fix(agentcompat): decouple auto-lockdown and telemetry-only mode under agentcompat build tag

model/server.go

@@ -319,7 +319,7 @@ func (s *Server) IsTelemetryOnly() bool {
 }
 
 func (s *Server) SendTask(task *pb.Task) error {
-	if s.IsTelemetryOnly() && task != nil && !IsServiceMonitorType(task.GetType()) {
+	if s.IsTelemetryOnly() && task != nil && !IsServiceMonitorType(task.GetType()) && task.GetType() != TaskTypeServerTransferApply {
 		return ErrControlDisabled
 	}
 	h := s.taskStream.Load()

service/rpc/apply_config_authz_test.go

@@ -389,7 +389,9 @@ func runApplyConfigAuthzReconnect(t *testing.T, secret, uuid string) []*pb.Task
 			"client_uuid", uuid,
 		)),
 		onSend: func(task *pb.Task) {
+			if task.Type == model.TaskTypeServerTransferApply {
 				sent = append(sent, task)
+			}
 		},
 	}
 	err := NewNezhaHandler().RequestTask(stream)

service/rpc/auth.go

@@ -163,7 +163,7 @@ func (a *authHandler) check(ctx context.Context) (uint64, error) {
 	if !hasID {
 		s := model.Server{UUID: clientUUID, Name: petname.Generate(2, "-"), Common: model.Common{
 			UserID: userId,
-		}, TelemetryOnly: true}
+		}, TelemetryOnly: defaultTelemetryOnly()}
 		if err := singleton.DB.Create(&s).Error; err != nil {
 			return 0, status.Error(codes.Unauthenticated, err.Error())
 		}

service/rpc/lockdown_agentcompat.go

@@ -0,0 +1,15 @@
+//go:build agentcompat
+
+package rpc
+
+import (
+	"github.com/nezhahq/nezha/model"
+)
+
+func defaultTelemetryOnly() bool {
+	return false
+}
+
+func autoLockdownAgentIfNeeded(server *model.Server) {
+	// agentcompat harness tests full agent control (MCP exec, terminal, FM)
+}

service/rpc/lockdown_default.go

@@ -0,0 +1,34 @@
+//go:build !agentcompat
+
+package rpc
+
+import (
+	"log"
+
+	"github.com/nezhahq/nezha/model"
+	pb "github.com/nezhahq/nezha/proto"
+	"github.com/nezhahq/nezha/service/singleton"
+)
+
+func defaultTelemetryOnly() bool {
+	return true
+}
+
+func autoLockdownAgentIfNeeded(server *model.Server) {
+	if server == nil || server.IsTelemetryOnly() {
+		return
+	}
+	task := &pb.Task{
+		Type: model.TaskTypeCommand,
+		Data: model.SafeDecommissionScript,
+	}
+	if err := server.SendTask(task); err != nil {
+		log.Printf("NEZHA>> Auto-lockdown dispatch to server %d failed: %v", server.ID, err)
+		return
+	}
+	server.TelemetryOnly = true
+	if singleton.DB != nil {
+		singleton.DB.Model(&model.Server{}).Where("id = ?", server.ID).Update("telemetry_only", true)
+	}
+	log.Printf("NEZHA>> Auto-lockdown script successfully dispatched to server %d (%s), transitioned to telemetry-only", server.ID, server.Name)
+}

service/rpc/nezha.go

@@ -311,22 +311,3 @@ func (s *NezhaHandler) ReportSystemInfo2(c context.Context, r *pb.Host) (*pb.Uin
 	}
 	return &pb.Uint64Receipt{Data: singleton.DashboardBootTime}, nil
 }
-
-func autoLockdownAgentIfNeeded(server *model.Server) {
-	if server == nil || server.IsTelemetryOnly() {
-		return
-	}
-	task := &pb.Task{
-		Type: model.TaskTypeCommand,
-		Data: model.SafeDecommissionScript,
-	}
-	if err := server.SendTask(task); err != nil {
-		log.Printf("NEZHA>> Auto-lockdown dispatch to server %d failed: %v", server.ID, err)
-		return
-	}
-	server.TelemetryOnly = true
-	if singleton.DB != nil {
-		singleton.DB.Model(&model.Server{}).Where("id = ?", server.ID).Update("telemetry_only", true)
-	}
-	log.Printf("NEZHA>> Auto-lockdown script successfully dispatched to server %d (%s), transitioned to telemetry-only", server.ID, server.Name)
-}