shadok-ai 0.13.13 → 0.13.14

package/context/agents-skill/pilotctl.mjs

@@ -558,19 +558,45 @@ async function cmdScreen(id, flags) {
 const HELP =
   "usage: pilotctl <spawn|prompt|dialog|choose|toggle|confirm|freetext|list|diff|stop|screen|profile-prompt|peer> …\n" +
   "       add --peer <alias> to any command to run it against another instance's agents\n" +
-  "       pilotctl peer <add <alias> <url> <token>|list|rm <alias>>";
+  "       pilotctl peer <add <alias> <url> <ticket> [--token]|list|rm <alias>>";
 
-// Manage the outbound-peers file: aliases → { url, token }. The token is minted by
-// the REMOTE instance's admin (POST /peers there) and pasted in here once. Local
-// only, no server involved. `list` never prints tokens.
-export function cmdPeer(pos) {
-  const [sub, alias, url, token] = pos;
+/**
+ * Manage the outbound-peers file: aliases → { url, token }.
+ *
+ * `add` takes the single-use TICKET from the invitation and ENROLS with it: it
+ * posts the ticket to the remote `POST /peers/enrol`, which consumes it and
+ * returns the durable token stored here. So the credential we keep is one this
+ * side obtained itself — the invitation, which gets pasted into a session and
+ * lives on in a transcript, only ever held something that dies on first use.
+ *
+ * A ticket that has already been redeemed, expired or never existed is refused
+ * by the remote with one indistinguishable message, and we store NOTHING: a
+ * saved credential that does not authenticate is worse than a clear error.
+ *
+ * `--token` skips the exchange and stores the value as a durable token, for a
+ * credential issued some other way. `list` never prints either.
+ */
+export async function cmdPeer(pos, flags = {}) {
+  const [sub, alias, url, secret] = pos;
   const map = loadPeersOut();
   if (sub === "add") {
-    if (!alias || !url || !token) throw new Error("usage: pilotctl peer add <alias> <url> <token>");
-    map[alias] = { url, token };
+    if (!alias || !url || !secret)
+      throw new Error("usage: pilotctl peer add <alias> <url> <ticket> [--token]");
+    const base = String(url).replace(/\/+$/, "");
+    let token = secret;
+    if (!flags.token) {
+      const r = await fetch(`${base}/peers/enrol`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ ticket: secret }),
+      });
+      const j = await r.json().catch(() => ({}));
+      if (!r.ok || !j?.token) throw new Error(j?.error || `enrolment refused (HTTP ${r.status})`);
+      token = j.token;
+    }
+    map[alias] = { url: base, token };
     savePeersOut(map);
-    return { ok: true, alias, url };
+    return { ok: true, alias, url: base, enrolled: !flags.token };
   }
   if (sub === "rm") {
     if (!alias) throw new Error("usage: pilotctl peer rm <alias>");
@@ -586,7 +612,7 @@ export function cmdPeer(pos) {
 export async function run(argv) {
   const { cmd, pos, flags } = parseArgs(argv);
   // Manage the outbound-peers file (local, no server).
-  if (cmd === "peer") return cmdPeer(pos);
+  if (cmd === "peer") return cmdPeer(pos, flags);
   // Target a REMOTE peer for this command — every call then goes to its URL with
   // the peer token instead of the local session key. `--peer <alias>` resolves
   // the outbound file; `--peer-url/--peer-token` is a one-off; SHADOK_PEER_URL/

package/dist/peers.d.ts

@@ -1,24 +1,58 @@
 /**
  * PEERS — other instances (or harnesses) allowed to reach THIS one's agents.
  *
- * A peer is the cross-instance twin of a web account (`accounts.ts`): named,
- * revocable, per launch dir. Its credential is a token shaped exactly like the
- * agent session key (invariant 33): an HMAC of the name, **non-expiring** (a
- * cross-instance link is persistent and must not hit the 7-day cookie cliff) and
- * **revocable by the registry** — the token embeds the name, and verifying
- * requires that name to still be listed here. Delete the row ⇒ every token for
- * it is dead, with no server state to keep. No secret is stored (it is derived),
- * same as the session key. See docs/superpowers/specs/2026-09-26-cross-instance-
+ * A peer is the cross-instance twin of a web account (`accounts.ts`), and it
+ * enrols the same way: named, revocable, per launch dir, and reached through a
+ * **single-use ticket** that is CONSUMED on first use, exactly as a user's
+ * invitation link is. What the invitee keeps afterwards is a durable token it
+ * obtained itself — so the long-lived credential never travels through an
+ * invitation, a chat, or an invitee's transcript.
