Nexus Agent
764703d401
flock 子 shell 递增后未回传 FAIL，导致 Layer 3 永不触发重启与 Telegram。 Co-authored-by: Cursor <cursoragent@cursor.com>
1.8 KiB
1.8 KiB
审计 — Layer 3 宿主机巡检 Telegram 打通
范围
| 文件 | 变更 |
|---|---|
server/infrastructure/env_file.py |
.env upsert/read（UTF-8 LF） |
server/application/services/ops_patrol_sync.py |
Telegram → /app/.env、persist 卷、host .env.prod |
server/api/settings.py |
set_setting 钩子；GET/POST ops-patrol/* |
deploy/health_monitor.sh |
load_telegram_from_db + bump_fail_count flock 修复 |
deploy/deploy-production.sh |
部署成功自动 install_ops_cron.sh |
deploy/nexus-1panel.sh |
sync_env_prod_to_volume 含 Telegram 键 |
frontend/src/pages/SettingsPage.vue |
Layer 3 巡检状态与同步 UI |
frontend/src/types/api.ts |
OpsPatrol* 类型 |
tests/test_ops_patrol_sync.py |
7 用例 |
docs/changelog/2026-06-07-ops-patrol-layer3-telegram.md |
changelog |
docs/design/plans/2026-06-07-ops-patrol-layer3-telegram.md |
技术说明 |
deploy/gate_log.jsonl |
门控记录（自动生成） |
Step 3 规则扫描
| H | 规则 | 结论 |
|---|---|---|
| H1 | Layer-3 与设置页 Telegram 脱节 | FIXED — 保存时 sync + DB 回退 |
| H2 | .env 写入破坏不可变键 |
SAFE — 仅 upsert NEXUS_TELEGRAM_* |
| H3 | 宿主机 cron 未安装 | FIXED — deploy 自动 install_ops_cron |
| H4 | env 同步失败静默 | SAFE — 记录 warning；DB 回退保底 |
| H5 | 敏感 Token 泄露至日志 | SAFE — 无 log token；审计仅写布尔标志 |
Closure
| H | 判定 | 依据 |
|---|---|---|
| H1–H5 | FIXED / SAFE | 代码 + pytest 7/7 |
DoD
- pytest
test_ops_patrol_sync.py+test_settings_telegram.py13 passed - changelog / audit / plan
- 无 SECRET_KEY/API_KEY/ENCRYPTION_KEY/DATABASE_URL 变更
验证
.venv/bin/pytest tests/test_ops_patrol_sync.py tests/test_settings_telegram.py -q