feat: 提交白名单配套——guard带GIT_ALLOW_COMMIT令牌 + hygiene新增钩子存在性检查

deploy/profile-scripts/deploy_guard.py

@@ -60,8 +60,10 @@ def xmpp(msg, level=None):
 
 
 def git(*args, check=True):
+    env = dict(os.environ)
+    env["GIT_ALLOW_COMMIT"] = "1"  # pre-commit 白名单令牌（知微无此令牌无法提交）
     r = subprocess.run(["git", "-C", REPO] + list(args),
-                       capture_output=True, text=True, timeout=60)
+                       capture_output=True, text=True, timeout=60, env=env)
     if check and r.returncode != 0:
         raise RuntimeError(f"git {' '.join(args)}: {r.stderr.strip()[:200]}")
     return r.stdout.strip()

deploy/profile-scripts/system_hygiene_audit.py

@@ -170,6 +170,21 @@ def check_orphan_files():
     return issues
 
 
+def check_commit_hook():
+    """提交白名单钩子存在性检查（2026-07-21 起：知微 git 写权限封锁的载体，
+    被删/被改 = 告警）"""
+    hook = f'{MOFIN_ROOT}/.git/hooks/pre-commit'
+    if not os.path.isfile(hook):
+        return [{'type': '安全机制缺失', 'file': hook,
+                 'action': 'pre-commit 提交白名单钩子丢失！知微封锁失效，立即恢复'}]
+    with open(hook, encoding='utf-8', errors='replace') as f:
+        content = f.read()
+    if 'GIT_ALLOW_COMMIT' not in content:
+        return [{'type': '安全机制异常', 'file': hook,
+                 'action': 'pre-commit 钩子内容被篡改（不含白名单令牌校验）'}]
+    return []
+
+
 def check_dead_cron():
     """cron job 指向不存在的脚本"""
     issues = []
@@ -280,7 +295,7 @@ def main():
     for name, fn in [('分叉副本', check_diverged), ('断裂硬链接', check_broken_hardlinks),
                      ('僵尸进程', check_zombies), ('孤儿文件', check_orphan_files),
                      ('死cron', check_dead_cron), ('DB新鲜度', check_db_freshness),
-                     ('指令冻结session', check_stale_sessions)]:
+                     ('指令冻结session', check_stale_sessions), ('提交白名单钩子', check_commit_hook)]:
         found = fn()
         status = f'❌ {len(found)}' if found else '✅'
         print(f'  {status} {name}')