feat: join-key enrollment (v1.5.0, protocol v1.2.0 1.1)

Installing the agent with one key is now all it takes to add a host.

New `join_key` config field, presented while auth_token is empty. The SSO
exchanges it for this agent's own token and the public key it must pin,
both delivered in the config frame; the agent persists them and blanks
the join key. Nothing has to be copied between two machines by hand.

PersistEnrollment rewrites only the credential lines -- line-based rather
than a YAML round-trip -- so operator comments, the capability matrix and
formatting survive. It re-reads afterwards so the credential is live
without a restart, and keeps the file 0600.

The connect URL carries ?hostname= so a self-enrolling host is named
after itself, and the agent refuses to connect at all (with a long
back-off) when it has no credential rather than presenting an empty one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

config.go

@@ -3,6 +3,8 @@ package main
 import (
 	"fmt"
 	"os"
+	"regexp"
+	"strings"
 	"sync"
 
 	"gopkg.in/yaml.v3"
@@ -17,17 +19,31 @@ type Capabilities struct {
 }
 
 type Config struct {
-	ServerURL    string       `yaml:"server_url"`
-	AuthToken    string       `yaml:"auth_token"`
+	ServerURL string `yaml:"server_url"`
+	AuthToken string `yaml:"auth_token"`
+	// A join key is the one credential an operator hands out. On first connect
+	// the server exchanges it for a per-agent AuthToken (written back to this
+	// file), so it is a bootstrap value, not a long-term credential. Used only
+	// when AuthToken is empty.
+	JoinKey      string       `yaml:"join_key"`
 	Location     string       `yaml:"location"`
 	PublicKey    string       `yaml:"public_key"` // Ed25519 public key for signed commands
 	Capabilities Capabilities `yaml:"capabilities"`
 }
 
+// Credential returns the value to present when connecting: our own token once
+// enrolled, otherwise the join key.
+func (c *Config) Credential() string {
+	if c.AuthToken != "" {
+		return c.AuthToken
+	}
+	return c.JoinKey
+}
+
 // ConfigManager handles thread-safe access and reloading of the agent configuration.
 type ConfigManager struct {
-	mu       sync.RWMutex
-	current  *Config
+	mu         sync.RWMutex
+	current    *Config
 	configPath string
 }
 
@@ -61,6 +77,62 @@ func (cm *ConfigManager) Reload() error {
 	return nil
 }
 
+// PersistEnrollment writes the credentials the server issued during join-key
+// enrollment back into agent.yml, then reloads. Only the auth_token and
+// public_key lines are rewritten (added if absent); every other line, including
+// operator comments and the capability matrix, is preserved -- this file is
+// hand-edited, so a naive marshal-and-write would destroy it.
+//
+// The join key is blanked once we hold our own token: leaving a fleet-wide
+// credential on every host after it has stopped being needed is exactly the
+// blast radius the per-agent token exists to avoid.
+func (cm *ConfigManager) PersistEnrollment(token, publicKey string) error {
+	if token == "" {
+		return fmt.Errorf("server reported enrollment but sent no token")
+	}
+
+	cm.mu.Lock()
+	defer cm.mu.Unlock()
+
+	raw, err := os.ReadFile(cm.configPath)
+	if err != nil {
+		return fmt.Errorf("read %s: %w", cm.configPath, err)
+	}
+
+	out := setYamlScalar(string(raw), "auth_token", token)
+	if publicKey != "" {
+		out = setYamlScalar(out, "public_key", publicKey)
+	}
+	out = setYamlScalar(out, "join_key", "")
+
+	// Same permissions the installer sets: this file now holds a credential.
+	if err := os.WriteFile(cm.configPath, []byte(out), 0600); err != nil {
+		return fmt.Errorf("write %s: %w", cm.configPath, err)
+	}
+
+	cfg, err := LoadConfig(cm.configPath)
+	if err != nil {
+		return fmt.Errorf("reload after enrollment: %w", err)
+	}
+	cm.current = cfg
+	return nil
+}
+
+// setYamlScalar replaces the value of a top-level `key: "..."` line, or appends
+// the key when it is absent. Deliberately line-based rather than a YAML
+// round-trip so comments and formatting survive.
+func setYamlScalar(doc, key, value string) string {
+	re := regexp.MustCompile(`(?m)^[ \t]*` + regexp.QuoteMeta(key) + `[ \t]*:.*$`)
+	line := fmt.Sprintf("%s: %q", key, value)
+	if re.MatchString(doc) {
+		return re.ReplaceAllString(doc, line)
+	}
+	if !strings.HasSuffix(doc, "\n") {
+		doc += "\n"
+	}
+	return doc + line + "\n"
+}
+
 func LoadConfig(path string) (*Config, error) {
 	file, err := os.Open(path)
 	if err != nil {