@logic-joe/fleek 0.2.1 → 0.2.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logic-joe/fleek",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "fleek - command line client for the Fleek agent hub (MCP over OAuth, OS keychain, signed role/project kits)",
   "license": "Apache-2.0",
   "type": "module",

package/service-agents/kit-setup

@@ -5,6 +5,12 @@
 # boundary stays. This runs `fleek kit setup` once as the broker with the service's profile (HOME), its OS keyring (private
 # D-Bus, unlocked from the service's own encrypted credential) and a working directory outside every git checkout (like
 # run-job's job directory), then repeats run-job's exact pull without a terminal to prove it needs no confirmation now.
+# ONF-225: the plugins of the approved kits (e.g. the FirstSpirit AI Toolkit) are installed by this setup without a question
+# (service account: the admin's approval of the signed kit is the confirmation; needs the `claude` CLI on the host, used only for
+# `plugin install|list`); run-job copies their skill Markdown read-only into the review container. Ready only when every declared
+# plugin is installed in the approved version with a skills/ directory (VF-R2: `kit run --dry-run` names each gap with its reason).
+# KIT-PLUGIN-BIND: only a plugin bound to a commit in the signed kit is installed here, only while its source serves exactly that
+# commit, and used only when Claude Code records that commit; an unbound plugin is reported "unbound" (the admin binds it in the kit).
 # Usage: sudo /opt/fleek-agents/kit-setup review        (then: systemctl restart fleek-agent-review.service)
 set -euo pipefail
 if [ "${1:-}" != --as-broker ]; then
@@ -52,8 +58,25 @@ cd "$job"
 set +e
 fleek kit pull "$project" --target claude --yes --json </dev/null >/dev/null 2>&1
 pulled=$?
+# VF-R2: the job's vendor skills - every plugin the approved kits declare must give the job a usable skills directory
+launch=$(fleek kit run claude --project "$project" --dry-run --json </dev/null 2>/dev/null)
+launched=$?
 set -e
 cd /
 rm -rf "$job"
 if [ "$pulled" -ne 0 ]; then echo "run-job is NOT ready: unattended kit pull exits $pulled" >&2; exit "$pulled"; fi
-echo "run-job ready: the unattended kit pull needs no confirmation. Next: systemctl restart fleek-agent-review.service"
+if [ "$launched" -ne 0 ]; then echo "run-job is NOT ready: kit run --dry-run exits $launched" >&2; exit "$launched"; fi
+gaps=$(printf '%s' "$launch" | python3 -I -c 'import json, re, sys
+for gap in json.load(sys.stdin).get("vendorPluginsMissing", [])[:5]:
+    plugin, reason, installed = (str(gap.get(key) or "") for key in ("plugin", "reason", "installed"))
+    if re.fullmatch(r"[a-z0-9@._-]{1,129}", plugin) and re.fullmatch(r"[a-z_]{1,20}", reason):
+        print(f"  {plugin}: {reason}" + (f" (installed {installed})" if re.fullmatch(r"[0-9A-Za-z.+-]{1,64}", installed) else ""))')
+if [ -n "$gaps" ]; then
+  printf 'run-job is NOT ready for the vendor skills of the approved kits (the job would run without them):\n%s\n' "$gaps" >&2
+  echo 'Fix: install / enable the approved version for this account (re-run this setup), or ask the admin to approve the installed version.' >&2
+  echo 'unbound / other_commit: the admin binds the plugin to the commit the source serves (new kit version); nothing unbound is installed here.' >&2
+  exit 13
+fi
+# Exit 13 of `kit setup` here only means optional host entries stayed open (e.g. MCP proposals answered N); the job needs none.
+[ "$setup" -eq 13 ] && echo "kit setup left optional host entries open (exit 13) - not needed by run-job."
+echo "run-job ready: the unattended kit pull needs no confirmation, every declared vendor plugin gives the job its skills. Next: systemctl restart fleek-agent-review.service"

package/service-agents/run-job

@@ -107,13 +107,16 @@ def container_args(image, name, job, provider):
     return args
 
 
-def agent_args(provider, event_id, issue_id):
+def agent_args(provider, event_id, issue_id, plugins=()):
     prompt = f"Job review; eventId={event_id}; issueId={issue_id}."
     if provider == "claude":
-        return ["claude", "-p", prompt, "--output-format", "json", "--max-turns", "30", "--tools", "",
-                "--allowedTools", "mcp__fleek__*", "--permission-mode", "dontAsk", "--strict-mcp-config",
+        # ONF-225: vendor plugin skills (Markdown copies below /job/plugins) need the Skill tool and reads of exactly that tree
+        tools = ["--tools", "Skill,Read", "--allowedTools", "mcp__fleek__*", "Skill", "Read(//job/plugins/**)"] if plugins else ["--tools", "", "--allowedTools", "mcp__fleek__*"]
+        dirs = [arg for name in plugins for arg in ("--plugin-dir", f"/job/plugins/{name}")]
+        return ["claude", "-p", prompt, "--output-format", "json", "--max-turns", "30", *tools,
+                "--permission-mode", "dontAsk", "--strict-mcp-config",
                 "--mcp-config", "/job/mcp.json", "--settings", "/job/settings.json", "--setting-sources", "",
-                "--append-system-prompt-file", "/job/kit.md"]
+                *dirs, "--append-system-prompt-file", "/job/kit.md"]
     return ["codex", "exec", "--json", "--skip-git-repo-check", "--sandbox", "read-only", "--ephemeral",
             "-c", 'forced_login_method="api"', "-c", 'web_search="disabled"', "-c", "features.shell_tool=false",
             "-c", "features.apply_patch_freeform=false", "-c", "features.multi_agent=false", "-c", "features.multi_agent_v2=false", "-c", "features.js_repl=false",
@@ -154,7 +157,115 @@ def host_report(fleek, provider_auth, kit=None, last_job_at=None, timeout=20):
         pass
 
