Enforce Claude settings with MDM

#!/bin/bash
# =======================================================================
# MDM Deployment Script — Linux (amd64)
# Claude Code / Codex  +  org MCP connectors
#
# Must be run as root. Re-running is safe and self-healing.
#   sudo ./tfy-mdm-setup.sh             # deploy
#   sudo ./tfy-mdm-setup.sh --dry-run   # print the payload, write nothing
#   sudo ./tfy-mdm-setup.sh --verify    # read back what is on this machine
# =======================================================================

set -euo pipefail

[[ "$(id -u)" -ne 0 ]] && { echo "ERROR: Must be run as root." >&2; exit 1; }

CONFIG_FILE="/etc/tfy/tfy-local-ai-setup.conf"
LOG_FILE="/var/log/tfy-local-ai-mdm.log"

log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*" | tee -a "${LOG_FILE}"; }

# ---------------------------------------------------------------------------
# Config — fill in on first run. Values are saved to ${CONFIG_FILE} and
# reloaded automatically on subsequent runs — no edits needed after that.
# ---------------------------------------------------------------------------
GATEWAY_URL="<your-gateway-url>"
CONTROL_PLANE_URL="<your-control-plane-url>"
TENANT_NAME="<your-tenant-name>"

# Org MCP connectors. Each name must match the server name in the TrueFoundry
# MCP registry exactly — the URL is derived from it. Leave the array empty to
# deploy inference only.
CONNECTORS=( "github" "slack" "atlassian" )

# Optional: per-tool gateway URL overrides (both default to GATEWAY_URL if not set)
# CLAUDE_GATEWAY_URL=""
# CODEX_GATEWAY_URL=""

# Optional: override model IDs (defaults shown)
# OPUS_MODEL="claude-code/claude-opus"
# SONNET_MODEL="claude-code/claude-sonnet"
# HAIKU_MODEL="claude-code/claude-haiku"

# Optional: templates for Claude Code's managed-settings.json / Codex config
# SETTINGS_FILE="/etc/tfy/base-settings.json"
# CODEX_SETTINGS_FILE="/etc/tfy/base-codex-config.toml"

MODE="apply"
while [[ $# -gt 0 ]]; do
  case "$1" in
    --dry-run) MODE="dry-run"; shift ;;
    --verify)  MODE="verify";  shift ;;
    *) echo "ERROR: unknown argument: $1" >&2; exit 1 ;;
  esac
done

# ---------------------------------------------------------------------------
# Load config
# ---------------------------------------------------------------------------
if [[ -f "${CONFIG_FILE}" ]]; then
  while IFS='=' read -r _key _value; do
    [[ -z "${_key}" || "${_key}" == \#* ]] && continue
    _key="${_key// /}"; _value="${_value%\"}"; _value="${_value#\"}"
    case "${_key}" in
      GATEWAY_URL)       [[ "${GATEWAY_URL}"       == "<your-gateway-url>" ]]       && GATEWAY_URL="${_value}" ;;
      CONTROL_PLANE_URL) [[ "${CONTROL_PLANE_URL}" == "<your-control-plane-url>" ]] && CONTROL_PLANE_URL="${_value}" ;;
      TENANT_NAME)       [[ "${TENANT_NAME}"       == "<your-tenant-name>" ]]       && TENANT_NAME="${_value}" ;;
    esac
  done < "${CONFIG_FILE}"
fi

[[ "${GATEWAY_URL}"       == "<your-gateway-url>" ]]       && { log "ERROR: GATEWAY_URL not set — fill it in above or check ${CONFIG_FILE}."; exit 1; }
[[ "${CONTROL_PLANE_URL}" == "<your-control-plane-url>" ]] && { log "ERROR: CONTROL_PLANE_URL not set — fill it in above or check ${CONFIG_FILE}."; exit 1; }
[[ "${TENANT_NAME}"       == "<your-tenant-name>" ]]       && { log "ERROR: TENANT_NAME not set — fill it in above or check ${CONFIG_FILE}."; exit 1; }

