@logic-joe/fleek 0.1.3 → 0.2.1

package/service-agents/run-job

@@ -0,0 +1,316 @@
+#!/usr/bin/env python3
+"""One ordinary headless CLI in a rootless container; never an agent implementation."""
+import datetime
+import fcntl
+import json
+import os
+from pathlib import Path
+import re
+import shutil
+import signal
+import stat
+import subprocess
+import sys
+import tempfile
+import time
+import uuid
+
+DENIED = 77
+LOGIN = 4
+UUID = re.compile(r"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$")
+
+
+def private_file(path):
+    value = Path(path)
+    info = value.lstat()
+    if not stat.S_ISREG(info.st_mode) or info.st_mode & 0o077 or info.st_uid not in (0, os.getuid()):
+        raise ValueError("private file required")
+    return value
+
+
+def load_config(path):
+    config = json.loads(private_file(path).read_text())
+    for field in ("expectedInstallationId", "workspaceId"):
+        if not UUID.fullmatch(config[field]):
+            raise ValueError("invalid identity")
+        config[field] = config[field].lower()
+    if not re.fullmatch(r"[A-Z0-9][A-Z0-9_]{0,19}", config["project"]):
+        raise ValueError("invalid project")
+    if config.get("provider", "claude") not in ("claude", "codex"):
+        raise ValueError("invalid provider")
+    if not re.fullmatch(r"[a-zA-Z0-9./:_-]+@sha256:[a-f0-9]{64}", config["image"]):
+        raise ValueError("image must be digest-pinned")
+    return config
+
+
+def command(argv, cwd=None):
+    result = subprocess.run(argv, cwd=cwd, stdin=subprocess.DEVNULL, stdout=subprocess.PIPE,
+                            stderr=subprocess.DEVNULL, timeout=60, check=False)
+    if result.returncode:
+        try:
+            code = json.loads(result.stdout).get("error")
+        except (ValueError, AttributeError):
+            code = None
+        # A kit change the CLI refuses without a terminal (first kit, new kit / MCP entry / files: CONFIRMATION_REQUIRED) needs
+        # the operator's one interactive confirmation (`kit-setup`); stop like a denial so the event is redelivered after it.
+        # USAGE: `--accept-approved` on a broker without a service-account login - an operator repair (fleek service setup)
+        raise SystemExit(DENIED if code in ("ACCESS_DENIED", "CONFIRMATION_REQUIRED", "DECLINED", "USAGE") else LOGIN if code in ("UNAUTHENTICATED", "NEEDS_LOGIN") else result.returncode if result.returncode in (DENIED, LOGIN) else 1)
+    if len(result.stdout) > 1024 * 1024:
+        raise ValueError("oversized broker output")
+    return json.loads(result.stdout)
+
+
+def quota(root):
+    # One listener plus a file lock keeps the 50/day default across restarts and accidental duplicate services.
