papercliped 1.1.0-beta.2 → 2.1.0

package/dist/manage/routes.js

@@ -1,65 +1,40 @@
-import { createHmac, timingSafeEqual } from "node:crypto";
 import { displayName } from "../accounts/alias.js";
-import { randomToken, sha256Hex } from "../oauth/crypto.js";
-import { managePage } from "./page.js";
-const COOKIE = "pcp_manage";
 const HEADERS = { "Cache-Control": "no-store", "X-Content-Type-Options": "nosniff", "Referrer-Policy": "no-referrer" };
+/** A DNS name or IPv4 literal, optionally with a port; undefined when it is anything else. */
+function cleanHost(v) {
+    if (typeof v !== "string")
+        return undefined;
+    const h = v.trim().toLowerCase();
+    if (!h)
+        return null;
+    if (h.length > 255 || !/^[a-z0-9]([a-z0-9.-]*[a-z0-9])?(:\d{1,5})?$/.test(h))
+        return undefined;
+    try {
+        return new URL(`https://${h}`).host;
+    }
+    catch {
+        return undefined;
+    }
+}
+const cleanUid = (v) => (v == null ? null : typeof v === "string" && v.length <= 100 ? v : undefined);
 /**
- * The connection manager for beta accounts: sign in with username + secret key, then see every connected app, change what each
- * may do, disconnect, switch anonymity, rotate the secret key, or disconnect/delete everything. Every action is limited to the
- * signed-in account; sensitive ones ask for the secret key again.
+ * The manage API behind the Papercliped plugin for Paperclip (there is no web page for it any more: managing happens inside
+ * Paperclip). The plugin signs in once with username + secret key and gets a plugin token; with it, it can list and change
+ * connected apps, switch anonymity, and list or remove plugin links. Sensitive actions (new secret key, disconnect Paperclip,
+ * delete account) need the secret key again in the request. Every action is limited to the token's own account.
  *
- * CSRF: the session cookie is SameSite=Strict, and every state-changing call must be JSON with a custom header, which a
- * cross-site page cannot send without a CORS preflight (which we never approve).
+ * Only bearer tokens are accepted, and a cross-site page cannot attach one without a CORS preflight (which we never approve),
+ * so there is no cookie and no CSRF surface.
  */
 export class ManageRoutes {
     p;
-    o;
-    key;
-    now;
-    ttl;
-    constructor(p, o) {
+    constructor(p, _o = {}) {
         this.p = p;
-        this.o = o;
-        this.key = p.manageSigningKey();
-        this.now = o.now ?? Date.now;
-        this.ttl = (o.sessionHours ?? 8) * 3600;
-    }
-    fp(a) {
-        return sha256Hex(a.secretHash).slice(0, 12);
-    }
-    mac(accountId, exp, fp) {
-        return createHmac("sha256", this.key).update(`${accountId}|${exp}|${fp}`).digest("base64url");
-    }
-    cookie(a) {
-        if (!a)
-            return `${COOKIE}=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0${this.o.secureCookie ? "; Secure" : ""}`;
-        const exp = Math.floor(this.now() / 1000) + this.ttl;
-        const fp = this.fp(a);
-        return `${COOKIE}=${a.id}~${exp}~${fp}~${this.mac(a.id, exp, fp)}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${this.ttl}${this.o.secureCookie ? "; Secure" : ""}`;
-    }
-    async session(req) {
-        const m = new RegExp(`(?:^|; )${COOKIE}=([^;]+)`).exec(req.headers.cookie ?? "");
-        if (!m)
-            return null;
-        const [id, exp, fp, mac] = m[1].split("~");
-        if (!id || !exp || !fp || !mac || Number(exp) * 1000 < this.now())
-            return null;
-        const want = Buffer.from(this.mac(id, Number(exp), fp));
-        const got = Buffer.from(mac);
-        if (want.length !== got.length || !timingSafeEqual(want, got))
-            return null;
-        const a = await this.p.manageAccount(id);
-        // Changing the secret key changes the fingerprint, which ends every session signed with the old one.
-        return a && !a.disabled && this.fp(a) === fp ? a : null;
-    }
-    send(res, status, body, type, extra = {}) {
-        res.writeHead(status, { "Content-Type": type, ...HEADERS, ...extra });
-        res.end(body);
-        return true;
     }
     json(res, status, body, extra = {}) {
-        return this.send(res, status, JSON.stringify(body), "application/json", extra);
+        res.writeHead(status, { "Content-Type": "application/json", ...HEADERS, ...extra });
+        res.end(JSON.stringify(body));
+        return true;
     }
     async body(req) {
         if (!/^application\/json\b/i.test(String(req.headers["content-type"] ?? "")))
@@ -81,50 +56,42 @@ export class ManageRoutes {
     async handle(req, res, url) {
         const path = url.pathname.replace(/\/+$/, "") || "/";
         const m = req.method ?? "GET";
-        if (m === "GET" && path === "/manage") {
-            const nonce = randomToken(12);
-            return this.send(res, 200, managePage(nonce), "text/html; charset=utf-8", {
-                "Content-Security-Policy": `default-src 'none'; img-src data:; style-src 'unsafe-inline'; script-src 'nonce-${nonce}'; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'`,
-            });
+        // The old browser page: managing now happens in Paperclip, with the plugin.
+        if (path === "/manage") {
+            res.writeHead(302, { Location: "/docs/paperclip-plugin", ...HEADERS });
+            res.end();
+            return true;
         }
         if (!path.startsWith("/api/manage"))
             return false;
-        if (m !== "GET") {
-            // CSRF guard (see class comment).
