Hermes CI FixandHermes AI
e1a9b25afa
- nginx 安全加固 (CSP, HSTS, 缓存策略) - 共享 style.css - 138个页面全部接入 Co-authored-by: Hermes AI <agent@hermes>
327 lines
14 KiB
HTML
327 lines
14 KiB
HTML
<!DOCTYPE html>
|
||
<html lang="zh-CN">
|
||
<head>
|
||
<meta charset="UTF-8">
|
||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||
<title>博海Agent控制面建设方案</title>
|
||
<style>
|
||
* { margin: 0; padding: 0; box-sizing: border-box; }
|
||
body { background: #f5f6f7; font-family: -apple-system, "PingFang SC", "Microsoft YaHei", sans-serif; padding: 24px 0; }
|
||
.container { max-width: 800px; margin: 0 auto; }
|
||
|
||
.header {
|
||
background: linear-gradient(135deg, #1a1a2e 0%, #16213e 50%, #0f3460 100%);
|
||
color: #fff; padding: 44px 40px 36px; border-radius: 12px 12px 0 0;
|
||
}
|
||
.header .badge {
|
||
display: inline-block; background: rgba(255,255,255,0.15);
|
||
padding: 4px 14px; border-radius: 20px; font-size: 12px; letter-spacing: 1px; margin-bottom: 14px;
|
||
}
|
||
.header h1 { font-size: 26px; line-height: 1.4; margin-bottom: 8px; }
|
||
.header .sub { font-size: 14px; opacity: 0.8; margin-bottom: 12px; }
|
||
.header .meta { font-size: 12px; opacity: 0.6; }
|
||
|
||
.content { background: #fff; padding: 36px 40px; box-shadow: 0 2px 8px rgba(0,0,0,0.06); }
|
||
.section { margin-bottom: 30px; }
|
||
|
||
.section-title {
|
||
font-size: 18px; color: #1a1a2e; font-weight: 700;
|
||
border-left: 4px solid #0f3460; padding-left: 14px; margin-bottom: 14px;
|
||
}
|
||
.section-lead {
|
||
background: #f0f4ff; border-left: 4px solid #0f3460;
|
||
padding: 14px 18px; border-radius: 0 6px 6px 0;
|
||
font-size: 14px; color: #2c3e50; margin-bottom: 18px; line-height: 1.7;
|
||
}
|
||
|
||
.summary-grid { display: grid; grid-template-columns: 1fr 1fr 1fr; gap: 14px; margin-bottom: 20px; }
|
||
.metric-card {
|
||
background: #f8f9fc; border-radius: 8px; padding: 16px; border: 1px solid #e8ecf0;
|
||
}
|
||
.metric-card .num { font-size: 24px; font-weight: 700; color: #0f3460; }
|
||
.metric-card .label { font-size: 12px; color: #7f8c8d; margin-top: 3px; }
|
||
.metric-card .desc { font-size: 12px; color: #555; margin-top: 5px; line-height: 1.5; }
|
||
|
||
table { width: 100%; border-collapse: collapse; font-size: 13px; margin: 10px 0 16px; }
|
||
table th {
|
||
background: #1a1a2e; color: #fff; padding: 8px 12px; text-align: left; font-weight: 500;
|
||
}
|
||
table th:first-child { border-radius: 4px 0 0 0; }
|
||
table th:last-child { border-radius: 0 4px 0 0; }
|
||
table td { padding: 8px 12px; border-bottom: 1px solid #e8ecf0; }
|
||
table tr:nth-child(even) { background: #f8f9fc; }
|
||
|
||
.badge-done { display: inline-block; background: #e8f5e9; color: #2e7d32; padding: 1px 8px; border-radius: 10px; font-size: 11px; font-weight: 600; }
|
||
.badge-half { display: inline-block; background: #fff8e1; color: #f57f17; padding: 1px 8px; border-radius: 10px; font-size: 11px; font-weight: 600; }
|
||
.badge-miss { display: inline-block; background: #fce4ec; color: #c62828; padding: 1px 8px; border-radius: 10px; font-size: 11px; font-weight: 600; }
|
||
