create-dwy 0.16.0 → 0.16.1

package/templates/ai-tools/skills/unitcircle/uc-deploy-audit/scripts/check_secrets.sh

@@ -0,0 +1,265 @@
+#!/usr/bin/env bash
+# 凭证强度审计 (只读, 全脱敏)
+#
+# 检查范围 (5 类):
+#   1. .env 文件: PASSWORD/SECRET/TOKEN/KEY/AK/SK 字段
+#   2. docker 容器内联 env (Config.Env)
+#   3. Redis 容器 --requirepass 启动参数
+#   4. Postgres 容器 POSTGRES_PASSWORD
+#   5. SSH 私钥 类型 + 位数 (~/.ssh/id_*)
+#
+# 强制脱敏: 只输出派生指标 (len/classes/strength), 永不输出明文
+# 字典词: 内置 ~30 个最常见弱口令
+
+TARGET="$1"; shift
+SSH_OPTS=("$@")
+
+ssh "${SSH_OPTS[@]}" "${TARGET}" bash -s <<'REMOTE'
+# ---------- 强度评估函数 ----------
+# 输入: 一个秘密字符串(从 stdin)
+# 输出: "len=N classes=K strength=STRONG/MEDIUM/WEAK reason=xxx"
+# 不打印明文, 不写文件
+strength_of() {
+  local val
+  IFS= read -r val
+  local len=${#val}
+
+  # 字典词内置(精简, 30 个最常见弱口令; 大小写不敏感子串匹配)
+  local weak_dict='password|passwd|123456|123123|qwerty|abc123|admin|administrator|root|test|demo|guest|user|welcome|letmein|changeme|secret|default|temp|public|private|master|sample|example|prod|dev|staging|backup|hello|monkey'
+  local is_dict=0
+  echo "$val" | grep -qiE "($weak_dict)" && is_dict=1
+
+  # 字符类
+  local has_upper=0 has_lower=0 has_digit=0 has_symbol=0
+  [[ "$val" =~ [A-Z] ]] && has_upper=1
+  [[ "$val" =~ [a-z] ]] && has_lower=1
+  [[ "$val" =~ [0-9] ]] && has_digit=1
+  [[ "$val" =~ [^a-zA-Z0-9] ]] && has_symbol=1
+  local classes=$(( has_upper + has_lower + has_digit + has_symbol ))
+
+  # 评级
+  local strength reason
+  if   [[ "$len" -lt 8 ]]; then          strength="WEAK";   reason="len<8"
+  elif [[ "$is_dict" == "1" ]]; then     strength="WEAK";   reason="dict_match"
+  elif [[ "$len" -lt 16 ]]; then         strength="MEDIUM"; reason="len<16"
+  elif [[ "$classes" -lt 3 ]]; then      strength="MEDIUM"; reason="classes<3"
+  else                                   strength="STRONG"; reason="ok"
+  fi
+  printf "len=%d classes=%d strength=%s reason=%s" "$len" "$classes" "$strength" "$reason"
+}
+
+# 排除明显是"数值/枚举配置参数"而非凭证的 key 名
+# (子串匹配 TOKEN/KEY 会误命中 ACCESS_TOKEN_EXPIRE_MINUTES / KEY_TIMEOUT 这种)
+is_config_not_secret() {
+  local key="$1"
+  echo "$key" | grep -qiE '(EXPIRE|EXPIRY|TTL|TIMEOUT|SECONDS|MINUTES|HOURS|DAYS|COUNT|LIMIT|RETRY|MAX|MIN|SIZE|LENGTH|INTERVAL|DELAY|ENABLED|DISABLED|MODE|TYPE|VERSION|PORT|HOST|URL|PATH|FILE|DIR)$|_(EXPIRE|TTL|TIMEOUT|SECONDS|MINUTES|HOURS|DAYS|COUNT|LIMIT|MAX|MIN|SIZE|MODE|TYPE)_'
+}
+
+# 包装: 给定 key+value, 加上"高敏字段长度门槛 32"判定
+evaluate_secret() {
+  local key="$1"
+  local val="$2"
+  [[ -z "$val" ]] && { echo "  (空值)"; return; }
+
+  # 判定是否真凭证字段 (key 名含 PASSWORD/SECRET/ACCESS_KEY_SECRET 等明确含义的)
+  # 这类即使值是纯数字短串(如某些服务默认密码 123456) 也必须评估为 WEAK 而非 SKIP
+  local is_true_credential=0
+  echo "$key" | grep -qiE '(PASSWORD|PASSWD|SECRET|PRIVATE[_-]?KEY|ACCESS[_-]?KEY[_-]?SECRET|_SK$|^SK_)' && is_true_credential=1
+
+  # Bug fix 1: 跳过明显是配置参数的 key (含 EXPIRE/TTL/TIMEOUT/MAX/MIN 等)
+  # 但真凭证字段不跳过
+  if [[ "$is_true_credential" == "0" ]] && is_config_not_secret "$key"; then
+    printf "  %-30s [i] SKIP: 看起来是配置参数(非凭证), key 名含 EXPIRE/TTL/TIMEOUT/MAX 等\n" "$key"
+    return
+  fi
+  # Bug fix 1.b: 纯数字短值(像 30 / 86400 这种 TTL/expire) 跳过
+  # 但真凭证字段不跳过 (服务默认密码 123456 / Redis 默认 123 这种弱密码必须报)
+  if [[ "$is_true_credential" == "0" ]] && [[ "$val" =~ ^[0-9]+$ ]] && [[ ${#val} -lt 10 ]]; then
+    printf "  %-30s [i] SKIP: 纯数字短值(看起来是配置参数, len=%d)\n" "$key" "${#val}"
+    return
+  fi
+
+  # 是否高敏字段
+  local high_sens=0
+  echo "$key" | grep -qiE 'SECRET|JWT|TOKEN|API[_-]?KEY|ACCESS[_-]?KEY[_-]?SECRET|PRIVATE[_-]?KEY|_AK$|_SK$|^AK_|^SK_' && high_sens=1
+
+  local result
+  result=$(printf '%s\n' "$val" | strength_of)