-            if (req.headers["x-papercliped"] !== "1")
-                return this.json(res, 400, { error: "Missing request header" });
-        }
         const route = path.slice("/api/manage".length) || "/";
-        if (m === "POST" && route === "/login") {
+        // The plugin proves the secret key once and gets its token. Throttled exactly like the sign-in page.
+        if (m === "POST" && route === "/plugin-link/sign-in") {
             const b = await this.body(req);
             if (!b)
                 return this.json(res, 400, { error: "Send JSON" });
+            const host = b.instanceHost == null ? null : cleanHost(b.instanceHost);
+            const uid = cleanUid(b.paperclipUserId);
+            if (host === undefined || uid === undefined)
+                return this.json(res, 400, { error: "Invalid instanceHost or paperclipUserId" });
             const r = await this.p.manageLogin(req, String(b.username ?? ""), String(b.secret ?? ""));
             if (!r.ok)
                 return r.reason === "throttled" ? this.json(res, 429, { error: "Too many attempts. Wait a few minutes." }) : this.json(res, 401, { error: "That username and secret key don't match." });
-            return this.json(res, 200, { ok: true }, { "Set-Cookie": this.cookie(r.account) });
+            const { token } = await this.p.manageLinkPlugin(r.account, { instanceHost: host, paperclipUserId: uid });
+            return this.json(res, 200, { token });
         }
-        const a = await this.session(req);
-        if (!a)
-            return this.json(res, 401, { error: "Sign in first" });
+        const bearer = /^Bearer\s+(\S+)$/i.exec(String(req.headers.authorization ?? ""))?.[1] ?? null;
+        const pr = bearer ? await this.p.managePluginPrincipal(bearer) : null;
+        if (!pr)
+            return this.json(res, 401, { error: "Link the Papercliped plugin again" });
+        const a = pr.account;
+        const linkId = pr.linkId;
         if (!(await this.p.store.hit(`manage:${a.id}`, 120, 60_000)))
             return this.json(res, 429, { error: "Slow down" });
-        if (m === "POST" && route === "/logout")
-            return this.json(res, 200, { ok: true }, { "Set-Cookie": this.cookie(null) });
         if (m === "GET" && route === "/me") {
             const link = await this.p.manageInstanceLabel(a.id);
-            return this.json(res, 200, { name: displayName(a), anonymous: !!a.anonymous, alias: a.alias ?? null, beta: !!a.beta, paperclip: link.label, connected: link.connected, createdAt: a.createdAt });
-        }
-        if (m === "POST" && route === "/beta") {
-            const b = await this.body(req);
-            if (!b || typeof b.beta !== "boolean")
-                return this.json(res, 400, { error: "beta must be true or false" });
-            await this.p.manageSetBeta(a, b.beta);
-            return this.json(res, 200, { beta: b.beta });
+            return this.json(res, 200, { name: displayName(a), anonymous: !!a.anonymous, alias: a.alias ?? null, paperclip: link.label, connected: link.connected, createdAt: a.createdAt });
         }
-        // Everything below is part of the beta.
-        if (!a.beta)
-            return this.json(res, 403, { error: "Join the beta to use the connection manager", code: "beta_required" });
         if (m === "GET" && route === "/connections")
             return this.json(res, 200, { connections: await this.p.manageConnections(a.id) });
         const c = /^\/connections\/([A-Za-z0-9_-]{1,80})$/.exec(route);
@@ -137,6 +104,13 @@ export class ManageRoutes {
         }
         if (c && m === "DELETE")
             return (await this.p.manageRevoke(a, c[1])) ? this.json(res, 200, { ok: true }) : this.json(res, 404, { error: "No such connection" });
+        if (m === "GET" && route === "/plugin-links")
+            return this.json(res, 200, { links: (await this.p.manageListPluginLinks(a.id)).map((l) => ({ id: l.id, host: l.host, createdAt: l.createdAt, lastUsedAt: l.lastUsedAt, current: l.id === linkId })) });
+        const pl = /^\/plugin-links\/([A-Za-z0-9_-]{1,80})$/.exec(route);
+        if (pl && m === "DELETE") {
+            const id = pl[1] === "self" ? linkId : pl[1];
+            return (await this.p.manageRevokePluginLink(a, id)) ? this.json(res, 200, { ok: true }) : this.json(res, 404, { error: "No such link" });
+        }
         if (m === "POST" && route === "/privacy") {
             const b = await this.body(req);
             if (!b || typeof b.anonymous !== "boolean")
@@ -158,9 +132,13 @@ export class ManageRoutes {
             if (!(await this.p.manageReauth(a.id, String(b.secret ?? ""))))
                 return this.json(res, 403, { error: "That secret key is not right (or too many attempts)." });
             if (route === "/secret/rotate") {
+                // Every plugin link ends with the old key; this plugin gets a fresh token so it stays linked.
