fix: Agent HMAC verification supports both old and new signature formats

- Old format: path:TIME (timestamp only)
- New format: path:t=TIME&mod=x&state=y (all query params)
- This ensures new Master can communicate with un-upgraded Agents

core/agent_daemon.sh

@@ -169,10 +169,16 @@ class AgentHandler(http.server.BaseHTTPRequestHandler):
             # 构建确定性签名字符串：path + 排序后的查询参数（排除 sign 本身）
             sorted_params = sorted((k, v[0]) for k, v in query.items() if k != 'sign')
             param_str = '&'.join(f'{k}={v}' for k, v in sorted_params)
-            msg = f"{req_path}:{param_str}".encode('utf-8')
-            expected_sign = hmac.new(AUTH_TOKEN.encode('utf-8'), msg, hashlib.sha256).hexdigest()
             
-            if not hmac.compare_digest(expected_sign, req_sign):
+            # [向后兼容] 同时支持新旧两种签名格式：
+            #   新格式: path:t=TIME&mod=x&state=y  (参数名+值)
+            #   旧格式: path:TIME                   (仅时间戳数字)
+            msg_new = f"{req_path}:{param_str}".encode('utf-8')
+            msg_old = f"{req_path}:{req_t}".encode('utf-8')
+            expected_sign_new = hmac.new(AUTH_TOKEN.encode('utf-8'), msg_new, hashlib.sha256).hexdigest()
+            expected_sign_old = hmac.new(AUTH_TOKEN.encode('utf-8'), msg_old, hashlib.sha256).hexdigest()
+            
+            if not (hmac.compare_digest(expected_sign_new, req_sign) or hmac.compare_digest(expected_sign_old, req_sign)):
                 self.send_response(401)
                 self.end_headers()
                 self.wfile.write(b"401 Unauthorized: Signature Mismatch\n")