Update start.sh

start.sh

@@ -2,79 +2,41 @@
 set -euo pipefail
 
 # ─────────────────────────────────────────────────────────────────────────
-# 🔥 阶段一：特权初始化与存储桶强力清洗、全量权限强刷（Root 空间行为）
+# 🛡️ 阶段一：用户空间强力锁擦除与动态权限宽容（顺应 Rootless 环境）
 # ─────────────────────────────────────────────────────────────────────────
-if [ "$(id -u)" -eq 0 ]; then
-  echo "[Storage-Sanitizer] Executing root initialization and aggressive privilege correction..."
-  
-  TARGET_HOME="${HERMES_HOME:-/opt/data}"
-  
-  # 1. 强行预先建立好原本属于 hermes 用户的完整存储层级拓扑
-  mkdir -p "$TARGET_HOME"/{cron,sessions,logs,hooks,memories,skills,skins,plans,workspace,home,plugins}
-  mkdir -p "$TARGET_HOME/.local/bin"
-  
-  # 2. 彻底清除上一次运行或闪退在存储桶里留下的所有幽灵锁与僵尸 PID 文件（消灭看板初始化权限死锁）
-  echo "[Storage-Sanitizer] Scrubbing lingering initialization locks and process pids..."
-  find "$TARGET_HOME" -name "*.lock" -delete 2>/dev/null || true
-  find "$TARGET_HOME" -name "*.pid" -delete 2>/dev/null || true
-  rm -f "$TARGET_HOME/kanban.db.init.lock" 2>/dev/null || true
-  
-  # 3. 降权前，无条件把整个挂载目录树的属主全部强刷为 hermes 用户
-  echo "[Storage-Sanitizer] Recurse-chown on $TARGET_HOME to user 'hermes'..."
-  chown -R hermes:hermes "$TARGET_HOME" 2>/dev/null || true
-  chown -R hermes:hermes /opt/huggingmes 2>/dev/null || true
-  
-  echo "[Storage-Sanitizer] Dropping privileges safely to user 'hermes'."
-  # 携带整套业务底座所需的全部环境变量，无缝将主进程控制权交回用户空间
-  exec runuser -u hermes -- env \
-    PATH="/opt/hermes/.venv/bin:/opt/data/.local/bin:$PATH" \
-    HOME="$HOME" \
-    HERMES_HOME="$TARGET_HOME" \
-    DEV_MODE="${DEV_MODE:-true}" \
-    GATEWAY_TOKEN="${GATEWAY_TOKEN:-}" \
-    API_SERVER_KEY="${API_SERVER_KEY:-}" \
-    API_SERVER_ENABLED="${API_SERVER_ENABLED:-true}" \
-    API_SERVER_HOST="${API_SERVER_HOST:-127.0.0.1}" \
-    API_SERVER_PORT="${API_SERVER_PORT:-8642}" \
-    GATEWAY_HEALTH_URL="${GATEWAY_HEALTH_URL:-http://127.0.0.1:8642}" \
-    TELEGRAM_WEBHOOK_PORT="${TELEGRAM_WEBHOOK_PORT:-8765}" \
-    PORT="${PORT:-7861}" \
-    HERMES_MODEL="${HERMES_MODEL:-}" \
-    LLM_MODEL="${LLM_MODEL:-}" \
-    HERMES_INFERENCE_PROVIDER="${HERMES_INFERENCE_PROVIDER:-auto}" \
-    LLM_API_KEY="${LLM_API_KEY:-}" \
-    CUSTOM_BASE_URL="${CUSTOM_BASE_URL:-}" \
-    CUSTOM_PROVIDER="${CUSTOM_PROVIDER:-}" \
-    CUSTOM_API_KEY="${CUSTOM_API_KEY:-}" \
-    CLOUDFLARE_WORKERS_TOKEN="${CLOUDFLARE_WORKERS_TOKEN:-}" \
-    CLOUDFLARE_PROXY_URL="${CLOUDFLARE_PROXY_URL:-}" \
-    TELEGRAM_BOT_TOKEN="${TELEGRAM_BOT_TOKEN:-}" \
-    SPACE_HOST="${SPACE_HOST:-}" \
-    TELEGRAM_MODE="${TELEGRAM_MODE:-}" \
-    TELEGRAM_ALLOWED_USERS="${TELEGRAM_ALLOWED_USERS:-}" \
-    TELEGRAM_USER_IDS="${TELEGRAM_USER_IDS:-}" \
-    HUGGINGMES_APT_PACKAGES="${HUGGINGMES_APT_PACKAGES:-}" \
-    HUGGINGMES_PIP_PACKAGES="${HUGGINGMES_PIP_PACKAGES:-}" \
-    HUGGINGMES_NPM_PACKAGES="${HUGGINGMES_NPM_PACKAGES:-}" \
-    HUGGINGMES_RUN="${HUGGINGMES_RUN:-}" \
-    /bin/bash "$0" "$@"
-fi
+TARGET_HOME="${HERMES_HOME:-/opt/data}"
+
+echo "[Sandbox-Initializer] Running fallback initialization inside rootless user space..."
+
+# 1. 尝试用当前最大权限创建运行所需拓扑
+mkdir -p "$TARGET_HOME"/{cron,sessions,logs,hooks,memories,skills,skins,plans,workspace,home,plugins} 2>/dev/null || true
+mkdir -p "$TARGET_HOME/.local/bin" 2>/dev/null || true
+
+# 2. 物理清除所有幽灵锁文件（核心死锁解除点）
+# 即使由于历史原因文件所有者不属于当前用户，只要有写权限或上层目录放开了 777，就能强行抹除
+echo "[Sandbox-Initializer] Clearing lingering init locks to prevent Kanban deadlocks..."
+find "$TARGET_HOME" -name "*.lock" -delete 2>/dev/null || true
+find "$TARGET_HOME" -name "*.pid" -delete 2>/dev/null || true
+rm -f "$TARGET_HOME/kanban.db.init.lock" 2>/dev/null || true
+rm -f "$TARGET_HOME/logs/container-boot.log" 2>/dev/null || true
+
+# 3. 动态宽容：放开对生成文件的控制，确保后续子进程 open("a+b") 或读写时不踩坑
+chmod -R 777 "$TARGET_HOME" 2>/dev/null || true
 