+  local len=$(echo "$result" | grep -oE 'len=[0-9]+' | cut -d= -f2)
+  local classes=$(echo "$result" | grep -oE 'classes=[0-9]+' | cut -d= -f2)
+  local strength=$(echo "$result" | grep -oE 'strength=[A-Z]+' | cut -d= -f2)
+
+  # Bug fix 2: 长度 >= 24 即视为 STRONG (即使 classes 少, 熵足够)
+  # 例如 48 字符 base64 / 64 字符 hex 即使只 2 类, 熵 >= 192 bits 远超 128 bits 安全门槛
+  if [[ "$strength" != "WEAK" && "$len" -ge 24 ]]; then
+    strength="STRONG"
+    result="${result/strength=MEDIUM/strength=STRONG}"
+    result="${result/reason=classes<3/reason=long_enough}"
+    result="${result/reason=len<16/reason=long_enough}"
+  fi
+
+  printf "  %-30s %s" "$key" "$result"
+  # 严重级标记
+  if   [[ "$strength" == "WEAK" ]]; then
+    printf "  [!!!] CRITICAL: 弱凭证, 必须立即轮换\n"
+  elif [[ "$high_sens" == "1" && "$len" -lt 32 ]]; then
+    printf "  [!!] HIGH: 高敏字段建议 >= 32 字符随机串\n"
+  elif [[ "$strength" == "MEDIUM" ]]; then
+    printf "  [!] MEDIUM: 建议加长至 16+ 且 3 类字符\n"
+  else
+    printf "  [OK]\n"
+  fi
+}
+
+# ---------- 1. .env 文件扫描 ----------
+echo "########## 1. .env 文件凭证强度 ##########"
+ENV_FILES=$(sudo -n find /home /opt /srv /root -maxdepth 6 -type f \
+              \( -name ".env" -o -name ".env.*" -o -name "*.env" \) 2>/dev/null \
+            | grep -vE '\.example|\.template|\.sample|\.bak|\.old|node_modules' \
+            | sort -u | head -20)
+[[ -z "$ENV_FILES" ]] && ENV_FILES=$(find /home /opt /srv /root -maxdepth 6 -type f \
+              \( -name ".env" -o -name ".env.*" -o -name "*.env" \) 2>/dev/null \
+            | grep -vE '\.example|\.template|\.sample|\.bak|\.old|node_modules' \
+            | sort -u | head -20)
+
+if [[ -z "$ENV_FILES" ]]; then
+  echo "[i] 未找到 .env 文件"
+else
+  for f in $ENV_FILES; do
+    echo ""
+    echo "[$f]"
+    # 只挑密码类字段, 解析 KEY=VALUE
+    if ! sudo -n cat "$f" 2>/dev/null | head -1 >/dev/null && ! cat "$f" 2>/dev/null | head -1 >/dev/null; then
+      echo "  [i] 不可读"
+      continue
+    fi
+    (sudo -n cat "$f" 2>/dev/null || cat "$f" 2>/dev/null) \
+      | grep -E '^[[:space:]]*[A-Z][A-Z0-9_]*[[:space:]]*=' \
+      | grep -iE '(PASSWORD|PASSWD|SECRET|TOKEN|API[_-]?KEY|ACCESS[_-]?KEY|PRIVATE[_-]?KEY|_AK|_SK|^AK_|^SK_)' \
+      | while IFS='=' read -r key val; do
+          key=$(echo "$key" | tr -d ' \t')
+          # 去引号 + 行尾注释
+          val=$(echo "$val" | sed -E 's/^[[:space:]]*//; s/[[:space:]]*#.*$//; s/^"//; s/"$//; s/^'\''//; s/'\''$//')
+          evaluate_secret "$key" "$val"
+        done
+  done
+fi
+
+# ---------- 2. docker 容器内联 env ----------
+echo ""
+echo "########## 2. Docker 容器内联 env 凭证强度 ##########"
+if command -v docker >/dev/null 2>&1; then
+  for c in $(docker ps -q 2>/dev/null); do
+    name=$(docker inspect -f '{{.Name}}' "$c" 2>/dev/null | sed 's|^/||')
+    echo ""
+    echo "[$name]"
+    docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' "$c" 2>/dev/null \
+      | grep -iE '(PASSWORD|PASSWD|SECRET|TOKEN|API[_-]?KEY|ACCESS[_-]?KEY|PRIVATE[_-]?KEY|_AK=|_SK=|^AK_|^SK_)' \
+      | while IFS='=' read -r key val; do
+          key=$(echo "$key" | tr -d ' \t')
+          evaluate_secret "$key" "$val"
+        done
+  done
+else
+  echo "[i] Docker 未安装"
+fi
+
+# ---------- 3. Redis requirepass (从启动参数提取) ----------
+echo ""
+echo "########## 3. Redis --requirepass 强度 ##########"
+if command -v docker >/dev/null 2>&1; then
+  REDIS_FOUND=0
+  for c in $(docker ps -q 2>/dev/null); do
+    image=$(docker inspect -f '{{.Config.Image}}' "$c" 2>/dev/null)
+    if echo "$image" | grep -qi "redis"; then
+      REDIS_FOUND=1
+      name=$(docker inspect -f '{{.Name}}' "$c" 2>/dev/null | sed 's|^/||')
