Update start.sh

start.sh

@@ -1,563 +1,122 @@
-#!/bin/bash
-set -euo pipefail
-
-# ─────────────────────────────────────────────────────────────────────────
-# 🔥 阶段一：特权初始化与存储桶强力清洗（Root空间）
-# ─────────────────────────────────────────────────────────────────────────
-if [ "$(id -u)" -eq 0 ]; then
-  echo "[Storage-Sanitizer] Executing root initialization and lock scrubbing..."
-  
-  TARGET_HOME="${HERMES_HOME:-/opt/data}"
-  # 预先建立好原本属于 hermes 用户的存储层级拓扑
-  mkdir -p "$TARGET_HOME"/{cron,sessions,logs,hooks,memories,skills,skins,plans,workspace,home,plugins}
-  
-  # 清除上一次运行闪退在存储桶里留下的幽灵锁与僵尸 PID 文件
-  find "$TARGET_HOME" -name "*.lock" -delete 2>/dev/null || true
-  find "$TARGET_HOME" -name "*.pid" -delete 2>/dev/null || true
-  
-  # 动态纠正因跨容器调度可能引起的物理存储卷挂载 UID 偏差
-  chown -R hermes:hermes "$TARGET_HOME" 2>/dev/null || true
-  
-  echo "[Storage-Sanitizer] Dropping privileges safely to user 'hermes'."
-  # 携带整套业务底座所需的全部环境变量，无缝将主进程控制权交回用户空间
-  exec runuser -u hermes -- env \
-    PATH="/opt/hermes/.venv/bin:/opt/data/.local/bin:$PATH" \
-    HOME="$HOME" \
-    HERMES_HOME="$TARGET_HOME" \
-    DEV_MODE="${DEV_MODE:-true}" \
-    GATEWAY_TOKEN="${GATEWAY_TOKEN:-}" \
-    API_SERVER_KEY="${API_SERVER_KEY:-}" \
-    API_SERVER_ENABLED="${API_SERVER_ENABLED:-true}" \
-    API_SERVER_HOST="${API_SERVER_HOST:-127.0.0.1}" \
-    API_SERVER_PORT="${API_SERVER_PORT:-8642}" \
-    GATEWAY_HEALTH_URL="${GATEWAY_HEALTH_URL:-http://127.0.0.1:8642}" \
-    TELEGRAM_WEBHOOK_PORT="${TELEGRAM_WEBHOOK_PORT:-8765}" \
-    PORT="${PORT:-7861}" \
-    HERMES_MODEL="${HERMES_MODEL:-}" \
-    LLM_MODEL="${LLM_MODEL:-}" \
-    HERMES_INFERENCE_PROVIDER="${HERMES_INFERENCE_PROVIDER:-auto}" \
-    LLM_API_KEY="${LLM_API_KEY:-}" \
-    CUSTOM_BASE_URL="${CUSTOM_BASE_URL:-}" \
-    CUSTOM_PROVIDER="${CUSTOM_PROVIDER:-}" \
-    CUSTOM_API_KEY="${CUSTOM_API_KEY:-}" \
-    CLOUDFLARE_WORKERS_TOKEN="${CLOUDFLARE_WORKERS_TOKEN:-}" \
-    CLOUDFLARE_PROXY_URL="${CLOUDFLARE_PROXY_URL:-}" \
-    TELEGRAM_BOT_TOKEN="${TELEGRAM_BOT_TOKEN:-}" \
-    SPACE_HOST="${SPACE_HOST:-}" \
-    TELEGRAM_MODE="${TELEGRAM_MODE:-}" \
-    TELEGRAM_ALLOWED_USERS="${TELEGRAM_ALLOWED_USERS:-}" \
-    TELEGRAM_USER_IDS="${TELEGRAM_USER_IDS:-}" \
-    HUGGINGMES_APT_PACKAGES="${HUGGINGMES_APT_PACKAGES:-}" \
-    HUGGINGMES_PIP_PACKAGES="${HUGGINGMES_PIP_PACKAGES:-}" \
-    HUGGINGMES_NPM_PACKAGES="${HUGGINGMES_NPM_PACKAGES:-}" \
-    HUGGINGMES_RUN="${HUGGINGMES_RUN:-}" \
-    /bin/bash "$0" "$@"
-fi
-
-# ─────────────────────────────────────────────────────────────────────────
-# 🛡️ 阶段二：安全降权沙箱运行（Hermes空间）
-# ─────────────────────────────────────────────────────────────────────────
-# 恢复原项目高强度安全掩码阻断非法外部嗅探
-umask 0077
-
-APP_DIR="${HUGGINGMES_APP_DIR:-/opt/huggingmes}"
-HERMES_HOME="${HERMES_HOME:-/opt/data}"
-PUBLIC_PORT="${PORT:-7861}"
-GATEWAY_API_PORT="${API_SERVER_PORT:-8642}"
-DASHBOARD_PORT="${DASHBOARD_PORT:-9119}"
-TELEGRAM_WEBHOOK_PORT="${TELEGRAM_WEBHOOK_PORT:-8765}"
-CF_PROXY_ENV_FILE="/tmp/huggingmes-cloudflare-proxy.env"
-STARTUP_FILE="$HERMES_HOME/workspace/startup.sh"
-
-export HERMES_HOME
-export API_SERVER_ENABLED="${API_SERVER_ENABLED:-true}"
-export API_SERVER_HOST="${API_SERVER_HOST:-127.0.0.1}"
-export API_SERVER_PORT="$GATEWAY_API_PORT"
-export GATEWAY_HEALTH_URL="${GATEWAY_HEALTH_URL:-http://127.0.0.1:${GATEWAY_API_PORT}}"
-export TELEGRAM_WEBHOOK_PORT
-
-echo ""
-echo "  ╔══════════════════════════════════════════╗"
-echo "  ║        🪽 HuggingMes Hermes Gateway      ║"
-echo "  ╚══════════════════════════════════════════╝"
-echo ""
-
-# Token 密钥配对自适应链条
-if [ -z "${API_SERVER_KEY:-}" ]; then
-  if [ -n "${GATEWAY_TOKEN:-}" ]; then
-    export API_SERVER_KEY="$GATEWAY_TOKEN"
-  else
-    API_SERVER_KEY="$(python3 - <<'PY'
-import secrets
-print(secrets.token_urlsafe(32))
-PY
-)"
-    export API_SERVER_KEY
-    echo "GATEWAY_TOKEN not set - generated an ephemeral API token for this boot."
