Add per-agent Settings key management (TASK-390)

backend/__tests__/service/runtimeTokenRevoke.test.js

@@ -21,7 +21,8 @@ process.env.NODE_ENV = 'test';
 
 // The signed-in human. A jest.mock factory may only reach `mock`-prefixed
 // bindings, read at call time.
-const mockOwner = { id: new mongoose.Types.ObjectId().toString() };
+const primaryOwnerId = new mongoose.Types.ObjectId().toString();
+const mockOwner = { id: primaryOwnerId };
 
 jest.mock('../../middleware/auth', () => {
   const auth = (req, _res, next) => {
@@ -46,6 +47,7 @@ const agentRuntimeAuth = require('../../middleware/agentRuntimeAuth');
 const app = express();
 app.use(express.json());
 app.use('/api/registry', require('../../routes/registry/agent-tokens'));
+app.use('/api/credentials', require('../../routes/credentials'));
 app.use('/api/registry', require('../../routes/registry/admin'));
 app.use('/api/registry', require('../../routes/registry/pod-agents'));
 // A limiter far above anything this suite sends: the probe is a test route,
@@ -85,6 +87,7 @@ describe('revoking a runtime token kills it in every store', () => {
   beforeAll(async () => { await setupMongoDb(); });
   afterAll(async () => { await closeMongoDb(); });
   beforeEach(async () => {
+    mockOwner.id = primaryOwnerId;
     await clearMongoDb();
     jest.spyOn(console, 'warn').mockImplementation(() => {});
   });
@@ -111,6 +114,97 @@ describe('revoking a runtime token kills it in every store', () => {
 
