athena-agent-launcher 0.2.0 → 0.3.1

package/bin/launcher.mjs

@@ -139,48 +139,176 @@ async function runSetup() {
   process.stdout.write("  Run an agent with: athena-agent run <agent-id>\n\n");
 }
 
-// Return the absolute path to `hermes` if it's findable on PATH, in
-// ~/.local/bin, or in a few other common locations. Returns null if not found.
+// Return the absolute path to `hermes` if it's findable on PATH or in a few
+// common install locations. Cross-platform (uses `where` on Windows, `which`
+// elsewhere) and never throws if the finder binary is missing. Returns null if
+// not found.
 async function locateHermes() {
-  const userLocalBin = join(homedir(), ".local", "bin", "hermes");
-  const candidates = [userLocalBin, "/usr/local/bin/hermes", "/opt/homebrew/bin/hermes"];
+  const isWin = process.platform === "win32";
+  const home = homedir();
+  const candidates = isWin
+    ? [
+        join(home, ".local", "bin", "hermes.exe"),
+        join(home, ".local", "bin", "hermes.cmd"),
+        join(home, ".local", "bin", "hermes"),
+      ]
+    : [join(home, ".local", "bin", "hermes"), "/usr/local/bin/hermes", "/opt/homebrew/bin/hermes"];
   for (const p of candidates) {
     if (existsSync(p)) return p;
   }
-  const which = await new Promise((resolve) => {
-    const c = spawn("which", ["hermes"], { stdio: ["ignore", "pipe", "ignore"] });
+  // `where` (Windows) / `which` (POSIX). Wrapped so a missing finder binary
+  // surfaces as null instead of an unhandled 'error' event (the ENOENT crash).
+  const finder = isWin ? "where" : "which";
+  return await new Promise((resolve) => {
     let out = "";
-    c.stdout.on("data", (d) => (out += d.toString()));
-    c.on("exit", () => resolve(out.trim()));
+    let child;
+    try {
+      child = spawn(finder, ["hermes"], { stdio: ["ignore", "pipe", "ignore"] });
+    } catch {
+      return resolve(null);
+    }
+    child.on("error", () => resolve(null));
+    child.stdout.on("data", (d) => (out += d.toString()));
+    child.on("exit", () => {
+      const first = out
+        .split(/\r?\n/)
+        .map((s) => s.trim())
+        .filter(Boolean)[0];
+      resolve(first || null);
+    });
   });
-  return which || null;
 }
 
 async function ensureHermesInstalled() {
   const found = await locateHermes();
   if (found) return found;
 
+  const isWin = process.platform === "win32";
   process.stderr.write(
-    "[athena-agent] Hermes is not installed. Installing silently (this is a one-time setup)…\n",
+    "[athena-agent] Hermes is not installed. Installing (this is a one-time setup)…\n",
   );
-  // `bash -s -- --skip-setup` passes the flag to the install script and
-  // suppresses its post-install wizard, so the user only ever sees Athena's UX.
   const code = await new Promise((resolve) => {
-    const c = spawn(
-      "bash",
-      ["-c", "curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash -s -- --skip-setup"],
-      { stdio: "inherit" },
-    );
+    let c;
+    try {
+      c = isWin
+        ? // Native Windows installer (PowerShell). Hermes' CLI + ACP run
+          // natively; only its own dashboard pane needs WSL2, which we don't use.
+          spawn(
+            "powershell",
+            [
+              "-NoProfile",
+              "-ExecutionPolicy",
+              "Bypass",
+              "-Command",
+              "iex (irm https://hermes-agent.nousresearch.com/install.ps1)",
+            ],
+            { stdio: "inherit" },
+          )
+        : // `bash -s -- --skip-setup` suppresses the installer's wizard so the
+          // user only ever sees Athena's UX.
+          spawn(
+            "bash",
+            [
+              "-c",
+              "curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash -s -- --skip-setup",
+            ],
+            { stdio: "inherit" },
+          );
+    } catch {
+      return resolve(1);
+    }
+    c.on("error", () => resolve(1));
     c.on("exit", (code) => resolve(code ?? 1));
   });
   if (code !== 0) {
-    process.stderr.write("[athena-agent] Hermes install failed. See output above.\n");
+    process.stderr.write(
+      "[athena-agent] Hermes install failed. On Windows you can also install it manually\n" +
+        "  (PowerShell):  iex (irm https://hermes-agent.nousresearch.com/install.ps1)\n" +
+        "  then re-run this command. Or use WSL2 for the fully-supported Linux path.\n",
+    );
     return null;
   }
   process.stderr.write("[athena-agent] Hermes installed.\n");
   return await locateHermes();
 }
 
