@agentshouse/kit 0.1.0-alpha.3 → 0.1.0-alpha.31

package/bin/connect-linux.sh

@@ -6,14 +6,144 @@ NAME='house-kit'
 HOUSE='https://agents.house'
 WORKSPACE="$HOME/AgentsHouse"
 MANUAL=0
+SKILLS=true
 WORKSPACE_SELECTED=0
 HOUSE_SELECTED=0
+FORWARDING=0
+FORWARDED=kit
+FORWARD=()
+UBUNTU_RELEASES=(jammy noble resolute)
+DOCKER_PACKAGES=(docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin)
+CONFLICTING_PACKAGES=(docker.io docker-compose docker-compose-v2 docker-doc docker-buildx podman-docker containerd runc)
+DOCKER_GROUP=0
 
 refuse() {
   printf 'kit_bootstrap_refused: %s\n' "$1" >&2
   exit 1
 }
 
+bind_mount() {
+  local source=${1//\"/\"\"}
+  printf 'type=bind,"src=%s",dst=%s' "$source" "$2"
+}
+
+login_kit() {
+  if [[ " $* " == *' --manual '* ]]; then
+    "${DOCKER_RUN[@]:0:2}" -i "${DOCKER_RUN[@]:2}" login "$@"
+    return
+  fi
+  command -v xdg-open >/dev/null || refuse 'no host browser opener; rerun with --manual'
+  "${DOCKER_RUN[@]}" login "$@" --host-browser | while IFS= read -r line; do
+    if [[ "$line" == 'Open '* ]]; then
+      printf 'Opening House Login in the host browser.\n'
+      xdg-open "${line#Open }" >/dev/null 2>&1 || refuse 'host browser did not open; rerun with --manual'
+    else
+      printf '%s\n' "$line"
+    fi
+  done
+}
+
+start_resident() {
+  local network=()
+  [[ "$HOUSE" == https://* ]] || network=(--network host)
+  docker run -d --name "$NAME" --restart unless-stopped "${network[@]}" --user "$(id -u):$(id -g)" --mount "$KIT_HOME_MOUNT" --mount "$WORKSPACE_MOUNT" --label "agentshouse.house=$HOUSE" --env HOME=/kit-home --env HOUSE_KIT_HOME=/kit-home --env HOUSE_KIT_CONTAINER=1 "$IMAGE" resident >/dev/null
+}
+
+docker() {
+  if ((DOCKER_GROUP)); then
+    sudo -u "$(id -un)" docker "$@"
+  else
+    command docker "$@"
+  fi
+}
+
+elevated() {
+  if ((EUID == 0)); then
+    "$@"
+  else
+    sudo "$@"
+  fi
+}
+
+docker_member() {
+  [[ " $(id -nG "$@") " == *' docker '* ]]
+}
+
+docker_answers() {
+  DOCKER_PLATFORM=$(docker info --format '{{.OSType}}/{{.Architecture}}' 2>/dev/null)
+}
+
+docker_cause() {
+  docker info 2>&1 >/dev/null | tail -n 1
+}
+
+unanswered() {
+  type -P docker >/dev/null || return 0
+  printf '; Docker Engine does not answer: %s' "$(docker_cause)"
+}
+
+installed_packages() {
+  { dpkg-query -W -f='${db:Status-Status} ${Package}\n' "$@" 2>/dev/null || true; } | awk '$1 == "installed" { print $2 }'
+}
+
+install_docker_engine() {
+  printf 'Installing Docker Engine from Docker'\''s apt repository for %s; sudo may ask for your password.\n' "$1"
+  elevated apt-get update -qq >/dev/null || refuse 'apt could not refresh its package lists'
+  elevated apt-get install -y -qq ca-certificates curl >/dev/null || refuse 'apt could not install ca-certificates and curl'
+  elevated install -m 0755 -d /etc/apt/keyrings || refuse '/etc/apt/keyrings could not be created'
+  elevated curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc || refuse 'the Docker apt repository key could not be downloaded'
+  elevated chmod a+r /etc/apt/keyrings/docker.asc || refuse 'the Docker apt repository key could not be made readable'
+  printf 'Types: deb\nURIs: https://download.docker.com/linux/ubuntu\nSuites: %s\nComponents: stable\nArchitectures: %s\nSigned-By: /etc/apt/keyrings/docker.asc\n' "$2" "$(dpkg --print-architecture)" \
+    | elevated tee /etc/apt/sources.list.d/docker.sources >/dev/null || refuse 'the Docker apt repository could not be configured'
+  elevated apt-get update -qq >/dev/null || refuse 'apt could not read the Docker apt repository'
+  elevated apt-get install -y -qq "${DOCKER_PACKAGES[@]}" >/dev/null || refuse 'apt could not install Docker Engine'
+}
+
+establish_docker_engine() {
+  docker_answers && return
