Upload Dockerfile

Dockerfile

@@ -1,684 +1,119 @@
-# ═══════════════════════════════════════════════════════════════════════════════
-# Chat2API — HuggingFace Space 版
-# 基于 Node.js，集成 Chat2API 项目 + code-server 按需启停 IDE
-# 持久化存储：HuggingFace Dataset（每小时自动备份，重启自动恢复）
-# ═══════════════════════════════════════════════════════════════════════════════
-
-FROM node:24-slim
-
-# ── 1. 基础系统依赖 ────────────────────────────────────────────────────────────
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    git openssh-client build-essential python3 python3-pip \
-    g++ make ca-certificates curl wget nginx \
-    && rm -rf /var/lib/apt/lists/*
-
-# ── 1.1. 安装 code-server（浏览器版 VS Code，自带 terminal） ──────────────────
-RUN curl -fsSL https://code-server.dev/install.sh | sh
-
-# ── 2. 安装 GitHub CLI ────────────────────────────────────────────────────────
-RUN mkdir -p -m 755 /etc/apt/keyrings \
-    && out=$(mktemp) && wget -nv -O$out https://cli.github.com/packages/githubcli-archive-keyring.gpg \
-    && cat $out | tee /etc/apt/keyrings/githubcli-archive-keyring.gpg > /dev/null \
-    && chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \
-    && mkdir -p -m 755 /etc/apt/sources.list.d \
-    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
-       | tee /etc/apt/sources.list.d/github-cli.list > /dev/null \
-    && apt-get update \
-    && apt-get install -y --no-install-recommends gh \
-    && rm -rf /var/lib/apt/lists/* \
-    && gh --version
-
-# ── 3. 安装 HuggingFace Hub Python 客户端（用于 Dataset 持久化） ───────────────
-RUN pip3 install --no-cache-dir huggingface_hub --break-system-packages
-
-# ── 4. 环境与 Git 配置 ────────────────────────────────────────────────────────
-RUN update-ca-certificates && \
-    git config --global http.sslVerify false && \
-    git config --global url."https://github.com/".insteadOf ssh://git@github.com/
-
-# ── 5. 克隆并构建 Chat2API 项目 ───────────────────────────────────────────────
-WORKDIR /app/chat2api
-RUN git clone --depth=1 https://github.com/xiaoY233/Chat2API.git . && \
-    npm install && \
-    npm run build:linux 2>/dev/null || true
-# 注：build:linux 产出 AppImage/deb，但在容器内我们直接用开发模式运行服务端进程
-
-# ── 6. 环境变量默认值 ─────────────────────────────────────────────────────────
-ENV PORT=7860 \
-    HOME=/root \
-    PYTHONUNBUFFERED=1
-
-# ── 7. 写入 Dataset 持久化同步引擎（sync.py）──────────────────────────────────
-RUN cat <<'EOF' > /usr/local/bin/sync.py
-import os, sys, tarfile, shutil
-from huggingface_hub import HfApi, hf_hub_download
-from datetime import datetime, timedelta
-
-api = HfApi()
-repo_id = os.getenv("HF_DATASET")
-token   = os.getenv("HF_TOKEN")
-
-DATA_DIR = "/root/.chat2api"
-
-# ── 工具函数 ──────────────────────────────────────────────────────────────────
-
-def _parse_skip_list(env_var):
-    raw = os.getenv(env_var, "").strip()
-    if not raw:
-        return set()
-    return {s.strip().strip("/") for s in raw.split(",") if s.strip()}
-
-def _is_skipped(rel_path, skip_set):
-    rel = rel_path.strip("/")
-    for skip in skip_set:
-        if rel == skip or rel.startswith(skip + "/"):
-            return True
-    return False
-
-def _walk_local(base_dir, skip_set=None):
-    results = []
-    if not os.path.isdir(base_dir):
-        return results
-    for dirpath, dirnames, filenames in os.walk(base_dir):
-        for fname in filenames:
-            abs_path = os.path.join(dirpath, fname)
-            rel_to_base = os.path.relpath(abs_path, base_dir)
-            if skip_set is not None:
-                rel_to_data = os.path.relpath(abs_path, DATA_DIR)
-                if _is_skipped(rel_to_data, skip_set):
-                    continue
-            results.append((abs_path, rel_to_base))
-    return results
-
-# ── restore() ────────────────────────────────────────────────────────────────
-
-def restore():
-    if not repo_id or not token:
-        print("Skip Restore: HF_DATASET or HF_TOKEN not set")
-        return
-
-    restore_skip_raw = os.getenv("RESTORE_SKIP", "").strip()
-    if restore_skip_raw == "all":
-        print("Restore skip: RESTORE_SKIP=all, skipping all restore.")
-        return
-
-    INIT_FLAG = "initialized.flag"
-    force_restore = os.getenv("FORCE_RESTORE", "").strip().lower() in ("true", "1", "yes")
-
-    try:
-        all_files = list(api.list_repo_files(repo_id=repo_id, repo_type="dataset", token=token))
-    except Exception as e:
-        print(f"Restore Error (list_repo_files): {e}")
-        return
-
-    flag_exists = INIT_FLAG in all_files
-
-    if not flag_exists and not force_restore:
-        print("Restore skip: initialized.flag not found, first deploy.")
-        import io
-        api.upload_file(
-            path_or_fileobj=io.BytesIO(b"initialized\n"),
-            path_in_repo=INIT_FLAG,
-            repo_id=repo_id,
-            repo_type="dataset",
-            token=token,
-            commit_message="Create initialized.flag on first deploy",
-        )
-        print("initialized.flag created in Dataset.")
-        return
-
-    if force_restore:
-        print("Restore: FORCE_RESTORE=true, ignoring initialized.flag.")
-    else:
-        print("Restore: initialized.flag found, normal restart.")
-
-    skip_set = _parse_skip_list("RESTORE_SKIP")
-
-    try:
-        now = datetime.now()
-        for i in range(5):
-            day  = (now - timedelta(days=i)).strftime("%Y-%m-%d")
-            name = f"backup_{day}.tar.gz"
-            if name in all_files:
-                print(f"Downloading {name}...")
-                path = hf_hub_download(repo_id=repo_id, filename=name, repo_type="dataset", token=token)
-                os.makedirs(DATA_DIR, exist_ok=True)
-                with tarfile.open(path, "r:gz") as tar:
-                    for member in tar.getmembers():
-                        if _is_skipped(member.name, skip_set):
-                            print(f"Restore skip: {member.name}")
-                            continue
-                        tar.extract(member, path=DATA_DIR)
-                print(f"Restored from {name}")
-                break
-
-        import io
-        api.upload_file(
-            path_or_fileobj=io.BytesIO(b"initialized at container startup\n"),
-            path_in_repo=INIT_FLAG,
-            repo_id=repo_id,
-            repo_type="dataset",
-            token=token,
-            commit_message="Set initialized.flag",
-        )
-        print("initialized.flag updated.")
-    except Exception as e:
-        print(f"Restore Error: {e}")
-
-
-# ── backup() ─────────────────────────────────────────────────────────────────
-
-def backup():
-    if not repo_id or not token:
-        print("Skip Backup: HF_DATASET or HF_TOKEN not set")
-        return
-
-    backup_tar_skip_raw = os.getenv("BACKUP_TAR_SKIP", "").strip()
-    if backup_tar_skip_raw == "all":
-        print("Backup skip: BACKUP_TAR_SKIP=all")
-        return
-    try:
-        tar_skip_set = _parse_skip_list("BACKUP_TAR_SKIP")
-        day  = datetime.now().strftime("%Y-%m-%d")
-        name = f"backup_{day}.tar.gz"
-        with tarfile.open(name, "w:gz") as tar:
-            for abs_path, rel_to_base in _walk_local(DATA_DIR, skip_set=tar_skip_set):
-                tar.add(abs_path, arcname=rel_to_base)
-        api.upload_file(path_or_fileobj=name, path_in_repo=name, repo_id=repo_id, repo_type="dataset", token=token)
-        print(f"Backup {name} done.")
-    except Exception as e:
-        print(f"Backup Error: {e}")
-
-
-if __name__ == "__main__":
-    if len(sys.argv) > 1 and sys.argv[1] == "backup":
-        backup()
-    else:
-        restore()
-EOF
-
-# ── 8. 写入 cs-manager 守护进程（来自原版 Dockerfile，原样复制） ────────────────
-RUN cat <<'PYEOF' > /usr/local/bin/cs-manager
-#!/usr/bin/env python3
-"""
-cs-manager: code-server 按需启停守护进程
-
-监听 Unix socket，提供两个 HTTP 端点：
-  GET /wakeup    - 触发启动 code-server（若未运行），返回"启动中"等待页
-  GET /heartbeat - 更新最后活跃时间（nginx 每次成功代理 /ide/ 后调用）
-
-后台定时任务：
-  每 60 秒检查一次，若超过 IDE_IDLE_MINUTES 分钟无 heartbeat，kill code-server
-"""
-
-import os, sys, time, signal, subprocess, threading, socket, re
-from http.server import HTTPServer, BaseHTTPRequestHandler
-
-# ── 配置 ─────────────────────────────────────────────────────────────────────
-SOCK_PATH        = "/tmp/cs-manager.sock"
-CS_PORT          = int(os.environ.get("CODE_SERVER_PORT", "13337"))
-CS_PASSWORD      = os.environ.get("CODE_SERVER_PASSWORD", "changeme123!")
-CS_USER_DATA_DIR = "/root/.code-server"
-CS_EXTENSIONS_DIR= "/root/.code-server/extensions"
-CS_WORKSPACE     = "/root/.chat2api"
-CS_LOG           = "/root/.chat2api/logs/code-server.log"
-IDLE_MINUTES     = int(os.environ.get("IDE_IDLE_MINUTES", "30"))
-LAST_ACCESS_FILE = "/tmp/cs-last-access"
-CS_PID_FILE      = "/tmp/cs-server.pid"
-CHECK_INTERVAL   = 60   # 秒
-
-# ── 全局状态 ──────────────────────────────────────────────────────────────────
-_lock     = threading.Lock()
-_starting = False   # 正在启动中，防止并发重复启动
-
-# ── 工具函数 ──────────────────────────────────────────────────────────────────
-
-def log(msg):
-    ts = time.strftime("%Y-%m-%d %H:%M:%S")
-    print(f"[cs-manager {ts}] {msg}", flush=True)
-
-def touch_last_access():
-    try:
-        with open(LAST_ACCESS_FILE, "w") as f:
-            f.write(str(time.time()))
-        os.utime(LAST_ACCESS_FILE, None)
-    except Exception as e:
-        log(f"touch_last_access error: {e}")
-
-def get_cs_pid():
-    """读取 PID 文件，返回 code-server PID（若进程存在），否则返回 None"""
-    try:
-        with open(CS_PID_FILE) as f:
-            pid = int(f.read().strip())
-        os.kill(pid, 0)   # 探测进程是否存在
-        return pid
-    except Exception:
-        return None
-
-def is_cs_running():
-    return get_cs_pid() is not None
-
-def is_cs_port_ready():
-    """尝试 TCP 连接 code-server 端口，确认服务真正可用"""
-    try:
-        s = socket.create_connection(("127.0.0.1", CS_PORT), timeout=1)
-        s.close()
-        return True
-    except Exception:
-        return False
-
-def start_cs():
-    """启动 code-server，非阻塞，返回后进程在后台运行"""
-    global _starting
-    with _lock:
-        if _starting or is_cs_running():
-            return
-        _starting = True
-
-    try:
-        log(f"Starting code-server on port {CS_PORT}...")
