feat(agents): Phase3.2 Agent凭据Fernet加密存储 写入加密+调用点解密+返回脱敏+主密钥持久化防竞态 [v2026.07.19.7]

backend/python/app/api/chat_skill.py

@@ -1,6 +1,7 @@
 # Auto-extracted from chat.py during Phase 1 refactor (Strangler Fig).
 # Source of truth: scripts/phase1_extract.py. Do not hand-merge back.
 
+from app.core.credential import decrypt_secret, mask_secret
 from fastapi import APIRouter, Depends, HTTPException, Query, Response
 from sqlalchemy.orm import Session
 from sqlalchemy import and_, desc, asc, func
@@ -530,7 +531,7 @@ def _resolve_market_agents(db: Session, agent_ids: list, user_id: str) -> list:
 
 
 
-            "agent_api_key": ag.agent_api_key or None,
+            "agent_api_key": mask_secret(decrypt_secret(ag.agent_api_key)) or None,
 
 
 

backend/python/app/api/market.py

@@ -1,3 +1,4 @@
+from app.core.credential import encrypt_secret
 from fastapi import APIRouter, Depends, HTTPException, Query
 from sqlalchemy.orm import Session
 from sqlalchemy import and_, desc, asc, func
@@ -557,7 +558,7 @@ def upload_app(
         is_member_free=req.is_member_free if req.is_member_free is not None else False,
         join_promotion=req.join_promotion if req.join_promotion is not None else False,
         agent_endpoint=req.agent_endpoint,
-        agent_api_key=req.api_key,
+        agent_api_key=encrypt_secret(req.api_key),
         status="published",  # 用户创建的应用直接发布
         created_at=datetime.now(),
         updated_at=datetime.now(),