-  fi
-fi
-
-# 【终极同步修复】：强行对齐全局变量断言，确保官方前端 Terminal 握手成功���报错
-export GATEWAY_TOKEN="$API_SERVER_KEY"
-
-# 系统本地运行依赖树拓扑生成
-mkdir -p "$HERMES_HOME"/{cron,sessions,logs,hooks,memories,skills,skins,plans,workspace,home,plugins}
-mkdir -p "$HERMES_HOME/.local/bin"
-
-if [ ! -L "$HERMES_HOME/.local/bin/hermes" ]; then
-  rm -f "$HERMES_HOME/.local/bin/hermes"
-  ln -sfn /opt/hermes/.venv/bin/hermes "$HERMES_HOME/.local/bin/hermes"
-fi
-
-if [ ! -L "${HOME}/.hermes/plugins" ]; then
-  mkdir -p "${HOME}/.hermes"
-  rm -rf "${HOME}/.hermes/plugins"
-  ln -sfn "$HERMES_HOME/plugins" "${HOME}/.hermes/plugins"
-fi
-
-# Cloudflare 网络层代理反向构建
-CLOUDFLARE_WORKERS_TOKEN="${CLOUDFLARE_WORKERS_TOKEN:-${CLOUDFLARE_API_TOKEN:-}}"
-export CLOUDFLARE_WORKERS_TOKEN
-if [ -n "${CLOUDFLARE_WORKERS_TOKEN:-}" ] || [ -n "${CLOUDFLARE_PROXY_URL:-}" ]; then
-  export CLOUDFLARE_PROXY_DEBUG="${CLOUDFLARE_PROXY_DEBUG:-false}"
-  echo "Preparing Cloudflare Telegram proxy..."
-  python3 "$APP_DIR/cloudflare-proxy-setup.py" || true
-  if [ -f "$CF_PROXY_ENV_FILE" ]; then
-    . "$CF_PROXY_ENV_FILE"
-  fi
-fi
-
-if [ -n "${CLOUDFLARE_WORKERS_TOKEN:-}" ]; then
-  echo "Preparing Cloudflare Keepalive worker..."
-  python3 "$APP_DIR/cloudflare-keepalive-setup.py" || true
-fi
-
-# Telegram 鉴权通道提取
-if [ -n "${TELEGRAM_USER_IDS:-}" ] && [ -z "${TELEGRAM_ALLOWED_USERS:-}" ]; then
-  export TELEGRAM_ALLOWED_USERS="$TELEGRAM_USER_IDS"
-elif [ -n "${TELEGRAM_USER_ID:-}" ] && [ -z "${TELEGRAM_ALLOWED_USERS:-}" ]; then
-  export TELEGRAM_ALLOWED_USERS="$TELEGRAM_USER_ID"
-fi
-
-if [ -n "${TELEGRAM_BOT_TOKEN:-}" ] && [ -n "${SPACE_HOST:-}" ] && [ -z "${TELEGRAM_WEBHOOK_URL:-}" ]; then
-  if [ "${TELEGRAM_MODE:-webhook}" != "polling" ]; then
-    export TELEGRAM_WEBHOOK_URL="https://${SPACE_HOST}/telegram"
-  fi
-fi
-
-if [ -n "${TELEGRAM_WEBHOOK_URL:-}" ] && [ -z "${TELEGRAM_WEBHOOK_SECRET:-}" ]; then
-  SECRET_FILE="$HERMES_HOME/.huggingmes-telegram-webhook-secret"
-  if [ -f "$SECRET_FILE" ]; then
-    TELEGRAM_WEBHOOK_SECRET="$(cat "$SECRET_FILE")"
-    export TELEGRAM_WEBHOOK_SECRET
-  else
-    TELEGRAM_WEBHOOK_SECRET="$(python3 - <<'PY'
-import secrets
-print(secrets.token_hex(32))
-PY
-)"
-    printf '%s' "$TELEGRAM_WEBHOOK_SECRET" > "$SECRET_FILE"
-    chmod 600 "$SECRET_FILE"
-    export TELEGRAM_WEBHOOK_SECRET
-  fi
-fi
-
-# 大模型特有转换矩阵矩阵（100% 完整继承）
-MODEL_INPUT="${HERMES_MODEL:-${LLM_MODEL:-}}"
-MODEL_FOR_CONFIG="$MODEL_INPUT"
-PROVIDER_FOR_CONFIG="${HERMES_INFERENCE_PROVIDER:-auto}"
-LLM_API_KEY="${LLM_API_KEY:-}"
-
-if [ -n "$MODEL_INPUT" ]; then
-  MODEL_PREFIX="${MODEL_INPUT%%/*}"
-else
-  MODEL_PREFIX=""
-fi
-
-case "$MODEL_PREFIX" in
-  openrouter)
-    [ -n "$LLM_API_KEY" ] && export OPENROUTER_API_KEY="${OPENROUTER_API_KEY:-$LLM_API_KEY}"
-    [ "$PROVIDER_FOR_CONFIG" = "auto" ] && PROVIDER_FOR_CONFIG="openrouter"
-    MODEL_FOR_CONFIG="${MODEL_INPUT#openrouter/}"
-    ;;
-  huggingface|hf)
-    [ -n "$LLM_API_KEY" ] && export HF_TOKEN="${HF_TOKEN:-$LLM_API_KEY}"
-    [ "$PROVIDER_FOR_CONFIG" = "auto" ] && PROVIDER_FOR_CONFIG="huggingface"
-    MODEL_FOR_CONFIG="${MODEL_INPUT#huggingface/}"
-    ;;
-  vercel-ai-gateway|ai-gateway)
-    [ -n "$LLM_API_KEY" ] && export AI_GATEWAY_API_KEY="${AI_GATEWAY_API_KEY:-$LLM_API_KEY}"
-    [ "$PROVIDER_FOR_CONFIG" = "auto" ] && PROVIDER_FOR_CONFIG="ai-gateway"
-    MODEL_FOR_CONFIG="${MODEL_INPUT#*/}"
-    ;;
-  anthropic) [ -n "$LLM_API_KEY" ] && export ANTHROPIC_API_KEY="${ANTHROPIC_API_KEY:-$LLM_API_KEY}" ;;
-  openai|openai-codex) [ -n "$LLM_API_KEY" ] && export OPENAI_API_KEY="${OPENAI_API_KEY:-$LLM_API_KEY}" ;;
