@sema-agent/server 1.185.0

package/deploy/sema-up/kube-up.sh

@@ -0,0 +1,377 @@
+#!/usr/bin/env bash
+# kube-up — sema-up 的 k8s 单机两态装配(helm chart 驱动;2026-07-12 一键补完批次)。
+#   KUBE_MODE=existing  已有 k8s(kubeconfig 指向;kind/k3d/k3s/云商托管都行)
+#   KUBE_MODE=k3s       本机现装 k3s 单机集群(Linux;需要 root/passwordless sudo)
+# 多机 ssh 装配(machines.yaml)走 cluster-up.sh,不在本脚本。
+# 纪律与 sema-up.sh 相同:幂等 check-then-apply;凭据只生成一次;密码不进日志/argv;
+# 凭据经 stdin 给 helm -f -(不落远端、不进 /proc cmdline)。
+#
+# 输入(sema-up.sh 注入;也可单独跑):
+#   WORK(状态目录)PROJECT REGION KUBE_MODE [KUBECONFIG_PATH] [DRY_RUN]
+#   USERS REGISTRY_ENABLED GIT_MODE [GIT_URL GIT_TOKEN]
+#   SEMA_SERVER_IMAGE(必需)[SEMA_REGISTRY_IMAGE][GITEA_IMAGE]
+#   MODEL_GATEWAY_BASEURL MODEL_ID MODEL_API_KEY
+#   [NAMESPACE=sema][STORAGE_CLASS=集群默认][CNPG_VERSION]
+set -euo pipefail
+HERE="$(cd "$(dirname "$0")" && pwd)"
+log() { printf '[kube-up] %s\n' "$*" >&2; }
+die() { log "⛔ $*"; exit 1; }
+
+: "${WORK:?WORK 未设置(状态目录,一般 ~/.sema-up/<project>)}"
+PROJECT="${PROJECT:-sema}"
+REGION="${REGION:-global}"
+KUBE_MODE="${KUBE_MODE:?KUBE_MODE 未设置(existing|k3s)}"
+DRY_RUN="${DRY_RUN:-false}"
+USERS="${USERS:-single}"
+REGISTRY_ENABLED="${REGISTRY_ENABLED:-true}"
+GIT_MODE="${GIT_MODE:-none}"
+NAMESPACE="${NAMESPACE:-sema}"
+CNPG_VERSION="${CNPG_VERSION:-1.30.0}"   # ⚠ in-tree barman 1.31 移除;升版前先迁 barman-cloud plugin
+K3S_CHANNEL="${K3S_CHANNEL:-stable}"
+
+# ── 0. kubeconfig / 工具解析 ─────────────────────────────────────────────────────
+if [ "$KUBE_MODE" = "k3s" ]; then
+  [ "$(uname -s)" = "Linux" ] || die "--kube=k3s 只支持 Linux(本机装 k3s)。macOS 下一步:用 kind/k3d 起集群后 --kube=existing"
+  SUDO=""; [ "$(id -u)" != "0" ] && { sudo -n true 2>/dev/null || die "--kube=k3s 需要 root 或 passwordless sudo(装 k3s 是系统级动作)"; SUDO="sudo"; }
+  if ! $SUDO test -f /usr/local/bin/k3s || ! systemctl is-active --quiet k3s 2>/dev/null; then
+    if [ "$DRY_RUN" = "true" ]; then log "dry-run:将安装 k3s 单机($K3S_CHANNEL$([ "$REGION" = cn ] && echo ',国内镜像'))"
+    else
+      log "0/6 安装 k3s 单机($K3S_CHANNEL)"
+      MIRROR=""; [ "$REGION" = "cn" ] && MIRROR="INSTALL_K3S_MIRROR=cn "
+      curl -sfL https://get.k3s.io | env ${MIRROR}INSTALL_K3S_CHANNEL="$K3S_CHANNEL" $SUDO sh - >/dev/null \
+        || die "k3s 安装失败。下一步:看上方安装器输出;网络不通时 --region=cn 走国内镜像"
+    fi
+  else log "0/6 k3s 已在跑,跳过安装"; fi
+  export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
+  KUBECTL="$SUDO k3s kubectl"
+else
+  KC="${KUBECONFIG_PATH:-${KUBECONFIG:-$HOME/.kube/config}}"
+  [ -r "$KC" ] || die "kubeconfig 不可读:$KC。下一步:--kubeconfig=<路径> 指向你的集群;没有集群可 --kube=k3s(Linux)或本机 kind create cluster"
+  export KUBECONFIG="$KC"
+  command -v kubectl >/dev/null || die "未装 kubectl。下一步:https://kubernetes.io/docs/tasks/tools/(macOS:brew install kubectl)"
+  KUBECTL="kubectl"
+fi
+command -v helm >/dev/null || {
+  if [ "$KUBE_MODE" = "k3s" ] && [ "$DRY_RUN" != "true" ]; then
+    log "装 helm(get-helm-3)"
+    curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash >/dev/null || die "helm 安装失败"
+  else die "未装 helm。下一步:brew install helm(macOS)/ https://helm.sh/docs/intro/install/"; fi
+}
+
+# ── 1. 集群探测(可达/节点数/默认 SC/kata)────────────────────────────────────────
+$KUBECTL get nodes >/dev/null 2>&1 || die "集群不可达(kubeconfig=$KUBECONFIG)。下一步:kubectl get nodes 手查;云商集群注意网络/凭据过期"
+NODES=$($KUBECTL get nodes --no-headers | grep -cw Ready || true)
+[ "$NODES" -ge 1 ] || die "没有 Ready 节点。下一步:kubectl get nodes -o wide 看节点状态"
+
+# ── 节点容量测量+建议(建议不强求;某台确实过小才拦)────────────────────────────────
+# allocatable 口径(比 capacity 更接近可用);盘容量 kubectl 不可见,PVC Pending 时按报错查 SC
+NODE_CAPS=$($KUBECTL get nodes -o jsonpath='{range .items[*]}{.metadata.name}{" "}{.status.allocatable.cpu}{" "}{.status.allocatable.memory}{"\n"}{end}' 2>/dev/null)
