Bookworm Portable boot scripts v1.1

This commit is contained in:
leesu 2026-04-01 12:47:44 +08:00
commit 5c005e8850
3 changed files with 498 additions and 0 deletions

51
README.txt Normal file
View File

@ -0,0 +1,51 @@
Bookworm Portable v1.1 - 纯云端便携部署工具包
================================================
=== 文件说明 ===
deploy-gitea.sh ECS Gitea 部署 (服务端,执行一次)
prepare-repo.ps1 仓库准备 (本机执行一次)
encrypt-secrets.ps1 凭证加密 (本机执行一次)
settings.template.json settings.json 模板
settings.local.template.json settings.local.json 模板 (权限白名单)
install.ps1 安装/启动 (目标机执行)
stop.ps1 清理/卸载 (目标机执行)
=== 一次性部署 ===
步骤 1: 部署 Gitea (ECS)
> scp deploy-gitea.sh root@8.138.11.105:/tmp/
> ssh root@8.138.11.105 "GITEA_ADMIN_PASS='你的密码' bash /tmp/deploy-gitea.sh"
> 登录 http://8.138.11.105:3000 创建两个私有仓库:
- bookworm-config (系统文件)
- bookworm-boot (引导脚本+加密凭证)
步骤 2: 推送 Bookworm 配置
> .\prepare-repo.ps1 -GitUrl "http://8.138.11.105:3000/leesu/bookworm-config.git"
步骤 3: 加密凭证
> .\encrypt-secrets.ps1
> (输入中转站 API Key + MCP 凭证 + 设置主密码,至少 12 位)
步骤 4: 推送 boot 仓库
> 将 install.ps1, stop.ps1, secrets.enc 推送到 bookworm-boot 仓库
=== 目标机使用 ===
安装: .\install.ps1
清理: .\stop.ps1
恢复: .\stop.ps1 -Restore
深度: .\stop.ps1 -Deep
=== 目标机要求 ===
[必须] Claude Code, Node.js >= 18, Git
[可选] Python 3.x, openssl (Git for Windows 自带)
=== 安全规格 ===
加密: AES-256-CBC + PBKDF2 (600000 迭代, OWASP 2023)
凭证: 仅进程级环境变量,不写磁盘/注册表
Gitea: INSTALL_LOCK=true, 注册关闭, 管理员 CLI 创建
密码: openssl stdin 管道传入,不暴露在进程列表
校验: Gitea 二进制 SHA256 完整性校验

302
install.ps1 Normal file
View File

@ -0,0 +1,302 @@
<#
.SYNOPSIS
Bookworm Portable - 安装/启动脚本
.DESCRIPTION
Gitea 私有仓克隆 Bookworm 配置到目标机,
解密凭证, 渲染模板, 启动 Claude Code.
.USAGE
# 首次安装 (从 Gitea 克隆)
.\install.ps1
# 仅启动 (已安装过)
.\install.ps1 -StartOnly
# 指定 Gitea 地址
.\install.ps1 -GitUrl "http://8.138.11.105:3000/leesu/bookworm-config.git"
#>
param(
[string]$GitUrl = "https://code.letcareme.com/leesu/bookworm-config.git",
[switch]$StartOnly,
[switch]$SkipSecrets
)
$ErrorActionPreference = "Stop"
# ─── 路径定义 ────────────────────────────────────────
$ScriptDir = if ($MyInvocation.MyCommand.Path) {
Split-Path -Parent $MyInvocation.MyCommand.Path
} else { $PWD.Path }
$ClaudeTarget = Join-Path $env:USERPROFILE ".claude"
$BackupPath = Join-Path $env:USERPROFILE ".claude.bw-backup"
$SecretsEnc = Join-Path $ScriptDir "secrets.enc"
$TemplateFile = Join-Path $ClaudeTarget "settings.template.json"
$LocalTplFile = Join-Path $ClaudeTarget "settings.local.template.json"
$SettingsFile = Join-Path $ClaudeTarget "settings.json"
$LocalSetFile = Join-Path $ClaudeTarget "settings.local.json"
$DebugDir = Join-Path $ClaudeTarget "debug"
# ─── openssl 检测 ────────────────────────────────────
$opensslCmd = (Get-Command openssl -ErrorAction SilentlyContinue)?.Source
if (-not $opensslCmd) {
$gitOpenssl = "C:\Program Files\Git\usr\bin\openssl.exe"
if (Test-Path $gitOpenssl) { $opensslCmd = $gitOpenssl }
}
# ─── 辅助函数 ────────────────────────────────────────
function Write-Banner {
Write-Host ""
Write-Host " ╔══════════════════════════════════════════╗" -ForegroundColor Cyan
Write-Host " ║ Bookworm Portable Installer v1.1 ║" -ForegroundColor Cyan
Write-Host " ╚══════════════════════════════════════════╝" -ForegroundColor Cyan
Write-Host ""
}
function Test-Command($cmd) {
return [bool](Get-Command $cmd -ErrorAction SilentlyContinue)
}
function Decrypt-Secrets {
if ($SkipSecrets -or -not (Test-Path $SecretsEnc)) {
