feat: Agent CLI 与终端审计回放全面优化

- Agent CLI: 多轮对话、SSH 长连接、流式推理、Evolver 按用户隔离、历史侧栏
- 终端审计: 回放播放器、命令书签、筛选分页导出、命令输出统计、录制落盘修复
- 修复 session_commands 表迁移、Kill 竞态导致录制丢失、无录制会话回放提示
- 审计历史页只读（移除删除），移除回放弹框录制搜索

backend/controller/agent_install.go

@@ -1,6 +1,7 @@
 package controller
 
 import (
+	"context"
 	"fmt"
 	"log"
 	"net"
@@ -25,6 +26,56 @@ func NewAgentInstallHandler(db *gorm.DB) *AgentInstallHandler {
 	return &AgentInstallHandler{db: db}
 }
 
+// auditCtx 快照请求上下文（用户身份 + 来源 IP），用于在异步 goroutine 中安全记录审计 // Logan.Li
+// gin.Context 在请求返回后会被 gin 池复用，goroutine 内禁止直接访问 c，必须提前快照
+type auditCtx struct {
+	userID    uint
+	username  string
+	ip        string
+	userAgent string
+}
+
+// newAuditCtx 从 gin.Context 提取审计所需上下文快照 // Logan.Li
+func newAuditCtx(c *gin.Context) auditCtx {
+	uid, _ := c.Get("userID")
+	uname, _ := c.Get("username")
+	id, _ := uid.(uint)
+	name, _ := uname.(string)
+	return auditCtx{
+		userID:    id,
+		username:  name,
+		ip:        c.ClientIP(),
+		userAgent: c.Request.UserAgent(),
+	}
+}
+
+// truncateAuditText 截断过长输出，避免审计 Error 字段膨胀 // Logan.Li
+func truncateAuditText(s string, n int) string {
+	s = strings.TrimSpace(s)
+	if len(s) > n {
+		return s[:n] + "..."
+	}
+	return s
+}
+
+// recordAgentAudit 记录 Agent 安装/卸载/升级操作审计 // Logan.Li
+// status: 1=成功, 0=失败；errMsg 记录失败原因（SSH 错误、脚本输出等），用于追溯"安装过程遇到什么问题"
+func (h *AgentInstallHandler) recordAgentAudit(ac auditCtx, action, resource, resourceID string, status int, errMsg string) {
+	uid := ac.userID
+	h.db.Create(&model.AuditLog{
+		UserID:     &uid,
+		Username:   ac.username,
+		IP:         ac.ip,
+		UserAgent:  ac.userAgent,
+		Module:     "agent",
+		Action:     action,
+		Resource:   resource,
+		ResourceID: resourceID,
+		Status:     status,
+		Error:      errMsg,
+	})
+}
+
 // sshDial 复用 webshell.go 的 SSH 连接逻辑（TOFU HostKey 验证）
 func sshDial(server model.Server) (*ssh.Client, error) {
 	config := &ssh.ClientConfig{
@@ -54,16 +105,77 @@ func sshDial(server model.Server) (*ssh.Client, error) {
 	return ssh.Dial("tcp", addr, config)
 }
 
-// runSSHCommand 在远程主机执行命令并返回输出
+// runSSHCommand 在远程主机执行命令并返回输出（默认 60s 超时，防止 sudo 密码等待导致挂死）// Logan.Li
 func runSSHCommand(client *ssh.Client, cmd string) (string, error) {
+	return runSSHCommandWithTimeout(client, cmd, 60*time.Second)
+}
+
+// runSSHCommandWithTimeout 支持自定义超时
+func runSSHCommandWithTimeout(client *ssh.Client, cmd string, timeout time.Duration) (string, error) {
 	session, err := client.NewSession()
 	if err != nil {
 		return "", err
 	}
 	defer session.Close()
 
