fix: preserve agent environment in installer unit

README.md

@@ -182,7 +182,7 @@ Agent 只主动连接 Hub，不需要公网入站端口。
 ### 一键安装
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/kyaring/vps-commander/main/deploy/install.sh | sudo bash
+curl -fsSL https://gitea.king.nyc.mn/openclaw/vps-commander/raw/branch/main/deploy/install.sh | sudo bash
 ```
 
 安装脚本自动识别 `amd64/arm64` 并进入 Hub / Agent 安装流程。
@@ -190,7 +190,7 @@ curl -fsSL https://raw.githubusercontent.com/kyaring/vps-commander/main/deploy/i
 ### 一键升级 Agent
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/kyaring/vps-commander/main/deploy/upgrade-agent.sh | sudo bash
+curl -fsSL https://gitea.king.nyc.mn/openclaw/vps-commander/raw/branch/main/deploy/upgrade-agent.sh | sudo bash
 ```
 
 升级脚本下载目标 Release、校验文件大小、备份旧版本并在启动失败时自动回滚。

cmd/hub/main.go

@@ -38,6 +38,7 @@ func main() {
 	clusterSecret := os.Getenv("VPS_COMMANDER_CLUSTER_SECRET")
 	webPassword := os.Getenv("VPS_COMMANDER_WEB_PASSWORD")
 	adminToken := os.Getenv("VPS_COMMANDER_ADMIN_TOKEN")
+	installCommand := os.Getenv("VPS_COMMANDER_INSTALL_COMMAND")
 	if adminToken == "" {
 		adminToken = webPassword
 	}
@@ -68,6 +69,7 @@ func main() {
 		LocalName:      local,
 		Notify:         notificationManager,
 		AdminToken:     adminToken,
+		InstallCommand: installCommand,
 		ExecLimiter:    make(chan struct{}, 32),
 		SearchLimiter:  make(chan struct{}, 8),
 		LocalSessions:  executor.NewSessionManager(0),

deploy/README.md

@@ -52,7 +52,7 @@ chmod 0600 /etc/vps-commander/agent.env
 ### 3.1 一键安装
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/kyaring/vps-commander/main/deploy/install.sh | sudo bash
+curl -fsSL https://gitea.king.nyc.mn/openclaw/vps-commander/raw/branch/main/deploy/install.sh | sudo bash
 ```
 
 脚本自动识别 `amd64/arm64`，并进入 Hub / Agent 安装流程。
@@ -64,7 +64,7 @@ curl -fsSL https://raw.githubusercontent.com/kyaring/vps-commander/main/deploy/i
 ### 3.2 一键升级 Agent
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/kyaring/vps-commander/main/deploy/upgrade-agent.sh | sudo bash
+curl -fsSL https://gitea.king.nyc.mn/openclaw/vps-commander/raw/branch/main/deploy/upgrade-agent.sh | sudo bash
 ```
 
 升级流程：

deploy/install.sh

@@ -2,13 +2,15 @@
 set -e
 
 # VPS-Commander 一键安装与配置脚本 (Hub / Agent)
-# Repo: https://github.com/kyaring/vps-commander
+# Repo: https://gitea.king.nyc.mn/openclaw/vps-commander
 
-REPO="kyaring/vps-commander"
+REPO="openclaw/vps-commander"
 INSTALL_DIR="/opt/vps-commander"
 CONF_DIR="/etc/vps-commander"
-GITHUB_URL="https://github.com"
+RELEASE_BASE_URL="https://gitea.king.nyc.mn"
-API_URL="https://api.github.com"
+API_URL="https://gitea.king.nyc.mn/api/v1"
+RAW_INSTALL_URL="https://gitea.king.nyc.mn/openclaw/vps-commander/raw/branch/main/deploy/install.sh"
+INSTALL_COMMAND="curl -fsSL ${RAW_INSTALL_URL} | bash"
 