+      echo ""
+      echo "[$name]"
+      args=$(docker inspect -f '{{range .Args}}{{.}} {{end}}' "$c" 2>/dev/null)
+      pass=$(echo "$args" | grep -oE -- '--requirepass [^ ]+' | head -1 | awk '{print $2}')
+      if [[ -n "$pass" ]]; then
+        evaluate_secret "REDIS_PASSWORD(--requirepass)" "$pass"
+      else
+        echo "  [!!!] CRITICAL: Redis 未设置 --requirepass"
+      fi
+    fi
+  done
+  [[ "$REDIS_FOUND" == "0" ]] && echo "[i] 未发现 Redis 容器"
+fi
+
+# ---------- 4. Postgres POSTGRES_PASSWORD (容器 env, 已在 2 覆盖, 此处单独 highlight) ----------
+echo ""
+echo "########## 4. Postgres POSTGRES_PASSWORD 强度 ##########"
+if command -v docker >/dev/null 2>&1; then
+  PG_FOUND=0
+  for c in $(docker ps -q 2>/dev/null); do
+    image=$(docker inspect -f '{{.Config.Image}}' "$c" 2>/dev/null)
+    if echo "$image" | grep -qi "postgres"; then
+      PG_FOUND=1
+      name=$(docker inspect -f '{{.Name}}' "$c" 2>/dev/null | sed 's|^/||')
+      echo ""
+      echo "[$name]"
+      pass=$(docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' "$c" 2>/dev/null \
+              | grep '^POSTGRES_PASSWORD=' | head -1 | cut -d= -f2-)
+      if [[ -n "$pass" ]]; then
+        evaluate_secret "POSTGRES_PASSWORD" "$pass"
+      else
+        echo "  [!!!] CRITICAL: 未取得 POSTGRES_PASSWORD (是否 secrets 挂载或 trust 认证?)"
+      fi
+    fi
+  done
+  [[ "$PG_FOUND" == "0" ]] && echo "[i] 未发现 Postgres 容器"
+fi
+
+# ---------- 5. SSH 私钥强度 ----------
+echo ""
+echo "########## 5. SSH 私钥类型 / 位数 ##########"
+# 当前用户 + root 的 ~/.ssh/ (Bug fix 3: 去重, root 用户登录时 $HOME=/root 会重复)
+SSH_DIRS=$(printf '%s\n' "$HOME/.ssh" /root/.ssh /home/*/.ssh 2>/dev/null | sort -u)
+for ssh_dir in $SSH_DIRS; do
+  [[ -d "$ssh_dir" ]] || continue
+  for kf in "$ssh_dir"/id_rsa "$ssh_dir"/id_ed25519 "$ssh_dir"/id_ecdsa "$ssh_dir"/id_dsa; do
+    [[ -f "$kf" ]] || continue
+    info=$(ssh-keygen -l -f "$kf" 2>/dev/null || sudo -n ssh-keygen -l -f "$kf" 2>/dev/null)
+    if [[ -z "$info" ]]; then
+      echo "  $kf  [i] 无法读取(权限?)"
+      continue
+    fi
+    bits=$(echo "$info" | awk '{print $1}')
+    type=$(echo "$info" | grep -oE '\([A-Z0-9]+\)$' | tr -d '()')
+    perm=$(stat -c '%a' "$kf" 2>/dev/null)
+
+    case "$type" in
+      ED25519)
+        printf "  %-40s type=%-8s bits=%-4s perm=%s  [OK]\n" "$kf" "$type" "$bits" "$perm" ;;
+      RSA)
+        if   [[ "$bits" -ge 4096 ]]; then mark="[OK]"
+        elif [[ "$bits" -ge 3072 ]]; then mark="[OK] (建议升 ed25519)"
+        elif [[ "$bits" -ge 2048 ]]; then mark="[!] MEDIUM: RSA-${bits} 可接受但建议升 ed25519 或 RSA-4096"
+        else                              mark="[!!!] CRITICAL: RSA-${bits} 已不安全, 立即轮换"
+        fi
+        printf "  %-40s type=%-8s bits=%-4s perm=%s  %s\n" "$kf" "$type" "$bits" "$perm" "$mark" ;;
+      ECDSA)
+        printf "  %-40s type=%-8s bits=%-4s perm=%s  [!] MEDIUM: ECDSA 存疑(NIST 曲线), 建议 ed25519\n" "$kf" "$type" "$bits" "$perm" ;;
+      DSA)
+        printf "  %-40s type=%-8s bits=%-4s perm=%s  [!!!] CRITICAL: DSA 已废弃, 立即轮换\n" "$kf" "$type" "$bits" "$perm" ;;
+      *)
+        printf "  %-40s type=%-8s bits=%-4s perm=%s\n" "$kf" "$type" "$bits" "$perm" ;;
+    esac
+
+    # 权限检查
+    if [[ -n "$perm" && "$perm" != "600" && "$perm" != "400" ]]; then
+      echo "    [!!] HIGH: 私钥权限 $perm 过宽, 应 600"
+    fi
+  done
+done
+
+echo ""
+echo "########## 凭证强度汇总 ##########"
+echo "[i] 修复指引:"
+echo "  - WEAK 密码: 立即轮换 (建议 >= 16 字符 + 三类字符的强密码)"
+echo "  - 高敏字段 (JWT/SECRET/AK/SK): >= 32 字符随机串"
+echo "  - 生成命令: openssl rand -base64 24 | tr -d '=+/' | cut -c1-20"
+echo "  - 高敏: openssl rand -hex 32  (生成 64 字符 hex token)"
+REMOTE