BINARY_PATH="/usr/local/bin/tfy-local-ai-setup"
RELEASE_TAG="v1.3.6"
BINARY_URL="https://github.com/truefoundry/tfy-local-ai-setup/releases/download/${RELEASE_TAG}/tfy-local-ai-setup-linux-amd64"
VERSION_FILE="${BINARY_PATH}.version"
MANAGED_DIR="/etc/claude-code"
MANAGED_MCP="${MANAGED_DIR}/managed-mcp.json"

# ---------------------------------------------------------------------------
# Build the Claude Code connector payload: an OBJECT keyed by server name.
# (Claude Desktop's array-of-objects form does not apply here — no Linux build.)
# ---------------------------------------------------------------------------
CLI_MCP="{\"mcpServers\":{"
for name in "${CONNECTORS[@]:-}"; do
  [[ -z "${name}" ]] && continue
  [[ "${CLI_MCP}" != "{\"mcpServers\":{" ]] && CLI_MCP+=","
  CLI_MCP+="\"${name}\":{\"type\":\"http\",\"url\":\"${GATEWAY_URL%/}/${TENANT_NAME}/mcp/${name}/server\"}"
done
CLI_MCP+="}}"

if [[ "${MODE}" == "verify" ]]; then
  echo "Claude Code connectors : $(cat "${MANAGED_MCP}" 2>/dev/null || echo 'managed-mcp.json NOT SET')"
  echo "Gateway                : $(python3 -c 'import json,sys;print(json.load(open("/etc/claude-code/managed-settings.json"))["env"].get("ANTHROPIC_BASE_URL",""))' 2>/dev/null || echo 'managed-settings.json NOT SET')"
  exit 0
fi

if [[ "${MODE}" == "dry-run" ]]; then
  echo "managed-mcp.json = ${CLI_MCP}"
  exit 0
fi

# Persist config for future runs (root-owned, 644 — developers cannot edit)
mkdir -p "$(dirname "${CONFIG_FILE}")"
cat > "${CONFIG_FILE}" <<CONF
GATEWAY_URL="${GATEWAY_URL}"
CONTROL_PLANE_URL="${CONTROL_PLANE_URL}"
TENANT_NAME="${TENANT_NAME}"
CONF
chown root:root "${CONFIG_FILE}" && chmod 644 "${CONFIG_FILE}"
log "Config saved to ${CONFIG_FILE}."

# ---------------------------------------------------------------------------
# Install binary (skip if already on the correct release tag)
# ---------------------------------------------------------------------------
INSTALLED_TAG="$([[ -f "${VERSION_FILE}" ]] && cat "${VERSION_FILE}" || echo '')"

if [[ ! -f "${BINARY_PATH}" ]] || [[ "${INSTALLED_TAG}" != "${RELEASE_TAG}" ]]; then
  log "Installing tfy-local-ai-setup ${RELEASE_TAG} (linux-amd64)..."
  # Download to a temp path and move into place, so an interrupted transfer
  # cannot leave a truncated binary that later runs treat as installed.
  curl -fsSL "${BINARY_URL}" -o "${BINARY_PATH}.download"
  chmod +x "${BINARY_PATH}.download"
  mv "${BINARY_PATH}.download" "${BINARY_PATH}"
  log "tfy-local-ai-setup installed at ${BINARY_PATH}."
else
  log "tfy-local-ai-setup ${RELEASE_TAG} already installed — skipping download."
fi

# ---------------------------------------------------------------------------
# Run — device login, then write + lock the managed config for every AI tool
# actually installed. The binary owns the API key; this script never sees one.
# ---------------------------------------------------------------------------
RUN_ARGS=( --url="${CONTROL_PLANE_URL}" --tenant="${TENANT_NAME}" --gateway="${GATEWAY_URL}" )
[[ -n "${CLAUDE_GATEWAY_URL:-}" ]]  && RUN_ARGS+=(--claude-gateway="${CLAUDE_GATEWAY_URL}")
[[ -n "${CODEX_GATEWAY_URL:-}" ]]   && RUN_ARGS+=(--codex-gateway="${CODEX_GATEWAY_URL}")
[[ -n "${OPUS_MODEL:-}" ]]          && RUN_ARGS+=(--opus-model="${OPUS_MODEL}")
[[ -n "${SONNET_MODEL:-}" ]]        && RUN_ARGS+=(--sonnet-model="${SONNET_MODEL}")
[[ -n "${HAIKU_MODEL:-}" ]]         && RUN_ARGS+=(--haiku-model="${HAIKU_MODEL}")
[[ -n "${SETTINGS_FILE:-}" ]]       && RUN_ARGS+=(--settings-file="${SETTINGS_FILE}")
[[ -n "${CODEX_SETTINGS_FILE:-}" ]] && RUN_ARGS+=(--codex-settings-file="${CODEX_SETTINGS_FILE}")

