feat(auth): migrate shared resource credentials (phase 5.2)

ENVIRONMENT.md

@@ -81,6 +81,16 @@ Manage shared web env var additions and rotations with `pnpm web:env set <VARIAB
 - `INTERNAL_API_SECRET` - Shared secret for internal API calls between services; used in `apps/web/src/lib/kiloclaw/cli-runs.test.ts`, `kiloclaw-router.test.ts`, dev seed scripts, and other service routers. `[SECRET]`
 - `SUPPORT_API_SECRET` - Shared bearer token for Customer Support Automation (CSA) internal API calls. Cloud uses it to authorize CSA → Cloud `apps/web/src/app/api/internal/support/` and Cloud → CSA `POST /api/internal/cloud/users/gdpr-scrub`. A CSA compromise can also call Cloud deletion and Cloud can scrub CSA-local PII. Leak can look up any email and enqueue deletion for non-admin, non-bot, non-live-subscription customers; access disable is deferred to worker preflight and pending requests can be cancelled. Keep production values off preview deployments; rotate Cloud and CSA together. `[SECRET]`
 - `BOUNDED_INTERNAL_SERVICE_TOKENS_ENABLED` - Set to exact `true` to enable modern, purpose-labelled internal assertions at the Phase 5.1 bounded Git broker, export, deletion, and Session Ingest callsites. Unset or any other value retains their existing legacy token formats. Enable only after compatible readers, including the dedicated GitHub disconnect audience, are deployed; generic human/control/runtime signers are not affected. [SERVER]
+- `NATIVE_RESOURCE_TOKENS_ENABLED` - Set to exact `true` to permit fresh native adoption of separate one-hour API/gateway access tokens only for clients explicitly requesting `api-gateway-v1`, provided `SHARED_RESOURCE_TOKENS_ENABLED` is also exact `true`. Default-off. Unsupported clients keep legacy responses. Turning this flag off affects subsequent native issuance/refreshes only; active modern device credentials can continue receiving bounded control tokens while their owned device session and current user pepper remain valid. [SERVER]
+- `SHARED_RESOURCE_TOKENS_ENABLED` - Master default-off readiness gate. Fresh modern producer issuance requires both this flag and its family flag below to be exact `true`; unset or any other value disables adoption. Native adoption separately requires `NATIVE_RESOURCE_TOKENS_ENABLED` and this master, independent of producer families; old CLI negotiation is unchanged. These flags do not revoke existing credentials. Valid modern device access credentials retain bounded control issuance after rollback, with current owned-session, pepper, and requested organization membership validation and a one-hour/parent-expiry cap. Chat likewise retains bounded three-audience issuance for validated modern devices; modern credentials never fall back to broad legacy tokens. Persisted modern workload renewal does not use adoption gates. Separately deployed readers/producers must be verified before activation. [SERVER]
+- `CLOUD_AGENT_RESOURCE_TOKENS_ENABLED` - Default-off family gate for Cloud Agent Next request control and workflow control tokens; requires the master and exact `true`. [SERVER]
+- `GASTOWN_RESOURCE_TOKENS_ENABLED` - Default-off family gate for Gastown control tokens; requires the master and exact `true`. This is not a safe-activation declaration: known ingest-audience and live-token-transport blockers remain deferred. [SERVER]
+- `WASTELAND_RESOURCE_TOKENS_ENABLED` - Default-off family gate for Wasteland control tokens; requires the master and exact `true`. [SERVER]
+- `CHAT_RESOURCE_TOKENS_ENABLED` - Default-off family gate for fresh chat resource issuance; requires the master and exact `true`. Validated modern devices retain chat/event-service/notifications issuance after rollback, capped by one hour and parent expiry. [SERVER]
+- `DELEGATED_RESOURCE_TOKENS_ENABLED` - Default-off family gate for explicit API, gateway, attribution, and HTML-deploy delegation, including the organization user-token resource route; requires the master and exact `true`. Disabled explicit delegation remains unavailable. [SERVER]
+- `WORKFLOW_GATEWAY_RESOURCE_TOKENS_ENABLED` - Default-off family gate for server workflow gateway tokens; requires the master and exact `true`. [SERVER]
+- `BENCHMARK_RESOURCE_TOKENS_ENABLED` - Default-off family gate for benchmark resource tokens; requires the master and exact `true`. [SERVER]
+- `RUNTIME_ISOLATION_ENABLED` - Cloud Agent Worker rollout control for new modern control-plane sessions and worktree destinations. Exact `true` permits adoption; default/unset/other values reject it before durable work. Legacy attachments keep directory-shared Kilo runtimes. Persisted modern runtime authorization continues selecting per-session isolation after rollback, and the connected wrapper must advertise the isolation capability. Keep off during the automatic deployment wave and enable only after compatible Worker and wrapper versions are healthy. Foreground expiry recovery retains the same session identity and requires acknowledged idle transport retirement; this flag does not establish complete real-provider smoke coverage. See `docs/token-issuance-policy.md`, Phase 5.2 merge, automatic deployment, and activation. [SERVER]
 - `CALLBACK_TOKEN_SECRET` - Secret for signing callback tokens. Required for local development. `[SECRET]`
 - `INTERNAL_SECRET` - Alias/fallback for `INTERNAL_API_SECRET`; used in KiloClaw E2E scripts (`services/kiloclaw/e2e/`). `[SECRET]`
 

