fix: add request timeouts, restore TLS verify, and stop logging secrets

veadk/auth/ve_credential_service.py

@@ -197,7 +197,7 @@ async def get_credential(
                 credential_key="bearer_token"
             )
             if credential:
-                print(f"Found token: {credential.bearer_token}")
+                print("Credential found")
             ```
         """
         return self._credentials.get(app_name, {}).get(user_id, {}).get(credential_key)

veadk/tools/builtin_tools/llm_shield.py

@@ -118,7 +118,7 @@ def _request_llm_shield(self, message: str, role: str) -> Optional[str]:
         version = "2025-08-31"
 
         # Check if using API key authentication
-        logger.debug(f"API key value: {self.api_key}, type: {type(self.api_key)}")
+        logger.debug(f"API key configured: {bool(self.api_key)}")
         if self.api_key and self.api_key != "":
             logger.debug("Using API key authentication (no AK/SK signature)")
             # Use API key authentication only - match curl command headers exactly

veadk/tools/builtin_tools/vesearch.py

@@ -41,7 +41,7 @@ def vesearch(query: str) -> str:
         "messages": [{"role": "user", "content": query}],
     }
 
-    response = requests.post(URL, json=data, headers=headers)
+    response = requests.post(URL, json=data, headers=headers, timeout=30)
     if response.status_code == 200:
         result = response.json()
         return result["choices"][0]["message"]["content"]

veadk/tools/builtin_tools/web_scraper.py

@@ -52,7 +52,7 @@ def web_scraper(query: str) -> dict[str, Any]:
                 {"key": "filter", "value": 1},
             ],
         }
-        response = requests.post(url, headers=headers, json=data, verify=False)
+        response = requests.post(url, headers=headers, json=data, timeout=30)
 
         response.raise_for_status()
 

veadk/utils/volcengine_sign.py

@@ -21,6 +21,11 @@
 
 import requests
 
+# Bounded default (connect, read) timeout in seconds for Volcengine API calls, so a
+# hung endpoint cannot block the caller forever. Callers with slow control-plane
+# operations (deploys, large uploads) can override via the ``timeout`` parameter.
+DEFAULT_REQUEST_TIMEOUT: tuple[float, float] = (10, 60)
+
 Service = ""
 Version = ""
 Region = ""
@@ -107,6 +112,7 @@ def volcengine_signed_request(
     scheme: Literal["http", "https"] = "https",
     unsigned_payload: bool = False,
     response_type: Literal["json", "content", "response"] = "json",
+    timeout: float | tuple[float, float] | None = DEFAULT_REQUEST_TIMEOUT,
 ):
     """Send a Volcengine SigV4 request to a concrete path.
 
@@ -203,6 +209,7 @@ def volcengine_signed_request(
         headers=header,
         params=query,
         data=body,
+        timeout=timeout,
     )
     response.raise_for_status()
     if response_type == "content":
@@ -226,6 +233,7 @@ def request(
     action,
     body,
     scheme: Literal["http", "https"] = "https",
+    timeout: float | tuple[float, float] | None = DEFAULT_REQUEST_TIMEOUT,
 ):
     # 第三步：创建身份证明。其中的 Service 和 Region 字段是固定的。ak 和 sk 分别代表
     # AccessKeyID 和 SecretAccessKey。同时需要初始化签名结构体。一些签名计算时需要的属性也在这里处理。
@@ -322,6 +330,7 @@ def request(
         headers=header,
         params=request_param["query"],
         data=request_param["body"],
+        timeout=timeout,
     )
     try:
         return r.json()