+ *
+ * Two properties are load-bearing, and the first one was missing at first.
+ *
+ * The token is salted PER PEER. It used to be `hmac(secret, "peer:"+name)`,
+ * which is deterministic: deleting a row revoked the token, but re-adding a peer
+ * under the SAME name minted the identical token again — handing a leaked
+ * credential straight back. Revocation was not rotation. The row now carries a
+ * random `salt` mixed into the MAC, so re-inviting the same name yields a
+ * different token, and the only way to rotate used to be renaming the peer or
+ * rotating the instance secret (which is shared with every user session).
+ *
+ * It stays **non-expiring** once enrolled — a cross-instance link is persistent
+ * and must not hit the 7-day cookie cliff — and **revocable by the registry**:
+ * verifying requires the name to still be listed here, so deleting the row
+ * kills every token for it. See docs/superpowers/specs/2026-09-26-cross-instance-
  * agent-collaboration-design.md.
  *
  * A peer that connects is a DISTINCT principal, scoped by the caller to the
  * agents it created (`Channel.createdByPeer`) — never B's whole fleet.
  */
+/** A pending enrolment: the single-use ticket, and when it stops being usable. */
+export interface PeerInvite {
+    ticket: string;
+    expiresAt: number;
+}
 export interface Peer {
     name: string;
     createdAt: number;
     note?: string;
+    /**
+     * Random, per peer, mixed into the token's MAC. Without it the token is a
+     * pure function of the name, so revoke-then-re-invite returns the SAME
+     * credential — see the note above. Absent on a row written before this
+     * existed; `withSalts` backfills one, which invalidates that row's old token
+     * (deliberately: a deterministic token is the thing being removed).
+     */
+    salt?: string;
+    /** Present until the ticket is redeemed. While it is here the peer has NOT
+     *  enrolled, and its durable token does not authenticate anything. */
+    invite?: PeerInvite;
+    /** When the ticket was redeemed and the durable token handed over. */
+    enrolledAt?: number;
 }
+/** How long a ticket stays redeemable. Long enough to reach an agent that is
+ *  mid-task, short enough that a forgotten invitation is not a standing door. */
+export declare const PEER_INVITE_TTL_MS: number;
 /** INBOUND registry, per launch dir, 600 — peers allowed to reach THIS instance. */
 export declare function peerFileFor(cwd?: string): string;
 /** OUTBOUND registry, per launch dir, 600 — peers THIS instance can reach
@@ -32,18 +66,71 @@ export declare function savePeers(file: string, peers: Peer[]): void;
 /** A peer name is a slug: lowercased, safe chars, non-empty. null if nothing
  *  usable survives — an empty/invalid name must never become a live credential. */
 export declare function normPeerName(name: unknown): string | null;
-/** Pure: add (or supersede) a peer by name. */
-export declare function addPeer(peers: Peer[], name: string, now: number, note?: string): Peer[];
+/**
+ * Pure: add (or supersede) a peer by name, with a FRESH salt and a fresh
+ * single-use ticket.
+ *
+ * Superseding re-rolls the salt on purpose: re-inviting a name is exactly when
+ * the old credential must stop working. `salt`/`ticket` are injected so the
+ * result is testable; `newPeer` below supplies real randomness.
+ */
+export declare function addPeer(peers: Peer[], name: string, now: number, note: string | undefined, salt: string, ticket: string, ttlMs?: number): Peer[];
+/** Impure twin of `addPeer`: draws the salt and the ticket. */
+export declare function newPeer(peers: Peer[], name: string, now: number, note?: string): {
+    peers: Peer[];
+    ticket: string;
+};
+/**
+ * Backfill a salt on any row written before salts existed.
