fix

2026-05-18 15:10:40 +08:00
parent 60002f6c31
commit 5891a510c7
22 changed files with 737 additions and 167 deletions
@@ -102,9 +102,9 @@ tms:
      # 标准版 CMSP/CMTP 停止命令。
      standard-app-stop-command: ${TMS_INIT_EXECUTOR_STANDARD_APP_STOP_COMMAND:/home/tms/bin/stop_standard_apps.sh}
      # 标准版 nginx 启动命令。
-      standard-nginx-start-command: ${TMS_INIT_EXECUTOR_STANDARD_NGINX_START_COMMAND:/home/tms/bin/start_standard_nginx.sh}
+      standard-nginx-start-command: ${TMS_INIT_EXECUTOR_STANDARD_NGINX_START_COMMAND:sudo -n /usr/local/sbin/tms-start-standard-nginx}
      # 标准版 nginx 停止命令。
-      standard-nginx-stop-command: ${TMS_INIT_EXECUTOR_STANDARD_NGINX_STOP_COMMAND:/home/tms/bin/stop_standard_nginx.sh}
+      standard-nginx-stop-command: ${TMS_INIT_EXECUTOR_STANDARD_NGINX_STOP_COMMAND:sudo -n /usr/local/sbin/tms-stop-standard-nginx}
      # 标准版 RabbitMQ 停止命令。
      standard-rabbit-stop-command: ${TMS_INIT_EXECUTOR_STANDARD_RABBIT_STOP_COMMAND:/home/tms/bin/stop_standard_rabbitmq.sh}
      # 标准版启动后检查命令。
@@ -114,7 +114,7 @@ tms:
      # 上传文件根目录；所有 fileId 均从该目录解析。
      upload-base-dir: ${TMS_INIT_EXECUTOR_UPLOAD_BASE_DIR:/home/tms/uploads}
      # 初始化过程临时暂存目录（用于复制上传文件后再处理）。
-      staging-root-dir: ${TMS_INIT_EXECUTOR_STAGING_ROOT_DIR:/home/tmp/tms-init-staging}
+      staging-root-dir: ${TMS_INIT_EXECUTOR_STAGING_ROOT_DIR:/home/tms/tmp/tms-init-staging}
      # 标准版收发器 license 固定落位路径。
      standard-receiver-license-target-path: ${TMS_INIT_EXECUTOR_STANDARD_RECEIVER_LICENSE_TARGET_PATH:${tms.init.executor.standard-home-dir}/cmep/license/cmep.license}
      # 直参版收发器 license 固定落位路径。
@@ -137,10 +137,10 @@ tms:
      rabbit-admin-password: ${TMS_INIT_EXECUTOR_RABBIT_ADMIN_PASSWORD:admin}
      # RabbitMQ 控制命令（用于新增用户、授权等）。
      # 建议线上配置为绝对路径，例如 /usr/local/rabbitmq/sbin/rabbitmqctl。
-      rabbitmq-ctl-command: ${TMS_INIT_EXECUTOR_RABBITMQ_CTL_COMMAND:rabbitmqctl}
+      rabbitmq-ctl-command: ${TMS_INIT_EXECUTOR_RABBITMQ_CTL_COMMAND:/usr/local/rabbitmq/sbin/rabbitmqctl}
      # RabbitMQ Admin CLI 命令路径（用于创建队列等）。
      rabbitmq-admin-command: ${TMS_INIT_EXECUTOR_RABBITMQ_ADMIN_COMMAND:/usr/sbin/rabbitmqadmin}
-      # 标准版 RabbitMQ 初始化脚本（会按前端输入替换 rConn/rConn 后执行）。
+      # 标准版 RabbitMQ 初始化脚本路径（保留兼容；MQ_USER_APPLY 当前优先直接调用 rabbitmqctl/rabbitmqadmin）。
      standard-rabbit-setup-script-path: ${TMS_INIT_EXECUTOR_STANDARD_RABBIT_SETUP_SCRIPT_PATH:${tms.init.executor.standard-home-dir}/cpackage/rabq/setuprabq.sh}
      # 标准版 RabbitMQ 队列初始化脚本（默认执行 01 节点脚本）。
      standard-rabbit-queue-script-path: ${TMS_INIT_EXECUTOR_STANDARD_RABBIT_QUEUE_SCRIPT_PATH:${tms.init.executor.standard-home-dir}/cpackage/rabq/addrabq_R_01.sh}
@@ -152,13 +152,15 @@ tms:
      standard-rabbit-app-config-patterns:
        - ${TMS_INIT_EXECUTOR_STANDARD_RABBIT_APP_CONFIG_PATTERN_1:${tms.init.executor.standard-home-dir}/cmsp/application-prd*.properties}
        - ${TMS_INIT_EXECUTOR_STANDARD_RABBIT_APP_CONFIG_PATTERN_2:${tms.init.executor.standard-home-dir}/cmtp/application-prd*.properties}
+      # 标准版 vendor 客户化脚本受控执行入口；该文件应由 root 部署到 /usr/local/sbin 且不可由 tms 写入。