+while read -r n_name n_cpu n_mem; do
+  [ -z "$n_name" ] && continue
+  # cpu:"4"或"3900m"→ 毫核;memory:"8049856Ki"/"7Gi" → MB
+  case "$n_cpu" in *m) n_mcpu="${n_cpu%m}" ;; *) n_mcpu=$(( ${n_cpu:-0} * 1000 )) ;; esac
+  case "$n_mem" in
+    *Ki) n_mb=$(( ${n_mem%Ki} / 1024 )) ;;
+    *Mi) n_mb="${n_mem%Mi}" ;;
+    *Gi) n_mb=$(( ${n_mem%Gi} * 1024 )) ;;
+    *) n_mb=$(( ${n_mem:-0} / 1048576 )) ;;
+  esac
+  if [ "$n_mcpu" -lt 1000 ] || [ "$n_mb" -lt 2048 ]; then
+    die "节点 $n_name 过小(${n_mcpu}m CPU / ${n_mb}MB)——低于 1c/2G 硬底线,确实无法部署。下一步:换/扩这台节点,或用 nodeSelector 把它排除后重跑"
+  elif [ "$n_mcpu" -lt 2000 ] || [ "$n_mb" -lt 4096 ]; then
+    log "⚠ 节点 $n_name 偏小(${n_mcpu}m CPU / ${n_mb}MB,推荐 ≥2c/4G)——能跑,数据面/沙箱余量紧;建议升配或外接 S3/DB 减负"
+  fi
+done <<EOF_NODES
+$NODE_CAPS
+EOF_NODES
+[ "$NODES" -lt 3 ] && log "建议:准生产配置=3 节点(PG 反亲和 HA+副本打散);当前 $NODES 节点能跑,按单机形态缩放(不强求)"
+DEFAULT_SC=$($KUBECTL get storageclass -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.metadata.annotations.storageclass\.kubernetes\.io/is-default-class}{"\n"}{end}' 2>/dev/null | awk -F'\t' '$2=="true"{print $1; exit}')
+STORAGE_CLASS="${STORAGE_CLASS:-}"   # 空=用集群默认 SC;显式给了就用给的
+if [ -z "$STORAGE_CLASS" ] && [ -z "$DEFAULT_SC" ]; then
+  die "集群没有默认 StorageClass,PVC 会永久 Pending。下一步:kubectl get sc 看有哪些,然后 STORAGE_CLASS=<名字> 重跑;或给集群设默认 SC"
+fi
+KATA_OK=false
+$KUBECTL get runtimeclass kata-qemu >/dev/null 2>&1 && KATA_OK=true
+RUNTIME_CLASS=$($KATA_OK && echo kata-qemu || echo "")
+$KATA_OK || log "⚠ 集群无 kata-qemu runtimeclass——沙箱降级为 runc(容器隔离,弱于 VM)。要 VM 隔离:节点装 kata-deploy(见 cluster-up.sh 4/8)后重跑"
+
+# 形态按节点数缩放(cluster-up 同款:<3 preferred,否则 required 永久 Pending——真踩)
+PG_INSTANCES=$(( NODES >= 3 ? 3 : NODES ))
+PG_AA=$([ "$NODES" -ge 3 ] && echo required || echo preferred)
+SERVER_REPLICAS=$(( NODES >= 3 ? 3 : NODES ))
+
+# ── 2. 输入校验(在 dry-run 打印之前,报错带下一步)───────────────────────────────
+: "${SEMA_SERVER_IMAGE:?需要 SEMA_SERVER_IMAGE(server 镜像 registry 引用)}"
+: "${MODEL_GATEWAY_BASEURL:?模型面必需(--gateway)}"; : "${MODEL_ID:?模型面必需(--model)}"
+if [ "$REGISTRY_ENABLED" = "true" ] && [ -z "${SEMA_REGISTRY_IMAGE:-}" ]; then
+  die "registry=true(默认)需要 SEMA_REGISTRY_IMAGE。下一步:--registry-image=<仓>/sema-registry:<tag>,或 --registry=false"
+fi
+
+ENVF="$WORK/.env"
+if [ "$DRY_RUN" = "true" ]; then
+  {
+    echo "══════ kube-up dry-run(不写文件、不动集群)══════"
+    echo " 集群: $NODES 节点(mode=$KUBE_MODE,kubeconfig=$KUBECONFIG)"
+    echo " SC: ${STORAGE_CLASS:-默认($DEFAULT_SC)} kata: $KATA_OK(否=沙箱 runc 降级)"
+    echo " 形态: pg×$PG_INSTANCES($PG_AA) server×$SERVER_REPLICAS registry=$REGISTRY_ENABLED git=$GIT_MODE"
+    echo " 将执行: CNPG operator $CNPG_VERSION → helm upgrade --install sema-stack -n $NAMESPACE"
+    echo "        → runner-token 复制 → MinIO 建桶 → $([ "$GIT_MODE" = provision ] && printf 'Gitea 引导(管理员/token/OAuth)→ ')smoke → summary"
+    echo " 凭据: $ENVF $([ -f "$ENVF" ] && echo '(已存在:只补缺不轮换)' || echo '(将新建)')"
+    echo " 卸载: helm -n $NAMESPACE uninstall sema-stack(数据 PVC 保留;sema-sandbox ns 有 keep 注记)"
+    echo "═══════════════════════════════════════════════"
+  } >&2
+  exit 0
+fi
+
+# ── 3. CNPG operator(钉版;server-side apply+重试——聚合 openapi 未就绪的瞬时错)──
+log "1/6 CNPG operator $CNPG_VERSION"
+if ! $KUBECTL get deployment -n cnpg-system cnpg-controller-manager >/dev/null 2>&1; then
+  ok=0
+  for t in 1 2 3 4 5; do
+    $KUBECTL apply --server-side -f \
+      "https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-${CNPG_VERSION%.*}/releases/cnpg-$CNPG_VERSION.yaml" >/dev/null 2>&1 && { ok=1; break; }
+    sleep 10
+  done
+  [ "$ok" = 1 ] || die "CNPG manifest apply 重试耗尽。下一步:raw.githubusercontent.com 可达性(cn 网络可先手动下载后 kubectl apply -f 本地文件)"
+fi
+$KUBECTL rollout status deployment/cnpg-controller-manager -n cnpg-system --timeout=300s >/dev/null || die "CNPG operator 未就绪。下一步:kubectl -n cnpg-system get pods 看事件"
+
+# ── 4. 凭据(.env 幂等,同 sema-up.sh 纪律)───────────────────────────────────────
+mkdir -p "$WORK"; chmod 700 "$WORK" 2>/dev/null || true
+touch "$ENVF"; chmod 600 "$ENVF"
+setk() { grep -q "^$1=" "$ENVF" || printf '%s=%s\n' "$1" "$2" >> "$ENVF"; }
+setk_new() { if grep -q "^$1=" "$ENVF"; then return 1; else printf '%s=%s\n' "$1" "$2" >> "$ENVF"; return 0; fi; }
+has_env() { grep -q "^$1=..*" "$ENVF"; }
+setk MINIO_PASSWORD "$(openssl rand -hex 24)"
+setk SERVICE_AUTH_TOKEN "$(openssl rand -hex 24)"
+NEW_REG_PW=false NEW_GIT_PW=false
+if [ "$REGISTRY_ENABLED" = "true" ]; then
+  setk_new REGISTRY_ADMIN_PASSWORD "$(openssl rand -hex 24)" && NEW_REG_PW=true
+  setk REGISTRY_SESSION_SECRET "$(openssl rand -hex 24)"
+  setk REGISTRY_PULL_TOKEN "$(openssl rand -hex 24)"
+fi
+if [ "$GIT_MODE" = "provision" ]; then
+  setk GIT_ADMIN_USER "${GIT_ADMIN_USER:-sema}"
+  setk_new GIT_ADMIN_PASSWORD "$(openssl rand -hex 24)" && NEW_GIT_PW=true
+fi
+# openssl 失败会被 $() 吞成空串写进 .env(set -e 不管参数位替换)——断言长度,fail-loud
+for k in MINIO_PASSWORD SERVICE_AUTH_TOKEN; do
+  grep -q "^$k=.\{32,\}$" "$ENVF" || die "$k 生成失败(openssl rand?)——检查 $ENVF"
+done
+. "$ENVF"
+[ -n "${MODEL_API_KEY:-}" ] || die "需要 MODEL_API_KEY(--model-key 或 -f 配置)"
+
+# 节点 IP(NodePort 入口;kind 场景宿主上不可达,summary 会给 port-forward 替代)
+NODE_IP=$($KUBECTL get nodes -o jsonpath='{.items[0].status.addresses[?(@.type=="InternalIP")].address}' | awk '{print $1}')
+
+# ── 5. helm 装配(凭据经 stdin;两遍:git=provision 时先无 OAuth 起栈,引导完 Gitea
+#    再带 OAuth 升级——registry 第一遍已可表单登录,不是半成品)────────────────────
+helm_values() { # helm_values <giteaBaseUrl> <oauthId> <oauthSecret>
+  V_GITEA_URL="$1" V_OA_ID="$2" V_OA_SECRET="$3" \
+  V_MINIO_PW="$MINIO_PASSWORD" V_SVC_TOKEN="$SERVICE_AUTH_TOKEN" V_MODEL_KEY="$MODEL_API_KEY" \
+  V_MODEL_GATEWAY="$MODEL_GATEWAY_BASEURL" V_MODEL_ID="$MODEL_ID" \
+  V_SERVER_IMAGE="$SEMA_SERVER_IMAGE" V_REPLICAS="$SERVER_REPLICAS" \
+  V_PG_INSTANCES="$PG_INSTANCES" V_PG_AA="$PG_AA" V_SC="$STORAGE_CLASS" \
+  V_RT_CLASS="$RUNTIME_CLASS" V_REQ_PRINCIPAL="$([ "$USERS" = multi ] && echo true || echo false)" \
+  V_PKG_SOURCE="$([ "$REGION" = "global" ] && echo global || echo '')" \
+  V_REG_ENABLED="$REGISTRY_ENABLED" V_REG_IMAGE="${SEMA_REGISTRY_IMAGE:-}" \
+  V_REG_PW="${REGISTRY_ADMIN_PASSWORD:-}" V_REG_SS="${REGISTRY_SESSION_SECRET:-}" V_REG_PT="${REGISTRY_PULL_TOKEN:-}" \
+  V_GITEA_ENABLED="$([ "$GIT_MODE" = provision ] && echo true || echo false)" \
+  V_GITEA_IMAGE="${GITEA_IMAGE:-gitea/gitea:1.24}" V_NODE_IP="$NODE_IP" \
+  python3 - <<'PY'
+import json, os
+e = os.environ
+# json 是合法 yaml;json.dumps 对任意凭据字符安全(引号/反斜杠/换行都正确转义)
+v = {
+  # helm 的 values 合并是深合并——只给部分 parameters 时 values.yaml 里 3 机 as-built 的
+  # shared_buffers=8GB/effective_cache_size=86GB 会留下来,小集群 PG 直接起不来(内存不够)。
+  # 必须整组显式覆盖成保守值;真按机器规格调优的入口是 STORAGE/PG 显式 values(后续档)。
+  "pg": {"instances": int(e["V_PG_INSTANCES"]), "antiAffinity": e["V_PG_AA"],
+         "storageClass": e["V_SC"], "storageSize": "20Gi",
+         "parameters": {"shared_buffers": "256MB", "effective_cache_size": "1GB",
+                        "maintenance_work_mem": "128MB", "random_page_cost": "1.1",
+                        "effective_io_concurrency": "200", "checkpoint_completion_target": "0.9",
+                        "max_parallel_workers": "2"}},
+  "minio": {"rootPassword": e["V_MINIO_PW"], "storageClass": e["V_SC"], "storageSize": "20Gi"},
+  "server": {
+    "image": e["V_SERVER_IMAGE"], "replicas": int(e["V_REPLICAS"]),
+    "serviceAuthToken": e["V_SVC_TOKEN"], "modelGatewayBaseurl": e["V_MODEL_GATEWAY"],
+    "modelId": e["V_MODEL_ID"], "modelApiKey": e["V_MODEL_KEY"],
+    "sandboxPkgSource": e["V_PKG_SOURCE"], "requirePrincipal": e["V_REQ_PRINCIPAL"],
+  },
+  "sandbox": {"runtimeClass": e["V_RT_CLASS"]},
+  "registry": {"enabled": e["V_REG_ENABLED"] == "true", "image": e["V_REG_IMAGE"],
+               "storageClass": e["V_SC"], "adminPassword": e["V_REG_PW"],
+               "sessionSecret": e["V_REG_SS"], "pullToken": e["V_REG_PT"],
+               "giteaBaseUrl": e["V_GITEA_URL"], "giteaOauthClientId": e["V_OA_ID"],
+               "giteaOauthClientSecret": e["V_OA_SECRET"]},
+  "gitea": {"enabled": e["V_GITEA_ENABLED"] == "true", "image": e["V_GITEA_IMAGE"],
+            "storageClass": e["V_SC"], "domain": e["V_NODE_IP"]},
+}
+print(json.dumps(v))
+PY
+}
+helm_apply() { # helm_apply <giteaBaseUrl> <oauthId> <oauthSecret>
+  helm_values "$1" "$2" "$3" | helm upgrade --install sema-stack "$HERE/chart" \
+    -n "$NAMESPACE" --create-namespace -f - >/dev/null \
+    || die "helm upgrade --install sema-stack 失败。下一步:helm -n $NAMESPACE status sema-stack;kubectl -n $NAMESPACE get events --sort-by=.lastTimestamp | tail"
+}
+log "2/6 helm 装配 sema-stack(-n $NAMESPACE,pg×$PG_INSTANCES server×$SERVER_REPLICAS registry=$REGISTRY_ENABLED gitea=$([ "$GIT_MODE" = provision ] && echo true || echo false))"
+OA_URL="${REGISTRY_GITEA_BASE_URL:-}"; OA_ID="${REGISTRY_GITEA_OAUTH_ID:-}"; OA_SECRET="${REGISTRY_GITEA_OAUTH_SECRET:-}"
+# git=connect:先验连通(fail-loud),Gitea 顺手自动建 OAuth app
+GIT_MANUAL=""
+if [ "$GIT_MODE" = "connect" ]; then
+  : "${GIT_URL:?git=connect 需要 GIT_URL}"; : "${GIT_TOKEN:?git=connect 需要 GIT_TOKEN}"
+  if printf '%s' "$GIT_URL" | grep -q 'github.com'; then
+    C=$(curl -m10 -s -o /dev/null -w '%{http_code}' -H "Authorization: Bearer $GIT_TOKEN" https://api.github.com/user)
+    [ "$C" = "200" ] || die "GitHub token 验证失败(HTTP $C)。下一步:检查 token 有效性/scope"
+    GIT_MANUAL="配置中心 OAuth 登录只支持 Gitea——GitHub 仓可用但登录集成无法自动配(表单登录即可)"
+  else
+    VER=$(curl -m10 -s -H "Authorization: token $GIT_TOKEN" "$GIT_URL/api/v1/version" | python3 -c 'import json,sys
+try: print(json.load(sys.stdin).get("version",""))
+except Exception: print("")')
+    [ -n "$VER" ] || die "$GIT_URL 不像可达的 Gitea(/api/v1/version 无响应)。下一步:核对根地址与 token"
+    if [ "$REGISTRY_ENABLED" = "true" ] && [ -z "$OA_ID" ]; then
+      REDIRECT="http://$NODE_IP:30300/api/auth/oauth/callback"
+      RESP=$(curl -m10 -s -H "Authorization: token $GIT_TOKEN" -X POST "$GIT_URL/api/v1/user/applications/oauth2" \
+        -H 'Content-Type: application/json' -d "{\"name\":\"sema-registry\",\"redirect_uris\":[\"$REDIRECT\"],\"confidential_client\":true}")
+      OA_ID=$(printf '%s' "$RESP" | python3 -c 'import json,sys
+try: print(json.load(sys.stdin).get("client_id",""))
+except Exception: print("")')
+      OA_SECRET=$(printf '%s' "$RESP" | python3 -c 'import json,sys
+try: print(json.load(sys.stdin).get("client_secret",""))
+except Exception: print("")')
+      if [ -n "$OA_ID" ] && [ -n "$OA_SECRET" ]; then
+        setk REGISTRY_GITEA_BASE_URL "$GIT_URL"; setk REGISTRY_GITEA_OAUTH_ID "$OA_ID"; setk REGISTRY_GITEA_OAUTH_SECRET "$OA_SECRET"
+        OA_URL="$GIT_URL"
+      else GIT_MANUAL="OAuth app 自动创建失败(token 可能缺 write:user)——手动建后把 id/secret 写进 $ENVF 重跑"; fi
+    fi
+  fi
+  setk GIT_URL "$GIT_URL"; setk GIT_TOKEN "$GIT_TOKEN"
+fi
+helm_apply "$OA_URL" "$OA_ID" "$OA_SECRET"
+
+# runner token 跨 ns 复制要赶在 server 起 pod 前(晚了=CreateContainerConfigError 干等——真踩)
+log "3/6 runner-token 复制 + 等数据面"
+TOK=""
+for t in $(seq 1 24); do
+  TOK=$($KUBECTL get secret sema-runner-token -n sema-sandbox -o jsonpath='{.data.token}' 2>/dev/null || true)
+  [ -n "$TOK" ] && break; sleep 5
+done
+[ -n "$TOK" ] || die "sema-runner-token 未被控制器填充。下一步:kubectl -n sema-sandbox get secret,sa"
+printf '%s' "$TOK" | base64 -d | $KUBECTL create secret generic sema-runner-token-copy -n "$NAMESPACE" \
+  --from-file=token=/dev/stdin --dry-run=client -o yaml | $KUBECTL apply -f - >/dev/null
+# PG healthy(冷启拉镜像+init 可要几分钟)
+s=""
+for t in $(seq 1 120); do
+  s=$($KUBECTL get cluster sema-pg -n "$NAMESPACE" -o jsonpath='{.status.phase}' 2>/dev/null || true)
+  [ "$s" = "Cluster in healthy state" ] && break; sleep 5
+done
+[ "$s" = "Cluster in healthy state" ] || { $KUBECTL get cluster -n "$NAMESPACE" >&2 || true; die "PG 未达 healthy。下一步:kubectl -n $NAMESPACE describe cluster sema-pg;PVC Pending 时查 StorageClass"; }
+$KUBECTL rollout status deployment/sema-minio -n "$NAMESPACE" --timeout=300s >/dev/null
+# MinIO 建桶(幂等;备份桶+对象桶)
+$KUBECTL exec deploy/sema-minio -n "$NAMESPACE" -- sh -c \
+  "mc alias set local http://localhost:9000 sema \"\$MINIO_ROOT_PASSWORD\" >/dev/null && mc mb --ignore-existing local/sema-pg-backup local/workspaces local/blobs local/backups" >/dev/null \
+  || die "MinIO 建桶失败。下一步:kubectl -n $NAMESPACE logs deploy/sema-minio"
+$KUBECTL rollout status deployment/sema-server -n "$NAMESPACE" --timeout=600s >/dev/null || die "sema-server 未就绪。下一步:kubectl -n $NAMESPACE logs deploy/sema-server(常见:镜像拉取失败→imagePullSecrets/私仓凭据)"
+
+# ── Gitea 引导(provision:管理员/token/OAuth app;全部 in-pod 动作,不依赖 NodePort 可达)──
+if [ "$GIT_MODE" = "provision" ]; then
+  log "4/6 Gitea 引导"
+  $KUBECTL rollout status deployment/sema-gitea -n "$NAMESPACE" --timeout=300s >/dev/null || die "Gitea 未就绪。下一步:kubectl -n $NAMESPACE logs deploy/sema-gitea"
+  . "$ENVF"
+  gexec() { $KUBECTL exec deploy/sema-gitea -n "$NAMESPACE" -- su git -c "$*"; }
+  if ! gexec "gitea admin user list" 2>/dev/null | awk '{print $2}' | grep -qx "$GIT_ADMIN_USER"; then
+    gexec "gitea admin user create --admin --username '$GIT_ADMIN_USER' --password '$GIT_ADMIN_PASSWORD' --email '${GIT_ADMIN_USER}@sema.local' --must-change-password=false" >/dev/null \
+      || die "Gitea 管理员创建失败。下一步:kubectl -n $NAMESPACE logs deploy/sema-gitea"
+  fi
+  if ! has_env GIT_ADMIN_TOKEN; then
+    TOK_NAME="sema-up-$(openssl rand -hex 3)"
+    GTOK=$($KUBECTL exec deploy/sema-gitea -n "$NAMESPACE" -- \
+      curl -m10 -s -u "$GIT_ADMIN_USER:$GIT_ADMIN_PASSWORD" -X POST "http://127.0.0.1:3000/api/v1/users/$GIT_ADMIN_USER/tokens" \
+      -H 'Content-Type: application/json' -d "{\"name\":\"$TOK_NAME\",\"scopes\":[\"all\"]}" \
+      | python3 -c 'import json,sys
+try: print(json.load(sys.stdin).get("sha1",""))
+except Exception: print("")')
+    [ -n "$GTOK" ] || die "Gitea access token 生成失败。下一步:kubectl -n $NAMESPACE logs deploy/sema-gitea"
+    setk GIT_ADMIN_TOKEN "$GTOK"
+  fi
+  . "$ENVF"
+  if [ "$REGISTRY_ENABLED" = "true" ] && ! has_env REGISTRY_GITEA_OAUTH_ID; then
+    REDIRECT="http://$NODE_IP:30300/api/auth/oauth/callback"
+    RESP=$($KUBECTL exec deploy/sema-gitea -n "$NAMESPACE" -- \
+      curl -m10 -s -H "Authorization: token $GIT_ADMIN_TOKEN" -X POST "http://127.0.0.1:3000/api/v1/user/applications/oauth2" \
+      -H 'Content-Type: application/json' -d "{\"name\":\"sema-registry\",\"redirect_uris\":[\"$REDIRECT\"],\"confidential_client\":true}")
+    OA_ID=$(printf '%s' "$RESP" | python3 -c 'import json,sys
+try: print(json.load(sys.stdin).get("client_id",""))
+except Exception: print("")')
+    OA_SECRET=$(printf '%s' "$RESP" | python3 -c 'import json,sys
+try: print(json.load(sys.stdin).get("client_secret",""))
+except Exception: print("")')
+    if [ -n "$OA_ID" ] && [ -n "$OA_SECRET" ]; then
+      setk REGISTRY_GITEA_BASE_URL "http://$NODE_IP:30330"; setk REGISTRY_GITEA_OAUTH_ID "$OA_ID"; setk REGISTRY_GITEA_OAUTH_SECRET "$OA_SECRET"
+      log "Gitea→registry OAuth 已接,helm 二遍升级注入"
+      helm_apply "http://$NODE_IP:30330" "$OA_ID" "$OA_SECRET"
+    else
+      GIT_MANUAL="Gitea OAuth app 自动创建失败——registry 仍可表单登录;手动建(回调 $REDIRECT)后把 id/secret 写进 $ENVF 重跑"
+    fi
+  fi
+fi
+if [ "$REGISTRY_ENABLED" = "true" ]; then
+  $KUBECTL rollout status deployment/sema-registry -n "$NAMESPACE" --timeout=300s >/dev/null || die "registry 未就绪。下一步:kubectl -n $NAMESPACE logs deploy/sema-registry(常见:镜像拉取失败)"
+fi
+
+# ── smoke(port-forward 直验——kind/远程 kubeconfig 下 NodePort 对本机不可达,别靠它)──
+log "5/6 smoke"
+smoke_pf() { # smoke_pf <svc> <port> <path> → http code
+  local pf_pid code
+  $KUBECTL port-forward "svc/$1" -n "$NAMESPACE" "1$2:$2" >/dev/null 2>&1 &
+  pf_pid=$!
+  sleep 2
+  code=$(curl -m5 -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:1$2$3" || echo 000)
+  kill $pf_pid 2>/dev/null; wait $pf_pid 2>/dev/null || true
+  printf '%s' "$code"
+}
+H=$(smoke_pf sema-server 8090 /health)
+[ "$H" = "200" ] || die "smoke 失败:server /health=$H(期望 200)。下一步:kubectl -n $NAMESPACE logs deploy/sema-server"
+A=$(smoke_pf sema-server 8090 /v1/runs)
+[ "$A" = "401" ] || die "smoke 失败:无 token /v1/runs=$A(期望 401=auth 门在)。SERVICE_AUTH_TOKEN 未生效=裸奔,立刻查"
+R="n/a"
+if [ "$REGISTRY_ENABLED" = "true" ]; then
+  R=$(smoke_pf sema-registry 3000 /api/healthz)
+  [ "$R" = "200" ] || die "smoke 失败:registry healthz=$R。下一步:kubectl -n $NAMESPACE logs deploy/sema-registry"
+fi
+G="n/a"
+if [ "$GIT_MODE" = "provision" ]; then
+  G=$(smoke_pf sema-gitea 3000 /api/healthz)
+  [ "$G" = "200" ] || die "smoke 失败:gitea healthz=$G"
+fi
+log "smoke ✓ health=$H auth=$A registry=$R gitea=$G"
+
+# ── summary(一屏;凭据一次性显示)────────────────────────────────────────────────
+log "6/6 完成"
+. "$ENVF"
+{
+  echo
+  echo "══════════════ kube-up 完成($NODES 节点,mode=$KUBE_MODE)══════════════"
+  echo " 引擎      NodePort 30890 → http://$NODE_IP:30890(API 凭据=SERVICE_AUTH_TOKEN)"
+  echo "           本机不可达 NodePort 时(kind/远程):kubectl -n $NAMESPACE port-forward svc/sema-server 8090:8090"
+  echo " 数据      CNPG sema-pg×$PG_INSTANCES($PG_AA)+ MinIO(桶:workspaces/blobs/backups/sema-pg-backup)"
+  if [ "$REGISTRY_ENABLED" = "true" ]; then
+    echo " 配置中心  NodePort 30300 → http://$NODE_IP:30300"
+    if $NEW_REG_PW; then echo "           首登:${REGISTRY_ADMIN_USER:-zhaoheran} / ${REGISTRY_ADMIN_PASSWORD}(⚠ 只显示这一次,之后看 .env)"
+    else echo "           首登:${REGISTRY_ADMIN_USER:-zhaoheran}(密码沿用上次,在 .env REGISTRY_ADMIN_PASSWORD)"; fi
+  fi
+  if [ "$GIT_MODE" = "provision" ]; then
+    echo " Git/Gitea NodePort 30330(http)/30322(ssh)→ http://$NODE_IP:30330"
+    if $NEW_GIT_PW; then echo "           管理员:${GIT_ADMIN_USER} / ${GIT_ADMIN_PASSWORD}(⚠ 只显示这一次,之后看 .env)"
+    else echo "           管理员:${GIT_ADMIN_USER}(密码在 .env GIT_ADMIN_PASSWORD)"; fi
+  elif [ "$GIT_MODE" = "connect" ]; then
+    echo " Git       已连接 ${GIT_URL}(token 在 .env GIT_TOKEN)"
+  fi
+  [ -n "$GIT_MANUAL" ] && echo " ⚠ 待人工  $GIT_MANUAL"
+  [ "$RUNTIME_CLASS" = "" ] && echo " ⚠ 沙箱    无 kata——runc 容器隔离(生产建议装 kata-deploy 后重跑)"
+  echo " 凭据      $ENVF(0600)"
+  echo " 卸载      helm -n $NAMESPACE uninstall sema-stack(PVC/数据留);CNPG operator/k3s 另卸"
+  echo "═══════════════════════════════════════════════════════════════════════"
+} >&2

package/deploy/sema-up/lib/parse-machines.py

@@ -0,0 +1,117 @@
+#!/usr/bin/env python3
+"""machines.yaml → env 行(sema-up.sh source 用)。
+只解析 machines.example.yaml 的固定形状(2 级缩进+机器列表),标准库零依赖——
+bootstrap 目标机不保证有 PyYAML,而形状是我们自己定的,mini-parser 覆盖即可;
+遇到解析不了的结构 fail-loud 指出行号,绝不猜。
+用法: parse-machines.py machines.yaml   # stdout 一行一个 KEY=VALUE
+"""
+import re, shlex, sys
+
+# 结构字段严格校验:值会被 sema-up.sh eval/嵌入 ssh 与远端 root shell——不是防操作员(yaml 就是
+# 操作员写的),是防粘贴事故/特殊字符静默注入(一次在 parser 层根治)
+VALIDATORS = {
+    "name":        (r"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$", "RFC1123 节点名(小写字母数字与-)"),
+    "host":        (r"^[A-Za-z0-9][A-Za-z0-9._-]{0,252}$", "IPv4/主机名(首字符字母数字——防 ssh 把 -o… 当选项)"),
+    "user":        (r"^[a-z_][a-z0-9_-]{0,31}$", "unix 用户名"),
+    "role":        (r"^(server|agent)$", "server|agent"),
+    "private_ip":  (r"^\d{1,3}(\.\d{1,3}){3}$", "IPv4"),
+    "private_cidr":(r"^\d{1,3}(\.\d{1,3}){3}/\d{1,2}$", "IPv4/prefix"),
+    "public_iface":(r"^[A-Za-z0-9_.@-]{1,15}$", "接口名"),
+}
+def validate(field, value, ctx, ln=None):
+    if field in VALIDATORS and value:
+        pat, hint = VALIDATORS[field]
+        if not re.match(pat, value):
+            die(f"{ctx} 的 {field}={value!r} 不合法(期望 {hint})", ln)
+
+def die(msg, ln=None):
+    sys.stderr.write(f"machines.yaml 解析失败{f'(第 {ln} 行)' if ln else ''}: {msg}\n")
+    sys.exit(1)
+
+def strip_comment(v):
+    # 值内不含引号字符串的场景(我们的模板如此);"# " 之后为注释
+    return re.split(r"\s+#", v, maxsplit=1)[0].strip().strip('"').strip("'")
+
+def main(path):
+    top = {}            # 顶层标量
+    sections = {}       # 顶层 section → {k: v}
+    machines = []       # [{host,user,ssh_key,password,role}]
+    cur_section = None
+    cur_machine = None
+    for ln, raw in enumerate(open(path, encoding="utf-8"), 1):
+        line = raw.rstrip("\n")
+        if not line.strip() or line.strip().startswith("#"):
+            continue
+        indent = len(line) - len(line.lstrip())
+        body = line.strip()
+        if indent == 0:
+            cur_machine = None
+            m = re.match(r"^([A-Za-z_][\w-]*):\s*(.*)$", body)
+            if not m: die(f"看不懂的顶层行: {body!r}", ln)
+            k, v = m.group(1), strip_comment(m.group(2))
+            if v:
+                top[k] = v; cur_section = None
+            else:
+                cur_section = k; sections.setdefault(k, {})
+        elif body.startswith("- "):
+            if cur_section != "machines": die(f"列表只允许出现在 machines: 下", ln)
+            cur_machine = {}
+            machines.append(cur_machine)
+            m = re.match(r"^-\s+([\w-]+):\s*(.*)$", body)
+            if not m: die(f"看不懂的列表项: {body!r}", ln)
+            cur_machine[m.group(1)] = strip_comment(m.group(2))
+        else:
+            m = re.match(r"^([\w-]+):\s*(.*)$", body)
+            if not m: die(f"看不懂的行: {body!r}", ln)
+            k, v = m.group(1), strip_comment(m.group(2))
+            if cur_section == "machines":
+                if cur_machine is None: die("machines 下的键不在任何 '- host:' 项里", ln)
+                cur_machine[k] = v
+            elif cur_section:
+                sections[cur_section][k] = v
+            else:
+                die(f"缩进了但没有所属 section: {body!r}", ln)
+
+    out = []
+    def emit(k, v):
+        if v is None or v == "": return
+        # shlex.quote:输出会被 shell eval,单引号量化让 $ ` 等永远是字面量(密码等自由字段也安全)
+        out.append(f"{k}={shlex.quote(v)}")
+
+    emit("PROFILE", top.get("profile"))
+    emit("REGION", top.get("region", "auto"))
+    emit("USERS", top.get("users", "single"))
+    # server 镜像(registry 引用;海外=docker.io/<ns>/sema-server:<tag>)
+    emit("SEMA_SERVER_IMAGE", top.get("server_image"))
+    emit("MACHINE_COUNT", str(len(machines)))
+    names = set()
+    for i, mch in enumerate(machines):
+        if "host" not in mch: die(f"machines[{i}] 缺 host")
+        # name=k3s node-name(必须全局唯一;缺省 sema-0<i+1>)。教训:裸机批次系统 hostname
+        # 常常整批相同,靠系统名注册 etcd 成员必撞;node-name 从第一次 join 就要唯一。
+        name = mch.get("name") or f"sema-{i+1:02d}"
+        if name in names: die(f"machines[{i}] name 重复: {name}")
+        names.add(name)
+        mch["name"] = name
+        for k in ("host", "user", "ssh_key", "password", "role", "name", "private_ip", "private_cidr", "public_iface"):
+            validate(k, mch.get(k), f"machines[{i}]")
+            emit(f"MACHINE_{i}_{k.upper()}", mch.get(k))
+    dp = sections.get("data_plane", {})
+    emit("DP_PG", dp.get("pg", "deploy"))
+    emit("DP_S3", dp.get("s3", "deploy"))
+    emit("DP_BACKUP", dp.get("backup", "true"))
+    sb = sections.get("sandbox", {})
+    emit("SANDBOX_LANE", sb.get("lane"))
+    emit("E2B_ENDPOINT", sb.get("e2b_endpoint"))
+    emit("E2B_API_KEY", sb.get("e2b_api_key"))
+    rg = sections.get("registry", {})
+    emit("REGISTRY_ENABLED", rg.get("enabled"))
+    emit("SEMA_REGISTRY_IMAGE", rg.get("image"))
+    ir = sections.get("image_registry", {})
+    emit("IMAGE_REGISTRY_MODE", ir.get("mode"))
+    emit("IMAGE_REGISTRY_ENDPOINT", ir.get("endpoint"))
+    print("\n".join(out))
+
+if __name__ == "__main__":
+    if len(sys.argv) != 2: die("用法: parse-machines.py <machines.yaml>")
+    main(sys.argv[1])

package/deploy/sema-up/machines.example.yaml

@@ -0,0 +1,53 @@
+# sema-up 机器清单模板(DEPLOY-OVERSEAS-PILOT §5 Phase 0/1)
+# 条目数决定模式:>=3 → cluster(k3s,embedded etcd HA);1 → single(docker compose)。
+# 凭据二选一:password(bootstrap 用它铺 ssh key,不落盘不入日志)或 ssh_key(已互信)。
+profile: full-cluster   # full-cluster | full-single | data-center | local-plus
+region: auto            # auto | cn | global(auto=连通性探测,--region 可覆盖)
+users: single           # single(超管 turnkey,推荐)| multi(身份隔离+能力默认全开)
+# server_image: ghcr.io/clayboby/sema-server:<tag>   # 引擎镜像 registry 引用(GHCR/Docker Hub 公开仓,
+#                         # 匿名可拉;CN 兜底=内网 Gitea registry。SWR 已弃用 2026-07-13);
+#                         # 不填则要 env SEMA_SERVER_IMAGE 或 SEMA_SERVER_IMAGE_TAR(tar 预灌)
+
+machines:
+  - host: 10.0.0.1      # ssh 可达地址(生产建议私网;公网入口走 LB,不直暴节点)
+    user: root
+    # password: "..."   # 或
+    ssh_key: ~/.ssh/id_ed25519
+    role: server        # server(k3s control-plane)| agent;single 模式忽略
+    # name: sema-01     # k3s node-name,缺省 sema-0N;必须唯一(裸机批次系统 hostname 常整批相同,
+    #                   # 靠系统名注册 etcd 成员必撞——Phase 1b 真踩)
+    # private_ip: 10.34.0.154   # 集群东西向走的私网 IP(VLAN);缺省用 host
+    # private_cidr: 10.34.0.0/24 # NodePort 限定网段;缺省从 private_ip 推 /24(非 /24 网段必填)
+    # public_iface: bond0       # 有公网口的机器填,VXLAN 8472 会在该口 DROP(隔离不变量)
+  - host: 10.0.0.2
+    user: root
+    ssh_key: ~/.ssh/id_ed25519
+    role: server
+  - host: 10.0.0.3
+    user: root
+    ssh_key: ~/.ssh/id_ed25519
+    role: server
+
+data_plane:
+  pg: deploy            # deploy(内置+自动调优)| 连接串 postgres://…(外接,先校验)
+  s3: deploy            # deploy(内置 MinIO+自动调优)| endpoint+key(外接 S3 协议桶)
+  backup: true          # PG 定时备份到 S3(data-center/full 默认 true)
+
+sandbox:
+  lane: kata            # kata(默认,需 KVM,预检不过不给)| e2b-cloud | e2b-self | runc
+  # e2b_endpoint: …     # lane=e2b-self 时必填(校验连通+模板可用)
+  # e2b_api_key: …
+
+registry:
+  enabled: true         # sema-registry 配置中心(MCP/skill/模型配置云同步);data-center 也建议 true
+  # image: ghcr.io/clayboby/sema-registry:<tag>  # enabled=true 必填(GHCR/Hub,迁移中;SWR 已弃用)
+image_registry:
+  mode: dockerhub       # dockerhub(现行:docker.io/claybobby 公开池,匿名可拉,clay 2026-07-12/13 拍
+  #                     # SWR 全面弃用)| swr-secret(已弃用:旧国内 SWR 拉取凭据)|
+  #                     # local(内网仓;CN 兜底=内网 Gitea registry)
+  # endpoint: …         # mode=local 时的仓地址
+  # 拉取凭据一律 env,不写进本文件:cluster-up.sh 读 IMAGE_PULL_USER / IMAGE_PULL_TOKEN
+  # (+可选 IMAGE_PULL_REGISTRY,默认 https://index.docker.io/v1/)→ 建 secret sema-regcred
+  # 于 sema/sema-sandbox 两 ns 并 patch default SA(server 与沙箱 pod 全覆盖)。
+  # server 镜像即 SEMA_SERVER_IMAGE=ghcr.io/clayboby/sema-server:<tag>(public 匿名可拉;
+  # 仅换成 private 仓时才要上面的凭据)。