+                const links = await this.p.manageListPluginLinks(a.id);
+                const here = links.find((l) => l.id === linkId);
                 const secret = await this.p.manageRotateSecret(a);
                 const fresh = (await this.p.manageAccount(a.id));
-                return this.json(res, 200, { secret }, { "Set-Cookie": this.cookie(fresh) });
+                const { token } = await this.p.manageLinkPlugin(fresh, { instanceHost: here?.host ?? null, paperclipUserId: here?.paperclipUserId ?? null });
+                return this.json(res, 200, { secret, token });
             }
             if (route === "/paperclip/disconnect") {
                 await this.p.manageDisconnectPaperclip(a);
@@ -169,7 +147,7 @@ export class ManageRoutes {
             if (String(b.confirm ?? "").toLowerCase() !== a.username.toLowerCase())
                 return this.json(res, 400, { error: "Type your username to confirm." });
             await this.p.manageDeleteAccount(a);
-            return this.json(res, 200, { ok: true }, { "Set-Cookie": this.cookie(null) });
+            return this.json(res, 200, { ok: true });
         }
         return this.json(res, 404, { error: "Not found" });
     }

package/dist/oauth/pages.js

@@ -1,29 +1,42 @@
 import { USERNAME_MAX, USERNAME_MIN } from "../accounts/username.js";
 import { FAVICON_LINK } from "../site/favicon.js";
-import { grantableScopes, scopesUpTo } from "./scopes.js";
+import { grantableScopes } from "./scopes.js";
 export const esc = (s) => s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
 /**
  * Papercliped sign-in pages. The look follows Paperclip's own sign-in screen (warm cream page, left-aligned form, olive
  * accents, no card chrome) so connecting feels native; colours were sampled from it and the enabled button is darkened so text
  * meets WCAG AA (contrast is asserted in the tests). One self-contained document per page: no external fonts, scripts or images.
  */
+/**
+ * The website's type and colours, for the server-rendered pages. Fonts load from /fonts/ when the website is deployed with the
+ * bridge (web/dist); otherwise the system fallbacks are used.
+ */
+export const FONTS_CSS = `@font-face{font-family:"Inter Variable";font-style:normal;font-display:swap;font-weight:100 900;src:url(/fonts/inter-latin-wght-normal.woff2) format("woff2-variations")}
+@font-face{font-family:"Bricolage Grotesque Variable";font-style:normal;font-display:swap;font-weight:200 800;src:url(/fonts/bricolage-grotesque-latin-wght-normal.woff2) format("woff2-variations")}
+@font-face{font-family:"JetBrains Mono";font-style:normal;font-display:swap;font-weight:400;src:url(/fonts/jetbrains-mono-latin-400-normal.woff2) format("woff2")}`;
+export const SANS = `"Inter Variable",Inter,ui-sans-serif,system-ui,-apple-system,"Segoe UI",Roboto,sans-serif`;
+export const DISPLAY = `"Bricolage Grotesque Variable","Inter Variable",ui-sans-serif,system-ui,sans-serif`;
+export const MONO = `"JetBrains Mono",ui-monospace,SFMono-Regular,Menlo,monospace`;
+/** The default "clip" theme in dark mode (same values as web/src/theme/palettes.ts). */
+export const THEME_DARK = { bg: "#16150f", ink: "#f4f1d6", ink2: "#e9e4b0", muted: "#bdb99f", line: "#5c5a49", btn: "#e9e4b0", btnText: "#16150f", disabled: "#7d7a64" };
 export const THEME = { bg: "#fffddc", ink: "#0b0a07", ink2: "#47463c", muted: "#6b6959", line: "#b0a993", btn: "#47463c", btnText: "#fffddc", disabled: "#8c8a77", errBg: "#fde8e3", errInk: "#8a1f11", warnBg: "#fff1c2" };
-const CSS = `
-:root{--bg:${THEME.bg};--ink:${THEME.ink};--ink2:${THEME.ink2};--muted:${THEME.muted};--line:${THEME.line};--btn:${THEME.btn};--btntext:${THEME.btnText};--off:${THEME.disabled}}
+const CSS = `${FONTS_CSS}
+:root{--bg:${THEME.bg};--ink:${THEME.ink};--ink2:${THEME.ink2};--muted:${THEME.muted};--line:${THEME.line};--btn:${THEME.btn};--btntext:${THEME.btnText};--off:${THEME.disabled};color-scheme:light}
+@media (prefers-color-scheme:dark){:root{--bg:${THEME_DARK.bg};--ink:${THEME_DARK.ink};--ink2:${THEME_DARK.ink2};--muted:${THEME_DARK.muted};--line:${THEME_DARK.line};--btn:${THEME_DARK.btn};--btntext:${THEME_DARK.btnText};--off:${THEME_DARK.disabled};color-scheme:dark}}
 *{box-sizing:border-box}html{-webkit-text-size-adjust:100%}
-body{margin:0;min-height:100vh;background:var(--bg);color:var(--ink);font:15px/1.5 Inter,ui-sans-serif,system-ui,-apple-system,"Segoe UI",Roboto,sans-serif;position:relative;overflow-x:hidden}
+body{margin:0;min-height:100vh;background:var(--bg);color:var(--ink);font:15px/1.55 ${SANS};position:relative;overflow-x:hidden}
 body::before{content:"";position:fixed;right:5vw;top:5vh;width:min(26vw,300px);height:min(48vh,420px);pointer-events:none;opacity:.55;
 background-image:radial-gradient(var(--line) 1.1px,transparent 1.3px);background-size:13px 13px;-webkit-mask-image:linear-gradient(135deg,#000 0%,transparent 75%);mask-image:linear-gradient(135deg,#000 0%,transparent 75%)}
 @media (max-width:900px){body::before{display:none}}
 main{position:relative;width:min(400px,100% - 40px);margin:9vh 0 6vh max(20px,min(14vw,240px))}
 @media (max-width:900px){main{margin:6vh auto}}
-.brand{display:flex;align-items:center;gap:8px;font-weight:600;font-size:17px;margin-bottom:34px}.brand svg{width:20px;height:20px}
