@logic-joe/fleek 0.2.0 → 0.2.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logic-joe/fleek",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "fleek - command line client for the Fleek agent hub (MCP over OAuth, OS keychain, signed role/project kits)",
   "license": "Apache-2.0",
   "type": "module",

package/service-agents/install-system-service

@@ -10,8 +10,8 @@ broker_uid=$(id -u "$broker")
 broker_home=$(getent passwd "$broker" | cut -d: -f6)
 [ "$broker_uid" -gt 0 ] && [ "$broker_home" = /home/fa-review ] || exit 77
 install -d -m 0755 /opt/fleek-agents
-if [ "$source_dir" != /opt/fleek-agents ]; then install -m 0755 "$source_dir/run-job" "$source_dir/unlock-keyring" "$source_dir/run-service" "$source_dir/kit-setup" "$source_dir/broker-run" /opt/fleek-agents/; fi
-chmod 0755 /opt/fleek-agents/run-job /opt/fleek-agents/unlock-keyring /opt/fleek-agents/run-service /opt/fleek-agents/kit-setup /opt/fleek-agents/broker-run
+if [ "$source_dir" != /opt/fleek-agents ]; then install -m 0755 "$source_dir/run-job" "$source_dir/knowledge-poll" "$source_dir/unlock-keyring" "$source_dir/run-service" "$source_dir/kit-setup" "$source_dir/broker-run" /opt/fleek-agents/; fi
+chmod 0755 /opt/fleek-agents/knowledge-poll /opt/fleek-agents/run-job /opt/fleek-agents/unlock-keyring /opt/fleek-agents/run-service /opt/fleek-agents/kit-setup /opt/fleek-agents/broker-run
 # Every level of ~/.config belongs to the broker (install -d sets owner/mode only on the NAMED directories, so naming
 # just .config/systemd/user left .config root-owned and `fleek login` could not create ~/.config/fleek - SVCLOGIN).
 # Re-running the installer repairs an existing host: install -d also re-applies owner/mode to existing directories.

package/service-agents/kit-setup

@@ -5,6 +5,10 @@
 # boundary stays. This runs `fleek kit setup` once as the broker with the service's profile (HOME), its OS keyring (private
 # D-Bus, unlocked from the service's own encrypted credential) and a working directory outside every git checkout (like
 # run-job's job directory), then repeats run-job's exact pull without a terminal to prove it needs no confirmation now.
+# ONF-225: the plugins of the approved kits (e.g. the FirstSpirit AI Toolkit) are installed by this setup without a question
+# (service account: the admin's approval of the signed kit is the confirmation; needs the `claude` CLI on the host, used only for
+# `plugin install|list`); run-job copies their skill Markdown read-only into the review container. Ready only when every declared
+# plugin is installed in the approved version with a skills/ directory (VF-R2: `kit run --dry-run` names each gap with its reason).
 # Usage: sudo /opt/fleek-agents/kit-setup review        (then: systemctl restart fleek-agent-review.service)
 set -euo pipefail
 if [ "${1:-}" != --as-broker ]; then
@@ -52,8 +56,24 @@ cd "$job"
 set +e
 fleek kit pull "$project" --target claude --yes --json </dev/null >/dev/null 2>&1
 pulled=$?
+# VF-R2: the job's vendor skills - every plugin the approved kits declare must give the job a usable skills directory
+launch=$(fleek kit run claude --project "$project" --dry-run --json </dev/null 2>/dev/null)
+launched=$?
 set -e
 cd /
 rm -rf "$job"
 if [ "$pulled" -ne 0 ]; then echo "run-job is NOT ready: unattended kit pull exits $pulled" >&2; exit "$pulled"; fi
-echo "run-job ready: the unattended kit pull needs no confirmation. Next: systemctl restart fleek-agent-review.service"
+if [ "$launched" -ne 0 ]; then echo "run-job is NOT ready: kit run --dry-run exits $launched" >&2; exit "$launched"; fi
+gaps=$(printf '%s' "$launch" | python3 -I -c 'import json, re, sys
+for gap in json.load(sys.stdin).get("vendorPluginsMissing", [])[:5]:
+    plugin, reason, installed = (str(gap.get(key) or "") for key in ("plugin", "reason", "installed"))
+    if re.fullmatch(r"[a-z0-9@._-]{1,129}", plugin) and re.fullmatch(r"[a-z_]{1,20}", reason):
+        print(f"  {plugin}: {reason}" + (f" (installed {installed})" if re.fullmatch(r"[0-9A-Za-z.+-]{1,64}", installed) else ""))')
+if [ -n "$gaps" ]; then
+  printf 'run-job is NOT ready for the vendor skills of the approved kits (the job would run without them):\n%s\n' "$gaps" >&2
+  echo 'Fix: install / enable the approved version for this account (re-run this setup), or ask the admin to approve the installed version.' >&2
+  exit 13
+fi
+# Exit 13 of `kit setup` here only means optional host entries stayed open (e.g. MCP proposals answered N); the job needs none.
+[ "$setup" -eq 13 ] && echo "kit setup left optional host entries open (exit 13) - not needed by run-job."
+echo "run-job ready: the unattended kit pull needs no confirmation, every declared vendor plugin gives the job its skills. Next: systemctl restart fleek-agent-review.service"

package/service-agents/knowledge-poll

@@ -0,0 +1,232 @@
+#!/usr/bin/env python3
+"""E10: one host-side poll, called every 15 minutes by the existing broker service.
+The broker owns STATE_DIRECTORY/repository (an ordinary, clean clone with its own Git read login).
+Only a changed default-branch HEAD runs fleek init; agents see the CLI's allowlisted staging, never the clone or broker keys.
+"""
+import datetime
+import fcntl
+import importlib.machinery
+import importlib.util
+import json
+import os
+from pathlib import Path
+import re
+import selectors
+import signal
+import stat
+import subprocess
+import sys
+import tempfile
+import time
+import uuid
+
+loader = importlib.machinery.SourceFileLoader("fleek_starter", str(Path(__file__).with_name("run-job")))
+spec = importlib.util.spec_from_loader(loader.name, loader)
+starter = importlib.util.module_from_spec(spec)
+loader.exec_module(starter)
+SHA = re.compile(r"^[0-9a-f]{40}(?:[0-9a-f]{24})?$")
+FLEEK = "/opt/fleek/bin/fleek"
+
+
+def git(repo, *args):
+    # No checkout hooks, fsmonitor hooks, recursive submodules or repository-selected executable protocols.
+    result = subprocess.run(["git", "-c", "core.hooksPath=/dev/null", "-c", "core.fsmonitor=false", "-c", "protocol.ext.allow=never",
+                             "-c", "protocol.file.allow=never", *args], cwd=repo, stdin=subprocess.DEVNULL,
+                            stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, timeout=60, check=False)
+    if result.returncode or len(result.stdout) > 1024 * 1024:
+        raise ValueError("repository_not_readable")
+    return result.stdout.decode("utf-8", "strict")
+
+
+def remote_head(repo):
+    lines = git(repo, "ls-remote", "--symref", "origin", "HEAD").splitlines()
+    branch = next((line[5:].split("\t", 1)[0] for line in lines if line.startswith("ref: ")), None)
+    commit = next((line.split("\t", 1)[0] for line in lines if line.endswith("\tHEAD") and not line.startswith("ref: ")), None)
+    if not branch or not re.fullmatch(r"refs/heads/[A-Za-z0-9_./-]{1,200}", branch) or ".." in branch or not commit or not SHA.fullmatch(commit):
+        raise ValueError("repository_not_readable")
+    return branch, commit
+
+
+def analyze(config, state, repo, profile):
+    if config.get("provider", "claude") != "claude":
+        raise ValueError("init_provider_unavailable")
+    poll_quota(state)
+    provider = starter.provider_env("claude")
+    # No Fleek/Git/keyring credential or repo customization enters this container.