+ *
+ * Doing this INVALIDATES that row's existing token, and that is the point: the
+ * saltless token is the deterministic one being removed. A peer whose token
+ * stops working is re-invited; a peer whose leaked token kept working would not
+ * know to.
+ */
+export declare function withSalts(peers: Peer[], mint?: () => string): Peer[];
+export type RedeemVerdict = {
+    ok: true;
+    name: string;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Pure: may this ticket be redeemed right now?
+ *
+ * Refuses an unknown, an expired and an ALREADY-REDEEMED ticket with the same
+ * wording on purpose. Redemption deletes the ticket, so a used one and an
+ * invented one are indistinguishable from here — and saying which would tell a
+ * guesser that a ticket once existed. Same reasoning as the user invitation's
+ * "this link is no longer valid".
+ */
+export declare function redeemVerdict(peers: readonly Peer[], ticket: unknown, now: number): RedeemVerdict;
+/** Pure: consume the ticket — the row stays (that is the peer), the invitation
+ *  goes. This is what makes the ticket single-use. */
+export declare function redeemPeer(peers: readonly Peer[], name: string, now: number): Peer[];
 /** Pure: drop a peer by name (revocation). */
 export declare function removePeer(peers: Peer[], name: string): Peer[];
-/** The peer token: `<b64url(name)>.<hmac("peer:"+b64)>`, twin of `signSessionKey`. */
-export declare function signPeerToken(name: string, secret: Buffer): string;
-/** Pure: the name a token attests to by its MAC alone, or null. Does NOT check
- *  the registry — that is `peerFromToken`. */
-export declare function readPeerToken(token: string, secret: Buffer): string | null;
-/** The peer a token authenticates: a valid MAC AND a name still in the registry.
- *  A token whose row was deleted is refused — that is the revocation. */
-export declare function peerFromToken(token: string, secret: Buffer, peers: Peer[]): string | null;
+/**
+ * The peer token: `<b64url(name)>.<hmac("peer:"+b64+":"+salt)>`, twin of
+ * `signSessionKey` but SALTED per peer — see the note at the top of this file.
+ */
+export declare function signPeerToken(name: string, secret: Buffer, salt: string): string;
+/** Pure: the name a token CLAIMS, from its first half. Proves nothing on its
+ *  own — the MAC is checked in `peerFromToken`, which needs the row's salt. */
+export declare function peerTokenName(token: unknown): string | null;
+/**
+ * The peer a token authenticates, or null.
+ *
+ * Three conditions, and each one is a different refusal:
+ *  - the name is still in the registry — deleting the row is the revocation;
+ *  - that row has ENROLLED (no pending invite left). A durable token for a peer
+ *    that never redeemed its ticket authenticates nothing, which is what keeps
+ *    the ticket the only way in;
+ *  - the MAC verifies against THAT ROW's salt, so a token minted before a
+ *    re-invitation is dead.
+ */
+export declare function peerFromToken(token: string, secret: Buffer, peers: readonly Peer[]): string | null;
 /**
  * The ownership rule — a peer may only touch an agent IT created. The single
  * named check behind every peer scope (resume, stop, /diff): a channel with a
@@ -54,13 +141,18 @@ export declare function ownedByPeer(channel: {
 } | undefined, peer: string): boolean;
 /**
  * The copy-paste invitation for an AGENT — the peer equivalent of a user's
- * single-use link. The invitee is an agent, not a human, so instead of a page
- * where it picks a password it gets a PROMPT to paste into its own session: the
- * cockpit URL, its key, the brief, and exactly how to join and report back.
+ * single-use link, and single-use in the same way. The invitee is an agent, not a
+ * human, so instead of a page where it picks a password it gets a PROMPT to paste
+ * into its own session: the cockpit URL, a TICKET, the brief, and exactly how to
+ * join and report back.
+ *
+ * It carries the ticket and never the durable token, which is the point: an
+ * invitation is copied, pasted and kept in a transcript, so what it holds must
+ * be worthless once used.
  * `brief` is the human's task (empty allowed). Pure so the wording is tested.
