fix(ops): stop hardcoding DB passwords and URL-embed git tokens

Load backup credentials from env/secrets files and push via a temporary credential helper so tokens never appear in process listings.

Co-authored-by: Cursor <cursoragent@cursor.com>

.doc/ops/CURRENT.md

@@ -17,8 +17,8 @@
 | Cursor-Auto | 2026-09-20-p0-hotfixes（Wave 0 文档） | docs/p0-triage-2026-09-20 | - | docs | done |
 | Cursor-Auto | 2026-09-20-p0-capability-00058 | fix/capability-merge-00058-2026-09-20 | - | infra+chat | done |
 | Cursor-Auto | 2026-09-20-p0-idor | fix/authz-idor-hotfixes-2026-09-20 | - | authz | done |
-| Cursor-Auto | 2026-09-20-p0-runtime-stability | fix/runtime-panic-races-2026-09-20 | - | taskrun+chat+web | in_progress |
+| Cursor-Auto | 2026-09-20-p0-runtime-stability | fix/runtime-panic-races-2026-09-20 | - | taskrun+chat+web | done |
-| Cursor-Auto | 2026-09-20-p0-credentials | fix/credential-hardening-2026-09-20 | - | ops+infra | planned |
+| Cursor-Auto | 2026-09-20-p0-credentials | fix/credential-hardening-2026-09-20 | - | ops+infra | in_progress |
 | Cursor-Auto | 2026-09-20-proposed-authoritative-reports | feature/capability-enablement-impact-plan | - | docgov | done |
 | Cursor-Auto | 2026-09-20-pi-narrative-clipped-diff | feature/capability-enablement-impact-plan | - | docgov | done |
 | Cursor-Auto | 2026-09-20-pi-reasoning-profile | feature/capability-enablement-impact-plan | - | pi-agent | done |
@@ -165,7 +165,7 @@
 
 | holder | phase | since | scope | queue |
 |--------|-------|-------|-------|-------|
-| Cursor-Auto | merging | 2026-09-20 | fix/runtime-panic-races | fix/credential-hardening |
+| Cursor-Auto | merging | 2026-09-20 | fix/credential-hardening | - |
 
 **phase**: `idle` | `merging` | `smoke` | `e2e`
 
@@ -177,7 +177,7 @@
 |------|------|--------|------|
 | dev | 8080 | **58** | healthy（`chat_summaries` 已落地；`pi-agent`；events `:8088`） |
 | test | 8081 | **57** | healthy（含 triage `00057`；分支树最高仍可能为 56——晋升前须对齐；events `:8089`） |
-| main | 8000 | **52** | healthy（分支树仅到 00025，环境超前——对齐晋升记 backlog；events `:8090`） |
+| main | 8000 | **58** | healthy（P0 Wave3 rebuild 已追平 schema；分支树对齐仍记 backlog；口令已轮换；events `:8090`） |
 
 ## SSOT
 

scripts/backup-system-db.sh

@@ -9,9 +9,16 @@
 #
 # 用法:
 #   ./scripts/backup-system-db.sh <dev|test|main> <目标备份目录>
+#
+# 口令（按优先级，不硬编码）:
+#   1. 环境变量 SYSTEM_DB_PASSWORD
+#   2. ${HOME}/.secrets/backup-env 中 SYSTEM_DB_PASSWORD_<ENV>
+#   3. configs/.env.<env> 中的 SYSTEM_DB_PASSWORD / CONTEXT_DB_PASSWORD
+# 当前实现经 docker exec 以库内角色执行 pg_dump，通常不需要宿主机口令；
+# 若后续改为宿主机 psql 连接，必须提供上述之一。
 # =============================================================================
 
