fix: correct workflow yaml syntax

.gitea/workflows/debug-cmd-agent.yml

@@ -0,0 +1,44 @@
+name: Debug CMD Agent
+
+on:
+  push:
+    branches:
+      - 'debug/cmd-agent'
+
+jobs:
+  debug:
+    name: Debug CMD Agent
+    runs-on: host
+    timeout-minutes: 5
+    steps:
+      - name: Diagnose
+        shell: bash
+        run: |
+          set +e
+          echo "=== 1. CMD Agent config ==="
+          cat /opt/xiaoxia-cmd-agent/config.json 2>/dev/null || cat /opt/xiaoxia-cmd-agent/config.yaml 2>/dev/null || echo "no config found"
+          ls -la /opt/xiaoxia-cmd-agent/ 2>/dev/null
+
+          echo ""
+          echo "=== 2. CMD Agent process ==="
+          ps aux | grep cmd-agent | grep -v grep
+
+          echo ""
+          echo "=== 3. Local curl test (127.0.0.1:18888) ==="
+          curl -s -X POST http://127.0.0.1:18888/cmd-agent/exec \
+            -H "Authorization: Bearer xsa-f2778a6953d59948cd1e5be4d99f60f7" \
+            -H "Content-Type: application/json" \
+            -d '{"command":"hostname"}' 2>&1 || echo "FAILED"
+
+          echo ""
+          echo "=== 4. Nginx config for cmd-agent ==="
+          grep -r "cmd-agent" /etc/nginx/sites-enabled/ 2>/dev/null || \
+          grep -r "cmd-agent" /etc/nginx/conf.d/ 2>/dev/null || \
+          echo "no nginx cmd-agent config found"
+
+          echo ""
+          echo "=== 5. Nginx access log (last 5 lines) ==="
+          tail -5 /var/log/nginx/access.log 2>/dev/null | grep cmd || echo "no log"
+
+          echo ""
+          echo "=== DONE ==="

.gitea/workflows/fix-cmd-agent-auth.yml

@@ -0,0 +1,46 @@
+name: Fix CMD Agent Auth
+
+on:
+  push:
+    branches:
+      - 'debug/cmd-agent'
+
+jobs:
+  fix:
+    runs-on: host
+    steps:
+      - name: 验证不带Bearer
+        run: |
+          curl -s -w "\nHTTP_CODE:%{http_code}" http://127.0.0.1:18888/status -H "Authorization: xsa-f2778a6953d59948cd1e5be4d99f60f7"
+      - name: 验证带Bearer（应该失败）
+        run: |
+          curl -s -w "\nHTTP_CODE:%{http_code}" http://127.0.0.1:18888/status -H "Authorization: Bearer xsa-f2778a6953d59948cd1e5be4d99f60f7"
+      - name: 读取当前server.py的check_auth
+        run: |
+          grep -A 5 "def check_auth" /opt/xiaoxia-cmd-agent/server.py
+      - name: 修复check_auth函数
+        run: |
+          cp /opt/xiaoxia-cmd-agent/server.py /opt/xiaoxia-cmd-agent/server.py.bak
+          sed -i '/def check_auth/,/return True/{
+            /def check_auth/a\        t = self.headers.get("Authorization", "")
+            /if t != AUTH_TOKEN/i\        if t.startswith("Bearer "):\n            t = t[7:]
+          }' /opt/xiaoxia-cmd-agent/server.py
+          echo "Done via sed"
+      - name: 验证修复后的check_auth
+        run: |
+          grep -A 8 "def check_auth" /opt/xiaoxia-cmd-agent/server.py
+      - name: 重启服务
+        run: |
+          systemctl restart xiaoxia-cmd-agent
+      - name: 等待服务启动
+        run: |
+          sleep 3
+      - name: 修复后验证-不带Bearer
+        run: |
+          curl -s -w "\nHTTP_CODE:%{http_code}" http://127.0.0.1:18888/status -H "Authorization: xsa-f2778a6953d59948cd1e5be4d99f60f7"
+      - name: 修复后验证-带Bearer
+        run: |
+          curl -s -w "\nHTTP_CODE:%{http_code}" http://127.0.0.1:18888/status -H "Authorization: Bearer xsa-f2778a6953d59948cd1e5be4d99f60f7"
+      - name: 公网路径验证
+        run: |
+          curl -sk -w "\nHTTP_CODE:%{http_code}" https://127.0.0.1/cmd-agent/status -H "Authorization: Bearer xsa-f2778a6953d59948cd1e5be4d99f60f7"

.gitea/workflows/read-auth.yml

@@ -0,0 +1,38 @@
+name: Read Auth Logic
+
+on:
+  push:
+    branches:
+      - 'debug/cmd-agent'
+
+jobs:
+  read:
+    name: Read check_auth logic
+    runs-on: host
+    timeout-minutes: 3
+    steps:
+      - name: Read
+        shell: bash
+        run: |
+          echo "=== Full server.py (lines 1-50) ==="
+          sed -n '1,50p' /opt/xiaoxia-cmd-agent/server.py
+          echo ""
+          echo "=== Lines 120-160 (startup logic) ==="
+          sed -n '120,160p' /opt/xiaoxia-cmd-agent/server.py
+          echo ""
+          echo "=== Test with X-Token header ==="
+          curl -s -X POST http://127.0.0.1:18888/cmd-agent/exec \
+            -H "X-Token: $(cat /etc/xiaoxia-cmd-agent.token)" \
+            -H "Content-Type: application/json" \
+            -d '{"command":"hostname"}'
+          echo ""
+          echo "=== Test with token in query string ==="
+          curl -s -X POST "http://127.0.0.1:18888/cmd-agent/exec?token=$(cat /etc/xiaoxia-cmd-agent.token)" \
+            -H "Content-Type: application/json" \
+            -d '{"command":"hostname"}'
+          echo ""
+          echo "=== Check if path is /exec not /cmd-agent/exec ==="
+          curl -s -X POST http://127.0.0.1:18888/exec \
+            -H "Authorization: Bearer $(cat /etc/xiaoxia-cmd-agent.token)" \
+            -H "Content-Type: application/json" \
+            -d '{"command":"hostname"}'

.gitea/workflows/read-cmd-agent.yml

@@ -0,0 +1,27 @@
+name: Read CMD Agent Source
+
+on:
+  push:
+    branches:
+      - 'debug/cmd-agent'
+
+jobs:
+  read:
+    name: Read CMD Agent server.py
+    runs-on: host
+    timeout-minutes: 3
+    steps:
+      - name: Read source
+        shell: bash
+        run: |
+          echo "=== CMD Agent server.py (first 80 lines) ==="
+          head -80 /opt/xiaoxia-cmd-agent/server.py
+          echo ""
+          echo "=== Token-related lines ==="
+          grep -n -i "token\|auth\|secret\|key" /opt/xiaoxia-cmd-agent/server.py
+          echo ""
+          echo "=== Systemd service config ==="
+          cat /etc/systemd/system/xiaoxia-cmd-agent.service 2>/dev/null || echo "no systemd service"
+          echo ""
+          echo "=== Environment variables from process ==="
+          cat /proc/1034/environ 2>/dev/null | tr '\0' '\n' | grep -i "token\|auth\|secret\|key" || echo "no env vars found"

.gitea/workflows/read-token.yml

@@ -0,0 +1,30 @@
+name: Read CMD Agent Token
+
+on:
+  push:
+    branches:
+      - 'debug/cmd-agent'
+
+jobs:
+  read:
+    name: Read Real Token
+    runs-on: host
+    timeout-minutes: 3
+    steps:
+      - name: Read
+        shell: bash
+        run: |
+          echo "=== Real CMD Agent Token ==="
+          cat /etc/xiaoxia-cmd-agent.token
+          echo ""
+          echo "=== Test with real token ==="
+          curl -s -X POST http://127.0.0.1:18888/cmd-agent/exec \
+            -H "Authorization: Bearer $(cat /etc/xiaoxia-cmd-agent.token)" \
+            -H "Content-Type: application/json" \
+            -d '{"command":"hostname && whoami"}'
+          echo ""
+          echo "=== Nginx config for cmd-agent (full) ==="
+          sed -n '/cmd-agent/,/}/p' /etc/nginx/sites-enabled/00-xiaoxia-saas | head -20
+          echo ""
+          echo "=== All listening ports ==="
+          ss -tlnp | head -20

