instar 1.3.1343 → 1.3.1345

package/dashboard/index.html

@@ -1042,6 +1042,24 @@
     .mnd-reason-cell { color: var(--text-dim); }
     .mnd-audit-head { display: flex; gap: 12px; align-items: center; margin-bottom: 8px; flex-wrap: wrap; }
     .mnd-dim { font-size: 13px; color: var(--text-dim); }
+    .pair-card { border: 1px solid var(--border); border-radius: 8px; padding: 12px; margin-top: 10px; }
+    .pair-head { display: flex; flex-wrap: wrap; gap: 8px; align-items: baseline; }
+    .pair-state { font-size: 13px; color: var(--text-dim); }
+    .pair-state-verification-failed { color: #f85149; }
+    .pair-state-mutual-verified, .pair-state-identity-verified { color: #3fb950; }
+    .pair-step { margin-top: 10px; }
+    .pair-step-title { font-size: 13px; margin-bottom: 6px; }
+    .pair-row { display: flex; flex-wrap: wrap; gap: 8px; align-items: center; margin: 6px 0; }
+    .pair-own-words { columns: 3; font-family: ui-monospace, monospace; font-size: 15px; margin: 6px 0; }
+    .pair-words { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 6px; }
+    .pair-word { display: flex; align-items: center; gap: 4px; font-size: 12px; color: var(--text-dim); }
+    .pair-word input { flex: 1; min-width: 0; padding: 6px; font-family: ui-monospace, monospace; font-size: 15px; }
+    .pair-meta { font-size: 11px; color: var(--text-dim); margin-top: 8px; }
+    @media (max-width: 640px) {
+      .pair-own-words { columns: 2; }
+      .pair-words { grid-template-columns: repeat(2, minmax(0, 1fr)); }
+      .pair-row .mnd-pin, .pair-row .mnd-btn { flex: 1 1 100%; width: 100%; }
+    }
     /* Mobile-first (item 5): at phone width the 5-column audit table stacks into
        labelled rows so the reason — the useful column — is never truncated. */
     @media (max-width: 640px) {
@@ -4208,6 +4226,17 @@
         <div id="tlBridgeError" style="color:var(--err, #c44);font-size:12px;display:none"></div>
       </div>
 
+      <!-- Verified pairing — the 12-word check (docs/specs/secure-a2a-verified-pairing.md §3.6) -->
+      <div id="pairCard" class="mnd-card" style="border:1px solid var(--border);border-radius:8px;padding:16px">
+        <div style="display:flex;justify-content:space-between;align-items:center;gap:8px;flex-wrap:wrap">
+          <strong>Verified pairing</strong>
+          <button onclick="startPairingPanel()" class="mnd-btn mnd-btn-quiet" style="padding:6px 12px">Refresh</button>
+        </div>
+        <div class="mnd-hint">Confirm another agent is really who it says it is: compare 12 words with its operator before it can be sent credentials.</div>
+        <div id="pairNotice" class="mnd-notice"></div>
+        <div id="pairList"></div>
+      </div>
+
       <!-- Conversation observability — threads list + message stream + search -->
       <div style="border:1px solid var(--border);border-radius:8px;padding:0;display:flex;flex-direction:column;min-height:480px">
         <!-- Toolbar -->
@@ -5990,6 +6019,7 @@
         onActivate: () => {
           if (typeof loadThreadlineBridgeConfig === 'function') loadThreadlineBridgeConfig();
           if (typeof tlObsLoadThreads === 'function') tlObsLoadThreads();
+          if (typeof startPairingPanel === 'function') startPairingPanel();
         },
       },
       {
@@ -10413,6 +10443,26 @@
       } catch { host.innerHTML = '<div style="opacity:.7">Throughput data is temporarily unavailable.</div>'; }
     }
 