Write-Host " [!] 跳过凭证解密 (无 secrets.enc)" -ForegroundColor Yellow
return
}
if (-not $opensslCmd) {
Write-Host " [!] openssl 未找到,跳过凭证解密" -ForegroundColor Yellow
return
}
$password = Read-Host " 输入主密码解密凭证" -AsSecureString
$bstr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($password)
$plainPwd = [System.Runtime.InteropServices.Marshal]::PtrToStringBSTR($bstr)
try {
# 通过 stdin 传入密码,避免进程列表泄露
$decrypted = $plainPwd | & $opensslCmd enc -aes-256-cbc -d -pbkdf2 -iter 600000 -in $SecretsEnc -pass stdin 2>&1
if ($LASTEXITCODE -ne 0) {
throw "解密失败,密码错误?"
}
# 使用 IndexOf 正确分割 key=value (value 中可能含 = 号)
$decrypted -split "`n" | ForEach-Object {
$line = $_.Trim()
if ($line -and $line.Contains('=')) {
$eqIdx = $line.IndexOf('=')
$key = $line.Substring(0, $eqIdx).Trim()
$val = $line.Substring($eqIdx + 1).Trim()
[System.Environment]::SetEnvironmentVariable($key, $val, "Process")
Write-Host " [OK] 已注入: $key" -ForegroundColor Green
}
}
}
catch {
Write-Host " [ERROR] 凭证解密失败: $_" -ForegroundColor Red
# 检查关键凭证是否存在
if (-not $env:ANTHROPIC_API_KEY) {
Write-Host " [WARN] ANTHROPIC_API_KEY 未设置Claude Code 可能无法使用中转站" -ForegroundColor Yellow
$continue = Read-Host " 继续启动? (y/n)"
if ($continue -ne 'y') { exit 1 }
}
}
finally {
$plainPwd = $null
[System.Runtime.InteropServices.Marshal]::ZeroFreeBSTR($bstr)
}
}
function Render-SettingsTemplate {
if (-not (Test-Path $TemplateFile)) {
Write-Host " [!] 未找到 settings.template.json跳过渲染" -ForegroundColor Yellow
return
}
$claudeRoot = $ClaudeTarget.Replace('\', '/')
# HOME 保留反斜杠格式,与 Claude Code 原始行为一致
$homeDir = $env:USERPROFILE
$content = Get-Content $TemplateFile -Raw
$content = $content -replace '\{\{CLAUDE_ROOT\}\}', $claudeRoot
$content = $content -replace '\{\{HOME\}\}', ($homeDir -replace '\\', '\\')
Set-Content $SettingsFile -Value $content -Encoding UTF8
Write-Host " [OK] settings.json 已渲染 (ROOT=$claudeRoot)" -ForegroundColor Green
# 渲染 settings.local.template.json (如果存在)
if (Test-Path $LocalTplFile) {
$localContent = Get-Content $LocalTplFile -Raw
$localContent = $localContent -replace '\{\{CLAUDE_ROOT\}\}', $claudeRoot
$localContent = $localContent -replace '\{\{HOME\}\}', ($homeDir -replace '\\', '\\')
$localContent = $localContent -replace '\{\{USERNAME\}\}', $env:USERNAME
Set-Content $LocalSetFile -Value $localContent -Encoding UTF8
Write-Host " [OK] settings.local.json 已渲染" -ForegroundColor Green
}
}
# ─── 主流程 ──────────────────────────────────────────
Write-Banner
# 步骤 0: 前置检查
Write-Host "[0/5] 前置检查..." -ForegroundColor White
$checks = @(
@{ Name = "Claude Code"; OK = (Test-Command "claude") }
@{ Name = "Node.js"; OK = (Test-Command "node") }
@{ Name = "Git"; OK = (Test-Command "git") }
)
foreach ($c in $checks) {
$icon = if ($c.OK) { "[OK]" } else { "[!!]" }
$color = if ($c.OK) { "Green" } else { "Red" }
Write-Host " $icon $($c.Name)" -ForegroundColor $color
}
if (-not (Test-Command "claude")) {
Write-Host "`n [ABORT] Claude Code 未安装,请先安装后重试" -ForegroundColor Red
exit 1
}
if (-not (Test-Command "node")) {
Write-Host "`n [ABORT] Node.js 未安装Bookworm Hooks 无法运行" -ForegroundColor Red
exit 1
}
# 步骤 1: 解密凭证 (进程级环境变量,不写磁盘)
Write-Host "`n[1/6] 解密凭证..." -ForegroundColor White
Decrypt-Secrets
# 步骤 2: 克隆/更新仓库
if (-not $StartOnly) {
Write-Host "`n[2/6] 同步 Bookworm 配置..." -ForegroundColor White
if (Test-Path $ClaudeTarget) {
$isGit = Test-Path (Join-Path $ClaudeTarget ".git")
if ($isGit) {
Write-Host " 已有仓库,执行 git pull..."