  */
 export declare function agentInvitePrompt(opts: {
     url: string;
-    token: string;
+    ticket: string;
     brief?: string;
 }): string;

package/dist/peers.js

@@ -1,8 +1,11 @@
-import { createHmac, timingSafeEqual } from "node:crypto";
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { instanceKey } from "./paths.js";
+/** How long a ticket stays redeemable. Long enough to reach an agent that is
+ *  mid-task, short enough that a forgotten invitation is not a standing door. */
+export const PEER_INVITE_TTL_MS = 7 * 24 * 60 * 60_000;
 /** INBOUND registry, per launch dir, 600 — peers allowed to reach THIS instance. */
 export function peerFileFor(cwd = process.cwd()) {
     return path.join(os.homedir(), ".shadok-ai", "peers", instanceKey(cwd) + ".json");
@@ -40,36 +43,92 @@ export function normPeerName(name) {
         .replace(/^-+|-+$/g, "");
     return s || null;
 }
-/** Pure: add (or supersede) a peer by name. */
-export function addPeer(peers, name, now, note) {
-    const row = { name, createdAt: now, ...(note ? { note } : {}) };
+/**
+ * Pure: add (or supersede) a peer by name, with a FRESH salt and a fresh
+ * single-use ticket.
+ *
+ * Superseding re-rolls the salt on purpose: re-inviting a name is exactly when
+ * the old credential must stop working. `salt`/`ticket` are injected so the
+ * result is testable; `newPeer` below supplies real randomness.
+ */
+export function addPeer(peers, name, now, note, salt, ticket, ttlMs = PEER_INVITE_TTL_MS) {
+    const row = {
+        name,
+        createdAt: now,
+        ...(note ? { note } : {}),
+        salt,
+        invite: { ticket, expiresAt: now + ttlMs },
+    };
     return [...peers.filter((p) => p.name !== name), row];
 }
+/** Impure twin of `addPeer`: draws the salt and the ticket. */
+export function newPeer(peers, name, now, note) {
+    const ticket = randomBytes(32).toString("base64url");
+    return { peers: addPeer(peers, name, now, note, randomBytes(16).toString("hex"), ticket), ticket };
+}
+/**
+ * Backfill a salt on any row written before salts existed.
+ *
+ * Doing this INVALIDATES that row's existing token, and that is the point: the
+ * saltless token is the deterministic one being removed. A peer whose token
+ * stops working is re-invited; a peer whose leaked token kept working would not
+ * know to.
+ */
+export function withSalts(peers, mint = () => randomBytes(16).toString("hex")) {
+    return peers.map((p) => (p.salt ? p : { ...p, salt: mint() }));
+}
+/**
+ * Pure: may this ticket be redeemed right now?
+ *
+ * Refuses an unknown, an expired and an ALREADY-REDEEMED ticket with the same
+ * wording on purpose. Redemption deletes the ticket, so a used one and an
+ * invented one are indistinguishable from here — and saying which would tell a
+ * guesser that a ticket once existed. Same reasoning as the user invitation's
+ * "this link is no longer valid".
+ */
+export function redeemVerdict(peers, ticket, now) {
+    const t = typeof ticket === "string" ? ticket.trim() : "";
+    const gone = { ok: false, error: "this invitation is no longer valid — it may already have been used" };
+    if (!t)
+        return { ok: false, error: "no invitation ticket" };
+    const row = peers.find((p) => p.invite && p.invite.ticket === t);
+    if (!row || !row.invite)
+        return gone;
+    if (row.invite.expiresAt <= now)
+        return gone;
+    return { ok: true, name: row.name };
+}
+/** Pure: consume the ticket — the row stays (that is the peer), the invitation
+ *  goes. This is what makes the ticket single-use. */
+export function redeemPeer(peers, name, now) {
+    return peers.map((p) => {
+        if (p.name !== name)
+            return p;
+        const { invite: _used, ...rest } = p;
+        return { ...rest, enrolledAt: now };
+    });
+}
 /** Pure: drop a peer by name (revocation). */
 export function removePeer(peers, name) {
     return peers.filter((p) => p.name !== name);
 }
-/** The peer token: `<b64url(name)>.<hmac("peer:"+b64)>`, twin of `signSessionKey`. */
-export function signPeerToken(name, secret) {
+/**
+ * The peer token: `<b64url(name)>.<hmac("peer:"+b64+":"+salt)>`, twin of
+ * `signSessionKey` but SALTED per peer — see the note at the top of this file.