+    // ── Verified pairing panel (Threadline tab; secure-a2a-verified-pairing §3.6) ──
+    // Lazy-loaded like Mandates. The PIN typed here is sent once per action, never stored.
+    let __pairController = null;
+    let __pairModule = null;
+    async function startPairingPanel() {
+      if (!__pairModule) {
+        try { __pairModule = await import('/dashboard/pairing.js'); }
+        catch (e) { console.error('[pairing] module load failed', e); return; }
+      }
+      if (!__pairController) {
+        const els = { list: document.getElementById('pairList'), notice: document.getElementById('pairNotice') };
+        const fetchImpl = (url, opts = {}) => fetch(url, {
+          ...opts,
+          headers: { 'Authorization': `Bearer ${token}`, ...(opts.headers || {}) },
+        });
+        __pairController = __pairModule.createController({ doc: document, els, fetchImpl });
+      }
+      __pairController.start();
+    }
+
     // ── Mandates tab (coordination-mandate spec, decision 2A) ──
     // Same lazy dynamic-import pattern as Process Health. The PIN typed in this
     // tab is sent once per action and never stored anywhere.

package/dashboard/pairing.js

@@ -0,0 +1,179 @@
+/**
+ * pairing.js — the Verified Pairing panel on the dashboard's Threadline tab
+ * (docs/specs/secure-a2a-verified-pairing.md §3.6, Mobile-Complete operator action).
+ *
+ * The operator's surface for the 12-word check: list pairings; for a pending one,
+ * enter the dashboard PIN to see THIS side's 12 words, then type the 12 words the
+ * OTHER side shows and confirm (the server compares all 12 in order; any difference
+ * is a denial). A denied pairing can be cleared with the PIN. The PIN is typed at
+ * action time, sent once, and never stored (no localStorage, no module state).
+ *
+ * Same shape as mandates.js: pure renderers + createController({ doc, els, fetchImpl }).
+ */
+
+const REFRESH_MS = 30_000;
+const WORD_COUNT = 12;
+
+function esc(s) {
+  return String(s ?? '').replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+}
+
+const STATE_LABEL = {
+  'pending-verification': 'Waiting for you to compare the words',
+  'mutual-verified': 'Verified',
+  'identity-verified': 'Verified on another of my machines',
+  'verification-failed': 'Words did not match — blocked',
+};
+
+/** One pairing card. Primary action first; the fingerprint is support metadata. */
+export function renderPairing(p) {
+  const fp = esc(p.peerFp);
+  const name = esc(p.peerName || 'Unknown agent');
+  const state = p.state;
+  const label = esc(STATE_LABEL[state] || state || 'Unknown');
+  let actions = '';
+  if (state === 'pending-verification') {
+    const inputs = Array.from({ length: WORD_COUNT }, (_, i) =>
+      `<label class="pair-word"><span>${i + 1}</span><input type="text" autocomplete="off" autocapitalize="off" spellcheck="false" data-their-word="${fp}" data-idx="${i}" aria-label="Their word ${i + 1}" /></label>`).join('');
+    actions = `
+      <div class="pair-step">
+        <div class="pair-step-title">1. See the words on this side</div>
+        <div class="pair-row"><input type="password" class="mnd-pin" data-show-pin="${fp}" placeholder="Your PIN" autocomplete="off" />
+        <button class="mnd-btn mnd-btn-primary" data-show-words="${fp}">Show my words</button></div>
+        <ol class="pair-own-words" data-own-words="${fp}"></ol>
+      </div>
+      <div class="pair-step">
+        <div class="pair-step-title">2. Type the 12 words the OTHER agent's operator sees</div>
+        <div class="pair-words">${inputs}</div>
+        <div class="pair-row"><input type="password" class="mnd-pin" data-confirm-pin="${fp}" placeholder="Your PIN" autocomplete="off" />
+        <button class="mnd-btn mnd-btn-primary" data-confirm="${fp}">Confirm they match</button></div>
+        <div class="mnd-hint">Compare over a call or in person, not through the agents. Any wrong word blocks this pairing.</div>
+        <button class="mnd-btn mnd-btn-quiet mnd-btn-danger" data-deny="${fp}">They don't match</button>
+      </div>`;
+  } else if (state === 'verification-failed') {
+    actions = `
+      <div class="pair-step">
+        <div class="mnd-hint">Clear this only once you know why the words were different.</div>
+        <div class="pair-row"><input type="password" class="mnd-pin" data-clear-pin="${fp}" placeholder="Your PIN" autocomplete="off" />
+        <button class="mnd-btn mnd-btn-quiet" data-clear="${fp}">Clear and start again</button></div>
+      </div>`;
+  }
+  return `<div class="pair-card" data-pairing="${fp}">
+    <div class="pair-head"><strong>${name}</strong> <span class="pair-state pair-state-${esc(state)}">${label}</span></div>
+    ${actions}
+    <div class="pair-meta">Agent ${fp.slice(0, 12)}…</div>
+  </div>`;
+}
+
+export function renderPairings(list) {
+  if (!Array.isArray(list) || list.length === 0) {
+    return '<div class="mnd-hint">No pairings yet. An agent starts one with <code>threadline_pair</code> start.</div>';
+  }
+  return list.map(renderPairing).join('');
+}
+
+/** Words typed into the 12 inputs for one pairing, in order. */
+export function collectTypedWords(root, fp) {
+  const inputs = Array.from(root.querySelectorAll(`[data-their-word="${fp}"]`));
