@halofy/agent-connect 0.11.0 → 0.12.0

package/README.md

@@ -22,7 +22,28 @@ conversations and serves the agent-invoked MCP memory tools, but does not push
 recalled memory into host sessions on session start or prompt submit. The
 bounded recall block formats stay in place and tested for when it returns.
 
-There is one setup path for every packaged client:
+## Browser sign-in (0.12.0 source)
+
+Users assigned to a team can run the installer without a manually copied badge:
+
+```bash
+npx @halofy/agent-connect@0.12.0 install claude-code --server https://app.halofy.ai
+```
+
+`login <client-kind> --server <origin>` is an alias for the same installation
+flow. The installer opens the existing Halofy sign-in page, displays a public
+verification code, and waits for the user to confirm their authorized team and
+device. Google sign-in is available through the existing console authentication.
+A per-installation Ed25519 key is saved privately before enrollment; the approval
+claim is bound to that same key. Device secrets and claims are never printed or
+put in browser URLs. Retry a failed/expired sign-in with the same command; the
+pending key survives retries. Installation still requires the terminal's
+explicit CONNECT disclosure before changing host configuration.
+
+This source version requires the matching server enrollment endpoints and a
+published 0.12.0 package before the npx example can be used remotely. The existing
+manual claim path remains supported:
+
 
 ```bash
 npx --yes @halofy/agent-connect@0.10.0 install <client-kind> \

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@halofy/agent-connect",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "type": "module",
   "description": "Halofy lifecycle installer and runtime for supported agents; runtime requests are signed with a per-installation Ed25519 key",
   "bin": {

package/src/enrollment.mjs

@@ -0,0 +1,83 @@
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { spawn } from "node:child_process";
+import { generateInstallationKeyPair } from "./crypto.mjs";
+import { normalizeLifecycleServerUrl } from "./install.mjs";
+import { readJson, writePrivateFile, defaultRuntimeDirectory } from "./storage.mjs";
+import { CLIENT_KINDS } from "./client-registry.mjs";
+
+export async function prepareInstallationKey(root, clientKind) {
+  const path = join(root, `pending-${clientKind}.json`);
+  const previous = await readJson(path);
+  if (previous) {
+    if (!previous.publicJwk || !previous.privateJwk || !previous.installationIdCandidate) {
+      throw new Error("pending installation key is invalid; repair local runtime storage before retrying");
+    }
+    return previous;
+  }
+  const key = { ...generateInstallationKeyPair(), installationIdCandidate: `local_${randomUUID()}` };
+  await writePrivateFile(path, `${JSON.stringify(key)}\n`);
+  return key;
+}
+
+export function openVerificationBrowser(uri) {
+  const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "rundll32" : "xdg-open";
+  const args = process.platform === "win32" ? ["url.dll,FileProtocolHandler", uri] : [uri];
+  const child = spawn(command, args, { shell: false, detached: true, stdio: "ignore" });
+  child.on("error", () => {}); // Printed URL remains usable when there is no desktop browser.
+  child.unref();
+}
+
+/** Device secrets stay in memory. Only the public human code reaches browser/terminal. */
+export async function enrollWithBrowser({ serverUrl, clientKind, root = defaultRuntimeDirectory(),
+  fetchImpl = globalThis.fetch, output = process.stdout, openBrowser = openVerificationBrowser,
+  sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), now = Date.now }) {
+  if (!CLIENT_KINDS.includes(clientKind)) throw new Error("unsupported enrollment client");
+  const server = normalizeLifecycleServerUrl(serverUrl);
+  const base = new URL(server);
+  if (!["https:", "http:"].includes(base.protocol) || base.username || base.password || base.search || base.hash || base.pathname !== "/") {
+    throw new Error("sign-in requires a server origin without credentials, path or query");
+  }
+  const key = await prepareInstallationKey(root, clientKind);
+  async function request(path, body) {
+    let response;
+    try {
+      response = await fetchImpl(`${server}/v1/agent-enrollment/${path}`, {
+        method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body),
+        redirect: "error", signal: AbortSignal.timeout(15_000),
+      });
+    } catch { throw new Error("sign-in connection unavailable; retry sign-in"); }
+    if (!response.ok) {
