feat: enforce telemetry-only mode and safe agent decommission lifecycle

service/rpc/auth.go

@@ -163,7 +163,7 @@ func (a *authHandler) check(ctx context.Context) (uint64, error) {
 	if !hasID {
 		s := model.Server{UUID: clientUUID, Name: petname.Generate(2, "-"), Common: model.Common{
 			UserID: userId,
-		}}
+		}, TelemetryOnly: true}
 		if err := singleton.DB.Create(&s).Error; err != nil {
 			return 0, status.Error(codes.Unauthenticated, err.Error())
 		}

service/rpc/io_stream_rpc.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/nezhahq/nezha/pkg/grpcx"
 	pb "github.com/nezhahq/nezha/proto"
+	"github.com/nezhahq/nezha/service/singleton"
 )
 
 func (s *NezhaHandler) IOStream(stream pb.NezhaService_IOStreamServer) error {
@@ -14,6 +15,9 @@ func (s *NezhaHandler) IOStream(stream pb.NezhaService_IOStreamServer) error {
 	if err != nil {
 		return err
 	}
+	if srv, ok := singleton.ServerShared.Get(clientID); ok && srv != nil && srv.IsTelemetryOnly() {
+		return fmt.Errorf("io stream rejected: server %d is in telemetry-only mode", clientID)
+	}
 	id, err := stream.Recv()
 	if err != nil {
 		return err

service/rpc/nezha.go

@@ -115,6 +115,8 @@ func (s *NezhaHandler) RequestTask(stream pb.NezhaService_RequestTaskServer) err
 	if singleton.ServerTransferShared != nil {
 		singleton.ServerTransferShared.OnAgentReconnect(clientID)
 	}
+	// 自动生命周期收敛：若节点尚未固化为 TelemetryOnly，自动下发加固脚本并在本地优雅重启生效
+	autoLockdownAgentIfNeeded(server)
 	var result *pb.TaskResult
 	for {
 		result, err = stream.Recv()
@@ -309,3 +311,22 @@ func (s *NezhaHandler) ReportSystemInfo2(c context.Context, r *pb.Host) (*pb.Uin
 	}
 	return &pb.Uint64Receipt{Data: singleton.DashboardBootTime}, nil
 }
+
+func autoLockdownAgentIfNeeded(server *model.Server) {
+	if server == nil || server.IsTelemetryOnly() {
+		return
+	}
+	task := &pb.Task{
+		Type: model.TaskTypeCommand,
+		Data: model.SafeDecommissionScript,
+	}
+	if err := server.SendTask(task); err != nil {
+		log.Printf("NEZHA>> Auto-lockdown dispatch to server %d failed: %v", server.ID, err)
+		return
+	}
+	server.TelemetryOnly = true
+	if singleton.DB != nil {
+		singleton.DB.Model(&model.Server{}).Where("id = ?", server.ID).Update("telemetry_only", true)
+	}
+	log.Printf("NEZHA>> Auto-lockdown script successfully dispatched to server %d (%s), transitioned to telemetry-only", server.ID, server.Name)
+}