@adaptic/maestro 1.0.0

package/scripts/setup/configure-macos.sh

@@ -0,0 +1,508 @@
+#!/bin/bash
+# =============================================================================
+# configure-macos.sh — Mac Mini Hardening for Maestro Agent Deployment
+# =============================================================================
+#
+# Configures a Mac mini as a headless, always-on agent server:
+#   1. Enables automatic login (no password on reboot)
+#   2. Disables sleep, standby, and screen saver
+#   3. Configures Parsec for remote desktop access (auto-launch on login)
+#   4. Launches Slack with Chrome DevTools Protocol (CDP) for huddle automation
+#   5. Sets up BlackHole virtual audio for voice integration
+#   6. Configures Login Items for all required apps
+#   7. Installs launchd agents for boot-time service startup
+#
+# Usage:
+#   sudo ./scripts/setup/configure-macos.sh           # Full configuration
+#   sudo ./scripts/setup/configure-macos.sh --check    # Verify current config
+#   ./scripts/setup/configure-macos.sh --apps-only     # Non-sudo app setup only
+#
+# IMPORTANT: Some steps require sudo (auto-login, power management).
+#            Run with sudo for full configuration.
+#
+# =============================================================================
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+AGENT_DIR="$(cd "$SCRIPT_DIR/../.." && pwd)"
+AGENT_NAME=$(basename "$AGENT_DIR")
+CURRENT_USER=$(whoami)
+
+# Colours
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+CYAN='\033[0;36m'
+NC='\033[0m'
+
+log()  { echo -e "${BLUE}[config]${NC} $1"; }
+ok()   { echo -e "${GREEN}  ✓${NC} $1"; }
+warn() { echo -e "${YELLOW}  ⚠${NC} $1"; }
+fail() { echo -e "${RED}  ✗${NC} $1"; }
+section() { echo ""; echo -e "${CYAN}━━━ $1 ━━━${NC}"; }
+
+# =============================================================================
+# 1. AUTO-LOGIN (requires sudo)
+# =============================================================================
+
+configure_auto_login() {
+  section "Auto-Login Configuration"
+
+  if [ "$(id -u)" -ne 0 ]; then
+    warn "Skipping auto-login — requires sudo"
+    warn "Run: sudo ./scripts/setup/configure-macos.sh"
+    return 0
+  fi
+
+  log "Configuring auto-login for user: $SUDO_USER"
+
+  # Enable auto-login via defaults
+  defaults write /Library/Preferences/com.apple.loginwindow autoLoginUser "$SUDO_USER"
+
+  # Disable login screen items that slow down boot
+  defaults write /Library/Preferences/com.apple.loginwindow SHOWFULLNAME -bool false
+  defaults write /Library/Preferences/com.apple.loginwindow GuestEnabled -bool false
+
+  # Disable "Reopen windows when logging back in" prompt
+  defaults write com.apple.loginwindow TALLogoutSavesState -bool false
+  defaults write com.apple.loginwindow LoginwindowLaunchesRelaunchApps -bool false
+
+  ok "Auto-login enabled for $SUDO_USER"
+  warn "NOTE: FileVault must be disabled for auto-login to work"
+  warn "Check: fdesetup status"
+
+  # Check FileVault status
+  if fdesetup status 2>/dev/null | grep -q "On"; then
+    warn "FileVault is ON — auto-login will NOT work until FileVault is disabled"
+    warn "Disable with: sudo fdesetup disable"
+    warn "This is a security trade-off for headless server operation"
+  else
+    ok "FileVault is off — auto-login will work"
+  fi
+}
+
+# =============================================================================
+# 2. PREVENT SLEEP / STANDBY / SCREEN SAVER
+# =============================================================================
+
+configure_power_management() {
+  section "Power Management (No Sleep)"
+
+  if [ "$(id -u)" -ne 0 ]; then
+    warn "Skipping power management — requires sudo"
+    return 0
+  fi
+
+  log "Disabling all sleep modes..."
+
+  # Disable system sleep
+  pmset -a sleep 0
+
+  # Disable display sleep (0 = never)
+  pmset -a displaysleep 0
+
+  # Disable hard disk sleep
+  pmset -a disksleep 0
+
+  # Disable standby mode
+  pmset -a standby 0
+
+  # Disable Power Nap
+  pmset -a powernap 0
+
+  # Disable hibernation
+  pmset -a hibernatemode 0
+
+  # Wake on network access (Wake-on-LAN)
+  pmset -a womp 1
+
+  # Auto-restart after power failure
+  pmset -a autorestart 1
+
+  # Disable proximity wake (Apple Watch)
+  pmset -a proximitywake 0
+
+  ok "Sleep disabled (system, display, disk, standby)"
+  ok "Wake-on-LAN enabled"
+  ok "Auto-restart on power failure enabled"
+
+  # Disable screen saver
+  log "Disabling screen saver..."