-	output, err := session.CombinedOutput(cmd)
-	return string(output), err
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+
+	type result struct {
+		output []byte
+		err    error
+	}
+	done := make(chan result, 1)
+	go func() {
+		out, err := session.CombinedOutput(cmd)
+		done <- result{output: out, err: err}
+	}()
+
+	select {
+	case <-ctx.Done():
+		session.Signal(ssh.SIGTERM)
+		return "", fmt.Errorf("命令执行超时(%s): %s", timeout, cmd)
+	case r := <-done:
+		return string(r.output), r.err
+	}
+}
+
+// installServerURL 根据请求构造后端可访问地址，兼容 Nginx 等反向代理 // Logan.Li
+func installServerURL(c *gin.Context) string {
+	scheme := "http"
+	if c.Request.TLS != nil {
+		scheme = "https"
+	}
+	if proto := c.GetHeader("X-Forwarded-Proto"); proto != "" {
+		scheme = proto
+	}
+	// 优先使用 X-Forwarded-Host（Nginx 暴露给客户端的真实域名），其次用 Host // Logan.Li
+	host := c.Request.Host
+	if fwd := c.GetHeader("X-Forwarded-Host"); fwd != "" {
+		host = fwd
+	}
+	// 去掉 scheme 的默认端口，避免生成 http://example.com:80 这类无效地址 // Logan.Li
+	if scheme == "http" && strings.HasSuffix(host, ":80") {
+		host = strings.TrimSuffix(host, ":80")
+	}
+	if scheme == "https" && strings.HasSuffix(host, ":443") {
+		host = strings.TrimSuffix(host, ":443")
+	}
+	return fmt.Sprintf("%s://%s", scheme, host)
+}
+
+// detectAgentVersion SSH 到目标主机读取已安装 Agent 的真实版本号 // Logan.Li
+func detectAgentVersion(client *ssh.Client) string {
+	verOut, _ := runSSHCommand(client, "/usr/local/bin/aiops-agent version 2>/dev/null || /usr/local/bin/aiops-agent -v 2>/dev/null || echo ''")
+	verOut = strings.TrimSpace(verOut)
+	// 输出形如: AIOps Agent v2.1.0 (built ...) go=go1.24...
+	if strings.HasPrefix(verOut, "AIOps Agent ") {
+		fields := strings.Fields(verOut)
+		if len(fields) >= 3 {
+			return fields[2]
+		}
+	}
+	return ""
 }
 
 // InstallAgent 远程安装 Agent 到指定服务器
@@ -98,6 +210,11 @@ func (h *AgentInstallHandler) InstallAgent(c *gin.Context) {
 		// 允许安装，不强制 running 状态
 	}
 
+	// 审计上下文 + 资源描述（同步流程，提前快照）// Logan.Li
+	ac := newAuditCtx(c)
+	resource := server.Hostname + " (" + server.IP + ")"
+	resourceID := strconv.Itoa(int(server.ID))
+
 	// 如果请求中提供了凭据，使用请求凭据覆盖服务器存储的凭据进行 SSH
 	effectiveServer := server
 	if req.Username != "" {
@@ -118,6 +235,7 @@ func (h *AgentInstallHandler) InstallAgent(c *gin.Context) {
 	client, err := sshDial(effectiveServer)
 	if err != nil {
 		log.Printf("[AgentInstall] SSH连接失败 %s: %v", server.IP, err)
+		h.recordAgentAudit(ac, "install", resource, resourceID, 0, "SSH连接失败: "+formatSSHError(err))
 		c.JSON(http.StatusOK, model.Response{
 			Code:    500,
 			Message: "SSH 连接失败: " + formatSSHError(err),
@@ -153,21 +271,35 @@ func (h *AgentInstallHandler) InstallAgent(c *gin.Context) {
 	}
 
 	// 3. 构造安装命令（使用 Agent API 服务地址）
-	// 从请求头获取后端可访问地址
-	serverURL := fmt.Sprintf("http://%s", c.Request.Host)
-	token := c.Query("token")
+	serverURL := installServerURL(c)
+	token := req.Token
+	if token == "" {
+		token = c.Query("token")
+	}
 
