create-dwy 0.16.1 → 0.17.0

package/templates/ai-tools/skills/unitcircle/uc-deploy-audit/scripts/check_secrets.sh

@@ -1,265 +0,0 @@
-#!/usr/bin/env bash
-# 凭证强度审计 (只读, 全脱敏)
-#
-# 检查范围 (5 类):
-#   1. .env 文件: PASSWORD/SECRET/TOKEN/KEY/AK/SK 字段
-#   2. docker 容器内联 env (Config.Env)
-#   3. Redis 容器 --requirepass 启动参数
-#   4. Postgres 容器 POSTGRES_PASSWORD
-#   5. SSH 私钥 类型 + 位数 (~/.ssh/id_*)
-#
-# 强制脱敏: 只输出派生指标 (len/classes/strength), 永不输出明文
-# 字典词: 内置 ~30 个最常见弱口令
-
-TARGET="$1"; shift
-SSH_OPTS=("$@")
-
-ssh "${SSH_OPTS[@]}" "${TARGET}" bash -s <<'REMOTE'
-# ---------- 强度评估函数 ----------
-# 输入: 一个秘密字符串(从 stdin)
-# 输出: "len=N classes=K strength=STRONG/MEDIUM/WEAK reason=xxx"
-# 不打印明文, 不写文件
-strength_of() {
-  local val
-  IFS= read -r val
-  local len=${#val}
-
-  # 字典词内置(精简, 30 个最常见弱口令; 大小写不敏感子串匹配)
-  local weak_dict='password|passwd|123456|123123|qwerty|abc123|admin|administrator|root|test|demo|guest|user|welcome|letmein|changeme|secret|default|temp|public|private|master|sample|example|prod|dev|staging|backup|hello|monkey'
-  local is_dict=0
-  echo "$val" | grep -qiE "($weak_dict)" && is_dict=1
-
-  # 字符类
-  local has_upper=0 has_lower=0 has_digit=0 has_symbol=0
-  [[ "$val" =~ [A-Z] ]] && has_upper=1
-  [[ "$val" =~ [a-z] ]] && has_lower=1
-  [[ "$val" =~ [0-9] ]] && has_digit=1
-  [[ "$val" =~ [^a-zA-Z0-9] ]] && has_symbol=1
-  local classes=$(( has_upper + has_lower + has_digit + has_symbol ))
-
-  # 评级
-  local strength reason
-  if   [[ "$len" -lt 8 ]]; then          strength="WEAK";   reason="len<8"
-  elif [[ "$is_dict" == "1" ]]; then     strength="WEAK";   reason="dict_match"
-  elif [[ "$len" -lt 16 ]]; then         strength="MEDIUM"; reason="len<16"
-  elif [[ "$classes" -lt 3 ]]; then      strength="MEDIUM"; reason="classes<3"
-  else                                   strength="STRONG"; reason="ok"
-  fi
-  printf "len=%d classes=%d strength=%s reason=%s" "$len" "$classes" "$strength" "$reason"
-}
-
-# 排除明显是"数值/枚举配置参数"而非凭证的 key 名
-# (子串匹配 TOKEN/KEY 会误命中 ACCESS_TOKEN_EXPIRE_MINUTES / KEY_TIMEOUT 这种)
-is_config_not_secret() {
-  local key="$1"
-  echo "$key" | grep -qiE '(EXPIRE|EXPIRY|TTL|TIMEOUT|SECONDS|MINUTES|HOURS|DAYS|COUNT|LIMIT|RETRY|MAX|MIN|SIZE|LENGTH|INTERVAL|DELAY|ENABLED|DISABLED|MODE|TYPE|VERSION|PORT|HOST|URL|PATH|FILE|DIR)$|_(EXPIRE|TTL|TIMEOUT|SECONDS|MINUTES|HOURS|DAYS|COUNT|LIMIT|MAX|MIN|SIZE|MODE|TYPE)_'
-}
-
-# 包装: 给定 key+value, 加上"高敏字段长度门槛 32"判定
-evaluate_secret() {
-  local key="$1"
-  local val="$2"
-  [[ -z "$val" ]] && { echo "  (空值)"; return; }
-
-  # 判定是否真凭证字段 (key 名含 PASSWORD/SECRET/ACCESS_KEY_SECRET 等明确含义的)
-  # 这类即使值是纯数字短串(如某些服务默认密码 123456) 也必须评估为 WEAK 而非 SKIP
-  local is_true_credential=0
-  echo "$key" | grep -qiE '(PASSWORD|PASSWD|SECRET|PRIVATE[_-]?KEY|ACCESS[_-]?KEY[_-]?SECRET|_SK$|^SK_)' && is_true_credential=1
-
-  # Bug fix 1: 跳过明显是配置参数的 key (含 EXPIRE/TTL/TIMEOUT/MAX/MIN 等)
