fix(deploy): set executable bit on nx and refresh symlinks on update

Git tracked deploy/nx as 644 so /usr/local/bin/nx failed with Permission denied after pull; update.sh now chmods CLI scripts before upgrade.

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/update.sh

@@ -10,4 +10,19 @@
 #
 set -euo pipefail
 ROOT="$(cd "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")/.." && pwd)"
+
+ensure_cli_executable() {
+    chmod +x \
+        "$ROOT/deploy/nx" \
+        "$ROOT/deploy/update.sh" \
+        "$ROOT/deploy/nexus-1panel.sh" \
+        "$ROOT/deploy/install-nexus-fresh.sh" \
+        2>/dev/null || true
+    if [[ "$(id -u)" -eq 0 ]]; then
+        ln -sf "$ROOT/deploy/nx" /usr/local/bin/nx
+        ln -sf "$ROOT/deploy/update.sh" /usr/local/bin/nexus-update
+    fi
+}
+
+ensure_cli_executable
 exec bash "$ROOT/deploy/nexus-1panel.sh" upgrade "$@"

docs/changelog/2026-06-05-nx-executable-bit.md

@@ -0,0 +1,18 @@
+# 2026-06-05 — 修复 nx Permission denied
+
+## 摘要
+
+`deploy/nx` 在 Git 中为 `100644`，`git pull` 后 `/usr/local/bin/nx` 符号链接指向不可执行文件，运行报 `Permission denied`。
+
+## 修复
+
+- Git 为 `deploy/nx`、`deploy/update.sh` 等脚本设置 `+x`
+- `deploy/update.sh` 启动时自动 `chmod +x` 并刷新 `/usr/local/bin/nx` 符号链接
+
+## 服务器立即修复
+
+```bash
+chmod +x /opt/nexus/deploy/nx /opt/nexus/deploy/update.sh
+ln -sf /opt/nexus/deploy/nx /usr/local/bin/nx
+nx
+```