+    path = root / "quota.json"
+    with os.fdopen(os.open(path, os.O_RDWR | os.O_CREAT | os.O_NOFOLLOW, 0o600), "r+") as stream:
+        os.fchmod(stream.fileno(), 0o600)
+        fcntl.flock(stream, fcntl.LOCK_EX)
+        stream.seek(0)
+        today = datetime.datetime.now(datetime.timezone.utc).date().isoformat()
+        raw = stream.read()
+        data = json.loads(raw) if raw else {"date": today, "count": 0}
+        count = data["count"] if data["date"] == today else 0
+        if count >= 50:
+            raise ValueError("daily limit")
+        stream.seek(0)
+        json.dump({"date": today, "count": count + 1}, stream)
+        stream.truncate()
+        stream.flush()
+        os.fsync(stream.fileno())
+
+
+def provider_env(provider):
+    credentials = Path(os.environ["CREDENTIALS_DIRECTORY"])
+    names = ([("claude-oauth", "CLAUDE_CODE_OAUTH_TOKEN"), ("anthropic-key", "ANTHROPIC_API_KEY")]
+             if provider == "claude" else [("openai-key", "CODEX_API_KEY")])
+    for filename, variable in names:
+        path = credentials / filename
+        if path.exists():
+            value = private_file(path).read_text().strip()
+            if not value or "\n" in value or len(value) > 16384:
+                raise ValueError("invalid provider credential")
+            return {variable: value}
+    raise ValueError("provider credential missing")
+
+
+def container_args(image, name, job, provider):
+    args = ["podman", "--cgroup-manager=cgroupfs", "run", "--rm", "--name", name, "--pull=never", "--read-only", "--userns=keep-id", "--cgroups=split",
+            f"--user={os.getuid()}:{os.getgid()}", "--cap-drop=ALL", "--security-opt=no-new-privileges", "--pids-limit=128", "--memory=1g", "--cpus=1",
+            "--log-driver=none", "--tmpfs=/home/agent:rw,nosuid,nodev,noexec,size=64m,mode=1777", "--tmpfs=/tmp:rw,nosuid,nodev,noexec,size=64m",
+            "--mount", f"type=bind,src={job / 'input'},dst=/job,ro=true", "--workdir=/job",
+            "--env=HOME=/home/agent/home", "--env=CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1", "--env=DISABLE_AUTOUPDATER=1",
+            "--env=DISABLE_TELEMETRY=1", "--env=CODEX_HOME=/home/agent/home/.codex"]
+    for variable in provider:
+        args.append(f"--env={variable}")  # value inherited only by the captured container process, never argv
+    args.append(image)
+    return args
+
+
+def agent_args(provider, event_id, issue_id):
+    prompt = f"Job review; eventId={event_id}; issueId={issue_id}."
+    if provider == "claude":
+        return ["claude", "-p", prompt, "--output-format", "json", "--max-turns", "30", "--tools", "",
+                "--allowedTools", "mcp__fleek__*", "--permission-mode", "dontAsk", "--strict-mcp-config",
+                "--mcp-config", "/job/mcp.json", "--settings", "/job/settings.json", "--setting-sources", "",
+                "--append-system-prompt-file", "/job/kit.md"]
+    return ["codex", "exec", "--json", "--skip-git-repo-check", "--sandbox", "read-only", "--ephemeral",
+            "-c", 'forced_login_method="api"', "-c", 'web_search="disabled"', "-c", "features.shell_tool=false",
+            "-c", "features.apply_patch_freeform=false", "-c", "features.multi_agent=false", "-c", "features.multi_agent_v2=false", "-c", "features.js_repl=false",
+            "-c", "features.code_mode=false", "-c", "features.code_mode_host=false", "-c", 'project_doc_max_bytes=0',
+            "-c", 'mcp_servers.fleek.command="socat"', "-c", 'mcp_servers.fleek.args=["STDIO","UNIX-CONNECT:/job/mcp.sock"]',
+            "-c", 'model_instructions_file="/job/kit.md"', prompt]
+
+
+def kit_version(pulled):
+    kits = [kit for kit in pulled.get("kits", []) if isinstance(kit, dict)] if isinstance(pulled, dict) else []
+    main = next((kit for kit in kits if kit.get("kind") != "supplement"), kits[0] if kits else None)
+    version = main.get("version") if main else None
+    return str(version) if isinstance(version, int) and not isinstance(version, bool) and 0 < version < 10**9 else None
+
+
+PROVIDER_AUTH_FAILED = re.compile(rb"(?i)(oauth token has expired|authentication_error|invalid api key|invalid bearer token|\b401\b)")
+
+
+def provider_state(state):
+    # ok | expired: the outcome of the last agent run's provider sign-in (file written by run-job; nothing else in it)
+    try:
+        value = (state / "provider-auth").read_text().strip()
+    except OSError:
+        return "ok"
+    return value if value in ("ok", "expired") else "ok"
+
+
+def host_report(fleek, provider_auth, kit=None, last_job_at=None, timeout=20):
+    # WZ-CLI-SVC: the host state for Fleek's "Alles grün" (serviceHosts.report). Best effort: never changes the job's outcome.
