ssh-mcp-pro 1.5.0 → 1.6.0

package/CHANGELOG.md

@@ -5,6 +5,40 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.6.0](https://github.com/oaslananka/ssh-mcp-pro/compare/ssh-mcp-pro-v1.5.0...ssh-mcp-pro-v1.6.0) (2026-11-12)
+
+
+### Features
+
+* **agent:** approve Linux enrollment in local browser ([#239](https://github.com/oaslananka/ssh-mcp-pro/issues/239)) ([7ba75d4](https://github.com/oaslananka/ssh-mcp-pro/commit/7ba75d42a19a07ae2de18a7872d2fa54eb0415b8))
+* **agent:** install Node LTS on first Windows enrollment ([#219](https://github.com/oaslananka/ssh-mcp-pro/issues/219)) ([8d2f82f](https://github.com/oaslananka/ssh-mcp-pro/commit/8d2f82f8696751bcf469fd42245327d5ed4007e7))
+* **dashboard:** confirm first device is Live Online during setup ([#227](https://github.com/oaslananka/ssh-mcp-pro/issues/227)) ([7447971](https://github.com/oaslananka/ssh-mcp-pro/commit/74479716133c8d34f7233d681d58d3881b3e5f47))
+* **install:** verified Node LTS bootstrap for clean Linux and WSL ([#237](https://github.com/oaslananka/ssh-mcp-pro/issues/237)) ([600b6f3](https://github.com/oaslananka/ssh-mcp-pro/commit/600b6f3f67ffd522817719be70c7839cb864d59e))
+* **recovery:** verify encrypted backup restore offline ([#233](https://github.com/oaslananka/ssh-mcp-pro/issues/233)) ([4187749](https://github.com/oaslananka/ssh-mcp-pro/commit/41877496c8233c1c02958fc1579ba96d0745fb7c))
+* **remote:** discover allowlisted files by name ([#217](https://github.com/oaslananka/ssh-mcp-pro/issues/217)) ([0f04209](https://github.com/oaslananka/ssh-mcp-pro/commit/0f04209464fd83b2d34ca8713b244969c8aeba80))
+* **remote:** manage interactive agent processes with bounded output ([#221](https://github.com/oaslananka/ssh-mcp-pro/issues/221)) ([1beaddb](https://github.com/oaslananka/ssh-mcp-pro/commit/1beaddb1ff96f3d2bcbeb407322b0a65aa87f218))
+* **remote:** page bounded file reads with UTF-8 safe cursors ([#215](https://github.com/oaslananka/ssh-mcp-pro/issues/215)) ([cce420b](https://github.com/oaslananka/ssh-mcp-pro/commit/cce420bcda302289fc92638e778f42848218cad1))
+* **remote:** preview and apply guarded file text replacements ([#220](https://github.com/oaslananka/ssh-mcp-pro/issues/220)) ([eb3a837](https://github.com/oaslananka/ssh-mcp-pro/commit/eb3a8374942c1fe939a71f1abf3ccd130e0d9d48))
+* **remote:** search allowed file contents by literal phrase ([#223](https://github.com/oaslananka/ssh-mcp-pro/issues/223)) ([f82034d](https://github.com/oaslananka/ssh-mcp-pro/commit/f82034d1c2cbad1706effc398c8666b48f9c1df7))
+
+
+### Bug Fixes
+
+* **agent:** make Windows enrollment work with restricted PowerShell ([#218](https://github.com/oaslananka/ssh-mcp-pro/issues/218)) ([de97766](https://github.com/oaslananka/ssh-mcp-pro/commit/de977665266ea7437ad885134d37b2ccb2f69025))
+* **agent:** reconnect safely after transient remote socket loss ([#230](https://github.com/oaslananka/ssh-mcp-pro/issues/230)) ([1f79e6e](https://github.com/oaslananka/ssh-mcp-pro/commit/1f79e6ec3a915eef66668c2dda90e7afe9be706b))
