feat: wall-audit 墙因校验工具+撞墙自动抓现场

- bin/wall-audit.sh <site> [--compare]:Cookie 清单(datadome 到期)/登录态/
  墙状态/拦截请求网络证据/出口 IP/系统代理/VPN 网卡,快照存 logs/<site>.wall-audit/
- keepalive 撞墙(exit 3)自动抓一份现场快照
- 首份基线:datadome cookie 有效期 365 天(非隔夜过期),出口 IP 与昨日截图不同

bin/keepalive.sh

@@ -44,6 +44,11 @@ if [ "$_rc" = 0 ]; then
   fi
 fi
 
+# 撞墙即抓现场证据(Cookie/网络/登录态快照),供跨天对比定位墙因
+if [ "$_rc" = 3 ] && [ -x "$HERE/wall-audit.sh" ]; then
+  bash "$HERE/wall-audit.sh" "$SITE" 2>&1 | sed 's/^/  [audit] /'
+fi
+
 # 撞墙告警(exit 3):邮件提醒人工过一次滑块;6 小时节流,避免每小时重复轰炸
 if [ "$_rc" = 3 ] && [ -x "$HERE/notify-mail.sh" ]; then
   _alert_ts="$LOG_DIR/${SITE}.wall-alert.ts"

bin/wall-audit.sh

+#!/bin/bash
+# wall-audit.sh <site> [extra-args] - 反爬墙现场审计(快照/对比)
+# 采集:Cookie 清单(datadome 到期)/登录态/墙状态/拦截请求网络证据/出口 IP/系统代理
+# 用法: bin/wall-audit.sh reuters            # 抓一份快照
+#       bin/wall-audit.sh reuters --compare  # 与上一份对比(第二天观察用)
+set -uo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+source "$HERE/platform.sh"
+export PATH="/opt/homebrew/bin:/usr/local/bin:$PATH"
+
+WORK_DIR="${WORK_DIR:-$(nh_default_work_dir)}"
+LOG_DIR="${LOG_DIR:-$WORK_DIR/logs}"
+SITE="${1:?用法: $0 <site> [--compare]}"; shift || true
+
+PORT="$(nh_cdp_port "$SITE")"
+PROFILE="$HOME/.news-harvester/profiles/${SITE}"
+SKILL_DIR="$(nh_skill_dir 2>/dev/null)" || { echo "❌ 找不到技能目录"; exit 1; }
+AUDIT_DIR="$LOG_DIR/${SITE}.wall-audit"
+mkdir -p "$AUDIT_DIR"
+
+export CDP_PORT_OVERRIDE="$PORT" CDP_PROFILE_OVERRIDE="$PROFILE" NH_AUDIT_DIR="$AUDIT_DIR"
+node "$SKILL_DIR/scripts/wall-audit.js" "$@"
+_rc=$?
+
+# 附加环境证据(出口 IP 之外的:系统代理配置、VPN 网卡)合并进 latest.json
+if command -v python3 >/dev/null 2>&1 && [ -f "$AUDIT_DIR/latest.json" ]; then
+  python3 - "$AUDIT_DIR/latest.json" <<'EOF'
+import json, subprocess, sys
+p = sys.argv[1]
+snap = json.load(open(p))
+def sh(cmd):
+    try: return subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=8).stdout.strip()
+    except Exception: return ""
+proxy = {}
+for line in sh("scutil --proxy").splitlines():
+    if " : " in line:
+        k, v = line.split(" : ", 1); proxy[k.strip()] = v.strip()
+snap["systemProxy"] = proxy
+snap["vpnInterfaces"] = [l.split(":")[0].strip() for l in sh("ifconfig -l").split() if l.startswith("utun")]
+json.dump(snap, open(p, "w"), ensure_ascii=False, indent=2)
+print(f"  系统代理: HTTP={proxy.get('HTTPEnable','?')} HTTPS={proxy.get('HTTPSEnable','?')} SOCKS={proxy.get('SOCKSEnable','?')}"
+      + (f" ({proxy.get('HTTPProxy','')}:{proxy.get('HTTPPort','')})" if proxy.get('HTTPEnable') == '1' else "")
+      + f" | VPN网卡: {len(snap['vpnInterfaces'])} 个 utun")
+EOF
+fi
+exit "$_rc"