fix(deploy): 在线更新 - 兼容旧版 Host Updater 升级到独立 Agent 容器

v1.5.8.x 的 Host Updater 只注入 backend/web 镜像且不生成 Agent Token，目标 Compose 强制要求 CANVAS_YINGCE_AGENT_IMAGE 与 YINGCE_AGENT_TOKEN 导致预检失败。部署 Compose 缺省时回退到同版本 Agent 镜像标签与更新器 Token，新版更新器后续更新仍写入 digest 与独立 Token；拉取阶段同时拉取 yingce-agent 镜像，避免摘要校验找不到本地镜像。

backend/internal/hostupdate/manager.go

@@ -271,7 +271,7 @@ func (m *Manager) runUpdate(fromVersion, targetVersion string) {
 
 	m.setPhase(PhasePulling, "拉取目标版本镜像")
 	targetImages := immutableImageRefs(m.config.Repository, targetVersion)
-	if err := m.composeWithImages(nextCompose, targetVersion, targetImages, m.config.StepTimeout, nil, "pull", "backend", "web"); err != nil {
+	if err := m.composeWithImages(nextCompose, targetVersion, targetImages, m.config.StepTimeout, nil, "pull", "backend", "web", "yingce-agent"); err != nil {
 		m.failWithoutRollback(PhaseFailed, err)
 		return
 	}

backend/internal/hostupdate/manager_ops_test.go

@@ -186,3 +186,23 @@ func TestWriteComposeEnvOverrideReplacesImageRefs(t *testing.T) {
 		t.Fatalf("unexpected override env: %q", value)
 	}
 }
+
+// v1.5.8.x 的 Host Updater 只注入 backend/web 镜像，也不会生成 Agent Token。
+// 部署 Compose 中 Agent 相关变量必须有回退值，否则旧更新器的预检会直接失败。
+func TestDeployComposeAgentVariablesFallbackForLegacyUpdater(t *testing.T) {
+	data, err := os.ReadFile(filepath.Join("..", "..", "..", "docker-compose.deploy.yml"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	compose := string(data)
+	for _, required := range []string{"${CANVAS_YINGCE_AGENT_IMAGE:?", "${YINGCE_AGENT_TOKEN:?"} {
+		if strings.Contains(compose, required) {
+			t.Errorf("docker-compose.deploy.yml must not hard-require %s…}", required)
+		}
+	}
+	for _, fallback := range []string{"${CANVAS_YINGCE_AGENT_IMAGE:-", "${YINGCE_AGENT_TOKEN:-${CANVAS_UPDATER_TOKEN:?"} {
+		if !strings.Contains(compose, fallback) {
+			t.Errorf("docker-compose.deploy.yml is missing fallback %s…}", fallback)
+		}
+	}
+}

docker-compose.deploy.yml

@@ -39,9 +39,10 @@ services:
         condition: service_healthy
 
   yingce-agent:
-    image: ${CANVAS_YINGCE_AGENT_IMAGE:?请先配置 CANVAS_YINGCE_AGENT_IMAGE（必须包含镜像 digest）}
+    # 让旧更新器也能完成本次升级；新版更新器在后续更新中会固定为镜像 digest。
+    image: ${CANVAS_YINGCE_AGENT_IMAGE:-ghcr.io/ddcat-ai/open-ai-canvas-yingce-agent:${CANVAS_IMAGE_TAG:?请先配置 CANVAS_IMAGE_TAG}}
     environment:
-      YINGCE_AGENT_TOKEN: ${YINGCE_AGENT_TOKEN:?请先配置 YINGCE_AGENT_TOKEN}
+      YINGCE_AGENT_TOKEN: ${YINGCE_AGENT_TOKEN:-${CANVAS_UPDATER_TOKEN:?请先配置 YINGCE_AGENT_TOKEN}}
       MAX_CONCURRENT_SESSIONS: ${YINGCE_AGENT_MAX_SESSIONS:-30}
       NODE_MAX_OLD_SPACE_SIZE: ${YINGCE_AGENT_NODE_MEMORY_MB:-512}
     healthcheck:
@@ -72,7 +73,7 @@ services:
       CANVAS_UPDATER_SOCKET: /run/open-ai-canvas-updater/updater.sock
       CANVAS_UPDATER_TOKEN: ${CANVAS_UPDATER_TOKEN:-}
       YINGCE_AGENT_URL: http://yingce-agent:8081
-      YINGCE_AGENT_TOKEN: ${YINGCE_AGENT_TOKEN:?请先配置 YINGCE_AGENT_TOKEN}
+      YINGCE_AGENT_TOKEN: ${YINGCE_AGENT_TOKEN:-${CANVAS_UPDATER_TOKEN:?请先配置 YINGCE_AGENT_TOKEN}}
       YINGCE_AGENT_BRIDGE_HOST: backend
       CANVAS_LOG_LEVEL: ${CANVAS_LOG_LEVEL:-info}
       CANVAS_LOG_FORMAT: ${CANVAS_LOG_FORMAT:-text}