+* **agent:** remove Windows scheduled task runtime cap ([#229](https://github.com/oaslananka/ssh-mcp-pro/issues/229)) ([e0956bf](https://github.com/oaslananka/ssh-mcp-pro/commit/e0956bf084b4133b278ee5d3aaf8b315f95d3b92))
+* **agent:** report failure to persist Linux user service ([#224](https://github.com/oaslananka/ssh-mcp-pro/issues/224)) ([5976050](https://github.com/oaslananka/ssh-mcp-pro/commit/59760503acc5576c49bb7d48cea9220acff5f291))
+* **agent:** report Linux status without uptime utility ([#231](https://github.com/oaslananka/ssh-mcp-pro/issues/231)) ([8868741](https://github.com/oaslananka/ssh-mcp-pro/commit/8868741439407a3dbe6d10cb57a3b06efdfd865e))
+* **dashboard:** allow browser enrollment callback to loopback ([#242](https://github.com/oaslananka/ssh-mcp-pro/issues/242)) ([7ccf4d1](https://github.com/oaslananka/ssh-mcp-pro/commit/7ccf4d13485ca99aaff9142cf0a50f9fb656c8d1))
+* **dashboard:** explain provider-scoped device inventory ([#234](https://github.com/oaslananka/ssh-mcp-pro/issues/234)) ([ac5a10c](https://github.com/oaslananka/ssh-mcp-pro/commit/ac5a10c10ee81aae54e8c1dfae03d61e66639d6a))
+* **dashboard:** show tenant-scoped device names in audit history ([#232](https://github.com/oaslananka/ssh-mcp-pro/issues/232)) ([ef0b8eb](https://github.com/oaslananka/ssh-mcp-pro/commit/ef0b8eb9398216cc88b0deaa4c8de80e58f77665))
+* **docker:** bundle installer scripts in standard runtime image ([#226](https://github.com/oaslananka/ssh-mcp-pro/issues/226)) ([ba6fffe](https://github.com/oaslananka/ssh-mcp-pro/commit/ba6fffe78877da2b7abaf2676663f15ebde36e7b))
+* **install:** clarify WSL agent lifetime after setup ([#241](https://github.com/oaslananka/ssh-mcp-pro/issues/241)) ([e1215b1](https://github.com/oaslananka/ssh-mcp-pro/commit/e1215b19d5f4870ccaf99c938f12b5525f5ee2d0))
+* **install:** explain missing system Node and npm ([#240](https://github.com/oaslananka/ssh-mcp-pro/issues/240)) ([249ee4c](https://github.com/oaslananka/ssh-mcp-pro/commit/249ee4c8f4327bfaa20e90acb09ee6c66f8208cb))
+* **remote:** describe mutation risks and output schemas ([#213](https://github.com/oaslananka/ssh-mcp-pro/issues/213)) ([c7d18f4](https://github.com/oaslananka/ssh-mcp-pro/commit/c7d18f4bcb0f9c69537277db23ce971ad051f9ec))
+* **remote:** expire abandoned pending agents ([#225](https://github.com/oaslananka/ssh-mcp-pro/issues/225)) ([43a730b](https://github.com/oaslananka/ssh-mcp-pro/commit/43a730b543ce8d8d67111dfe0391a39c57aacee4))
+* **windows:** provide tokenless legacy agent task repair ([#235](https://github.com/oaslananka/ssh-mcp-pro/issues/235)) ([5a267e8](https://github.com/oaslananka/ssh-mcp-pro/commit/5a267e8cb60a4f25b3cb0fea2911439b8774d2c5))
+
 ## [1.5.0](https://github.com/oaslananka/ssh-mcp-pro/compare/ssh-mcp-pro-v1.4.3...ssh-mcp-pro-v1.5.0) (2026-11-10)
 
