85616a6cb7
Two narrow, direct write capabilities for the otherwise read-only Agent role, decided 2026-08-01 (docs/roadmap.md): - Calendar: ===CALENDAR-EVENT=== marker, parsed and acted on entirely in worker.py's Python (never inside Codex's own sandbox -- read-only has no network_access field at all, only workspace-write does). calendar-add-event (new writeShellApplication) builds a VEVENT and PUTs it to Radicale's calendar/public over the existing `calendar` LLDAP account, tailnet-only via calendar.0ff.space. - Tasks: ===TASK-EDIT=== marker triggers a second, narrowly-scoped `codex exec --sandbox workspace-write --add-dir /home/drone/tasks` (that one directory only, no network access), then the same COMMIT-MESSAGE-marker-and-commit-outside-the-sandbox mechanism builder.py already uses for its own repos, committing/pushing directly with no /freigeben approval step. New lukas/tasks Forgejo repo (seeded from website's about.html shell + style.css/manifest/icons), tailnet-only static site on blunix (tasks.nix, port 8006, routes-internal.nix + adguard.nix rewrite), webhook auto-deploy hook matching website/launcher's existing pattern. agentCalendarPw.age secret scaffolded (real LLDAP password still needs setting by hand -- see docs). agents/agent.md and the agent-codex README document both new capabilities; 49/49 unit tests pass including 9 new ones for the marker parsing, sandbox scoping, and commit path. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
20 lines
697 B
Nix
20 lines
697 B
Nix
{ pkgs, ... }:
|
|
|
|
{
|
|
# Task list maintained by agent@ (see agent-codex.nix's task-edit
|
|
# capability) -- tailnet-only, wired via routes-internal.nix's mkRoute
|
|
# (not an inline Traefik block like website.nix/launcher.nix, since
|
|
# those are public).
|
|
systemd.services.tasks = {
|
|
description = "Task list, edited via chat with agent@bot.0ff.space (tailnet-only)";
|
|
wantedBy = [ "multi-user.target" ];
|
|
before = [ "traefik.service" ];
|
|
serviceConfig = {
|
|
User = "drone";
|
|
Group = "users";
|
|
ExecStart = "${pkgs.static-web-server}/bin/static-web-server --host 127.0.0.1 --port 8006 --root /var/www/tasks";
|
|
Restart = "always";
|
|
RestartSec = "5s";
|
|
};
|
|
};
|
|
}
|