From 038851ef1a94352ee215b39b49448f05aff2c207 Mon Sep 17 00:00:00 2001 From: Peter Wagstaff Date: Thu, 7 May 2026 15:39:10 -0700 Subject: [PATCH 1/4] Extract enrollment into a function in demo.sh --- demo/demo.sh | 101 +++++++++++++++++---------------------------------- 1 file changed, 34 insertions(+), 67 deletions(-) diff --git a/demo/demo.sh b/demo/demo.sh index 4d58e12..4eca6d4 100755 --- a/demo/demo.sh +++ b/demo/demo.sh @@ -21,8 +21,6 @@ GATEWAY_CA="${AGENT_GATEWAY_DEMO_GATEWAY_CA:-$REPO_ROOT/certs/server-ca.pem}" MOCK_CA="${AGENT_GATEWAY_DEMO_MOCK_CA:-$REPO_ROOT/certs/mock-ca.pem}" SIDECAR_BIN="$REPO_ROOT/target/debug/agent_gateway_sidecar" GATEWAY_IMAGE="${AGENT_GATEWAY_DEMO_GATEWAY_IMAGE:-ghcr.io/sl5taskforce/agent-gateway:main}" -VERIFY_TIMEOUT_SECONDS="${AGENT_GATEWAY_DEMO_VERIFY_TIMEOUT_SECONDS:-120}" - export COMPOSE_PROJECT_NAME export AGENT_GATEWAY_DEMO_GATEWAY_IMAGE="$GATEWAY_IMAGE" @@ -109,42 +107,46 @@ state_dir() { printf '%s/%s\n' "$STATE_ROOT" "$HANDLE" } -print_verification_diagnostics() { - local sidecar_log - sidecar_log="$(state_dir)/sidecar.log" +enroll() { + demo_env=( + "AGENT_GATEWAY_DATABASE_URL=$DATABASE_URL" + "AGENT_GATEWAY_DEMO_GATEWAY=$GATEWAY" + "AGENT_GATEWAY_DEMO_GATEWAY_CA=$GATEWAY_CA" + "AGENT_GATEWAY_DEMO_MOCK_CA=$MOCK_CA" + "AGENT_GATEWAY_DEMO_SIDECAR_BIN=$SIDECAR_BIN" + "AGENT_GATEWAY_DEMO_STATE_DIR=$STATE_ROOT" + "AGENT_GATEWAY_TPM_USER_PIN=$USER_PIN" + "AGENT_GATEWAY_TPM_SO_PIN=$SO_PIN" + "AGENT_GATEWAY_RESET_TPM_STORE=false" + "CLAUDE_CODE_PROXY_RESOLVES_HOSTS=1" + "CURL_CA_BUNDLE=$MOCK_CA" + "NODE_EXTRA_CA_CERTS=$MOCK_CA" + "SSL_CERT_FILE=$MOCK_CA" + "TPM2_PKCS11_STORE=$TPM2_PKCS11_STORE" + "AGENT_GATEWAY_DEMO_DASHBOARD_URL=http://localhost:3000" + ) - echo "Check the gateway, sidecar, and mock service logs before retrying." >&2 - echo "Sidecar log: $sidecar_log" >&2 - if [[ -f "$sidecar_log" ]]; then - echo >&2 - echo "Recent sidecar log lines:" >&2 - tail -n 80 "$sidecar_log" >&2 || true - fi + echo "==> Registering demo principal $PRINCIPAL" + env "${demo_env[@]}" "$REPO_ROOT/registry-cli/register-principal-key.sh" "$PRINCIPAL" + + echo "==> Granting demo scopes" + env "${demo_env[@]}" "$REPO_ROOT/registry-cli/grant-principal-scope.sh" "$PRINCIPAL" docstore messaging api.anthropic.com + + echo "==> Creating demo agent $HANDLE" + env "${demo_env[@]}" "$SCRIPT_DIR/demo-agent.sh" create \ + --identity "$IDENTITY" \ + --handle "$HANDLE" \ + --grant docstore \ + --grant api.anthropic.com >/dev/null } -demo_env=( - "AGENT_GATEWAY_DATABASE_URL=$DATABASE_URL" - "AGENT_GATEWAY_DEMO_GATEWAY=$GATEWAY" - "AGENT_GATEWAY_DEMO_GATEWAY_CA=$GATEWAY_CA" - "AGENT_GATEWAY_DEMO_MOCK_CA=$MOCK_CA" - "AGENT_GATEWAY_DEMO_SIDECAR_BIN=$SIDECAR_BIN" - "AGENT_GATEWAY_DEMO_STATE_DIR=$STATE_ROOT" - "AGENT_GATEWAY_TPM_USER_PIN=$USER_PIN" - "AGENT_GATEWAY_TPM_SO_PIN=$SO_PIN" - "AGENT_GATEWAY_RESET_TPM_STORE=false" - "CLAUDE_CODE_PROXY_RESOLVES_HOSTS=1" - "CURL_CA_BUNDLE=$MOCK_CA" - "NODE_EXTRA_CA_CERTS=$MOCK_CA" - "SSL_CERT_FILE=$MOCK_CA" - "TPM2_PKCS11_STORE=$TPM2_PKCS11_STORE" -) +# ── Main ────────────────────────────────────────────────────────────────────── cmd_setup() { select_compose require_cmd cargo require_cmd openssl require_cmd psql - require_cmd timeout cd "$REPO_ROOT" @@ -166,51 +168,16 @@ cmd_setup() { wait_for_postgres apply_migrations - echo "==> Starting gateway" + echo "==> Starting gateway, otel-collector, and dashboard" compose up -d --force-recreate gateway otel-collector dashboard - echo "==> Registering demo principal $PRINCIPAL" - env "${demo_env[@]}" "$REPO_ROOT/registry-cli/register-principal-key.sh" "$PRINCIPAL" - - echo "==> Granting demo scopes" - env "${demo_env[@]}" "$REPO_ROOT/registry-cli/grant-principal-scope.sh" "$PRINCIPAL" docstore