 

package/MIGRATION.md

@@ -7,7 +7,7 @@ Version `1.0.0` is the initial public baseline for this repository. There are no
 When upgrading within `1.x`, preserve these compatibility expectations:
 
 - Node.js must satisfy `>=22.22.2` (Node 24 and 26 are tested in CI).
-- pnpm must satisfy `^11.28.10` for current development and build tooling.
+- pnpm must satisfy `^11.28.11` for current development and build tooling.
 - Existing stdio MCP client configs can continue to launch `ssh-mcp-pro` with no arguments.
 - HTTP deployments should keep explicit authentication, allowed origins, host allowlists, strict host-key verification, and a remote-safe tool profile.
 

package/README.md

@@ -38,7 +38,7 @@ ssh-mcp-pro is a secure Model Context Protocol (MCP) server for SSH automation.
 ## Prerequisites
 
 - Node.js `>=22.22.2` or `>=24.15.0` or `>=26.3.0`
-- pnpm `^11.28.10` (use Corepack for development)
+- pnpm `^11.28.11` (use Corepack for development)
 - SSH access to the target hosts
 - Docker, only for local integration tests and container image builds
 

package/dist/agent-bin.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { runAgentCli } from "./remote/agent-cli.js";
+import { runAgentCliWithReconnect } from "./remote/agent-cli.js";
 try {
-    await runAgentCli(process.argv.slice(2));
+    await runAgentCliWithReconnect(process.argv.slice(2));
 }
 catch (error) {
     const message = error instanceof Error ? error.message : String(error);

package/dist/agent-bin.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-bin.js","sourceRoot":"","sources":["../src/agent-bin.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,IAAI,CAAC;IACH,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC;AAAC,OAAO,KAAc,EAAE,CAAC;IACxB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;IACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}
+{"version":3,"file":"agent-bin.js","sourceRoot":"","sources":["../src/agent-bin.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEjE,IAAI,CAAC;IACH,MAAM,wBAAwB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAAC,OAAO,KAAc,EAAE,CAAC;IACxB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;IACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/dist/mcp.d.ts

@@ -1,7 +1,7 @@
 import { McpServer } from "@modelcontextprotocol/server";
 import type { Transport } from "@modelcontextprotocol/server";
 import type { AppContainer } from "./container.js";
-export declare const SERVER_VERSION = "1.5.0";
+export declare const SERVER_VERSION = "1.6.0";
 export declare const SERVER_NAME = "io.github.oaslananka/ssh-mcp-pro";
 export declare class SSHMCPServer {
     private readonly container;

package/dist/mcp.js

@@ -5,7 +5,7 @@ import { listResources, readResource } from "./resources.js";
 import { getMCPPrompt, listMCPPrompts } from "./prompts.js";
 import { withSpan } from "./telemetry.js";
 import { createToolRegistry } from "./tools/index.js";
-export const SERVER_VERSION = "1.5.0"; // x-release-please-version
+export const SERVER_VERSION = "1.6.0"; // x-release-please-version
 export const SERVER_NAME = "io.github.oaslananka/ssh-mcp-pro";
 function getSessionIdFromArgs(args) {
     if (typeof args !== "object" || args === null || Array.isArray(args)) {