-  # 但真凭证字段不跳过
-  if [[ "$is_true_credential" == "0" ]] && is_config_not_secret "$key"; then
-    printf "  %-30s [i] SKIP: 看起来是配置参数(非凭证), key 名含 EXPIRE/TTL/TIMEOUT/MAX 等\n" "$key"
-    return
-  fi
-  # Bug fix 1.b: 纯数字短值(像 30 / 86400 这种 TTL/expire) 跳过
-  # 但真凭证字段不跳过 (服务默认密码 123456 / Redis 默认 123 这种弱密码必须报)
-  if [[ "$is_true_credential" == "0" ]] && [[ "$val" =~ ^[0-9]+$ ]] && [[ ${#val} -lt 10 ]]; then
-    printf "  %-30s [i] SKIP: 纯数字短值(看起来是配置参数, len=%d)\n" "$key" "${#val}"
-    return
-  fi
-
-  # 是否高敏字段
-  local high_sens=0
-  echo "$key" | grep -qiE 'SECRET|JWT|TOKEN|API[_-]?KEY|ACCESS[_-]?KEY[_-]?SECRET|PRIVATE[_-]?KEY|_AK$|_SK$|^AK_|^SK_' && high_sens=1
-
-  local result
-  result=$(printf '%s\n' "$val" | strength_of)
-  local len=$(echo "$result" | grep -oE 'len=[0-9]+' | cut -d= -f2)
-  local classes=$(echo "$result" | grep -oE 'classes=[0-9]+' | cut -d= -f2)
-  local strength=$(echo "$result" | grep -oE 'strength=[A-Z]+' | cut -d= -f2)
-
-  # Bug fix 2: 长度 >= 24 即视为 STRONG (即使 classes 少, 熵足够)
-  # 例如 48 字符 base64 / 64 字符 hex 即使只 2 类, 熵 >= 192 bits 远超 128 bits 安全门槛
-  if [[ "$strength" != "WEAK" && "$len" -ge 24 ]]; then
-    strength="STRONG"
-    result="${result/strength=MEDIUM/strength=STRONG}"
-    result="${result/reason=classes<3/reason=long_enough}"
-    result="${result/reason=len<16/reason=long_enough}"
-  fi
-
-  printf "  %-30s %s" "$key" "$result"
-  # 严重级标记
-  if   [[ "$strength" == "WEAK" ]]; then
-    printf "  [!!!] CRITICAL: 弱凭证, 必须立即轮换\n"
-  elif [[ "$high_sens" == "1" && "$len" -lt 32 ]]; then
-    printf "  [!!] HIGH: 高敏字段建议 >= 32 字符随机串\n"
-  elif [[ "$strength" == "MEDIUM" ]]; then
-    printf "  [!] MEDIUM: 建议加长至 16+ 且 3 类字符\n"
-  else
-    printf "  [OK]\n"
-  fi
-}
-
-# ---------- 1. .env 文件扫描 ----------
-echo "########## 1. .env 文件凭证强度 ##########"
-ENV_FILES=$(sudo -n find /home /opt /srv /root -maxdepth 6 -type f \
-              \( -name ".env" -o -name ".env.*" -o -name "*.env" \) 2>/dev/null \
-            | grep -vE '\.example|\.template|\.sample|\.bak|\.old|node_modules' \
-            | sort -u | head -20)
-[[ -z "$ENV_FILES" ]] && ENV_FILES=$(find /home /opt /srv /root -maxdepth 6 -type f \
-              \( -name ".env" -o -name ".env.*" -o -name "*.env" \) 2>/dev/null \
-            | grep -vE '\.example|\.template|\.sample|\.bak|\.old|node_modules' \
-            | sort -u | head -20)
-
-if [[ -z "$ENV_FILES" ]]; then
-  echo "[i] 未找到 .env 文件"
-else
-  for f in $ENV_FILES; do
-    echo ""
-    echo "[$f]"
-    # 只挑密码类字段, 解析 KEY=VALUE
-    if ! sudo -n cat "$f" 2>/dev/null | head -1 >/dev/null && ! cat "$f" 2>/dev/null | head -1 >/dev/null; then
-      echo "  [i] 不可读"
-      continue
-    fi
-    (sudo -n cat "$f" 2>/dev/null || cat "$f" 2>/dev/null) \
-      | grep -E '^[[:space:]]*[A-Z][A-Z0-9_]*[[:space:]]*=' \
