fix(hub): 修复 Hub 部署脚本失败处理

hub/deploy/install_service.sh

@@ -16,6 +16,7 @@ HOST="${HOST:-127.0.0.1}"
 PORT="${PORT:-8788}"
 ENV_FILE="${ENV_FILE:-$BASE/.secrets/platform.env}"
 NODE_BIN="${NODE_BIN:-$(command -v node || true)}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 if [ -z "$NODE_BIN" ]; then
   echo "node must be on PATH, or set NODE_BIN." >&2
@@ -29,6 +30,10 @@ if [ ! -f "$HUB_DIR/dist/server.js" ]; then
   echo "build missing: run 'npm ci && npm run build' in $HUB_DIR first." >&2
   exit 1
 fi
+if [ ! -f "$SCRIPT_DIR/cph-hub.service" ]; then
+  echo "service template missing: $SCRIPT_DIR/cph-hub.service" >&2
+  exit 1
+fi
 
 # Seed the env file if absent. Secrets stay on the server, never in the repo.
 if [ ! -f "$ENV_FILE" ]; then
@@ -47,18 +52,23 @@ FEISHU_BOT_OPEN_ID=
 PORT=$PORT
 HOST=$HOST
 EOF
+  chmod 0600 "$ENV_FILE"
   echo "Seeded $ENV_FILE — edit it to fill in ANTHROPIC_AUTH_TOKEN and Feishu creds, then re-run."
   exit 0
 fi
 
 # Render the unit with concrete paths.
 UNIT=/etc/systemd/system/cph-hub.service
+TMP_UNIT="$(mktemp)"
 sed \
   -e "s|__SERVICE_USER__|$SERVICE_USER|g" \
   -e "s|__HUB_DIR__|$HUB_DIR|g" \
   -e "s|__BASE_DIR__|$BASE|g" \
   -e "s|__ENV_FILE__|$ENV_FILE|g" \
   -e "s|__NODE_BIN__|$NODE_BIN|g" \
+  "$SCRIPT_DIR/cph-hub.service" >"$TMP_UNIT"
+install -m 0644 "$TMP_UNIT" "$UNIT"
+rm -f "$TMP_UNIT"
 
 systemctl daemon-reload
 systemctl enable cph-hub.service