package/dist/remote/action-record-sanitize.d.ts

@@ -0,0 +1,4 @@
+import type { RemoteToolName } from "./types.js";
+/** Keep managed process command and stdin payloads out of durable action metadata. */
+export declare function safeStoredActionArgs(tool: RemoteToolName, args: Record<string, unknown>): Record<string, unknown>;
+//# sourceMappingURL=action-record-sanitize.d.ts.map

package/dist/remote/action-record-sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-record-sanitize.d.ts","sourceRoot":"","sources":["../../src/remote/action-record-sanitize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,sFAAsF;AACtF,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,cAAc,EACpB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAKzB"}

package/dist/remote/action-record-sanitize.js

@@ -0,0 +1,11 @@
+/** Keep managed process command and stdin payloads out of durable action metadata. */
+export function safeStoredActionArgs(tool, args) {
+    if (tool === "process_start")
+        return { ...args, command: "[redacted]" };
+    if (tool === "process_input")
+        return { ...args, input: "[redacted]" };
+    if (tool === "file_content_search")
+        return { ...args, query: "[redacted]" };
+    return args;
+}
+//# sourceMappingURL=action-record-sanitize.js.map

package/dist/remote/action-record-sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-record-sanitize.js","sourceRoot":"","sources":["../../src/remote/action-record-sanitize.ts"],"names":[],"mappings":"AAEA,sFAAsF;AACtF,MAAM,UAAU,oBAAoB,CAClC,IAAoB,EACpB,IAA6B;IAE7B,IAAI,IAAI,KAAK,eAAe;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IACxE,IAAI,IAAI,KAAK,eAAe;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACtE,IAAI,IAAI,KAAK,qBAAqB;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IAC5E,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/remote/agent-bounded-io.d.ts

@@ -13,6 +13,16 @@ export declare function readFileBounded(file: FileHandle, maxBytes: number): Pro
     value: Buffer;
     truncated: boolean;
 }>;
+/**
+ * Read one page using byte offsets without buffering the entire file.
+ * Unlike a legacy read, a page must not include a truncation marker in text.
+ * Valid UTF-8 is kept at code-point boundaries when a page ends mid-character.
+ */
+export declare function readFilePageBounded(file: FileHandle, offsetBytes: number, maxBytes: number): Promise<{
+    value: Buffer;
+    truncated: boolean;
+    nextOffsetBytes?: number;
+}>;
 export declare function readFileTailBounded(file: FileHandle, maxBytes: number, maxLines?: number): Promise<{
     value: Buffer;
     truncated: boolean;

package/dist/remote/agent-bounded-io.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-bounded-io.d.ts","sourceRoot":"","sources":["../../src/remote/agent-bounded-io.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;CACpB;AAkCD,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,iBAAiB,EAC9B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,IAAI,CAcN;AAED,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,iBAAiB,EAC9B,QAAQ,EAAE,MAAM,GACf;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAMvC;AAoBD,wBAAsB,eAAe,CACnC,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IACT,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC,CAID;AAyCD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,SAAM,GACb,OAAO,CAAC;IACT,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC,CAcD"}
+{"version":3,"file":"agent-bounded-io.d.ts","sourceRoot":"","sources":["../../src/remote/agent-bounded-io.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;CACpB;AAkCD,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,iBAAiB,EAC9B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,IAAI,CAcN;AAED,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,iBAAiB,EAC9B,QAAQ,EAAE,MAAM,GACf;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAMvC;AAoBD,wBAAsB,eAAe,CACnC,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IACT,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC,CAID;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,UAAU,EAChB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAgC1E;AAyCD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,SAAM,GACb,OAAO,CAAC;IACT,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC,CAcD"}

package/dist/remote/agent-bounded-io.js

@@ -60,6 +60,40 @@ export async function readFileBounded(file, maxBytes) {
     const buffer = await readHandleRange(file, 0, cappedBytes + 1);
     return truncateBuffer(buffer, cappedBytes);
 }
+/**
+ * Read one page using byte offsets without buffering the entire file.
+ * Unlike a legacy read, a page must not include a truncation marker in text.
+ * Valid UTF-8 is kept at code-point boundaries when a page ends mid-character.
+ */
+export async function readFilePageBounded(file, offsetBytes, maxBytes) {
+    const raw = await readHandleRange(file, offsetBytes, maxBytes + 1);
+    let page = raw.subarray(0, maxBytes);
+    let truncated = raw.byteLength > maxBytes;
+    const decoder = new TextDecoder("utf-8", { fatal: true });
+    let validPage = false;
+    for (let removed = 0; removed <= (truncated ? Math.min(3, page.byteLength) : 0); removed += 1) {
+        try {
+            decoder.decode(page.subarray(0, page.byteLength - removed));
+            page = page.subarray(0, page.byteLength - removed);
+            validPage = true;
+            break;
+        }
+        catch {
+            // A UTF-8 code point may cross the page boundary.
+        }
+    }
+    if (!validPage || (truncated && page.byteLength === 0)) {
+        throw Object.assign(new Error("Page cannot advance at this UTF-8 boundary; increase max_bytes or use a valid offset"), {
+            code: "POLICY_DENIED",
+        });
+    }
+    truncated ||= page.byteLength < raw.byteLength;
+    return {
+        value: page,
+        truncated,
+        ...(truncated && page.byteLength > 0 ? { nextOffsetBytes: offsetBytes + page.byteLength } : {}),
+    };
+}
 const TAIL_SCAN_CHUNK_BYTES = 64 * 1024;
 const MAX_TAIL_SCAN_BYTES = 8 * 1024 * 1024;
 async function findTailStart(file, size, maxLines, maxScanBytes) {

