fix(security): migrate internal service token

scripts/deploy.sh

@@ -442,6 +442,8 @@ ok "config/secrets.env 已写入 (chmod 600)"
 # secrets.env，安装输出和交付文档均不得展示其内容。
 # shellcheck disable=SC1091
 . "$ROOT_DIR/scripts/lib.sh"
+ensure_internal_service_token "$ROOT_DIR/config/secrets.env" \
+  || fail "内部服务令牌初始化失败"
 ensure_sdk_config_signing_keypair "$ROOT_DIR/config/secrets.env" \
   || fail "SDK 配置签名密钥初始化失败"
 ok "SDK 配置签名密钥已生成"

scripts/lib.sh

@@ -105,6 +105,28 @@ ensure_env_value() {
   fi
 }
 
+ensure_internal_service_token() {
+  local secrets_file="${1:-$ROOT_DIR/config/secrets.env}"
+  local current generated
+
+  if [ ! -f "$secrets_file" ]; then
+    mkdir -p "$(dirname "$secrets_file")"
+    cp "$ROOT_DIR/config/secrets.env.example" "$secrets_file"
+  fi
+  current="$(grep '^SDK_INTERNAL_TOKEN=' "$secrets_file" 2>/dev/null | cut -d= -f2- || true)"
+  if [ -n "$current" ] && [ "$current" != "xuqm-internal-token" ] && [ "$current" != "change-me" ]; then
+    return 0
+  fi
+
+  generated="$(random_secret)"
+  [ -n "$generated" ] || {
+    printf '生成内部服务令牌失败\n' >&2
+    return 1
+  }
+  set_env_value "$secrets_file" "SDK_INTERNAL_TOKEN" "$generated"
+  chmod 600 "$secrets_file" || true
+}
+
 ensure_sdk_config_signing_keypair() {
   local secrets_file="${1:-$ROOT_DIR/config/secrets.env}"
   local private_key public_key key_id key_dir

scripts/reset.sh

@@ -105,6 +105,9 @@ fi
 # reset 也可能是旧部署升级后的首次入口，必须补齐服务启动所需的签名信任根。
 # shellcheck disable=SC1091
 . "$ROOT_DIR/scripts/lib.sh"
+ensure_internal_service_token "$ROOT_DIR/config/secrets.env" \
+  || fail "内部服务令牌初始化失败"
+ok "内部服务令牌已就绪"
 ensure_sdk_config_signing_keypair "$ROOT_DIR/config/secrets.env" \
   || fail "SDK 配置签名密钥初始化失败"
 ok "SDK 配置签名密钥已就绪"

scripts/update.sh

@@ -162,6 +162,9 @@ fi
 # 生成一次并永久保留；只存在半套配置时拒绝自动轮换，避免已签发配置突然失效。
 # shellcheck disable=SC1091
 . "$ROOT_DIR/scripts/lib.sh"
+ensure_internal_service_token "$ROOT_DIR/config/secrets.env" \
+  || fail "内部服务令牌初始化失败"
+ok "内部服务令牌已就绪"
 ensure_sdk_config_signing_keypair "$ROOT_DIR/config/secrets.env" \
   || fail "SDK 配置签名密钥初始化失败"
 ok "SDK 配置签名密钥已就绪"