[TOL-2062] Fable port of build changes and remote auth - #34
Merged
delwaterman merged 4 commits intoJul 27, 2026
Conversation
delwaterman
commented
Jul 27, 2026
delwaterman
commented
Contributor
- Switched to dev/release build configuration instead of Pinning URLs
- Add remote auth strategies
The auth service migrated /agent/v1/tokens/identity away from the shape-sniffed "consent" grant to explicit per-strategy values; the bare "consent" arm no longer exists server-side, so redirect consent redemption was failing against prod. Ports the redirect subset of tollbit/tollbit-cli#33. Co-Authored-By: Claude Fable 5 <[email protected]>
Ports the tollbit-cli #32 shape: build mode is a single IsDev const (mode_dev.go / mode_release.go), and per-field configurable:"dev"|"release" struct tags now gate every external override. Env vars are applied explicitly (env.go walking the config via introspection.go) instead of viper AutomaticEnv, so release builds ignore endpoint overrides at the source rather than pinning them back afterwards — PinEndpoints, parseEmbeddedYAML, and Factory.SkipPinEndpoints are gone. The dev config file merge is compiled in only when IsDev. globalflags is rewritten as an IsConfigurable-gated flag table; the nine previously hidden flags and the TOLLBIT_SHOW_DEV_FLAGS mechanism are removed (dev overrides use TOLLBIT_* env vars). Co-Authored-By: Claude Fable 5 <[email protected]>
Ports tollbit/tollbit-cli#30 (with the final #33 request shapes — the strategy is born on the namespaced consent:browser_select_icon grant): - internal/cliruntime: end-user proximity (configured → saved runtime.json state → default remote), new `tollbit runtime status|set|help` commands, and browser opening (moved from agentauth) - internal/agentauth: ConsentStrategy interface with per-strategy Guidance; browser_consent.go becomes redirect/ and the new browserselecticon/ strategy relays a consent URL plus a verification icon, returning AuthorizationPendingError instead of blocking - pending-auth.json in the credential store, completed via the new `tollbit auth complete` command; still-pending exits with code 3 - auth login prints runtime proximity + flow label and renders both configured flows in its long help; auth status reports pending authorization, refresh token, and auto-refresh state - auth client gains browser-select-icon start/redeem and now surfaces problem+json errors as typed values (authorization_pending, access_denied, expired_token, invalid_grant) - WithOBORetry only retries when the active strategy supports it; detached strategies return an explicit-login-required error instead of silently starting consent mid-command Co-Authored-By: Claude Fable 5 <[email protected]>
Ports tollbit/tollbit-cli#34: - internal/agentauth/agentconfirmsicons: detached flow where the agent relays only the consent URL; the end user reads back three icons and the agent submits them in order via `tollbit auth complete <first> <second> <third>`. The valid icon vocabulary is printed at login for the agent's spelling reference only. - auth client: agent-confirms-icons start endpoint and consent:agent_confirms_icons redeem (exactly three non-empty names) - auth complete accepts up to three icon args (required for this flow); unrecognized_icon errors reprint the vocabulary and keep the pending challenge (no attempt is consumed); denial codes still clear it - guide/SKILL.md are now rendered from the resolved strategies: {{ .AuthInstructions }} shows BOTH configured local and remote flows, {{ .AuthCompleteInputs }} documents auth complete's inputs, and a footer records which strategies were rendered. `guide --install` writes the rendered markdown; frontmatter stays literal so the version-sync check is unchanged. - shipped remote consent strategy default flips to agent_confirms_icons (tb-cli.config.yaml); exit code 3 documented in the skill Co-Authored-By: Claude Fable 5 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.