@cyanautomation/kaseki-agent 1.4.1

package/scripts/kaseki-container-entrypoint-wrapper.sh

@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+#
+# kaseki-container-entrypoint-wrapper.sh — Credential handling helper
+#
+# Internal helper used by docker-entrypoint.sh to safely handle credentials
+# in container entry point modes (setup, run-mode, etc).
+#
+# Not directly invoked by users; called from docker-entrypoint.sh
+
+set -euo pipefail
+
+# Securely handle credentials from environment variable
+# Args: <env_var_name> <target_file> [mode]
+handle_env_credential() {
+  local env_var="$1"
+  local target_file="$2"
+  local mode="${3:-600}"
+  
+  # Read from environment
+  local credential="${!env_var:-}"
+  
+  if [ -z "$credential" ]; then
+    echo "Error: $env_var environment variable is empty" >&2
+    return 1
+  fi
+  
+  # Ensure directory exists
+  mkdir -p "$(dirname "$target_file")"
+  
+  # Write to file with restricted permissions
+  # Using a temp file first to avoid truncation on error
+  local temp_file="$target_file.tmp.$$"
+  echo "$credential" > "$temp_file"
+  chmod "$mode" "$temp_file"
+  mv "$temp_file" "$target_file"
+  
+  # Clear environment variable (security: avoid exposure in process list)
+  export "${env_var}="
+  
+  return 0
+}
+
+# Verify credential file exists and is readable
+verify_credential() {
+  local credential_file="$1"
+  local description="${2:-Credential}"
+  
+  if [ ! -f "$credential_file" ]; then
+    echo "Error: $description file not found: $credential_file" >&2
+    return 1
+  fi
+  
+  if [ ! -r "$credential_file" ]; then
+    echo "Error: $description file not readable: $credential_file" >&2
+    return 1
+  fi
+  
+  return 0
+}
+
+# Check if credential file has valid format
+validate_credential_format() {
+  local credential_file="$1"
+  local pattern="$2"  # regex pattern to match
+  
+  if ! grep -q "$pattern" "$credential_file" 2>/dev/null; then
+    echo "Error: Credential file has invalid format" >&2
+    return 1
+  fi
+  
+  return 0
+}
+
+# Export credential as environment variable for child processes
+# (only for backward compatibility; prefer file-based approach)
+export_credential_env() {
+  local credential_file="$1"
+  local env_var_name="$2"
+  
+  if [ ! -f "$credential_file" ]; then
+    echo "Error: Credential file not found: $credential_file" >&2
+    return 1
+  fi
+  
+  local credential
+  credential=$(<"$credential_file")
+  export "$env_var_name=$credential"
+  
+  return 0
+}
+
+# Main router: called from docker-entrypoint.sh
+case "${1:-}" in
+  handle-env)
+    shift
+    handle_env_credential "$@"
+    ;;
+  verify)
+    shift
+    verify_credential "$@"
+    ;;
+  validate-format)
+    shift
+    validate_credential_format "$@"
+    ;;
+  export-env)
+    shift
+    export_credential_env "$@"
+    ;;
+  *)
+    echo "Usage: $0 <command> [args]"
+    echo "Commands:"
+    echo "  handle-env <env_var> <target_file> [mode]     # Read from env, write to file"
+    echo "  verify <file> [description]                    # Verify file exists and readable"
+    echo "  validate-format <file> <regex>                 # Validate file content format"
+    echo "  export-env <file> <env_var>                    # Export file to env var"
+    exit 1
+    ;;
+esac

package/scripts/kaseki-container-setup-remote.sh

@@ -0,0 +1,172 @@
+#!/usr/bin/env bash
+#
+# kaseki-container-setup-remote.sh — Remote host setup orchestrator
+#
+# This script runs INSIDE the kaseki-agent container to orchestrate
+# setup of remote Pi/host instances via SSH.
+#
+# It:
+# 1. Validates SSH connectivity
+# 2. Securely transfers API key
+# 3. Triggers setup on remote host (via Docker or script)
+# 4. Validates remote readiness
+#
+# Entry point: docker run kaseki-agent setup-remote <host> <api-key>
+
+set -euo pipefail
+
+# Colors
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+# Helpers
+print_header() { echo -e "${BLUE}=== $1 ===${NC}"; }
+print_success() { echo -e "${GREEN}✓ $1${NC}"; }
+print_error() { echo -e "${RED}✗ $1${NC}" >&2; }
+print_warning() { echo -e "${YELLOW}⚠ $1${NC}"; }
+
+# Argument validation
+if [ $# -lt 2 ]; then
+  echo "Usage: $0 <remote-host> <api-key-or-file>"
+  echo ""
+  echo "Examples:"
+  echo "  $0 pi@192.168.88.201 sk-or-v1-your-key"
+  echo "  $0 pi@192.168.88.201 /path/to/api-key-file"
+  echo ""
+  exit 1
+fi
+
+REMOTE_HOST="$1"
+API_KEY_SOURCE="$2"
+
+# Resolve API key
+if [ -f "$API_KEY_SOURCE" ]; then
+  # It's a file
+  API_KEY=$(<"$API_KEY_SOURCE")
+elif [[ "$API_KEY_SOURCE" =~ ^sk-or ]]; then
+  # It's an inline key
+  API_KEY="$API_KEY_SOURCE"
+else
+  print_error "Invalid API key source: must be a file or start with 'sk-or'"
+  exit 1
+fi
+
+# Validate key format
+if [[ ! "$API_KEY" =~ ^sk-or ]]; then
+  print_error "Invalid API key format: must start with 'sk-or'"
+  exit 1
+fi
+
+main() {
+  echo ""
+  echo "╔════════════════════════════════════════════════════════════╗"
+  echo "║    Kaseki Agent - Remote Setup Orchestrator                 ║"
+  echo "╚════════════════════════════════════════════════════════════╝"
+  echo ""
+  
+  print_header "Configuration"
+  echo "Remote host: $REMOTE_HOST"
+  echo ""
+  
+  # Step 1: SSH connectivity check
+  print_header "SSH Connectivity Check"
+  if ssh -o ConnectTimeout=5 "$REMOTE_HOST" "echo 'OK'" >/dev/null 2>&1; then
+    print_success "SSH connectivity to $REMOTE_HOST verified"
+  else
+    print_error "Cannot connect to $REMOTE_HOST via SSH"
+    print_warning "Make sure:"
+    print_warning "  1. Host is reachable"
+    print_warning "  2. SSH keys are configured"
+    print_warning "  3. User has permission"
+    exit 1
+  fi
+  echo ""
+  
+  # Step 2: Create secrets directory on remote
+  print_header "Creating Secrets Directory on Remote Host"
+  if ssh "$REMOTE_HOST" "
+    mkdir -p ~/.kaseki/secrets
+    chmod 700 ~/.kaseki/secrets
+    [ -d ~/.kaseki/secrets ] && echo 'Secrets directory created'
+  " >/dev/null 2>&1; then
+    print_success "Secrets directory created on $REMOTE_HOST"
+  else
+    print_error "Failed to create secrets directory on remote host"
+    exit 1
+  fi
+  echo ""
+  
+  # Step 3: Transfer API key securely via SSH
+  print_header "Transferring OpenRouter API Key Securely"
+  if echo "$API_KEY" | ssh "$REMOTE_HOST" "
+    cat > ~/.kaseki/secrets/openrouter_api_key
+    chmod 600 ~/.kaseki/secrets/openrouter_api_key
+    [ -f ~/.kaseki/secrets/openrouter_api_key ] && echo 'API key transferred'
+  " >/dev/null 2>&1; then
+    print_success "API key transferred and secured on $REMOTE_HOST"
+  else
+    print_error "Failed to transfer API key to remote host"
+    exit 1
+  fi
+  echo ""
+  
+  # Step 4: Try Docker-based setup on remote (if Docker available)
+  print_header "Attempting Remote Setup"
+  
+  # Check if Docker is available on remote
+  if ssh "$REMOTE_HOST" "command -v docker >/dev/null 2>&1" >/dev/null 2>&1; then
+    print_success "Docker available on remote host"
+    
+    # Try to pull image and run setup
+    echo "Pulling kaseki-agent image on remote host (may take a few minutes)..."
+    if ssh "$REMOTE_HOST" "
+      docker pull docker.io/cyanautomation/kaseki-agent:latest >/dev/null 2>&1 && \
+      docker run -it \
+        -v ~/.kaseki/secrets:/secrets \
+        -v /var/run/docker.sock:/var/run/docker.sock \
+        docker.io/cyanautomation/kaseki-agent:latest \
+        doctor >/dev/null 2>&1
+    " 2>&1 | tail -10; then
+      print_success "Docker-based setup successful on $REMOTE_HOST"
+    else
+      print_warning "Docker-based setup had issues. Continuing..."
+    fi
+  else
+    print_warning "Docker not available on $REMOTE_HOST"
+    print_warning "Manual setup required. Guide:"
+    echo ""
+    echo "  SSH to $REMOTE_HOST and run:"
+    echo "    mkdir -p ~/.kaseki/secrets"
+    echo "    chmod 700 ~/.kaseki/secrets"
+    echo "    curl -fsSL https://raw.githubusercontent.com/CyanAutomation/kaseki-agent/main/scripts/kaseki-install.sh | KASEKI_CONTROLLER_MODE=1 KASEKI_REPLACE_STALE=1 sh"
+    echo ""
+  fi
+  echo ""
+  
+  # Final status
+  echo "╔════════════════════════════════════════════════════════════╗"
+  echo -e "${GREEN}║      Setup Complete for $REMOTE_HOST! ✓${NC}"
+  echo "╚════════════════════════════════════════════════════════════╝"
+  echo ""
+  echo "Next steps:"
+  echo "  1. Verify readiness on remote host:"
+  echo "     ssh $REMOTE_HOST 'docker run -v ~/.kaseki/secrets:/secrets docker.io/cyanautomation/kaseki-agent:latest doctor'"
+  echo ""
+  echo "  2. Run your first task on remote host:"
+  echo "     ssh $REMOTE_HOST '"
+  echo "       docker run -it \\"
+  echo "         -v ~/.kaseki/secrets:/secrets \\"
+  echo "         -v /var/run/docker.sock:/var/run/docker.sock \\"
+  echo "         docker.io/cyanautomation/kaseki-agent:latest \\"
+  echo "         agent https://github.com/your-org/your-repo main"
+  echo "     '"
+  echo ""
+  echo "  3. For additional hosts:"
+  echo "     docker run kaseki-agent setup-remote pi@192.168.88.202 \$(cat ~/.kaseki/secrets/openrouter_api_key)"
+  echo ""
+}
+
+main "$@"

package/scripts/kaseki-container-setup.sh

@@ -0,0 +1,193 @@
+#!/usr/bin/env bash
+#
+# kaseki-container-setup.sh — Setup wizard inside the container
+#
+# This script runs INSIDE the kaseki-agent container during setup mode.
+# It:
+# 1. Securely prompts for OpenRouter API key (or accepts from env var)
+# 2. Creates /secrets directory with proper permissions
+# 3. Validates the API key
+# 4. Runs health checks
+#
+# Entry point: docker run -it kaseki-agent setup
+# Or: docker run -e OPENROUTER_API_KEY=sk-or-... kaseki-agent setup
+
+set -euo pipefail
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+# Helper functions
+print_header() {
+  echo -e "${BLUE}=== $1 ===${NC}"
+}
+
+print_success() {
+  echo -e "${GREEN}✓ $1${NC}"
+}
+
+print_error() {
+  echo -e "${RED}✗ $1${NC}" >&2
+}
+
+print_warning() {
+  echo -e "${YELLOW}⚠ $1${NC}"
+}
+
+# Setup secrets directory
+setup_secrets_dir() {
+  SECRETS_DIR="${1:-.}/secrets"
+  mkdir -p "$SECRETS_DIR"
+  chmod 700 "$SECRETS_DIR"
+  print_success "Secrets directory ready: $SECRETS_DIR"
+}
+
+# Get API key from various sources
+get_api_key() {
+  print_header "OpenRouter API Key Configuration"
+  
+  # Priority 1: Check if API key file already exists (mounted)
+  if [ -f "/secrets/openrouter_api_key" ] && [ -s "/secrets/openrouter_api_key" ]; then
+    print_warning "API key file already exists at /secrets/openrouter_api_key"
+    read -p "Use existing key? (y/n) " -n 1 -r
+    echo
+    if [[ $REPLY =~ ^[Yy]$ ]]; then
+      API_KEY=$(<"/secrets/openrouter_api_key")
+      return 0
+    fi
+  fi
+  
+  # Priority 2: Check environment variable
+  if [ -n "${OPENROUTER_API_KEY:-}" ]; then
+    print_success "Using API key from OPENROUTER_API_KEY environment variable"
+    API_KEY="$OPENROUTER_API_KEY"
+    return 0
+  fi
+  
+  # Priority 3: Prompt interactively
+  echo "You can obtain an API key from: https://openrouter.ai/keys"
+  echo ""
+  read -rsp "Enter your OpenRouter API key (sk-or-v1-...): " API_KEY
+  echo
+  
+  # Validate key format
+  if [[ ! "$API_KEY" =~ ^sk-or ]]; then
+    print_error "Invalid API key format. Must start with 'sk-or'"
+    return 1
+  fi
+  
+  return 0
+}
+
+# Store API key securely
+store_api_key() {
+  local api_key="$1"
+  local secrets_dir="${2:-/secrets}"
+  local key_file="$secrets_dir/openrouter_api_key"
+  
+  # Write key to file with restrictive permissions
+  echo "$api_key" > "$key_file"
+  chmod 600 "$key_file"
+  
+  # Verify
+  if [ ! -f "$key_file" ] || [ ! -r "$key_file" ]; then
+    print_error "Failed to write API key to $key_file"
+    return 1
+  fi
+  
+  print_success "API key stored securely at $key_file (mode 600)"
+  return 0
+}
+
+# Run health checks
+run_health_checks() {
+  print_header "Running Health Checks"
+  
+  # Check Docker daemon
+  if docker ps >/dev/null 2>&1; then
+    print_success "Docker daemon is accessible"
+  else
+    print_error "Docker daemon is not accessible"
+    print_warning "Make sure Docker socket is mounted: -v /var/run/docker.sock:/var/run/docker.sock"
+    return 1
+  fi
+  
+  # Check Pi CLI
+  if command -v pi >/dev/null 2>&1; then
+    print_success "Pi CLI is available"
+  else
+    print_error "Pi CLI is not available"
+    return 1
+  fi
+  
+  # Check API key file is readable
+  if [ -f "/secrets/openrouter_api_key" ] && [ -r "/secrets/openrouter_api_key" ]; then
+    print_success "API key file is readable"
+  else
+    print_error "API key file is missing or unreadable"
+    return 1
+  fi
+  
+  print_success "All health checks passed"
+  return 0
+}
+
+# Main workflow
+main() {
+  echo ""
+  echo "╔════════════════════════════════════════════════════════════╗"
+  echo "║      Kaseki Agent - Container Setup Wizard                  ║"
+  echo "╚════════════════════════════════════════════════════════════╝"
+  echo ""
+  
+  # Step 1: Setup secrets directory
+  setup_secrets_dir "/secrets"
+  echo ""
+  
+  # Step 2: Get API key
+  if ! get_api_key; then
+    print_error "Failed to configure API key"
+    exit 1
+  fi
+  echo ""
+  
+  # Step 3: Store API key
+  if ! store_api_key "$API_KEY" "/secrets"; then
+    print_error "Failed to store API key"
+    exit 1
+  fi
+  echo ""
+  
+  # Step 4: Run health checks
+  if ! run_health_checks; then
+    print_warning "Some health checks failed. Setup may have issues."