Push-Location $ClaudeTarget
try {
# stash 本地修改,防止 rebase 冲突
$stashOutput = git stash 2>&1
$hasStash = $stashOutput -notmatch "No local changes"
git pull --rebase 2>&1 | ForEach-Object { Write-Host " $_" }
if ($hasStash) {
git stash pop 2>&1 | ForEach-Object { Write-Host " $_" }
}
}
catch {
Write-Host " [WARN] git pull 失败: $_" -ForegroundColor Yellow
Write-Host " 使用本地现有版本继续" -ForegroundColor Yellow
}
finally { Pop-Location }
}
else {
# 安全克隆: 先克隆到临时目录,成功后再替换
Write-Host " 备份现有 .claude/ 并克隆..."
$tempClone = "$ClaudeTarget.bw-clone-temp"
try {
if (Test-Path $tempClone) { Remove-Item $tempClone -Recurse -Force }
git clone --depth 1 $GitUrl $tempClone 2>&1 | ForEach-Object { Write-Host " $_" }
# 克隆成功,执行替换
if (Test-Path $BackupPath) { Remove-Item $BackupPath -Recurse -Force }
Rename-Item $ClaudeTarget $BackupPath
Rename-Item $tempClone $ClaudeTarget
Write-Host " [OK] 克隆完成,原始配置已备份到 .claude.bw-backup/" -ForegroundColor Green
}
catch {
Write-Host " [ERROR] 克隆失败: $_" -ForegroundColor Red
if (Test-Path $tempClone) { Remove-Item $tempClone -Recurse -Force -ErrorAction SilentlyContinue }
Write-Host " 原始 .claude/ 未被修改" -ForegroundColor Yellow
exit 1
}
}
}
else {
Write-Host " 首次安装,克隆仓库..."
try {
git clone --depth 1 $GitUrl $ClaudeTarget 2>&1 | ForEach-Object { Write-Host " $_" }
if (-not (Test-Path (Join-Path $ClaudeTarget "CLAUDE.md"))) {
throw "克隆完成但缺少 CLAUDE.md"
}
}
catch {
Write-Host " [ERROR] 克隆失败: $_" -ForegroundColor Red
Write-Host ""
Write-Host " 可能原因:" -ForegroundColor Yellow
Write-Host " - Gitea 服务不可达 (检查 https://code.letcareme.com)" -ForegroundColor Yellow
Write-Host " - 网络连接问题 (检查 DNS 和防火墙)" -ForegroundColor Yellow
Write-Host " - Git 凭证错误 (检查用户名密码)" -ForegroundColor Yellow
Write-Host ""
Write-Host " 离线模式: 如有本地 .claude 备份,运行:" -ForegroundColor Gray
Write-Host " Copy-Item .claude.bw-backup .claude -Recurse" -ForegroundColor Gray
exit 1
}
}
}
else {
Write-Host "`n[2/6] StartOnly 模式,跳过同步" -ForegroundColor Gray
}
# 步骤 3: 完整性校验
$integrityFile = Join-Path $ClaudeTarget "integrity.sha256"
if (Test-Path $integrityFile) {
Write-Host "`n[3/6] 完整性校验..." -ForegroundColor White
$failures = @()
Get-Content $integrityFile | ForEach-Object {
if ($_ -match '^([a-f0-9]{64})\s+(.+)$') {
$expectedHash = $Matches[1]
$filePath = Join-Path $ClaudeTarget $Matches[2]
if (Test-Path $filePath) {
$actualHash = (Get-FileHash $filePath -Algorithm SHA256).Hash.ToLower()
if ($actualHash -ne $expectedHash) {
$failures += $Matches[2]
}
}
}
}
if ($failures.Count -gt 0) {
Write-Host " [WARN] 以下文件哈希不匹配:" -ForegroundColor Yellow
$failures | ForEach-Object { Write-Host " $_" -ForegroundColor Yellow }
Write-Host " 可能原因: 仓库内容被修改或本地有改动" -ForegroundColor Yellow
$continue = Read-Host " 继续? (y/n)"
if ($continue -ne 'y') { exit 1 }
} else {
Write-Host " [OK] 所有文件完整性校验通过" -ForegroundColor Green
