@kubitnodes/stellaris 0.1.0 → 0.2.0

package/dist/server/index.js

@@ -695,6 +695,9 @@ var BOARD_EVENT_TYPES = [
   "knowledge.written",
   "skill.promoted",
   "runner.added",
+  "user.signed_in",
+  "user.signed_out",
+  "user.token_rotated",
   "runner.changed",
   "ops.signal",
   "paused.changed",
@@ -803,6 +806,36 @@ var RunnerHelloSchema = z6.object({
   turns: z6.array(UlidSchema).default([])
 });
 var RunnerWelcomeSchema = z6.object({ name: NameSchema, version: z6.string() });
+var RunnerEnrollRequestSchema = z6.object({
+  protocol: z6.number().int().positive(),
+  version: z6.string().min(1).max(64),
+  hostname: z6.string().min(1).max(253),
+  os: RunnerOsSchema,
+  clis: z6.array(CliKindSchema).max(8),
+  capabilities: z6.array(z6.string().min(1).max(64)).max(32).default([])
+});
+var RunnerEnrollmentSchema = z6.object({
+  deviceCode: z6.string().min(1),
+  userCode: z6.string().min(1),
+  expiresAt: IsoDateTimeSchema,
+  intervalMs: z6.number().int().positive()
+});
+var RunnerEnrollPollSchema = z6.object({ deviceCode: z6.string().min(1) });
+var RunnerEnrollStatusSchema = z6.discriminatedUnion("status", [
+  z6.object({ status: z6.literal("pending") }),
+  z6.object({ status: z6.literal("approved"), name: NameSchema, token: z6.string().min(1) }),
+  z6.object({ status: z6.literal("denied") })
+]);
+var PendingEnrollmentSchema = z6.object({
+  userCode: z6.string().min(1),
+  hostname: z6.string(),
+  os: RunnerOsSchema,
+  clis: z6.array(CliKindSchema),
+  capabilities: z6.array(z6.string()),
+  version: z6.string(),
+  requestedAt: IsoDateTimeSchema,
+  expiresAt: IsoDateTimeSchema
+});
 var ProjectRepoSchema = z6.object({
   slug: NameSchema,
   origin: z6.string().nullable(),
@@ -1121,6 +1154,12 @@ var MetricsSchema = z9.object({
 // packages/shared/dist/config.js
 import { z as z10 } from "zod";
 var LogLevelSchema = z10.enum(["trace", "debug", "info", "warn", "error", "fatal"]);
+var GithubSignInSchema = z10.object({
+  clientId: z10.string().min(1),
+  clientSecret: z10.string().min(1),
+  /** Logins, lowercased; GitHub logins are case-insensitive. */
+  users: z10.array(z10.string().min(1)).min(1)
+});
 var ServerConfigSchema = z10.object({
   dataDir: z10.string().min(1),
   host: z10.string().min(1),
@@ -1138,7 +1177,14 @@ var ServerConfigSchema = z10.object({
   /** Rounds of tool calls one Claude turn may take, or null for no limit. */
   toolRounds: z10.number().int().positive().nullable(),
   /** How long a resident session stays warm after its last turn. */
-  residentIdleMs: z10.number().int().positive()
+  residentIdleMs: z10.number().int().positive(),
+  /** Signing in to the board with GitHub, or null when only a token lets anyone in. */
+  github: GithubSignInSchema.nullable(),
+  /**
+   * Reverse proxies in front of the server whose X-Forwarded-For entries name the client, for the
+   * rate limits on what anyone may ask without a token: 0 when clients connect directly.