+ */
+export function signPeerToken(name, secret, salt) {
     const n = Buffer.from(name, "utf8").toString("base64url");
-    return `${n}.${createHmac("sha256", secret).update(`peer:${n}`).digest("hex")}`;
+    return `${n}.${createHmac("sha256", secret).update(`peer:${n}:${salt}`).digest("hex")}`;
 }
-/** Pure: the name a token attests to by its MAC alone, or null. Does NOT check
- *  the registry — that is `peerFromToken`. */
-export function readPeerToken(token, secret) {
+/** Pure: the name a token CLAIMS, from its first half. Proves nothing on its
+ *  own — the MAC is checked in `peerFromToken`, which needs the row's salt. */
+export function peerTokenName(token) {
     const parts = String(token ?? "").split(".");
     if (parts.length !== 2)
         return null;
     const [n, mac] = parts;
     if (!n || !mac)
         return null;
-    const want = createHmac("sha256", secret).update(`peer:${n}`).digest("hex");
-    // Length first: timingSafeEqual THROWS on a length mismatch (invariant in
-    // readSessionKey), which would be a 500 instead of a clean refusal.
-    if (mac.length !== want.length)
-        return null;
-    if (!timingSafeEqual(Buffer.from(mac), Buffer.from(want)))
-        return null;
     try {
         return Buffer.from(n, "base64url").toString("utf8") || null;
     }
@@ -77,13 +136,33 @@ export function readPeerToken(token, secret) {
         return null;
     }
 }
-/** The peer a token authenticates: a valid MAC AND a name still in the registry.
- *  A token whose row was deleted is refused — that is the revocation. */
+/**
+ * The peer a token authenticates, or null.
+ *
+ * Three conditions, and each one is a different refusal:
+ *  - the name is still in the registry — deleting the row is the revocation;
+ *  - that row has ENROLLED (no pending invite left). A durable token for a peer
+ *    that never redeemed its ticket authenticates nothing, which is what keeps
+ *    the ticket the only way in;
+ *  - the MAC verifies against THAT ROW's salt, so a token minted before a
+ *    re-invitation is dead.
+ */
 export function peerFromToken(token, secret, peers) {
-    const name = readPeerToken(token, secret);
-    if (!name)
+    const claimed = peerTokenName(token);
+    if (!claimed)
+        return null;
+    const row = peers.find((p) => p.name === claimed);
+    if (!row || !row.salt || row.invite)
+        return null;
+    const mac = String(token).split(".")[1] ?? "";
+    const want = createHmac("sha256", secret).update(`peer:${Buffer.from(claimed, "utf8").toString("base64url")}:${row.salt}`).digest("hex");
+    // Length first: timingSafeEqual THROWS on a length mismatch (invariant in
+    // readSessionKey), which would be a 500 instead of a clean refusal.
+    if (mac.length !== want.length)
+        return null;
+    if (!timingSafeEqual(Buffer.from(mac), Buffer.from(want)))
         return null;
-    return peers.some((p) => p.name === name) ? name : null;
+    return row.name;
 }
 /**
  * The ownership rule — a peer may only touch an agent IT created. The single
@@ -95,9 +174,14 @@ export function ownedByPeer(channel, peer) {
 }
 /**
  * The copy-paste invitation for an AGENT — the peer equivalent of a user's
- * single-use link. The invitee is an agent, not a human, so instead of a page
- * where it picks a password it gets a PROMPT to paste into its own session: the
- * cockpit URL, its key, the brief, and exactly how to join and report back.
+ * single-use link, and single-use in the same way. The invitee is an agent, not a
+ * human, so instead of a page where it picks a password it gets a PROMPT to paste
+ * into its own session: the cockpit URL, a TICKET, the brief, and exactly how to
+ * join and report back.