}
} else {
Write-Host "`n[3/6] 跳过完整性校验 (无 integrity.sha256)" -ForegroundColor Gray
}
# 步骤 4: 渲染 settings.json
Write-Host "`n[4/6] 渲染配置模板..." -ForegroundColor White
Render-SettingsTemplate
# 步骤 5: 确保必要目录存在
Write-Host "`n[5/6] 初始化本地目录..." -ForegroundColor White
$localDirs = @("debug", "sessions", "cache", "backups", "telemetry", "shell-snapshots", "projects", "memory")
foreach ($d in $localDirs) {
$dirPath = Join-Path $ClaudeTarget $d
if (-not (Test-Path $dirPath)) {
New-Item -ItemType Directory -Path $dirPath -Force | Out-Null
Write-Host " 创建: $d/" -ForegroundColor Gray
}
}
# 设置环境变量 (进程级)
$env:CLAUDE_HOME = $ClaudeTarget
Write-Host " [OK] CLAUDE_HOME=$ClaudeTarget" -ForegroundColor Green
# 验证环境变量传递
$nodeCheck = & node -e "console.log(process.env.CLAUDE_HOME || 'NOT_SET')" 2>$null
if ($nodeCheck -eq $ClaudeTarget) {
Write-Host " [OK] Node.js 环境变量传递验证通过" -ForegroundColor Green
} else {
Write-Host " [WARN] Node.js 环境变量传递异常hooks 可能无法正确解析路径" -ForegroundColor Yellow
}
# 步骤 6: 启动 Claude Code
Write-Host "`n[6/6] 启动 Claude Code..." -ForegroundColor White
Write-Host ""
Write-Host " ╔══════════════════════════════════════════╗" -ForegroundColor Green
Write-Host " ║ Bookworm 就绪! 正在启动 Claude Code... ║" -ForegroundColor Green
Write-Host " ╚══════════════════════════════════════════╝" -ForegroundColor Green
Write-Host ""
& claude

145
stop.ps1 Normal file
View File

@ -0,0 +1,145 @@
<#
.SYNOPSIS
Bookworm Portable - 清理/卸载脚本
.DESCRIPTION
清除环境变量, 恢复原始 .claude 目录, 清理痕迹.
.USAGE
.\stop.ps1 # 标准清理 (保留 Bookworm 配置)
.\stop.ps1 -Restore # 完整恢复 (删除 Bookworm, 恢复备份)
.\stop.ps1 -Deep # 深度清理 (含 PS 历史)
#>
param(
[switch]$Restore,
[switch]$Deep
)
$ClaudeTarget = Join-Path $env:USERPROFILE ".claude"
$BackupPath = Join-Path $env:USERPROFILE ".claude.bw-backup"
Write-Host ""
Write-Host " Bookworm Portable - 清理" -ForegroundColor Cyan
Write-Host " ========================" -ForegroundColor Cyan
Write-Host ""
# 1. 终止 Claude Code 及 Node.js 子进程
$claudeProcs = Get-Process | Where-Object { $_.ProcessName -in @("claude", "claude-code") } -ErrorAction SilentlyContinue
if ($claudeProcs) {
Write-Host "[1/5] 终止 Claude Code 进程..." -ForegroundColor Yellow
$claudeProcs | Stop-Process -Force
Start-Sleep -Seconds 3
# 清理残留 node 子进程 (hooks)
Get-Process node -ErrorAction SilentlyContinue | Where-Object {
$_.CommandLine -match '\.claude[\\/]hooks'
} | Stop-Process -Force -ErrorAction SilentlyContinue
Write-Host " [OK] 进程已终止" -ForegroundColor Green
}
else {
Write-Host "[1/5] 无 Claude Code 进程运行" -ForegroundColor Gray
}
# 2. 清除进程级环境变量
Write-Host "[2/4] 清除环境变量..." -ForegroundColor White
$envVars = @(
"CLAUDE_HOME", "CLAUDE_ROOT", "ANTHROPIC_API_KEY",
"ANTHROPIC_BASE_URL", "SUPABASE_ACCESS_TOKEN",
"GITHUB_PERSONAL_ACCESS_TOKEN", "SLACK_BOT_TOKEN",
"ATLASSIAN_API_TOKEN", "BROWSERBASE_API_KEY",
