Initial commit: Hexis capability registry + execution service baseline

Go daemon (hexisd/hexisctl) implementing capability registry, guarded execution (confirmations, blessed-entity checks), systemd/workspace-mcp providers per ECOSYSTEM-SPEC.md. Snapshotting existing working state before further development.
2026-07-20 00:50:37 +04:00
commit cca63269e1
20 changed files with 2461 additions and 0 deletions
@@ -0,0 +1,230 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/kami/hexis/pkg/client"
+)
+
+var cli *client.Client
+
+func main() {
+	if len(os.Args) < 2 {
+		printUsage()
+		os.Exit(1)
+	}
+
+	baseURL := os.Getenv("HEXIS_URL")
+	if baseURL == "" {
+		baseURL = "http://localhost:9741"
+	}
+	if os.Args[1] == "--url" && len(os.Args) > 2 {
+		baseURL = os.Args[2]
+		os.Args = append(os.Args[:1], os.Args[3:]...)
+	}
+
+	cli = client.New(baseURL)
+
+	cmd := os.Args[1]
+	args := os.Args[2:]
+
+	switch cmd {
+	case "capability":
+		handleCapability(args)
+	case "exec":
+		handleExec(args)
+	case "execution":
+		handleExecution(args)
+	case "health":
+		handleHealth()
+	default:
+		fmt.Fprintf(os.Stderr, "unknown command: %s\n", cmd)
+		printUsage()
+		os.Exit(1)
+	}
+}
+
+func handleCapability(args []string) {
+	if len(args) < 1 {
+		fmt.Fprintln(os.Stderr, "usage: hexis capability <create|list|show|delete> [...]")
+		os.Exit(1)
+	}
+
+	sub := args[0]
+	rest := args[1:]
+
+	switch sub {
+	case "create":
+		capCreate(rest)
+	case "list":
+		capList(rest)
+	case "show":
+		capShow(rest)
+	case "delete":
+		capDelete(rest)
+	default:
+		fmt.Fprintf(os.Stderr, "unknown capability subcommand: %s\n", sub)
+		os.Exit(1)
+	}
+}
+
+func capCreate(args []string) {
+	flags := parseFlags(args)
+	req := client.CreateCapabilityRequest{
+		Name:                flags["name"],
+		Description:         flags["description"],
+		TargetEntityID:      flags["target"],
+		Provider:            flags["provider"],
+		Operation:           flags["operation"],
+		Risk:                flags["risk"],
+		ExpectedSideEffects: flags["side-effects"],
+	}
+	if flags["read-only"] == "true" {
+		req.ReadOnly = true
+	}
+	if typesStr := flags["types"]; typesStr != "" {
+		req.TargetTypes = strings.Split(typesStr, ",")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	cap, err := cli.CreateCapability(ctx, req)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "error: %v\n", err)
+		os.Exit(1)
+	}
+	printJSON(cap)
+}
+
+func capList(args []string) {
+	flags := parseFlags(args)
+	entityID := flags["entity"]
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	caps, err := cli.Capabilities(ctx, entityID)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "error: %v\n", err)
+		os.Exit(1)
+	}
+	printJSON(caps)
+}
+
+func capShow(args []string) {
+	if len(args) < 1 {
+		fmt.Fprintln(os.Stderr, "usage: hexis capability show <id>")
+		os.Exit(1)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	cap, err := cli.GetCapability(ctx, args[0])
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "error: %v\n", err)
+		os.Exit(1)
+	}
+	printJSON(cap)
+}
+
+func capDelete(args []string) {
+	fmt.Fprintln(os.Stderr, "capability delete not yet implemented")
+	os.Exit(1)
+}
+
+func handleExec(args []string) {
+	if len(args) < 2 {
+		fmt.Fprintln(os.Stderr, "usage: hexis exec <capability-id> <target-entity-id> [--args JSON] [--idempotency KEY]")
+		os.Exit(1)
+	}
+
+	flags := parseFlags(args[2:])
+	req := client.ExecuteRequest{
+		CapabilityID:   args[0],
+		TargetEntityID: args[1],
+		IdempotencyKey: flags["idempotency"],
+	}
+	if argsStr := flags["args"]; argsStr != "" {
+		json.Unmarshal([]byte(argsStr), &req.Arguments)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	result, err := cli.Execute(ctx, req)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "error: %v\n", err)
+		os.Exit(1)
+	}
+	printJSON(result)
+}
+
+func handleExecution(args []string) {
+	if len(args) < 1 {
+		fmt.Fprintln(os.Stderr, "usage: hexis execution <id>")
+		os.Exit(1)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	exec, err := cli.GetExecution(ctx, args[0])
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "error: %v\n", err)
+		os.Exit(1)
+	}
+	printJSON(exec)
+}
+
+func handleHealth() {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	if err := cli.Health(ctx); err != nil {
