Grok Bot、dots、MuseのVM構成を比較する

#!/usr/bin/env bash
# A standalone, offline Linux survey. Bash 3.2+; no package installation.
# Sourceable so the cgroup reader can be tested against fixture files.
# Single-quoted snippets are intentionally evaluated by awk or a child Bash.
# shellcheck disable=SC2016

SURVEY_VERSION=1.0.0

usage() {
    cat <<'EOF'
Usage: bash survey.sh LABEL [--plan TEXT] [--note TEXT] [--output DIR] [--workdir DIR]

  LABEL         grok-bot / muse / dots, or another short ASCII label
  --plan        Manually recorded subscription plan (default: unknown)
  --note        How this terminal was opened; do not include secrets
  --output      Parent directory for a new result folder (default: ./results)
  --workdir     Filesystem to inspect as the workspace (default: current directory)

Runs on Linux only. Reads system information and writes a NEW result folder.
No network requests, sudo, installs, benchmarks, or persistence experiments.
EOF
}

cell() {
    # One TSV cell; Markdown escaping happens only when rendering Markdown.
    printf '%s' "$1" | tr '\t\r\n' '   '
}

fact() {
    printf '%s\t%s\t%s\t%s\n' "$1" "$2" "$(cell "$3")" "$(cell "$4")" >> "$FACTS"
}

probe() {
    local key=$1 description=$2 rc=0
    shift 2
    LAST_OUTPUT='' LAST_STATUS=unavailable
    if ! command -v "$1" >/dev/null 2>&1; then
        LAST_OUTPUT="command not found: $1"
        rc=127
    else
        if command -v timeout >/dev/null 2>&1; then
            LAST_OUTPUT=$(timeout -k 2s 10s "$@" 2>&1) || rc=$?
        else
            LAST_OUTPUT=$("$@" 2>&1) || rc=$?
        fi
        case $rc in
            0) LAST_STATUS=observed ;;
            124|137) LAST_STATUS=timeout ;;
            *) LAST_STATUS=error ;;
        esac
    fi
    # Logs contain allowlisted commands, not an environment/process/mount dump.
    printf '\n[%s]\n$ %s\nexit_code=%s status=%s\n%s\n' \
        "$key" "$description" "$rc" "$LAST_STATUS" "$LAST_OUTPUT" >> "$RAW"
}

measure() {
    local key=$1 description=$2
    probe "$@"
    if [[ $LAST_STATUS == observed && -n $LAST_OUTPUT ]]; then
        fact "$key" observed "$LAST_OUTPUT" "$description"
    elif [[ $LAST_STATUS == observed ]]; then
        fact "$key" unknown unknown "$description: empty output"
    else
        fact "$key" "$LAST_STATUS" unknown "$description; see commands.txt"
    fi
}

read_cgroup_value() {
    local key=$1 path=$2 description=$3
    if [[ -r $path ]]; then
        measure "$key" "$description" cat "$path"
    else
        LAST_OUTPUT='' LAST_STATUS=unavailable
        fact "$key" unavailable unknown "$description: absent or unreadable"
    fi
}

update_cpu_min() {
    local quota=$1 period=$2 candidate
    if [[ $quota =~ ^[0-9]+$ && $period =~ ^[0-9]+$ ]] && (( period > 0 )); then
        candidate=$(awk -v q="$quota" -v p="$period" 'BEGIN {printf "%.6f", q/p}')
        CPU_MIN=$(awk -v old="$CPU_MIN" -v new="$candidate" \
            'BEGIN {if (old == "" || new+0 < old+0) print new; else print old}')
    fi
}

update_memory_min() {
    local value=$1
    if [[ $value =~ ^[0-9]+$ ]]; then
        MEMORY_MIN=$(awk -v old="$MEMORY_MIN" -v new="$value" \
            'BEGIN {if (old == "" || new+0 < old+0) printf "%.0f", new; else print old}')
    fi
}

walk_cgroup() {
    local kind=$1 mount=$3 level=0 directory=$2 file quota period memory prefix
    local files=()
    case $kind in
        v2) files=(cpu.max cpu.max.burst cpu.stat cpuset.cpus.effective memory.max memory.high memory.current memory.swap.max pids.max) ;;
        cpu) files=(cpu.cfs_quota_us cpu.cfs_period_us cpu.stat) ;;
        memory) files=(memory.limit_in_bytes memory.usage_in_bytes memory.use_hierarchy memory.memsw.limit_in_bytes) ;;
        cpuset) files=(cpuset.cpus cpuset.effective_cpus) ;;
        pids) files=(pids.max) ;;
    esac
    while :; do
        prefix="cgroup.$kind.level$level"
        quota='' period='' memory=''
        for file in "${files[@]}"; do
            read_cgroup_value "$prefix.$file" "$directory/$file" "cat <cgroup:$kind:level$level>/$file"
            [[ $LAST_STATUS == observed ]] || continue
            case $file in
                cpu.max) read -r quota period <<< "$LAST_OUTPUT" ;;
                cpu.cfs_quota_us) quota=$LAST_OUTPUT ;;
                cpu.cfs_period_us) period=$LAST_OUTPUT ;;
                memory.max) memory=$LAST_OUTPUT ;;
            esac
        done
        update_cpu_min "$quota" "$period"
        # v1 memory parents may have use_hierarchy=0. Do not treat every parent
        # limit as effective; keep the original per-level values for inspection.
        [[ $kind != v2 ]] || update_memory_min "$memory"
        [[ $directory != "$mount" ]] || break
        directory=${directory%/*}
        [[ -n $directory ]] || directory=/
        level=$((level + 1))
        if (( level >= 128 )); then
            fact "cgroup.$kind.truncated" unknown yes 'Stopped after 128 visible levels'
            break
        fi
    done
    fact "cgroup.$kind.levels_read" observed "$((level + 1))" 'Level 0 = current group; higher levels = visible ancestors'
}

inspect_cgroups() {
    local membership_file=$1 mountinfo_file=$2 hierarchy controllers group
    local fs root mount options relative candidate kind controller found=0
    local seen='|' mounts kinds=()
    CPU_MIN='' MEMORY_MIN=''
    if [[ ! -r $membership_file || ! -r $mountinfo_file ]]; then
        fact cgroup.discovery unavailable unknown 'proc cgroup/mountinfo unavailable'
        return
    fi
    # Do not publish these files: cgroup paths and mount sources can contain IDs.
    mounts=$(awk '
        { for (i=7; i<=NF; i++) if ($i=="-") {
            if ($(i+1)=="cgroup" || $(i+1)=="cgroup2")
                printf "%s\t%s\t%s\t%s\n", $(i+1), $4, $5, $(i+3)
            break
        }}' "$mountinfo_file")
    while IFS=: read -r hierarchy controllers group; do
        [[ $group == /* ]] || continue
        # Never traverse outside a mounted hierarchy for unexpected proc data.
        case "/${group#/}/" in */../*|*/./*) continue ;; esac
        kinds=()
        if [[ $hierarchy == 0 && -z $controllers ]]; then
            kinds=(v2)
        else
            for controller in cpu memory cpuset pids; do
                case ",$controllers," in *",$controller,"*) kinds+=("$controller") ;; esac
            done
        fi
        for kind in "${kinds[@]-}"; do
            [[ -n $kind ]] || continue
            case "$seen" in *"|$kind|"*) continue ;; esac
            while IFS=$'\t' read -r fs root mount options; do
                [[ -n $fs ]] || continue
                if [[ $kind == v2 ]]; then
                    [[ $fs == cgroup2 ]] || continue
                else
                    [[ $fs == cgroup ]] || continue
                    case ",$options," in *",$kind,"*) ;; *) continue ;; esac
                fi
                # Linux mountinfo encodes spaces, tabs, newlines and backslashes.
                printf -v root '%b' "$root"
                printf -v mount '%b' "$mount"
                if [[ $group == "$root" ]]; then relative=''
                elif [[ $root == / ]]; then relative=$group
                elif [[ $group == "$root/"* ]]; then relative=${group#"$root"}
                else continue
                fi
                candidate="${mount%/}$relative"
                [[ -d $candidate ]] || continue
                # Both are kernel-supplied paths, but canonicalize to enforce
                # the boundary even for fixture files or unusual bind mounts.
                mount=$(cd -- "$mount" && pwd -P) || continue
                candidate=$(cd -- "$candidate" && pwd -P) || continue
                [[ $candidate == "$mount" || $candidate == "$mount/"* || $mount == / ]] || continue
                fact "cgroup.$kind.mapping" observed mapped 'proc membership matched mountinfo root; paths omitted'
                walk_cgroup "$kind" "$candidate" "$mount"
                seen="$seen$kind|"
                found=$((found + 1))
                break
            done <<< "$mounts"
        done
    done < "$membership_file"
    fact cgroup.hierarchies_mapped observed "$found" 'proc membership and visible cgroup mounts'
    if [[ -n $CPU_MIN ]]; then
        fact cgroup.cpu_quota_visible_min_cores derived "$CPU_MIN" 'Minimum observed quota/period; shared group budget, not dedicated cores'
    else
        fact cgroup.cpu_quota_visible_min_cores unknown unknown 'No finite readable quota found; NOT evidence of unrestricted CPU'
    fi
    if [[ -n $MEMORY_MIN ]]; then
        fact cgroup.v2_memory_visible_min_bytes derived "$MEMORY_MIN" 'Minimum observed v2 memory.max; shared group limit'
    else
        fact cgroup.v2_memory_visible_min_bytes unknown unknown 'No finite readable v2 limit; inspect v1 rows if present'
    fi
    fact cgroup.visibility_limit note 'Visible hierarchy only' 'Hidden ancestors, hypervisor limits and other workloads are not measurable here'
}

inspect_storage() {
    local role=$1 path=$2 number prior same='' id
    if [[ ! -d $path ]]; then
        fact "disk.$role" unavailable unknown 'Directory absent or unreadable'
        return
    fi
    # df sources/mountpoints can disclose remote shares or usernames. Select only
    # numeric columns, and explicitly label the log as filtered command output.
    probe "disk.$role.capacity" "df -Pk <path:$role> | awk <numeric columns only>" \
        bash -c 'set -o pipefail; df -Pk -- "$1" | awk "NR==2 {print \$2, \$3, \$4, \$5}"' _ "$path"
    if [[ $LAST_STATUS == observed && $LAST_OUTPUT =~ ^[0-9]+\ [0-9]+\ [0-9]+\ [0-9]+%$ ]]; then
        read -r number _ _ _ <<< "$LAST_OUTPUT"
        fact "disk.$role.total_kib" observed "$number" "Filtered df -Pk; raw log disk.$role.capacity"
        number=$(awk '{print $3}' <<< "$LAST_OUTPUT")
        fact "disk.$role.available_kib" observed "$number" "Available to unprivileged users; raw log disk.$role.capacity"
    else
        fact "disk.$role.capacity" unknown unknown "See commands.txt: disk.$role.capacity"
    fi
    measure "disk.$role.fstype" "stat -f -c %T <path:$role>" stat -f -c %T -- "$path"
    # st_dev is kept internally to identify duplicate filesystems, not published.
    id=$(stat -c %d -- "$path" 2>/dev/null) || id=''
    if [[ -n $id ]]; then
        for prior in "${STORAGE_IDS[@]-}"; do
            [[ -n $prior ]] || continue
            [[ ${prior#*:} != "$id" ]] || same=${prior%%:*}
        done
        STORAGE_IDS+=("$role:$id")
        fact "disk.$role.same_filesystem_as" observed "${same:-none_of_the_preceding_paths}" 'Compared stat st_dev; do not sum duplicate capacities'
    else
        fact "disk.$role.same_filesystem_as" unknown unknown 'stat st_dev unavailable'
    fi
}

render_summary() {
    cat <<'EOF'
# Agent VM survey

この結果は「スクリプトを実行した環境」の観測です。サービス名・プラン・実行先の説明は入力者の申告であり、自動検証していません。

- observed: 観測値、derived: 観測値からの計算、declared: 入力者の申告。
- unavailable / error / timeout / unknown: 未確認。機能・制限が存在しないという意味ではありません。
- CPUモデル内のコア数やゲストのトポロジーから、専有する物理コア数は断定できません。
- cgroupの上限は同じグループ内で共有されます。見える親階層までの値で、保証性能ではありません。
- GPUのツールやデバイスが見つからなくても、ホストのGPU不在は断定できません。
- ストレージ容量はファイルシステム単位です。ユーザークォータやバックエンドの実容量は未確認です。
- 永続性・ネットワーク性能・推論基盤は今回の調査対象外です。
- 実行コマンド・終了コード・出力は commands.txt、比較用データは facts.tsv にあります。

| 項目 | 状態 | 値 | 根拠・注記 |
| --- | --- | --- | --- |
EOF
    awk -F '\t' 'NR>1 {for(i=1;i<=4;i++) {gsub(/&/, "\\&amp;", $i); gsub(/</, "\\&lt;", $i); gsub(/\|/, "\\&#124;", $i)} printf "| %s | %s | %s | %s |\n", $1,$2,$3,$4}' "$FACTS"
}

main() {
    set -u
    set -o pipefail
    export LC_ALL=C
    umask 077
    local label='' plan=unknown note=unknown output=./results workspace=$PWD option
    local started outdir tool field metric hash
    [[ $# -gt 0 ]] || { usage; return 2; }
    case $1 in --help|-h) usage; return 0 ;; esac
    label=$1; shift
    [[ $label =~ ^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$ ]] || { printf 'Invalid LABEL\n' >&2; return 2; }
    while [[ $# -gt 0 ]]; do
        option=$1
        [[ $# -ge 2 ]] || { printf 'Missing value: %s\n' "$option" >&2; return 2; }
        case $option in
            --plan) plan=$2 ;; --note) note=$2 ;; --output) output=$2 ;; --workdir) workspace=$2 ;;
            *) printf 'Unknown option: %s\n' "$option" >&2; return 2 ;;
        esac
        shift 2
    done
    [[ $(uname -s) == Linux ]] || { printf 'Linux only. Run this in the agent cloud terminal, not your Mac.\n' >&2; return 2; }
    for tool in awk bash cat cp date mkdir mktemp stat tr uname; do
        command -v "$tool" >/dev/null 2>&1 || { printf 'Required command missing: %s\n' "$tool" >&2; return 2; }
    done
    [[ -d $workspace ]] || { printf 'Workspace is not a directory\n' >&2; return 2; }
    started=$(date -u +%Y-%m-%dT%H:%M:%SZ)
    mkdir -p -- "$output" || return 1
    outdir=$(mktemp -d "$output/$label-$(date -u +%Y%m%dT%H%M%SZ)-XXXXXX") || return 1
    FACTS=$outdir/facts.tsv RAW=$outdir/commands.txt
    printf 'key\tstatus\tvalue\tsource\n' > "$FACTS"
    printf 'agent-vm-survey %s\nstarted_utc=%s\n' "$SURVEY_VERSION" "$started" > "$RAW"
    printf 'Collecting %s ...\n' "$label"
    fact survey.version observed "$SURVEY_VERSION" 'survey.sh'
    fact survey.started_utc observed "$started" 'date -u'
    fact survey.label declared "$label" 'CLI argument; service identity is not independently verified'
    fact survey.plan declared "$plan" 'CLI argument'
    fact survey.execution_note declared "$note" 'CLI argument'
    fact survey.timeout_available observed "$(command -v timeout >/dev/null 2>&1 && printf yes || printf no)" '10s per command when GNU-compatible timeout is available'
    probe os.release 'cat /etc/os-release (never sourced)' cat /etc/os-release
    if [[ $LAST_STATUS == observed ]]; then
        for field in ID VERSION_ID PRETTY_NAME; do
            metric=$(awk -v key="$field" 'index($0,key"=")==1 {sub(/^[^=]*=/, ""); gsub(/^"|"$/, ""); print; exit}' <<< "$LAST_OUTPUT")
            if [[ -n $metric ]]; then fact "os.$field" observed "$metric" '/etc/os-release'
            else fact "os.$field" unknown unknown 'Field absent from /etc/os-release'; fi
        done
    else
        fact os.release "$LAST_STATUS" unknown 'See commands.txt'
    fi
    measure os.kernel 'uname -sr' uname -sr
    measure os.architecture 'uname -m' uname -m
    measure process.uid 'id -u (numeric only)' id -u
    measure process.limits 'ulimit -a (in inherited subshell)' bash -c 'ulimit -a'
    probe cpu.lscpu 'lscpu' lscpu
    if [[ $LAST_STATUS == observed ]]; then
        metric=$(awk -F: '/^Model name:/ {sub(/^[ \t]+/, "", $2); print $2; exit}' <<< "$LAST_OUTPUT")
        if [[ -n $metric ]]; then fact cpu.model observed "$metric" 'lscpu; full topology in commands.txt'
        else fact cpu.model unknown unknown 'Model name absent; inspect lscpu in commands.txt'; fi
    else
        measure cpu.model 'CPU model fields in /proc/cpuinfo' awk -F: '/^(model name|Hardware|Processor)[ \t]*:/ {sub(/^[ \t]+/, "", $2); print $2; exit}' /proc/cpuinfo
    fi
    measure cpu.online 'getconf _NPROCESSORS_ONLN' getconf _NPROCESSORS_ONLN
    measure cpu.nproc 'env -u OMP_NUM_THREADS -u OMP_THREAD_LIMIT nproc' env -u OMP_NUM_THREADS -u OMP_THREAD_LIMIT nproc
    measure cpu.nproc_all 'nproc --all' nproc --all
    measure cpu.allowed_list 'Cpus_allowed_list from /proc/<survey-pid>/status' awk '/^Cpus_allowed_list:/ {print $2}' "/proc/$$/status"
    probe memory.meminfo 'Selected capacity fields in /proc/meminfo' awk '/^(MemTotal|MemAvailable|SwapTotal|SwapFree):/ {print}' /proc/meminfo
    if [[ $LAST_STATUS == observed ]]; then
        for field in MemTotal MemAvailable SwapTotal SwapFree; do
            metric=$(awk -v key="$field:" '$1==key {printf "%.0f", $2*1024}' <<< "$LAST_OUTPUT")
            if [[ -n $metric ]]; then fact "memory.$field.bytes" observed "$metric" '/proc/meminfo kB multiplied by 1024'
            else fact "memory.$field.bytes" unknown unknown 'Field absent from /proc/meminfo'; fi
        done
    else
        fact memory.meminfo "$LAST_STATUS" unknown 'See commands.txt'
    fi
    probe memory.free 'free -b' free -b
    inspect_cgroups "/proc/$$/cgroup" "/proc/$$/mountinfo"
    STORAGE_IDS=()
    inspect_storage root /
    inspect_storage home "${HOME:-/nonexistent}"
    inspect_storage work "$workspace"
    probe virtualization.detect 'systemd-detect-virt (exit 1 + none means none detected)' systemd-detect-virt
    if [[ $LAST_OUTPUT == none ]]; then
        fact virtualization.detect observed none_detected 'systemd-detect-virt; not proof of bare metal'
    elif [[ $LAST_STATUS == observed ]]; then
        fact virtualization.detect observed "$LAST_OUTPUT" 'systemd-detect-virt'
    else
        fact virtualization.detect "$LAST_STATUS" unknown 'See commands.txt'
    fi
    for field in sys_vendor product_name board_vendor; do
        read_cgroup_value "virtualization.dmi.$field" "/sys/class/dmi/id/$field" "cat /sys/class/dmi/id/$field"
    done
    probe gpu.pci 'lspci -nn (display-class devices only in facts.tsv)' lspci -nn
    if [[ $LAST_STATUS == observed ]]; then
        metric=$(awk '/VGA compatible controller|3D controller|Display controller/' <<< "$LAST_OUTPUT")
        fact gpu.pci_display_devices observed "${metric:-no_display_class_device_visible}" 'Filtered lspci -nn; host GPU presence remains unknown'
    else
        fact gpu.pci_display_devices "$LAST_STATUS" unknown 'lspci unavailable or failed'
    fi
    measure gpu.nvidia 'nvidia-smi --query-gpu=name,memory.total,driver_version --format=csv,noheader' \
        nvidia-smi --query-gpu=name,memory.total,driver_version --format=csv,noheader
    for tool in python3 python node npm git ffmpeg chromium chromium-browser google-chrome firefox; do
        if [[ $tool == ffmpeg ]]; then
            probe "tool.$tool" "$tool -version" "$tool" -version
        else
            probe "tool.$tool" "$tool --version" "$tool" --version
        fi
        if [[ $LAST_STATUS == observed ]]; then
            metric=${LAST_OUTPUT%%$'\n'*}
            fact "tool.$tool" observed "$metric" 'Version command; full output in commands.txt'
        else
            fact "tool.$tool" "$LAST_STATUS" unknown 'See commands.txt'
        fi
    done
    fact survey.finished_utc observed "$(date -u +%Y-%m-%dT%H:%M:%SZ)" 'date -u'
    cp -- "${BASH_SOURCE[0]}" "$outdir/survey.sh" || return 1
    if command -v sha256sum >/dev/null 2>&1; then
        hash=$(sha256sum "$outdir/survey.sh")
        fact survey.script_sha256 observed "${hash%% *}" 'sha256sum survey.sh'
    fi
    render_summary > "$outdir/summary.md" || return 1
    if command -v sha256sum >/dev/null 2>&1; then
        (cd -- "$outdir" && sha256sum survey.sh facts.tsv commands.txt summary.md > SHA256SUMS) || return 1
    fi
    printf 'Done: %s\nRead summary.md; compare facts.tsv; evidence in commands.txt.\n' "$outdir"
}

if [[ ${BASH_SOURCE[0]} == "$0" ]]; then
    main "$@"
fi

Authentication refused: bad ownership or modes for directory /home/hatch/workspace