package/templates/ai-tools/skills/unitcircle/uc-deploy-audit/scripts/check_services.sh

@@ -0,0 +1,94 @@
+#!/usr/bin/env bash
+# 依赖服务连通性 / 防火墙
+TARGET="$1"; shift
+SSH_OPTS=("$@")
+
+ssh "${SSH_OPTS[@]}" "${TARGET}" bash -s <<'REMOTE'
+echo "--- 防火墙状态 ---"
+if command -v ufw >/dev/null 2>&1; then
+  echo "[ufw]"
+  sudo -n ufw status verbose 2>/dev/null || echo "  [!] 需 sudo 查看 ufw"
+fi
+if command -v firewall-cmd >/dev/null 2>&1; then
+  echo "[firewalld]"
+  sudo -n firewall-cmd --state 2>/dev/null
+  sudo -n firewall-cmd --list-all 2>/dev/null
+fi
+echo "[iptables]"
+sudo -n iptables -L INPUT -n --line-numbers 2>/dev/null | head -20 || echo "  [i] 无法读取 iptables"
+
+echo ""
+echo "--- 监听端口 (按地址分组) ---"
+(ss -tlnp 2>/dev/null || netstat -tlnp 2>/dev/null) | awk 'NR>1 {print $4}' | awk -F: '{
+  port=$NF;
+  ip=substr($0,1,length($0)-length(port)-1);
+  if (ip=="0.0.0.0" || ip=="*" || ip=="[::]") public[port]++;
+  else if (ip=="127.0.0.1" || ip=="[::1]") loop[port]++;
+  else internal[port]++;
+}
+END {
+  print "公网监听 (0.0.0.0 / *):"
+  for (p in public) print "  " p
+  print "内网监听 (具体 IP):"
+  for (p in internal) print "  " p
+  print "回环监听 (127.0.0.1):"
+  for (p in loop) print "  " p
+}'
+
+echo ""
+echo "--- 系统负载与内存 ---"
+uptime
+free -h 2>/dev/null | head -3
+
+echo ""
+echo "--- 磁盘 ---"
+df -h | grep -vE "tmpfs|udev" | head -10
+
+echo ""
+echo "--- 已安装的 Web 应用进程 (常见) ---"
+ps -eo user,pid,%cpu,%mem,cmd --sort=-%mem 2>/dev/null \
+  | grep -E "(nginx|node|python|uvicorn|gunicorn|java|php-fpm|redis-server|postgres|mysql|mongod)" \
+  | grep -v grep | head -20
+
+echo ""
+echo "--- 应用健康检查端点 (经本地 nginx 回环 + --resolve, 避免 hairpin NAT) ---"
+NGINX_DUMP=$(sudo -n nginx -T 2>/dev/null || nginx -T 2>/dev/null || true)
+# 只取真实 server_name 指令行(行首仅空白 + 关键字), 去行内注释, 拆多域名, 过滤 _ / 通配 / 空 / 非法 token
+# 旧实现用 awk '/server_name/' 会误匹配注释行里的 server_name 文字, 产出 _) 1. :80 等垃圾域名
+DOMAINS=$(echo "$NGINX_DUMP" \
+  | grep -E '^[[:space:]]*server_name[[:space:]]' \
+  | sed -E 's/#.*$//; s/^[[:space:]]*server_name[[:space:]]+//; s/;.*$//' \
+  | tr ' ' '\n' \
+  | grep -E '^[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?$' \
+  | grep -v '^_$' \
+  | sort -u | head -5)
+[[ -z "$DOMAINS" ]] && DOMAINS="localhost"
+# 是否启用 https(443 在监听); 公网域名从本机直连会触发 hairpin NAT 返回 000,
+# 用 --resolve 把域名钉到回环, 既走本地 nginx 又匹配 SNI 证书, 才是白盒正解
+HAS_HTTPS=$( (ss -tln 2>/dev/null || netstat -tln 2>/dev/null) | grep -qE ':443[[:space:]]' && echo yes || echo no )
+for D in $DOMAINS; do
+  for path in "/api/health" "/health" "/healthz" "/_health" "/status"; do
+    if [[ "$HAS_HTTPS" == "yes" ]]; then
+      code=$(curl -k -sS -o /dev/null -w "%{http_code}" --max-time 3 --resolve "$D:443:127.0.0.1" "https://$D$path" 2>/dev/null || echo "000")
+      scheme="https"
+    else
+      code=$(curl -sS -o /dev/null -w "%{http_code}" --max-time 3 --resolve "$D:80:127.0.0.1" "http://$D$path" 2>/dev/null || echo "000")
+      scheme="http"
+    fi
+    [[ "$code" != "404" && "$code" != "000" ]] && printf "  %s://%s%s -> %s\n" "$scheme" "$D" "$path" "$code"
+  done
+done
+
+echo ""
+echo "--- 系统更新提示 ---"
+if command -v apt >/dev/null 2>&1; then
+  sudo -n apt list --upgradable 2>/dev/null | head -10 || echo "  [i] 无法检查 apt 更新"
+elif command -v yum >/dev/null 2>&1; then
+  sudo -n yum check-update 2>/dev/null | head -10 || echo "  [i] 无法检查 yum 更新"
+fi
+
+echo ""
+echo "--- 内核/系统启动时间 ---"
+who -b 2>/dev/null
+echo "kernel: $(uname -r)"
+REMOTE

