jochen
4ef4983d0d
The manager binds the node a login was adopted from to that login's licence, switching it if it was bound to another; serves public_key; adopt takes a key sealed to it. claude-code gains claude_code_add_api_key: read a file on this node, seal, hand to adopt, remove the file, optionally switch here.
385 lines
14 KiB
Go
385 lines
14 KiB
Go
// claude-code's bundle (novox/hq design 36, ADR 0183, ADR 0206): a binary the node's runtime launches over
|
|
// stdio as the operator account (ADR 0193) and is the bus for (ADR 0198). It is given its state directory
|
|
// and two files the mesh renders into it (ADR 0192), beside the runtime's own words.
|
|
//
|
|
// At start it renders the agent's managed directory, reports what this node holds as the module's
|
|
// `holdings` state and again whenever the credentials file changes, watches the licence manager's
|
|
// `bindings` state for this node and fetches the token when it says so, and watches the module's
|
|
// `servers` state — every node's MCP server registrations (ADR 0201). node.go holds the logic.
|
|
//
|
|
// stdout is the MCP channel; everything this module says, it says on stderr.
|
|
package main
|
|
|
|
import (
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"os"
|
|
"os/exec"
|
|
"path/filepath"
|
|
"strings"
|
|
"time"
|
|
|
|
stdio "git.novox.be/novox/mesh-sdk/go"
|
|
)
|
|
|
|
func say(format string, args ...any) {
|
|
fmt.Fprintf(os.Stderr, "[claude-code] "+format+"\n", args...)
|
|
}
|
|
|
|
// writeManaged writes one managed file as root, only when its content changed. From a staged file, never
|
|
// /dev/stdin: a child's input may be a socket, which /dev/stdin cannot open (found on the first assignment).
|
|
func writeManaged(name, content string) (string, error) {
|
|
path := filepath.Join(ManagedDir, name)
|
|
if was, err := os.ReadFile(path); err == nil && string(was) == content {
|
|
return name + ": unchanged", nil
|
|
}
|
|
staged, err := os.MkdirTemp("", "claude-code-")
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
defer os.RemoveAll(staged)
|
|
source := filepath.Join(staged, name)
|
|
if err := os.WriteFile(source, []byte(content), 0o644); err != nil {
|
|
return "", err
|
|
}
|
|
args := []string{"install", "-D", "-m", "0644", source, path}
|
|
if os.Geteuid() != 0 {
|
|
args = append([]string{"sudo", "-n"}, args...)
|
|
}
|
|
if out, err := exec.Command(args[0], args[1:]...).CombinedOutput(); err != nil {
|
|
return "", fmt.Errorf("%s: could not be written to %s (%s); the module writes there through the operator account's passwordless sudo",
|
|
name, ManagedDir, strings.TrimSpace(string(out)))
|
|
}
|
|
return name + ": written", nil
|
|
}
|
|
|
|
// ask is a tool on the bus, through the runtime: its answer is the tool's value.
|
|
func ask(address string, args any) (json.RawMessage, error) { return stdio.Ask(address, args) }
|
|
|
|
// stateOf adapts the SDK's state to what node.go asks of one.
|
|
type stateOf struct{ s stdio.KeptState }
|
|
|
|
func (s stateOf) Put(key string, value any) error { _, err := s.s.Put(key, value); return err }
|
|
func (s stateOf) Delete(key string) error { return s.s.Delete(key) }
|
|
func (s stateOf) Keys() ([]string, error) { return s.s.Keys() }
|
|
|
|
// nodesRunningMe is the nodes claude-code runs on, from the controller's list of modules — for the register
|
|
// tool's question.
