Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/build-images.yml
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ jobs:
fi

# Resolve variants
ALLOWED="kiro,claude,codex,copilot,cursor,devin,gemini,grok,hermes,kimi,mimocode,opencode,antigravity,pi,native,agentcore"
ALLOWED="kiro,claude,codex,copilot,cursor,devin,gemini,grok,kimi,mimocode,opencode,antigravity,pi,native,agentcore"
if [ "$VARIANTS_INPUT" = "all" ] || [ -z "$VARIANTS_INPUT" ]; then
VARIANTS="$ALLOWED"
else
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/build-operator.yml
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}
# All agent variants built from Dockerfile.unified targets.
AGENTS: "kiro,claude,codex,copilot,cursor,devin,gemini,grok,hermes,kimi,mimocode,opencode,antigravity,pi,native,agentcore"
AGENTS: "kiro,claude,codex,copilot,cursor,devin,gemini,grok,kimi,mimocode,opencode,antigravity,pi,native,agentcore"

jobs:
resolve-tag:
Expand Down
1 change: 0 additions & 1 deletion .github/workflows/docker-smoke-test-unified.yml
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,6 @@ jobs:
- { name: devin, agent: "devin" }
- { name: gemini, agent: "gemini" }
- { name: grok, agent: "grok" }
- { name: hermes, agent: "hermes-acp" }
- { name: kimi, agent: "kimi" }
- { name: mimocode, agent: "mimo" }
- { name: opencode, agent: "opencode" }
Expand Down
4 changes: 0 additions & 4 deletions .github/workflows/docker-smoke-test.yml
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,6 @@ jobs:
- { dockerfile: Dockerfile.cursor, suffix: "-cursor", agent: "cursor-agent", agent_args: "acp", build_args: "" }
- { dockerfile: Dockerfile.kimi, suffix: "-kimi", agent: "kimi", agent_args: "acp", build_args: "" }
- { dockerfile: Dockerfile.mimocode, suffix: "-mimocode", agent: "mimo", agent_args: "acp", build_args: "" }
- { dockerfile: Dockerfile.hermes, suffix: "-hermes", agent: "hermes-acp", agent_args: "", build_args: "" }
- { dockerfile: Dockerfile.grok, suffix: "-grok", agent: "grok", agent_args: "agent stdio", build_args: "" }
- { dockerfile: Dockerfile.devin, suffix: "-devin", agent: "devin", agent_args: "acp", build_args: "" }
- { dockerfile: Dockerfile.antigravity, suffix: "-antigravity", agent: "agy-acp", agent_args: "", build_args: "" }
Expand Down Expand Up @@ -179,9 +178,6 @@ jobs:
assert_line 'ARG DEVIN_VERSION=3000.2.17' Dockerfile.devin Dockerfile.package Dockerfile.unified
assert_line 'ARG DEVIN_SHA256_AMD64=f0e1e9363afc6ee68c4ef87bab4aeb7ff5cc08a5fa838350ef3ceefdbb2a2be2' Dockerfile.devin Dockerfile.package Dockerfile.unified
assert_line 'ARG DEVIN_SHA256_ARM64=116dc71ef085a922bc3ff0ea0377d4b26c529a431d58246e36572913e2d25624' Dockerfile.devin Dockerfile.package Dockerfile.unified
assert_occurrences 1 '--retry 6 --retry-all-errors --retry-delay 10 --retry-max-time 120' Dockerfile.hermes
assert_occurrences 1 '--retry 6 --retry-all-errors --retry-delay 10 --retry-max-time 120' Dockerfile.package
assert_occurrences 1 '--retry 6 --retry-all-errors --retry-delay 10 --retry-max-time 120' Dockerfile.unified
assert_line 'ENV AGY_VERSION=1.1.13' Dockerfile.antigravity Dockerfile.unified Dockerfile.final Dockerfile.ci
assert_line 'ARG AGY_VERSION=1.1.13' Dockerfile.package
assert_line 'ENV AGY_VERSION="${AGY_VERSION}"' Dockerfile.package
Expand Down
32 changes: 2 additions & 30 deletions .github/workflows/nightly-build.yml
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ env:
# OPENAB_AGENT_COMMAND=openab-agent but does not ship that binary (a
# pre-existing bug across all lanes — see follow-up issue), so a nightly-pi
# tag would publish a runtime-broken image. Re-add once the pi target is fixed.
ALL_VARIANTS: 'kiro,claude,codex,copilot,cursor,devin,gemini,grok,hermes,kimi,mimocode,opencode,antigravity'
ALL_VARIANTS: 'kiro,claude,codex,copilot,cursor,devin,gemini,grok,kimi,mimocode,opencode,antigravity'

jobs:
# ---------------------------------------------------------------------------
Expand Down Expand Up @@ -182,7 +182,7 @@ jobs:
steps:
- name: Resolve the vendor's latest CLI version
env:
# Used for the cross-repo GitHub API requests (hermes, antigravity).
# Used for the cross-repo GitHub API requests (antigravity).
# An authenticated fetch avoids the shared-runner 429s seen on
# api/raw.githubusercontent.com, while the resolved commit/tag keeps
# the installer immutable.
Expand Down Expand Up @@ -319,34 +319,6 @@ jobs:
AGY_SHA256_AMD64=
AGY_SHA256_ARM64=
ALLOW_UNVERIFIED_NIGHTLY_DOWNLOADS=true" ;;
hermes)
# Resolve the release, dereference an annotated tag to its immutable
# commit, then pin both the install commit and the installer SHA so
# the Dockerfile's SHA check stays enabled.
RELEASE=$(github_api https://api.github.com/repos/NousResearch/hermes-agent/releases/latest)
TAG=$(echo "$RELEASE" | jq -r .tag_name)
REF=$(github_api "https://api.github.com/repos/NousResearch/hermes-agent/git/ref/tags/${TAG}")
REF_TYPE=$(echo "$REF" | jq -r .object.type)
COMMIT=$(echo "$REF" | jq -r .object.sha)
for _ in 1 2 3; do
[ "$REF_TYPE" = "tag" ] || break
REF=$(github_api "https://api.github.com/repos/NousResearch/hermes-agent/git/tags/${COMMIT}")
REF_TYPE=$(echo "$REF" | jq -r .object.type)
COMMIT=$(echo "$REF" | jq -r .object.sha)
done
[ "$REF_TYPE" = "commit" ] || { echo "::error::hermes $TAG did not resolve to a commit"; exit 1; }
echo "$COMMIT" | grep -qE '^[0-9a-f]{40}$' || { echo "::error::invalid hermes commit: $COMMIT"; exit 1; }
# Hash the installer via the authenticated Contents API (raw+json)
# for the resolved commit — same reason as the release fetch above:
# dodges the shared-runner 429s on raw.githubusercontent.com. The
# Dockerfile still fetches+verifies against this SHA at build time.
INSTALL_SHA=$(github_api -H 'Accept: application/vnd.github.raw+json' \
"https://api.github.com/repos/NousResearch/hermes-agent/contents/scripts/install.sh?ref=${COMMIT}" \
| sha256sum | cut -d' ' -f1)
echo "$INSTALL_SHA" | grep -qE '^[0-9a-f]{64}$' || { echo "::error::could not hash hermes installer"; exit 1; }
REPORT="hermes $TAG @ $COMMIT"
BUILD_ARGS="HERMES_INSTALL_COMMIT=$COMMIT
HERMES_INSTALL_SHA256=$INSTALL_SHA" ;;
*)
echo "::error::no resolver for variant $VARIANT"; exit 1 ;;
esac
Expand Down
1 change: 0 additions & 1 deletion .github/workflows/pr-preview.yml
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,6 @@ on:
- devin
- gemini
- grok
- hermes
- kimi
- mimocode
- native
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/pre-beta-build.yml
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ on:
env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}
ALL_AGENTS: 'kiro,claude,codex,copilot,cursor,devin,gemini,grok,hermes,kimi,mimocode,opencode,antigravity,pi,native,agentcore'
ALL_AGENTS: 'kiro,claude,codex,copilot,cursor,devin,gemini,grok,kimi,mimocode,opencode,antigravity,pi,native,agentcore'