.badge-new { display: inline-block; background: #e3f2fd; color: #1565c0; padding: 1px 8px; border-radius: 10px; font-size: 11px; font-weight: 600; }
|
||
|
||
.timeline { position: relative; padding-left: 26px; margin: 14px 0; }
|
||
.timeline::before {
|
||
content: ''; position: absolute; left: 7px; top: 6px; bottom: 6px;
|
||
width: 2px; background: #d0d7de;
|
||
}
|
||
.timeline-item { position: relative; margin-bottom: 18px; }
|
||
.timeline-item::before {
|
||
content: ''; position: absolute; left: -19px; top: 5px;
|
||
width: 10px; height: 10px; border-radius: 50%; background: #0f3460; border: 2px solid #fff;
|
||
}
|
||
.timeline-item .title { font-weight: 600; color: #1a1a2e; margin-bottom: 3px; font-size: 14px; }
|
||
.timeline-item .desc { font-size: 13px; color: #555; line-height: 1.6; }
|
||
.timeline-item .tag { font-size: 11px; color: #999; margin-top: 2px; }
|
||
|
||
.arch-box {
|
||
background: #1a1a2e; color: #e6edf3; border-radius: 8px; padding: 18px 22px;
|
||
margin: 12px 0; font-family: "Courier New", monospace; font-size: 12px; line-height: 1.8;
|
||
}
|
||
.arch-box .hl { color: #ffa657; }
|
||
.arch-box .gr { color: #7ee787; }
|
||
.arch-box .bl { color: #58a6ff; }
|
||
.arch-box .dim { color: #8b949e; }
|
||
|
||
.quote-block {
|
||
background: #f0f4ff; border-radius: 8px; padding: 18px; margin: 14px 0;
|
||
border: 1px solid #dbeafe;
|
||
}
|
||
.quote-block .label { font-size: 11px; color: #0f3460; font-weight: 600; margin-bottom: 6px; }
|
||
.quote-block .text { font-size: 13px; color: #2c3e50; line-height: 1.7; }
|
||
|
||
.separator { text-align: center; color: #ccc; font-size: 13px; margin: 24px 0; letter-spacing: 5px; }
|
||
|
||
.footer {
|
||
background: #1a1a2e; color: rgba(255,255,255,0.6);
|
||
padding: 20px 40px; border-radius: 0 0 12px 12px; font-size: 12px; text-align: center;
|
||
}
|
||
|
||
@media (max-width: 640px) {
|
||
.content { padding: 20px; }
|
||
.summary-grid { grid-template-columns: 1fr; }
|
||
.header { padding: 28px 20px; }
|
||
.header h1 { font-size: 20px; }
|
||
}
|
||
</style>
|
||
<link rel="stylesheet" href="/style.css">
|
||
</head>
|
||
<body>
|
||
<div class="container">
|
||
|
||
<div class="header">
|
||
<div class="badge">🏗️ 博海 · Agent 控制面</div>
|
||
<h1>阿里云Agent架构 · Hermes落地翻译</h1>
|
||
<div class="sub">基于 HiClaw + AgentLoop + Nacos AI Registry 架构的博海适配方案</div>
|
||
<div class="meta">研学整理 · 2026-06-25</div>
|
||
</div>
|
||
|
||
<div class="content">
|
||
|
||
<!-- 现状对齐 -->
|
||
<div class="section">
|
||
<div class="section-title">一、阿里云四件套 → 博海现状映射</div>
|
||
|
||
<table>
|
||
<tr><th>阿里云组件</th><th>定位</th><th>博海现状</th><th>差距</th></tr>
|
||
<tr>
|
||
<td><strong>HiClaw</strong></td>
|
||
<td>多Agent协作底座<br>Manager→TL→Worker</td>
|
||
<td>8个Profile平级运行，<br>无统一编排层</td>
|
||
<td><span class="badge-half">有骨架缺大脑</span></td>
|
||
</tr>
|
||
<tr>
|
||
<td><strong>AgentLoop</strong></td>
|
||
<td>可观测+自动评分<br>循环优化Agent</td>
|
||
<td>Loop Engineering skill<br>（builder/checker循环）</td>
|
||
<td><span class="badge-done">基本对齐，缺评分机制</span></td>
|
||
</tr>
|
||
<tr>
|
||
<td><strong>Nacos AI Registry</strong></td>
|
||
