@cohortapp/agent-sdk 2.11.15 → 2.13.0

package/scripts/setup/configure-macos.sh

@@ -11,11 +11,21 @@
 #   5. Sets up BlackHole virtual audio for voice integration
 #   6. Configures Login Items for all required apps
 #   7. Installs launchd agents for boot-time service startup
+#   8. Retires the legacy Terminal.app boot-claude-session job (the front-door
+#      session is now the launchd `ai.maestro.<first>-session` supervisor job
+#      that scripts/local-triggers/generate-plists.sh emits)
+#   9. `--tailscale-ssh`: advertises Tailscale SSH + turns Remote Login on so
+#      an operator can reach the seat without a console (audit F4)
 #
 # Usage:
 #   sudo ./scripts/setup/configure-macos.sh           # Full configuration
 #   sudo ./scripts/setup/configure-macos.sh --check    # Verify current config
 #   ./scripts/setup/configure-macos.sh --apps-only     # Non-sudo app setup only
+#   ./scripts/setup/configure-macos.sh --tailscale-ssh # Operator SSH over the tailnet
+#
+# Testing seam: `MAESTRO_CONFIGURE_MACOS_NO_MAIN=1 source configure-macos.sh`
+# defines the functions without running main(), so configure-macos.test.mjs can
+# exercise one function at a time against stub binaries.
 #
 # IMPORTANT: Some steps require sudo (auto-login, power management).
 #            Run with sudo for full configuration.
@@ -335,63 +345,207 @@ configure_app_launches() {
   done
   ok "Log and state directories verified (owned by $real_user)"
 
-  # --- Claude Code boot session (opens Terminal with interactive claude) ------
-  local BOOT_SCRIPT="$AGENT_DIR/scripts/setup/boot-claude-session.sh"
-  if [ -f "$BOOT_SCRIPT" ]; then
-    chmod +x "$BOOT_SCRIPT"
+  # --- Legacy Terminal.app boot session: retired ------------------------------
+  # The front-door session is now a launchd KeepAlive job
+  # (ai.maestro.<first>-session → scripts/session/supervisor.sh) generated by
+  # scripts/local-triggers/generate-plists.sh. Unload + remove the old job so
+  # two sessions can never race on the same machine.
+  retire_boot_claude_session
+}
 
-    local PLIST_NAME="ai.maestro.boot-claude-session"
-    local PLIST_PATH="$real_home/Library/LaunchAgents/${PLIST_NAME}.plist"
-    local real_home
-    real_home=$(eval echo "~$real_user")
+# =============================================================================
+# 6b. RETIRE THE LEGACY boot-claude-session LAUNCHD JOB
+# =============================================================================
+#
+# F15: the Terminal.app boot script had no KeepAlive, no lock, no headless mode and
+# needed Terminal.app. It is replaced by the supervisor job. This is idempotent:
+# absent plist → nothing to do, exit 0. Runs as the real user when invoked
+# under sudo so launchctl addresses the right (gui) domain.
 
-    # Use the directory from which configure-macos.sh was invoked
-    local boot_agent_dir="$CALLER_DIR"
+retire_boot_claude_session() {
+  local real_user="${SUDO_USER:-$CURRENT_USER}"
+  # Under sudo the plist lives in the invoking user's home; otherwise $HOME is
+  # authoritative (a `~user` expansion would bypass an overridden HOME).
+  local real_home="$HOME"
+  if [ "$(id -u)" -eq 0 ] && [ -n "${SUDO_USER:-}" ]; then
+    real_home=$(eval echo "~$SUDO_USER")
+  fi
+  local LABEL="ai.maestro.boot-claude-session"
+  local PLIST_PATH="$real_home/Library/LaunchAgents/${LABEL}.plist"
 
