init: sxbh.ltd 官网初始提交

- nginx 安全加固 (CSP, HSTS, 缓存策略)
- 共享 style.css
- 138个页面全部接入

Co-authored-by: Hermes AI <agent@hermes>
This commit is contained in:
Hermes CI Fix
2026-07-11 17:29:24 +08:00
co-authored by Hermes AI
commit e1a9b25afa
177 changed files with 21447 additions and 0 deletions
+518
View File
@@ -0,0 +1,518 @@
<!DOCTYPE html>
<html lang="zh-CN">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>博海科技 Bot 行为手册</title>
<style>
* { margin: 0; padding: 0; box-sizing: border-box; }
body {
font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", "PingFang SC", "Microsoft YaHei", sans-serif;
line-height: 1.8;
color: #1a1a2e;
background: #f5f6fa;
padding: 20px;
}
.container {
max-width: 900px;
margin: 0 auto;
background: #fff;
border-radius: 12px;
box-shadow: 0 2px 20px rgba(0,0,0,0.08);
padding: 40px 50px;
}
h1 {
font-size: 28px;
color: #1a1a2e;
border-bottom: 3px solid #4361ee;
padding-bottom: 12px;
margin-bottom: 8px;
}
.version {
color: #888;
font-size: 14px;
margin-bottom: 30px;
}
h2 {
font-size: 22px;
color: #4361ee;
margin-top: 40px;
margin-bottom: 15px;
padding-left: 12px;
border-left: 4px solid #4361ee;
}
h3 {
font-size: 18px;
color: #3a0ca3;
margin-top: 25px;
margin-bottom: 10px;
}
p { margin-bottom: 12px; }
ul, ol { margin: 10px 0 10px 25px; }
li { margin-bottom: 6px; }
table {
width: 100%;
border-collapse: collapse;
margin: 15px 0;
font-size: 14px;
}
th, td {
border: 1px solid #e0e0e0;
padding: 10px 14px;
text-align: left;
}
th {
background: #4361ee;
color: white;
font-weight: 600;
}
tr:nth-child(even) { background: #f8f9ff; }
code {
background: #f0f0f5;
padding: 2px 8px;
border-radius: 4px;
font-family: "SF Mono", "Fira Code", "Consolas", monospace;
font-size: 13px;
color: #e63946;
}
pre {
background: #1e1e2e;
color: #cdd6f4;
padding: 16px 20px;
border-radius: 8px;
overflow-x: auto;
font-size: 13px;
line-height: 1.6;
margin: 15px 0;
}
pre code {
background: none;
color: inherit;
padding: 0;
font-size: inherit;
}
blockquote {
border-left: 4px solid #e63946;
background: #fff5f5;
padding: 12px 18px;
margin: 15px 0;
border-radius: 0 8px 8px 0;
color: #c62828;
font-weight: 600;
}
hr {
border: none;
border-top: 1px solid #e0e0e0;
margin: 30px 0;
}
.toc {
background: #f8f9ff;
border: 1px solid #e0e0e0;
border-radius: 8px;
padding: 20px 25px;
margin: 20px 0;
}
.toc h3 { margin-top: 0; border: none; padding: 0; color: #1a1a2e; }
.toc a {
color: #4361ee;
text-decoration: none;
}
.toc a:hover { text-decoration: underline; }
.footer {
text-align: center;
color: #888;
font-size: 13px;
margin-top: 40px;
padding-top: 20px;
border-top: 1px solid #e0e0e0;
}
@media (max-width: 640px) {
.container { padding: 20px; }
pre { font-size: 12px; padding: 12px; }
}
</style>
<link rel="stylesheet" href="/style.css">
</head>
<body>
<div class="container">
<h1>博海科技 Bot 行为手册 (Bot Behavior Manual)</h1>
<blockquote>
<p><strong>版本</strong>: v1.0 | <strong>更新</strong>: 2026-07-08
<strong>适用范围</strong>: 全Profile(运维/财务/项目/品宣/研学/行政/商务/其他)
<strong>存放位置</strong>: <code>/root/.hermes/BOT_BEHAVIOR_MANUAL.md</code></p>
</blockquote>
<hr />
<h2>目录</h2>
<ol>
<li><a href="#1-文件写入规范">文件写入规范</a></li>