+ *
+ * It carries the ticket and never the durable token, which is the point: an
+ * invitation is copied, pasted and kept in a transcript, so what it holds must
+ * be worthless once used.
  * `brief` is the human's task (empty allowed). Pure so the wording is tested.
  */
 export function agentInvitePrompt(opts) {
@@ -107,11 +191,13 @@ export function agentInvitePrompt(opts) {
         "You've been invited to collaborate with a shadok-ai cockpit as a peer agent.",
         "",
         `Cockpit: ${url}`,
-        `Your peer key: ${opts.token}`,
-        "(Keep the key secret — it authenticates you as this peer, and it can be revoked at any time.)",
+        `Your invitation ticket: ${opts.ticket}`,
+        "(Single use: `peer add` exchanges it for your own durable key, and the ticket",
+        " dies at that moment. Keep the key you get back secret — it authenticates you",
+        " as this peer, and it can be revoked at any time.)",
         "",
         "To join, use the shadok-ai-agents skill (pilotctl):",
-        `  pilotctl peer add host ${url} ${opts.token}`,
+        `  pilotctl peer add host ${url} ${opts.ticket}`,
         "  pilotctl spawn  --peer host --cwd /workspace     # start an agent on the cockpit",
         '  pilotctl prompt <id> "<your work>" --peer host   # drive it',
         "  pilotctl diff   <id> --peer host                 # read what it changed",

package/dist/peers.js.map

@@ -1 +1 @@
-{"version":3,"file":"peers.js","sourceRoot":"","sources":["../src/peers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAyBzC,oFAAoF;AACpF,MAAM,UAAU,WAAW,CAAC,GAAG,GAAW,OAAO,CAAC,GAAG,EAAE;IACrD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;AACpF,CAAC;AAED;;;;6DAI6D;AAC7D,MAAM,UAAU,eAAe,CAAC,GAAG,GAAW,OAAO,CAAC,GAAG,EAAE;IACzD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,KAAa;IACnD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,IAAI,GAAG,MAAM,CAAC;IAC1B,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;mFACmF;AACnF,MAAM,UAAU,YAAY,CAAC,IAAa;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;SACzB,WAAW,EAAE;SACb,IAAI,EAAE;SACN,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,OAAO,CAAC,IAAI,IAAI,CAAC;AACnB,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,OAAO,CAAC,KAAa,EAAE,IAAY,EAAE,GAAW,EAAE,IAAa;IAC7E,MAAM,GAAG,GAAS,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACtE,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,IAAY;IACpD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,MAAc;IACxD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1D,OAAO,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAClF,CAAC;AAED;8CAC8C;AAC9C,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,MAAc;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;IACvB,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5E,0EAA0E;IAC1E,oEAAoE;IACpE,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;yEACyE;AACzE,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,MAAc,EAAE,KAAa;IACxE,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,OAA+C,EAAE,IAAY;IACvF,OAAO,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAoD;IACpF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,OAAO;QACL,8EAA8E;QAC9E,EAAE;QACF,YAAY,GAAG,EAAE;QACjB,kBAAkB,IAAI,CAAC,KAAK,EAAE;QAC9B,+FAA+F;QAC/F,EAAE;QACF,qDAAqD;QACrD,4BAA4B,GAAG,IAAI,IAAI,CAAC,KAAK,EAAE;QAC/C,oFAAoF;QACpF,+DAA+D;QAC/D,2EAA2E;QAC3E,EAAE;QACF,uFAAuF;QACvF,EAAE;QACF,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,2EAA2E;QACnG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,EAAE;QACF,mFAAmF;KACpF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}
