feat: 模块化命令框架 + runbook 严格断言与查询结果回传

- core/module: 命令模板、门控（feature flag/confirm/dry-run）、ecode 错误标签、ResultFormatter - runbook executor: http.get/http.post/assert.json(expect_success 严格断言)、目标主机管理、任务落库、最终 stdout 直接回传 - cf 模块: /cf dns list 支持域名自动解析 zone_id；dns list/zones/workers list 格式化回传；API success:false 判真失败 - 全部 CF/CPA runbook 接入严格断言，杜绝假阳性 success - 新增 cpa/cfdav/mail/sub 模块与 runbooks；QQ 订阅到期提醒调度 - Web 后台: 模块设置(CF/CPA/cfdav/AI)、OPS 任务、渠道管理、审计页
2026-09-13 07:42:17 +08:00
parent 9085c490f3
commit 81939825d1
86 changed files with 6885 additions and 467 deletions
@@ -0,0 +1,18 @@
+version: 1
+name: cf_dns_add
+description: 新增 DNS 记录（按 name/content）
+steps:
+  - id: add_dns
+    action: ssh.exec
+    on_fail: stop
+    with:
+      target: hwsg
+      command: "CF_ACCOUNT_ID=${env_cf_account_id} CF_API_TOKEN=${env_cf_api_token} INPUT_NAME=${env.INPUT_NAME} INPUT_CONTENT=${env.INPUT_CONTENT} INPUT_TYPE=${env.INPUT_TYPE} INPUT_PROXIED=${env.INPUT_PROXIED} python3 -c 'import base64; exec(base64.b64decode(\"aW1wb3J0IG9zLHJlcXVlc3RzLGpzb24KbmFtZT1vcy5nZXRlbnYoJ0lOUFVUX05BTUUnLCcnKQpjb250ZW50PW9zLmdldGVudignSU5QVVRfQ09OVEVOVCcsJycpCnJlY190eXBlPW9zLmdldGVudignSU5QVVRfVFlQRScsJ0EnKQpwcm94aWVkPW9zLmdldGVudignSU5QVVRfUFJPWElFRCcsJ2ZhbHNlJykubG93ZXIoKT09J3RydWUnCmFjY291bnQ9b3MuZ2V0ZW52KCdDRl9BQ0NPVU5UX0lEJywnJykKdG9rZW49b3MuZ2V0ZW52KCdDRl9BUElfVE9LRU4nLCcnKQpoZWFkZXJzPXsnQXV0aG9yaXphdGlvbic6J0JlYXJlciAnK3Rva2VuLCdDb250ZW50LVR5cGUnOidhcHBsaWNhdGlvbi9qc29uJ30KcmVzcD1yZXF1ZXN0cy5nZXQoJ2h0dHBzOi8vYXBpLmNsb3VkZmxhcmUuY29tL2NsaWVudC92NC96b25lcycsIGhlYWRlcnM9aGVhZGVycywgcGFyYW1zPXsnYWNjb3VudC5pZCc6YWNjb3VudCwncGVyX3BhZ2UnOjIwMH0sIHRpbWVvdXQ9MTUpCmRhdGE9cmVzcC5qc29uKCkKem9uZT1Ob25lCmZvciB6IGluIGRhdGEuZ2V0KCdyZXN1bHQnLFtdKToKICAgIHpuPXouZ2V0KCduYW1lJywnJykKICAgIGlmIG5hbWU9PXpuIG9yIG5hbWUuZW5kc3dpdGgoJy4nK3puKToKICAgICAgICB6b25lPXo7IGJyZWFrCmlmIG5vdCB6b25lOgogICAgcHJpbnQoanNvbi5kdW1wcyh7J3N1Y2Nlc3MnOkZhbHNlLCdzdGFnZSc6J21hdGNoX3pvbmUnLCdlcnJvcnMnOlsnem9uZV9ub3RfZm91bmQnXSwnbmFtZSc6bmFtZX0sIGVuc3VyZV9hc2NpaT1GYWxzZSkpOyByYWlzZSBTeXN0ZW1FeGl0KDIpCnpvbmVfaWQ9em9uZS5nZXQoJ2lkJykKcGF5bG9hZD17J3R5cGUnOnJlY190eXBlLCduYW1lJzpuYW1lLCdjb250ZW50Jzpjb250ZW50LCdwcm94aWVkJzpwcm94aWVkfQpyZXNwMj1yZXF1ZXN0cy5wb3N0KCdodHRwczovL2FwaS5jbG91ZGZsYXJlLmNvbS9jbGllbnQvdjQvem9uZXMvJyt6b25lX2lkKycvZG5zX3JlY29yZHMnLCBoZWFkZXJzPWhlYWRlcnMsIGpzb249cGF5bG9hZCwgdGltZW91dD0xNSkKcHJpbnQocmVzcDIudGV4dCkK\"), {})'"
+  - id: assert
+    action: assert.json
+    on_fail: stop
+    with:
+      source_step: add_dns
+      expect_success: true
+      required_paths:
+        - "success"
@@ -0,0 +1,18 @@
+version: 1
+name: cf_dns_del
+description: 删除 DNS 记录（按 record_id）
+steps:
+  - id: del_dns
+    action: ssh.exec
+    on_fail: stop
+    with:
+      target: hwsg
+      command: "CF_API_TOKEN=${env_cf_api_token} INPUT_RECORD_ID=${env.INPUT_RECORD_ID} python3 - <<'PY'\nimport os,requests,json\nrec=os.getenv('INPUT_RECORD_ID','')\ntoken=os.getenv('CF_API_TOKEN','')\nemail=os.getenv('CF_API_EMAIL','')\nheaders={'Authorization':'Bearer '+token,'Content-Type':'application/json'}\n# find record across zones\nzones=requests.get('https://api.cloudflare.com/client/v4/zones?per_page=200', headers=headers, timeout=15).json().get('result',[])\nzone_id=None\nfor z in zones:\n    zid=z.get('id')\n    r=requests.get(f'https://api.cloudflare.com/client/v4/zones/{zid}/dns_records/{rec}', headers=headers, timeout=15)\n    if r.status_code==200 and r.json().get('success'):\n        zone_id=zid\n        break\nif not zone_id:\n    print(json.dumps({'success':False,'errors':['record_not_found']}))\n    raise SystemExit(1)\nresp=requests.delete(f'https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records/{rec}', headers=headers, timeout=15)\nprint(resp.text)\nPY"