<li><a href="#2-安全红线">安全红线</a></li>
<li><a href="#3-跨bot协作规则">跨Bot协作规则</a></li>
<li><a href="#4-定时任务管理">定时任务管理</a></li>
<li><a href="#5-通知规范">通知规范</a></li>
<li><a href="#6-运维工具标准">运维工具标准</a></li>
<li><a href="#7-raci权责边界">RACI权责边界</a></li>
<li><a href="#8-附录快速参考卡">附录:快速参考卡</a></li>
</ol>
<hr />
<h2>1. 文件写入规范</h2>
<h3>1.1 生产目录文件写入铁律</h3>
<p><strong>所有写入 <code>/var/www/html/</code> 生产目录的文件,一律使用 base64 方式,不走 <code>write_file</code> 工具。</strong></p>
<p><code>write_file</code> 对相对路径的解析存在不可靠性,可能写入到非预期位置(如 <code>/root/</code> 下)但返回成功状态码。</p>
<p><strong>标准流程:</strong></p>
<div class="codehilite"><pre><span></span><code><span class="c1"># ① base64 编码内容</span>
<span class="nv">base64_content</span><span class="o">=</span><span class="k">$(</span><span class="nb">echo</span><span class="w"> </span>-n<span class="w"> </span><span class="s2">&quot;文件内容&quot;</span><span class="w"> </span><span class="p">|</span><span class="w"> </span>base64<span class="w"> </span>-w<span class="w"> </span><span class="m">0</span><span class="k">)</span>
<span class="c1"># ② 写入绝对路径</span>
<span class="nb">echo</span><span class="w"> </span><span class="s2">&quot;</span><span class="nv">$base64_content</span><span class="s2">&quot;</span><span class="w"> </span><span class="p">|</span><span class="w"> </span>base64<span class="w"> </span>-d<span class="w"> </span>&gt;<span class="w"> </span>/var/www/html/products/目标文件.html
<span class="c1"># ③ 验证文件大小</span>
wc<span class="w"> </span>-c<span class="w"> </span>/var/www/html/products/目标文件.html
<span class="c1"># ④ 验证页面可访问</span>
curl<span class="w"> </span>-sL<span class="w"> </span>-o<span class="w"> </span>/dev/null<span class="w"> </span>-w<span class="w"> </span><span class="s2">&quot;%{http_code} %{size_download}&quot;</span><span class="w"> </span>https://sxbh.ltd/products/目标文件.html
</code></pre></div>
<p>如果验证结果与预期不符(文件大小偏小或 HTTP 非 200),立即重新写入。</p>
<hr />
<h2>2. 安全红线</h2>
<h3>2.1 安装安全评估</h3>
<p><strong>安装任何新软件/包之前,必须先做安全评估。</strong></p>
<p>检查维度:
- 来源可信度(官方源 vs 第三方 PPA)
- 权限要求(是否需要 root
- 网络行为(是否会外连)
- 社区评价(GitHub stars、维护状态)</p>
<h3>2.2 高危命令安全熔断</h3>
<p><strong>执行高危命令前先调用 <code>approval-gate</code></strong></p>
<div class="codehilite"><pre><span></span><code><span class="c1"># Step 1: Dry-Run 安全预览</span>
approval-gate<span class="w"> </span>dry-run<span class="w"> </span><span class="s2">&quot;&lt;命令&gt;&quot;</span>
<span class="c1"># → READY / WARNING / BLOCKED</span>
<span class="c1"># Step 2: 高风险命令熔断</span>
approval-gate<span class="w"> </span>check<span class="w"> </span><span class="s2">&quot;&lt;命令&gt;&quot;</span>
<span class="c1"># → LOW/MEDIUM 自动放行</span>
<span class="c1"># → HIGH/CRITICAL 拦截,等人工确认</span>
</code></pre></div>
<hr />
<h2>3. 跨Bot协作规则</h2>
<h3>3.1 多 Agent 协作七大铁律</h3>
<table>
<thead>
<tr>
<th style="text-align: center;">#</th>
<th style="text-align: left;">铁律</th>
<th style="text-align: left;">说明</th>
</tr>
</thead>
<tbody>
<tr>
<td style="text-align: center;">1</td>
<td style="text-align: left;"><strong>唯一执行人</strong></td>
<td style="text-align: left;">一个任务只由一个 agent 执行,有人认领不得并行</td>
</tr>
<tr>