package/templates/ai-tools/skills/unitcircle/uc-deploy-audit/scripts/check_ssh.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# SSH 安全检查 (只读)
+TARGET="$1"; shift
+SSH_OPTS=("$@")
+
+ssh "${SSH_OPTS[@]}" "${TARGET}" bash -s <<'REMOTE'
+echo "--- /etc/ssh/sshd_config (filtered key directives) ---"
+SSHD_CONF="/etc/ssh/sshd_config"
+SSHD_DIR="/etc/ssh/sshd_config.d"
+if [[ -r "$SSHD_CONF" ]]; then
+  grep -Ei "^[[:space:]]*(PermitRootLogin|PasswordAuthentication|PubkeyAuthentication|PermitEmptyPasswords|Port|Protocol|MaxAuthTries|LoginGraceTime|AllowUsers|AllowGroups|DenyUsers|DenyGroups|ChallengeResponseAuthentication|UsePAM|X11Forwarding|ClientAliveInterval|ClientAliveCountMax|LogLevel|Banner)" "$SSHD_CONF" 2>/dev/null
+  if [[ -d "$SSHD_DIR" ]]; then
+    echo "--- $SSHD_DIR/*.conf ---"
+    grep -EiH "^[[:space:]]*(PermitRootLogin|PasswordAuthentication|PubkeyAuthentication|PermitEmptyPasswords|Port|Protocol|MaxAuthTries)" "$SSHD_DIR"/*.conf 2>/dev/null
+  fi
+else
+  echo "[!] $SSHD_CONF 不可读 (需要 sudo)"
+fi
+
+echo ""
+echo "--- effective sshd config (sshd -T, 需 sudo) ---"
+sudo -n sshd -T 2>/dev/null | grep -Ei "^(permitrootlogin|passwordauthentication|pubkeyauthentication|permitemptypasswords|port|protocol|maxauthtries|logingracetime|allowusers|allowgroups|x11forwarding|loglevel)" || echo "[i] 无法读取 effective config (需要 sudo 或 sshd -T 不可用)"
+
+echo ""
+echo "--- ssh process & version ---"
+sshd -V 2>&1 | head -2 || ssh -V 2>&1
+
+echo ""
+echo "--- recent failed logins (last 20) ---"
+sudo -n journalctl _COMM=sshd --since "7 days ago" 2>/dev/null | grep -Ei "failed|invalid" | tail -20 \
+  || sudo -n grep -Ei "failed|invalid" /var/log/auth.log 2>/dev/null | tail -20 \
+  || echo "[i] 无法读取认证日志 (需要 sudo)"
+
+echo ""
+echo "--- fail2ban status ---"
+if command -v fail2ban-client >/dev/null 2>&1; then
+  sudo -n fail2ban-client status 2>/dev/null || echo "[i] fail2ban 已安装,但需要 sudo 查看状态"
+else
+  echo "[!] fail2ban 未安装"
+fi
+
+echo ""
+echo "--- authorized_keys 概览 (当前用户) ---"
+if [[ -r ~/.ssh/authorized_keys ]]; then
+  awk '{print "  key: " $1 " " substr($2,1,16) "... " $3}' ~/.ssh/authorized_keys
+  echo "  total: $(wc -l < ~/.ssh/authorized_keys) keys"
+else
+  echo "[i] 当前用户无 authorized_keys"
+fi
+
+echo ""
+echo "--- /root/.ssh/authorized_keys (需 sudo) ---"
+sudo -n test -f /root/.ssh/authorized_keys 2>/dev/null && \
+  echo "  [!] root 用户存在 authorized_keys, 共 $(sudo -n wc -l < /root/.ssh/authorized_keys 2>/dev/null) 行" \
+  || echo "[i] 无 root authorized_keys 或无 sudo 权限"
+REMOTE

package/templates/ai-tools/skills/unitcircle/uc-deploy-audit/scripts/run_all.sh

@@ -0,0 +1,105 @@
+#!/usr/bin/env bash
+# uc-deploy-audit: 一键全量巡检（subagent 不可用时的串行/并行退化方案）
+#
+# 优先做法是让 Claude 用 subagent 并行派遣多个 Agent 跑各类 check_xxx.sh
+# (见 SKILL.md Step 4)。本脚本仅作为本地一键回退使用。
+#
+# 用法:
+#   ./run_all.sh <user>@<host> [-p <port>] [-i <key>] [--serial]
+#
+# 默认 8 路并行。--serial 强制串行。
+
+set -uo pipefail
+
+if [[ $# -lt 1 ]]; then
+  echo "Usage: $0 <user>@<host|alias> [-p <port>] [-i <key>] [--serial]" >&2
+  exit 1
+fi
+
+TARGET="$1"; shift
+SSH_OPTS=(-o ConnectTimeout=10 -o BatchMode=yes -o StrictHostKeyChecking=accept-new)
+PARALLEL=true
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    -p) SSH_OPTS+=(-p "$2"); shift 2;;
+    -i) SSH_OPTS+=(-i "$2"); shift 2;;
+    --serial) PARALLEL=false; shift;;
+    *)  echo "Unknown arg: $1" >&2; exit 1;;
+  esac
+done
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+TMP_DIR=$(mktemp -d -t uc-audit-XXXXXX)
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+# 检查项: <section_name>:<script_name>
+SECTIONS=(
+  "BASE_INFO:check_base.sh"
+  "SSH:check_ssh.sh"
+  "NGINX:check_nginx.sh"
+  "DB:check_db.sh"
+  "HTTPS:check_https.sh"
+  "ENV:check_env.sh"
+  "DOCKER:check_docker.sh"
+  "SERVICES:check_services.sh"
+  "RESILIENCE:check_resilience.sh"
+  "LOGS:check_logs.sh"
+  "CAPACITY:check_capacity.sh"
+  "SECRETS:check_secrets.sh"
+)
+
+echo "========================================"
+echo " uc-deploy-audit | target: ${TARGET}"
+echo " timestamp: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
+echo " mode: $([ "$PARALLEL" = true ] && echo "parallel (${#SECTIONS[@]} workers)" || echo 'serial')"
+echo "========================================"
+
+run_section() {
+  local name="$1"
+  local script="$2"
+  local out_file="${TMP_DIR}/${name}.out"
+  {
+    echo "########## SECTION: ${name} ##########"
+    bash "${SCRIPT_DIR}/${script}" "${TARGET}" "${SSH_OPTS[@]}" 2>&1 \
+      || echo "[!] ${name} 部分失败"
+    echo "########## END: ${name} ##########"
+  } > "$out_file" 2>&1
+}
+
+if [[ "$PARALLEL" == "true" ]]; then
+  # 并行：所有 section 后台启动
+  pids=()
+  for entry in "${SECTIONS[@]}"; do
+    name="${entry%%:*}"
+    script="${entry##*:}"
+    run_section "$name" "$script" &
+    pids+=($!)
+  done
+
+  # 等所有完成
+  for pid in "${pids[@]}"; do
+    wait "$pid"
+  done
+
+  # 按顺序输出结果（保证报告分类有序）
+  for entry in "${SECTIONS[@]}"; do
+    name="${entry%%:*}"
+    echo ""
+    cat "${TMP_DIR}/${name}.out"
+  done
+else
+  # 串行
+  for entry in "${SECTIONS[@]}"; do
+    name="${entry%%:*}"
+    script="${entry##*:}"
+    echo ""
+    run_section "$name" "$script"
+    cat "${TMP_DIR}/${name}.out"
+  done
+fi
+
+echo ""
+echo "========================================"
+echo " 巡检数据采集完成,请由 Claude 分析生成报告"
+echo "========================================"