-  google|gemini)
-    [ -n "$LLM_API_KEY" ] && export GOOGLE_API_KEY="${GOOGLE_API_KEY:-$LLM_API_KEY}" GEMINI_API_KEY="${GEMINI_API_KEY:-$LLM_API_KEY}"
-    PROVIDER_FOR_CONFIG="gemini"
-    MODEL_FOR_CONFIG="${MODEL_INPUT#*/}"
-    ;;
-  deepseek) [ -n "$LLM_API_KEY" ] && export DEEPSEEK_API_KEY="${DEEPSEEK_API_KEY:-$LLM_API_KEY}" ;;
-  kimi-coding|moonshot) [ -n "$LLM_API_KEY" ] && export KIMI_API_KEY="${KIMI_API_KEY:-$LLM_API_KEY}" ;;
-  kimi-coding-cn|moonshot-cn|kimi-cn) [ -n "$LLM_API_KEY" ] && export KIMI_CN_API_KEY="${KIMI_CN_API_KEY:-$LLM_API_KEY}" ;;
-  minimax) [ -n "$LLM_API_KEY" ] && export MINIMAX_API_KEY="${MINIMAX_API_KEY:-$LLM_API_KEY}" ;;
-  minimax-cn) [ -n "$LLM_API_KEY" ] && export MINIMAX_CN_API_KEY="${MINIMAX_CN_API_KEY:-$LLM_API_KEY}" ;;
-  xiaomi) [ -n "$LLM_API_KEY" ] && export XIAOMI_API_KEY="${XIAOMI_API_KEY:-$LLM_API_KEY}" ;;
-  zai|z-ai|z.ai|glm) [ -n "$LLM_API_KEY" ] && export GLM_API_KEY="${GLM_API_KEY:-$LLM_API_KEY}" ;;
-  arcee|arcee-ai|arceeai) [ -n "$LLM_API_KEY" ] && export ARCEEAI_API_KEY="${ARCEEAI_API_KEY:-$LLM_API_KEY}" ;;
-  gmi|gmi-cloud|gmicloud) [ -n "$LLM_API_KEY" ] && export GMI_API_KEY="${GMI_API_KEY:-$LLM_API_KEY}" ;;
-  alibaba|alibaba-coding-plan|alibaba_coding) [ -n "$LLM_API_KEY" ] && export DASHSCOPE_API_KEY="${DASHSCOPE_API_KEY:-$LLM_API_KEY}" ;;
-  tencent-tokenhub|tencent|tokenhub|tencentmaas) [ -n "$LLM_API_KEY" ] && export TOKENHUB_API_KEY="${TOKENHUB_API_KEY:-$LLM_API_KEY}" ;;
-  nvidia) [ -n "$LLM_API_KEY" ] && export NVIDIA_API_KEY="${NVIDIA_API_KEY:-$LLM_API_KEY}" ;;
-  xai|grok) [ -n "$LLM_API_KEY" ] && export XAI_API_KEY="${XAI_API_KEY:-$LLM_API_KEY}" ;;
-  kilocode) [ -n "$LLM_API_KEY" ] && export KILOCODE_API_KEY="${KILOCODE_API_KEY:-$LLM_API_KEY}" ;;
-  opencode-zen) [ -n "$LLM_API_KEY" ] && export OPENCODE_ZEN_API_KEY="${OPENCODE_ZEN_API_KEY:-$LLM_API_KEY}" ;;
-  opencode-go) [ -n "$LLM_API_KEY" ] && export OPENCODE_GO_API_KEY="${OPENCODE_GO_API_KEY:-$LLM_API_KEY}" ;;
-esac
-
-if [ -n "${CUSTOM_BASE_URL:-}" ]; then
-  PROVIDER_FOR_CONFIG="${CUSTOM_PROVIDER:-custom}"
-  [ -n "$LLM_API_KEY" ] && export OPENAI_API_KEY="${OPENAI_API_KEY:-$LLM_API_KEY}"
-fi
-
-export MODEL_FOR_CONFIG PROVIDER_FOR_CONFIG
-export CUSTOM_BASE_URL="${CUSTOM_BASE_URL:-}"
-export CUSTOM_API_KEY="${CUSTOM_API_KEY:-${LLM_API_KEY:-}}"
-export CUSTOM_MODEL_CONTEXT_LENGTH="${CUSTOM_MODEL_CONTEXT_LENGTH:-131072}"
-export CUSTOM_MODEL_MAX_TOKENS="${CUSTOM_MODEL_MAX_TOKENS:-8192}"
-export TELEGRAM_BASE_URL="${TELEGRAM_BASE_URL:-}"
-export TELEGRAM_BASE_FILE_URL="${TELEGRAM_BASE_FILE_URL:-}"
-
-if [ -n "${CLOUDFLARE_PROXY_URL:-}" ] && [ -z "$TELEGRAM_BASE_URL" ]; then
-  CLOUDFLARE_PROXY_URL="${CLOUDFLARE_PROXY_URL%/}"
-  export TELEGRAM_BASE_URL="${CLOUDFLARE_PROXY_URL}/bot"
-  export TELEGRAM_BASE_FILE_URL="${CLOUDFLARE_PROXY_URL}/file/bot"
-fi
-
-promote_first_pool_key() {
-  local singular_var="$1" local pool_var="$2"
-  local singular_val="${!singular_var:-}" pool_val="${!pool_var:-}"
-  [ -n "$singular_val" ] && return 0
-  [ -n "$pool_val" ] || return 0
-  local first
-  first=$(printf '%s' "$pool_val" | tr ',' '\n' | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//' | awk 'NF{print; exit}')
-  [ -n "$first" ] || return 0
-  export "${singular_var}=$first"
-}
-promote_first_pool_key "OPENROUTER_API_KEY"   "OPENROUTER_API_KEYS"
-promote_first_pool_key "ANTHROPIC_API_KEY"    "ANTHROPIC_API_KEYS"
-promote_first_pool_key "OPENAI_API_KEY"       "OPENAI_API_KEYS"
-promote_first_pool_key "GOOGLE_API_KEY"       "GOOGLE_API_KEYS"