jobs:
gate:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/snapshot-build.yml
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ on:
env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}
ALL_VARIANTS: 'default,agentcore,antigravity,claude,codex,copilot,cursor,devin,gemini,grok,hermes,kimi,mimocode,native,opencode,pi'
ALL_VARIANTS: 'default,agentcore,antigravity,claude,codex,copilot,cursor,devin,gemini,grok,kimi,mimocode,native,opencode,pi'

jobs:
matrix:
Expand Down
69 changes: 0 additions & 69 deletions Dockerfile.hermes

This file was deleted.

38 changes: 0 additions & 38 deletions Dockerfile.package
Original file line number Diff line number Diff line change
Expand Up @@ -256,44 +256,6 @@ ENV OPENAB_AGENT_AUTH_COMMAND="grok login --device-auth"
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

# =============================================================================
# Target: hermes
# =============================================================================
FROM python:3.12-slim-trixie AS hermes
RUN useradd -m -u 1000 agent
RUN apt-get update && apt-get install -y --no-install-recommends \
ca-certificates curl procps ripgrep tini git ffmpeg unzip xz-utils \
&& rm -rf /var/lib/apt/lists/*
ARG HERMES_INSTALL_COMMIT=2bd1977d8fad185c9b4be47884f7e87f1add0ce3
ARG HERMES_INSTALL_SHA256=dbd9d555ed4ac67bd1fc71ba6a39b410cf2af0ebcfd8f4889e086af78c9ddcaa
# Shared CI runners can be throttled by raw.githubusercontent.com; retry
# transient failures while the pinned SHA256 still verifies the response body.
RUN curl -fsSL --retry 6 --retry-all-errors --retry-delay 10 --retry-max-time 120 \
"https://raw.githubusercontent.com/NousResearch/hermes-agent/${HERMES_INSTALL_COMMIT}/scripts/install.sh" \
-o /tmp/install-hermes.sh && \
echo "${HERMES_INSTALL_SHA256} /tmp/install-hermes.sh" | sha256sum -c - && \
HERMES_HOME=/home/agent/.hermes bash /tmp/install-hermes.sh && \
rm /tmp/install-hermes.sh && \
(test -d /root/.local/share/uv && chmod -R a+rX /root/.local/share/uv && chmod a+rx /root /root/.local /root/.local/share || true) && \
ln -sf /usr/local/lib/hermes-agent/venv/bin/hermes-acp /usr/local/bin/hermes-acp
RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
-o /usr/share/keyrings/githubcli-archive-keyring.gpg && \
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
> /etc/apt/sources.list.d/github-cli.list && \
apt-get update && apt-get install -y --no-install-recommends gh && \
rm -rf /var/lib/apt/lists/*
ENV HOME=/home/agent
WORKDIR /home/agent
COPY --from=bins --chown=agent:agent /openab /usr/local/bin/openab
RUN chown -R agent:agent /home/agent
USER agent
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="hermes-acp"
ENV OPENAB_AGENT_AUTH_COMMAND="hermes auth add"
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

# =============================================================================
# Target: mimocode
# =============================================================================
Expand Down
38 changes: 0 additions & 38 deletions Dockerfile.unified
Original file line number Diff line number Diff line change
Expand Up @@ -122,7 +122,7 @@
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="kiro-cli acp --trust-all-tools"
ENV OPENAB_AGENT_AUTH_COMMAND="kiro-cli login --use-device-flow"

Check warning on line 125 in Dockerfile.unified

View workflow job for this annotation

GitHub Actions / smoke-test-unified (kiro, kiro-cli)

Sensitive data should not be used in the ARG or ENV commands

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "OPENAB_AGENT_AUTH_COMMAND") More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

Expand All @@ -142,7 +142,7 @@
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="claude-agent-acp"
ENV OPENAB_AGENT_AUTH_COMMAND="claude auth login"

Check warning on line 145 in Dockerfile.unified

View workflow job for this annotation

GitHub Actions / smoke-test-unified (claude, claude-agent-acp)