+      standard-vendor-step-runner-command: ${TMS_INIT_EXECUTOR_STANDARD_VENDOR_STEP_RUNNER_COMMAND:/usr/local/sbin/tms-run-standard-vendor-step}
      # 回写应用配置时，是否对 RabbitMQ 账号密码进行 3DES 加密。
      standard-rabbit-credential-encrypt-enabled: ${TMS_INIT_EXECUTOR_STANDARD_RABBIT_CREDENTIAL_ENCRYPT_ENABLED:true}
      # 3DES 加密密钥（需与收发器解密逻辑保持一致）。
      standard-rabbit-credential-secret-key: ${TMS_INIT_EXECUTOR_STANDARD_RABBIT_CREDENTIAL_SECRET_KEY:ABCDEFGHIJKLMN1234567890}
      # LOCAL 模式命令白名单前缀；非白名单命令会被拒绝执行。
      whitelist-prefixes:
-        - ${TMS_INIT_EXECUTOR_WHITELIST_PREFIX_1:bash ${tms.init.executor.standard-home-dir}/cpackage/}
+        - ${TMS_INIT_EXECUTOR_WHITELIST_PREFIX_1:sudo -n ${tms.init.executor.standard-vendor-step-runner-command} }
        - ${TMS_INIT_EXECUTOR_WHITELIST_PREFIX_2:bash /opt/CAE_Install_}
        - ${TMS_INIT_EXECUTOR_WHITELIST_PREFIX_3:systemctl }
        - ${TMS_INIT_EXECUTOR_WHITELIST_PREFIX_4:echo }
@@ -191,7 +193,7 @@ tms:
    # 升级任务统一日志目录。
    log-dir: ${TMS_UPGRADE_LOG_DIR:/home/tms/tmp/tms-upgrade-logs}
    # 升级包验签使用的公钥 PEM 文件路径；为空时升级预检会拒绝通过。
-    signature-public-key-pem-path: ${TMS_UPGRADE_SIGNATURE_PUBLIC_KEY_PEM_PATH:/home/tms/cert/public_key.pem}
+    signature-public-key-pem-path: ${TMS_UPGRADE_SIGNATURE_PUBLIC_KEY_PEM_PATH:/home/tms/device/dev.mac.pub}
  backup:
    # 资源备份包输出目录；第一版先在本机生成可见的 .tmsbak 文件。
    output-dir: ${TMS_BACKUP_OUTPUT_DIR:/home/tms/tmp/resource-backup-packages}
@@ -315,8 +317,6 @@ tms:
      - ${TMS_BACKUP_TMS_DB_EXCLUDED_TABLE_ROLE_UKEY:tms_role_ukey_binding}
      - ${TMS_BACKUP_TMS_DB_EXCLUDED_TABLE_AUTH_FULL:tms_auth_full_account}
      - ${TMS_BACKUP_TMS_DB_EXCLUDED_TABLE_AUTH_SESSION:tms_auth_session}
-      - ${TMS_BACKUP_TMS_DB_EXCLUDED_TABLE_AUTH_CHALLENGE:tms_auth_challenge}
-      - ${TMS_BACKUP_TMS_DB_EXCLUDED_TABLE_AUTH_AUDIT:tms_auth_audit_log}
      - ${TMS_BACKUP_TMS_DB_EXCLUDED_TABLE_RESOURCE_BACKUP_TASK:tms_resource_backup_task}
      - ${TMS_BACKUP_TMS_DB_EXCLUDED_TABLE_RESOURCE_RESTORE_TASK:tms_resource_restore_task}
    # 备份/恢复标准收发器业务库名；第一版默认使用 CMEP。
@@ -340,7 +340,7 @@ tms:
    internal-token: ${TMS_INTERNAL_TOKEN:change-me-internal-token}
    internal-auth:
      # 是否启用 /api/** 的内部登录鉴权；开发联调时可临时关闭。
-      enabled: ${TMS_SECURITY_INTERNAL_AUTH_ENABLED:true}
+      enabled: ${TMS_SECURITY_INTERNAL_AUTH_ENABLED:false}
      # 关闭内部鉴权后，注入请求上下文的调试角色。
      debug-role-code: ${TMS_SECURITY_INTERNAL_AUTH_DEBUG_ROLE_CODE:OPS_ADMIN}
      # 关闭内部鉴权后，注入请求上下文的调试认证等级。
@@ -349,7 +349,7 @@ tms:
      debug-session-token: ${TMS_SECURITY_INTERNAL_AUTH_DEBUG_SESSION_TOKEN:DEBUG-BYPASS}
    replay:
      # 是否启用防重放校验；本地 Postman/联调可临时设为 false，生产环境应保持 true。
-      enabled: ${TMS_SECURITY_REPLAY_ENABLED:true}
+      enabled: ${TMS_SECURITY_REPLAY_ENABLED:false}
    openapi:
      # 外部签名服务接口允许的时间戳偏差（秒），防重放。
      timestamp-skew-seconds: 300
@@ -33,7 +33,7 @@ CREATE TABLE IF NOT EXISTS tms_init_task (
    create_time DATETIME(3) NOT NULL,
    update_time DATETIME(3) NOT NULL,
    UNIQUE KEY uk_tms_init_task_task_id (task_id)
-);
+) COMMENT='初始化任务表';