-        os.makedirs(os.path.dirname(CS_LOG), exist_ok=True)
-        os.makedirs(CS_USER_DATA_DIR, exist_ok=True)
-
-        # 写入 code-server config.yaml
-        cfg_dir = "/root/.config/code-server"
-        os.makedirs(cfg_dir, exist_ok=True)
-        with open(os.path.join(cfg_dir, "config.yaml"), "w") as f:
-            f.write(f"bind-addr: 127.0.0.1:{CS_PORT}\n")
-            f.write(f"auth: password\n")
-            f.write(f"password: {CS_PASSWORD}\n")
-            f.write(f"cert: false\n")
-
-        env = os.environ.copy()
-        env.pop("PORT", None)   # 防止 code-server 读取 PORT=7860 覆盖端口
-
-        log_file = open(CS_LOG, "a")
-        proc = subprocess.Popen(
-            [
-                "code-server",
-                "--disable-telemetry",
-                "--disable-update-check",
-                f"--user-data-dir={CS_USER_DATA_DIR}",
-                f"--extensions-dir={CS_EXTENSIONS_DIR}",
-                CS_WORKSPACE,
-            ],
-            stdout=log_file,
-            stderr=log_file,
-            env=env,
-            start_new_session=True,   # 脱离当前进程组，避免随父进程终止
-        )
-
-        # 写入 PID 文件
-        with open(CS_PID_FILE, "w") as f:
-            f.write(str(proc.pid))
-        log(f"code-server started, PID={proc.pid}")
-        touch_last_access()
-    except Exception as e:
-        log(f"start_cs error: {e}")
-    finally:
-        with _lock:
-            _starting = False
-
-def stop_cs():
-    """终止 code-server 进程"""
-    pid = get_cs_pid()
-    if pid is None:
-        log("stop_cs: code-server not running, skip")
-        return
-    try:
-        os.kill(pid, signal.SIGTERM)
-        log(f"code-server (PID={pid}) terminated (SIGTERM)")
-    except Exception as e:
-        log(f"stop_cs error: {e}")
-    try:
-        os.remove(CS_PID_FILE)
-    except Exception:
-        pass
-
-# ── 闲置检测定时器 ────────────────────────────────────────────────────────────
-
-def idle_checker():
-    while True:
-        time.sleep(CHECK_INTERVAL)
-        try:
-            if not is_cs_running():
-                continue
-            try:
-                mtime = os.path.getmtime(LAST_ACCESS_FILE)
-            except FileNotFoundError:
-                mtime = 0
-            idle_secs = time.time() - mtime
-            idle_mins  = idle_secs / 60
-            if idle_mins >= IDLE_MINUTES:
-                log(f"Idle for {idle_mins:.1f} min (threshold={IDLE_MINUTES} min), stopping code-server...")
-                stop_cs()
-            else:
-                remaining = IDLE_MINUTES - idle_mins
-                log(f"code-server running, idle {idle_mins:.1f}/{IDLE_MINUTES} min (auto-stop in {remaining:.1f} min)")
-        except Exception as e:
-            log(f"idle_checker error: {e}")
-
-# ── HTTP 请求处理 ─────────────────────────────────────────────────────────────
-
-WAKEUP_HTML = """\
-<!DOCTYPE html>
-<html lang="zh">
-<head>
-<meta charset="utf-8">
-<meta http-equiv="refresh" content="5;url=/ide/">
-<title>IDE 启动中...</title>
-<style>
-  body {{ font-family: sans-serif; display:flex; align-items:center;
-          justify-content:center; height:100vh; margin:0; background:#1e1e1e; color:#ccc; }}
-  .box {{ text-align:center; }}
-  .spinner {{ width:48px; height:48px; border:5px solid #555;
-              border-top-color:#0078d4; border-radius:50%;
-              animation:spin 1s linear infinite; margin:0 auto 20px; }}
-  @keyframes spin {{ to {{ transform:rotate(360deg) }} }}
-  p {{ margin:6px 0; }}
-  small {{ color:#888; }}
-</style>
-</head>
-<body>
-<div class="box">
-  <div class="spinner"></div>
-  <p>VS Code IDE 正在启动，请稍候...</p>
-  <p><small>页面将在 5 秒后自动重试，或手动 <a href="/ide/" style="color:#0078d4">刷新</a></small></p>
-</div>
-</body>
-</html>
-"""
-
-class CSManagerHandler(BaseHTTPRequestHandler):
-    def log_message(self, fmt, *args):
-        pass  # 静默 access log，避免刷日志
-
-    def do_GET(self):
-        if self.path.startswith("/wakeup"):
-            self._handle_wakeup()
-        elif self.path.startswith("/heartbeat"):
-            self._handle_heartbeat()
-        else:
-            self.send_response(404)
-            self.end_headers()
-
-    def _handle_wakeup(self):
-        """
-        nginx @ide_wakeup 调用此端点。
-        若 code-server 已在运行（端口可达），返回 302 重定向回 /ide/。
-        若未运行，触发后台启动，返回 200 "启动中"等待页。
-        """
-        if is_cs_port_ready():
-            touch_last_access()
-            self.send_response(302)
-            self.send_header("Location", "/ide/")
-            self.end_headers()
-        else:
-            if not is_cs_running():
-                t = threading.Thread(target=start_cs, daemon=True)
-                t.start()
-            html = WAKEUP_HTML.encode()
-            self.send_response(200)
-            self.send_header("Content-Type", "text/html; charset=utf-8")
-            self.send_header("Content-Length", str(len(html)))
-            self.end_headers()
-            self.wfile.write(html)
-
-    def _handle_heartbeat(self):
-        """nginx 成功转发 /ide/ 请求后调用，更新活跃时间"""
-        touch_last_access()
-        self.send_response(204)
-        self.end_headers()
-
-
-class UnixSocketHTTPServer(HTTPServer):
-    """在 Unix domain socket 上监听的 HTTPServer"""
-    address_family = socket.AF_UNIX
-
-    def server_bind(self):
-        try:
-            os.unlink(self.server_address)
-        except FileNotFoundError:
-            pass
-        super().server_bind()
-        os.chmod(self.server_address, 0o666)
-
-
-# ── 主入口 ────────────────────────────────────────────────────────────────────
-
-if __name__ == "__main__":
-    log(f"cs-manager starting (idle_timeout={IDLE_MINUTES} min, cs_port={CS_PORT})")
-    log(f"Listening on Unix socket: {SOCK_PATH}")
-
-    # 启动闲置检测后台线程
-    t = threading.Thread(target=idle_checker, daemon=True)
-    t.start()
-
-    # 启动 HTTP 服务（Unix socket）
-    server = UnixSocketHTTPServer(SOCK_PATH, CSManagerHandler)
-    try:
-        server.serve_forever()
-    except KeyboardInterrupt:
-        log("cs-manager shutting down")
-        server.server_close()
-PYEOF
-
-RUN chmod +x /usr/local/bin/cs-manager
-
-# ── 9. 写入主启动脚本 ─────────────────────────────────────────────────────────
-RUN cat <<'EOF' > /usr/local/bin/start-chat2api
-#!/bin/bash
-set -e
-
-# ── 环境变量 ─────────────────────────────────────��────────────────────────────
-LISTEN_PORT="${PORT:-7860}"
-CHAT2API_PORT=7862          # Chat2API 服务内部端口
-CODE_SERVER_PORT="${CODE_SERVER_PORT:-13337}"
-IDE_IDLE_MINUTES="${IDE_IDLE_MINUTES:-30}"
-
-export CODE_SERVER_PORT IDE_IDLE_MINUTES
-export CODE_SERVER_PASSWORD="${CODE_SERVER_PASSWORD:-changeme123!}"
-export CHAT2API_DATA_DIR="/root/.chat2api"
-
-echo "=== Chat2API HuggingFace Space 启动 ==="
-echo "外部监听端口    : ${LISTEN_PORT}"
-echo "Chat2API内部端口: ${CHAT2API_PORT}"
-echo "IDE内部端口     : ${CODE_SERVER_PORT}"
-echo "IDE闲置自动关闭 : ${IDE_IDLE_MINUTES} min"
-
-# ── 步骤 1：从 HF Dataset 恢复持久化数据 ──────────────────────────────────────
-echo "--- 恢复持久化配置数据 ---"
-python3 /usr/local/bin/sync.py restore
-
-# ── 步骤 2：准备 Chat2API 数据目录 ────────────────────────────────────────────
-mkdir -p "${CHAT2API_DATA_DIR}/logs" "${CHAT2API_DATA_DIR}/sessions"
-
-# 若数据目录不存在配置，从 HF Space 变量生成初始配置
-CONFIG_FILE="${CHAT2API_DATA_DIR}/config.json"
-if [ ! -f "$CONFIG_FILE" ]; then
-    echo "生成初始 config.json..."
-    python3 - << 'PYEOF'
-import os, json
-
-config = {
-    "port": int(os.getenv("CHAT2API_PORT", "7862")),
-    "apiKey": os.getenv("CHAT2API_API_KEY", ""),
-    "loadBalance": {
-        "strategy": os.getenv("LB_STRATEGY", "round-robin")
-    }
-}
-os.makedirs(os.getenv("CHAT2API_DATA_DIR", "/root/.chat2api"), exist_ok=True)
-with open(os.path.join(os.getenv("CHAT2API_DATA_DIR", "/root/.chat2api"), "config.json"), "w") as f:
-    json.dump(config, f, indent=2)
-print("config.json initialized.")
-PYEOF
-fi
-
-# 若数据目录不存在账户列表，从 HF Space 变量注入初始账户
-ACCOUNTS_FILE="${CHAT2API_DATA_DIR}/accounts.json"
-if [ ! -f "$ACCOUNTS_FILE" ]; then
-    echo "生成初始 accounts.json..."
-    python3 - << 'PYEOF'
-import os, json
-
-accounts = []
-# 从环境变量 PROVIDER_x_TOKEN 批量注入账户
-# 格式: PROVIDER_1_TYPE=deepseek, PROVIDER_1_TOKEN=xxx
-for i in range(1, 11):
-    ptype = os.getenv(f"PROVIDER_{i}_TYPE", "").strip()
-    token = os.getenv(f"PROVIDER_{i}_TOKEN", "").strip()
-    if ptype and token:
-        accounts.append({"provider": ptype, "token": token, "enabled": True})
-
-data_dir = os.getenv("CHAT2API_DATA_DIR", "/root/.chat2api")
-with open(os.path.join(data_dir, "accounts.json"), "w") as f:
-    json.dump(accounts, f, indent=2)
-print(f"accounts.json initialized with {len(accounts)} account(s).")
-PYEOF
-fi
-
-# ── 步骤 3：启动 Chat2API 服务（后台）─────────────────────────────────────────
-echo "--- 启动 Chat2API 服务 (内部端口 ${CHAT2API_PORT}) ---"
-cd /app/chat2api
-PORT=${CHAT2API_PORT} \
-CHAT2API_DATA="${CHAT2API_DATA_DIR}" \
-npx electron-vite dev 2>&1 | tee "${CHAT2API_DATA_DIR}/logs/chat2api.log" &
-echo "Chat2API 已在后台启动"
-
-# ── 步骤 4：启动 cs-manager 守护进程（后台）───────────────────────────────────
-echo "--- 启动 IDE 按需管理器 ---"
-python3 /usr/local/bin/cs-manager 2>&1 | tee "${CHAT2API_DATA_DIR}/logs/cs-manager.log" &
-
-# 等待 cs-manager socket 就绪（最多 10 秒）
-for i in $(seq 1 20); do
-  if [ -S /tmp/cs-manager.sock ]; then
-    echo "cs-manager socket 就绪"
-    break
-  fi
-  sleep 0.5
-done
-
-# ── 步骤 5：等待 Chat2API 服务就绪（最多 120 秒）─────────────────────────────
-echo "等待 Chat2API 服务启动..."
-for i in $(seq 1 60); do
-  if curl -fsS http://127.0.0.1:${CHAT2API_PORT}/ >/dev/null 2>&1; then
-    echo "Chat2API 服务已就绪（${i}*2s）"
-    break
-  fi
-  sleep 2
-done
-
-# ── 步骤 6：启动定时备份循环（每 60 分钟）────────────────────────────────────
-(while true; do sleep 3600; python3 /usr/local/bin/sync.py backup; done) &
-echo "持久化备份循环已启动（每小时备份一次）"
-
-# ── 步骤 7：生成 nginx 配置并启动 ────────────────────────────────────────────
-rm -f /etc/nginx/sites-enabled/default /etc/nginx/conf.d/default.conf
-
-cat > /etc/nginx/conf.d/chat2api.conf <<NGINX
-# cs-manager Unix socket upstream（IDE 按需启停控制器）
-upstream cs_manager {
-    server unix:/tmp/cs-manager.sock;
-}
-
-server {
-    listen PLACEHOLDER_LISTEN_PORT;
-    server_name _;
-    client_max_body_size 100M;
-
-    access_log /dev/stdout;
-    error_log  /dev/stderr warn;
-
-    # HF Space 由 Cloudflare 做 SSL 终结，避免端口号出现在重定向 URL 中
-    absolute_redirect off;
-    port_in_redirect off;
-
-    # ── /ide/ 主 location（IDE 按需启停）────────────────────────────────────
-    location /ide/ {
-        proxy_pass http://127.0.0.1:PLACEHOLDER_CODE_SERVER_PORT/;
-        proxy_http_version 1.1;
-        proxy_set_header Host \$host;
-        proxy_set_header Upgrade \$http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto \$scheme;
-        proxy_redirect / /ide/;
-        proxy_read_timeout 86400;
-        proxy_connect_timeout 2s;
-        error_page 502 504 @ide_wakeup;
-        post_action /ide-heartbeat/;
-    }
-
-    # ── 心跳端点 ─────────────────────────────────────────────────────────────
-    location /ide-heartbeat/ {
-        internal;
-        rewrite ^ /heartbeat break;
-        proxy_pass http://cs_manager;
-        proxy_connect_timeout 1s;
-        proxy_read_timeout 2s;
-    }
-
-    # ── IDE 唤醒 fallback ─────────────────────────────────────────────────────
-    location @ide_wakeup {
-        rewrite ^ /wakeup break;
-        proxy_pass http://cs_manager;
-        proxy_http_version 1.1;
-        proxy_set_header Host \$host;
-        proxy_connect_timeout 5s;
-        proxy_read_timeout 30s;
-    }
-
-    # ── 所有其他请求：转发到 Chat2API 服务 ───────────────────────────────────
-    location / {
-        proxy_pass http://127.0.0.1:PLACEHOLDER_CHAT2API_PORT/;
-        proxy_http_version 1.1;
-        proxy_set_header Host \$host;
-        proxy_set_header Upgrade \$http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto \$scheme;
-        proxy_read_timeout 86400;
-    }
-}
-NGINX
-
-sed -i \
-  "s/PLACEHOLDER_LISTEN_PORT/${LISTEN_PORT}/g;
-   s/PLACEHOLDER_CODE_SERVER_PORT/${CODE_SERVER_PORT}/g;
-   s/PLACEHOLDER_CHAT2API_PORT/${CHAT2API_PORT}/g" \
-  /etc/nginx/conf.d/chat2api.conf
-
-echo "nginx 配置已生成："
-cat /etc/nginx/conf.d/chat2api.conf
-
-nginx -t
-echo "启动 nginx（前台运行，保持容器存活）..."
-exec nginx -g 'daemon off; error_log /dev/stderr warn;'
-EOF
-
-RUN chmod +x /usr/local/bin/start-chat2api
-
-# ── 10. 暴露端口 ──────────────────────────────────────────────────────────────
-EXPOSE 7860
-
-# ── 访问说明 ─────────────────────────────────────────────────────────────────
-# Space 启动后访问方式：
-#   主界面 (Chat2API 管理面板)  : https://<your-space>.hf.space/
-#   API 接入端点               : https://<your-space>.hf.space/v1/
-#   VS Code IDE                : https://<your-space>.hf.space/ide/
-#
-# 必填 HF Space Secrets（变量）：
-#   HF_TOKEN            —— HuggingFace 访问令牌（用于 Dataset 读写，需有 write 权限）
-#   HF_DATASET          —— Dataset repo ID，格式：your-username/your-dataset-name
-#
-# 可选 Secrets（可在面板中配置，也可通过变量预注入）：
-#   CHAT2API_API_KEY    —— 为 Chat2API 设置访问密钥（留空则无需认证）
-#   CODE_SERVER_PASSWORD—— VS Code IDE 登录密码（默认：changeme123!）
-#   IDE_IDLE_MINUTES    —— IDE 闲置自动关闭时间（分钟），默认 30
-#   PROVIDER_1_TYPE     —— 第一个服务商类型，如 deepseek / kimi / qwen
-#   PROVIDER_1_TOKEN    —— 第一个服务商的认证 Token
-#   PROVIDER_2_TYPE / PROVIDER_2_TOKEN —— 第二个服务商（以此类推，最多 10 个）
-#   LB_STRATEGY         —— 负载均衡策略：round-robin / fill-first / failover
-#   FORCE_RESTORE       —— 设为 true 强制从 Dataset 覆盖恢复（Factory Reset 用）
-
-CMD ["/usr/local/bin/start-chat2api"]
+# ═══════════════════════════════════════════════════════════════════════════════
+# Chat2API — HuggingFace Space 版（单文件部署版）
+# 基于 Node.js，集成 Chat2API 项目 + code-server 按需启停 IDE
+# 持久化存储：HuggingFace Dataset（每小时自动备份，重启自动恢复）
+#
+# 修复说明：
+#   原版 Dockerfile 用 RUN cat <<'EOF'> 写脚本，内部嵌套 heredoc 时
+#   BuildKit 会提前截断，导致脚本为空文件，运行时报 exit 127。
+#   本版改用 RUN python3 -c "import base64; open(...).write(base64.b64decode(...))"
+#   将所有脚本以 base64 形式内嵌，彻底绕开 heredoc 嵌套问题。
+# ═══════════════════════════════════════════════════════════════════════════════
+
+FROM node:24-slim
+
+# ── 1. 基础系统依赖 + Electron/Chromium 运行库 + Xvfb ─────────────────────────
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git openssh-client build-essential python3 python3-pip \
+    g++ make ca-certificates curl wget nginx \
+    xvfb \
+    libgbm1 libglib2.0-0 libnss3 libatk1.0-0 libatk-bridge2.0-0 \
+    libcups2 libdrm2 libxkbcommon0 libxcomposite1 libxdamage1 \
+    libxfixes3 libxrandr2 libpangocairo-1.0-0 libcairo2 \
+    libasound2 libxtst6 libx11-xcb1 libxcb-dri3-0 \
+    fonts-liberation libappindicator3-1 xdg-utils \
+    && rm -rf /var/lib/apt/lists/*
+
+# ── 1.1. 安装 code-server ─────────────────────────────────────────────────────
+RUN curl -fsSL https://code-server.dev/install.sh | sh
+
+# ── 2. 安装 GitHub CLI ────────────────────────────────────────────────────────
+RUN mkdir -p -m 755 /etc/apt/keyrings \
+    && out=$(mktemp) && wget -nv -O$out https://cli.github.com/packages/githubcli-archive-keyring.gpg \
+    && cat $out | tee /etc/apt/keyrings/githubcli-archive-keyring.gpg > /dev/null \
+    && chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \
+    && mkdir -p -m 755 /etc/apt/sources.list.d \
+    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
+       | tee /etc/apt/sources.list.d/github-cli.list > /dev/null \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends gh \
+    && rm -rf /var/lib/apt/lists/* \
+    && gh --version
+
+# ── 3. 安装 HuggingFace Hub ───────────────────────────────────────────────────
+RUN pip3 install --no-cache-dir huggingface_hub --break-system-packages
+
+# ── 4. 环境与 Git 配置 ────────────────────────────────────────────────────────
+RUN update-ca-certificates && \
+    git config --global http.sslVerify false && \
+    git config --global url."https://github.com/".insteadOf ssh://git@github.com/
+
+# ── 5. 克隆并构建 Chat2API 项目 ───────────────────────────────────────────────
+WORKDIR /app/chat2api
+RUN git clone --depth=1 https://github.com/xiaoY233/Chat2API.git . && \
+    npm install && \
+    npm run build:linux 2>/dev/null || true
+
+# ── 6. 环境变量默认值 ─────────────────────────────────────────────────────────
+ENV PORT=7860 \
+    HOME=/root \
+    PYTHONUNBUFFERED=1 \
+    DISPLAY=:99
+
+# ── 7. 内嵌所有脚本（base64 编码，彻底规避 BuildKit heredoc 嵌套截断问题）──────
+#    每个 RUN 指令用 python3 一行完成：decode → 写文件 → 设权限
+#    原理：base64 字符串中不含任何 shell 特殊字符，不受 heredoc 影响。
+
+RUN python3 -c "import base64,os; d=base64.b64decode('aW1wb3J0IG9zLCBzeXMsIHRhcmZpbGUsIHNodXRpbApmcm9tIGh1Z2dpbmdmYWNlX2h1YiBpbXBvcnQgSGZBcGksIGhmX2h1Yl9kb3dubG9hZApmcm9tIGRhdGV0aW1lIGltcG9ydCBkYXRldGltZSwgdGltZWRlbHRhCgphcGkgPSBIZkFwaSgpCnJlcG9faWQgPSBvcy5nZXRlbnYoIkhGX0RBVEFTRVQiKQp0b2tlbiAgID0gb3MuZ2V0ZW52KCJIRl9UT0tFTiIpCgpEQVRBX0RJUiA9ICIvcm9vdC8uY2hhdDJhcGkiCgojIOKUgOKUgCDlt6Xlhbflh73mlbAg4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSACgpkZWYgX3BhcnNlX3NraXBfbGlzdChlbnZfdmFyKToKICAgIHJhdyA9IG9zLmdldGVudihlbnZfdmFyLCAiIikuc3RyaXAoKQogICAgaWYgbm90IHJhdzoKICAgICAgICByZXR1cm4gc2V0KCkKICAgIHJldHVybiB7cy5zdHJpcCgpLnN0cmlwKCIvIikgZm9yIHMgaW4gcmF3LnNwbGl0KCIsIikgaWYgcy5zdHJpcCgpfQoKZGVmIF9pc19za2lwcGVkKHJlbF9wYXRoLCBza2lwX3NldCk6CiAgICByZWwgPSByZWxfcGF0aC5zdHJpcCgiLyIpCiAgICBmb3Igc2tpcCBpbiBza2lwX3NldDoKICAgICAgICBpZiByZWwgPT0gc2tpcCBvciByZWwuc3RhcnRzd2l0aChza2lwICsgIi8iKToKICAgICAgICAgICAgcmV0dXJuIFRydWUKICAgIHJldHVybiBGYWxzZQoKZGVmIF93YWxrX2xvY2FsKGJhc2VfZGlyLCBza2lwX3NldD1Ob25lKToKICAgIHJlc3VsdHMgPSBbXQogICAgaWYgbm90IG9zLnBhdGguaXNkaXIoYmFzZV9kaXIpOgogICAgICAgIHJldHVybiByZXN1bHRzCiAgICBmb3IgZGlycGF0aCwgZGlybmFtZXMsIGZpbGVuYW1lcyBpbiBvcy53YWxrKGJhc2VfZGlyKToKICAgICAgICBmb3IgZm5hbWUgaW4gZmlsZW5hbWVzOgogICAgICAgICAgICBhYnNfcGF0aCA9IG9zLnBhdGguam9pbihkaXJwYXRoLCBmbmFtZSkKICAgICAgICAgICAgcmVsX3RvX2Jhc2UgPSBvcy5wYXRoLnJlbHBhdGgoYWJzX3BhdGgsIGJhc2VfZGlyKQogICAgICAgICAgICBpZiBza2lwX3NldCBpcyBub3QgTm9uZToKICAgICAgICAgICAgICAgIHJlbF90b19kYXRhID0gb3MucGF0aC5yZWxwYXRoKGFic19wYXRoLCBEQVRBX0RJUikKICAgICAgICAgICAgICAgIGlmIF9pc19za2lwcGVkKHJlbF90b19kYXRhLCBza2lwX3NldCk6CiAgICAgICAgICAgICAgICAgICAgY29udGludWUKICAgICAgICAgICAgcmVzdWx0cy5hcHBlbmQoKGFic19wYXRoLCByZWxfdG9fYmFzZSkpCiAgICByZXR1cm4gcmVzdWx0cwoKIyDilIDilIAgcmVzdG9yZSgpIOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgAoKZGVmIHJlc3RvcmUoKToKICAgIGlmIG5vdCByZXBvX2lkIG9yIG5vdCB0b2tlbjoKICAgICAgICBwcmludCgiU2tpcCBSZXN0b3JlOiBIRl9EQVRBU0VUIG9yIEhGX1RPS0VOIG5vdCBzZXQiKQogICAgICAgIHJldHVybgoKICAgIHJlc3RvcmVfc2tpcF9yYXcgPSBvcy5nZXRlbnYoIlJFU1RPUkVfU0tJUCIsICIiKS5zdHJpcCgpCiAgICBpZiByZXN0b3JlX3NraXBfcmF3ID09ICJhbGwiOgogICAgICAgIHByaW50KCJSZXN0b3JlIHNraXA6IFJFU1RPUkVfU0tJUD1hbGwsIHNraXBwaW5nIGFsbCByZXN0b3JlLiIpCiAgICAgICAgcmV0dXJuCgogICAgSU5JVF9GTEFHID0gImluaXRpYWxpemVkLmZsYWciCiAgICBmb3JjZV9yZXN0b3JlID0gb3MuZ2V0ZW52KCJGT1JDRV9SRVNUT1JFIiwgIiIpLnN0cmlwKCkubG93ZXIoKSBpbiAoInRydWUiLCAiMSIsICJ5ZXMiKQoKICAgIHRyeToKICAgICAgICBhbGxfZmlsZXMgPSBsaXN0KGFwaS5saXN0X3JlcG9fZmlsZXMocmVwb19pZD1yZXBvX2lkLCByZXBvX3R5cGU9ImRhdGFzZXQiLCB0b2tlbj10b2tlbikpCiAgICBleGNlcHQgRXhjZXB0aW9uIGFzIGU6CiAgICAgICAgcHJpbnQoZiJSZXN0b3JlIEVycm9yIChsaXN0X3JlcG9fZmlsZXMpOiB7ZX0iKQogICAgICAgIHJldHVybgoKICAgIGZsYWdfZXhpc3RzID0gSU5JVF9GTEFHIGluIGFsbF9maWxlcwoKICAgIGlmIG5vdCBmbGFnX2V4aXN0cyBhbmQgbm90IGZvcmNlX3Jlc3RvcmU6CiAgICAgICAgcHJpbnQoIlJlc3RvcmUgc2tpcDogaW5pdGlhbGl6ZWQuZmxhZyBub3QgZm91bmQsIGZpcnN0IGRlcGxveS4iKQogICAgICAgIGltcG9ydCBpbwogICAgICAgIGFwaS51cGxvYWRfZmlsZSgKICAgICAgICAgICAgcGF0aF9vcl9maWxlb2JqPWlvLkJ5dGVzSU8oYiJpbml0aWFsaXplZFxuIiksCiAgICAgICAgICAgIHBhdGhfaW5fcmVwbz1JTklUX0ZMQUcsCiAgICAgICAgICAgIHJlcG9faWQ9cmVwb19pZCwKICAgICAgICAgICAgcmVwb190eXBlPSJkYXRhc2V0IiwKICAgICAgICAgICAgdG9rZW49dG9rZW4sCiAgICAgICAgICAgIGNvbW1pdF9tZXNzYWdlPSJDcmVhdGUgaW5pdGlhbGl6ZWQuZmxhZyBvbiBmaXJzdCBkZXBsb3kiLAogICAgICAgICkKICAgICAgICBwcmludCgiaW5pdGlhbGl6ZWQuZmxhZyBjcmVhdGVkIGluIERhdGFzZXQuIikKICAgICAgICByZXR1cm4KCiAgICBpZiBmb3JjZV9yZXN0b3JlOgogICAgICAgIHByaW50KCJSZXN0b3JlOiBGT1JDRV9SRVNUT1JFPXRydWUsIGlnbm9yaW5nIGluaXRpYWxpemVkLmZsYWcuIikKICAgIGVsc2U6CiAgICAgICAgcHJpbnQoIlJlc3RvcmU6IGluaXRpYWxpemVkLmZsYWcgZm91bmQsIG5vcm1hbCByZXN0YXJ0LiIpCgogICAgc2tpcF9zZXQgPSBfcGFyc2Vfc2tpcF9saXN0KCJSRVNUT1JFX1NLSVAiKQoKICAgIHRyeToKICAgICAgICBub3cgPSBkYXRldGltZS5ub3coKQogICAgICAgIGZvciBpIGluIHJhbmdlKDUpOgogICAgICAgICAgICBkYXkgID0gKG5vdyAtIHRpbWVkZWx0YShkYXlzPWkpKS5zdHJmdGltZSgiJVktJW0tJWQiKQogICAgICAgICAgICBuYW1lID0gZiJiYWNrdXBfe2RheX0udGFyLmd6IgogICAgICAgICAgICBpZiBuYW1lIGluIGFsbF9maWxlczoKICAgICAgICAgICAgICAgIHByaW50KGYiRG93bmxvYWRpbmcge25hbWV9Li4uIikKICAgICAgICAgICAgICAgIHBhdGggPSBoZl9odWJfZG93bmxvYWQocmVwb19pZD1yZXBvX2lkLCBmaWxlbmFtZT1uYW1lLCByZXBvX3R5cGU9ImRhdGFzZXQiLCB0b2tlbj10b2tlbikKICAgICAgICAgICAgICAgIG9zLm1ha2VkaXJzKERBVEFfRElSLCBleGlzdF9vaz1UcnVlKQogICAgICAgICAgICAgICAgd2l0aCB0YXJmaWxlLm9wZW4ocGF0aCwgInI6Z3oiKSBhcyB0YXI6CiAgICAgICAgICAgICAgICAgICAgZm9yIG1lbWJlciBpbiB0YXIuZ2V0bWVtYmVycygpOgogICAgICAgICAgICAgICAgICAgICAgICBpZiBfaXNfc2tpcHBlZChtZW1iZXIubmFtZSwgc2tpcF9zZXQpOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgcHJpbnQoZiJSZXN0b3JlIHNraXA6IHttZW1iZXIubmFtZX0iKQogICAgICAgICAgICAgICAgICAgICAgICAgICAgY29udGludWUKICAgICAgICAgICAgICAgICAgICAgICAgdGFyLmV4dHJhY3QobWVtYmVyLCBwYXRoPURBVEFfRElSKQogICAgICAgICAgICAgICAgcHJpbnQoZiJSZXN0b3JlZCBmcm9tIHtuYW1lfSIpCiAgICAgICAgICAgICAgICBicmVhawoKICAgICAgICBpbXBvcnQgaW8KICAgICAgICBhcGkudXBsb2FkX2ZpbGUoCiAgICAgICAgICAgIHBhdGhfb3JfZmlsZW9iaj1pby5CeXRlc0lPKGIiaW5pdGlhbGl6ZWQgYXQgY29udGFpbmVyIHN0YXJ0dXBcbiIpLAogICAgICAgICAgICBwYXRoX2luX3JlcG89SU5JVF9GTEFHLAogICAgICAgICAgICByZXBvX2lkPXJlcG9faWQsCiAgICAgICAgICAgIHJlcG9fdHlwZT0iZGF0YXNldCIsCiAgICAgICAgICAgIHRva2VuPXRva2VuLAogICAgICAgICAgICBjb21taXRfbWVzc2FnZT0iU2V0IGluaXRpYWxpemVkLmZsYWciLAogICAgICAgICkKICAgICAgICBwcmludCgiaW5pdGlhbGl6ZWQuZmxhZyB1cGRhdGVkLiIpCiAgICBleGNlcHQgRXhjZXB0aW9uIGFzIGU6CiAgICAgICAgcHJpbnQoZiJSZXN0b3JlIEVycm9yOiB7ZX0iKQoKCiMg4pSA4pSAIGJhY2t1cCgpIOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgAoKZGVmIGJhY2t1cCgpOgogICAgaWYgbm90IHJlcG9faWQgb3Igbm90IHRva2VuOgogICAgICAgIHByaW50KCJTa2lwIEJhY2t1cDogSEZfREFUQVNFVCBvciBIRl9UT0tFTiBub3Qgc2V0IikKICAgICAgICByZXR1cm4KCiAgICBiYWNrdXBfdGFyX3NraXBfcmF3ID0gb3MuZ2V0ZW52KCJCQUNLVVBfVEFSX1NLSVAiLCAiIikuc3RyaXAoKQogICAgaWYgYmFja3VwX3Rhcl9za2lwX3JhdyA9PSAiYWxsIjoKICAgICAgICBwcmludCgiQmFja3VwIHNraXA6IEJBQ0tVUF9UQVJfU0tJUD1hbGwiKQogICAgICAgIHJldHVybgogICAgdHJ5OgogICAgICAgIHRhcl9za2lwX3NldCA9IF9wYXJzZV9za2lwX2xpc3QoIkJBQ0tVUF9UQVJfU0tJUCIpCiAgICAgICAgZGF5ICA9IGRhdGV0aW1lLm5vdygpLnN0cmZ0aW1lKCIlWS0lbS0lZCIpCiAgICAgICAgbmFtZSA9IGYiYmFja3VwX3tkYXl9LnRhci5neiIKICAgICAgICB3aXRoIHRhcmZpbGUub3BlbihuYW1lLCAidzpneiIpIGFzIHRhcjoKICAgICAgICAgICAgZm9yIGFic19wYXRoLCByZWxfdG9fYmFzZSBpbiBfd2Fsa19sb2NhbChEQVRBX0RJUiwgc2tpcF9zZXQ9dGFyX3NraXBfc2V0KToKICAgICAgICAgICAgICAgIHRhci5hZGQoYWJzX3BhdGgsIGFyY25hbWU9cmVsX3RvX2Jhc2UpCiAgICAgICAgYXBpLnVwbG9hZF9maWxlKHBhdGhfb3JfZmlsZW9iaj1uYW1lLCBwYXRoX2luX3JlcG89bmFtZSwgcmVwb19pZD1yZXBvX2lkLCByZXBvX3R5cGU9ImRhdGFzZXQiLCB0b2tlbj10b2tlbikKICAgICAgICBwcmludChmIkJhY2t1cCB7bmFtZX0gZG9uZS4iKQogICAgZXhjZXB0IEV4Y2VwdGlvbiBhcyBlOgogICAgICAgIHByaW50KGYiQmFja3VwIEVycm9yOiB7ZX0iKQoKCmlmIF9fbmFtZV9fID09ICJfX21haW5fXyI6CiAgICBpZiBsZW4oc3lzLmFyZ3YpID4gMSBhbmQgc3lzLmFyZ3ZbMV0gPT0gImJhY2t1cCI6CiAgICAgICAgYmFja3VwKCkKICAgIGVsc2U6CiAgICAgICAgcmVzdG9yZSgpCg=='); open('/usr/local/bin/sync.py','wb').write(d)"
+
+RUN python3 -c "import base64,os,stat; d=base64.b64decode('IyEvdXNyL2Jpbi9lbnYgcHl0aG9uMwoiIiIKY3MtbWFuYWdlcjogY29kZS1zZXJ2ZXIg5oyJ6ZyA5ZCv5YGc5a6I5oqk6L+b56iLCgrnm5HlkKwgVW5peCBzb2NrZXTvvIzmj5DkvpvkuKTkuKogSFRUUCDnq6/ngrnvvJoKICBHRVQgL3dha2V1cCAgICAtIOinpuWPkeWQr+WKqCBjb2RlLXNlcnZlcu+8iOiLpeacqui/kOihjO+8ie+8jOi/lOWbniLlkK/liqjkuK0i562J5b6F6aG1CiAgR0VUIC9oZWFydGJlYXQgLSDmm7TmlrDmnIDlkI7mtLvot4Pml7bpl7TvvIhuZ2lueCDmr4/mrKHmiJDlip/ku6PnkIYgL2lkZS8g5ZCO6LCD55So77yJCgrlkI7lj7Dlrprml7bku7vliqHvvJoKICDmr48gNjAg56eS5qOA5p+l5LiA5qyh77yM6Iul6LaF6L+HIElERV9JRExFX01JTlVURVMg5YiG6ZKf5pegIGhlYXJ0YmVhdO+8jGtpbGwgY29kZS1zZXJ2ZXIKIiIiCgppbXBvcnQgb3MsIHN5cywgdGltZSwgc2lnbmFsLCBzdWJwcm9jZXNzLCB0aHJlYWRpbmcsIHNvY2tldCwgcmUKZnJvbSBodHRwLnNlcnZlciBpbXBvcnQgSFRUUFNlcnZlciwgQmFzZUhUVFBSZXF1ZXN0SGFuZGxlcgoKIyDilIDilIAg6YWN572uIOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgApTT0NLX1BBVEggICAgICAgID0gIi90bXAvY3MtbWFuYWdlci5zb2NrIgpDU19QT1JUICAgICAgICAgID0gaW50KG9zLmVudmlyb24uZ2V0KCJDT0RFX1NFUlZFUl9QT1JUIiwgIjEzMzM3IikpCkNTX1BBU1NXT1JEICAgICAgPSBvcy5lbnZpcm9uLmdldCgiQ09ERV9TRVJWRVJfUEFTU1dPUkQiLCAiY2hhbmdlbWUxMjMhIikKSURMRV9NSU5VVEVTICAgICA9IGludChvcy5lbnZpcm9uLmdldCgiSURFX0lETEVfTUlOVVRFUyIsICIzMCIpKQpDSEVDS19JTlRFUlZBTCAgID0gNjAgICAjIOenkgoKIyDilIDilIAg5YWo5bGA54q25oCBIOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgApjc19wcm9jICAgICAgICAgID0gTm9uZQpsYXN0X2hlYXJ0YmVhdCAgID0gMC4wCmxvY2sgICAgICAgICAgICAgPSB0aHJlYWRpbmcuTG9jaygpCgojIOKUgOKUgCBjb2RlLXNlcnZlciDlkK/lgZwg4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSACgpkZWYgc3RhcnRfY3MoKToKICAgIGdsb2JhbCBjc19wcm9jLCBsYXN0X2hlYXJ0YmVhdAogICAgd2l0aCBsb2NrOgogICAgICAgIGlmIGNzX3Byb2MgaXMgbm90IE5vbmUgYW5kIGNzX3Byb2MucG9sbCgpIGlzIE5vbmU6CiAgICAgICAgICAgIHJldHVybiAgIyBhbHJlYWR5IHJ1bm5pbmcKICAgICAgICBwcmludChmIltjcy1tYW5hZ2VyXSBTdGFydGluZyBjb2RlLXNlcnZlciBvbiBwb3J0IHtDU19QT1JUfSIsIGZsdXNoPVRydWUpCiAgICAgICAgZW52ID0gb3MuZW52aXJvbi5jb3B5KCkKICAgICAgICBlbnZbIlBBU1NXT1JEIl0gPSBDU19QQVNTV09SRAogICAgICAgIGNzX3Byb2MgPSBzdWJwcm9jZXNzLlBvcGVuKAogICAgICAgICAgICBbImNvZGUtc2VydmVyIiwKICAgICAgICAgICAgICItLWJpbmQtYWRkciIsIGYiMTI3LjAuMC4xOntDU19QT1JUfSIsCiAgICAgICAgICAgICAiLS1hdXRoIiwgInBhc3N3b3JkIiwKICAgICAgICAgICAgICItLWRpc2FibGUtdGVsZW1ldHJ5IiwKICAgICAgICAgICAgICIvYXBwL2NoYXQyYXBpIl0sCiAgICAgICAgICAgIGVudj1lbnYsCiAgICAgICAgICAgIHN0ZG91dD1zdWJwcm9jZXNzLkRFVk5VTEwsCiAgICAgICAgICAgIHN0ZGVycj1zdWJwcm9jZXNzLkRFVk5VTEwsCiAgICAgICAgKQogICAgICAgIGxhc3RfaGVhcnRiZWF0ID0gdGltZS50aW1lKCkKICAgICAgICBwcmludChmIltjcy1tYW5hZ2VyXSBjb2RlLXNlcnZlciBwaWQ9e2NzX3Byb2MucGlkfSIsIGZsdXNoPVRydWUpCgpkZWYgc3RvcF9jcygpOgogICAgZ2xvYmFsIGNzX3Byb2MKICAgIHdpdGggbG9jazoKICAgICAgICBpZiBjc19wcm9jIGlzIE5vbmUgb3IgY3NfcHJvYy5wb2xsKCkgaXMgbm90IE5vbmU6CiAgICAgICAgICAgIHJldHVybgogICAgICAgIHByaW50KCJbY3MtbWFuYWdlcl0gU3RvcHBpbmcgaWRsZSBjb2RlLXNlcnZlciIsIGZsdXNoPVRydWUpCiAgICAgICAgY3NfcHJvYy50ZXJtaW5hdGUoKQogICAgICAgIHRyeToKICAgICAgICAgICAgY3NfcHJvYy53YWl0KHRpbWVvdXQ9MTApCiAgICAgICAgZXhjZXB0IHN1YnByb2Nlc3MuVGltZW91dEV4cGlyZWQ6CiAgICAgICAgICAgIGNzX3Byb2Mua2lsbCgpCiAgICAgICAgY3NfcHJvYyA9IE5vbmUKCmRlZiBpc19jc19ydW5uaW5nKCk6CiAgICB3aXRoIGxvY2s6CiAgICAgICAgcmV0dXJuIGNzX3Byb2MgaXMgbm90IE5vbmUgYW5kIGNzX3Byb2MucG9sbCgpIGlzIE5vbmUKCiMg4pSA4pSAIEhUVFAgaGFuZGxlciDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIAKCldBS0VVUF9IVE1MID0gIiIiXAo8IURPQ1RZUEUgaHRtbD48aHRtbD48aGVhZD4KPG1ldGEgY2hhcnNldD0idXRmLTgiPgo8bWV0YSBodHRwLWVxdWl2PSJyZWZyZXNoIiBjb250ZW50PSIzIj4KPHRpdGxlPklERSDlkK/liqjkuK3igKY8L3RpdGxlPgo8c3R5bGU+CmJvZHl7Zm9udC1mYW1pbHk6c2Fucy1zZXJpZjtkaXNwbGF5OmZsZXg7YWxpZ24taXRlbXM6Y2VudGVyO2p1c3RpZnktY29udGVudDpjZW50ZXI7CiAgICAgaGVpZ2h0OjEwMHZoO21hcmdpbjowO2JhY2tncm91bmQ6IzFlMWUyZTtjb2xvcjojY2RkNmY0fQouYm94e3RleHQtYWxpZ246Y2VudGVyfS5zcGlubmVye3dpZHRoOjQ4cHg7aGVpZ2h0OjQ4cHg7Ym9yZGVyOjVweCBzb2xpZCAjMzEzMjQ0OwogICAgIGJvcmRlci10b3AtY29sb3I6Izg5YjRmYTtib3JkZXItcmFkaXVzOjUwJTthbmltYXRpb246c3BpbiAxcyBsaW5lYXIgaW5maW5pdGU7CiAgICAgbWFyZ2luOjAgYXV0byAyMHB4fQpAa2V5ZnJhbWVzIHNwaW57dG97dHJhbnNmb3JtOnJvdGF0ZSgzNjBkZWcpfX0KPC9zdHlsZT48L2hlYWQ+PGJvZHk+CjxkaXYgY2xhc3M9ImJveCI+CiAgPGRpdiBjbGFzcz0ic3Bpbm5lciI+PC9kaXY+CiAgPGgyPlZTIENvZGUgSURFIOWQr+WKqOS4reKApjwvaDI+CiAgPHA+6aG16Z2i5bCG5ZyoIDMg56eS5ZCO6Ieq5Yqo5Yi35pawPC9wPgo8L2Rpdj48L2JvZHk+PC9odG1sPgoiIiIKCmNsYXNzIEhhbmRsZXIoQmFzZUhUVFBSZXF1ZXN0SGFuZGxlcik6CiAgICBkZWYgbG9nX21lc3NhZ2Uoc2VsZiwgZm10LCAqYXJncyk6CiAgICAgICAgcGFzcyAgIyDpnZnpu5jorr/pl67ml6Xlv5cKCiAgICBkZWYgZG9fR0VUKHNlbGYpOgogICAgICAgIGdsb2JhbCBsYXN0X2hlYXJ0YmVhdAogICAgICAgIHBhdGggPSBzZWxmLnBhdGguc3BsaXQoIj8iKVswXQoKICAgICAgICBpZiBwYXRoID09ICIvaGVhcnRiZWF0IjoKICAgICAgICAgICAgbGFzdF9oZWFydGJlYXQgPSB0aW1lLnRpbWUoKQogICAgICAgICAgICBzZWxmLl9yZXNwb25kKDIwMCwgInRleHQvcGxhaW4iLCBiIm9rIikKCiAgICAgICAgZWxpZiBwYXRoID09ICIvd2FrZXVwIjoKICAgICAgICAgICAgaWYgbm90IGlzX2NzX3J1bm5pbmcoKToKICAgICAgICAgICAgICAgIHN0YXJ0X2NzKCkKICAgICAgICAgICAgICAgICMg562J5b6FIGNvZGUtc2VydmVyIOWwsee7qu+8iOacgOWkmiAzMCDnp5LvvIkKICAgICAgICAgICAgICAgIGZvciBfIGluIHJhbmdlKDMwKToKICAgICAgICAgICAgICAgICAgICB0aW1lLnNsZWVwKDEpCiAgICAgICAgICAgICAgICAgICAgdHJ5OgogICAgICAgICAgICAgICAgICAgICAgICBpbXBvcnQgdXJsbGliLnJlcXVlc3QKICAgICAgICAgICAgICAgICAgICAgICAgdXJsbGliLnJlcXVlc3QudXJsb3BlbihmImh0dHA6Ly8xMjcuMC4wLjE6e0NTX1BPUlR9LyIsIHRpbWVvdXQ9MSkKICAgICAgICAgICAgICAgICAgICAgICAgYnJlYWsKICAgICAgICAgICAgICAgICAgICBleGNlcHQgRXhjZXB0aW9uOgogICAgICAgICAgICAgICAgICAgICAgICBwYXNzCiAgICAgICAgICAgIHNlbGYuX3Jlc3BvbmQoMjAwLCAidGV4dC9odG1sIiwgV0FLRVVQX0hUTUwuZW5jb2RlKCkpCgogICAgICAgIGVsc2U6CiAgICAgICAgICAgIHNlbGYuX3Jlc3BvbmQoNDA0LCAidGV4dC9wbGFpbiIsIGIibm90IGZvdW5kIikKCiAgICBkZWYgX3Jlc3BvbmQoc2VsZiwgY29kZSwgY3R5cGUsIGJvZHkpOgogICAgICAgIHNlbGYuc2VuZF9yZXNwb25zZShjb2RlKQogICAgICAgIHNlbGYuc2VuZF9oZWFkZXIoIkNvbnRlbnQtVHlwZSIsIGN0eXBlKQogICAgICAgIHNlbGYuc2VuZF9oZWFkZXIoIkNvbnRlbnQtTGVuZ3RoIiwgc3RyKGxlbihib2R5KSkpCiAgICAgICAgc2VsZi5lbmRfaGVhZGVycygpCiAgICAgICAgc2VsZi53ZmlsZS53cml0ZShib2R5KQoKIyDilIDilIAgVW5peCBzb2NrZXQgc2VydmVyIOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgAoKY2xhc3MgVW5peEhUVFBTZXJ2ZXIoSFRUUFNlcnZlcik6CiAgICBhZGRyZXNzX2ZhbWlseSA9IHNvY2tldC5BRl9VTklYCgogICAgZGVmIHNlcnZlcl9iaW5kKHNlbGYpOgogICAgICAgIGlmIG9zLnBhdGguZXhpc3RzKFNPQ0tfUEFUSCk6CiAgICAgICAgICAgIG9zLnJlbW92ZShTT0NLX1BBVEgpCiAgICAgICAgc3VwZXIoKS5zZXJ2ZXJfYmluZCgpCiAgICAgICAgb3MuY2htb2QoU09DS19QQVRILCAwbzY2NikKCiMg4pSA4pSAIOepuumXsuajgOafpeW+queOryDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIAKCmRlZiBpZGxlX3dhdGNoZXIoKToKICAgIHdoaWxlIFRydWU6CiAgICAgICAgdGltZS5zbGVlcChDSEVDS19JTlRFUlZBTCkKICAgICAgICBpZiBpc19jc19ydW5uaW5nKCk6CiAgICAgICAgICAgIGlkbGVfc2VjcyA9IHRpbWUudGltZSgpIC0gbGFzdF9oZWFydGJlYXQKICAgICAgICAgICAgaWYgaWRsZV9zZWNzID4gSURMRV9NSU5VVEVTICogNjA6CiAgICAgICAgICAgICAgICBwcmludChmIltjcy1tYW5hZ2VyXSBJZGxlIHtpZGxlX3NlY3MvNjA6LjFmfSBtaW4gPiB7SURMRV9NSU5VVEVTfSBtaW4sIHN0b3BwaW5nLiIsIGZsdXNoPVRydWUpCiAgICAgICAgICAgICAgICBzdG9wX2NzKCkKCiMg4pSA4pSAIOS4u+WFpeWPoyDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIAKCmlmIF9fbmFtZV9fID09ICJfX21haW5fXyI6CiAgICB3YXRjaGVyID0gdGhyZWFkaW5nLlRocmVhZCh0YXJnZXQ9aWRsZV93YXRjaGVyLCBkYWVtb249VHJ1ZSkKICAgIHdhdGNoZXIuc3RhcnQoKQoKICAgIHNlcnZlciA9IFVuaXhIVFRQU2VydmVyKFNPQ0tfUEFUSCwgSGFuZGxlcikKICAgIHByaW50KGYiW2NzLW1hbmFnZXJdIExpc3RlbmluZyBvbiB7U09DS19QQVRIfSIsIGZsdXNoPVRydWUpCiAgICB0cnk6CiAgICAgICAgc2VydmVyLnNlcnZlX2ZvcmV2ZXIoKQogICAgZXhjZXB0IEtleWJvYXJkSW50ZXJydXB0OgogICAgICAgIHBhc3MK'); p='/usr/local/bin/cs-manager'; open(p,'wb').write(d); os.chmod(p, os.stat(p).st_mode | stat.S_IEXEC | stat.S_IXGRP | stat.S_IXOTH)"
+
+RUN python3 -c "import base64,os,stat; d=base64.b64decode('IyEvYmluL2Jhc2gKc2V0IC1lCgojIOKUgOKUgCDnjq/looPlj5jph48g4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSACkxJU1RFTl9QT1JUPSIke1BPUlQ6LTc4NjB9IgpDSEFUMkFQSV9QT1JUPTc4NjIKQ09ERV9TRVJWRVJfUE9SVD0iJHtDT0RFX1NFUlZFUl9QT1JUOi0xMzMzN30iCklERV9JRExFX01JTlVURVM9IiR7SURFX0lETEVfTUlOVVRFUzotMzB9IgoKZXhwb3J0IENPREVfU0VSVkVSX1BPUlQgSURFX0lETEVfTUlOVVRFUwpleHBvcnQgQ09ERV9TRVJWRVJfUEFTU1dPUkQ9IiR7Q09ERV9TRVJWRVJfUEFTU1dPUkQ6LWNoYW5nZW1lMTIzIX0iCmV4cG9ydCBDSEFUMkFQSV9EQVRBX0RJUj0iL3Jvb3QvLmNoYXQyYXBpIgoKZWNobyAiPT09IENoYXQyQVBJIEh1Z2dpbmdGYWNlIFNwYWNlIOWQr+WKqCA9PT0iCmVjaG8gIuWklumDqOebkeWQrOerr+WPoyAgICA6ICR7TElTVEVOX1BPUlR9IgplY2hvICJDaGF0MkFQSeWGhemDqOerr+WPozogJHtDSEFUMkFQSV9QT1JUfSIKZWNobyAiSURF5YaF6YOo56uv5Y+jICAgICA6ICR7Q09ERV9TRVJWRVJfUE9SVH0iCmVjaG8gIklERemXsue9ruiHquWKqOWFs+mXrSA6ICR7SURFX0lETEVfTUlOVVRFU30gbWluIgoKIyDilIDilIAg5q2l6aqkIDHvvJrku44gSEYgRGF0YXNldCDmgaLlpI3mjIHkuYXljJbmlbDmja4g4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSACmVjaG8gIi0tLSDmgaLlpI3mjIHkuYXljJbphY3nva7mlbDmja4gLS0tIgpweXRob24zIC91c3IvbG9jYWwvYmluL3N5bmMucHkgcmVzdG9yZSB8fCB0cnVlCgojIOKUgOKUgCDmraXpqqQgMu+8muWHhuWkhyBDaGF0MkFQSSDmlbDmja7nm67lvZUg4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSACm1rZGlyIC1wICIke0NIQVQyQVBJX0RBVEFfRElSfS9sb2dzIiAiJHtDSEFUMkFQSV9EQVRBX0RJUn0vc2Vzc2lvbnMiCgojIOiLpeaVsOaNruebruW9leS4jeWtmOWcqOmFjee9ru+8jOS7jiBIRiBTcGFjZSDlj5jph4/nlJ/miJDliJ3lp4vphY3nva4KQ09ORklHX0ZJTEU9IiR7Q0hBVDJBUElfREFUQV9ESVJ9L2NvbmZpZy5qc29uIgppZiBbICEgLWYgIiRDT05GSUdfRklMRSIgXTsgdGhlbgogICAgZWNobyAi55Sf5oiQ5Yid5aeLIGNvbmZpZy5qc29uLi4uIgogICAgcHl0aG9uMyAvdXNyL2xvY2FsL2Jpbi9pbml0LWNvbmZpZy5weQpmaQoKIyDoi6XmlbDmja7nm67lvZXkuI3lrZjlnKjotKbmiLfliJfooajvvIzku44gSEYgU3BhY2Ug5Y+Y6YeP5rOo5YWl5Yid5aeL6LSm5oi3CkFDQ09VTlRTX0ZJTEU9IiR7Q0hBVDJBUElfREFUQV9ESVJ9L2FjY291bnRzLmpzb24iCmlmIFsgISAtZiAiJEFDQ09VTlRTX0ZJTEUiIF07IHRoZW4KICAgIGVjaG8gIueUn+aIkOWIneWniyBhY2NvdW50cy5qc29uLi4uIgogICAgcHl0aG9uMyAvdXNyL2xvY2FsL2Jpbi9pbml0LWFjY291bnRzLnB5CmZpCgojIOKUgOKUgCDmraXpqqQgM++8muWQr+WKqOiZmuaLn+aYvuekuu+8iEVsZWN0cm9uIOmcgOimgSBYIGRpc3BsYXnvvInilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIAKZWNobyAiLS0tIOWQr+WKqCBYdmZiIOiZmuaLn+aYvuekuiAtLS0iClh2ZmIgOjk5IC1zY3JlZW4gMCAxMjgweDgwMHgyNCAtYWMgK2V4dGVuc2lvbiBHTFggK3JlbmRlciAtbm9yZXNldCAmClhWRkJfUElEPSQhCmV4cG9ydCBESVNQTEFZPTo5OQplY2hvICLnrYnlvoUgWHZmYiDlsLHnu6ouLi4iCnNsZWVwIDIKCiMg4pSA4pSAIOatpemqpCA077ya5ZCv5YqoIENoYXQyQVBJ77yIRWxlY3Ryb24gQXBwSW1hZ2XvvIzlkI7lj7Dov5DooYzvvInilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIAKZWNobyAiLS0tIOWQr+WKqCBDaGF0MkFQSSDmnI3liqEgKOWGhemDqOerr+WPoyAke0NIQVQyQVBJX1BPUlR9KSAtLS0iCmNkIC9hcHAvY2hhdDJhcGkKCiMg5p+l5om+5p6E5bu65Lqn54mp77ya5LyY5YWI55SoIEFwcEltYWdl77yM5YW25qyh55SoIHVucGFja2VkIOebruW9leWGheeahCBlbGVjdHJvbiDlj6/miafooYzmlofku7YKQVBQSU1BR0U9JChmaW5kIGRpc3QgLW5hbWUgIiouQXBwSW1hZ2UiIC1tYXhkZXB0aCAxIDI+L2Rldi9udWxsIHwgaGVhZCAtMSkKCmlmIFsgLW4gIiRBUFBJTUFHRSIgXTsgdGhlbgogICAgZWNobyAi5L2/55SoIEFwcEltYWdlOiAkQVBQSU1BR0UiCiAgICBDSEFUMkFQSV9QT1JUPSIke0NIQVQyQVBJX1BPUlR9IiBcCiAgICBDSEFUMkFQSV9EQVRBPSIke0NIQVQyQVBJX0RBVEFfRElSfSIgXAogICAgIiRBUFBJTUFHRSIgLS1uby1zYW5kYm94IC0tZGlzYWJsZS1ncHUgMj4mMSBcCiAgICAgICAgfCB0ZWUgIiR7Q0hBVDJBUElfREFUQV9ESVJ9L2xvZ3MvY2hhdDJhcGkubG9nIiAmCmVsc2UKICAgICMg5Zue6YCA77ya5L2/55SoIGVsZWN0cm9uLXZpdGUgZGV2IOaooeW8j++8iOS7jemcgCBESVNQTEFZ77yJCiAgICBlY2hvICJBcHBJbWFnZSDmnKrmib7liLDvvIzlm57pgIDliLAgZWxlY3Ryb24tdml0ZSBkZXYg5qih5byPIgogICAgQ0hBVDJBUElfUE9SVD0iJHtDSEFUMkFQSV9QT1JUfSIgXAogICAgQ0hBVDJBUElfREFUQT0iJHtDSEFUMkFQSV9EQVRBX0RJUn0iIFwKICAgIG5weCBlbGVjdHJvbiAuIC0tbm8tc2FuZGJveCAtLWRpc2FibGUtZ3B1IDI+JjEgXAogICAgICAgIHwgdGVlICIke0NIQVQyQVBJX0RBVEFfRElSfS9sb2dzL2NoYXQyYXBpLmxvZyIgJgpmaQplY2hvICJDaGF0MkFQSSDlt7LlnKjlkI7lj7DlkK/liqgiCgojIOKUgOKUgCDmraXpqqQgNe+8muWQr+WKqCBjcy1tYW5hZ2VyIOWuiOaKpOi/m+eoi++8iOWQjuWPsO+8ieKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgOKUgAplY2hvICItLS0g5ZCv5YqoIElERSDmjInpnIDnrqHnkIblmaggLS0tIgpweXRob24zIC91c3IvbG9jYWwvYmluL2NzLW1hbmFnZXIgMj4mMSB8IHRlZSAiJHtDSEFUMkFQSV9EQVRBX0RJUn0vbG9ncy9jcy1tYW5hZ2VyLmxvZyIgJgoKIyDnrYnlvoUgY3MtbWFuYWdlciBzb2NrZXQg5bCx57uq77yI5pyA5aSaIDEwIOenku+8iQpmb3IgaSBpbiAkKHNlcSAxIDIwKTsgZG8KICBpZiBbIC1TIC90bXAvY3MtbWFuYWdlci5zb2NrIF07IHRoZW4KICAgIGVjaG8gImNzLW1hbmFnZXIgc29ja2V0IOWwsee7qiIKICAgIGJyZWFrCiAgZmkKICBzbGVlcCAwLjUKZG9uZQoKIyDilIDilIAg5q2l6aqkIDbvvJrnrYnlvoUgQ2hhdDJBUEkg5pyN5Yqh5bCx57uq77yI5pyA5aSaIDEyMCDnp5LvvInilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIAKZWNobyAi562J5b6FIENoYXQyQVBJIOacjeWKoeWQr+WKqC4uLiIKZm9yIGkgaW4gJChzZXEgMSA2MCk7IGRvCiAgaWYgY3VybCAtZnNTICJodHRwOi8vMTI3LjAuMC4xOiR7Q0hBVDJBUElfUE9SVH0vIiA+L2Rldi9udWxsIDI+JjE7IHRoZW4KICAgIGVjaG8gIkNoYXQyQVBJIOacjeWKoeW3suWwsee7qu+8iCR7aX0qMnPvvIkiCiAgICBicmVhawogIGZpCiAgc2xlZXAgMgpkb25lCgojIOKUgOKUgCDmraXpqqQgN++8muWQr+WKqOWumuaXtuWkh+S7veW+queOr++8iOavjyA2MCDliIbpkp/vvInilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIDilIAKKHdoaWxlIHRydWU7IGRvIHNsZWVwIDM2MDA7IHB5dGhvbjMgL3Vzci9sb2NhbC9iaW4vc3luYy5weSBiYWNrdXAgfHwgdHJ1ZTsgZG9uZSkgJgplY2hvICLmjIHkuYXljJblpIfku73lvqrnjq/lt7LlkK/liqjvvIjmr4/lsI/ml7blpIfku73kuIDmrKHvvIkiCgojIOKUgOKUgCDmraXpqqQgOO+8mueUn+aIkCBuZ2lueCDphY3nva7lubblkK/liqgg4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSA4pSACnJtIC1mIC9ldGMvbmdpbngvc2l0ZXMtZW5hYmxlZC9kZWZhdWx0IC9ldGMvbmdpbngvY29uZi5kL2RlZmF1bHQuY29uZgoKTkdJTlhfQ09ORj0iL2V0Yy9uZ2lueC9jb25mLmQvY2hhdDJhcGkuY29uZiIKCnB5dGhvbjMgLSA8PFBZRU9GCmltcG9ydCBvcwpsaXN0ZW4gICA9IG9zLmVudmlyb24uZ2V0KCJQT1JUIiwgIjc4NjAiKQpjc19wb3J0ICA9IG9zLmVudmlyb24uZ2V0KCJDT0RFX1NFUlZFUl9QT1JUIiwgIjEzMzM3IikKYXBpX3BvcnQgPSAiNzg2MiIKCmNvbmYgPSBmIiIiCnVwc3RyZWFtIGNzX21hbmFnZXIge3sKICAgIHNlcnZlciB1bml4Oi90bXAvY3MtbWFuYWdlci5zb2NrOwp9fQoKc2VydmVyIHt7CiAgICBsaXN0ZW4ge2xpc3Rlbn07CiAgICBzZXJ2ZXJfbmFtZSBfOwogICAgY2xpZW50X21heF9ib2R5X3NpemUgMTAwTTsKCiAgICBhY2Nlc3NfbG9nIC9kZXYvc3Rkb3V0OwogICAgZXJyb3JfbG9nICAvZGV2L3N0ZGVyciB3YXJuOwoKICAgIGFic29sdXRlX3JlZGlyZWN0IG9mZjsKICAgIHBvcnRfaW5fcmVkaXJlY3Qgb2ZmOwoKICAgIGxvY2F0aW9uIC9pZGUvIHt7CiAgICAgICAgcHJveHlfcGFzcyBodHRwOi8vMTI3LjAuMC4xOntjc19wb3J0fS87CiAgICAgICAgcHJveHlfaHR0cF92ZXJzaW9uIDEuMTsKICAgICAgICBwcm94eV9zZXRfaGVhZGVyIEhvc3QgXCRob3N0OwogICAgICAgIHByb3h5X3NldF9oZWFkZXIgVXBncmFkZSBcJGh0dHBfdXBncmFkZTsKICAgICAgICBwcm94eV9zZXRfaGVhZGVyIENvbm5lY3Rpb24gInVwZ3JhZGUiOwogICAgICAgIHByb3h5X3NldF9oZWFkZXIgWC1Gb3J3YXJkZWQtRm9yIFwkcHJveHlfYWRkX3hfZm9yd2FyZGVkX2ZvcjsKICAgICAgICBwcm94eV9zZXRfaGVhZGVyIFgtRm9yd2FyZGVkLVByb3RvIFwkc2NoZW1lOwogICAgICAgIHByb3h5X3JlZGlyZWN0IC8gL2lkZS87CiAgICAgICAgcHJveHlfcmVhZF90aW1lb3V0IDg2NDAwOwogICAgICAgIHByb3h5X2Nvbm5lY3RfdGltZW91dCAyczsKICAgICAgICBlcnJvcl9wYWdlIDUwMiA1MDQgQGlkZV93YWtldXA7CiAgICAgICAgcG9zdF9hY3Rpb24gL2lkZS1oZWFydGJlYXQvOwogICAgfX0KCiAgICBsb2NhdGlvbiAvaWRlLWhlYXJ0YmVhdC8ge3sKICAgICAgICBpbnRlcm5hbDsKICAgICAgICByZXdyaXRlIF4gL2hlYXJ0YmVhdCBicmVhazsKICAgICAgICBwcm94eV9wYXNzIGh0dHA6Ly9jc19tYW5hZ2VyOwogICAgICAgIHByb3h5X2Nvbm5lY3RfdGltZW91dCAxczsKICAgICAgICBwcm94eV9yZWFkX3RpbWVvdXQgMnM7CiAgICB9fQoKICAgIGxvY2F0aW9uIEBpZGVfd2FrZXVwIHt7CiAgICAgICAgcmV3cml0ZSBeIC93YWtldXAgYnJlYWs7CiAgICAgICAgcHJveHlfcGFzcyBodHRwOi8vY3NfbWFuYWdlcjsKICAgICAgICBwcm94eV9odHRwX3ZlcnNpb24gMS4xOwogICAgICAgIHByb3h5X3NldF9oZWFkZXIgSG9zdCBcJGhvc3Q7CiAgICAgICAgcHJveHlfY29ubmVjdF90aW1lb3V0IDVzOwogICAgICAgIHByb3h5X3JlYWRfdGltZW91dCAzMHM7CiAgICB9fQoKICAgIGxvY2F0aW9uIC8ge3sKICAgICAgICBwcm94eV9wYXNzIGh0dHA6Ly8xMjcuMC4wLjE6e2FwaV9wb3J0fS87CiAgICAgICAgcHJveHlfaHR0cF92ZXJzaW9uIDEuMTsKICAgICAgICBwcm94eV9zZXRfaGVhZGVyIEhvc3QgXCRob3N0OwogICAgICAgIHByb3h5X3NldF9oZWFkZXIgVXBncmFkZSBcJGh0dHBfdXBncmFkZTsKICAgICAgICBwcm94eV9zZXRfaGVhZGVyIENvbm5lY3Rpb24gInVwZ3JhZGUiOwogICAgICAgIHByb3h5X3NldF9oZWFkZXIgWC1Gb3J3YXJkZWQtRm9yIFwkcHJveHlfYWRkX3hfZm9yd2FyZGVkX2ZvcjsKICAgICAgICBwcm94eV9zZXRfaGVhZGVyIFgtRm9yd2FyZGVkLVByb3RvIFwkc2NoZW1lOwogICAgICAgIHByb3h5X3JlYWRfdGltZW91dCA4NjQwMDsKICAgIH19Cn19CiIiIgoKd2l0aCBvcGVuKCIvZXRjL25naW54L2NvbmYuZC9jaGF0MmFwaS5jb25mIiwgInciKSBhcyBmOgogICAgZi53cml0ZShjb25mKQpwcmludCgibmdpbnggY29uZmlnIHdyaXR0ZW4uIikKUFlFT0YKCmVjaG8gIm5naW54IOmFjee9ruW3sueUn+aIkCIKbmdpbnggLXQKZWNobyAi5ZCv5YqoIG5naW5477yI5YmN5Y+w6L+Q6KGM77yM5L+d5oyB5a655Zmo5a2Y5rS777yJLi4uIgpleGVjIG5naW54IC1nICdkYWVtb24gb2ZmOyBlcnJvcl9sb2cgL2Rldi9zdGRlcnIgd2FybjsnCg=='); p='/usr/local/bin/start-chat2api'; open(p,'wb').write(d); os.chmod(p, os.stat(p).st_mode | stat.S_IEXEC | stat.S_IXGRP | stat.S_IXOTH)"
+
+RUN python3 -c "import base64,os; d=base64.b64decode('aW1wb3J0IG9zLCBqc29uCgpjb25maWcgPSB7CiAgICAicG9ydCI6IGludChvcy5nZXRlbnYoIkNIQVQyQVBJX1BPUlQiLCAiNzg2MiIpKSwKICAgICJhcGlLZXkiOiBvcy5nZXRlbnYoIkNIQVQyQVBJX0FQSV9LRVkiLCAiIiksCiAgICAibG9hZEJhbGFuY2UiOiB7CiAgICAgICAgInN0cmF0ZWd5Ijogb3MuZ2V0ZW52KCJMQl9TVFJBVEVHWSIsICJyb3VuZC1yb2JpbiIpCiAgICB9Cn0KZGF0YV9kaXIgPSBvcy5nZXRlbnYoIkNIQVQyQVBJX0RBVEFfRElSIiwgIi9yb290Ly5jaGF0MmFwaSIpCm9zLm1ha2VkaXJzKGRhdGFfZGlyLCBleGlzdF9vaz1UcnVlKQp3aXRoIG9wZW4ob3MucGF0aC5qb2luKGRhdGFfZGlyLCAiY29uZmlnLmpzb24iKSwgInciKSBhcyBmOgogICAganNvbi5kdW1wKGNvbmZpZywgZiwgaW5kZW50PTIpCnByaW50KCJjb25maWcuanNvbiBpbml0aWFsaXplZC4iKQo='); open('/usr/local/bin/init-config.py','wb').write(d)"
+
+RUN python3 -c "import base64,os; d=base64.b64decode('aW1wb3J0IG9zLCBqc29uCgphY2NvdW50cyA9IFtdCmZvciBpIGluIHJhbmdlKDEsIDExKToKICAgIHB0eXBlID0gb3MuZ2V0ZW52KGYiUFJPVklERVJfe2l9X1RZUEUiLCAiIikuc3RyaXAoKQogICAgdG9rZW4gPSBvcy5nZXRlbnYoZiJQUk9WSURFUl97aX1fVE9LRU4iLCAiIikuc3RyaXAoKQogICAgaWYgcHR5cGUgYW5kIHRva2VuOgogICAgICAgIGFjY291bnRzLmFwcGVuZCh7InByb3ZpZGVyIjogcHR5cGUsICJ0b2tlbiI6IHRva2VuLCAiZW5hYmxlZCI6IFRydWV9KQoKZGF0YV9kaXIgPSBvcy5nZXRlbnYoIkNIQVQyQVBJX0RBVEFfRElSIiwgIi9yb290Ly5jaGF0MmFwaSIpCm9zLm1ha2VkaXJzKGRhdGFfZGlyLCBleGlzdF9vaz1UcnVlKQp3aXRoIG9wZW4ob3MucGF0aC5qb2luKGRhdGFfZGlyLCAiYWNjb3VudHMuanNvbiIpLCAidyIpIGFzIGY6CiAgICBqc29uLmR1bXAoYWNjb3VudHMsIGYsIGluZGVudD0yKQpwcmludChmImFjY291bnRzLmpzb24gaW5pdGlhbGl6ZWQgd2l0aCB7bGVuKGFjY291bnRzKX0gYWNjb3VudChzKS4iKQo='); open('/usr/local/bin/init-accounts.py','wb').write(d)"
+
+# ── 8. 验证脚本写入完整（构建时校验，有问题立即报错）────────────────────────────
+RUN python3 -c "
+import os, stat
+scripts = {
+    '/usr/local/bin/sync.py':           False,
+    '/usr/local/bin/cs-manager':        True,
+    '/usr/local/bin/start-chat2api':    True,
+    '/usr/local/bin/init-config.py':    False,
+    '/usr/local/bin/init-accounts.py':  False,
+}
+for path, need_exec in scripts.items():
+    assert os.path.exists(path), f'MISSING: {path}'
+    size = os.path.getsize(path)
+    assert size > 100, f'TOO SMALL ({size}B): {path}'
+    if need_exec:
+        mode = os.stat(path).st_mode
+        assert mode & stat.S_IEXEC, f'NOT EXECUTABLE: {path}'
+    print(f'OK {size:6d}B  {path}')
+print('All scripts verified.')
+"
+
+# ── 9. 暴露端口 ──────────────────────────────────────────────────────────────
+EXPOSE 7860
+
+# ── 访问说明 ─────────────────────────────────────────────────────────────────
+# Space 启动后访问方式：
+#   主界面 (Chat2API 管理面板)  : https://<your-space>.hf.space/
+#   API 接入端点               : https://<your-space>.hf.space/v1/
+#   VS Code IDE                : https://<your-space>.hf.space/ide/
+#
+# 必填 HF Space Secrets：
+#   HF_TOKEN      —— HuggingFace 访问令牌（write 权限）
+#   HF_DATASET    —— Dataset repo ID，格式：username/dataset-name
+#
+# 可选 Secrets：
+#   CHAT2API_API_KEY      —— Chat2API 访问密钥（留空则无需认证）
+#   CODE_SERVER_PASSWORD  —— VS Code IDE 登录密码（默认：changeme123!）
+#   IDE_IDLE_MINUTES      —— IDE 闲置自动关闭分钟数（默认：30）
+#   PROVIDER_1_TYPE / PROVIDER_1_TOKEN  —— 预注入服务商（最多 10 个）
+#   LB_STRATEGY           —— 负载均衡策略：round-robin / fill-first / failover
+#   FORCE_RESTORE         —— 设为 true 强制从 Dataset 覆盖恢复
+
+CMD ["/usr/local/bin/start-chat2api"]