feat: @epilot/agent-auth package and Agent Auth Protocol login for the CLI - #505
Open
anttiviljami wants to merge 5 commits into
Open
anttiviljami wants to merge 5 commits into
anttiviljami wants to merge 5 commits into
Conversation
New zero-dependency package implementing the AAP v1.0-draft client side: Ed25519 key pairs and RFC 7638 thumbprints, host/agent JWT signing, discovery with caching, register/request-capability/status/execute, waitForApproval polling, agent and host lifecycle calls, plus the epilot capability helpers (organizations.list, access_token.issue, grant mapping, issuer per stage). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CBojHN7n7Y2Vx8caWb3kCR
…refresh - `epilot auth login` registers this machine as a host and the CLI as an agent, shows the verification code, opens the approval page, polls until approved, then issues and stores a token for the chosen organization. `--org`, `--readonly`, `--anonymize`, `--no-interactive`, `--json`; `--token` stays manual mode and `--legacy` keeps the previous browser callback flow (legacyBrowserLogin). - New `epilot org list|use|request|current` commands built on the organizations.list / access_token.issue capabilities; `org request` prints the approval object with status "pending" in --json/--no-interactive. - `auth status` shows agent, host, issuer and per-organization grants; `auth logout` revokes the agent before deleting local state. - resolveTokenAsync() silently re-issues tokens that are missing or expire within two minutes; callApi awaits it. - Host/agent key storage under ~/.config/epilot/agent-auth (mode 0600). - Tests with an msw fake AAP server for storage, login and org flows. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CBojHN7n7Y2Vx8caWb3kCR
… workspace deps in CI - README: new Authentication section (AAP flow, organizations, silent refresh, --legacy, local state, issuer override). - Root help lists `auth login --org` and the `org` commands. - CI: `pnpm --filter @epilot/cli... build` so @epilot/agent-auth is built before the CLI bundles it. - Changeset for @epilot/cli. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CBojHN7n7Y2Vx8caWb3kCR
… template `pnpm generate` rewrites src/index.ts and the README usage block, so the `org` subcommand and the updated auth/org help lines need to live in scripts/generate.ts as well; the README usage block is updated to match. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CBojHN7n7Y2Vx8caWb3kCR
…r base path Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CBojHN7n7Y2Vx8caWb3kCR
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| pendingGrantIds?: string[]; | ||
| } | ||
|
|
||
| const trimSlash = (value: string) => value.replace(/\/+$/, ''); |
| process.exit(1); | ||
| } | ||
| const token = await legacyBrowserLogin(profileName, env, readonly, anonymize); | ||
| if (token) { |
| const path = join(tmp.configDir, 'agent-auth', 'host.json'); | ||
| expect(existsSync(path)).toBe(true); | ||
| expect(statSync(path).mode & 0o777).toBe(0o600); | ||
| const stored = JSON.parse(readFileSync(path, 'utf-8')); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Second client of epilot's Agent Auth Protocol (RFC with resolved decisions: https://claude.ai/artifact/7rKkSL589k59uXyYik9rNa).
@epilot/agent-auth(packages/agent-auth, zero runtime deps, Node ≥ 18): Ed25519 keypairs, RFC 7638 thumbprints, host/agent JWT signing,AgentAuthClient(discover, registerAgent, requestCapability, getAgentStatus, waitForApproval, execute, capabilities, revoke/reactivate/rotate/introspect) and epilot helpers (EPILOT_CAPABILITIES,organizationAccessCapability,listEpilotOrganizations,issueEpilotAccessToken,epilotAgentAuthIssuer→https://access-token.sls.epilot.io/v1/access-tokens/agent-auth).@epilot/cli):epilot auth loginnow registers an agent (host key per machine, agent per profile under~/.config/epilot/agent-auth/), shows the user code, opens the approval page, polls, picks the org and stores a token. Tokens refresh silently while the agent is active. Newepilot org list | use <id> | request <id> [--write] [--full-pii] | current.auth statusshows agent + per-org grants;auth logoutrevokes the agent.--tokenkept;--legacykeeps the old browser flow for one release.--json --no-interactivesupported for agents driving the CLI.Server side lives in
access-token-api(GitLab, branchfeat/agent-auth-protocol); the MCP gateway vendors this package's core until it is published.Test plan
pnpm --filter @epilot/agent-auth build test lint(23 tests)pnpm --filter @epilot/cli test(128 tests), rootpnpm lintcleanpnpm --filter @epilot/cli dev auth login --use-devagainst the dev issuer once access-token-api is deployed🤖 Generated with Claude Code
https://claude.ai/code/session_01CBojHN7n7Y2Vx8caWb3kCR
Generated by Claude Code