-h1{font-size:21px;line-height:1.25;font-weight:600;margin:0 0 6px}
+.brand{display:flex;align-items:center;gap:8px;font-family:${DISPLAY};font-weight:700;font-size:19px;text-transform:lowercase;margin-bottom:34px}.brand svg{width:20px;height:20px}
+h1{font-family:${DISPLAY};font-size:24px;line-height:1.2;font-weight:700;letter-spacing:-.01em;margin:0 0 6px}
 p.lede{margin:0 0 20px;color:var(--muted)}
 label.f{display:block;font-size:12px;color:var(--muted);margin:14px 0 5px}
 input[type=text],input[type=password]{width:100%;height:42px;padding:0 12px;border:1px solid var(--line);border-radius:8px;background:transparent;color:var(--ink);font:inherit}
 input:focus-visible,button:focus-visible,a:focus-visible,summary:focus-visible{outline:2px solid var(--ink2);outline-offset:2px}
-.btn{display:block;width:100%;height:42px;margin-top:18px;border:1px solid var(--btn);border-radius:8px;background:var(--btn);color:var(--btntext);font:inherit;font-weight:600;cursor:pointer}
+.btn{display:block;width:100%;height:42px;margin-top:18px;border:1px solid var(--btn);border-radius:8px;background:var(--btn);color:var(--btntext);font:inherit;font-weight:600;cursor:pointer;transition:transform .15s ease,box-shadow .15s ease}.btn:hover{transform:translateY(-1px);box-shadow:0 6px 16px rgba(0,0,0,.12)}.btn:active{transform:translateY(0) scale(.98)}@media (prefers-reduced-motion:reduce){.btn{transition:none}.btn:hover{transform:none}}
 .btn:hover{filter:brightness(1.15)}.btn:disabled{background:var(--off);border-color:var(--off);cursor:not-allowed;filter:none}
 .btn.ghost{background:transparent;color:var(--ink);border-color:var(--line)}.btn.ghost:hover{background:rgba(71,70,60,.07);filter:none}
 .row{display:flex;gap:10px}.row .btn{margin-top:18px}
@@ -33,7 +46,7 @@ input:focus-visible,button:focus-visible,a:focus-visible,summary:focus-visible{o
 .opt{display:block;border:1px solid var(--line);border-radius:8px;padding:10px 12px;margin:8px 0;cursor:pointer}.opt:has(input:checked){border-color:var(--ink2);box-shadow:0 0 0 1px var(--ink2)}
 .opt strong{font-weight:600}.opt small{display:block;color:var(--muted);margin-top:2px;font-size:13px}
 small.hint{display:block;color:var(--muted);font-size:12.5px;margin-top:6px}
-code,.mono{font-family:ui-monospace,SFMono-Regular,Menlo,monospace}
+code,.mono{font-family:${MONO}}
 .secret{display:block;margin:14px 0 8px;padding:14px 12px;border:1px dashed var(--ink2);border-radius:8px;font-size:13px;letter-spacing:0;overflow-wrap:normal;background:rgba(255,255,255,.35);user-select:all}
 a{color:var(--ink)}
 .fine{color:var(--muted);font-size:12.5px;margin-top:22px}
@@ -42,7 +55,7 @@ ul.rules{margin:8px 0 0;padding-left:18px;color:var(--muted);font-size:13px}
 `;
 const CLIP = `<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M21.44 11.05l-9.19 9.19a6 6 0 0 1-8.49-8.49l9.19-9.19a4 4 0 0 1 5.66 5.66l-9.2 9.19a2 2 0 0 1-2.83-2.83l8.49-8.48"/></svg>`;
 function shell(title, body, nonce, script) {
-    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="color-scheme" content="light"><title>${esc(title)} · Papercliped</title>${FAVICON_LINK}<style>${CSS}</style></head><body><main><div class="brand">${CLIP}<span>Papercliped</span></div>${body}</main>${script ? `<script nonce="${nonce}">${script}</script>` : ""}</body></html>`;
+    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="color-scheme" content="light dark"><title>${esc(title)} · Papercliped</title>${FAVICON_LINK}<style>${CSS}</style></head><body><main><div class="brand">${CLIP}<span>Papercliped</span></div>${body}</main>${script ? `<script nonce="${nonce}">${script}</script>` : ""}</body></html>`;
 }
 const hidden = (rid, csrf) => `<input type="hidden" name="rid" value="${esc(rid)}"><input type="hidden" name="csrf" value="${esc(csrf)}">`;
 const errBox = (e) => (e ? `<div class="err" role="alert">${esc(e)}</div>` : "");
@@ -90,7 +103,7 @@ export function approvePage(v) {
        <div class="row"><button class="btn" name="action" value="continue">Continue</button>${cancel}</div>
      </form>`, v.nonce, poll);
 }
-const ANON_TEXT = "Appear anonymously in the operator's logs and panel (as a name like Ann02), and hide my Paperclip's address there.";
+const ANON_TEXT = "Appear anonymously in the operator's logs and dashboard (as a name like Ann02), and hide my Paperclip's address there.";
 export function usernamePage(v) {
     return shell("Choose a username", `<h1>Choose your username</h1>
      <p class="lede">Your Paperclip is connected. Pick a username so you can log in later without approving again.</p>
@@ -128,13 +141,12 @@ export function welcomePage(v) {
 }
 const LEVELS = [
     { scope: "paperclip:read", label: "Read only", blurb: "View agents, tasks, goals, costs and reports. Cannot change anything." },
-    { scope: "paperclip:control", label: "Full control (beta)", blurb: "Everything above, plus pause, resume or wake agents, create and update issues and goals, and comment." },
-    { scope: "paperclip:admin", label: "Admin (advanced)", blurb: "Everything above, plus decide approvals, change budgets, terminate agents and send arbitrary API writes." },
+    { scope: "paperclip:control", label: "Full control", blurb: "Everything: pause, resume, wake or terminate agents, assign and update issues and goals, comment, decide approvals, set budgets and send any API request." },
 ];
 /** Final step of the account flow: pick how much the app may do. */
 export function scopePage(v) {
     const allowed = new Set(grantableScopes(v.requestedMax));
-    const def = v.requestedMax === "paperclip:admin" ? "paperclip:control" : v.requestedMax;
+    const def = v.requestedMax;
     const opts = LEVELS.filter((l) => allowed.has(l.scope))
         .map((l) => `<label class="opt"><input type="radio" name="level" value="${l.scope}"${l.scope === def ? " checked" : ""}> <strong>${l.label}</strong><small>${esc(l.blurb)}</small></label>`)
         .join("");
@@ -148,15 +160,13 @@ export function scopePage(v) {
        ${opts}${where}
        <input type="hidden" name="privacy_present" value="1">
        <label class="chk"><input type="checkbox" name="anonymous"${v.anonymous ? " checked" : ""}><span>${esc(ANON_TEXT)}${v.alias ? ` <small class="hint">${v.anonymous ? "You appear as" : "You would appear as"} <strong>${esc(v.alias)}</strong>.</small>` : ""}</span></label>
-       <input type="hidden" name="beta_present" value="1">
-       <label class="chk"><input type="checkbox" name="beta"${v.beta ? " checked" : ""}><span>Join the beta: manage your connections (see them, change what each may do, disconnect) at <code>/manage</code>.</span></label>
        <div class="row"><button class="btn" name="action" value="allow">Allow</button>${cancel}</div>
      </form>
-     <p class="fine">Disconnect any time from the app. Access levels are enforced by Papercliped; your Paperclip key stays encrypted on our side and is never shown to the app.</p>`);
+     <p class="fine">Disconnect any time from the app, or manage every connection inside Paperclip with the Papercliped plugin. Access levels are enforced by Papercliped; your Paperclip key stays encrypted on our side and is never shown to the app.</p>`);
 }
 export function consentPage(v) {
-    const allowed = new Set(scopesUpTo(v.requestedMax));
-    const def = v.requestedMax === "paperclip:admin" ? "paperclip:control" : v.requestedMax;
+    const allowed = new Set(grantableScopes());
+    const def = v.requestedMax;
     const opts = LEVELS.filter((l) => allowed.has(l.scope))
         .map((l) => `<label class="opt"><input type="radio" name="level" value="${l.scope}"${l.scope === def ? " checked" : ""}> <strong>${l.label}</strong><small>${esc(l.blurb)}</small></label>`)
         .join("");

package/dist/oauth/pg-store.js

@@ -429,16 +429,3 @@ export class PgStore {
         await this.pool.end();
     }
 }
-/**
- * The operator panel's data access. Connects with the read-only `panel_ro` role (docs/panel-role.sql) and reads accounts and grants
- * ONLY through the safe views, so it cannot see a secret hash, a sealed credential or a real username of an anonymous account.
- * Write methods inherited from PgStore are never called by the panel, and the role could not execute them anyway.
- */
-export class PgPanelStore extends PgStore {
-    async countAccounts() {
-        return num((await this.q("select count(*) as n from bridge.panel_accounts")).rows[0].n);
-    }
-    async liveGrantCount() {
-        return num((await this.q("select count(*) as n from bridge.panel_grants where not revoked")).rows[0].n);
-    }
-}

package/dist/oauth/provider.js

@@ -1,4 +1,3 @@
-import { hkdfSync } from "node:crypto";
 import { generateSecretKey, burnVerify, hashSecretKey, normalizeSecretKey, verifySecretKey } from "../accounts/secret.js";
 import { anonInstanceLabel, displayName, generateAlias } from "../accounts/alias.js";
 import { AliasTakenError } from "../accounts/types.js";
@@ -10,7 +9,7 @@ import { Keyring, isValidCodeChallenge, randomToken, safeEqual, sha256Hex, verif
 import { approvePage, choosePage, consentPage, errorPage, instancePage, scopePage, secretPage, usernamePage, welcomePage } from "./pages.js";
 import { LoginError, PaperclipLogin } from "./paperclip-login.js";
 import { MemoryStore } from "./store.js";
-import { SCOPES, grantableScopes, isScope, maxRank, scopeAllows, scopesUpTo } from "./scopes.js";
+import { SCOPES, grantableScopes, isScope, maxRank, normalizeScope, normalizeScopes, scopeAllows, scopesUpTo } from "./scopes.js";
 const LOOPBACK = new Set(["localhost", "127.0.0.1", "[::1]"]);
 const PENDING_TTL_MS = 10 * 60_000;
 const CODE_TTL_MS = 60_000;
@@ -83,7 +82,7 @@ export class OAuthProvider {
             /* telemetry only */
         }
     }
-    /** The name logs and the panel show for an account: its alias if it opted into anonymity, else its username. */
+    /** The name logs and the operator dashboard show for an account: its alias if it opted into anonymity, else its username. */
     async who(accountId) {
         if (!accountId)
             return null;
@@ -222,8 +221,8 @@ export class OAuthProvider {
             /* best effort */
         }
     }
-    // ───────────── account management (the beta connection manager) ─────────────
-    // Everything here acts on ONE account and is reached only through ManageRoutes after the owner proved the secret key.
+    // ───────────── account management (the Paperclip plugin's connection manager) ─────────────
+    // Everything here acts on ONE account and is reached only through ManageRoutes, with a plugin token or the secret key.