package/dist/remote/agent-bounded-io.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-bounded-io.js","sourceRoot":"","sources":["../../src/remote/agent-bounded-io.ts"],"names":[],"mappings":"AAQA,SAAS,cAAc,CAAC,MAAc,EAAE,QAAgB;IACtD,IAAI,MAAM,CAAC,UAAU,IAAI,QAAQ,EAAE,CAAC;QAClC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO,sBAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,sBAAsB,QAAQ,WAAW,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,sBAAsB,CAC7B,MAAc,EACd,QAAgB;IAKhB,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAClB,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,UAAU,IAAI,QAAQ,EAAE,CAAC;QAClC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/D,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC;QAC1E,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,WAA8B,EAC9B,KAAa,EACb,QAAgB;IAEhB,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAClB,WAAW,CAAC,SAAS,KAAK,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC;IAC/C,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnB,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC;QAC7B,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC3C,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,WAAW,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;IACtC,WAAW,CAAC,SAAS,KAAK,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,WAA8B,EAC9B,QAAgB;IAEhB,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;IACnE,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAgB,EAAE,KAAa,EAAE,MAAc;IAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAClC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CACnC,MAAM,EACN,MAAM,EACN,MAAM,CAAC,UAAU,GAAG,MAAM,EAC1B,KAAK,GAAG,MAAM,CACf,CAAC;QACF,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM;QACR,CAAC;QACD,MAAM,IAAI,SAAS,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAgB,EAChB,QAAgB;IAKhB,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC;IAC/D,OAAO,cAAc,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC,MAAM,mBAAmB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAO5C,KAAK,UAAU,aAAa,CAC1B,IAAgB,EAChB,IAAY,EACZ,QAAgB,EAChB,YAAoB;IAEpB,IAAI,IAAI,IAAI,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IAChD,CAAC;IAED,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC;IACtE,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,OAAO,QAAQ,GAAG,eAAe,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE,QAAQ,GAAG,eAAe,CAAC,CAAC;QAC9E,QAAQ,IAAI,SAAS,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC/D,KAAK,IAAI,KAAK,GAAG,KAAK,CAAC,UAAU,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC9D,MAAM,aAAa,GAAG,QAAQ,GAAG,KAAK,CAAC;YACvC,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,aAAa,KAAK,IAAI,GAAG,CAAC,EAAE,CAAC;gBACxD,SAAS;YACX,CAAC;YACD,IAAI,aAAa,IAAI,QAAQ,EAAE,CAAC;gBAC9B,OAAO,EAAE,MAAM,EAAE,aAAa,GAAG,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;YAC7D,CAAC;YACD,aAAa,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,GAAG,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAgB,EAChB,QAAgB,EAChB,QAAQ,GAAG,GAAG;IAKd,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CACxB,qBAAqB,EACrB,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,WAAW,GAAG,CAAC,GAAG,CAAC,CAAC,CACnD,CAAC;IACF,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC7F,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,MAAM,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpD,OAAO,aAAa,IAAI,CAAC,OAAO,CAAC,SAAS;QACxC,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC;QACpD,CAAC,CAAC,OAAO,CAAC;AACd,CAAC"}
+{"version":3,"file":"agent-bounded-io.js","sourceRoot":"","sources":["../../src/remote/agent-bounded-io.ts"],"names":[],"mappings":"AAQA,SAAS,cAAc,CAAC,MAAc,EAAE,QAAgB;IACtD,IAAI,MAAM,CAAC,UAAU,IAAI,QAAQ,EAAE,CAAC;QAClC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO,sBAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,sBAAsB,QAAQ,WAAW,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,sBAAsB,CAC7B,MAAc,EACd,QAAgB;IAKhB,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAClB,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,UAAU,IAAI,QAAQ,EAAE,CAAC;QAClC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/D,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC;QAC1E,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,WAA8B,EAC9B,KAAa,EACb,QAAgB;IAEhB,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAClB,WAAW,CAAC,SAAS,KAAK,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC;IAC/C,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnB,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC;QAC7B,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC3C,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,WAAW,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;IACtC,WAAW,CAAC,SAAS,KAAK,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,WAA8B,EAC9B,QAAgB;IAEhB,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;IACnE,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAgB,EAAE,KAAa,EAAE,MAAc;IAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAClC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CACnC,MAAM,EACN,MAAM,EACN,MAAM,CAAC,UAAU,GAAG,MAAM,EAC1B,KAAK,GAAG,MAAM,CACf,CAAC;QACF,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM;QACR,CAAC;QACD,MAAM,IAAI,SAAS,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAgB,EAChB,QAAgB;IAKhB,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC;IAC/D,OAAO,cAAc,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAgB,EAChB,WAAmB,EACnB,QAAgB;IAEhB,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;IACnE,IAAI,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACrC,IAAI,SAAS,GAAG,GAAG,CAAC,UAAU,GAAG,QAAQ,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAC9F,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC;YAC5D,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,CAAC;YACnD,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM;QACR,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,sFAAsF,CACvF,EACD;YACE,IAAI,EAAE,eAAwB;SAC/B,CACF,CAAC;IACJ,CAAC;IACD,SAAS,KAAK,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IAC/C,OAAO;QACL,KAAK,EAAE,IAAI;QACX,SAAS;QACT,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChG,CAAC;AACJ,CAAC;AAED,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC,MAAM,mBAAmB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAO5C,KAAK,UAAU,aAAa,CAC1B,IAAgB,EAChB,IAAY,EACZ,QAAgB,EAChB,YAAoB;IAEpB,IAAI,IAAI,IAAI,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IAChD,CAAC;IAED,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC;IACtE,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,OAAO,QAAQ,GAAG,eAAe,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE,QAAQ,GAAG,eAAe,CAAC,CAAC;QAC9E,QAAQ,IAAI,SAAS,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC/D,KAAK,IAAI,KAAK,GAAG,KAAK,CAAC,UAAU,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC9D,MAAM,aAAa,GAAG,QAAQ,GAAG,KAAK,CAAC;YACvC,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,aAAa,KAAK,IAAI,GAAG,CAAC,EAAE,CAAC;gBACxD,SAAS;YACX,CAAC;YACD,IAAI,aAAa,IAAI,QAAQ,EAAE,CAAC;gBAC9B,OAAO,EAAE,MAAM,EAAE,aAAa,GAAG,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;YAC7D,CAAC;YACD,aAAa,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,GAAG,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAgB,EAChB,QAAgB,EAChB,QAAQ,GAAG,GAAG;IAKd,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CACxB,qBAAqB,EACrB,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,WAAW,GAAG,CAAC,GAAG,CAAC,CAAC,CACnD,CAAC;IACF,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC7F,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,MAAM,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpD,OAAO,aAAa,IAAI,CAAC,OAAO,CAAC,SAAS;QACxC,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC;QACpD,CAAC,CAAC,OAAO,CAAC;AACd,CAAC"}