-promote_first_pool_key "GEMINI_API_KEY"       "GEMINI_API_KEYS"
-promote_first_pool_key "DEEPSEEK_API_KEY"     "DEEPSEEK_API_KEYS"
-promote_first_pool_key "KIMI_API_KEY"         "KIMI_API_KEYS"
-promote_first_pool_key "MINIMAX_API_KEY"      "MINIMAX_API_KEYS"
-promote_first_pool_key "NVIDIA_API_KEY"       "NVIDIA_API_KEYS"
-promote_first_pool_key "XAI_API_KEY"          "XAI_API_KEYS"
-promote_first_pool_key "KILOCODE_API_KEY"     "KILOCODE_API_KEYS"
-promote_first_pool_key "GLM_API_KEY"          "GLM_API_KEYS"
-promote_first_pool_key "ARCEEAI_API_KEY"      "ARCEEAI_API_KEYS"
-promote_first_pool_key "DASHSCOPE_API_KEY"    "DASHSCOPE_API_KEYS"
-promote_first_pool_key "GMI_API_KEY"          "GMI_API_KEYS"
-promote_first_pool_key "TOKENHUB_API_KEY"     "TOKENHUB_API_KEYS"
-
-# YAML 多组学环境配置刷入
-python3 - <<'PY'
-import os
-from pathlib import Path
-import yaml
-home = Path(os.environ["HERMES_HOME"])
-path = home / "config.yaml"
+# 采用官方给定的核心底座
+ARG HERMES_AGENT_VERSION=latest
+FROM nousresearch/hermes-agent:${HERMES_AGENT_VERSION}
+
+USER root
+
+# 1. [span_2](start_span)完整保留原项目的全部系统依赖[span_2](end_span)
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    curl \
+    jq \
+    sudo \
+    python3 \
+    python3-venv \
+    python3-pip \
+    chromium \
+    dbus \
+    dbus-x11 \
+    libnss3 \
+    libatk1.0-0 \
+    libatk-bridge2.0-0 \
+    libdrm2 \
+    libgbm1 \
+    libxcomposite1 \
+    libxdamage1 \
+    libxrandr2 \
+    libxkbcommon0 \
+    libx11-6 \
+    libxext6 \
+    libxfixes3 \
+    fonts-dejavu-core \
+    fonts-liberation \
+    fonts-noto-color-emoji \
+    && (apt-get install -y --no-install-recommends libasound2 2>/dev/null \
+        || apt-get install -y --no-install-recommends libasound2t64 2>/dev/null \
+        || true) \
+    && rm -rf /var/lib/apt/lists/*
+
+# 2. [span_3](start_span)将 JupyterLab 注入到虚拟环境中以驱动原项目的 Terminal 终端[span_3](end_span)
+RUN uv pip install --python /opt/hermes/.venv/bin/python --no-cache-dir \
+        "jupyterlab>=4.0,<5" \
+        "tornado>=6.4" \
+        "ipywidgets>=8.1" \
+    && printf 'hermes ALL=(ALL) NOPASSWD: ALL\n' > /etc/sudoers.d/hermes \
+    && chmod 0440 /etc/sudoers.d/hermes \
+    && /usr/sbin/visudo -cf /etc/sudoers.d/hermes
+
+# 3. 复制魔改项目的全部核心组件
+COPY --chown=hermes:hermes start.sh /opt/huggingmes/start.sh
+COPY --chown=hermes:hermes health-server.js /opt/huggingmes/health-server.js
+COPY --chown=hermes:hermes cloudflare-proxy-setup.py /opt/huggingmes/cloudflare-proxy-setup.py
+COPY --chown=hermes:hermes cloudflare-keepalive-setup.py /opt/huggingmes/cloudflare-keepalive-setup.py
+COPY --chown=hermes:hermes env-builder.html /opt/huggingmes/env-builder.html
+COPY --chown=hermes:hermes env-builder.js /opt/huggingmes/env-builder.js
+
+RUN chmod +x \
+    /opt/huggingmes/start.sh \
+    /opt/huggingmes/cloudflare-proxy-setup.py \
+    /opt/huggingmes/cloudflare-keepalive-setup.py
+
+# 4. [span_4](start_span)保留原项目看板数据库迁移幂等补丁[span_4](end_span)
+RUN python3 - <<'PY'
+import sys
 try:
-    config = yaml.safe_load(path.read_text(encoding="utf-8")) or {}
-except FileNotFoundError:
-    config = {}
-
-model_name = os.environ.get("MODEL_FOR_CONFIG", "").strip()
-provider_name = os.environ.get("PROVIDER_FOR_CONFIG", "").strip()
-if model_name:
-    model = config.setdefault("model", {})
-    model["default"] = model_name
-    if provider_name and provider_name != "auto":
-        model["provider"] = provider_name
-    else:
-        model.pop("provider", None)
-
-custom_base = os.environ.get("CUSTOM_BASE_URL", "").strip()
-if custom_base and model_name:
-    model.setdefault("base_url", custom_base.rstrip("/"))
-    if os.environ.get("CUSTOM_API_KEY"):
-        model.setdefault("api_key", os.environ["CUSTOM_API_KEY"])
-    try:
-        model.setdefault("context_length", int(os.environ.get("CUSTOM_MODEL_CONTEXT_LENGTH", "131072")))
-        model.setdefault("max_tokens", int(os.environ.get("CUSTOM_MODEL_MAX_TOKENS", "8192")))
-    except ValueError:
-        pass
-
-config.setdefault("terminal", {}).setdefault("cwd", os.environ.get("MESSAGING_CWD", str(home / "workspace")))
-config.setdefault("compression", {}).setdefault("enabled", True)
-config.setdefault("display", {}).setdefault("background_process_notifications", os.environ.get("HERMES_BACKGROUND_NOTIFICATIONS", "result"))
-config.setdefault("security", {}).setdefault("redact_secrets", True)
-
-platforms = config.setdefault("platforms", {})
-if os.environ.get("TELEGRAM_BOT_TOKEN"):
-    telegram = platforms.setdefault("telegram", {})
-    telegram.setdefault("enabled", True)
-    extra = telegram.setdefault("extra", {})
-    if os.environ.get("TELEGRAM_BASE_URL"):
-        extra.setdefault("base_url", os.environ["TELEGRAM_BASE_URL"])
-        extra.setdefault("base_file_url", os.environ.get("TELEGRAM_BASE_FILE_URL") or os.environ["TELEGRAM_BASE_URL"])
-    if os.environ.get("TELEGRAM_ALLOWED_USERS"):
-        config.setdefault("telegram", {}).setdefault("allow_from", [
-            item.strip() for item in os.environ["TELEGRAM_ALLOWED_USERS"].split(",") if item.strip()
-        ])
-
-path.write_text(yaml.safe_dump(config, sort_keys=False), encoding="utf-8")
-path.chmod(0o664)
+    from pathlib import Path
+
+    p = Path("/opt/hermes/hermes_cli/kanban_db.py")
+    if not p.exists():
+        print("kanban patch: file not found, skipping")
+        sys.exit(0)
+
+    src = p.read_text(encoding="utf-8", errors="replace")
+    sentinel = "# huggingmes: idempotent-alter"
+    if sentinel in src:
+        print("kanban patch: already applied, skipping")
+        sys.exit(0)
+
+    old = (
+        '    conn.execute(\n'
+        '        "ALTER TABLE tasks ADD COLUMN consecutive_failures "\n'
+        '        "INTEGER NOT NULL DEFAULT 0"\n'
+        '    )'
+    )
+    new = (
+        f'    try:  {sentinel}\n'
+        '        conn.execute(\n'
+        '            "ALTER TABLE tasks ADD COLUMN consecutive_failures "\n'
+        '            "INTEGER NOT NULL DEFAULT 0"\n'
+        '        )\n'
+        '    except Exception:\n'
+        '        pass'
+    )
+
+    if old not in src:
+        print("kanban patch: pattern not found, may be fixed upstream, skipping")
+        sys.exit(0)
+
+    p.write_text(src.replace(old, new), encoding="utf-8")
+    print("kanban patch: applied")
+except Exception as e:
+    print(f"kanban patch: error ({e}), skipping", file=sys.stderr)
 PY
 
-# 环境就绪面板构建
-HERMES_RUNTIME_VERSION="$(/opt/hermes/.venv/bin/hermes --version 2>/dev/null | awk '{print $NF; exit}' || true)"
-echo ""
-[ -n "${HERMES_RUNTIME_VERSION:-}" ] && echo "Version   : ${HERMES_RUNTIME_VERSION}"
-echo "Model     : ${MODEL_FOR_CONFIG:-unset}"
-echo "Provider  : ${PROVIDER_FOR_CONFIG:-unset}"
-echo "Routes    : /app/ (Hermes UI), /terminal/ (JupyterLab)"
-echo "Dashboard : http://127.0.0.1:${DASHBOARD_PORT}"
-echo "Gateway   : http://127.0.0.1:${GATEWAY_API_PORT}"
-echo ""
-
-# JupyterLab 后台运行线程
-JUPYTER_PID=""
-start_jupyter() {
-  if [ "${DEV_MODE:-true}" = "false" ]; then
-    echo "JupyterLab disabled (DEV_MODE=false)."