     /** Username + secret key, throttled exactly like the sign-in page (shared counters, so there is no cheaper way to guess). */
     async manageLogin(req, username, secret) {
         const typed = username.trim().slice(0, 64);
@@ -249,45 +248,21 @@ export class OAuthProvider {
             return false;
         return verifySecretKey(secret, a.secretHash);
     }
-    /** Key for signing manager session cookies (derived from the service secret; never the secret itself). */
-    manageSigningKey() {
-        return Buffer.from(hkdfSync("sha256", this.deps.oauth.secret, "papercliped", "manage-session-v1", 32));
-    }
-    // ── the Paperclip plugin link: a one-time code (typed into the plugin) is exchanged for a long-lived plugin token ──
+    // ── the Paperclip plugin link: the plugin signs in once with username + secret key and gets a long-lived plugin token ──
     // The token is stored as a hash on a synthetic grant (client "paperclip-plugin", NO scopes), so it appears in no tool list,
     // cannot call any Paperclip tool, and is revoked like any grant. It only opens the manage API for its own account.
-    /** A single-use code the user types into the Paperclip plugin. Valid 10 minutes. */
-    async manageIssueLinkCode(a) {
-        const raw = randomToken(9).replace(/[^A-Za-z0-9]/g, "").toUpperCase().padEnd(10, "7").slice(0, 10);
-        const code = `pcl_${raw.slice(0, 5)}-${raw.slice(5)}`;
-        const ttl = 10 * 60_000;
-        await this.store.putCode(sha256Hex(code), { clientId: "plugin-link", redirectUri: "", codeChallenge: "", scopes: [], clientName: "Paperclip plugin", userId: null, instanceUrl: null, sealedCredential: null, accountId: a.id, username: displayName(a), path: "plugin", expiresAt: this.now() + ttl });
-        await this.event("updated", { accountId: a.id, username: displayName(a) }, "plugin_code");
-        return { code, expiresInSec: ttl / 1000 };
-    }
-    /** Trade a link code for a plugin token. Wrong, used and expired codes all look the same. */
-    async manageExchangeLinkCode(req, code, meta) {
-        if (!(await this.limit(`plink:ip:${this.ip(req)}`, 20)))
-            return null;
-        const norm = code.trim().toUpperCase();
-        if (!/^PCL_[A-Z0-9]{5}-[A-Z0-9]{5}$/.test(norm))
-            return null;
-        const taken = await this.store.takeCode(sha256Hex(`pcl_${norm.slice(4)}`));
-        if (taken.status !== "ok" || taken.record.clientId !== "plugin-link" || taken.record.expiresAt < this.now() || !taken.record.accountId)
-            return null;
-        const a = await this.store.getAccount(taken.record.accountId);
-        if (!a || a.disabled)
-            return null;
+    /** A plugin token for an account whose owner just proved the secret key. */
+    async manageLinkPlugin(a, meta) {
         const id = `pcb_pg_${randomToken(10)}`;
         const token = `pcb_pl_${randomToken(32)}`;
         await this.store.putGrant({ id, clientId: "paperclip-plugin", clientName: "Paperclip plugin", userId: meta.paperclipUserId, scopes: [], resource: "manage", instanceUrl: meta.instanceHost ? `https://${meta.instanceHost}` : null, sealedCredential: null, accountId: a.id, username: displayName(a), createdAt: this.now(), lastUsedAt: this.now(), revoked: false });
         await this.store.putAccess(sha256Hex(token), { grantId: id, expiresAt: this.now() + 180 * DAY_MS });
         await this.event("updated", { accountId: a.id, username: displayName(a) }, "plugin_linked");
-        return { token };
+        return { token, linkId: id };
     }
-    /** The account a plugin token belongs to (null if unknown, expired, revoked, or not a plugin token). */
-    async manageAccountForPluginToken(token) {
-        if (!token.startsWith("pcb_pl_"))
+    /** The account (and link id) a plugin token belongs to (null if unknown, expired, revoked, or not a plugin token). */
+    async managePluginPrincipal(token) {
+        if (!token.startsWith("pcb_pl_") || token.length > 200)
             return null;
         const rec = await this.store.getAccess(sha256Hex(token));
         if (!rec || rec.expiresAt < this.now())
@@ -299,10 +274,10 @@ export class OAuthProvider {
         if (!a || a.disabled)
             return null;
         await this.store.touchGrant(g.id);
-        return a;
+        return { account: a, linkId: g.id };
     }
     async manageListPluginLinks(accountId) {
-        return (await this.store.listAccountGrants(accountId)).filter((g) => g.clientId === "paperclip-plugin" && !g.revoked).map((g) => ({ id: g.id, host: g.instanceUrl ? new URL(g.instanceUrl).host : null, createdAt: g.createdAt, lastUsedAt: g.lastUsedAt }));
+        return (await this.store.listAccountGrants(accountId)).filter((g) => g.clientId === "paperclip-plugin" && !g.revoked).map((g) => ({ id: g.id, host: g.instanceUrl ? new URL(g.instanceUrl).host : null, paperclipUserId: g.userId, createdAt: g.createdAt, lastUsedAt: g.lastUsedAt }));
     }
     async manageRevokePluginLink(a, id) {
         const g = await this.store.getGrant(id);
@@ -315,24 +290,16 @@ export class OAuthProvider {
     manageAccount(accountId) {
         return this.store.getAccount(accountId);
     }
-    async manageSetBeta(a, beta) {
-        if (!!a.beta === beta)
-            return;
-        await this.store.setAccountBeta(a.id, beta);
-        await this.event("updated", { accountId: a.id, username: displayName(a) }, beta ? "beta_on" : "beta_off");
-    }
     async manageConnections(accountId) {
         return (await this.store.listAccountGrants(accountId))
             .filter((g) => !g.revoked && g.clientId !== "paperclip-plugin")
             .map((g) => ({ id: g.id, app: g.clientName, level: levelOf(g.scopes), createdAt: g.createdAt, lastUsedAt: g.lastUsedAt }));
     }
-    /** Change what a connected app may do. The owner may move it between read and control, or lower an admin grant; admin is never granted here. */
+    /** Change what a connected app may do: Read only or Full control. */
     async manageSetLevel(a, grantId, level) {
         const g = await this.store.getGrant(grantId);
         if (!g || g.revoked || g.accountId !== a.id || g.clientId === "paperclip-plugin")
             return false;
-        if (level === "paperclip:admin" && levelOf(g.scopes) !== "paperclip:admin")
-            return false;
         if (!(await this.store.setGrantScopes(g.id, scopesUpTo(level))))
             return false;
         await this.event("updated", { accountId: a.id, username: displayName(a) }, `level_${level.split(":")[1]}`);
@@ -352,6 +319,10 @@ export class OAuthProvider {
     async manageRotateSecret(a) {
         const secret = generateSecretKey();
         await this.store.setAccountSecret(a.id, await hashSecretKey(normalizeSecretKey(secret)));
+        // A new secret key means "I may be compromised": every plugin link goes too (the caller relinks the plugin it came from).
