clawdie-iso/live/operator-session/clawdie-enable-mother.sh

#!/bin/sh
# Enable the opt-in MCP link to "mother".
#
# Direction: this agent's Pi calls mother's tools. colibri-mcp dials OUT to
# mother over SSH-stdio and proxies mother's MCP tools to the Pi via its
# external-call path. Off by default; this script turns it on.
#
# The colibri daemon (and the Pi it spawns) run as the `colibri` user, so the
# outbound SSH uses an identity in the colibri home (/var/db/colibri/.ssh).
# Run this in a visible terminal so the operator can copy the public key.

set -eu

PROVIDER_ENV="/usr/local/etc/colibri/provider.env"
EXTERNAL_MCP="/usr/local/etc/colibri/external-mcp.json"
COLIBRI_HOME="/var/db/colibri"
SSH_KEY="${COLIBRI_HOME}/.ssh/id_ed25519"

finish() {
    echo ""
    echo "Press Enter to close."
    read -r _
    exit "${1:-0}"
}

have() {
    command -v "$1" >/dev/null 2>&1
}

if ! have mdo; then
    echo "ERROR: mdo is required to update the colibri service configuration."
    finish 1
fi

echo "========================================"
echo "  Clawdie — Enable Mother Link"
echo "========================================"
echo ""

# 1. Mother's reachable address + remote MCP command.
printf "  Mother SSH target (user@tailscale-ip-or-name): "
read -r MOTHER_HOST
if [ -z "${MOTHER_HOST:-}" ]; then
    echo "  Cancelled: no mother target entered."
    finish 0
fi
printf "  Mother MCP command [colibri-mcp]: "
read -r MOTHER_CMD
[ -n "${MOTHER_CMD:-}" ] || MOTHER_CMD="colibri-mcp"

# 2. Ensure the colibri service account has an SSH key for the outbound link.
echo ""
echo "[1/4] Ensuring colibri SSH identity..."
mdo -u root sh -c '
    set -eu
    home="$1"; key="$2"
    install -d -o colibri -g colibri -m 0700 "${home}/.ssh"
    if [ ! -f "$key" ]; then
        ssh-keygen -t ed25519 -N "" -f "$key" -C "colibri@$(hostname)" >/dev/null
        chown colibri:colibri "$key" "${key}.pub"
        chmod 0600 "$key"; chmod 0644 "${key}.pub"
    fi
' sh "$COLIBRI_HOME" "$SSH_KEY"

# 3. Merge the mother entry into the external MCP registry. Use jq so existing
# server entries are preserved (not overwritten), and write atomically.
echo "[2/4] Registering mother in ${EXTERNAL_MCP}..."
if ! have jq; then
    echo "       ERROR: jq is required to merge the mother entry into ${EXTERNAL_MCP}."
    finish 1
fi
existing="$(mdo -u root cat "$EXTERNAL_MCP" 2>/dev/null || echo '{}')"
[ -n "$existing" ] || existing='{}'
printf '%s\n' "$existing" |
    jq --arg host "$MOTHER_HOST" --arg cmd "$MOTHER_CMD" --arg key "$SSH_KEY" \
        '.servers = ((.servers // {}) + {mother: {command: "ssh", args: ["-i", $key, "-o", "BatchMode=yes", "-o", "StrictHostKeyChecking=accept-new", $host, $cmd], env: {}}})' |
    mdo -u root sh -c '
        set -eu
        f="$1"
        tmp="$(mktemp "$(dirname "$f")/external-mcp.XXXXXX")"
        cat >"$tmp"
        chmod 0644 "$tmp"
        mv "$tmp" "$f"
    ' sh "$EXTERNAL_MCP"

# 4. Allow external MCP calls: upsert COLIBRI_MCP_EXTERNAL_CALL=1 into provider.env.
echo "[3/4] Enabling external MCP calls..."
mdo -u root sh -c '
    set -eu
    f="$1"
    tmp="$(mktemp)"
    grep -v "^COLIBRI_MCP_EXTERNAL_CALL=" "$f" >"$tmp" 2>/dev/null || :
    printf "COLIBRI_MCP_EXTERNAL_CALL=\"1\"\n" >>"$tmp"
    cat "$tmp" >"$f"
    rm -f "$tmp"
    chmod 0600 "$f"
' sh "$PROVIDER_ENV"

# 5. Restart the daemon so the Pi inherits the new env + registry.
echo "[4/4] Restarting colibri daemon..."
mdo -u root service colibri_daemon restart >/dev/null 2>&1 ||
    echo "       WARNING: restart failed; run: mdo -u root service colibri_daemon restart"

echo ""
echo "Mother link configured. Authorize this key on mother (restrict it to the"
echo "MCP command, e.g. command=\"${MOTHER_CMD}\",restrict in authorized_keys):"
echo ""
mdo -u root cat "${SSH_KEY}.pub" 2>/dev/null || echo "  (could not read ${SSH_KEY}.pub)"
echo ""
echo "Once authorized on mother, the Pi can call mother's tools via colibri-mcp."
finish 0