+	// 4. 构造安装命令：root 用户直接 bash，非 root 用 sudo -n（无密码才执行，避免挂死）// Logan.Li
 	installCmd := fmt.Sprintf(
-		`curl -fsSL %s/agent/install.sh | sudo bash -s -- --server %s --token %s`,
+		`if [ "$(id -u)" -eq 0 ]; then curl -fsSL %s/agent/install.sh | bash -s -- --server %s --token %s; else curl -fsSL %s/agent/install.sh | sudo -n bash -s -- --server %s --token %s; fi`,
+		serverURL, serverURL, token,
 		serverURL, serverURL, token,
 	)
 
-	// 4. 执行安装
+	// 5. 执行安装
 	installOut, err := runSSHCommand(client, installCmd)
 	if err != nil {
+		msg := "安装命令执行失败"
+		lowerOut := strings.ToLower(installOut)
+		if strings.Contains(lowerOut, "sudo: a password is required") || strings.Contains(lowerOut, "需要密码") {
+			msg = "目标主机 SSH 用户没有免密 sudo 权限，请使用 root 账号或配置 passwordless sudo"
+		} else if strings.Contains(lowerOut, "curl") && (strings.Contains(lowerOut, "not found") || strings.Contains(lowerOut, "未找到")) {
+			msg = "目标主机未安装 curl"
+		} else if strings.Contains(lowerOut, "下载失败") || strings.Contains(lowerOut, "failed to connect") || strings.Contains(lowerOut, "connection refused") {
+			msg = "目标主机无法下载安装脚本，请检查后端地址 " + serverURL + " 是否可达"
+		}
+		h.recordAgentAudit(ac, "install", resource, resourceID, 0, msg+": "+truncateAuditText(installOut, 300))
 		c.JSON(http.StatusOK, model.Response{
 			Code:    500,
-			Message: "安装命令执行失败（可能需要 sudo 权限或 curl 未安装）",
+			Message: msg,
 			Data:    installOut,
 		})
 		return
@@ -178,12 +310,22 @@ func (h *AgentInstallHandler) InstallAgent(c *gin.Context) {
 	installed := contains(verifyOut, "active") || contains(verifyOut, "running")
 
 	if installed {
-		// 更新服务器 Agent 状态（版本号：安装成功后由 Agent 下一次上报自动更新）
-		h.db.Model(&server).Updates(map[string]interface{}{
+		// 只更新在线状态；版本号仅在能读到真实版本时才写入，未上报时不写假版本（等 Agent 首次上报真实数据）// Logan.Li
+		updates := map[string]interface{}{
 			"agent_status":  "online",
-			"agent_version": "v0.1.0",
 			"last_check_at": time.Now(),
-		})
+		}
+		if agentVersion := detectAgentVersion(client); agentVersion != "" {
+			updates["agent_version"] = agentVersion
+		}
+		h.db.Model(&server).Updates(updates)
+	}
+
+	// 审计：成功或"命令已执行但服务未运行"均记录，便于追溯 // Logan.Li
+	if installed {
+		h.recordAgentAudit(ac, "install", resource, resourceID, 1, "")
+	} else {
+		h.recordAgentAudit(ac, "install", resource, resourceID, 0, "安装命令已执行但服务未检测到运行: "+truncateAuditText(verifyOut, 300))
 	}
 
 	c.JSON(http.StatusOK, model.Response{
@@ -214,7 +356,8 @@ func (h *AgentInstallHandler) installOne(server model.Server, serverURL, token s
 	// 不强制 server.Status==running：只要 SSH 可达即可安装（DB 状态可能滞后于实际开机状态） // Logan.Li
 
 	installCmd := fmt.Sprintf(
-		`curl -fsSL %s/agent/install.sh | sudo bash -s -- --server %s --token %s`,
+		`if [ "$(id -u)" -eq 0 ]; then curl -fsSL %s/agent/install.sh | bash -s -- --server %s --token %s; else curl -fsSL %s/agent/install.sh | sudo -n bash -s -- --server %s --token %s; fi`,
+		serverURL, serverURL, token,
 		serverURL, serverURL, token,
 	)
 
@@ -227,11 +370,15 @@ func (h *AgentInstallHandler) installOne(server model.Server, serverURL, token s
 	installed := contains(verifyOut, "active") || contains(verifyOut, "running")
 
 	if installed {
-		h.db.Model(&server).Updates(map[string]interface{}{
+		// 只更新在线状态；版本号仅在能读到真实版本时才写入，未上报时不写假版本 // Logan.Li
+		updates := map[string]interface{}{
 			"agent_status":  "online",
-			"agent_version": "v0.1.0",
 			"last_check_at": time.Now(),
-		})
+		}
+		if agentVersion := detectAgentVersion(client); agentVersion != "" {
+			updates["agent_version"] = agentVersion
+		}
+		h.db.Model(&server).Updates(updates)
 	}
 
 	return installed, installOut, verifyOut, nil
@@ -239,17 +386,25 @@ func (h *AgentInstallHandler) installOne(server model.Server, serverURL, token s
 
 // BatchInstallAgent 批量安装 Agent（异步执行，立即返回）// Logan.Li
 // POST /servers/install-agent
+// 支持传入临时凭据：key 为服务器 ID，首次连接成功后自动保存到服务器记录
 func (h *AgentInstallHandler) BatchInstallAgent(c *gin.Context) {
 	var req struct {
-		ServerIDs []uint `json:"server_ids"`
+		ServerIDs   []uint `json:"server_ids"`
+		Credentials map[string]struct {
+			Username string `json:"username"`
+			Password string `json:"password"`
+			SSHKey   string `json:"ssh_key"`
+			AuthType string `json:"auth_type"`
+		} `json:"credentials"`
 	}
 	if err := c.ShouldBindJSON(&req); err != nil || len(req.ServerIDs) == 0 {
 		c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "请提供要安装的服务器 ID 列表"})
 		return
 	}
 
-	serverURL := fmt.Sprintf("http://%s", c.Request.Host)
+	serverURL := installServerURL(c)
 	token := c.Query("token")
+	ac := newAuditCtx(c) // 提前快照上下文，goroutine 内不可再用 c // Logan.Li
 
 	// 异步执行：立即返回，后台 goroutine 逐台安装
 	go func() {
@@ -260,15 +415,39 @@ func (h *AgentInstallHandler) BatchInstallAgent(c *gin.Context) {
 				log.Printf("[BatchInstall] 服务器 %d 不存在，跳过", sid)
 				continue
 			}
-			installed, _, _, err := h.installOne(server, serverURL, token)
+
+			// 如果请求提供了该服务器的临时凭据，覆盖使用（不立即写入 DB，由 installOne 首次连接成功后保存） // Logan.Li
+			effectiveServer := server
+			if cred, ok := req.Credentials[fmt.Sprintf("%d", sid)]; ok {
+				if cred.Username != "" {
+					effectiveServer.Username = cred.Username
+				}
+				if cred.Password != "" {
+					effectiveServer.Password = cred.Password
+				}
+				if cred.SSHKey != "" {
+					effectiveServer.SSHKey = cred.SSHKey
+					effectiveServer.AuthType = "key"
+				}
+				if cred.AuthType != "" {
+					effectiveServer.AuthType = cred.AuthType
+				}
+			}
+
+			installed, _, verifyOut, err := h.installOne(effectiveServer, serverURL, token)
+			res := server.Hostname + " (" + server.IP + ")"
+			rid := strconv.Itoa(int(server.ID))
 			if err != nil {
 				log.Printf("[BatchInstall] %s (%s) 安装失败: %v", server.Hostname, server.IP, err)
+				h.recordAgentAudit(ac, "install", res, rid, 0, truncateAuditText(err.Error(), 500))
 			} else {
 				successCount++
 				if installed {
 					log.Printf("[BatchInstall] %s Agent 安装成功", server.Hostname)
+					h.recordAgentAudit(ac, "install", res, rid, 1, "")
 				} else {
 					log.Printf("[BatchInstall] %s Agent 安装命令已执行但服务未检测到运行", server.Hostname)
+					h.recordAgentAudit(ac, "install", res, rid, 0, "服务未检测到运行: "+truncateAuditText(verifyOut, 300))
 				}
 			}
 		}
@@ -310,17 +489,23 @@ func (h *AgentInstallHandler) UninstallAgent(c *gin.Context) {
 		return
 	}
 