package/templates/ai-tools/skills//345/205/203/345/267/245/345/205/267/dwy-shared/SKILL.md

@@ -153,10 +153,31 @@ git -C "$REPO_PATH" mv <仓库内相对路径> <new-相对路径>
 
 **冲突处理**：目标已存在 → AskUserQuestion 让用户选「覆盖 / 改名 / 取消」。
 
+### 步骤 6.5：bump ai-tools 内部版本 + CHANGELOG（强制）
+
+凡改动 `$REPO_PATH/dwy-cli/templates/ai-tools/` 下任意内容，**必须**同批更新：
+
+| 文件 | 动作 |
+| ---- | ---- |
+| `dwy-cli/templates/ai-tools/VERSION` | 按 `CHANGELOG.md` 内维护约定 bump（MAJOR / MINOR / PATCH） |
+| `dwy-cli/templates/ai-tools/CHANGELOG.md` | 顶部追加 `## x.y.z — YYYY-MM-DD` 段 + Added/Changed/Fixed/Removed |
+
+约定全文见：`$REPO_PATH/dwy-cli/templates/ai-tools/CHANGELOG.md`「维护约定」。
+
+- 新增 skill/rule/hook/command 或新增强制约束 → 至少 **MINOR**
+- 仅修正文案 / 链接 / 不改强制语义 → **PATCH**
+- 破坏同步结构 / 删除广泛依赖项且无迁移 → **MAJOR**
+
+**禁止**只提交模板文件而不改 `VERSION` + `CHANGELOG.md`。
+
 ### 步骤 7：staged + 显示 diff
 
 ```bash
 git -C "$REPO_PATH" add <精准路径>
+# 务必包含 VERSION 与 CHANGELOG
+git -C "$REPO_PATH" add \
+  "$REPO_PATH/dwy-cli/templates/ai-tools/VERSION" \
+  "$REPO_PATH/dwy-cli/templates/ai-tools/CHANGELOG.md"
 git -C "$REPO_PATH" status --short
 git -C "$REPO_PATH" diff --cached --stat
 ```
@@ -170,7 +191,7 @@ git -C "$REPO_PATH" diff --cached --stat
 按项目 `CLAUDE.md` 中 Git Commit Scope 规范：
 - scope: `cli`
 - type: `feat`（新模板）/ `fix`（修复模板）/ `docs`（仅文档）
-- subject: 中文动宾短语 ≤72 字符
+- subject: 中文动宾短语 ≤72 字符；可附 ai-tools 版本号（如 `ai-tools 0.2.0`）
 - **禁** AI 署名 / Co-Authored-By trailer
 
 模板：

package/templates/ai-tools/skills//345/256/211/345/205/250/dwy-deploy-audit/SKILL.md

@@ -464,7 +464,7 @@ bash {scripts}/check_db.sh <target> [ssh_opts...]
 