apps/mobile/src/components/kilo-chat/hooks/use-kilo-chat-token.test.ts

@@ -1,7 +1,7 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 
 const mocks = vi.hoisted(() => ({
-  getItemAsync: vi.fn<() => Promise<string | null>>(),
+  getItemAsync: vi.fn<(key: string) => Promise<string | null>>(),
   getTokenQuery: vi.fn<() => Promise<{ token: string; userId: string; expiresAt: string }>>(),
 }));
 
@@ -13,8 +13,11 @@ vi.mock('expo-secure-store', () => ({
   getItemAsync: mocks.getItemAsync,
 }));
 
+vi.mock('@/lib/config', () => ({ E2E_SECURE_STORE_FAULT_MS: 0 }));
+
 vi.mock('@/lib/storage-keys', () => ({
   AUTH_TOKEN_KEY: 'auth-token',
+  NATIVE_CREDENTIAL_BUNDLE_KEY: 'native-credential-bundle',
 }));
 
 vi.mock('@/lib/trpc', () => ({
@@ -30,6 +33,8 @@ vi.mock('@/lib/trpc', () => ({
 describe('useKiloChatTokenResponseGetter', () => {
   beforeEach(async () => {
     vi.clearAllMocks();
+    const { clearActiveToken } = await import('@/lib/auth/token-owner');
+    clearActiveToken();
     const { clearKiloChatTokenCache } = await import('./use-kilo-chat-token');
     clearKiloChatTokenCache();
   });
@@ -42,7 +47,10 @@ describe('useKiloChatTokenResponseGetter', () => {
     };
     const seenUserIds: string[] = [];
 
-    mocks.getItemAsync.mockResolvedValue('auth-token-1');
+    mocks.getItemAsync.mockImplementation(async key => {
+      await Promise.resolve();
+      return key === 'auth-token' ? 'auth-token-1' : null;
+    });
     mocks.getTokenQuery.mockRejectedValueOnce(new Error('network down'));
     mocks.getTokenQuery.mockResolvedValueOnce(response);
 
@@ -69,7 +77,10 @@ describe('useKiloChatTokenResponseGetter', () => {
       expiresAt: '2099-03-13 14:30:00+00',
     };
 
-    mocks.getItemAsync.mockResolvedValue('auth-token-2');
+    mocks.getItemAsync.mockImplementation(async key => {
+      await Promise.resolve();
+      return key === 'auth-token' ? 'auth-token-2' : null;
+    });
     mocks.getTokenQuery.mockResolvedValueOnce(response);
 
     const { useKiloChatTokenResponseGetter } = await import('./use-kilo-chat-token');
@@ -98,7 +109,10 @@ describe('useKiloChatTokenResponseGetter', () => {
       expiresAt: '2099-03-13 14:30:00+00',
     };
 