+	ac := newAuditCtx(c) // Logan.Li
+	resource := server.Hostname + " (" + server.IP + ")"
+	resourceID := strconv.Itoa(int(server.ID))
+
 	// 无 SSH 凭据的主机（自动注册的）直接改本地状态；注意 SSH key 认证的主机 Password 为空但 SSHKey 非空，仍可远程卸载 // Logan.Li
 	if server.Username == "" || (server.Password == "" && server.SSHKey == "") {
 		h.db.Model(&server).Updates(map[string]interface{}{
 			"agent_status": "offline", "agent_version": "",
 		})
+		h.recordAgentAudit(ac, "uninstall", resource, resourceID, 1, "无SSH凭据，已标记离线")
 		c.JSON(http.StatusOK, model.Response{Code: 200, Message: "已标记为离线（该主机无SSH凭据，无法远程卸载，请手动执行 systemctl stop aiops-agent）"})
 		return
 	}
 
 	client, err := sshDial(server)
 	if err != nil {
+		h.recordAgentAudit(ac, "uninstall", resource, resourceID, 0, "SSH连接失败: "+formatSSHError(err))
 		c.JSON(http.StatusOK, model.Response{Code: 500, Message: "SSH连接失败: " + formatSSHError(err)})
 		return
 	}
@@ -331,6 +516,7 @@ func (h *AgentInstallHandler) UninstallAgent(c *gin.Context) {
 	h.db.Model(&server).Updates(map[string]interface{}{
 		"agent_status": "offline", "agent_version": "",
 	})
+	h.recordAgentAudit(ac, "uninstall", resource, resourceID, 1, "")
 
 	c.JSON(http.StatusOK, model.Response{Code: 200, Message: fmt.Sprintf("已卸载 %s (%s) 的 Agent", server.Hostname, server.IP)})
 }
@@ -346,6 +532,8 @@ func (h *AgentInstallHandler) BatchUninstallAgent(c *gin.Context) {
 		return
 	}
 
+	ac := newAuditCtx(c) // 提前快照上下文，goroutine 内不可再用 c // Logan.Li
+
 	// 异步执行：立即返回，后台逐台卸载
 	go func() {
 		successCount := 0
@@ -355,21 +543,26 @@ func (h *AgentInstallHandler) BatchUninstallAgent(c *gin.Context) {
 				log.Printf("[BatchUninstall] 服务器 %d 不存在，跳过", id)
 				continue
 			}
+			res := server.Hostname + " (" + server.IP + ")"
+			rid := strconv.Itoa(int(server.ID))
 			if server.Username == "" || (server.Password == "" && server.SSHKey == "") {
 				h.db.Model(&server).Updates(map[string]interface{}{"agent_status": "offline", "agent_version": ""})
 				log.Printf("[BatchUninstall] %s 无SSH凭据，已标记离线", server.Hostname)
+				h.recordAgentAudit(ac, "uninstall", res, rid, 1, "无SSH凭据，已标记离线")
 				successCount++
 				continue
 			}
 			client, err := sshDial(server)
 			if err != nil {
 				log.Printf("[BatchUninstall] %s SSH失败: %v", server.Hostname, err)
+				h.recordAgentAudit(ac, "uninstall", res, rid, 0, "SSH连接失败: "+formatSSHError(err))
 				continue
 			}
 			runSSHCommand(client, "systemctl stop aiops-agent 2>/dev/null; systemctl disable aiops-agent 2>/dev/null; rm -f /usr/local/bin/aiops-agent /etc/systemd/system/aiops-agent.service; systemctl daemon-reload 2>/dev/null")
 			client.Close()
 			h.db.Model(&server).Updates(map[string]interface{}{"agent_status": "offline", "agent_version": ""})
 			log.Printf("[BatchUninstall] %s Agent 已卸载", server.Hostname)
+			h.recordAgentAudit(ac, "uninstall", res, rid, 1, "")
 			successCount++
 		}
 		log.Printf("[BatchUninstall] 批量卸载完成: %d/%d 成功", successCount, len(req.ServerIDs))
@@ -393,7 +586,8 @@ func (h *AgentInstallHandler) BatchUpgradeAgent(c *gin.Context) {
 		return
 	}
 