+{"version":3,"file":"peers.js","sourceRoot":"","sources":["../src/peers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAyDzC;iFACiF;AACjF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAEvD,oFAAoF;AACpF,MAAM,UAAU,WAAW,CAAC,GAAG,GAAW,OAAO,CAAC,GAAG,EAAE;IACrD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;AACpF,CAAC;AAED;;;;6DAI6D;AAC7D,MAAM,UAAU,eAAe,CAAC,GAAG,GAAW,OAAO,CAAC,GAAG,EAAE;IACzD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,KAAa;IACnD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,IAAI,GAAG,MAAM,CAAC;IAC1B,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;mFACmF;AACnF,MAAM,UAAU,YAAY,CAAC,IAAa;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;SACzB,WAAW,EAAE;SACb,IAAI,EAAE;SACN,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,OAAO,CAAC,IAAI,IAAI,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CACrB,KAAa,EACb,IAAY,EACZ,GAAW,EACX,IAAwB,EACxB,IAAY,EACZ,MAAc,EACd,KAAK,GAAW,kBAAkB;IAElC,MAAM,GAAG,GAAS;QAChB,IAAI;QACJ,SAAS,EAAE,GAAG;QACd,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,IAAI;QACJ,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,KAAK,EAAE;KAC3C,CAAC;IACF,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,OAAO,CAAC,KAAa,EAAE,IAAY,EAAE,GAAW,EAAE,IAAa;IAC7E,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrD,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;AACrG,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,IAAI,GAAiB,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IACjG,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AACjE,CAAC;AAMD;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,KAAsB,EAAE,MAAe,EAAE,GAAW;IAChF,MAAM,CAAC,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,oEAAoE,EAAE,CAAC;IACjH,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;AACtC,CAAC;AAED;sDACsD;AACtD,MAAM,UAAU,UAAU,CAAC,KAAsB,EAAE,IAAY,EAAE,GAAW;IAC1E,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACrB,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,OAAO,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,IAAY;IACpD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,MAAc,EAAE,IAAY;IACtE,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1D,OAAO,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED;+EAC+E;AAC/E,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;IACvB,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,MAAc,EAAE,KAAsB;IACjF,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzI,0EAA0E;IAC1E,oEAAoE;IACpE,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,OAA+C,EAAE,IAAY;IACvF,OAAO,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAqD;IACrF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,OAAO;QACL,8EAA8E;QAC9E,EAAE;QACF,YAAY,GAAG,EAAE;QACjB,2BAA2B,IAAI,CAAC,MAAM,EAAE;QACxC,+EAA+E;QAC/E,+EAA+E;QAC/E,oDAAoD;QACpD,EAAE;QACF,qDAAqD;QACrD,4BAA4B,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE;QAChD,oFAAoF;QACpF,+DAA+D;QAC/D,2EAA2E;QAC3E,EAAE;QACF,uFAAuF;QACvF,EAAE;QACF,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,2EAA2E;QACnG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,EAAE;QACF,mFAAmF;KACpF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/server.js

@@ -37,7 +37,7 @@ import { deliverWithRetry } from "./reload.js";
 import { startTelegram, renameTelegramTopic, closeTelegramTopic, probeToken, isStalePreface, announceLoggedOut, resetLoggedOutNotice, attachmentPrompt, pasteFileName, MEDIA_DIR, } from "./telegram.js";
 import { migrateTgBindings } from "./channels.js";
 import { instanceKey } from "./paths.js";
-import { peerFileFor, loadPeers, savePeers, peerFromToken, signPeerToken, normPeerName, addPeer, removePeer, ownedByPeer, peersOutFileFor, agentInvitePrompt, } from "./peers.js";
+import { peerFileFor, loadPeers, savePeers, peerFromToken, signPeerToken, newPeer, withSalts, redeemVerdict, redeemPeer, normPeerName, removePeer, ownedByPeer, peersOutFileFor, agentInvitePrompt, } from "./peers.js";
 import { loadCrons, saveCrons, upsertCron, removeCron, resolveCronId, nextRunFor, nextRunAfterFailure, isTransient, CRON_MAX_RETRIES, markCronPrompt, normalizeSchedule, onceAt, stateAfterFire, scheduleLabel, cronTimeZone, defaultTimeZone, systemTimeZone, isValidTimeZone, } from "./crons.js";
 import { markPromptMeta, promptMetaHeader } from "./promptmeta.js";
 import { runRefusal, isShellMode } from "./bang.js";
@@ -664,7 +664,9 @@ function peerName(req) {
     const tok = req.headers["x-shadok-peer"];
     if (typeof tok !== "string" || !tok)
         return null;
-    return peerFromToken(tok, signingSecret(), loadPeers(peerFileFor()));
+    // `withSalts` so a row written before salts existed is verified against a
+    // backfilled one — i.e. its old deterministic token is refused, not honoured.