-    cat > "$PLIST_PATH" << PLIST_EOF
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-    <key>Label</key>
-    <string>${PLIST_NAME}</string>
-    <key>ProgramArguments</key>
-    <array>
-        <string>/bin/bash</string>
-        <string>${BOOT_SCRIPT}</string>
-        <string>${boot_agent_dir}</string>
-    </array>
-    <key>RunAtLoad</key>
-    <true/>
-    <key>StandardOutPath</key>
-    <string>${AGENT_DIR}/logs/watchdog/boot-session-stdout.log</string>
-    <key>StandardErrorPath</key>
-    <string>${AGENT_DIR}/logs/watchdog/boot-session-stderr.log</string>
-    <key>EnvironmentVariables</key>
-    <dict>
-        <key>PATH</key>
-        <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:${real_home}/.local/bin</string>
-        <key>HOME</key>
-        <string>${real_home}</string>
-    </dict>
-</dict>
-</plist>
-PLIST_EOF
+  if [ ! -f "$PLIST_PATH" ]; then
+    log "Legacy $LABEL job not present — nothing to retire"
+    return 0
+  fi
+
+  if [ "$(id -u)" -eq 0 ] && [ "$real_user" != "root" ]; then
+    su "$real_user" -c "launchctl unload '$PLIST_PATH' 2>/dev/null || launchctl bootout gui/\$(id -u)/$LABEL 2>/dev/null" 2>/dev/null || true
+  else
+    launchctl unload "$PLIST_PATH" 2>/dev/null || launchctl bootout "gui/$(id -u)/$LABEL" 2>/dev/null || true
+  fi
+  rm -f "$PLIST_PATH"
+  ok "Retired legacy $LABEL job (replaced by the ai.maestro.<first>-session supervisor)"
+}
 
-    chown "$real_user:staff" "$PLIST_PATH" 2>/dev/null || true
+# =============================================================================
+# 6c. TAILSCALE SSH (operator access without a console)
+# =============================================================================
+#
+# Audit F4: no operator could reach any of 41 seats over SSH. Tailscale SSH
+# (`tailscale set --ssh`) advertises the host to the tailnet; macOS still gates
+# inbound SSH behind Remote Login (`systemsetup -setremotelogin on`, root).
+# Neither is reachable until the tailnet ACL grants an `ssh` rule, which only a
+# tailnet admin can write — hence the reminder printed at the end.
+#
+# MAESTRO_TAILSCALE_BIN overrides the CLI path (tests; non-standard installs).
 
