Omar SobhandClaude Opus 4.8
fb59378aa2
Agents can now provision their sandbox on a connected fleet node instead of the gateway host. Local stays the strict default, so existing agents are byte-for- byte unaffected until explicitly placed elsewhere. Security parity: the daemon links the REAL cm-sandbox DockerDriver and runs the typed container ops (sb_provision/sb_exec/sb_destroy/sb_health/sb_list) through it — identical hardening (cap-drop ALL, seccomp, no-net, read-only, non-root) to local sandboxes. cm-sandbox spec types are now Serialize/Deserialize so the spec crosses the channel. - cm-api: RemoteDriver (impl SandboxDriver over the node channel) + HubDriverProvider (impl cm_runtime::NodeDriverProvider, hands out a driver only for connected nodes via a sync online set) + NodeHub.call/is_connected. AppState.with_node_hub so the hub is shared with the placement provider. - cm-runtime SandboxManager: driver_for(node_id) routes by the recorded agent_containers.node_id (local default = existing driver, identical path); placement_node() reads the workspace setting and falls back to local if the node is offline; exec/release route accordingly. NodeDriverProvider trait. - DB: 0020_workspace_placement + repo (for_agent/get/set/clear). - main.rs: build the NodeHub first; inject HubDriverProvider into the agent manager + share the hub with AppState. - API+UI: GET/PUT /api/fleet/placement + a "Run agents on: Local / <node>" selector in the Fleet overview. Note: a node must be able to pull the agent image (the daemon docker-pulls it); interactive PTY for agent containers on remote nodes is not wired (Terminal app stays local) — the in-dashboard node shell already covers host access. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Clawmates Frontend — handoff package
Every Clawmates screen as a self-contained HTML file, plus a dependency-free real-time bridge that makes them update live from the durable runner. No build step to view the screens.
handoff/
├── IMPLEMENTATION.md ← READ THIS FIRST. Per-screen guide + full wiring to cm-api.
├── install.sh ← one-shot installer (idempotent)
├── .env.example ← copy → .env, edit for live mode
├── screens/ ← the UI (open directly in a browser, no build step)
│ ├── Clawmates World.dc.html · Large World: Hierarchy · Flat · Live (Gource)
│ ├── Clawmates Observe.dc.html · Agent close-up + System mission-control
│ ├── Clawmates Dashboard.dc.html · Tiered admin: org→company→team→claw + topology morph
│ ├── Clawmates Infrastructure.dc.html · Local & Tailscale first, then Cloud providers
│ ├── Clawmates Auth.dc.html · Clerk-style sign-in / sign-up (Google · Apple · GitHub)
│ ├── Clawmates Landing.dc.html · Marketing page
│ └── support.js · the .dc.html runtime (keep next to the html)
└── realtime/ ← the live bridge (dependency-free Node ≥20)
├── server.mjs · demo + live SSE bridge
├── clawmates-live.js · browser client adapter (window.ClawmatesLive)
└── events.schema.json · the Clawmates Event Taxonomy (the contract)
60-second start (demo, no backend)
chmod +x install.sh && ./install.sh
(cd realtime && CLAWMATES_MODE=demo node server.mjs) &
caddy file-server --root ./screens --listen :8080 # or: npx serve ./screens -l 8080
Open http://localhost:8080/Clawmates%20World.dc.html?live=http://localhost:8420/live, switch to the Live formation, and watch the agents converge on events from the bridge.
Then read IMPLEMENTATION.md for the per-screen integration seams, the event taxonomy, the Infrastructure (Tailscale + daemon + cloud) wiring, and the cm-api hookup.