-set -eo pipefail
+set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
@@ -24,6 +31,9 @@ show_help() {
 示例:
     $0 dev ./backups/system_dev_20260912
     $0 test /tmp/agent_system_test_backup
+
+口令来源（勿写入仓库）:
+    SYSTEM_DB_PASSWORD 或 \${HOME}/.secrets/backup-env 或 configs/.env.<env>
 EOF
     exit 0
 }
@@ -40,19 +50,22 @@ case "${ENV_NAME}" in
         CONTAINER_NAME="shuimu-context-pg-dev"
         DB_NAME="agent_system_dev"
         DB_USER="app"
-        DB_PASS="dev_secret_db_pass"
+        ENV_FILE="${ROOT_DIR}/configs/.env.dev"
+        SECRET_KEY="SYSTEM_DB_PASSWORD_DEV"
         ;;
     test)
         CONTAINER_NAME="shuimu-system-pg-test"
         DB_NAME="agent_system_test"
         DB_USER="app"
-        DB_PASS="test_secret_db_pass"
+        ENV_FILE="${ROOT_DIR}/configs/.env.test"
+        SECRET_KEY="SYSTEM_DB_PASSWORD_TEST"
         ;;
     main)
         CONTAINER_NAME="shuimu-system-pg-main"
         DB_NAME="agent_system_main"
         DB_USER="app"
-        DB_PASS="prod_highly_secure_db_pass"
+        ENV_FILE="${ROOT_DIR}/configs/.env.main"
+        SECRET_KEY="SYSTEM_DB_PASSWORD_MAIN"
         ;;
     *)
         echo "[错误] 未知环境: ${ENV_NAME}（仅支持 dev/test/main）"
@@ -60,6 +73,48 @@ case "${ENV_NAME}" in
         ;;
 esac
 
+resolve_db_password() {
+    if [[ -n "${SYSTEM_DB_PASSWORD:-}" ]]; then
+        printf '%s' "${SYSTEM_DB_PASSWORD}"
+        return 0
+    fi
+    local secrets_file="${HOME}/.secrets/backup-env"
+    if [[ -f "${secrets_file}" ]]; then
+        local from_secret
+        from_secret=$(grep -E "^${SECRET_KEY}=" "${secrets_file}" | head -1 | cut -d= -f2- || true)
+        if [[ -n "${from_secret}" ]]; then
+            printf '%s' "${from_secret}"
+            return 0
+        fi
+        from_secret=$(grep -E '^SYSTEM_DB_PASSWORD=' "${secrets_file}" | head -1 | cut -d= -f2- || true)
+        if [[ -n "${from_secret}" ]]; then
+            printf '%s' "${from_secret}"
+            return 0
+        fi
+    fi
+    if [[ -f "${ENV_FILE}" ]]; then
+        local from_env
+        from_env=$(grep -E '^SYSTEM_DB_PASSWORD=' "${ENV_FILE}" | head -1 | cut -d= -f2- || true)
+        if [[ -z "${from_env}" ]]; then
+            from_env=$(grep -E '^CONTEXT_DB_PASSWORD=' "${ENV_FILE}" | head -1 | cut -d= -f2- || true)
+        fi
+        if [[ -n "${from_env}" ]]; then
+            printf '%s' "${from_env}"
+            return 0
+        fi
+    fi
+    return 1
+}
+
+# docker exec 路径通常不需要宿主机口令；解析失败不阻断备份。
+DB_PASS=""
+if resolved="$(resolve_db_password 2>/dev/null)" && [[ -n "${resolved}" ]]; then
+    DB_PASS="${resolved}"
+fi
+unset resolved
+# 仅保留变量供未来宿主机连接扩展；当前 pg_dump 走容器内角色。
+: "${DB_PASS}"
+
 mkdir -p "${TARGET_DIR}"
 TARGET_DIR="$(cd "${TARGET_DIR}" && pwd)"
 

scripts/git-push-dev.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
-# 使用 ~/.secrets/gitea 推送 dev 分支（不写入 git config）
+# 使用 ~/.secrets/gitea 推送分支（不写入 git config；token 不出现在 URL/`ps`）
-set -eo pipefail
+set -euo pipefail
 
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 SECRETS="${HOME}/.secrets/gitea"
@@ -20,4 +20,23 @@ if [[ -z "${TOKEN}" || -z "${PREFIX}" ]]; then
 fi
 
 cd "${ROOT_DIR}"
-git push "https://oauth2:${TOKEN}@${PREFIX}/weichen/Agent-System.git" "${BRANCH}"
+
+# 通过临时 credential helper 注入，避免 oauth2:token@host 出现在进程列表。
+HELPER_SCRIPT="$(mktemp)"
+cleanup() {
+  rm -f "${HELPER_SCRIPT}"
+}
+trap cleanup EXIT
+
+cat > "${HELPER_SCRIPT}" <<EOF
+#!/usr/bin/env bash
+set -euo pipefail
+if [[ "\${1:-}" == "get" ]]; then
+  echo "username=oauth2"
+  echo "password=${TOKEN}"
+fi
+EOF
+chmod 700 "${HELPER_SCRIPT}"
+
+git -c "credential.helper=${HELPER_SCRIPT}" \
+  push "https://${PREFIX}/weichen/Agent-System.git" "${BRANCH}"