-    return 0
-  fi
-  if [ -n "${JUPYTER_PID:-}" ] && kill -0 "$JUPYTER_PID" 2>/dev/null; then
-    return 0
-  fi
-  
-  export JUPYTER_TOKEN="$GATEWAY_TOKEN"
-  local VENV_PYTHON="/opt/hermes/.venv/bin/python"
-  local root_dir="${JUPYTER_ROOT_DIR:-$HERMES_HOME/workspace}"
-  mkdir -p "$root_dir"
-  
-  # 完美复现原项目第 331 行行为
-  ln -sfn "$HERMES_HOME" "$root_dir/HuggingMes" 2>/dev/null || true
-  
-  echo "Starting JupyterLab terminal on port 8888 (root: $root_dir)"
-  "$VENV_PYTHON" -m jupyterlab \
-    --ip 127.0.0.1 \
-    --port 8888 \
-    --no-browser \
-    --IdentityProvider.token="$JUPYTER_TOKEN" \
-    --ServerApp.base_url=/terminal/ \
-    --ServerApp.terminals_enabled=True \
-    --ServerApp.terminado_settings='{"shell_command":["/bin/bash","-i"]}' \
-    --ServerApp.allow_origin='*' \
-    --ServerApp.allow_remote_access=True \
-    --ServerApp.trust_xheaders=True \
-    --ServerApp.tornado_settings="{'headers': {'Content-Security-Policy': 'frame-ancestors *'}}" \
-    --IdentityProvider.cookie_options="{'SameSite': 'None', 'Secure': True}" \
-    --ServerApp.disable_check_xsrf=True \
-    --LabApp.news_url=None \
-    --LabApp.check_for_updates_class=jupyterlab.NeverCheckForUpdate \
-    --ServerApp.log_level=WARN \
-    --ServerApp.root_dir="$root_dir" \
-    >> "$HERMES_HOME/logs/jupyter.log" 2>&1 &
-  JUPYTER_PID=$!
-  export JUPYTER_PID
-  echo "JupyterLab started (PID: $JUPYTER_PID)"
-}
-
-graceful_shutdown() {
-  echo "Shutting down HuggingMes..."
-  kill $(jobs -p) 2>/dev/null || true
-  exit 0
-}
-trap graceful_shutdown SIGTERM SIGINT
-
-# Shell 行为劫持恢复矩阵 (.bashrc 全量注入)
-if [ ! -f "$STARTUP_FILE" ]; then
-  touch "$STARTUP_FILE" && chmod +x "$STARTUP_FILE"
-fi
-cat > "$HOME/.bashrc" << 'BASHRC'
-export PATH="/opt/hermes/.venv/bin:/opt/data/.local/bin:$PATH"
-export DEBIAN_FRONTEND="${DEBIAN_FRONTEND:-noninteractive}"
-[ -z "${PS1:-}" ] || PS1="\u@\h:\w\$ "
-HERMES_HOME="${HERMES_HOME:-/opt/data}"
-STARTUP_FILE="$HERMES_HOME/workspace/startup.sh"
-_hm_append() {
-  [ "${HUGGINGMES_CAPTURE_DISABLE:-0}" = "1" ] && return 0
-  local line="$*"
-  mkdir -p "$(dirname "$STARTUP_FILE")"
-  touch "$STARTUP_FILE" && chmod +x "$STARTUP_FILE" 2>/dev/null || true
-  grep -qxF "$line" "$STARTUP_FILE" 2>/dev/null || echo "$line" >> "$STARTUP_FILE"
-}
-_hm_quote_args() {
-  local quoted=() arg
-  for arg in "$@"; do printf -v arg '%q' "$arg"; quoted+=("$arg"); done
-  printf '%s' "${quoted[*]}"
-}
-_hm_append_cmd() {
-  local cmd="$1"; shift; local args; args=$(_hm_quote_args "$@")
-  if [ -n "$args" ]; then _hm_append "$cmd $args"; else _hm_append "$cmd"; fi
-}
-_hm_args_without_flags() {
-  for arg in "$@"; do case "$arg" in ''|-|--*|-*) ;; *) printf '%s\n' "$arg" ;; esac; done
-}
-_hm_has_install_targets() {
-  local item
-  while IFS= read -r item; do [ -n "$item" ] && return 0; done <<EOF
-$(_hm_args_without_flags "$@")
-EOF
-  return 1
-}
-_hm_can_sudo_apt() { command -v sudo >/dev/null 2>&1 && sudo -n apt-get --version >/dev/null 2>&1; }
-_hm_apt_install() {
-  if [ "$(id -u)" -eq 0 ]; then command apt-get update && command apt-get install -y "$@";
-  elif _hm_can_sudo_apt; then sudo apt-get update && sudo apt-get install -y "$@";
-  else echo "Error: apt install needs root." >&2; return 1; fi
-}
-apt-get() {
-  case "${1:-}" in
-    install) shift; _hm_apt_install "$@"; local rc=$?; [ $rc -eq 0 ] && _hm_has_install_targets "$@" && _hm_append_cmd "sudo apt-get update && sudo apt-get install -y" "$@"; return $rc ;;
