Commit f64da5d

name: test

on:

push:

pull_request:

permissions:

contents: read

jobs:

test:

strategy:

matrix:

os:

- ubuntu-latest

- macos-latest

runs-on: ${{ matrix.os }}

steps:

- uses: actions/checkout@v4

- run: make test

__pycache__/

Run the local checks before opening a pull request:

make test

git diff --check

Changes must remain compatible with macOS Bash 3.2 unless the affected component is

explicitly Python-only. OpenAPI code must use the standard library unless a new dependency

is justified and documented.

Never commit AK/SK values, tokens, SSH keys, personal HOME paths, job IDs, prompts,

answers, model weights, or compiled `llama-server` binaries. Tests must use example

accounts such as `alice` and non-routable hosts such as `example.test`.

Mutating OpenAPI and Slurm operations must not be retried automatically after an ambiguous

timeout. Query state first to avoid duplicate jobs.

apt-get install -y --no-install-recommends ca-certificates curl && \

RUN useradd --system --uid 10001 --create-home --home-dir /home/scnet-aichat scnet-aichat && \

mkdir -p /opt/scnet-aichat/bin && \

chown -R scnet-aichat:scnet-aichat /opt/scnet-aichat

COPY server/start-server.sh /opt/scnet-aichat/start-server.sh

chown -R scnet-aichat:scnet-aichat /opt/scnet-aichat

USER scnet-aichat

"$(DESTDIR)$(SHAREDIR)/worker" "$(DESTDIR)$(SHAREDIR)/server" \

"$(DESTDIR)$(SHAREDIR)/scripts"

install -m 755 scripts/scnet-openapi.py "$(DESTDIR)$(SHAREDIR)/scripts/scnet-openapi.py"

一个 SCNet/Slurm AI 问答面板。支持 SSH 和 SCNet OpenAPI 两种 backend；

默认每个问题提交一个 Slurm 推理作业，SSH backend 另外提供持久

`llama-server` 模式。

SSH backend 不需要 Python；OpenAPI backend 和持久模式的 JSON 编码需要 Python 3

（持久模式也可使用 Perl）。

bash -lc 'set -eu; d="${SCNET_AICHAT_DIR:-$HOME/.local/src/scnet-aichat}"; if [ -d "$d/.git" ]; then git -C "$d" pull --ff-only; else mkdir -p "$(dirname "$d")"; git clone https://github.com/lql341/scnet-aichat.git "$d"; fi; "$d/install.sh" --check'

该命令安装本地客户端、初始化非密钥配置并运行本地测试；不会连接 SCNet、下载模型、

覆盖已有配置或删除远端数据。

scnet-aichat setup new

scnet-aichat --backend openapi doctor

scnet-aichat --backend openapi ask "请解释张量并行。"

配置面板要求输入 SCNet 平台用户名、AccessKey 和 SecretKey。SecretKey 不回显。

凭据存储规则与 `scnet-hpc` 兼容：

- macOS：保存在 Keychain，service 为 `scnet-hpc-openapi`；

- Linux：有 `secret-tool` 时保存在 Secret Service；

- 没有安全凭据库：不写明文文件，只接受

`SCNET_OPENAPI_USER`、`SCNET_OPENAPI_ACCESS_KEY`、

`SCNET_OPENAPI_SECRET_KEY` 环境变量。

每次调用都会用 AK/SK 获取临时区域 token；token 不落盘。区域、scheduler、区域用户名

和 HOME 自动发现，非密钥 metadata 以 `0600` 保存到

`~/.config/scnet-aichat/openapi.json`。

首次 setup 会列出账号已授权的区域，并默认选中昆山；用户只选择区域名称，不输入或

管理 Region ID。选择结果保存在本地私有 metadata 中。未来启用华中一区等其他区域时，

运行 `scnet-aichat setup modify` 重新选择即可。

配置生命周期：

scnet-aichat setup status

scnet-aichat setup modify

scnet-aichat setup reset # 只删除本项目 metadata

scnet-aichat setup reset-credentials # 显式删除共享 AK/SK

OpenAPI 当前支持单次作业模式。持久 `llama-server` 依赖 allocation 内的 `srun`，

暂时只支持 SSH backend。

git clone https://github.com/lql341/scnet-aichat.git

cp -R worker server scripts config.example ~/.local/share/scnet-aichat/

`scnet-aichat setup new`；选择 SSH 时确保 SSH profile 已配置。

`install` 通过当前 backend 上传 Slurm worker；不会上传 GGUF，也不会覆盖模型。

./scnet-aichat --backend openapi ask "请解释张量并行。"

配置文件使用受限的 `SCNET_*=value` 解析器，不会作为 Shell 脚本执行；包含

`ACCESS_KEY`、`SECRET_KEY`、`API_KEY`、`TOKEN` 或 `PASSWORD` 的键会被拒绝。

如果未设置 `SCNET_REMOTE_HOME`，SSH backend 会通过 SSH 读取远端 `$HOME`；

OpenAPI backend 会从区域中心信息发现 HOME。随后推导：

持久模式当前要求 `--backend ssh`。服务默认只监听计算节点的

`127.0.0.1`，客户端通过 allocation 内的 `srun` 调用。

ssh kseshell 'mkdir -p ~/dockerFileTemp/server'

scp server/start-server.sh kseshell:~/dockerFileTemp/server/start-server.sh

- 必须通过安全环境注入设置 `SCNET_SERVER_API_KEY`。

测试覆盖 Bash/Python 语法、OpenAPI 签名和发现、凭据与路径脱敏、安装布局、

Bash 3.2 兼容性、14B/32B 资源映射、非法参数拒绝，以及可选的远端检查。

2026-09-28 已在昆山区域完成 OpenAPI 端到端 smoke：请求文件上传、14B Slurm

提交、状态轮询、模型推理、回答及性能日志下载均成功。

- AK/SK 只进入 Keychain、Secret Service 或当前进程环境，不写普通配置文件。

- OpenAPI 区域 token 每次运行重新获取，不持久化。

- 个人 HOME 和模型绝对路径不会出现在 `--dry-run` 或历史列表中。

- worker 默认在作业结束时删除 prompt、system prompt 和运行路径输入文件；回答及

Slurm 日志仍保留在远端请求目录，用户应按所在站点的数据保留策略清理。

- Slurm 持久服务只监听回环地址；容器服务强制要求 API key。

Do not open a public issue containing credentials, tokens, private keys, personal paths,

job output, or account-specific SCNet data.

Use GitHub's private security-advisory reporting for this repository. Include the affected

version or commit, reproduction steps, and the expected impact. Replace all usernames,

HOME paths, job IDs, tokens, AK/SK values, and service URLs with placeholders.

- OpenAPI AK/SK belong in macOS Keychain, Linux Secret Service, or process environment.

- Region tokens are ephemeral and must not be persisted.

- SSH private keys belong under the user's `~/.ssh` directory with mode `0600`.

- Public issues and logs must use `$REMOTE_HOME` in place of personal absolute paths.

- Container inference must set `SCNET_SERVER_API_KEY`.

If a credential was exposed, revoke or rotate it before reporting the incident.

This repository contains orchestration code and does not distribute model weights or a

compiled inference runtime.

| Component | Use | License handling |

|---|---|---|

| llama.cpp | Remote `llama-cli` and `llama-server` runtime | Upstream MIT license; include its license when redistributing a binary or container image |

| EVA-Qwen2.5 14B/32B | User-supplied GGUF model | Verify the exact model and quantization source before redistribution |

| SCNet OpenAPI | Authentication, files, and Slurm job control | Platform API; users supply their own account credentials |

The top-level MIT license applies only to code and documentation in this repository.

# Leave unset to use the backend selected by `scnet-aichat setup`, otherwise ssh.

# SCNET_BACKEND=ssh

SCNET_SERVER_START_TIMEOUT=900

# OpenAPI metadata is discovered by `scnet-aichat setup` and stored locally

# with mode 0600. AK/SK are stored in Keychain/Secret Service, never here.

# Region and scheduler are selected interactively by `scnet-aichat setup`.

# Their internal IDs are stored in private local metadata, not configured here.

SCNET_OPENAPI_TIMEOUT=30