messaging api.anthropic.com - - echo "==> Creating demo agent $HANDLE" - env "${demo_env[@]}" "$SCRIPT_DIR/demo-agent.sh" create \ - --identity "$IDENTITY" \ - --handle "$HANDLE" \ - --grant docstore \ - --grant api.anthropic.com \ - --grant messaging >/dev/null - - echo "==> Verifying Claude Code HTTP requests through the gateway" - if ! timeout "$VERIFY_TIMEOUT_SECONDS" env "${demo_env[@]}" "$SCRIPT_DIR/demo-agent.sh" prompt "$HANDLE" --prompt \ - "Access https://docstore/health using curl and return only the raw response body. -Return only the raw response body."; then - cat >&2 < Date: Thu, 7 May 2026 15:39:37 -0700 Subject: [PATCH 2/4] Add agent context via --system-prompt in demo-agent.sh --- demo/demo-agent.sh | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/demo/demo-agent.sh b/demo/demo-agent.sh index 1f220fd..bcd5ae0 100755 --- a/demo/demo-agent.sh +++ b/demo/demo-agent.sh @@ -476,6 +476,17 @@ run_prompt() { mkdir -p "$work_dir" local claude_args=( --allowedTools "Bash(curl *)" + --system-prompt "You have access to two internal services via HTTPS: + +- docstore (https://docstore) - document storage + - GET /health - health check + - GET /documents - list available documents + +- messaging (https://messaging) - internal messaging (read-only) + - GET /health - health check + - GET /messages - list recent messages + +Use the Bash tool with curl to interact with these services." ) local first_prompt=false From 174ff2a768d37cfe4f485efc6f225053ef7bffe1 Mon Sep 17 00:00:00 2001 From: Peter Wagstaff Date: Thu, 7 May 2026 15:39:40 -0700 Subject: [PATCH 3/4] Emit agent lifecycle events to dashboard --- demo/demo-agent.sh | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/demo/demo-agent.sh b/demo/demo-agent.sh index bcd5ae0..eaf06fc 100755 --- a/demo/demo-agent.sh +++ b/demo/demo-agent.sh @@ -17,6 +17,7 @@ SWTPM_HOST="127.0.0.1" TPM2_PKCS11_STORE="${TPM2_PKCS11_STORE:-$HOME/.tpm2_pkcs11}" TOKEN_LABEL="${AGENT_GATEWAY_TPM_TOKEN_LABEL:-agent-gateway}" USER_PIN="${AGENT_GATEWAY_TPM_USER_PIN:-}" +DASHBOARD_URL="${AGENT_GATEWAY_DEMO_DASHBOARD_URL:-http://localhost:3000}" export TPM2_PKCS11_STORE usage() { @@ -549,6 +550,11 @@ cmd_create() { grant_permissions start_sidecar "$dir" + curl -sf --max-time 2 -X POST "$DASHBOARD_URL/api/events" \ + -H 'Content-Type: application/json' \ + -d "{\"event_type\":\"agent.created\",\"source\":\"agent-platform\",\"attributes\":{\"user.id\":\"$PRINCIPAL\",\"agent.id\":\"$IDENTITY\"}}" \ + >/dev/null || true + echo "$HANDLE" } @@ -592,6 +598,10 @@ cmd_prompt() { done [[ -n "$PROMPT" ]] || { echo "error: prompt requires --prompt" >&2; exit 2; } + curl -sf --max-time 2 -X POST "$DASHBOARD_URL/api/events" \ + -H 'Content-Type: application/json' \ + -d "{\"event_type\":\"agent.prompted\",\"source\":\"agent-platform\",\"attributes\":{\"user.id\":\"$PRINCIPAL\",\"agent.id\":\"$IDENTITY\"}}" \ + >/dev/null || true ensure_runtime "$dir" [[ -f "$DEFAULT_MOCK_CA" ]] || { echo "error: mock service CA file not found: $DEFAULT_MOCK_CA" >&2 From f4d2d3401fd28f1f845db0af4e7515b3da6ad3ec Mon Sep 17 00:00:00 2001 From: Peter Wagstaff Date: Thu, 7 May 2026 15:39:42 -0700 Subject: [PATCH 4/4] Remove otel-collector batch processor for real-time span forwarding --- otel-collector.yaml | 6 ------ 1 file changed, 6 deletions(-) diff --git a/otel-collector.yaml b/otel-collector.yaml index 19b3769..915a4ef 100644 --- a/otel-collector.yaml +++ b/otel-collector.yaml @@ -4,11 +4,6 @@ receivers: grpc: endpoint: 0.0.0.0:4317 -processors: - batch: - timeout: 1s - send_batch_size: 50 - exporters: otlphttp/dashboard: endpoint: http://dashboard:3000 @@ -20,7 +15,6 @@ service: pipelines: traces: receivers: [otlp] - processors: [batch] exporters: [otlphttp/dashboard] telemetry: