Feature 57 (config and provisioning): modules declare config and provisions, their files rendered from templates; synced with main (issues of feature 57, 874)

modules/claude-code/module.json

@@ -1,16 +1,24 @@
 {
   "module": "claude-code",
   "version": "1",
+  "moved": true,
   "slug": "agent",
   "capabilities": [
     "package-manager"
   ],
   "requires": [
-    "mcp-endpoint"
+    "mcp-endpoint",
+    {
+      "name": "gitea-read",
+      "optional": true
+    }
   ],
   "binds": {
     "mcp-endpoint": "${dir:state}/mcp-endpoint.json"
   },
+  "secrets": {
+    "gitea-read": "${dir:state}/gitea-read.secret"
+  },
   "uses": [
     "operator-channel"
   ],
@@ -85,6 +93,57 @@
       }
     ]
   },
+  "config": {
+    "role": {
+      "type": "string",
+      "description": "What this machine is for, in a sentence, written into the instructions every Claude Code session on it reads; empty says nothing.",
+      "trusted": true,
+      "default": ""
+    },
+    "mcp_servers": {
+      "type": "object",
+      "description": "The tool servers every session on this machine is given beside the mesh's own, by name, each as Claude Code's managed MCP configuration takes it; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "managed_settings": {
+      "type": "object",
+      "description": "Keys of Claude Code's managed settings every session on this machine obeys, such as spinnerTipsEnabled, laid over the mesh's own; empty adds none. Falls back to agent-managed-settings, the mesh's or this node's.",
+      "trusted": true,
+      "predefined": "agent-managed-settings",
+      "default": {}
+    },
+    "instructions": {
+      "type": "object",
+      "description": "The instructions every session on this machine reads, by name, each a text as one line or a list of its lines; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "output_styles": {
+      "type": "object",
+      "description": "The output styles offered to every session on this machine, by name, each a text as one line or a list of its lines; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "skills": {
+      "type": "object",
+      "description": "The skills offered to every session on this machine, by name, each its files by path, a text as one line or a list of its lines; a skill without its SKILL.md is left out; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "commands": {
+      "type": "object",
+      "description": "The slash commands offered to every session on this machine, by name, each a text as one line or a list of its lines; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "agents": {
+      "type": "object",
+      "description": "The agents offered to every session on this machine, by name, each a text as one line or a list of its lines; empty adds none.",
+      "trusted": true,
+      "default": {}
+    }
+  },
   "resources": [
     {
       "id": "package",
@@ -102,14 +161,14 @@
       "type": "file",
       "path": "/usr/local/bin/claude-agent",
       "mode": "0755",
-      "content": "#!/bin/sh\n# The mesh's (module claude-code, novox/hq ADR 0266): start the agent as the account agents run as on this\n# machine. Written whole at every push: an edit here is overwritten.\nagent='${machine:agent-account}'\nif [ \"$(id -un)\" = \"$agent\" ]; then\n\texec claude \"$@\"\nfi\n# Another account, the operator's, becomes the agent's through its own sudo: the person is the authority. The\n# operator's override of the guard travels only when it is set in this shell, as it would reach claude.\nif [ -n \"$MESH_GUARD_OVERRIDE\" ]; then\n\texec sudo -iu \"$agent\" env MESH_GUARD_OVERRIDE=\"$MESH_GUARD_OVERRIDE\" claude \"$@\"\nfi\nexec sudo -iu \"$agent\" claude \"$@\"\n"
+      "template": "files/claude-agent"
     },
     {
       "id": "agent-account-name",
       "type": "file",
       "path": "/etc/claude-code/agent-account",
       "mode": "0644",
-      "content": "${machine:agent-account}\n"
+      "template": "files/agent-account"
     },
     {
       "id": "agent-account",
@@ -138,7 +197,7 @@
       "path": "${dir:state}/facts.json",
       "mode": "0600",
       "owner": "${machine:account}",
-      "content": "{\n  \"node\": \"${machine:name}\",\n  \"console\": \"http://127.0.0.1:${bound:mcp-endpoint:port}/mcp\"\n}\n"
+      "template": "files/facts.json"
     },
     {
       "id": "settings",
@@ -146,15 +205,15 @@
       "path": "${dir:state}/settings.json",
       "mode": "0600",
       "owner": "${machine:account}",
+      "takes-config": ["role", "mcp_servers", "managed_settings", "instructions", "output_styles", "skills", "commands", "agents"],
       "merge": "json",
-      "content": "{\n  \"role\": \"\",\n  \"mcp_servers\": {},\n  \"managed_settings\": {},\n  \"instructions\": {},\n  \"output_styles\": {},\n  \"skills\": {},\n  \"commands\": {},\n  \"agents\": {}\n}\n"
+      "template": "files/settings.json"
     }
   ],
-  "shell": [
+  "items": [
     {
-      "for": "zsh",
-      "slot": "normal",
-      "code": "# The agent's session (module claude-code, novox/hq ADR 0266): where this machine names an account of the\n# agents' own, claude in an interactive zsh is claude-agent, which starts the session as that account. Where\n# agents run as the operator's account the file names that account, and nothing is added. claude-agent runs\n# the real claude: exec, sudo and its sh see no alias.\nif [[ -r /etc/claude-code/agent-account ]]; then\n\t() {\n\t\tlocal agent=$(</etc/claude-code/agent-account)\n\t\tif [[ -n $agent && $agent != $USERNAME ]]; then\n\t\t\talias claude=claude-agent\n\t\tfi\n\t}\nfi\n"
+      "collection": "shell:zsh:normal",
+      "template": "files/zsh-normal"
     }
   ],
   "build": {
@@ -174,6 +233,11 @@
           "MESH_CLAUDE_CODE_FACTS": "${dir:state}/facts.json",
           "MESH_CLAUDE_CODE_SETTINGS": "${dir:state}/settings.json"
         }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
       }
     ]
   }