agent-exec transport a443dca04059a65125557a30f32dfa5c/62ee46d8fdc0
This commit is contained in:
agent-exec-transport
@@ -13,7 +13,7 @@ PLUGINS := plugins
|
||||
COMBO := core=$(shell git -C $(CORE) rev-parse --short HEAD 2>/dev/null)+backend=$(shell git -C $(BACKEND) rev-parse --short HEAD 2>/dev/null)+frontend=$(shell git -C $(FRONTEND) rev-parse --short HEAD 2>/dev/null)+ui=$(shell git -C $(UI) rev-parse --short HEAD 2>/dev/null)+agentcmd=$(shell git -C deps/agent-command rev-parse --short HEAD 2>/dev/null)+documents=$(shell git -C modules/documents rev-parse --short HEAD 2>/dev/null)+native=$(shell git -C deps/agent-native rev-parse --short HEAD 2>/dev/null)+squad=$(shell git -C deps/agent-squad rev-parse --short HEAD 2>/dev/null)+intent=$(shell git -C deps/agent-intent rev-parse --short HEAD 2>/dev/null)
|
||||
VERSION := $(shell git describe --tags --always --dirty 2>/dev/null)+$(COMBO)
|
||||
|
||||
.PHONY: help sync status build frontend svc svc-list svc-info svc-commits svc-history svc-update svc-recover svc-watchdog test-backend test-backend-pg test-multi-instance test-lifecycle test-regulations-kb test-frontend test-ui test-core test-agentcmd test-pins test-libs dev pin clean setup precheck task-triage task-triage-decide task-start task-resume task-sync task-close task-finish task-pr-check ci-wait facts-verify evidence version agent-exec-validate agent-exec-apply agent-exec-admit
|
||||
.PHONY: help sync status build frontend svc svc-list svc-info svc-commits svc-history svc-update svc-recover svc-watchdog test-backend test-backend-pg test-multi-instance test-lifecycle test-regulations-kb test-frontend test-ui test-core test-agentcmd test-pins test-libs dev pin clean setup precheck task-triage task-triage-decide task-start task-resume task-sync task-close task-finish task-pr-check ci-wait facts-verify evidence version agent-exec-validate agent-exec-apply agent-exec-admit image-build image-verify
|
||||
|
||||
version:
|
||||
@echo "agent-system $(VERSION)"
|
||||
@@ -99,6 +99,8 @@ help:
|
||||
@echo "make dev 开发模式说明（前后端分离热更新）"
|
||||
@echo "make pin 推进 submodule 指针到各仓远端 main（提交前须 make test 通过）"
|
||||
@echo "make status submodule 状态"
|
||||
@echo "make image-build 构建 Docker 测试环境镜像 agent-system-test-env:dev"
|
||||
@echo "make image-verify 运行镜像内环境自检 verify-env.sh"
|
||||
@echo "make agent-exec-validate 校验 AGENT-EXECUTION.md（scripts/agent-exec validate，经 dm-server agent-exec）"
|
||||
@echo "make agent-exec-apply RECEIPT=<path> 快进当前分支到成功收据的 transport"
|
||||
@echo "make agent-exec-admit 校验暂存路径具备 transport 来源或属于 host 豁免"
|
||||
@@ -118,6 +120,12 @@ agent-exec-apply:
|
||||
agent-exec-admit:
|
||||
scripts/agent-exec admit --repo .