+    with tempfile.TemporaryDirectory(prefix="knowledge-", dir=state) as temp:
+        job = Path(temp)
+        work = job / "work"
+        work.mkdir(mode=0o700)
+        proc = subprocess.Popen([FLEEK, "init", "--project", config["project"], "--refresh", "--maintenance", "--all-apps",
+                                 "--agent", "manual", "--yes", "--json", "--profile", profile, "--work-dir", str(work)], cwd=repo,
+                                stdin=subprocess.DEVNULL, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, start_new_session=True)
+        containers = []
+        done = False
+        try:
+            selector = selectors.DefaultSelector()
+            selector.register(proc.stdout, selectors.EVENT_READ)
+            deadline = time.monotonic() + 3600
+            while proc.poll() is None or not done:
+                if time.monotonic() > deadline:
+                    raise ValueError("analysis_timeout")
+                if not selector.select(timeout=10):
+                    if proc.poll() is not None:
+                        break
+                    continue
+                line = proc.stdout.readline(65537)
+                if not line:
+                    break
+                if len(line) > 65536 or not line.endswith(b"\n"):
+                    raise ValueError("analysis_output_invalid")
+                event = json.loads(line)
+                if event.get("event") == "staged":
+                    staging, output = Path(event["stagingDir"]), Path(event["outputFile"])
+                    if not staging.resolve().is_relative_to(work.resolve()) or not output.parent.resolve().is_relative_to(work.resolve()):
+                        raise ValueError("analysis_path_invalid")
+                    if staging.is_symlink() or output.parent.is_symlink():
+                        raise ValueError("analysis_path_invalid")
+                    name = "fleek-init-" + uuid.uuid4().hex
+                    containers.append(name)
+                    argv = starter.container_args(config["image"], name, job, provider)
+                    mount = f"type=bind,src={job / 'input'},dst=/job,ro=true"
+                    argv[argv.index(mount)] = f"type=bind,src={staging},dst=/job,ro=true"
+                    argv += ["claude", "-p", "Read fleek-input.json and the allowed files. Return ONLY the JSON object requested by FLEEK-INIT.md.",
+                             "--output-format", "text", "--no-session-persistence", "--tools", "Read,Glob,Grep", "--allowedTools", "Read,Glob,Grep",
+                             "--permission-mode", "dontAsk", "--strict-mcp-config", "--mcp-config", '{"mcpServers":{}}',
+                             "--settings", '{"disableAllHooks":true,"permissions":{"deny":["Read(/proc/**)","Read(/run/**)"]}}', "--setting-sources", "", "--append-system-prompt-file", "/job/FLEEK-INIT.md"]
+                    # A file avoids retaining provider output/logs in memory or the journal; the service bounds files to 16 MiB.
+                    target = output.with_suffix(".tmp")
+                    fd = os.open(target, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600)
+                    with os.fdopen(fd, "wb") as stream:
+                        agent = subprocess.run(argv, stdin=subprocess.DEVNULL, stdout=stream, stderr=subprocess.DEVNULL,
+                                               env={**os.environ, **provider}, timeout=1800, check=False)
+                    if agent.returncode or target.stat().st_size > 65536:
+                        raise ValueError("analysis_failed")
+                    target.rename(output)
+                if event.get("event") == "error":
+                    raise ValueError("analysis_failed")
+                if event.get("event") == "done":
+                    done = event.get("failed") == 0
+                    break
+            if proc.wait(timeout=30) or not done:
+                raise ValueError("analysis_failed")
+        finally:
+            if proc.poll() is None:
+                os.killpg(proc.pid, signal.SIGTERM)
+                try:
+                    proc.wait(timeout=10)
+                except subprocess.TimeoutExpired:
+                    os.killpg(proc.pid, signal.SIGKILL)
+                    proc.wait()
+            for name in containers:
+                subprocess.run(["podman", "rm", "-f", name], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, timeout=30, check=False)
+
+
+def write_state(path, record):
+    fd, temp = tempfile.mkstemp(prefix="knowledge-state-", dir=path.parent)
+    with os.fdopen(fd, "w") as stream:
+        json.dump(record, stream)
+    os.replace(temp, path)
+
+
+def poll_quota(state):
+    # This poll never consumes the review worker's quota.json / 50 daily jobs.
+    path = state / "knowledge-quota.json"
+    today = datetime.datetime.now(datetime.timezone.utc).date().isoformat()
+    try:
+        data = json.loads(starter.private_file(path).read_text())
+    except (OSError, ValueError):
+        data = {}
+    count = data.get("count", 0) if data.get("date") == today else 0
+    if not isinstance(count, int) or count >= 8:
+        raise ValueError("knowledge_daily_limit")
+    write_state(path, {"date": today, "count": count + 1})
+
+
+def verified_profile(config):
+    # Profile files contain routing metadata only. Fix the exact configured installation before using a checkout binding.