+  if ((EUID != 0)) && ! docker_member && docker_member "$(id -un)"; then
+    refuse "$(id -un) joined the docker group after this session began; sign out and back in, then rerun this bootstrap"
+  fi
+  local distribution='' release='' described='this Linux distribution' conflicting present
+  if [[ -r /etc/os-release ]]; then
+    distribution=$(. /etc/os-release && printf '%s' "${ID:-}")
+    release=$(. /etc/os-release && printf '%s' "${UBUNTU_CODENAME:-${VERSION_CODENAME:-}}")
+    described=$(. /etc/os-release && printf '%s' "${PRETTY_NAME:-$described}")
+  fi
+  if ((FORWARDING)); then
+    type -P docker >/dev/null || refuse 'House Kit is not installed; run this bootstrap without arguments first'
+    refuse "Docker Engine does not answer: $(docker_cause)"
+  fi
+  if [[ "$distribution" != ubuntu ]]; then
+    type -P docker >/dev/null || refuse "Docker Engine is not installed on $described; install a working Docker Engine, then rerun this bootstrap"
+    refuse "Docker Engine does not answer on $described: $(docker_cause)"
+  fi
+  [[ " ${UBUNTU_RELEASES[*]} " == *" $release "* ]] || refuse "this bootstrap installs Docker Engine only on Ubuntu 22.04, 24.04 and 26.04 LTS, not $described; install a working Docker Engine, then rerun this bootstrap$(unanswered)"
+  conflicting=$(installed_packages "${CONFLICTING_PACKAGES[@]}" | paste -sd ' ' -)
+  [[ -z "$conflicting" ]] || refuse "the installed packages $conflicting conflict with Docker Engine; remove them or make their Docker Engine work, then rerun this bootstrap$(unanswered)"
+  present=$(installed_packages "${DOCKER_PACKAGES[@]}" | wc -l)
+  ((present == ${#DOCKER_PACKAGES[@]})) || install_docker_engine "$described" "$release"
+  if ! systemctl is-active --quiet docker.service; then
+    printf 'Starting Docker Engine; sudo may ask for your password.\n'
+    elevated systemctl start docker.service || refuse 'Docker Engine could not be started'
+  fi
+  if ((EUID != 0)); then
+    if ! docker_member "$(id -un)"; then
+      printf 'Adding %s to the docker group; it applies from your next sign-in, so this run reaches Docker Engine through sudo.\n' "$(id -un)"
+      elevated usermod -aG docker "$(id -un)" || refuse "$(id -un) could not be added to the docker group"
+    fi
+    docker_member || DOCKER_GROUP=1
+  fi
+  docker_answers || refuse "Docker Engine does not answer: $(docker_cause)"
+}
+
+if [[ "${1:-}" == kit || "${1:-}" == house ]]; then
+  FORWARDING=1
+  FORWARDED="$1"
+  FORWARD=("${@:2}")
+  set --
+fi
+
 while (($#)); do
   case "$1" in
     --workspace|--house)
@@ -33,6 +163,10 @@ while (($#)); do
       MANUAL=1
       shift
       ;;
+    --no-skills)
+      SKILLS=false
+      shift
+      ;;
     *) refuse "unknown argument $1" ;;
   esac
 done
@@ -45,14 +179,17 @@ case "$(uname -m)" in
   *) refuse "unsupported Linux architecture $(uname -m)" ;;
 esac
 [[ "$WORKSPACE" == /* ]] || refuse 'workspace root must be an absolute path'
-command -v docker >/dev/null || refuse 'Docker Engine client is unavailable'
-DOCKER_PLATFORM=$(docker info --format '{{.OSType}}/{{.Architecture}}' 2>/dev/null) || refuse 'Docker Engine is unavailable'
+establish_docker_engine
 case "$DOCKER_PLATFORM" in
   linux/x86_64|linux/amd64) DOCKER_ARCH=amd64 ;;
   linux/aarch64|linux/arm64) DOCKER_ARCH=arm64 ;;
   *) refuse "unsupported Docker Engine platform $DOCKER_PLATFORM" ;;
 esac
 [[ "$DOCKER_ARCH" == "$ARCH" ]] || refuse "host linux/$ARCH does not match Docker Engine linux/$DOCKER_ARCH"
+if ((FORWARDING)); then
+  docker container inspect "$NAME" >/dev/null 2>&1 || refuse 'House Kit is not installed; run this bootstrap without arguments first'
+  WORKSPACE=$(docker inspect --format '{{range .Mounts}}{{if eq .Destination "/agents/house"}}{{.Source}}{{end}}{{end}}' "$NAME")
+fi
 
 umask 077
 KIT_HOME="$HOME/.house-kit"
@@ -65,6 +202,8 @@ for path in "$KIT_HOME" "$WORKSPACE"; do
 done
 KIT_HOME=$(cd "$KIT_HOME" && pwd -P)
 WORKSPACE=$(cd "$WORKSPACE" && pwd -P)
+KIT_HOME_MOUNT=$(bind_mount "$KIT_HOME" /kit-home)
+WORKSPACE_MOUNT=$(bind_mount "$WORKSPACE" /agents/house)
 if [[ -f "$KIT_HOME/credential" || -f "$KIT_HOME/environment" ]] && [[ ! -f "$KIT_HOME/house" ]]; then
   refuse 'stored House origin is missing for an enrolled Environment'
 fi
@@ -76,10 +215,21 @@ if [[ -f "$KIT_HOME/house" ]]; then
   HOUSE="$BOUND_HOUSE"
 fi
 [[ "$HOUSE" == https://* || "$HOUSE" == http://127.0.0.1:* || "$HOUSE" == http://localhost:* ]] || refuse 'House origin must use HTTPS or local loopback HTTP'
-DOCKER_RUN=(docker run --rm --network host --user "$(id -u):$(id -g)" --mount "type=bind,src=$KIT_HOME,dst=/kit-home" --mount "type=bind,src=$WORKSPACE,dst=/agents/house" --env HOME=/kit-home --env HOUSE_KIT_HOME=/kit-home --env HOUSE_KIT_CONTAINER=1 --env "HOUSE_KIT_HOSTNAME=$(hostname)" "$IMAGE")
+if ((FORWARDING == 0)); then
+  if [[ ! -f "$KIT_HOME/kit.json" ]]; then
+    printf '{"availability":"intermittent","execution_authority":"allow","migrators":[],"instances":[],"clients":[],"host":null,"skills":%s}\n' "$SKILLS" > "$KIT_HOME/kit.json"
+  elif grep -Eq '"skills"[[:space:]]*:' "$KIT_HOME/kit.json"; then
+    sed -E -i "s/(\"skills\"[[:space:]]*:[[:space:]]*)(true|false)/\\1$SKILLS/" "$KIT_HOME/kit.json" || refuse 'kit.json could not be updated'
+  else
+    sed -E -i "1s/^([[:space:]]*)\\{/\\1{\"skills\":$SKILLS,/" "$KIT_HOME/kit.json" || refuse 'kit.json could not be updated'
+  fi
+  grep -Eq "\"skills\"[[:space:]]*:[[:space:]]*$SKILLS" "$KIT_HOME/kit.json" || refuse 'kit.json could not be updated'
+fi
+DOCKER_RUN=(docker run --rm --network host --user "$(id -u):$(id -g)" --mount "$KIT_HOME_MOUNT" --mount "$WORKSPACE_MOUNT" --env HOME=/kit-home --env HOUSE_KIT_HOME=/kit-home --env HOUSE_KIT_CONTAINER=1 --env "HOUSE_KIT_HOSTNAME=$(hostname)" "$IMAGE")
 
 if docker container inspect "$NAME" >/dev/null 2>&1; then
-  [[ "$(docker inspect --format '{{.Config.Image}}' "$NAME")" == "$IMAGE" ]] || refuse 'an installed Kit uses a different image; update it explicitly'
+  INSTALLED_IMAGE=$(docker inspect --format '{{.Config.Image}}' "$NAME")
+  ((FORWARDING == 0)) || [[ "$INSTALLED_IMAGE" == "$IMAGE" ]] || refuse 'an installed Kit uses a different image; rerun this bootstrap without arguments to update it'
   [[ "$(docker inspect --format '{{.HostConfig.RestartPolicy.Name}}' "$NAME")" == unless-stopped ]] || refuse 'the installed Kit has a different lifecycle'
   [[ "$(docker inspect --format '{{len .Mounts}}' "$NAME")" == 2 ]] || refuse 'the installed Kit has unexpected mounts'
   [[ "$(docker inspect --format '{{range .Mounts}}{{if eq .Destination "/kit-home"}}{{.Source}}{{end}}{{end}}' "$NAME")" == "$KIT_HOME" ]] || refuse 'the installed Kit uses another Kit home'
@@ -88,7 +238,45 @@ if docker container inspect "$NAME" >/dev/null 2>&1; then
   [[ "$(docker inspect --format '{{range .Mounts}}{{if eq .Destination "/agents/house"}}{{.Type}}/{{.RW}}{{end}}{{end}}' "$NAME")" == bind/true ]] || refuse 'the installed workspace is not a writable bind mount'
   [[ "$(docker inspect --format '{{index .Config.Labels "agentshouse.house"}}' "$NAME")" == "$HOUSE" ]] || refuse 'the installed Kit uses another House origin'
   [[ -f "$KIT_HOME/credential" && -f "$KIT_HOME/environment" && -f "$KIT_HOME/house" ]] || refuse 'the installed Kit has no enrolled authority'
-  "${DOCKER_RUN[@]}" credential check --house "$HOUSE"
+  if ((FORWARDING)); then
+    if [[ "$FORWARDED" == kit && "${FORWARD[0]:-}" == login ]]; then
+      login_kit "${FORWARD[@]:1}"
+      exit 0
+    fi
+    PLACED=()
+    ENTRY=()
+    if [[ "$FORWARDED" == house ]]; then
+      HERE=$(pwd -P)
+      [[ "$HERE" == "$WORKSPACE" || "$HERE" == "$WORKSPACE"/* ]] || refuse "the current directory is outside the workspace $WORKSPACE"
+      PLACED=(--workdir "/agents/house${HERE#"$WORKSPACE"}")
+      ENTRY=(--entrypoint house)
+    fi
+    TERMINAL=()
+    if [[ -t 0 && -t 1 ]]; then TERMINAL=(-t); fi
+    if [[ -t 0 && ! -t 1 ]]; then
+      ECHOED=$(stty -g)
+      trap 'stty "$ECHOED"' EXIT
+      stty -echo
+    fi
+    if [[ "$(docker inspect --format '{{.State.Running}}' "$NAME")" == true ]]; then
+      docker exec -i "${TERMINAL[@]}" "${PLACED[@]}" "$NAME" "$FORWARDED" "${FORWARD[@]}"
+    else
+      "${DOCKER_RUN[@]:0:2}" -i "${TERMINAL[@]}" "${PLACED[@]}" "${ENTRY[@]}" "${DOCKER_RUN[@]:2}" "${FORWARD[@]}"
+    fi
+    exit
+  fi
+  if [[ "$INSTALLED_IMAGE" != "$IMAGE" ]]; then
+    docker pull --quiet --platform "linux/$ARCH" "$IMAGE" >/dev/null
+    if [[ "$(docker inspect --format '{{.State.Running}}' "$NAME")" == true ]]; then
+      docker exec "$NAME" kit resident drain
+    fi
+    docker rm -f "$NAME" >/dev/null
+    rm -f "$KIT_HOME/state/update-drain"
+    start_resident
+    printf 'House Kit updated for Environment %s.\n' "$(cat "$KIT_HOME/environment")"
+    exit 0
+  fi
+  "${DOCKER_RUN[@]}" credential check
   if [[ "$(docker inspect --format '{{.State.Running}}' "$NAME")" == true ]]; then
     printf 'House Kit is already running for Environment %s.\n' "$(cat "$KIT_HOME/environment")"
   else
@@ -100,28 +288,15 @@ fi
 
