This repository has no description
2.0 kB
58 lines
1# crit (https://crit.md): agents run `crit` to open their diff/plan for review
2# in the browser and block until it is finished. Each review session is its
3# own daemon on its own port, reachable over retiolum as
4# http://<host>.r:<port>.
5#
6# SECURITY: crit has no authentication, and comments left in a review are fed
7# to the agent as instructions. Whoever can reach a daemon can steer an agent
8# running here, so the ports are only open on retiolum.
9{
10 self,
11 config,
12 pkgs,
13 ...
14}:
15let
16 firstPort = 7700;
17 lastPort = 7719;
18 crit-unwrapped = self.inputs.llm-agents.packages.${pkgs.system}.crit;
19
20 # crit binds 127.0.0.1 on a random port by default. Bind all interfaces on a
21 # free port from the firewalled range instead and advertise the retiolum URL.
22 # Only the invocation that starts a daemon binds the port; reconnecting to a
23 # running session uses the port and URL recorded in ~/.crit/sessions.
24 crit = pkgs.symlinkJoin {
25 name = "crit";
26 paths = [
27 (pkgs.writeShellScriptBin "crit" ''
28 if [ -z "''${CRIT_PORT:-}" ]; then
29 for p in $(${pkgs.coreutils}/bin/seq ${toString firstPort} ${toString lastPort}); do
30 if [ -z "$(${pkgs.iproute2}/bin/ss -Htln "sport = :$p")" ]; then
31 export CRIT_PORT=$p
32 break
33 fi
34 done
35 fi
36 if [ -n "''${CRIT_PORT:-}" ]; then
37 export CRIT_PUBLIC_URL="''${CRIT_PUBLIC_URL:-http://${config.networking.hostName}.r:$CRIT_PORT}"
38 else
39 echo "crit: ports ${toString firstPort}-${toString lastPort} all busy, using a random port (not reachable over retiolum)" >&2
40 fi
41 export CRIT_HOST="''${CRIT_HOST:-0.0.0.0}"
42 export CRIT_ALLOW_UNAUTHENTICATED_NETWORK=1
43 exec ${crit-unwrapped}/bin/crit "$@"
44 '')
45 crit-unwrapped
46 ];
47 };
48in
49{
50 environment.systemPackages = [ crit ];
51
52 networking.firewall.interfaces.retiolum.allowedTCPPortRanges = [
53 {
54 from = firstPort;
55 to = lastPort;
56 }
57 ];
58}