fix: correct workflow yaml syntax

.gitea/workflows/debug-cmd-agent.yml

@@ -0,0 +1,44 @@
+name: Debug CMD Agent
+
+on:
+  push:
+    branches:
+      - 'debug/cmd-agent'
+
+jobs:
+  debug:
+    name: Debug CMD Agent
+    runs-on: host
+    timeout-minutes: 5
+    steps:
+      - name: Diagnose
+        shell: bash
+        run: |
+          set +e
+          echo "=== 1. CMD Agent config ==="
+          cat /opt/xiaoxia-cmd-agent/config.json 2>/dev/null || cat /opt/xiaoxia-cmd-agent/config.yaml 2>/dev/null || echo "no config found"
+          ls -la /opt/xiaoxia-cmd-agent/ 2>/dev/null
+
+          echo ""
+          echo "=== 2. CMD Agent process ==="
+          ps aux | grep cmd-agent | grep -v grep
+
+          echo ""
+          echo "=== 3. Local curl test (127.0.0.1:18888) ==="
+          curl -s -X POST http://127.0.0.1:18888/cmd-agent/exec \
+            -H "Authorization: Bearer xsa-f2778a6953d59948cd1e5be4d99f60f7" \
+            -H "Content-Type: application/json" \
+            -d '{"command":"hostname"}' 2>&1 || echo "FAILED"
+
+          echo ""
+          echo "=== 4. Nginx config for cmd-agent ==="
+          grep -r "cmd-agent" /etc/nginx/sites-enabled/ 2>/dev/null || \
+          grep -r "cmd-agent" /etc/nginx/conf.d/ 2>/dev/null || \
+          echo "no nginx cmd-agent config found"
+
+          echo ""
+          echo "=== 5. Nginx access log (last 5 lines) ==="
+          tail -5 /var/log/nginx/access.log 2>/dev/null | grep cmd || echo "no log"
+
+          echo ""
+          echo "=== DONE ==="

.gitea/workflows/fix-cmd-agent-auth.yml

@@ -0,0 +1,46 @@
+name: Fix CMD Agent Auth
+
+on:
+  push:
+    branches:
+      - 'debug/cmd-agent'
+
+jobs:
+  fix:
+    runs-on: host
+    steps:
+      - name: 验证不带Bearer
+        run: |
+          curl -s -w "\nHTTP_CODE:%{http_code}" http://127.0.0.1:18888/status -H "Authorization: xsa-f2778a6953d59948cd1e5be4d99f60f7"
+      - name: 验证带Bearer（应该失败）
+        run: |
+          curl -s -w "\nHTTP_CODE:%{http_code}" http://127.0.0.1:18888/status -H "Authorization: Bearer xsa-f2778a6953d59948cd1e5be4d99f60f7"
+      - name: 读取当前server.py的check_auth
+        run: |
+          grep -A 5 "def check_auth" /opt/xiaoxia-cmd-agent/server.py
+      - name: 修复check_auth函数
+        run: |
+          cp /opt/xiaoxia-cmd-agent/server.py /opt/xiaoxia-cmd-agent/server.py.bak
+          sed -i '/def check_auth/,/return True/{
+            /def check_auth/a\        t = self.headers.get("Authorization", "")
+            /if t != AUTH_TOKEN/i\        if t.startswith("Bearer "):\n            t = t[7:]
+          }' /opt/xiaoxia-cmd-agent/server.py
+          echo "Done via sed"
+      - name: 验证修复后的check_auth
+        run: |
+          grep -A 8 "def check_auth" /opt/xiaoxia-cmd-agent/server.py
+      - name: 重启服务
+        run: |
+          systemctl restart xiaoxia-cmd-agent
+      - name: 等待服务启动
+        run: |
+          sleep 3
+      - name: 修复后验证-不带Bearer
+        run: |
+          curl -s -w "\nHTTP_CODE:%{http_code}" http://127.0.0.1:18888/status -H "Authorization: xsa-f2778a6953d59948cd1e5be4d99f60f7"
+      - name: 修复后验证-带Bearer
+        run: |
+          curl -s -w "\nHTTP_CODE:%{http_code}" http://127.0.0.1:18888/status -H "Authorization: Bearer xsa-f2778a6953d59948cd1e5be4d99f60f7"
+      - name: 公网路径验证
+        run: |
+          curl -sk -w "\nHTTP_CODE:%{http_code}" https://127.0.0.1/cmd-agent/status -H "Authorization: Bearer xsa-f2778a6953d59948cd1e5be4d99f60f7"

.gitea/workflows/read-auth.yml

@@ -0,0 +1,38 @@
+name: Read Auth Logic
+
+on:
+  push:
+    branches:
+      - 'debug/cmd-agent'
+
+jobs:
+  read:
+    name: Read check_auth logic
+    runs-on: host
+    timeout-minutes: 3
+    steps:
+      - name: Read
+        shell: bash
+        run: |
+          echo "=== Full server.py (lines 1-50) ==="
+          sed -n '1,50p' /opt/xiaoxia-cmd-agent/server.py
+          echo ""
+          echo "=== Lines 120-160 (startup logic) ==="
+          sed -n '120,160p' /opt/xiaoxia-cmd-agent/server.py
+          echo ""
+          echo "=== Test with X-Token header ==="
+          curl -s -X POST http://127.0.0.1:18888/cmd-agent/exec \
+            -H "X-Token: $(cat /etc/xiaoxia-cmd-agent.token)" \
+            -H "Content-Type: application/json" \
+            -d '{"command":"hostname"}'
+          echo ""
+          echo "=== Test with token in query string ==="
+          curl -s -X POST "http://127.0.0.1:18888/cmd-agent/exec?token=$(cat /etc/xiaoxia-cmd-agent.token)" \
+            -H "Content-Type: application/json" \
+            -d '{"command":"hostname"}'
+          echo ""
+          echo "=== Check if path is /exec not /cmd-agent/exec ==="
+          curl -s -X POST http://127.0.0.1:18888/exec \
+            -H "Authorization: Bearer $(cat /etc/xiaoxia-cmd-agent.token)" \
+            -H "Content-Type: application/json" \
+            -d '{"command":"hostname"}'

.gitea/workflows/read-cmd-agent.yml

@@ -0,0 +1,27 @@
+name: Read CMD Agent Source
+
+on:
+  push:
+    branches:
+      - 'debug/cmd-agent'
+
+jobs:
+  read:
+    name: Read CMD Agent server.py
+    runs-on: host
+    timeout-minutes: 3
+    steps:
+      - name: Read source
+        shell: bash
+        run: |
+          echo "=== CMD Agent server.py (first 80 lines) ==="
+          head -80 /opt/xiaoxia-cmd-agent/server.py
+          echo ""
+          echo "=== Token-related lines ==="
+          grep -n -i "token\|auth\|secret\|key" /opt/xiaoxia-cmd-agent/server.py
+          echo ""
+          echo "=== Systemd service config ==="
+          cat /etc/systemd/system/xiaoxia-cmd-agent.service 2>/dev/null || echo "no systemd service"
+          echo ""
+          echo "=== Environment variables from process ==="
+          cat /proc/1034/environ 2>/dev/null | tr '\0' '\n' | grep -i "token\|auth\|secret\|key" || echo "no env vars found"

.gitea/workflows/read-token.yml

@@ -0,0 +1,30 @@
+name: Read CMD Agent Token
+
+on:
+  push:
+    branches:
+      - 'debug/cmd-agent'
+
+jobs:
+  read:
+    name: Read Real Token
+    runs-on: host
+    timeout-minutes: 3
+    steps:
+      - name: Read
+        shell: bash
+        run: |
+          echo "=== Real CMD Agent Token ==="
+          cat /etc/xiaoxia-cmd-agent.token
+          echo ""
+          echo "=== Test with real token ==="
+          curl -s -X POST http://127.0.0.1:18888/cmd-agent/exec \
+            -H "Authorization: Bearer $(cat /etc/xiaoxia-cmd-agent.token)" \
+            -H "Content-Type: application/json" \
+            -d '{"command":"hostname && whoami"}'
+          echo ""
+          echo "=== Nginx config for cmd-agent (full) ==="
+          sed -n '/cmd-agent/,/}/p' /etc/nginx/sites-enabled/00-xiaoxia-saas | head -20
+          echo ""
+          echo "=== All listening ports ==="
+          ss -tlnp | head -20