@webority/ensemble 0.2.3 → 0.3.0

package/bin/ensemble.js

@@ -18,9 +18,42 @@ function parseArgs(argv) {
   return args;
 }
 
+function reportSetup(wired) {
+  core.log('• wired session hooks: ' + (wired.join(', ') || '(no supported coding CLI found — run `ensemble hooks` after installing claude/codex/grok)'));
+  core.log('• installed auto-start + launched the runner');
+  core.log('\n✓ Done. This machine runs your Ensemble runner and its coding sessions now share the bus (scoped to your org).');
+  core.log('  Open a NEW terminal (so ENSEMBLE_MACHINE_TOKEN loads), then start Claude/Codex/Grok as usual.');
+}
+
+// Browser sign-in (device flow) — no token to copy. The recommended path.
+async function login(args) {
+  const api = args.api || core.DEFAULT_API;
+  const name = args.name || os.hostname();
+  core.log('Ensemble — signing in "' + name + '" via ' + api);
+  core.log('• fetching runner + bus binaries');
+  const { runnerPath } = await core.ensureBinaries();
+  const grant = await core.startDevice(api, name);
+  core.log('\n  Approve this machine in your browser:\n    ' + grant.verificationUriComplete +
+    '\n  Confirmation code:  ' + grant.userCode + '\n');
+  core.openBrowser(grant.verificationUriComplete);
+  core.log('• waiting for approval …');
+  const deadline = Date.now() + grant.expiresIn * 1000;
+  let token = null;
+  while (Date.now() < deadline) {
+    await core.sleep((grant.interval || 5) * 1000);
+    const r = await core.pollDevice(api, grant.deviceCode);
+    if (r.status === 'approved') { token = r.token; break; }
+    if (r.status === 'denied') core.die('approval was denied in the browser.');
+    if (r.status === 'expired') core.die('the login request expired — run `ensemble login` again.');
+  }
+  if (!token) core.die('timed out waiting for approval — run `ensemble login` again.');
+  reportSetup(core.finishSetup(api, token, runnerPath));
+}
+
+// Headless / CI path: enrol with a copy-pasted enrollment token.
 async function enroll(args) {
   const token = args.token || process.env.ENSEMBLE_ENROLL_TOKEN;
-  if (!token) core.die('missing --token <enrollment-token> — get it from your Ensemble portal → Connect Runner');
+  if (!token) core.die('missing --token <enrollment-token> — get it from your Ensemble portal → Connect Runner, or use `ensemble login` for browser sign-in');
   const api = args.api || core.DEFAULT_API;
   const name = args.name || os.hostname();
   core.log('Ensemble — enrolling "' + name + '" with ' + api);
@@ -28,14 +61,7 @@ async function enroll(args) {
   const { runnerPath } = await core.ensureBinaries();
   core.log('• exchanging enrollment token for a per-machine token');
   const machineToken = await core.enrollMachine(api, token, name);
-  core.writeRunnerConfig(api, machineToken);
-  const wired = core.wireHooks();
-  core.log('• wired session hooks: ' + (wired.join(', ') || '(no supported coding CLI found — run `ensemble hooks` after installing claude/codex/grok)'));
-  core.log('• installing auto-start + launching the runner');
-  core.installAutostart(runnerPath);
-  core.startRunner(runnerPath);
-  core.log('\n✓ Enrolled. This machine runs your Ensemble runner and its coding sessions now share the bus (scoped to your org).');
-  core.log('  Open a NEW terminal (so ENSEMBLE_MACHINE_TOKEN loads), then start Claude/Codex/Grok as usual.');
+  reportSetup(core.finishSetup(api, machineToken, runnerPath));
 }
 
 async function status(args) {
@@ -57,13 +83,15 @@ function usage() {
   core.log(
 `ensemble — connect this machine to your Ensemble control plane
 
+  ensemble login [--api <url>] [--name <machine>]
+        sign in via your browser (recommended) — approve the machine, no token to copy
   ensemble enroll --token <enrollment-token> [--api <url>] [--name <machine>]
-        download + enrol the runner, wire session hooks, and start it
+        headless / CI: enrol with an enrollment token from the portal
   ensemble status         show connection + your org's live session mailboxes
   ensemble hooks          (re)wire ensemble-bus into installed coding CLIs
   ensemble version
 
-Get your enrollment token from the Ensemble portal → Connect Runner.`);
+Run \`ensemble login\` and approve the machine in your browser.`);
 }
 
 (async () => {
@@ -71,7 +99,8 @@ Get your enrollment token from the Ensemble portal → Connect Runner.`);
   const cmd = argv[0];
   const args = parseArgs(argv.slice(1));
   try {
-    if (cmd === 'enroll') await enroll(args);
+    if (cmd === 'login') await login(args);
+    else if (cmd === 'enroll') await enroll(args);
     else if (cmd === 'status') await status(args);
     else if (cmd === 'hooks') { await core.ensureBinaries(); core.log('wired: ' + (core.wireHooks().join(', ') || 'none')); }
     else if (cmd === 'version' || cmd === '--version' || cmd === '-v') core.log(require('../package.json').version);

package/lib/core.js

@@ -238,7 +238,43 @@ function startRunner(runnerPath) {
   child.unref();
 }
 
+function sleep(ms) { return new Promise((r) => setTimeout(r, ms)); }
+
+function openBrowser(url) {
+  const pf = platform();
+  try {
+    if (pf.os === 'windows') spawn('cmd', ['/c', 'start', '', url], { detached: true, stdio: 'ignore' }).unref();
+    else if (pf.os === 'mac') spawn('open', [url], { detached: true, stdio: 'ignore' }).unref();
+    else spawn('xdg-open', [url], { detached: true, stdio: 'ignore' }).unref();
+  } catch (e) { /* fall back to the printed URL */ }
+}
+
+// --- device-authorization login (RFC 8628): browser approve instead of a copy-pasted token ---
+async function startDevice(api, machineName) {
+  const res = await request('POST', api.replace(/\/$/, '') + '/api/device/start',
+    { 'Content-Type': 'application/json' }, JSON.stringify({ machineName }));
+  if (res.status !== 200) throw new Error('could not start login: HTTP ' + res.status + ' ' + res.body);
+  return JSON.parse(res.body);
+}
+
+async function pollDevice(api, deviceCode) {
+  const res = await request('POST', api.replace(/\/$/, '') + '/api/device/poll',
+    { 'Content-Type': 'application/json' }, JSON.stringify({ deviceCode }));
+  if (res.status !== 200) throw new Error('poll failed: HTTP ' + res.status);
+  return JSON.parse(res.body);
+}
+
+// Shared post-token setup used by both `login` and `enroll`: write config, wire hooks, auto-start, run.
+function finishSetup(api, machineToken, runnerPath) {
+  writeRunnerConfig(api, machineToken);
+  const wired = wireHooks();
+  installAutostart(runnerPath);
+  startRunner(runnerPath);
+  return wired;
+}
+
 module.exports = {
   log, warn, die, platform, DEFAULT_API, ENSEMBLE_DIR, RUNNER_DIR, BIN_DIR,
   ensureBinaries, enrollMachine, writeRunnerConfig, wireHooks, installAutostart, startRunner, request,
+  sleep, openBrowser, startDevice, pollDevice, finishSetup,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webority/ensemble",
-  "version": "0.2.3",
+  "version": "0.3.0",
   "description": "Connect this machine to your Ensemble control plane — runs the local agent runner and wires the ensemble-bus session bus so your coding sessions talk (per-org, isolated).",
   "bin": {
     "ensemble": "bin/ensemble.js"