 # 颜色输出
 RED='\033[0;31m'
@@ -40,7 +42,7 @@ command -v curl >/dev/null 2>&1 || (apt-get update && apt-get install -y curl ||
 info "正在获取 VPS-Commander 最新版本信息..."
 LATEST_TAG=$(curl -fsSL --proto '=https' --proto-redir '=https' --retry 3 --connect-timeout 15 --max-time 30 "${API_URL}/repos/${REPO}/releases/latest" | sed -n 's/^[[:space:]]*"tag_name": "\([^"]*\)".*/\1/p' | head -n1)
 if [ -z "$LATEST_TAG" ]; then
-    error "无法从 GitHub 获取最新正式 Release，已停止安装；不会回退到旧版本"
+    error "无法从 Gitea 获取最新正式 Release，已停止安装；不会回退到旧版本"
 fi
 info "检测到最新版本: ${LATEST_TAG} (${TARGET_ARCH})"
 
@@ -60,7 +62,7 @@ download_verified() {
         error "下载结果为空: ${asset_name}"
     fi
     if command -v sha256sum >/dev/null 2>&1; then
-        checksum=$(curl -fsSL --proto '=https' --proto-redir '=https' --retry 3 --connect-timeout 15 --max-time 60 "${GITHUB_URL}/${REPO}/releases/download/${LATEST_TAG}/checksums.txt") || error "无法获取 Release 校验文件"
+        checksum=$(curl -fsSL --proto '=https' --proto-redir '=https' --retry 3 --connect-timeout 15 --max-time 60 "${RELEASE_BASE_URL}/${REPO}/releases/download/${LATEST_TAG}/checksums.txt") || error "无法获取 Release 校验文件"
         expected=$(printf '%s\n' "$checksum" | awk -v f="$asset_name" '$2 == f {print $1; exit}')
         [ -n "$expected" ] || error "Release 校验文件中缺少 ${asset_name}"
         actual=$(sha256sum "$tmp" | awk '{print $1}')
@@ -85,7 +87,7 @@ read_tty() {
         fi
         printf -v "$__var" '%s' "$value"
     else
-        error "检测不到可用 TTY。当前命令可能通过管道运行；请使用带终端的 shell 执行，例如: curl -fsSL https://raw.githubusercontent.com/kyaring/vps-commander/main/deploy/install.sh | bash"
+        error "检测不到可用 TTY。当前命令可能通过管道运行；请使用带终端的 shell 执行，例如: curl -fsSL ${RAW_INSTALL_URL} | bash"
     fi
 }
 
@@ -100,7 +102,7 @@ select_mode() {
 install_agent() {
     info "开始安装 VPS-Commander Agent (${TARGET_ARCH})..."
     BIN_NAME="vps-commander-agent-linux-${TARGET_ARCH}"
-    DOWNLOAD_URL="${GITHUB_URL}/${REPO}/releases/download/${LATEST_TAG}/${BIN_NAME}"
+    DOWNLOAD_URL="${RELEASE_BASE_URL}/${REPO}/releases/download/${LATEST_TAG}/${BIN_NAME}"
 
     download_verified "${DOWNLOAD_URL}" "${INSTALL_DIR}/vps-commander-agent" "${BIN_NAME}"
     chmod +x "${INSTALL_DIR}/vps-commander-agent"
@@ -136,7 +138,7 @@ Type=simple
 User=root
 WorkingDirectory=${INSTALL_DIR}
 EnvironmentFile=-${CONF_DIR}/agent.env
-ExecStart=${INSTALL_DIR}/vps-commander-agent -hub \${VPS_COMMANDER_HUB_WS_URL} -name \${VPS_COMMANDER_AGENT_NAME}
+ExecStart=/bin/sh -c 'exec ${INSTALL_DIR}/vps-commander-agent -hub "\$VPS_COMMANDER_HUB_WS_URL" -name "\$VPS_COMMANDER_AGENT_NAME"'
 Restart=always
 RestartSec=3s
 KillSignal=SIGTERM
@@ -149,22 +151,60 @@ WantedBy=multi-user.target
 SVC
 
     systemctl daemon-reload
-    systemctl enable --now vps-commander-agent
-    sleep 1
 
