Rebrand: TeamClaw -> Clawmates (clawmates.work)

Full-depth rename per the approved plan; the 'claw' product vocabulary (claws, /claws routes, clawId, Claw Chat) stays — it is now the brand. - Display brand: Clawmates (manifest, titles, hero, login/rail logo 'clawmates'); default host app.clawmates.work; registry ghcr.io/clawmates - Crates tc-* -> cm-* (16 crates + all imports); binaries clawmates-server/broker/bundler; images clawmates/*; env prefix CLAWMATES_* (+ CM_TEST_DATABASE_URL / CM_LIVE_LLM); config clawmates.toml; helm chart deploy/helm/clawmates with clawmates-* resources; db names clawmates*; sockets /run/clawmates; cookie cm_session; kind cluster clawmates-test; seccomp node profile clawmates-agent-profile.json - All 9 Playwright brand assertions updated in lockstep; historical spec document left untouched as the only remaining 'TeamClaw' - Local env migrated: dev pg clawmates-dev-pg/clawmates_dev, shared test server clawmates-test-pg, kind cluster recreated with image + profile, compose images rebuilt under clawmates/* Verified end to end: 161 Rust + 68 frontend tests, 29 Playwright journeys, 4 live kind tests, helm/install/LOC/placeholder gates, and the clean-room install rehearsal serving the clawmates login page from a signed bundle of the rebuilt images. Co-Authored-By: Claude Fable 5 <[email protected]>
2026-06-10 12:31:25 -05:00
parent 8046853feb
commit add4f79fed
209 changed files with 1429 additions and 1422 deletions
@@ -0,0 +1,98 @@
+use std::path::Path;
+
+use cm_domain::WorkspaceId;
+use tokio::net::UnixStream;
+use uuid::Uuid;
+
+use crate::protocol::{read_frame, write_frame, Request, Response};
+use crate::BrokerError;
+
+/// Client side of the broker protocol, used by the server process only.
+pub struct BrokerClient {
+    stream: UnixStream,
+}
+
+impl BrokerClient {
+    pub async fn connect(socket_path: &Path) -> Result<BrokerClient, BrokerError> {
+        let stream = UnixStream::connect(socket_path)
+            .await
+            .map_err(|e| BrokerError::Io(e.to_string()))?;
+        Ok(BrokerClient { stream })
+    }
+
+    async fn round_trip(&mut self, request: Request) -> Result<Response, BrokerError> {
+        write_frame(&mut self.stream, &request).await?;
+        let response: Response = read_frame(&mut self.stream).await?;
+        response.into_result()
+    }
+
+    pub async fn store_secret(
+        &mut self,
+        workspace_id: WorkspaceId,
+        kind: &str,
+        plaintext: &str,
+    ) -> Result<Uuid, BrokerError> {
+        match self
+            .round_trip(Request::StoreSecret {
+                workspace_id: workspace_id.as_uuid(),
+                kind: kind.to_owned(),
+                plaintext: plaintext.to_owned(),
+            })
+            .await?
+        {
+            Response::SecretStored { secret_id } => Ok(secret_id),
+            other => Err(BrokerError::Io(format!("unexpected response: {other:?}"))),
+        }
+    }
+
+    pub async fn secret_kind(&mut self, secret_id: Uuid) -> Result<String, BrokerError> {
+        match self.round_trip(Request::SecretKind { secret_id }).await? {
+            Response::SecretKind { kind } => Ok(kind),
+            other => Err(BrokerError::Io(format!("unexpected response: {other:?}"))),
+        }
+    }
+
+    /// Asks the broker to verify a Slack signature; the signing secret
+    /// never crosses the socket.
+    pub async fn verify_slack_signature(
+        &mut self,
+        secret_id: Uuid,
+        timestamp: &str,
+        body: &str,
+        signature: &str,
+    ) -> Result<bool, BrokerError> {
+        match self
+            .round_trip(Request::VerifySlackSignature {
+                secret_id,
+                timestamp: timestamp.to_owned(),
+                body: body.to_owned(),
+                signature: signature.to_owned(),
+            })
+            .await?
+        {
+            Response::Verified { valid } => Ok(valid),
+            other => Err(BrokerError::Io(format!("unexpected response: {other:?}"))),
+        }
+    }
+
+    pub async fn invoke_http(
+        &mut self,
+        approval_id: Uuid,
+        secret_id: Uuid,
+        url: &str,
+        body: serde_json::Value,
+    ) -> Result<u16, BrokerError> {
+        match self
+            .round_trip(Request::InvokeHttp {
+                approval_id,
+                secret_id,
+                url: url.to_owned(),
+                body,
+            })
+            .await?
+        {
+            Response::HttpDone { status } => Ok(status),
+            other => Err(BrokerError::Io(format!("unexpected response: {other:?}"))),
+        }
+    }
+}