+   */
+  trustedProxies: z10.number().int().min(0).max(16)
 });
 function limit(value, fallback) {
   if (value === void 0 || value.trim() === "") {
@@ -1146,6 +1192,21 @@ function limit(value, fallback) {
   }
   return value.trim().toLowerCase() === "unlimited" ? null : Number(value);
 }
+function list(value) {
+  return (value ?? "").split(",").map((item) => item.trim()).filter((item) => item.length > 0);
+}
+function githubSignIn(env) {
+  const clientId = env["STELLARIS_GITHUB_CLIENT_ID"] ?? "";
+  const clientSecret = env["STELLARIS_GITHUB_CLIENT_SECRET"] ?? "";
+  const users = list(env["STELLARIS_GITHUB_USERS"]).map((login) => login.toLowerCase());
+  if (clientId === "" && clientSecret === "" && users.length === 0) {
+    return null;
+  }
+  if (clientId === "" || clientSecret === "" || users.length === 0) {
+    throw new Error("GitHub sign-in needs STELLARIS_GITHUB_CLIENT_ID, STELLARIS_GITHUB_CLIENT_SECRET, and STELLARIS_GITHUB_USERS together");
+  }
+  return GithubSignInSchema.parse({ clientId, clientSecret, users });
+}
 function loadServerConfig(env) {
   return ServerConfigSchema.parse({
     dataDir: env["STELLARIS_DATA_DIR"] ?? "./data",
@@ -1156,14 +1217,19 @@ function loadServerConfig(env) {
     concurrency: limit(env["STELLARIS_CONCURRENCY"], null),
     turnTimeoutMs: limit(env["STELLARIS_TURN_TIMEOUT_MS"], 20 * 6e4),
     toolRounds: limit(env["STELLARIS_TOOL_ROUNDS"], 60),
-    residentIdleMs: Number(env["STELLARIS_RESIDENT_IDLE_MS"] ?? String(10 * 6e4))
+    residentIdleMs: Number(env["STELLARIS_RESIDENT_IDLE_MS"] ?? String(10 * 6e4)),
+    github: githubSignIn(env),
+    trustedProxies: Number(env["STELLARIS_TRUSTED_PROXIES"] ?? "0")
   });
 }
 var RunnerConfigSchema = z10.object({
   /** The board server, for example http://127.0.0.1:4700. */
   serverUrl: z10.string().url(),
-  /** The runner's token, minted by `runner add`. */
-  token: z10.string().min(1),
+  /**
+   * The runner's token, from `runner add`, or null for the one it saved when it was enrolled, or
+   * to enroll it.
+   */
+  token: z10.string().min(1).nullable(),
   /** The runner's own data directory: the board mirror, agent homes, repositories, worktrees. */
   dataDir: z10.string().min(1),
   logLevel: LogLevelSchema,
@@ -1174,7 +1240,7 @@ var RunnerConfigSchema = z10.object({
 });
 
 // packages/shared/dist/version.js
-var STELLARIS_VERSION = "0.1.0";
+var STELLARIS_VERSION = "0.2.0";
 
 // packages/board-core/dist/errors.js
 var BoardError = class extends Error {
@@ -1228,9 +1294,9 @@ async function readMarkdown(file, schema) {
   return { data: schema.parse(parsed.data), body: parsed.content.replace(/^\n/, "") };
 }
 async function writeMarkdown(file, data, body) {
-  const normalized = body.endsWith("\n") || body.length === 0 ? body : `${body}
+  const normalized2 = body.endsWith("\n") || body.length === 0 ? body : `${body}
 `;
-  await writeFileAtomic(file, matter.stringify(normalized, data));
+  await writeFileAtomic(file, matter.stringify(normalized2, data));
 }
 function isMissing(error) {
   return typeof error === "object" && error !== null && error.code === "ENOENT";
@@ -1969,11 +2035,11 @@ function computeMetrics(input) {
       unanswered: waiting.length,
       medianMs: median(allLatencies),
       slowestMs: allLatencies.length === 0 ? null : Math.max(...allLatencies),
-      byAgent: [...latencies].map(([agent, list]) => ({
+      byAgent: [...latencies].map(([agent, list2]) => ({
         agent,
-        mentions: list.length,
-        medianMs: median(list) ?? 0,
-        slowestMs: Math.max(...list)
+        mentions: list2.length,
+        medianMs: median(list2) ?? 0,
+        slowestMs: Math.max(...list2)
       })).toSorted((a, b) => b.medianMs - a.medianMs)
     },
     decisions: {
@@ -2207,6 +2273,14 @@ var SKIPPED_IN_HOME = /* @__PURE__ */ new Set([".git", "turns", ".claude", ".cod
 var RunnerTokensSchema = z12.object({
   runners: z12.record(z12.string(), z12.object({ tokenHash: z12.string().min(1) }))
 });
+var SignInsSchema = z12.object({
+  signIns: z12.array(z12.object({
+    tokenHash: z12.string().min(1),
+    login: z12.string().min(1),
+    createdAt: IsoDateTimeSchema,
+    expiresAt: IsoDateTimeSchema
+  })).default([])
+});
 var TurnHistoryPayloadSchema = z12.object({
   project: NameSchema,
   thread: UlidSchema.optional(),
@@ -2412,6 +2486,8 @@ var Board = class _Board {
   turnTokens = /* @__PURE__ */ new Map();