-      | grep -iE '(PASSWORD|PASSWD|SECRET|TOKEN|API[_-]?KEY|ACCESS[_-]?KEY|PRIVATE[_-]?KEY|_AK|_SK|^AK_|^SK_)' \
-      | while IFS='=' read -r key val; do
-          key=$(echo "$key" | tr -d ' \t')
-          # 去引号 + 行尾注释
-          val=$(echo "$val" | sed -E 's/^[[:space:]]*//; s/[[:space:]]*#.*$//; s/^"//; s/"$//; s/^'\''//; s/'\''$//')
-          evaluate_secret "$key" "$val"
-        done
-  done
-fi
-
-# ---------- 2. docker 容器内联 env ----------
-echo ""
-echo "########## 2. Docker 容器内联 env 凭证强度 ##########"
-if command -v docker >/dev/null 2>&1; then
-  for c in $(docker ps -q 2>/dev/null); do
-    name=$(docker inspect -f '{{.Name}}' "$c" 2>/dev/null | sed 's|^/||')
-    echo ""
-    echo "[$name]"
-    docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' "$c" 2>/dev/null \
-      | grep -iE '(PASSWORD|PASSWD|SECRET|TOKEN|API[_-]?KEY|ACCESS[_-]?KEY|PRIVATE[_-]?KEY|_AK=|_SK=|^AK_|^SK_)' \
-      | while IFS='=' read -r key val; do
-          key=$(echo "$key" | tr -d ' \t')
-          evaluate_secret "$key" "$val"
-        done
-  done
-else
-  echo "[i] Docker 未安装"
-fi
-
-# ---------- 3. Redis requirepass (从启动参数提取) ----------
-echo ""
-echo "########## 3. Redis --requirepass 强度 ##########"
-if command -v docker >/dev/null 2>&1; then
-  REDIS_FOUND=0
-  for c in $(docker ps -q 2>/dev/null); do
-    image=$(docker inspect -f '{{.Config.Image}}' "$c" 2>/dev/null)
-    if echo "$image" | grep -qi "redis"; then
-      REDIS_FOUND=1
-      name=$(docker inspect -f '{{.Name}}' "$c" 2>/dev/null | sed 's|^/||')
-      echo ""
-      echo "[$name]"
-      args=$(docker inspect -f '{{range .Args}}{{.}} {{end}}' "$c" 2>/dev/null)
-      pass=$(echo "$args" | grep -oE -- '--requirepass [^ ]+' | head -1 | awk '{print $2}')
-      if [[ -n "$pass" ]]; then
-        evaluate_secret "REDIS_PASSWORD(--requirepass)" "$pass"
-      else
-        echo "  [!!!] CRITICAL: Redis 未设置 --requirepass"
-      fi
-    fi
-  done
-  [[ "$REDIS_FOUND" == "0" ]] && echo "[i] 未发现 Redis 容器"
-fi
-
-# ---------- 4. Postgres POSTGRES_PASSWORD (容器 env, 已在 2 覆盖, 此处单独 highlight) ----------
-echo ""
-echo "########## 4. Postgres POSTGRES_PASSWORD 强度 ##########"
-if command -v docker >/dev/null 2>&1; then
-  PG_FOUND=0
-  for c in $(docker ps -q 2>/dev/null); do
-    image=$(docker inspect -f '{{.Config.Image}}' "$c" 2>/dev/null)
-    if echo "$image" | grep -qi "postgres"; then
-      PG_FOUND=1
-      name=$(docker inspect -f '{{.Name}}' "$c" 2>/dev/null | sed 's|^/||')
-      echo ""
-      echo "[$name]"
-      pass=$(docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' "$c" 2>/dev/null \
-              | grep '^POSTGRES_PASSWORD=' | head -1 | cut -d= -f2-)
-      if [[ -n "$pass" ]]; then
-        evaluate_secret "POSTGRES_PASSWORD" "$pass"
-      else
-        echo "  [!!!] CRITICAL: 未取得 POSTGRES_PASSWORD (是否 secrets 挂载或 trust 认证?)"