+    directory = Path(os.environ.get("FLEEK_CONFIG_DIR") or Path(os.environ.get("XDG_CONFIG_HOME") or Path.home() / ".config") / "fleek")
+    profiles = json.loads(starter.private_file(directory / "profiles.json").read_text()).get("profiles", {})
+    matches = [key for key, value in profiles.items() if re.fullmatch(r"[0-9a-f]{32}", key)
+               and value.get("workspace", {}).get("id", "").lower() == config["workspaceId"]
+               and value.get("holder", {}).get("kind") == "installation"
+               and value.get("holder", {}).get("id", "").lower() == config["expectedInstallationId"] and not value.get("needsLogin")]
+    if len(matches) != 1:
+        raise ValueError("identity_unavailable")
+    profile = matches[0]
+    identity = starter.command([FLEEK, "whoami", "--profile", profile, "--json"])
+    if (identity.get("installation", {}).get("id", "").lower() != config["expectedInstallationId"]
+            or identity.get("workspace", {}).get("id", "").lower() != config["workspaceId"]
+            or identity.get("principal", {}).get("kind") != "service_account" or identity.get("grantClass") != "G4x"):
+        raise ValueError("identity_unavailable")
+    return profile
+
+
+def poll(config, state, profile=None):
+    profile = profile or verified_profile(config)
+    # Statements are independent of a merge and are drained even when Git is unchanged/unreadable.
+    statements_ok = True
+    try:
+        starter.command([FLEEK, "service", "knowledge-check", config["project"], "--profile", profile, "--json"])
+    except (SystemExit, ValueError, OSError, subprocess.SubprocessError):
+        statements_ok = False
+    repo = state / "repository"
+    info = repo.lstat()
+    if not stat.S_ISDIR(info.st_mode) or stat.S_ISLNK(info.st_mode) or info.st_uid != os.getuid() or info.st_mode & 0o077:
+        raise ValueError("repository_not_readable")
+    branch, commit = remote_head(repo)
+    previous = state / "knowledge-checked.json"
+    try:
+        last = json.loads(starter.private_file(previous).read_text())
+    except (OSError, ValueError):
+        last = {}
+    scope = {"project": config["project"], "workspaceId": config.get("workspaceId"), "installationId": config.get("expectedInstallationId")}
+    if last.get("commit") == commit and all(last.get(key) == value for key, value in scope.items()):
+        return "checked" if statements_ok else "not_checkable"
+    failure_path = state / "knowledge-failed.json"
+    try:
+        failure = json.loads(starter.private_file(failure_path).read_text())
+    except (OSError, ValueError):
+        failure = {}
+    same_failure = failure.get("commit") == commit and all(failure.get(key) == value for key, value in scope.items())
+    if same_failure and (failure.get("count", 0) >= 3 or time.time() < failure.get("retryAt", 0)):
+        return "not_checkable"
+    if git(repo, "status", "--porcelain=v1").strip():
+        raise ValueError("repository_dirty")
+    git(repo, "fetch", "--no-tags", "--recurse-submodules=no", "origin", branch)
+    # Default-branch movement during the fetch is retryable; never record a different commit as checked.
+    fetched = git(repo, "rev-parse", "FETCH_HEAD").strip()
+    if fetched != commit:
+        raise ValueError("repository_changed")
+    git(repo, "checkout", "--detach", commit)
+    try:
+        analyze(config, state, repo, profile)
+    except (ValueError, OSError, KeyError, TypeError, AttributeError, subprocess.SubprocessError):
+        count = failure.get("count", 0) + 1 if same_failure else 1
+        write_state(failure_path, {**scope, "commit": commit, "count": count, "retryAt": time.time() + 6 * 3600})
+        raise
+    record = {**scope, "commit": commit, "checkedAt": datetime.datetime.now(datetime.timezone.utc).isoformat(), "result": "checked"}
+    write_state(previous, record)
+    return "checked" if statements_ok else "not_checkable"
+
+
+def main():
+    state = Path(os.environ["STATE_DIRECTORY"])
+    config = starter.load_config(sys.argv[1])
+    with os.fdopen(os.open(state / "knowledge-poll.lock", os.O_WRONLY | os.O_CREAT | os.O_NOFOLLOW, 0o600), "w") as lock:
+        try:
+            fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
+        except BlockingIOError:
+            return 0
+        try:
+            result = poll(config, state)
+            print(json.dumps({"result": result}), flush=True)
+            return 0
+        except (SystemExit, ValueError, OSError, KeyError, TypeError, AttributeError, subprocess.SubprocessError):
+            # A fixed result only: never Git/provider stderr, code, configuration or credentials.