+		fmt.Fprintf(os.Stderr, "unhealthy: %v\n", err)
+		os.Exit(1)
+	}
+	fmt.Println("ok")
+}
+
+func printUsage() {
+	fmt.Fprintf(os.Stderr, `Usage: hexis [--url URL] <command> [args]
+
+Commands:
+  capability create --name NAME --provider PROVIDER --operation OP [--target ENTITY] [--types TYPES] [--risk RISK] [--read-only true] [--side-effects TEXT]
+  capability list [--entity ENTITY_ID]
+  capability show <id>
+  exec <capability-id> <target-entity-id> [--args JSON] [--idempotency KEY]
+  execution <id>
+  health
+`)
+}
+
+func parseFlags(args []string) map[string]string {
+	flags := map[string]string{}
+	for i := 0; i < len(args); i++ {
+		if strings.HasPrefix(args[i], "--") {
+			key := strings.TrimPrefix(args[i], "--")
+			if i+1 < len(args) && !strings.HasPrefix(args[i+1], "--") {
+				flags[key] = args[i+1]
+				i++
+			} else {
+				flags[key] = "true"
+			}
+		}
+	}
+	return flags
+}
+
+func printJSON(v any) {
+	enc := json.NewEncoder(os.Stdout)
+	enc.SetIndent("", "  ")
+	enc.Encode(v)
+}
@@ -0,0 +1,117 @@
+package main
+
+import (
+	"context"
+	"flag"
+	"log"
+	"os"
+	"os/signal"
+	"path/filepath"
+	"syscall"
+
+	"github.com/kami/hexis/internal/api"
+	"github.com/kami/hexis/internal/execution"
+	"github.com/kami/hexis/internal/mcp"
+	"github.com/kami/hexis/internal/provider"
+	"github.com/kami/hexis/internal/storage"
+)
+
+func main() {
+	var httpAddr string
+	var dataDir string
+	var mcpMode bool
+	var workspaceURL string
+	var workspaceAllowlist string
+
+	flag.StringVar(&httpAddr, "http", "", "HTTP listen address (default localhost:9741)")
+	flag.StringVar(&dataDir, "data", "", "Data directory for SQLite database")
+	flag.BoolVar(&mcpMode, "mcp", false, "Run in MCP stdio mode")
+	flag.StringVar(&workspaceURL, "workspace-url", "", "Workspace MCP HTTP API URL (e.g. http://localhost:9930)")
+	flag.StringVar(&workspaceAllowlist, "workspace-allowlist", "", "Path to workspace tool allowlist YAML")
+	flag.Parse()
+
+	if dataDir == "" {
+		dataDir = filepath.Join(os.Getenv("HOME"), ".local", "share", "hexis")
+	}
+	if httpAddr == "" {
+		httpAddr = "localhost:9741"
+	}
+	if workspaceAllowlist == "" {
+		workspaceAllowlist = filepath.Join(dataDir, "workspace-allowlist.yaml")
+	}
+	if workspaceURL == "" {
+		workspaceURL = os.Getenv("WORKSPACE_MCP_URL")
+	}
+
+	dbPath := filepath.Join(dataDir, "hexis.db")
+
+	store, err := storage.Open(dbPath)
+	if err != nil {
+		log.Fatalf("open storage: %v", err)
+	}
+	defer store.Close()
+
+	reg := provider.NewRegistry()
+	reg.Register(provider.NewSystemdProvider())
+
+	// Register workspace MCP provider if configured
+	if workspaceURL != "" {
+		allowlist, err := provider.LoadToolAllowlist(workspaceAllowlist)
+		if err != nil {
+			log.Fatalf("load workspace allowlist: %v", err)
+		}
+		wsProvider := provider.NewWorkspaceMCPProvider(workspaceURL, allowlist)
+		reg.Register(wsProvider)
+
+		tools, err := wsProvider.DiscoverTools()
+		if err != nil {
+			log.Printf("warning: workspace MCP discovery failed: %v", err)
+		} else {
+			log.Printf("discovered %d workspace tools, %d in allowlist", len(tools), len(allowlist.Tools))
+		}
+
+		// Register workspace capabilities
+		for _, cap := range wsProvider.BuildCapabilities() {
+			existing, err := store.GetCapability(cap.ID)
+			if err == nil && existing != nil {
+				continue
+			}
+			if err := store.CreateCapability(&cap); err != nil {
+				log.Printf("warning: register capability %s: %v", cap.Name, err)
+			} else {
+				log.Printf("registered capability: %s -> %s", cap.Name, cap.Operation)
+			}
+		}
+	}
+
+	engine := execution.New(store, reg)
+
+	if mcpMode {
+		log.Printf("starting MCP stdio adapter")
+		adapter := mcp.New(store, engine)
+		if err := adapter.ServeStdio(); err != nil {
+			log.Fatalf("MCP error: %v", err)
+		}
+		return
+	}
+
+	srv := api.NewServer(store, engine)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	go func() {
+		log.Printf("listening on http %s", httpAddr)
+		if err := srv.ListenHTTP(httpAddr); err != nil {
+			log.Printf("http error: %v", err)
+		}
+	}()
+
+	sig := make(chan os.Signal, 1)
+	signal.Notify(sig, syscall.SIGINT, syscall.SIGTERM)
+	<-sig
+
+	log.Println("shutting down...")
+	srv.Shutdown(ctx)
+	log.Println("stopped")
+}