+  - id: assert
+    action: assert.json
+    on_fail: stop
+    with:
+      source_step: del_dns
+      expect_success: true
+      required_paths:
+        - "success"
@@ -0,0 +1,18 @@
+version: 1
+name: cf_dns_list
+description: 列出某个 Zone 的 DNS 记录
+steps:
+  - id: list_dns
+    action: ssh.exec
+    on_fail: stop
+    with:
+      target: hwsg
+      command: "CF_ACCOUNT_ID=${env_cf_account_id} CF_API_TOKEN=${env_cf_api_token} INPUT_ZONE_ID=${env.INPUT_ZONE_ID} python3 -c \"import os,requests; zone=os.getenv('INPUT_ZONE_ID',''); token=os.getenv('CF_API_TOKEN',''); email=os.getenv('CF_API_EMAIL',''); headers={'Authorization':'Bearer '+token,'Content-Type':'application/json'}; url='https://api.cloudflare.com/client/v4/zones/%s/dns_records'%zone; resp=requests.get(url, headers=headers, timeout=15); print(resp.text)\""
+  - id: assert
+    action: assert.json
+    on_fail: stop
+    with:
+      source_step: list_dns
+      expect_success: true
+      required_paths:
+        - "success"
@@ -13,6 +13,7 @@ steps:
    on_fail: stop
    with:
      source_step: resolve_dns
+      expect_success: true
      required_paths:
        - "success"
  - id: update_dns
@@ -26,5 +27,6 @@ steps:
    on_fail: stop
    with:
      source_step: update_dns
+      expect_success: true
      required_paths:
        - "success"
@@ -0,0 +1,32 @@
+version: 1
+name: cf_dns_set
+description: 修改 DNS 记录内容（按 record_id）
+steps:
+  - id: get_dns
+    action: ssh.exec
+    on_fail: stop
+    with:
+      target: hwsg
+      command: "CF_API_TOKEN=${env_cf_api_token} INPUT_RECORD_ID=${env.INPUT_RECORD_ID} python3 - <<'PY'\nimport os,requests\nrec=os.getenv('INPUT_RECORD_ID','')\ntoken=os.getenv('CF_API_TOKEN','')\nemail=os.getenv('CF_API_EMAIL','')\nheaders={'Authorization':'Bearer '+token,'Content-Type':'application/json'}\nurl=f'https://api.cloudflare.com/client/v4/zones?per_page=200'\nresp=requests.get(url, headers=headers, timeout=15)\nresp.raise_for_status()\n# find record across zones\nfor z in resp.json().get('result',[]):\n    zone_id=z.get('id')\n    rurl=f'https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records/{rec}'\n    r=requests.get(rurl, headers=headers, timeout=15)\n    if r.status_code==200:\n        print(r.text)\n        raise SystemExit(0)\nprint('{"success":false,"errors":["record_not_found"]}')\nPY"
+  - id: assert_get
+    action: assert.json
+    on_fail: stop
+    with:
+      source_step: get_dns
+      expect_success: true
+      required_paths:
+        - "success"
+  - id: update_dns
+    action: ssh.exec
+    on_fail: stop
+    with:
+      target: hwsg
+      command: "CF_API_TOKEN=${env_cf_api_token} INPUT_RECORD_ID=${env.INPUT_RECORD_ID} INPUT_CONTENT=${env.INPUT_CONTENT} INPUT_PROXIED=${env.INPUT_PROXIED} python3 - <<'PY'\nimport os,requests,json\nrec=os.getenv('INPUT_RECORD_ID','')\ncontent=os.getenv('INPUT_CONTENT','')\nproxied=os.getenv('INPUT_PROXIED','false').lower()=='true'\ntoken=os.getenv('CF_API_TOKEN','')\nemail=os.getenv('CF_API_EMAIL','')\nheaders={'Authorization':'Bearer '+token,'Content-Type':'application/json'}\n# find record and zone\nzones=requests.get('https://api.cloudflare.com/client/v4/zones?per_page=200', headers=headers, timeout=15).json().get('result',[])\nzone_id=None\nrecord=None\nfor z in zones:\n    zid=z.get('id')\n    r=requests.get(f'https://api.cloudflare.com/client/v4/zones/{zid}/dns_records/{rec}', headers=headers, timeout=15)\n    if r.status_code==200:\n        data=r.json()\n        if data.get('success'):\n            zone_id=zid\n            record=data.get('result')\n            break\nif not zone_id or not record:\n    print(json.dumps({'success':False,'errors':['record_not_found']}))\n    raise SystemExit(1)\npayload={\n  'type': record.get('type'),\n  'name': record.get('name'),\n  'content': content,\n  'proxied': proxied\n}\nresp=requests.put(f'https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records/{rec}', headers=headers, json=payload, timeout=15)\nprint(resp.text)\nPY"
+  - id: assert_update
+    action: assert.json
+    on_fail: stop
+    with:
+      source_step: update_dns
+      expect_success: true
+      required_paths:
+        - "success"
@@ -0,0 +1,18 @@
+version: 1
+name: cf_dns_update
+description: 更新 DNS 记录（按 record_id）
+steps:
+  - id: update_dns
+    action: ssh.exec
+    on_fail: stop
+    with:
+      target: hwsg
+      command: "CF_ACCOUNT_ID=${env_cf_account_id} CF_API_TOKEN=${env_cf_api_token} INPUT_ZONE_ID=${env.INPUT_ZONE_ID} INPUT_RECORD_ID=${env.INPUT_RECORD_ID} INPUT_TYPE=${env.INPUT_TYPE} INPUT_NAME=${env.INPUT_NAME} INPUT_CONTENT=${env.INPUT_CONTENT} INPUT_TTL=${env.INPUT_TTL} INPUT_PROXIED=${env.INPUT_PROXIED} python3 - <<'PY'\nimport os, requests\nzone=os.getenv('INPUT_ZONE_ID','')\nrec=os.getenv('INPUT_RECORD_ID','')\ntoken=os.getenv('CF_API_TOKEN','')\nemail=os.getenv('CF_API_EMAIL','')\nheaders={'Authorization':'Bearer '+token,'Content-Type':'application/json'}\nurl=f'https://api.cloudflare.com/client/v4/zones/{zone}/dns_records/{rec}'\npayload={\n  'type': os.getenv('INPUT_TYPE',''),\n  'name': os.getenv('INPUT_NAME',''),\n  'content': os.getenv('INPUT_CONTENT',''),\n}\nif os.getenv('INPUT_TTL',''):\n    payload['ttl']=int(os.getenv('INPUT_TTL'))\nif os.getenv('INPUT_PROXIED','')!='':\n    payload['proxied']=os.getenv('INPUT_PROXIED').lower()=='true'\nresp=requests.put(url, headers=headers, json=payload, timeout=15)\nprint(resp.text)\nPY"
+  - id: assert
+    action: assert.json
+    on_fail: stop
+    with:
+      source_step: update_dns
+      expect_success: true
+      required_paths:
+        - "success"
@@ -0,0 +1,10 @@
+version: 1
+name: cf_status
+description: CF 模块状态检查占位 runbook（不执行外部操作）
+inputs: []
+steps:
+  - id: cf_noop
+    action: sleep
+    on_fail: stop
+    with:
+      ms: 10
@@ -0,0 +1,18 @@
+version: 1
+name: cf_workers_list
+description: 列出账户下 Workers 脚本
+steps:
+  - id: list_workers
+    action: ssh.exec
+    on_fail: stop
+    with:
+      target: hwsg
