osuite 2.9.4 → 2.9.5

package/README.md

@@ -1,4 +1,4 @@
-# OSuite SDK (v2.9.4)
+# OSuite SDK (v2.9.5)
 
 **Governed action SDK for AI agents.**
 
@@ -11,6 +11,13 @@ The OSuite SDK helps teams route approvals, record governed decisions, and produ
 npm install osuite
 ```
 
+### One-command runtime connect
+```bash
+curl -fsSL https://studio.osuite.ai/install.sh | bash
+```
+
+The installer detects Codex, Claude Code, SDK, or MCP-style projects, opens a browser handoff, and writes the approved runtime environment into the project (`.codex/.env`, `.claude/.env`, or `.osuite/.env`). API keys remain available as a fallback, but the normal path is terminal start -> Studio approval -> terminal auto-finish.
+
 ### Python
 ```bash
 pip install requests

package/cli.js

@@ -162,6 +162,124 @@ function buildConnectHandoffUrl({ baseUrl, runtime, code }) {
   return url.toString();
 }
 
+function defaultAgentIdForRuntime(runtime) {
+  if (runtime === 'codex') return 'codex-runtime';
+  if (runtime === 'claude') return 'claude-code-runtime';
+  if (runtime === 'mcp') return 'mcp-runtime';
+  return 'sdk-runtime';
+}
+
+function envPathForRuntime(runtime) {
+  if (runtime === 'codex') return '.codex/.env';
+  if (runtime === 'claude') return '.claude/.env';
+  return '.osuite/.env';
+}
+
+function orderedEnvEntries(env = {}) {
+  const preferred = [
+    'OSUITE_BASE_URL',
+    'OSUITE_API_KEY',
+    'OSUITE_AGENT_ID',
+    'OSUITE_RUNTIME_ADAPTER_ID',
+    'OSUITE_SIGNATURE_MODE',
+  ];
+  const seen = new Set();
+  const entries = [];
+  preferred.forEach((key) => {
+    if (env[key] !== undefined && env[key] !== null && env[key] !== '') {
+      seen.add(key);
+      entries.push([key, env[key]]);
+    }
+  });
+  Object.keys(env)
+    .sort()
+    .forEach((key) => {
+      if (!seen.has(key) && env[key] !== undefined && env[key] !== null && env[key] !== '') {
+        entries.push([key, env[key]]);
+      }
+    });
+  return entries;
+}
+
+function formatEnvBody(env = {}) {
+  return `${orderedEnvEntries(env)
+    .map(([key, value]) => `${key}=${String(value).replace(/\n/g, '')}`)
+    .join('\n')}\n`;
+}
+
+function parsePositiveInt(value, fallback) {
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isFinite(parsed) || parsed < 0) return fallback;
+  return parsed;
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+async function postJson(url, body) {
+  const response = await fetch(url, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(body || {}),
+  });
+  const text = await response.text();
+  let payload = {};
+  if (text) {
+    try {
+      payload = JSON.parse(text);
+    } catch {
+      payload = { raw: text };
+    }
+  }
+  return { response, payload };
+}
+
+async function startDeviceConnect({ baseUrl, runtime, agentId }) {
+  const { response, payload } = await postJson(`${normalizedBaseUrl(baseUrl)}/api/onboarding/device-connect/start`, {
+    runtime,
+    agent_id: agentId,
+    project_root: process.cwd(),
+  });
+  if (!response.ok) {
+    throw new Error(payload.error || `Unable to start browser handoff: HTTP ${response.status}`);
+  }
+  if (!payload.device_code || !payload.poll_token || !payload.user_code) {
+    throw new Error('Studio did not return a complete device-connect payload.');
+  }
+  return payload;
+}
+
+async function pollDeviceConnect({ baseUrl, deviceCode, pollToken, timeoutMs, intervalMs }) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() <= deadline) {
+    const { response, payload } = await postJson(`${normalizedBaseUrl(baseUrl)}/api/onboarding/device-connect/poll`, {
+      device_code: deviceCode,
+      poll_token: pollToken,
+    });
+
+    if (response.status === 200 && payload.status === 'approved' && payload.credential?.env) {
+      return payload.credential;
+    }
+    if (response.status === 202 || payload.status === 'pending') {
+      const serverInterval = Number(payload.interval_seconds || 0) * 1000;
+      await sleep(serverInterval > 0 ? Math.max(intervalMs, serverInterval) : intervalMs);
+      continue;
+    }
+    if (response.status === 410 || payload.status === 'expired') {
+      throw new Error('Browser handoff expired. Run osuite connect again.');
+    }
+    if (response.status === 409 || payload.status === 'consumed') {
+      throw new Error(payload.error || 'Browser handoff was already consumed.');
+    }
+    if (response.status === 404) {
+      throw new Error('Browser handoff was not found. Run osuite connect again.');
+    }
+    throw new Error(payload.error || `Unable to finish browser handoff: HTTP ${response.status}`);
+  }
+  return null;
+}
+
 function projectFilePath(relativePath) {
   const clean = String(relativePath || '').replace(/^\/+/, '');
   const root = path.resolve(process.cwd());
@@ -554,21 +672,32 @@ async function connect(target = 'auto', args = {}) {
   const config = readConfig();
   const runtime = detectRuntimeTarget(target);
   const baseUrl = normalizedBaseUrl(args['base-url'] || config.baseUrl || DEFAULT_BASE_URL);
-  const code = String(args.code || generateConnectCode()).trim() || generateConnectCode();
-  const handoffUrl = buildConnectHandoffUrl({ baseUrl, runtime, code });
+  const configuredAgentId = envValue('OSUITE_AGENT_ID', 'DASHCLAW_AGENT_ID');
+  const agentId = String(args['agent-id'] || configuredAgentId || defaultAgentIdForRuntime(runtime));
+  const dryRunCode = String(args.code || generateConnectCode()).trim() || generateConnectCode();
+  let connectPayload = null;
+  let code = dryRunCode;
+  let handoffUrl = buildConnectHandoffUrl({ baseUrl, runtime, code });
   const hasApiKey = Boolean(config.apiKey);
 