-	serverURL := fmt.Sprintf("http://%s", c.Request.Host)
+	serverURL := installServerURL(c)
+	ac := newAuditCtx(c) // 提前快照上下文，goroutine 内不可再用 c // Logan.Li
 
 	// 异步执行：立即返回，后台逐台升级
 	go func() {
@@ -409,10 +603,14 @@ func (h *AgentInstallHandler) BatchUpgradeAgent(c *gin.Context) {
 				continue
 			}
 
+			res := server.Hostname + " (" + server.IP + ")"
+			rid := strconv.Itoa(int(server.ID))
+
 			// 检测架构
 			client, err := sshDial(server)
 			if err != nil {
 				log.Printf("[BatchUpgrade] %s SSH连接失败: %v", server.Hostname, err)
+				h.recordAgentAudit(ac, "upgrade", res, rid, 0, "SSH连接失败: "+formatSSHError(err))
 				continue
 			}
 
@@ -424,7 +622,7 @@ func (h *AgentInstallHandler) BatchUpgradeAgent(c *gin.Context) {
 
 			// 下载新二进制 + 获取版本号 + 重启服务
 			upgradeScript := fmt.Sprintf(
-				`curl -fsSL -o /tmp/aiops-agent %s/api/agent/bin/%s && chmod +x /tmp/aiops-agent && systemctl stop aiops-agent 2>/dev/null; mv /tmp/aiops-agent /usr/local/bin/aiops-agent && systemctl start aiops-agent; ver=$(/usr/local/bin/aiops-agent output 2>/dev/null | grep 'agent.version' | awk -F'[|[|]' '{print $2}' | tr -d ' '); echo "UPGRADE_OK ver=$ver"`,
+				`curl -fsSL -o /tmp/aiops-agent %s/api/agent/bin/%s && chmod +x /tmp/aiops-agent && systemctl stop aiops-agent 2>/dev/null; mv /tmp/aiops-agent /usr/local/bin/aiops-agent && systemctl start aiops-agent; ver=$(/usr/local/bin/aiops-agent version 2>/dev/null | awk '/AIOps Agent/{print $3}'); echo "UPGRADE_OK ver=$ver"`,
 				serverURL, binaryFile,
 			)
 
@@ -433,6 +631,7 @@ func (h *AgentInstallHandler) BatchUpgradeAgent(c *gin.Context) {
 
 			if err != nil || !contains(out, "UPGRADE_OK") {
 				log.Printf("[BatchUpgrade] %s 升级失败: output=%s err=%v", server.Hostname, out, err)
+				h.recordAgentAudit(ac, "upgrade", res, rid, 0, "升级失败: "+truncateAuditText(out, 300))
 				continue
 			}
 
@@ -448,6 +647,7 @@ func (h *AgentInstallHandler) BatchUpgradeAgent(c *gin.Context) {
 				"last_check_at": time.Now(),
 			})
 			log.Printf("[BatchUpgrade] %s Agent 升级成功", server.Hostname)
+			h.recordAgentAudit(ac, "upgrade", res, rid, 1, "")
 			successCount++
 		}
 		log.Printf("[BatchUpgrade] 批量升级完成: %d/%d 成功", successCount, len(req.ServerIDs))