+    argv = [fleek, "service", "host-report", "--provider-auth", provider_auth, "--json"]
+    if kit:
+        argv += ["--kit-version", kit]
+    if last_job_at:
+        argv += ["--last-job-at", last_job_at]
+    try:
+        subprocess.run(argv, stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, timeout=timeout, check=False)
+    except (OSError, subprocess.SubprocessError):
+        pass
+
+
+def kit_text(fleek, project, cwd):
+    # WZ-CLI-SVC (founder 25.10.2026): new kit versions an admin released, signed and pinned to this project are taken over
+    # without a root terminal (--accept-approved: service-account logins only; kit MCP entries are only noted - the container
+    # below still gets nothing but the Fleek socket).
+    pulled = command([fleek, "kit", "pull", project, "--target", "claude", "--yes", "--accept-approved", "--json"], cwd)
+    host_report(fleek, provider_state(Path(os.environ["STATE_DIRECTORY"])), kit_version(pulled))
+    launch = command([fleek, "kit", "run", "claude", "--project", project, "--dry-run", "--json"], cwd)
+    args = launch["args"]
+    parts = []
+    for index, arg in enumerate(args):
+        if arg == "--append-system-prompt":
+            parts.append(args[index + 1])
+        elif arg == "--plugin-dir":
+            plugin = Path(args[index + 1]).resolve(strict=True)
+            # Only plain Markdown enters the container; no plugin hooks, scripts, MCP entries or broker paths.
+            for file in sorted(plugin.rglob("*.md")):
+                if file.is_symlink() or not file.resolve().is_relative_to(plugin):
+                    raise ValueError("unsafe kit")
+                parts.append(file.read_text())
+    text = "\n\n".join(parts)
+    if not text or len(text.encode()) > 120000:
+        raise ValueError("invalid kit")
+    return text
+
+
+def run(config_path):
+    if os.getuid() == 0:
+        return DENIED
+    config = load_config(config_path)
+    raw = sys.stdin.buffer.read(65537)
+    if len(raw) > 65536:
+        raise ValueError("oversized event")
+    event = json.loads(raw)
+    event_id, issue_id = event.get("eventId", ""), event.get("aggregateId", "")
+    # AUTO-AGENT: "Agent startet automatisch" - In Prüfung keeps its own event, every other agent step wakes with agent_work_requested
+    if event.get("eventType") not in ("issue.intake_review_requested", "issue.agent_work_requested") or event.get("aggregateType") != "issue" or not UUID.fullmatch(event_id) or not UUID.fullmatch(issue_id):
+        return 64  # listener makes the durable metadata-only dead letter; no unknown event is acknowledged
+    event_id, issue_id = event_id.lower(), issue_id.lower()
+    fleek = config.get("fleek", "/opt/fleek/bin/fleek")
+    identity = command([fleek, "whoami", "--json"])
+    if identity.get("installation", {}).get("id", "").lower() != config["expectedInstallationId"] or identity.get("workspace", {}).get("id", "").lower() != config["workspaceId"]:
+        return DENIED
+    context = command([fleek, "context", issue_id, "--json"])
+    subject = context.get("subject", {})
+    if subject.get("id", "").lower() != issue_id or not re.fullmatch(re.escape(config["project"]) + r"-[1-9][0-9]*", subject.get("identifier", "")):
+        return 64
+    state = Path(os.environ["STATE_DIRECTORY"])
+    if not state.is_dir() or state.is_symlink() or state.stat().st_uid != os.getuid() or state.stat().st_mode & 0o077:
+        raise ValueError("private state required")
+    quota(state)
+    # Per-broker serialization covers a second listener started by mistake as well.
