From 0631aa4a4fb6d1e59a08d23ab12c51e09fef63b2 Mon Sep 17 00:00:00 2001
From: caoqianming <caoqianming@foxmail.com>
Date: Sat, 11 Jul 2026 09:58:02 +0800
Subject: [PATCH] =?UTF-8?q?fix(sandbox):=20round-3=20=E6=8E=A2=E9=92=88?=
 =?UTF-8?q?=E4=B8=8B=E8=BD=BD=E6=BA=90=E6=94=B9=E9=98=BF=E9=87=8C(bump=200?=
 =?UTF-8?q?.58.6)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

npx 拉 @puppeteer/browsers 包显式 npm_config_registry=registry.npmmirror.com;
chrome-for-testing 二进制按 阿里 CDN -> 阿里 registry binary -> 官方 三级
fallback(服务器实测默认源下不动)。

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 PROGRESS.md                             |  3 ++-
 core/__init__.py                        |  2 +-
 deploy/sandbox/probe_chromium_round3.sh | 24 +++++++++++++++---------
 3 files changed, 18 insertions(+), 11 deletions(-)

diff --git a/PROGRESS.md b/PROGRESS.md
index 2d8f234..5b6d4d6 100644
--- a/PROGRESS.md
+++ b/PROGRESS.md
@@ -2,7 +2,7 @@
 
 > 配合 `DESIGN.md`。本文件只记 phase 状态、决策偏差、文件量、下一步。每条 1-2 句:做了啥 + 关键判断;细节查 `git log` / `git diff` / `DESIGN §7.9`。
 
-最后更新:2026-07-11(chromium 秒崩 round-3 探针:FATAL 抓取 + headless-shell 修法验证,bump 0.58.5)
+最后更新:2026-07-11(round-3 探针下载源改阿里,bump 0.58.6)
 
 ---
 
@@ -23,6 +23,7 @@
 
 ### 2026-07
 
+- **07-11 / 0.58.6**:round-3 探针下载源修正——npx 拉 `@puppeteer/browsers` 显式走阿里 npm registry,chrome-for-testing 二进制按 阿里 CDN → 阿里 registry binary → 官方 三级 fallback(服务器实测默认源下不动)。
 - **07-11 / 0.58.5**:**chromium 秒崩 round-3 探针**:bisect 结果全 case FAIL(含 baseline 无 hardening、seccomp=unconfined)→ hardening 全部无罪,宿主 overcommit/ulimit 数据也干净——嫌疑收敛为 trixie chromium 150 构建 × 本宿主组合本身跑不了。新 `deploy/sandbox/probe_chromium_round3.sh`:①抓崩溃 FATAL 行(此前日志被 head 截断)+ gdb backtrace(best-effort);②实测 Google 官方 chrome-headless-shell(npmmirror 下载,puppeteer 生态对着它测试)在本宿主能否跑 + mmdc 接上出图——直接验证「镜像弃发行版 chromium 改 pinned headless shell」修法可行性,PASS 即定案动 Dockerfile。
 - **07-11 / 0.58.4**:**mermaid 崩塌第二根因排查工具 `deploy/sandbox/probe_chromium_bisect.sh`**:pids-limit 1024 部署后复测(同 task 9dcae061,green 实例全新容器)仍首调秒崩——排除 pids 打满,根因在 hardening flag × chromium 150 交互。探针把线上 docker run 全款 hardening 逐 flag 开关(no-new-privileges / read-only / cap-drop / mem·cpu / seccomp=unconfined),每 case 跑 mmdc + 裸 chromium 两条,忠实复现 exec 路径(--user zcbot + HOME=/tmp),尾部带判读表;RUN.md 故障兜底条目同步。
 - **07-11 / 0.58.3**：**admin 用量表默认时间范围 all→近7天**：`admin.js` 「按模型」「各用户用量」两表初始 range 从"全部"改"近7天"（下拉仍可切全部/30天）；API 端 `range` 默认值不动。
diff --git a/core/__init__.py b/core/__init__.py
index e292870..db5054f 100644
--- a/core/__init__.py
+++ b/core/__init__.py
@@ -1,3 +1,3 @@
 # zcbot 版本号单一事实源:web/app.py 的 FastAPI version、/healthz 返回、前端展示都引这里。
 # 改版本只动这一行。
-__version__ = "0.58.5"
+__version__ = "0.58.6"
diff --git a/deploy/sandbox/probe_chromium_round3.sh b/deploy/sandbox/probe_chromium_round3.sh
index 44fa545..b0c21d2 100644
--- a/deploy/sandbox/probe_chromium_round3.sh
+++ b/deploy/sandbox/probe_chromium_round3.sh
@@ -36,15 +36,21 @@ echo "===== 3. Google 官方 chrome-headless-shell 实测(验证修法 A) ====="
 docker run --rm --user zcbot -e HOME=/tmp --entrypoint bash "$IMG" -c '
   set -u
   cd /tmp
-  MIRROR="https://cdn.npmmirror.com/binaries/chrome-for-testing"
-  echo "[download] chrome-headless-shell@stable via npmmirror ..."
-  if ! npx -y @puppeteer/browsers install chrome-headless-shell@stable \
-        --path /tmp/pptr --base-url "$MIRROR" >/tmp/dl.log 2>&1; then
-    echo "[download] npmmirror 失败,改试官方源 ..."
-    npx -y @puppeteer/browsers install chrome-headless-shell@stable \
-        --path /tmp/pptr >/tmp/dl.log 2>&1 \
-      || { echo "[FAIL] 两个源都下不动"; tail -5 /tmp/dl.log; exit 1; }
-  fi
+  # npm 包源走阿里(npx 拉 @puppeteer/browsers 包本身);二进制源三级 fallback:
+  # 阿里 CDN -> 阿里 registry binary 路径 -> Google 官方
+  export npm_config_registry="https://registry.npmmirror.com"
+  ok=""
+  for BASE in "https://cdn.npmmirror.com/binaries/chrome-for-testing" \
+              "https://registry.npmmirror.com/-/binary/chrome-for-testing" \
+              ""; do
+    echo "[download] chrome-headless-shell@stable base-url=${BASE:-官方} ..."
+    if npx -y @puppeteer/browsers install chrome-headless-shell@stable \
+          --path /tmp/pptr ${BASE:+--base-url "$BASE"} >/tmp/dl.log 2>&1; then
+      ok=1; break
+    fi
+    tail -2 /tmp/dl.log
+  done
+  [ -n "$ok" ] || { echo "[FAIL] 三个源都下不动"; tail -5 /tmp/dl.log; exit 1; }
   BIN=$(find /tmp/pptr -type f -name chrome-headless-shell | head -1)
   [ -n "$BIN" ] || { echo "[FAIL] 下载完成但没找到二进制"; exit 1; }
   echo "BIN=$BIN"