   /** Runner token hashes to runner names. */
   runnerTokens = /* @__PURE__ */ new Map();
+  /** Sign-ins by token hash, each acting as the user until it expires. */
+  signIns = /* @__PURE__ */ new Map();
   files = new FileTree();
   homes;
   constructor(dataDir, options) {
@@ -2440,6 +2516,7 @@ var Board = class _Board {
     await board2.mutex.run(() => board2.applyAlignments());
     await board2.loadTokenIndex();
     await board2.loadRunnerTokens();
+    await board2.loadSignIns();
     await board2.homes.installHooks();
     return board2;
   }
@@ -2762,6 +2839,14 @@ ${charter.purpose}
     if (persistent !== void 0) {
       return persistent;
     }
+    const signIn = this.signIns.get(hash);
+    if (signIn !== void 0) {
+      if (signIn.expiresAt > this.now().getTime()) {
+        return this.userActor();
+      }
+      this.signIns.delete(hash);
+      return null;
+    }
     const temporary = this.turnTokens.get(hash);
     if (temporary === void 0) {
       return null;
@@ -2806,6 +2891,77 @@ ${charter.purpose}
   userActor() {
     return { name: USER_NAME, role: USER_ROLE };
   }
+  /**
+   * Signs the user in, as `login` on the identity provider, for `ttlMs`, and returns the sign-in's
+   * token, shown once. Only its hash is kept, in `state/sign-ins.json`, so a sign-in outlives a
+   * restart; it acts as the user, like the user's own token, until it expires or is signed out.
+   */
+  async signIn(login, ttlMs) {
+    return this.mutex.run(async () => {
+      const token = mintToken();
+      const now = this.now().getTime();
+      const record = {
+        tokenHash: hashToken(token),
+        login,
+        createdAt: new Date(now).toISOString(),
+        expiresAt: new Date(now + ttlMs).toISOString()
+      };
+      const live = (await this.readSignIns()).filter((each) => Date.parse(each.expiresAt) > now);
+      await writeJson(this.signInsFile(), { signIns: [...live, record] });
+      this.signIns.set(record.tokenHash, { login, expiresAt: Date.parse(record.expiresAt) });
+      await this.events.append("user.signed_in", USER_NAME, { login });
+      return token;
+    });
+  }
+  /** Ends the sign-in a token belongs to; false for a token that is no sign-in's. */
+  async signOut(token) {
+    const hash = hashToken(token);
+    return this.mutex.run(async () => {
+      const signIn = this.signIns.get(hash);
+      if (signIn === void 0) {
+        return false;
+      }
+      this.signIns.delete(hash);
+      await writeJson(this.signInsFile(), {
+        signIns: (await this.readSignIns()).filter((each) => each.tokenHash !== hash)
+      });
+      await this.events.append("user.signed_out", USER_NAME, { login: signIn.login });
+      return true;
+    });
+  }
+  /**
+   * Issues the user a new token and revokes the old one, returning the new one, shown once: the way
+   * back in when the token is lost. A server already running keeps the old token's hash in memory
+   * until it restarts, since the admin CLI that calls this writes the data directory beside it.
+   */
+  async rotateUserToken() {
+    return this.mutex.run(async () => {
+      const previous = await this.readAgent(USER_NAME);
+      const token = mintToken();
+      await this.updateAgent(USER_NAME, (agent) => ({ ...agent, tokenHash: hashToken(token) }));
+      this.tokenIndex.delete(previous.tokenHash);
+      this.tokenIndex.set(hashToken(token), this.userActor());
+      await this.events.append("user.token_rotated", USER_NAME, {});
+      return token;
+    });
+  }
+  signInsFile() {
+    return path6.join(this.paths.state(), "sign-ins.json");
+  }
+  async readSignIns() {
+    const file = this.signInsFile();
+    return await exists(file) ? (await readJson(file, SignInsSchema)).signIns : [];
+  }
+  async loadSignIns() {
+    this.signIns.clear();
+    const now = this.now().getTime();
+    for (const signIn of await this.readSignIns()) {
+      const expiresAt = Date.parse(signIn.expiresAt);
+      if (expiresAt > now) {
+        this.signIns.set(signIn.tokenHash, { login: signIn.login, expiresAt });
+      }
+    }
+  }
   async actorFor(name) {
     const agent = await this.readAgent(name);
     return { name: agent.name, role: agent.role };
@@ -4802,8 +4958,9 @@ ${rationale}`}`);
   /**
    * Registers a runner and mints its token, returned once; only its hash is kept, outside the
    * projection. The runner reports its operating system, CLIs, and capabilities when it connects.
