# AetherDesk sign-in wiring

AetherDesk should not make agents useless just because a login screen appears.
The system should always ask: can useful local or public work continue without this account?

## Policy

- Do not block on sign-in when local or public work can continue.
- Ask for sign-in only when an account-scoped action is required.
- Prefer device-code, browser-mediated, or official CLI auth flows when a human account is needed.
- Never store API keys, registry tokens, refresh tokens, cookies, or session secrets in AetherDesk artifacts.
- When blocked by auth, write a receipt naming the exact action that needs the account.

## Headless command

```powershell
npm run aetherdesk:signin:map
```

## Programmatic route

```text
GET /api/agent/signin-wire-map
```

## Workflow Library/API action

```text
signin_wire_map
```

## Lanes covered

- local-first no account work
- GitHub
- Docker Hub / registries
- OpenAI
- Anthropic / Claude
- Hugging Face
- Google / Google Play / Colab / Drive
- Stripe
- npm / PyPI
- Vercel / Netlify

This map is not a login automation bot. It is a friction map that tells the AI PC when sign-in is optional, when it is required, and which fallback keeps work moving. Runtime action cards keep sign-in optional for local Docker-like work and explicit only for private registry, push, cloud, publish, or paid/account-scoped boundaries.

## Auth boundary receipt

When a sign-in screen blocks an account-scoped action, write a receipt instead of silently stopping:

```powershell
npm run aetherdesk:auth:receipt -- --provider=docker_registry --action="private image pull" --fallback="used local Podman build"
```

```text
GET /api/agent/auth-boundary-receipt
POST /api/agent/workflows/auth_boundary_receipt/run
```

This receipt does not sign in, store tokens, or perform remote writes. It names the exact account boundary and the fallback used so the human can approve the fast official sign-in path later.