 CREATE TABLE IF NOT EXISTS tms_init_task_step (
    id BIGINT PRIMARY KEY,
@@ -49,7 +49,7 @@ CREATE TABLE IF NOT EXISTS tms_init_task_step (
    update_time DATETIME(3) NOT NULL,
    UNIQUE KEY uk_tms_init_task_step_task_no (task_id, step_no),
    KEY idx_tms_init_task_step_task_id (task_id)
-);
+) COMMENT='初始化任务步骤表';

 -- -----------------------------------------------------------------------------
 -- 资源备份与恢复
@@ -83,7 +83,7 @@ CREATE TABLE IF NOT EXISTS tms_resource_backup_task (
    UNIQUE KEY uk_tms_resource_backup_task_backup_id (backup_id),
    KEY idx_tms_resource_backup_task_status (status),
    KEY idx_tms_resource_backup_task_create_time (create_time)
-);
+) COMMENT='资源备份任务表';

 CREATE TABLE IF NOT EXISTS tms_resource_restore_task (
    id BIGINT PRIMARY KEY,
@@ -114,7 +114,7 @@ CREATE TABLE IF NOT EXISTS tms_resource_restore_task (
    UNIQUE KEY uk_tms_resource_restore_task_precheck_id (precheck_id),
    KEY idx_tms_resource_restore_task_status (status),
    KEY idx_tms_resource_restore_task_create_time (create_time)
-);
+) COMMENT='资源恢复任务表';
 -- -----------------------------------------------------------------------------
 -- 认证与设备基础表
 -- -----------------------------------------------------------------------------
@@ -127,7 +127,7 @@ CREATE TABLE IF NOT EXISTS tms_device_node (
    create_time DATETIME(3) NOT NULL,
    update_time DATETIME(3) NOT NULL,
    UNIQUE KEY uk_tms_device_node_node_id (node_id)
-);
+) COMMENT='设备节点表';

 CREATE TABLE IF NOT EXISTS tms_file_record (
    id BIGINT PRIMARY KEY,
@@ -138,7 +138,7 @@ CREATE TABLE IF NOT EXISTS tms_file_record (
    create_time DATETIME(3) NOT NULL,
    update_time DATETIME(3) NOT NULL,
    UNIQUE KEY uk_tms_file_record_file_id (file_id)
-);
+) COMMENT='文件记录表';

 -- -----------------------------------------------------------------------------
 -- 设备软件版本
@@ -155,7 +155,7 @@ CREATE TABLE IF NOT EXISTS tms_device_software_version (
    create_time DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
    update_time DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    UNIQUE KEY uk_tms_device_software_version_component_code (component_code)
-);
+) COMMENT='设备软件版本表';