+   * An enrolled runner names the machine that asked, which the event records.
    */
-  async addRunner(actor, name) {
+  async addRunner(actor, name, enrolled) {
     if (actor.role !== USER_ROLE) {
       throw new BoardError("FORBIDDEN", "only the user adds runners");
     }
@@ -4827,7 +4984,10 @@ ${rationale}`}`);
         runners: { ...tokens, [parsed]: { tokenHash: hashToken(token) } }
       });
       this.runnerTokens.set(hashToken(token), parsed);
-      await this.events.append("runner.added", actor.name, { name: parsed });
+      await this.events.append("runner.added", actor.name, {
+        name: parsed,
+        ...enrolled === void 0 ? {} : { enrolledFrom: enrolled.hostname }
+      });
       return { runner, token };
     });
   }
@@ -8282,14 +8442,205 @@ async function handleMcpRequest(board2, actor, request, version) {
 }
 
 // apps/server/dist/app.js
-import { Hono as Hono2 } from "hono";
+import { Hono as Hono3 } from "hono";
 import { compress } from "hono/compress";
 import { streamSSE as streamSSE2 } from "hono/streaming";
-import { z as z14, ZodError } from "zod";
+import { z as z15, ZodError } from "zod";
+
+// apps/server/dist/github-auth.js
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { Hono } from "hono";
+import { z as z14 } from "zod";
+var SIGN_IN_TTL_MS = 30 * 24 * 36e5;
+var STATE_TTL_MS = 10 * 6e4;
+var MAX_STATES = 1e3;
+var TokenAnswerSchema = z14.object({ access_token: z14.string().min(1) });
+var GithubUserSchema = z14.object({ login: z14.string().min(1), id: z14.number().int() });
+function safeNext(next) {
+  return next !== void 0 && /^\/(?![/\\])/.test(next) ? next : "/";
+}
+function land(c, next, fragment) {
+  return c.redirect(`${next}#${fragment}`, 302);
+}
+function githubAuthRoutes(options) {
+  const { board: board2, github } = options;
+  const fetchImpl = options.fetch ?? fetch;
+  const now = options.now ?? Date.now;
+  const states = /* @__PURE__ */ new Map();
+  const routes = new Hono();
+  routes.get("/config", (c) => c.json({ github: github !== null }));
+  if (github === null) {
+    return routes;
+  }
+  routes.get("/github", options.limit ?? ((_c, next) => next()), (c) => {
+    for (const [state2, pending] of states) {
+      if (pending.expiresAt <= now() || states.size >= MAX_STATES) {
+        states.delete(state2);
+      }
+    }
+    const state = randomBytes2(24).toString("base64url");
+    states.set(state, { next: safeNext(c.req.query("next")), expiresAt: now() + STATE_TTL_MS });
+    const authorize = new URL("https://github.com/login/oauth/authorize");
+    authorize.searchParams.set("client_id", github.clientId);
+    authorize.searchParams.set("state", state);
+    authorize.searchParams.set("allow_signup", "false");
+    return c.redirect(authorize.toString(), 302);
+  });
+  routes.get("/github/callback", async (c) => {
+    const state = c.req.query("state") ?? "";
+    const pending = states.get(state);
+    states.delete(state);
+    if (pending === void 0 || pending.expiresAt <= now()) {
+      return land(c, "/", "signin-error=expired");
+    }
+    const code = c.req.query("code");
+    if (code === void 0 || code === "") {
+      return land(c, pending.next, "signin-error=declined");
+    }
+    let login;
+    let id;
+    try {
+      const tokenAnswer = await fetchImpl("https://github.com/login/oauth/access_token", {
+        method: "POST",
+        headers: { accept: "application/json", "content-type": "application/json" },
+        body: JSON.stringify({
+          client_id: github.clientId,
+          client_secret: github.clientSecret,
+          code
+        })
+      });
+      const { access_token: accessToken } = TokenAnswerSchema.parse(await tokenAnswer.json());
+      const userAnswer = await fetchImpl("https://api.github.com/user", {
+        headers: {
+          accept: "application/vnd.github+json",
+          authorization: `Bearer ${accessToken}`,
+          "user-agent": "stellaris"
+        }
+      });
+      if (!userAnswer.ok) {
+        throw new Error(`GitHub answered ${userAnswer.status} for the user`);
+      }
+      ({ login, id } = GithubUserSchema.parse(await userAnswer.json()));
