Skip to content

chore: sync automatic Runtime credentials #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Frank-svg-dev merged 1 commit into from
Jul 21, 2026
Merged

chore: sync automatic Runtime credentials #12

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 9 additions & 30 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,9 +79,7 @@ source with the commands below.
Prerequisites:

- Go 1.25 or newer
- an Agent and Node registered in Core
- their lowercase UUIDs and an Agent Token
- a Core-issued client certificate, private key, and trusted CA bundle
- an active Agent Token
- a private, persistent data directory
- a local backend

Expand All @@ -92,35 +90,16 @@ go test ./...
go build ./cmd/openlinker-agent-node
```

Enroll the Runtime Node with this Adapter's exact implementation version. Core
rejects a Session when the enrolled version and Worker hello differ. Set
`NODE_VERSION` to the complete value reported by the binary release, or copy
the complete `AgentNodeVersion` string from `internal/agentnode/node.go` for a
source build:

```bash
NODE_VERSION=openlinker-agent-node/0.x.y
DATABASE_URL='postgres://...' ./api runtime-node issue \
--ca-cert /secure/runtime-client-ca.crt \
--ca-key /secure/runtime-client-ca.key \
--display-name 'legacy-backend-adapter' \
--node-version "${NODE_VERSION}" \
--capacity 1 \
--cert-out /run/openlinker/node.crt \
--key-out /run/openlinker/node.key
```
On first start the SDK creates the Node ID and P-256 private key inside the
private data directory, binds that public key one-to-one to the Agent Token,
and obtains a 24-hour client certificate. Renewal is automatic.

Run a local HTTP backend:

```bash
OPENLINKER_URL=https://openlinker.example \
OPENLINKER_NODE_ID=11111111-1111-4111-8111-111111111111 \
OPENLINKER_AGENT_ID=22222222-2222-4222-8222-222222222222 \
OPENLINKER_AGENT_TOKEN=ol_agent_xxx \
OPENLINKER_AGENT_NODE_DATA_DIR=/var/lib/openlinker-agent-node \
OPENLINKER_AGENT_NODE_MTLS_CERT_FILE=/run/openlinker/node.crt \
OPENLINKER_AGENT_NODE_MTLS_KEY_FILE=/run/openlinker/node.key \
OPENLINKER_AGENT_NODE_MTLS_CA_FILE=/run/openlinker/core-ca.crt \
OPENLINKER_AGENT_NODE_TRANSPORT=auto \
OPENLINKER_AGENT_NODE_ADAPTER=http \
OPENLINKER_AGENT_NODE_HTTP_URL=http://127.0.0.1:18080/run \
Expand Down Expand Up @@ -151,13 +130,13 @@ stops startup instead of falling back to the ordinary API origin.
| Variable | Purpose |
| --- | --- |
| `OPENLINKER_URL` | OpenLinker platform origin used to discover the Runtime connection |
| `OPENLINKER_NODE_ID` | Registered Node UUID |
| `OPENLINKER_AGENT_ID` | Agent UUID served by this process |
| `OPENLINKER_NODE_ID` | Optional legacy Node UUID override; generated automatically by default |
| `OPENLINKER_AGENT_ID` | Optional legacy Agent UUID override; resolved from the Agent Token by default |
| `OPENLINKER_AGENT_TOKEN` | Long-lived Agent Token kept inside the node |
| `OPENLINKER_AGENT_NODE_DATA_DIR` | Directory selected for the SDK `FileRuntimeStore` |
| `OPENLINKER_AGENT_NODE_MTLS_CERT_FILE` | Client certificate |
| `OPENLINKER_AGENT_NODE_MTLS_KEY_FILE` | Client private key |
| `OPENLINKER_AGENT_NODE_MTLS_CA_FILE` | CA bundle used to verify Core |
| `OPENLINKER_AGENT_NODE_MTLS_CERT_FILE` | Optional external-PKI compatibility certificate |
| `OPENLINKER_AGENT_NODE_MTLS_KEY_FILE` | Optional external-PKI compatibility private key |
| `OPENLINKER_AGENT_NODE_MTLS_CA_FILE` | Optional external-PKI compatibility CA bundle |
| `OPENLINKER_AGENT_NODE_MTLS_SERVER_NAME` | Optional certificate server-name override |
| `OPENLINKER_AGENT_NODE_TRANSPORT` | `auto` (default), `ws`, or `pull`; all share one Runtime session |

Expand Down
36 changes: 8 additions & 28 deletions README.zh-CN.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,9 +67,7 @@ Linux、macOS、Windows 预构建二进制及相邻的 `.sha256` 文件发布在
需要准备：

- Go 1.25 或更高版本
- 已在 Core 注册的 Agent 和 Node
- 两者的小写 UUID 与 Agent Token
- Core 签发的 client certificate、private key 和受信 CA bundle
- 有效的 Agent Token
- 私有、可持久化的数据目录
- 本地 backend