Sensitive data should not be used in the ARG or ENV commands

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "OPENAB_AGENT_AUTH_COMMAND") More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

Expand All @@ -161,7 +161,7 @@
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="codex-acp"
ENV OPENAB_AGENT_AUTH_COMMAND="codex login --device-auth"

Check warning on line 164 in Dockerfile.unified

View workflow job for this annotation

GitHub Actions / smoke-test-unified (codex, codex-acp)

Sensitive data should not be used in the ARG or ENV commands

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "OPENAB_AGENT_AUTH_COMMAND") More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

Expand All @@ -188,7 +188,7 @@
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="kimi acp"
ENV OPENAB_AGENT_AUTH_COMMAND="kimi"

Check warning on line 191 in Dockerfile.unified

View workflow job for this annotation

GitHub Actions / smoke-test-unified (kimi, kimi)

Sensitive data should not be used in the ARG or ENV commands

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "OPENAB_AGENT_AUTH_COMMAND") More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

Expand All @@ -206,7 +206,7 @@
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="copilot --acp --stdio"
ENV OPENAB_AGENT_AUTH_COMMAND="copilot login"

Check warning on line 209 in Dockerfile.unified

View workflow job for this annotation

GitHub Actions / smoke-test-unified (copilot, copilot)

Sensitive data should not be used in the ARG or ENV commands

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "OPENAB_AGENT_AUTH_COMMAND") More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

Expand All @@ -231,7 +231,7 @@
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="cursor-agent acp"
ENV OPENAB_AGENT_AUTH_COMMAND="cursor-agent login"

Check warning on line 234 in Dockerfile.unified

View workflow job for this annotation

GitHub Actions / smoke-test-unified (cursor, cursor-agent)

Sensitive data should not be used in the ARG or ENV commands

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "OPENAB_AGENT_AUTH_COMMAND") More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

Expand All @@ -249,7 +249,7 @@
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="gemini --acp"
ENV OPENAB_AGENT_AUTH_COMMAND="gemini auth"

Check warning on line 252 in Dockerfile.unified

View workflow job for this annotation

GitHub Actions / smoke-test-unified (gemini, gemini)

Sensitive data should not be used in the ARG or ENV commands

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "OPENAB_AGENT_AUTH_COMMAND") More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

Expand Down Expand Up @@ -280,48 +280,10 @@
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="grok agent stdio"
ENV OPENAB_AGENT_AUTH_COMMAND="grok login --device-auth"

Check warning on line 283 in Dockerfile.unified

View workflow job for this annotation

GitHub Actions / smoke-test-unified (grok, grok)

Sensitive data should not be used in the ARG or ENV commands

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "OPENAB_AGENT_AUTH_COMMAND") More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

# =============================================================================
# Target: hermes
# =============================================================================
FROM python:3.12-slim-trixie AS hermes
RUN useradd -m -u 1000 agent
RUN apt-get update && apt-get install -y --no-install-recommends \
ca-certificates curl procps ripgrep tini git ffmpeg unzip xz-utils \
&& rm -rf /var/lib/apt/lists/*
ARG HERMES_INSTALL_COMMIT=2bd1977d8fad185c9b4be47884f7e87f1add0ce3
ARG HERMES_INSTALL_SHA256=dbd9d555ed4ac67bd1fc71ba6a39b410cf2af0ebcfd8f4889e086af78c9ddcaa
# Shared CI runners can be throttled by raw.githubusercontent.com; retry
# transient failures while the pinned SHA256 still verifies the response body.
RUN curl -fsSL --retry 6 --retry-all-errors --retry-delay 10 --retry-max-time 120 \
"https://raw.githubusercontent.com/NousResearch/hermes-agent/${HERMES_INSTALL_COMMIT}/scripts/install.sh" \
-o /tmp/install-hermes.sh && \
echo "${HERMES_INSTALL_SHA256} /tmp/install-hermes.sh" | sha256sum -c - && \
HERMES_HOME=/home/agent/.hermes bash /tmp/install-hermes.sh && \
rm /tmp/install-hermes.sh && \
(test -d /root/.local/share/uv && chmod -R a+rX /root/.local/share/uv && chmod a+rx /root /root/.local /root/.local/share || true) && \
ln -sf /usr/local/lib/hermes-agent/venv/bin/hermes-acp /usr/local/bin/hermes-acp
RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
-o /usr/share/keyrings/githubcli-archive-keyring.gpg && \
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
> /etc/apt/sources.list.d/github-cli.list && \
apt-get update && apt-get install -y --no-install-recommends gh && \
rm -rf /var/lib/apt/lists/*
ENV HOME=/home/agent
WORKDIR /home/agent
COPY --from=builder --chown=agent:agent /build/target/release/openab /usr/local/bin/openab
RUN chown -R agent:agent /home/agent
USER agent
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="hermes-acp"
ENV OPENAB_AGENT_AUTH_COMMAND="hermes auth add"
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

# =============================================================================
# Target: mimocode
# =============================================================================
Expand All @@ -336,7 +298,7 @@
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="mimo acp"
ENV OPENAB_AGENT_AUTH_COMMAND="mimo auth login --provider mimo --method \"MiMo Auto (free)\""

Check warning on line 301 in Dockerfile.unified

View workflow job for this annotation

GitHub Actions / smoke-test-unified (mimocode, mimo)

Sensitive data should not be used in the ARG or ENV commands

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "OPENAB_AGENT_AUTH_COMMAND") More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

Expand All @@ -354,7 +316,7 @@
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="opencode acp"
ENV OPENAB_AGENT_AUTH_COMMAND="opencode auth login"

Check warning on line 319 in Dockerfile.unified

View workflow job for this annotation

GitHub Actions / smoke-test-unified (opencode, opencode)

Sensitive data should not be used in the ARG or ENV commands

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "OPENAB_AGENT_AUTH_COMMAND") More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

Expand Down Expand Up @@ -386,7 +348,7 @@
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="devin acp"
ENV OPENAB_AGENT_AUTH_COMMAND="devin auth login --force-manual-token-flow"

Check warning on line 351 in Dockerfile.unified

View workflow job for this annotation

GitHub Actions / smoke-test-unified (devin, devin)

Sensitive data should not be used in the ARG or ENV commands

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "OPENAB_AGENT_AUTH_COMMAND") More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

Expand Down Expand Up @@ -419,7 +381,7 @@
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="agy-acp"
ENV OPENAB_AGENT_AUTH_COMMAND="agy auth"

Check warning on line 384 in Dockerfile.unified

View workflow job for this annotation

GitHub Actions / smoke-test-unified (antigravity, agy-acp)

Sensitive data should not be used in the ARG or ENV commands

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "OPENAB_AGENT_AUTH_COMMAND") More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

Expand All @@ -438,7 +400,7 @@
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="openab-agent"
ENV OPENAB_AGENT_AUTH_COMMAND="pi /login"

Check warning on line 403 in Dockerfile.unified

View workflow job for this annotation

GitHub Actions / smoke-test-unified (pi, pi-acp)

Sensitive data should not be used in the ARG or ENV commands

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "OPENAB_AGENT_AUTH_COMMAND") More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

Expand All @@ -455,7 +417,7 @@
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="openab-agent"
ENV OPENAB_AGENT_AUTH_COMMAND="openab-agent auth codex-oauth --no-browser"

Check warning on line 420 in Dockerfile.unified

View workflow job for this annotation

GitHub Actions / smoke-test-unified (native, openab-agent)

Sensitive data should not be used in the ARG or ENV commands

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "OPENAB_AGENT_AUTH_COMMAND") More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

Expand Down
7 changes: 3 additions & 4 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ English | [繁體中文](README.zh-TW.md)

![OpenAB banner](images/banner.jpg)