+  if (!args['dry-run']) {
+    connectPayload = await startDeviceConnect({ baseUrl, runtime, agentId });
+    code = connectPayload.user_code;
+    handoffUrl = connectPayload.verification_uri_complete || buildConnectHandoffUrl({ baseUrl, runtime, code });
+  }
+
   write(c('OSuite Connect', `${ANSI.bold}${ANSI.cyan}`));
   write(c('Project-root setup for governed agent actions.', ANSI.dim));
   write('');
   write(`Detected runtime     ${runtime}`);
   write(`Project root         ${process.cwd()}`);
   write(`Browser handoff      ${handoffUrl}`);
+  write(`One-time code        ${code}`);
   write('');
   write(c('What happens next', ANSI.bold));
-  write('  1. Open the browser handoff URL and choose the workspace that should own this runtime.');
-  write('  2. OSuite prepares the runtime identity and project hook lane for the detected agent.');
-  write('  3. Run osuite doctor, then trigger one low-risk governed action from the same project root.');
+  write('  1. Open the browser handoff URL and approve this terminal connection in Studio.');
+  write('  2. OSuite prepares the runtime identity, project hook lane, and signed env for this project.');
+  write('  3. Return here; the CLI will finish automatically and then you can run osuite doctor.');
   write('');
 
   if (PROJECT_BOOTSTRAPS[runtime]) {
@@ -584,6 +713,39 @@ async function connect(target = 'auto', args = {}) {
     if (runtime === 'mcp') write('  Wrap consequential tool calls with OSuite preflight, wait-for-approval, and complete-action steps.');
   }
 
+  if (!args['dry-run'] && connectPayload) {
+    const timeoutMs = parsePositiveInt(args['poll-timeout-ms'], 180000);
+    const intervalMs = parsePositiveInt(
+      args['poll-interval-ms'],
+      Math.max(1000, Number(connectPayload.interval_seconds || 2) * 1000),
+    );
+
+    write('');
+    write(c('Waiting for browser approval', ANSI.bold));
+    write(`  Code ${code} expires in about ${Math.round(Number(connectPayload.expires_in || 600) / 60)} minutes.`);
+
+    const credential = await pollDeviceConnect({
+      baseUrl,
+      deviceCode: connectPayload.device_code,
+      pollToken: connectPayload.poll_token,
+      timeoutMs,
+      intervalMs,
+    });
+
+    if (credential?.env) {
+      const envPath = envPathForRuntime(runtime);
+      const result = writeProjectFile(envPath, formatEnvBody(credential.env), { force: true });
+      write('');
+      write(c('Connected to OSuite', ANSI.green));
+      write(`  ${result.status === 'written' ? 'wrote' : 'kept'} ${result.relativePath}`);
+      write('  Run osuite doctor, then start the agent from this project root.');
+    } else {
+      write('');
+      write(c('Browser approval not completed before the timeout.', ANSI.yellow));
+      write('  Keep the browser handoff open or run osuite connect again.');
+    }
+  }
+
   write('');
   write(c('API key fallback', ANSI.bold));
   if (hasApiKey) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "osuite",
-  "version": "2.9.4",
+  "version": "2.9.5",
   "description": "OSuite governed action SDK for AI agents. Approve, replay, prove, and verify runtime decisions.",
   "type": "module",
   "publishConfig": {