mirror of
https://github.com/0xWheatyz/handler.git
synced 2026-08-30 21:16:25 +00:00
Claude
a3a5c272a2
Model backend rows gain a harness column (claude | pi). A pi-harness row runs the agent through the pi coding agent instead of the claude binary — pi speaks the OpenAI Completions API natively, so a bare vLLM/llama.cpp/Ollama endpoint needs no LiteLLM/claude-code-router translation proxy, and the loop is far lighter for slow local token throughput. The Claude subscription and existing claude-harness backends are untouched. Parity comes from generated per-agent artifacts under ~/.handler-pi (outside the repo tree, so the clean-tree gate never trips): models.json + settings.json render the row as a pi provider pinned as the default model; a bundled bridge extension (pi_bridge.ts) adapts pi's events to the exact stdin/stdout contract of `python -m handler.hooks` — the Stop/completion gate re-prompts pi with blockers via a follow-up message, git push runs the test/build/approval gates and denies on failure, questions defer through an ask_operator tool into the normal answer/resume flow, and memory recall is injected at session start. The memory tools are registered natively (pi has no MCP), shelling to a new `python -m handler.mcpserver --call <tool>` seam that reuses the MCP server's implementations. Skills reuse the same ~/.claude/skills sync (pi implements the same SKILL.md standard) plus the repo's committed .claude/skills. Sessions are single JSONL files pre-assigned via --session, so cross-worker resume archives/materializes exactly like claude's; the prompt travels on stdin (pi has no -- separator). The supervisor normalizes pi's event stream on the fly: assistant message_end feeds last_output, the final agent_end becomes the run result. The whole chain was validated live against pi 0.84.1 with a stub OpenAI endpoint: memory injection, push-gate denial (including the protected- branch approval gate), stop-gate block loop, and ask_operator pause all ran end to end through the real hooks and DB. Also: harness selector in the dashboard Models form, pi baked into the control image (NodeSource 22 for pi's node >= 22.19 floor), PI_BIN override, docs in docs/local-models.md, fake_pi fixture + 12 tests (361 total green). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KdGv3u3DfTsP1S188KDhVH
107 lines
5.2 KiB
Docker
107 lines
5.2 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# Control-layer image: the `handler` CLI (the write side — spawn/list/kill agents,
|
|
# approve/reject branches, forge-init, and the CI poller). It shares the package, the
|
|
# database, and the /var/lib/handler data volume with the API image (see Dockerfile),
|
|
# but runs the control process instead of uvicorn.
|
|
|
|
# ---- forge build stage: compile the git-forge CLI (git-pkgs/forge, Go) ----
|
|
# Built here and copied into the runtime image as a single static binary, so the runtime
|
|
# stage needs no Go toolchain. `forge` gives the CI poller its cross-forge `ci list`.
|
|
# `golang:1` tracks the latest stable Go (forge >= v0.6.0 needs Go 1.26+); GOTOOLCHAIN=auto
|
|
# lets `go install` fetch an even newer toolchain if a future forge release requires one.
|
|
FROM golang:1-bookworm AS forge-builder
|
|
ENV CGO_ENABLED=0 \
|
|
GOTOOLCHAIN=auto
|
|
RUN go install github.com/git-pkgs/forge/cmd/forge@latest
|
|
|
|
# ---- build stage: install the package + deps into an isolated venv ----
|
|
FROM python:3.11-slim AS builder
|
|
|
|
ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
|
|
PIP_NO_CACHE_DIR=1
|
|
|
|
RUN python -m venv /opt/venv
|
|
ENV PATH="/opt/venv/bin:$PATH"
|
|
|
|
WORKDIR /build
|
|
COPY pyproject.toml README.md ./
|
|
COPY src ./src
|
|
RUN pip install .