-    update) if [ "$(id -u)" -eq 0 ]; then command apt-get "$@"; elif _hm_can_sudo_apt; then sudo apt-get "$@"; else command apt-get "$@"; fi; return $? ;;
-    *) command apt-get "$@"; return $? ;;
-  esac
-}
-apt() {
-  case "${1:-}" in
-    install) shift; _hm_apt_install "$@"; local rc=$?; [ $rc -eq 0 ] && _hm_has_install_targets "$@" && _hm_append_cmd "sudo apt-get update && sudo apt-get install -y" "$@"; return $rc ;;
-    update) if [ "$(id -u)" -eq 0 ]; then command apt "$@"; elif _hm_can_sudo_apt; then sudo apt "$@"; else command apt "$@"; fi; return $? ;;
-    *) command apt "$@"; return $? ;;
-  esac
-}
-pip() {
-  command pip "$@"; local rc=$?
-  [ $rc -eq 0 ] && [ "${1:-}" = "install" ] && ! grep -qE '\-r|\-\-requirement' <<<"$*" && _hm_has_install_targets "${@:2}" && _hm_append_cmd "pip install" "${@:2}"
-  return $rc
-}
-pip3() {
-  command pip3 "$@"; local rc=$?
-  [ $rc -eq 0 ] && [ "${1:-}" = "install" ] && ! grep -qE '\-r|\-\-requirement' <<<"$*" && _hm_has_install_targets "${@:2}" && _hm_append_cmd "pip install" "${@:2}"
-  return $rc
-}
-uv() {
-  command uv "$@"; local rc=$?
-  [ $rc -eq 0 ] && [ "${1:-}" = "pip" ] && [ "${2:-}" = "install" ] && ! grep -qE '\-r|\-\-requirements' <<<"$*" && _hm_has_install_targets "${@:3}" && _hm_append_cmd "uv pip install" "${@:3}"
-  return $rc
-}
-npm() {
-  command npm "$@"; local rc=$?
-  [ $rc -eq 0 ] && { [ "${1:-}" = "install" ] || [ "${1:-}" = "i" ]; } && { [ "${2:-}" = "-g" ] || [ "${2:-}" = "--global" ]; } && _hm_has_install_targets "${@:3}" && _hm_append_cmd "npm install -g" "${@:3}"
-  return $rc
-}
-hermes() {
-  command hermes "$@"
-  local grading=$?
-  [ $grading -eq 0 ] && [ "${1:-}" = "plugins" ] && [ "${2:-}" = "install" ] && _hm_has_install_targets "${@:3}" && _hm_append_cmd "hermes plugins install" "${@:3}"
-  return $grading
-}
-BASHRC
-
-cat > "$HOME/.profile" << 'PROFILE'
-[ -n "${BASH_VERSION:-}" ] && [ -f ~/.bashrc ] && . ~/.bashrc
-PROFILE
-
-# 环境自动化动态包加载
-HM_STARTUP_FAILURES=0
-if [ -n "${HUGGINGMES_APT_PACKAGES:-}" ]; then
-  read -r -a HM_APT_PACKAGES <<< "$HUGGINGMES_APT_PACKAGES"
-  if command -v sudo >/dev/null 2>&1; then sudo apt-get update && sudo apt-get install -y "${HM_APT_PACKAGES[@]}" || HM_STARTUP_FAILURES=$((HM_STARTUP_FAILURES + 1))
-  else apt-get update && apt-get install -y "${HM_APT_PACKAGES[@]}" || HM_STARTUP_FAILURES=$((HM_STARTUP_FAILURES + 1)); fi
-fi
-if [ -n "${HUGGINGMES_PIP_PACKAGES:-}" ]; then
-  read -r -a HM_PIP_PACKAGES <<< "$HUGGINGMES_PIP_PACKAGES"
-  /opt/hermes/.venv/bin/pip install "${HM_PIP_PACKAGES[@]}" || HM_STARTUP_FAILURES=$((HM_STARTUP_FAILURES + 1))
-fi
-if [ -n "${HUGGINGMES_NPM_PACKAGES:-}" ]; then
-  read -r -a HM_NPM_PACKAGES <<< "$HUGGINGMES_NPM_PACKAGES"
-  npm install -g "${HM_NPM_PACKAGES[@]}" || HM_STARTUP_FAILURES=$((HM_STARTUP_FAILURES + 1))
-fi
-
-hm_run_startup_auto() {
-  local payload="$1"
-  [ -n "$payload" ] || return 0
-  local script_file
-  script_file=$(mktemp "/tmp/huggingmes-startup.XXXXXX.sh")
-  {
-    echo 'export HUGGINGMES_CAPTURE_DISABLE=1'
-    echo '[ -f ~/.bashrc ] && . ~/.bashrc'
-    if [[ "$payload" == base64:* ]] || [[ "$payload" == b64:* ]]; then
-      printf '%s' "${payload#*:}" | base64 -d
-    else
-      printf '%s\n' "$payload"
-    fi
-  } > "$script_file" && chmod 700 "$script_file"
-  set +e; bash "$script_file"; local rc=$?; set -e; rm -f "$script_file"
-  [ $rc -eq 0 ] || HM_STARTUP_FAILURES=$((HM_STARTUP_FAILURES + 1))
-}
-[ -n "${HUGGINGMES_RUN:-}" ] && hm_run_startup_auto "$HUGGINGMES_RUN"
-
-if [ -s "$STARTUP_FILE" ]; then
-  echo "Replaying workspace/startup.sh packages..."
