bootstrap
Adom Hydrogen (macOS / Lima)
Public Made by Adomby adom
The macOS platform layer for Adom Hydrogen.
← Commit history
Publish 0.1.8
5 files changed
+143−8
README.md+2−1@@ -64,8 +64,9 @@ layer split **13 mixed** skills into `<name>-windows` companions (e.g. stays in `hd-bootstrap`, the Windows half drops into `hd-windows-bootstrap`. This layer carries the parallel **macOS halves** in `skills/<name>-mac/`. -**Companions authored (10):**+**Companions authored (11):** - `hd-api-mac` — `adom-host` gateway, `~/.adom/hd-control-url` discovery, vz-no-loopback, `/workspace/*` (nspawn) endpoints (mirror of `hd-api-windows`' `/wsl/*` tables).+- `hd-api-key-mac` — diagnose/repair the injected `/var/run/adom/api-key` session token (adom-cli 401s, tmpfs wipe on machine reboot, pre-0.1.148 post-auth gap): pull via `GET /auth-token`, prompt the user to reauthorize, or trigger the `inject-api-key` setup step. - `hd-notifications-mac` — Notification Center toasts + emergency Dock-bounce + the Notifications grant (mirror of `hd-notifications-windows`' WinRT/AUMID). - `hd-recording-mac` — the native recorder is `#[cfg(windows)]`, so on macOS recording is in-app getDisplayMedia / pup / AD relay; ScreenCaptureKit native recorder **not yet built** (honest gap). Screen Recording TCC. - `hd-screen-lock-mac` — IOKit `IOPMAssertionCreateWithName`/`PreventUserIdleDisplaySleep`, `pmset -g assertions`, `caffeinate` (vs `SetThreadExecutionState`).
package.json+3−3@@ -4,7 +4,7 @@ "type": "bootstrap", "title": "Hydrogen Desktop (macOS / Lima)", "brief": "The macOS platform layer for Hydrogen Desktop.",- "version": "0.1.7",+ "version": "0.1.8", "description": "The macOS platform layer for Hydrogen Desktop, where the workspace runs in a Lima Ubuntu VM hosting the Adom-Workspace systemd-nspawn machine. Depends on adom/hd-bootstrap (the platform-generic HD layer) and adds everything specific to the Lima/nspawn runtime: the container/networking/ports/setup/topology/volume/workspace-lifecycle hd-* skills (the macOS-runtime bucket), the in-machine workspace-updater daemon, and the macOS code-server workbench seed. Sibling layers adom/hd-windows-bootstrap (WSL2) and adom/hd-ubuntu-bootstrap depend on the same adom/hd-bootstrap. This is the package the golden Lima image installs.", "org": "adom", "tags": [@@ -36,7 +36,7 @@ "type": "image", "path": "screenshots/hero-v3.png" },- "discovery_pitch": "The macOS platform layer for Hydrogen Desktop \u2014 the Lima/nspawn workspace runtime plus every mac-specific hd-* skill.",+ "discovery_pitch": "The macOS platform layer for Hydrogen Desktop — the Lima/nspawn workspace runtime plus every mac-specific hd-* skill.", "discovery_triggers": [ "hydrogen desktop mac", "hd on macos",@@ -68,4 +68,4 @@ "prompt": "is my Lima workspace machine healthy" } ]-}+}
page.json+35−4@@ -3,8 +3,8 @@ "type": "bootstrap", "slug": "hd-mac-bootstrap", "title": "Hydrogen Desktop (macOS / Lima)",- "brief": "The macOS platform layer for Hydrogen Desktop \u2014 converges a Lima/nspawn workspace to the HD-on-Mac runtime.",- "version": "0.1.7",+ "brief": "The macOS platform layer for Hydrogen Desktop.",+ "version": "0.1.8", "license": "proprietary", "visibility": "public", "metadata": {@@ -16,7 +16,7 @@ "type": "image", "path": "screenshots/hero-v3.png" },- "discovery_pitch": "The macOS platform layer for Hydrogen Desktop \u2014 the Lima/nspawn workspace runtime plus every mac-specific hd-* skill.",+ "discovery_pitch": "The macOS platform layer for Hydrogen Desktop — the Lima/nspawn workspace runtime plus every mac-specific hd-* skill.", "discovery_triggers": [ "hydrogen desktop mac", "hd on macos",@@ -47,5 +47,36 @@ "label": "Workspace status", "prompt": "is my Lima workspace machine healthy" }- ]+ ],+ "description": "The macOS platform layer for Hydrogen Desktop, where the workspace runs in a Lima Ubuntu VM hosting the Adom-Workspace systemd-nspawn machine. Depends on adom/hd-bootstrap (the platform-generic HD layer) and adds everything specific to the Lima/nspawn runtime: the container/networking/ports/setup/topology/volume/workspace-lifecycle hd-* skills (the macOS-runtime bucket), the in-machine workspace-updater daemon, and the macOS code-server workbench seed. Sibling layers adom/hd-windows-bootstrap (WSL2) and adom/hd-ubuntu-bootstrap depend on the same adom/hd-bootstrap. This is the package the golden Lima image installs.",+ "org": "adom",+ "tags": [+ "bootstrap",+ "hydrogen-desktop",+ "hd",+ "macos",+ "mac",+ "lima",+ "nspawn"+ ],+ "needs_sudo": false,+ "scripts": {+ "postinstall": "./postinstall.sh"+ },+ "dependencies": {+ "adom/hd-bootstrap": "^0.2.0"+ },+ "files": [+ "postinstall.sh",+ "skills/**",+ "README.md",+ "SKILL.md",+ "page.json",+ "docs/**",+ "screenshots/**"+ ],+ "author": {+ "name": "Kyle Bergstedt",+ "email": "[email protected]"+ } }