+        for (const g of await this.store.listAccountGrants(a.id))
+            if (g.clientId === "paperclip-plugin" && !g.revoked)
+                await this.store.revokeGrant(g.id);
         await this.event("updated", { accountId: a.id, username: displayName(a) }, "secret_rotated");
         return secret;
     }
@@ -520,7 +491,7 @@ export class OAuthProvider {
             "X-Frame-Options": "DENY",
             "X-Content-Type-Options": "nosniff",
             "Referrer-Policy": "no-referrer",
-            "Content-Security-Policy": `default-src 'none'; img-src data:; style-src 'unsafe-inline'; ${nonce ? `script-src 'nonce-${nonce}'; connect-src 'self'; ` : ""}form-action 'self'${formOrigin ? ` ${formOrigin}` : ""}; frame-ancestors 'none'; base-uri 'none'`,
+            "Content-Security-Policy": `default-src 'none'; img-src data:; style-src 'unsafe-inline'; font-src 'self'; ${nonce ? `script-src 'nonce-${nonce}'; connect-src 'self'; ` : ""}form-action 'self'${formOrigin ? ` ${formOrigin}` : ""}; frame-ancestors 'none'; base-uri 'none'`,
         });
         res.end(body);
         return true;
@@ -640,7 +611,7 @@ export class OAuthProvider {
             return this.html(res, 429, errorPage("Too many requests", "Please wait a minute and try again."));
         if ((await this.store.countPending()) >= MAX_PENDING)
             return this.html(res, 503, errorPage("Busy", "Too many sign-ins in progress. Try again shortly."));
-        const asked = (q.get("scope") ?? "").split(/\s+/).filter(isScope);
+        const asked = (q.get("scope") ?? "").split(/\s+/).map(normalizeScope).filter(isScope);
         const requestedMax = asked.length ? levelOf(asked) : "paperclip:read";
         const rid = randomToken(24);
         const p = { clientId: client.id, clientName: client.name, redirectUri, state, codeChallenge: challenge, requestedMax, csrf: randomToken(24), attempts: 0, expiresAt: this.now() + PENDING_TTL_MS };
@@ -676,7 +647,7 @@ export class OAuthProvider {
             clientName: p.clientName,
             redirectHost: u.host,
             loopbackOnly: u.protocol === "http:" && LOOPBACK.has(u.hostname),
-            requestedMax: p.requestedMax,
+            requestedMax: normalizeScope(p.requestedMax),
             login: this.deps.oauth.login,
             approvalUrl: ch?.approvalUrl,
             approved,
@@ -716,7 +687,7 @@ export class OAuthProvider {
             await this.event("connect_failed", null, "denied");
             return this.redirectWith(res, p.redirectUri, { error: "access_denied", error_description: "The user denied the request", state: p.state });
         }
-        const allowed = scopesUpTo(p.requestedMax);
+        const allowed = grantableScopes();
         const level = (f.get("level") ?? "");
         if (!allowed.includes(level))
             return this.renderConsent(res, rid, p, false, "Choose an access level.");
@@ -805,7 +776,7 @@ export class OAuthProvider {
                 const link = p.accountId ? await this.store.getLink(p.accountId) : undefined;
                 const u = new URL(p.redirectUri);
                 const acct = p.accountId ? await this.store.getAccount(p.accountId) : undefined;
-                return this.page(res, status, scopePage({ ...c, requestedMax: p.requestedMax, loopbackOnly: u.protocol === "http:" && LOOPBACK.has(u.hostname), instanceHost: link ? new URL(link.instanceUrl).host : "your Paperclip", username: p.username ?? "", anonymous: !!acct?.anonymous, alias: acct?.alias ?? null, beta: !!acct?.beta }), p);
+                return this.page(res, status, scopePage({ ...c, requestedMax: normalizeScope(p.requestedMax), loopbackOnly: u.protocol === "http:" && LOOPBACK.has(u.hostname), instanceHost: link ? new URL(link.instanceUrl).host : "your Paperclip", username: p.username ?? "", anonymous: !!acct?.anonymous, alias: acct?.alias ?? null }), p);
             }
             default:
                 return this.page(res, status, choosePage(c), p);
@@ -1140,7 +1111,7 @@ export class OAuthProvider {
         if (!s)
             return true;
         const { f, p, rid } = s;
-        const allowed = grantableScopes(p.requestedMax);
+        const allowed = grantableScopes();
         const level = (f.get("level") ?? "");
         if (!allowed.includes(level))
             return this.renderStage(res, rid, p, "Choose an access level.");
@@ -1156,13 +1127,6 @@ export class OAuthProvider {
             if (want !== !!acct.anonymous)
                 acct = await this.setPrivacy(acct, want);
         }
-        if (f.get("beta_present") === "1") {
-            const want = f.get("beta") === "on";
-            if (want !== !!acct.beta) {
-                await this.manageSetBeta(acct, want);
-                acct = { ...acct, beta: want };
-            }
-        }
         const code = `pcb_ac_${randomToken(32)}`;
