diff --git a/.codex/skills/inspect-shz-logs/SKILL.md b/.codex/skills/inspect-shz-logs/SKILL.md index 115dac6..6d378e2 100644 --- a/.codex/skills/inspect-shz-logs/SKILL.md +++ b/.codex/skills/inspect-shz-logs/SKILL.md @@ -1,6 +1,6 @@ --- name: inspect-shz-logs -description: Inspect and follow the SHZ backend's local and production logs through bounded, read-only commands. Use when Codex is working in the shz-backend project and needs to diagnose startup failures, exceptions, request behavior, scheduled jobs, or runtime incidents from local backend.log or the production backend, error, info, and user logs on the shz server. +description: Inspect and follow the SHZ backend's local, test, and production logs through bounded, read-only commands. Use when Codex is working in the shz-backend project and needs to diagnose startup failures, exceptions, request behavior, scheduled jobs, or runtime incidents from local backend.log or the test and production backend, error, info, and user logs. --- # Inspect SHZ Logs @@ -35,7 +35,25 @@ Read the current error log: .codex/skills/inspect-shz-logs/scripts/view.sh online error 200 ``` -Choose only one production log type: `backend`, `error`, `info`, or `user`. Add `--follow` as the final argument only for an explicit live-monitoring request. +`online` is the existing production-environment name and remains supported. `production` is an equivalent alias. + +Choose only one log type: `backend`, `error`, `info`, or `user`. Add `--follow` as the final argument only for an explicit live-monitoring request. + +## Inspect test logs + +Read the main test-environment application log: + +```bash +.codex/skills/inspect-shz-logs/scripts/view.sh test backend 200 +``` + +Read the current test-environment error log: + +```bash +.codex/skills/inspect-shz-logs/scripts/view.sh test error 200 +``` + +The test environment uses the same four log types as production. The default test server is `root@47.111.103.66` on SSH port `22`; the endpoint and log directory can be overridden with `SHZ_TEST_SSH_HOST`, `SHZ_TEST_SSH_PORT`, and `SHZ_TEST_LOG_DIR` when the server layout changes. For keyword analysis, fetch a bounded window and filter locally, for example: @@ -45,12 +63,12 @@ For keyword analysis, fetch a bounded window and filter locally, for example: ## Diagnose from logs -1. Establish whether the request concerns local or production behavior. +1. Establish whether the request concerns local, test, or production behavior. 2. Read 100–300 recent lines from the relevant log. 3. Expand up to the script's 5,000-line cap only when timestamps or stack traces require more context. 4. Correlate timestamps, thread names, exception causes, and nearby requests. 5. Report the evidence and likely cause without exposing tokens, passwords, personal data, or unrelated log content. -Treat production access as read-only. Never restart services, edit files, deploy code, truncate logs, or run arbitrary remote commands through this skill. +Treat test and production access as read-only. Never restart services, edit files, deploy code, truncate logs, or run arbitrary remote commands through this skill. Read [references/log-locations.md](references/log-locations.md) only when checking server identity, paths, or supported log types. diff --git a/.codex/skills/inspect-shz-logs/agents/openai.yaml b/.codex/skills/inspect-shz-logs/agents/openai.yaml index 15c36a2..317bd7c 100644 --- a/.codex/skills/inspect-shz-logs/agents/openai.yaml +++ b/.codex/skills/inspect-shz-logs/agents/openai.yaml @@ -1,4 +1,4 @@ interface: display_name: "查看 SHZ 项目日志" - short_description: "安全查看并跟踪 SHZ 项目的本地与线上运行日志内容" - default_prompt: "Use $inspect-shz-logs to inspect recent local or production logs for the SHZ backend." + short_description: "安全查看并跟踪 SHZ 项目的本地、测试与线上日志内容" + default_prompt: "Use $inspect-shz-logs to inspect recent local, test, or production