v0.8.7: tool capability metadata, in-process engine, Qt app, Android engine
The engine can be embedded now instead of only driven from a terminal: the same objects link into a Qt front end (app/) that owns a cst_agent_t inside its own process -- no port, no token, no second process -- and that front end now runs on the desktop and, engine-side, on the phone. Capability metadata (include/cst_tools.h, src/tools/registry.c): - cst_tool_def_t gains perm_name, platforms and available (a probe that returns a reason), so a permission is addressable by name and a tool can say why it cannot run here. - cst_platform_name(), cst_tool_platform_ok(), cst_tool_available(), cst_tool_meta_reload(), cst_tool_perm_name() and CST_PLAT_DESKTOP[]. - cst_tool_register() may take over a built-in name that is not runnable on this platform, so a front end replaces it with its own implementation. - the registry entries carry their class (delete_file -> "delete"), the desktop clipboard tools carry a clipboard probe; find/active/run gate on it. - /api/settings.tools[] exposes perm_name, platforms, available, why and the declared parameters. Engine as a library (Makefile, CMakeLists.txt): - libcstcore.a from the CORE_OBJ set, and a CMake cstcore target shared by the CLI and by app/ (-DCST_BUILD_APP=ON): the engine is compiled once. - Android branch for the vendored sashidown: a per-ABI archive built with the NDK's aarch64-linux-android24-clang wrapper, because CMake's compiler is plain clang and keeps --target/--sysroot in its own variables. Qt front end (app/, new): - AgentCore wraps one cst_agent_t: turns run on a worker thread, every cst_agent_hooks_t callback becomes a Qt signal, and the two hooks that need an answer (on_permission, on_ask_user) block the worker until the GUI replies; mode, approval and plan mode go through the engine's config. - ToolProvider hands the front end's tools to the engine (owner "app:*"); the Linux one is notification_send with a probe for notify-send/D-Bus. - Main.qml: transcript, tool blocks, consent dialog (Deny/Once/Always -> CST_PERM_*), ask_user, mode switch, Esc to cancel; --selftest stays headless and runs the embedding checks without QML. Android (scripts/, docs/android.md, new): - scripts/build_third_party_android.sh builds static mbedTLS + libcurl for an ABI (CA path /system/etc/security/cacerts); build_android.sh builds cst-agent, libcstcore.a and the test binaries for the phone, can push them and run the whole suite there. - sandbox_exec.c keeps the plain exec path on Android: the seccomp supervisor compiled in and the probe reported "seccomp", but writes outside the workspace were not denied on the device -- claiming a sandbox that does not hold is worse than reporting none. - tests/test_diff.c compares layouts only against real GNU diffutils: toybox's diff prints the same hunk header with its own hunk/context rules. Tests: test_tool_meta (metadata, platform gate, probe reasons, takeover of a built-in name) and test_embed (in-process embedding contract) are new; the existing registry/llm_body assertions now follow availability. 38 test binaries pass on the host, 36/36 on arm64-v8a Android 16, cst-app-selftest passes in both the standalone app/ build and the repo build. Version 0.8.7.
This commit is contained in:
WHC
Executable
+107
@@ -0,0 +1,107 @@
|
||||
#!/usr/bin/env bash
|
||||
# Cross-build the engine for Android: libcstcore.a (what the APK embeds) plus
|
||||
# cst-agent and tests/test_embed, which run straight from /data/local/tmp.
|
||||
# No TUI (no ncurses on Android) and no WebUI (the phone app talks to the
|
||||
# engine in-process; the stub compiles instead of the HTTP server).
|
||||
#
|
||||
# scripts/build_android.sh [arm64-v8a|x86_64] [--push] [--run] [--run-tests]
|
||||
#
|
||||
# --push copy the binaries to /data/local/tmp
|
||||
# --run also smoke-test there: cst-agent --version, test_embed
|
||||
# --run-tests build and run the whole tests/ suite on the device
|
||||
#
|
||||
# Needs ANDROID_NDK_HOME (see build_third_party_android.sh) and the deps from
|
||||
# scripts/build_third_party_android.sh ABI all.
|
||||
set -euo pipefail
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
||||
ABI="arm64-v8a"
|
||||
DO_PUSH=0
|
||||
DO_RUN=0
|
||||
DO_TESTS=0
|
||||
for a in "$@"; do
|
||||
case "$a" in
|
||||
arm64-v8a | x86_64) ABI="$a" ;;
|
||||
--push) DO_PUSH=1 ;;
|
||||
--run) DO_PUSH=1; DO_RUN=1 ;;
|
||||
--run-tests) DO_PUSH=1; DO_TESTS=1 ;;
|
||||
*) echo "usage: $0 [arm64-v8a|x86_64] [--push] [--run|--run-tests]" >&2; exit 1 ;;
|
||||
esac
|
||||
done
|
||||
|
||||
API_LEVEL="${API_LEVEL:-24}"
|
||||
PREFIX="$ROOT/third_party/prefix-android-$ABI"
|
||||
BUILD="$ROOT/build-android-$ABI"
|
||||
JOBS="${JOBS:-$(nproc 2>/dev/null || echo 4)}"
|
||||
|
||||
NDK="${ANDROID_NDK_HOME:-${ANDROID_NDK_ROOT:-}}"
|
||||
if [[ -z "$NDK" || ! -f "$NDK/build/cmake/android.toolchain.cmake" ]]; then
|
||||
echo "set ANDROID_NDK_HOME to an NDK (see build_third_party_android.sh)" >&2
|
||||
exit 1
|
||||
fi
|
||||
if [[ ! -f "$PREFIX/lib/libcurl.a" ]]; then
|
||||
echo "missing $PREFIX/lib/libcurl.a -- run:" >&2
|
||||
echo " scripts/build_third_party_android.sh $ABI all" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
cmake -S "$ROOT" -B "$BUILD" -G Ninja \
|
||||
-DCMAKE_TOOLCHAIN_FILE="$NDK/build/cmake/android.toolchain.cmake" \
|
||||
-DANDROID_ABI="$ABI" -DANDROID_PLATFORM="android-$API_LEVEL" \
|
||||
-DANDROID_NDK="$NDK" \
|
||||
-DCMAKE_BUILD_TYPE=Release \
|
||||
-DCMAKE_PREFIX_PATH="$PREFIX" \
|
||||
-DCURL_INCLUDE_DIR="$PREFIX/include" -DCURL_LIBRARY="$PREFIX/lib/libcurl.a" \
|
||||
-DCMAKE_EXE_LINKER_FLAGS="-L$PREFIX/lib" \
|
||||
-DCST_BUILD_TUI=OFF -DCST_BUILD_WEBUI=OFF -DCST_BUILD_APP=OFF \
|
||||
-DCST_BUNDLE_BUSYBOX=OFF
|
||||
if [[ "$DO_TESTS" == 1 ]]; then
|
||||
cmake --build "$BUILD" -j"$JOBS" # every test target
|
||||
else
|
||||
cmake --build "$BUILD" -j"$JOBS" --target cst-agent test_embed
|
||||
fi
|
||||
echo "built in $BUILD"
|
||||
[[ "$DO_PUSH" == 1 ]] || exit 0
|
||||
|
||||
ADB="${ADB:-adb}"
|
||||
command -v "$ADB" >/dev/null || { echo "adb not found (nix-shell -p android-tools)" >&2; exit 1; }
|
||||
DEV=/data/local/tmp
|
||||
NAMES=(cst-agent test_embed)
|
||||
FILES=("$BUILD/cst-agent" "$BUILD/test_embed")
|
||||
TESTS=()
|
||||
if [[ "$DO_TESTS" == 1 ]]; then
|
||||
mapfile -t TESTS < <(find "$BUILD" -maxdepth 1 -type f -name 'test_*' -perm -u+x | sort)
|
||||
for t in "${TESTS[@]}"; do
|
||||
NAMES+=("${t##*/}")
|
||||
FILES+=("$t")
|
||||
done
|
||||
fi
|
||||
"$ADB" push "${FILES[@]}" "$DEV/" >/dev/null
|
||||
"$ADB" shell chmod 755 "${NAMES[@]/#/$DEV/}"
|
||||
echo "pushed ${#NAMES[@]} binaries to $DEV"
|
||||
[[ "$DO_PUSH" == 1 && ( "$DO_RUN" == 1 || "$DO_TESTS" == 1 ) ]] || exit 0
|
||||
|
||||
echo "--- $DEV/cst-agent --version"
|
||||
"$ADB" shell "$DEV/cst-agent --version"
|
||||
if [[ "$DO_TESTS" == 0 ]]; then
|
||||
echo "--- $DEV/test_embed"
|
||||
"$ADB" shell "cd $DEV && ./test_embed"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# The suite runs on the device as the shell user; tests that want a real
|
||||
# /bin/sh, a host fixture tree or a Linux-specific sandbox report their own
|
||||
# failure, which is the point of running them here.
|
||||
# The sandbox test builds its scratch trees under $PWD/tests, the same way
|
||||
# ctest runs it from the repo root.
|
||||
"$ADB" shell mkdir -p "$DEV/tests"
|
||||
pass=0; fail=0; skipped=()
|
||||
for t in "${TESTS[@]}"; do
|
||||
name="${t##*/}"
|
||||
if "$ADB" shell "cd $DEV && ./$name" >/dev/null 2>&1; then
|
||||
pass=$((pass + 1)); echo "ok $name"
|
||||
else
|
||||
fail=$((fail + 1)); skipped+=("$name"); echo "FAIL $name"
|
||||
fi
|
||||
done
|
||||
echo "--- $pass passed, $fail failed"
|
||||
[[ "$fail" == 0 ]] || { printf 'failed: %s\n' "${skipped[*]}"; exit 1; }
|
||||
Executable
+137
@@ -0,0 +1,137 @@
|
||||
#!/usr/bin/env bash
|
||||
# Static deps for Android into third_party/prefix-android-ABI: mbedTLS and
|
||||
# libcurl (HTTP(S) only, mbedTLS), the same pair the Linux release uses --
|
||||
# a phone has no system libcurl and bionic's CA store is /system/etc/security,
|
||||
# so libcurl is built here rather than taken from the platform.
|
||||
#
|
||||
# scripts/build_third_party_android.sh arm64-v8a|x86_64 [all|mbedtls|curl]
|
||||
#
|
||||
# Needs the NDK in ANDROID_NDK_HOME (a directory with
|
||||
# build/cmake/android.toolchain.cmake). On NixOS the packaged one is:
|
||||
# export ANDROID_NDK_HOME=$(
|
||||
# NIXPKGS_ALLOW_UNFREE=1 nix build --impure --no-link --print-out-paths \
|
||||
# 'nixpkgs#androidenv.androidPkgs.ndk-bundle')/libexec/android-sdk/ndk-bundle
|
||||
# Host tools: cmake ninja make.
|
||||
set -euo pipefail
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
||||
ABI="${1:?usage: $0 arm64-v8a|x86_64 [all|mbedtls|curl]}"
|
||||
TP="$ROOT/third_party"
|
||||
PREFIX="$TP/prefix-android-$ABI"
|
||||
SRC="$TP/src"
|
||||
WORK="$TP/build-android-$ABI"
|
||||
JOBS="${JOBS:-$(nproc 2>/dev/null || echo 4)}"
|
||||
|
||||
MBEDTLS_VER=3.6.7
|
||||
MBEDTLS_SHA=a7e8bcbec0e6f761b4af24f25677626b35f762f68eef79c08677a363212d11f6
|
||||
CURL_VER=8.22.0
|
||||
CURL_SHA=f7ef3ae8a22e521f289803fe93543eb64c329b58aa73a9e224dfd915a2a5f4f7
|
||||
|
||||
# Android 7.0: what bionic gives the engine (threads, exec, /system CA store).
|
||||
API_LEVEL="${API_LEVEL:-24}"
|
||||
# Per-app CAs land in the user store; the system bundle is the readable one.
|
||||
CA_PATH=/system/etc/security/cacerts
|
||||
|
||||
NDK="${ANDROID_NDK_HOME:-${ANDROID_NDK_ROOT:-}}"
|
||||
if [[ -z "$NDK" || ! -f "$NDK/build/cmake/android.toolchain.cmake" ]]; then
|
||||
echo "set ANDROID_NDK_HOME to an NDK (see the header of this script)" >&2
|
||||
exit 1
|
||||
fi
|
||||
TOOLCHAIN="$NDK/build/cmake/android.toolchain.cmake"
|
||||
|
||||
need() { command -v "$1" >/dev/null || { echo "missing: $1" >&2; exit 1; }; }
|
||||
need cmake
|
||||
need ninja
|
||||
mkdir -p "$PREFIX" "$SRC" "$WORK"
|
||||
|
||||
fetch() { # file sha url...
|
||||
local file="$1" sha="$2" u
|
||||
shift 2
|
||||
if [[ -f "$SRC/$file" ]] && echo "$sha $SRC/$file" | sha256sum -c --quiet - 2>/dev/null; then
|
||||
return 0
|
||||
fi
|
||||
for u in "$@"; do
|
||||
echo " try $u"
|
||||
if curl -fsSL --retry 2 --connect-timeout 15 --max-time 600 -o "$SRC/$file.part" "$u" &&
|
||||
echo "$sha $SRC/$file.part" | sha256sum -c --quiet -; then
|
||||
mv "$SRC/$file.part" "$SRC/$file"
|
||||
return 0
|
||||
fi
|
||||
done
|
||||
rm -f "$SRC/$file.part"
|
||||
echo "download failed: $file" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
unpack() { # file dir
|
||||
rm -rf "${WORK:?}/$2"
|
||||
tar -C "$WORK" -xf "$SRC/$1"
|
||||
}
|
||||
|
||||
gh() { # path -> GitHub URL candidates (CN proxies first)
|
||||
printf '%s\n' "https://ghfast.top/https://github.com/$1" \
|
||||
"https://ghproxy.net/https://github.com/$1" "https://github.com/$1"
|
||||
}
|
||||
|
||||
cmake_android() { # src build args...
