feat(cloud): remove static credentials and add host console

apps/device-host-agent/host_agent/config.py

@@ -11,12 +11,14 @@ class HostAgentConfigurationError(ValueError):
     """Raised when Host Agent process configuration is invalid."""
 
 
+_LOOPBACK_BIND_HOSTS = frozenset({"127.0.0.1", "localhost", "::1"})
+
+
 @dataclass(frozen=True)
 class HostAgentConfig:
     control_plane_url: str
     host_id: str = ""
     token: str = field(default="", repr=False)
-    enrollment_token: str = field(default="", repr=False)
     identity_path: Path = Path("tasks/host_identity.json")
     local_account_path: Path = Path("tasks/host_local_account.json")
     enrollment_managed: bool = False
@@ -26,6 +28,12 @@ class HostAgentConfig:
     retry_backoff_seconds: float = 1.0
     max_retry_backoff_seconds: float = 30.0
     max_retry_attempts: int = 5
+    console_enabled: bool = False
+    console_bind_host: str = "127.0.0.1"
+    console_port: int = 8765
+    console_allow_non_loopback: bool = False
+    console_session_ttl_seconds: float = 43200.0
+    console_history_limit: int = 200
 
 
 def load_host_agent_config(
@@ -46,13 +54,6 @@ def load_host_agent_config(
             "HOST_AGENT_CONTROL_PLANE_URL must be an HTTP(S) URL"
         )
 
-    host_id = values.get("HOST_AGENT_HOST_ID", "").strip()
-    token = values.get("HOST_AGENT_TOKEN", "").strip()
-    if bool(host_id) != bool(token):
-        raise HostAgentConfigurationError(
-            "HOST_AGENT_HOST_ID and HOST_AGENT_TOKEN must be configured together"
-        )
-    enrollment_token = values.get("HOST_AGENT_ENROLLMENT_TOKEN", "").strip()
     identity_path = Path(
         values.get("HOST_AGENT_IDENTITY_PATH", "tasks/host_identity.json").strip()
     )
@@ -64,12 +65,9 @@ def load_host_agent_config(
 
     config = HostAgentConfig(
         control_plane_url=control_plane_url,
-        host_id=host_id,
-        token=token,
-        enrollment_token=enrollment_token,
         identity_path=identity_path,
         local_account_path=local_account_path,
-        enrollment_managed=not bool(host_id),
+        enrollment_managed=True,
         display_name=values.get("HOST_AGENT_DISPLAY_NAME") or None,
         heartbeat_interval_seconds=_positive_float(
             values,
@@ -96,11 +94,38 @@ def load_host_agent_config(
             "HOST_AGENT_MAX_RETRY_ATTEMPTS",
             5,
         ),
+        console_enabled=_truthy(values, "HOST_AGENT_CONSOLE_ENABLED", False),
+        console_bind_host=values.get(
+            "HOST_AGENT_CONSOLE_BIND_HOST", "127.0.0.1"
+        ).strip(),
+        console_port=_positive_int(values, "HOST_AGENT_CONSOLE_PORT", 8765),
+        console_allow_non_loopback=_truthy(
+            values, "HOST_AGENT_CONSOLE_ALLOW_NON_LOOPBACK", False
+        ),
+        console_session_ttl_seconds=_positive_float(
+            values,
+            "HOST_AGENT_CONSOLE_SESSION_TTL_SECONDS",
+            43200.0,
+        ),
+        console_history_limit=_positive_int(
+            values,
+            "HOST_AGENT_CONSOLE_HISTORY_LIMIT",
+            200,
+        ),
     )
     if config.max_retry_backoff_seconds < config.retry_backoff_seconds:
         raise HostAgentConfigurationError(
             "maximum retry backoff must not be less than initial backoff"
         )
+    if config.console_enabled and (
+        config.console_bind_host not in _LOOPBACK_BIND_HOSTS
+        and not config.console_allow_non_loopback
+    ):
+        raise HostAgentConfigurationError(
+            "HOST_AGENT_CONSOLE_BIND_HOST must be a loopback address "
+            f"({', '.join(sorted(_LOOPBACK_BIND_HOSTS))}) unless "
+            "HOST_AGENT_CONSOLE_ALLOW_NON_LOOPBACK is set"
+        )
     return config
 
 
@@ -136,3 +161,14 @@ def _positive_int(
     if value <= 0:
         raise HostAgentConfigurationError(f"{name} must be greater than zero")
     return value
+
+
+def _truthy(
+    values: Mapping[str, str],
+    name: str,
+    default: bool,
+) -> bool:
+    raw_value = values.get(name)
+    if raw_value is None:
+        return default
+    return raw_value.strip().lower() in {"true", "1"}