+      command: "CF_ACCOUNT_ID=${env_cf_account_id} CF_API_TOKEN=${env_cf_api_token} python3 -c \"import os,requests,json; acct=os.getenv('CF_ACCOUNT_ID',''); token=os.getenv('CF_API_TOKEN',''); headers={'Authorization':'Bearer '+token,'Content-Type':'application/json'}; url='https://api.cloudflare.com/client/v4/accounts/%s/workers/scripts'%acct; resp=requests.get(url, headers=headers, timeout=15); data=resp.json(); workers=[(w.get('id') or w.get('name')) for w in data.get('result',[])]; print(json.dumps({'workers':workers}, ensure_ascii=False))\""
+  - id: assert
+    action: assert.json
+    on_fail: stop
+    with:
+      source_step: list_workers
+      expect_success: true
+      required_paths:
+        - "success"
@@ -0,0 +1,18 @@
+version: 1
+name: cf_zones
+description: 列出 Cloudflare 账号下的 Zone
+steps:
+  - id: list_zones
+    action: ssh.exec
+    on_fail: stop
+    with:
+      target: hwsg
+      command: "CF_ACCOUNT_ID=${env_cf_account_id} CF_API_TOKEN=${env_cf_api_token} python3 -c \"import os,requests,json; acct=os.getenv('CF_ACCOUNT_ID',''); token=os.getenv('CF_API_TOKEN',''); email=os.getenv('CF_API_EMAIL',''); headers={'Authorization':'Bearer '+token,'Content-Type':'application/json'}; url='https://api.cloudflare.com/client/v4/zones'; params={'account.id':acct,'per_page':200}; resp=requests.get(url, headers=headers, params=params, timeout=15); data=resp.json(); zones=[{'name':z.get('name'), 'id':z.get('id')} for z in data.get('result',[])]; print(json.dumps({'success':data.get('success',False),'zones':zones,'errors':data.get('errors',[])}, ensure_ascii=False))\""
+  - id: assert
+    action: assert.json
+    on_fail: stop
+    with:
+      source_step: list_zones
+      expect_success: true
+      required_paths:
+        - "success"
@@ -0,0 +1,20 @@
+version: 1
+name: cpa_status
+description: 获取 CPA 服务状态与 usage 快照
+inputs: []
+steps:
+  - id: usage_snapshot
+    action: shell.exec
+    on_fail: stop
+    with:
+      command: "CPA_TOKEN=${env.cpa_management_token} CPA_BASE=https://cpa.pao.xx.kg/v0/management python3 -c 'import base64,os; code=base64.b64decode(\"Y3VybCAtc1MgLUggIkF1dGhvcml6YXRpb246IEJlYXJlciAke0NQQV9UT0tFTn0iICR7Q1BBX0JBU0V9L3VzYWdlIHwgcHl0aG9uMyAtYyAiaW1wb3J0IGpzb24sc3lzOyBkYXRhPWpzb24ubG9hZChzeXMuc3RkaW4pOyBvdXQ9eyd1c2FnZSc6IHsndG90YWxfcmVxdWVzdHMnOiBkYXRhLmdldCgndXNhZ2UnLHt9KS5nZXQoJ3RvdGFsX3JlcXVlc3RzJyksICd0b3RhbF90b2tlbnMnOiBkYXRhLmdldCgndXNhZ2UnLHt9KS5nZXQoJ3RvdGFsX3Rva2VucycpfX07IHByaW50KGpzb24uZHVtcHMob3V0LCBlbnN1cmVfYXNjaWk9RmFsc2UpKSIK\"); os.system(code.decode())'"
+
+  - id: usage_assert
+    action: assert.json
+    on_fail: stop
+    with:
+      source_step: usage_snapshot
+      expect_success: true
+      required_paths:
+        - "usage.total_requests"
+        - "usage.total_tokens"
@@ -83,6 +83,7 @@ steps:
    on_fail: stop
    with:
      source_step: verify_now
+      expect_success: true
      required_paths:
        - "usage.total_requests"
        - "usage.total_tokens"
@@ -107,6 +108,7 @@ steps:
    on_fail: stop
    with:
      source_step: verify_later
+      expect_success: true
      required_paths:
        - "usage.total_requests"
        - "usage.total_tokens"
@@ -0,0 +1,10 @@
+version: 1
+name: mail_status
+description: Mail 模块状态检查占位 runbook（不执行外部操作）
+inputs: []
+steps:
+  - id: mail_noop
+    action: sleep
+    on_fail: stop
+    with:
+      ms: 10