-    mocks.getItemAsync.mockResolvedValue('auth-token-3');
+    mocks.getItemAsync.mockImplementation(async key => {
+      await Promise.resolve();
+      return key === 'auth-token' ? 'auth-token-3' : null;
+    });
     mocks.getTokenQuery.mockResolvedValueOnce(firstResponse);
     mocks.getTokenQuery.mockResolvedValueOnce(secondResponse);
 

apps/mobile/src/components/login-screen.test.ts

@@ -23,10 +23,8 @@ import { errorMessage } from './login-screen-state';
 
 const deviceAuth = vi.hoisted(() => ({
   status: 'idle' as string,
-  token: undefined as string | undefined,
   code: undefined as string | undefined,
-  refreshToken: undefined as string | undefined,
-  expiresIn: undefined as number | undefined,
+  credentials: undefined,
   error: undefined as string | undefined,
   verificationUrl: undefined as string | undefined,
   resumed: false,
@@ -74,10 +72,8 @@ vi.mock('@/lib/auth/auth-context', () => ({
 vi.mock('@/lib/auth/use-device-auth', () => ({
   useDeviceAuth: () => ({
     status: deviceAuth.status,
-    token: deviceAuth.token,
     code: deviceAuth.code,
-    refreshToken: deviceAuth.refreshToken,
-    expiresIn: deviceAuth.expiresIn,
+    credentials: deviceAuth.credentials,
     error: deviceAuth.error,
     verificationUrl: deviceAuth.verificationUrl,
     resumed: deviceAuth.resumed,
@@ -270,10 +266,8 @@ describe('login-screen language globe', () => {
   beforeEach(() => {
     (globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
     deviceAuth.status = 'idle';
-    deviceAuth.token = undefined;
     deviceAuth.code = undefined;
-    deviceAuth.refreshToken = undefined;
-    deviceAuth.expiresIn = undefined;
+    deviceAuth.credentials = undefined;
     deviceAuth.error = undefined;
     deviceAuth.verificationUrl = undefined;
     deviceAuth.resumed = false;
@@ -350,10 +344,8 @@ describe('login-screen idle skeleton', () => {
   beforeEach(() => {
     (globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
     deviceAuth.status = 'idle';
-    deviceAuth.token = undefined;
     deviceAuth.code = undefined;
-    deviceAuth.refreshToken = undefined;
-    deviceAuth.expiresIn = undefined;
+    deviceAuth.credentials = undefined;
     deviceAuth.error = undefined;
     deviceAuth.verificationUrl = undefined;
     deviceAuth.resumed = false;

apps/mobile/src/components/login-screen.tsx

@@ -1,15 +1,13 @@
-/* eslint-disable max-lines -- The login screen keeps its device-auth branches, keyboard padding, and language picker together. */
 import * as Clipboard from 'expo-clipboard';
 import { type Href, useRouter } from 'expo-router';
 import { ExternalLink, Globe } from '@/components/ui/icons';
-import { useCallback, useEffect, useState } from 'react';
+import { useEffect, useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import {
   AppState,
   I18nManager,
   Keyboard,
   KeyboardAvoidingView,
-  type KeyboardEvent,
   Platform,
   Pressable,
   ScrollView,
@@ -33,60 +31,38 @@ import { Skeleton } from '@/components/ui/skeleton';
 import { Text } from '@/components/ui/text';
 import { announcingToast } from '@/lib/a11y/announcing-toast';
 import { useAuth } from '@/lib/auth/auth-context';
+import { useDeviceApprovalPersistence } from '@/lib/auth/use-device-approval-persistence';
 import { useDeviceAuth } from '@/lib/auth/use-device-auth';
 import { useThemeColors } from '@/lib/hooks/use-theme-colors';
 import {
-  clearLoginDrafts,
   clearPersistedLoginDrafts,
   persistLoginDrafts,
   restoreLoginDrafts,
   type SsoRecoveryDraft,
 } from '@/lib/login-draft';
 import { setLanguagePickerBridge } from '@/lib/picker-bridge';
 
-function keyboardHeightFromEvent(event: KeyboardEvent): number {
-  return event.endCoordinates.height;
-}
-
 export function LoginScreen() {
   const { sessionEnded, signIn } = useAuth();
   const router = useRouter();
-  const {
-    status,
-    token,
-    code,
-    refreshToken,
-    expiresIn,
-    error,
-    verificationUrl,
-    resumed,
-    start,
-    cancel,
-    openBrowser,
-  } = useDeviceAuth();
+  const { status, code, credentials, error, verificationUrl, resumed, start, cancel, openBrowser } =
+    useDeviceAuth();
   const colors = useThemeColors();
   const insets = useSafeAreaInsets();
   const { t } = useTranslation();
-  const [persistError, setPersistError] = useState<string | undefined>(undefined);
   const [androidKeyboardHeight, setAndroidKeyboardHeight] = useState(0);
   const [authFormBusy, setAuthFormBusy] = useState(false);
   const [draft, setDraft] = useState<{
     email: string;
     ssoRecovery: SsoRecoveryDraft | null;
   } | null>(null);
 
