Break enterprise policy out into openchamber-policy.json

- New --enterprise <policy.json> flag installs a policy file from the
  cloned repo (openchamber-policy.json) instead of the built-in defaults
- --relay-url overrides the source file's relayUrl key; matching relay
  installs the file content verbatim
- Invalid or missing policy source fails closed with a clear error
- Arg parsing extracted into a testable parse_args function

openchamber-boostrap.sh

@@ -17,9 +17,13 @@
 #   4. Installs opencode (if missing)
 #   5. Installs/updates @openchamber/web to latest via bun (every run)
 #   6. Installs the enterprise policy file (/etc/openchamber/policy.json):
-#      enterprise mode + organization + pinned relay. Without root it
+#      enterprise mode + organization + pinned relay. Pass
-#      falls back to OPENCHAMBER_ENTERPRISE_MODE=1 in the rc files
+#      --enterprise <file> to install your own policy (e.g.
-#      (weaker lock — the user can edit those). Skip with --no-enterprise.
+#      openchamber-policy.json from this repo); otherwise built-in
+#      defaults are used. --relay-url overrides the file's relayUrl.
+#      Without root it falls back to OPENCHAMBER_ENTERPRISE_MODE=1 in
+#      the rc files (weaker lock — the user can edit those). Skip with
+#      --no-enterprise.
 #   7. Syncs ~/.config/opencode/opencode.json from CONFIG_URL and injects
 #      OpenCode provider policies: deny every provider, then allow the
 #      ones derived from the config's own providers, the baseline list
@@ -35,6 +39,10 @@
 #        --allow-provider <id>       allow an extra model provider in the
 #                                    OpenCode policy (repeatable), e.g.
 #                                    --allow-provider constellation
+#        --enterprise <policy.json>  install this file as the OpenChamber
+#                                    enterprise policy (e.g. the
+#                                    openchamber-policy.json in this repo);
+#                                    without it, built-in defaults apply
 #        --no-enterprise             do not install the enterprise policy
 #                                    file / env pin
 
@@ -53,13 +61,18 @@ INVITE=0
 INVITE_PORT=3000
 NO_ENTERPRISE=0
 ALLOW_PROVIDERS_STR=""
+POLICY_SOURCE=""
 info()  { printf '\033[1;34m[info]\033[0m %s\n' "$*"; }
 ok()    { printf '\033[1;32m[ ok ]\033[0m %s\n' "$*"; }
 warn()  { printf '\033[1;33m[warn]\033[0m %s\n' "$*"; }
 die()   { printf '\033[1;31m[fail]\033[0m %s\n' "$*" >&2; exit 1; }
-while [ $# -gt 0 ]; do
+
+# parse_args "$@" — set INVITE/INVITE_PORT/NO_ENTERPRISE/ALLOW_PROVIDERS_STR/
+# POLICY_SOURCE/RELAY_URL from the command line.
+parse_args() {
+  while [ $# -gt 0 ]; do
     case "$1" in
-    --relay-url) RELAY_URL="$2"; shift 2 ;;
+      --relay-url) [ $# -ge 2 ] || die "--relay-url needs a value"; RELAY_URL="$2"; shift 2 ;;
       --invite)
         INVITE=1
         if [ $# -ge 2 ] && [ "${2#--}" = "$2" ]; then INVITE_PORT="$2"; shift; fi
@@ -68,17 +81,53 @@ while [ $# -gt 0 ]; do
         [ $# -ge 2 ] || die "--allow-provider needs a provider id"
         ALLOW_PROVIDERS_STR="$ALLOW_PROVIDERS_STR $2"
         shift 2 ;;
+      --enterprise)
+        [ $# -ge 2 ] || die "--enterprise needs a policy file path"
+        [ -r "$2" ] || die "enterprise policy file not found: $2"
+        POLICY_SOURCE="$2"
+        shift 2 ;;
       --no-enterprise) NO_ENTERPRISE=1; shift ;;
-    *) echo "unknown arg: $1 (usage: $0 [--relay-url wss://host/ws] [--invite [port]] [--allow-provider <id>] [--no-enterprise])" >&2; exit 1 ;;
+      *) echo "unknown arg: $1 (usage: $0 [--relay-url wss://host/ws] [--invite [port]] [--allow-provider <id>] [--enterprise <policy.json>] [--no-enterprise])" >&2; exit 1 ;;
     esac
-done
+  done
+}
 
 # ---- helpers ----------------------------------------------------------------
 
-# policy_json — emit the enterprise policy file content on stdout
+# policy_json — emit the enterprise policy file content on stdout.
+# With POLICY_SOURCE set: the file is the source of truth, except --relay-url
+# overrides its relayUrl key. Without it: built-in defaults.
 policy_json() {
+  if [ -z "$POLICY_SOURCE" ]; then
     printf '{\n  "enterpriseMode": true,\n  "organization": "%s",\n  "relayUrl": "%s"\n}\n' \
       "$ORGANIZATION" "$RELAY_URL"
+    return 0
+  fi
+  local tmp
+  tmp="$(mktemp)"
+  if command -v python3 >/dev/null 2>&1; then
+    python3 - "$POLICY_SOURCE" "$tmp" "$RELAY_URL" <<'PY' || { rm -f "$tmp"; die "invalid JSON in enterprise policy file: $POLICY_SOURCE"; }
+import json, sys
+src, dst, relay = sys.argv[1], sys.argv[2], sys.argv[3]
+p = json.load(open(src))
+if relay and p.get("relayUrl") != relay:
+    p["relayUrl"] = relay
+with open(dst, "w") as f:
+    json.dump(p, f, indent=2)
+    f.write("\n")
+PY
+  elif command -v bun >/dev/null 2>&1; then
+    IN="$POLICY_SOURCE" OUT="$tmp" RELAY="$RELAY_URL" bun -e '
+const fs = require("fs");
+const p = JSON.parse(fs.readFileSync(process.env.IN, "utf8"));
+if (process.env.RELAY && p.relayUrl !== process.env.RELAY) p.relayUrl = process.env.RELAY;
+fs.writeFileSync(process.env.OUT, JSON.stringify(p, null, 2) + "\n");
+' || { rm -f "$tmp"; die "invalid JSON in enterprise policy file: $POLICY_SOURCE"; }
+  else
+    die "need python3 or bun to read the enterprise policy file"
+  fi
+  cat "$tmp"
+  rm -f "$tmp"
 }
 
 # write_policy_file <path> — idempotently install the enterprise policy file
@@ -230,7 +279,9 @@ except Exception:
 # ---- main -------------------------------------------------------------------
 
 main() {
-info "host: $(uname -srm)"
+  parse_args "$@"
+
+  info "host: $(uname -srm)"
 [ "$(uname -s)" = "Linux" ] || die "this script targets Linux hosts"
 
 # ---- preflight -------------------------------------------------------------

openchamber-policy.json

@@ -0,0 +1,5 @@
+{
+  "enterpriseMode": true,
+  "organization": "Zuccaro",
+  "relayUrl": "wss://code.zuccaro.me/ws"
+}