logs for the SHZ backend." diff --git a/.codex/skills/inspect-shz-logs/references/log-locations.md b/.codex/skills/inspect-shz-logs/references/log-locations.md index 03f4b0a..b9b22e0 100644 --- a/.codex/skills/inspect-shz-logs/references/log-locations.md +++ b/.codex/skills/inspect-shz-logs/references/log-locations.md @@ -16,4 +16,17 @@ - Current info log: `/opt/service/project/shz-backend/logs/sys-info.log` - Current user log: `/opt/service/project/shz-backend/logs/sys-user.log` +## Test: shz-test + +- SSH: `root@47.111.103.66:22` +- Application: `/data/code/shz-backend/ruoyi-admin/target/ruoyi-admin.jar` +- Profile: `test` +- HTTP port: `9091` +- Main process log: `/data/code/shz-backend/logs/backend.log` +- Current error log: `/data/code/shz-backend/logs/sys-error.log` +- Current info log: `/data/code/shz-backend/logs/sys-info.log` +- Current user log: `/data/code/shz-backend/logs/sys-user.log` + +The test endpoint defaults can be overridden with `SHZ_TEST_SSH_HOST`, `SHZ_TEST_SSH_PORT`, and `SHZ_TEST_LOG_DIR`. + Use only the bundled read-only viewer. Rotated files use date suffixes but are intentionally not exposed by the default script. diff --git a/.codex/skills/inspect-shz-logs/scripts/view.sh b/.codex/skills/inspect-shz-logs/scripts/view.sh index bc7fd45..7e74b3d 100755 --- a/.codex/skills/inspect-shz-logs/scripts/view.sh +++ b/.codex/skills/inspect-shz-logs/scripts/view.sh @@ -5,20 +5,26 @@ skill_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" project_dir="$(cd "${skill_dir}/../../.." && pwd)" local_log="${project_dir}/.local/logs/backend.log" -ssh_host="root@39.98.44.136" -ssh_port="6022" -remote_log_dir="/opt/service/project/shz-backend/logs" +online_ssh_host="${SHZ_ONLINE_SSH_HOST:-root@39.98.44.136}" +online_ssh_port="${SHZ_ONLINE_SSH_PORT:-6022}" +online_remote_log_dir="${SHZ_ONLINE_LOG_DIR:-/opt/service/project/shz-backend/logs}" + +test_ssh_host="${SHZ_TEST_SSH_HOST:-root@47.111.103.66}" +test_ssh_port="${SHZ_TEST_SSH_PORT:-22}" +test_remote_log_dir="${SHZ_TEST_LOG_DIR:-/data/code/shz-backend/logs}" usage() { cat <<'EOF' Usage: view.sh local [lines] [--follow] - view.sh online [backend|error|info|user] [lines] [--follow] + view.sh online|production [backend|error|info|user] [lines] [--follow] + view.sh test [backend|error|info|user] [lines] [--follow] Examples: view.sh local 200 view.sh local 100 --follow view.sh online backend 200 + view.sh test error 200 view.sh online error 500 --follow EOF } @@ -59,11 +65,30 @@ view_local() { fi } -view_online() { - local kind="${1:-backend}" - local lines="${2:-200}" - local follow="${3:-}" - local remote_file +view_remote() { + local target="$1" + local kind="${2:-backend}" + local lines="${3:-200}" + local follow="${4:-}" + local ssh_host ssh_port remote_log_dir remote_file + + case "${target}" in + online|production) + ssh_host="${online_ssh_host}" + ssh_port="${online_ssh_port}" + remote_log_dir="${online_remote_log_dir}" + ;; + test) + ssh_host="${test_ssh_host}" + ssh_port="${test_ssh_port}" + remote_log_dir="${test_remote_log_dir}" + ;; + *) + echo "Unknown remote environment: ${target}" >&2 + usage >&2 + exit 2 + ;; + esac case "${kind}" in backend) remote_file="${remote_log_dir}/backend.log" ;; @@ -71,7 +96,7 @@ view_online() { info) remote_file="${remote_log_dir}/sys-info.log" ;; user) remote_file="${remote_log_dir}/sys-user.log" ;; *) - echo "Unknown online log type: ${kind}" >&2 + echo "Unknown log type: ${kind}" >&2 usage >&2 exit 2 ;; @@ -80,11 +105,16 @@ view_online() { validate_lines "${lines}" validate_follow "${follow}" + local -a ssh_args=(-o BatchMode=yes -o ConnectTimeout=10) + if [[ -n "${ssh_port}" ]]; then + ssh_args+=(-p "${ssh_port}") + fi + if [[ "${follow}" == "--follow" ]]; then - ssh -p "${ssh_port}" -o BatchMode=yes -o ConnectTimeout=10 "${ssh_host}" \ + ssh "${ssh_args[@]}" "${ssh_host}" \ tail -n "${lines}" -F -- "${remote_file}" else - ssh -p "${ssh_port}" -o BatchMode=yes -o ConnectTimeout=10 "${ssh_host}" \ + ssh "${ssh_args[@]}" "${ssh_host}" \ tail -n "${lines}" -- "${remote_file}" fi } @@ -95,9 +125,9 @@ case "${target}" in [[ $# -le 3 ]] || { usage >&2; exit 2; } view_local "${2:-200}" "${3:-}" ;; - online) + online|production|test) [[ $# -le 4 ]] || { usage >&2; exit 2; } - view_online "${2:-backend}" "${3:-200}" "${4:-}" + view_remote "${target}" "${2:-backend}" "${3:-200}" "${4:-}" ;; help|-h|--help) usage diff --git a/.codex/skills/query-shz-highgo/SKILL.md b/.codex/skills/query-shz-highgo/SKILL.md index 1d1b059..b57b25d 100644 --- a/.codex/skills/query-shz-highgo/SKILL.md +++ b/.codex/skills/query-shz-highgo/SKILL.md @@ -1,11 +1,11 @@ --- name: query-shz-highgo -description: Query the SHZ HighGo Security Enterprise Edition database through its SSH gateway using a guarded read-only psql workflow. Use when Codex is working in the shz-backend project and needs to inspect database schemas, tables, columns, row counts, or application data; diagnose data-related behavior; or execute SELECT, WITH, SHOW, or EXPLAIN statements against the project's HighGo database. +description: Query the SHZ HighGo Security Enterprise Edition database in the test or production environment through an SSH gateway using a guarded read-only psql workflow. Use when Codex is working in the shz-backend project and needs to inspect database schemas, tables, columns, row counts, or application data; diagnose data-related behavior; or execute SELECT, WITH, SHOW, or EXPLAIN statements against the project's HighGo database. --- # Query SHZ HighGo -Use the bundled script to run read-only SQL through the configured SSH gateway. +Use the bundled script to run read-only SQL through the configured SSH gateway. The existing one-argument form queries production; pass `test` as the first argument to query the test environment. ## Query workflow @@ -15,6 +15,9 @@ Use the bundled script to run read-only SQL through the configured SSH gateway. ```bash .codex/skills/query-shz-highgo/scripts/query.sh 'SELECT current_database(), current_user, current_schema()' + + # Test environment + .codex/skills/query-shz-highgo/scripts/query.sh test 'SELECT current_database(), current_user, current_schema()' ``` 4. Summarize the result and distinguish returned facts from inferences. diff --git a/.codex/skills/query-shz-highgo/agents/openai.yaml b/.codex/skills/query-shz-highgo/agents/openai.yaml index 330b230..bd52488 100644 --- a/.codex/skills/query-shz-highgo/agents/openai.yaml +++ b/.codex/skills/query-shz-highgo/agents/openai.yaml @@ -1,4 +1,4 @@ interface: display_name: "查询 SHZ 翰高数据库" - short_description: "通过 SSH 网关安全执行本项目翰高数据库只读 SQL 查询" - default_prompt: "Use $query-shz-highgo to run a read-only query against this project's SHZ HighGo database." + short_description: "通过 SSH 安全查询 SHZ 测试或线上翰高数据库" + default_prompt: "Use $query-shz-highgo to run a read-only query against this project's test or production HighGo database." diff --git a/.codex/skills/query-shz-highgo/references/connection.md b/.codex/skills/query-shz-highgo/references/connection.md index a96f752..5783d9f 100644 --- a/.codex/skills/query-shz-highgo/references/connection.md +++ b/.codex/skills/query-shz-highgo/references/connection.md @@ -9,4 +9,16 @@ - Detected server: HighGo Security Enterprise Edition Database System 4.5.10 - Password source: `../.password`, mode `600`; override with `HIGHGO_PASSWORD_FILE` +## Test environment + +- SSH gateway: `root@47.111.103.66:22` +- HighGo client: `/opt/HighGo4.5.7-see/bin/psql` +- Database endpoint from the test profile: `127.0.0.1:5866` (on the test server) +- Database: `highgo` +- User: `sysdba` +- Default schemas: `shz,public` +- Password source: `HIGHGO_TEST_PASSWORD_FILE` when set; otherwise the existing `HIGHGO_PASSWORD_FILE` or `../.password` + +The test connection is made