<td>Skill/Worker 治理中心<br>安全门+生命周期+权限+审计</td>
|
||
<td>无统一Skill注册表，<br>各Profile各自为政</td>
|
||
<td><span class="badge-miss">缺失</span></td>
|
||
</tr>
|
||
<tr>
|
||
<td><strong>标准数字员工模板</strong></td>
|
||
<td>SOUL.md+AGENTS.md+MEMORY.md<br>+manifest.json+skills/</td>
|
||
<td>项目BOT已有SOUL.md<br>和MEMORY.md</td>
|
||
<td><span class="badge-half">格式对齐，缺manifest</span></td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
|
||
<div class="separator">◆ ◆ ◆</div>
|
||
|
||
<!-- 控制面架构 -->
|
||
<div class="section">
|
||
<div class="section-title">二、控制面架构设计</div>
|
||
|
||
<div class="section-lead">
|
||
<strong>核心思路：</strong>在8个Profile之上加一层"控制面"，不改造现有BOT，只加一个注册中心+一个安全门+一个审计日志。对标Nacos AI Registry 的四大能力。
|
||
</div>
|
||
|
||
<div class="arch-box">
|
||
<span class="bl">博海Agent控制面</span><span class="dim"> (控制层 · 新增)</span>
|
||
├── <span class="hl">注册中心</span><span class="dim"> (Registry)</span>
|
||
│ ├── profile 注册表（8个Profile + 能力清单）
|
||
│ ├── skill 注册表（所有已发布技能 + 版本号）
|
||
│ └── worker 状态表（在线/离线/负载）
|
||
├── <span class="hl">安全门</span><span class="dim"> (Security Gate)</span>
|
||
│ ├── skill 扫描（检测硬编码密钥/敏感数据）
|
||
│ ├── 权限校验（谁可以用什么skill）
|
||
│ └── 变更审计（谁在何时改了啥）
|
||
├── <span class="hl">生命周期</span><span class="dim"> (Lifecycle)</span>
|
||
│ ├── skill: 草稿→审核→发布→下线
|
||
│ └── profile: 启用→运行→维护→退役
|
||
└── <span class="hl">审计日志</span><span class="dim"> (Audit)</span>
|
||
└── 所有跨Profile操作全留痕
|
||
</div>
|
||
</div>
|
||
|
||
<div class="separator">◆ ◆ ◆</div>
|
||
|
||
<!-- 落地路线 -->
|
||
<div class="section">
|
||
<div class="section-title">三、四阶段落地路线图</div>
|
||
|
||
<div class="timeline">
|
||
|
||
<div class="timeline-item">
|
||
<div class="title">📌 Phase 1：注册表 + 清单（1周）</div>
|
||
<div class="desc">
|
||
不需要新系统，只需要一个 JSON 文件 + 一个聚合脚本。<br><br>
|
||
<strong>具体做：</strong><br>
|
||
· 创建 <code>/etc/hermes-registry/registry.json</code>，登记8个Profile的：
|
||
· profile 名称 + 端口 + 状态
|
||
· 已安装的 skills 列表 + 版本
|
||
· 负责人 + 维护时间<br>
|
||
· 写一个巡查脚本 <code>scripts/registry-sync.sh</code>，每天自动扫描各 Profile 的 skill 目录，更新注册表<br>
|
||
· 用 wecom-ops 的 cronjob 每天汇报差异
|
||
</div>
|
||
<div class="tag">投入：低 · 1天可搞定</div>
|
||
</div>
|
||
|
||
<div class="timeline-item">
|
||
<div class="title">🔒 Phase 2：安全门 + 审计（2周）</div>
|
||
<div class="desc">
|
||
<strong>上一步的注册表成熟后，加两道门：</strong><br><br>
|
||
<strong>安全扫描门：</strong><br>
|
||
· 写一个 skill 扫描脚本，对所有 skill/scripts 目录做：
|
||
· grep 硬编码密钥/密码/Token/SK
|
||
· 检测可疑的 exfiltration（curl/wget 到未知域名）
|
||
· 标记含敏感数据暴露风险的 skill<br>
|
||
· 扫描结果写入 registry.json 的每个 skill 条目<br>
|
||
· 未通过扫描的 skill 标记不可用<br><br>
|
||
<strong>审计日志：</strong><br>
|
||
· 在每个 Profile 的 cronjob/output/ 下追加审计日志<br>
|
||
· 格式统一：时间戳 | 操作者 | 操作类型 | 目标 | 结果<br>
|
||
· 运维BOT 每天汇总成审计日报
|
||
</div>
|
||
<div class="tag">投入：中 · 工具链可复用</div>
|
||
</div>
|
||
|
||
<div class="timeline-item">
|
||
<div class="title">🔄 Phase 3：生命周期管理（1个月）</div>
|
||
<div class="desc">
|
||
<strong>skill 从"写出来就能用"变成"有流程地发布"：</strong><br><br>
|
||
<table>
|
||
<tr><th>状态</th><th>含义</th><th>谁触发</th></tr>
|
||
<tr><td>📝 草稿</td><td>正在开发，仅作者可见</td><td>开发者</td></tr>
|
||
<tr><td>🔍 审核中</td><td>提交安全扫描+人工检查</td><td>自动 + 管理员</td></tr>
|
||