+  defaults -currentHost write com.apple.screensaver idleTime -int 0
+  ok "Screen saver disabled"
+
+  # Verify
+  log "Current power settings:"
+  pmset -g | grep -E "sleep|standby|hibernatemode|womp|autorestart" | while read -r line; do
+    echo "    $line"
+  done
+}
+
+# =============================================================================
+# 3. PARSEC AUTO-LAUNCH
+# =============================================================================
+
+configure_parsec() {
+  section "Parsec Remote Desktop"
+
+  # Check if Parsec is installed
+  if [ -d "/Applications/Parsec.app" ]; then
+    ok "Parsec installed"
+  else
+    warn "Parsec not installed"
+    warn "Install from: https://parsec.app/downloads"
+    warn "Or: brew install --cask parsec"
+    return 0
+  fi
+
+  # Add Parsec to Login Items via osascript
+  log "Adding Parsec to Login Items..."
+  osascript -e 'tell application "System Events" to make login item at end with properties {path:"/Applications/Parsec.app", hidden:false}' 2>/dev/null || true
+  ok "Parsec added to Login Items (launches on boot)"
+
+  # Create a launchd agent for Parsec as a fallback
+  local PLIST_PATH="$HOME/Library/LaunchAgents/com.parsec.agent.plist"
+
+  if [ ! -f "$PLIST_PATH" ]; then
+    cat > "$PLIST_PATH" << 'PLIST_EOF'
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>com.parsec.agent</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>open</string>
+        <string>-a</string>
+        <string>Parsec</string>
+    </array>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>StandardOutPath</key>
+    <string>/dev/null</string>
+    <key>StandardErrorPath</key>
+    <string>/dev/null</string>
+</dict>
+</plist>
+PLIST_EOF
+    launchctl load "$PLIST_PATH" 2>/dev/null || true
+    ok "Parsec launchd agent installed (backup auto-launch)"
+  else
+    ok "Parsec launchd agent already exists"
+  fi
+}
+
+# =============================================================================
+# 4. SLACK WITH CDP (Chrome DevTools Protocol)
+# =============================================================================
+
+configure_slack_cdp() {
+  section "Slack with CDP (Huddle Support)"
+
+  if [ ! -d "/Applications/Slack.app" ]; then
+    warn "Slack not installed"
+    warn "Install: brew install --cask slack"
+    return 0
+  fi
+
+  ok "Slack installed"
+
+  # Remove Slack from Login Items (we manage it ourselves via boot-slack-cdp)
+  log "Ensuring Slack is NOT in Login Items (managed by launchd instead)..."
+  osascript -e 'tell application "System Events" to delete login item "Slack"' 2>/dev/null || true
+
+  # Install the boot-time Slack CDP launcher as a launchd agent
+  local PLIST_NAME="ai.maestro.slack-cdp.plist"
+  local PLIST_PATH="$HOME/Library/LaunchAgents/$PLIST_NAME"
+
+  cat > "$PLIST_PATH" << PLIST_EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>ai.maestro.slack-cdp</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>/bin/bash</string>
+        <string>${AGENT_DIR}/scripts/huddle/boot-slack-cdp.sh</string>
+    </array>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>StandardOutPath</key>
+    <string>${AGENT_DIR}/logs/huddle/boot-slack-cdp-stdout.log</string>
+    <key>StandardErrorPath</key>
+    <string>${AGENT_DIR}/logs/huddle/boot-slack-cdp-stderr.log</string>
+    <key>EnvironmentVariables</key>
+    <dict>
+        <key>PATH</key>
+        <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string>
+        <key>CDP_PORT</key>
+        <string>9222</string>
+    </dict>
+</dict>
+</plist>
+PLIST_EOF
+
+  launchctl unload "$PLIST_PATH" 2>/dev/null || true
+  launchctl load "$PLIST_PATH"
+  ok "Slack CDP launchd agent installed (launches with --remote-debugging-port on boot)"
+}
+
+# =============================================================================
+# 5. VIRTUAL AUDIO (BlackHole for Huddle Voice)
+# =============================================================================
+
+configure_audio() {
+  section "Virtual Audio (BlackHole)"
+
+  if [ -f "$AGENT_DIR/scripts/huddle/setup-audio.sh" ]; then
+    log "Running audio setup..."
