Translated agent into python - #19
Open
irapatil07 wants to merge 74 commits into
Open
Conversation
… for osquery client
…y and maintenance workflows, and implement scheduled query loading
modified: agent/crates/agent-core/src/orchestrator.rs modified: agent/crates/fleet-client/src/lib.rs
- Created `fleet-manager` crate with a basic fleet management function. - Added `fleet-tracing` crate for initializing tracing and logging. - Introduced `grpc-listener` crate with build script for gRPC service. - Implemented health tracking in `health-tracker` crate. - Added Kafka publishing functionality in `kafka-handler` crate. - Created `node-enrollment` crate for node enrollment functionality. - Established Postgres interface in `postgres-interface` crate. - Updated `fleet-server-bin` to initialize and run the fleet server.
…persistence
This commit implements the foundational architecture for the `fleet-server` backend,
including domain logic, robust database persistence, and local infrastructure setup.
Major Additions:
- `postgres-interface`: Implemented production-ready database layer using `sqlx`
for compile-time checked SQL queries and strict state transitions.
- `node-enrollment`: Added endpoint registration flow generating secure 24-hour JWTs.
- `health-tracker`: Added time-series heartbeat recording.
- Infra: Added `docker-compose.yml`, `Dockerfile`, SQL migrations, and seed data.
- Config: Integrated `dotenvy` to parse `.env` files and added `.env.example`.
- CI: Added `CHANGELOG.md` and `local-ci.sh` script to streamline pre-push checks.
Security & Architectural Fixes:
- Enforced server-side status coercion to prevent agents from self-reporting
as "isolated" or overriding operator commands.
- Transitioned away from using `xmax` system columns for UPSERT detection,
opting for explicit `SELECT FOR UPDATE` patterns to guarantee query reliability.
- Fixed a silent clock failure vulnerability in the JWT signing process.
- Fixed `unused_import`, `dead_code`, and 32-bit truncation warnings to
ensure the workspace compiles with zero clippy warnings.
…, enrollment logic and ci fixes
… ESLint configuration
… Protobuf to JSON serialization
refactor(agent): migrate fleet communication and event buffering from…
… management, and osquery configuration orchestration
…move yara-x dependency
…-server - ci: upgrade actions/checkout v3 -> v4 in all four workflow jobs - agent/agent.toml: remove hardcoded node_id (written by enrollment flow on first run) - agent-bin/main.rs: fail fast on malformed UUID from fleet server (expect vs unwrap_or_default); remove unused imports (File, BufRead, BufReader, error); drop blanket #![allow] - command_handler: remove blanket #![allow], drop unused tracing imports - agent-core/lib.rs: remove blanket #![allow] - agent-core/orchestrator.rs: remove blanket #![allow] - fleet-client/lib.rs: remove blanket #![allow] + unused imports; propagate UUID parse error in enroll(); log payload serialization failures and skip instead of silently empty-vec; replace silent while-let stream loop with explicit match that logs errors and graceful close - osquery/osquery.flags: fix contradictory --disable_audit=false -> true; remove --enable_syslog and --audit_allow_sockets that contradict eBPF-only architecture - agent/tests: mark unimplemented integration test with #[ignore] - test_query.rs: fix 'FAMED' -> 'FRAMED' typo - kafka-handler: replace Timeout::Never with Timeout::After(30s) to prevent indefinite blocking - kafka-pipeline/Dockerfile: replace libssl-dev with libssl3 in runtime stage; add --no-install-recommends to both apt-get calls; add non-root 'edr' user and switch to it before CMD - kafka-pipeline/Cargo.toml: remove redundant commented-out rdkafka workspace dep line - kafka-admin.rs: replace brittle positional arg parsing with flag-name-based parser; remove advertised-but-unimplemented verify-topics/describe-topic doc comments - consumer.rs: disable auto-commit (enable.auto.commit=false); remove blanket #![allow] and unused tracing imports - event_router.rs: remove blanket #![allow] and unused warn import - guide.md: fix stale function reference determine_topic -> route_topic - README.md: standardize spelling normalised -> normalized
find the .proto file having ServerCommand and then complete this one
|
Important Review skippedToo many files! This PR contains 203 files, which is 103 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry. ⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (18)
📒 Files selected for processing (203)
You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Owner
|
This pr has too much overlap with other work , it will take time for review . Thanks for PR ! |
Owner
|
There are several issues in pr first is you have forked from wrong branch i guess. we will discuss this later . |
Author
|
Should I make changes and send it again?
…On Wed, 12 Aug, 2026, 9:05 pm Swarnit, ***@***.***> wrote:
*swar09* left a comment (swar09/aigis-zero#19)
<#19 (comment)>
There are several issues in pr first is you have forked from wrong branch
i guess. we will discuss this later .
—
Reply to this email directly, view it on GitHub
<#19?email_source=notifications&email_token=CEUJNFMBWBAELW7EK74ZET35JSFDPA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMRWHA4TMNBWGU4KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-5268964658>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/CEUJNFINVM7EAHBWEFXQBTD5JSFDPAVCNFSNUABGKJSXA33TNF2G64TZHMYTENBWGYZTINRTGQ5US43TOVSTWNJQHA2DEMBVHE2DTILWAI>
.
Triage notifications, keep track of coding agent tasks and review pull
requests on the go with GitHub Mobile for iOS
<https://github.com/notifications/mobile/ios/CEUJNFP5Z3DHKXAYAIDIZ435JSFDPA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMRWHA4TMNBWGU4KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KUZTPN52GK4S7NFXXG>
and Android
<https://github.com/notifications/mobile/android/CEUJNFKSJUK7EVFHY5PDJP35JSFDPA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMRWHA4TMNBWGU4KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA>.
Download it today!
You are receiving this because you authored the thread.Message ID:
***@***.***>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Type
Target Module / Crate
SDK
sdk— shared types, proto definitionsAgent Workspace
agent/agent-core— binary entry point, orchestratoragent/ebpf-collector— eBPF programs and loaderagent/osquery-client— OSQuery socket IPC clientagent/event-buffer— local disk buffer (sled)agent/fleet-client— gRPC client to Fleet Serveragent/isolation— IPTables-based network isolationBackend Services
fleet-server— gRPC fleet server (enrollment, streaming, C2)kafka-pipeline— event processor + normaliser + DB writerrule-engine— YARA scanning, MITRE mapping, alert generationapi-backend— REST API + WebSocket for frontendFrontend
frontend— React/Vite/TypeScript dashboardInfrastructure
infra— Docker Compose, K8s manifests, Terraform, scriptsChecklist
docker-compose uptested locallyHow to verify