Priva Agent
===========
Files: privaagentd (background daemon), privaagentctl (command-line client),
privaagentui (graphical terminal in your browser; same as "privaagentctl ui").
On Windows they are privaagentd.exe, privaagentctl.exe and privaagentui.exe (64-bit Windows 10 / 11 / Server 2016+).

The client talks to the daemon over a local-only channel: a Unix socket
(~/.priva-agent/agent.sock, owner-only) on macOS/Linux, and a per-user Windows
named pipe (\\.\pipe\priva-agent-<your SID>) on Windows. Only your own account
(and SYSTEM) can open the pipe; remote/network clients are rejected. Nothing
listens on a network port.

macOS / Linux
-------------
1. Save the Controller certificate you were given (priva-controller.crt) next to these files.
2. Start the daemon (leave it running):
     CONTROLLER_URL=https://<controller-host>:8443 CONTROLLER_CA_FILE=./priva-controller.crt ./privaagentd
3. Check it is up, then enroll once (uses your own Priva login token; the tunnel starts automatically):
     ./privaagentctl ping
     ./privaagentctl enroll -token <token> -identity <identityId> -label "My laptop"
4. Connect:
     ./privaagentctl ssh -token <token> -device <deviceId> -user <os-username>

Windows (PowerShell)
--------------------
Run these as your normal user (no administrator rights needed). Extract the
archive first, e.g.:  tar -xzf priva-agent-Windows.tar.gz ; cd priva-agent-Windows

1. Save the Controller certificate you were given as priva-controller.crt in this folder.
2. Start the daemon in its own window (leave it open; Ctrl+C stops it):
     $env:CONTROLLER_URL = "https://<controller-host>:8443"
     $env:CONTROLLER_CA_FILE = "$PWD\priva-controller.crt"
     .\privaagentd.exe
   Your identity (private key, certificate) is stored in %LOCALAPPDATA%\PrivaAgent,
   readable only by you and SYSTEM. Set DATA_DIR to use another folder.
3. In a second PowerShell window, check it is up and enroll once:
     .\privaagentctl.exe ping
     .\privaagentctl.exe enroll -token <token> -identity <identityId> -label "My PC"
   The tunnel to the Gateway starts automatically after enrollment.
4. Connect (Windows Terminal or a modern console host gives the best terminal rendering):
     .\privaagentctl.exe ssh -token <token> -device <deviceId> -user <os-username>

To start the daemon automatically at logon, create a per-user scheduled task
(still no administrator needed), for example:
     $a = New-ScheduledTaskAction -Execute "$PWD\privaagentd.exe"
     $t = New-ScheduledTaskTrigger -AtLogOn -User $env:USERNAME
     Register-ScheduledTask -TaskName PrivaAgent -Action $a -Trigger $t
(set CONTROLLER_URL / CONTROLLER_CA_FILE as user environment variables first:
[Environment]::SetEnvironmentVariable("CONTROLLER_URL","https://<controller-host>:8443","User")).

Advanced: IPC_SOCKET_PATH (daemon) / PRIVA_AGENT_SOCKET (privaagentctl) override
the channel address. On Windows it must be a pipe name such as \\.\pipe\my-priva.

Graphical terminal (macOS, Windows, Linux)
------------------------------------------
With the daemon running (and enrolled), start the browser terminal:
     ./privaagentctl ui          (Windows: .\privaagentctl.exe ui   or   .\privaagentui.exe)
It opens your default browser on a private link such as
http://127.0.0.1:<port>/#<secret> (also printed in the console), where you sign in
with your Priva token, pick a device, type the OS username and get a real terminal
(resizes with the window). Nothing is loaded from the internet; the page is served
by this program, only on 127.0.0.1, and only the link with the secret works.
It uses the same CONTROLLER_URL / CONTROLLER_CA_FILE as the daemon (or -controller /
-ca-file; a one-line file priva-controller.url next to the program also works, and
so does priva-controller.crt). Useful options:
     -once            exit when the terminal tab is closed / the session ends
     -idle-timeout 15m  disconnect after this long without typing (default 15m)
     -no-browser      just print the link
     $PRIVA_TOKEN or -token-file <file>   skip the sign-in form
Stop it with Ctrl+C. It also stops by itself after 60 minutes with no activity.