Expand All @@ -80,33 +78,15 @@ go test ./...
go build ./cmd/openlinker-agent-node
```

登记 Runtime Node 时必须写入当前 Adapter 的精确实现版本。登记值与 Worker hello 不一致时，
Core 会拒绝 Session。`NODE_VERSION` 应填写二进制 release 报告的完整值；源码构建则原样
复制 `internal/agentnode/node.go` 中完整的 `AgentNodeVersion` 字符串：

```bash
NODE_VERSION=openlinker-agent-node/0.x.y
DATABASE_URL='postgres://...' ./api runtime-node issue \
--ca-cert /secure/runtime-client-ca.crt \
--ca-key /secure/runtime-client-ca.key \
--display-name 'legacy-backend-adapter' \
--node-version "${NODE_VERSION}" \
--capacity 1 \
--cert-out /run/openlinker/node.crt \
--key-out /run/openlinker/node.key
```
首次启动时，SDK 会在私有目录生成 Node ID 和 P-256 私钥，将公钥一对一绑定到 Agent Token，
并取得 24 小时客户端证书；续期全自动完成。

运行本地 HTTP backend：

```bash
OPENLINKER_URL=https://openlinker.example \
OPENLINKER_NODE_ID=11111111-1111-4111-8111-111111111111 \
OPENLINKER_AGENT_ID=22222222-2222-4222-8222-222222222222 \
OPENLINKER_AGENT_TOKEN=ol_agent_xxx \
OPENLINKER_AGENT_NODE_DATA_DIR=/var/lib/openlinker-agent-node \
OPENLINKER_AGENT_NODE_MTLS_CERT_FILE=/run/openlinker/node.crt \
OPENLINKER_AGENT_NODE_MTLS_KEY_FILE=/run/openlinker/node.key \
OPENLINKER_AGENT_NODE_MTLS_CA_FILE=/run/openlinker/core-ca.crt \
OPENLINKER_AGENT_NODE_TRANSPORT=auto \
OPENLINKER_AGENT_NODE_ADAPTER=http \
OPENLINKER_AGENT_NODE_HTTP_URL=http://127.0.0.1:18080/run \
Expand All @@ -133,13 +113,13 @@ SDK 加密 spool 的上限是 512 MiB 和 10,000 条记录。使用量达到 80%
| 环境变量 | 用途 |
| --- | --- |
| `OPENLINKER_URL` | OpenLinker 平台地址，用于自动发现 Runtime 连接信息 |
| `OPENLINKER_NODE_ID` | 已注册 Node 的 UUID |
| `OPENLINKER_AGENT_ID` | 当前进程承载的 Agent UUID |
| `OPENLINKER_NODE_ID` | 可选的旧版 Node UUID 覆盖；默认自动生成 |
| `OPENLINKER_AGENT_ID` | 可选的旧版 Agent UUID 覆盖；默认从 Agent Token 解析 |
| `OPENLINKER_AGENT_TOKEN` | 只保留在节点内的长效 Agent Token |
| `OPENLINKER_AGENT_NODE_DATA_DIR` | 交给 SDK `FileRuntimeStore` 的目录 |
| `OPENLINKER_AGENT_NODE_MTLS_CERT_FILE` | client certificate |
| `OPENLINKER_AGENT_NODE_MTLS_KEY_FILE` | client private key |
| `OPENLINKER_AGENT_NODE_MTLS_CA_FILE` | 用来校验 Core 的 CA bundle |
| `OPENLINKER_AGENT_NODE_MTLS_CERT_FILE` | 可选的外部 PKI 兼容证书 |
| `OPENLINKER_AGENT_NODE_MTLS_KEY_FILE` | 可选的外部 PKI 兼容私钥 |
| `OPENLINKER_AGENT_NODE_MTLS_CA_FILE` | 可选的外部 PKI 兼容 CA bundle |
| `OPENLINKER_AGENT_NODE_MTLS_SERVER_NAME` | 可选的证书 server name 覆盖值 |
| `OPENLINKER_AGENT_NODE_TRANSPORT` | `auto`（默认）、`ws` 或 `pull`；三者共用同一 Runtime session |

Expand Down
5 changes: 5 additions & 0 deletions internal/agentnode/node.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,6 +151,11 @@ func (node *Node) newPublicA2AProxy(ctx context.Context) (publicA2AProxy, error)
RuntimeURL: node.RuntimeURL,
AgentToken: node.AgentToken,
AgentSlug: node.PublicA2A.Slug,
DataDir: node.DataDir,
NodeID: node.NodeID,
AgentID: node.AgentID,
NodeVersion: AgentNodeVersion,
Capacity: node.Capacity,
MTLS: openlinker.RuntimeMTLSConfig{
CertFile: node.MTLSCertFile,
KeyFile: node.MTLSKeyFile,
Expand Down
35 changes: 35 additions & 0 deletions vendor/github.com/OpenLinker-ai/openlinker-go/runtime_a2a_proxy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

61 changes: 51 additions & 10 deletions vendor/github.com/OpenLinker-ai/openlinker-go/runtime_worker.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading