@logic-joe/fleek 0.1.2 → 0.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logic-joe/fleek",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "fleek - command line client for the Fleek agent hub (MCP over OAuth, OS keychain, signed role/project kits)",
   "license": "Apache-2.0",
   "type": "module",
@@ -9,6 +9,7 @@
   },
   "files": [
     "dist/fleek.mjs",
+    "service-agents",
     "LICENSE",
     "THIRD_PARTY_NOTICES.txt"
   ],

package/service-agents/Containerfile

@@ -0,0 +1,13 @@
+# Build on fleek-agents after choosing audited base/image digests. Never build on the coordinator Mac.
+ARG BASE_IMAGE
+FROM ${BASE_IMAGE}
+USER root
+RUN apt-get update && apt-get install -y --no-install-recommends socat ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+# Versions match packages/fleek-cli/src/kit-capabilities.ts; reverify tool restrictions on any upgrade.
+RUN npm install -g --allow-scripts=@anthropic-ai/claude-code @anthropic-ai/claude-code@2.1.303 @openai/codex@0.161.0
+COPY container-entrypoint /usr/local/bin/fleek-agent-entrypoint
+RUN chmod 0755 /usr/local/bin/fleek-agent-entrypoint
+USER node
+WORKDIR /job
+ENTRYPOINT ["/usr/local/bin/fleek-agent-entrypoint"]

package/service-agents/broker-run

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# WZ-CLI-SVC: runs ONE `fleek` command as the service broker - its own profile (HOME), its OS keyring unlocked from the service's
+# encrypted credential on a private D-Bus, working directory / (outside every git checkout). Same arrangement as kit-setup and
+# run-service; `fleek service setup|status|renew` (root) use it for the broker's login, whoami, claim, reports and kit pull.
+# Usage (root): broker-run review pty|pipe <purpose> [FLEEK_SETUP_CODE] -- <fleek arguments>
+#   pty  = a person at the terminal (device login); pipe = captured output (--json documents)
+#   FLEEK_SETUP_CODE = take the wizard's setup code from the caller's environment and hand it to the inner fleek as a unit
+#   CREDENTIAL (root-only 0600 file, LoadCredential): never argv, never a unit property (`systemctl show` is readable by every
+#   user; -E would put it there), never the journal.
+set -euo pipefail
+if [ "${1:-}" != --as-broker ]; then
+  [ "$(id -u)" = 0 ] || { echo 'root required' >&2; exit 77; }
+  kind=${1:-}; mode=${2:-}; purpose=${3:-}
+  [ "$kind" = review ] || { echo 'only the review starter is enabled' >&2; exit 64; }
+  case $mode in pty|pipe) ;; *) exit 64 ;; esac
+  [[ "$purpose" =~ ^[a-z][a-z-]{0,23}$ ]] || exit 64
+  shift 3
+  credential=()
+  if [ "${1:-}" = FLEEK_SETUP_CODE ]; then
+    [[ "${FLEEK_SETUP_CODE:-}" =~ ^[BCDFGHJKLMNPQRSTVWXZ]{8}$ ]] || exit 64
+    secret_dir=$(mktemp -d /run/fleek-setup-code-XXXXXX)
+    trap 'rm -rf "$secret_dir"' EXIT
+    printf '%s' "$FLEEK_SETUP_CODE" > "$secret_dir/setup-code"
+    chmod 0600 "$secret_dir/setup-code"
+    credential=(-p "LoadCredential=setup-code:$secret_dir/setup-code")
+    shift
+  fi
+  [ "${1:-}" = -- ] || exit 64
+  shift
+  broker=fa-$kind
+  broker_uid=$(id -u "$broker")
+  broker_home=$(getent passwd "$broker" | cut -d: -f6)
+  [ "$broker_uid" -gt 0 ] && [ "$broker_home" = "/home/$broker" ] || exit 77
+  # not exec: the credential file is removed when the unit ended (EXIT trap)
+  systemd-run --quiet "--$mode" --wait --collect --uid="$broker" --gid="$broker" --working-directory=/ \
+    --description="fleek $purpose" -p UMask=0077 -p "RuntimeDirectory=fleek-$purpose-$kind-$$" -p RuntimeDirectoryMode=0700 \
+    -p "LoadCredentialEncrypted=keyring-unlock:/etc/credstore.encrypted/fleek-$kind-keyring-unlock" \
+    -E "HOME=$broker_home" -E PATH=/opt/fleek/bin:/usr/local/bin:/usr/bin:/bin -E "XDG_RUNTIME_DIR=/run/user/$broker_uid" \
+    -E "LANG=${LANG:-C.UTF-8}" "${credential[@]}" \
+    /opt/fleek-agents/broker-run --as-broker "$@"
+  exit $?
+fi
+shift
+if [ "${1:-}" != --inside-private-bus ]; then
+  export GNOME_KEYRING_CONTROL="$RUNTIME_DIRECTORY/keyring"
+  mkdir -p -m 0700 "$GNOME_KEYRING_CONTROL"
+  exec dbus-run-session -- "$0" --as-broker --inside-private-bus "$@"
+fi
+shift
+/opt/fleek-agents/unlock-keyring
+if [ -r "${CREDENTIALS_DIRECTORY:-/nonexistent}/setup-code" ]; then
+  FLEEK_SETUP_CODE=$(cat "$CREDENTIALS_DIRECTORY/setup-code")
+  export FLEEK_SETUP_CODE
+fi
+exec /opt/fleek/bin/fleek "$@"

