@cordfuse/crosstalk 8.3.0 → 8.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cordfuse/crosstalk",
-  "version": "8.3.0",
+  "version": "8.3.1",
   "description": "Crosstalk — agent-agnostic swarm communication protocol over a shared directory (git or filesystem transport). Operator CLI + daemon in one binary.",
   "type": "module",
   "license": "MIT",

package/src/dispatch.ts

@@ -52,7 +52,7 @@ import { startApi } from './api.js';
 import { logBuffer } from './log-buffer.js';
 import { FileUserStore } from './auth/users.js';
 import { FileTokenStore } from './auth/tokens.js';
-import { SetupState } from './auth/setup.js';
+import { SetupState, bootstrapFromEnv } from './auth/setup.js';
 import type { Server as HttpServer } from 'http';
 
 const RUNTIME_VERSION: string = (() => {
@@ -478,15 +478,32 @@ async function main(): Promise<void> {
     const userStore = new FileUserStore(join(authDir, 'users.json'));
     const tokenStore = new FileTokenStore(join(authDir, 'tokens.json'));
     const setupState = new SetupState(join(authDir, 'setup-token'));
-    // First-run: mint setup token + log the URL so the operator can
-    // bootstrap from the browser. Subsequent boots: leave the
-    // existing token if present (operator may have stalled mid-setup).
-    if (await userStore.isEmpty() && !setupState.hasActiveToken) {
-      const rec = setupState.mint();
-      log('auth_first_run_setup_token', {
-        url: `http://127.0.0.1:<port>/setup?token=${rec.token}`,
-        note: 'Visit this URL in a browser to create the admin account. Replace <port> with the bound API port.',
-      });
+    // First-run: try the non-interactive env-var bootstrap first (Docker /
+    // CI / headless deploys — LLMUX_INIT_USERNAME/NAME/PASSPHRASE, see
+    // bootstrapFromEnv's docstring). Falls through to minting a browser
+    // setup token when no env vars are set, same as before. A PARTIAL env
+    // var set is almost certainly an operator typo, not something to fail
+    // silently on — logged loudly, but still falls through to the browser
+    // path rather than crashing the boot over one bad var, same
+    // skip-and-continue philosophy as the skip-bad-provider handling in
+    // models.ts.
+    if (await userStore.isEmpty()) {
+      let bootstrapped: Awaited<ReturnType<typeof bootstrapFromEnv>>;
+      try {
+        bootstrapped = await bootstrapFromEnv(userStore, tokenStore);
+      } catch (err) {
+        log('auth_bootstrap_from_env_failed', { error: (err as Error).message });
+        bootstrapped = undefined;
+      }
+      if (bootstrapped) {
+        log('auth_bootstrap_from_env', { username: bootstrapped.token.username });
+      } else if (!setupState.hasActiveToken) {
+        const rec = setupState.mint();
+        log('auth_first_run_setup_token', {
+          url: `http://127.0.0.1:<port>/setup?token=${rec.token}`,
+          note: 'Visit this URL in a browser to create the admin account. Replace <port> with the bound API port.',
+        });
+      }
     }
     apiServer = startApi(
       {