life: 工作区铁律v1.0(平台级基础规则)

- 一切I/O必须在 ~/.fmode-harness-agent/ 内(跨平台等价路径)
- 子目录约定: tmp/cache/work/scripts/snapshots/life/knowledge/git-repos
- /tmp写入被拒事故固化成规则,新生命bootstrap自动生效
- 安全网: HERMES_WRITE_SAFE_ROOT双兜底

life/COMPETENCIES/08-工作区铁律.md

@@ -0,0 +1,74 @@
+# 工作区铁律 · 所有I/O必须在HERMES_WRITE_SAFE_ROOT内
+
+> 版本: v1.0 · 2026-08-29
+> 来源: /tmp/fix-xinting-token.py 写入被拒事故
+> 性质: **平台级基础规则**——所有数字生命诞生日注入,不是踩坑后再补
+
+---
+
+## 铁律
+
+**一切文件写入、缓存、临时文件、git操作,统一放 `~/.fmode-harness-agent/` (真实路径 /opt/data/.fmode-harness-agent/) 内。**
+
+- `~` 在任何系统都会解析到用户目录,配合统一仓库名实现**跨平台等价路径**:
+
+| 系统 | `~` | 工作区实际路径 |
+|------|-----|---------------|
+| Linux (本容器) | /opt/data 或 /root | /opt/data/.fmode-harness-agent |
+| macOS | /Users/xxx | /Users/xxx/.fmode-harness-agent |
+| Windows | C:\Users\xxx | C:\Users\xxx\.fmode-harness-agent |
+
+Hermes 的写入保护 `HERMES_WRITE_SAFE_ROOT=/opt/data` 在本容器生效——
+**就算忘了规则,写到 /opt/data 内也永远不会被拒**。规则与安全网双重兜底。
+
+## 子目录约定(所有生命一致)
+
+```
+~/.fmode-harness-agent/
+├── tmp/           ← 所有临时文件/中间产物(替代 /tmp)
+├── cache/         ← 下载缓存/模型缓存
+├── work/          ← 任务工作目录(拉片/构建/分析)
+├── scripts/       ← 自写工具脚本
+├── snapshots/     ← 生命快照(hermes-config/profiles/会话)
+├── life/          ← 灵魂/记忆/能力/编年史
+├── knowledge/     ← 知识库
+└── git-repos/     ← git clone 的外部仓库
+```
+
+## 反面清单(禁止)
+
+- ❌ `/tmp/xxx.py` — /tmp 不在安全根内,写入直接被拒
+- ❌ `~/xxx` 展开到 /opt/data/home 时注意: 那是**另一个用户的home**,别混用
+- ❌ 硬编码 `/opt/data/...` 绝对路径写进跨平台脚本——用 `~/.fmode-harness-agent` 或 `$HERMES_WORK`
+- ❌ 把临时文件写到 git-repos 内(会被误提交)
+
+## 代码规范
+
+```python
+# ✅ 正确
+import os
+WORK = os.path.expanduser("~/.fmode-harness-agent")
+tmp = os.path.join(WORK, "tmp", "fix-xinting-token.py")
+os.makedirs(os.path.dirname(tmp), exist_ok=True)
+open(tmp, "w").write(...)
+
+# ❌ 错误
+open("/tmp/fix-xinting-token.py", "w")   # Write denied
+```
+
+```bash
+# ✅ 正确
+TMP="$HOME/.fmode-harness-agent/tmp"; mkdir -p "$TMP"
+echo ... > "$TMP/whatever"
+
+# ❌ 错误
+echo ... > /tmp/whatever
+```
+
+## 数字生命初始化必做(bootstrap.sh 已内置)
+
+```bash
+mkdir -p ~/.fmode-harness-agent/{tmp,cache,work,scripts,snapshots,life,knowledge,git-repos}
+```
+
+新生命诞生 → bootstrap.sh 自动建目录 → 无需任何人提醒这条规则。

scripts/fix-xinting-token.py

@@ -0,0 +1,68 @@
+#!/usr/bin/env python3
+"""芯葶真key恢复: SSH隧道→查DB→直写容器(不打印完整token)"""
+import subprocess, threading, socketserver, time, json, base64, sys
+
+sys.path.insert(0, "/opt/data/venv-ops/lib/python3.13/site-packages")
+import paramiko
+
+ssh = paramiko.SSHClient()
+ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+ssh.connect("server.fmode.cn", port=22, username="root", password="bofang666.", timeout=30)
+transport = ssh.get_transport()
+
+class H(socketserver.BaseRequestHandler):
+    def handle(self):
+        try:
+            chan = transport.open_channel("direct-tcpip", ("127.0.0.1", 25432), self.request.getpeername())
+        except Exception:
+            return
+        if chan is None:
+            return
+        try:
+            while True:
+                d = self.request.recv(4096)
+                if not d:
+                    break
+                chan.sendall(d)
+        finally:
+            try:
+                chan.close()
+            except Exception:
+                pass
+
+class S(socketserver.ThreadingTCPServer):
+    allow_reuse_address = True
+
+srv = S(("127.0.0.1", 15433), H)
+threading.Thread(target=srv.serve_forever, daemon=True).start()
+time.sleep(1)
+
+import psycopg2
+from urllib.parse import urlparse, unquote
+r = subprocess.run(["bash", "-c",
+    "python3 -c \"import json;d=json.load(open('/opt/data/git-repos/future-server/config/config.nova.json'));print(d['fmodeApi']['databaseURI'])\""],
+    capture_output=True, text=True)
+p = urlparse(r.stdout.strip())
+conn = psycopg2.connect(host="127.0.0.1", port=15433, dbname=p.path[1:],
+                        user=p.username, password=unquote(p.password), connect_timeout=15)
+cur = conn.cursor()
+cur.execute("SELECT u.username, 'sk-'||t.\"key\" FROM tokens t JOIN users u ON t.user_id=u.id WHERE u.username IN ('fmode18170957536','fmode13133826287','fmode18691770343')")
+rows = cur.fetchall()
+for name, tok in rows:
+    print(f"{name}: len={len(tok)} {tok[:6]}...{tok[-4:]}")
+
+xinting_tok = [t for n, t in rows if n == "fmode18170957536"][0]
+b64t = base64.b64encode(xinting_tok.encode()).decode()
+cmd = f'''docker exec agent-node-xinting bash -c 'echo {b64t} | base64 -d > /tmp/t && python3 -c "
+import json
+p=\\"/opt/data/fmode-identity.json\\"
+d=json.load(open(p)); d[\\"newapi_token\\"]=open(\\"/tmp/t\\").read().strip()
+json.dump(d,open(p,\\"w\\"),ensure_ascii=False,indent=2)
+print(\\"xinting identity len:\\", len(d[\\"newapi_token\\"]))
+" && rm /tmp/t' '''
+r2 = subprocess.run(["/opt/data/venv-ops/bin/python", "/opt/data/scripts/r730_root.py", cmd],
+                    capture_output=True, text=True, timeout=120)
+print(r2.stdout[:150])
+conn.close()
+srv.shutdown()
+ssh.close()

scripts/pg_forward.py

@@ -0,0 +1,43 @@
+#!/usr/bin/env python3
+"""云服务器上的TCP转发守护(替代socat): 25432 -> db.fmode.cn:5432"""
+import socket, threading, subprocess, sys
+
+def pipe(a, b):
+    try:
+        while True:
+            d = a.recv(65536)
+            if not d:
+                break
+            b.sendall(d)
+    except Exception:
+        pass
+    finally:
+        try:
+            a.close()
+        except Exception:
+            pass
+        try:
+            b.close()
+        except Exception:
+            pass
+
+def handle(client):
+    try:
+        upstream = socket.create_connection(("db.fmode.cn", 5432), timeout=10)
+    except Exception:
+        client.close()
+        return
+    threading.Thread(target=pipe, args=(client, upstream), daemon=True).start()
+    threading.Thread(target=pipe, args=(upstream, client), daemon=True).start()
+
+def serve():
+    srv = socket.socket()
+    srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+    srv.bind(("127.0.0.1", 25432))
+    srv.listen(16)
+    print("forwarder up", flush=True)
+    while True:
+        c, _ = srv.accept()
+        threading.Thread(target=handle, args=(c,), daemon=True).start()
+
+serve()