|
|
func nodesRunningMe() ([]string, error) {
|
|
raw, err := ask("seat:mesh-controller.modules", map[string]any{})
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
var answer struct {
|
|
Output string `json:"output"`
|
|
}
|
|
text := string(raw)
|
|
if json.Unmarshal(raw, &answer) == nil && answer.Output != "" {
|
|
text = answer.Output
|
|
}
|
|
for _, line := range strings.Split(text, "\n") {
|
|
if !strings.HasPrefix(line, "claude-code ") {
|
|
continue
|
|
}
|
|
_, on, ok := strings.Cut(line, " on ")
|
|
if !ok || strings.TrimSpace(on) == "nothing" {
|
|
return nil, nil
|
|
}
|
|
var out []string
|
|
for _, n := range strings.Split(on, ",") {
|
|
if n = strings.TrimSpace(n); n != "" {
|
|
out = append(out, n)
|
|
}
|
|
}
|
|
return out, nil
|
|
}
|
|
return nil, nil
|
|
}
|
|
|
|
func fingerprintOfFile(path string) any {
|
|
raw, err := os.ReadFile(path)
|
|
if err != nil {
|
|
return nil
|
|
}
|
|
return Fingerprint(string(raw))
|
|
}
|
|
|
|
func status(p Paths) map[string]any {
|
|
creds := ReadCredentials(p.credentials())
|
|
var token any
|
|
if g := GrantOf(creds); g != nil {
|
|
token = map[string]any{"fingerprint": Fingerprint(g.AccessToken), "expiresAt": stamp(g.ExpiresAt), "loginWaiting": HoldsLogin(creds)}
|
|
}
|
|
var managed []map[string]any
|
|
for _, f := range []string{"managed-mcp.json", "managed-settings.json", "CLAUDE.md"} {
|
|
path := filepath.Join(ManagedDir, f)
|
|
managed = append(managed, map[string]any{"file": path, "fingerprint": fingerprintOfFile(path)})
|
|
}
|
|
var licence any
|
|
var b Binding
|
|
if readJSON(p.binding(), &b) {
|
|
licence = b
|
|
}
|
|
names := []string{}
|
|
for n := range Registered(p) {
|
|
names = append(names, n)
|
|
}
|
|
return map[string]any{"node": p.Node, "licence": licence, "token": token, "holdings": HoldingsOf(p),
|
|
"managed": managed, "registered": names}
|
|
}
|
|
|
|
func str(description string) map[string]any {
|
|
return map[string]any{"type": "string", "description": description}
|
|
}
|
|
|
|
// nodesOf reads the tools' `nodes` argument: absent is this node, "all" every node, else a list.
|
|
func nodesOf(v any) []string {
|
|
s, _ := v.(string)
|
|
s = strings.TrimSpace(s)
|
|
switch s {
|
|
case "":
|
|
return nil
|
|
case "all":
|
|
return []string{"all"}
|
|
}
|
|
var out []string
|
|
for _, n := range strings.Split(s, ",") {
|
|
if n = strings.TrimSpace(n); n != "" {
|
|
out = append(out, n)
|
|
}
|
|
}
|
|
return out
|
|
}
|
|
|
|
func tools(p Paths, servers ServerState, view *ServerView) []stdio.Tool {
|
|
nodesArg := str(`more nodes: "all" for every node running claude-code, or a comma-separated list; absent is this node only`)
|
|
return []stdio.Tool{
|
|
{Name: "claude_code_status",
|
|
Description: "Claude Code on this machine as the mesh configured it: the licence it holds and when its token expires, what it reports holding, the managed files, the MCP servers registered here. Fingerprints only, never a token.",
|
|
Run: func(map[string]any) (any, error) { return status(p), nil }},
|
|
{Name: "claude_code_render",
|
|
Description: "Write Claude Code's managed directory now, from the mesh's facts, this module's settings and the servers registered here.",
|
|
Run: func(map[string]any) (any, error) {
|
|
out, err := RenderNow(p, writeManaged)
|
|
return map[string]any{"rendered": out}, err
|
|
}},
|
|
{Name: "claude_code_pull",
|
|
Description: "Ask the licence manager for this node's current token now and apply it, rather than waiting for its binding to change.",
|
|
Run: func(map[string]any) (any, error) { return Pull(p, ask, writeManaged) }},
|
|
{Name: "claude_code_grant",
|
|
Description: "For the licence manager (ADR 0206): the full grant in this node's credentials file — a login made here — sealed to the public key given, with the account it belongs to. Nothing when no login is waiting. Never answers a token in the clear.",
|
|
Input: map[string]any{"public_key": str("the manager's public key, PEM; the grant opens only with its private half")},
|
|
Run: func(a map[string]any) (any, error) {
|
|
key, _ := a["public_key"].(string)
|
|
if !strings.Contains(key, "PUBLIC KEY") {
|
|
return nil, errors.New("claude_code_grant seals to a public key, and none was given")
|
|
}
|
|