+            print('{"result":"not_checkable"}', flush=True)
+            return 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/service-agents/run-job

@@ -107,13 +107,16 @@ def container_args(image, name, job, provider):
     return args
 
 
-def agent_args(provider, event_id, issue_id):
+def agent_args(provider, event_id, issue_id, plugins=()):
     prompt = f"Job review; eventId={event_id}; issueId={issue_id}."
     if provider == "claude":
-        return ["claude", "-p", prompt, "--output-format", "json", "--max-turns", "30", "--tools", "",
-                "--allowedTools", "mcp__fleek__*", "--permission-mode", "dontAsk", "--strict-mcp-config",
+        # ONF-225: vendor plugin skills (Markdown copies below /job/plugins) need the Skill tool and reads of exactly that tree
+        tools = ["--tools", "Skill,Read", "--allowedTools", "mcp__fleek__*", "Skill", "Read(//job/plugins/**)"] if plugins else ["--tools", "", "--allowedTools", "mcp__fleek__*"]
+        dirs = [arg for name in plugins for arg in ("--plugin-dir", f"/job/plugins/{name}")]
+        return ["claude", "-p", prompt, "--output-format", "json", "--max-turns", "30", *tools,
+                "--permission-mode", "dontAsk", "--strict-mcp-config",
                 "--mcp-config", "/job/mcp.json", "--settings", "/job/settings.json", "--setting-sources", "",
-                "--append-system-prompt-file", "/job/kit.md"]
+                *dirs, "--append-system-prompt-file", "/job/kit.md"]
     return ["codex", "exec", "--json", "--skip-git-repo-check", "--sandbox", "read-only", "--ephemeral",
             "-c", 'forced_login_method="api"', "-c", 'web_search="disabled"', "-c", "features.shell_tool=false",
             "-c", "features.apply_patch_freeform=false", "-c", "features.multi_agent=false", "-c", "features.multi_agent_v2=false", "-c", "features.js_repl=false",
@@ -154,7 +157,114 @@ def host_report(fleek, provider_auth, kit=None, last_job_at=None, timeout=20):
         pass
 
 
-def kit_text(fleek, project, cwd):
+PLUGIN_NAME = re.compile(r"[a-z0-9][a-z0-9._-]{0,63}")
+PLUGIN_VERSION = re.compile(r"[0-9A-Za-z.+-]{1,64}")
+PLUGIN_ID = re.compile(r"[a-z0-9][a-z0-9._-]{0,63}@[a-z0-9][a-z0-9._-]{0,63}")
+VENDOR_GAP_REASONS = ("other_version", "disabled", "missing", "unchecked", "unverified", "error", "no_client", "outside_cache", "no_skills")
+VENDOR_MAX_FILES, VENDOR_MAX_BYTES, VENDOR_MAX_ENTRIES, VENDOR_MAX_FILE = 2000, 8 * 1024 * 1024, 10000, 1024 * 1024
+
+
+def inert_markdown(data, skill):
+    # Vendor text is data for the agent, never configuration: a SKILL.md keeps only name + description of its frontmatter
+    # (no allowed-tools, hooks, model, ...), and Claude Code's `!`cmd`` pre-execution syntax is broken up everywhere.
+    text = data.decode("utf-8").replace("!`", "! `")
+    if skill:
+        match = re.match(r"---\n(.*?)\n---\n?", text, re.S)
+        fields = {}
+        if match:
+            lines = match.group(1).split("\n")
+            for index, line in enumerate(lines):
+                key, _, value = line.partition(":")
+                value = value.strip()
+                if key not in ("name", "description") or not value:
+                    continue
+                if value in (">", "|", ">-", "|-"):  # a folded / literal block: its indented lines
+                    block = []
+                    for more in lines[index + 1:]:
+                        if not more.startswith((" ", "\t")):
+                            break
+                        block.append(more.strip())
+                    value = " ".join(part for part in block if part)
+                fields[key] = value.strip('"').strip("'")[:1024]
+            text = text[match.end():]
+        head = "".join(f"{key}: {json.dumps(fields[key])}\n" for key in ("name", "description") if key in fields)
+        text = f"---\n{head}---\n\n{text}"
+    return text.encode("utf-8")
+
+
+def read_regular(path):
+    # no symlink is followed (O_NOFOLLOW), the size is bounded before anything is read
+    fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW)
+    try:
+        info = os.fstat(fd)
+        if not stat.S_ISREG(info.st_mode) or info.st_size > VENDOR_MAX_FILE:
+            raise ValueError("unsafe vendor plugin")
+        with os.fdopen(fd, "rb", closefd=False) as stream:
+            data = stream.read(VENDOR_MAX_FILE + 1)
+    finally:
+        os.close(fd)
+    if len(data) > VENDOR_MAX_FILE:
+        raise ValueError("unsafe vendor plugin")
+    return data
+
+
+def vendor_plugins(launch, inputs):
+    # ONF-225: the vendor plugins of the project's pinned kits, as the CLI reports them for the verified generation (installed by
+    # `kit setup` on this host with exactly the approved version, below the client's plugin cache). Only plain Markdown below the
+    # plugin's skills/ enters the container (no hooks, scripts, MCP entries, settings); no symlink is followed, nothing is fetched.