+  inputs.sort((a, b) => Number(a.dataset.idx) - Number(b.dataset.idx));
+  return inputs.map((i) => String(i.value || '').trim().toLowerCase());
+}
+
+export function createController({ doc, els, fetchImpl }) {
+  let timer = null;
+
+  async function fetchJson(url, opts) {
+    const res = await fetchImpl(url, opts);
+    let body = null;
+    try { body = await res.json(); } catch { body = null; }
+    return { status: res.status, body };
+  }
+
+  function note(msg, kind) {
+    if (!els.notice) return;
+    els.notice.textContent = msg;
+    els.notice.className = kind === 'error' ? 'mnd-notice mnd-notice-err' : kind === 'success' ? 'mnd-notice mnd-notice-ok' : 'mnd-notice';
+  }
+
+  // A timed refresh must not wipe words or a PIN the operator is typing.
+  function operatorIsTyping() {
+    const inputs = els.list ? Array.from(els.list.querySelectorAll('input')) : [];
+    return inputs.some((i) => i.value);
+  }
+
+  async function load(opts = {}) {
+    if (opts.timed && operatorIsTyping()) return;
+    try {
+      const { status, body } = await fetchJson('/threadline/pairing');
+      if (status === 503) { els.list.innerHTML = '<div class="mnd-hint">Verified pairing is turned off on this agent.</div>'; return; }
+      if (status !== 200) { note(`Could not load pairings: ${body?.error ?? `HTTP ${status}`}`, 'error'); return; }
+      els.list.innerHTML = renderPairings(body?.pairings ?? []);
+    } catch (e) {
+      note(`Could not reach the agent: ${e?.message ?? e}`, 'error');
+    }
+  }
+
+  async function post(url, payload) {
+    return fetchJson(url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(payload) });
+  }
+
+  async function onClick(ev) {
+    const t = ev.target;
+    if (!t || !t.dataset) return;
+    const root = els.list;
+    const take = (attr, fp) => { const el = root.querySelector(`[${attr}="${fp}"]`); const v = el ? el.value : ''; if (el) el.value = ''; return v; };
+    try {
+      if (t.dataset.showWords) {
+        const fp = t.dataset.showWords;
+        const pin = take('data-show-pin', fp);
+        if (!pin) { note('Enter your PIN to see the words.', 'error'); return; }
+        const res = await fetchImpl(`/threadline/pairing/${fp}`, { headers: { 'X-Dashboard-Pin': pin } });
+        const body = await res.json().catch(() => null);
+        const words = body?.pairing?.sasWords;
+        if (!Array.isArray(words)) { note(res.status === 200 ? 'The PIN was not accepted, or this pairing is no longer waiting.' : `Refused: ${body?.error ?? `HTTP ${res.status}`}`, 'error'); return; }
+        const ol = root.querySelector(`[data-own-words="${fp}"]`);
+        if (ol) ol.innerHTML = words.map((w) => `<li>${esc(w)}</li>`).join('');
+        note('These are the words on this side. Read them to the other operator and type theirs below.', 'info');
+      } else if (t.dataset.confirm) {
+        const fp = t.dataset.confirm;
+        const words = collectTypedWords(root, fp);
+        const pin = take('data-confirm-pin', fp);
+        if (words.some((w) => !w)) { note(`Type all ${WORD_COUNT} of the other side's words first.`, 'error'); return; }
+        if (!pin) { note('Enter your PIN to confirm.', 'error'); return; }
+        const { status, body } = await post(`/threadline/pairing/${fp}/verify`, { words, pin });
+        if (status !== 200) { note(`Not confirmed — the server refused: ${body?.error ?? `HTTP ${status}`}`, 'error'); return; }
+        note(body?.state === 'mutual-verified' ? 'Verified. Every word matched.' : 'The words did not match. This pairing is now blocked.', body?.state === 'mutual-verified' ? 'success' : 'error');
+        await load();
+      } else if (t.dataset.deny) {
+        const fp = t.dataset.deny;
+        const pin = take('data-confirm-pin', fp);
+        if (!pin) { note('Enter your PIN (in the field above) to record that the words did not match.', 'error'); return; }
+        const { status, body } = await post(`/threadline/pairing/${fp}/verify`, { match: false, pin });
+        if (status !== 200) { note(`Not recorded — the server refused: ${body?.error ?? `HTTP ${status}`}`, 'error'); return; }
+        note('Recorded: the words did not match. This pairing is blocked.', 'success');
+        await load();
+      } else if (t.dataset.clear) {
+        const fp = t.dataset.clear;
+        const pin = take('data-clear-pin', fp);
+        if (!pin) { note('Enter your PIN to clear this pairing.', 'error'); return; }
+        const { status, body } = await post(`/threadline/pairing/${fp}/start`, { clearFailed: true, pin });
+        if (status !== 200) { note(`Not cleared — the server refused: ${body?.error ?? `HTTP ${status}`}`, 'error'); return; }
+        note('Cleared. Compare the words again.', 'success');
+        await load();
+      }
+    } catch (e) {
+      note(`Could not reach the agent: ${e?.message ?? e}`, 'error');
+    }
+  }
+
+  return {
+    start() {
+      if (els.list && !els.list.__pairWired) { els.list.addEventListener('click', onClick); els.list.__pairWired = true; }
+      load();
+      if (!timer) timer = setInterval(() => load({ timed: true }), REFRESH_MS);
+    },
+    stop() { if (timer) { clearInterval(timer); timer = null; } },
+    load,
+    onClick,
+  };
+}