+      throw new Error(response.status === 429 ? "sign-in rate limit reached; try again later" :
+        response.status === 410 ? "sign-in expired; retry sign-in" : "sign-in denied or unavailable; retry sign-in");
+    }
+    try { return await response.json(); } catch { throw new Error("invalid sign-in response"); }
+  }
+  const start = await request("start", { clientKind, publicKeyJwk: key.publicJwk });
+  let uri;
+  try { uri = new URL(start.verificationUri); } catch { throw new Error("invalid sign-in response"); }
+  if (typeof start.deviceCode !== "string" || !/^[A-Za-z0-9_-]{32,128}$/.test(start.deviceCode) ||
+      typeof start.userCode !== "string" || !/^[A-Za-z0-9-]{4,32}$/.test(start.userCode) ||
+      uri.origin !== base.origin || uri.username || uri.password || uri.pathname !== "/console/connect" ||
+      uri.hash || uri.search !== `?code=${start.userCode}` ||
+      !Number.isFinite(start.expiresIn) || start.expiresIn <= 0 || start.expiresIn > 1800 ||
+      !Number.isFinite(start.interval) || start.interval < 1 || start.interval > 60) {
+    throw new Error("invalid sign-in response");
+  }
+  const deadline = now() + start.expiresIn * 1000;
+  output.write(`Sign in and confirm this device: ${uri.href}\nCode: ${start.userCode}\n`);
+  try { await openBrowser(uri.href); } catch { /* URL is available for manual opening. */ }
+  while (now() < deadline) {
+    await sleep(start.interval * 1000);
+    if (now() >= deadline) break;
+    const token = await request("token", { deviceCode: start.deviceCode });
+    if (token.status === "pending") continue;
+    if (token.status === "expired") throw new Error("sign-in expired; retry sign-in");
+    if (token.status === "denied") throw new Error("sign-in denied; retry sign-in");
+    if (token.status !== "approved" || token.clientKind !== clientKind ||
+        typeof token.claim !== "string" || !/^hsc_[A-Za-z0-9_-]{43}$/.test(token.claim) ||
+        typeof token.organization !== "string" || !token.organization.trim()) throw new Error("invalid sign-in response");
+    return { claim: token.claim, organization: token.organization.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").trim().slice(0, 100) };
+  }
+  throw new Error("sign-in expired; retry sign-in");
+}

package/src/installer-cli.mjs

@@ -1,3 +1,4 @@
+import { enrollWithBrowser } from "./enrollment.mjs";
 import { recordHealthTargets } from "./health.mjs";
 import { spawnSync } from "node:child_process";
 import { existsSync, readdirSync } from "node:fs";
@@ -78,9 +79,9 @@ export function parseInstallerArgs(argv) {
   }
   const serverUrl = values.get("--server");
   const claim = values.get("--claim");
-  if (command !== "install" || !CLIENT_KINDS.includes(clientKind) || !serverUrl || !claim ||
-      !/^hsc_[A-Za-z0-9_-]{43}$/.test(claim)) {
-    throw new Error("Usage: agent-connect install <supported-client> --server <https-url> --claim <one-use-claim>");
+  if (!["install", "login"].includes(command) || !CLIENT_KINDS.includes(clientKind) || !serverUrl ||
+      (claim !== undefined && !/^hsc_[A-Za-z0-9_-]{43}$/.test(claim))) {
+    throw new Error("Usage: agent-connect install|login <supported-client> --server <https-url> [--claim <one-use-claim>]");
   }
   return {
     mode: "single",
@@ -426,6 +427,9 @@ export async function runInstaller(argv, {
   sourceRoot,
   claudeConfigPath,
   skillsHome,
+  openBrowser,
+  enrollmentSleep,
+  enrollmentNow,
 } = {}) {
   const input = parseInstallerArgs(argv);
   if (input.mode === "all") {
@@ -435,7 +439,13 @@ export async function runInstaller(argv, {
     });
   }
   const clientVersion = input.clientKind === "claude-code" ? await detectClaude() : await detectHost(input.clientKind);
-  const claimDisclosure = await fetchClaimDisclosure({
+  const enrollment = !input.claim ? await enrollWithBrowser({
+    serverUrl: input.serverUrl, clientKind: input.clientKind, root, fetchImpl, output,
+    ...(openBrowser ? { openBrowser } : {}), ...(enrollmentSleep ? { sleep: enrollmentSleep } : {}),
+    ...(enrollmentNow ? { now: enrollmentNow } : {}),
+  }) : null;
+  if (enrollment) input.claim = enrollment.claim;
+  const claimDisclosure = enrollment || await fetchClaimDisclosure({
     serverUrl: input.serverUrl,
     claim: input.claim,
     fetchImpl,

package/src/version.mjs

@@ -1,4 +1,4 @@
 export const PACKAGE_NAME = "@halofy/agent-connect";
-export const INSTALLER_VERSION = "0.11.0";
-export const RUNTIME_VERSION = "0.11.0";
+export const INSTALLER_VERSION = "0.12.0";
+export const RUNTIME_VERSION = "0.12.0";
 export const DISCLOSURE_VERSION = "halofy-agent-lifecycle-2026-09-10.1";