@agentshouse/kit 0.1.0-alpha.40 → 0.1.0-alpha.42

package/README.md

@@ -13,20 +13,20 @@ The Skill set Kit installs is Matt Pocock's
 Linux (`amd64`, `arm64`) or macOS (Apple silicon, Intel):
 
 ```sh
-bash <(curl -fsSL https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.40/connect-linux.sh)
+bash <(curl -fsSL https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.42/connect-linux.sh)
 ```
 
 Windows 11 (`amd64`), in PowerShell:
 
 ```powershell
-& ([scriptblock]::Create((irm https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.40/connect-windows.ps1)))
+& ([scriptblock]::Create((irm https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.42/connect-windows.ps1)))
 ```
 
-The command sets up Docker if it is missing, creates `~/.house-kit` (Kit home)
-and `~/AgentsHouse` (your workspace), signs this computer in to House in your
-browser, and starts Kit in a container that comes back after a restart. Running
-it again is safe: it continues where it stopped. Running a newer release's
-command is the update.
+The command sets up Docker if it is missing, creates `~/.house-kit` (Kit home;
+on Windows the Docker volume `house-kit-home`) and `~/AgentsHouse` (your
+workspace), signs this computer in to House in your browser, and starts Kit in
+a container that comes back after a restart. Running it again is safe: it
+continues where it stopped. Running a newer release's command is the update.
 
 Options:
 

package/bin/connect-windows.ps1

@@ -3,6 +3,8 @@ $ProgressPreference = 'SilentlyContinue'
 
 $Image = 'ghcr.io/agentshouse/kit@sha256:__IMAGE_DIGEST__'
 $Name = 'house-kit'
+$KitHome = 'house-kit-home'
+$KitHomeMount = "type=volume,src=$KitHome,dst=/kit-home"
 $BootstrapArguments = @($args | ForEach-Object { [string]$_ })
 $MinimumBuild = 22631
 $MinimumWsl = [version]'2.1.5'
@@ -180,8 +182,25 @@ function Protect-Directory([string] $Path) {
   $item.FullName.TrimEnd('\')
 }
 
-function Write-Text([string] $Path, [string] $Text) {
-  [IO.File]::WriteAllText($Path, $Text, (New-Object Text.UTF8Encoding($false)))
+function Invoke-KitHome([string] $Failure, [string] $Script) {
+  $ErrorActionPreference = 'Continue'
+  $output = @($input | & docker run -i --rm --network none --mount $KitHomeMount --entrypoint sh $Image -c $Script 2>&1 | ForEach-Object { "$_" })
+  if ($LASTEXITCODE -ne 0) { Stop-Bootstrap "${Failure}: $(@($output | Where-Object { $_ })[-1])" }
+  $output
+}
+
+function Read-KitHome {
+  $files = @{}
+  $listed = Invoke-KitHome 'the Kit home could not be read' 'cd /kit-home && for name in environment house kit.json; do if [ -f $name ]; then echo $name $(base64 -w 0 $name); fi; done && if [ -f credential ]; then echo credential; fi'
+  foreach ($line in @($listed | Where-Object { $_ -match '^(credential|environment|house|kit\.json)( [A-Za-z0-9+/=]+)?$' })) {
+    $file, $encoded = $line -split ' ', 2
+    $files[$file] = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("$encoded"))
+  }
+  $files
+}
+
+function Write-KitHome([string] $File, [string] $Text) {
+  [void]([Convert]::ToBase64String((New-Object Text.UTF8Encoding($false)).GetBytes($Text)) | Invoke-KitHome "$File could not be updated" "umask 077 && base64 -di > /kit-home/$File")
 }
 
 function Read-Inspect([string] $Format) {
@@ -284,49 +303,43 @@ function Connect-Kit {
   if ($docker.Platform -ne 'linux/x86_64' -and $docker.Platform -ne 'linux/amd64') { Stop-Bootstrap "host linux/amd64 does not match Docker Desktop $($docker.Platform)" }
   if ($Forwarding) {
     if (-not (Test-Container)) { Stop-Bootstrap 'House Kit is not installed; run this bootstrap without arguments first' }
+    if ((Read-Inspect '{{.Config.Image}}') -cne $Image) { Stop-Bootstrap 'an installed Kit uses a different image; rerun this bootstrap without arguments to update it' }
     $Workspace = Read-Source '/agents/house'
     if ($Workspace -notmatch '^[A-Za-z]:\\' -or -not (Test-Path -LiteralPath $Workspace -PathType Container)) {
       Stop-Bootstrap "the installed Kit's workspace root $Workspace is not a directory on this computer; rerun this bootstrap without arguments"
     }
+  } else {
+    Invoke-Docker volume create $KitHome | Out-Null
+    if ((Invoke-Native docker @('image', 'inspect', '--format', '{{.Id}}', $Image)).Status -ne 0) { Invoke-Docker pull --quiet --platform linux/amd64 $Image | Out-Null }
   }
   if (-not $Workspace) { $Workspace = Join-Path $env:USERPROFILE 'AgentsHouse' }
 
   $User = [Security.Principal.WindowsIdentity]::GetCurrent().User
-  $kitHome = Protect-Directory (Join-Path $env:USERPROFILE '.house-kit')
   $Workspace = Protect-Directory $Workspace
-  $KitHomeMount = "type=bind,src=$kitHome,dst=/kit-home"
   $WorkspaceMount = "type=bind,src=$Workspace,dst=/agents/house"
-  $credential = Join-Path $kitHome 'credential'
-  $environment = Join-Path $kitHome 'environment'
-  $bound = Join-Path $kitHome 'house'
-  $configuration = Join-Path $kitHome 'kit.json'
-  if (((Test-Path -LiteralPath $credential) -or (Test-Path -LiteralPath $environment)) -and -not (Test-Path -LiteralPath $bound)) {
+  $stored = Read-KitHome
+  if (($stored.ContainsKey('credential') -or $stored.ContainsKey('environment')) -and -not $stored.ContainsKey('house')) {
     Stop-Bootstrap 'stored House origin is missing for an enrolled Environment'
   }
-  if (Test-Path -LiteralPath $bound) {
-    $boundHouse = @([IO.File]::ReadAllLines($bound))
-    if ($boundHouse.Count -eq 0) { Stop-Bootstrap 'stored House origin is unreadable' }
-    if ($HouseSelected -and $House -cne $boundHouse[0]) { Stop-Bootstrap 'this Environment is bound to another House origin' }
-    $House = $boundHouse[0]
+  if ($stored.ContainsKey('house')) {
+    $boundHouse = @($stored['house'] -split '\r?\n')[0]
+    if (-not $boundHouse) { Stop-Bootstrap 'stored House origin is unreadable' }
+    if ($HouseSelected -and $House -cne $boundHouse) { Stop-Bootstrap 'this Environment is bound to another House origin' }
+    $House = $boundHouse
   }
   if ($House -notmatch '^(https://|http://127\.0\.0\.1:|http://localhost:)') { Stop-Bootstrap 'House origin must use HTTPS or local loopback HTTP' }
   if (-not $Forwarding) {
-    try {
-      if (-not (Test-Path -LiteralPath $configuration)) {
-        Write-Text $configuration "{`"availability`":`"intermittent`",`"execution_authority`":`"allow`",`"migrators`":[],`"instances`":[],`"clients`":[],`"host`":null,`"skills`":$Skills}`n"
+    $text = "{`"availability`":`"intermittent`",`"execution_authority`":`"allow`",`"migrators`":[],`"instances`":[],`"clients`":[],`"host`":null,`"skills`":$Skills}`n"
+    if ($stored.ContainsKey('kit.json')) {
+      $text = $stored['kit.json']
+      if ($text -match '"skills"\s*:') {
+        $text = $text -replace '("skills"\s*:\s*)(true|false)', "`${1}$Skills"
       } else {
-        $text = [IO.File]::ReadAllText($configuration)
-        if ($text -match '"skills"\s*:') {
-          $text = $text -replace '("skills"\s*:\s*)(true|false)', "`${1}$Skills"
-        } else {
-          $text = $text -replace '^(\s*)\{', "`${1}{`"skills`":$Skills,"
-        }
-        Write-Text $configuration $text
+        $text = $text -replace '^(\s*)\{', "`${1}{`"skills`":$Skills,"
       }
-    } catch {
-      Stop-Bootstrap 'kit.json could not be updated'
     }
-    if ([IO.File]::ReadAllText($configuration) -notmatch "`"skills`"\s*:\s*$Skills") { Stop-Bootstrap 'kit.json could not be updated' }
+    if ($text -notmatch "`"skills`"\s*:\s*$Skills") { Stop-Bootstrap 'kit.json could not be updated' }
+    Write-KitHome 'kit.json' $text
   }
   $Network = @('--network', 'host')
   $Published = @()
@@ -339,15 +352,14 @@ function Connect-Kit {
 
   if (Test-Container) {
     $installed = Read-Inspect '{{.Config.Image}}'
-    if ($Forwarding -and $installed -cne $Image) { Stop-Bootstrap 'an installed Kit uses a different image; rerun this bootstrap without arguments to update it' }
     if ((Read-Inspect '{{.HostConfig.RestartPolicy.Name}}') -cne 'unless-stopped') { Stop-Bootstrap 'the installed Kit has a different lifecycle' }
     if ((Read-Inspect '{{len .Mounts}}') -cne '2') { Stop-Bootstrap 'the installed Kit has unexpected mounts' }
-    if ((Read-Source '/kit-home') -ine $kitHome) { Stop-Bootstrap 'the installed Kit uses another Kit home' }
-    if ((Read-Inspect '{{range .Mounts}}{{if eq .Destination `/kit-home`}}{{.Type}}/{{.RW}}{{end}}{{end}}') -cne 'bind/true') { Stop-Bootstrap 'the installed Kit home is not a writable bind mount' }
+    if ((Read-Inspect '{{range .Mounts}}{{if eq .Destination `/kit-home`}}{{.Name}}{{end}}{{end}}') -cne $KitHome) { Stop-Bootstrap 'the installed Kit uses another Kit home' }
+    if ((Read-Inspect '{{range .Mounts}}{{if eq .Destination `/kit-home`}}{{.Type}}/{{.RW}}{{end}}{{end}}') -cne 'volume/true') { Stop-Bootstrap 'the installed Kit home is not a writable volume' }
     if ((Read-Source '/agents/house') -ine $Workspace) { Stop-Bootstrap 'the installed Kit uses another workspace root' }
     if ((Read-Inspect '{{range .Mounts}}{{if eq .Destination `/agents/house`}}{{.Type}}/{{.RW}}{{end}}{{end}}') -cne 'bind/true') { Stop-Bootstrap 'the installed workspace is not a writable bind mount' }
     if ((Read-Inspect '{{index .Config.Labels `agentshouse.house`}}') -cne $House) { Stop-Bootstrap 'the installed Kit uses another House origin' }
-    if (-not ((Test-Path -LiteralPath $credential) -and (Test-Path -LiteralPath $environment) -and (Test-Path -LiteralPath $bound))) { Stop-Bootstrap 'the installed Kit has no enrolled authority' }
+    if (-not ($stored.ContainsKey('credential') -and $stored.ContainsKey('environment') -and $stored.ContainsKey('house'))) { Stop-Bootstrap 'the installed Kit has no enrolled authority' }
     if ($Forwarding) {
       if ($Forwarded -ceq 'kit' -and $Forward.Count -gt 0 -and $Forward[0] -ceq 'login') {
         Invoke-Login @($Forward | Select-Object -Skip 1)
@@ -373,26 +385,24 @@ function Connect-Kit {
       Exit-Bootstrap $LASTEXITCODE
     }
     if ($installed -cne $Image) {
-      Invoke-Docker pull --quiet --platform linux/amd64 $Image | Out-Null
       if ((Read-Inspect '{{.State.Running}}') -ceq 'true') { Invoke-Docker exec $Name kit resident drain }
       Invoke-Docker rm -f $Name | Out-Null
-      Remove-Item -LiteralPath (Join-Path $kitHome 'state\update-drain') -Force -ErrorAction SilentlyContinue
+      [void](Invoke-KitHome 'the Kit home could not be updated' 'rm -f /kit-home/state/update-drain')
       Start-Resident
-      Write-Host "House Kit updated for Environment $([IO.File]::ReadAllText($environment).Trim())."
+      Write-Host "House Kit updated for Environment $($stored['environment'].Trim())."
       return
     }
     Invoke-Docker run --rm @Network @Common credential check
     if ((Read-Inspect '{{.State.Running}}') -ceq 'true') {
-      Write-Host "House Kit is already running for Environment $([IO.File]::ReadAllText($environment).Trim())."
+      Write-Host "House Kit is already running for Environment $($stored['environment'].Trim())."
     } else {
       Invoke-Docker start $Name | Out-Null
-      Write-Host "House Kit restarted for Environment $([IO.File]::ReadAllText($environment).Trim())."
+      Write-Host "House Kit restarted for Environment $($stored['environment'].Trim())."
     }
     return
   }
 