+    with (state / "job.lock").open("a") as lock:
+        os.chmod(state / "job.lock", 0o600)
+        fcntl.flock(lock, fcntl.LOCK_EX)
+        job = Path(tempfile.mkdtemp(prefix="job-", dir=os.environ["RUNTIME_DIRECTORY"]))
+        proxy = agent = None
+        name = "fleek-" + uuid.uuid4().hex
+        exit_code = 1
+        def outcome(code):
+            nonlocal exit_code
+            exit_code = code
+            return code
+        started = time.monotonic()
+        provider = config.get("provider", "claude")
+        container_env = {key: os.environ[key] for key in ("PATH", "HOME", "XDG_RUNTIME_DIR") if key in os.environ}
+        try:
+            inputs = job / "input"
+            inputs.mkdir(mode=0o700)
+            (inputs / "kit.md").write_text(kit_text(fleek, config["project"], job))
+            (inputs / "mcp.json").write_text(json.dumps({"mcpServers": {"fleek": {"command": "socat", "args": ["STDIO", "UNIX-CONNECT:/job/mcp.sock"]}}}))
+            (inputs / "settings.json").write_text(json.dumps({"permissions": {"deny": ["Read(/proc/**)", "Read(/run/**)"]}}))
+            with (job / "proxy.log").open("wb") as proxy_log, (job / "agent.stdout").open("wb") as stdout, (job / "agent.stderr").open("wb") as stderr:
+                proxy = subprocess.Popen([fleek, "mcp", "serve", "--socket", str(inputs / "mcp.sock"), "--job", event_id], stdout=proxy_log, stderr=proxy_log)
+                deadline = time.monotonic() + 10
+                while not (inputs / "mcp.sock").exists():
+                    if proxy.poll() is not None:
+                        return outcome(proxy.returncode)
+                    if time.monotonic() >= deadline:
+                        return outcome(1)
+                    time.sleep(0.05)
+                container_env.update(provider_env(provider))
+                argv = container_args(config["image"], name, job, {key: value for key, value in container_env.items() if key in ("CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY", "CODEX_API_KEY")})
+                agent = subprocess.Popen(argv + agent_args(provider, event_id, issue_id), env=container_env, stdin=subprocess.DEVNULL, stdout=stdout, stderr=stderr)
+                while agent.poll() is None:
+                    if proxy.poll() is not None:
+                        return outcome(proxy.returncode if proxy.returncode in (DENIED, LOGIN) else 1)
+                    if time.monotonic() - started >= 600:
+                        return outcome(75)
+                    time.sleep(0.1)
+                # A just-denied proxy may still be exiting when the CLI returns. Never acknowledge that race.
+                try:
+                    proxy.wait(timeout=1)
+                except subprocess.TimeoutExpired:
+                    pass
+                exit_code = proxy.returncode if proxy.poll() in (DENIED, LOGIN) else 0 if agent.returncode == 0 else 1
+                # provider sign-in outcome for the host report (only "ok"/"expired" is stored, never agent text)
+                if agent.returncode == 0 or exit_code in (DENIED, LOGIN):
+                    auth = "ok" if agent.returncode == 0 else None
+                else:
+                    with (job / "agent.stdout").open("rb") as out, (job / "agent.stderr").open("rb") as err:
+                        auth = "expired" if PROVIDER_AUTH_FAILED.search(out.read(1024 * 1024) + err.read(1024 * 1024)) else None
+                if auth:
+                    fd = os.open(state / "provider-auth", os.O_WRONLY | os.O_CREAT | os.O_TRUNC | os.O_NOFOLLOW, 0o600)
+                    with os.fdopen(fd, "w") as stream:
+                        stream.write(auth)
+                return exit_code
+        except SystemExit as error:
+            exit_code = error.code if isinstance(error.code, int) else 1
+            raise
+        finally:
+            # systemd and the listener can both send TERM; teardown must not be interrupted twice.
+            for sig in (signal.SIGTERM, signal.SIGINT):
+                signal.signal(sig, signal.SIG_IGN)
+            # Container removal is required even when Podman's client process already exited or was signaled.
