agent/runtime: fix browser auth bridge and macOS agent runtime

[dominic-r]

This extracts the runtime fixes from sdko/nix-pkg in prevision of Nix support and some issues discovered while working on the flake.

It fixes Firefox/native-messaging compatibility in the browser extension, preserves explicit native-host errors instead of collapsing them to empty responses, reconnects and times out disconnected native-host requests safely, and keeps endpoint challenge signing working across browser/runtime differences.

On the agent side, it fixes macOS app discovery for ak-sysd when the Agent app is installed outside the /Applications path, persists the domain token fallback so reloads survive Darwin keychain read failures, and validates endpoint challenges directly against the configured JWK set instead of the broken key lookup path. It also removes duplicate "in" in the token renewal dropdown

This is far from being my area of expertise, so please LMK

[codecov]

Bundle Report

Changes will increase total bundle size by 3.85kB (0.09%) ⬆️. This is within the configured threshold ✅

Detailed changes

Bundle name	Size	Change
browser-ext-esm	4.42MB	3.85kB (0.09%) ⬆️

Affected Assets, Files, and Routes:

view changes for bundle: browser-ext-esm

Assets Changed:

Asset Name	Size Change	Total Size	Change (%)
background.js	2.11kB	4.08MB	0.05%
content.js	1.42kB	2.32kB	157.89% ⚠️
utils/native.d.ts	20 bytes	859 bytes	2.38%
content/content.d.ts	299 bytes	336 bytes	808.11% ⚠️

Files in background.js:

• ./src/background/background.ts → Total Size: 1.01kB

• ./src/utils/native.ts → Total Size: 5.68kB

Files in content.js:

• ./src/content/content.ts → Total Size: 2.28kB

[codecov]

Codecov Report

❌ Patch coverage is 43.51852% with 61 lines in your changes missing coverage. Please review.
✅ Project coverage is 38.80%. Comparing base (7636e57) to head (84ca2b2).
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
pkg/agent_system/agent_starter/starter.go	46.55%	26 Missing and 5 partials ⚠️
pkg/agent_system/device/signed.go	47.22%	15 Missing and 4 partials ⚠️
pkg/browser_support/handler.go	0.00%	9 Missing ⚠️
pkg/agent_local/tray/items.go	0.00%	1 Missing ⚠️
pkg/agent_system/config/config.go	50.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #707      +/-   ##
==========================================
+ Coverage   38.35%   38.80%   +0.44%     
==========================================
  Files         204      204              
  Lines        6945     7017      +72     
==========================================
+ Hits         2664     2723      +59     
- Misses       3948     3957       +9     
- Partials      333      337       +4     

Flag	Coverage Δ
go-e2e	42.85% <44.79%> (+0.35%)	⬆️
go-integration	17.80% <39.58%> (+1.99%)	⬆️
go-macos-15	16.04% <40.20%> (+2.01%)	⬆️
go-ubuntu-24.04	15.55% <39.58%> (+2.02%)	⬆️
go-ubuntu-24.04-arm	14.96% <38.31%> (+1.94%)	⬆️
go-windows-2025	15.28% <39.58%> (+2.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[authentik-automation]

🚀 Deployed on https://pr-707--authentik-pkg.netlify.app