package/dist/remote/agent-browser-enrollment.d.ts

@@ -0,0 +1,16 @@
+export interface LocalBrowserEnrollment {
+    verificationUrl: string;
+    callbackUrl: string;
+    port: number;
+    finished: Promise<void>;
+    close(): void;
+}
+/**
+ * A same-device HTTPS dashboard may hand its one-time token directly to a
+ * loopback listener. Only the bound browser origin, random challenge and
+ * local socket are accepted; the one-time token never appears in the URL.
+ */
+export declare function startLocalBrowserEnrollment(serverUrl: string, alias: string, onToken: (token: string) => Promise<void>, options?: {
+    timeoutMs?: number;
+}): Promise<LocalBrowserEnrollment>;
+//# sourceMappingURL=agent-browser-enrollment.d.ts.map

package/dist/remote/agent-browser-enrollment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-browser-enrollment.d.ts","sourceRoot":"","sources":["../../src/remote/agent-browser-enrollment.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,sBAAsB;IACrC,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,KAAK,IAAI,IAAI,CAAC;CACf;AA8DD;;;;GAIG;AACH,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,EACzC,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACnC,OAAO,CAAC,sBAAsB,CAAC,CAkIjC"}

package/dist/remote/agent-browser-enrollment.js

@@ -0,0 +1,190 @@
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+const MAX_BODY_BYTES = 4_096;
+const DEFAULT_TIMEOUT_MS = 600_000;
+function safeEqual(expected, actual) {
+    const left = Buffer.from(expected);
+    const right = Buffer.from(actual);
+    return left.length === right.length && timingSafeEqual(left, right);
+}
+function validServerOrigin(serverUrl) {
+    const url = new URL(serverUrl);
+    if (url.username ||
+        url.password ||
+        url.search ||
+        url.hash ||
+        (url.protocol !== "https:" &&
+            !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)))) {
+        throw new Error("Browser enrollment requires an HTTPS server or local loopback URL");
+    }
+    return url.origin;
+}
+function send(res, code, message, origin, preflight = false) {
+    res.writeHead(code, {
+        "Content-Type": "text/plain; charset=utf-8",
+        "Cache-Control": "no-store",
+        ...(origin
+            ? {
+                "Access-Control-Allow-Origin": origin,
+                Vary: "Origin",
+                ...(preflight
+                    ? {
+                        "Access-Control-Allow-Methods": "POST, OPTIONS",
+                        "Access-Control-Allow-Headers": "content-type",
+                        "Access-Control-Max-Age": "0",
+                    }
+                    : {}),
+            }
+            : {}),
+    });
+    res.end(message);
+}
+async function readLimitedJson(req) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        size += bytes.length;
+        if (size > MAX_BODY_BYTES)
+            throw new Error("Request body exceeds limit");
+        chunks.push(bytes);
+    }
+    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
+/**
+ * A same-device HTTPS dashboard may hand its one-time token directly to a
+ * loopback listener. Only the bound browser origin, random challenge and
+ * local socket are accepted; the one-time token never appears in the URL.
+ */
+export async function startLocalBrowserEnrollment(serverUrl, alias, onToken, options = {}) {
+    const origin = validServerOrigin(serverUrl);
+    const state = randomBytes(32).toString("base64url");
+    let complete;
+    let fail;
+    let settled = false;
+    const finished = new Promise((resolve, reject) => {
+        complete = () => {
+            if (settled)
+                return;
+            settled = true;
+            resolve();
+        };
+        fail = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            reject(error);
+        };
+    });
+    // Closing early is allowed without an unhandled rejection, while callers
+    // awaiting finished still receive the same timeout/cancellation failure.
+    void finished.catch(() => { });
+    let enrolled = false;
+    const listener = createServer((req, res) => {
+        void handleRequest(req, res).catch(() => {
+            if (!res.headersSent)
+                send(res, 500, "Local approval failed");
+        });
+    });
+    async function handleRequest(req, res) {
+        const remote = req.socket.remoteAddress ?? "";
+        const localOnly = remote === "127.0.0.1";
+        if (!localOnly || req.headers.origin !== origin) {
+            send(res, 403, "Browser origin is not allowed");
+            return;
+        }
+        const address = listener.address();
+        if (req.headers.host !== `127.0.0.1:${address.port}` ||
+            (req.url !== "/enroll" && req.url !== "/ready")) {
+            send(res, 403, "Unexpected callback destination", origin);
+            return;
+        }
+        if (req.method === "GET" && req.url === "/ready") {
+            send(res, 204, "", origin);
+            return;
+        }
+        if (req.method === "OPTIONS") {
+            send(res, 204, "", origin, true);
+            return;
+        }
+        if (req.method !== "POST" || enrolled) {
+            send(res, 405, "Enrollment is not available", origin);
+            return;
+        }
+        if (!(req.headers["content-type"] ?? "").startsWith("application/json")) {
+            send(res, 415, "JSON required", origin);
+            return;
+        }
+        let body;
+        try {
+            body = await readLimitedJson(req);
+        }
+        catch {
+            send(res, 400, "Invalid enrollment request", origin);
+            return;
+        }
+        if (!body || typeof body !== "object" || Array.isArray(body)) {
+            send(res, 400, "Invalid enrollment request", origin);
+            return;
+        }
+        const data = body;
+        if (typeof data.state !== "string" || !safeEqual(state, data.state)) {
+            send(res, 403, "Enrollment link does not match", origin);
+            return;
+        }
+        if (typeof data.token !== "string" || !/^[A-Za-z0-9_-]{30,256}$/u.test(data.token)) {
+            send(res, 400, "Enrollment token is missing or malformed", origin);
+            return;
+        }
+        enrolled = true;
+        try {
+            await onToken(data.token);
+            send(res, 200, "Enrollment accepted", origin);
+            complete();
+            listener.close();
+        }
+        catch {
+            enrolled = false;
+            send(res, 502, "Device enrollment failed; check the agent terminal", origin);
+        }
+    }
+    await new Promise((resolve, reject) => {
+        listener.once("error", reject);
+        listener.listen(0, "127.0.0.1", () => {
+            listener.off("error", reject);
+            resolve();
+        });
+    });
+    const address = listener.address();
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > DEFAULT_TIMEOUT_MS) {
+        listener.close();
+        throw new Error("Invalid local browser enrollment timeout");
+    }
+    const timer = setTimeout(() => {
+        fail(new Error("Browser enrollment expired; restart the installer"));
+        listener.close();
+    }, timeoutMs);
+    timer.unref();
+    void finished
+        .finally(() => {
+        clearTimeout(timer);
+    })
+        .catch(() => { });
+    const dashboardUrl = new URL("/dashboard", origin);
+    dashboardUrl.searchParams.set("local_enroll_port", String(address.port));
+    dashboardUrl.searchParams.set("local_enroll_state", state);
+    dashboardUrl.searchParams.set("local_enroll_alias", alias);
+    return {
+        verificationUrl: dashboardUrl.toString(),
+        callbackUrl: `http://127.0.0.1:${address.port}/enroll`,
+        port: address.port,
+        finished,
+        close() {
+            fail(new Error("Browser enrollment cancelled"));
+            clearTimeout(timer);
+            listener.close();
+        },
+    };
+}
+//# sourceMappingURL=agent-browser-enrollment.js.map

