Nexus Agent
f9934bd4f1
保存 Telegram 时同步至 .env，health_monitor 支持 MySQL 回退， 设置页展示巡检状态，部署时自动安装 cron。 Co-authored-by: Cursor <cursoragent@cursor.com>
45 lines
1.8 KiB
Markdown
45 lines
1.8 KiB
Markdown
# 审计 — Layer 3 宿主机巡检 Telegram 打通
|
||
|
||
## 范围
|
||
|
||
| 文件 | 变更 |
|
||
|------|------|
|
||
| `server/infrastructure/env_file.py` | `.env` upsert/read（UTF-8 LF） |
|
||
| `server/application/services/ops_patrol_sync.py` | Telegram → `/app/.env`、persist 卷、host `.env.prod` |
|
||
| `server/api/settings.py` | `set_setting` 钩子；`GET/POST ops-patrol/*` |
|
||
| `deploy/health_monitor.sh` | `load_telegram_from_db` MySQL 回退 |
|
||
| `deploy/deploy-production.sh` | 部署成功自动 `install_ops_cron.sh` |
|
||
| `deploy/nexus-1panel.sh` | `sync_env_prod_to_volume` 含 Telegram 键 |
|
||
| `frontend/src/pages/SettingsPage.vue` | Layer 3 巡检状态与同步 UI |
|
||
| `frontend/src/types/api.ts` | `OpsPatrol*` 类型 |
|
||
| `tests/test_ops_patrol_sync.py` | 7 用例 |
|
||
| `docs/changelog/2026-06-07-ops-patrol-layer3-telegram.md` | changelog |
|
||
| `docs/design/plans/2026-06-07-ops-patrol-layer3-telegram.md` | 技术说明 |
|
||
| `deploy/gate_log.jsonl` | 门控记录（自动生成） |
|
||
|
||
## Step 3 规则扫描
|
||
|
||
| H | 规则 | 结论 |
|
||
|---|------|------|
|
||
| H1 | Layer-3 与设置页 Telegram 脱节 | FIXED — 保存时 sync + DB 回退 |
|
||
| H2 | `.env` 写入破坏不可变键 | SAFE — 仅 upsert `NEXUS_TELEGRAM_*` |
|
||
| H3 | 宿主机 cron 未安装 | FIXED — deploy 自动 install_ops_cron |
|
||
| H4 | env 同步失败静默 | SAFE — 记录 warning；DB 回退保底 |
|
||
| H5 | 敏感 Token 泄露至日志 | SAFE — 无 log token；审计仅写布尔标志 |
|
||
|
||
## Closure
|
||
|
||
| H | 判定 | 依据 |
|
||
|---|------|------|
|
||
| H1–H5 | FIXED / SAFE | 代码 + pytest 7/7 |
|
||
|
||
## DoD
|
||
|
||
- [x] pytest `test_ops_patrol_sync.py` + `test_settings_telegram.py` 13 passed
|
||
- [x] changelog / audit / plan
|
||
- [x] 无 SECRET_KEY/API_KEY/ENCRYPTION_KEY/DATABASE_URL 变更
|
||
|
||
## 验证
|
||
|
||
`.venv/bin/pytest tests/test_ops_patrol_sync.py tests/test_settings_telegram.py -q`
|