100 lines
4.3 KiB
Markdown
100 lines
4.3 KiB
Markdown
# MeshCentral ↔ OpenClaw Bridge — Resume Handoff
|
|
|
|
**Checkpoint:** 2026-09-03 18:25 EDT
|
|
**Owner:** Rob / Clawdia
|
|
**Project state:** Read-only inventory path verified live. Local changes are uncommitted and require review before any push or deployment.
|
|
|
|
## Current verified result
|
|
|
|
- Authenticated WSS connection to `mesh.ledrew.me`: passed.
|
|
- `meshes` inventory request: passed; `Servers` group found.
|
|
- `nodes` request for `Servers`: passed; PVE3 found.
|
|
- Real adapter end-to-end check: passed; 3 groups, 5 `Servers` devices, PVE3 mapped as online.
|
|
- Local gate: 91 tests passed, TypeScript build passed, ESLint passed.
|
|
- No commands, diagnostics, file transfer, power operations, administration, or state changes were performed.
|
|
|
|
## Transport decision
|
|
|
|
MeshCentral 1.2.5 sends unsolicited `serverinfo`, `userinfo`, and event messages after login. Its `meshes` response omits `responseid`, and its `nodes` response is grouped by mesh ID. The project now uses `upstream-transport.ts`, which follows the working upstream `meshctrl.js` connection timing and response handling while retaining typed validation at the bridge boundary.
|
|
|
|
## What was completed in the resumed work session
|
|
|
|
1. Repaired the TypeScript regression in `implementation/src/adapter.ts` where a literal `\\n` had been inserted into source line 316.
|
|
2. Removed two unused-variable lint failures exposed after the repair.
|
|
3. Added protocol validation to `implementation/src/meshctrl-client.ts`:
|
|
- bounded response size using `MAX_RESPONSE_SIZE`
|
|
- JSON/protocol envelope validation
|
|
- action-specific response schema validation using Zod
|
|
- request/response action matching
|
|
- generic MeshCentral request errors instead of exposing server error text
|
|
4. Hardened credential handling:
|
|
- credentials are validated before encoding
|
|
- malformed credentials are rejected
|
|
- credential metadata is redacted
|
|
- no password/token is written to project files or logs
|
|
5. Corrected real-adapter device and group allowlist filtering in `implementation/src/adapter.ts`.
|
|
6. Added `implementation/src/__tests__/meshctrl-client.test.ts` covering:
|
|
- valid and malformed credentials
|
|
- redacted credential metadata
|
|
- malformed and oversized responses
|
|
- response action mismatches
|
|
- invalid node response data
|
|
7. Exported `validateResponseForAction` from `implementation/src/index.ts`.
|
|
8. Updated `implementation/README.md` to describe the real adapter accurately and clearly mark it as not live-approved; diagnostics remain mock-only.
|
|
|
|
## Verification at checkpoint
|
|
|
|
Run from `implementation/`:
|
|
|
|
```bash
|
|
npm test -- --runInBand
|
|
npm run build
|
|
npm run lint
|
|
```
|
|
|
|
Last successful result:
|
|
|
|
- 9 test suites passed
|
|
- 56 tests passed
|
|
- TypeScript build passed
|
|
- ESLint passed
|
|
- `tsc --noEmit` passed
|
|
|
|
## Current phase
|
|
|
|
Read-only inventory MVP verified. Diagnostics remain mock-only and state-changing actions remain disabled.
|
|
|
|
## Remaining work, in order
|
|
|
|
1. Review the uncommitted diff and commit on a feature branch.
|
|
2. Add/complete transport-level regression tests for bootstrap messages and grouped node responses.
|
|
3. Reconcile the final implementation with the security review and deployment documentation.
|
|
4. Keep diagnostics mock-only; do not add remote commands or state-changing actions until separately designed and reviewed.
|
|
|
|
## Live-test facts already documented
|
|
|
|
See `DEPLOYMENT.md`. It records the reported MeshCentral host/version, the dedicated integration account name, the intended PVE3 test target, secret-handling rules, prerequisites, and the explicit approval checkpoint. The password is intentionally not stored in this project.
|
|
|
|
## Safety constraints
|
|
|
|
- Do not connect to MeshCentral without Rob's explicit go-ahead in the same step.
|
|
- Do not use or store the integration password in source, prompts, command lines, logs, or this handoff.
|
|
- Do not execute remote commands or state-changing actions.
|
|
- Do not modify infrastructure.
|
|
- PVE1/PVE2 production cluster remains off-limits for testing.
|
|
|
|
## Scheduler state
|
|
|
|
The `meshcentral-project-progress` cron job is disabled/paused at Rob's request. Re-enable it only when Rob asks.
|
|
|
|
## Suggested resume procedure
|
|
|
|
```bash
|
|
cd /home/ledadmin/projects/meshcentral-openclaw-bridge/implementation
|
|
npm test -- --runInBand
|
|
npm run build
|
|
npm run lint
|
|
```
|
|
|
|
Then inspect this file, `TODO.md`, `SECURITY.md`, `DEPLOYMENT.md`, and `review/LIVE-ADAPTER-REVIEW.md` before continuing with the next remaining item.
|