feat(agent): accurate agent_code detection + per-channel agentId for stats#467
Merged
Conversation
PeterGuy326
force-pushed
the
feat/agent-channel-detect
branch
from
0df80d9 to
d9c9a13
Compare
audanye-sudo
approved these changes
Jun 16, 2026
audanye-sudo
approved these changes
Jun 16, 2026
audanye-sudo
approved these changes
Jun 16, 2026
audanye-sudo
approved these changes
Jun 16, 2026
audanye-sudo
approved these changes
Jun 16, 2026
audanye-sudo
approved these changes
Jun 16, 2026
audanye-sudo
approved these changes
Jun 16, 2026
…stats
Tag each MCP request with which agent host is driving dws (agent_code) and a
per-(machine × agent_code) instance id, so usage can be sliced by channel and
instance in the data warehouse. Root cause it fixes: agent_code was only sent
when the host injected DINGTALK_DWS_AGENTCODE (~99.98% empty), so the gateway
logged none.
Detection ladder (every signature observed on a real host / official docs, not
guessed; unknown -> custom):
T0 explicit DINGTALK_DWS_AGENTCODE
T1 verified env signatures: claudecode (CLAUDECODE), codex (CODEX_SANDBOX),
openclaw (OPENCLAW_BUNDLE_ROOT), hermes (HERMES_HOME)
T2 VSCODE_BRAND value (covers the whole VS Code fork family)
T3 macOS __CFBundleIdentifier map (qoder/cursor/vscode/workbuddy)
T4 custom fallback
identity.json v2 (machineId + per-agent_code agents map), deterministic
dwsa_<base62> derivation, transparent v1 migration. Backward-compatible wiring:
x-dws-agent-id stays machine-level; new x-dws-agent-instance-id carries the
per-channel id; X-Cli-Version emitted so old/new clients are distinguishable.
Trust boundary (docs/agent-code.md): agent_code and the ids are self-reported
and spoofable — fit for statistics ONLY, never for auth/limit/billing.
Includes unit tests for every tier and the integration doc.
PeterGuy326
force-pushed
the
feat/agent-channel-detect
branch
from
994bfe5 to
0aed349
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
背景
网关侧反馈
agent_code在日志里没有上报。根因:CLI 仅在 host 注入DINGTALK_DWS_AGENTCODE(约 99.98% 为空)时才发该字段。本 PR 在 CLI 侧让 dws 准确识别市面各 agent host + 每实例可统计,无需网关分配 agentId。agent_code 探测(覆盖 agent 生态)
置信度阶梯,每条签名均在真机/官方文档实测,不臆测;识别不了一律
custom:DINGTALK_DWS_AGENTCODE(任意 agent 通用,推荐)CLAUDECODE)、codex(CODEX_SANDBOX,防伪过滤)、openclaw(OPENCLAW_BUNDLE_ROOT)、hermes(HERMES_HOME)VSCODE_BRAND值 —— 一条规则覆盖整个 VS Code fork 家族(Qoder/Cursor/VSCode/Windsurf/Trae/Kiro/未来 fork)__CFBundleIdentifier映射(qoder/cursor/vscode/workbuddy)custom兜底CLI 侧上报的 header(本 PR 已实现并验证)
dws 每次 MCP 请求会带上:
x-dingtalk-dws-agent-codeclaudecode/qoder/customx-dws-agent-instance-iddwsa_c8oildTg5d0Ox-dws-agent-id504ddd36-...X-Cli-Version1.0.xx🔧 待网关侧配合(@李晓军,非本 PR,但数据落地必须做)
CLI 把上面 header 发到 mcp-gw 是必要但不充分的;网关侧不接,这些 header 会被 strip、数仓拿不到。需要两步:
x-dingtalk-dws-agent-code、x-dws-agent-instance-id、x-dws-agent-id、X-Cli-Version加入网关a2a/routes.py的_build_upstream_headers放行名单(否则未知 header 被丢弃——与 list-direct 踩过同一个坑)。agent_code、agent_instance_id、cli_version字段,随现有 SLS → MaxCompute 投递一起进数仓。数仓侧即可group by agent_code出渠道分布、按agent_instance_id拆实例、用cli_version区分新老(老版本无 agent_code,单独成桶不报错)。agent_code和两个 id(x-dws-agent-id/x-dws-agent-instance-id)都是客户端自报、可伪造(改~/.dws/identity.json或改 header 即可),dwsa_前缀不代表安全 ID。agentId / 兼容性
identity.jsonv2(machineId+ 按 agent_code 派生dwsa_<base62(sha256(machineId|agent_code))>),v1 透明迁移;x-dws-agent-id保持机器级(与 v1 连续),新增字段为增量,老版本缺字段=老/unknown 不报错。验证
go build ./.../go vet通过;auth + app 全包回归通过;探测各阶梯单测(precedence、未知 bundle→custom、噪声不判定);真机签名矩阵端到端验证(claudecode/codex/openclaw/hermes/qoder/cursor/workbuddy/vscode/windsurf/trae 命中,未知/噪声→custom)。完整对接说明见docs/agent-code.md。