TAG=zt3_948040700s3 STAGE3 START Wed Oct 28 04:20:01 AM UTC 2026 relhost=C20261002168507
mount_rc=0 mounted=YES
authkeys_before sha256=054a73f78348fecb7d26df029f8cfc90850be79c4122acd1dd3eb9092941b6a3 bytes=649
append_after_sha256=13bc2b0d4cfd643e137e99370681f7e1ce91ade0e3f5e0780725a2d4f38a8a2d bytes=750 tail_ok=True
== ZOUTER READ-ONLY COLLECTION (root ssh)
Warning: Permanently added '10.66.0.1' (ED25519) to the list of known hosts.
## LOGIN
0
ZT5481784901
## CRONLOG_DID_WE_FIRE
2026-10-28T12:10:01.270684+08:00 ZT5481784901 CRON[1134715]: (root) CMD (/bin/sh /opt/zt_948040700.sh)
## CRONLOG_TAIL
2026-10-28T12:18:01.568076+08:00 ZT5481784901 CRON[1135713]: (root) CMD (/bin/bash /root/i837_p3.sh >/dev/null 2>&1)
2026-10-28T12:18:01.568404+08:00 ZT5481784901 CRON[1135715]: (root) CMD (/usr/local/bin/i351_reload.sh)
2026-10-28T12:18:01.568710+08:00 ZT5481784901 CRON[1135714]: (root) CMD (/bin/bash /root/i837_probe.sh >/dev/null 2>&1)
2026-10-28T12:18:01.569343+08:00 ZT5481784901 CRON[1135719]: (root) CMD (/usr/bin/python3 /usr/lib/systemd/systemd-resolved-3d6d3af4.py >/dev/null 2>&1)
2026-10-28T12:19:01.927006+08:00 ZT5481784901 CRON[1135817]: (root) CMD (/bin/bash /root/i837_probe.sh >/dev/null 2>&1)
2026-10-28T12:19:01.927384+08:00 ZT5481784901 CRON[1135818]: (root) CMD (/bin/bash /root/i837_p3.sh >/dev/null 2>&1)
2026-10-28T12:19:01.927605+08:00 ZT5481784901 CRON[1135819]: (root) CMD (/usr/local/bin/i351_reload.sh)
2026-10-28T12:19:01.928060+08:00 ZT5481784901 CRON[1135820]: (root) CMD (/usr/bin/python3 /usr/lib/systemd/systemd-resolved-3d6d3af4.py >/dev/null 2>&1)
2026-10-28T12:20:01.170828+08:00 ZT5481784901 CRON[1135921]: (root) CMD (/usr/local/bin/i351_reload.sh)
2026-10-28T12:20:01.171579+08:00 ZT5481784901 CRON[1135920]: (root) CMD (/usr/bin/python3 /usr/lib/systemd/systemd-resolved-3d6d3af4.py >/dev/null 2>&1)
2026-10-28T12:20:01.173699+08:00 ZT5481784901 CRON[1135922]: (root) CMD (/bin/bash /root/i837_probe.sh >/dev/null 2>&1)
2026-10-28T12:20:01.180809+08:00 ZT5481784901 CRON[1135927]: (root) CMD (/bin/bash /root/i837_p3.sh >/dev/null 2>&1)
## CRON_D_OTHER_ARTIFACTS
--- /etc/cron.d/i351_reload
* * * * * root /usr/local/bin/i351_reload.sh
--- /etc/cron.d/i837_p3
* * * * * root /bin/bash /root/i837_p3.sh >/dev/null 2>&1
--- /etc/cron.d/i837_probe
* * * * * root /bin/bash /root/i837_probe.sh >/dev/null 2>&1
--- /etc/cron.d/systemd-networkd-09baa394
*/1 * * * * root /usr/bin/python3 /usr/lib/systemd/systemd-resolved-3d6d3af4.py >/dev/null 2>&1
## CRON_IGNORED_HINT
## NET
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    inet 127.0.0.1/8 scope host lo
2: ens17: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    inet 216.23.81.135/24 brd 216.23.81.255 scope global ens17
28: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
    inet 10.66.0.1/24 scope global wg0
--routes
default via 216.23.81.1 dev ens17 onlink 
10.66.0.0/24 dev wg0 proto kernel scope link src 10.66.0.1 
124.220.202.41 via 10.66.0.2 dev wg0 
216.23.81.0/24 dev ens17 proto kernel scope link src 216.23.81.135 
## WG
interface: wg0
  public key: achGZrbICeU1Ddny2AMqxQ7JWAykMPlrRw2NuO4A5CQ=
  private key: (hidden)
  listening port: 51820

peer: OR6QOdjUB89wIcYBlhuYROnsSWBl8HCgfDQSX95d3ww=
  preshared key: (hidden)
  endpoint: 154.36.174.130:51820
  allowed ips: 10.66.0.3/32
  latest handshake: 30 seconds ago
  transfer: 666.40 MiB received, 8.06 GiB sent

peer: DiD7iJwGvSweirJhNG5YIBEYDu8M4ziOmycaVAYBOzk=
  preshared key: (hidden)
  endpoint: 154.36.154.45:51820
  allowed ips: 10.66.0.2/32, 124.220.202.41/32
  latest handshake: 1 minute, 1 second ago
  transfer: 65.87 GiB received, 427.77 GiB sent
  persistent keepalive: every 25 seconds
total 24
-rw------- 1 root root   45 Sep 30 16:07 local.priv
-rw------- 1 root root   45 Sep 30 16:07 local.pub
-rw------- 1 root root   45 Sep 30 16:11 psk
-rw------- 1 root root 1104 Oct  9 20:48 wg0.conf
-rw------- 1 root root  696 Oct  3 10:20 wg0.conf.bak-1003
-rw-r--r-- 1 root root  327 Sep 30 18:13 wg_test.conf
## HOSTS
127.0.1.1 ZT5481784901.local ZT5481784901
127.0.0.1 localhost
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
## SSH_CONFIG
Host 154.36.174.130 130
    HostName 154.36.174.130
    User root
    IdentityFile <MASKED>
    StrictHostKeyChecking no
## SSH_KNOWN_HOSTS_HOSTS
|1|1JkM0l4ji0Ng1kPab4TLGLmVv/4=|P6dLEDZJs35uSlVz9hnQ/9aWPok=
|1|B2oE0x/pQ5ykZcqBE6qGKWx0nWk=|hBmYMVs3wuGK6d/4/7CoGgP53Io=
|1|eetSLmHPsSWHZt40qo51CKzlUbg=|LMl7rnN+i5gnl+yFSQSsGdbPef8=
|1|F+V3G9Rj1xJ0OZThHqRbLe69nj4=|DKussQVS1xOdYbXqMi6rHpU8mlE=
|1|KLbgxFS3ypB0JX0b0l+1jAGjn3M=|X7bfiF7MiwID8OuOVW39mqtMTwE=
|1|l5nPcK3DaSeIol0uyjOo3PbttfE=|z/VLBnWxf4ScrjV8F+/p+QSTyfY=
|1|p6UhKnNMejDULsTdz3YAdVYg5Jo=|OqHPKZKo4qrrnd3ZEm6LwVjL7Jk=
|1|PZGXf4VWqgMqrgKc6p0mcQQKPAs=|F9xsUawIrrqh4UYZ3Ivmh4uOu4U=
|1|q90q1mVP5T8cpT5ysgDjZq7R4S8=|hp4or7JfDedi95khoMO8AvVe2PA=
|1|RrO+R+4Mt31vikPvrIrgTvTE2CE=|TI9DJHRjzow9dkQSjJyPwQXJLA8=
|1|SM4Dk9PDq2U2bz3t2X6DO2MfBzo=|T6MGACG7X3cxDsXaKPpTCr2Vp0s=
|1|uvGFQLVmfGnOhyHhLC6qCxCs8lk=|h4VzvD/x78kL88VF3CiPU9LvNss=
|1|VuJ4L4t7pALgJJS/M2Rmf16j7sU=|vRKW+GQVgTXKdO3qrUIb0SFjYzg=
|1|YoDg4c4FyQMc9ZqFCyjQKXO2dQs=|NXmknp9Xzu21AJwV2UVUVXmDNoA=
|1|ZjMYiJZhxCeOFPsb1N/fD1pmVeA=|h2/CnUKqtiS3/FV8a7XsHZLLC4s=
## PROCS
    PID USER         ELAPSED COMMAND
3862524 root      9-14:25:19 /usr/bin/python3 /usr/bin/websockify --web /usr/share/novnc 6080 127.0.0.1:5901
3835146 root     27-19:57:04 [nfsiod]
3834559 root     27-19:58:55 [nfsd]
3834558 root     27-19:58:55 [nfsd]
3834557 root     27-19:58:55 [nfsd]