 INSERT INTO tms_device_software_version
 (id, component_code, component_name, current_version, source_type, detected_at, remarks)
@@ -204,7 +204,7 @@ CREATE TABLE IF NOT EXISTS tms_upgrade_task (
    KEY idx_tms_upgrade_task_status (status),
    KEY idx_tms_upgrade_task_task_type (task_type),
    KEY idx_tms_upgrade_task_create_time (create_time)
-);
+) COMMENT='升级任务表';

 -- -----------------------------------------------------------------------------
 -- 新认证体系
@@ -219,7 +219,7 @@ CREATE TABLE IF NOT EXISTS tms_role_account (
    create_time DATETIME(3) NOT NULL,
    update_time DATETIME(3) NOT NULL,
    UNIQUE KEY uk_tms_role_account_role_code (role_code)
-);
+) COMMENT='角色账号表';

 CREATE TABLE IF NOT EXISTS tms_role_ukey_binding (
    id BIGINT PRIMARY KEY,
@@ -236,7 +236,7 @@ CREATE TABLE IF NOT EXISTS tms_role_ukey_binding (
    UNIQUE KEY uk_tms_role_ukey_binding_role_uid_serial (role_code, uid, ukey_serial),
    KEY idx_tms_role_ukey_binding_role_uid_status (role_code, uid, status),
    KEY idx_tms_role_ukey_binding_role_status (role_code, status)
-);
+) COMMENT='角色UKey绑定表';

 CREATE TABLE IF NOT EXISTS tms_auth_full_account (
    id BIGINT PRIMARY KEY,
@@ -258,7 +258,7 @@ CREATE TABLE IF NOT EXISTS tms_auth_full_account (
    UNIQUE KEY uk_tms_auth_full_account_role_uid (role_code, uid),
    UNIQUE KEY uk_tms_auth_full_account_name (account_name),
    KEY idx_tms_auth_full_account_role_code (role_code)
-);
+) COMMENT='完整认证账号表';

 CREATE TABLE IF NOT EXISTS tms_auth_session (
    id BIGINT PRIMARY KEY,
@@ -275,7 +275,7 @@ CREATE TABLE IF NOT EXISTS tms_auth_session (
    update_time DATETIME(3) NOT NULL,
    UNIQUE KEY uk_tms_auth_session_token (session_token),
    KEY idx_tms_auth_session_role_code (role_code)
-);
+) COMMENT='认证会话表';

 -- -----------------------------------------------------------------------------
 -- 防重放与安全事件
@@ -298,7 +298,7 @@ CREATE TABLE IF NOT EXISTS tms_replay_nonce (
    UNIQUE KEY uk_tms_replay_nonce_scope_principal_nonce (scope, principal_id, nonce),
    KEY idx_tms_replay_nonce_expires_at (expires_at),
    KEY idx_tms_replay_nonce_principal_time (principal_id, create_time)
-);
+) COMMENT='防重放nonce表';

 CREATE TABLE IF NOT EXISTS tms_security_event (
    id BIGINT PRIMARY KEY,
@@ -314,7 +314,7 @@ CREATE TABLE IF NOT EXISTS tms_security_event (
    update_time DATETIME(3) NOT NULL,
    KEY idx_tms_security_event_event_type (event_type),
    KEY idx_tms_security_event_scope_principal (scope, principal_id)
-);
+) COMMENT='安全事件表';

 INSERT IGNORE INTO tms_role_account (
    id,
@@ -483,7 +483,7 @@ CREATE TABLE IF NOT EXISTS tms_access_whitelist (
    mask VARCHAR(10) NOT NULL,
    create_time DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
    update_time DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)
-    );
+) COMMENT='访问白名单表';


 -- -----------------------------------------------------------------------------
@@ -512,7 +512,7 @@ CREATE TABLE IF NOT EXISTS tms_key_entity (
    KEY idx_tms_key_entity_algo (algo_type),
    KEY idx_tms_key_entity_status (status),
    KEY idx_tms_key_entity_create_time (create_time)
-);
+) COMMENT='密钥实体表';

 CREATE TABLE IF NOT EXISTS tms_certificate (
    id BIGINT PRIMARY KEY,
@@ -537,7 +537,7 @@ CREATE TABLE IF NOT EXISTS tms_certificate (
    KEY idx_tms_certificate_issuer_dn (issuer_dn(512)),
    KEY idx_tms_certificate_valid_to (valid_to),
    KEY idx_tms_certificate_import_time (import_time)
-);
+) COMMENT='证书表';

