Feature 57 (config and provisioning): modules declare config and provisions, their files rendered from templates; synced with main (issues of feature 57, 874)

modules/gitea/cmd/agent-token/main.go

@@ -0,0 +1,72 @@
+// agent-token: the forge's read credential for each node's agent (novox/hq ADR 0365 clauses 1, 3, 4 and 5; issue
+// 737). A process the node's runtime launches and speaks MCP over stdio to, beside the module's other bundles.
+//
+// It serves one tool, gitea_agent_token, which the vault alone asks (ADR 0349 clause 10, issue 749): for each holder
+// of the provision `gitea-read` the vault names — the claude-code module on one machine — it makes that machine's
+// agent a forge account of its own, `agent-<node>`, no administrator and in no team, mints it a token whose one
+// scope is `read:repository`, and answers the git credential lines for it, each holder's sealed to the key the vault
+// made for the call. Asked again, it mints again and deletes the account's token from before: that is its rotation.
+//
+// stdout is the protocol; it says what it says on stderr, and never a token or the admin's password.
+package main
+
+import (
+	"fmt"
+	"os"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
+)
+
+// ToolNames are the tools this bundle serves. The module's manifest lists no `tools` (see the npm-registry bundle
+// for why); the README names this one, and a test holds the three together.
+var ToolNames = []string{ToolName}
+
+func main() {
+	if err := stdio.Serve("", Tools(MinterFromEnv)); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
+
+// Tools are the bundle's tools over the minter the function gives, asked per call, so a manifest that does not set
+// the environment is a refusal naming what is missing, not a bundle that will not start.
+func Tools(minter func() (*Minter, error)) []stdio.Tool {
+	return []stdio.Tool{{
+		Name: ToolName,
+		Description: "The forge's read credential for each node's agent (novox/hq ADR 0365), answered to the vault " +
+			"alone: for each holder named, a forge account of the node's agent's own (agent-<node>), no administrator " +
+			"and in no team, and a token of scope read:repository minted for it anew, its git credential lines " +
+			"sealed to seal_to. Any other caller is refused and nothing is minted.",
+		Input: map[string]any{
+			"type": "object",
+			"properties": map[string]any{
+				"provision": map[string]any{"type": "string", "description": "the provision, " + Provision},
+				"seal_to":   map[string]any{"type": "string", "description": "the key made for this call, base64"},
+				"holders": map[string]any{
+					"type":        "array",
+					"description": "the provision's holders: each a consuming module on one machine",
+					"items": map[string]any{"type": "object", "properties": map[string]any{
+						"node":   map[string]any{"type": "string"},
+						"module": map[string]any{"type": "string"},
+					}},
+				},
+			},
+			"required": []string{"provision", "seal_to", "holders"},
+		},
+		Run: func(args map[string]any) (any, error) {
+			caller := stdio.CallerOf(args)
+			if err := fromTheVault(caller); err != nil {
+				return nil, err
+			}
+			ask, err := readAsk(args)
+			if err != nil {
+				return nil, err
+			}
+			m, err := minter()
+			if err != nil {
+				return nil, err
+			}
+			return m.Answer(ask)
+		},
+	}}
+}