Sam & Claude
c49fe82ea8
Track C's enable-mother overwrote external-mcp.json with a single mother server. Use jq to merge the mother entry into the existing registry so other configured servers are preserved, written atomically (mktemp in same dir + mv). This is the concrete consumer that makes jq a real dependency of the MCP path; fails loudly if jq is absent. (Re-applied: the original commit was lost to a branch-recreation race when #97 merged at the packages-only commit.) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
111 lines
3.8 KiB
Bash
Executable file
111 lines
3.8 KiB
Bash
Executable file
#!/bin/sh
|
|
# Enable the opt-in MCP link to "mother".
|
|
#
|
|
# Direction: this agent's Pi calls mother's tools. colibri-mcp dials OUT to
|
|
# mother over SSH-stdio and proxies mother's MCP tools to the Pi via its
|
|
# external-call path. Off by default; this script turns it on.
|
|
#
|
|
# The colibri daemon (and the Pi it spawns) run as the `colibri` user, so the
|
|
# outbound SSH uses an identity in the colibri home (/var/db/colibri/.ssh).
|
|
# Run this in a visible terminal so the operator can copy the public key.
|
|
|
|
set -eu
|
|
|
|
PROVIDER_ENV="/usr/local/etc/colibri/provider.env"
|
|
EXTERNAL_MCP="/usr/local/etc/colibri/external-mcp.json"
|
|
COLIBRI_HOME="/var/db/colibri"
|
|
SSH_KEY="${COLIBRI_HOME}/.ssh/id_ed25519"
|
|
|
|
finish() {
|
|
echo ""
|
|
echo "Press Enter to close."
|
|
read -r _
|
|
exit "${1:-0}"
|
|
}
|
|
|
|
have() {
|
|
command -v "$1" >/dev/null 2>&1
|
|
}
|
|
|
|
if ! have mdo; then
|
|
echo "ERROR: mdo is required to update the colibri service configuration."
|
|
finish 1
|
|
fi
|
|
|
|
echo "========================================"
|
|
echo " Clawdie — Enable Mother Link"
|
|
echo "========================================"
|
|
echo ""
|
|
|
|
# 1. Mother's reachable address + remote MCP command.
|
|
printf " Mother SSH target (user@tailscale-ip-or-name): "
|
|
read -r MOTHER_HOST
|
|
if [ -z "${MOTHER_HOST:-}" ]; then
|
|
echo " Cancelled: no mother target entered."
|
|
finish 0
|
|
fi
|
|
printf " Mother MCP command [colibri-mcp]: "
|
|
read -r MOTHER_CMD
|
|
[ -n "${MOTHER_CMD:-}" ] || MOTHER_CMD="colibri-mcp"
|
|
|
|
# 2. Ensure the colibri service account has an SSH key for the outbound link.
|
|
echo ""
|
|
echo "[1/4] Ensuring colibri SSH identity..."
|
|
mdo -u root sh -c '
|
|
set -eu
|
|
home="$1"; key="$2"
|
|
install -d -o colibri -g colibri -m 0700 "${home}/.ssh"
|
|
if [ ! -f "$key" ]; then
|
|
ssh-keygen -t ed25519 -N "" -f "$key" -C "colibri@$(hostname)" >/dev/null
|
|
chown colibri:colibri "$key" "${key}.pub"
|
|
chmod 0600 "$key"; chmod 0644 "${key}.pub"
|
|
fi
|
|
' sh "$COLIBRI_HOME" "$SSH_KEY"
|
|
|
|
# 3. Merge the mother entry into the external MCP registry. Use jq so existing
|
|
# server entries are preserved (not overwritten), and write atomically.
|
|
echo "[2/4] Registering mother in ${EXTERNAL_MCP}..."
|
|
if ! have jq; then
|
|
echo " ERROR: jq is required to merge the mother entry into ${EXTERNAL_MCP}."
|
|
finish 1
|
|
fi
|
|
existing="$(mdo -u root cat "$EXTERNAL_MCP" 2>/dev/null || echo '{}')"
|
|
[ -n "$existing" ] || existing='{}'
|
|
printf '%s\n' "$existing" |
|
|
jq --arg host "$MOTHER_HOST" --arg cmd "$MOTHER_CMD" --arg key "$SSH_KEY" \
|
|
'.servers = ((.servers // {}) + {mother: {command: "ssh", args: ["-i", $key, "-o", "BatchMode=yes", "-o", "StrictHostKeyChecking=accept-new", $host, $cmd], env: {}}})' |
|
|
mdo -u root sh -c '
|
|
set -eu
|
|
f="$1"
|
|
tmp="$(mktemp "$(dirname "$f")/external-mcp.XXXXXX")"
|
|
cat >"$tmp"
|
|
chmod 0644 "$tmp"
|
|
mv "$tmp" "$f"
|
|
' sh "$EXTERNAL_MCP"
|
|
|
|
# 4. Allow external MCP calls: upsert COLIBRI_MCP_EXTERNAL_CALL=1 into provider.env.
|
|
echo "[3/4] Enabling external MCP calls..."
|
|
mdo -u root sh -c '
|
|
set -eu
|
|
f="$1"
|
|
tmp="$(mktemp)"
|
|
grep -v "^COLIBRI_MCP_EXTERNAL_CALL=" "$f" >"$tmp" 2>/dev/null || :
|
|
printf "COLIBRI_MCP_EXTERNAL_CALL=\"1\"\n" >>"$tmp"
|
|
cat "$tmp" >"$f"
|
|
rm -f "$tmp"
|
|
chmod 0600 "$f"
|
|
' sh "$PROVIDER_ENV"
|
|
|
|
# 5. Restart the daemon so the Pi inherits the new env + registry.
|
|
echo "[4/4] Restarting colibri daemon..."
|
|
mdo -u root service colibri_daemon restart >/dev/null 2>&1 ||
|
|
echo " WARNING: restart failed; run: mdo -u root service colibri_daemon restart"
|
|
|
|
echo ""
|
|
echo "Mother link configured. Authorize this key on mother (restrict it to the"
|
|
echo "MCP command, e.g. command=\"${MOTHER_CMD}\",restrict in authorized_keys):"
|
|
echo ""
|
|
mdo -u root cat "${SSH_KEY}.pub" 2>/dev/null || echo " (could not read ${SSH_KEY}.pub)"
|
|
echo ""
|
|
echo "Once authorized on mother, the Pi can call mother's tools via colibri-mcp."
|
|
finish 0
|