 根据本次失败项归纳的可执行后续动作:
 
-- 镜像版本不固定 (4.6) → 跑 `/dwy-docker-image` 选 N-1 minor
+- 镜像版本不固定 (4.6) → 跑 `/dwy-docker` 选 N-1 minor
 - daemon 未配 registry-mirrors (4.6) → 跑 `/dwy-mirror-source` 写国内源
 - 容器资源偏离推荐 (4.10) → 改 `docker-compose.prod.yml` 的 mem_limit/maxmemory
 - ...

package/templates/ai-tools/skills//345/256/211/345/205/250/dwy-deploy-audit/references/checks-runtime.md

@@ -11,7 +11,7 @@
 ## 4.6 Docker 安全 — `{scripts}/check_docker.sh`
 
 > **跨 skill 联动**:本节发现的镜像版本/镜像源问题,只**报告**不修复。具体修复路径:
-> - 镜像 tag 不固定 / `:latest` / 浮动 tag → 引导用户跑 `/dwy-docker-image`(走 query_dockerhub.py 选 N-1 minor)
+> - 镜像 tag 不固定 / `:latest` / 浮动 tag → 引导用户跑 `/dwy-docker`(走 query_dockerhub.py 选 N-1 minor)
 > - daemon 未配 registry-mirrors / 容器用境外 registry → 引导用户跑 `/dwy-mirror-source`(写阿里云/中科大/daocloud)
 
 | 检查项 | 期望值 | 严重级 |
@@ -107,7 +107,7 @@
 
 ## 4.10 硬件识别与资源推荐 — `{scripts}/check_capacity.sh`
 
-> 脚本只输出 raw（硬件规格 + 当前容器 mem_limit + Postgres/Redis 启动参数 + compose 资源声明）；主 Claude 用下表生成 "推荐 vs 当前" 对比报告。详细推荐规则与配比公式参考 `dwy-docker-image` skill 第二部分。
+> 脚本只输出 raw（硬件规格 + 当前容器 mem_limit + Postgres/Redis 启动参数 + compose 资源声明）；主 Claude 用下表生成 "推荐 vs 当前" 对比报告。详细推荐规则与配比公式参考 `dwy-docker` skill 第二部分。
 
 **容器资源推荐分级表（按宿主总内存）**
 

package/templates/ai-tools/skills//345/256/211/345/205/250/dwy-deploy-audit/scripts/check_docker.sh

@@ -43,7 +43,7 @@ docker ps --format "{{.Names}}|{{.Ports}}" 2>/dev/null | while IFS='|' read -r n
 done
 
 echo ""
-echo "--- 镜像 tag 分级检查 (生产期望: 固定到具体 patch, 跑 /dwy-docker-image 选 N-1 minor) ---"
+echo "--- 镜像 tag 分级检查 (生产期望: 固定到具体 patch, 跑 /dwy-docker 选 N-1 minor) ---"
 # 浮动 tag 黑名单 (无版本号或仅描述类的)
 FLOATING_TAGS='^(latest|stable|mainline|edge|current|alpine|slim|bookworm|bullseye|buster|jammy|focal|noble|nightly)$'
 docker ps --format "{{.Names}}|{{.Image}}" 2>/dev/null | while IFS='|' read -r name image; do
@@ -87,7 +87,7 @@ docker ps --format "{{.Names}}|{{.Image}}" 2>/dev/null | while IFS='|' read -r n
   fi
 done
 echo ""
-echo "[i] 修复:对每条 [!!!] / [!!] / [!] 的镜像,跑 /dwy-docker-image 用 query_dockerhub.py 拿 N-1 minor 推荐版本"
+echo "[i] 修复:对每条 [!!!] / [!!] / [!] 的镜像,跑 /dwy-docker 用 query_dockerhub.py 拿 N-1 minor 推荐版本"
 
 echo ""
 echo "--- 容器是否以 root 运行 ---"
@@ -255,5 +255,5 @@ echo ""
 echo "[i] 修复路径:"
 echo "      1. docker.io 加速  → /dwy-mirror-source 自动配 daemon registry-mirrors"
 echo "      2. gcr/ghcr/k8s    → 把 image 改 <registry>.m.daocloud.io 前缀, 见 dwy-mirror-source 镜像替换表"
-echo "      3. 镜像版本不固定  → /dwy-docker-image 选 N-1 minor 重新固定"
+echo "      3. 镜像版本不固定  → /dwy-docker 选 N-1 minor 重新固定"
 REMOTE

package/templates/ai-tools/skills//345/256/211/345/205/250/dwy-deploy-audit/scripts/check_secrets.sh

@@ -320,7 +320,7 @@ done
 echo ""
 echo "########## 凭证强度汇总 ##########"
 echo "[i] 修复指引:"
-echo "  - WEAK 密码: 立即轮换 + 走 dwy-server-security 规则 (>= 16 字符 + 三类字符)"
+echo "  - WEAK 密码: 立即轮换 (建议 >= 16 字符 + 三类字符的强密码)"
 echo "  - 高敏字段 (JWT/SECRET/AK/SK): >= 32 字符随机串"
 echo "  - 生成命令: openssl rand -base64 24 | tr -d '=+/' | cut -c1-20"
 echo "  - 高敏: openssl rand -hex 32  (生成 64 字符 hex token)"