package/dist/cli.js

@@ -31,6 +31,7 @@ import { addUser, listUsers } from './commands/user.js';
 import { addJob, listJobs } from './commands/job.js';
 import { listRelationships, importRelationships, exportRelationships } from './commands/relationship.js';
 import { listMachines, removeMachine, whoami, startPairing, joinMesh, leaveMesh, wakeup, doctor } from './commands/machine.js';
+import { identityAdopt, identityInit, identityStatus } from './commands/identity.js';
 import pc from 'picocolors';
 import { getInstarVersion } from './core/Config.js';
 import { resolveAgentDir } from './core/Config.js';
@@ -1969,6 +1970,28 @@ machineCmd
     .description('Revoke a machine from the mesh')
     .option('-d, --dir <path>', 'Project directory')
     .action(removeMachine);
+// ── Agent identity (a2a-single-agent-identity §1.4) ──────────────────
+const identityCmd = program
+    .command('identity')
+    .description('This machine\'s AGENT identity: adopt it from a sibling, or mint a standalone one');
+identityCmd
+    .command('status')
+    .description('The on-disk posture + routing fingerprint (never key material)')
+    .option('-d, --dir <path>', 'Project directory')
+    .action(identityStatus);
+identityCmd
+    .command('adopt')
+    .description('Move this machine\'s existing identity aside and adopt the one a named sibling publishes (run ON the affected machine, after the operator\'s yes)')
+    .requiredOption('--from <machine-name-or-id>', 'The sibling to adopt the identity from')
+    .option('-d, --dir <path>', 'Project directory')
+    .action(identityAdopt);
+identityCmd
+    .command('init')
+    .description('Mint a NEW agent identity on a fleet with no usable candidate (peers must re-pin)')
+    .option('--standalone', 'Required: this is a standalone recovery mint')
+    .option('--i-understand-peers-must-repin', 'Required: acknowledge every peer must re-pin the new address')
+    .option('-d, --dir <path>', 'Project directory')
+    .action(identityInit);
 program
     .command('whoami')
     .description("Show this machine's identity and role")