-  const persistToken = useCallback(
-    async (tokenValue: string, refreshTokenValue?: string, expiresInValue?: number) => {
-      setPersistError(undefined);
-      try {
-        await signIn(tokenValue, refreshTokenValue, expiresInValue);
-        clearLoginDrafts();
-      } catch {
-        setPersistError(t('login.couldNotCompleteSignIn'));
-      }
-    },
-    [signIn, t]
-  );
+  const { persistError, isPersisting, persistToken } = useDeviceApprovalPersistence({
+    status,
+    credentials,
+    signIn,
+    couldNotCompleteSignIn: t('login.couldNotCompleteSignIn'),
+  });
 
   useEffect(() => {
     let cancelled = false;
@@ -116,13 +92,6 @@ export function LoginScreen() {
     }
   }, [sessionEnded, t]);
 
-  useEffect(() => {
-    if (status === 'approved' && token) {
-      void persistToken(token, refreshToken, expiresIn);
-    }
-    // eslint-disable-next-line react-hooks/exhaustive-deps -- persistToken is stable except for signIn identity; only re-run on a newly approved token
-  }, [status, token]);
-
   // Android shell keyboard pad: under API 35+ EDGE_TO_EDGE_ENFORCED the window
   // never resizes for the IME, so KeyboardAvoidingView is inert. keyboardDidShow
   // still fires with real heights; consume them here (r0b: zero layout shift for
@@ -144,7 +113,7 @@ export function LoginScreen() {
           currentPadding: current,
           event: {
             type: 'keyboard-visible',
-            keyboardHeight: keyboardHeightFromEvent(event),
+            keyboardHeight: event.endCoordinates.height,
           },
         })
       );
@@ -181,11 +150,12 @@ export function LoginScreen() {
             <Text className="text-center text-sm text-destructive">{persistError}</Text>
             <Button
               onPress={() => {
-                if (token) {
-                  void persistToken(token, refreshToken, expiresIn);
+                if (credentials) {
+                  void persistToken(credentials);
                 }
               }}
               accessibilityLabel={t('login.retrySignIn')}
+              disabled={isPersisting}
             >
               <Text>{t('common.retry')}</Text>
             </Button>

apps/mobile/src/components/quick-chat/quick-chat-screen.mounted.test.tsx

@@ -116,9 +116,8 @@ vi.mock('@/lib/utils', () => ({
 vi.mock('@/lib/auth/auth-context', () => ({
   useAuth: () => ({ authEpoch: authEpoch.value, token: 'token' }),
 }));
-vi.mock('@/lib/auth/token-owner', () => ({
-  getAuthTokenForRequest: () => 'token-1',
-}));
+vi.mock('@/lib/auth/token-owner', () => ({}));
+vi.mock('@/lib/auth/credentials', () => ({ getGatewayAuthTokenForRequest: () => 'token-1' }));
 vi.mock('@/lib/organization-context', () => ({
   useOrganization: () => ({
     organizationId: organizationId.value,

apps/mobile/src/components/quick-chat/use-quick-chat.ts

@@ -6,7 +6,7 @@ import { ulid } from 'ulid';
 
 import { i18n } from '@/i18n';
 import { useAuth } from '@/lib/auth/auth-context';
-import { getAuthTokenForRequest } from '@/lib/auth/token-owner';
+import { getGatewayAuthTokenForRequest } from '@/lib/auth/credentials';
 import { useOrganization } from '@/lib/organization-context';
 import { trpcClient, useTRPC } from '@/lib/trpc';
 
@@ -266,7 +266,7 @@ export function useQuickChat(model: string) {
 
     void (async () => {
       try {
-        const authToken = await getAuthTokenForRequest();
+        const authToken = await getGatewayAuthTokenForRequest();
         if (abortRef.current !== controller) {
           return;
         }