 # ─────────────────────────────────────────────────────────────────────────
 # 🛡️ 阶段二：安全降权沙箱运行（Hermes 空间行为）
 # ──────────────────────────────────────────────────────────────��──────────
-umask 0077
+umask 0000
 
 APP_DIR="${HUGGINGMES_APP_DIR:-/opt/huggingmes}"
-HERMES_HOME="${HERMES_HOME:-/opt/data}"
 PUBLIC_PORT="${PORT:-7861}"
 GATEWAY_API_PORT="${API_SERVER_PORT:-8642}"
 DASHBOARD_PORT="${DASHBOARD_PORT:-9119}"
 TELEGRAM_WEBHOOK_PORT="${TELEGRAM_WEBHOOK_PORT:-8765}"
 CF_PROXY_ENV_FILE="/tmp/huggingmes-cloudflare-proxy.env"
-STARTUP_FILE="$HERMES_HOME/workspace/startup.sh"
+STARTUP_FILE="$TARGET_HOME/workspace/startup.sh"
 
-export HERMES_HOME
+export HERMES_HOME="$TARGET_HOME"
 export API_SERVER_ENABLED="${API_SERVER_ENABLED:-true}"
 export API_SERVER_HOST="${API_SERVER_HOST:-127.0.0.1}"
 export API_SERVER_PORT="$GATEWAY_API_PORT"
@@ -104,19 +66,15 @@ fi
 # 强行对齐全局变量断言，确保官方前端 Terminal 握手成功不报错
 export GATEWAY_TOKEN="$API_SERVER_KEY"
 