 CREATE TABLE IF NOT EXISTS tms_trusted_cert (
    id BIGINT PRIMARY KEY,
@@ -560,7 +560,7 @@ CREATE TABLE IF NOT EXISTS tms_trusted_cert (
    KEY idx_tms_trusted_cert_subject_dn (subject_dn(512)),
    KEY idx_tms_trusted_cert_issuer_dn (issuer_dn(512)),
    KEY idx_tms_trusted_cert_valid_to (valid_to)
-);
+) COMMENT='可信证书表';

 CREATE TABLE IF NOT EXISTS tms_certificate_crl (
    id BIGINT PRIMARY KEY,
@@ -580,7 +580,7 @@ CREATE TABLE IF NOT EXISTS tms_certificate_crl (
    KEY idx_tms_certificate_crl_issuer_dn (issuer_dn(512)),
    KEY idx_tms_certificate_crl_this_update (this_update),
    KEY idx_tms_certificate_crl_next_update (next_update)
-);
+) COMMENT='证书CRL表';

 CREATE TABLE IF NOT EXISTS tms_certificate_crl_revoked (
    id BIGINT PRIMARY KEY,
@@ -598,7 +598,7 @@ CREATE TABLE IF NOT EXISTS tms_certificate_crl_revoked (
    KEY idx_tms_certificate_crl_revoked_issuer_serial (issuer_dn(512), serial_number),
    KEY idx_tms_certificate_crl_revoked_subject_dn (subject_dn(512)),
    KEY idx_tms_certificate_crl_revoked_revocation_time (revocation_time)
-);
+) COMMENT='证书CRL吊销明细表';

 CREATE TABLE IF NOT EXISTS tms_certificate_crl_import_task (
    id BIGINT PRIMARY KEY,
@@ -617,7 +617,7 @@ CREATE TABLE IF NOT EXISTS tms_certificate_crl_import_task (
    UNIQUE KEY uk_tms_certificate_crl_import_task_task_id (task_id),
    KEY idx_tms_certificate_crl_import_task_status (status),
    KEY idx_tms_certificate_crl_import_task_create_time (create_time)
-);
+) COMMENT='证书CRL导入任务表';


 -- -----------------------------------------------------------------------------
@@ -650,7 +650,7 @@ CREATE TABLE IF NOT EXISTS tms_operation_audit_log (
    KEY idx_tms_operation_audit_log_result (operation_result),
    KEY idx_tms_operation_audit_log_audit_status (audit_status),
    KEY idx_tms_operation_audit_log_occurred_at (occurred_at)
-);
+) COMMENT='操作审计日志表';



@@ -672,7 +672,7 @@ CREATE TABLE IF NOT EXISTS tms_log_backup_record (
     UNIQUE KEY `uk_record_id` (`record_id`),
     KEY `idx_create_time` (`create_time`),
     KEY `idx_backup_type` (`backup_type`)
-);
+) COMMENT='日志备份记录表';



@@ -687,7 +687,7 @@ CREATE TABLE IF NOT EXISTS tms_backup_config (
     last_backup_time datetime DEFAULT NULL COMMENT '上次执行时间',
     sign_data varchar(255) NOT NULL COMMENT '其他字段的签名值',
     PRIMARY KEY (`id`)
-);
+) COMMENT='日志备份配置表';


 CREATE TABLE IF NOT EXISTS tms_master_key_activate (
@@ -699,7 +699,7 @@ CREATE TABLE IF NOT EXISTS tms_master_key_activate (

     create_time DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
     update_time DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)
-);
+) COMMENT='主密钥激活状态表';

 INSERT IGNORE INTO tms_master_key_activate (
    id,
@@ -3,12 +3,12 @@
    "RABBITMQ": {
      "RENDER_CONFIG": "internal::render_config",
      "FILE_PREPARE": "internal::file_prepare",
-      "SET_RABBITMQ": "bash {{STANDARD_HOME_DIR}}/cpackage/toolsh/setfraq.sh",
+      "SET_RABBITMQ": "sudo -n {{STANDARD_VENDOR_STEP_RUNNER}} setfraq",
      "MQ_USER_APPLY": "internal::mq_user_apply",
      "MQ_QUEUE_APPLY": "internal::mq_queue_apply",
      "DB_RENDER": "internal::db_render",
      "DB_APPLY": "internal::db_apply",
-      "DEPLOY_RECEIVER": "bash {{STANDARD_HOME_DIR}}/cpackage/toolsh/setsptp.sh",
+      "DEPLOY_RECEIVER": "sudo -n {{STANDARD_VENDOR_STEP_RUNNER}} setsptp",
      "APP_MQ_CREDENTIALS_APPLY": "internal::app_mq_credentials_apply",
      "NGINX_CONFIG_APPLY": "internal::nginx_config_apply",
      "WEB_CONFIG_APPLY": "internal::web_config_apply",
@@ -20,11 +20,11 @@
    "TLQ": {
      "RENDER_CONFIG": "internal::render_config",
      "FILE_PREPARE": "internal::file_prepare",
-      "SET_TLQ": "bash {{STANDARD_HOME_DIR}}/cpackage/toolsh/setftq.sh",
-      "TLQ_CONF_APPLY": "bash {{STANDARD_HOME_DIR}}/cpackage/toolsh/settlq.sh",
+      "SET_TLQ": "sudo -n {{STANDARD_VENDOR_STEP_RUNNER}} setftq",
+      "TLQ_CONF_APPLY": "sudo -n {{STANDARD_VENDOR_STEP_RUNNER}} settlq",
      "DB_RENDER": "internal::db_render",
      "DB_APPLY": "internal::db_apply",
-      "DEPLOY_RECEIVER": "bash {{STANDARD_HOME_DIR}}/cpackage/toolsh/setsptp.sh",
+      "DEPLOY_RECEIVER": "sudo -n {{STANDARD_VENDOR_STEP_RUNNER}} setsptp",
      "NGINX_CONFIG_APPLY": "internal::nginx_config_apply",
      "WEB_CONFIG_APPLY": "internal::web_config_apply",
      "START_CMSP_CMTP": "internal::start_cmsp_cmtp",
@@ -37,12 +37,12 @@
    "RABBITMQ": {
      "RENDER_CONFIG": "internal::render_config",
      "FILE_PREPARE": "internal::file_prepare",
-      "SET_RABBITMQ": "bash {{STANDARD_HOME_DIR}}/cpackage/toolsh/setfraq.sh",
+      "SET_RABBITMQ": "sudo -n {{STANDARD_VENDOR_STEP_RUNNER}} setfraq",
      "MQ_USER_APPLY": "internal::mq_user_apply",
      "MQ_QUEUE_APPLY": "internal::mq_queue_apply",
      "DB_RENDER": "internal::db_render",
      "DB_APPLY": "internal::db_apply",
-      "DEPLOY_RECEIVER": "bash {{STANDARD_HOME_DIR}}/cpackage/toolsh/setsptp.sh",
+      "DEPLOY_RECEIVER": "sudo -n {{STANDARD_VENDOR_STEP_RUNNER}} setsptp",
      "APP_MQ_CREDENTIALS_APPLY": "internal::app_mq_credentials_apply",
      "NGINX_CONFIG_APPLY": "internal::nginx_config_apply",
      "WEB_CONFIG_APPLY": "internal::web_config_apply",
@@ -54,13 +54,13 @@
    "RABBITMQ_TLQ": {
      "RENDER_CONFIG": "internal::render_config",
      "FILE_PREPARE": "internal::file_prepare",
-      "SET_TLQ": "bash {{STANDARD_HOME_DIR}}/cpackage/toolsh/setftq.sh",
-      "TLQ_CONF_APPLY": "bash {{STANDARD_HOME_DIR}}/cpackage/toolsh/settlq.sh",
+      "SET_TLQ": "sudo -n {{STANDARD_VENDOR_STEP_RUNNER}} setftq",
+      "TLQ_CONF_APPLY": "sudo -n {{STANDARD_VENDOR_STEP_RUNNER}} settlq",
      "MQ_USER_APPLY": "internal::mq_user_apply",
      "MQ_QUEUE_APPLY": "internal::mq_queue_apply",
      "DB_RENDER": "internal::db_render",
      "DB_APPLY": "internal::db_apply",
-      "DEPLOY_RECEIVER": "bash {{STANDARD_HOME_DIR}}/cpackage/toolsh/setsptp.sh",
+      "DEPLOY_RECEIVER": "sudo -n {{STANDARD_VENDOR_STEP_RUNNER}} setsptp",
      "APP_MQ_CREDENTIALS_APPLY": "internal::app_mq_credentials_apply",
      "NGINX_CONFIG_APPLY": "internal::nginx_config_apply",
      "WEB_CONFIG_APPLY": "internal::web_config_apply",