         await this.store.putCode(sha256Hex(code), {
             clientId: p.clientId,
@@ -1174,7 +1138,7 @@ export class OAuthProvider {
             instanceUrl: link.instanceUrl,
             sealedCredential: null, // the credential stays on the account link
             accountId: p.accountId,
-            username: displayName(acct), // grants carry the DISPLAY name: that is what audit rows and the panel see
+            username: displayName(acct), // grants carry the DISPLAY name: that is what audit rows and the operator dashboard see
             path: p.path ?? "connect",
             expiresAt: this.now() + CODE_TTL_MS,
         });
@@ -1246,7 +1210,7 @@ export class OAuthProvider {
         }
         if (f.get("client_id") !== grant.clientId)
             throw new OAuthError("invalid_grant", "client_id mismatch");
-        const asked = (f.get("scope") ?? "").split(/\s+/).filter(Boolean);
+        const asked = (f.get("scope") ?? "").split(/\s+/).filter(Boolean).map(normalizeScope);
         if (asked.some((s) => !isScope(s) || !scopeAllows(grant.scopes, s)))
             throw new OAuthError("invalid_scope", "Requested scope exceeds the original grant");
         return this.issue(grant);
@@ -1257,7 +1221,7 @@ export class OAuthProvider {
         const refresh = `pcb_rt_${randomToken(32)}`;
         await this.store.putAccess(sha256Hex(access), { grantId: grant.id, expiresAt: t + this.deps.oauth.accessTtlSec * 1000 });
         await this.store.putRefresh(sha256Hex(refresh), { grantId: grant.id, expiresAt: t + this.deps.oauth.refreshTtlSec * 1000 });
-        return { access_token: access, token_type: "Bearer", expires_in: this.deps.oauth.accessTtlSec, refresh_token: refresh, scope: grant.scopes.join(" ") };
+        return { access_token: access, token_type: "Bearer", expires_in: this.deps.oauth.accessTtlSec, refresh_token: refresh, scope: normalizeScopes(grant.scopes).join(" ") };
     }
     // ───────────── POST /revoke (RFC 7009) ─────────────
     async revoke(req, res) {

package/dist/oauth/scopes.js

@@ -1,24 +1,27 @@
-export const SCOPES = ["paperclip:read", "paperclip:control", "paperclip:admin"];
-const RANK = { "paperclip:read": 1, "paperclip:control": 2, "paperclip:admin": 3 };
-/** Tools that are `write` by access class but too consequential for the control tier. */
-const ADMIN_TOOLS = new Set(["paperclip_decide_approval", "paperclip_set_agent_budget"]);
+/**
+ * Two levels: Read only and Full control. Full control is every tool, because the point of Papercliped is to run your
+ * Paperclip from anywhere, not just to watch it.
+ */
+export const SCOPES = ["paperclip:read", "paperclip:control"];
+/** A retired third level. Old grants and apps that still ask for it get Full control. */
+export const LEGACY_ADMIN = "paperclip:admin";
+const RANK = { "paperclip:read": 1, "paperclip:control": 2 };
 export const isScope = (s) => SCOPES.includes(s);
-/** read < control < admin; each level includes the ones below. */
+export const normalizeScope = (s) => (s === LEGACY_ADMIN ? "paperclip:control" : s);
+/** Known scopes only, retired names mapped, no duplicates. */
+export const normalizeScopes = (list) => [...new Set(list.map(normalizeScope).filter(isScope))];
+/** read < control; control includes read. */
 export function maxRank(granted) {
-    return Math.max(0, ...granted.filter(isScope).map((s) => RANK[s]));
+    return Math.max(0, ...normalizeScopes(granted).map((s) => RANK[s]));
 }
+/** Reads (and raw GETs) need Read only; anything that changes something needs Full control. */
 export function requiredScope(tool, input = {}) {
     if (tool.name === "paperclip_api_request")
-        return input.method === "GET" ? "paperclip:read" : "paperclip:admin";
-    if (tool.access === "destructive" || ADMIN_TOOLS.has(tool.name))
-        return "paperclip:admin";
-    return tool.access === "write" ? "paperclip:control" : "paperclip:read";
+        return input.method === "GET" ? "paperclip:read" : "paperclip:control";
+    return tool.access === "read" ? "paperclip:read" : "paperclip:control";
 }
 export const scopeAllows = (granted, needed) => maxRank(granted) >= RANK[needed];
-/** Highest-level scope name for a rank, e.g. 2 → paperclip:control. */
+/** The scope list for a level, e.g. control → [read, control]. */
 export const scopesUpTo = (level) => SCOPES.filter((s) => RANK[s] <= RANK[level]);
-/**
- * Levels the person may choose in the account flow. Control ("Full control (beta)") is always on offer, because the person
- * is the one granting it; Admin is only offered when the app itself asked for it.
- */
-export const grantableScopes = (requestedMax) => scopesUpTo(RANK[requestedMax] >= RANK["paperclip:control"] ? requestedMax : "paperclip:control");
+/** Levels the person may choose: always both, because the person is the one granting it. */
+export const grantableScopes = (_requestedMax) => [...SCOPES];