|
||||
local s="$1" b="$2"
|
||||
shift 2
|
||||
cmake -S "$s" -B "$b" -G Ninja \
|
||||
-DCMAKE_TOOLCHAIN_FILE="$TOOLCHAIN" \
|
||||
-DANDROID_ABI="$ABI" -DANDROID_PLATFORM="android-$API_LEVEL" \
|
||||
-DANDROID_NDK="$NDK" \
|
||||
-DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX="$PREFIX" \
|
||||
-DCMAKE_PREFIX_PATH="$PREFIX" -DCMAKE_INSTALL_LIBDIR=lib \
|
||||
-DCMAKE_POSITION_INDEPENDENT_CODE=OFF \
|
||||
"$@"
|
||||
cmake --build "$b" -j"$JOBS"
|
||||
cmake --install "$b"
|
||||
}
|
||||
|
||||
build_mbedtls() {
|
||||
local f="mbedtls-$MBEDTLS_VER.tar.bz2"
|
||||
mapfile -t urls < <(gh "Mbed-TLS/mbedtls/releases/download/mbedtls-$MBEDTLS_VER/$f")
|
||||
fetch "$f" "$MBEDTLS_SHA" "${urls[@]}"
|
||||
unpack "$f" "mbedtls-$MBEDTLS_VER"
|
||||
# 3.6.x keeps its own entropy source on Android, no /dev/urandom probing.
|
||||
cmake_android "$WORK/mbedtls-$MBEDTLS_VER" "$WORK/mbedtls-$MBEDTLS_VER/build" \
|
||||
-DENABLE_TESTING=OFF -DENABLE_PROGRAMS=OFF -DGEN_FILES=OFF \
|
||||
-DUSE_STATIC_MBEDTLS_LIBRARY=ON -DUSE_SHARED_MBEDTLS_LIBRARY=OFF \
|
||||
-DMBEDTLS_FATAL_WARNINGS=OFF
|
||||
echo "mbedTLS $MBEDTLS_VER -> $PREFIX"
|
||||
}
|
||||
|
||||
build_curl() {
|
||||
local f="curl-$CURL_VER.tar.xz"
|
||||
mapfile -t urls < <(gh "curl/curl/releases/download/curl-${CURL_VER//./_}/$f")
|
||||
fetch "$f" "$CURL_SHA" "https://curl.se/download/$f" "${urls[@]}"
|
||||
unpack "$f" "curl-$CURL_VER"
|
||||
cmake_android "$WORK/curl-$CURL_VER" "$WORK/curl-$CURL_VER/build" \
|
||||
-DBUILD_SHARED_LIBS=OFF -DBUILD_STATIC_LIBS=ON \
|
||||
-DCURL_USE_MBEDTLS=ON -DCURL_USE_OPENSSL=OFF \
|
||||
-DMBEDTLS_INCLUDE_DIR="$PREFIX/include" \
|
||||
-DMBEDTLS_LIBRARY="$PREFIX/lib/libmbedtls.a" \
|
||||
-DMBEDX509_LIBRARY="$PREFIX/lib/libmbedx509.a" \
|
||||
-DMBEDCRYPTO_LIBRARY="$PREFIX/lib/libmbedcrypto.a" \
|
||||
-DCURL_CA_BUNDLE=none -DCURL_CA_PATH="$CA_PATH" \
|
||||
-DHTTP_ONLY=ON -DCURL_DISABLE_LDAP=ON -DCURL_USE_LIBPSL=OFF \
|
||||
-DCURL_USE_LIBSSH2=OFF -DCURL_USE_LIBSSH=OFF -DUSE_LIBIDN2=OFF \
|
||||
-DUSE_NGHTTP2=OFF -DCURL_ZLIB=OFF -DCURL_BROTLI=OFF -DCURL_ZSTD=OFF \
|
||||
-DCURL_USE_GSSAPI=OFF -DENABLE_THREADED_RESOLVER=ON \
|
||||
-DBUILD_CURL_EXE=OFF -DBUILD_TESTING=OFF -DBUILD_EXAMPLES=OFF \
|
||||
-DBUILD_LIBCURL_DOCS=OFF -DBUILD_MISC_DOCS=OFF -DENABLE_CURL_MANUAL=OFF
|
||||
echo "curl $CURL_VER -> $PREFIX"
|
||||
}
|
||||
|
||||
case "${2:-all}" in
|
||||
mbedtls) build_mbedtls ;;
|
||||
curl) build_curl ;;
|
||||
all)
|
||||
build_mbedtls
|
||||
build_curl
|
||||
;;
|
||||
*)
|
||||
echo "usage: $0 ABI [all|mbedtls|curl]" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
echo "DONE android-$ABI"
|
||||
Reference in New Issue
Block a user