-    # Load as the real user
-    if [ "$(id -u)" -eq 0 ]; then
-      su "$real_user" -c "launchctl unload '$PLIST_PATH' 2>/dev/null; launchctl load '$PLIST_PATH'" 2>/dev/null || true
+resolve_tailscale_bin() {
+  if [ -n "${MAESTRO_TAILSCALE_BIN:-}" ]; then
+    [ -x "$MAESTRO_TAILSCALE_BIN" ] && echo "$MAESTRO_TAILSCALE_BIN"
+    return 0
+  fi
+  local c
+  for c in "$(command -v tailscale 2>/dev/null)" \
+           /Applications/Tailscale.app/Contents/MacOS/Tailscale \
+           /usr/local/bin/tailscale /opt/homebrew/bin/tailscale; do
+    if [ -n "$c" ] && [ -x "$c" ]; then echo "$c"; return 0; fi
+  done
+  return 0
+}
+
+# Which Tailscale is this? The Tailscale SSH server ships ONLY in the
+# open-source `tailscaled` variant; Tailscale.app (Mac App Store / standalone
+# GUI) cannot honour RunSSH no matter what `tailscale set --ssh` says. The
+# fleet runs the GUI app, whose /usr/local/bin/tailscale is a two-line sh shim
+# onto /Applications/Tailscale.app/Contents/MacOS/tailscale.
+#   gui          — Tailscale.app (path under the bundle, or the shim naming it)
+#   open-source  — a tailscaled is installed next to the CLI
+#   unknown      — cannot tell; proceed as before
+# MAESTRO_TAILSCALED_BIN overrides the daemon path (tests; non-standard installs).
+tailscale_variant() {
+  local TS="$1" c
+  [ -z "$TS" ] && { echo "unknown"; return 0; }
+  case "$TS" in */Tailscale.app/*) echo "gui"; return 0 ;; esac
+  if head -c 512 "$TS" 2>/dev/null | grep -aq "Tailscale.app"; then echo "gui"; return 0; fi
+  for c in "${MAESTRO_TAILSCALED_BIN:-}" "$(command -v tailscaled 2>/dev/null)" \
+           /opt/homebrew/bin/tailscaled /usr/local/bin/tailscaled \
+           /opt/homebrew/opt/tailscale/bin/tailscaled; do
+    if [ -n "$c" ] && [ -x "$c" ]; then echo "open-source"; return 0; fi
+  done
+  echo "unknown"
+}
+
+# The seat's tailnet IPv4, for the sshd-over-tailnet fallback line. Empty when unknown.
+tailscale_ip4() {
+  local TS="$1"
+  [ -n "$TS" ] && "$TS" ip -4 2>/dev/null | head -1 || true
+}
+
+print_tailscale_gui_remedy() { # $1 = tailscale bin
+  local ip
+  ip="$(tailscale_ip4 "$1")"
+  warn "Tailscale SSH is NOT available on Tailscale.app (GUI): only the open-source tailscaled carries the SSH server."
+  log "Two ways to reach this seat:"
+  log "  1. Switch to the open-source variant (Tailscale SSH):"
+  log "       quit Tailscale.app, then:  brew install tailscale && sudo brew services start tailscale"
+  log "       sign in:  tailscale up --ssh   — then re-run: ./scripts/setup/configure-macos.sh --tailscale-ssh"
+  log "  2. Keep the GUI app and use Remote Login (sshd) over the tailnet IP, enabled below:"
+  log "       ssh $(whoami)@${ip:-<tailnet-ip>}   (the operator's key must be in ~/.ssh/authorized_keys)"
+}
+
+print_tailscale_acl_reminder() {
+  echo ""
+  log "Tailnet ACL reminder — SSH is advertised but NOT reachable until an admin"
+  log "adds an ssh rule at https://login.tailscale.com/admin/acls, e.g.:"
+  echo '    "ssh": [{'
+  echo '      "action": "check",'
+  echo '      "src":    ["autogroup:admin"],'
+  echo '      "dst":    ["autogroup:self", "tag:agent-seat"],'
+  echo '      "users":  ["autogroup:nonroot"]'
+  echo '    }]'
+  log "Then from an operator machine: tailscale ssh $(whoami)@$(hostname -s 2>/dev/null || hostname)"
+}
+
+configure_tailscale_ssh() {
+  section "Tailscale SSH (operator access)"
+
+  local TS
+  TS="$(resolve_tailscale_bin)"
+  if [ -z "$TS" ]; then
+    fail "tailscale CLI not found — install Tailscale (brew install --cask tailscale, sign in), then re-run --tailscale-ssh"
+    return 1
+  fi
+  ok "tailscale CLI: $TS"
+
+  local variant
+  variant="$(tailscale_variant "$TS")"
+  if [ "$variant" = "gui" ]; then
+    print_tailscale_gui_remedy "$TS"
+  elif "$TS" set --ssh; then
+    ok "Tailscale SSH advertised (tailscale set --ssh)"
+  else
+    warn "tailscale set --ssh failed — is the node up and signed in? Check: $TS status"
+  fi
+
+  # Remote Login (sshd). systemsetup needs root; under sudo -n a missing
+  # credential fails fast instead of prompting from an unattended run.
+  if [ "$(id -u)" -eq 0 ]; then
+    systemsetup -setremotelogin on >/dev/null 2>&1 && ok "Remote Login enabled (sshd)" \
+      || warn "systemsetup -setremotelogin on failed — enable Remote Login in System Settings > General > Sharing"
+  else
+    if sudo -n systemsetup -setremotelogin on >/dev/null 2>&1; then
+      ok "Remote Login enabled (sshd)"
     else
-      launchctl unload "$PLIST_PATH" 2>/dev/null || true
-      launchctl load "$PLIST_PATH" 2>/dev/null || true
+      warn "Remote Login needs sudo: run  sudo systemsetup -setremotelogin on"
     fi
+  fi
 
-    ok "Claude Code boot session agent installed (opens Terminal + claude on login)"
+  if [ "$variant" = "gui" ]; then
+    log "Tailnet ACL reminder does not apply until Tailscale SSH is available on this seat."
   else
-    warn "Boot session script not found at $BOOT_SCRIPT"
+    print_tailscale_acl_reminder
   fi
+  return 0
+}
+
+# --check helpers: "on" / "off" / "unavailable" / "unknown" for each half of
+# operator access. "unavailable" = the GUI app, where RunSSH can never be true.
+tailscale_ssh_state() {
+  local TS
+  TS="$(resolve_tailscale_bin)"
+  [ -z "$TS" ] && { echo "unknown"; return 0; }
+  local prefs
+  prefs="$("$TS" debug prefs 2>/dev/null || true)"
+  if printf '%s' "$prefs" | grep -Eq '"RunSSH":[[:space:]]*true'; then echo "on"
+  elif [ "$(tailscale_variant "$TS")" = "gui" ]; then echo "unavailable"
+  elif printf '%s' "$prefs" | grep -Eq '"RunSSH":[[:space:]]*false'; then echo "off"
+  else echo "unknown"; fi
+}
+
+# `launchctl list` in the CALLER's gui domain. Under `sudo … --check` the
+# shell is root, whose `launchctl list` cannot see gui/<uid> jobs — every
+# ai.maestro.* agent would read as "not loaded" on a healthy seat. As root
+# with SUDO_USER set, ask launchd on that user's behalf.
+gui_launchctl_list() {
+  if [ "$(id -u)" -eq 0 ] && [ -n "${SUDO_USER:-}" ]; then
+    launchctl asuser "$(id -u "$SUDO_USER")" launchctl list 2>/dev/null
+  else
+    launchctl list 2>/dev/null
+  fi
+}
+
+remote_login_state() {
+  local out
+  if [ "$(id -u)" -eq 0 ]; then
+    out="$(systemsetup -getremotelogin 2>/dev/null || true)"
+  else
+    out="$(sudo -n systemsetup -getremotelogin 2>/dev/null || true)"
+  fi
+  case "$out" in
+    *On*|*on*) echo "on" ;;
+    *Off*|*off*) echo "off" ;;
+    *) echo "unknown" ;;
+  esac
 }
 
 # =============================================================================
@@ -470,7 +624,7 @@ configure_boot_services() {
 
     # Check which are loaded
     local loaded_count
-    loaded_count=$(launchctl list 2>/dev/null | grep -cE 'ai\.(maestro|adaptic)' || true)
+    loaded_count=$(gui_launchctl_list | grep -cE 'ai\.(maestro|adaptic)' || true)
     if [ "$loaded_count" -gt 0 ]; then
       ok "$loaded_count agents currently loaded"
     else
@@ -481,7 +635,7 @@ configure_boot_services() {
   fi
 
   # Check if the daemon is running
-  if launchctl list 2>/dev/null | grep -q "daemon"; then
+  if gui_launchctl_list | grep -q "daemon"; then
     ok "Main daemon is loaded"
   else
     warn "Main daemon not loaded — the orchestrator won't start on boot"
@@ -580,7 +734,7 @@ verify_all() {
   fi
 
   # Check memory watchdog
-  if launchctl list 2>/dev/null | grep -q "ai.maestro.memory-watchdog"; then
+  if gui_launchctl_list | grep -q "ai.maestro.memory-watchdog"; then
     ok "Memory watchdog: running"
   elif [ -f "$HOME/Library/LaunchAgents/ai.maestro.memory-watchdog.plist" ]; then
     warn "Memory watchdog: installed but not loaded"
@@ -603,6 +757,40 @@ verify_all() {
     warn "Heartbeat: no heartbeat file found"
   fi
 