<td style="text-align: center;">2</td>
<td style="text-align: left;"><strong>先确认再落笔</strong></td>
<td style="text-align: left;">动工前先在群聊确认方案</td>
</tr>
<tr>
<td style="text-align: center;">3</td>
<td style="text-align: left;"><strong>写后必验证</strong></td>
<td style="text-align: left;">改完立即验证语法/功能</td>
</tr>
<tr>
<td style="text-align: center;">4</td>
<td style="text-align: left;"><strong>进度汇总归研学</strong></td>
<td style="text-align: left;">老板问全局进度时等研学汇总</td>
</tr>
<tr>
<td style="text-align: center;">5</td>
<td style="text-align: left;"><strong>文件写前占位</strong></td>
<td style="text-align: left;">先喊 <code>我要改 xxx</code>,改完喊 <code>已释放 xxx</code></td>
</tr>
<tr>
<td style="text-align: center;">6</td>
<td style="text-align: left;"><strong>bus/send 不送达 Bot</strong></td>
<td style="text-align: left;">广播只到用户,不到 Bot 自己</td>
</tr>
<tr>
<td style="text-align: center;">7</td>
<td style="text-align: left;"><strong>定时任务新增前避让</strong></td>
<td style="text-align: left;">见第4节</td>
</tr>
</tbody>
</table>
<h3>3.2 跨Bot调度规范</h3>
<p><strong>发现问题时直接通过 system-bus 调度对方 Bot 修复,不只报告问题。</strong></p>
<div class="codehilite"><pre><span></span><code>curl<span class="w"> </span>-s<span class="w"> </span>-X<span class="w"> </span>POST<span class="w"> </span>http://127.0.0.1:8660/bus/send<span class="w"> </span><span class="se">\</span>
<span class="w"> </span>-H<span class="w"> </span><span class="s1">&#39;X-API-Key: system-bus-relay-key-2026&#39;</span><span class="w"> </span><span class="se">\</span>
<span class="w"> </span>-d<span class="w"> </span><span class="s1">&#39;{&quot;touser&quot;:&quot;200653946&quot;,&quot;agentid&quot;:&lt;AGENT_ID&gt;,&quot;msgtype&quot;:&quot;markdown&quot;,&quot;content&quot;:&quot;...&quot;}&#39;</span>
</code></pre></div>
<p><strong>注意</strong><code>bus/send</code> 只发消息给<strong>用户</strong>,不发消息给 <strong>Bot 自己</strong>。要让另一个 Bot 执行任务,需要用对方的 API Server 或直接编辑其文件后重启网关。</p>
<p>各Bot Agent ID</p>
<table>
<thead>
<tr>
<th style="text-align: left;">Bot</th>
<th style="text-align: center;">Agent ID</th>
<th style="text-align: center;">API Server</th>
<th style="text-align: center;">端口</th>
</tr>
</thead>
<tbody>
<tr>
<td style="text-align: left;">财务</td>
<td style="text-align: center;">1000040</td>
<td style="text-align: center;">❌ 关闭</td>
<td style="text-align: center;">8651</td>
</tr>
<tr>
<td style="text-align: left;">项目</td>
<td style="text-align: center;">1000039</td>
<td style="text-align: center;">❌ 关闭</td>
<td style="text-align: center;">8650</td>
</tr>
<tr>
<td style="text-align: left;">品宣</td>
<td style="text-align: center;">1000037</td>
<td style="text-align: center;">❌ 关闭</td>
<td style="text-align: center;">8642</td>
</tr>
<tr>
<td style="text-align: left;">行政</td>
<td style="text-align: center;">1000020</td>
<td style="text-align: center;">❌ 关闭</td>
<td style="text-align: center;">8646</td>
</tr>
<tr>
<td style="text-align: left;">研学</td>
<td style="text-align: center;">1000032</td>
<td style="text-align: center;">❌ 关闭(未认证)</td>
<td style="text-align: center;">8652</td>
</tr>
<tr>
<td style="text-align: left;">商务</td>
<td style="text-align: center;">1000043</td>
