Manage harness runtimes per device and encrypt shared accounts - #335
Closed
wingleeio wants to merge 8 commits into
Closed
Manage harness runtimes per device and encrypt shared accounts#335wingleeio wants to merge 8 commits into
wingleeio wants to merge 8 commits into
Conversation
Exercise setup, approval, account actions, recovery, revocation and failure states through the native screenshot fixture. Add a reproducible Linux capture script and fix recovery-warning wrapping and device/store labels exposed by the captures.
wingleeio
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This draft separates Accounts from Harnesses and makes runtime selection explicit on each execution device. Each harness expands into device rows showing installation status, version, enablement, and installation controls. Accounts contains account identity, usage, and encrypted device access. Neither page needs a device switcher.
The login-once goal is still incomplete. Shared API-key credentials work across approved devices, but ordinary subscription login flows still produce native account slots. Shared browser onboarding, provider-specific renewal with refresh ownership and crash recovery, delivery to running harnesses, and shared subscription usage remain required before merge. Successful current-token transfer probes do not substitute for those features.
Managed installations cover Codex 0.153.3, Claude Code 2.1.258, Grok 1.0.4, Devin 3000.10.21, OpenCode 1.18.21, Pi 0.85.1 with pi-acp 0.0.33, and Cursor SDK 1.0.28. Existing installations remain an explicit option; Cursor uses its managed SDK, and Hermes currently supports existing installations only.
Limitations: npm/Node must currently be available for npm-based installation; bare-device Node bootstrap, a pinned Hermes installer, and JavaScript launcher installation on Windows are pending. Subscription lifecycle integration and independent security review remain merge requirements.
Validation:
ZERON_AUTH_OKin fresh and restarted credential-only homes; original stores hidden; source hashes unchanged; temporary secrets removedSee runtime decision and validation and native authentication probes for the evidence and remaining acceptance criteria.
Screenshots below are native application captures using synthetic devices/accounts. They document the implemented UI, including API-key flows; they are not evidence of completed subscription onboarding or real cloud-agent renewal.