return GrantFor(p, key)
|
|
}},
|
|
{Name: "claude_code_add_api_key",
|
|
Description: "Add an Anthropic API key as a licence (ADR 0209): read from a file on this machine — never typed as an argument — sealed to the licence manager's key, handed over, and the file removed once taken. With use_here, this machine switches to it at once; other machines move with the manager's `switch`.",
|
|
Input: map[string]any{
|
|
"name": str("the licence's name, e.g. api"),
|
|
"file": str("a file on this machine holding the key, e.g. ~/api-key (removed once the manager has it)"),
|
|
"use_here": map[string]any{"type": "boolean", "description": "switch this machine to the new licence"},
|
|
},
|
|
Run: func(a map[string]any) (any, error) {
|
|
name, _ := a["name"].(string)
|
|
file, _ := a["file"].(string)
|
|
if strings.TrimSpace(name) == "" || strings.TrimSpace(file) == "" {
|
|
return nil, errors.New("name and file are required")
|
|
}
|
|
if strings.HasPrefix(file, "~/") {
|
|
file = filepath.Join(p.Home, file[2:])
|
|
}
|
|
useHere, _ := a["use_here"].(bool)
|
|
return AddAPIKey(p, strings.TrimSpace(name), file, useHere, ask)
|
|
}},
|
|
{Name: "claude_code_mcp_list",
|
|
Description: "The MCP servers registered through this module: those that apply on this node (beside the console, `mesh`, and those set in the module's settings), and every registration on the mesh, by key — `all.<server>` for every node, `<node>.<server>` for one.",
|
|
Run: func(map[string]any) (any, error) {
|
|
keys, err := servers.Keys()
|
|
return map[string]any{"here": Registered(p), "everywhere": keys}, err
|
|
}},
|
|
{Name: "claude_code_mcp_register",
|
|
Description: "Register an MCP server with Claude Code on this node, every node, or a list — an http/sse server by url, or a stdio server by command. Kept on the bus, so a node that joins later takes it too. Never put a secret in env or headers: the mesh refuses one.",
|
|
Input: map[string]any{
|
|
"name": str("the server's name: letters, digits, - and _"),
|
|
"type": str("http, sse or stdio (default stdio when a command is given, http when a url is)"),
|
|
"url": str("an http or sse server's url"),
|
|
"command": str("a stdio server's program"),
|
|
"args": map[string]any{"type": "array", "description": "a stdio server's arguments"},
|
|
"env": map[string]any{"type": "object", "description": "a stdio server's environment"},
|
|
"headers": map[string]any{"type": "object", "description": "an http server's headers"},
|
|
"nodes": nodesArg,
|
|
},
|
|
Run: func(a map[string]any) (any, error) {
|
|
entry := map[string]any{}
|
|
if t, _ := a["type"].(string); t != "" {
|
|
entry["type"] = t
|
|
} else if _, hasURL := a["url"]; hasURL {
|
|
entry["type"] = "http"
|
|
} else {
|
|
entry["type"] = "stdio"
|
|
}
|
|
for _, k := range []string{"url", "command", "args", "env", "headers"} {
|
|
if v, ok := a[k]; ok {
|
|
entry[k] = v
|
|
}
|
|
}
|
|
name, _ := a["name"].(string)
|
|
return RegisterServer(p, Registration{Name: name, Entry: entry, Nodes: nodesOf(a["nodes"])}, servers, view, writeManaged, nodesRunningMe)
|
|
}},
|
|
{Name: "claude_code_mcp_unregister",
|
|
Description: "Remove an MCP server registered through this module, on this node or more.",
|
|
Input: map[string]any{"name": str("the server's name"), "nodes": nodesArg},
|
|
Run: func(a map[string]any) (any, error) {
|
|
name, _ := a["name"].(string)
|
|
return RegisterServer(p, Registration{Name: name, Nodes: nodesOf(a["nodes"])}, servers, view, writeManaged, nodesRunningMe)
|
|
}},
|
|
}
|
|
}
|
|
|
|
// persist asks the state again until it answers: its bucket or the bus's grant may arrive after the module.
|
|
func persist(what string, attempt func() error, done func(refusals int)) {
|
|
waits := []time.Duration{2 * time.Second, 5 * time.Second, 10 * time.Second, 30 * time.Second}
|
|
for n := 0; ; n++ {
|
|
err := attempt()
|
|
if err == nil {
|
|
done(n)
|
|
return
|
|
}
|
|
pause := time.Minute
|
|
if n < len(waits) {
|
|
pause = waits[n]
|
|
}
|
|
say("%s not yet (%v); asking again in %s", what, err, pause)
|
|
time.Sleep(pause)
|
|
}
|
|
}
|
|
|
|
func main() {
|
|
p, launched := PathsFrom(os.Getenv)
|
|
if !launched {
|
|
// Outside a launch — a build, a check — it serves nothing and says why.
