AssertionError(f"unexpected Runtime request path: {url}")
+
+    monkeypatch.setenv("_FAAS_FUNC_ID", "function-test")
+    app = _generated_debug_app(monkeypatch, tmp_path)
+    _FakeProcess.created.clear()
+    _FakeAsyncClient.listed_apps = ["legacy_agent"]
+    monkeypatch.setattr("subprocess.Popen", _FakeProcess)
+    monkeypatch.setattr("httpx.AsyncClient", RuntimeDebugClient)
+    real_socket = socket.socket
+    monkeypatch.setattr(
+        "socket.socket",
+        lambda *args, **kwargs: (
+            real_socket(*args, **kwargs)
+            if len(args) >= 4 or "fileno" in kwargs
+            else _FakeSocket(*args, **kwargs)
+        ),
+    )
+
+    with TestClient(app) as client:
+        response = client.post(
+            "/web/generated-agent-test-runs",
+            json={
+                "draft": published_draft,
+                "runtimeId": runtime.runtime_id,
+                "runtimeRegion": "cn-shanghai",
+            },
+        )
+
+    assert response.status_code == 200, response.text
+    assert captured_discovery_env[credential_reference] == credential_value
+    assert credential_value not in response.text
+
+
 def test_debug_text_redacts_environment_and_inline_markers(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:

veadk/cli/cli_frontend.py

@@ -4451,6 +4451,7 @@ async def _agentkit_proxy(request: Request, path: str):
         debug_runtime_env_from_draft,
         generate_project_from_draft,
         normalize_and_validate_draft,
+        prepare_mcp_auth,
     )
     from veadk.cli.generated_agent_security import (
         DebugPolicyError,
@@ -5077,10 +5078,15 @@ async def _generate_project_and_draft_from_request(
         *,
         debug: bool,
         owner_id: str = "local",
+        validated_test_request: GeneratedAgentTestRunRequest | None = None,
+        debug_mcp_env_values: Mapping[str, str] | None = None,
     ) -> tuple[GeneratedProject, AgentDraft]:
         try:
             if debug:
-                req = GeneratedAgentTestRunRequest.model_validate(data)
+                req = (
+                    validated_test_request
+                    or GeneratedAgentTestRunRequest.model_validate(data)
+                )
             else:
                 req = GeneratedAgentProjectRequest.model_validate(data)
             draft = normalize_and_validate_draft(req.draft)
@@ -5099,7 +5105,18 @@ async def _generate_project_and_draft_from_request(
                         else _cloud_studio_private_networks
                     ),
                 )
-                draft = await resolve_debug_mcp_endpoints(draft)
+                if debug_mcp_env_values:
+                    draft = prepare_mcp_auth(draft)
+                    mcp_env_values = dict(draft.deployment.envValues)
+                    for key, value in debug_mcp_env_values.items():
+                        if value and not mcp_env_values.get(key):
+                            mcp_env_values[key] = value
+                    draft = await resolve_debug_mcp_endpoints(
+                        draft,
+                        mcp_env_values,
+                    )
+                else:
+                    draft = await resolve_debug_mcp_endpoints(draft)
             else:
                 validate_project_policy(draft)
             project = generate_project_from_draft(draft)
@@ -5658,10 +5675,99 @@ async def _create_generated_agent_test_run(request: Request):
         temp_dir = ""
         proc = None
         try:
+            try:
+                test_request = GeneratedAgentTestRunRequest.model_validate(data)
+            except ValidationError as error:
+                raise HTTPException(status_code=422, detail=error.errors()) from error
+
+            runtime_envs: dict[str, str] = {}
+            debug_mcp_env_values: dict[str, str] = {}
+            runtime_id = test_request.runtimeId.strip()
+            runtime_region = _coerce_cloud_region(test_request.runtimeRegion)
+            if runtime_id:
+                edited_draft = test_request.draft.model_dump(
+                    mode="json",
+                    by_alias=True,
+                    exclude_none=True,
+                )
+                requested_references = mcp_auth_environment_keys(edited_draft)
+                requested_env_values = test_request.draft.deployment.envValues
+                stored_references = tuple(
+                    reference
+                    for reference in requested_references
+                    if not requested_env_values.get(reference)
+                )
+                if stored_references:
+                    (
+                        update_capability,
+                        runtime,
+                    ) = await _runtime_update_capability_details(
+                        request,
+                        runtime_id=runtime_id,
+                        region=runtime_region,
+                    )
+                else:
+                    update_capability = {}
+                    runtime = await asyncio.to_thread(
+                        _authorized_runtime,
+                        request,
+                        runtime_id,
+                        runtime_region,
+                        coded_access_error=True,
+                    )
+                runtime_envs = {
+                    str(item.key): str(item.value or "")
+                    for item in (getattr(runtime, "envs", None) or [])
+                    if getattr(item, "key", None)
+                    and not _is_debug_protected_model_env(str(item.key))
+                }
+                published_agent = update_capability.get("agent")
+                published_draft = (
+                    published_agent.get("draft")
+                    if isinstance(published_agent, Mapping)
+                    else None
+                )
+                if stored_references and isinstance(published_draft, Mapping):
+                    published_environment = _legacy_runtime_environment(runtime)
+                    published_references = mcp_auth_environment_keys(published_draft)
+                    published_reference_values = {
+                        reference: published_environment[reference]
+                        for reference in published_references
+                        if published_environment.get(reference)
+                    }
+                    if set(published_references).difference(published_reference_values):
+                        try:
+                            recovery, recovered_values = _legacy_mcp_state(
+                                runtime,
+                                runtime_region,
+                            )
+                            published_reference_values.update(
+                                mcp_secret_values_for_draft_references(
+                                    draft=published_draft,
+                                    recovery=recovery,
+                                    recovered_values=recovered_values,
+                                )
+                            )
+                        except LegacyRecoveryError as error:
+                            logger.info(
+                                "debug MCP credential recovery unavailable "
+                                "runtime_id=%s region=%s code=%s",
+                                runtime_id,
+                                runtime_region,
+                                error.code,
+                            )
+                    debug_mcp_env_values = retained_mcp_secret_values(
+                        published_draft=published_draft,
+                        edited_draft=edited_draft,
+                        published_reference_values=published_reference_values,
+                    )
+
             project, draft = await _generate_project_and_draft_from_request(
                 data,
                 debug=True,
                 owner_id=owner_id or "local",
+                validated_test_request=test_request,
+                debug_mcp_env_values=debug_mcp_env_values,
             )
             sidecar_env: dict[str, str] = {}
             sidecar_plan: dict[str, Any] | None = None
@@ -5698,25 +5804,6 @@ async def _create_generated_agent_test_run(request: Request):
                         status_code=409,
                         detail="Harness Sidecar 配置已更新，请重新解析后再启动调试。",
                     )
-            runtime_envs: dict[str, str] = {}
-            runtime_id = str(data.get("runtimeId") or "").strip()
-            if runtime_id:
-                runtime_region = (
-                    str(data.get("runtimeRegion") or "cn-beijing").strip()
-                    or "cn-beijing"
-                )
-                runtime = _authorized_runtime(
-                    request,
-                    runtime_id,
-                    runtime_region,
-                    coded_access_error=True,
-                )
-                runtime_envs = {
-                    str(item.key): str(item.value or "")
-                    for item in (getattr(runtime, "envs", None) or [])
-                    if getattr(item, "key", None)
-                    and not _is_debug_protected_model_env(str(item.key))
-                }
             temp_dir = tempfile.mkdtemp(prefix="veadk_generated_agent_test_")
             app_name = _write_generated_project(project, temp_dir)
             staged_environment_skills = ""