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
+// Open a URL in the user's default browser (best-effort, cross-platform).
+function openBrowser(url) {
+  const cmd =
+    process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const cmdArgs = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    spawn(cmd, cmdArgs, { stdio: "ignore", detached: true }).unref();
+  } catch {
+    /* best-effort; the URL is also printed */
+  }
+}
+
+// SSO device pairing: open the browser to authorize, poll until a key bound to
+// the verified identity is issued. Returns the ak_ key.
+async function pairAndGetKey(baseUrl, agentId) {
+  const startRes = await fetch(`${baseUrl}/api/launcher/pair/start`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ agent_id: agentId }),
+  });
+  if (!startRes.ok) {
+    throw new Error(`pair/start failed (${startRes.status}): ${await startRes.text()}`);
+  }
+  const { device_code, user_code, verification_url } = await startRes.json();
+  process.stderr.write(
+    `\n[athena-agent] Sign in with your Sonance account to authorize this device:\n` +
+      `\n    ${verification_url}\n\n` +
+      `  (opening your browser… code: ${user_code})\n\n`,
+  );
+  openBrowser(verification_url);
+
+  const deadline = Date.now() + 10 * 60 * 1000;
+  let notified = false;
+  while (Date.now() < deadline) {
+    await sleep(3000);
+    let j;
+    try {
+      const pollRes = await fetch(`${baseUrl}/api/launcher/pair/poll`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ device_code }),
+      });
+      j = await pollRes.json();
+    } catch {
+      continue; // transient network blip — keep polling
+    }
+    if (j.status === "approved" && j.api_key) {
+      process.stderr.write("[athena-agent] ✓ authorized.\n");
+      return j.api_key;
+    }
+    if (j.status === "denied") throw new Error(`Authorization denied: ${j.error || "no access"}`);
+    if (j.status === "expired") throw new Error("Pairing expired — run the command again.");
+    if (!notified && j.status === "pending") {
+      process.stderr.write("[athena-agent] waiting for you to approve in the browser…\n");
+      notified = true;
+    }
+  }
+  throw new Error("Pairing timed out — run the command again.");
+}
+
+// Persist a per-agent key (new format) without clobbering other agents' keys
+// or the legacy flat `api_key`.
+function saveAgentKey(agentId, apiKey, baseUrl) {
+  const credsPath = join(homedir(), ".athena", "credentials.json");
+  const creds = loadCredsFile();
+  if (!creds.base_url) creds.base_url = baseUrl;
+  creds.agent_keys = creds.agent_keys || {};
+  creds.agent_keys[agentId] = apiKey;
+  mkdirSync(dirname(credsPath), { recursive: true });
+  writeFileSync(credsPath, JSON.stringify(creds, null, 2), "utf8");
+  chmodSync(credsPath, 0o600);
+}
+
 async function fetchManifest({ baseUrl, agentId, apiKey }) {
   const res = await fetch(`${baseUrl}/api/agents/${agentId}/launcher-manifest`, {
     headers: { authorization: `Bearer ${apiKey}` },
@@ -232,28 +360,36 @@ async function main() {
   }
 