+            cleanup_failed = False
+            try:
+                result = subprocess.run(["podman", "--cgroup-manager=cgroupfs", "rm", "--force", "--time=0", "--ignore", name], env=container_env, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, timeout=5, check=False)
+                cleanup_failed = result.returncode != 0
+            except (OSError, subprocess.SubprocessError):
+                cleanup_failed = True
+            finally:
+                for child in (agent, proxy):
+                    if child and child.poll() is None:
+                        child.terminate()
+                        try:
+                            child.wait(timeout=2)
+                        except subprocess.TimeoutExpired:
+                            child.kill()
+                            child.wait(timeout=2)
+                shutil.rmtree(job)
+            if cleanup_failed:
+                exit_code = DENIED
+            stamp = datetime.datetime.now(datetime.timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z")
+            try:
+                last = Path(os.environ["STATE_DIRECTORY"]) / "last-job-at"
+                fd = os.open(last, os.O_WRONLY | os.O_CREAT | os.O_TRUNC | os.O_NOFOLLOW, 0o600)
+                with os.fdopen(fd, "w") as stream:
+                    stream.write(stamp)
+            except (OSError, KeyError):
+                pass
+            host_report(fleek, provider_state(state), None, stamp, timeout=5)
+            # Only validated IDs and numeric metadata ever reach journald. No agent-derived text/statistics.
+            print(json.dumps({"eventId": event_id, "kind": "review", "exit": exit_code, "durationMs": int((time.monotonic() - started) * 1000), "cleanupFailed": cleanup_failed}), flush=True)
+            if cleanup_failed:
+                raise SystemExit(DENIED)
+
+
+def interrupted(_signal, _frame):
+    raise SystemExit(75)
+
+
+if __name__ == "__main__":
+    os.umask(0o077)
+    for sig in (signal.SIGTERM, signal.SIGINT):
+        signal.signal(sig, interrupted)
+    try:
+        result = run(sys.argv[1])
+    except (ValueError, KeyError, TypeError, OSError, subprocess.SubprocessError):
+        result = 1  # exception text can contain credentials or event content; never log it
+    sys.exit(result)

package/service-agents/run-service

@@ -0,0 +1,32 @@
+#!/bin/sh
+# Both system and user units keep D-Bus + the unlocked OS keyring in the broker's own service cgroup.
+set -eu
+export GNOME_KEYRING_CONTROL="$RUNTIME_DIRECTORY/keyring"
+mkdir -p -m 0700 "$GNOME_KEYRING_CONTROL"
+if [ "${1:-}" != --inside-private-bus ]; then
+  exec dbus-run-session -- "$0" --inside-private-bus "$@"
+fi
+shift
+[ "${1:-}" = review ] && [ "${2:-}" = /etc/fleek-agents/review.json ] || exit 2
+/opt/fleek-agents/unlock-keyring
+# WZ-CLI-SVC: host state for Fleek every minute (contract: "Alles grün" needs a report younger than 5 minutes). Same unit, same keyring;
+# KillMode=control-group ends it with the service. The unit only starts with its provider credential: "ok" unless the last
+# job recorded a failed provider sign-in ("expired", file written by run-job).
+(
+  while :; do
+    auth=$(cat "$STATE_DIRECTORY/provider-auth" 2>/dev/null || true)
+    case $auth in expired) ;; *) auth=ok ;; esac
+    last=$(cat "$STATE_DIRECTORY/last-job-at" 2>/dev/null || true)
+    case $last in [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]T[0-9][0-9]:[0-9][0-9]:[0-9][0-9]Z) set -- --last-job-at "$last" ;; *) set -- ;; esac
+    /opt/fleek/bin/fleek service host-report --provider-auth "$auth" "$@" --json >/dev/null 2>&1 || true
+    sleep 60
+  done
+) &
+# E10: the broker's existing private bus/keyring/cgroup; no server job or per-drift notification.
+(
+  while :; do
+    /opt/fleek-agents/knowledge-poll /etc/fleek-agents/review.json || true
+    sleep 900
+  done
+) &
+exec /opt/fleek/bin/fleek listen --name review --concurrency 1 --timeout 660 --quiet-children --exec /opt/fleek-agents/run-job /etc/fleek-agents/review.json

package/service-agents/unlock-keyring

@@ -0,0 +1,4 @@
+#!/bin/sh
+set -eu
+# No shell expansion of credential values, argv, files or terminal output.
+exec gnome-keyring-daemon --unlock --components=secrets --control-directory="$GNOME_KEYRING_CONTROL" < "$CREDENTIALS_DIRECTORY/keyring-unlock" > /dev/null 2>&1