 docker pull --quiet --platform "linux/$ARCH" "$IMAGE" >/dev/null
 
-if [[ ! -f "$KIT_HOME/kit.json" ]]; then
-  printf '{"availability":"intermittent","execution_authority":"allow","migrators":[],"instances":[],"clients":[],"host":null}\n' > "$KIT_HOME/kit.json"
-fi
-
 if [[ -f "$KIT_HOME/credential" ]]; then
-  "${DOCKER_RUN[@]}" credential check --house "$HOUSE"
+  "${DOCKER_RUN[@]}" credential check
 else
-  if ((MANUAL)); then
-    "${DOCKER_RUN[@]:0:2}" -i "${DOCKER_RUN[@]:2}" login --house "$HOUSE" --manual
-  else
-    command -v xdg-open >/dev/null || refuse 'no host browser opener; rerun with --manual'
-    "${DOCKER_RUN[@]}" login --house "$HOUSE" --host-browser | while IFS= read -r line; do
-      if [[ "$line" == 'Open '* ]]; then
-        printf 'Opening House Login in the host browser.\n'
-        xdg-open "${line#Open }" >/dev/null 2>&1 || refuse 'host browser did not open; rerun with --manual'
-      else
-        printf '%s\n' "$line"
-      fi
-    done
-  fi
+  LOGIN=()
+  if ((HOUSE_SELECTED)); then LOGIN+=(--house "$HOUSE"); fi
+  if ((MANUAL)); then LOGIN+=(--manual); fi
+  login_kit "${LOGIN[@]}"
 fi
 
-"${DOCKER_RUN[@]}" apply --house "$HOUSE"
-docker run -d --name "$NAME" --restart unless-stopped --user "$(id -u):$(id -g)" --mount "type=bind,src=$KIT_HOME,dst=/kit-home" --mount "type=bind,src=$WORKSPACE,dst=/agents/house" --label "agentshouse.house=$HOUSE" --env HOME=/kit-home --env HOUSE_KIT_HOME=/kit-home --env HOUSE_KIT_CONTAINER=1 "$IMAGE" resident --house "$HOUSE" >/dev/null
+"${DOCKER_RUN[@]}" apply
+start_resident
 printf 'House Kit connected for Environment %s.\n' "$(cat "$KIT_HOME/environment")"