set +e
"${BINARY_PATH}" "${RUN_ARGS[@]}" 2>&1 | tee -a "${LOG_FILE}"
CODE=${PIPESTATUS[0]}
set -e

if [[ ${CODE} -ne 0 ]]; then
  log "Setup failed with exit code ${CODE} — stopping before the connector write."
  exit ${CODE}
fi
echo "${RELEASE_TAG}" > "${VERSION_FILE}"

# ---------------------------------------------------------------------------
# Claude Code connectors — managed-mcp.json
#
# The binary does not write this file, so the script owns it: unlock, write,
# re-lock, so developers cannot edit it between runs.
# ---------------------------------------------------------------------------
if [[ ${#CONNECTORS[@]} -gt 0 && -d "${MANAGED_DIR}" ]]; then
  chattr -i "${MANAGED_MCP}" 2>/dev/null || true
  printf '%s' "${CLI_MCP}" > "${MANAGED_MCP}"
  chown root:root "${MANAGED_MCP}" && chmod 644 "${MANAGED_MCP}"
  chattr +i "${MANAGED_MCP}" 2>/dev/null || log "WARNING: chattr +i failed (not supported on this filesystem)."
  log "Claude Code: ${#CONNECTORS[@]} connectors written to ${MANAGED_MCP}."
else
  log "Claude Code not configured on this machine — skipping managed-mcp.json."
fi

log "Done. Developers run /mcp inside Claude Code once to sign in to each server."

# =========================================================================
# MDM Deployment Script — Windows (amd64)
# Claude Code / Codex / Claude Desktop  +  org MCP connectors
#
# Run hourly as SYSTEM. Re-running is safe and self-healing.
#   .\tfy-mdm-setup.ps1              # deploy
#   .\tfy-mdm-setup.ps1 -DryRun      # print the payloads, write nothing
#   .\tfy-mdm-setup.ps1 -VerifyOnly  # read back what is on this machine
# =========================================================================

#Requires -RunAsAdministrator
[CmdletBinding()]
param(
  [string]$GatewayUrl      = "<your-gateway-url>",
  [string]$ControlPlaneUrl = "<your-control-plane-url>",
  [string]$TenantName      = "<your-tenant-name>",

  # Org MCP connectors. Each name must match the server name in the
  # TrueFoundry MCP registry exactly — both payloads are derived from it.
  [string[]]$Connectors = @("github", "slack", "atlassian"),

  # "true" keeps user-added local MCP servers working in Claude Desktop
  # alongside the org connectors. "false" is the locked-down posture.
  [ValidateSet("true", "false")][string]$AllowLocalMcp = "true",

  [string]$OpusModel    = "",   # defaults to claude-code/claude-opus
  [string]$SonnetModel  = "",   # defaults to claude-code/claude-sonnet
  [string]$HaikuModel   = "",   # defaults to claude-code/claude-haiku
  [string]$SettingsFile = "",   # JSON template for managed-settings.json
  [string]$ReleaseTag   = "v1.3.6",
  [switch]$DryRun,
  [switch]$VerifyOnly,
  [switch]$Relaunched           # internal — set by the re-launch below
)

