@agentikos/omega-os 0.2.0 → 0.19.6

package/bootstrap/lib/manifest-helpers.py

@@ -0,0 +1,384 @@
+#!/usr/bin/env python3
+"""Manifest-driven install helpers, invoked from `bootstrap/lib/steps.sh`.
+
+The shell side only orchestrates; this file is where we read YAML, write
+files, and call into the engine. All commands are non-fatal — they return
+exit 0 even on minor issues, but print warnings the operator can act on.
+
+Subcommands
+-----------
+    providers <manifest> <omega_home>
+        Read `providers:` and write Agentik_SSOT/providers/router.yaml.
+
+    autonomous <manifest> <templates_dir> <target_dir>
+        Read `autonomous_agents:` and copy matching template charters into
+        Agentik_Orchestration/autonomous/.
+
+    rag <manifest> <omega_home>
+        Read `options.rag` and write Agentik_SSOT/rag/config.yaml.
+
+    init-vault <omega_home>
+        Idempotent: ensure the vault is set up (age keypair if available,
+        mode-700 directory). Prints the resolved backend.
+
+    accounts <manifest> <omega_home>
+        Read `accounts:` and add each to the pool. If `token_env` is set
+        AND the env var has a value, write the token through the vault.
+
+    first-project <manifest> <omega_home>
+        If `first_project:` is set, create that project (folder + registry
+        + Telegram topic if a bridge is wired).
+
+    encrypt-mcp-env <omega_home> <mcp_id>
+        Migrate ``Agentik_Extra/etc/secrets/mcp-<id>.env`` into the
+        encrypted vault when age is the active backend. No-op otherwise.
+
+    telegram-chat-id <manifest> <omega_home>
+        Read ``telegram.group_chat_id`` from the manifest (if set) and
+        persist it through the vault. Returns the resolved id on stdout.
+"""
+from __future__ import annotations
+
+import os
+import shutil
+import sys
+from pathlib import Path
+
+import yaml
+
+
+def _engine_on_path(omega_home: str | Path) -> None:
+    """Make the engine importable in this subprocess."""
+    engine = Path(omega_home) / "Agentik_Engine"
+    if engine.is_dir():
+        sys.path.insert(0, str(engine))
+
+
+def _load_manifest(path: str | Path) -> dict:
+    p = Path(path)
+    if not p.exists():
+        print(f"manifest not found: {p}")
+        return {}
+    try:
+        data = yaml.safe_load(p.read_text()) or {}
+    except yaml.YAMLError as exc:
+        print(f"manifest YAML error: {exc}")
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def cmd_providers(manifest: str, omega_home: str) -> int:
+    data = _load_manifest(manifest)
+    providers = data.get("providers") or []
+    if not providers:
+        print("no `providers:` in manifest — skipping")
+        return 0
+    out_dir = Path(omega_home) / "Agentik_SSOT" / "providers"
+    out_dir.mkdir(parents=True, exist_ok=True)
+    router: dict = {"providers": []}
+    for entry in providers:
+        if isinstance(entry, str):
+            entry = {"id": entry, "roles": []}
+        if not isinstance(entry, dict):
+            continue
+        pid = (entry.get("id") or "").strip()
+        if not pid:
+            continue
+        roles = entry.get("roles") or []
+        if not isinstance(roles, list):
+            roles = [str(roles)]
+        router["providers"].append({
+            "id": pid,
+            "roles": [str(r) for r in roles],
+            "enabled": bool(entry.get("enabled", True)),
+            "secret_ref": entry.get("secret_ref") or f"{pid.upper()}_API_KEY",
+        })
+        print(f"  provider {pid}: roles={roles}")
+    target = out_dir / "router.yaml"
+    target.write_text(yaml.safe_dump(router, sort_keys=False, default_flow_style=False))
+    print(f"wrote {target}")
+    return 0
+
+
+def cmd_autonomous(manifest: str, templates_dir: str, target_dir: str) -> int:
+    data = _load_manifest(manifest)
+    agents = data.get("autonomous_agents") or []
+    if not agents:
+        print("no `autonomous_agents:` in manifest — skipping")
+        return 0
+    templates = Path(templates_dir)
+    target = Path(target_dir)
+    target.mkdir(parents=True, exist_ok=True)
+    copied: list[str] = []
+    missing: list[str] = []
+    skipped: list[str] = []
+    for a in agents:
+        if isinstance(a, dict):
+            aid = (a.get("id") or "").strip()
+        else:
+            aid = str(a).strip()
+        if not aid:
+            continue
+        src = templates / f"{aid}.yaml"
+        dst = target / f"{aid}.yaml"
+        if dst.exists():
+            skipped.append(aid)
+            continue
+        if not src.exists():
+            missing.append(aid)
+            continue
+        shutil.copy(src, dst)
+        copied.append(aid)
+    if copied:
+        print(f"  registered charters: {copied}")
+    if skipped:
+        print(f"  charters already present (kept): {skipped}")
+    if missing:
+        print(
+            f"  charters with no template: {missing} — drop a YAML at "
+            f"{target}/<id>.yaml to enable"
+        )
+    return 0
+
+
+def cmd_rag(manifest: str, omega_home: str) -> int:
+    data = _load_manifest(manifest)
+    rag = (data.get("options") or {}).get("rag") or {}
+    if not rag:
+        print("no `options.rag` in manifest — skipping")
+        return 0
+    out_dir = Path(omega_home) / "Agentik_SSOT" / "rag"
+    out_dir.mkdir(parents=True, exist_ok=True)
+    config = {
+        "envelope": rag.get("envelope", "corrective"),
+        "strategies": rag.get("strategies", ["hybrid"]),
+    }
+    target = out_dir / "config.yaml"
+    target.write_text(yaml.safe_dump(config, sort_keys=False, default_flow_style=False))
+    print(f"wrote {target}: {config}")
+    return 0
+
+
+def cmd_init_vault(omega_home: str) -> int:
+    home = Path(omega_home)
+    _engine_on_path(home)
+    try:
+        from omega_engine.vault import vault_init  # type: ignore
+    except ImportError as exc:
+        print(f"vault module unavailable yet (step 30 may not have run): {exc}")
+        return 0
+    info = vault_init(home)
+    backend = info.get("backend", "unknown")
+    if backend == "age":
+        print(f"  vault backend: age (keypair at {info.get('key_path')})")
+    else:
+        print(
+            "  vault backend: plain (chmod 600). Install `age` for encryption — "
+            "e.g. `sudo apt-get install age` then re-run."
+        )
+        if info.get("warning"):
+            print(f"  warning: {info['warning']}")
+    return 0
+
+
+def cmd_accounts(manifest: str, omega_home: str) -> int:
+    """Process the manifest's `accounts:` list — add to pool + write tokens."""
+    data = _load_manifest(manifest)
+    accounts = data.get("accounts") or []
+    if not accounts:
+        print("no `accounts:` in manifest — skipping")
+        return 0
+    home = Path(omega_home)
+    _engine_on_path(home)
+    try:
+        from omega_engine.account import AccountPool, ClaudeAccount, write_token
+    except ImportError as exc:
+        print(f"engine not importable yet: {exc}")
+        return 0
+
+    pool = AccountPool.load(home)
+    n_added = n_with_token = 0
+    for entry in accounts:
+        if isinstance(entry, str):
+            entry = {"id": entry}
+        if not isinstance(entry, dict):
+            continue
+        aid = (entry.get("id") or "").strip()
+        if not aid:
+            continue
+        secret_ref = entry.get("secret_ref") or f"CLAUDE_OAUTH_{aid}"
+        token_env = (entry.get("token_env")
+                     or f"CLAUDE_OAUTH_{aid.replace('-', '_')}")
+        token = os.environ.get(token_env)
+        if token:
+            try:
+                write_token(home, secret_ref, token)
+                n_with_token += 1
+                print(f"  account {aid}: token written from ${token_env}")
+            except Exception as exc:  # noqa: BLE001
+                print(f"  account {aid}: write_token failed: {exc}")
+        else:
+            print(
+                f"  account {aid}: no token in ${token_env} "
+                f"(run `omega account login --id {aid}` later)"
+            )
+
+        if pool.get(aid) is None:
+            pool.add(ClaudeAccount(
+                id=aid,
+                label=str(entry.get("label", f"Claude Max ({aid})")),
+                secret_ref=secret_ref,
+                weight=int(entry.get("weight", 1)),
+                status="active" if token else "resting",
+            ))
+            n_added += 1
+        else:
+            print(f"  account {aid}: already in pool — kept")
+    pool.save(home)
+    print(
+        f"pool saved with {len(pool.accounts)} account(s); "
+        f"{n_added} added, {n_with_token} with tokens"
+    )
+    return 0
+
+
+def cmd_first_project(manifest: str, omega_home: str) -> int:
+    """Create the first project listed under `first_project:`."""
+    data = _load_manifest(manifest)
+    name = ""
+    fp = data.get("first_project")
+    if isinstance(fp, str):
+        name = fp.strip()
+    elif isinstance(fp, dict):
+        name = str(fp.get("name", "")).strip()
+    if not name:
+        print("no `first_project:` in manifest — skipping")
+        return 0
+
+    home = Path(omega_home)
+    _engine_on_path(home)
+    try:
+        from omega_engine.project import create_project, load_projects, slugify
+    except ImportError as exc:
+        print(f"engine not importable yet: {exc}")
+        return 0
+
+    # Set OMEGA_HOME so create_project's default resolves correctly.
+    os.environ["OMEGA_HOME"] = str(home)
+
+    slug = slugify(name)
+    existing = load_projects()
+    if any(getattr(p, "slug", None) == slug for p in existing):
+        print(f"project '{name}' (slug={slug}) already exists — skipping")
+        return 0
+
+    telegram = None
+    try:
+        from omega_engine.telegram import TelegramBridge
+        telegram = TelegramBridge.from_vault()
+    except Exception as exc:  # noqa: BLE001
+        print(f"  (no Telegram topic — {exc})")
+
+    try:
+        project = create_project(name, telegram=telegram)
+    except Exception as exc:  # noqa: BLE001
+        print(f"  project creation failed: {exc}")
+        return 0
+    print(f"created project '{project.name}' (slug={project.slug}) at {project.path}")
+    topic = getattr(project, "topic_id", None)
+    if topic:
+        print(f"  telegram topic: {topic}")
+    return 0
+
+
+def cmd_encrypt_mcp_env(omega_home: str, mcp_id: str) -> int:
+    """Encrypt an mcp-<id>.env file at rest if the vault is age-backed."""
+    home = Path(omega_home)
+    _engine_on_path(home)
+    try:
+        from omega_engine.vault import vault_init, vault_write
+    except ImportError as exc:
+        print(f"vault not available: {exc}")
+        return 0
+    info = vault_init(home)
+    if info.get("backend") != "age":
+        # Plain backend keeps the dotenv file at chmod 600.
+        return 0
+
+    secrets_dir = home / "Agentik_Extra" / "etc" / "secrets"
+    env_file = secrets_dir / f"mcp-{mcp_id}.env"
+    if not env_file.exists():
+        return 0
+    content = env_file.read_text()
+    has_value = any(
+        "=" in ln.strip() and not ln.strip().startswith("#")
+        for ln in content.splitlines()
+    )
+    if not has_value:
+        # Just a placeholder header — leave it on disk; no value to encrypt.
+        return 0
+    try:
+        vault_write(home, f"mcp_{mcp_id}_ENV", content)
+    except Exception as exc:  # noqa: BLE001
+        print(f"encrypt mcp-{mcp_id}.env failed: {exc}")
+        return 0
+    try:
+        env_file.unlink()
+    except OSError:
+        pass
+    print(f"encrypted mcp-{mcp_id}.env → vault (mcp_{mcp_id}_ENV.age)")
+    return 0
+
+
+def cmd_telegram_chat_id(manifest: str, omega_home: str) -> int:
+    """Persist ``telegram.group_chat_id`` from the manifest into the vault."""
+    data = _load_manifest(manifest)
+    tg = data.get("telegram") or {}
+    chat_id = str(tg.get("group_chat_id") or "").strip()
+    if not chat_id:
+        print("no `telegram.group_chat_id` in manifest — skipping")
+        return 0
+    home = Path(omega_home)
+    _engine_on_path(home)
+    try:
+        from omega_engine.vault import vault_write
+    except ImportError as exc:
+        print(f"vault not available: {exc}")
+        return 0
+    try:
+        vault_write(home, "TELEGRAM_GROUP_ID", chat_id)
+    except Exception as exc:  # noqa: BLE001
+        print(f"could not persist chat id: {exc}")
+        return 0
+    print(f"Telegram group_chat_id stored in vault: {chat_id}")
+    return 0
+
+
+def main(argv: list[str]) -> int:
+    if len(argv) < 2:
+        print("usage: manifest-helpers.py <providers|autonomous|rag|init-vault> ...")
+        return 2
+    cmd = argv[1]
+    rest = argv[2:]
+    if cmd == "providers" and len(rest) == 2:
+        return cmd_providers(*rest)
+    if cmd == "autonomous" and len(rest) == 3:
+        return cmd_autonomous(*rest)
+    if cmd == "rag" and len(rest) == 2:
+        return cmd_rag(*rest)
+    if cmd == "init-vault" and len(rest) == 1:
+        return cmd_init_vault(*rest)
+    if cmd == "accounts" and len(rest) == 2:
+        return cmd_accounts(*rest)
+    if cmd == "first-project" and len(rest) == 2:
+        return cmd_first_project(*rest)
+    if cmd == "encrypt-mcp-env" and len(rest) == 2:
+        return cmd_encrypt_mcp_env(*rest)
+    if cmd == "telegram-chat-id" and len(rest) == 2:
+        return cmd_telegram_chat_id(*rest)
+    print(f"bad invocation: {argv}")
+    return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))