+  # Front-door session job (ai.maestro.<first>-session, KeepAlive)
+  if gui_launchctl_list | grep -Eq 'ai\.maestro\.[^[:space:]]+-session$'; then
+    ok "Front-door session job: loaded"
+  elif ls "$HOME"/Library/LaunchAgents/ai.maestro.*-session.plist >/dev/null 2>&1; then
+    warn "Front-door session job: installed but not loaded — maestro session start"
+  else
+    warn "Front-door session job: not installed — run: npm run init-agent"
+  fi
+  if [ -f "$HOME/Library/LaunchAgents/ai.maestro.boot-claude-session.plist" ]; then
+    warn "Legacy boot-claude-session job still present — re-run this script to retire it"
+  fi
+
+  # Operator access over the tailnet (audit F4): both halves must be on.
+  local ts_state rl_state
+  ts_state="$(tailscale_ssh_state)"
+  rl_state="$(remote_login_state)"
+  case "$ts_state" in
+    on)  ok "Tailscale SSH: on (advertised)" ;;
+    off) fail "Tailscale SSH: off — run: ./scripts/setup/configure-macos.sh --tailscale-ssh"; issues=$((issues + 1)) ;;
+    unavailable)
+      if [ "$rl_state" = "on" ]; then
+        warn "Tailscale SSH: unavailable on Tailscale.app (GUI) — Remote Login over the tailnet IP is the access path; for Tailscale SSH: brew install tailscale (open-source tailscaled)"
+      else
+        fail "Tailscale SSH: unavailable on Tailscale.app (GUI) and Remote Login is off — run: sudo ./scripts/setup/configure-macos.sh --tailscale-ssh (or brew install tailscale for the open-source tailscaled)"
+        issues=$((issues + 1))
+      fi ;;
+    *)   warn "Tailscale SSH: unknown (tailscale CLI missing or node not up)" ;;
+  esac
+  case "$rl_state" in
+    on)  ok "Remote Login: on (sshd)" ;;
+    off) fail "Remote Login: off — run: sudo ./scripts/setup/configure-macos.sh --tailscale-ssh"; issues=$((issues + 1)) ;;
+    *)   warn "Remote Login: unknown (needs sudo to read: sudo systemsetup -getremotelogin)" ;;
+  esac
+
   # Summary
   echo ""
   if [ "$issues" -eq 0 ]; then
@@ -632,6 +820,9 @@ main() {
     --check|check)
       verify_all
       ;;
+    --tailscale-ssh|tailscale-ssh)
+      configure_tailscale_ssh
+      ;;
     --apps-only|apps)
       configure_parsec
       configure_slack_cdp
@@ -661,14 +852,18 @@ main() {
       echo ""
       ;;
     *)
-      echo "Usage: $0 [--full|--check|--apps-only]"
+      echo "Usage: $0 [--full|--check|--apps-only|--tailscale-ssh]"
       echo ""
-      echo "  --full       Full configuration (requires sudo for auto-login and power)"
-      echo "  --check      Verify current configuration"
-      echo "  --apps-only  Configure apps and services only (no sudo needed)"
+      echo "  --full           Full configuration (requires sudo for auto-login and power)"
+      echo "  --check          Verify current configuration"
+      echo "  --apps-only      Configure apps and services only (no sudo needed)"
+      echo "  --tailscale-ssh  Advertise Tailscale SSH + enable Remote Login (operator access)"
       exit 1
       ;;
   esac
 }
 
-main "$@"
+# Sourcing seam for tests: define everything, run nothing.
+if [ "${MAESTRO_CONFIGURE_MACOS_NO_MAIN:-0}" != "1" ]; then
+  main "$@"
+fi