codex-app-server/chv-guest/chv-cell.py

#!/usr/bin/env python3
"""chv-cell：客机内 systemd-nspawn 运行时单元（Hatch 式）启动器。

对齐 Muse P2（见 docs/chv-muse-p2-gap.md）：codex 跑在单元内，不再
直接跑在客机用户态。单元是单命令容器（--as-pid2，不 boot 第二个
systemd），单元即沙箱——单元内 codex 用 danger-full-access，不再
套 bwrap（bwrap 的 --proc 挂载在嵌套命名空间里走不通，见 AGENTS.md
内层 proc 定位）。

关键映射（与 Muse“单元 root 映射为 host 侧非特权用户”同款）：
  --private-users=1000:65536 —— 单元内 uid 0 → 客机侧 chv（uid 1000）。
  效果：workspace / ~/.codex（chv 所有）单元内仍可写；host-root 0600
  文件（如 /etc/chv/guest-env）在单元内显示为 overflow uid、不可读；
  再加 --inaccessible 遮蔽作纵深防御。

网络：--network-veth。宿主侧 ve-chv-cell（10.200.0.1/24），单元侧
host0（10.200.0.2/24，默认路由经 10.200.0.1），客机侧 NAT 出站
（MASQUERADE 走客机默认路由的上行口，动态发现）。单元内配网经
nsenter 进单元 init 的 netns 做。veth 建不起来即大声失败，不静默
回落共享网络；CHV_CELL_NETWORK=shared 是显式调试逃生口，须显式
设置并打日志，绝不默认。

环境透传：nspawn 不透传调用方环境，本脚本只转发白名单变量（模型
网关与代理变量）。GITEA_TOKEN 等凭证变量不在白名单里，绝不进单元。

用法（客机侧 root 运行，执行器经 SSH 调）：
  chv-cell run [--network veth|shared] -- <cmd...>
      # 例：chv-cell run -- python3 /app/host.py --state
      #   /home/chv/.codex/host-state.json --codex-home /home/chv/.codex
      #   --sandbox danger-full-access dispatch --name t --task ...
  chv-cell argv [--network veth|shared] -- <cmd...>
      # 只打印 nspawn 参数表（JSON），不启动
  chv-cell network-commands [--uplink IFACE] [--cell-pid PID]
      # 只打印配网命令表（JSON），不执行
只用标准库。单元启动失败、配网失败一律非零退出，不静默降级。
"""
import json
import os
import pwd
import re
import subprocess
import sys
import time

MACHINE = "chv-cell"
# 单元映射：单元内 uid 0 → 客机侧 chv（uid 1000，非特权用户）。
UID_BASE = 1000
UID_COUNT = 65536
CELL_USER = "chv"
CELL_UID = 1000
CELL_GID = 1000
WORKSPACE = "/home/chv/workspace"
CODEX_HOME = "/home/chv/.codex"
BROKER_DIR = "/run/chv"
CELL_PID_FILE = "/run/chv/cell.pid"

# 单元网络（与客机 tap 网 192.168.10.0/24 不重叠的独立 /24）。
CELL_NET = "10.200.0.0/24"
HOST_IP = "10.200.0.1"
CELL_IP = "10.200.0.2"
HOST_IFACE = "ve-chv-cell"
CELL_IFACE = "host0"

# Muse 点名要丢的能力 + 同批丢的危险能力（nspawn 默认集已有限，
# 这里是显式再丢，--drop-capability 逐项写，测试逐项断言）。
DROP_CAPABILITIES = [
    "CAP_SYS_ADMIN",
    "CAP_SYS_PTRACE",
    "CAP_NET_ADMIN",
    "CAP_NET_RAW",
    "CAP_SYS_MODULE",
    "CAP_SYS_RAWIO",
    "CAP_SYS_BOOT",
    "CAP_MKNOD",
]

# syscall 过滤：@system-service 集合再扣掉 io_uring 三件套
#（Muse 点名禁用 io_uring）。
SYSCALL_FILTER = ("@system-service ~io_uring_setup "
                  "~io_uring_enter ~io_uring_register")

