v24.46.1: AI claude-cli reachable as root + cluster node selector

klasSponsor installed Claude Code and ran `sudo claude login` on the admin node,
but the AI still errored "claude not installed". Cause: WolfStack runs as root
under systemd, whose default PATH (/usr/local/bin:/usr/bin:…) does NOT include
~/.local/bin — exactly where Claude Code's native installer drops the binary. So
a valid root install at /root/.local/bin/claude was invisible to the bare
`Command::new("claude")`.

- find_claude_binary() (src/ai/mod.rs): resolves `claude` via PATH then the
  common install locations (/usr/local/bin, /usr/bin, ~/.local/bin,
  ~/.npm-global/bin, ~/.claude/local, /root/* equivalents, and nvm node dirs).
  call_claude_cli uses the resolved path. Clearer error when truly absent
  (explains root vs user, and that a cluster only needs it on one node).

- AI node selector ("Run the CLI on" in Settings → AI Agent, claude-cli section):
  aiNodeUrl() routes the AI Agent tab + assistant chat (config/status/models/
  test-connection/test-email/chat/action/alerts) through /api/nodes/{id}/proxy
  to a chosen node, persisted in localStorage. So `claude` only needs installing
  on the ONE node you point the AI at, not every node. The GitHub-issues AI
  badge/scheduler and WolfAgents surfaces intentionally stay local.

Build green (-D warnings), Cargo.lock bumped, web assets parse-checked. The
binary-discovery path and the proxied node selector are logic-verified but not
yet run against klas's live cluster.

Author: Paul C

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "wolfstack"
-version = "24.46.0"
+version = "24.46.1"
 edition = "2024"
 authors = ["Wolf Software Systems Ltd"]
 description = "Server management platform for the Wolf software suite"

Cargo.toml

@@ -3290,6 +3290,44 @@ async fn call_local_no_tools(
 ///
 /// Auth lives in the invoking user's `~/.claude`. WolfStack runs as root, so
 /// the operator must have run `sudo claude login` first (surfaced in the UI).
+/// Locate the `claude` (Claude Code) binary. WolfStack runs as root under
+/// systemd, whose default PATH (/usr/local/bin:/usr/bin:…) does NOT include
+/// `~/.local/bin` — exactly where Claude Code's native installer drops the
+/// binary. So a perfectly valid `sudo claude` install lands at
+/// /root/.local/bin/claude and a bare `Command::new("claude")` reports "not
+/// installed". Check PATH first, then the common install locations (root's home
+/// and a node-version-manager layout). Returns the resolved path, or None.
+fn find_claude_binary() -> Option<String> {
+    // On PATH already? (`command -v` honours the inherited PATH.)
+    if let Ok(o) = std::process::Command::new("sh").arg("-c").arg("command -v claude").output() {
+        if o.status.success() {
+            let p = String::from_utf8_lossy(&o.stdout).trim().to_string();
+            if !p.is_empty() && std::path::Path::new(&p).exists() {
+                return Some(p);
+            }
+        }
+    }
+    let home = std::env::var("HOME").unwrap_or_else(|_| "/root".to_string());
+    let mut candidates = vec![
+        "/usr/local/bin/claude".to_string(),
+        "/usr/bin/claude".to_string(),
+        format!("{home}/.local/bin/claude"),
+        format!("{home}/.npm-global/bin/claude"),
+        format!("{home}/.claude/local/claude"),
+        // Fall back to /root explicitly in case HOME isn't set in the unit env.
+        "/root/.local/bin/claude".to_string(),
+        "/root/.npm-global/bin/claude".to_string(),
+        "/root/.claude/local/claude".to_string(),
+    ];
+    // nvm-style: ~/.nvm/versions/node/<ver>/bin/claude
+    if let Ok(entries) = std::fs::read_dir(format!("{home}/.nvm/versions/node")) {
+        for e in entries.flatten() {
+            candidates.push(format!("{}/bin/claude", e.path().display()));
+        }
+    }
+    candidates.into_iter().find(|p| std::path::Path::new(p).is_file())
+}
+
 async fn call_claude_cli(
     model: &str,
     system: &str,
@@ -3322,7 +3360,17 @@ async fn call_claude_cli(
 
     let mdl = if model.trim().is_empty() { "sonnet" } else { model.trim() };
 
-    let mut child = tokio::process::Command::new("claude")
+    // WolfStack runs as root; resolve the binary across PATH + common install
+    // dirs so a `~/.local/bin` install (the native installer's default) is found.
+    let claude_bin = find_claude_binary().ok_or_else(|| {
+        "The `claude` CLI isn't installed or reachable as root on this node. \
+         WolfStack runs as root, which has its own home and PATH — installing or \
+         logging in as your normal user is NOT enough. As root: install Claude \
+         Code, then run `sudo claude login`. In a cluster you only need this on \
+         the node you point the AI at (you don't need it on every node).".to_string()
+    })?;
+
+    let mut child = tokio::process::Command::new(&claude_bin)
         .arg("-p")
         .arg("--model").arg(mdl)
         .arg("--allowedTools").arg("")        // no tools — text only (security)
@@ -3332,11 +3380,7 @@ async fn call_claude_cli(
         .stderr(std::process::Stdio::piped())
         .kill_on_drop(true)                   // a timed-out `claude` is reaped, not orphaned
         .spawn()
-        .map_err(|e| if e.kind() == std::io::ErrorKind::NotFound {
-            "The `claude` CLI isn't installed on this node. Install Claude Code and run `sudo claude login` (WolfStack runs as root, so root needs the session).".to_string()
-        } else {
-            format!("Failed to launch `claude`: {}", e)
-        })?;
+        .map_err(|e| format!("Failed to launch `{}`: {}", claude_bin, e))?;
 
     // Write stdin from a separate task so it streams CONCURRENTLY with draining
     // stdout/stderr — writing the whole prompt before reading output can

src/ai/mod.rs

@@ -6246,11 +6246,18 @@ <h4 style="margin:0 0 16px 0;font-size:14px;color:var(--accent-light);">LLM Prov
                                     <div style="padding:10px 12px; border:1px solid var(--border); border-radius:6px; background:rgba(99,102,241,0.08); font-size:13px; line-height:1.5;">
                                         <strong>Uses your Claude Pro/Max subscription</strong> via the local <code>claude</code> CLI — no API key, no per-use cost.
                                         <ul style="margin:8px 0 0 18px; padding:0;">
-                                            <li>Install <strong>Claude Code</strong> on this node, then run <code>sudo claude login</code> (WolfStack runs as root, so root needs the session).</li>
+                                            <li>Install <strong>Claude Code</strong> as <strong>root</strong> on the chosen node, then run <code>sudo claude login</code> (WolfStack runs as root — installing/logging in as your normal user is not enough).</li>
                                             <li>Set the <strong>Model</strong> below to <code>opus</code>, <code>sonnet</code>, or <code>haiku</code> (or a full <code>claude-*</code> id).</li>
                                             <li>The assistant runs with <strong>all Claude Code tools disabled</strong> — it only returns text; WolfStack's own confirmed command flow is unchanged.</li>
                                         </ul>
                                     </div>
+                                    <div class="form-group" style="margin-top:12px; margin-bottom:0;">
+                                        <label for="ai-cli-node">Run the CLI on</label>
+                                        <select id="ai-cli-node" class="form-control" onchange="onAiCliNodeChange()">
+                                            <option value="">This node</option>
+                                        </select>
+                                        <small style="color:var(--text-muted); display:block; margin-top:4px;">The <code>claude</code> CLI only needs installing + <code>sudo claude login</code> on the <strong>one</strong> node you pick here — not every node. Settings, Test Connection, and the assistant chat all run on that node.</small>
+                                    </div>
                                 </div>
                                 <div class="form-group" style="margin-bottom:16px;">
                                     <label>Gemini API Key</label>

web/index.html

@@ -2003,6 +2003,47 @@ function configuratorNodeUrl(path) {
     return apiUrl(path);
 }
 
+// Which node the AI (Settings → AI Agent, Test Connection, assistant chat)
+// runs on. Empty = the page-serving node. Set via the "Run the CLI on" selector
+// in the AI Agent tab so the `claude` CLI only needs installing on ONE node in a
+// cluster (klasSponsor). Persisted so the choice survives reloads.
+let _aiNodeId = '';
+try { _aiNodeId = localStorage.getItem('ai_node_id') || ''; } catch (e) { _aiNodeId = ''; }
+function aiNodeUrl(path) {
+    if (_aiNodeId) {
+        const cleanPath = path.replace(/^\/api\//, '');
+        return `/api/nodes/${encodeURIComponent(_aiNodeId)}/proxy/${cleanPath}`;
+    }
+    return path;
+}
+// Fill the AI node selector with the cluster's WolfStack nodes and restore the
+// saved choice. Called when the AI Agent tab loads.
+function populateAiCliNodes() {
+    const sel = document.getElementById('ai-cli-node');
+    if (!sel) return;
+    const nodes = (allNodes || []).filter(n => n.node_type === 'wolfstack');
+    const opts = ['<option value="">This node</option>'].concat(
+        nodes.filter(n => !n.is_self).map(n =>
+            `<option value="${escapeAttr(n.id)}">${escapeHtml(n.display_name || n.hostname || n.address)}</option>`)
+    );
+    sel.innerHTML = opts.join('');
+    // Restore the saved selection if that node still exists.
+    if (_aiNodeId && nodes.some(n => n.id === _aiNodeId)) {
+        sel.value = _aiNodeId;
+    } else {
+        _aiNodeId = '';
+        sel.value = '';
+    }
+}
+function onAiCliNodeChange() {
+    const sel = document.getElementById('ai-cli-node');
+    _aiNodeId = sel ? sel.value : '';
+    try { localStorage.setItem('ai_node_id', _aiNodeId); } catch (e) { /* ignore */ }
+    // Re-load config + status from the newly-selected node.
+    if (typeof loadAiConfig === 'function') loadAiConfig();
+    if (typeof loadAiStatus === 'function') loadAiStatus();
+}
+
 // Which node a cert action should run on. An explicit nodeId (cluster-scope
 // rows in the SSL manager pass one) always wins; otherwise the configurator's
 // selected node; '' means the page-serving node (the existing single-node
@@ -32042,7 +32083,7 @@ async function sendAiMessage() {
         }
         if (currentPage) chatPayload.view = currentPage;
 
-        var resp = await fetch('/api/ai/chat', {
+        var resp = await fetch(aiNodeUrl('/api/ai/chat'), {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify(chatPayload)
@@ -32177,7 +32218,7 @@ async function approveAiAction(actionId) {
 
     // Mark the action as approved on the server first (required before terminal can fetch the command)
     try {
-        var approveResp = await fetch('/api/ai/action', {
+        var approveResp = await fetch(aiNodeUrl('/api/ai/action'), {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ action_id: actionId, approved: true })
@@ -32213,7 +32254,7 @@ async function dismissAiAction(actionId) {
     if (btns) btns.innerHTML = '<span style="color:var(--text-muted);font-size:12px;">Dismissed</span>';
 
     try {
-        await fetch('/api/ai/action', {
+        await fetch(aiNodeUrl('/api/ai/action'), {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ action_id: actionId, approved: false })
@@ -32228,8 +32269,9 @@ function openAiSettings() {
 }
 
 async function loadAiConfig() {
+    populateAiCliNodes();
     try {
-        var resp = await fetch('/api/ai/config');
+        var resp = await fetch(aiNodeUrl('/api/ai/config'));
         var cfg = await resp.json();
         var el;
         // agent_enabled defaults to true server-side; tolerate missing
@@ -32288,7 +32330,7 @@ async function fetchAiModels(provider, selectedModel) {
     }
     select.innerHTML = '<option value="">Loading models...</option>';
     try {
-        var resp = await fetch('/api/ai/models?provider=' + encodeURIComponent(provider));
+        var resp = await fetch(aiNodeUrl('/api/ai/models?provider=' + encodeURIComponent(provider)));
         var data = await resp.json();
         var models = data.models || [];
         select.innerHTML = '';
@@ -32424,7 +32466,7 @@ async function saveAiConfig() {
     if (model === null) return;
     var config = _buildAiConfigPayload(model);
     try {
-        var resp = await fetch('/api/ai/config', {
+        var resp = await fetch(aiNodeUrl('/api/ai/config'), {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify(config)
@@ -32451,7 +32493,7 @@ async function saveAiConfig() {
 
 async function loadAiStatus() {
     try {
-        var resp = await fetch('/api/ai/status');
+        var resp = await fetch(aiNodeUrl('/api/ai/status'));
         var status = await resp.json();
         var textEl = document.getElementById('ai-status-text');
         var detailEl = document.getElementById('ai-status-detail');
@@ -32479,7 +32521,7 @@ async function loadAiStatus() {
 
 async function loadAiAlerts() {
     try {
-        var resp = await fetch('/api/ai/alerts');
+        var resp = await fetch(aiNodeUrl('/api/ai/alerts'));
         var alerts = await resp.json();
         var container = document.getElementById('ai-alerts-list');
         if (!container) return;
@@ -32546,15 +32588,15 @@ async function testAiConnection() {
     };
 
     try {
-        await fetch('/api/ai/config', {
+        await fetch(aiNodeUrl('/api/ai/config'), {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify(config)
         });
 
         stepEl.textContent = 'Sending a 150-byte ping to ' + (config.provider === 'local' ? config.local_url : config.provider) + '…';
 
-        var resp = await fetch('/api/ai/test-connection', {
+        var resp = await fetch(aiNodeUrl('/api/ai/test-connection'), {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
         });
@@ -32589,7 +32631,7 @@ async function testAiConnection() {
 
 async function sendTestEmail() {
     try {
-        var resp = await fetch('/api/ai/test-email', { method: 'POST' });
+        var resp = await fetch(aiNodeUrl('/api/ai/test-email'), { method: 'POST' });
         var data = await resp.json();
         if (data.error) {
             showModal('' + data.error, 'Email Error');