+    # VF-R2: the declared plugins the CLI could not hand over (reason only), plus the ones without a Markdown file below skills/; reported in the
+    # job's metadata line, the job runs without them.
+    entries, gaps = launch.get("vendorPlugins", []), launch.get("vendorPluginsMissing", [])
+    if not isinstance(entries, list) or len(entries) > 5 or not isinstance(gaps, list) or len(gaps) > 5:
+        raise ValueError("invalid vendor plugins")
+    missing = []
+    for gap in gaps:
+        plugin, reason = (gap.get("plugin"), gap.get("reason")) if isinstance(gap, dict) else (None, None)
+        if not isinstance(plugin, str) or not PLUGIN_ID.fullmatch(plugin) or reason not in VENDOR_GAP_REASONS:
+            raise ValueError("invalid vendor plugin")
+        missing.append({"plugin": plugin, "reason": reason})
+    names, files, total, walked = [], 0, 0, 0
+    for entry in entries:
+        name, version, source = (entry.get(key) for key in ("name", "version", "dir")) if isinstance(entry, dict) else (None, None, None)
+        if not isinstance(name, str) or not PLUGIN_NAME.fullmatch(name) or name in names or not isinstance(version, str) or not PLUGIN_VERSION.fullmatch(version) \
+                or not isinstance(source, str) or not os.path.isabs(source):
+            raise ValueError("invalid vendor plugin")
+        plugin = entry.get("plugin") if isinstance(entry.get("plugin"), str) and PLUGIN_ID.fullmatch(entry["plugin"]) else name
+        root = Path(source)
+        skills = root / "skills"
+        if root.is_symlink() or skills.is_symlink() or not skills.is_dir():
+            missing.append({"plugin": plugin, "reason": "no_skills"})
+            continue
+        target = inputs / "plugins" / name
+        for directory, subdirs, children in os.walk(skills, followlinks=False):
+            subdirs.sort()
+            walked += len(subdirs) + len(children)
+            if walked > VENDOR_MAX_ENTRIES:
+                raise ValueError("vendor plugins too large")
+            for child in sorted(children):
+                file = Path(directory) / child
+                if not child.endswith(".md"):
+                    continue
+                if not file.resolve().is_relative_to(skills.resolve()):
+                    raise ValueError("unsafe vendor plugin")
+                data = inert_markdown(read_regular(file), child == "SKILL.md")
+                files, total = files + 1, total + len(data)
+                if files > VENDOR_MAX_FILES or total > VENDOR_MAX_BYTES:
+                    raise ValueError("vendor plugins too large")
+                dest = target / "skills" / file.relative_to(skills)
+                dest.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+                dest.write_bytes(data)
+        if (target / "skills").is_dir():
+            (target / ".claude-plugin").mkdir(mode=0o700)
+            (target / ".claude-plugin" / "plugin.json").write_text(json.dumps({"name": name, "version": version}))
+            names.append(name)
+        else:
+            # VF-R4: an empty or non-Markdown-only skills/ gives the job nothing
+            missing.append({"plugin": plugin, "reason": "no_skills"})
+    return names, missing
+
+
+def kit_text(fleek, project, cwd, inputs):
     # WZ-CLI-SVC (founder 25.10.2026): new kit versions an admin released, signed and pinned to this project are taken over
     # without a root terminal (--accept-approved: service-account logins only; kit MCP entries are only noted - the container
     # below still gets nothing but the Fleek socket).
@@ -176,7 +286,8 @@ def kit_text(fleek, project, cwd):
     text = "\n\n".join(parts)
     if not text or len(text.encode()) > 120000:
         raise ValueError("invalid kit")
-    return text
+    names, missing = vendor_plugins(launch, inputs)
+    return text, names, missing
 
 
 def run(config_path):
@@ -217,14 +328,18 @@ def run(config_path):
             exit_code = code
             return code
         started = time.monotonic()
+        vendor_missing = []
         provider = config.get("provider", "claude")
         container_env = {key: os.environ[key] for key in ("PATH", "HOME", "XDG_RUNTIME_DIR") if key in os.environ}
         try:
             inputs = job / "input"
             inputs.mkdir(mode=0o700)
-            (inputs / "kit.md").write_text(kit_text(fleek, config["project"], job))
+            text, plugins, vendor_missing = kit_text(fleek, config["project"], job, inputs)
+            (inputs / "kit.md").write_text(text)
             (inputs / "mcp.json").write_text(json.dumps({"mcpServers": {"fleek": {"command": "socat", "args": ["STDIO", "UNIX-CONNECT:/job/mcp.sock"]}}}))
-            (inputs / "settings.json").write_text(json.dumps({"permissions": {"deny": ["Read(/proc/**)", "Read(/run/**)"]}}))
+            # absolute paths (`//`): a single leading slash would be relative to the settings file; no hook ever runs in the job
+            (inputs / "settings.json").write_text(json.dumps({"disableAllHooks": True,
+                "permissions": {"deny": ["Read(//proc/**)", "Read(//run/**)", "Read(//home/**)", "Read(//tmp/**)"]}}))
             with (job / "proxy.log").open("wb") as proxy_log, (job / "agent.stdout").open("wb") as stdout, (job / "agent.stderr").open("wb") as stderr:
                 proxy = subprocess.Popen([fleek, "mcp", "serve", "--socket", str(inputs / "mcp.sock"), "--job", event_id], stdout=proxy_log, stderr=proxy_log)
                 deadline = time.monotonic() + 10
@@ -236,7 +351,7 @@ def run(config_path):
                     time.sleep(0.05)
                 container_env.update(provider_env(provider))
                 argv = container_args(config["image"], name, job, {key: value for key, value in container_env.items() if key in ("CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY", "CODEX_API_KEY")})
-                agent = subprocess.Popen(argv + agent_args(provider, event_id, issue_id), env=container_env, stdin=subprocess.DEVNULL, stdout=stdout, stderr=stderr)
+                agent = subprocess.Popen(argv + agent_args(provider, event_id, issue_id, plugins if provider == "claude" else ()), env=container_env, stdin=subprocess.DEVNULL, stdout=stdout, stderr=stderr)
                 while agent.poll() is None:
                     if proxy.poll() is not None:
                         return outcome(proxy.returncode if proxy.returncode in (DENIED, LOGIN) else 1)
@@ -296,7 +411,9 @@ def run(config_path):
                 pass
             host_report(fleek, provider_state(state), None, stamp, timeout=5)
             # Only validated IDs and numeric metadata ever reach journald. No agent-derived text/statistics.
-            print(json.dumps({"eventId": event_id, "kind": "review", "exit": exit_code, "durationMs": int((time.monotonic() - started) * 1000), "cleanupFailed": cleanup_failed}), flush=True)
+            # VF-R2: declared vendor plugins the job ran without (validated plugin id + fixed reason)
+            print(json.dumps({"eventId": event_id, "kind": "review", "exit": exit_code, "durationMs": int((time.monotonic() - started) * 1000), "cleanupFailed": cleanup_failed,
+                              **({"vendorSkillsMissing": vendor_missing} if vendor_missing else {})}), flush=True)
             if cleanup_failed:
                 raise SystemExit(DENIED)
 

package/service-agents/run-service

@@ -22,4 +22,11 @@ shift
     sleep 60
   done
 ) &
+# E10: the broker's existing private bus/keyring/cgroup; no server job or per-drift notification.
+(
+  while :; do
+    /opt/fleek-agents/knowledge-poll /etc/fleek-agents/review.json || true
+    sleep 900
+  done
+) &
 exec /opt/fleek/bin/fleek listen --name review --concurrency 1 --timeout 660 --quiet-children --exec /opt/fleek-agents/run-job /etc/fleek-agents/review.json