# 单元内遮掉的路径：凭证与浏览器（单元内跑不起自己的浏览器，
# 只能走 broker 的 chv-browser）。
INACCESSIBLE_BASE = [
    "/etc/chv",
    "/home/chv/.git-credentials",
    "/usr/local/share/ms-playwright",
]

# 只转发白名单环境变量进单元。凭证类变量（GITEA_TOKEN 等）
# 不在白名单里，绝不进单元。
FORWARD_ENV_ALLOWLIST = (
    "SUB2API_BASE_URL",
    "SUB2API_API_KEY",
    "XCM_API_KEY",
    "HTTP_PROXY",
    "HTTPS_PROXY",
    "NO_PROXY",
    "http_proxy",
    "https_proxy",
    "no_proxy",
)


def _playwright_package_dir():
    """playwright pip 包目录（遮蔽用）。算不出时回落到 noble 默认路径。"""
    try:
        import sysconfig
        purelib = sysconfig.get_path("purelib")
        if purelib:
            return os.path.join(purelib, "playwright")
    except Exception:
        pass
    return "/usr/local/lib/python3.12/dist-packages/playwright"


def build_nspawn_argv(command, network="veth",
                      workspace=WORKSPACE, codex_home=CODEX_HOME,
                      broker_dir=BROKER_DIR,
                      playwright_package_dir=None):
    """产 nspawn 参数表（纯函数，可单测）。command 是单元内要跑的命令
   （list，如 ["python3", "/app/host.py", ...]）。"""
    if not command:
        raise ValueError("chv-cell: 单元内命令不能为空")
    if network not in ("veth", "shared"):
        raise ValueError("chv-cell: network 只能是 veth|shared：%r"
                         % network)
    if playwright_package_dir is None:
        playwright_package_dir = _playwright_package_dir()
    argv = [
        "systemd-nspawn", "--quiet",
        "--machine=%s" % MACHINE,
        "--directory=/",
        "--as-pid2",
        "--private-users=%d:%d" % (UID_BASE, UID_COUNT),
        "--no-new-privileges",
        "--system-call-filter=%s" % SYSCALL_FILTER,
    ]
    for cap in DROP_CAPABILITIES:
        argv.append("--drop-capability=%s" % cap)
    for path in INACCESSIBLE_BASE + [playwright_package_dir]:
        argv.append("--inaccessible=%s" % path)
    argv += [
        "--bind=%s" % workspace,
        "--bind=%s" % codex_home,
        "--bind=%s" % broker_dir,
        "--tmpfs=/tmp",
    ]
    if network == "veth":
        argv.append("--network-veth")
    argv += [
        "--setenv=CHV_CELL=1",
        "--setenv=HOME=/home/chv",
    ]
    for name in FORWARD_ENV_ALLOWLIST:
        value = os.environ.get(name)
        if value:
            argv.append("--setenv=%s=%s" % (name, value))
    argv += ["--chdir=%s" % workspace]
    argv += list(command)
    return argv


def parse_default_route_iface(ip_route_output):
    """从 `ip route show default` 的输出里解析上行口名。
    无默认路由时返回 None（调用方大声失败）。"""
    for line in (ip_route_output or "").splitlines():
        line = line.strip()
        if not line.startswith("default "):
            continue
        m = re.search(r"\bdev\s+(\S+)", line)
        if m:
            return m.group(1)
    return None


def find_uplink_iface(run=None):
    """发现客机上行口（默认路由的 dev）。run 供单测注入。"""
    run = run or subprocess.run
    proc = run(["ip", "route", "show", "default"],
               capture_output=True, text=True)
    if proc.returncode != 0:
        return None
    return parse_default_route_iface(proc.stdout)


def host_network_commands(uplink_iface):
    """客机侧配网命令表（纯函数）：ve 接口起 IP + 转发 + NAT。
    调用方按顺序执行，任一失败即停。"""
    if not uplink_iface:
        raise ValueError("chv-cell: 上行口名为空，配不出 NAT")
    return [
        ["ip", "addr", "add", "%s/24" % HOST_IP, "dev", HOST_IFACE],
        ["ip", "link", "set", HOST_IFACE, "up"],
        ["sysctl", "-w", "net.ipv4.ip_forward=1"],
        ["iptables", "-t", "nat", "-A", "POSTROUTING",
         "-s", CELL_NET, "-o", uplink_iface, "-j", "MASQUERADE"],
        ["iptables", "-A", "FORWARD", "-i", HOST_IFACE,
         "-o", uplink_iface, "-j", "ACCEPT"],
        ["iptables", "-A", "FORWARD", "-i", uplink_iface,
         "-o", HOST_IFACE, "-m", "state", "--state",
         "RELATED,ESTABLISHED", "-j", "ACCEPT"],
    ]


def host_network_cleanup_commands(uplink_iface):
    """配网清理命令表（与 host_network_commands 配对，-A 改 -D）。
    清理是 best-effort：删不掉（规则已不在）不报错。"""
    if not uplink_iface:
        raise ValueError("chv-cell: 上行口名为空，清不了 NAT")
    cmds = []
    for cmd in host_network_commands(uplink_iface):
        if "iptables" not in cmd:
            continue
        cleaned = [c if c != "-A" else "-D" for c in cmd]
        cmds.append(cleaned)
    return cmds


def find_cell_init_pid(nspawn_pid, proc_root="/proc"):
    """找单元 init 的 pid：nspawn 进程的第一个子进程
   （--as-pid2 时它是 stub init，payload 是 PID 2；两者同 netns）。
    找不到返回 None。"""
    try:
        task_dir = os.path.join(proc_root, str(nspawn_pid), "task")
        for tid in os.listdir(task_dir):
            children_path = os.path.join(task_dir, tid, "children")
            try:
                with open(children_path) as fh:
                    children = fh.read().split()
            except OSError:
                continue
            if children:
                return int(children[0])
    except (OSError, ValueError):
        return None
    return None


def cell_network_commands(cell_pid):
    """单元内配网命令表（纯函数）：nsenter 进单元 init 的 netns，
    给 host0 配 IP、起接口、加默认路由。"""
    if not cell_pid:
        raise ValueError("chv-cell: 单元 init pid 为空，配不了单元内网络")
    prefix = ["nsenter", "-t", str(cell_pid), "-n"]
    return [
        prefix + ["ip", "addr", "add", "%s/24" % CELL_IP,
                  "dev", CELL_IFACE],
        prefix + ["ip", "link", "set", CELL_IFACE, "up"],
        prefix + ["ip", "route", "add", "default", "via", HOST_IP],
    ]


def _ensure_bind_source(path, uid=CELL_UID, gid=CELL_GID):
    """bind 源目录须存在且属 chv（单元内 root 即客机 chv，属主不对
    就写不进 workspace）。root 建的目录要 chown 回 chv。"""
    os.makedirs(path, exist_ok=True)
    try:
        st = os.stat(path)
        if st.st_uid != uid or st.st_gid != gid:
            os.chown(path, uid, gid)
    except OSError as e:
        print("chv-cell: chown %s 失败：%s" % (path, e), file=sys.stderr)
        raise


def _wait_for_iface(iface, timeout=10.0):
    deadline = time.time() + timeout
    while time.time() < deadline:
        proc = subprocess.run(["ip", "link", "show", iface],
                              capture_output=True)
        if proc.returncode == 0:
            return True
        time.sleep(0.2)
    return False


def _run_cmds(cmds, what):
    for cmd in cmds:
        print("chv-cell: + %s" % " ".join(cmd), file=sys.stderr)
        proc = subprocess.run(cmd)
        if proc.returncode != 0:
            raise RuntimeError(
                "chv-cell: %s 失败（rc=%d）：%s"
                % (what, proc.returncode, " ".join(cmd)))


def run_cell(command, network="veth"):
    """起单元、配网、等 payload 退出、清 NAT，返回 payload 退出码。"""
    if os.geteuid() != 0:
        print("chv-cell: 须以 root 运行（nspawn + 配网都要 root）",
              file=sys.stderr)
        return 2
    _ensure_bind_source(WORKSPACE)
    _ensure_bind_source(CODEX_HOME)
    _ensure_bind_source(BROKER_DIR, uid=0, gid=0)
    argv = build_nspawn_argv(command, network=network)
    print("chv-cell: 启动单元：%s" % " ".join(argv), file=sys.stderr)
    proc = subprocess.Popen(argv)
    uplink = None
    cell_pid = None
    try:
        if network == "veth":
            if not _wait_for_iface(HOST_IFACE):
                raise RuntimeError(
                    "chv-cell: veth 接口 %s 未出现，拒绝回落共享网络"
                    % HOST_IFACE)
            uplink = find_uplink_iface()
            if not uplink:
                raise RuntimeError(
                    "chv-cell: 客机无默认路由，配不出 NAT")
            _run_cmds(host_network_commands(uplink), "客机侧配网")
            cell_pid = find_cell_init_pid(proc.pid)
            if not cell_pid:
                raise RuntimeError("chv-cell: 找不到单元 init pid")
            with open(CELL_PID_FILE, "w") as fh:
                fh.write(str(cell_pid))
            _run_cmds(cell_network_commands(cell_pid), "单元内配网")
        return proc.wait()
    finally:
        if uplink:
            for cmd in host_network_cleanup_commands(uplink):
                subprocess.run(cmd, capture_output=True)
        try:
            if os.path.exists(CELL_PID_FILE):
                os.remove(CELL_PID_FILE)
        except OSError:
            pass
        if proc.poll() is None:
            proc.terminate()
            try:
                proc.wait(timeout=10)
            except subprocess.TimeoutExpired:
                proc.kill()


def main(argv):
    if len(argv) < 1:
        print("用法：chv-cell run|argv|network-commands …",
              file=sys.stderr)
        return 2
    verb = argv[0]
    rest = argv[1:]
    network = os.environ.get("CHV_CELL_NETWORK", "veth")
    # --network 只在 run/argv 前接受，其它位置一律不认。
    if rest and rest[0] == "--network":
        if len(rest) < 2:
            print("chv-cell: --network 缺值", file=sys.stderr)
            return 2
        network = rest[1]
        rest = rest[2:]
    if network not in ("veth", "shared"):
        print("chv-cell: network 只能是 veth|shared：%r" % network,
              file=sys.stderr)
        return 2
    if network == "shared":
        print("chv-cell: 警告：共享网络模式（调试逃生口），单元与"
              "客机共用网络命名空间", file=sys.stderr)
    if verb == "run":
        if not rest or rest[0] != "--":
            print("chv-cell: run 用法：chv-cell run -- <cmd...>",
                  file=sys.stderr)
            return 2
        command = rest[1:]
        if not command:
            print("chv-cell: 单元内命令不能为空", file=sys.stderr)
            return 2
        try:
            return run_cell(command, network=network)
        except RuntimeError as e:
            print(str(e), file=sys.stderr)
            return 1
    if verb == "argv":
        if not rest or rest[0] != "--":
            print("chv-cell: argv 用法：chv-cell argv -- <cmd...>",
                  file=sys.stderr)
            return 2
        print(json.dumps(build_nspawn_argv(rest[1:], network=network),
                         ensure_ascii=False))
        return 0
    if verb == "network-commands":
        uplink = None
        cell_pid = None
        i = 0
        while i < len(rest):
            if rest[i] == "--uplink" and i + 1 < len(rest):
                uplink = rest[i + 1]
                i += 2
            elif rest[i] == "--cell-pid" and i + 1 < len(rest):
                cell_pid = int(rest[i + 1])
                i += 2
            else:
                print("chv-cell: network-commands 未知参数：%s"
                      % rest[i], file=sys.stderr)
                return 2
        out = {}
        if uplink:
            out["host"] = host_network_commands(uplink)
            out["host_cleanup"] = host_network_cleanup_commands(uplink)
        if cell_pid:
            out["cell"] = cell_network_commands(cell_pid)
        print(json.dumps(out, ensure_ascii=False))
        return 0
    print("chv-cell: 未知子命令：%s" % verb, file=sys.stderr)
    return 2


if __name__ == "__main__":
    raise SystemExit(main(sys.argv[1:]))