 
-def kit_text(fleek, project, cwd):
+PLUGIN_NAME = re.compile(r"[a-z0-9][a-z0-9._-]{0,63}")
+PLUGIN_VERSION = re.compile(r"[0-9A-Za-z.+-]{1,64}")
+PLUGIN_ID = re.compile(r"[a-z0-9][a-z0-9._-]{0,63}@[a-z0-9][a-z0-9._-]{0,63}")
+# KIT-PLUGIN-BIND: "unbound" (no commit in the signed kit: never installed here) and "other_commit" (the install is not the bound commit)
+VENDOR_GAP_REASONS = ("other_version", "other_commit", "unbound", "disabled", "missing", "unchecked", "unverified", "error", "no_client", "outside_cache", "no_skills")
+VENDOR_MAX_FILES, VENDOR_MAX_BYTES, VENDOR_MAX_ENTRIES, VENDOR_MAX_FILE = 2000, 8 * 1024 * 1024, 10000, 1024 * 1024
+
+
+def inert_markdown(data, skill):
+    # Vendor text is data for the agent, never configuration: a SKILL.md keeps only name + description of its frontmatter
+    # (no allowed-tools, hooks, model, ...), and Claude Code's `!`cmd`` pre-execution syntax is broken up everywhere.
+    text = data.decode("utf-8").replace("!`", "! `")
+    if skill:
+        match = re.match(r"---\n(.*?)\n---\n?", text, re.S)
+        fields = {}
+        if match:
+            lines = match.group(1).split("\n")
+            for index, line in enumerate(lines):
+                key, _, value = line.partition(":")
+                value = value.strip()
+                if key not in ("name", "description") or not value:
+                    continue
+                if value in (">", "|", ">-", "|-"):  # a folded / literal block: its indented lines
+                    block = []
+                    for more in lines[index + 1:]:
+                        if not more.startswith((" ", "\t")):
+                            break
+                        block.append(more.strip())
+                    value = " ".join(part for part in block if part)
+                fields[key] = value.strip('"').strip("'")[:1024]
+            text = text[match.end():]
+        head = "".join(f"{key}: {json.dumps(fields[key])}\n" for key in ("name", "description") if key in fields)
+        text = f"---\n{head}---\n\n{text}"
+    return text.encode("utf-8")
+
+
+def read_regular(path):
+    # no symlink is followed (O_NOFOLLOW), the size is bounded before anything is read
+    fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW)
+    try:
+        info = os.fstat(fd)
+        if not stat.S_ISREG(info.st_mode) or info.st_size > VENDOR_MAX_FILE:
+            raise ValueError("unsafe vendor plugin")
+        with os.fdopen(fd, "rb", closefd=False) as stream:
+            data = stream.read(VENDOR_MAX_FILE + 1)
+    finally:
+        os.close(fd)
+    if len(data) > VENDOR_MAX_FILE:
+        raise ValueError("unsafe vendor plugin")
+    return data
+
+
+def vendor_plugins(launch, inputs):
+    # ONF-225: the vendor plugins of the project's pinned kits, as the CLI reports them for the verified generation (installed by
+    # `kit setup` on this host with exactly the approved version, below the client's plugin cache). Only plain Markdown below the
+    # plugin's skills/ enters the container (no hooks, scripts, MCP entries, settings); no symlink is followed, nothing is fetched.
+    # VF-R2: the declared plugins the CLI could not hand over (reason only), plus the ones without a Markdown file below skills/; reported in the
+    # job's metadata line, the job runs without them.
+    entries, gaps = launch.get("vendorPlugins", []), launch.get("vendorPluginsMissing", [])
+    if not isinstance(entries, list) or len(entries) > 5 or not isinstance(gaps, list) or len(gaps) > 5:
+        raise ValueError("invalid vendor plugins")
+    missing = []
+    for gap in gaps:
+        plugin, reason = (gap.get("plugin"), gap.get("reason")) if isinstance(gap, dict) else (None, None)
+        if not isinstance(plugin, str) or not PLUGIN_ID.fullmatch(plugin) or reason not in VENDOR_GAP_REASONS:
+            raise ValueError("invalid vendor plugin")
+        missing.append({"plugin": plugin, "reason": reason})
+    names, files, total, walked = [], 0, 0, 0
+    for entry in entries:
+        name, version, source = (entry.get(key) for key in ("name", "version", "dir")) if isinstance(entry, dict) else (None, None, None)
+        if not isinstance(name, str) or not PLUGIN_NAME.fullmatch(name) or name in names or not isinstance(version, str) or not PLUGIN_VERSION.fullmatch(version) \
+                or not isinstance(source, str) or not os.path.isabs(source):
+            raise ValueError("invalid vendor plugin")
+        plugin = entry.get("plugin") if isinstance(entry.get("plugin"), str) and PLUGIN_ID.fullmatch(entry["plugin"]) else name
+        root = Path(source)
+        skills = root / "skills"
+        if root.is_symlink() or skills.is_symlink() or not skills.is_dir():
+            missing.append({"plugin": plugin, "reason": "no_skills"})
+            continue
+        target = inputs / "plugins" / name
+        for directory, subdirs, children in os.walk(skills, followlinks=False):
+            subdirs.sort()
+            walked += len(subdirs) + len(children)
+            if walked > VENDOR_MAX_ENTRIES:
+                raise ValueError("vendor plugins too large")
+            for child in sorted(children):
+                file = Path(directory) / child
+                if not child.endswith(".md"):
+                    continue
+                if not file.resolve().is_relative_to(skills.resolve()):
+                    raise ValueError("unsafe vendor plugin")
+                data = inert_markdown(read_regular(file), child == "SKILL.md")
+                files, total = files + 1, total + len(data)
+                if files > VENDOR_MAX_FILES or total > VENDOR_MAX_BYTES:
+                    raise ValueError("vendor plugins too large")
+                dest = target / "skills" / file.relative_to(skills)
+                dest.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+                dest.write_bytes(data)
+        if (target / "skills").is_dir():
+            (target / ".claude-plugin").mkdir(mode=0o700)
+            (target / ".claude-plugin" / "plugin.json").write_text(json.dumps({"name": name, "version": version}))
+            names.append(name)
+        else:
+            # VF-R4: an empty or non-Markdown-only skills/ gives the job nothing
+            missing.append({"plugin": plugin, "reason": "no_skills"})
+    return names, missing
+
+
+def kit_text(fleek, project, cwd, inputs):
     # WZ-CLI-SVC (founder 25.10.2026): new kit versions an admin released, signed and pinned to this project are taken over
     # without a root terminal (--accept-approved: service-account logins only; kit MCP entries are only noted - the container
     # below still gets nothing but the Fleek socket).
@@ -176,7 +287,8 @@ def kit_text(fleek, project, cwd):
     text = "\n\n".join(parts)
     if not text or len(text.encode()) > 120000:
         raise ValueError("invalid kit")
-    return text
+    names, missing = vendor_plugins(launch, inputs)
+    return text, names, missing
 