-      fi
-    fi
-  done
-  [[ "$PG_FOUND" == "0" ]] && echo "[i] 未发现 Postgres 容器"
-fi
-
-# ---------- 5. SSH 私钥强度 ----------
-echo ""
-echo "########## 5. SSH 私钥类型 / 位数 ##########"
-# 当前用户 + root 的 ~/.ssh/ (Bug fix 3: 去重, root 用户登录时 $HOME=/root 会重复)
-SSH_DIRS=$(printf '%s\n' "$HOME/.ssh" /root/.ssh /home/*/.ssh 2>/dev/null | sort -u)
-for ssh_dir in $SSH_DIRS; do
-  [[ -d "$ssh_dir" ]] || continue
-  for kf in "$ssh_dir"/id_rsa "$ssh_dir"/id_ed25519 "$ssh_dir"/id_ecdsa "$ssh_dir"/id_dsa; do
-    [[ -f "$kf" ]] || continue
-    info=$(ssh-keygen -l -f "$kf" 2>/dev/null || sudo -n ssh-keygen -l -f "$kf" 2>/dev/null)
-    if [[ -z "$info" ]]; then
-      echo "  $kf  [i] 无法读取(权限?)"
-      continue
-    fi
-    bits=$(echo "$info" | awk '{print $1}')
-    type=$(echo "$info" | grep -oE '\([A-Z0-9]+\)$' | tr -d '()')
-    perm=$(stat -c '%a' "$kf" 2>/dev/null)
-
-    case "$type" in
-      ED25519)
-        printf "  %-40s type=%-8s bits=%-4s perm=%s  [OK]\n" "$kf" "$type" "$bits" "$perm" ;;
-      RSA)
-        if   [[ "$bits" -ge 4096 ]]; then mark="[OK]"
-        elif [[ "$bits" -ge 3072 ]]; then mark="[OK] (建议升 ed25519)"
-        elif [[ "$bits" -ge 2048 ]]; then mark="[!] MEDIUM: RSA-${bits} 可接受但建议升 ed25519 或 RSA-4096"
-        else                              mark="[!!!] CRITICAL: RSA-${bits} 已不安全, 立即轮换"
-        fi
-        printf "  %-40s type=%-8s bits=%-4s perm=%s  %s\n" "$kf" "$type" "$bits" "$perm" "$mark" ;;
-      ECDSA)
-        printf "  %-40s type=%-8s bits=%-4s perm=%s  [!] MEDIUM: ECDSA 存疑(NIST 曲线), 建议 ed25519\n" "$kf" "$type" "$bits" "$perm" ;;
-      DSA)
-        printf "  %-40s type=%-8s bits=%-4s perm=%s  [!!!] CRITICAL: DSA 已废弃, 立即轮换\n" "$kf" "$type" "$bits" "$perm" ;;
-      *)
-        printf "  %-40s type=%-8s bits=%-4s perm=%s\n" "$kf" "$type" "$bits" "$perm" ;;
-    esac
-
-    # 权限检查
-    if [[ -n "$perm" && "$perm" != "600" && "$perm" != "400" ]]; then
-      echo "    [!!] HIGH: 私钥权限 $perm 过宽, 应 600"
-    fi
-  done
-done
-
-echo ""
-echo "########## 凭证强度汇总 ##########"
-echo "[i] 修复指引:"
-echo "  - WEAK 密码: 立即轮换 (建议 >= 16 字符 + 三类字符的强密码)"
-echo "  - 高敏字段 (JWT/SECRET/AK/SK): >= 32 字符随机串"
-echo "  - 生成命令: openssl rand -base64 24 | tr -d '=+/' | cut -c1-20"
-echo "  - 高敏: openssl rand -hex 32  (生成 64 字符 hex token)"
-REMOTE

package/templates/ai-tools/skills/unitcircle/uc-deploy-audit/scripts/check_services.sh

@@ -1,94 +0,0 @@
-#!/usr/bin/env bash
-# 依赖服务连通性 / 防火墙
-TARGET="$1"; shift
-SSH_OPTS=("$@")
-
-ssh "${SSH_OPTS[@]}" "${TARGET}" bash -s <<'REMOTE'
-echo "--- 防火墙状态 ---"
-if command -v ufw >/dev/null 2>&1; then
-  echo "[ufw]"
-  sudo -n ufw status verbose 2>/dev/null || echo "  [!] 需 sudo 查看 ufw"
-fi
-if command -v firewall-cmd >/dev/null 2>&1; then
-  echo "[firewalld]"
-  sudo -n firewall-cmd --state 2>/dev/null
-  sudo -n firewall-cmd --list-all 2>/dev/null
-fi
-echo "[iptables]"
-sudo -n iptables -L INPUT -n --line-numbers 2>/dev/null | head -20 || echo "  [i] 无法读取 iptables"
-
-echo ""
-echo "--- 监听端口 (按地址分组) ---"
-(ss -tlnp 2>/dev/null || netstat -tlnp 2>/dev/null) | awk 'NR>1 {print $4}' | awk -F: '{
-  port=$NF;
-  ip=substr($0,1,length($0)-length(port)-1);
-  if (ip=="0.0.0.0" || ip=="*" || ip=="[::]") public[port]++;
-  else if (ip=="127.0.0.1" || ip=="[::1]") loop[port]++;
-  else internal[port]++;
-}
-END {
-  print "公网监听 (0.0.0.0 / *):"
-  for (p in public) print "  " p
-  print "内网监听 (具体 IP):"
-  for (p in internal) print "  " p
-  print "回环监听 (127.0.0.1):"
-  for (p in loop) print "  " p
-}'
-
-echo ""
-echo "--- 系统负载与内存 ---"
-uptime
-free -h 2>/dev/null | head -3
-
-echo ""
-echo "--- 磁盘 ---"
-df -h | grep -vE "tmpfs|udev" | head -10
-
-echo ""
-echo "--- 已安装的 Web 应用进程 (常见) ---"
-ps -eo user,pid,%cpu,%mem,cmd --sort=-%mem 2>/dev/null \
-  | grep -E "(nginx|node|python|uvicorn|gunicorn|java|php-fpm|redis-server|postgres|mysql|mongod)" \
-  | grep -v grep | head -20
-
-echo ""
-echo "--- 应用健康检查端点 (经本地 nginx 回环 + --resolve, 避免 hairpin NAT) ---"
-NGINX_DUMP=$(sudo -n nginx -T 2>/dev/null || nginx -T 2>/dev/null || true)
-# 只取真实 server_name 指令行(行首仅空白 + 关键字), 去行内注释, 拆多域名, 过滤 _ / 通配 / 空 / 非法 token
-# 旧实现用 awk '/server_name/' 会误匹配注释行里的 server_name 文字, 产出 _) 1. :80 等垃圾域名
-DOMAINS=$(echo "$NGINX_DUMP" \
-  | grep -E '^[[:space:]]*server_name[[:space:]]' \
-  | sed -E 's/#.*$//; s/^[[:space:]]*server_name[[:space:]]+//; s/;.*$//' \
-  | tr ' ' '\n' \
-  | grep -E '^[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?$' \
-  | grep -v '^_$' \
-  | sort -u | head -5)
-[[ -z "$DOMAINS" ]] && DOMAINS="localhost"
-# 是否启用 https(443 在监听); 公网域名从本机直连会触发 hairpin NAT 返回 000,
-# 用 --resolve 把域名钉到回环, 既走本地 nginx 又匹配 SNI 证书, 才是白盒正解
-HAS_HTTPS=$( (ss -tln 2>/dev/null || netstat -tln 2>/dev/null) | grep -qE ':443[[:space:]]' && echo yes || echo no )
-for D in $DOMAINS; do
-  for path in "/api/health" "/health" "/healthz" "/_health" "/status"; do
-    if [[ "$HAS_HTTPS" == "yes" ]]; then
-      code=$(curl -k -sS -o /dev/null -w "%{http_code}" --max-time 3 --resolve "$D:443:127.0.0.1" "https://$D$path" 2>/dev/null || echo "000")
-      scheme="https"
-    else
-      code=$(curl -sS -o /dev/null -w "%{http_code}" --max-time 3 --resolve "$D:80:127.0.0.1" "http://$D$path" 2>/dev/null || echo "000")
-      scheme="http"
-    fi
-    [[ "$code" != "404" && "$code" != "000" ]] && printf "  %s://%s%s -> %s\n" "$scheme" "$D" "$path" "$code"
-  done
-done
-
-echo ""
-echo "--- 系统更新提示 ---"
-if command -v apt >/dev/null 2>&1; then
-  sudo -n apt list --upgradable 2>/dev/null | head -10 || echo "  [i] 无法检查 apt 更新"