|
|
|
|
# ---- runtime stage ----
|
|
FROM python:3.11-slim
|
|
|
|
# Every executable the control layer shells out to is now bundled — no bring-your-own
|
|
# binaries — so the container can spawn live agents, run the verification gate, resolve CI,
|
|
# and drive the claude web-login flow out of the box:
|
|
# git / openssh-client — clone/push over https + ssh remotes
|
|
# tmux — one detached session per agent (and per login attempt)
|
|
# node + claude — the Claude Code CLI the agents *are*, and the /login flow the
|
|
# dashboard drives (see control/login.py)
|
|
# pi — the lightweight pi coding agent (harness='pi' model backends,
|
|
# see control/pi_harness.py); speaks OpenAI-compatible endpoints
|
|
# natively, so local vLLM/llama.cpp backends need no proxy
|
|
# mise — the per-project task runner the test/build gates invoke
|
|
# forge — the cross-forge CLI the CI poller reads run status from
|
|
# Node comes from NodeSource (>=18 for Claude Code, >=22.19 for pi); mise from its official
|
|
# apt repo; forge from the build stage above. Installed under /usr/{bin,local/bin} — outside
|
|
# the /var/lib/handler VOLUME — so the volume mount never masks them at runtime. The image is
|
|
# built for amd64 and arm64: NodeSource + forge detect the arch, and the mise apt source is
|
|
# pinned to `dpkg --print-architecture` (the image's own arch) so the arm64 build pulls the
|
|
# arm64 package, not an amd64 one.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
git tmux openssh-client curl ca-certificates gnupg \
|
|
&& install -dm 755 /etc/apt/keyrings \
|
|
&& curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
|
|
&& apt-get install -y --no-install-recommends nodejs \
|
|
&& npm install -g @anthropic-ai/claude-code \
|
|
&& npm install -g --ignore-scripts @earendil-works/pi-coding-agent \
|
|
&& npm cache clean --force \
|
|
&& curl -fsSL https://mise.jdx.dev/gpg-key.pub \
|
|
| gpg --dearmor -o /etc/apt/keyrings/mise-archive-keyring.gpg \
|
|
&& echo "deb [signed-by=/etc/apt/keyrings/mise-archive-keyring.gpg arch=$(dpkg --print-architecture)] https://mise.jdx.dev/deb stable main" \
|
|
> /etc/apt/sources.list.d/mise.list \
|
|
&& apt-get update \
|
|
&& apt-get install -y --no-install-recommends mise \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# The cross-forge CLI compiled in the build stage above (github.com/git-pkgs/forge).
|
|
COPY --from=forge-builder /go/bin/forge /usr/local/bin/forge
|
|
|
|
ENV PATH="/opt/venv/bin:$PATH" \
|
|
PYTHONUNBUFFERED=1 \
|
|
# SQLite fallback lives on the /var/lib/handler volume; point DATABASE_URL at the
|
|
# same Postgres the API uses for a shared, real deploy (see docker-compose.yml).
|
|
DATABASE_URL="sqlite:////var/lib/handler/handler.db" \
|
|
PROJECTS_ROOT="/var/lib/handler/projects"
|
|
|
|
COPY --from=builder /opt/venv /opt/venv
|
|
|
|
# Ship alembic alongside the package so the image can migrate standalone if asked
|
|
# (RUN_MIGRATIONS=true). In the compose stack the API owns migrations and the control
|
|
# service runs with RUN_MIGRATIONS=false to avoid a startup race.
|
|
WORKDIR /app
|
|
COPY alembic.ini ./
|
|
COPY src/handler/migrations ./src/handler/migrations
|
|
COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
|
|
|
|
RUN useradd --system --home-dir /var/lib/handler --create-home handler \
|
|
&& mkdir -p /var/lib/handler/projects \
|
|
&& chown -R handler:handler /var/lib/handler \
|
|
&& chmod +x /usr/local/bin/docker-entrypoint.sh
|
|
|
|
USER handler
|
|
VOLUME /var/lib/handler
|
|
|
|
# Liveness: exercises the CLI end-to-end and confirms the database is reachable.
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
|
|
CMD handler list >/dev/null 2>&1 || exit 1
|
|
|
|
# Default to the worker: it drains the control-command queue the API enqueues
|
|
# (spawn/kill/resume/approve/…) and sweeps CI on an interval (subsuming `poll-ci --watch`).
|
|
# Override for one-shot control operations, e.g. `docker compose run --rm control handler list`.
|
|
ENTRYPOINT ["docker-entrypoint.sh"]
|
|
CMD ["handler", "worker"]
|