skills/hd-api-key-mac/._SKILL.mdadded⋯ 1 unchanged line ⋯
skills/hd-api-key-mac/SKILL.mdadded+103@@ -0,0 +1,103 @@+---+name: hd-api-key-mac+description: >+ Diagnose and repair the workspace's Adom API key (`/var/run/adom/api-key`) on macOS+ Hydrogen Desktop — the injected session token that adom-cli and every Adom tool+ authenticate with. Use when adom-cli returns 401/unauthorized, `/var/run/adom/api-key`+ is missing or empty, "adom-cli can't reach Adom", or the user asks to reauthorize+ Adom / re-pull the API key. Covers: pulling the current token from HD via+ `GET /auth-token`, re-writing the key (passwordless sudo), prompting the user to+ sign in to HD when the host has no valid session, and triggering HD's+ inject-api-key setup step. Trigger words — api key, api-key, /var/run/adom,+ 401 unauthorized, adom-cli auth, reauthorize adom, re-auth adom, pull api key,+ session token missing, fix adom auth, carbon 401.+---++# hd-api-key-mac — recover the workspace Adom API key++`/var/run/adom/api-key` (mode 644) holds the user's Adom **session token**, injected+into the `Adom-Workspace` machine by HD. `adom-cli` and the other Adom CLIs read it to+authenticate against carbon (through HD's proxy over `adom-host`). When it's missing+or stale, every Adom platform call fails — usually surfacing as `401`/`unauthorized`+from `adom-cli`.++## Why it goes missing (know before fixing)++- `/var/run` is **tmpfs** — a machine or Lima-VM reboot silently wipes the key even+ though the user's session on the Mac is still valid.+- HD writes it at three moments: the `inject-api-key` setup step, **every Adom auth+ completion**, and **on every HD launch** (the last two are HD ≥ 0.1.148; older HDs+ only wrote it during setup — if the user signed in *after* setup ran, the key never+ landed. That gap is exactly what this skill recovers).+- The setup step self-skips with "sign in later" when the user wasn't signed in yet.++## Diagnose (two commands)++```bash+wc -c /var/run/adom/api-key 2>/dev/null # missing/0 bytes → key absent+timeout 15 adom-cli carbon user get # 401/unauthorized → key stale or absent+```++| Symptom | Meaning | Fix |+|---|---|---|+| file missing/empty, host signed in | tmpfs wipe or pre-0.1.148 auth gap | Pull the token (below) |+| file present, `401` | host session rotated/expired since injection | Pull the token (below) |+| pull says no session on host | user isn't signed in to HD | Prompt reauthorization (below) |++## Fix — pull the current token from HD++HD's control API serves the raw session token at `GET /auth-token` (raw text when+signed in; a JSON `{"error":"no session token"}` object when not). The `adom` user+has passwordless sudo:++```bash+CTRL="$(cat ~/.adom/hd-control-url)" # e.g. http://adom-host:<control> — see hd-api-mac+TOKEN="$(curl -sf "$CTRL/auth-token")"+case "$TOKEN" in+ ""|\{*) echo "NO SESSION on host — user must sign in to HD (see below)" ;;+ *) sudo mkdir -p /var/run/adom \+ && printf %s "$TOKEN" | sudo tee /var/run/adom/api-key >/dev/null \+ && sudo chmod 644 /var/run/adom/api-key \+ && echo "key written ($(wc -c < /var/run/adom/api-key) bytes)" ;;+esac+timeout 15 adom-cli carbon user get # VERIFY — must return user JSON, not 401+```++Always verify with `adom-cli carbon user get` — a written key proves nothing if the+host session itself expired (then the pull "succeeds" but carbon still 401s →+reauthorization needed).++## Prompt the user to reauthorize++When the host has no session (or the pulled token still 401s), the fix is a human+step — **tell the user in chat**, plainly:++> Your Adom session has expired (or you're not signed in). Please bring up the+> Hydrogen Desktop window and sign in to Adom — I'll pick it up automatically and+> finish fixing the workspace auth.++Optionally also raise a native toast so they see it outside the editor (see+`hd-notifications-mac`). Then poll — on HD ≥ 0.1.148 auth completion re-injects the+key automatically:++```bash+for i in $(seq 1 60); do [ -s /var/run/adom/api-key ] && break; sleep 5; done+timeout 15 adom-cli carbon user get+```++If the key never appears (older HD), re-run the pull block above once the user+confirms they signed in.++## Alternative: trigger HD's setup step++`POST "$CTRL/setup/step/inject-api-key"` re-runs the injection through HD's Setup+panel (the panel is force-shown; the user sees live progress; the step also+validates against carbon). Use this when you want the user-visible, HD-audited path+instead of writing the file yourself. Do **NOT** use `POST /setup/run-step` — that+endpoint is deprecated and hard-refused.++## Related++- `hd-api-mac` — `~/.adom/hd-control-url` discovery + the `adom-host` gateway (why+ `127.0.0.1` doesn't reach HD from the machine).+- `hd-setup-steps` — where `inject-api-key` sits in the install cascade.