-elif command -v yum >/dev/null 2>&1; then
-  sudo -n yum check-update 2>/dev/null | head -10 || echo "  [i] 无法检查 yum 更新"
-fi
-
-echo ""
-echo "--- 内核/系统启动时间 ---"
-who -b 2>/dev/null
-echo "kernel: $(uname -r)"
-REMOTE

package/templates/ai-tools/skills/unitcircle/uc-deploy-audit/scripts/check_ssh.sh

@@ -1,56 +0,0 @@
-#!/usr/bin/env bash
-# SSH 安全检查 (只读)
-TARGET="$1"; shift
-SSH_OPTS=("$@")
-
-ssh "${SSH_OPTS[@]}" "${TARGET}" bash -s <<'REMOTE'
-echo "--- /etc/ssh/sshd_config (filtered key directives) ---"
-SSHD_CONF="/etc/ssh/sshd_config"
-SSHD_DIR="/etc/ssh/sshd_config.d"
-if [[ -r "$SSHD_CONF" ]]; then
-  grep -Ei "^[[:space:]]*(PermitRootLogin|PasswordAuthentication|PubkeyAuthentication|PermitEmptyPasswords|Port|Protocol|MaxAuthTries|LoginGraceTime|AllowUsers|AllowGroups|DenyUsers|DenyGroups|ChallengeResponseAuthentication|UsePAM|X11Forwarding|ClientAliveInterval|ClientAliveCountMax|LogLevel|Banner)" "$SSHD_CONF" 2>/dev/null
-  if [[ -d "$SSHD_DIR" ]]; then
-    echo "--- $SSHD_DIR/*.conf ---"
-    grep -EiH "^[[:space:]]*(PermitRootLogin|PasswordAuthentication|PubkeyAuthentication|PermitEmptyPasswords|Port|Protocol|MaxAuthTries)" "$SSHD_DIR"/*.conf 2>/dev/null
-  fi
-else
-  echo "[!] $SSHD_CONF 不可读 (需要 sudo)"
-fi
-
-echo ""
-echo "--- effective sshd config (sshd -T, 需 sudo) ---"
-sudo -n sshd -T 2>/dev/null | grep -Ei "^(permitrootlogin|passwordauthentication|pubkeyauthentication|permitemptypasswords|port|protocol|maxauthtries|logingracetime|allowusers|allowgroups|x11forwarding|loglevel)" || echo "[i] 无法读取 effective config (需要 sudo 或 sshd -T 不可用)"
-
-echo ""
-echo "--- ssh process & version ---"
-sshd -V 2>&1 | head -2 || ssh -V 2>&1
-
-echo ""
-echo "--- recent failed logins (last 20) ---"
-sudo -n journalctl _COMM=sshd --since "7 days ago" 2>/dev/null | grep -Ei "failed|invalid" | tail -20 \
-  || sudo -n grep -Ei "failed|invalid" /var/log/auth.log 2>/dev/null | tail -20 \
-  || echo "[i] 无法读取认证日志 (需要 sudo)"
-
-echo ""
-echo "--- fail2ban status ---"
-if command -v fail2ban-client >/dev/null 2>&1; then
-  sudo -n fail2ban-client status 2>/dev/null || echo "[i] fail2ban 已安装,但需要 sudo 查看状态"
-else
-  echo "[!] fail2ban 未安装"
-fi
-
-echo ""
-echo "--- authorized_keys 概览 (当前用户) ---"
-if [[ -r ~/.ssh/authorized_keys ]]; then
-  awk '{print "  key: " $1 " " substr($2,1,16) "... " $3}' ~/.ssh/authorized_keys
-  echo "  total: $(wc -l < ~/.ssh/authorized_keys) keys"
-else
-  echo "[i] 当前用户无 authorized_keys"
-fi
-
-echo ""
-echo "--- /root/.ssh/authorized_keys (需 sudo) ---"
-sudo -n test -f /root/.ssh/authorized_keys 2>/dev/null && \
-  echo "  [!] root 用户存在 authorized_keys, 共 $(sudo -n wc -l < /root/.ssh/authorized_keys 2>/dev/null) 行" \
-  || echo "[i] 无 root authorized_keys 或无 sudo 权限"
-REMOTE

package/templates/ai-tools/skills/unitcircle/uc-deploy-audit/scripts/run_all.sh

@@ -1,105 +0,0 @@
-#!/usr/bin/env bash
-# uc-deploy-audit: 一键全量巡检（subagent 不可用时的串行/并行退化方案）
-#
-# 优先做法是让 Claude 用 subagent 并行派遣多个 Agent 跑各类 check_xxx.sh
-# (见 SKILL.md Step 4)。本脚本仅作为本地一键回退使用。
-#
-# 用法:
-#   ./run_all.sh <user>@<host> [-p <port>] [-i <key>] [--serial]
-#
-# 默认 8 路并行。--serial 强制串行。
-
-set -uo pipefail
-
-if [[ $# -lt 1 ]]; then
-  echo "Usage: $0 <user>@<host|alias> [-p <port>] [-i <key>] [--serial]" >&2
-  exit 1
-fi
-
-TARGET="$1"; shift
-SSH_OPTS=(-o ConnectTimeout=10 -o BatchMode=yes -o StrictHostKeyChecking=accept-new)
-PARALLEL=true
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    -p) SSH_OPTS+=(-p "$2"); shift 2;;
-    -i) SSH_OPTS+=(-i "$2"); shift 2;;
-    --serial) PARALLEL=false; shift;;
-    *)  echo "Unknown arg: $1" >&2; exit 1;;
-  esac
-done
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-TMP_DIR=$(mktemp -d -t uc-audit-XXXXXX)
-trap 'rm -rf "$TMP_DIR"' EXIT
-
-# 检查项: <section_name>:<script_name>
-SECTIONS=(
-  "BASE_INFO:check_base.sh"
-  "SSH:check_ssh.sh"
-  "NGINX:check_nginx.sh"
-  "DB:check_db.sh"
-  "HTTPS:check_https.sh"
-  "ENV:check_env.sh"
-  "DOCKER:check_docker.sh"
-  "SERVICES:check_services.sh"
-  "RESILIENCE:check_resilience.sh"
-  "LOGS:check_logs.sh"
-  "CAPACITY:check_capacity.sh"
-  "SECRETS:check_secrets.sh"
-)
-
-echo "========================================"
-echo " uc-deploy-audit | target: ${TARGET}"
-echo " timestamp: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
-echo " mode: $([ "$PARALLEL" = true ] && echo "parallel (${#SECTIONS[@]} workers)" || echo 'serial')"
-echo "========================================"
-
-run_section() {
-  local name="$1"
-  local script="$2"
-  local out_file="${TMP_DIR}/${name}.out"
-  {
-    echo "########## SECTION: ${name} ##########"
-    bash "${SCRIPT_DIR}/${script}" "${TARGET}" "${SSH_OPTS[@]}" 2>&1 \
-      || echo "[!] ${name} 部分失败"
-    echo "########## END: ${name} ##########"
-  } > "$out_file" 2>&1
-}
-
-if [[ "$PARALLEL" == "true" ]]; then
-  # 并行：所有 section 后台启动
-  pids=()
-  for entry in "${SECTIONS[@]}"; do
-    name="${entry%%:*}"
-    script="${entry##*:}"
-    run_section "$name" "$script" &
-    pids+=($!)
-  done
-
-  # 等所有完成
-  for pid in "${pids[@]}"; do
-    wait "$pid"
-  done
-
-  # 按顺序输出结果（保证报告分类有序）
-  for entry in "${SECTIONS[@]}"; do
-    name="${entry%%:*}"
-    echo ""
-    cat "${TMP_DIR}/${name}.out"
-  done
-else
-  # 串行
-  for entry in "${SECTIONS[@]}"; do
-    name="${entry%%:*}"
-    script="${entry##*:}"
-    echo ""
-    run_section "$name" "$script"
-    cat "${TMP_DIR}/${name}.out"
-  done
-fi
-
-echo ""
-echo "========================================"
-echo " 巡检数据采集完成,请由 Claude 分析生成报告"
-echo "========================================"