|
||||
|
||||
image-build:
|
||||
docker build -t agent-system-test-env:dev docker/
|
||||
|
||||
image-verify:
|
||||
docker run --rm --shm-size=1g agent-system-test-env:dev /usr/local/bin/verify-env.sh
|
||||
|
||||
sync:
|
||||
git submodule update --init --recursive --jobs 8
|
||||
|
||||
|
||||
@@ -0,0 +1,50 @@
|
||||
FROM --platform=linux/amd64 ubuntu:24.04
|
||||
|
||||
ENV DEBIAN_FRONTEND=noninteractive
|
||||
ENV PLAYWRIGHT_BROWSERS_PATH=/opt/ms-playwright
|
||||
ENV PATH=/usr/local/go/bin:/usr/local/lib/nodejs/node-v26.10.0-linux-x64/bin:${PATH}
|
||||
|
||||
RUN apt-get update \
|
||||
&& apt-get install -y --no-install-recommends \
|
||||
ca-certificates \
|
||||
curl \
|
||||
git \
|
||||
libatomic1 \
|
||||
make \
|
||||
openssh-server \
|
||||
sudo \
|
||||
xz-utils \
|
||||
software-properties-common \
|
||||
&& add-apt-repository -y ppa:deadsnakes/ppa \
|
||||
&& apt-get update \
|
||||
&& apt-get install -y --no-install-recommends \
|
||||
python3.14 \
|
||||
python3.14-venv \
|
||||
&& python3.14 -m ensurepip --upgrade \
|
||||
&& ln -sf /usr/bin/python3.14 /usr/local/bin/python3 \
|
||||
&& ln -sf /usr/bin/python3.14 /usr/local/bin/python \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
RUN curl -fsSL https://go.dev/dl/go1.27.1.linux-amd64.tar.gz -o /tmp/go1.27.1.linux-amd64.tar.gz \
|
||||
&& rm -rf /usr/local/go \
|
||||
&& tar -C /usr/local -xzf /tmp/go1.27.1.linux-amd64.tar.gz \
|
||||
&& curl -fsSL https://nodejs.org/dist/v26.10.0/node-v26.10.0-linux-x64.tar.xz -o /tmp/node-v26.10.0-linux-x64.tar.xz \
|
||||
&& mkdir -p /usr/local/lib/nodejs \
|
||||
&& tar -C /usr/local/lib/nodejs -xJf /tmp/node-v26.10.0-linux-x64.tar.xz \
|
||||
&& npx -y playwright@1.64.0 install --with-deps chromium \
|
||||
&& rm -f /tmp/go1.27.1.linux-amd64.tar.gz /tmp/node-v26.10.0-linux-x64.tar.xz \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
RUN userdel -r ubuntu 2>/dev/null || true \
|
||||
&& groupdel ubuntu 2>/dev/null || true \
|
||||
&& groupadd --gid 1000 dev \
|
||||
&& useradd --uid 1000 --gid 1000 --create-home --shell /bin/bash dev \
|
||||
&& echo "dev ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/dev \
|
||||
&& chmod 0440 /etc/sudoers.d/dev \
|
||||
&& printf '\nPermitRootLogin no\nPasswordAuthentication no\nPubkeyAuthentication yes\n' >> /etc/ssh/sshd_config
|
||||
|
||||
COPY --chmod=755 entrypoint.sh /usr/local/bin/entrypoint.sh
|
||||
COPY --chmod=755 verify-env.sh /usr/local/bin/verify-env.sh
|
||||
|
||||
EXPOSE 22
|
||||
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
|
||||
@@ -0,0 +1,57 @@
|
||||
# Docker 测试环境镜像说明
|
||||
|
||||
## 用途与边界
|
||||
|
||||
本目录用于定义一个可重复构建的隔离测试环境镜像，供后续用该镜像启动一次性容器、挂载当前仓库做隔离测试。
|
||||
|
||||
- 该镜像只提供测试运行环境，不包含仓库代码。
|
||||
- 该镜像不包含任何密钥、私钥或凭据。
|
||||
- 本仓正式交付流程仍以非容器化路径为准，此镜像仅用于辅助隔离测试。
|
||||
|
||||
## 构建与自检
|
||||
|
||||
在仓库根目录执行：
|
||||
|
||||
```bash
|
||||
make image-build
|
||||
make image-verify
|
||||
```
|
||||
|
||||
- `make image-build`：构建镜像 `agent-system-test-env:dev`。
|
||||
- `make image-verify`：运行镜像内环境自检脚本 `/usr/local/bin/verify-env.sh`。
|
||||
|
||||
## 启动测试容器示例
|
||||
|
||||
```bash
|
||||
docker run -d --name asdev-test --shm-size=1g -p 127.0.0.1:2222:22 -v ~/.ssh/id_ed25519.pub:/home/dev/.ssh/authorized_keys:ro -v $PWD:/workspace agent-system-test-env:dev
|
||||
```
|
||||
|
||||
说明：
|
||||
|
||||
- `authorized_keys` 挂载源可以替换为任意可用的 `.pub` 公钥文件。
|
||||
- 容器内 SSH 登录用户为 `dev`。
|
||||
- `dev` 用户已配置 sudo 免密。
|
||||
|
||||
进入容器：
