teamclaws 2.0.8 → 2.0.9

package/README.md

@@ -55,12 +55,16 @@ the existing paired shell. Status-only requests do not start onboarding.
 
 Before any browser authorization, the agent explains the process: sign this
 computer's CLI into the user's TeamClaws account through the browser, choose a
-workspace and approve pairing with that server in the browser, then choose useful
+workspace and pair with that server, then choose useful
 work and set up its environment on the server. It explains the purpose and access
 of each approval before presenting a link, adapting to steps already completed.
 The conversation starts with that context rather than an unexplained request to
 click an authorization link.
 
+Pairing completes automatically when TeamClawsDeploy confirms the account owns
+the workspace or is a superuser in its access group. Browser approval is shown
+only when the target reports that approval is pending.
+
 Agents keep their turn and the original login/pairing process alive while the
 user approves in the browser, monitor its output, and continue automatically
 after terminal success. No "I approved" message is needed. An execution
@@ -89,7 +93,8 @@ Existing event names and schema version remain unchanged. The
 login keeps running. Signed-out `auth_status` includes the non-executing
 `login_command: "teamclaws login --json"`; status never starts device authorization.
 
-`pairing_browser_required` supplies the safe approval URL and public `user_code`.
+When approval is pending, `pairing_browser_required` supplies the safe approval
+URL and public `user_code`. Automatic pairing emits no browser approval event.
 Some hosts include a validated `agent_action` with the legacy type
 `deliver_and_stop`. The agent displays its approval message and continues
 monitoring the original process; that field does not end the agent's turn. The
@@ -281,7 +286,8 @@ to a specific request, so neither command checks for later conversation turns.
 
 For authorized workspace administration, first check pairing status with
 `teamclaws pair status <target> --json`. If `not_paired`, complete CLI login and pairing
-approval for that workspace before using the shell. A linked AI provider or
+for that workspace before using the shell, following browser approval only when
+requested by the CLI. A linked AI provider or
 TCChat conversation is not required for paired-shell access; remote chat is a
 separate operation.
 

package/dist/constants.js

@@ -1,5 +1,5 @@
 export const PACKAGE_NAME = "teamclaws";
-export const PACKAGE_VERSION = "2.0.8";
+export const PACKAGE_VERSION = "2.0.9";
 export const CLIENT_NAME = "teamclaws-cli";
 export const CONTRACT_VERSION = 1;
 export const OUTPUT_SCHEMA_VERSION = 1;

package/dist/pairing.js

@@ -76,12 +76,9 @@ export class PairingClient {
         }
     }
     async complete(pending, deviceName, noOpen, signal) {
-        this.output.pairingBrowser(pending.verification_uri_complete, pending.user_code, pending.agent_action);
-        if (!noOpen)
-            await this.openBrowser(pending.verification_uri_complete);
         let credential;
         try {
-            credential = await this.poll(pending, signal);
+            credential = await this.poll(pending, noOpen, signal);
             const grant = await this.authorization.requireGrant();
             if (credential.pairing_id !== credential.device_id ||
                 credential.origin !== pending.target.origin ||
@@ -142,9 +139,10 @@ export class PairingClient {
             void credential;
         }
     }
-    async poll(pending, signal) {
+    async poll(pending, noOpen, signal) {
         const deadline = this.now() + pending.expires_in * 1_000;
         let intervalSeconds = pending.interval;
+        let approvalShown = false;
         const pollUrl = directTargetUrl(pending.target, pending.target.token_poll_path);
         while (this.now() < deadline) {
             if (signal?.aborted)
@@ -158,6 +156,12 @@ export class PairingClient {
             if (response.status >= 200 && response.status < 300) {
                 if (response.status === 202) {
                     intervalSeconds = pendingInterval(response, intervalSeconds);
+                    if (!approvalShown) {
+                        this.output.pairingBrowser(pending.verification_uri_complete, pending.user_code, pending.agent_action);
+                        approvalShown = true;
+                        if (!noOpen)
+                            await this.openBrowser(pending.verification_uri_complete);
+                    }
                     await this.wait(intervalSeconds * 1_000, signal);
                     continue;
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "teamclaws",
-  "version": "2.0.8",
+  "version": "2.0.9",
   "description": "Official TeamClaws command-line client and agent skills",
   "license": "PolyForm-Shield-1.0.0",
   "homepage": "https://teamclaws.com",

package/skills/teamclaws-login/SKILL.md

@@ -11,8 +11,9 @@ A status-only request runs only `teamclaws auth status --json` and stops.
 
 Before starting browser login, explain that the user will sign this computer's
 TeamClaws command-line client into their TeamClaws account through the browser.
-This connects the client to their account; workspace selection and browser
-pairing approval come next when they are connecting a workspace. If onboarding
+This connects the client to their account; workspace selection and pairing come
+next when they are connecting a workspace. Pairing may complete automatically;
+show browser approval only if the CLI requests it. If onboarding
 already explained the process, use a short transition into this step. Give the
 approval link with that context, never as an unexplained authorization request.
 

package/skills/teamclaws-onboard/SKILL.md

@@ -22,7 +22,9 @@ user's work and any steps already completed:
 1. First, we'll sign this computer into your TeamClaws account using your browser.
    This lets the TeamClaws command-line client here connect to your account.
 2. Next, you'll choose a workspace, and we'll pair this computer with that server.
-   You'll approve that connection in your browser too. Pairing gives this computer
+   Pairing completes automatically when TeamClawsDeploy confirms you own the
+   workspace or are a superuser in its access group. Follow browser approval
+   only if the CLI requests it. Pairing gives this computer
    access to run commands and work with files on the workspace.
 3. Then we'll find the best work to move there and set up a clean environment for
    it, separate from your laptop. That could be a complete job, an agent, a service

package/skills/teamclaws-pair/SKILL.md

@@ -56,7 +56,7 @@ teamclaws pair <stable-server-identifier> --json
 ```
 
 Use `--no-open` only when automatic browser opening is undesirable. The
-`pairing_browser_required` event still provides the safe approval address.
+`pairing_browser_required` event provides the safe approval address when approval is needed.
 
 When no selected stable identifier is known, run `teamclaws servers list --json`,
 show each server's display name (`alias`), returned `description`, and readiness,
@@ -71,11 +71,13 @@ workspaces; use the onboarding skill's discovery rules.
 
 ## Wait for approval and continue automatically
 
-Before starting the command, explain that the next browser approval pairs this
-computer with the selected workspace. Name that workspace and explain that the
+Before starting the command, explain that pairing connects this computer with
+the selected workspace. TeamClawsDeploy authorizes automatic pairing for its
+owner or a superuser in the workspace's access group. Follow browser approval
+only if the CLI requests it. Name that workspace and explain that the
 connection gives this computer access to run commands and work with its files.
 Connect the step to the user's intended work, and say you'll keep waiting and
-continue automatically after approval. Use a short transition if onboarding
+continue automatically after pairing. Use a short transition if onboarding
 already introduced the process; the approval link should never arrive without
 an explanation of what the user is authorizing.
 
@@ -145,7 +147,7 @@ teamclaws pair status <stable-server-identifier-or-canonical-workspace-address>
 ```
 
 If it reports `not_paired`, follow the login and pairing flow above for that
-selected workspace; pairing requires the normal browser and owner approval. Do not use
+selected workspace; follow browser approval only if `pairing_browser_required` is emitted. Do not use
 another workspace's pairing or bypass approval. After `paired` is verified,
 authorized host commands can use the existing paired shell: