The kvb-hub is a local review hub in a container bound to 127.0.0.1: one page, JSON APIs and an MCP endpoint for the operator's inbox, asks, decisions, staged-commit reviews, the radio stream, the agent graph, the worktree tree, push-to-talk and read-aloud radio (Piper, whisper.cpp) and an optional LLM command line. The hub is only a relay. The host executors in hub/client (the runner user service, the PermissionRequest hook and the approval CLI the commit skills call) verify a WebAuthn passkey signature against keys pinned outside every sandbox, refuse replays and fail closed. scripts/hub.sh with make hub-install, hub-check, hub-pin, hub-runner and hub-hook installs and checks the hub; hub-hook writes ~/.claude/settings.json after a backup. make watch-check shows a stuck watch hook. The new kvb-git-diff skill and the commit skills route reviews through the hub; the test_hub_* suites replace test_hub.py. Security review (kvb-think-criticize, three skeptics) fixed four holes: signed rules auto-approved chained shell commands; the client and LLM openers followed redirects, the LLM one with its bearer key; the worktree scan ran git fsmonitor and filter commands from agent-writable repos; compose set no memory, pids or health limits. Documented until core requirement 093, on the operator's word: the hub page is trusted while signing and pinning, local processes can forge the unsigned operator actions, and the container reads the host /tmp. Committed on the operator's word despite the gate: the passkey path is not yet verified live. Accepted MEDUSA false positives (137 findings on 115 lines, rows in security-accepted.jsonl): EXA002 x17, MEDUSA-MM-SCAN-058 x12, B603 x8, MEDUSA-FTSC-SCAN-089 x7, MEDUSA-PRIV-SCAN-762 x6, AIC-EXFIL-005 x5, EXA006 x5, MEDUSA-FTSCAN-231 x5, WEB-SSRF x5, MEDUSA-INF-SCAN-2057 x3, RH005 x3, TC001 x3, LO002 x2, MEDUSA-AEXP-SCAN-096 x2, MEDUSA-CGS-SCAN-028 x2, MEDUSA-INF-SCAN-1350 x2, MEDUSA-INF-SCAN-2369 x2, MEDUSA-INF-SCAN-2440 x2, MEDUSA-INF-SCAN-2638 x2, MLSC-SERIAL-002 x2, PL002 x2, PQC005 x2, SAST-PATH-001 x2, TC004 x2, TC005 x2, TC006 x2, TC007 x2, AA-146, EXA007, FINE-050, GB-ENCODE-001, GB-ENCODE-003, MEDUSA-CGS-SCAN-029, MEDUSA-CGS-SCAN-103, MEDUSA-DP-SCAN-1034, MEDUSA-DP-SCAN-1916, MEDUSA-DP-SCAN-954, MEDUSA-EXF26-TOOL-004, MEDUSA-FT-TRIGGER-005, MEDUSA-INF-SCAN-2206, MEDUSA-INF-SCAN-2457, MEDUSA-INF-WEB-003, MEDUSA-INFRA-SCAN-030, MEDUSA-MP-SCAN-1135, MEDUSA-RLHF-POISON-002, MEDUSA-RT-SCAN-006, MM-ENCODE-001, MP-124, PQC001, PQC002, PQC006, RP001, TC009, TC010, WEB-FLASK-004. 🎯 Fix: 80 % 💥 Break: 4 % 💸 Cost: 129 % ⏱️ Time: – 🛡️ Security: 100 % 💰 Value: ? 🏆 Score: 60 🚦 Gate: ⛔ fix 80 % < 90; cost 129 % > 100: ask the operator before the commit ``` /home/kevinveenbirkenbach/Repositories/github.com/kevinveenbirkenbach/skills/.worktrees/feature/kvb-hub ``` Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
114 lines
4.4 KiB
Bash
114 lines
4.4 KiB
Bash
#!/usr/bin/env bash
|
|
# Render the skills from skills-lock.json and copy them into TARGET.
|
|
# TARGET defaults to $HOME (global install); pass a project root to
|
|
# equip that project. Skills land in <TARGET>/.agents/skills and are
|
|
# mirrored to <TARGET>/.claude/skills.
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
|
|
REPO_ROOT="$(cd -- "${SCRIPT_DIR}/.." && pwd)"
|
|
TARGET="${TARGET:-${HOME}}"
|
|
|
|
log() { printf '%s\n' "$*"; }
|
|
warn() { printf '%s\n' "$*" >&2; }
|
|
|
|
if ! command -v npx &>/dev/null; then
|
|
warn "skills: npx not found — install Node.js first: https://nodejs.org"
|
|
exit 1
|
|
fi
|
|
|
|
if [[ ! -d "${TARGET}" ]]; then
|
|
warn "skills: TARGET does not exist: ${TARGET}"
|
|
exit 2
|
|
fi
|
|
|
|
cd "${REPO_ROOT}"
|
|
src="${REPO_ROOT}/.agents/skills"
|
|
rm -rf "${src}"
|
|
log "skills: restoring from skills-lock.json..."
|
|
npx --yes skills experimental_install
|
|
|
|
if [[ ! -d "${src}" ]]; then
|
|
warn "skills: ${src} not found after install."
|
|
exit 1
|
|
fi
|
|
|
|
if [[ -d "${REPO_ROOT}/skills" ]]; then
|
|
log "skills: adding first-party skills from skills/..."
|
|
cp -a "${REPO_ROOT}/skills/." "${src}/"
|
|
fi
|
|
|
|
for dst in "${TARGET}/.agents/skills" "${TARGET}/.claude/skills"; do
|
|
log "skills: copying -> ${dst}"
|
|
rm -rf "${dst}"
|
|
mkdir -p "${dst}"
|
|
cp -a "${src}/." "${dst}/"
|
|
done
|
|
|
|
settings="${TARGET}/.claude/settings.local.json"
|
|
if command -v node &>/dev/null; then
|
|
log "skills: auto-enabling caveman + ponytail plugins in ${settings}"
|
|
node "${REPO_ROOT}/scripts/enable-plugins.js" "${settings}"
|
|
else
|
|
warn "skills: node not found; skipped auto-enabling caveman/ponytail plugins."
|
|
fi
|
|
|
|
if [[ "${TARGET}" == "${HOME}" ]]; then
|
|
if command -v systemctl &>/dev/null && systemctl --user show-environment &>/dev/null; then
|
|
log "skills: enabling the daily kvb-dream notification timer"
|
|
units="${HOME}/.config/systemd/user"
|
|
mkdir -p "${units}"
|
|
cp -f "${REPO_ROOT}/skills/kvb-dream/systemd/kvb-dream-notify.service" "${REPO_ROOT}/skills/kvb-dream/systemd/kvb-dream-notify.timer" "${units}/"
|
|
systemctl --user daemon-reload
|
|
systemctl --user enable --now kvb-dream-notify.timer
|
|
else
|
|
warn "skills: no systemd user session; skipped the kvb-dream notification timer."
|
|
fi
|
|
if command -v docker &>/dev/null; then
|
|
bash "${REPO_ROOT}/scripts/hub.sh" install
|
|
bash "${REPO_ROOT}/scripts/hub.sh" runner || true
|
|
else
|
|
warn "skills: docker not found; skipped the kvb-hub review hub."
|
|
fi
|
|
log "skills: installing or updating the codebase-memory-mcp code graph for every detected agent"
|
|
if ! curl -fsSL --proto '=https' https://raw.githubusercontent.com/DeusData/codebase-memory-mcp/main/install.sh | bash; then
|
|
warn "skills: the codebase-memory-mcp installer failed; the code graph keeps its previous setup."
|
|
fi
|
|
if (ulimit -c 0; codebase-memory-mcp config set auto_index true); then
|
|
log "skills: auto-indexing every repository a session opens into the code graph"
|
|
else
|
|
warn "skills: codebase-memory-mcp is not runnable from PATH; the code graph stays off (see kvb-agent-optimize)."
|
|
fi
|
|
if command -v medusa &>/dev/null; then
|
|
log "skills: the MEDUSA security scanner is installed"
|
|
elif ! command -v pipx &>/dev/null; then
|
|
warn "skills: pipx not found; install the MEDUSA scanner with 'pip install --user medusa-security'. Until then kvb-check-security reviews by hand."
|
|
elif pipx install medusa-security; then
|
|
log "skills: installed the MEDUSA security scanner for kvb-check-security"
|
|
else
|
|
warn "skills: the MEDUSA install failed; kvb-check-security reviews by hand."
|
|
fi
|
|
lizard_pin="lizard==1.24.1"
|
|
if command -v lizard &>/dev/null; then
|
|
log "skills: lizard is installed"
|
|
elif ! command -v pipx &>/dev/null; then
|
|
warn "skills: pipx not found; install lizard with 'pipx install ${lizard_pin}'. Until then principles.py skips its complexity hits."
|
|
elif pipx install "${lizard_pin}"; then
|
|
log "skills: installed ${lizard_pin} for the principles.py complexity hits"
|
|
else
|
|
warn "skills: the lizard install failed; principles.py skips its complexity hits."
|
|
fi
|
|
jscpd_pin="jscpd@5.4.2"
|
|
if command -v jscpd &>/dev/null; then
|
|
log "skills: jscpd is installed"
|
|
elif ! command -v npm &>/dev/null; then
|
|
warn "skills: npm not found; install jscpd with 'npm install --global ${jscpd_pin}'. Until then principles.py skips its clone hits."
|
|
elif npm install --global "${jscpd_pin}"; then
|
|
log "skills: installed ${jscpd_pin} for the principles.py clone hits"
|
|
else
|
|
warn "skills: the jscpd install failed; principles.py skips its clone hits."
|
|
fi
|
|
fi
|
|
|
|
log "skills: done. Restart your agent to load the skills."
|