一个 A2A Hub 认证问题

[ww1425680101]

发现一个 A2A Hub 认证问题，根因在 src/gep/a2aProtocol.js 的 getHubNodeSecret()。

当前实现只读取缓存和持久化 secret：

• _cachedHubNodeSecret
• _loadPersistedNodeSecret()

但不会读取环境变量 A2A_NODE_SECRET，导致只通过 .env / shell 注入 A2A_NODE_SECRET 的部署场景下，Hub Search 会失败（表现为 401）。临时 workaround 是：

A2A_HUB_TOKEN=$A2A_NODE_SECRET

我本地验证结果：

1. 仅设置 A2A_NODE_SECRET 时，Hub Search 失败
2. 额外设置 A2A_HUB_TOKEN=$A2A_NODE_SECRET 后恢复
3. 修改 getHubNodeSecret()，优先读取 process.env.A2A_NODE_SECRET 后
4. 删除 A2A_HUB_TOKEN workaround，Hub Search 仍成功

建议修复优先级：

1. process.env.A2A_NODE_SECRET
2. _cachedHubNodeSecret
3. _loadPersistedNodeSecret()
4. process.env.A2A_HUB_TOKEN（兼容 fallback）

a2a-node-secret-fix.patch
补丁我已整理成 diff，可直接应用。

[autogame-17]

Thank you @ww1425680101 for the detailed analysis and the patch. You've correctly identified the issue -- getHubNodeSecret() does not read process.env.A2A_NODE_SECRET, which causes Hub Search to fail with 401 in deployment scenarios that inject the secret only via environment variable.

Your suggested priority order is sound:

1. process.env.A2A_NODE_SECRET
2. _cachedHubNodeSecret
3. _loadPersistedNodeSecret()
4. process.env.A2A_HUB_TOKEN (compatibility fallback)

We will review the attached patch and incorporate the fix. The workaround you described (A2A_HUB_TOKEN=$A2A_NODE_SECRET) is valid for current versions.

This will be included in a future release. Thanks for the contribution!

[autogame-17]

This has been fixed in v1.29.8 (just released).

getHubNodeSecret() now checks process.env.A2A_NODE_SECRET first, with the full priority order:

1. process.env.A2A_NODE_SECRET
2. In-memory cache
3. Persisted secret file
4. process.env.A2A_HUB_TOKEN (compatibility fallback)

You can update via npm install -g @evomap/evolver@latest or pull the latest from the repo. The A2A_HUB_TOKEN workaround is no longer needed.

Thank you for the report and the patch -- this was a valid fix.