Harden strategy SoT: fail-closed funds gate, shared open pipeline, LIVE switch guards.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/backup.py

@@ -127,6 +127,7 @@ def create_backup(
     *,
     db: Database | None = None,
     reason: str = "manual",
+    include_env: bool | None = None,
 ) -> dict[str, Any]:
     db = db or get_db()
     backup_dir = resolve_backup_dir()
@@ -134,24 +135,28 @@ def create_backup(
     out = backup_dir / f"{BACKUP_PREFIX}{ts}.zip"
     env_path = resolve_env_path()
     db_path = Path(db.path)
+    # 机内备份默认可含 .env；BACKUP_INCLUDE_ENV=0 可关。HTTP 下载另做剥离。
+    if include_env is None:
+        include_env = (os.environ.get("BACKUP_INCLUDE_ENV") or "1").strip() != "0"
 
     with tempfile.TemporaryDirectory(prefix="eth_hedge_bak_") as td:
         tmp_db = Path(td) / "hedge.db"
         _sqlite_snapshot(db, tmp_db)
+        has_env = bool(include_env and env_path and env_path.is_file())
         manifest = {
             "product": "比特骆驼自动化对冲系统",
             "version": 1,
             "created_at_ms": int(time.time() * 1000),
             "reason": reason,
             "db_source": str(db_path),
-            "env_source": str(env_path) if env_path else None,
-            "has_env": bool(env_path and env_path.is_file()),
+            "env_source": str(env_path) if has_env else None,
+            "has_env": has_env,
             "mode": get_settings().mode,
             "env_name": get_settings().env_name,
         }
         with zipfile.ZipFile(out, "w", compression=zipfile.ZIP_DEFLATED) as zf:
             zf.write(tmp_db, DB_ARCNAME)
-            if env_path and env_path.is_file():
+            if has_env and env_path is not None:
                 zf.write(env_path, ENV_ARCNAME)
             zf.writestr(
                 MANIFEST_NAME,
@@ -161,7 +166,7 @@ def create_backup(
     db.set_setting("backup_last_at_ms", str(int(time.time() * 1000)))
     prune_backups()
     st = out.stat()
-    logger.info("backup created path=%s reason=%s size=%s", out, reason, st.st_size)
+    logger.info("backup created path=%s reason=%s size=%s has_env=%s", out, reason, st.st_size, has_env)
     return {
         "ok": True,
         "name": out.name,
@@ -173,6 +178,22 @@ def create_backup(
     }
 
 
+def materialize_download_zip(src: Path) -> Path:
+    """HTTP 下载用：去掉包内 .env，避免令牌失窃带走交易所密钥。"""
+    fd, name = tempfile.mkstemp(prefix="eth_hedge_dl_", suffix=".zip")
+    os.close(fd)
+    dest = Path(name)
+    with zipfile.ZipFile(src, "r") as zin, zipfile.ZipFile(
+        dest, "w", compression=zipfile.ZIP_DEFLATED
+    ) as zout:
+        for info in zin.infolist():
+            base = Path(info.filename).name
+            if base == ENV_ARCNAME or base.endswith(".env"):
+                continue
+            zout.writestr(info, zin.read(info.filename))
+    return dest
+
+
 def read_backup_file(name: str) -> Path:
     safe = Path(name).name
     if not safe.startswith(BACKUP_PREFIX) or not safe.endswith(".zip"):