73 lines
3.0 KiB
Go
73 lines
3.0 KiB
Go
// agent-token: the forge's read credential for each node's agent (novox/hq ADR 0365 clauses 1, 3, 4 and 5; issue
|
|
// 737). A process the node's runtime launches and speaks MCP over stdio to, beside the module's other bundles.
|
|
//
|
|
// It serves one tool, gitea_agent_token, which the vault alone asks (ADR 0349 clause 10, issue 749): for each holder
|
|
// of the provision `gitea-read` the vault names — the claude-code module on one machine — it makes that machine's
|
|
// agent a forge account of its own, `agent-<node>`, no administrator and in no team, mints it a token whose one
|
|
// scope is `read:repository`, and answers the git credential lines for it, each holder's sealed to the key the vault
|
|
// made for the call. Asked again, it mints again and deletes the account's token from before: that is its rotation.
|
|
//
|
|
// stdout is the protocol; it says what it says on stderr, and never a token or the admin's password.
|
|
package main
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
|
|
stdio "git.novox.be/novox/mesh-sdk/go"
|
|
)
|
|
|
|
// ToolNames are the tools this bundle serves. The module's manifest lists no `tools` (see the npm-registry bundle
|
|
// for why); the README names this one, and a test holds the three together.
|
|
var ToolNames = []string{ToolName}
|
|
|
|
func main() {
|
|
if err := stdio.Serve("", Tools(MinterFromEnv)); err != nil {
|
|
fmt.Fprintln(os.Stderr, err)
|
|
os.Exit(1)
|
|
}
|
|
}
|
|
|
|
// Tools are the bundle's tools over the minter the function gives, asked per call, so a manifest that does not set
|
|
// the environment is a refusal naming what is missing, not a bundle that will not start.
|
|
func Tools(minter func() (*Minter, error)) []stdio.Tool {
|
|
return []stdio.Tool{{
|
|
Name: ToolName,
|
|
Description: "The forge's read credential for each node's agent (novox/hq ADR 0365), answered to the vault " +
|
|
"alone: for each holder named, a forge account of the node's agent's own (agent-<node>), no administrator " +
|
|
"and in no team, and a token of scope read:repository minted for it anew, its git credential lines " +
|
|
"sealed to seal_to. Any other caller is refused and nothing is minted.",
|
|
Input: map[string]any{
|
|
"type": "object",
|
|
"properties": map[string]any{
|
|
"provision": map[string]any{"type": "string", "description": "the provision, " + Provision},
|
|
"seal_to": map[string]any{"type": "string", "description": "the key made for this call, base64"},
|
|
"holders": map[string]any{
|
|
"type": "array",
|
|
"description": "the provision's holders: each a consuming module on one machine",
|
|
"items": map[string]any{"type": "object", "properties": map[string]any{
|
|
"node": map[string]any{"type": "string"},
|
|
"module": map[string]any{"type": "string"},
|
|
}},
|
|
},
|
|
},
|
|
"required": []string{"provision", "seal_to", "holders"},
|
|
},
|
|
Run: func(args map[string]any) (any, error) {
|
|
caller := stdio.CallerOf(args)
|
|
if err := fromTheVault(caller); err != nil {
|
|
return nil, err
|
|
}
|
|
ask, err := readAsk(args)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
m, err := minter()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return m.Answer(ask)
|
|
},
|
|
}}
|
|
}
|