leetcrypt
e49dbca451
CI / rust client (hh) (macos-latest) (push) Waiting to run
CI / rust client (hh) (ubuntu-latest) (push) Waiting to run
CI / rust coverage (push) Waiting to run
CI / python server (3.10) (push) Waiting to run
CI / python server (3.11) (push) Waiting to run
CI / python server (3.12) (push) Waiting to run
CI / headless e2e smoke (push) Waiting to run
CI / dependency audit (push) Waiting to run
CI / secret scanning (push) Waiting to run
Remove the Goose agentic harness across the codebase per
docs/spec-native-harness.md §3. Goose made N sequential model calls inside the
sandbox (slow on CPU-only hardware) and forced an in-container→host Ollama
gateway that tripped the rootless-Podman slirp4netns loopback bug.
- bridge.py: delete _run_goose/_goose_argv/_goose_present + GOOSE_* consts and
the present-cache; __init__ now takes harness="simple"/max_turns=5; granted
!task runs _run_simple until the native loop lands (Phase 2).
- __main__.py: --harness {native,simple} (was {goose,simple}); drop
--goose-max-turns, add --max-turns; default harness simple.
- app.rs: /ai start accepts native|simple (plain aliases simple) instead of a
bare plain flag; refresh harness comments.
- sbx.rs: remove the in-container Ollama gateway (Docker host-gateway / Podman
slirp4netns host-loopback) and the dk_bootstrap OLLAMA_HOST env — kills the
slirp4netns loopback bug; drop Goose comments.
- bootstrap.sh: drop goose from the prereq probe.
- bootstrap-ai.sh: remove the entire Goose install block, --no-goose flag,
GOOSE_INSTALLER_URL, host config writer, and goose_bin helper.
- sandbox-bootstrap.sh: remove the in-sandbox Goose binary install + config.
- spec-goose-harness.md: banner — harness portion superseded; Podman stays.
cargo check + py_compile clean. No Goose refs remain (headroom/ untouched).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
59 lines
2.5 KiB
Bash
59 lines
2.5 KiB
Bash
#!/usr/bin/env bash
|
|
# sandbox-bootstrap.sh — install a baseline dev toolchain inside a hack-house
|
|
# Docker sandbox.
|
|
#
|
|
# It is piped to `bash -s` (as root) inside the container at provision time, so
|
|
# fresh sandboxes come up usable instead of bare. Idempotent + sentinel-guarded:
|
|
# a re-provision (new member joins) or a snapshot load is a fast no-op.
|
|
#
|
|
# When launched by hh, the package list comes from scripts/sandbox-tools.json
|
|
# (the canonical, editable schema) via $HH_SBX_PKGS. DEFAULT_PKGS below is only
|
|
# the fallback for running this script standalone. Per-launch override:
|
|
# HH_SBX_PKGS="vim tmux ripgrep" ./host-house.sh ...
|
|
set -uo pipefail
|
|
|
|
# -h/--help: print the usage header above and exit. (No effect in normal use —
|
|
# hh pipes this to `bash -s` inside the container with no args; the flag is for
|
|
# running it standalone to read what it does.)
|
|
case "${1:-}" in
|
|
-h|--help|-help) sed -n '2,/^set /{/^set /d;s/^# \{0,1\}//;p}' "$0"; exit 0 ;;
|
|
esac
|
|
|
|
SENTINEL=/var/lib/hh-bootstrap.done
|
|
[[ -f "$SENTINEL" ]] && exit 0 # this container is already provisioned
|
|
|
|
# Baseline dev tools: editors, fetchers, vcs, net + inspect utilities, json,
|
|
# archives. Keep names valid for the base image (ubuntu:24.04) — an unknown
|
|
# package would otherwise abort the whole batch install.
|
|
DEFAULT_PKGS="vim nano less curl wget ca-certificates git \
|
|
build-essential pkg-config \
|
|
procps iproute2 iputils-ping net-tools \
|
|
jq unzip zip tree htop file ripgrep \
|
|
python3 python3-pip python3-venv"
|
|
|
|
PKGS="${HH_SBX_PKGS:-$DEFAULT_PKGS}"
|
|
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
|
|
# Refresh the index first (base images ship without /var/lib/apt/lists). If the
|
|
# update fails (e.g. no network) we bail WITHOUT writing the sentinel, so the
|
|
# next launch retries instead of leaving a half-provisioned shell.
|
|
apt-get update -qq || exit 0
|
|
|
|
# --no-install-recommends keeps the image lean. apt is atomic on resolution, so
|
|
# if one name is unavailable the batch aborts — fall back to one-by-one so a
|
|
# single bad/missing package can't deprive the shell of everything else.
|
|
# shellcheck disable=SC2086
|
|
if ! apt-get install -y --no-install-recommends $PKGS; then
|
|
for p in $PKGS; do
|
|
apt-get install -y --no-install-recommends "$p" || true
|
|
done
|
|
fi
|
|
|
|
# No in-sandbox agentic harness is installed here: the native `!task` harness
|
|
# runs the model host-side and only execs commands into this sandbox, so nothing
|
|
# extra needs to live in the container.
|
|
|
|
mkdir -p "$(dirname "$SENTINEL")"
|
|
date -u +%FT%TZ > "$SENTINEL" # mark done; skip on the next provision pass
|