Files
skills/scripts/install.sh
T
Kevin Veen-BirkenbachandClaude Opus 5.5 8ba45efd04 feat(hub): kvb-hub review hub with passkey-signed approvals
The kvb-hub is a local review hub in a container bound to 127.0.0.1: one page, JSON APIs and an MCP endpoint for the operator's inbox, asks, decisions, staged-commit reviews, the radio stream, the agent graph, the worktree tree, push-to-talk and read-aloud radio (Piper, whisper.cpp) and an optional LLM command line. The hub is only a relay. The host executors in hub/client (the runner user service, the PermissionRequest hook and the approval CLI the commit skills call) verify a WebAuthn passkey signature against keys pinned outside every sandbox, refuse replays and fail closed. scripts/hub.sh with make hub-install, hub-check, hub-pin, hub-runner and hub-hook installs and checks the hub; hub-hook writes ~/.claude/settings.json after a backup. make watch-check shows a stuck watch hook. The new kvb-git-diff skill and the commit skills route reviews through the hub; the test_hub_* suites replace test_hub.py.

Security review (kvb-think-criticize, three skeptics) fixed four holes: signed rules auto-approved chained shell commands; the client and LLM openers followed redirects, the LLM one with its bearer key; the worktree scan ran git fsmonitor and filter commands from agent-writable repos; compose set no memory, pids or health limits. Documented until core requirement 093, on the operator's word: the hub page is trusted while signing and pinning, local processes can forge the unsigned operator actions, and the container reads the host /tmp. Committed on the operator's word despite the gate: the passkey path is not yet verified live.

Accepted MEDUSA false positives (137 findings on 115 lines, rows in security-accepted.jsonl): EXA002 x17, MEDUSA-MM-SCAN-058 x12, B603 x8, MEDUSA-FTSC-SCAN-089 x7, MEDUSA-PRIV-SCAN-762 x6, AIC-EXFIL-005 x5, EXA006 x5, MEDUSA-FTSCAN-231 x5, WEB-SSRF x5, MEDUSA-INF-SCAN-2057 x3, RH005 x3, TC001 x3, LO002 x2, MEDUSA-AEXP-SCAN-096 x2, MEDUSA-CGS-SCAN-028 x2, MEDUSA-INF-SCAN-1350 x2, MEDUSA-INF-SCAN-2369 x2, MEDUSA-INF-SCAN-2440 x2, MEDUSA-INF-SCAN-2638 x2, MLSC-SERIAL-002 x2, PL002 x2, PQC005 x2, SAST-PATH-001 x2, TC004 x2, TC005 x2, TC006 x2, TC007 x2, AA-146, EXA007, FINE-050, GB-ENCODE-001, GB-ENCODE-003, MEDUSA-CGS-SCAN-029, MEDUSA-CGS-SCAN-103, MEDUSA-DP-SCAN-1034, MEDUSA-DP-SCAN-1916, MEDUSA-DP-SCAN-954, MEDUSA-EXF26-TOOL-004, MEDUSA-FT-TRIGGER-005, MEDUSA-INF-SCAN-2206, MEDUSA-INF-SCAN-2457, MEDUSA-INF-WEB-003, MEDUSA-INFRA-SCAN-030, MEDUSA-MP-SCAN-1135, MEDUSA-RLHF-POISON-002, MEDUSA-RT-SCAN-006, MM-ENCODE-001, MP-124, PQC001, PQC002, PQC006, RP001, TC009, TC010, WEB-FLASK-004.

🎯 Fix: 80 %
💥 Break: 4 %
💸 Cost: 129 %
⏱️ Time: –
🛡️ Security: 100 %
💰 Value: ?
🏆 Score: 60
🚦 Gate: ⛔ fix 80 % < 90; cost 129 % > 100: ask the operator before the commit

```
/home/kevinveenbirkenbach/Repositories/github.com/kevinveenbirkenbach/skills/.worktrees/feature/kvb-hub
```

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 18:46:40 +00:00

114 lines
4.4 KiB
Bash

#!/usr/bin/env bash
# Render the skills from skills-lock.json and copy them into TARGET.
# TARGET defaults to $HOME (global install); pass a project root to
# equip that project. Skills land in <TARGET>/.agents/skills and are
# mirrored to <TARGET>/.claude/skills.
set -euo pipefail
SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
REPO_ROOT="$(cd -- "${SCRIPT_DIR}/.." && pwd)"
TARGET="${TARGET:-${HOME}}"
log() { printf '%s\n' "$*"; }
warn() { printf '%s\n' "$*" >&2; }
if ! command -v npx &>/dev/null; then
warn "skills: npx not found — install Node.js first: https://nodejs.org"
exit 1
fi
if [[ ! -d "${TARGET}" ]]; then
warn "skills: TARGET does not exist: ${TARGET}"
exit 2
fi
cd "${REPO_ROOT}"
src="${REPO_ROOT}/.agents/skills"
rm -rf "${src}"
log "skills: restoring from skills-lock.json..."
npx --yes skills experimental_install
if [[ ! -d "${src}" ]]; then
warn "skills: ${src} not found after install."
exit 1
fi
if [[ -d "${REPO_ROOT}/skills" ]]; then
log "skills: adding first-party skills from skills/..."
cp -a "${REPO_ROOT}/skills/." "${src}/"
fi
for dst in "${TARGET}/.agents/skills" "${TARGET}/.claude/skills"; do
log "skills: copying -> ${dst}"
rm -rf "${dst}"
mkdir -p "${dst}"
cp -a "${src}/." "${dst}/"
done
settings="${TARGET}/.claude/settings.local.json"
if command -v node &>/dev/null; then
log "skills: auto-enabling caveman + ponytail plugins in ${settings}"
node "${REPO_ROOT}/scripts/enable-plugins.js" "${settings}"
else
warn "skills: node not found; skipped auto-enabling caveman/ponytail plugins."
fi
if [[ "${TARGET}" == "${HOME}" ]]; then
if command -v systemctl &>/dev/null && systemctl --user show-environment &>/dev/null; then
log "skills: enabling the daily kvb-dream notification timer"
units="${HOME}/.config/systemd/user"
mkdir -p "${units}"
cp -f "${REPO_ROOT}/skills/kvb-dream/systemd/kvb-dream-notify.service" "${REPO_ROOT}/skills/kvb-dream/systemd/kvb-dream-notify.timer" "${units}/"
systemctl --user daemon-reload
systemctl --user enable --now kvb-dream-notify.timer
else
warn "skills: no systemd user session; skipped the kvb-dream notification timer."
fi
if command -v docker &>/dev/null; then
bash "${REPO_ROOT}/scripts/hub.sh" install
bash "${REPO_ROOT}/scripts/hub.sh" runner || true
else
warn "skills: docker not found; skipped the kvb-hub review hub."
fi
log "skills: installing or updating the codebase-memory-mcp code graph for every detected agent"
if ! curl -fsSL --proto '=https' https://raw.githubusercontent.com/DeusData/codebase-memory-mcp/main/install.sh | bash; then
warn "skills: the codebase-memory-mcp installer failed; the code graph keeps its previous setup."
fi
if (ulimit -c 0; codebase-memory-mcp config set auto_index true); then
log "skills: auto-indexing every repository a session opens into the code graph"
else
warn "skills: codebase-memory-mcp is not runnable from PATH; the code graph stays off (see kvb-agent-optimize)."
fi
if command -v medusa &>/dev/null; then
log "skills: the MEDUSA security scanner is installed"
elif ! command -v pipx &>/dev/null; then
warn "skills: pipx not found; install the MEDUSA scanner with 'pip install --user medusa-security'. Until then kvb-check-security reviews by hand."
elif pipx install medusa-security; then
log "skills: installed the MEDUSA security scanner for kvb-check-security"
else
warn "skills: the MEDUSA install failed; kvb-check-security reviews by hand."
fi
lizard_pin="lizard==1.24.1"
if command -v lizard &>/dev/null; then
log "skills: lizard is installed"
elif ! command -v pipx &>/dev/null; then
warn "skills: pipx not found; install lizard with 'pipx install ${lizard_pin}'. Until then principles.py skips its complexity hits."
elif pipx install "${lizard_pin}"; then
log "skills: installed ${lizard_pin} for the principles.py complexity hits"
else
warn "skills: the lizard install failed; principles.py skips its complexity hits."
fi
jscpd_pin="jscpd@5.4.2"
if command -v jscpd &>/dev/null; then
log "skills: jscpd is installed"
elif ! command -v npm &>/dev/null; then
warn "skills: npm not found; install jscpd with 'npm install --global ${jscpd_pin}'. Until then principles.py skips its clone hits."
elif npm install --global "${jscpd_pin}"; then
log "skills: installed ${jscpd_pin} for the principles.py clone hits"
else
warn "skills: the jscpd install failed; principles.py skips its clone hits."
fi
fi
log "skills: done. Restart your agent to load the skills."