 
 def run(config_path):
@@ -217,14 +329,18 @@ def run(config_path):
             exit_code = code
             return code
         started = time.monotonic()
+        vendor_missing = []
         provider = config.get("provider", "claude")
         container_env = {key: os.environ[key] for key in ("PATH", "HOME", "XDG_RUNTIME_DIR") if key in os.environ}
         try:
             inputs = job / "input"
             inputs.mkdir(mode=0o700)
-            (inputs / "kit.md").write_text(kit_text(fleek, config["project"], job))
+            text, plugins, vendor_missing = kit_text(fleek, config["project"], job, inputs)
+            (inputs / "kit.md").write_text(text)
             (inputs / "mcp.json").write_text(json.dumps({"mcpServers": {"fleek": {"command": "socat", "args": ["STDIO", "UNIX-CONNECT:/job/mcp.sock"]}}}))
-            (inputs / "settings.json").write_text(json.dumps({"permissions": {"deny": ["Read(/proc/**)", "Read(/run/**)"]}}))
+            # absolute paths (`//`): a single leading slash would be relative to the settings file; no hook ever runs in the job
+            (inputs / "settings.json").write_text(json.dumps({"disableAllHooks": True,
+                "permissions": {"deny": ["Read(//proc/**)", "Read(//run/**)", "Read(//home/**)", "Read(//tmp/**)"]}}))
             with (job / "proxy.log").open("wb") as proxy_log, (job / "agent.stdout").open("wb") as stdout, (job / "agent.stderr").open("wb") as stderr:
                 proxy = subprocess.Popen([fleek, "mcp", "serve", "--socket", str(inputs / "mcp.sock"), "--job", event_id], stdout=proxy_log, stderr=proxy_log)
                 deadline = time.monotonic() + 10
@@ -236,7 +352,7 @@ def run(config_path):
                     time.sleep(0.05)
                 container_env.update(provider_env(provider))
                 argv = container_args(config["image"], name, job, {key: value for key, value in container_env.items() if key in ("CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY", "CODEX_API_KEY")})
-                agent = subprocess.Popen(argv + agent_args(provider, event_id, issue_id), env=container_env, stdin=subprocess.DEVNULL, stdout=stdout, stderr=stderr)
+                agent = subprocess.Popen(argv + agent_args(provider, event_id, issue_id, plugins if provider == "claude" else ()), env=container_env, stdin=subprocess.DEVNULL, stdout=stdout, stderr=stderr)
                 while agent.poll() is None:
                     if proxy.poll() is not None:
                         return outcome(proxy.returncode if proxy.returncode in (DENIED, LOGIN) else 1)
@@ -296,7 +412,9 @@ def run(config_path):
                 pass
             host_report(fleek, provider_state(state), None, stamp, timeout=5)
             # Only validated IDs and numeric metadata ever reach journald. No agent-derived text/statistics.
-            print(json.dumps({"eventId": event_id, "kind": "review", "exit": exit_code, "durationMs": int((time.monotonic() - started) * 1000), "cleanupFailed": cleanup_failed}), flush=True)
+            # VF-R2: declared vendor plugins the job ran without (validated plugin id + fixed reason)
+            print(json.dumps({"eventId": event_id, "kind": "review", "exit": exit_code, "durationMs": int((time.monotonic() - started) * 1000), "cleanupFailed": cleanup_failed,
+                              **({"vendorSkillsMissing": vendor_missing} if vendor_missing else {})}), flush=True)
             if cleanup_failed:
                 raise SystemExit(DENIED)