nisse/scripts/bringup.sh

#!/usr/bin/env bash
# Bring-up runs of nisse-dev on this development VM (Development Plan M0.2).
#
# The agent runs as its container image (M1.5), built from the code under
# test, as a transient systemd unit, so it outlives the shell that started
# it. It touches only test resources (an operator-made test repository, the
# test Matrix room, a budget-capped LiteLLM key), from the run's config.
#
# $E2E is mounted at the same path inside the container, so the config's
# paths (state_db, keys) mean the same there; for that it runs as root here,
# since the keys are root's. In production the image runs as its own user
# with a state volume (Dockerfile).
#
#   scripts/bringup.sh start [REF]    set the last run aside, build REF (default
#                                     HEAD) into an image and start the agent
#   scripts/bringup.sh plan [REF]     print what start would build and run
#   scripts/bringup.sh stop           stop it cleanly (SIGTERM)
#   scripts/bringup.sh status         the unit, and the agent's state
#   scripts/bringup.sh logs           follow the agent's log
#   scripts/bringup.sh collect        save the log and a readable transcript
#                                     into the current run's directory
#
# Layout, under $E2E (default /root/nisse-e2e):
#   nisse-dev.yaml, .env    the run config and its secrets (made by hand once)
#   code/                   the exported code under test, built into the image
#   state.db                the agent's state (its workspace is on the build VM)
#   ssh/                    the agent's key for the build VM, and push keys
#   run-info, collected/    what was run, and the output of `collect`
#   runs/<time>/            earlier runs, set aside by `start`
set -euo pipefail

E2E=${NISSE_E2E:-/root/nisse-e2e}
SRC=${NISSE_SRC:-/root/nisse}            # repository to export code from
CODE=$E2E/code
UNIT=nisse-bringup
IMAGE=nisse-dev:bringup

die() { echo "bringup: $*" >&2; exit 1; }
running() { systemctl is-active --quiet "$UNIT"; }

# The container the unit runs: host networking (Matrix, Gitea, LiteLLM as
# here), $E2E at its own path, the config and secrets from it.
docker_run() {
    echo docker run --rm --name "$UNIT" --network host --user 0 \
        -v "$E2E:$E2E" \
        -e NISSE_CONFIG="$E2E/nisse-dev.yaml" -e NISSE_ENV="$E2E/.env" \
        "$IMAGE"
}

cmd_plan() {
    local ref=${1:-HEAD} sha
    sha=$(git -C "$SRC" rev-parse --verify "$ref^{commit}") || die "unknown ref $ref"
    echo "git -C $SRC archive $sha | tar -x -C $CODE"
    echo "docker build -t $IMAGE $CODE"
    echo "systemd-run --unit=$UNIT ... $(docker_run)"
}

cmd_start() {
    local ref=${1:-HEAD} sha
    [ -f "$E2E/nisse-dev.yaml" ] && [ -f "$E2E/.env" ] || die "no config in $E2E"
    running && die "already running; stop it first"
    sha=$(git -C "$SRC" rev-parse --verify "$ref^{commit}") || die "unknown ref $ref"

    # Set the previous run aside, whole: state, workspace, collected output.
    local items=() item aside
    for item in "$E2E"/state.db* "$E2E/project" "$E2E/collected" "$E2E/run-info"; do
        [ -e "$item" ] && items+=("$item")
    done
    local stamp
    stamp=$(date +%Y%m%d-%H%M%S)
    if [ ${#items[@]} -gt 0 ]; then
        aside=$E2E/runs/$stamp
        mkdir -p "$aside"
        mv "${items[@]}" "$aside/"
        echo "previous run set aside in $aside"
    fi
    remote_aside "$stamp"

    # Export the code under test, so edits to the working tree can't change a
    # running agent. Uncommitted changes are not part of a run.
    rm -rf "$CODE"
    mkdir -p "$CODE"
    git -C "$SRC" archive "$sha" | tar -x -C "$CODE"
    docker build --quiet -t "$IMAGE" "$CODE" > /dev/null
    printf 'ref: %s\ncommit: %s\nstarted: %s\n' "$ref" "$sha" "$(date -Is)" > "$E2E/run-info"

    systemctl reset-failed "$UNIT" 2>/dev/null || true
    # SIGTERM reaches the agent through docker run's signal proxy; it shuts
    # down cleanly (main.py).
    # shellcheck disable=SC2046
    systemd-run --quiet --unit="$UNIT" --collect \
        --property=KillSignal=SIGTERM --property=TimeoutStopSec=120 \
        $(docker_run)
    echo "started $UNIT at ${sha:0:8} ($ref)"
}

# The workspace lives on the build VM (L13): set the last run's aside there
# too, so each run starts from a fresh clone.
remote_aside() {
    local stamp=$1 where
    where=$(python3 - "$E2E/nisse-dev.yaml" <<'PY'
import sys, yaml
c = yaml.safe_load(open(sys.argv[1]))
for p in c["projects"].values():  # each project's workspace, on its build VM (D8)
    b = p["build_host"]
    print(b.get("user", "root"), b["address"], b.get("port", 22), b["key"], p["workspace"])
PY
) || die "cannot read the projects' build VMs and workspaces from the config"
    while read -r user address port key workspace; do
        ssh -n -i "$key" -p "$port" -o BatchMode=yes -o StrictHostKeyChecking=accept-new \
            -o UserKnownHostsFile="$E2E/ssh/known_hosts" "$user@$address" \
            "if [ -e '$workspace' ]; then mv '$workspace' '$workspace.$stamp' && echo 'build VM: set aside $workspace.$stamp'; fi" \
            || die "cannot reach the build VM $address"
    done <<< "$where"
}

cmd_stop() {
    running || { echo "not running"; return 0; }
    systemctl stop "$UNIT"   # SIGTERM: the agent shuts down cleanly (main.py)
    echo "stopped"
}

cmd_status() {
    if running; then echo "unit: running"; else echo "unit: not running"; fi
    [ -f "$E2E/run-info" ] && sed 's/^/  /' "$E2E/run-info"
    if [ -f "$E2E/state.db" ]; then
        dump "$E2E/state.db" | head -n 3
    fi
}

cmd_logs() { journalctl -u "$UNIT" -f -o cat; }

# The state store, read with the image's own code.
dump() {
    docker run --rm --user 0 -v "$E2E:$E2E" --entrypoint python "$IMAGE" \
        -m nisse_core.state.dump "$@"
}

cmd_collect() {
    [ -f "$E2E/run-info" ] || die "no run to collect"
    local out=$E2E/collected since
    since=$(sed -n 's/^started: //p' "$E2E/run-info")
    mkdir -p "$out"
    journalctl -u "$UNIT" --since "$since" -o cat > "$out/agent.log"
    dump --full "$E2E/state.db" > "$out/transcript.txt"
    echo "collected into $out"
}

case "${1:-}" in
    start) shift; cmd_start "$@" ;;
    plan) shift; cmd_plan "$@" ;;
    stop) cmd_stop ;;
    status) cmd_status ;;
    logs) cmd_logs ;;
    collect) cmd_collect ;;
    *) sed -n '2,30p' "$0" | sed 's/^# \{0,1\}//'; exit 2 ;;
esac