Commit Graph

29 Commits

Author SHA1 Message Date
Levi Neely 1120da18d9 anvillm-hook: simplify agentSpawn to always use SKILLS_PROMPT.md 2026-02-26 15:15:12 +01:00
Levi Neely 8a55b99864 p9: capability-based tools discovery
- Add front-matter parsing for capabilities/description in tool scripts
- Virtual capability directories: tools appear in multiple caps
- /tools/help aggregated one-liner index
- Update walk/readDir for /tools/<capability>/<tool.sh> paths
2026-02-26 14:36:30 +01:00
Levi Neely 5f8c41b576
Implement MCP code execution pattern (#20)
* Implement MCP code execution pattern

- Add execute_code tool for bash execution in landrun sandbox
- Remove redundant MCP tools (read_inbox, send_message, etc.)
- Implement dynamic tool discovery from ~/.config/anvillm/mcptools/
- Add workspace isolation (~/.cache/anvillm/exec)
- Add security: output limits, concurrency limits, validation, path traversal protection
- Update bot templates (Conductor, Taskmaster) with bash examples
- Update anvillm-communication skill to use execute_code pattern
- Create comprehensive documentation (user guide, migration guide, security guide)
- Add test suite for validation and limitedWriter
- Fix landrun flags: --rox for executables, --env for AGENT_ID passthrough
- Network blocked by default (no --connect-tcp or --unrestricted-network)

Token reduction: 80-99% via progressive tool discovery and subprocess data processing

* Fix code review issues in MCP code execution pattern

- Security: Change security.jsonl permissions from 0644 to 0600
- Bug: Fix limitedWriter to return correct byte count for io.Copy
- Bug: Fix tool schema inconsistency (execute_code requires only 'code')
- Performance: Move whitespace regex to package-level var
- Security: Improve validateCode with regex patterns and normalization
- Cleanup: Remove dead code from main.go and tools.go
- Cleanup: Rewrite shell scripts to use jq for safe JSON construction
- Docs: Fix duplicate sections and JavaScript syntax in bash examples

* Improve code validation security patterns

- Fix rm -rf bypass: allow optional whitespace before /
- Expand rm -rf to block sensitive paths (/home, /var, /usr, etc.)
- Block all network protocols in curl/wget (not just http/https)
- Add test for regex pattern compilation
- Add test cases for tabs, sensitive paths, ftp/file protocols

* Harden shell scripts and improve rate limiting

---------

Co-authored-by: Levi Neely <lkn@darkstar.example.net>
Co-authored-by: Levi Neely <lneely@pascom.net>
2026-02-26 14:02:54 +01:00
Levi Neely 96876ea6c8
Add output discipline enforcement (bd-nk8) (#13)
- OUTPUT_PROTOCOL.md: shared protocol injected at session start for all backends
- anvillm-hook: injects OUTPUT_PROTOCOL.md via Kiro agentSpawn
- claude/agent/anvillm-agent.md: Output Protocol section (Claude session-start equivalent)
- bot-templates: Output Protocol block in Conductor and Taskmaster contexts
- anvillm-communication skill: structured body schemas for all message types
- install-hooks.sh: also installs anvillm-agent.md to ~/.claude/agents/
- kiro-cli/README.md: install instructions for prompt files

Co-authored-by: Levi Neely <lkn@darkstar.example.net>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-02-23 21:48:58 +01:00
Levi Neely 5bba76d2b9 hotfixes, msg trace diagram generator 2026-02-23 12:20:46 +01:00
Levi Neely 50ae1d0dad Add approval gates: beads schema, Conductor, notification daemon, init scripts
Implements bd-i4h (Approval Gates / Human in the Loop):

beads schema (bd-i4h.4):
- Add StatusPendingApproval/StatusPendingReview local status constants
- Add pending-approval, pending-review, resume ctl commands
- Add agent/beads/pending read endpoint
- Document requires-approval/requires-review label conventions
- Update BEADS.md with full Approval Gates section

Conductor bot (bd-i4h.2):
- Read context prompt from stdin when not a terminal (custom prompt support)
- Extend default prompt with approval gate workflow instructions

Human notification daemon (bd-i4h.1):
- Add scripts/anvillm-inbox-notify: streams agent/events, fires notify-send
  for configurable message types (default: APPROVAL_REQUEST, REVIEW_REQUEST)
- Add services/inbox-notify-runit/: runit service
- Add services/systemd/anvillm-inbox-notify.service: systemd user service
- Add services/sysvinit/anvillm-inbox-notify: SysV LSB init script
- Add services/sysvinit/rc.anvillm-inbox-notify: Slackware rc script

anvilsrv init scripts:
- Add services/sysvinit/anvilsrv: SysV LSB init script
- Add services/sysvinit/rc.anvilsrv: Slackware rc script