-  set +e; HUGGINGMES_CAPTURE_DISABLE=1 bash -l "$STARTUP_FILE"; set -e
-fi
-
-# 反睡眠多探针 Node 节点开启
-node "$APP_DIR/health-server.js" &
-HEALTH_PID=$!
-
-start_dashboard_once() {
-  if [ -n "${DASHBOARD_PID:-}" ] && kill -0 "$DASHBOARD_PID" 2>/dev/null; then return 0; fi
-  echo "Launching Hermes dashboard..."
-  (hermes dashboard --host 127.0.0.1 --insecure 2>&1 | tee -a "$HERMES_HOME/logs/dashboard.log") &
-  DASHBOARD_PID=$!
-}
-
-start_dashboard_once
-start_jupyter
-
-# ── 常驻核心守候管理循环 ──
-GATEWAY_RESTART_DELAY="${GATEWAY_RESTART_DELAY:-5}"
-GATEWAY_READY_TIMEOUT="${GATEWAY_READY_TIMEOUT:-120}"
-
-while true; do
-  if [ -n "${HEALTH_PID:-}" ] && ! kill -0 "$HEALTH_PID" 2>/dev/null; then
-    node "$APP_DIR/health-server.js" &
-    HEALTH_PID=$!
-  fi
-  if [ -n "${DASHBOARD_PID:-}" ] && ! kill -0 "$DASHBOARD_PID" 2>/dev/null; then
-    start_dashboard_once
-  fi
-  if [ "${DEV_MODE:-true}" != "false" ] && [ -n "${JUPYTER_PID:-}" ] && ! kill -0 "$JUPYTER_PID" 2>/dev/null; then
-    unset JUPYTER_PID
-    start_jupyter
-  fi
+# 5. [span_5](start_span)坚决维持原项目持久化存储桶挂载路径 /opt/data[span_5](end_span)
+RUN echo 'export PATH="/opt/hermes/.venv/bin:/opt/data/.local/bin:$PATH"' \
+    > /etc/profile.d/hermes-venv.sh
 
-  echo "Launching Hermes gateway..."
-  (hermes gateway run 2>&1 | tee -a "$HERMES_HOME/logs/gateway.log") &
-  GATEWAY_PID=$!
+# 环境变量修正：完全对齐官方与魔改共存的工作空间路径
+ENV HERMES_HOME=/opt/data \
+    HUGGINGMES_APP_DIR=/opt/huggingmes \
+    HERMES_AGENT_VERSION=${HERMES_AGENT_VERSION} \
+    PYTHONUNBUFFERED=1 \
+    PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH=/usr/bin/chromium
 
-  ready=false
-  for ((i=0; i<GATEWAY_READY_TIMEOUT; i++)); do
-    if (echo > "/dev/tcp/127.0.0.1/${GATEWAY_API_PORT}") 2>/dev/null; then
-      ready=true
-      break
-    fi
-    if ! kill -0 "$GATEWAY_PID" 2>/dev/null; then break; fi
-    sleep 1
-  done
+EXPOSE 7861
 
-  if [ "$ready" != "true" ]; then
-    echo "Hermes gateway failed to expose ports. Logs tail:"
-    tail -40 "$HERMES_HOME/logs/gateway.log" || true
-    exit 1
-  fi
+# [span_6](start_span)维持 HF Spaces 健康检查探针[span_6](end_span)
+HEALTHCHECK --interval=30s --timeout=5s --start-period=60s \
+  CMD curl -fsS http://localhost:7861/health || exit 1
 
-  set +e; wait "$GATEWAY_PID"; set -e
-  echo "Gateway exited, recovering in ${GATEWAY_RESTART_DELAY}s..."
-  sleep "$GATEWAY_RESTART_DELAY"
-done
+# 以 root 入口启动，用于在容器挂载冷启动时清洗和重置权限
+CMD ["/opt/huggingmes/start.sh"]