shadok-ai 0.17.1 → 0.17.2

package/README.md

@@ -476,10 +476,16 @@ in to Claude, which happens after boot; the banner stays up until then and the
 migration **finishes on its own the moment you sign in** (no restart needed).
 **One-time provisioning:** isolated-group agents authenticate with a
 subscription token injected into their environment, not a shared credential
-file. Run `claude setup-token` once and store the result as the vault secret
-`MT_CLAUDE_OAUTH_TOKEN`. Without it, group spawns are refused with a message
-naming this step. The token is valid for about a year; re-mint it by hand
-(`claude setup-token`, then overwrite the secret) before it expires.
+file. Until it is set, group spawns are refused with a message naming this step,
+and the cockpit shows a red "no subscription token" banner. Provide it from the
+cockpit itself — **no shell needed**: as an admin, click **Provide token** on
+that banner (or **Replace subscription token…** in the version menu to rotate
+it), authorise on your Claude subscription in the browser, and paste the code
+back; the server mints and stores it. From Telegram, `/mttoken` then
+`/mtcode <code>` do the same. The token is captured and vaulted server-side and
+is never shown. It is valid for about a year; re-run the card (or `/mttoken`)
+before it expires. The shell path still works as a fallback: `claude setup-token`
+and store the result as the vault secret `MT_CLAUDE_OAUTH_TOKEN`.
 
 Telegram stays single-owner, and there are no
 disk quotas yet. Design: `docs/superpowers/specs/2026-10-29-multi-tenant-scoped-isolation-design.md`.

package/dist/server.js

@@ -20,7 +20,8 @@ import { findTransientErrors, newTransientErrors, RETRY_DELAYS_MS } from "./retr
 import { backgroundTasks, screenShowsWork, moveToOption } from "./detect.js";
 import { PtyPilot } from "./session.js";
 import { ensureClaudeHome, ensureProjectTrusted, getDefaultModel, setDefaultModel, parseClaudeVersion, seedPlan, settingsPlan, } from "./claude-home.js";
-import { authStatus, cancelLogin, startLogin, submitLoginCode } from "./claude-auth.js";
+import { authStatus, cancelLogin, invalidateAuthStatus, startLogin, submitLoginCode } from "./claude-auth.js";
+import { startSetupToken, submitSetupTokenCode, cancelSetupToken } from "./setup-token.js";
 import { readTokenExpiry } from "./claude-creds.js";
 import { starCount } from "./stars.js";
 import { announceFirstAgent, countMainChannels, ensureFirstAgent, firstAgentStatus, settleFirstAgent, } from "./first-agent.js";
@@ -290,7 +291,7 @@ async function startFirstAgent() {
 }
 function restartTelegram() {
     tgBridge.stop();
-    tgBridge = startTelegram(boundPort, tgCookie());
+    tgBridge = startTelegram(boundPort, tgCookie(), DEPLOYMENT_MODE === "multi-tenant");
 }
 // ── Cron scheduler ───────────────────────────────────────────────────────────
 // Scheduled per-channel prompts (monitoring/reporting). The server drives the
@@ -1641,7 +1642,19 @@ app.get("/auth", async (_req, res) => res.json({
     ...readTokenExpiry(),
     ...longLivedTokenInfo(loadVault(), DEPLOYMENT_MODE),
     ...customBackendFields(),
+    ...mtTokenFields(),
 }));
+/**
+ * Whether this is a multi-tenant instance and, if so, whether its group agents'
+ * subscription token is still missing — the signal the cockpit uses to offer the
+ * in-cockpit provisioning card (and the blocking banner). Mono-tenant → both
+ * false; it needs no token.
+ */
+function mtTokenFields() {
+    const multiTenant = DEPLOYMENT_MODE === "multi-tenant";
+    const present = !!secretsFor([MT_CLAUDE_OAUTH_TOKEN_NAME], MAIN_GROUP_ID)[MT_CLAUDE_OAUTH_TOKEN_NAME];
+    return { multiTenant, mtTokenMissing: multiTenant && !present };
+}
 function customBackendFields() {
     const b = instanceBackend();
     return b.kind === "custom" ? { backend: "custom", backendModel: b.model } : {};
@@ -1679,6 +1692,59 @@ app.delete("/auth/login", (_req, res) => {
     cancelLogin();
     res.json({ ok: true });
 });
+// --- Subscription-token provisioning (src/setup-token.ts) -----------------
+// A multi-tenant instance injects the long-lived subscription token
+// (MT_CLAUDE_OAUTH_TOKEN) into its privilege-dropped agents; these two routes
+// let an ADMIN mint/rotate it from the cockpit instead of a hand-run shell
+// `claude setup-token`. Browser-origin + admin, exactly like the guardrail
+// writes — and server-owned: the token is captured and stored server-side, and
+// the response never carries it. Mono-tenant needs no token, so the routes are
+// inert there (the UI hides them too).
+function mtTokenGate(req, res) {
+    if (DEPLOYMENT_MODE !== "multi-tenant") {
+        res.status(400).json({ error: "not applicable: this instance is single-tenant" });
+        return false;
+    }
+    if (!requestFromBrowser(req)) {
+        res.status(403).json({ error: "browser only" });
+        return false;
+    }
+    if (currentAccount(req)?.role !== "admin") {
+        res.status(403).json({ error: "admins only" });
+        return false;
+    }
+    return true;
+}
+app.post("/mt-token/start", async (req, res) => {
+    if (!mtTokenGate(req, res))
+        return;
+    const r = await startSetupToken();
+    if ("error" in r)
+        return res.status(502).json(r);
+    res.json(r); // {url}
+});
+app.post("/mt-token/code", async (req, res) => {
+    if (!mtTokenGate(req, res))
+        return;
+    const code = typeof req.body?.code === "string" ? req.body.code : "";
+    // The token is captured and written to the vault HERE and never leaves the
+    // server: `store` is the only thing that ever touches the value.
+    const r = await submitSetupTokenCode(code, (token) => setSecret(MT_CLAUDE_OAUTH_TOKEN_NAME, token, MAIN_GROUP_ID, "operator:setup-token"));
+    if (r.ok) {
+        mtTokenWarned = false; // a future absence gets warned again
+        invalidateAuthStatus(); // so /auth re-reports longLived immediately
+    }
+    res.status(r.ok ? 200 : 400).json(r); // {ok} — never the token
+});
+app.delete("/mt-token", (req, res) => {
+    // Same gate as start/code: a cancel is still a write on a credential flow, so
+    // a non-admin/non-browser caller must not be able to kill an admin's live
+    // mint mid-rotation.
+    if (!mtTokenGate(req, res))
+        return;
+    cancelSetupToken();
+    res.json({ ok: true });
+});
 // --- Model backend (src/backend.ts) ---------------------------------------
 // The instance-wide source for every agent's backend variables: the backend
 // chosen in the cockpit if any, else shadok's own environment. Read on every
@@ -7223,7 +7289,7 @@ server.listen(port, HOST, () => {
     // the internal auth cookie so it gets through the GUI password gate. The
     // handle + bound port let /telegram restart it hot when the config changes.
     boundPort = port;
-    tgBridge = startTelegram(port, tgCookie());
+    tgBridge = startTelegram(port, tgCookie(), DEPLOYMENT_MODE === "multi-tenant");
     if (GUI_PASSWORD)
         console.log("gui: password protection ON");
     // Cron scheduler: prime nextRun then tick every 30s (unref'd so it never