# -------------------------------------------------------------------------
# Re-launch under 64-bit PowerShell if started from a 32-bit host.
#
# A 32-bit MDM agent (ManageEngine lives in "Program Files (x86)") gets WOW64
# redirection, so a write to HKLM\SOFTWARE\Policies\Claude lands under
# WOW6432Node — where the 64-bit Claude Desktop never looks. That is a silent,
# green-in-the-console failure. "Sysnative" exists only inside a 32-bit
# process and is the supported way back to the native shell.
# -------------------------------------------------------------------------
if (-not $Relaunched -and -not [Environment]::Is64BitProcess -and [Environment]::Is64BitOperatingSystem) {
  $NativeShell = Join-Path $env:SystemRoot "Sysnative\WindowsPowerShell\v1.0\powershell.exe"
  if ($PSCommandPath -and (Test-Path $NativeShell)) {
    $Forward = @()
    foreach ($Entry in $PSBoundParameters.GetEnumerator()) {
      $Value = $Entry.Value
      if ($Value -is [switch]) { if ($Value.IsPresent) { $Forward += "-$($Entry.Key)" } }
      elseif ($Value -is [array]) { $Forward += "-$($Entry.Key)"; $Forward += (($Value | ForEach-Object { "'$_'" }) -join ",") }
      else { $Forward += "-$($Entry.Key)"; $Forward += "'$Value'" }
    }
    & $NativeShell -NoProfile -ExecutionPolicy Bypass -File $PSCommandPath @Forward -Relaunched
    exit $LASTEXITCODE
  }
  Write-Warning "Running 32-bit and cannot re-launch — registry writes may land in WOW6432Node."
}

Set-StrictMode -Version Latest
$ErrorActionPreference = "Stop"
# PowerShell 7.4+ turns a non-zero native exit code into a terminating error
# while $ErrorActionPreference is Stop. icacls below is best-effort and the
# binary's exit code is handled explicitly, so opt out.
if (Test-Path Variable:PSNativeCommandUseErrorActionPreference) { $PSNativeCommandUseErrorActionPreference = $false }
# GitHub requires TLS 1.2; PowerShell 5.1 on older builds still defaults to 1.0.
[Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12

$ConfigFile  = "C:\ProgramData\TrueFoundry\tfy-local-ai-setup.conf"
$BinaryDir   = "C:\Program Files\TrueFoundry"
$BinaryPath  = "$BinaryDir\tfy-local-ai-setup.exe"
$VersionFile = "$BinaryPath.version"
$BinaryUrl   = "https://github.com/truefoundry/tfy-local-ai-setup/releases/download/$ReleaseTag/tfy-local-ai-setup-windows-amd64.exe"
$ManagedMcp  = "C:\Program Files\ClaudeCode\managed-mcp.json"
$LogFile     = "C:\Windows\Temp\tfy-local-ai-mdm.log"

# HKLM is the hive SYSTEM writes and the one to use. Since Claude Desktop
# v1.19367.0 the hives are NOT merged: anything at all under HKLM makes the
# app ignore HKCU entirely, so the whole configuration must live in one hive.
$RegistryKey = "HKLM:\SOFTWARE\Policies\Claude"

function Write-Log {
  param([string]$Message)
  $Line = "[$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')] $Message"
  Write-Host $Line
  Add-Content -Path $LogFile -Value $Line
}

# Set-StrictMode makes a missing property throw, so every read goes through here.
function Get-RegValue {
  param([string]$Name)
  $Item = Get-ItemProperty -Path $RegistryKey -ErrorAction SilentlyContinue
  if (-not $Item) { return $null }
  if (@($Item.PSObject.Properties.Name) -contains $Name) { return $Item.$Name }
  return $null
}

# -------------------------------------------------------------------------
# Build both connector payloads from the one list
#
# Claude Desktop wants an ARRAY of {name, transport, url, oauth}; Claude Code
# wants an OBJECT keyed by server name holding {type, url}.
#
# String concatenation on purpose: ConvertTo-Json -Compress can emit a bare
# object for a ONE-element array, and re-wrapping it yields [[{...}]] — which
# parses cleanly and is then silently dropped by the app.
# -------------------------------------------------------------------------
$GatewayBase = $GatewayUrl.TrimEnd("/")
$DesktopMcp = "[" + (($Connectors | ForEach-Object {
  '{{"name":"{0}","transport":"http","url":"{1}/{2}/mcp/{0}/server","oauth":true}}' -f $_, $GatewayBase, $TenantName
}) -join ",") + "]"
$CliMcp = '{"mcpServers":{' + (($Connectors | ForEach-Object {
  '"{0}":{{"type":"http","url":"{1}/{2}/mcp/{0}/server"}}' -f $_, $GatewayBase, $TenantName
}) -join ",") + "}}"

