athena-agent-launcher 0.2.0 → 0.3.0

package/bin/launcher.mjs

@@ -181,6 +181,83 @@ async function ensureHermesInstalled() {
   return await locateHermes();
 }
 
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
+// Open a URL in the user's default browser (best-effort, cross-platform).
+function openBrowser(url) {
+  const cmd =
+    process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const cmdArgs = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    spawn(cmd, cmdArgs, { stdio: "ignore", detached: true }).unref();
+  } catch {
+    /* best-effort; the URL is also printed */
+  }
+}
+
+// SSO device pairing: open the browser to authorize, poll until a key bound to
+// the verified identity is issued. Returns the ak_ key.
+async function pairAndGetKey(baseUrl, agentId) {
+  const startRes = await fetch(`${baseUrl}/api/launcher/pair/start`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ agent_id: agentId }),
+  });
+  if (!startRes.ok) {
+    throw new Error(`pair/start failed (${startRes.status}): ${await startRes.text()}`);
+  }
+  const { device_code, user_code, verification_url } = await startRes.json();
+  process.stderr.write(
+    `\n[athena-agent] Sign in with your Sonance account to authorize this device:\n` +
+      `\n    ${verification_url}\n\n` +
+      `  (opening your browser… code: ${user_code})\n\n`,
+  );
+  openBrowser(verification_url);
+
+  const deadline = Date.now() + 10 * 60 * 1000;
+  let notified = false;
+  while (Date.now() < deadline) {
+    await sleep(3000);
+    let j;
+    try {
+      const pollRes = await fetch(`${baseUrl}/api/launcher/pair/poll`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ device_code }),
+      });
+      j = await pollRes.json();
+    } catch {
+      continue; // transient network blip — keep polling
+    }
+    if (j.status === "approved" && j.api_key) {
+      process.stderr.write("[athena-agent] ✓ authorized.\n");
+      return j.api_key;
+    }
+    if (j.status === "denied") throw new Error(`Authorization denied: ${j.error || "no access"}`);
+    if (j.status === "expired") throw new Error("Pairing expired — run the command again.");
+    if (!notified && j.status === "pending") {
+      process.stderr.write("[athena-agent] waiting for you to approve in the browser…\n");
+      notified = true;
+    }
+  }
+  throw new Error("Pairing timed out — run the command again.");
+}
+
+// Persist a per-agent key (new format) without clobbering other agents' keys
+// or the legacy flat `api_key`.
+function saveAgentKey(agentId, apiKey, baseUrl) {
+  const credsPath = join(homedir(), ".athena", "credentials.json");
+  const creds = loadCredsFile();
+  if (!creds.base_url) creds.base_url = baseUrl;
+  creds.agent_keys = creds.agent_keys || {};
+  creds.agent_keys[agentId] = apiKey;
+  mkdirSync(dirname(credsPath), { recursive: true });
+  writeFileSync(credsPath, JSON.stringify(creds, null, 2), "utf8");
+  chmodSync(credsPath, 0o600);
+}
+
 async function fetchManifest({ baseUrl, agentId, apiKey }) {
   const res = await fetch(`${baseUrl}/api/agents/${agentId}/launcher-manifest`, {
     headers: { authorization: `Bearer ${apiKey}` },
@@ -232,28 +309,36 @@ async function main() {
   }
 
   const agentId = args._[1];
-  let creds = loadCredsFile();
-  let baseUrl =
+  const creds = loadCredsFile();
+  const baseUrl =
     args.baseUrl || process.env.ATHENA_BASE_URL || creds.base_url || DEFAULT_BASE_URL;
-  let apiKey = args.apiKey || process.env.ATHENA_API_KEY || creds.api_key;
-
-  // First-run UX: if no credentials are available, drop straight into the
-  // setup prompt instead of bailing with an error. Skip when --api-key was
-  // passed explicitly (caller is scripting and supplied creds inline).
+  // Key precedence: explicit flag/env > per-agent saved key > legacy flat key.
+  let apiKey =
+    args.apiKey ||
+    process.env.ATHENA_API_KEY ||
+    creds.agent_keys?.[agentId] ||
+    creds.api_key;
+
+  // No saved key for this agent → authorize this device via Sonance SSO. The
+  // browser flow verifies the user's Okta identity and (if they hold an access
+  // grant) hands back a key bound to their account, which we cache per-agent.
   if (!apiKey && !args.apiKey) {
     process.stderr.write(
-      "[athena-agent] no credentials found — running first-time setup.\n",
+      `[athena-agent] no saved key for ${agentId} — starting SSO authorization.\n`,
     );
-    await runSetup();
-    creds = loadCredsFile();
-    baseUrl = creds.base_url || baseUrl;
-    apiKey = creds.api_key;
+    try {
+      apiKey = await pairAndGetKey(baseUrl, agentId);
+    } catch (err) {
+      process.stderr.write(`[athena-agent] ${err.message}\n`);
+      process.exit(1);
+    }
+    saveAgentKey(agentId, apiKey, baseUrl);
   }
 
   if (!apiKey) {
     process.stderr.write(
       "Error: no API key. Pass --api-key ak_..., set $ATHENA_API_KEY, " +
-        "or write {\"api_key\": \"ak_...\"} to ~/.athena/credentials.json\n",
+        "or run without flags to authorize via Sonance SSO.\n",
     );
     process.exit(2);
   }
@@ -262,17 +347,33 @@ async function main() {
   try {
     manifest = await fetchManifest({ baseUrl, agentId, apiKey });
   } catch (err) {
-    // `fetch failed` from undici is opaque on its own — the real cause
-    // (ENOTFOUND, ECONNREFUSED, TLS, etc.) lives on err.cause.
-    const cause = err?.cause
-      ? ` (${err.cause.code || err.cause.message || err.cause})`
-      : "";
-    process.stderr.write(
-      `[athena-agent] ${err.message}${cause}\n` +
-        `  base URL: ${baseUrl}\n` +
-        `  agent:    ${agentId}\n`,
-    );
-    process.exit(1);
+    // A saved key that's been revoked server-side returns 401 — re-authorize
+    // via SSO once and retry, unless the key was supplied explicitly.
+    if (/\(401\)/.test(err.message) && !args.apiKey && !process.env.ATHENA_API_KEY) {
+      process.stderr.write(
+        "[athena-agent] saved key was rejected (revoked?) — re-authorizing via SSO.\n",
+      );
+      try {
+        apiKey = await pairAndGetKey(baseUrl, agentId);
+        saveAgentKey(agentId, apiKey, baseUrl);
+        manifest = await fetchManifest({ baseUrl, agentId, apiKey });
+      } catch (err2) {
+        process.stderr.write(`[athena-agent] ${err2.message}\n`);
+        process.exit(1);
+      }
+    } else {
+      // `fetch failed` from undici is opaque on its own — the real cause
+      // (ENOTFOUND, ECONNREFUSED, TLS, etc.) lives on err.cause.
+      const cause = err?.cause
+        ? ` (${err.cause.code || err.cause.message || err.cause})`
+        : "";
+      process.stderr.write(
+        `[athena-agent] ${err.message}${cause}\n` +
+          `  base URL: ${baseUrl}\n` +
+          `  agent:    ${agentId}\n`,
+      );
+      process.exit(1);
+    }
   }
 
   if (args.manifestOnly) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "athena-agent-launcher",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Run an Athena-configured agent locally. Resolves runtime + bindings from the Athena control plane and spawns the correct agent binary (Anthropic SDK, OpenClaw, or Hermes).",
   "type": "module",
   "bin": {