This PR lets an agent or system workflow to run to allow signalling of updates

Author: hughneale

internal/common/client.go

@@ -2,14 +2,31 @@ package common
 
 import (
 	"crypto/sha256"
+	"os"
+	"strings"
 
 	"github.com/denisbrodbeck/machineid"
 	"github.com/google/uuid"
 )
 
+const clientIdentifierEnvVar = "THAND_AGENT_ID"
+
 // GetClientIdentifier returns a UUID that uniquely identifies this system.
 // It uses the machine's hardware ID to generate a consistent, system-specific UUID.
 func GetClientIdentifier() uuid.UUID {
+	// If set, this env var overrides the default machine-derived identifier.
+	//
+	// Accepts:
+	//   - a UUID string (returned as-is)
+	//   - any non-empty string (hashed deterministically to a UUID)
+	if value := strings.TrimSpace(os.Getenv(clientIdentifierEnvVar)); value != "" {
+		if parsed, err := uuid.Parse(value); err == nil {
+			return parsed
+		}
+
+		hash := sha256.Sum256([]byte(value))
+		return uuid.UUID(hash[:16])
+	}
 
 	// TODO(hugh): Check if the thand.io config exists and use that for an identifier.
 

internal/config/services/client.go

@@ -5,9 +5,9 @@ import (
 	"sync"
 
 	"github.com/sirupsen/logrus"
+	"github.com/thand-io/agent/internal/common"
 	"github.com/thand-io/agent/internal/config/services/temporal"
 	"github.com/thand-io/agent/internal/models"
-	"github.com/thand-io/agent/internal/sessions"
 )
 
 type localClient struct {
@@ -371,45 +371,18 @@ func (e *localClient) ReloadTemporal() error {
 		e.mu.Unlock()
 	}
 
-	// Client mode NEVER starts Temporal
-	if e.config.IsClient() {
-		logrus.Info("Skipping Temporal initialization in client mode")
-		return nil
-	}
-
 	logrus.Infof("Initializing temporal...")
 
-	// Determine identities based on mode
-	environment := e.config.GetEnvironment()
-	identities := []string{environment.GetIdentifier()}
-
-	if e.config.IsAgent() {
-		// Agent mode: query session manager for all active identities + hostname
-		sessionMgr := sessions.GetSessionManager()
-		loginServerName := e.config.GetLoginServerHostname()
-
-		loginServer, err := sessionMgr.GetLoginServer(loginServerName)
-
-		if err != nil {
-			logrus.WithError(err).Warn("Failed to get login server, using hostname identity only")
-		} else {
-			activeSessions := loginServer.GetSessions()
-
-			// Add active session providers as identities
-			for providerName, session := range activeSessions {
-				if !session.IsExpired() {
-					identities = append(identities, providerName)
-					logrus.WithFields(logrus.Fields{
-						"provider": providerName,
-						"expiry":   session.Expiry,
-					}).Debug("Adding active session identity to worker pool")
-				}
-			}
-		}
-
-		logrus.WithField("identities", identities).Info("Configuring Temporal workers for agent mode")
+	// Determine task queue based on mode:
+	// - Server: shared default task queue
+	// - Agent / Client: per-client task queue derived from the client identifier
+	taskQueue := temporal.DefaultTaskQueue
+	if e.config.IsAgent() || e.config.IsClient() {
+		taskQueue = common.GetClientIdentifier().String()
 	}
 
+	logrus.WithField("taskQueue", taskQueue).Info("Configuring Temporal worker")
+
 	// Get Temporal config from services
 	servicesConfig := e.config.GetServicesConfig()
 
@@ -422,7 +395,7 @@ func (e *localClient) ReloadTemporal() error {
 	temporalService := temporal.NewTemporalClient(
 		temporalConfig,
 		e.vault,
-		identities...,
+		taskQueue,
 	)
 	if err := temporalService.Initialize(); err != nil {
 		logrus.Errorf("Error initializing temporal: %v", err)

internal/config/services/temporal/auth_apikey_test.go

@@ -95,6 +95,7 @@ func TestHasAPIKeyAuth(t *testing.T) {
 			temporalClient := NewTemporalClient(
 				config,
 				nil,
+				"test-identity",
 			)
 
 			got := temporalClient.hasAPIKeyAuth()

internal/config/services/temporal/auth_mtls_file_test.go

@@ -145,6 +145,7 @@ func TestHasMTLSFile(t *testing.T) {
 			temporalClient := NewTemporalClient(
 				config,
 				nil,
+				"test-identity",
 			)
 
 			got := temporalClient.hasMTLSFile()

internal/config/services/temporal/auth_mtls_inline_test.go

@@ -129,6 +129,7 @@ func TestHasMTLSInline(t *testing.T) {
 			temporalClient := NewTemporalClient(
 				config,
 				nil,
+				"test-identity",
 			)
 
 			got := temporalClient.hasMTLSInline()

internal/config/services/temporal/auth_mtls_vault_test.go

@@ -341,6 +341,7 @@ func TestHasMTLSVault(t *testing.T) {
 			temporalClient := NewTemporalClient(
 				config,
 				nil,
+				"test-identity",
 			)
 
 			got := temporalClient.hasMTLSVault()