.gitea/workflows/temp-runner-expand.yml

@@ -1,164 +0,0 @@
-name: Runner Expand
-on: push
-
-jobs:
-  expand:
-    runs-on: host
-    steps:
-      - name: Expand to 3 runner instances
-        run: |
-          set +e
-          
-          echo "========== Step 1: 检查当前runner =========="
-          echo "当前进程数: $(ps aux | grep 'act_runner daemon' | grep -v grep | wc -l)"
-          
-          echo ""
-          echo "========== Step 2: 创建 runner-2 =========="
-          if [ -f /var/lib/xiaoxia-ci-runner-2/.runner ]; then
-            echo "runner-2 已注册，跳过"
-          else
-            mkdir -p /var/lib/xiaoxia-ci-runner-2
-            cp /var/lib/xiaoxia-ci/act_runner /var/lib/xiaoxia-ci-runner-2/act_runner
-            chmod +x /var/lib/xiaoxia-ci-runner-2/act_runner
-            
-            cat > /var/lib/xiaoxia-ci-runner-2/.runner-config.yaml << 'CFG'
-log:
-  level: info
-runner:
-  file: .runner
-  capacity: 1
-  timeout: 3h
-  insecure: false
-  fetch_timeout: 5s
-  fetch_interval: 2s
-  labels:
-    - runtime-builder
-    - ubuntu-latest
-    - host
-cache:
-  enabled: true
-  dir: /var/lib/xiaoxia-ci-runner-2/cache
-host:
-  workdir_parent: /var/lib/xiaoxia-ci-runner-2/workspace
-container:
-  network: host
-CFG
-            
-            REG_TOKEN=$(python3 -c "import json; print(json.load(open('/var/lib/xiaoxia-ci/.runner'))['token'])" 2>/dev/null)
-            REG_ADDR=$(python3 -c "import json; print(json.load(open('/var/lib/xiaoxia-ci/.runner'))['address'])" 2>/dev/null)
-            echo "使用注册地址: $REG_ADDR"
-            
-            cd /var/lib/xiaoxia-ci-runner-2
-            ./act_runner register \
-              --instance "$REG_ADDR" \
-              --token "$REG_TOKEN" \
-              --name "xiaoxia-ci-runner-2" \
-              --labels "runtime-builder:host,ubuntu-latest:host,host:host" \
-              --no-interactive 2>&1
-            echo "runner-2 注册结果: $?"
-          fi
-          
-          echo ""
-          echo "========== Step 3: 创建 runner-3 =========="
-          if [ -f /var/lib/xiaoxia-ci-runner-3/.runner ]; then
-            echo "runner-3 已注册，跳过"
-          else
-            mkdir -p /var/lib/xiaoxia-ci-runner-3
-            cp /var/lib/xiaoxia-ci/act_runner /var/lib/xiaoxia-ci-runner-3/act_runner
-            chmod +x /var/lib/xiaoxia-ci-runner-3/act_runner
-            
-            cat > /var/lib/xiaoxia-ci-runner-3/.runner-config.yaml << 'CFG'
-log:
-  level: info
-runner:
-  file: .runner
-  capacity: 1
-  timeout: 3h
-  insecure: false
-  fetch_timeout: 5s
-  fetch_interval: 2s
-  labels:
-    - runtime-builder
-    - ubuntu-latest
-    - host
-cache:
-  enabled: true
-  dir: /var/lib/xiaoxia-ci-runner-3/cache
-host:
-  workdir_parent: /var/lib/xiaoxia-ci-runner-3/workspace
-container:
-  network: host
-CFG
-            
-            REG_TOKEN=$(python3 -c "import json; print(json.load(open('/var/lib/xiaoxia-ci/.runner'))['token'])" 2>/dev/null)
-            REG_ADDR=$(python3 -c "import json; print(json.load(open('/var/lib/xiaoxia-ci/.runner'))['address'])" 2>/dev/null)
-            
-            cd /var/lib/xiaoxia-ci-runner-3
-            ./act_runner register \
-              --instance "$REG_ADDR" \
-              --token "$REG_TOKEN" \
-              --name "xiaoxia-ci-runner-3" \
-              --labels "runtime-builder:host,ubuntu-latest:host,host:host" \
-              --no-interactive 2>&1
-            echo "runner-3 注册结果: $?"
-          fi
-          
-          echo ""
-          echo "========== Step 4: systemd 服务 =========="
-          cat > /etc/systemd/system/act_runner-2.service << 'SVC'
-[Unit]
-Description=Gitea Actions Runner 2
-After=gitea.service network.target
-[Service]
-Type=simple
-WorkingDirectory=/var/lib/xiaoxia-ci-runner-2
-ExecStart=/var/lib/xiaoxia-ci-runner-2/act_runner daemon --config .runner-config.yaml
-Restart=always
-RestartSec=5s
-User=root
-[Install]
-WantedBy=multi-user.target
-SVC
-          
-          cat > /etc/systemd/system/act_runner-3.service << 'SVC'
-[Unit]
-Description=Gitea Actions Runner 3
-After=gitea.service network.target
-[Service]
-Type=simple
-WorkingDirectory=/var/lib/xiaoxia-ci-runner-3
-ExecStart=/var/lib/xiaoxia-ci-runner-3/act_runner daemon --config .runner-config.yaml
-Restart=always
-RestartSec=5s
-User=root
-[Install]
-WantedBy=multi-user.target
-SVC
-          
-          systemctl daemon-reload
-          systemctl enable act_runner-2.service act_runner-3.service 2>&1
-          systemctl start act_runner-2.service 2>&1
-          systemctl start act_runner-3.service 2>&1
-          sleep 8
-          
-          echo ""
-          echo "========== Step 5: 验证 =========="
-          COUNT=$(ps aux | grep 'act_runner daemon' | grep -v grep | wc -l)
-          echo "runner进程数: $COUNT"
-          ps aux | grep 'act_runner daemon' | grep -v grep
-          echo ""
-          echo "服务状态:"
-          systemctl is-active act_runner.service act_runner-2.service act_runner-3.service 2>&1
-          echo ""
-          echo "注册信息:"
-          for d in /var/lib/xiaoxia-ci /var/lib/xiaoxia-ci-runner-2 /var/lib/xiaoxia-ci-runner-3; do
-            if [ -f "$d/.runner" ]; then
-              python3 -c "
-import json
-d = json.load(open('$d/.runner'))
-print(f'  {d[\"name\"]}: id={d[\"id\"]}')
-" 2>/dev/null
-            fi
-          done
-          echo ""
-          echo "========== DONE =========="