-    if systemctl is-active --quiet vps-commander-agent; then
+    # Validate the generated unit before starting it. systemd does not expand
-        success "VPS-Commander Agent 安装并启动成功！"
+    # ${VPS_COMMANDER_*} in ExecStart directly; the shell wrapper above must
+    # remain intact. This prevents a false-success install with a broken URL.
+    if ! grep -Fq 'ExecStart=/bin/sh -c' /etc/systemd/system/vps-commander-agent.service ||
+       ! grep -Fq '$VPS_COMMANDER_HUB_WS_URL' /etc/systemd/system/vps-commander-agent.service ||
+       ! grep -Fq '$VPS_COMMANDER_AGENT_NAME' /etc/systemd/system/vps-commander-agent.service; then
+        error "生成的 Agent systemd 服务异常，ExecStart 未通过校验。安装已中止。"
+    fi
+    if ! [[ "$HUB_WS" =~ ^wss://[^[:space:]]+/agent/ws$ ]]; then
+        error "Hub WSS 地址格式无效: ${HUB_WS}"
+    fi
+    if [[ "$AGENT_NAME" =~ [[:space:]/\?\&\=\#\%] ]]; then
+        error "节点名称包含非法字符: ${AGENT_NAME}"
+    fi
+
+    INSTALL_CHECK_SINCE=$(date --iso-8601=seconds)
+    systemctl enable --now vps-commander-agent
+    sleep 2
+
+    if ! systemctl is-active --quiet vps-commander-agent; then
+        error "Agent 服务启动失败，请执行: journalctl -u vps-commander-agent -n 50 --no-pager"
+    fi
+
+    # Verify that the running process received the actual URL/name, not literal
+    # placeholders or installer source text.
+    AGENT_CMD=$(ps -eo args= | grep -F "${INSTALL_DIR}/vps-commander-agent" | grep -v grep | head -n1 || true)
+    if [[ "$AGENT_CMD" != *"-hub ${HUB_WS} -name ${AGENT_NAME}"* ]]; then
+        error "Agent 进程参数校验失败: ${AGENT_CMD}"
+    fi
+
+    # A fresh connection produces this message after the Hub handshake/MCP sync.
+    # Do not report success merely because systemd says the process is running.
+    CONNECTED=0
+    for _ in {1..13}; do
+        if journalctl -u vps-commander-agent --since "$INSTALL_CHECK_SINCE" --no-pager -o cat 2>/dev/null | grep -q "MCP services synced:"; then
+            CONNECTED=1
+            break
+        fi
+        sleep 1
+    done
+    if [ "$CONNECTED" -ne 1 ]; then
+        error "Agent 已启动，但 15 秒内未确认成功连接 Hub，请检查: journalctl -u vps-commander-agent -n 50 --no-pager"
+    fi
+
+    success "VPS-Commander Agent 安装、启动并完成 Hub 连接校验！"
     info "节点名称: ${AGENT_NAME}"
     info "可通过 'systemctl status vps-commander-agent' 查看运行状态。"
-    else
-        warn "服务已启动但状态可能异常，请检查 'journalctl -u vps-commander-agent -n 20'。"
-    fi
 }
 
 install_hub() {
     info "开始安装 VPS-Commander Hub (${TARGET_ARCH})..."
     BIN_NAME="vps-commander-hub-linux-${TARGET_ARCH}"
-    DOWNLOAD_URL="${GITHUB_URL}/${REPO}/releases/download/${LATEST_TAG}/${BIN_NAME}"
+    DOWNLOAD_URL="${RELEASE_BASE_URL}/${REPO}/releases/download/${LATEST_TAG}/${BIN_NAME}"
 
     download_verified "${DOWNLOAD_URL}" "${INSTALL_DIR}/vps-commander-hub" "${BIN_NAME}"
     chmod +x "${INSTALL_DIR}/vps-commander-hub"
@@ -185,6 +225,7 @@ install_hub() {
     cat << ENV > "${CONF_DIR}/hub.env"
 VPS_COMMANDER_API_KEY=${API_KEY}
 VPS_COMMANDER_WEB_PASSWORD=${WEB_PASS}
+VPS_COMMANDER_INSTALL_COMMAND="${INSTALL_COMMAND}"
 ENV
     chmod 0600 "${CONF_DIR}/hub.env"
 

deploy/upgrade-agent.sh

@@ -2,12 +2,12 @@
 set -euo pipefail
 
 # VPS-Commander Agent 一键安全升级脚本
-# Repo: https://github.com/kyaring/vps-commander
+# Repo: https://gitea.king.nyc.mn/openclaw/vps-commander
 
-REPO="kyaring/vps-commander"
+REPO="openclaw/vps-commander"
 INSTALL_DIR="/opt/vps-commander"
-GITHUB_URL="https://github.com"
+RELEASE_BASE_URL="https://gitea.king.nyc.mn"
-API_URL="https://api.github.com"
+API_URL="https://gitea.king.nyc.mn/api/v1"
 
 RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; BLUE='\033[0;34m'; NC='\033[0m'
 info() { echo -e "${BLUE}[INFO]${NC} $*"; }
@@ -31,12 +31,12 @@ info "正在获取最新正式 Release 版本信息..."
 LATEST_TAG=$(curl -fsSL --proto '=https' --proto-redir '=https' --retry 3 --connect-timeout 15 --max-time 30 \
     "${API_URL}/repos/${REPO}/releases/latest" |
     sed -n 's/^[[:space:]]*"tag_name": "\\([^"]*\\)".*/\\1/p' | head -n1)
-[ -n "$LATEST_TAG" ] || error "无法从 GitHub 获取最新正式 Release，已停止升级；不会回退到旧版本"
+[ -n "$LATEST_TAG" ] || error "无法从 Gitea 获取最新正式 Release，已停止升级；不会回退到旧版本"
 info "目标升级版本: ${LATEST_TAG} (${TARGET_ARCH})"
 
 BIN_NAME="vps-commander-agent-linux-${TARGET_ARCH}"
-DOWNLOAD_URL="${GITHUB_URL}/${REPO}/releases/download/${LATEST_TAG}/${BIN_NAME}"
+DOWNLOAD_URL="${RELEASE_BASE_URL}/${REPO}/releases/download/${LATEST_TAG}/${BIN_NAME}"
-CHECKSUM_URL="${GITHUB_URL}/${REPO}/releases/download/${LATEST_TAG}/checksums.txt"
+CHECKSUM_URL="${RELEASE_BASE_URL}/${REPO}/releases/download/${LATEST_TAG}/checksums.txt"
 TMP_BIN=$(mktemp "${INSTALL_DIR}/vps-commander-agent.tmp.XXXXXX") || error "无法创建临时文件"
 TMP_SUM=$(mktemp "${INSTALL_DIR}/vps-commander-checksums.tmp.XXXXXX") || { rm -f "$TMP_BIN"; error "无法创建校验文件"; }
 BAK_BIN="${INSTALL_DIR}/vps-commander-agent.bak"

docs/MCP_INTEGRATION.md

@@ -176,7 +176,7 @@ API Key 不应提交到 Git 仓库。
 仓库已经提供统一安装脚本，支持 Linux `amd64` 与 `arm64`，安装时自动识别架构并从 GitHub Release 获取对应二进制。
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/kyaring/vps-commander/main/deploy/install.sh | sudo bash
+curl -fsSL https://gitea.king.nyc.mn/openclaw/vps-commander/raw/branch/main/deploy/install.sh | sudo bash
 ```
 
 脚本会进入交互式安装流程，可选择 Hub 或 Agent。生产环境使用时，Agent 应使用独立设备凭据，不应重新启用全局 Shared Secret。
@@ -184,7 +184,7 @@ curl -fsSL https://raw.githubusercontent.com/kyaring/vps-commander/main/deploy/i
 ### 7.2 一键升级 Agent
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/kyaring/vps-commander/main/deploy/upgrade-agent.sh | sudo bash
+curl -fsSL https://gitea.king.nyc.mn/openclaw/vps-commander/raw/branch/main/deploy/upgrade-agent.sh | sudo bash
 ```
 
 升级采用临时文件下载 → 基础完整性检查 → 旧二进制备份 → 原子替换 → systemd 重启 → 健康检查；启动失败时自动回滚旧版本。

internal/api/api.go

@@ -47,6 +47,7 @@ type Server struct {
 	Notify         *notify.Manager
 	Policy         *security.Snapshot
 	AdminToken     string
+	InstallCommand string
 	ExecLimiter    chan struct{}
 	SearchLimiter  chan struct{}
 	LocalSessions  *executor.SessionManager
@@ -254,8 +255,17 @@ func (s *Server) ProvisionDeviceCredentialJSON(w http.ResponseWriter, r *http.Re
 		http.Error(w, "local control node does not use agent credential", 400)
 		return
 	}
-	if s.Cluster == nil || !s.Cluster.Online(q.Device) {
+	if strings.ContainsAny(q.Device, "/\\?&=#%") {
-		http.Error(w, "device offline", 409)
+		http.Error(w, "invalid device name", 400)
+		return
+	}
+	configured, err := s.Store.HasDeviceCredential(q.Device)
+	if err != nil {
+		http.Error(w, "credential lookup failed", 500)
+		return
+	}
+	if configured {
+		http.Error(w, "device credential already exists; revoke/rotate it before provisioning again", 409)
 		return
 	}
 	b := make([]byte, 32)
@@ -269,7 +279,7 @@ func (s *Server) ProvisionDeviceCredentialJSON(w http.ResponseWriter, r *http.Re
 		return
 	}
 	_ = s.Store.Audit(clientIP(r), q.Device, "device_credential_provision", "device="+q.Device, 0, 0, "credential provisioned")
-	jsonOut(w, map[string]any{"ok": true, "device": q.Device, "token": token})
+	jsonOut(w, map[string]any{"ok": true, "device": q.Device, "token": token, "install_command": s.InstallCommand})
 }
 
 func (s *Server) UpdateSecuritySettingsJSON(w http.ResponseWriter, r *http.Request) {

internal/api/api_test.go

@@ -167,3 +167,44 @@ func TestEditBlockSecurityAndReplacement(t *testing.T) {
 		t.Fatalf("low mode status=%d body=%s", w.Code, w.Body.String())
 	}
 }
+
+func TestProvisionDeviceCredentialForNewOfflineDevice(t *testing.T) {
+	store, err := storage.Open(filepath.Join(t.TempDir(), "commander.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer store.DB.Close()
+
+	s := &Server{
+		Store:      store,
+		LocalName:  "wjyhk",
+		AdminToken: "admin-test-token",
+	}
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/security/device-credentials/provision", strings.NewReader("{\"device\":\"new-node-01\"}"))
+	req.Header.Set("X-Admin-Token", "admin-test-token")
+	w := httptest.NewRecorder()
+	s.ProvisionDeviceCredentialJSON(w, req)
+	if w.Code != http.StatusOK {
+		t.Fatalf("provision status=%d body=%s", w.Code, w.Body.String())
+	}
+	if !strings.Contains(w.Body.String(), "\"token\"") {
+		t.Fatalf("missing token: %s", w.Body.String())
+	}
+
+	ok, err := store.HasDeviceCredential("new-node-01")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !ok {
+		t.Fatal("credential was not persisted")
+	}
+
+	req = httptest.NewRequest(http.MethodPost, "/api/v1/security/device-credentials/provision", strings.NewReader("{\"device\":\"new-node-01\"}"))
+	req.Header.Set("X-Admin-Token", "admin-test-token")
+	w = httptest.NewRecorder()
+	s.ProvisionDeviceCredentialJSON(w, req)
+	if w.Code != http.StatusConflict {
+		t.Fatalf("duplicate provision status=%d body=%s", w.Code, w.Body.String())
+	}
+}

internal/web/panel.go

@@ -54,6 +54,7 @@ func (p *Panel) Handler() http.Handler {
 	mux.HandleFunc("/panel/api/mcp/test", p.protected(p.testMCP))
 	mux.HandleFunc("/panel/api/security/settings", p.protected(p.securitySettings))
 	mux.HandleFunc("/panel/api/security/settings/update", p.protected(p.updateSecuritySettings))
+	mux.HandleFunc("/panel/api/security/device-credentials/provision", p.protected(p.provisionDeviceCredential))
 	mux.HandleFunc("/panel/api/notifications/webhooks", p.protected(p.webhookTargets))
 	mux.HandleFunc("/panel/api/notifications/webhook/update", p.protected(p.updateWebhookTarget))
 	mux.HandleFunc("/panel/api/notifications/webhook/delete", p.protected(p.deleteWebhookTarget))
@@ -65,6 +66,7 @@ func (p *Panel) Handler() http.Handler {
 type securityPanelRunner interface {
 	SecuritySettingsJSON(http.ResponseWriter, *http.Request)
 	UpdateSecuritySettingsJSON(http.ResponseWriter, *http.Request)
+	ProvisionDeviceCredentialJSON(http.ResponseWriter, *http.Request)
 }
 
 type mcpPanelRunner interface {
@@ -121,6 +123,17 @@ func (p *Panel) updateSecuritySettings(w http.ResponseWriter, r *http.Request) {
 	http.Error(w, "security API unavailable", 501)
 }
 
+func (p *Panel) provisionDeviceCredential(w http.ResponseWriter, r *http.Request) {
+	if p.AdminToken != "" {
+		r.Header.Set("X-Admin-Token", p.AdminToken)
+	}
+	if v, ok := p.Runner.(securityPanelRunner); ok {
+		v.ProvisionDeviceCredentialJSON(w, r)
+		return
+	}
+	http.Error(w, "security API unavailable", 501)
+}
+
 func (p *Panel) testMCP(w http.ResponseWriter, r *http.Request) {
 	if v, ok := p.Runner.(mcpPanelRunner); ok {
 		v.TestMCPJSON(w, r)

internal/web/static/app.js

@@ -213,6 +213,25 @@ $("#mcpTest").onclick=async()=>{
 $("#mcpTransport").onchange=()=>{const stdio=$("#mcpTransport").value==="stdio";$("#mcpCommand").parentElement.style.display=stdio?"":"none";$("#mcpArgs").parentElement.style.display=stdio?"":"none";$("#mcpUrl").parentElement.style.display=stdio?"none":""};
 loadMCPServices().catch(console.error);
 
+async function provisionDeviceCredential(){
+  const result=$("#deviceProvisionResult");
+  const status=$("#deviceProvisionStatus");
+  const name=($("#provisionDeviceName").value||"").trim();
+  if(!name){status.textContent="请输入节点名称。";return}
+  try{
+    const x=await api("/security/device-credentials/provision",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({device:name})});
+    $("#deviceProvisionToken").value=x.token||"";
+    $("#deviceProvisionCommand").value=x.install_command||"";
+    result.hidden=false;
+    status.textContent=name+" 接入凭证已生成。安装时把 Token 填入 Agent Token。";
+  }catch(e){status.textContent="生成失败: "+e.message}
+}
+$("#deviceProvisionNew").onclick=()=>{$("#deviceProvisionEditor").hidden=false;$("#deviceProvisionResult").hidden=true;$("#deviceProvisionStatus").textContent="";$("#provisionDeviceName").focus()};
+$("#deviceProvisionCancel").onclick=()=>{$("#deviceProvisionEditor").hidden=true};
+$("#deviceProvisionCreate").onclick=()=>provisionDeviceCredential();
+$("#deviceProvisionToken").onclick=e=>e.target.select();
+$("#deviceProvisionCommand").onclick=e=>e.target.select();
+
 async function loadSecuritySettings(){const x=await api("/security/settings"),nodes=x.nodes||[],effective=x.effective||{},configured=new Map(nodes.map(n=>[n.node,n.mode])),devices=await api("/devices");$("#globalSecurity").value=x.global||"medium";$("#securityNodes").innerHTML=devices.map(d=>{const mode=configured.get(d.name)||"inherit",eff=effective[d.name]||x.global||"medium";return `<tr><td>${esc(d.name)}</td><td><select data-security-node="${esc(d.name)}"><option value="inherit" ${mode==='inherit'?'selected':''}>跟随全局</option><option value="low" ${mode==='low'?'selected':''}>低 · Low</option><option value="medium" ${mode==='medium'?'selected':''}>中 · Medium</option><option value="high" ${mode==='high'?'selected':''}>高 · High</option></select></td><td>${esc(eff)}</td><td><button type="button" onclick="saveNodeSecurity('${esc(d.name)}')">保存</button></td></tr>`}).join("")}
 async function saveNodeSecurity(node){const el=document.querySelector(`[data-security-node="${CSS.escape(node)}"]`);if(!el)return;try{await api("/security/settings/update",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({node,mode:el.value})});$("#securityStatus").textContent=`${node} 策略已保存。`;await loadSecuritySettings()}catch(e){$("#securityStatus").textContent="保存失败: "+e.message}}
 $("#saveGlobalSecurity").onclick=async()=>{try{await api("/security/settings/update",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({global:$("#globalSecurity").value})});$("#securityStatus").textContent="全局安全策略已保存。";await loadSecuritySettings()}catch(e){$("#securityStatus").textContent="保存失败: "+e.message}};$("#securityRefresh").onclick=()=>loadSecuritySettings().catch(console.error);loadSecuritySettings().catch(console.error);

internal/web/static/index.html

@@ -1,5 +1,22 @@
 <!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><script>(function(){try{var t=localStorage.getItem("vpc_theme");if(t!=="light"&&t!=="dark")t=matchMedia("(prefers-color-scheme:light)").matches?"light":"dark";document.documentElement.dataset.theme=t}catch(e){document.documentElement.dataset.theme="dark"}})();</script><title>VPS-Commander</title><link rel="stylesheet" href="/static/app.css"></head><body><header><div class="brand-wrap"><img src="/static/icon.png" alt="logo" class="brand-logo"><div><strong>VPS-Commander</strong><span>Private Infrastructure Console</span></div></div><div class="header-actions"><button id="themeToggle" type="button" class="btn-icon" title="切换主题" aria-label="切换主题"><svg class="theme-svg svg-sun" viewBox="0 0 24 24" width="18" height="18" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="5"></circle><line x1="12" y1="1" x2="12" y2="3"></line><line x1="12" y1="21" x2="12" y2="23"></line><line x1="4.22" y1="4.22" x2="5.64" y2="5.64"></line><line x1="18.36" y1="18.36" x2="19.78" y2="19.78"></line><line x1="1" y1="12" x2="3" y2="12"></line><line x1="21" y1="12" x2="23" y2="12"></line><line x1="4.22" y1="19.78" x2="5.64" y2="18.36"></line><line x1="18.36" y1="5.64" x2="19.78" y2="4.22"></line></svg><svg class="theme-svg svg-moon" viewBox="0 0 24 24" width="18" height="18" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"></path></svg></button><button id="logout" type="button">退出</button></div></header><main><section class="grid"><article class="card wide"><div class="cardhead"><h2>设备看板</h2><button id="refresh" type="button">刷新</button></div><div id="devices" class="devices"></div></article><article class="card"><h2>Actions 向导</h2><p>当前 Hub 的 OpenAPI Schema：</p><div class="actions"><button id="copySchema" type="button">复制 Schema 地址</button><button id="copyPrompt" type="button">复制 System Prompt</button><button id="rotateKey" type="button">轮换 API Key</button></div><pre id="schemaHint">/openapi.json</pre><pre id="newKey"></pre></article><article class="card wide"><div class="mcp-toolbar"><h2>MCP</h2><button id="mcpNew" type="button">新增 MCP</button></div><div id="mcpList" class="mcp-grid"></div><div id="mcpEditor" hidden><div class="mcp-form"><label>服务标识<input id="mcpId" placeholder="docker"></label><label>显示名称<input id="mcpName" placeholder="Docker 容器管理"></label><label>传输类型<select id="mcpTransport"><option value="stdio">命令行 / stdio</option><option value="http">HTTP / Streamable HTTP</option><option value="sse">SSE</option></select></label><label>启用<select id="mcpEnabled"><option value="1">启用</option><option value="0">停用</option></select></label><label class="full">Command<input id="mcpCommand" placeholder="docker-mcp"></label><label class="full">Arguments（JSON 数组）<textarea id="mcpArgs">[]</textarea></label><label class="full">URL<input id="mcpUrl" placeholder="http://127.0.0.1:8080/mcp"></label><label class="full">Headers（JSON 对象，可选）<textarea id="mcpHeaders">{}</textarea></label><label class="full">环境变量（JSON 对象，可选）<textarea id="mcpEnv">{}</textarea></label><label>生效范围<select id="mcpScope"><option value="all">全部节点</option><option value="custom">指定节点</option></select></label><div><span>指定节点</span><div id="mcpNodes" class="mcp-nodes"></div></div><label>测试节点<select id="mcpTestNode"><option value="local">Hub 本机</option></select></label></div><div class="mcp-actions"><button id="mcpSave" type="button">保存并热更新</button><button id="mcpTest" type="button">测试连通性</button><button id="mcpCancel" type="button">取消</button></div><div id="mcpStatus" class="mcp-status"></div><div id="mcpTestResult" class="mcp-test-result" hidden></div></div></article>
-<article class="card wide"><div class="cardhead"><h2>快速控制台</h2><select id="device"></select></div><textarea id="command" placeholder="输入 Shell 命令，例如 uname -a"></textarea><div><button id="run" type="button">执行</button></div><pre id="output"></pre></article><article class="card wide"><div class="cardhead"><h2>安全</h2><button id="securityRefresh" type="button">刷新</button></div><div class="security-grid"><label>全局安全等级<select id="globalSecurity"><option value="low">低 · Low</option><option value="medium">中 · Medium</option><option value="high">高 · High</option></select></label><button id="saveGlobalSecurity" type="button">保存全局策略</button></div><div class="tablewrap"><table><thead><tr><th>节点</th><th>单机策略</th><th>有效策略</th><th>操作</th></tr></thead><tbody id="securityNodes"></tbody></table></div><p id="securityStatus"></p></article><article class="card wide">
+<article class="card wide"><div class="cardhead"><h2>快速控制台</h2><select id="device"></select></div><textarea id="command" placeholder="输入 Shell 命令，例如 uname -a"></textarea><div><button id="run" type="button">执行</button></div><pre id="output"></pre></article><article class="card wide"><div class="cardhead"><h2>设备接入</h2><button id="deviceProvisionNew" type="button">添加设备</button></div>
+<div id="deviceProvisionEditor" hidden>
+  <div class="mcp-form">
+    <label>节点名称<input id="provisionDeviceName" placeholder="例如 hk-vps-01"></label>
+  </div>
+  <div class="mcp-actions">
+    <button id="deviceProvisionCreate" type="button">生成接入凭证</button>
+    <button id="deviceProvisionCancel" type="button">取消</button>
+  </div>
+  <div id="deviceProvisionStatus" class="mcp-status"></div>
+  <div id="deviceProvisionResult" hidden>
+    <label>Agent Token<input id="deviceProvisionToken" readonly></label>
+    <label>一键安装命令<textarea id="deviceProvisionCommand" readonly></textarea></label>
+    <p>Token 只在这里明文显示；Hub 仅保存 Token 哈希。</p>
+  </div>
+</div>
+</article>
+<article class="card wide"><div class="cardhead"><h2>安全</h2><button id="securityRefresh" type="button">刷新</button></div><div class="security-grid"><label>全局安全等级<select id="globalSecurity"><option value="low">低 · Low</option><option value="medium">中 · Medium</option><option value="high">高 · High</option></select></label><button id="saveGlobalSecurity" type="button">保存全局策略</button></div><div class="tablewrap"><table><thead><tr><th>节点</th><th>单机策略</th><th>有效策略</th><th>操作</th></tr></thead><tbody id="securityNodes"></tbody></table></div><p id="securityStatus"></p></article><article class="card wide">
   <div class="mcp-toolbar">
     <h2>通知</h2>
     <div style="display:flex;gap:8px">