# Parseable is not enough — a bare object and a nested array both parse. The
# ForEach-Object is load-bearing: Windows PowerShell 5.1's ConvertFrom-Json
# returns a JSON array as ONE Object[] instead of enumerating it.
$Parsed = @($DesktopMcp | ConvertFrom-Json | ForEach-Object { $_ })
if ($Parsed.Count -ne $Connectors.Count) { throw "connector payload has $($Parsed.Count) entries, expected $($Connectors.Count): $DesktopMcp" }
foreach ($Entry in $Parsed) {
  if ($Entry -is [System.Object[]]) { throw "connector payload is a nested array, not an array of objects: $DesktopMcp" }
}
$null = $CliMcp | ConvertFrom-Json

if ($VerifyOnly) {
  Write-Host ("inferenceProvider      : {0}" -f (Get-RegValue "inferenceProvider"))
  Write-Host ("managedMcpServers      : {0}" -f (Get-RegValue "managedMcpServers"))
  Write-Host ("isLocalDevMcpEnabled   : {0}" -f (Get-RegValue "isLocalDevMcpEnabled"))
  Write-Host ("Claude Code connectors : {0}" -f $(if (Test-Path $ManagedMcp) { (Get-Content $ManagedMcp -Raw).Trim() } else { "managed-mcp.json NOT SET" }))
  exit 0
}
if ($DryRun) {
  Write-Host "managed-mcp.json  = $CliMcp"
  Write-Host "managedMcpServers = $DesktopMcp"
  exit 0
}

# -------------------------------------------------------------------------
# Persist config so a later run with no parameters still has it.
#
# ACLs are granted by SID: the literal strings SYSTEM / Administrators / Users
# do not resolve on a non-English Windows install, where icacls then fails.
# -------------------------------------------------------------------------
$ConfigDir = Split-Path $ConfigFile
if (-not (Test-Path $ConfigDir)) { New-Item -ItemType Directory -Path $ConfigDir -Force | Out-Null }
@"
GATEWAY_URL="$GatewayUrl"
CONTROL_PLANE_URL="$ControlPlaneUrl"
TENANT_NAME="$TenantName"
"@ | Set-Content -Path $ConfigFile -Encoding UTF8
icacls $ConfigFile /inheritance:r /grant '*S-1-5-18:(F)' /grant '*S-1-5-32-544:(F)' /grant '*S-1-5-32-545:(R)' 2>$null | Out-Null
Write-Log "Config saved to $ConfigFile."

# -------------------------------------------------------------------------
# Install the binary (skipped when already on $ReleaseTag)
# -------------------------------------------------------------------------
$InstalledTag = if (Test-Path $VersionFile) { (Get-Content $VersionFile -Raw).Trim() } else { "" }

if (-not (Test-Path $BinaryPath) -or $InstalledTag -ne $ReleaseTag) {
  Write-Log "Installing tfy-local-ai-setup $ReleaseTag (windows-amd64)..."
  if (-not (Test-Path $BinaryDir)) { New-Item -ItemType Directory -Path $BinaryDir -Force | Out-Null }
  # Download to a temp path and move into place, so an interrupted transfer
  # cannot leave a truncated binary that later runs treat as installed.
  Invoke-WebRequest -Uri $BinaryUrl -OutFile "$BinaryPath.download" -UseBasicParsing
  Move-Item -Path "$BinaryPath.download" -Destination $BinaryPath -Force
  Write-Log "Installed at $BinaryPath."
} else {
  Write-Log "tfy-local-ai-setup $ReleaseTag already installed — skipping download."
}

# -------------------------------------------------------------------------
# Run it — device login, then write + lock the managed config for every AI
# tool installed. The binary owns the API key; this script never sees one.
# -------------------------------------------------------------------------
$RunArgs = @("--url=$ControlPlaneUrl", "--tenant=$TenantName", "--gateway=$GatewayUrl")
if ($OpusModel)    { $RunArgs += "--opus-model=$OpusModel" }
if ($SonnetModel)  { $RunArgs += "--sonnet-model=$SonnetModel" }
if ($HaikuModel)   { $RunArgs += "--haiku-model=$HaikuModel" }
if ($SettingsFile) { $RunArgs += "--settings-file=$SettingsFile" }

& $BinaryPath @RunArgs
if ($LASTEXITCODE -ne 0) {
  Write-Log "Setup failed ($LASTEXITCODE) — stopping before the connector writes."
  exit $LASTEXITCODE
}
# Record the version only after a successful run, or a binary that installs
# but never works is treated as current and never re-downloaded.
Set-Content -Path $VersionFile -Value $ReleaseTag

# -------------------------------------------------------------------------
# Claude Code connectors — managed-mcp.json (the binary does not write it)
# -------------------------------------------------------------------------
if ($Connectors.Count -gt 0 -and (Test-Path (Split-Path $ManagedMcp))) {
  Set-Content -Path $ManagedMcp -Value $CliMcp -Encoding UTF8
  icacls $ManagedMcp /inheritance:r /grant '*S-1-5-18:(F)' /grant '*S-1-5-32-544:(F)' /grant '*S-1-5-32-545:(R)' 2>$null | Out-Null
  Write-Log "Claude Code: $($Connectors.Count) connectors written to $ManagedMcp."
} else {
  Write-Log "Claude Code not configured on this machine — skipping managed-mcp.json."
}

# -------------------------------------------------------------------------
# Claude Desktop connectors — managedMcpServers
#
# New-ItemProperty, NOT reg add: PowerShell does not escape embedded double
# quotes when building a native command line, so reg.exe re-parses the JSON
# and strips every " from the stored value — which yields an empty
# Connectors pane and no error anywhere.
#
# Never run New-Item -Force on the key: on the registry provider that deletes
# and recreates it, wiping the inference values the binary just wrote and
# logging the user out of Claude Desktop.
# -------------------------------------------------------------------------
if (-not (Test-Path $RegistryKey)) {
  Write-Log "Claude Desktop not configured on this machine — skipping. Clean no-op, not a failure."
  exit 0
}

# -PropertyType String is REG_SZ, the only type to write here. REG_EXPAND_SZ
# counts as machine policy being PRESENT but unreadable, which disables HKCU
# too and takes the entire managed config down silently.
New-ItemProperty -Path $RegistryKey -Name managedMcpServers    -Value $DesktopMcp    -PropertyType String -Force | Out-Null
New-ItemProperty -Path $RegistryKey -Name isLocalDevMcpEnabled -Value $AllowLocalMcp -PropertyType String -Force | Out-Null

# -------------------------------------------------------------------------
# Verify — a write can succeed against a redirected view, and a round-tripped
# value can come back quote-stripped, so read everything back.
# -------------------------------------------------------------------------
$Failed = 0
if ((Get-RegValue "managedMcpServers") -ne $DesktopMcp) {
  Write-Log "FAIL: managedMcpServers does not match what was written."; $Failed = 1
}
# Connectors ride on the inference block: in first-party mode the app ignores
# the entire managed config and the Connectors pane comes up empty.
if ((Get-RegValue "inferenceProvider") -ne "gateway") {
  Write-Log "FAIL: inferenceProvider is not 'gateway' — Desktop will ignore the managed block."; $Failed = 1
}
if (-not (Get-RegValue "inferenceGatewayApiKey")) {
  Write-Log "FAIL: inferenceGatewayApiKey is empty — the device login did not produce a token."; $Failed = 1
}
if ($Failed -ne 0) { Write-Log "Configuration was NOT applied correctly — re-run and check $LogFile."; exit 1 }

Write-Log "Done. Fully quit Claude Desktop (tray icon → Quit) and relaunch."
Write-Log "Connectors appear under Customize → Connectors, each with a Connect button —"
Write-Log "they are not pre-connected; every user signs in with their own account."
Write-Log "If the pane is empty, grep %LOCALAPPDATA%\Claude-3p\logs\main.log (NOT %APPDATA%) for:"
Write-Log "  [custom-3p] Credentials loaded from managed config { mcpServerCount: N }"