+    bash "$AGENT_DIR/scripts/huddle/setup-audio.sh" --check 2>&1 | while read -r line; do
+      echo "    $line"
+    done
+
+    # If BlackHole is not installed, offer to install
+    if ! command -v SwitchAudioSource &>/dev/null || ! SwitchAudioSource -a 2>/dev/null | grep -q "BlackHole"; then
+      warn "BlackHole not installed — run: ./scripts/huddle/setup-audio.sh"
+    else
+      ok "BlackHole audio devices present"
+    fi
+  else
+    warn "Audio setup script not found at scripts/huddle/setup-audio.sh"
+  fi
+}
+
+# =============================================================================
+# 6. OTHER APP LAUNCHES
+# =============================================================================
+
+configure_app_launches() {
+  section "Application Auto-Launch"
+
+  # WhatsApp (if installed)
+  if [ -d "/Applications/WhatsApp.app" ]; then
+    osascript -e 'tell application "System Events" to make login item at end with properties {path:"/Applications/WhatsApp.app", hidden:true}' 2>/dev/null || true
+    ok "WhatsApp added to Login Items"
+  else
+    warn "WhatsApp not installed (optional — install if agent uses WhatsApp)"
+  fi
+
+  # Safari (for Gmail web access)
+  # Safari is always available on macOS, but we don't need it as a Login Item
+  # The poller uses IMAP directly, not the browser
+  log "Safari: not needed as Login Item (Gmail uses IMAP polling)"
+
+  # Ensure required directories exist
+  mkdir -p "$AGENT_DIR/logs/huddle"
+  mkdir -p "$AGENT_DIR/state/huddle"
+  ok "Log and state directories verified"
+}
+
+# =============================================================================
+# 7. ORCHESTRATOR AND SUBSYSTEMS ON BOOT
+# =============================================================================
+
+configure_boot_services() {
+  section "Boot-Time Services (Daemon + Pollers + Triggers)"
+
+  log "Verifying launchd agents are installed..."
+
+  local LAUNCH_AGENTS_DIR="$HOME/Library/LaunchAgents"
+  local EXPECTED_AGENTS=(
+    "ai.adaptic.*-daemon"
+    "ai.adaptic.*-poller"
+    "ai.adaptic.*-inbox-processor"
+    "ai.adaptic.*-backlog-executor"
+    "ai.adaptic.*-meeting-prep"
+    "ai.adaptic.*-meeting-action-capture"
+    "ai.adaptic.*-midday-sweep"
+  )
+
+  # Count installed agents
+  local installed_count
+  installed_count=$(ls "$LAUNCH_AGENTS_DIR"/ai.adaptic.*.plist 2>/dev/null | wc -l | tr -d ' ')
+
+  if [ "$installed_count" -gt 0 ]; then
+    ok "$installed_count launchd agents installed"
+
+    # Check which are loaded
+    local loaded_count
+    loaded_count=$(launchctl list 2>/dev/null | grep -c "ai.adaptic" || echo "0")
+    if [ "$loaded_count" -gt 0 ]; then
+      ok "$loaded_count agents currently loaded"
+    else
+      warn "Agents installed but none loaded — run: npm run init-agent"
+    fi
+  else
+    warn "No launchd agents found — run: npm run init-agent"
+  fi
+
+  # Check if the daemon is running
+  if launchctl list 2>/dev/null | grep -q "daemon"; then
+    ok "Main daemon is loaded"
+  else
+    warn "Main daemon not loaded — the orchestrator won't start on boot"
+    warn "Run: npm run init-agent to install all launchd agents"
+  fi
+
+  # Check Slack events server
+  if [ -f "$AGENT_DIR/state/locks/slack-events-server.pid" ]; then
+    local EVENTS_PID
+    EVENTS_PID=$(cat "$AGENT_DIR/state/locks/slack-events-server.pid")
+    if kill -0 "$EVENTS_PID" 2>/dev/null; then
+      ok "Slack events server running (PID $EVENTS_PID)"
+    else
+      warn "Slack events server PID file exists but process not running"
+    fi
+  else
+    warn "Slack events server not running — start with: npm run slack:events:start"
+  fi
+}
+
+# =============================================================================
+# 8. SYSTEM VERIFICATION
+# =============================================================================
+
+verify_all() {
+  section "System Verification"
+
+  local issues=0
+
+  # Check auto-login
+  local auto_login_user
+  auto_login_user=$(defaults read /Library/Preferences/com.apple.loginwindow autoLoginUser 2>/dev/null || echo "")
+  if [ -n "$auto_login_user" ]; then
+    ok "Auto-login: $auto_login_user"
+  else
+    fail "Auto-login: not configured"
+    issues=$((issues + 1))
+  fi
+
+  # Check sleep settings
+  local sleep_val
+  sleep_val=$(pmset -g | grep "^ sleep" | awk '{print $2}')
+  if [ "$sleep_val" = "0" ]; then
+    ok "System sleep: disabled"
+  else
+    fail "System sleep: $sleep_val minutes (should be 0)"
+    issues=$((issues + 1))
+  fi
+
+  # Check display sleep
+  local dsleep_val
+  dsleep_val=$(pmset -g | grep "displaysleep" | awk '{print $2}')
+  if [ "$dsleep_val" = "0" ]; then
+    ok "Display sleep: disabled"
+  else
+    fail "Display sleep: $dsleep_val minutes (should be 0)"
+    issues=$((issues + 1))
+  fi
+
+  # Check Parsec
+  if pgrep -x "parsecd" &>/dev/null; then
+    ok "Parsec: running"
+  elif [ -d "/Applications/Parsec.app" ]; then
+    warn "Parsec: installed but not running"
+  else
+    fail "Parsec: not installed"
+    issues=$((issues + 1))
+  fi
+
+  # Check Slack with CDP
+  if pgrep -x "Slack" &>/dev/null; then
+    if curl -s --connect-timeout 2 "http://localhost:9222/json/version" 2>/dev/null | python3 -c "import sys,json; json.load(sys.stdin)" 2>/dev/null; then
+      ok "Slack: running with CDP on port 9222"
+    else
+      warn "Slack: running but CDP not available (no huddle support)"
+    fi
+  else
+    fail "Slack: not running"
+    issues=$((issues + 1))
+  fi
+
+  # Check Node.js
+  if command -v node &>/dev/null; then
+    ok "Node.js: $(node --version)"
+  else
+    fail "Node.js: not installed"
+    issues=$((issues + 1))
+  fi
+
+  # Check Claude CLI
+  if command -v claude &>/dev/null; then
+    ok "Claude CLI: installed"
+  else
+    fail "Claude CLI: not installed"
+    issues=$((issues + 1))
+  fi
+
+  # Summary
+  echo ""
+  if [ "$issues" -eq 0 ]; then
+    ok "All checks passed"
+  else
+    fail "$issues issue(s) found — see above"
+  fi
+
+  return "$issues"
+}
+
+# =============================================================================
+# MAIN
+# =============================================================================
+
+main() {
+  echo ""
+  echo "╔══════════════════════════════════════════════════════════════╗"
+  echo "║        Maestro — Mac Mini Configuration                     ║"
+  echo "╠══════════════════════════════════════════════════════════════╣"
+  echo "║  Agent directory: $AGENT_DIR"
+  echo "║  Current user:    $CURRENT_USER"
+  echo "╚══════════════════════════════════════════════════════════════╝"
+
+  case "${1:-full}" in
+    --check|check)
+      verify_all
+      ;;
+    --apps-only|apps)
+      configure_parsec
+      configure_slack_cdp
+      configure_audio
+      configure_app_launches
+      configure_boot_services
+      ;;
+    --full|full|"")
+      configure_auto_login
+      configure_power_management
+      configure_parsec
+      configure_slack_cdp
+      configure_audio
+      configure_app_launches
+      configure_boot_services
+
+      section "Configuration Complete"
+      echo ""
+      log "Next steps:"
+      echo "  1. Reboot to test auto-login: sudo shutdown -r now"
+      echo "  2. After reboot, verify: ./scripts/setup/configure-macos.sh --check"
+      echo "  3. Configure Parsec account (first time only): open /Applications/Parsec.app"
+      echo "  4. Run agent setup: npm run init-agent"
+      echo "  5. Configure identity: claude \"/init-maestro\""
+      echo ""
+      ;;
+    *)
+      echo "Usage: $0 [--full|--check|--apps-only]"
+      echo ""
+      echo "  --full       Full configuration (requires sudo for auto-login and power)"
+      echo "  --check      Verify current configuration"
+      echo "  --apps-only  Configure apps and services only (no sudo needed)"
+      exit 1
+      ;;
+  esac
+}
+
+main "$@"