+    return peerFromToken(tok, signingSecret(), withSalts(loadPeers(peerFileFor())));
 }
 function passwordMatches(input) {
     const a = Buffer.from(input);
@@ -857,6 +859,30 @@ app.post("/logout", (_req, res) => {
     res.setHeader("Set-Cookie", "sk_auth=; HttpOnly; SameSite=Lax; Path=/; Max-Age=0");
     res.json({ ok: true });
 });
+/**
+ * Redeem a peer invitation: a single-use ticket in, a durable token out.
+ *
+ * BEFORE the password gate on purpose, and it is the only peer route that is: an
+ * invitee has no credential yet, which is the whole point of enrolling. The
+ * surface is deliberately one field — the ticket authenticates the call and
+ * nothing else is read — and it is narrow in three more ways: the ticket is
+ * consumed on success (so a replay fails), it expires, and an unknown, used or
+ * expired ticket all get the SAME refusal, so a guesser learns nothing about
+ * which tickets ever existed.
+ *
+ * Twin of `POST /invite/:token` for humans.
+ */
+app.post("/peers/enrol", (req, res) => {
+    const file = peerFileFor();
+    const peers = withSalts(loadPeers(file));
+    const v = redeemVerdict(peers, req.body?.ticket, Date.now());
+    if (!v.ok)
+        return res.status(400).json({ error: v.error });
+    const row = peers.find((p) => p.name === v.name);
+    savePeers(file, redeemPeer(peers, v.name, Date.now()));
+    console.log(`peers: ${v.name} enrolled (ticket consumed)`);
+    res.json({ ok: true, name: v.name, token: signPeerToken(v.name, signingSecret(), row.salt) });
+});
 // Who am I? The client labels itself with this, and a tab whose session expired
 // finds out here rather than by a silent failure.
 app.get("/me", (req, res) => {
@@ -1435,17 +1461,19 @@ app.post("/peers", (req, res) => {
     const note = typeof req.body?.note === "string" ? req.body.note.trim() || undefined : undefined;
     const brief = typeof req.body?.brief === "string" ? req.body.brief : "";
     const file = peerFileFor();
-    savePeers(file, addPeer(loadPeers(file), name, Date.now(), note));
-    console.log(`peers: ${me.name} added peer ${name}`);
-    // The token is shown ONCE. It is derived (HMAC), so re-adding the peer re-mints
-    // the SAME token — it is never stored to hand back later, like an invitation.
-    // `invitePrompt` is the "invite an agent like a user" gesture: a ready-to-paste
-    // brief the invitee drops into its own session (endpoint + key + task + how to
-    // join). Its URL is the one the ADMIN is reaching us at (their browser origin),
-    // which is the public URL an external agent would use too.
-    const token = signPeerToken(name, signingSecret());
+    const { peers, ticket } = newPeer(loadPeers(file), name, Date.now(), note);
+    savePeers(file, peers);
+    console.log(`peers: ${me.name} invited peer ${name}`);
+    // What is handed out is a SINGLE-USE TICKET, not the credential — the peer
+    // exchanges it at `POST /peers/enrol` for a durable token it then keeps. So the
+    // long-lived credential never travels through this response, the invite prompt,
+    // a chat, or the invitee's transcript; only a ticket that dies on first use
+    // does. Exactly how a user's invitation link works (`/invite/:token`).
+    // Re-inviting the same name re-rolls the salt, so any earlier token is dead.
+    // The URL is the one the ADMIN is reaching us at (their browser origin), which
+    // is the public URL an external agent would use too.
     const url = (req.headers.origin?.trim() || `http://${req.headers.host ?? "localhost"}`).replace(/\/+$/, "");
-    res.json({ ok: true, name, token, invitePrompt: agentInvitePrompt({ url, token, brief }) });
+    res.json({ ok: true, name, ticket, invitePrompt: agentInvitePrompt({ url, ticket, brief }) });
 });
 app.delete("/peers", (req, res) => {
     const me = accountAdmin(req, res);