+  fi
+  echo ""
+  
+  # Success message
+  echo "╔════════════════════════════════════════════════════════════╗"
+  echo -e "${GREEN}║              Setup Complete! ✓                             ║${NC}"
+  echo "╚════════════════════════════════════════════════════════════╝"
+  echo ""
+  echo "Next steps:"
+  echo "  1. Run your first task:"
+  echo "     docker run -it \\"
+  echo "       -v ~/.kaseki/secrets:/secrets \\"
+  echo "       -v /var/run/docker.sock:/var/run/docker.sock \\"
+  echo "       docker.io/cyanautomation/kaseki-agent:latest \\"
+  echo "       agent https://github.com/your-org/your-repo main"
+  echo ""
+  echo "  2. Or use the convenience wrapper (if installed):"
+  echo "     ./kaseki agent https://github.com/your-org/your-repo main"
+  echo ""
+  echo "  3. For help:"
+  echo "     docker run kaseki-agent --help"
+  echo ""
+}
+
+# Run main
+main "$@"

package/scripts/kaseki-healthcheck.sh

@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+TARGET_FILE="${1:-${KASEKI_HEARTBEAT_FILE:-/var/log/kaseki/heartbeat.json}}"
+CHECK_CONTAINERS="${KASEKI_HEALTHCHECK_CONTAINERS:-1}"
+
+json_encode() {
+  local value
+  value="$(cat)"
+  value="${value//\\/\\\\}"
+  value="${value//\"/\\\"}"
+  value="${value//$'\b'/\\b}"
+  value="${value//$'\f'/\\f}"
+  value="${value//$'\n'/\\n}"
+  value="${value//$'\r'/\\r}"
+  value="${value//$'\t'/\\t}"
+  printf '"%s"' "$value"
+}
+
+json_string() {
+  printf '%s' "$1" | json_encode
+}
+
+status_ok="true"
+ts="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+
+has_docker="false"
+docker_cmd=""
+daemon_ok="false"
+daemon_error=""
+container_check_enabled="false"
+container_count="0"
+container_names_json="[]"
+
+if command -v docker >/dev/null 2>&1; then
+  has_docker="true"
+  docker_cmd="$(command -v docker)"
+fi
+
+if [ "$has_docker" = "true" ]; then
+  if docker info >/dev/null 2>&1; then
+    daemon_ok="true"
+  else
+    daemon_error="$(docker info 2>&1 || true)"
+    status_ok="false"
+  fi
+else
+  status_ok="false"
+fi
+
+if [ "$CHECK_CONTAINERS" = "1" ] && [ "$daemon_ok" = "true" ]; then
+  container_check_enabled="true"
+  mapfile -t names < <(docker ps --filter 'name=^kaseki-' --format '{{.Names}}' || true)
+  container_count="${#names[@]}"
+  if [ "${#names[@]}" -gt 0 ]; then
+    json_items=()
+    for n in "${names[@]}"; do
+      json_items+=("$(json_string "$n")")
+    done
+    container_names_json="[$(IFS=,; echo "${json_items[*]}")]"
+  fi
+fi
+
+overall_status="ok"
+if [ "$status_ok" != "true" ]; then
+  overall_status="degraded"
+fi
+
+mkdir -p "$(dirname "$TARGET_FILE")"
+tmp_file="$(mktemp "${TARGET_FILE}.XXXXXX")"
+
+cat > "$tmp_file" <<JSON
+{
+  "timestamp": $(json_string "$ts"),
+  "status": $(json_string "$overall_status"),
+  "checks": {
+    "docker_command": {
+      "ok": $has_docker,
+      "path": $(json_string "$docker_cmd")
+    },
+    "docker_daemon": {
+      "ok": $daemon_ok,
+      "error": $(json_string "$daemon_error")
+    },
+    "kaseki_containers": {
+      "enabled": $container_check_enabled,
+      "active_count": $container_count,
+      "active_names": $container_names_json
+    }
+  }
+}
+JSON
+
+mv "$tmp_file" "$TARGET_FILE"
+printf '%s\n' "$TARGET_FILE"

package/scripts/kaseki-install.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+KASEKI_REPO_URL="${KASEKI_REPO_URL:-https://github.com/CyanAutomation/kaseki-agent.git}"
+KASEKI_REF="${KASEKI_REF:-main}"
+KASEKI_ROOT="${KASEKI_ROOT:-/agents}"
+KASEKI_CHECKOUT_DIR="${KASEKI_CHECKOUT_DIR:-$KASEKI_ROOT/kaseki-agent}"
+KASEKI_LOG_DIR="${KASEKI_LOG_DIR:-/var/log/kaseki}"
+KASEKI_CONTROLLER_MODE="${KASEKI_CONTROLLER_MODE:-0}"
+KASEKI_BUILD_IMAGE_IF_TEMPLATE_MISSING="${KASEKI_BUILD_IMAGE_IF_TEMPLATE_MISSING:-1}"
+KASEKI_IMAGE_PULL_POLICY="${KASEKI_IMAGE_PULL_POLICY:-always}"
+KASEKI_REPLACE_STALE="${KASEKI_REPLACE_STALE:-0}"
+
+if [ "$KASEKI_CONTROLLER_MODE" = "1" ]; then
+  KASEKI_BUILD_IMAGE_IF_TEMPLATE_MISSING="0"
+  KASEKI_IMAGE_PULL_POLICY="always"
+fi
+
+if ! command -v git >/dev/null 2>&1; then
+  printf 'Error: git is required to install kaseki-agent.\n' >&2
+  exit 1
+fi
+
+mkdir -p "$(dirname "$KASEKI_CHECKOUT_DIR")"
+
+if [ -d "$KASEKI_CHECKOUT_DIR/.git" ]; then
+  if [ -n "$(git -C "$KASEKI_CHECKOUT_DIR" status --porcelain)" ]; then
+    if [ "$KASEKI_REPLACE_STALE" = "1" ]; then
+      git -C "$KASEKI_CHECKOUT_DIR" reset --hard HEAD
+      git -C "$KASEKI_CHECKOUT_DIR" clean -fdx
+    else
+      printf 'Error: dirty kaseki-agent checkout at %s. Set KASEKI_REPLACE_STALE=1 to reset stale local files.\n' "$KASEKI_CHECKOUT_DIR" >&2
+      exit 3
+    fi
+  fi
+  git -C "$KASEKI_CHECKOUT_DIR" fetch --prune origin
+else
+  rm -rf "$KASEKI_CHECKOUT_DIR"
+  git clone "$KASEKI_REPO_URL" "$KASEKI_CHECKOUT_DIR"
+fi
+
+git -C "$KASEKI_CHECKOUT_DIR" checkout "$KASEKI_REF"
+git -C "$KASEKI_CHECKOUT_DIR" pull --ff-only origin "$KASEKI_REF" 2>/dev/null || true
+
+KASEKI_LOG_DIR="$KASEKI_LOG_DIR" \
+KASEKI_CONTROLLER_MODE="$KASEKI_CONTROLLER_MODE" \
+KASEKI_BUILD_IMAGE_IF_TEMPLATE_MISSING="$KASEKI_BUILD_IMAGE_IF_TEMPLATE_MISSING" \
+KASEKI_IMAGE_PULL_POLICY="$KASEKI_IMAGE_PULL_POLICY" \
+KASEKI_REPLACE_STALE="$KASEKI_REPLACE_STALE" \
+"$KASEKI_CHECKOUT_DIR/scripts/kaseki-activate.sh" --json bootstrap