<tr><td>✅ 已发布</td><td>可被其他Profile发现和调用</td><td>审核通过</td></tr>
|
||
<tr><td>📦 已下线</td><td>不再可用，保留审计记录</td><td>管理员</td></tr>
|
||
</table>
|
||
<br>
|
||
每个 skill 的 metadata 加上：版本号、依赖、安全评分、最后审核时间
|
||
</div>
|
||
<div class="tag">投入：中高 · 需规范流程</div>
|
||
</div>
|
||
|
||
<div class="timeline-item">
|
||
<div class="title">🎯 Phase 4：跨Profile编排（季度目标）</div>
|
||
<div class="desc">
|
||
<strong>对标 HiClaw 的 Manager→TL→Worker 架构：</strong><br><br>
|
||
· 选定 wecom-admin（管理BOT）作为<strong>Manager Agent</strong><br>
|
||
· 复杂任务由 Manager 拆解，分配给各 Profile 的 TL<br>
|
||
· 结果聚合返回，全程审计<br><br>
|
||
Hermes 的 <code>delegate_task</code> 已经支持多子任务并行，<br>
|
||
<code>max_spawn_depth: 2</code>（项目BOT）已经支持嵌套编排。<br>
|
||
缺的是一个"任务路由表"——哪个Profile擅长什么。
|
||
</div>
|
||
<div class="tag">投入：高 · 需架构决策</div>
|
||
</div>
|
||
|
||
</div>
|
||
</div>
|
||
|
||
<div class="separator">◆ ◆ ◆</div>
|
||
|
||
<!-- 安全扫描 -->
|
||
<div class="section">
|
||
<div class="section-title">四、安全扫描门 · MVP实现</div>
|
||
|
||
<div class="section-lead">
|
||
<strong>阿里云的数据触目惊心：54% 的社区Skill存在敏感数据暴露。</strong>你的Profile里也可能有——不需要装任何工具，Hermes 自带的 grep/search_files 就能扫。
|
||
</div>
|
||
|
||
<div class="quote-block">
|
||
<div class="label">🔍 一份扫描脚本就能做的事</div>
|
||
<div class="text">
|
||
<strong>扫描范围：</strong>所有 Profile 的 skills/ scripts/ memories/ 目录<br>
|
||
<strong>扫描模式：</strong><br>
|
||
· 正则匹配 <code>API_KEY|SECRET|PASSWORD|TOKEN|sk-[a-zA-Z0-9]</code> 等模式<br>
|
||
· 检测 curl/wget 到非白名单域名<br>
|
||
· 检测 eval/exec/subprocess 调用<br>
|
||
<strong>输出格式：</strong>JSON { "skill": "", "risk": "high/mid/low", "detail": "", "file": "", "line": 0 }<br>
|
||
<strong>频率：</strong>每次 git push / skill 更新后自动触发
|
||
</div>
|
||
</div>
|
||
|
||
<p style="font-size:13px;color:#555;line-height:1.7;margin:8px 0;">
|
||
<strong>明天就能做：</strong>让运维BOT 跑一次全Profile的 security scan，看看我们现在有没有暴露的密钥。
|
||
</p>
|
||
</div>
|
||
|
||
<div class="separator">◆ ◆ ◆</div>
|
||
|
||
<!-- 博海总结 -->
|
||
<div class="section">
|
||
<div class="section-title">五、总结：你的位置和下一步</div>
|
||
|
||
<div class="summary-grid">
|
||
<div class="metric-card">
|
||
<div class="num">8</div>
|
||
<div class="label">Profile · 已有</div>
|
||
<div class="desc">比其他大多数企业起步早得多</div>
|
||
</div>
|
||
<div class="metric-card">
|
||
<div class="num">3</div>
|
||
<div class="label">已对齐组件</div>
|
||
<div class="desc">SOUL.md/MEMORY.md ✅<br>Loop Engineering ✅<br>delegate_task 编排 ✅</div>
|
||
</div>
|
||
<div class="metric-card">
|
||
<div class="num">1</div>
|
||
<div class="label">最大缺失</div>
|
||
<div class="desc">统一注册+安全门+审计<br>→ 加一层控制面就够</div>
|
||
</div>
|
||
</div>
|
||
|
||
<div class="quote-block">
|
||
<div class="label">💡 研学的判断</div>
|
||
<div class="text">
|
||
<strong>阿里云用108页PPT画了一张"企业级Agent基础设施"的蓝图。</strong><br>
|
||
你不是从零开始，你已经在蓝图里了——只是缺一个控制面（注册表+安全门+审计）。<br><br>
|
||
Phase 1（注册表）一个人一天就能搭完，不需要装任何新软件。<br>
|
||
<strong>要我直接给你写出 registry-sync.sh 脚本吗？</strong>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
|
||
</div>
|
||
|
||
<div class="footer">
|
||
基于阿里云AI科技沙龙《108页PPT泄露阿里云Agent底牌》分析 · 研学整理<br>
|
||
对标组件：HiClaw + AgentLoop + Nacos AI Registry
|
||
</div>
|
||
|
||
</div>
|
||
</body>
|
||
</html>
|