Omar SobhandClaude Opus 4.8
fb59378aa2
Agents can now provision their sandbox on a connected fleet node instead of the gateway host. Local stays the strict default, so existing agents are byte-for- byte unaffected until explicitly placed elsewhere. Security parity: the daemon links the REAL cm-sandbox DockerDriver and runs the typed container ops (sb_provision/sb_exec/sb_destroy/sb_health/sb_list) through it — identical hardening (cap-drop ALL, seccomp, no-net, read-only, non-root) to local sandboxes. cm-sandbox spec types are now Serialize/Deserialize so the spec crosses the channel. - cm-api: RemoteDriver (impl SandboxDriver over the node channel) + HubDriverProvider (impl cm_runtime::NodeDriverProvider, hands out a driver only for connected nodes via a sync online set) + NodeHub.call/is_connected. AppState.with_node_hub so the hub is shared with the placement provider. - cm-runtime SandboxManager: driver_for(node_id) routes by the recorded agent_containers.node_id (local default = existing driver, identical path); placement_node() reads the workspace setting and falls back to local if the node is offline; exec/release route accordingly. NodeDriverProvider trait. - DB: 0020_workspace_placement + repo (for_agent/get/set/clear). - main.rs: build the NodeHub first; inject HubDriverProvider into the agent manager + share the hub with AppState. - API+UI: GET/PUT /api/fleet/placement + a "Run agents on: Local / <node>" selector in the Fleet overview. Note: a node must be able to pull the agent image (the daemon docker-pulls it); interactive PTY for agent containers on remote nodes is not wired (Terminal app stays local) — the in-dashboard node shell already covers host access. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
19 lines
717 B
Bash
19 lines
717 B
Bash
# Clawmates Live bridge — environment
|
|
# Copy to ../.env (the installer does this for you) and edit.
|
|
|
|
# demo = synthetic events, no backend needed (great first run)
|
|
# live = subscribe to the cm-api run SSE stream and normalize it
|
|
CLAWMATES_MODE=demo
|
|
|
|
# Port this bridge serves the browser SSE feed on
|
|
LIVE_PORT=8420
|
|
|
|
# Browser origins allowed to connect (CORS). Comma-separated.
|
|
LIVE_ALLOWED_ORIGINS=http://localhost:8080
|
|
|
|
# ---- live mode only -------------------------------------------------------
|
|
# Where the durable runner / cm-api publishes its run + turn SSE stream:
|
|
CM_API_SSE_URL=http://127.0.0.1:8080/v1/runs/stream
|
|
# Read-only service token scoped to run events (NOT a broker credential):
|
|
CM_API_TOKEN=
|