|
||||
|
||||
```bash
|
||||
ssh -p 2222 dev@127.0.0.1
|
||||
```
|
||||
|
||||
## 容器内最小测试流程
|
||||
|
||||
```bash
|
||||
cd /workspace
|
||||
make sync
|
||||
cd modules/frontend
|
||||
npm ci
|
||||
npx playwright test
|
||||
```
|
||||
|
||||
说明：镜像已内置 `PLAYWRIGHT_BROWSERS_PATH=/opt/ms-playwright` 下的 Chromium，通常无需在容器内再次执行 `playwright install`。
|
||||
|
||||
## 安全说明
|
||||
|
||||
- 容器内无密码登录，仅允许公钥认证。
|
||||
- 每个容器实例在启动时独立生成 SSH host key。
|
||||
- 不要将生产凭据、私钥或其他敏感文件带进容器。
|
||||
@@ -0,0 +1,23 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
mkdir -p /run/sshd
|
||||
ssh-keygen -A
|
||||
|
||||
install -d -m 0700 -o dev -g dev /home/dev/.ssh
|
||||
|
||||
if [ -f /home/dev/.ssh/authorized_keys ]; then
|
||||
tmp_authorized_keys="$(mktemp)"
|
||||
cp /home/dev/.ssh/authorized_keys "${tmp_authorized_keys}"
|
||||
install -m 0600 -o dev -g dev "${tmp_authorized_keys}" /home/dev/.ssh/authorized_keys 2>/dev/null || {
|
||||
chown dev:dev /home/dev/.ssh/authorized_keys 2>/dev/null || true
|
||||
chmod 0600 /home/dev/.ssh/authorized_keys 2>/dev/null || true
|
||||
}
|
||||
rm -f "${tmp_authorized_keys}"
|
||||
fi
|
||||
|
||||
if [ "$#" -gt 0 ]; then
|
||||
exec "$@"
|
||||
fi
|
||||
|
||||
exec /usr/sbin/sshd -D -e
|
||||
@@ -0,0 +1,50 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
fail_expect() {
|
||||
local expected="$1"
|
||||
local actual="$2"
|
||||
echo "校验失败: 期望: ${expected}"
|
||||
echo "校验失败: 实际: ${actual}"
|
||||
exit 1
|
||||
}
|
||||
|
||||
command -v git >/dev/null 2>&1 || fail_expect "git 可执行文件存在" "git 不存在"
|
||||
command -v make >/dev/null 2>&1 || fail_expect "make 可执行文件存在" "make 不存在"
|
||||
|
||||
go_version="$(go version 2>&1 || true)"
|
||||
[[ "${go_version}" == *"go1.27.1"* ]] || fail_expect "go version 输出包含 go1.27.1" "${go_version}"
|
||||
|
||||
node_version="$(node --version 2>&1 || true)"
|
||||
[[ "${node_version}" == "v26.10.0" ]] || fail_expect "v26.10.0" "${node_version}"
|
||||
|
||||
npm_version="$(npm --version 2>&1 || true)"
|
||||
[[ -n "${npm_version}" ]] || fail_expect "npm --version 有输出" "空输出"
|
||||
|
||||
python_version="$(python3 --version 2>&1 || true)"
|
||||
[[ "${python_version}" =~ ^Python\ 3\.14\.[0-9]+$ ]] || fail_expect "Python 3.14.x" "${python_version}"
|
||||
|
||||
if ! sshd_output="$(sshd -t 2>&1)"; then
|
||||
fail_expect "sshd -t 检查通过" "${sshd_output}"
|
||||
fi
|
||||
|
||||
id dev >/dev/null 2>&1 || fail_expect "用户 dev 存在" "用户 dev 不存在"
|
||||
|
||||
sudo_list="$(sudo -l -U dev 2>&1 || true)"
|
||||
echo "${sudo_list}" | grep -q "NOPASSWD" || fail_expect "sudo -l -U dev 含 NOPASSWD" "${sudo_list}"
|
||||
|
||||
if [ "${PLAYWRIGHT_BROWSERS_PATH:-}" != "/opt/ms-playwright" ]; then
|
||||
fail_expect "PLAYWRIGHT_BROWSERS_PATH=/opt/ms-playwright" "${PLAYWRIGHT_BROWSERS_PATH:-<未设置>}"
|
||||
fi
|
||||
|
||||
chromium_path="$(
|
||||
find /opt/ms-playwright -type f \( -name headless_shell -o -name chrome \) 2>/dev/null | head -n 1
|
||||
)"
|
||||
|
||||
[ -n "${chromium_path}" ] || fail_expect "在 /opt/ms-playwright 下存在 headless_shell 或 chrome" "未找到可执行文件"
|
||||
[ -x "${chromium_path}" ] || fail_expect "chromium 可执行文件具有执行权限" "${chromium_path} 不可执行"
|
||||
|
||||
chromium_dom="$("${chromium_path}" --headless --no-sandbox --disable-gpu --dump-dom about:blank 2>&1 || true)"
|
||||
echo "${chromium_dom}" | grep -q "<html" || fail_expect "chromium --dump-dom 输出包含 <html" "${chromium_dom}"
|
||||
|
||||
echo "verify-env: PASS"
|
||||
Reference in New Issue
Block a user