-# 系统本地运行依赖树拓扑生成
-mkdir -p "$HERMES_HOME"/{cron,sessions,logs,hooks,memories,skills,skins,plans,workspace,home,plugins}
-mkdir -p "$HERMES_HOME/.local/bin"
-
-if [ ! -L "$HERMES_HOME/.local/bin/hermes" ]; then
-  rm -f "$HERMES_HOME/.local/bin/hermes"
-  ln -sfn /opt/hermes/.venv/bin/hermes "$HERMES_HOME/.local/bin/hermes"
+if [ ! -L "$TARGET_HOME/.local/bin/hermes" ]; then
+  rm -f "$TARGET_HOME/.local/bin/hermes" 2>/dev/null || true
+  ln -sfn /opt/hermes/.venv/bin/hermes "$TARGET_HOME/.local/bin/hermes" 2>/dev/null || true
 fi
 
 if [ ! -L "${HOME}/.hermes/plugins" ]; then
-  mkdir -p "${HOME}/.hermes"
-  rm -rf "${HOME}/.hermes/plugins"
-  ln -sfn "$HERMES_HOME/plugins" "${HOME}/.hermes/plugins"
+  mkdir -p "${HOME}/.hermes" 2>/dev/null || true
+  rm -rf "${HOME}/.hermes/plugins" 2>/dev/null || true
+  ln -sfn "$TARGET_HOME/plugins" "${HOME}/.hermes/plugins" 2>/dev/null || true
 fi
 
 # Cloudflare 网络层代理反向构建
@@ -150,7 +108,7 @@ if [ -n "${TELEGRAM_BOT_TOKEN:-}" ] && [ -n "${SPACE_HOST:-}" ] && [ -z "${TELEG
 fi
 
 if [ -n "${TELEGRAM_WEBHOOK_URL:-}" ] && [ -z "${TELEGRAM_WEBHOOK_SECRET:-}" ]; then
-  SECRET_FILE="$HERMES_HOME/.huggingmes-telegram-webhook-secret"
+  SECRET_FILE="$TARGET_HOME/.huggingmes-telegram-webhook-secret"
   if [ -f "$SECRET_FILE" ]; then
     TELEGRAM_WEBHOOK_SECRET="$(cat "$SECRET_FILE")"
     export TELEGRAM_WEBHOOK_SECRET
@@ -160,13 +118,13 @@ import secrets
 print(secrets.token_hex(32))
 PY
 )"
-    printf '%s' "$TELEGRAM_WEBHOOK_SECRET" > "$SECRET_FILE"
-    chmod 600 "$SECRET_FILE"
+    printf '%s' "$TELEGRAM_WEBHOOK_SECRET" > "$SECRET_FILE" 2>/dev/null || true
+    chmod 600 "$SECRET_FILE" 2>/dev/null || true
     export TELEGRAM_WEBHOOK_SECRET
   fi
 fi
 
-# 大模型多前缀提取与转换矩阵矩阵
+# 大模型多前缀提取与转换矩阵
 MODEL_INPUT="${HERMES_MODEL:-${LLM_MODEL:-}}"
 MODEL_FOR_CONFIG="$MODEL_INPUT"
 PROVIDER_FOR_CONFIG="${HERMES_INFERENCE_PROVIDER:-auto}"
@@ -317,7 +275,10 @@ if os.environ.get("TELEGRAM_BOT_TOKEN"):
         ])
 
 path.write_text(yaml.safe_dump(config, sort_keys=False), encoding="utf-8")
-path.chmod(0o664)
+try:
+    path.chmod(0o777)
+except Exception:
+    pass
 PY
 
 HERMES_RUNTIME_VERSION="$(/opt/hermes/.venv/bin/hermes --version 2>/dev/null | awk '{print $NF; exit}' || true)"
@@ -343,10 +304,10 @@ start_jupyter() {
   
   export JUPYTER_TOKEN="$GATEWAY_TOKEN"
   local VENV_PYTHON="/opt/hermes/.venv/bin/python"
-  local root_dir="${JUPYTER_ROOT_DIR:-$HERMES_HOME/workspace}"
-  mkdir -p "$root_dir"
+  local root_dir="${JUPYTER_ROOT_DIR:-$TARGET_HOME/workspace}"
+  mkdir -p "$root_dir" 2>/dev/null || true
   