by SSHing to `47.111.103.66` and running the HighGo client there against its loopback database endpoint. Override the test endpoint with `HIGHGO_TEST_SSH_HOST`, `HIGHGO_TEST_SSH_PORT`, `HIGHGO_TEST_PSQL_PATH`, `HIGHGO_TEST_DB_HOST`, `HIGHGO_TEST_DB_PORT`, `HIGHGO_TEST_DB_NAME`, or `HIGHGO_TEST_DB_USER` if the server layout differs. + The SSH gateway must be reachable with the workstation's existing SSH key. Keep credentials out of commands, logs, responses, and `SKILL.md`. diff --git a/.codex/skills/query-shz-highgo/scripts/query.sh b/.codex/skills/query-shz-highgo/scripts/query.sh index 2c88bde..b54ee65 100755 --- a/.codex/skills/query-shz-highgo/scripts/query.sh +++ b/.codex/skills/query-shz-highgo/scripts/query.sh @@ -2,14 +2,40 @@ set -euo pipefail skill_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" -password_file="${HIGHGO_PASSWORD_FILE:-$skill_dir/.password}" -ssh_host="root@124.243.245.42" -psql_path="/opt/HighGo4.5.7-see/bin/psql" -db_host="39.98.44.136" -db_port="6023" -db_name="highgo" -db_user="sysdba" +environment="online" +if [[ "${1:-}" == "online" || "${1:-}" == "production" || "${1:-}" == "test" ]]; then + environment="$1" + shift +fi + +case "${environment}" in + online|production) + password_file="${HIGHGO_PASSWORD_FILE:-$skill_dir/.password}" + ssh_host="${HIGHGO_ONLINE_SSH_HOST:-root@124.243.245.42}" + ssh_port="${HIGHGO_ONLINE_SSH_PORT:-}" + psql_path="${HIGHGO_ONLINE_PSQL_PATH:-/opt/HighGo4.5.7-see/bin/psql}" + db_host="${HIGHGO_ONLINE_DB_HOST:-39.98.44.136}" + db_port="${HIGHGO_ONLINE_DB_PORT:-6023}" + db_name="${HIGHGO_ONLINE_DB_NAME:-highgo}" + db_user="${HIGHGO_ONLINE_DB_USER:-sysdba}" + ;; + test) + password_file="${HIGHGO_TEST_PASSWORD_FILE:-${HIGHGO_PASSWORD_FILE:-$skill_dir/.password}}" + ssh_host="${HIGHGO_TEST_SSH_HOST:-root@47.111.103.66}" + ssh_port="${HIGHGO_TEST_SSH_PORT:-22}" + psql_path="${HIGHGO_TEST_PSQL_PATH:-/opt/HighGo4.5.7-see/bin/psql}" + db_host="${HIGHGO_TEST_DB_HOST:-127.0.0.1}" + db_port="${HIGHGO_TEST_DB_PORT:-5866}" + db_name="${HIGHGO_TEST_DB_NAME:-highgo}" + db_user="${HIGHGO_TEST_DB_USER:-sysdba}" + ;; + *) + echo "Unknown environment: ${environment}" >&2 + echo "Usage: $0 [online|production|test] 'SELECT ...'" >&2 + exit 2 + ;; +esac if [[ ! -r "$password_file" ]]; then echo "HighGo password file is missing or unreadable: $password_file" >&2 @@ -17,7 +43,7 @@ if [[ ! -r "$password_file" ]]; then fi if [[ $# -eq 0 ]]; then - echo "Usage: $0 'SELECT ...'" >&2 + echo "Usage: $0 [online|production|test] 'SELECT ...'" >&2 exit 2 fi @@ -36,8 +62,19 @@ fi password="$(<"$password_file")" sql_base64="$(printf '%s' "$sql" | base64 | tr -d '\n')" +printf -v quoted_psql_path '%q' "$psql_path" +printf -v quoted_db_host '%q' "$db_host" +printf -v quoted_db_port '%q' "$db_port" +printf -v quoted_db_user '%q' "$db_user" +printf -v quoted_db_name '%q' "$db_name" + +ssh_args=(-o BatchMode=yes -o ConnectTimeout=10) +if [[ -n "${ssh_port}" ]]; then + ssh_args+=(-p "${ssh_port}") +fi + { printf '%s\n' "$password" printf '%s\n' "$sql_base64" -} | ssh -o BatchMode=yes -o ConnectTimeout=10 "$ssh_host" \ - "read -r PGPASSWORD; read -r SQL_BASE64; export PGPASSWORD; export PGOPTIONS='-c default_transaction_read_only=on -c search_path=shz,public -c statement_timeout=30000'; SQL=\$(printf '%s' \"\$SQL_BASE64\" | base64 -d); exec '$psql_path' -X --no-psqlrc -h '$db_host' -p '$db_port' -U '$db_user' -d '$db_name' -v ON_ERROR_STOP=1 -P pager=off -c \"\$SQL\"" +} | ssh "${ssh_args[@]}" "$ssh_host" \ + "read -r PGPASSWORD; read -r SQL_BASE64; export PGPASSWORD; export PGOPTIONS='-c default_transaction_read_only=on -c search_path=shz,public -c statement_timeout=30000'; SQL=\$(printf '%s' \"\$SQL_BASE64\" | base64 -d); exec ${quoted_psql_path} -X --no-psqlrc -h ${quoted_db_host} -p ${quoted_db_port} -U ${quoted_db_user} -d ${quoted_db_name} -v ON_ERROR_STOP=1 -P pager=off -c \"\$SQL\""