   const agentId = args._[1];
-  let creds = loadCredsFile();
-  let baseUrl =
+  const creds = loadCredsFile();
+  const baseUrl =
     args.baseUrl || process.env.ATHENA_BASE_URL || creds.base_url || DEFAULT_BASE_URL;
-  let apiKey = args.apiKey || process.env.ATHENA_API_KEY || creds.api_key;
-
-  // First-run UX: if no credentials are available, drop straight into the
-  // setup prompt instead of bailing with an error. Skip when --api-key was
-  // passed explicitly (caller is scripting and supplied creds inline).
+  // Key precedence: explicit flag/env > per-agent saved key > legacy flat key.
+  let apiKey =
+    args.apiKey ||
+    process.env.ATHENA_API_KEY ||
+    creds.agent_keys?.[agentId] ||
+    creds.api_key;
+
+  // No saved key for this agent → authorize this device via Sonance SSO. The
+  // browser flow verifies the user's Okta identity and (if they hold an access
+  // grant) hands back a key bound to their account, which we cache per-agent.
   if (!apiKey && !args.apiKey) {
     process.stderr.write(
-      "[athena-agent] no credentials found — running first-time setup.\n",
+      `[athena-agent] no saved key for ${agentId} — starting SSO authorization.\n`,
     );
-    await runSetup();
-    creds = loadCredsFile();
-    baseUrl = creds.base_url || baseUrl;
-    apiKey = creds.api_key;
+    try {
+      apiKey = await pairAndGetKey(baseUrl, agentId);
+    } catch (err) {
+      process.stderr.write(`[athena-agent] ${err.message}\n`);
+      process.exit(1);
+    }
+    saveAgentKey(agentId, apiKey, baseUrl);
   }
 
   if (!apiKey) {
     process.stderr.write(
       "Error: no API key. Pass --api-key ak_..., set $ATHENA_API_KEY, " +
-        "or write {\"api_key\": \"ak_...\"} to ~/.athena/credentials.json\n",
+        "or run without flags to authorize via Sonance SSO.\n",
     );
     process.exit(2);
   }
@@ -262,17 +398,33 @@ async function main() {
   try {
     manifest = await fetchManifest({ baseUrl, agentId, apiKey });
   } catch (err) {
-    // `fetch failed` from undici is opaque on its own — the real cause
-    // (ENOTFOUND, ECONNREFUSED, TLS, etc.) lives on err.cause.
-    const cause = err?.cause
-      ? ` (${err.cause.code || err.cause.message || err.cause})`
-      : "";
-    process.stderr.write(
-      `[athena-agent] ${err.message}${cause}\n` +
-        `  base URL: ${baseUrl}\n` +
-        `  agent:    ${agentId}\n`,
-    );
-    process.exit(1);
+    // A saved key that's been revoked server-side returns 401 — re-authorize
+    // via SSO once and retry, unless the key was supplied explicitly.
+    if (/\(401\)/.test(err.message) && !args.apiKey && !process.env.ATHENA_API_KEY) {
+      process.stderr.write(
+        "[athena-agent] saved key was rejected (revoked?) — re-authorizing via SSO.\n",
+      );
+      try {
+        apiKey = await pairAndGetKey(baseUrl, agentId);
+        saveAgentKey(agentId, apiKey, baseUrl);
+        manifest = await fetchManifest({ baseUrl, agentId, apiKey });
+      } catch (err2) {
+        process.stderr.write(`[athena-agent] ${err2.message}\n`);
+        process.exit(1);
+      }
+    } else {
+      // `fetch failed` from undici is opaque on its own — the real cause
+      // (ENOTFOUND, ECONNREFUSED, TLS, etc.) lives on err.cause.
+      const cause = err?.cause
+        ? ` (${err.cause.code || err.cause.message || err.cause})`
+        : "";
+      process.stderr.write(
+        `[athena-agent] ${err.message}${cause}\n` +
+          `  base URL: ${baseUrl}\n` +
+          `  agent:    ${agentId}\n`,
+      );
+      process.exit(1);
+    }
   }
 
   if (args.manifestOnly) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "athena-agent-launcher",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "Run an Athena-configured agent locally. Resolves runtime + bindings from the Athena control plane and spawns the correct agent binary (Anthropic SDK, OpenClaw, or Hermes).",
   "type": "module",
   "bin": {