<td style="text-align: center;">❌ 关闭</td>
<td style="text-align: center;">8647</td>
</tr>
<tr>
<td style="text-align: left;">运维</td>
<td style="text-align: center;"></td>
<td style="text-align: center;">✅ 开启</td>
<td style="text-align: center;">8649</td>
</tr>
<tr>
<td style="text-align: left;">老板</td>
<td style="text-align: center;">1000041</td>
<td style="text-align: center;">❌ 未配置</td>
<td style="text-align: center;">8648</td>
</tr>
</tbody>
</table>
<h3>3.3 清理前交叉验证</h3>
<p><strong>清理 <code>/root/</code> 下的项目代码前,必须先做部署交叉验证。</strong></p>
<p>三步法:
1. 收集部署链路信息(Docker / Nginx / 进程)
2. 收集 /root 项目信息
3. 交叉对照:有 Nginx 域名 + 进程 cwd 指向 /root → <strong>不可删</strong></p>
<hr />
<h2>4. 定时任务管理</h2>
<h3>4.1 铁律</h3>
<p><strong>所有 Profile 新增定时任务前,必须先跑预检定时任务脚本,避开已有时间段。</strong></p>
<p>无法避开时(如业务必须特定时间),必须通过运维BOT告知管理者(任富海)。</p>
<h3>4.2 预检命令</h3>
<div class="codehilite"><pre><span></span><code>python3<span class="w"> </span>/root/.hermes/profiles/wecom-ops/scripts/check-cron-conflict.py<span class="w"> </span><span class="s2">&quot;分 时&quot;</span><span class="w"> </span><span class="s2">&quot;任务名&quot;</span>
<span class="c1"># 示例</span>
python3<span class="w"> </span>check-cron-conflict.py<span class="w"> </span><span class="s2">&quot;30 14&quot;</span><span class="w"> </span><span class="s2">&quot;数据同步&quot;</span>
<span class="c1"># → ✅ 空闲 或 ⚠️ 列出冲突任务</span>
</code></pre></div>
<h3>4.3 已占用时间段参考表</h3>
<p>完整排布表:<code>/root/.hermes/profiles/wecom-ops/scripts/CRON_SCHEDULE.md</code></p>
<p><strong>禁止扎堆时段</strong>: 08:00~09:30(已排 17 个任务)</p>
<h3>4.4 避让优先级</h3>
<table>
<thead>
<tr>
<th style="text-align: center;">优先级</th>
<th style="text-align: left;">规则</th>
</tr>
</thead>
<tbody>
<tr>
<td style="text-align: center;">🥇</td>
<td style="text-align: left;">选完全空闲的时段</td>
</tr>
<tr>
<td style="text-align: center;">🥈</td>
<td style="text-align: left;">与同Profile任务间隔 ≥ 15分钟</td>
</tr>
<tr>
<td style="text-align: center;">🥉</td>
<td style="text-align: left;">跨Profile任务可适当靠近</td>
</tr>
</tbody>
</table>
<hr />
<h2>5. 通知规范</h2>
<h3>5.1 发消息到公司全员群</h3>
<div class="codehilite"><pre><span></span><code>curl<span class="w"> </span>-s<span class="w"> </span>http://127.0.0.1:8800/send<span class="w"> </span>-d<span class="w"> </span><span class="s1">&#39;msg=消息内容&amp;source=Bot名称&#39;</span>
</code></pre></div>
<h3>5.2 开会角色</h3>
<table>
<thead>
<tr>
<th style="text-align: left;">Bot</th>
<th style="text-align: left;">视角</th>
</tr>
</thead>
<tbody>
<tr>
<td style="text-align: left;"><strong>运维</strong></td>
<td style="text-align: left;">技术可行性:服务器撑不撑得住、安全风险、技术资源</td>
</tr>
<tr>
<td style="text-align: left;"><strong>财务</strong></td>
<td style="text-align: left;">财务影响:投入多少、多久回本、现金流压力</td>
</tr>
<tr>
<td style="text-align: left;"><strong>项目</strong></td>
<td style="text-align: left;">项目管理:时间进度、代码质量、CI/CD</td>
</tr>
<tr>
<td style="text-align: left;"><strong>商务</strong></td>
<td style="text-align: left;">商务条款:合同、供应商、商务风险</td>
</tr>
<tr>
<td style="text-align: left;"><strong>品宣</strong></td>
<td style="text-align: left;">内容/设计:品牌形象、用户体验</td>
</tr>
<tr>
<td style="text-align: left;"><strong>行政</strong></td>
<td style="text-align: left;">行政流程:流程合规、资源协调</td>
</tr>
<tr>
<td style="text-align: left;"><strong>研学</strong></td>
<td style="text-align: left;">技术调度:方案评估、跨Profile协调、研究</td>
</tr>
</tbody>
</table>
<hr />
<h2>6. 运维工具标准</h2>
<p>所有 Shell/Python 运维脚本遵循 <strong>四层契约</strong></p>
<div class="codehilite"><pre><span></span><code><span class="c1"># 输入层:命令行参数 / 环境变量 / 配置文件</span>
<span class="c1"># 输出层:stdout 结构化输出</span>
<span class="c1"># 错误层:stderr 退出码 + 错误信息</span>
<span class="c1"># 元数据层:版本号、运行时间、调用方</span>
</code></pre></div>
<p>详见:<code>ops-tool-standard</code> skill</p>
<hr />
<h2>7. RACI 权责边界</h2>
<table>
<thead>
<tr>
<th style="text-align: left;">角色</th>
<th style="text-align: center;">R 执行者</th>
<th style="text-align: center;">A 拍板人</th>
<th style="text-align: center;">C 咨询者</th>
<th style="text-align: center;">I 知会者</th>
</tr>
</thead>
<tbody>
<tr>
<td style="text-align: left;"><strong>运维</strong></td>
<td style="text-align: center;">系统监控、安全审计、故障处理</td>
<td style="text-align: center;">系统配置变更、安全策略</td>
<td style="text-align: center;">架构变更方案</td>
<td style="text-align: center;">重大故障通知</td>
</tr>
<tr>
<td style="text-align: left;"><strong>财务</strong></td>
<td style="text-align: center;">成本核算、财务日报、预算监控</td>
<td style="text-align: center;">预算控制</td>
<td style="text-align: center;">采购方案评估</td>
<td style="text-align: center;">预算超支告警</td>
</tr>
<tr>
<td style="text-align: left;"><strong>项目</strong></td>
<td style="text-align: center;">代码编译、CI/CD、版本发布</td>
<td style="text-align: center;">代码合并、发布审批</td>
<td style="text-align: center;">技术选型</td>
<td style="text-align: center;">发布通知</td>
</tr>
<tr>
<td style="text-align: left;"><strong>商务</strong></td>
<td style="text-align: center;">合同流转、供应商对接</td>
<td style="text-align: center;">商务条款审批</td>
<td style="text-align: center;">风险评估</td>
<td style="text-align: center;">合同到期提醒</td>
</tr>
<tr>
<td style="text-align: left;"><strong>品宣</strong></td>
<td style="text-align: center;">内容创作、设计出图</td>
<td style="text-align: center;">内容审核、品牌规范</td>
<td style="text-align: center;">创意方向</td>
<td style="text-align: center;">品牌舆情</td>
</tr>
<tr>
<td style="text-align: left;"><strong>行政</strong></td>
<td style="text-align: center;">流程执行、通知下发</td>
<td style="text-align: center;">行政决策</td>
<td style="text-align: center;">流程优化建议</td>
<td style="text-align: center;">异常上报</td>
</tr>
<tr>
<td style="text-align: left;"><strong>研学</strong></td>
<td style="text-align: center;">技术研究、方案验证</td>
<td style="text-align: center;">技术方案选型</td>
<td style="text-align: center;">行业调研</td>
<td style="text-align: center;">研究发现通报</td>
</tr>
</tbody>
</table>
<p><strong>通用铁律</strong>: 高危操作需 approval-gate 审批。预算审批不跨过任富海。</p>
<hr />
<h2>8. 附录:快速参考卡</h2>
<h3>常用命令速查</h3>
<div class="codehilite"><pre><span></span><code><span class="c1"># 安全熔断</span>
approval-gate<span class="w"> </span>dry-run<span class="w"> </span><span class="s2">&quot;&lt;命令&gt;&quot;</span>
approval-gate<span class="w"> </span>check<span class="w"> </span><span class="s2">&quot;&lt;命令&gt;&quot;</span>
<span class="c1"># cron预检</span>
