Omar SobhandClaude Opus 5
08847e6a63
The python guest agent only ever worked because Firecracker's CI Ubuntu image happens to ship python3. NONE of our images do — agent-base has neither python nor git, agent-terminal has git but no python — so it could never have run in a real mission rootfs. An agent that dictates what must be installed in the image has the dependency backwards. crates/bins/fcagent is a 905K static x86_64-unknown-linux-musl binary that needs nothing from the rootfs it is dropped into. The wire is unchanged on purpose — 4-byte BE length + JSON, ops ping/exec/put/get — so microvm.rs and microvm_client.rs needed no edit at all. std has no AF_VSOCK and the workspace denies `unsafe`, so it uses the `vsock` crate. `process_group(0)` gives each command its own group without unsafe, so a command that spawns background children can be killed wholesale rather than outliving the run. A unit test caught a bug that would have broken EVERY exec: sourcing the image-env file with `. env.sh 2>/dev/null; cmd` returns rc=1 WITHOUT running cmd, because `.` on a missing file makes a non-interactive POSIX shell exit immediately. On any rootfs lacking that file every command would have failed while looking like an ordinary non-zero exit. Guarded with `if [ -f ]` now. Other places a failure must not borrow an outcome's representation: a killed command reports ok:false with no rc (not rc=124, which would read as a build failure); `get` on a missing path is an error, not an empty archive; a signalled process reports 128+signal rather than success. Verified on tank: --vm-selftest still 8/8 with the agent swapped (create 949ms, wire identical), fc-node-setup 8/8, and — the point of the change — a rootfs built from clawmates/agent-terminal:dev, which has NO python3, boots and reports `git version 2.39.5` from inside the VM. Also fixes a shell bug in fc-build-rootfs.sh: $HOME in a double-quoted default expanded on this Mac, so it looked for the node's binary under /Users/quantum on a Linux host. Co-Authored-By: Claude Opus 5 <[email protected]>
81 lines
2.9 KiB
TOML
81 lines
2.9 KiB
TOML
[workspace]
|
|
resolver = "2"
|
|
members = [
|
|
"crates/cm-domain",
|
|
"crates/cm-topology",
|
|
"crates/cm-orchestrator",
|
|
"crates/cm-config",
|
|
"crates/cm-db",
|
|
"crates/cm-llm",
|
|
"crates/cm-runtime",
|
|
"crates/cm-tools",
|
|
"crates/cm-safety",
|
|
"crates/cm-sandbox",
|
|
"crates/cm-secrets",
|
|
"crates/cm-files",
|
|
"crates/cm-scheduler",
|
|
"crates/cm-billing",
|
|
"crates/cm-telemetry",
|
|
"crates/cm-testkit",
|
|
"crates/cm-auth",
|
|
"crates/cm-brain",
|
|
"crates/cm-api",
|
|
"crates/bins/clawmates-server",
|
|
"crates/bins/clawmates-broker",
|
|
"crates/bins/clawmates-node",
|
|
"crates/bins/fcagent",
|
|
"tools/bundler",
|
|
]
|
|
|
|
[workspace.package]
|
|
edition = "2021"
|
|
rust-version = "1.96"
|
|
license = "UNLICENSED"
|
|
publish = false
|
|
|
|
[workspace.dependencies]
|
|
# Shared dependency versions; crates opt in via { workspace = true }.
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
# Streaming tar for mission copy-in/copy-out (no compression: the payload is
|
|
# a git checkout on a local socket, so CPU spent zipping buys nothing).
|
|
tar = "0.4"
|
|
thiserror = "2"
|
|
uuid = { version = "1", features = ["v7", "serde"] }
|
|
proptest = "1"
|
|
time = { version = "0.3", features = ["serde", "serde-well-known"] }
|
|
tokio = { version = "1", features = ["macros", "rt-multi-thread", "fs", "net", "time", "sync", "io-util", "process"] }
|
|
sqlx = { version = "0.8", default-features = false, features = [
|
|
"runtime-tokio",
|
|
"tls-rustls",
|
|
"postgres",
|
|
"uuid",
|
|
"time",
|
|
"json",
|
|
"migrate",
|
|
"macros",
|
|
"bigdecimal",
|
|
] }
|
|
testcontainers-modules = { version = "0.13", features = ["postgres"] }
|
|
|
|
[workspace.lints.rust]
|
|
unsafe_code = "deny"
|
|
|
|
[workspace.lints.clippy]
|
|
todo = "deny"
|
|
unimplemented = "deny"
|
|
dbg_macro = "deny"
|
|
|
|
# ClawSync (claw-brain `sync` feature) pulls clawhdf5-onion/clawsync-onion/
|
|
# clawsync-agent from the clawsync repo, whose crates internally path-dep on a
|
|
# sibling ../clawhdf5 (absent in a git checkout). clawverse patches this for its
|
|
# own build, but `[patch]` only applies from the root workspace — so we mirror it
|
|
# here, redirecting clawsync's clawhdf5 view to the same quantumclaw rev cm-brain
|
|
# already uses (one clawhdf5 in the graph, types unify).
|
|
[patch."https://git.redclaw.dev/redclaw/clawsync.git"]
|
|
clawhdf5 = { git = "https://git.redclaw.dev/quantumclaw/clawhdf5.git", rev = "8534c7d204959c6f8959f3983f3edf6475ba25b9" }
|
|
clawhdf5-format = { git = "https://git.redclaw.dev/quantumclaw/clawhdf5.git", rev = "8534c7d204959c6f8959f3983f3edf6475ba25b9" }
|
|
clawhdf5-io = { git = "https://git.redclaw.dev/quantumclaw/clawhdf5.git", rev = "8534c7d204959c6f8959f3983f3edf6475ba25b9" }
|
|
clawhdf5-filters = { git = "https://git.redclaw.dev/quantumclaw/clawhdf5.git", rev = "8534c7d204959c6f8959f3983f3edf6475ba25b9" }
|
|
clawhdf5-agent = { git = "https://git.redclaw.dev/quantumclaw/clawhdf5.git", rev = "8534c7d204959c6f8959f3983f3edf6475ba25b9" }
|