package/service-agents/container-entrypoint

@@ -0,0 +1,10 @@
+#!/bin/sh
+set -eu
+umask 077
+mkdir -p -m 0700 "$HOME"
+chmod 0700 "$HOME"
+if [ -n "${CODEX_HOME:-}" ]; then
+  mkdir -p -m 0700 "$CODEX_HOME"
+  chmod 0700 "$CODEX_HOME"
+fi
+exec "$@"

package/service-agents/egress-allowlist

@@ -0,0 +1,44 @@
+#!/usr/bin/env python3
+"""Root-owned broker egress: fixed approved DNS names, current public addresses, no private/link-local routes."""
+import ipaddress
+import os
+import pwd
+import socket
+import subprocess
+
+if os.getuid() != 0:
+    raise SystemExit(77)
+# platform.claude.com: token exchange of `claude setup-token` (WZ-CLI-SVC provider sign-in in the agent image, pre-check 25.10.2026)
+hosts = ("api.onfleek.app", "mcp.onfleek.app", "app.onfleek.app", "api.anthropic.com", "claude.ai", "platform.claude.com", "api.openai.com", "github.com")
+addresses = {4: set(), 6: set()}
+for host in hosts:
+    for family, _type, _proto, _name, endpoint in socket.getaddrinfo(host, 443, type=socket.SOCK_STREAM):
+        address = ipaddress.ip_address(endpoint[0])
+        if not address.is_global:
+            raise SystemExit("refusing non-public egress address")
+        addresses[address.version].add(str(address))
+uid = pwd.getpwnam("fa-review").pw_uid
+if uid == 0 or not addresses[4]:
+    raise SystemExit(77)
+subprocess.run(["nft", "add", "table", "inet", "fleek_agents"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+rules = f"""delete table inet fleek_agents
+table inet fleek_agents {{
+  set allow4 {{ type ipv4_addr; elements = {{ {', '.join(sorted(addresses[4]))} }} }}
+  set allow6 {{ type ipv6_addr; elements = {{ {', '.join(sorted(addresses[6]))} }} }}
+  chain output {{ type filter hook output priority -10; policy accept;
+    meta skuid {uid} jump broker
+  }}
+  chain broker {{
+    ct state established,related accept
+    ip daddr 127.0.0.53 udp dport 53 accept
+    ip daddr 127.0.0.53 tcp dport 53 accept
+    ip daddr {{ 0.0.0.0/8,10.0.0.0/8,100.64.0.0/10,127.0.0.0/8,169.254.0.0/16,172.16.0.0/12,192.168.0.0/16 }} reject
+    ip6 daddr {{ ::1/128,fc00::/7,fe80::/10 }} reject
+    ip daddr @allow4 tcp dport 443 accept
+    ip6 daddr @allow6 tcp dport 443 accept
+    reject with icmpx type admin-prohibited
+  }}
+}}
+"""
+subprocess.run(["nft", "-f", "-"], input=rules, text=True, check=True)
+print(f"fleek egress updated: uid={uid} hosts={len(hosts)} IPv4={len(addresses[4])} IPv6={len(addresses[6])}")

package/service-agents/fleek-agent@.service

@@ -0,0 +1,32 @@
+# Install as a USER service under the dedicated fa-<kind> broker (loginctl enable-linger).
+[Unit]
+Description=Fleek service agent %i
+StartLimitIntervalSec=300
+StartLimitBurst=3
+
+[Service]
+Type=simple
+UMask=0077
+Environment=PATH=/opt/fleek/bin:/usr/local/bin:/usr/bin:/bin
+StateDirectory=fleek-agent-%i
+StateDirectoryMode=0700
+RuntimeDirectory=fleek-agent-%i
+RuntimeDirectoryMode=0700
+# Encrypted files are created on this machine. Configure ONE provider (OAuth preferred for Claude).
+LoadCredentialEncrypted=claude-oauth:%h/.config/fleek-agent/claude-oauth.cred
+# Alternative: replace the line above with anthropic-key or openai-key (not all three).
+LoadCredentialEncrypted=keyring-unlock:%h/.config/fleek-agent/keyring-unlock.cred
+ExecStart=/opt/fleek-agents/run-service %i /etc/fleek-agents/%i.json
+Restart=on-failure
+RestartSec=30
+RestartPreventExitStatus=4 77
+KillMode=control-group
+TimeoutStopSec=10
+LimitFSIZE=16M
+# Rootless Podman needs user namespaces/cgroup delegation; do not use PrivateUsers/NoNewPrivileges here.
+Delegate=yes
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=default.target

package/service-agents/fleek-egress.service

@@ -0,0 +1,8 @@
+[Unit]
+Description=Refresh approved Fleek broker egress addresses
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/opt/fleek-agents/egress-allowlist

package/service-agents/fleek-egress.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Keep Fleek broker egress in sync with approved DNS names
+
+[Timer]
+OnBootSec=30
+OnUnitActiveSec=300
+Unit=fleek-egress.service
+
+[Install]
+WantedBy=timers.target

package/service-agents/install-system-service

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# Root-only installer for systemd255 hosts. Encrypted credentials remain host-managed; the process runs as fa-review.
+set -euo pipefail
+[ "$(id -u)" = 0 ] || { echo 'root required' >&2; exit 77; }
+kind=${1:-review}
+[ "$kind" = review ] || { echo 'only the review starter is enabled' >&2; exit 64; }
+source_dir=$(cd "$(dirname "$0")" && pwd)
+broker=fa-$kind
+broker_uid=$(id -u "$broker")
+broker_home=$(getent passwd "$broker" | cut -d: -f6)
+[ "$broker_uid" -gt 0 ] && [ "$broker_home" = /home/fa-review ] || exit 77
+install -d -m 0755 /opt/fleek-agents
+if [ "$source_dir" != /opt/fleek-agents ]; then install -m 0755 "$source_dir/run-job" "$source_dir/unlock-keyring" "$source_dir/run-service" "$source_dir/kit-setup" "$source_dir/broker-run" /opt/fleek-agents/; fi
+chmod 0755 /opt/fleek-agents/run-job /opt/fleek-agents/unlock-keyring /opt/fleek-agents/run-service /opt/fleek-agents/kit-setup /opt/fleek-agents/broker-run
+# Every level of ~/.config belongs to the broker (install -d sets owner/mode only on the NAMED directories, so naming
+# just .config/systemd/user left .config root-owned and `fleek login` could not create ~/.config/fleek - SVCLOGIN).
+# Re-running the installer repairs an existing host: install -d also re-applies owner/mode to existing directories.
+install -d -m 0700 -o "$broker" -g "$broker" "$broker_home/.config" "$broker_home/.config/systemd" "$broker_home/.config/systemd/user"
+install -d -m 0750 -o root -g "$broker" /etc/fleek-agents
+install -d -m 0700 /etc/credstore.encrypted
+if [ "$source_dir" != /opt/fleek-agents ]; then install -m 0755 "$source_dir/egress-allowlist" /opt/fleek-agents/; fi
+install -m 0644 "$source_dir/fleek-egress.service" "$source_dir/fleek-egress.timer" /etc/systemd/system/
+cat > "/etc/systemd/system/fleek-agent-$kind.service" <<UNIT
+[Unit]
+Description=Fleek review service agent
+StartLimitIntervalSec=300
+StartLimitBurst=3
+Requires=user@$broker_uid.service
+After=network-online.target user@$broker_uid.service fleek-egress.service
+Requires=fleek-egress.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=$broker
+Group=$broker
+UMask=0077
+Environment=HOME=$broker_home
+Environment=PATH=/opt/fleek/bin:/usr/local/bin:/usr/bin:/bin
+Environment=XDG_RUNTIME_DIR=/run/user/$broker_uid
+RuntimeDirectory=fleek-agent-$kind
+RuntimeDirectoryMode=0700
+StateDirectory=fleek-agent-$kind
+StateDirectoryMode=0700
+LoadCredentialEncrypted=claude-oauth:/etc/credstore.encrypted/fleek-$kind-claude-oauth
+LoadCredentialEncrypted=keyring-unlock:/etc/credstore.encrypted/fleek-$kind-keyring-unlock
+ExecStart=/opt/fleek-agents/run-service $kind /etc/fleek-agents/$kind.json
+Restart=on-failure
+RestartSec=30
+RestartPreventExitStatus=4 77
+KillMode=control-group
+TimeoutStopSec=10
+LimitFSIZE=16M
+Delegate=yes
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target
+UNIT
+loginctl enable-linger "$broker"
+systemctl start "user@$broker_uid.service"
+systemctl daemon-reload
+systemctl enable --now fleek-egress.timer
+systemctl start fleek-egress.service
+# Deliberately not enabled/started: identity, image, provider credential and host acceptance must be ready first
+# (`fleek service setup` enables it once they are). Re-running this on a running host keeps the unit's state.
+printf '%s\n' "Installed disabled fleek-agent-$kind.service for $broker (uid $broker_uid)"

package/service-agents/kit-setup

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# KIT-PROVISION for a service broker (root, at a terminal): the ONE interactive kit confirmation an operator gives.
+# run-job pulls kits unattended (`fleek kit pull <project> --target claude --yes --json`, stdin /dev/null). The CLI refuses a
+# first kit, a new kit, a new MCP entry or new kit files without a terminal (CONFIRMATION_REQUIRED, run-job exits 77) - that
+# boundary stays. This runs `fleek kit setup` once as the broker with the service's profile (HOME), its OS keyring (private
+# D-Bus, unlocked from the service's own encrypted credential) and a working directory outside every git checkout (like
+# run-job's job directory), then repeats run-job's exact pull without a terminal to prove it needs no confirmation now.
+# Usage: sudo /opt/fleek-agents/kit-setup review        (then: systemctl restart fleek-agent-review.service)
+set -euo pipefail
+if [ "${1:-}" != --as-broker ]; then
+  [ "$(id -u)" = 0 ] || { echo 'root required' >&2; exit 77; }
+  kind=${1:-review}
+  [ "$kind" = review ] || { echo 'only the review starter is enabled' >&2; exit 64; }
+  [ -t 0 ] && [ -t 1 ] || { echo 'an interactive terminal is required (the confirmation is a person at a terminal)' >&2; exit 3; }
+  broker=fa-$kind
+  broker_uid=$(id -u "$broker")
+  broker_home=$(getent passwd "$broker" | cut -d: -f6)
+  [ "$broker_uid" -gt 0 ] && [ "$broker_home" = "/home/$broker" ] || exit 77
+  project=$(python3 -c 'import json, re, sys
+p = json.load(open(sys.argv[1]))["project"]
+if not re.fullmatch(r"[A-Z0-9][A-Z0-9_]{0,19}", p): sys.exit(2)
+print(p)' "/etc/fleek-agents/$kind.json")
+  exec systemd-run --quiet --pty --wait --collect --uid="$broker" --gid="$broker" --working-directory=/ \
+    -p UMask=0077 -p "RuntimeDirectory=fleek-kit-setup-$kind" -p RuntimeDirectoryMode=0700 \
+    -p "LoadCredentialEncrypted=keyring-unlock:/etc/credstore.encrypted/fleek-$kind-keyring-unlock" \
+    -E "HOME=$broker_home" -E PATH=/opt/fleek/bin:/usr/local/bin:/usr/bin:/bin -E "XDG_RUNTIME_DIR=/run/user/$broker_uid" \
+    -E "LANG=${LANG:-C.UTF-8}" \
+    /opt/fleek-agents/kit-setup --as-broker "$project"
+fi
+shift
+# Same D-Bus + keyring arrangement as run-service (private session bus in this unit, keyring control below RuntimeDirectory)
+if [ "${1:-}" != --inside-private-bus ]; then
+  export GNOME_KEYRING_CONTROL="$RUNTIME_DIRECTORY/keyring"
+  mkdir -p -m 0700 "$GNOME_KEYRING_CONTROL"
+  exec dbus-run-session -- "$0" --as-broker --inside-private-bus "$@"
+fi
+shift
+project=${1:-}
+[[ "$project" =~ ^[A-Z0-9][A-Z0-9_]{0,19}$ ]] || exit 2
+/opt/fleek-agents/unlock-keyring
+fleek whoami
+# The confirmation (TTY): same profile, project key and target as run-job. Other MCP proposals: answer N - the job
+# container only ever gets the Fleek MCP socket, never the host's client configuration.
+set +e
+fleek kit setup "$project" --target claude
+setup=$?
+set -e
+case $setup in 0|13) ;; *) echo "kit setup ended with exit $setup - nothing confirmed" >&2; exit "$setup" ;; esac
+# Proof: run-job's exact unattended call from a fresh job-like directory, no terminal
+job=$(mktemp -d -p "$RUNTIME_DIRECTORY" job-XXXXXX)
+cd "$job"
+set +e
+fleek kit pull "$project" --target claude --yes --json </dev/null >/dev/null 2>&1
+pulled=$?
+set -e
+cd /
+rm -rf "$job"
+if [ "$pulled" -ne 0 ]; then echo "run-job is NOT ready: unattended kit pull exits $pulled" >&2; exit "$pulled"; fi
+echo "run-job ready: the unattended kit pull needs no confirmation. Next: systemctl restart fleek-agent-review.service"

package/service-agents/run-job

@@ -0,0 +1,316 @@
+#!/usr/bin/env python3
+"""One ordinary headless CLI in a rootless container; never an agent implementation."""
+import datetime
+import fcntl
+import json
+import os
+from pathlib import Path
+import re
+import shutil
+import signal
+import stat
+import subprocess
+import sys
+import tempfile
+import time
+import uuid
+
+DENIED = 77
+LOGIN = 4
+UUID = re.compile(r"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$")
+
+
+def private_file(path):
+    value = Path(path)
+    info = value.lstat()
+    if not stat.S_ISREG(info.st_mode) or info.st_mode & 0o077 or info.st_uid not in (0, os.getuid()):
+        raise ValueError("private file required")
+    return value
+
+
+def load_config(path):
+    config = json.loads(private_file(path).read_text())
+    for field in ("expectedInstallationId", "workspaceId"):
+        if not UUID.fullmatch(config[field]):
+            raise ValueError("invalid identity")
+        config[field] = config[field].lower()
+    if not re.fullmatch(r"[A-Z0-9][A-Z0-9_]{0,19}", config["project"]):
+        raise ValueError("invalid project")
+    if config.get("provider", "claude") not in ("claude", "codex"):
+        raise ValueError("invalid provider")
+    if not re.fullmatch(r"[a-zA-Z0-9./:_-]+@sha256:[a-f0-9]{64}", config["image"]):
+        raise ValueError("image must be digest-pinned")
+    return config
+
+
+def command(argv, cwd=None):
+    result = subprocess.run(argv, cwd=cwd, stdin=subprocess.DEVNULL, stdout=subprocess.PIPE,
+                            stderr=subprocess.DEVNULL, timeout=60, check=False)
+    if result.returncode:
+        try:
+            code = json.loads(result.stdout).get("error")
+        except (ValueError, AttributeError):
+            code = None
+        # A kit change the CLI refuses without a terminal (first kit, new kit / MCP entry / files: CONFIRMATION_REQUIRED) needs
+        # the operator's one interactive confirmation (`kit-setup`); stop like a denial so the event is redelivered after it.
+        # USAGE: `--accept-approved` on a broker without a service-account login - an operator repair (fleek service setup)
+        raise SystemExit(DENIED if code in ("ACCESS_DENIED", "CONFIRMATION_REQUIRED", "DECLINED", "USAGE") else LOGIN if code in ("UNAUTHENTICATED", "NEEDS_LOGIN") else result.returncode if result.returncode in (DENIED, LOGIN) else 1)
+    if len(result.stdout) > 1024 * 1024:
+        raise ValueError("oversized broker output")
+    return json.loads(result.stdout)
+
+
+def quota(root):
+    # One listener plus a file lock keeps the 50/day default across restarts and accidental duplicate services.
+    path = root / "quota.json"
+    with os.fdopen(os.open(path, os.O_RDWR | os.O_CREAT | os.O_NOFOLLOW, 0o600), "r+") as stream:
+        os.fchmod(stream.fileno(), 0o600)
+        fcntl.flock(stream, fcntl.LOCK_EX)
+        stream.seek(0)
+        today = datetime.datetime.now(datetime.timezone.utc).date().isoformat()
+        raw = stream.read()
+        data = json.loads(raw) if raw else {"date": today, "count": 0}
+        count = data["count"] if data["date"] == today else 0
+        if count >= 50:
+            raise ValueError("daily limit")
+        stream.seek(0)
+        json.dump({"date": today, "count": count + 1}, stream)
+        stream.truncate()
+        stream.flush()
+        os.fsync(stream.fileno())
+
+
+def provider_env(provider):
+    credentials = Path(os.environ["CREDENTIALS_DIRECTORY"])
+    names = ([("claude-oauth", "CLAUDE_CODE_OAUTH_TOKEN"), ("anthropic-key", "ANTHROPIC_API_KEY")]
+             if provider == "claude" else [("openai-key", "CODEX_API_KEY")])
+    for filename, variable in names:
+        path = credentials / filename
+        if path.exists():
+            value = private_file(path).read_text().strip()
+            if not value or "\n" in value or len(value) > 16384:
+                raise ValueError("invalid provider credential")
+            return {variable: value}
+    raise ValueError("provider credential missing")
+
+
+def container_args(image, name, job, provider):
+    args = ["podman", "--cgroup-manager=cgroupfs", "run", "--rm", "--name", name, "--pull=never", "--read-only", "--userns=keep-id", "--cgroups=split",
+            f"--user={os.getuid()}:{os.getgid()}", "--cap-drop=ALL", "--security-opt=no-new-privileges", "--pids-limit=128", "--memory=1g", "--cpus=1",
+            "--log-driver=none", "--tmpfs=/home/agent:rw,nosuid,nodev,noexec,size=64m,mode=1777", "--tmpfs=/tmp:rw,nosuid,nodev,noexec,size=64m",
+            "--mount", f"type=bind,src={job / 'input'},dst=/job,ro=true", "--workdir=/job",
+            "--env=HOME=/home/agent/home", "--env=CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1", "--env=DISABLE_AUTOUPDATER=1",
+            "--env=DISABLE_TELEMETRY=1", "--env=CODEX_HOME=/home/agent/home/.codex"]
+    for variable in provider:
+        args.append(f"--env={variable}")  # value inherited only by the captured container process, never argv
+    args.append(image)
+    return args
+
+
+def agent_args(provider, event_id, issue_id):
+    prompt = f"Job review; eventId={event_id}; issueId={issue_id}."
+    if provider == "claude":
+        return ["claude", "-p", prompt, "--output-format", "json", "--max-turns", "30", "--tools", "",
+                "--allowedTools", "mcp__fleek__*", "--permission-mode", "dontAsk", "--strict-mcp-config",
+                "--mcp-config", "/job/mcp.json", "--settings", "/job/settings.json", "--setting-sources", "",
+                "--append-system-prompt-file", "/job/kit.md"]
+    return ["codex", "exec", "--json", "--skip-git-repo-check", "--sandbox", "read-only", "--ephemeral",
+            "-c", 'forced_login_method="api"', "-c", 'web_search="disabled"', "-c", "features.shell_tool=false",
+            "-c", "features.apply_patch_freeform=false", "-c", "features.multi_agent=false", "-c", "features.multi_agent_v2=false", "-c", "features.js_repl=false",
+            "-c", "features.code_mode=false", "-c", "features.code_mode_host=false", "-c", 'project_doc_max_bytes=0',
+            "-c", 'mcp_servers.fleek.command="socat"', "-c", 'mcp_servers.fleek.args=["STDIO","UNIX-CONNECT:/job/mcp.sock"]',
+            "-c", 'model_instructions_file="/job/kit.md"', prompt]
+
+
+def kit_version(pulled):
+    kits = [kit for kit in pulled.get("kits", []) if isinstance(kit, dict)] if isinstance(pulled, dict) else []
+    main = next((kit for kit in kits if kit.get("kind") != "supplement"), kits[0] if kits else None)
+    version = main.get("version") if main else None
+    return str(version) if isinstance(version, int) and not isinstance(version, bool) and 0 < version < 10**9 else None
+
+
+PROVIDER_AUTH_FAILED = re.compile(rb"(?i)(oauth token has expired|authentication_error|invalid api key|invalid bearer token|\b401\b)")
+
+
+def provider_state(state):
+    # ok | expired: the outcome of the last agent run's provider sign-in (file written by run-job; nothing else in it)
+    try:
+        value = (state / "provider-auth").read_text().strip()
+    except OSError:
+        return "ok"
+    return value if value in ("ok", "expired") else "ok"
+
+
+def host_report(fleek, provider_auth, kit=None, last_job_at=None, timeout=20):
+    # WZ-CLI-SVC: the host state for Fleek's "Alles grün" (serviceHosts.report). Best effort: never changes the job's outcome.
+    argv = [fleek, "service", "host-report", "--provider-auth", provider_auth, "--json"]
+    if kit:
+        argv += ["--kit-version", kit]
+    if last_job_at:
+        argv += ["--last-job-at", last_job_at]
+    try:
+        subprocess.run(argv, stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, timeout=timeout, check=False)
+    except (OSError, subprocess.SubprocessError):
+        pass
+
+
+def kit_text(fleek, project, cwd):
+    # WZ-CLI-SVC (founder 25.10.2026): new kit versions an admin released, signed and pinned to this project are taken over
+    # without a root terminal (--accept-approved: service-account logins only; kit MCP entries are only noted - the container
+    # below still gets nothing but the Fleek socket).
+    pulled = command([fleek, "kit", "pull", project, "--target", "claude", "--yes", "--accept-approved", "--json"], cwd)
+    host_report(fleek, provider_state(Path(os.environ["STATE_DIRECTORY"])), kit_version(pulled))
+    launch = command([fleek, "kit", "run", "claude", "--project", project, "--dry-run", "--json"], cwd)
+    args = launch["args"]
+    parts = []
+    for index, arg in enumerate(args):
+        if arg == "--append-system-prompt":
+            parts.append(args[index + 1])
+        elif arg == "--plugin-dir":
+            plugin = Path(args[index + 1]).resolve(strict=True)
+            # Only plain Markdown enters the container; no plugin hooks, scripts, MCP entries or broker paths.
+            for file in sorted(plugin.rglob("*.md")):
+                if file.is_symlink() or not file.resolve().is_relative_to(plugin):
+                    raise ValueError("unsafe kit")
+                parts.append(file.read_text())
+    text = "\n\n".join(parts)
+    if not text or len(text.encode()) > 120000:
+        raise ValueError("invalid kit")
+    return text
+
+
+def run(config_path):
+    if os.getuid() == 0:
+        return DENIED
+    config = load_config(config_path)
+    raw = sys.stdin.buffer.read(65537)
+    if len(raw) > 65536:
+        raise ValueError("oversized event")
+    event = json.loads(raw)
+    event_id, issue_id = event.get("eventId", ""), event.get("aggregateId", "")
+    # AUTO-AGENT: "Agent startet automatisch" - In Prüfung keeps its own event, every other agent step wakes with agent_work_requested
+    if event.get("eventType") not in ("issue.intake_review_requested", "issue.agent_work_requested") or event.get("aggregateType") != "issue" or not UUID.fullmatch(event_id) or not UUID.fullmatch(issue_id):
+        return 64  # listener makes the durable metadata-only dead letter; no unknown event is acknowledged
+    event_id, issue_id = event_id.lower(), issue_id.lower()
+    fleek = config.get("fleek", "/opt/fleek/bin/fleek")
+    identity = command([fleek, "whoami", "--json"])
+    if identity.get("installation", {}).get("id", "").lower() != config["expectedInstallationId"] or identity.get("workspace", {}).get("id", "").lower() != config["workspaceId"]:
+        return DENIED
+    context = command([fleek, "context", issue_id, "--json"])
+    subject = context.get("subject", {})
+    if subject.get("id", "").lower() != issue_id or not re.fullmatch(re.escape(config["project"]) + r"-[1-9][0-9]*", subject.get("identifier", "")):
+        return 64
+    state = Path(os.environ["STATE_DIRECTORY"])
+    if not state.is_dir() or state.is_symlink() or state.stat().st_uid != os.getuid() or state.stat().st_mode & 0o077:
+        raise ValueError("private state required")
+    quota(state)
+    # Per-broker serialization covers a second listener started by mistake as well.
+    with (state / "job.lock").open("a") as lock:
+        os.chmod(state / "job.lock", 0o600)
+        fcntl.flock(lock, fcntl.LOCK_EX)
+        job = Path(tempfile.mkdtemp(prefix="job-", dir=os.environ["RUNTIME_DIRECTORY"]))
+        proxy = agent = None
+        name = "fleek-" + uuid.uuid4().hex
+        exit_code = 1
+        def outcome(code):
+            nonlocal exit_code
+            exit_code = code
+            return code
+        started = time.monotonic()
+        provider = config.get("provider", "claude")
+        container_env = {key: os.environ[key] for key in ("PATH", "HOME", "XDG_RUNTIME_DIR") if key in os.environ}
+        try:
+            inputs = job / "input"
+            inputs.mkdir(mode=0o700)
+            (inputs / "kit.md").write_text(kit_text(fleek, config["project"], job))
+            (inputs / "mcp.json").write_text(json.dumps({"mcpServers": {"fleek": {"command": "socat", "args": ["STDIO", "UNIX-CONNECT:/job/mcp.sock"]}}}))
+            (inputs / "settings.json").write_text(json.dumps({"permissions": {"deny": ["Read(/proc/**)", "Read(/run/**)"]}}))
+            with (job / "proxy.log").open("wb") as proxy_log, (job / "agent.stdout").open("wb") as stdout, (job / "agent.stderr").open("wb") as stderr:
+                proxy = subprocess.Popen([fleek, "mcp", "serve", "--socket", str(inputs / "mcp.sock"), "--job", event_id], stdout=proxy_log, stderr=proxy_log)
+                deadline = time.monotonic() + 10
+                while not (inputs / "mcp.sock").exists():
+                    if proxy.poll() is not None:
+                        return outcome(proxy.returncode)
+                    if time.monotonic() >= deadline:
+                        return outcome(1)
+                    time.sleep(0.05)
+                container_env.update(provider_env(provider))
+                argv = container_args(config["image"], name, job, {key: value for key, value in container_env.items() if key in ("CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY", "CODEX_API_KEY")})
+                agent = subprocess.Popen(argv + agent_args(provider, event_id, issue_id), env=container_env, stdin=subprocess.DEVNULL, stdout=stdout, stderr=stderr)
+                while agent.poll() is None:
+                    if proxy.poll() is not None:
+                        return outcome(proxy.returncode if proxy.returncode in (DENIED, LOGIN) else 1)
+                    if time.monotonic() - started >= 600:
+                        return outcome(75)
+                    time.sleep(0.1)
+                # A just-denied proxy may still be exiting when the CLI returns. Never acknowledge that race.
+                try:
+                    proxy.wait(timeout=1)
+                except subprocess.TimeoutExpired:
+                    pass
+                exit_code = proxy.returncode if proxy.poll() in (DENIED, LOGIN) else 0 if agent.returncode == 0 else 1
+                # provider sign-in outcome for the host report (only "ok"/"expired" is stored, never agent text)
+                if agent.returncode == 0 or exit_code in (DENIED, LOGIN):
+                    auth = "ok" if agent.returncode == 0 else None
+                else:
+                    with (job / "agent.stdout").open("rb") as out, (job / "agent.stderr").open("rb") as err:
+                        auth = "expired" if PROVIDER_AUTH_FAILED.search(out.read(1024 * 1024) + err.read(1024 * 1024)) else None
+                if auth:
+                    fd = os.open(state / "provider-auth", os.O_WRONLY | os.O_CREAT | os.O_TRUNC | os.O_NOFOLLOW, 0o600)
+                    with os.fdopen(fd, "w") as stream:
+                        stream.write(auth)
+                return exit_code
+        except SystemExit as error:
+            exit_code = error.code if isinstance(error.code, int) else 1
+            raise
+        finally:
+            # systemd and the listener can both send TERM; teardown must not be interrupted twice.
+            for sig in (signal.SIGTERM, signal.SIGINT):
+                signal.signal(sig, signal.SIG_IGN)
+            # Container removal is required even when Podman's client process already exited or was signaled.
+            cleanup_failed = False
+            try:
+                result = subprocess.run(["podman", "--cgroup-manager=cgroupfs", "rm", "--force", "--time=0", "--ignore", name], env=container_env, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, timeout=5, check=False)
+                cleanup_failed = result.returncode != 0
+            except (OSError, subprocess.SubprocessError):
+                cleanup_failed = True
+            finally:
+                for child in (agent, proxy):
+                    if child and child.poll() is None:
+                        child.terminate()
+                        try:
+                            child.wait(timeout=2)
+                        except subprocess.TimeoutExpired:
+                            child.kill()
+                            child.wait(timeout=2)
+                shutil.rmtree(job)
+            if cleanup_failed:
+                exit_code = DENIED
+            stamp = datetime.datetime.now(datetime.timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z")
+            try:
+                last = Path(os.environ["STATE_DIRECTORY"]) / "last-job-at"
+                fd = os.open(last, os.O_WRONLY | os.O_CREAT | os.O_TRUNC | os.O_NOFOLLOW, 0o600)
+                with os.fdopen(fd, "w") as stream:
+                    stream.write(stamp)
+            except (OSError, KeyError):
+                pass
+            host_report(fleek, provider_state(state), None, stamp, timeout=5)
+            # Only validated IDs and numeric metadata ever reach journald. No agent-derived text/statistics.
+            print(json.dumps({"eventId": event_id, "kind": "review", "exit": exit_code, "durationMs": int((time.monotonic() - started) * 1000), "cleanupFailed": cleanup_failed}), flush=True)
+            if cleanup_failed:
+                raise SystemExit(DENIED)
+
+
+def interrupted(_signal, _frame):
+    raise SystemExit(75)
+
+
+if __name__ == "__main__":
+    os.umask(0o077)
+    for sig in (signal.SIGTERM, signal.SIGINT):
+        signal.signal(sig, interrupted)
+    try:
+        result = run(sys.argv[1])
+    except (ValueError, KeyError, TypeError, OSError, subprocess.SubprocessError):
+        result = 1  # exception text can contain credentials or event content; never log it
+    sys.exit(result)