package/dist/remote/agent-browser-enrollment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-browser-enrollment.js","sourceRoot":"","sources":["../../src/remote/agent-browser-enrollment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AAGpF,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAUnC,SAAS,SAAS,CAAC,QAAgB,EAAE,MAAc;IACjD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/B,IACE,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,IAAI;QACR,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACxB,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAC5F,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,SAAS,IAAI,CACX,GAAmB,EACnB,IAAY,EACZ,OAAe,EACf,MAAe,EACf,SAAS,GAAG,KAAK;IAEjB,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE;QAClB,cAAc,EAAE,2BAA2B;QAC3C,eAAe,EAAE,UAAU;QAC3B,GAAG,CAAC,MAAM;YACR,CAAC,CAAC;gBACE,6BAA6B,EAAE,MAAM;gBACrC,IAAI,EAAE,QAAQ;gBACd,GAAG,CAAC,SAAS;oBACX,CAAC,CAAC;wBACE,8BAA8B,EAAE,eAAe;wBAC/C,8BAA8B,EAAE,cAAc;wBAC9C,wBAAwB,EAAE,GAAG;qBAC9B;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,GAAoB;IACjD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAC;QAChF,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;QACrB,IAAI,IAAI,GAAG,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACzE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,SAAiB,EACjB,KAAa,EACb,OAAyC,EACzC,UAAkC,EAAE;IAEpC,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,IAAI,QAAqB,CAAC;IAC1B,IAAI,IAA6B,CAAC;IAClC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrD,QAAQ,GAAG,GAAG,EAAE;YACd,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,IAAI,GAAG,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,yEAAyE;IACzE,yEAAyE;IACzE,KAAK,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAE9B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACzC,KAAK,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACtC,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,KAAK,UAAU,aAAa,CAAC,GAAoB,EAAE,GAAmB;QACpE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,MAAM,KAAK,WAAW,CAAC;QACzC,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,+BAA+B,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAiB,CAAC;QAClD,IACE,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,aAAa,OAAO,CAAC,IAAI,EAAE;YAChD,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,EAC/C,CAAC;YACD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,iCAAiC,EAAE,MAAM,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACjD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAC3B,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,6BAA6B,EAAE,MAAM,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QACD,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,4BAA4B,EAAE,MAAM,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,4BAA4B,EAAE,MAAM,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,IAA+B,CAAC;QAC7C,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACpE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,gCAAgC,EAAE,MAAM,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACnF,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,0CAA0C,EAAE,MAAM,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QACD,QAAQ,GAAG,IAAI,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,qBAAqB,EAAE,MAAM,CAAC,CAAC;YAC9C,QAAQ,EAAE,CAAC;YACX,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,KAAK,CAAC;YACjB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,oDAAoD,EAAE,MAAM,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACnC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC9B,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAiB,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,IAAI,SAAS,GAAG,kBAAkB,EAAE,CAAC;QACpF,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,IAAI,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC,CAAC;QACrE,QAAQ,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC,EAAE,SAAS,CAAC,CAAC;IACd,KAAK,CAAC,KAAK,EAAE,CAAC;IAEd,KAAK,QAAQ;SACV,OAAO,CAAC,GAAG,EAAE;QACZ,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC,CAAC;SACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAEnB,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACnD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;IAC3D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;IAC3D,OAAO;QACL,eAAe,EAAE,YAAY,CAAC,QAAQ,EAAE;QACxC,WAAW,EAAE,oBAAoB,OAAO,CAAC,IAAI,SAAS;QACtD,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ;QACR,KAAK;YACH,IAAI,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;YAChD,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/remote/agent-cli.d.ts

@@ -1,2 +1,7 @@
+/** Recoverable network failure; invalid enrollment/configuration must not be retried. */
+export declare class RetryableAgentTransportError extends Error {
+}
 export declare function runAgentCli(argv: string[]): Promise<void>;
+/** Keep installed agents online across transient socket failures without re-enrollment. */
+export declare function runAgentCliWithReconnect(argv: string[], run?: (args: string[]) => Promise<void>, pause?: (delayMs: number) => Promise<void>): Promise<void>;
 //# sourceMappingURL=agent-cli.d.ts.map

package/dist/remote/agent-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-cli.d.ts","sourceRoot":"","sources":["../../src/remote/agent-cli.ts"],"names":[],"mappings":"AAsfA,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAiC/D"}
+{"version":3,"file":"agent-cli.d.ts","sourceRoot":"","sources":["../../src/remote/agent-cli.ts"],"names":[],"mappings":"AAwDA,yFAAyF;AACzF,qBAAa,4BAA6B,SAAQ,KAAK;CAAG;AAkf1D,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAiC/D;AACD,2FAA2F;AAC3F,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,GAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAe,EACpD,KAAK,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CACW,GAClD,OAAO,CAAC,IAAI,CAAC,CA2Bf"}

package/dist/remote/agent-cli.js

@@ -3,10 +3,14 @@ import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { AgentExecutor, defaultHostMetadata } from "./agent-executor.js";
+import { startLocalBrowserEnrollment } from "./agent-browser-enrollment.js";
 import { AgentActivityLog, agentActivityLogPath, showAgentActivityLogs, } from "./agent-activity-log.js";
 import { ensurePemKeyPair, nowIso, randomToken, signEnvelope, verifyEnvelope, } from "./crypto.js";
 import { rememberAcceptedPolicyUpdate, validatePolicyUpdate, } from "./policy-update-guard.js";
 import { parseControlPlaneEnvelope, parseAgentPolicy } from "./schemas.js";
+/** Recoverable network failure; invalid enrollment/configuration must not be retried. */
+export class RetryableAgentTransportError extends Error {
+}
 function output(line) {
     process.stdout.write(`${line}\n`);
 }
@@ -123,13 +127,7 @@ function removeTrailingSlashes(value) {
     }
     return value.slice(0, end);
 }
-async function enroll(argv) {
-    const server = removeTrailingSlashes(parseFlag(argv, "--server") ?? "");
-    const token = parseFlag(argv, "--token");
-    const alias = parseFlag(argv, "--alias") ?? os.hostname();
-    if (!server || !token) {
-        throw new Error("Usage: ssh-mcp-pro-agent enroll --server <url> --token <token> --alias <alias>");
-    }
+async function enrollWithToken(server, token, alias) {
     const keyPair = ensurePemKeyPair(keyPath());
     const response = await postJson(`${server}/api/agents/enroll`, {
         token,
@@ -153,6 +151,31 @@ async function enroll(argv) {
     output(`Agent enrolled: ${config.agentId} (${config.alias})`);
     output(`Config: ${configPath()}`);
 }
+async function enroll(argv) {
+    const server = removeTrailingSlashes(parseFlag(argv, "--server") ?? "");
+    const token = parseFlag(argv, "--token");
+    const browser = argv.includes("--browser");
+    const alias = parseFlag(argv, "--alias") ?? os.hostname();
+    if (!server || (!token && !browser) || (token !== undefined && browser)) {
+        throw new Error("Usage: ssh-mcp-pro-agent enroll --server <url> --token <token> --alias <alias> (or --browser without --token)");
+    }
+    if (!browser) {
+        await enrollWithToken(server, token, alias);
+        return;
+    }
+    const local = await startLocalBrowserEnrollment(server, alias, async (oneTimeToken) => {
+        await enrollWithToken(server, oneTimeToken, alias);
+    });
+    output("Open this URL in a browser on this same device to approve read-only or selected device access:");
+    output(local.verificationUrl);
+    output("Waiting for browser approval; the enrollment token stays on this device (10-minute limit).");
+    try {
+        await local.finished;
+    }
+    finally {
+        local.close();
+    }
+}
 /** A server-side ready acknowledgement is distinct from an open WebSocket. */
 function handleAgentControlMessage(payload, config, activity) {
     if (payload.type === "agent.ready") {
@@ -299,16 +322,44 @@ async function runAgent() {
                 activity.event("error", "action_failed", "Action processing failed; details withheld.");
             });
         };
+        // An error can precede the close event carrying a non-retryable policy code.
+        let errorCloseTimer;
+        let closed = false;
         ws.onerror = () => {
-            activity.event("error", "socket_error", "Connection error. Service restart may be required.");
-            reject(new Error("WebSocket transport error"));
+            if (closed)
+                return;
+            activity.event("error", "socket_error", "Connection error. Checking close reason.");
+            errorCloseTimer ??= setTimeout(() => {
+                errorCloseTimer = undefined;
+                closed = true;
+                reject(new RetryableAgentTransportError("WebSocket transport error"));
+                // If a runtime never delivers close after error, do not retain a stale socket.
+                try {
+                    ws.close();
+                }
+                catch {
+                    // The transport may already be unusable.
+                }
+            }, 2_000);
         };
-        // A disconnected agent must exit nonzero so its service supervisor can restart it.
-        ws.onclose = () => {
-            activity.event("warn", "disconnected", "Connection closed. Awaiting service restart.");
-            reject(new Error("Agent WebSocket connection closed"));
+        // Policy-denied agents must not loop; ordinary transport losses are recoverable.
+        ws.onclose = (event) => {
+            if (closed)
+                return;
+            closed = true;
+            if (errorCloseTimer) {
+                clearTimeout(errorCloseTimer);
+                errorCloseTimer = undefined;
+            }
+            if (event?.code === 1008) {
+                activity.event("error", "connection_denied", "Server rejected the agent connection.");
+                reject(new Error("Agent connection rejected by server"));
+                return;
+            }
+            activity.event("warn", "disconnected", "Connection closed. Reconnecting automatically.");
+            reject(new RetryableAgentTransportError("Agent WebSocket connection closed"));
         };
-    });
+    }).finally(() => executor.dispose());
 }
 function status() {
     if (!existsSync(configPath())) {
@@ -357,6 +408,7 @@ function uninstallService() {
 function printAgentUsage() {
     output("Usage:");
     output("  ssh-mcp-pro-agent enroll --server <url> --token <token> --alias <alias>");
+    output("  ssh-mcp-pro-agent enroll --server <url> --browser --alias <alias>");
     output("  ssh-mcp-pro-agent run");
     output("  ssh-mcp-pro-agent status");
     output("  ssh-mcp-pro-agent logs [--tail 60] [--follow]");
@@ -406,4 +458,29 @@ export async function runAgentCli(argv) {
             throw new Error("Unknown agent command. Run ssh-mcp-pro-agent --help for usage.");
     }
 }
+/** Keep installed agents online across transient socket failures without re-enrollment. */
+export function runAgentCliWithReconnect(argv, run = runAgentCli, pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms))) {
+    let delayMs = 1_000;
+    // Schedule each attempt independently so long-lived agents do not retain retry stacks.
+    return new Promise((resolve, reject) => {
+        function handleFailure(error) {
+            if (argv[0] !== "run" || !(error instanceof RetryableAgentTransportError)) {
+                reject(error);
+                return;
+            }
+            const currentDelayMs = delayMs;
+            delayMs = Math.min(delayMs * 2, 30_000);
+            process.stderr.write(`Agent connection lost; retrying in ${currentDelayMs / 1_000} seconds.\n`);
+            void Promise.resolve()
+                .then(() => pause(currentDelayMs))
+                .then(attempt, reject);
+        }
+        function attempt() {
+            void Promise.resolve()
+                .then(() => run(argv))
+                .then(resolve, handleFailure);
+        }
+        attempt();
+    });
+}
 //# sourceMappingURL=agent-cli.js.map