nisse/scripts/bringup.sh

#!/usr/bin/env bash
# Bring-up runs of nisse-dev on this development VM (Development Plan M0.2).
#
# The agent runs as root, as it will on its own VM in production (D7): it may
# install what it needs. It touches only test resources (the sandbox repo, the
# test Matrix room, a budget-capped LiteLLM key), from the run's config. It
# runs as a transient systemd unit, so it outlives the shell that started it.
#
#   scripts/bringup.sh start [REF]    set the last run aside, export REF (default
#                                     HEAD) and start the agent
#   scripts/bringup.sh stop           stop it cleanly (SIGTERM)
#   scripts/bringup.sh status         the unit, and the agent's state
#   scripts/bringup.sh logs           follow the agent's log
#   scripts/bringup.sh collect        save the log and a readable transcript
#                                     into the current run's directory
#
# Layout, under $E2E (default /root/nisse-e2e):
#   nisse-dev.yaml, .env    the run config and its secrets (made by hand once)
#   code/                   the exported code under test, with its own .venv
#   state.db                the agent's state (its workspace is on the build VM)
#   ssh/                    the agent's key for the build VM, and push keys
#   run-info, collected/    what was run, and the output of `collect`
#   runs/<time>/            earlier runs, set aside by `start`
set -euo pipefail

E2E=${NISSE_E2E:-/root/nisse-e2e}
SRC=${NISSE_SRC:-/root/nisse}            # repository to export code from
CODE=$E2E/code
UNIT=nisse-bringup
UV=${UV:-$(command -v uv || echo /snap/bin/uv)}

die() { echo "bringup: $*" >&2; exit 1; }
running() { systemctl is-active --quiet "$UNIT"; }

cmd_start() {
    local ref=${1:-HEAD} sha
    [ -f "$E2E/nisse-dev.yaml" ] && [ -f "$E2E/.env" ] || die "no config in $E2E"
    running && die "already running; stop it first"
    sha=$(git -C "$SRC" rev-parse --verify "$ref^{commit}") || die "unknown ref $ref"

    # Set the previous run aside, whole: state, workspace, collected output.
    local items=() item aside
    for item in "$E2E"/state.db* "$E2E/project" "$E2E/collected" "$E2E/run-info"; do
        [ -e "$item" ] && items+=("$item")
    done
    local stamp
    stamp=$(date +%Y%m%d-%H%M%S)
    if [ ${#items[@]} -gt 0 ]; then
        aside=$E2E/runs/$stamp
        mkdir -p "$aside"
        mv "${items[@]}" "$aside/"
        echo "previous run set aside in $aside"
    fi
    remote_aside "$stamp"

    # Export the code under test, so edits to the working tree can't change a
    # running agent. Uncommitted changes are not part of a run.
    rm -rf "$CODE"
    mkdir -p "$CODE"
    git -C "$SRC" archive "$sha" | tar -x -C "$CODE"
    (cd "$CODE" && "$UV" sync --quiet --all-packages)
    printf 'ref: %s\ncommit: %s\nstarted: %s\n' "$ref" "$sha" "$(date -Is)" > "$E2E/run-info"

    systemctl reset-failed "$UNIT" 2>/dev/null || true
    systemd-run --quiet --unit="$UNIT" --collect \
        --property=WorkingDirectory="$CODE" \
        --property=KillSignal=SIGTERM --property=TimeoutStopSec=120 \
        --setenv=NISSE_CONFIG="$E2E/nisse-dev.yaml" \
        --setenv=NISSE_ENV="$E2E/.env" \
        "$CODE/.venv/bin/nisse-dev"
    echo "started $UNIT at ${sha:0:8} ($ref)"
}

# The workspace lives on the build VM (L13): set the last run's aside there
# too, so each run starts from a fresh clone.
remote_aside() {
    local stamp=$1 where
    where=$(python3 - "$E2E/nisse-dev.yaml" <<'PY'
import sys, yaml
c = yaml.safe_load(open(sys.argv[1]))
b = c["build_host"]
print(b.get("user", "root"), b["address"], b.get("port", 22), b["key"], c["workspace"])
PY
) || die "cannot read build_host and workspace from the config"
    read -r user address port key workspace <<< "$where"
    ssh -i "$key" -p "$port" -o BatchMode=yes -o StrictHostKeyChecking=accept-new \
        -o UserKnownHostsFile="$E2E/ssh/known_hosts" "$user@$address" \
        "if [ -e '$workspace' ]; then mv '$workspace' '$workspace.$stamp' && echo 'build VM: set aside $workspace.$stamp'; fi" \
        || die "cannot reach the build VM $address"
}

cmd_stop() {
    running || { echo "not running"; return 0; }
    systemctl stop "$UNIT"   # SIGTERM: the agent shuts down cleanly (main.py)
    echo "stopped"
}

cmd_status() {
    if running; then echo "unit: running"; else echo "unit: not running"; fi
    [ -f "$E2E/run-info" ] && sed 's/^/  /' "$E2E/run-info"
    if [ -f "$E2E/state.db" ] && [ -x "$CODE/.venv/bin/python" ]; then
        "$CODE/.venv/bin/python" -m nisse_dev.dump "$E2E/state.db" | head -n 3
    fi
}

cmd_logs() { journalctl -u "$UNIT" -f -o cat; }

cmd_collect() {
    [ -f "$E2E/run-info" ] || die "no run to collect"
    local out=$E2E/collected since
    since=$(sed -n 's/^started: //p' "$E2E/run-info")
    mkdir -p "$out"
    journalctl -u "$UNIT" --since "$since" -o cat > "$out/agent.log"
    "$CODE/.venv/bin/python" -m nisse_dev.dump --full "$E2E/state.db" > "$out/transcript.txt"
    echo "collected into $out"
}

case "${1:-}" in
    start) shift; cmd_start "$@" ;;
    stop) cmd_stop ;;
    status) cmd_status ;;
    logs) cmd_logs ;;
    collect) cmd_collect ;;
    *) sed -n '2,25p' "$0" | sed 's/^# \{0,1\}//'; exit 2 ;;
esac