mirror of
https://github.com/rennf93/roboco.git
synced 2026-08-03 07:23:24 +02:00
Renn F
82945ae023
The keystone of the Grok parity work (CEO's "take Claude as baseline, create what's missing" call): the one-shot Grok container now starts the same SDK server the Claude path runs, so the per-verb circuit breaker (the flow/do MCP servers already POST /verb/attempted to it), the per-session budget/loop counters, the terminal-verb tracking, and the SessionEnd post-mortem all work on Grok instead of being silently absent. - entrypoint: launch roboco.agent_sdk.server (bare venv python, not `uv run` which would re-sync the drifted clone lock and stall), wait for /health, reset counters; run opencode WITHOUT exec so the script regains control to run the post-mortem and the silent-exit substitute after the run returns. - budget-feed.js: opencode plugin that gates on /budget/status in tool.execute.before (halt/loop deny — the only place to stop a runaway one-shot run; opencode has no PostToolUse-deny) and records the executed tool + args-hash in tool.execute.after. Fail-open; bare-verb normalization for MCP-namespaced terminal verbs. - silent-exit substitute: on a graceful exit with no terminal verb the entrypoint posts /terminal/force_substitute so the task isn't left stuck claimed/in_progress (Stop-hook parity at the boundary). - opencode_config: wire budget-feed into the plugin array; add ROBOCO_OPENCODE_EXTRA_PLUGINS so per-image role tool plugins load scoped to one role; read the per-role ROBOCO_GROK_EDIT_PERMISSION. Targeted gate green (ruff/mypy/xenon + opencode_config tests; node --check on the plugins; bash -n on the entrypoint).
51 lines
2.6 KiB
Docker
51 lines
2.6 KiB
Docker
# Grok (xAI) Agent Image
|
|
# =============================================================================
|
|
# Runs grok-build-0.1 through the opencode CLI (OpenAI protocol) instead of
|
|
# Claude Code, while reusing the base image's roboco venv + uv + the RoboCo MCP
|
|
# gateway servers. The entrypoint renders opencode.json from the spawn env +
|
|
# mounted mcp-config.json (see roboco.llm.providers.opencode_config) and runs
|
|
# opencode. One runtime image serves every role — role behaviour comes from the
|
|
# mounted system prompt / manifest / mcp-config, exactly as on the Claude path.
|
|
# =============================================================================
|
|
|
|
FROM roboco-agent-base
|
|
|
|
USER root
|
|
|
|
# opencode — the OpenAI-protocol agent runtime. grok-build-0.1 is driven via the
|
|
# OpenAI Responses API, so the provider package is @ai-sdk/openai (NOT
|
|
# @ai-sdk/openai-compatible, which is chat/completions only and errors with
|
|
# "responses is not a function"). opencode resolves it at runtime, but
|
|
# pre-installing keeps first spawn off the network.
|
|
RUN npm install -g opencode-ai @ai-sdk/openai \
|
|
&& npm cache clean --force \
|
|
&& rm -rf /root/.npm /tmp/*
|
|
|
|
# opencode plugins (referenced from the generated opencode.json `plugin:` array):
|
|
# secret-scrub — bash-guard parity (PAT/credential deny on tool.execute.before)
|
|
# budget-feed — POSTs budget/loop/terminal counters to the in-container SDK
|
|
# server (tool.execute.{before,after}); the entrypoint starts
|
|
# that server (roboco.agent_sdk.server) for Claude-parity.
|
|
COPY docker/grok/secret-scrub.js /app/opencode-plugins/secret-scrub.js
|
|
COPY docker/grok/budget-feed.js /app/opencode-plugins/budget-feed.js
|
|
|
|
# Entrypoint: render opencode.json, then run opencode (overrides base's `claude`).
|
|
COPY docker/scripts/grok-agent-entrypoint.sh /app/scripts/grok-agent-entrypoint.sh
|
|
RUN chmod 0755 /app/scripts/grok-agent-entrypoint.sh
|
|
|
|
# opencode persists data under ~/.local/share and state under ~/.local/state.
|
|
# When the orchestrator bind-mounts the opencode store at
|
|
# ~/.local/share/opencode, docker creates the intermediate ~/.local AS ROOT, so
|
|
# the non-root agent can no longer create its sibling ~/.local/state and opencode
|
|
# EACCESes at boot. Pre-create the tree agent-owned so the mount leaves the
|
|
# parents writable (complements the orchestrator's 0777 host-source pre-create).
|
|
RUN mkdir -p /home/agent/.local/share/opencode /home/agent/.local/state \
|
|
&& chown -R agent:agent /home/agent/.local
|
|
|
|
USER agent
|
|
|
|
LABEL role="grok-runtime"
|
|
LABEL description="Grok (xAI) agent runtime — grok-build-0.1 via opencode (OpenAI protocol)"
|
|
|
|
ENTRYPOINT ["/app/scripts/grok-agent-entrypoint.sh"]
|