forked from bai/curriculum-project-hub
hongjr03
ecbc2c8666
runner.ts: 启用 SDK 内置沙箱(bubblewrap/seatbelt),写入限制在 workspace, denyRead 敏感路径,failIfUnavailable 硬拒非沙箱运行。bypassPermissions 保留 (headless 无交互),沙箱是硬边界而非权限提示层。 install_service.sh: 默认 service user 从 root 改为 cph-hub;env 模板修正 OPENROUTER_API_KEY → ANTHROPIC_AUTH_TOKEN/ANTHROPIC_BASE_URL/ANTHROPIC_API_KEY (与 server.ts 实际读取一致);补 __BASE_DIR__ sed 替换。 cph-hub.service: AssertPathExists=/usr/bin/bwrap 强制沙箱依赖;NoNewPrivileges。 不加 ProtectSystem/ProtectHome(会破坏 cph render-cache 与 bwrap user-namespace)。 trigger.ts: 权限闸门去掉 if (senderOpenId !== '') 短路——缺 open_id 一律 fail-closed 拒绝,不再静默跳过;role gate 同步去掉冗余守卫(已由上游保证)。 顺手把 JSON.parse(msg.content) 的 inline cast 换成 Zod schema parse (FileMessageContentSchema / TextMessageContentSchema)。 ADR-0018: 状态改为 Accepted+implemented,机制段写定 SDK 沙箱,网络决定为开放, Open Questions 更新。
45 lines
2.0 KiB
Bash
Executable File
45 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Deploy the Hub to a host: rsync the repo, install deps, build, restart service.
|
|
#
|
|
# Configure these env vars (e.g. in CI secrets):
|
|
# PLATFORM_DEPLOY_HOST required
|
|
# PLATFORM_DEPLOY_SSH_KEY required (private key for the deploy user)
|
|
# PLATFORM_DEPLOY_USER optional, defaults to deploy
|
|
# PLATFORM_DEPLOY_PORT optional, defaults to 22
|
|
# PLATFORM_DEPLOY_BASE optional, defaults to /srv/curriculum-project-hub
|
|
# The target host must have Node.js, npm, rsync, PostgreSQL, systemd, bubblewrap
|
|
# (`bwrap`, for the ADR-0018 agent sandbox), and a writable $PLATFORM_DEPLOY_BASE.
|
|
# Use a dedicated `deploy` user that has passwordless sudo for:
|
|
set -euo pipefail
|
|
|
|
HOST="${PLATFORM_DEPLOY_HOST:?PLATFORM_DEPLOY_HOST required}"
|
|
SSH_KEY="${PLATFORM_DEPLOY_SSH_KEY:?PLATFORM_DEPLOY_SSH_KEY required}"
|
|
DEPLOY_USER="${PLATFORM_DEPLOY_USER:-deploy}"
|
|
PORT="${PLATFORM_DEPLOY_PORT:-22}"
|
|
BASE="${PLATFORM_DEPLOY_BASE:-/srv/curriculum-project-hub}"
|
|
HUB_DIR="$BASE/hub"
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
|
|
|
|
SSH_OPTS=(-i "$SSH_KEY" -p "$PORT" -o StrictHostKeyChecking=accept-new)
|
|
|
|
# 1. Rsync the hub/ directory (exclude node_modules/dist, they rebuild on host).
|
|
rsync -az --delete \
|
|
--exclude node_modules --exclude dist --exclude .env \
|
|
-e "ssh ${SSH_OPTS[*]}" \
|
|
"$REPO_ROOT/hub/" "$DEPLOY_USER@$HOST:$HUB_DIR/"
|
|
|
|
# 2. Install deps + build on the host.
|
|
ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" "cd '$HUB_DIR' && npm ci && npm run build"
|
|
|
|
# 3. Ensure the service is installed (idempotent), then restart.
|
|
ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" "
|
|
BASE='$BASE' HUB_DIR='$HUB_DIR' bash '$HUB_DIR/deploy/install_service.sh' || true
|
|
sudo systemctl restart cph-hub.service
|
|
sleep 2
|
|
sudo systemctl is-active --quiet cph-hub.service || { echo 'service failed to start'; exit 1; }
|
|
curl -sf http://127.0.0.1:8788/api/healthz || { echo 'healthz failed'; exit 1; }
|
|
"
|
|
|
|
echo "Deployed cph-hub to $HOST ($HUB_DIR)"
|