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-02-22 18:47:23 +01:00
Levi Neely 977745d133 Make skills command conditional: use agent-prompt/agent-skills if available 2026-02-19 15:30:56 +01:00
Levi Neely 44934e685a Make agent-hook support direct invocation
- Added dual-mode support: JSON stdin or event name as argument
- Updated agent config to use agent-hook with event names
- Centralizes all hook logic in one script
- Works with both wrapper scripts and direct Kiro hooks
2026-02-18 22:35:27 +01:00
Levi Neely 5fdcc039d1 Add agent-hook script and SKILLS_PROMPT.md
- Added agent-hook for future use with wrapper script
- Created SKILLS_PROMPT.md for automatic skill loading
- Updated mkfile to install both
- Kept explicit commands in agent config (agent-hook needs wrapper)
2026-02-18 22:33:09 +01:00
Levi Neely 01efe06831 Revert "Remove 9p-read-inbox script"
This reverts commit 748c32aa05.
2026-02-18 22:18:29 +01:00
Levi Neely 748c32aa05 Remove 9p-read-inbox script
- Replaced by read_inbox MCP tool
- MCP tool provides same functionality with better integration
2026-02-18 22:17:26 +01:00
Levi Neely 5399d709c4 Replace PID-based temp files with AGENT_ID env var
- Simplified Claude hooks to use AGENT_ID instead of PID lookup
- Updated 9p-read-inbox to use AGENT_ID env var
- Removed temporary file creation in tmux.go
- Much cleaner and more reliable approach
2026-02-18 20:09:12 +01:00
Levi Neely 314d347e76 Add centralized audit log system
- Created internal/audit package for centralized logging
- Replaced per-session log files with single agent/audit file
- Updated all UIs (TUI, web, Emacs) to use centralized audit log
- Modified mailbox manager to log all message deliveries with aliases
- Updated Alog script to stream centralized audit log
- Removed session-specific log streaming in favor of global audit log
2026-02-17 22:07:39 +01:00
Levi Neely 35b3ff338e Fix 9p-read-inbox to strip .json extension when marking messages complete 2026-02-17 14:37:46 +01:00
Levi Neely fed6bbdbdb Reorganize config structure: separate claude/ and kiro-cli/ directories 2026-02-17 10:35:31 +01:00
Levi Neely 72ffd90bf3 Add Claude hooks integration for AnviLLM
- Created install-claude-hooks.sh to merge hooks into existing settings.json
- Updated mkfile to use merge script instead of overwriting settings.json
- Made agent name configurable via CLAUDE_AGENT_NAME env var
- Added Claude agent configuration and hook scripts
- Removed unused NewClaudeWithContinue/NewClaudeWithResume functions
2026-02-17 10:27:59 +01:00
Levi Neely 4ec64e9124 Rename skills script to anvillm-skills
- Fixed script to search for SKILL.md files in subdirectories
- Renamed scripts/skills to scripts/anvillm-skills for clarity
- Updated mkfile to install as anvillm-skills
2026-02-16 18:06:12 +01:00
Levi Neely 873f839278 Implement layered sandbox configuration system
- Add global.yaml base config (renamed from sandbox.yaml)
- Add backend-specific configs (claude.yaml, kiro-cli.yaml)
- Add role configs (developer, reviewer, tester, architect, etc.)
- Add task configs (git, docker, go, rust, python, nodejs, etc.)
- Implement config merging: global + backend + role + tasks
- Update workflows to use roles and tasks
- Create tester role with read-only source, execute-only bins
- Fix reviewer role to use rox for bin directories
- Auto-create RW directories that don't exist
- Make backend configs required (fail if missing)
- Update mkfile to install cfg files to ~/.config/anvillm
- Remove Role-Based Sessions from IDEAS.md (now implemented)
2026-02-15 18:57:55 +01:00
Levi Neely d149f5b595 anvillm-notify in scripts 2026-02-15 15:25:08 +01:00
Levi Neely 851ac311b0 remove acme log window in favor of external script 2026-02-15 13:22:12 +01:00
Levi Neely b7a823f120 feat: split monolith into anvilsrv daemon and Assist client
Major architectural refactoring to separate server and UI concerns:

Architecture Changes:
- Split into anvilsrv (server daemon) and Assist (Acme client)
- Removed UI coupling from server (OnAliasChange, WinID tracking)
- Server runs as background daemon, client reconnects as needed
- Client auto-starts server if not running

Server (anvilsrv):
- Add daemon management: start/stop/status commands
- Daemonize by default (fgstart for foreground/debug mode)
- Proper PID file handling in $NAMESPACE (not /tmp)
- Graceful shutdown with SIGTERM handling
- Duplicate start prevention with stale PID detection

Client (Assist):
- Auto-start anvilsrv if not running
- Fixed plan9 package imports (OWRITE/OREAD constants)
- Removed unused context import

Security Fixes:
- Move PID file from /tmp to $NAMESPACE (prevent symlink attacks)
- Add path validation in session creation:
  - Clean path traversal (/../../../etc → /etc)
  - Verify directory exists before creating session
  - Ensure absolute paths
  - Reject non-directory paths
- Add SECURITY.md documenting 9P socket risks

Service Integration:
- Add systemd service files (system, user, template)
- Add runit service files (run, finish)
- Add service documentation and installation instructions

Build & Testing:
- Both binaries build successfully
- All daemon operations verified (start/stop/status/daemonize)
- Path validation tested and working
- Auto-start functionality verified
- Add DevReviewQA workflow script

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-02-14 11:30:57 +01:00
Levi Neely df73ce39c9 update workflow scripts 2026-02-13 18:17:30 +01:00
Levi Neely f36dbaa81f Remove ticket-id argument from Planning script 2026-02-13 11:50:37 +01:00
Levi Neely a71a1ff8e8 Refactor workflow scripts and remove PID from session list
- Remove PID column from session list display in main.go
- Rename workflow scripts: Claude-DevReview.sh -> DevReview, Kiro-Planning.sh -> Planning
- Make workflow scripts backend-agnostic (accept backend as first argument)
- Install workflow scripts to $INSTALL_PATH/Workflows/ in mkfile
2026-02-13 11:43:49 +01:00
Levi Neely 680f5bcaf1 planning workflow 2026-02-13 11:10:40 +01:00
Levi Neely 483ada27d8 bugfix in ctl new, dev-reviewer flow create script 2026-02-12 19:41:51 +01:00
Levi Neely 66e81a3cf6 no more need for scripts 2026-02-10 22:29:00 +01:00
Levi Neely a0a94e952c readme corrections 2026-02-09 22:02:14 +01:00
Levi Neely 5cd8cbc28f refactor done; claude support wip 2026-02-09 21:26:11 +01:00