A lightweight, secure, cloud-native ACP harness that bridges **Discord, Slack**, and any [Agent Client Protocol](https://github.com/anthropics/agent-protocol)-compatible coding CLI (Kiro CLI, Claude Code, Codex, Gemini, OpenCode, MiMo-Code, Kimi Code, Copilot CLI, Hermes, Grok Build, Devin, Antigravity, Pi, etc.) over stdio JSON-RPC — delivering the next-generation development experience. **Telegram, LINE, Feishu/Lark, Google Chat, WeCom, and Microsoft Teams** are available through gateway adapters, either compiled into the unified binary or deployed as the standalone [Custom Gateway](crates/openab-gateway/).
A lightweight, secure, cloud-native ACP harness that bridges **Discord, Slack**, and any [Agent Client Protocol](https://github.com/anthropics/agent-protocol)-compatible coding CLI (Kiro CLI, Claude Code, Codex, Gemini, OpenCode, MiMo-Code, Kimi Code, Copilot CLI, Grok Build, Devin, Antigravity, Pi, etc.) over stdio JSON-RPC — delivering the next-generation development experience. **Telegram, LINE, Feishu/Lark, Google Chat, WeCom, and Microsoft Teams** are available through gateway adapters, either compiled into the unified binary or deployed as the standalone [Custom Gateway](crates/openab-gateway/).

🪼 **Join our community!** Come say hi on Discord — we'd love to have you: **[🪼 OpenAB — Official](https://openab.dev/discord)** 🎉

Expand All @@ -22,7 +22,7 @@ A lightweight, secure, cloud-native ACP harness that bridges **Discord, Slack**,
│ User │ │ │ WebSocket │ gemini --acp │
├──────────────┤ │ │ (standalone) │ copilot --acp │
│ LINE │◄webhook/API─►┤ │ or in-process │ cursor-agent acp │
│ User │ │ │ (unified) │ hermes-acp │
│ User │ │ │ (unified) │ │
├──────────────┤ │ ┌──────┴───────────┐ │ opencode acp │
│ Feishu/Lark │◄─WS/webhook─►┼►│ gateway adapters │ │ mimo acp │
│ User │ │ │ standalone or │ │ kimi acp │
Expand Down Expand Up @@ -54,7 +54,7 @@ webhook platforms and `WS/webhook` for Feishu/Lark.

- **Multi-platform** — supports Discord and Slack, run one or both simultaneously
- **Gateway adapters** — extend to Telegram, LINE, Feishu/Lark, Google Chat, WeCom, and Microsoft Teams through the standalone [gateway](crates/openab-gateway/) or an opt-in unified build
- **Pluggable agent backend** — swap between Kiro CLI, Claude Code, Codex, Gemini, OpenCode, MiMo-Code, Kimi Code, Copilot CLI, Hermes, Grok Build, Devin, Antigravity, Pi via config
- **Pluggable agent backend** — swap between Kiro CLI, Claude Code, Codex, Gemini, OpenCode, MiMo-Code, Kimi Code, Copilot CLI, Grok Build, Devin, Antigravity, Pi via config
- **@mention trigger** — mention the bot in an allowed channel to start a conversation
- **Thread-based multi-turn** — auto-creates threads; no @mention needed for follow-ups
- **Multi-agent collaboration** — bot-to-bot messaging for coordinated workflows ([docs/multi-agent.md](docs/multi-agent.md))
Expand Down Expand Up @@ -189,7 +189,6 @@ The bot creates a thread. After that, just type in the thread — no @mention ne
| Kimi Code | `kimi acp` | Native | [docs/kimi.md](docs/kimi.md) |
| Copilot CLI ⚠️ | `copilot --acp --stdio` | Native | [docs/copilot.md](docs/copilot.md) |
| Cursor | `cursor-agent acp` | Native | [docs/cursor.md](docs/cursor.md) |
| Hermes Agent | `hermes-acp` | Native | [docs/hermes.md](docs/hermes.md) |
| Grok Build | `grok agent stdio` | Native | [docs/grok.md](docs/grok.md) |
| Devin | `devin acp` | Native | [docs/devin.md](docs/devin.md) |
| Antigravity | `agy-acp` | [agy-acp](agy-acp/) | [docs/antigravity.md](docs/antigravity.md) |
Expand Down
Loading
Loading