Add device agent enrollment and ITAM backend

[gearnode]

Summary by cubic

Adds device agent enrollment with one‑time tokens, full device inventory and posture in the console, and native macOS/Windows tray helpers. Includes a curl‑to‑sh installer, probo:// deep‑link enrollment, a secure owner model, and safer server URL and secret handling.

Tests +1447 -0

• E2E for enrollment flow, RBAC, owner visibility, isolation, and pending exclusion.
• Unit tests for enroll URL parsing, server URL normalization, regions manifest, and device/posture ordering.

Coredata +1802 -0

• Device, DevicePosture, and one‑shot DeviceEnrollmentToken models; enums and order fields; migrations and entity type IDs 104/105/106.
• Owners stored as membership profiles and exposed as ownerId; tokens are SHA‑256 hashed with TTL and GC.
• Index fixes to allow re‑enrollment after revoke; cursor pagination for latest postures.

Service +596 -86

• Agent configures with a device API key and activates on first heartbeat; console redeems one‑time tokens server‑side; deep‑link enroll-url handler.
• Tray on macOS/Windows with auto‑start/elevation; macOS uses a system LaunchAgent; Windows startup works across RDP/Local System/Entra users.
• Public enrollment marker moved to /var/run (0600), robust IsEnrolled checks; tray uses --run-dir.
• Server URL defaults/validation tightened (SaaS *.probo.com, reject fragments/port‑only); elevated install forwards --dir.
• Central hash.HashBearerCredential; race fixes map zero‑row updates to 401; expanded Windows command paths.

App: console +3063 -3

• New /enroll wizard with org picker and deep‑link; derives --server from runtime config or current origin.
• Organization Devices list/detail with owner, tabbed layout, and latest posture table; revoke/assign are permission‑gated.
• Employee “Your devices” tab with manual enrollment; pending devices hidden until first heartbeat.
• Create/Reassign dialogs handle clearing owners, avoid duplicate submits, and keep stable selects.
• Sidebar adds Devices entry gated by itam:device:list.

Package: ui +17 -2

• Select.Option supports custom classes and data‑highlight styles.
• Dialog adds onOpenChange hooks.

Agents +252 -7

• Release notes for CGO tray builds and deep‑link enrollment; macOS/Windows‑only tray guidance.
• Ownership guide added; API surface docs updated.

Other +1469 -44

• New cmd/probo-agent installer (install.sh) for Darwin/Linux/FreeBSD; CI lints with shellcheck and injects release checksums.
• macOS PKG bundles a Swift Probo Agent.app (probo:// handler); pre/postinstall register system LaunchAgent and open enrollment UI.
• Windows protocol registration script and dev GNUmakefile for local agent install.
• Helm wires PROBOD_ITAM_DEVICE_ENROLLMENT_TOKEN_VALIDITY; bootstrap reads it.
• Seed script creates a mixed‑state device fleet; go.mod adds fyne.io/systray and promotes golang.org/x/sys.

^{Written for commit 8922608. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 89 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 32 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 13 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 30 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 3 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 15 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[lukkor]

@cubic-dev-ai review the PR again

[cubic-dev-ai]

@cubic-dev-ai review the PR again

@lukkor I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

1 issue found across 133 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="pkg/deviceagent/client.go">

<violation number="1" location="pkg/deviceagent/client.go:148">
P1: Enrollment tokens can be sent to loopback/private or attacker-controlled `--server` targets because this new exchange request uses a client without SSRF protection. Construct this client with `httpclient.WithSSRFProtection()` (and inject a loopback-allowed client only in tests) before sending the token.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 15 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[lukkor]

@cubic-dev-ai review the PR again

[cubic-dev-ai]

@cubic-dev-ai review the PR again

@lukkor I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

6 issues found across 151 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="pkg/deviceagent/tray/tray_supported.go">

<violation number="1" location="pkg/deviceagent/tray/tray_supported.go:35">
P3: `ServerURL` defaulting has no effect because the supported tray implementation never consumes it. Remove this dead assignment, or use the value in the intended enrollment flow.</violation>
</file>

<file name="pkg/itam/gc.go">

<violation number="1" location="pkg/itam/gc.go:75">
P2: A custom `worker.WithInterval` does not control this collector's cadence: after its first run, `Claim` still suppresses work for five minutes. Store and use the configured GC interval here, or remove this second interval gate and let `worker.Worker` schedule polling.</violation>
</file>

<file name="pkg/server/api/agent/v1/types/models.go">

<violation number="1" location="pkg/server/api/agent/v1/types/models.go:45">
P2: `uptime_seconds` is accepted but discarded before `RecordHeartbeat`, so agents cannot persist or expose the uptime they send. Add it through the ITAM request/persistence flow, or remove it from this public payload until supported.</violation>
</file>

<file name="pkg/deviceagent/tray/autostart_darwin.go">

<violation number="1" location="pkg/deviceagent/tray/autostart_darwin.go:40">
P2: A later login by any local account starts this tray helper, while uninstall stops only the current GUI account. Store this per interactive user (or deliberately unload every affected GUI domain) so enrollment and removal have matching scope.</violation>
</file>

<file name="cmd/probo-agent/main.go">

<violation number="1" location="cmd/probo-agent/main.go:129">
P2: Concurrent enrollment-link launches can race past this check and corrupt shared enrollment state; one installer may overwrite `agent.key` after the other has configured the device. Serialize enrollment with an atomic lock/reservation held by the elevated install path.</violation>
</file>

<file name="pkg/deviceagent/tray/console_user_windows_test.go">

<violation number="1" location="pkg/deviceagent/tray/console_user_windows_test.go:131">
P2: `TestInteractiveSessionCandidates_OrderAndDedup` depends on real Windows session state and will flake on headless systems where no interactive, active, or connected sessions exist. Consider mocking `interactiveSessionCandidates` or restructuring the test to accept an empty result gracefully, for example asserting on ordering/dedup only when candidates are non-empty rather than requiring non-empty.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P3: ServerURL defaulting has no effect because the supported tray implementation never consumes it. Remove this dead assignment, or use the value in the intended enrollment flow.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/deviceagent/tray/tray_supported.go, line 35:

<comment>`ServerURL` defaulting has no effect because the supported tray implementation never consumes it. Remove this dead assignment, or use the value in the intended enrollment flow.</comment>

<file context>
@@ -0,0 +1,129 @@
+
+func Run(opts Options) error {
+	if opts.ServerURL == "" {
+		opts.ServerURL = deviceagent.DefaultServerURL
+	}
+
</file context>