"FIRECRAWL_API_KEY"
)
foreach ($v in $envVars) {
if ([System.Environment]::GetEnvironmentVariable($v, "Process")) {
[System.Environment]::SetEnvironmentVariable($v, $null, "Process")
Write-Host " 清除: $v" -ForegroundColor Gray
}
}
Write-Host " [OK] 环境变量已清除" -ForegroundColor Green
# 3. 清除 Git 凭证缓存
Write-Host "[3/5] 清除 Git 凭证缓存..." -ForegroundColor White
$gitCredTargets = @("git:https://code.letcareme.com", "git:http://8.138.11.105", "git:https://8.138.11.105")
foreach ($target in $gitCredTargets) {
$exists = cmdkey /list 2>$null | Select-String $target
if ($exists) {
cmdkey /delete:$target 2>$null
Write-Host " 清除: $target" -ForegroundColor Gray
}
}
# 通过 git credential reject 清除缓存
@("code.letcareme.com", "8.138.11.105") | ForEach-Object {
@"
protocol=https
host=$_
"@ | git credential reject 2>$null
}
Write-Host " [OK] Git 凭证已清除" -ForegroundColor Green
# 4. 恢复备份 (如果请求)
if ($Restore) {
Write-Host "[4/5] 恢复原始 .claude 目录..." -ForegroundColor White
if (Test-Path $BackupPath) {
if (Test-Path $ClaudeTarget) {
$retries = 3
while ($retries -gt 0) {
try {
Remove-Item $ClaudeTarget -Recurse -Force -ErrorAction Stop
break
} catch {
$retries--
if ($retries -gt 0) {
Write-Host " 文件占用,等待重试... ($retries)" -ForegroundColor Yellow
Start-Sleep 3
} else {
Write-Host " [ERROR] 无法删除 .claude可能有文件被占用" -ForegroundColor Red
Write-Host " 请关闭所有 Node.js/Claude 进程后重试" -ForegroundColor Yellow
exit 1
}
}
}
Write-Host " 已删除 Bookworm 配置" -ForegroundColor Gray
}
Rename-Item $BackupPath $ClaudeTarget
Write-Host " [OK] 原始 .claude 已恢复" -ForegroundColor Green
}
else {
Write-Host " [!] 无备份可恢复 (.claude.bw-backup 不存在)" -ForegroundColor Yellow
}
}
else {
Write-Host "[4/5] 保留 Bookworm 配置 (使用 -Restore 可恢复原始)" -ForegroundColor Gray
}
# 5. 深度清理 (可选)
if ($Deep) {
Write-Host "[5/5] 深度清理..." -ForegroundColor White
# 清除 PowerShell 历史
$histFile = Join-Path $env:APPDATA "Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt"
if (Test-Path $histFile) {
# 仅删除含 bookworm/secrets/api_key 的行
$lines = Get-Content $histFile
$cleaned = $lines | Where-Object {
$_ -notmatch 'secrets\.enc|ANTHROPIC_API_KEY|api[_-]?key|bookworm-portable'
}
Set-Content $histFile -Value $cleaned
Write-Host " [OK] PS 历史已清理敏感条目" -ForegroundColor Green
}
# 清除 Claude Code 本地缓存
$cacheDir = Join-Path $env:LOCALAPPDATA "claude-code"
if (Test-Path $cacheDir) {
Write-Host " 发现本地缓存: $cacheDir" -ForegroundColor Yellow
Write-Host " (手动决定是否删除)" -ForegroundColor Yellow
}
Write-Host " [OK] 深度清理完成" -ForegroundColor Green
}
else {
Write-Host "[5/5] 跳过深度清理 (使用 -Deep 可清理 PS 历史)" -ForegroundColor Gray
}
Write-Host ""
Write-Host " ╔══════════════════════════════════════════╗" -ForegroundColor Green
Write-Host " ║ Bookworm 已清理完毕 ║" -ForegroundColor Green
Write-Host " ╚══════════════════════════════════════════╝" -ForegroundColor Green
Write-Host ""