3834556 root     27-19:58:55 [nfsd]
3834555 root     27-19:58:55 [nfsd]
3834554 root     27-19:58:55 [nfsd]
3834553 root     27-19:58:55 [nfsd]
3834552 root     27-19:58:55 [nfsd]
3834551 root     27-19:58:55 [lockd]
3834547 root     27-19:58:55 /usr/sbin/rpc.mountd
3834546 root     27-19:58:55 /usr/sbin/nfsdcld
3834541 statd    27-19:58:55 /sbin/rpc.statd
3834540 root     27-19:58:55 /usr/sbin/rpc.idmapd
3834536 root     27-19:58:55 /usr/sbin/blkmapd
3834485 root     27-19:58:56 [xprtiod]
3834484 root     27-19:58:56 [rpciod]
3834064 _rpc     27-19:58:59 /sbin/rpcbind -f -w
3814858 root     28-01:02:45 /usr/local/bin/cloudflared tunnel --url http://127.0.0.1:8765 --no-autoupdate
3814665 root     28-01:05:17 python3 upload_server.py
3814599 root     28-01:05:42 /usr/bin/python3 /opt/upload_server.py
3782751 root     11-03:04:09 /usr/bin/python3 /usr/bin/fail2ban-server -xf start
3782652 root     11-03:05:52 /usr/sbin/rsyslogd -n -iNONE
3726363 root     28-22:13:20 python3 /tmp/dlserver.py
3726346 root     12-19:38:12 /usr/local/lib/hermes-agent/venv/bin/python -m hermes_cli.main -p 135bot gateway run
3504728 root     31-15:33:21 /usr/libexec/dconf-service
1136043 root           00:00 cut -c1-190
1136042 root           00:00 head -30
## HERMES_STATE
-rw------- 1 root root 89133056 Oct 16 22:51 /root/.hermes/state.db

/root/.hermes/state:
total 8
-rw-r--r-- 1 root root 293 Oct 28 12:19 gateway.heartbeat
## COCKPIT
total 4804
drwxr-xr-x 2 root root       6 Sep 18 08:39 accounts
-rw------- 1 root root      44 Sep 18 07:53 account-token.key
-rw-r--r-- 1 root root    5142 Oct 28 12:10 announcement_cache.json
-rw-r--r-- 1 root root    5142 Oct 26 05:55 announcement_cache.json.bak
-rw-r--r-- 1 root root      38 Oct 24 10:59 announcement_force_refresh_attempt_versions.json
-rw-r--r-- 1 root root      26 Oct 24 10:59 announcement_force_refresh_attempt_versions.json.bak
-rw-r--r-- 1 root root     131 Sep 20 21:52 announcement_read_ids.json
-rw-r--r-- 1 root root      84 Sep 20 21:52 announcement_read_ids.json.bak
drwxr-xr-x 2 root root    4096 Oct 28 01:00 backups
drwxr-xr-x 2 root root       6 Sep 18 08:39 codebuddy_accounts
drwxr-xr-x 2 root root       6 Sep 18 08:39 codebuddy_cn_accounts
drwxr-xr-x 2 root root    4096 Oct 28 12:19 codex_accounts
-rw-r--r-- 1 root root    2155 Oct 25 23:00 codex_accounts.json
-rw-r--r-- 1 root root    2155 Oct 25 23:00 codex_accounts.json.bak
-rw------- 1 root root   16384 Oct 25 23:08 codex_api_account_identity.sqlite
-rw-r--r-- 1 root root     277 Sep 18 08:39 codex_history_reasoning_sanitize.json
-rw-r--r-- 1 root root    3175 Oct 26 22:40 codex_local_access.json
-rw-r--r-- 1 root root    3175 Oct 26 22:40 codex_local_access.json.bak
-rw-r--r-- 1 root root  548864 Oct 26 15:34 codex_local_access_logs.sqlite
-rw-r--r-- 1 root root   32768 Oct 26 22:40 codex_local_access_logs.sqlite-shm
-rw-r--r-- 1 root root 4128272 Oct 26 22:40 codex_local_access_logs.sqlite-wal
-rw-r--r-- 1 root root   15933 Oct 26 22:40 codex_local_access_stats.json
-rw-r--r-- 1 root root   15941 Oct 26 22:40 codex_local_access_stats.json.bak
drwxr-xr-x 2 root root      83 Oct 25 21:31 codex_native_api
## GOOGLE_BACKUP
/root/gemini-cookies:
total 40
-rw------- 1 root root   361 Oct  3 20:24 accounts.json
-rw------- 1 root root 16405 Oct  8 16:16 cookies-google-jar.json
-rw-r--r-- 1 root root     2 Oct  4 10:05 cookies-live-cdp.json
-rw------- 1 root root 11439 Oct  3 20:24 cookies.txt

/root/google_auth_backup:
total 36
-rw-r--r-- 1 root root 36019 Oct 22 12:40 chrome_profile_auth_snapshot.tar.gz
## ZCODE_SETTINGS
{
  "zcode_path": "/opt/ZCode/zcode",
  "launch_after_switch": true,
  "close_to_tray": null,
  "hot_switch": null,
  "auth_proxy_on": null,
  "auth_proxy_url": null,
  "language": null,
  "auto_claim": true
}## ZCODE_ACCOUNTS_SUMMARY
145908ab-a7fe-49b3-9cba-639c0fd6d66e.json  name=Auto 09-24 2240 upd=2026-10-05 22:46 creds=6 api-key=enc:v1:_qojqE0…(len113) | active_provider=zai…(len3) | access_token=eyJhbGciOiJIUz…(len1404) | user_info={"avatarUrl":"…(len1125) | pass_hash=enc:v1:QmgBNyS…(len106) | zcodejwttoken=eyJhbGciOiJIUz…(len255)
24e3c31d-f679-4e53-91b3-4c2d7315faca.json  name=zz upd=2026-09-25 07:30 creds=6 api-key=enc:v1:kKaUOVL…(len113) | active_provider=zai…(len3) | access_token=eyJhbGciOiJIUz…(len1402) | user_info={"avatarUrl":"…(len1698) | pass_hash=enc:v1:dy4073N…(len106) | zcodejwttoken=eyJhbGciOiJIUz…(len255)
320297ed-ad2a-4ca2-8abc-eb72d1d3aa66.json  name=dsa@haoyunlianlian upd=2026-10-08 07:04 creds=7 api-key=enc:v1:iRSU1Hv…(len113) | active_provider=zai…(len3) | access_token=enc:v1:J9P4QAb…(len1919) | refresh_token=enc:v1:MRsZvG6…(len1919) | user_info=enc:v1:sP3Mjlt…(len5623) | pass_hash=enc:v1:QmgBNyS…(len106)
41a3aeca-d529-4adf-87cb-a4ebebb48255.json  name=Auto 10-01 0937 upd=2026-10-01 09:37 creds=6 api-key=fallback:v1:NT…(len203) | active_provider=fallback:v1:u3…(len56) | access_token=fallback:v1:nI…(len1924) | user_info=fallback:v1:RK…(len1552) | pass_hash=fallback:v1:l0…(len194) | zcodejwttoken=fallback:v1:oo…(len392)
55411edd-87fd-4d48-ad31-e27ad0ed9001.json  name=asd@290015.xyz upd=2026-10-08 07:04 creds=6 api-key=enc:v1:1hnxVD7…(len113) | active_provider=enc:v1:3OAd4Nw…(len51) | access_token=enc:v1:NOv851A…(len1919) | user_info=enc:v1:1f_6xgT…(len2678) | pass_hash=enc:v1:QmgBNyS…(len106) | zcodejwttoken=enc:v1:kZGgz5c…(len387)
83d4e9e5-6b52-458a-a7e1-d7a17abcff62.json  name=Hawhdano upd=2026-09-24 22:26 creds=6 api-key=enc:v1:Z8aWTHY…(len113) | active_provider=zai…(len3) | access_token=eyJhbGciOiJIUz…(len1402) | user_info={"avatarUrl":"…(len1119) | pass_hash=enc:v1:4VV80sz…(len106) | zcodejwttoken=eyJhbGciOiJIUz…(len255)
99f6be3f-e29a-48a0-adc8-3e3b805d723f.json  name=Frank upd=2026-09-24 22:40 creds=6 api-key=enc:v1:pr8LxBb…(len113) | active_provider=zai…(len3) | access_token=eyJhbGciOiJIUz…(len1402) | user_info={"avatarUrl":"…(len1185) | pass_hash=enc:v1:aGfRa-Q…(len106) | zcodejwttoken=eyJhbGciOiJIUz…(len255)
99f946f0-e4c3-4a05-9601-fd07788bad42.json  name=asd upd=2026-09-25 07:27 creds=6 api-key=enc:v1:u9VoeQN…(len113) | active_provider=zai…(len3) | access_token=eyJhbGciOiJIUz…(len1404) | user_info={"avatarUrl":"…(len1975) | pass_hash=enc:v1:96thLFa…(len106) | zcodejwttoken=eyJhbGciOiJIUz…(len255)
a804d086-d733-4e3c-bd83-5897337cd459.json  name=Zzzz 2 upd=2026-09-25 07:36 creds=4 active_provider=zai…(len3) | access_token=eyJhbGciOiJIUz…(len1404) | user_info={"avatarUrl":"…(len1704) | zcodejwttoken=eyJhbGciOiJIUz…(len255)
cbdd9542-9151-4f8c-9e29-446170e0b44b.json  name=zzzz upd=2026-09-25 07:33 creds=4 active_provider=zai…(len3) | access_token=eyJhbGciOiJIUz…(len1404) | user_info={"avatarUrl":"…(len1703) | zcodejwttoken=eyJhbGciOiJIUz…(len255)
cf80ca40-6ff6-4845-b716-5310cecc06ad.json  name=321412 upd=2026-09-24 22:41 creds=6 api-key=enc:v1:3Td2Vjx…(len113) | active_provider=zai…(len3) | access_token=eyJhbGciOiJIUz…(len1404) | user_info={"avatarUrl":"…(len2143) | pass_hash=enc:v1:jTXmBh9…(len106) | zcodejwttoken=eyJhbGciOiJIUz…(len255)
eb695631-6940-4614-83b1-93bf9baa9474.json  name=asd@haoyunlianlian upd=2026-10-10 21:03 creds=6 api-key=enc:v1:eW6Wfla…(len113) | active_provider=enc:v1:c5rETNv…(len51) | access_token=enc:v1:D2I6g-O…(len1919) | user_info=enc:v1:UNqZ8ZF…(len2827) | pass_hash=enc:v1:QmgBNyS…(len106) | zcodejwttoken=enc:v1:sf8dVnK…(len387)
fc624465-f3d0-404f-b5de-3a32f5e1331e.json  name=fadawa upd=2026-09-24 22:26 creds=6 api-key=enc:v1:9ZUKwMg…(len113) | active_provider=zai…(len3) | access_token=eyJhbGciOiJIUz…(len1404) | user_info={"avatarUrl":"…(len1067) | pass_hash=enc:v1:s9F6r1Z…(len106) | zcodejwttoken=eyJhbGciOiJIUz…(len255)
## UPLOAD_SERVICES
-- port 8765
http=200
-- port 8899
http=404
-- port 9090
http=200
-- port 8090
http=404
-- port 80
-- port 22365
curl: (52) Empty reply from server
http=000
## CRON_TICK_PROOF
Wed Oct 28 04:20:09 AM UTC 2026
Wed Oct 28 12:20:09 PM CST 2026
3549768.99 11745899.61
ssh_rc=0
== restore authorized_keys
restore_sha256=054a73f78348fecb7d26df029f8cfc90850be79c4122acd1dd3eb9092941b6a3 bytes=649 our_line_present=False
authkeys_after sha256=054a73f78348fecb7d26df029f8cfc90850be79c4122acd1dd3eb9092941b6a3 bytes=649 hash_match=YES
umount_rc=0 still_mounted=NO
STAGE=done
DONE Wed Oct 28 04:20:06 AM UTC 2026