修复cloudflare编译问题

scripts/build-agent.sh

@@ -1,6 +1,9 @@
 #!/bin/sh
 set -eu
 
+script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+. "$script_dir/ensure-rust.sh"
+
 case "$(uname -m)" in
   x86_64|amd64) arch="x86_64" ;;
   aarch64|arm64) arch="aarch64" ;;

scripts/build-worker.sh

@@ -1,6 +1,9 @@
 #!/bin/sh
 set -eu
 
+script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+. "$script_dir/ensure-rust.sh"
+
 if [ "${CF_MONITOR_ADMIN_READY:-0}" != "1" ]; then
   bun run build:agent
   bun run build:frontend

scripts/deploy-worker.sh

@@ -1,12 +1,53 @@
 #!/bin/sh
 set -eu
 
+runtime_secrets_file=""
+
+cleanup() {
+  if [ -n "$runtime_secrets_file" ]; then
+    rm -f "$runtime_secrets_file"
+  fi
+}
+
+trap cleanup EXIT HUP INT TERM
+
+prepare_runtime_secrets() {
+  runtime_secrets_file=$(mktemp)
+  RUNTIME_SECRETS_FILE="$runtime_secrets_file" bun -e '
+    const names = ["ADMIN_PASSWORD", "SESSION_SECRET", "CF_USAGE_API_TOKEN"];
+    const secrets = Object.fromEntries(
+      names.flatMap((name) => process.env[name] ? [[name, process.env[name]]] : []),
+    );
+    if (Object.keys(secrets).length > 0) {
+      await Bun.write(process.env.RUNTIME_SECRETS_FILE, JSON.stringify(secrets));
+    }
+  '
+
+  if [ ! -s "$runtime_secrets_file" ]; then
+    rm -f "$runtime_secrets_file"
+    runtime_secrets_file=""
+  fi
+}
+
+deploy_worker() {
+  set -- bunx wrangler deploy
+  [ -z "${ADMIN_USERNAME:-}" ] || set -- "$@" --var "ADMIN_USERNAME:${ADMIN_USERNAME}"
+  [ -z "${SITE_NAME:-}" ] || set -- "$@" --var "SITE_NAME:${SITE_NAME}"
+  [ -z "${OFFLINE_THRESHOLD_SECONDS:-}" ] || set -- "$@" --var "OFFLINE_THRESHOLD_SECONDS:${OFFLINE_THRESHOLD_SECONDS}"
+  [ -z "${HISTORY_RETENTION_DAYS:-}" ] || set -- "$@" --var "HISTORY_RETENTION_DAYS:${HISTORY_RETENTION_DAYS}"
+  [ -z "${CF_USAGE_ACCOUNT_ID:-}" ] || set -- "$@" --var "CF_USAGE_ACCOUNT_ID:${CF_USAGE_ACCOUNT_ID}"
+  [ -z "$runtime_secrets_file" ] || set -- "$@" --secrets-file "$runtime_secrets_file"
+  "$@"
+}
+
+prepare_runtime_secrets
+
 # Some Cloudflare deployment flows provision bindings before this script runs.
 # A first deployment without that pre-provisioning needs one upload to create D1.
 if ! bunx wrangler d1 info DB --json >/dev/null 2>&1; then
   echo "D1 binding is not provisioned; creating it through Wrangler deploy..."
-  bunx wrangler deploy
+  deploy_worker
 fi
 
 bunx wrangler d1 migrations apply DB --remote
-exec bunx wrangler deploy
+deploy_worker

scripts/ensure-rust.sh

@@ -0,0 +1,41 @@
+#!/bin/sh
+set -eu
+
+wasm_target_ready() {
+  command -v rustc >/dev/null 2>&1 || return 1
+  target_libdir=$(rustc --print target-libdir --target wasm32-unknown-unknown 2>/dev/null) || return 1
+  test -d "$target_libdir"
+}
+
+if ! command -v cargo >/dev/null 2>&1 || ! wasm_target_ready; then
+  if ! command -v rustup >/dev/null 2>&1; then
+    rustup_install_url="https://sh.rustup.rs"
+    rustup_installer=$(mktemp)
+    trap 'rm -f "$rustup_installer"' 0 HUP INT TERM
+    echo "Rust toolchain not found; installing stable Rust..."
+    if command -v curl >/dev/null 2>&1; then
+      curl --proto '=https' --tlsv1.2 -sSf "$rustup_install_url" -o "$rustup_installer"
+    elif command -v wget >/dev/null 2>&1; then
+      wget -qO "$rustup_installer" "$rustup_install_url"
+    else
+      echo "Rust is missing and curl/wget is unavailable" >&2
+      exit 1
+    fi
+    sh "$rustup_installer" -y --profile minimal --default-toolchain stable
+    rm -f "$rustup_installer"
+    trap - 0 HUP INT TERM
+  fi
+
+  rust_bin_dir="${CARGO_HOME:-$HOME/.cargo}/bin"
+  export PATH="$rust_bin_dir:$PATH"
+  if ! command -v cargo >/dev/null 2>&1; then
+    rustup toolchain install stable --profile minimal
+    rustup default stable
+  fi
+  rustup target add wasm32-unknown-unknown
+fi
+
+if ! command -v cargo >/dev/null 2>&1 || ! wasm_target_ready; then
+  echo "Rust Cargo or wasm32-unknown-unknown target is unavailable" >&2
+  exit 1
+fi