-  ln -sfn "$HERMES_HOME" "$root_dir/HuggingMes" 2>/dev/null || true
+  ln -sfn "$TARGET_HOME" "$root_dir/HuggingMes" 2>/dev/null || true
   
   echo "Starting JupyterLab terminal on port 8888 (root: $root_dir)"
   "$VENV_PYTHON" -m jupyterlab \
@@ -367,7 +328,7 @@ start_jupyter() {
     --LabApp.check_for_updates_class=jupyterlab.NeverCheckForUpdate \
     --ServerApp.log_level=WARN \
     --ServerApp.root_dir="$root_dir" \
-    >> "$HERMES_HOME/logs/jupyter.log" 2>&1 &
+    >> "$TARGET_HOME/logs/jupyter.log" 2>&1 &
   JUPYTER_PID=$!
   export JUPYTER_PID
   echo "JupyterLab started (PID: $JUPYTER_PID)"
@@ -382,7 +343,7 @@ trap graceful_shutdown SIGTERM SIGINT
 
 # Terminal 命令捕获与持久化同步器 (.bashrc 全量注入)
 if [ ! -f "$STARTUP_FILE" ]; then
-  touch "$STARTUP_FILE" && chmod +x "$STARTUP_FILE"
+  touch "$STARTUP_FILE" 2>/dev/null && chmod +x "$STARTUP_FILE" 2>/dev/null || true
 fi
 cat > "$HOME/.bashrc" << 'BASHRC'
 export PATH="/opt/hermes/.venv/bin:/opt/data/.local/bin:$PATH"
@@ -393,9 +354,9 @@ STARTUP_FILE="$HERMES_HOME/workspace/startup.sh"
 _hm_append() {
   [ "${HUGGINGMES_CAPTURE_DISABLE:-0}" = "1" ] && return 0
   local line="$*"
-  mkdir -p "$(dirname "$STARTUP_FILE")"
-  touch "$STARTUP_FILE" && chmod +x "$STARTUP_FILE" 2>/dev/null || true
-  grep -qxF "$line" "$STARTUP_FILE" 2>/dev/null || echo "$line" >> "$STARTUP_FILE"
+  mkdir -p "$(dirname "$STARTUP_FILE")" 2>/dev/null || true
+  touch "$STARTUP_FILE" 2>/dev/null && chmod +x "$STARTUP_FILE" 2>/dev/null || true
+  grep -qxF "$line" "$STARTUP_FILE" 2>/dev/null || echo "$line" >> "$STARTUP_FILE" 2>/dev/null || true
 }
 _hm_quote_args() {
   local quoted=() arg
@@ -515,7 +476,7 @@ HEALTH_PID=$!
 start_dashboard_once() {
   if [ -n "${DASHBOARD_PID:-}" ] && kill -0 "$DASHBOARD_PID" 2>/dev/null; then return 0; fi
   echo "Launching Hermes dashboard..."
-  (hermes dashboard --host 127.0.0.1 --insecure 2>&1 | tee -a "$HERMES_HOME/logs/dashboard.log") &
+  (hermes dashboard --host 127.0.0.1 --insecure 2>&1 | tee -a "$TARGET_HOME/logs/dashboard.log") &
   DASHBOARD_PID=$!
 }
 
@@ -540,7 +501,7 @@ while true; do
   fi
 
   echo "Launching Hermes gateway..."
-  (hermes gateway run 2>&1 | tee -a "$HERMES_HOME/logs/gateway.log") &
+  (hermes gateway run 2>&1 | tee -a "$TARGET_HOME/logs/gateway.log") &
   GATEWAY_PID=$!
 
   ready=false
@@ -555,7 +516,7 @@ while true; do
 
   if [ "$ready" != "true" ]; then
     echo "Hermes gateway failed to expose ports. Logs tail:"
-    tail -40 "$HERMES_HOME/logs/gateway.log" || true
+    tail -40 "$TARGET_HOME/logs/gateway.log" || true
     exit 1
   fi