@agentshouse/kit 0.0.1 → 0.1.0-alpha.10

package/bin/connect-linux.sh

@@ -0,0 +1,173 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+IMAGE='ghcr.io/agentshouse/kit@sha256:__IMAGE_DIGEST__'
+NAME='house-kit'
+HOUSE='https://agents.house'
+WORKSPACE="$HOME/AgentsHouse"
+MANUAL=0
+WORKSPACE_SELECTED=0
+HOUSE_SELECTED=0
+FORWARDING=0
+FORWARD=()
+
+refuse() {
+  printf 'kit_bootstrap_refused: %s\n' "$1" >&2
+  exit 1
+}
+
+bind_mount() {
+  local source=${1//\"/\"\"}
+  printf 'type=bind,"src=%s",dst=%s' "$source" "$2"
+}
+
+login_kit() {
+  if [[ " $* " == *' --manual '* ]]; then
+    "${DOCKER_RUN[@]:0:2}" -i "${DOCKER_RUN[@]:2}" login "$@"
+    return
+  fi
+  command -v xdg-open >/dev/null || refuse 'no host browser opener; rerun with --manual'
+  "${DOCKER_RUN[@]}" login "$@" --host-browser | while IFS= read -r line; do
+    if [[ "$line" == 'Open '* ]]; then
+      printf 'Opening House Login in the host browser.\n'
+      xdg-open "${line#Open }" >/dev/null 2>&1 || refuse 'host browser did not open; rerun with --manual'
+    else
+      printf '%s\n' "$line"
+    fi
+  done
+}
+
+if [[ "${1:-}" == kit ]]; then
+  FORWARDING=1
+  FORWARD=("${@:2}")
+  set --
+fi
+
+while (($#)); do
+  case "$1" in
+    --workspace|--house)
+      (($# >= 2)) || refuse "$1 requires one value"
+      if [[ "$1" == --workspace ]]; then
+        ((WORKSPACE_SELECTED == 0)) || refuse 'supply exactly one workspace root'
+        WORKSPACE="$2"
+        WORKSPACE_SELECTED=1
+      else
+        ((HOUSE_SELECTED == 0)) || refuse 'supply exactly one House origin'
+        HOUSE="$2"
+        HOUSE_SELECTED=1
+      fi
+      shift 2
+      ;;
+    --manual)
+      MANUAL=1
+      shift
+      ;;
+    *) refuse "unknown argument $1" ;;
+  esac
+done
+
+[[ "$IMAGE" =~ ^ghcr\.io/agentshouse/kit@sha256:[0-9a-f]{64}$ ]] || refuse 'this bootstrap has not been published with an immutable image digest'
+[[ "$(uname -s)" == Linux ]] || refuse "unsupported host $(uname -s); this bootstrap is for Linux"
+case "$(uname -m)" in
+  x86_64|amd64) ARCH=amd64 ;;
+  aarch64|arm64) ARCH=arm64 ;;
+  *) refuse "unsupported Linux architecture $(uname -m)" ;;
+esac
+[[ "$WORKSPACE" == /* ]] || refuse 'workspace root must be an absolute path'
+command -v docker >/dev/null || refuse 'Docker Engine client is unavailable'
+DOCKER_PLATFORM=$(docker info --format '{{.OSType}}/{{.Architecture}}' 2>/dev/null) || refuse 'Docker Engine is unavailable'
+case "$DOCKER_PLATFORM" in
+  linux/x86_64|linux/amd64) DOCKER_ARCH=amd64 ;;
+  linux/aarch64|linux/arm64) DOCKER_ARCH=arm64 ;;
+  *) refuse "unsupported Docker Engine platform $DOCKER_PLATFORM" ;;
+esac
+[[ "$DOCKER_ARCH" == "$ARCH" ]] || refuse "host linux/$ARCH does not match Docker Engine linux/$DOCKER_ARCH"
+if ((FORWARDING)); then
+  docker container inspect "$NAME" >/dev/null 2>&1 || refuse 'House Kit is not installed; run this bootstrap without arguments first'
+  WORKSPACE=$(docker inspect --format '{{range .Mounts}}{{if eq .Destination "/agents/house"}}{{.Source}}{{end}}{{end}}' "$NAME")
+fi
+
+umask 077
+KIT_HOME="$HOME/.house-kit"
+for path in "$KIT_HOME" "$WORKSPACE"; do
+  [[ ! -L "$path" ]] || refuse "$path is a symbolic link"
+  mkdir -p -m 700 "$path" || refuse "$path could not be created"
+  [[ -d "$path" ]] || refuse "$path is not a directory"
+  [[ "$(stat -c %u "$path")" == "$(id -u)" ]] || refuse "$path is not owned by this User"
+  chmod 700 "$path" || refuse "$path could not be owner-protected"
+done
+KIT_HOME=$(cd "$KIT_HOME" && pwd -P)
+WORKSPACE=$(cd "$WORKSPACE" && pwd -P)
+KIT_HOME_MOUNT=$(bind_mount "$KIT_HOME" /kit-home)
+WORKSPACE_MOUNT=$(bind_mount "$WORKSPACE" /agents/house)
+if [[ -f "$KIT_HOME/credential" || -f "$KIT_HOME/environment" ]] && [[ ! -f "$KIT_HOME/house" ]]; then
+  refuse 'stored House origin is missing for an enrolled Environment'
+fi
+if [[ -f "$KIT_HOME/house" ]]; then
+  IFS= read -r BOUND_HOUSE < "$KIT_HOME/house" || refuse 'stored House origin is unreadable'
+  if ((HOUSE_SELECTED)) && [[ "$HOUSE" != "$BOUND_HOUSE" ]]; then
+    refuse 'this Environment is bound to another House origin'
+  fi
+  HOUSE="$BOUND_HOUSE"
+fi
+[[ "$HOUSE" == https://* || "$HOUSE" == http://127.0.0.1:* || "$HOUSE" == http://localhost:* ]] || refuse 'House origin must use HTTPS or local loopback HTTP'
+DOCKER_RUN=(docker run --rm --network host --user "$(id -u):$(id -g)" --mount "$KIT_HOME_MOUNT" --mount "$WORKSPACE_MOUNT" --env HOME=/kit-home --env HOUSE_KIT_HOME=/kit-home --env HOUSE_KIT_CONTAINER=1 --env "HOUSE_KIT_HOSTNAME=$(hostname)" "$IMAGE")
+
+if docker container inspect "$NAME" >/dev/null 2>&1; then
+  [[ "$(docker inspect --format '{{.Config.Image}}' "$NAME")" == "$IMAGE" ]] || refuse 'an installed Kit uses a different image; update it explicitly'
+  [[ "$(docker inspect --format '{{.HostConfig.RestartPolicy.Name}}' "$NAME")" == unless-stopped ]] || refuse 'the installed Kit has a different lifecycle'
+  [[ "$(docker inspect --format '{{len .Mounts}}' "$NAME")" == 2 ]] || refuse 'the installed Kit has unexpected mounts'
+  [[ "$(docker inspect --format '{{range .Mounts}}{{if eq .Destination "/kit-home"}}{{.Source}}{{end}}{{end}}' "$NAME")" == "$KIT_HOME" ]] || refuse 'the installed Kit uses another Kit home'
+  [[ "$(docker inspect --format '{{range .Mounts}}{{if eq .Destination "/kit-home"}}{{.Type}}/{{.RW}}{{end}}{{end}}' "$NAME")" == bind/true ]] || refuse 'the installed Kit home is not a writable bind mount'
+  [[ "$(docker inspect --format '{{range .Mounts}}{{if eq .Destination "/agents/house"}}{{.Source}}{{end}}{{end}}' "$NAME")" == "$WORKSPACE" ]] || refuse 'the installed Kit uses another workspace root'
+  [[ "$(docker inspect --format '{{range .Mounts}}{{if eq .Destination "/agents/house"}}{{.Type}}/{{.RW}}{{end}}{{end}}' "$NAME")" == bind/true ]] || refuse 'the installed workspace is not a writable bind mount'
+  [[ "$(docker inspect --format '{{index .Config.Labels "agentshouse.house"}}' "$NAME")" == "$HOUSE" ]] || refuse 'the installed Kit uses another House origin'
+  [[ -f "$KIT_HOME/credential" && -f "$KIT_HOME/environment" && -f "$KIT_HOME/house" ]] || refuse 'the installed Kit has no enrolled authority'
+  if ((FORWARDING)); then
+    if [[ "${FORWARD[0]:-}" == login ]]; then
+      login_kit "${FORWARD[@]:1}"
+      exit 0
+    fi
+    TERMINAL=()
+    if [[ -t 0 && -t 1 ]]; then TERMINAL=(-t); fi
+    if [[ -t 0 && ! -t 1 ]]; then
+      ECHOED=$(stty -g)
+      trap 'stty "$ECHOED"' EXIT
+      stty -echo
+    fi
+    if [[ "$(docker inspect --format '{{.State.Running}}' "$NAME")" == true ]]; then
+      docker exec -i "${TERMINAL[@]}" "$NAME" kit "${FORWARD[@]}"
+    else
+      "${DOCKER_RUN[@]:0:2}" -i "${TERMINAL[@]}" "${DOCKER_RUN[@]:2}" "${FORWARD[@]}"
+    fi
+    exit
+  fi
+  "${DOCKER_RUN[@]}" credential check --house "$HOUSE"
+  if [[ "$(docker inspect --format '{{.State.Running}}' "$NAME")" == true ]]; then
+    printf 'House Kit is already running for Environment %s.\n' "$(cat "$KIT_HOME/environment")"
+  else
+    docker start "$NAME" >/dev/null
+    printf 'House Kit restarted for Environment %s.\n' "$(cat "$KIT_HOME/environment")"
+  fi
+  exit 0
+fi
+
+docker pull --quiet --platform "linux/$ARCH" "$IMAGE" >/dev/null
+
+if [[ ! -f "$KIT_HOME/kit.json" ]]; then
+  printf '{"availability":"intermittent","execution_authority":"allow","migrators":[],"instances":[],"clients":[],"host":null}\n' > "$KIT_HOME/kit.json"
+fi
+
+if [[ -f "$KIT_HOME/credential" ]]; then
+  "${DOCKER_RUN[@]}" credential check --house "$HOUSE"
+else
+  if ((MANUAL)); then
+    login_kit --house "$HOUSE" --manual
+  else
+    login_kit --house "$HOUSE"
+  fi
+fi
+
+"${DOCKER_RUN[@]}" apply --house "$HOUSE"
+docker run -d --name "$NAME" --restart unless-stopped --user "$(id -u):$(id -g)" --mount "$KIT_HOME_MOUNT" --mount "$WORKSPACE_MOUNT" --label "agentshouse.house=$HOUSE" --env HOME=/kit-home --env HOUSE_KIT_HOME=/kit-home --env HOUSE_KIT_CONTAINER=1 "$IMAGE" resident --house "$HOUSE" >/dev/null
+printf 'House Kit connected for Environment %s.\n' "$(cat "$KIT_HOME/environment")"