+    } catch (error) {
+      options.log?.warn({ error: String(error) }, "GitHub sign-in failed");
+      return land(c, pending.next, "signin-error=github");
+    }
+    if (!github.users.includes(login.toLowerCase()) && !github.users.includes(String(id))) {
+      options.log?.warn({ login }, "GitHub sign-in refused a login that is not on the list");
+      return land(c, pending.next, "signin-error=not-allowed");
+    }
+    const token = await board2.signIn(login, SIGN_IN_TTL_MS);
+    return land(c, pending.next, `session=${encodeURIComponent(token)}`);
+  });
+  return routes;
+}
+
+// apps/server/dist/rate-limit.js
+import { isIPv4, isIPv6 } from "node:net";
+import { getConnInfo } from "@hono/node-server/conninfo";
+var ENROLL_LIMIT = { limit: 5, windowMs: 10 * 6e4 };
+var SIGN_IN_LIMIT = { limit: 20, windowMs: 10 * 6e4 };
+var MAX_ADDRESSES = 1e4;
+var RateLimiter = class {
+  options;
+  hits = /* @__PURE__ */ new Map();
+  constructor(options) {
+    this.options = options;
+  }
+  take(key) {
+    const now = (this.options.now ?? Date.now)();
+    const since = now - this.options.windowMs;
+    let entry = this.hits.get(key);
+    if (entry === void 0) {
+      this.makeRoom(since);
+      entry = { times: [], warned: false };
+    }
+    this.hits.delete(key);
+    this.hits.set(key, entry);
+    entry.times = entry.times.filter((time) => time > since);
+    const oldest = entry.times[0];
+    if (oldest !== void 0 && entry.times.length >= this.options.limit) {
+      const first = !entry.warned;
+      entry.warned = true;
+      return { ok: false, retryAfterMs: oldest + this.options.windowMs - now, first };
+    }
+    entry.times.push(now);
+    entry.warned = false;
+    return { ok: true };
+  }
+  makeRoom(since) {
+    if (this.hits.size < MAX_ADDRESSES) {
+      return;
+    }
+    for (const [key, entry] of this.hits) {
+      if (entry.times.every((time) => time <= since)) {
+        this.hits.delete(key);
+      }
+    }
+    for (const key of this.hits.keys()) {
+      if (this.hits.size < MAX_ADDRESSES) {
+        break;
+      }
+      this.hits.delete(key);
+    }
+  }
+};
+function clientAddress(c, trustedProxies) {
+  let socket = "unknown";
+  try {
+    socket = getConnInfo(c).remote.address ?? socket;
+  } catch {
+  }
+  const forwarded = (c.req.header("x-forwarded-for") ?? "").split(",").map((entry) => entry.trim()).filter((entry) => entry !== "");
+  const chain = [socket, ...forwarded.toReversed()];
+  return chain[Math.min(trustedProxies, chain.length - 1)] ?? socket;
+}
+function groups(part) {
+  return part === "" ? [] : part.split(":");
+}
+function width(parts) {
+  return parts.reduce((sum, part) => sum + (part.includes(".") ? 2 : 1), 0);
+}
+function addressKey(address) {
+  const unwrapped = /^\[(.+)\](?::\d+)?$/.exec(address)?.[1] ?? /^(\d+\.\d+\.\d+\.\d+):\d+$/.exec(address)?.[1] ?? address;
+  const bare = unwrapped.split("%")[0] ?? unwrapped;
+  const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i.exec(bare)?.[1];
+  if (mapped !== void 0) {
+    return mapped;
+  }
+  if (isIPv4(bare) || !isIPv6(bare)) {
+    return bare.slice(0, 64);
+  }
+  const [head = "", tail] = bare.split("::");
+  const front = groups(head);
+  const back = tail === void 0 ? [] : groups(tail);
+  const filled = tail === void 0 ? front : [...front, ...Array.from({ length: 8 - width(front) - width(back) }, () => "0"), ...back];
+  const prefix = filled.slice(0, 4).map((group) => Number.parseInt(group, 16).toString(16));
+  return `${prefix.join(":")}::/64`;
+}
+function rateLimit(options) {
+  return async (c, next) => {
+    const address = clientAddress(c, options.trustedProxies);
+    const verdict = options.limiter.take(addressKey(address));
+    if (!verdict.ok) {
+      const seconds = Math.max(1, Math.ceil(verdict.retryAfterMs / 1e3));
+      if (verdict.first) {
+        options.log?.warn({ address, retryAfterSeconds: seconds }, `rate limited ${options.what}`);
+      }
+      c.header("retry-after", String(seconds));
+      return c.json({
+        error: "RATE_LIMITED",
+        message: `too many ${options.what} from this address; try again in ${seconds} seconds`
+      }, 429);
+    }
+    await next();
+    return void 0;
+  };
+}
 
 // apps/server/dist/runner-routes.js
 import path7 from "node:path";
-import { Hono } from "hono";
+import { Hono as Hono2 } from "hono";
 import { streamSSE } from "hono/streaming";
 
 // apps/server/dist/home-git.js
@@ -8385,8 +8736,16 @@ function bearer(c) {
   const match = /^Bearer\s+(.+)$/i.exec(c.req.header("authorization") ?? "");
   return match?.[1]?.trim() ?? null;
 }
-function runnerRoutes(board2, hub) {
-  const routes = new Hono();
+function runnerRoutes(board2, hub, enrollments, enrollLimit) {
+  const routes = new Hono2();
+  if (enrollments !== void 0) {
+    routes.post("/enroll", enrollLimit ?? ((_c, next) => next()), async (c) => c.json(enrollments.open(RunnerEnrollRequestSchema.parse(await c.req.json()))));
+    routes.post("/enroll/poll", async (c) => {
+      const { deviceCode } = RunnerEnrollPollSchema.parse(await c.req.json());
+      const status = enrollments.poll(deviceCode);
+      return status === null ? c.json({ error: "NOT_FOUND", message: "no such enrollment; it may have expired" }, 404) : c.json(status);
+    });
+  }
   routes.use("*", async (c, next) => {
     const token = bearer(c);
     const runner = token === null ? null : board2.resolveRunnerToken(token);
@@ -8450,7 +8809,7 @@ function runnerRoutes(board2, hub) {
   });
   routes.get("/board/manifest", async (c) => c.json({ files: await board2.boardManifest() }));
   routes.post("/board/read", async (c) => c.json({ files: await board2.readBoardFiles(FileReadSchema.parse(await c.req.json()).paths) }));
-  const home = new Hono();
+  const home = new Hono2();
   home.use("*", async (c, next) => {
     const agent = NameSchema.parse(c.req.param("agent"));
     if (!hub.mayTouchHome(c.get("runner"), agent)) {
@@ -8550,15 +8909,16 @@ var ERROR_STATUS = {
   INVALID_TRANSITION: 409,
   INVALID_STATE: 409
 };
-var RetireBodySchema = z14.object({ reason: z14.string().min(1) });
-var RunnerBodySchema = z14.object({ name: NameSchema });
-var HomeRunnerBodySchema = z14.object({ runner: NameSchema.nullable() });
-var ModelBodySchema = z14.object({ model: ModelNameSchema.nullable() });
-var HistoryLimitSchema = z14.coerce.number().int().min(1).max(500);
-var ChannelBodySchema = z14.object({
+var RetireBodySchema = z15.object({ reason: z15.string().min(1) });
+var RunnerBodySchema = z15.object({ name: NameSchema });
+var EnrollmentApprovalSchema = z15.object({ name: NameSchema });
+var HomeRunnerBodySchema = z15.object({ runner: NameSchema.nullable() });
+var ModelBodySchema = z15.object({ model: ModelNameSchema.nullable() });
+var HistoryLimitSchema = z15.coerce.number().int().min(1).max(500);
+var ChannelBodySchema = z15.object({
   project: NameSchema.nullable().default(null),
   name: NameSchema,
-  purpose: z14.string().min(1)
+  purpose: z15.string().min(1)
 });
 function bearer2(c) {
   const header = c.req.header("authorization") ?? "";
@@ -8567,7 +8927,7 @@ function bearer2(c) {
 }
 function createApp(deps) {
   const { board: board2, version, turns: turns2, scheduler: scheduler2, models } = deps;
-  const app2 = new Hono2();
+  const app2 = new Hono3();
   app2.get("/health", (c) => c.json({ ok: true, version }));
   app2.onError((error, c) => {
     if (isBoardError(error)) {
@@ -8590,9 +8950,10 @@ function createApp(deps) {
     c.set("actor", actor);
     await next();
   };
-  const api = new Hono2();
+  const api = new Hono3();
   api.use("*", authenticate);
   api.get("/me", (c) => c.json(c.get("actor")));
+  api.delete("/sign-in", async (c) => c.json({ signedOut: await board2.signOut(bearer2(c) ?? "") }));
   api.get("/society", async (c) => c.json(await board2.society()));
   api.get("/agents", async (c) => c.json((await board2.listAgents()).map(({ tokenHash: _hash, ...agent }) => agent)));
   api.get("/members", async (c) => c.json(await board2.listMembers()));
@@ -8621,6 +8982,28 @@ function createApp(deps) {
     const body = RunnerBodySchema.parse(await c.req.json());
     return c.json(await board2.addRunner(c.get("actor"), body.name));
   });
+  const enrollments = deps.enrollments;
+  if (enrollments !== void 0) {
+    const forUser = (c) => {
+      if (c.get("actor").role !== USER_ROLE) {
+        throw new BoardError("FORBIDDEN", "only the user enrolls runners");
+      }
+    };
+    api.get("/enrollments", (c) => {
+      forUser(c);
+      return c.json(enrollments.waiting());
+    });
+    api.post("/enrollments/:code/approve", async (c) => {
+      forUser(c);
+      const body = EnrollmentApprovalSchema.parse(await c.req.json());
+      return c.json(await enrollments.approve(c.get("actor"), c.req.param("code"), body.name));
+    });
+    api.post("/enrollments/:code/deny", (c) => {
+      forUser(c);
+      enrollments.deny(c.req.param("code"));
+      return c.json({ denied: true });
+    });
+  }
   api.get("/proposals", async (c) => c.json(await board2.listProposals()));
   api.get("/proposals/:id", async (c) => c.json(await board2.readProposal(c.req.param("id"))));
   api.get("/signals", async (c) => c.json(await board2.listSignals(Number(c.req.query("limit") ?? "100"))));
@@ -8654,7 +9037,7 @@ function createApp(deps) {
   });
   api.put("/roles/:name", async (c) => {
     const charter = RoleCharterSchema.parse({
-      ...z14.record(z14.string(), z14.unknown()).parse(await c.req.json()),
+      ...z15.record(z15.string(), z15.unknown()).parse(await c.req.json()),
       name: c.req.param("name")
     });
     return c.json(await board2.setRoleCharter(c.get("actor"), charter));
@@ -8769,8 +9152,16 @@ function createApp(deps) {
     return c.json(result ?? null);
   });
   app2.route("/api", api);
+  const trustedProxies = deps.trustedProxies ?? 0;
+  const limited = (limit2, what) => rateLimit({ limiter: new RateLimiter(limit2), trustedProxies, what, log: deps.log });
+  app2.route("/auth", githubAuthRoutes({
+    board: board2,
+    github: null,
+    ...deps.signIn,
+    limit: limited(SIGN_IN_LIMIT, "sign-ins")
+  }));
   if (deps.runners !== void 0) {
-    app2.route("/runner", runnerRoutes(board2, deps.runners));
+    app2.route("/runner", runnerRoutes(board2, deps.runners, deps.enrollments, limited(ENROLL_LIMIT, "enrollment requests")));
   }
   app2.all("/mcp", async (c) => {
     const token = bearer2(c);
@@ -8786,6 +9177,113 @@ function createApp(deps) {
   return app2;
 }
 
+// apps/server/dist/enrollment.js
+import { randomBytes as randomBytes3, randomInt } from "node:crypto";
+var ENROLLMENT_TTL_MS = 10 * 6e4;
+var POLL_INTERVAL_MS = 3e3;
+var MAX_WAITING = 100;
+var CODE_ALPHABET = "BCDFGHJKLMNPQRSTVWXZ23456789";
+function codeHalf() {
+  return Array.from({ length: 4 }, () => CODE_ALPHABET.charAt(randomInt(CODE_ALPHABET.length))).join("");
+}
+function userCode() {
+  return `${codeHalf()}-${codeHalf()}`;
+}
+function normalized(code) {
+  return code.toUpperCase().replaceAll(/[^A-Z0-9]/g, "");
+}
+var EnrollmentDesk = class {
+  board;
+  enrollments = /* @__PURE__ */ new Map();
+  now;
+  pollIntervalMs;
+  constructor(board2, options = {}) {
+    this.board = board2;
+    this.now = options.now ?? Date.now;
+    this.pollIntervalMs = options.pollIntervalMs ?? POLL_INTERVAL_MS;
+  }
+  open(request) {
+    this.prune();
+    const waiting = [...this.enrollments.values()].filter((each) => each.status.status === "pending");
+    if (waiting.length >= MAX_WAITING) {
+      throw new BoardError("INVALID_STATE", `${MAX_WAITING} runners already wait for approval; try again once some have expired`);
+    }
+    const enrollment = {
+      deviceCode: randomBytes3(32).toString("base64url"),
+      userCode: userCode(),
+      request,
+      requestedAt: this.now(),
+      expiresAt: this.now() + ENROLLMENT_TTL_MS,
+      status: { status: "pending" }
+    };
+    this.enrollments.set(enrollment.deviceCode, enrollment);
+    return {
+      deviceCode: enrollment.deviceCode,
+      userCode: enrollment.userCode,
+      expiresAt: new Date(enrollment.expiresAt).toISOString(),
+      intervalMs: this.pollIntervalMs
+    };
+  }
+  /**
+   * Where the runner's enrollment stands, or null once it is unknown or expired. An approval or a
+   * denial is told once and then forgotten, so the token never travels twice.
+   */
+  poll(deviceCode) {
+    this.prune();
+    const enrollment = this.enrollments.get(deviceCode);
+    if (enrollment === void 0) {
+      return null;
+    }
+    if (enrollment.status.status !== "pending") {
+      this.enrollments.delete(deviceCode);
+    }
+    return enrollment.status;
+  }
+  /** The enrollments waiting for the user, newest first. */
+  waiting() {
+    this.prune();
+    return [...this.enrollments.values()].filter((each) => each.status.status === "pending").toSorted((a, b) => b.requestedAt - a.requestedAt).map((each) => ({
+      userCode: each.userCode,
+      hostname: each.request.hostname,
+      os: each.request.os,
+      clis: each.request.clis,
+      capabilities: each.request.capabilities,
+      version: each.request.version,
+      requestedAt: new Date(each.requestedAt).toISOString(),
+      expiresAt: new Date(each.expiresAt).toISOString()
+    }));
+  }
+  /** Registers the runner a waiting enrollment asked for, under `name`, for its next poll. */
+  async approve(actor, code, name) {
+    const enrollment = this.waitingFor(code);
+    const { runner, token } = await this.board.addRunner(actor, name, {
+      hostname: enrollment.request.hostname
+    });
+    enrollment.status = { status: "approved", name: runner.name, token };
+    return runner;
+  }
+  deny(code) {
+    this.waitingFor(code).status = { status: "denied" };
+  }
+  waitingFor(code) {
+    this.prune();
+    const wanted = normalized(code);
+    for (const enrollment of this.enrollments.values()) {
+      if (enrollment.status.status === "pending" && normalized(enrollment.userCode) === wanted) {
+        return enrollment;
+      }
+    }
+    throw new BoardError("NOT_FOUND", `no runner waits for approval with the code ${code}`);
+  }
+  prune() {
+    for (const [deviceCode, enrollment] of this.enrollments) {
+      if (enrollment.expiresAt <= this.now()) {
+        this.enrollments.delete(deviceCode);
+      }
+    }
+  }
+};
+
 // apps/server/dist/models.js
 var HOUR = 60 * 6e4;
 var ModelCatalog = class {
@@ -8918,10 +9416,23 @@ var app = createApp({
   scheduler: view,
   models: new ModelCatalog((cli) => runners.models(cli)),
   runners,
-  webDir
+  webDir,
+  signIn: { github: config.github, log },
+  enrollments: new EnrollmentDesk(board),
+  trustedProxies: config.trustedProxies,
+  log
 });
 var server = serve({ fetch: app.fetch, port: config.port, hostname: config.host }, (info) => {
-  log.info({ host: info.address, port: info.port, dataDir: config.dataDir, mcpUrl, webDir, webBuilt }, "board server listening");
+  log.info({
+    host: info.address,
+    port: info.port,
+    dataDir: config.dataDir,
+    mcpUrl,
+    webDir,
+    webBuilt,
+    signIn: config.github === null ? "token" : `github (${config.github.users.join(", ")})`,
+    trustedProxies: config.trustedProxies
+  }, "board server listening");
 });
 await scheduler.start();
 log.info({