-  Invoke-Docker pull --quiet --platform linux/amd64 $Image | Out-Null
-  if (Test-Path -LiteralPath $credential) {
+  if ($stored.ContainsKey('credential')) {
     Invoke-Docker run --rm @Network @Common credential check
   } else {
     $login = @()
@@ -402,7 +412,7 @@ function Connect-Kit {
   }
   Invoke-Docker run --rm @Network @Common apply
   Start-Resident
-  Write-Host "House Kit connected for Environment $([IO.File]::ReadAllText($environment).Trim())."
+  Write-Host "House Kit connected for Environment $((Read-KitHome)['environment'].Trim())."
 }
 
 $consoleEncoding = [Console]::OutputEncoding

package/bootstrap.json

@@ -1,12 +1,12 @@
 {
   "schemaVersion": 1,
-  "version": "0.1.0-alpha.40",
+  "version": "0.1.0-alpha.42",
   "hosts": {
     "linux": {
-      "command": "bash <(curl -fsSL https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.40/connect-linux.sh)",
+      "command": "bash <(curl -fsSL https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.42/connect-linux.sh)",
       "asset": {
         "name": "connect-linux.sh",
-        "url": "https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.40/connect-linux.sh"
+        "url": "https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.42/connect-linux.sh"
       },
       "workspace": {
         "argument": "--workspace",
@@ -14,10 +14,10 @@
       }
     },
     "windows": {
-      "command": "& ([scriptblock]::Create((irm https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.40/connect-windows.ps1)))",
+      "command": "& ([scriptblock]::Create((irm https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.42/connect-windows.ps1)))",
       "asset": {
         "name": "connect-windows.ps1",
-        "url": "https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.40/connect-windows.ps1"
+        "url": "https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.42/connect-windows.ps1"
       },
       "workspace": {
         "argument": "--workspace",

package/docs/windows.md

@@ -19,12 +19,13 @@ on `amd64`. Windows Server, Windows 10 and Windows on ARM are refused.
 
 ## What it creates
 
-- `%USERPROFILE%\.house-kit`: Kit home.
+- The Docker volume `house-kit-home`: Kit home, with your credential and
+  `kit.json`, mounted in the container as `/kit-home`. It lives on Docker
+  Desktop's own WSL 2 disk, not on your Windows drive. Docker Desktop's
+  Volumes view shows its files; double-click `kit.json` there to edit it.
 - `%USERPROFILE%\AgentsHouse`: your workspace. Pass
-  `--workspace 'D:\Agents'` to use another directory.
-
-Both are restricted to your Windows account. A path containing a comma is
-refused.
+  `--workspace 'D:\Agents'` to use another directory. It is restricted to your
+  Windows account, and a path containing a comma is refused.
 
 ## Notes
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentshouse/kit",
-  "version": "0.1.0-alpha.40",
+  "version": "0.1.0-alpha.42",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/workspace.js

@@ -401,7 +401,7 @@ async function placeReplacement(host, settings, identity, held, running) {
 }
 
 async function rollBack(host, identity, running, cause) {
-  const unrestored = await restorePrevious(host, identity);
+  const unrestored = await restorePrevious(host, identity, true);
   if (unrestored !== null) return `${cause}, and ${unrestored}`;
   if (!running) return cause;
   const restarted = await docker(host, ["start", identity]);
@@ -409,10 +409,16 @@ async function rollBack(host, identity, running, cause) {
   return `${cause}, and the workspace did not start again: ${restarted.stderr.trim()}`;
 }
 
-async function restorePrevious(host, identity) {
+async function restorePrevious(host, identity, rollingBack = false) {
   const previous = previousName(identity);
   if ((await workspacePresent(host, previous)) === null) return null;
-  if ((await workspacePresent(host, identity)) !== null) {
+  const current = await workspacePresent(host, identity);
+  if (current === "running" && !rollingBack) {
+    const removed = await docker(host, ["rm", "--force", previous]);
+    if (removed.status !== 0) return `the previous workspace was not removed: ${removed.stderr.trim()}`;
+    return null;
+  }
+  if (current !== null) {
     const discarded = await docker(host, ["rm", "--force", identity]);
     if (discarded.status !== 0) {
       return `the replacement was not removed: ${discarded.stderr.trim()}`;