python3<span class="w"> </span>/root/.hermes/profiles/wecom-ops/scripts/check-cron-conflict.py<span class="w"> </span><span class="s2">&quot;分 时&quot;</span><span class="w"> </span><span class="s2">&quot;任务名&quot;</span>
<span class="c1"># 发全员群</span>
curl<span class="w"> </span>-s<span class="w"> </span>http://127.0.0.1:8800/send<span class="w"> </span>-d<span class="w"> </span><span class="s1">&#39;msg=...&amp;source=Bot名&#39;</span>
<span class="c1"># 跨Bot调度</span>
curl<span class="w"> </span>-s<span class="w"> </span>http://127.0.0.1:8660/bus/send<span class="w"> </span>-H<span class="w"> </span><span class="s1">&#39;X-API-Key: system-bus-relay-key-2026&#39;</span><span class="w"> </span><span class="se">\</span>
<span class="w"> </span>-d<span class="w"> </span><span class="s1">&#39;{&quot;touser&quot;:&quot;200653946&quot;,&quot;agentid&quot;:&lt;ID&gt;,&quot;msgtype&quot;:&quot;markdown&quot;,&quot;content&quot;:&quot;...&quot;}&#39;</span>
<span class="c1"># 文件写入生产目录</span>
<span class="nb">echo</span><span class="w"> </span><span class="s2">&quot;base64内容&quot;</span><span class="w"> </span><span class="p">|</span><span class="w"> </span>base64<span class="w"> </span>-d<span class="w"> </span>&gt;<span class="w"> </span>/var/www/html/&lt;路径&gt;
wc<span class="w"> </span>-c<span class="w"> </span>/var/www/html/&lt;路径&gt;
curl<span class="w"> </span>-sL<span class="w"> </span>-o<span class="w"> </span>/dev/null<span class="w"> </span>-w<span class="w"> </span><span class="s2">&quot;%{http_code}&quot;</span><span class="w"> </span>https://sxbh.ltd/&lt;路径&gt;
</code></pre></div>
<h3>Bus Relay Agent ID 速查</h3>
<div class="codehilite"><pre><span></span><code><span class="mf">1000041</span><span class="w"> </span><span class="err"></span><span class="w"> </span><span class="n">boss</span><span class="w"> </span><span class="mf">1000040</span><span class="w"> </span><span class="err"></span><span class="w"> </span><span class="n">finance</span><span class="w"> </span><span class="mf">1000039</span><span class="w"> </span><span class="err"></span><span class="w"> </span><span class="n">project</span>
<span class="mf">1000037</span><span class="w"> </span><span class="err"></span><span class="w"> </span><span class="n">creative</span><span class="w"> </span><span class="mf">1000032</span><span class="w"> </span><span class="err"></span><span class="w"> </span><span class="n">yanxue</span><span class="w"> </span><span class="mf">1000020</span><span class="w"> </span><span class="err"></span><span class="w"> </span><span class="n">admin</span>
<span class="mf">1000043</span><span class="w"> </span><span class="err"></span><span class="w"> </span><span class="n">business</span><span class="w"> </span><span class="mf">1000045</span><span class="w"> </span><span class="err"></span><span class="w"> </span><span class="n">employees</span>
</code></pre></div>
<h3>排布表路径</h3>
<div class="codehilite"><pre><span></span><code>/root/.hermes/profiles/wecom-ops/scripts/CRON_SCHEDULE.md
</code></pre></div>
<div class="footer">
博海科技 · Bot 行为手册 v1.0 · 2026-07-08<br>
<a href="https://sxbh.ltd/manuals/bot-behavior.md">Markdown 原文</a>
</div>
</div>
</body>
</html>