fix: 租户 Docker 任务链路可见（租户目录优先、共享目录兜底）

此前服务端只读共享链路目录，租户隔离的 Docker 任务链路文件落在 tenants/<项目>/work/host-traces/，/trace 与 /agents 会误报为空。改后按任务解析目录列表（租户优先、共享兜底），父链路与子链路文件多目录合并读；直接发送的续写跟到已有链路文件所在的目录，不把一条任务的链路拆成两处。

cloud/tests/test_task_trace.py

@@ -18,11 +18,11 @@ from pathlib import Path
 
 try:
     from cloud.auth import AuthStore
-    from cloud.server import create_server
+    from cloud.server import create_server, _tenant_trace_dir
 except ImportError:
     sys.path.insert(0, str(Path(__file__).resolve().parents[2]))
     from cloud.auth import AuthStore
-    from cloud.server import create_server
+    from cloud.server import create_server, _tenant_trace_dir
 
 
 class TaskTraceTestCase(unittest.TestCase):
@@ -31,11 +31,14 @@ class TaskTraceTestCase(unittest.TestCase):
         self.db_path = os.path.join(self.tmp.name, "control.db")
         self.trace_dir = os.path.join(self.tmp.name, "host-traces")
         os.makedirs(self.trace_dir, exist_ok=True)
+        self.tenants_root = os.path.join(self.tmp.name, "tenants")
+        os.makedirs(self.tenants_root, exist_ok=True)
         self.auth = AuthStore(self.db_path)
         self.owner_id, self.owner_key = self.auth.create_user("owner")
         self.other_id, self.other_key = self.auth.create_user("other")
         self.server = create_server(self.db_path, "127.0.0.1", 0)
         self.server.trace_dir = self.trace_dir
+        self.server.tenants_root = self.tenants_root
         self.port = self.server.server_address[1]
         self.thread = threading.Thread(
             target=self.server.serve_forever, daemon=True)
@@ -93,6 +96,15 @@ class TaskTraceTestCase(unittest.TestCase):
             for line in lines:
                 f.write(line + "\n")
 
+    def _write_tenant_trace(self, lines, filename=None):
+        d = os.path.join(self.tenants_root, self.project["id"],
+                         "work", "host-traces")
+        os.makedirs(d, exist_ok=True)
+        path = os.path.join(d, filename or (self.task_id + ".jsonl"))
+        with open(path, "w", encoding="utf-8") as f:
+            for line in lines:
+                f.write(line + "\n")
+
     def test_trace_auth_and_not_found(self):
         status, _ = self._req(
             "GET", "/tasks/%s/trace" % self.task_id)
@@ -246,6 +258,79 @@ class TaskTraceTestCase(unittest.TestCase):
         self.assertEqual(data["agents"][0]["kind"], "main")
         self.assertEqual(data["agents"][0]["calls"], [])
 
+    def test_tenant_trace_dir_mapping(self):
+        class S:
+            tenants_root = "/tenants"
+        self.assertEqual(
+            _tenant_trace_dir(S(), "abc-123"),
+            "/tenants/abc-123/work/host-traces")
+        self.assertIsNone(_tenant_trace_dir(S(), None))
+        self.assertIsNone(_tenant_trace_dir(S(), ""))
+        self.assertIsNone(_tenant_trace_dir(S(), ".."))
+        self.assertIsNone(_tenant_trace_dir(S(), "..."))
+
+    def test_trace_reads_tenant_dir_only(self):
+        # 租户 Docker 任务的链路文件只在租户目录里：旧版只读
+        # 共享目录会误报为空，修后 /trace 与 /agents 都看得见。
+        self._write_tenant_trace([
+            json.dumps({"kind": "exec", "id": "c1", "command": "make"}),
+        ])
+        status, data = self._req(
+            "GET", "/tasks/%s/trace" % self.task_id, key=self.owner_key)
+        self.assertEqual(status, 200)
+        self.assertEqual([e["id"] for e in data["entries"]], ["c1"])
+        status, data = self._req(
+            "GET", "/tasks/%s/agents" % self.task_id, key=self.owner_key)
+        self.assertEqual(status, 200)
+        self.assertEqual([e["id"] for e in data["agents"][0]["calls"]],
+                         ["c1"])
+
+    def test_trace_merges_tenant_and_shared(self):
+        self._write_tenant_trace([
+            json.dumps({"kind": "exec", "id": "c1", "command": "tenant"}),
+        ])
+        self._write_trace([
+            json.dumps({"kind": "exec", "id": "c2", "command": "shared"}),
+        ])
+        status, data = self._req(
+            "GET", "/tasks/%s/trace" % self.task_id, key=self.owner_key)
+        self.assertEqual(status, 200)
+        self.assertEqual([e["id"] for e in data["entries"]], ["c1", "c2"])
+        # 同 id 冲突时后读的共享目录覆盖（顺序有文档、可复现）。
+        self._write_tenant_trace([
+            json.dumps({"kind": "exec", "id": "c1",
+                        "command": "tenant-cmd"}),
+        ])
+        self._write_trace([
+            json.dumps({"kind": "exec", "id": "c1",
+                        "command": "shared-cmd"}),
+        ])
+        status, data = self._req(
+            "GET", "/tasks/%s/trace" % self.task_id, key=self.owner_key)
+        self.assertEqual(data["entries"][0]["command"], "shared-cmd")
+
+    def test_agents_tenant_child_file(self):
+        # 委派子任务的子链路文件也在租户目录里：父标记的
+        # trace 名要在租户目录里找得到，子任务调用才进链。
+        self._write_tenant_trace([
+            json.dumps({"kind": "agent-start", "id": "agent:rev",
+                        "name": "rev", "prompt": "review",
+                        "trace": "rev.jsonl", "ts": 1002}),
+            json.dumps({"kind": "agent-done", "id": "agent:rev:done",
+                        "name": "rev", "status": "completed",
+                        "trace": "rev.jsonl", "ts": 1004}),
+        ])
+        self._write_tenant_trace([
+            json.dumps({"kind": "exec", "id": "c9", "command": "grep"}),
+        ], filename="rev.jsonl")
+        status, data = self._req(
+            "GET", "/tasks/%s/agents" % self.task_id, key=self.owner_key)
+        self.assertEqual(status, 200)
+        delegate = [a for a in data["agents"]
+                    if a["kind"] == "delegate"][0]
+        self.assertEqual(delegate["status"], "completed")
+        self.assertEqual([e["id"] for e in delegate["calls"]], ["c9"])
+
 
 if __name__ == "__main__":
     unittest.main()