From 708ffb90ad4243b0446d24bb92104c3437821b4d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 30 Mar 2026 13:46:36 +0000
Subject: [PATCH] =?UTF-8?q?=E4=BB=A3=E7=A0=81=E5=AE=A1=E6=9F=A5=E4=BF=AE?=
 =?UTF-8?q?=E5=A4=8D=C2=B7CN=E5=B7=A5=E4=BD=9C=E6=B5=81=E8=B7=AF=E5=BE=84?=
 =?UTF-8?q?=E7=BB=9F=E4=B8=80=C2=B7server.js=E5=AD=98=E5=9C=A8=E6=A3=80?=
 =?UTF-8?q?=E6=9F=A5=C2=B7SSH=E5=8A=A0=E5=9B=BA=E5=A2=9E=E5=BC=BA?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Agent-Logs-Url: https://github.com/qinfendebingshuo/guanghulab/sessions/36c879f1-286c-4166-aeee-13297073467f

Co-authored-by: qinfendebingshuo <207279273+qinfendebingshuo@users.noreply.github.com>
---
 .github/workflows/deploy-to-cn-server.yml | 18 +++++++++++++++---
 server/setup/cn-server-init.sh            | 10 +++-------
 2 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/deploy-to-cn-server.yml b/.github/workflows/deploy-to-cn-server.yml
index bbd1dd62..bf8d387f 100644
--- a/.github/workflows/deploy-to-cn-server.yml
+++ b/.github/workflows/deploy-to-cn-server.yml
@@ -26,6 +26,9 @@ on:
           - init
           - health-check
 
+env:
+  CN_DEFAULT_PATH: /opt/zhuyuan-cn
+
 concurrency:
   group: cn-server-deploy
   cancel-in-progress: false
@@ -76,7 +79,8 @@ jobs:
 
       - name: 📦 同步应用代码
         run: |
-          CN_PATH="${{ secrets.ZY_CN_SERVER_PATH || '/opt/zhuyuan-cn' }}"
+          CN_PATH="${{ secrets.ZY_CN_SERVER_PATH }}"
+          CN_PATH="${CN_PATH:-${{ env.CN_DEFAULT_PATH }}}"
           echo "📦 部署目标: ${CN_PATH}"
 
           # 确保目标目录存在
@@ -91,7 +95,8 @@ jobs:
 
       - name: 📦 同步大脑文件
         run: |
-          CN_PATH="${{ secrets.ZY_CN_SERVER_PATH || '/opt/zhuyuan-cn' }}"
+          CN_PATH="${{ secrets.ZY_CN_SERVER_PATH }}"
+          CN_PATH="${CN_PATH:-${{ env.CN_DEFAULT_PATH }}}"
 
           # 同步大脑核心文件到备用服务器
           rsync -avz \
@@ -101,7 +106,8 @@ jobs:
 
       - name: 📥 安装依赖 & 重启
         run: |
-          CN_PATH="${{ secrets.ZY_CN_SERVER_PATH || '/opt/zhuyuan-cn' }}"
+          CN_PATH="${{ secrets.ZY_CN_SERVER_PATH }}"
+          CN_PATH="${CN_PATH:-${{ env.CN_DEFAULT_PATH }}}"
           COMMIT_SHA="${{ github.sha }}"
           ssh -i ~/.ssh/zy_cn_key \
             ${{ secrets.ZY_CN_SERVER_USER }}@${{ secrets.ZY_CN_SERVER_HOST }} << DEPLOY_CMD
@@ -109,6 +115,12 @@ jobs:
           set -e
           cd ${CN_PATH}/app
 
+          # 验证入口文件存在
+          if [ ! -f server.js ]; then
+            echo "❌ 错误: server.js 不存在"
+            exit 1
+          fi
+
           # 安装依赖
           npm install --production 2>&1
 
diff --git a/server/setup/cn-server-init.sh b/server/setup/cn-server-init.sh
index 9ecb38cd..2c7b03fd 100644
--- a/server/setup/cn-server-init.sh
+++ b/server/setup/cn-server-init.sh
@@ -200,13 +200,9 @@ log "  自动安全更新已启用"
 
 # ═══ §9 SSH安全加固 ═══
 log "§9 SSH安全加固..."
-if grep -q "^PasswordAuthentication yes" /etc/ssh/sshd_config 2>/dev/null; then
-  sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
-  systemctl restart sshd
-  log "  密码登录已禁用，仅允许密钥认证"
-else
-  log "  SSH配置已安全，跳过"
-fi
+sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
+systemctl restart sshd
+log "  密码登录已禁用，仅允许密钥认证"
 
 # ═══ §10 完成报告 ═══
 log "§10 生成初始化报告..."