|
|
say("not launched by the runtime with this module's words; serving no tools")
|
|
if err := stdio.Serve("", nil); err != nil {
|
|
os.Exit(1)
|
|
}
|
|
return
|
|
}
|
|
if _, err := Keypair(p); err != nil {
|
|
say("this module's key: %v", err)
|
|
}
|
|
if out, err := RenderNow(p, writeManaged); err != nil {
|
|
say("%v", err)
|
|
} else {
|
|
for _, line := range out {
|
|
if !strings.HasSuffix(line, "unchanged") {
|
|
say("%s", line)
|
|
}
|
|
}
|
|
}
|
|
servers := stateOf{stdio.State("servers")}
|
|
view := NewServerView(p)
|
|
go run(p, view)
|
|
if err := stdio.Serve("", tools(p, servers, view)); err != nil {
|
|
say("%v", err)
|
|
os.Exit(1)
|
|
}
|
|
}
|
|
|
|
// run is the module's long-running half, beside the tools (ADR 0198).
|
|
func run(p Paths, view *ServerView) {
|
|
// Every node's MCP servers: the whole current set first, then each change (ADR 0201).
|
|
go persist("watching the MCP servers", func() error {
|
|
return stdio.State("servers").Watch("", func(c stdio.StateChange) error {
|
|
var value map[string]any
|
|
_ = json.Unmarshal(c.Value, &value)
|
|
if done, err := OnServerChange(view, ServerChange{Key: c.Key, Op: c.Op, Value: value}, p, writeManaged); err != nil {
|
|
say("taking %s %s: %v", c.Op, c.Key, err) // the view took it; the next render writes it
|
|
} else if done != "" {
|
|
say("%s", done)
|
|
}
|
|
return nil
|
|
})
|
|
}, func(n int) { say("watching the MCP servers%s", refusals(n)) })
|
|
|
|
// What this node holds (ADR 0206): at start — a node already logged in is reported at once — and on
|
|
// every change of the credentials file, polled, because the file is replaced by rename and a watch on
|
|
// the old inode would go quiet. Fingerprints and expiries only.
|
|
holdings := stdio.State("holdings")
|
|
reported := ""
|
|
report := func() {
|
|
now := HoldingsOf(p)
|
|
raw, _ := json.Marshal(now)
|
|
if string(raw) == reported {
|
|
return
|
|
}
|
|
persist("reporting what this node holds", func() error { _, err := holdings.Put(p.Node, now); return err }, func(int) {
|
|
reported = string(raw)
|
|
account := "no account"
|
|
if now.Identity != nil && now.Identity.EmailAddress != "" {
|
|
account = now.Identity.EmailAddress
|
|
}
|
|
line := "reported: " + account
|
|
if now.Kind != nil {
|
|
line += ", " + *now.Kind
|
|
}
|
|
if now.Refresh.Present {
|
|
line += ", a login waiting"
|
|
}
|
|
if now.Licence != nil {
|
|
line += fmt.Sprintf(", licence %s g%d", *now.Licence, now.Generation)
|
|
}
|
|
say("%s", line)
|
|
})
|
|
}
|
|
|
|
// What this node should hold (ADR 0206): the manager's `bindings` key for this node; a newer
|
|
// generation is fetched with the seat's `current`, sealed to this module's key.
|
|
go persist("watching this node's licence binding", func() error {
|
|
return stdio.State(Manager+".bindings").Watch(p.Node, func(c stdio.StateChange) error {
|
|
if c.Key != p.Node {
|
|
return nil
|
|
}
|
|
var b *BindingState
|
|
if c.Op == "put" {
|
|
b = &BindingState{}
|
|
if err := json.Unmarshal(c.Value, b); err != nil {
|
|
return nil
|
|
}
|
|
}
|
|
if done, err := OnBinding(p, b, ask, writeManaged); err != nil {
|
|
say("fetching this node's token failed: %v", err)
|
|
} else if done != "" {
|
|
say("%s", done)
|
|
}
|
|
go report()
|
|
return nil
|
|
})
|
|
}, func(n int) { say("watching this node's licence binding%s", refusals(n)) })
|
|
|
|
report()
|
|
var last string
|
|
for range time.Tick(5 * time.Second) {
|
|
info, err := os.Stat(p.credentials())
|
|
now := "absent"
|
|
if err == nil {
|
|
now = fmt.Sprintf("%d/%d", info.ModTime().UnixNano(), info.Size())
|
|
}
|
|
if now != last {
|
|
last = now
|
|
report()
|
|
}
|
|
}
|
|
}
|
|
|
|
func refusals(n int) string {
|
|
if n == 0 {
|
|
return ""
|
|
}
|
|
return fmt.Sprintf(" (after %d refusal(s))", n)
|
|
}
|