     expect((await probe(token)).status).toBe(401);
     expect(await storesHolding(tokenHash)).toEqual({ users: 0, installations: 0 });
+    const history = await request(app).get(`/api/credentials?agentName=${AGENT}&instanceId=default`);
+    expect(history.status).toBe(200);
+    expect(history.body).toEqual([expect.objectContaining({
+      label: 'laptop', status: 'revoked', revokedAt: expect.any(String),
+    })]);
+    expect(JSON.stringify(history.body)).not.toContain(token);
+  });
+
+  test('a pod member who did not install the identity cannot list key metadata', async () => {
+    const { workspace } = await seed();
+    const issued = await request(app)
+      .post(`/api/registry/pods/${workspace._id}/agents/${AGENT}/runtime-tokens`)
+      .send({ label: 'private laptop' });
+    expect(issued.status).toBe(200);
+    const otherId = new mongoose.Types.ObjectId().toString();
+    const credential = await AgentCredential.findOne({ label: 'private laptop' }).lean();
+    await Pod.updateOne({ _id: workspace._id }, { $push: { members: otherId } });
+    mockOwner.id = otherId;
+    const listed = await request(app).get(`/api/registry/pods/${workspace._id}/agents/${AGENT}/runtime-tokens`);
+    expect(listed.status).toBe(403);
+    expect(JSON.stringify(listed.body)).not.toContain('private laptop');
+    const credentials = await request(app).get(`/api/credentials?agentName=${AGENT}&instanceId=default`);
+    expect(credentials.status).toBe(403);
+    expect(JSON.stringify(credentials.body)).not.toContain('private laptop');
+    const revoke = await request(app).delete(`/api/credentials/${credential._id}?agentName=${AGENT}&instanceId=default`);
+    expect(revoke.status).toBe(403);
+    expect((await AgentCredential.findById(credential._id).lean()).status).toBe('active');
+  });
+
+  test('an instance admin can read a key-bearing installation without joining its pod', async () => {
+    const { workspace } = await seed();
+    const issued = await request(app)
+      .post(`/api/registry/pods/${workspace._id}/agents/${AGENT}/runtime-tokens`)
+      .send({ label: 'owner key' });
+    expect(issued.status).toBe(200);
+    const adminId = new mongoose.Types.ObjectId();
+    await User.create({ _id: adminId, username: 'settings-admin', email: 'settings-admin@example.test',
+      role: 'admin', authProviders: [{ provider: 'github', providerId: 'settings-admin' }] });
+    mockOwner.id = String(adminId);
+    const installation = await request(app)
+      .get(`/api/registry/pods/${workspace._id}/agents/${AGENT}?instanceId=default`);
+    expect(installation.status).toBe(200);
+    const keys = await request(app).get(`/api/credentials?agentName=${AGENT}&instanceId=default`);
+    expect(keys.status).toBe(200);
+  });
+
+  test('the Settings credential revoke stops the agent token and keeps its history', async () => {
+    const { workspace } = await seed();
+    const issued = await request(app)
+      .post(`/api/registry/pods/${workspace._id}/agents/${AGENT}/runtime-tokens`)
+      .send({ label: 'Settings key' });
+    expect((await probe(issued.body.token)).status).toBe(200);
+    const listed = await request(app).get(`/api/credentials?agentName=${AGENT}&instanceId=default`);
+    expect(listed.status).toBe(200);
+    expect(listed.body).toEqual([expect.objectContaining({ label: 'Settings key', status: 'active' })]);
+    const revoked = await request(app).delete(`/api/credentials/${listed.body[0]._id}?agentName=${AGENT}&instanceId=default`);
+    expect(revoked.status).toBe(200);
+    expect((await probe(issued.body.token)).status).toBe(401);
+    const after = await request(app).get(`/api/credentials?agentName=${AGENT}&instanceId=default`);
+    expect(after.body).toEqual([expect.objectContaining({ label: 'Settings key', status: 'revoked' })]);
+  });
+
+  test('an existing embedded key is imported into Settings before it is revoked', async () => {
+    const { workspaceInstall } = await seed();
+    const agentUser = await AgentIdentityService.getOrCreateAgentUser(AGENT, { instanceId: 'default' });
+    const issued = await issueRuntimeTokenForAgent(agentUser, 'Old CLI key', workspaceInstall);
+    expect(await AgentCredential.countDocuments({ agentUserId: agentUser._id })).toBe(0);
+    const listed = await request(app).get(`/api/credentials?agentName=${AGENT}&instanceId=default`);
+    expect(listed.status).toBe(200);
+    expect(listed.body).toEqual([expect.objectContaining({ label: 'Old CLI key', status: 'active' })]);
+    const revoked = await request(app).delete(`/api/credentials/${listed.body[0]._id}?agentName=${AGENT}&instanceId=default`);
+    expect(revoked.status).toBe(200);
+    expect((await probe(issued.token)).status).toBe(401);
+    expect((await request(app).get(`/api/credentials?agentName=${AGENT}&instanceId=default`)).body)
+      .toEqual([expect.objectContaining({ label: 'Old CLI key', status: 'revoked' })]);
+    expect((await User.findById(agentUser._id).lean()).agentRuntimeTokens).toHaveLength(1);
+    expect((await AgentInstallation.findById(workspaceInstall._id).lean()).runtimeTokens).toHaveLength(1);
+  });
+
+  test('an installation-only legacy key remains visible for owner revocation', async () => {
+    const { workspaceInstall } = await seed();
+    const agentUser = await AgentIdentityService.getOrCreateAgentUser(AGENT, { instanceId: 'default' });
+    const issued = await issueRuntimeTokenForAgent(agentUser, 'Installation key', workspaceInstall);
+    await User.updateOne({ _id: agentUser._id }, { $set: { agentRuntimeTokens: [] } });
+    expect((await probe(issued.token)).status).toBe(200);
+    const listed = await request(app).get(`/api/credentials?agentName=${AGENT}&instanceId=default`);
+    expect(listed.status).toBe(200);
+    expect(listed.body).toEqual([expect.objectContaining({ label: 'Installation key', status: 'active' })]);
+    const revoked = await request(app).delete(`/api/credentials/${listed.body[0]._id}?agentName=${AGENT}&instanceId=default`);
+    expect(revoked.status).toBe(200);
+    expect((await probe(issued.token)).status).toBe(401);
   });
 
   test('a copy on a sibling installation dies too, and so does a ledger row', async () => {
@@ -179,6 +273,12 @@ describe('revoking a runtime token kills it in every store', () => {
 
     expect((await probe(first.token)).status).toBe(401);
     expect((await probe(second)).status).toBe(200);
+    const history = await request(app).get(`/api/credentials?agentName=${AGENT}&instanceId=default`);
+    expect(history.status).toBe(200);
+    expect(history.body).toEqual(expect.arrayContaining([
+      expect.objectContaining({ label: 'laptop', status: 'revoked', revokedAt: expect.any(String) }),
+      expect.objectContaining({ label: 'desktop', status: 'active', revokedAt: null }),
+    ]));
   });
 
   test('pod uninstall keeps a shared token until the last installation, then revokes it and preserves identity', async () => {

backend/__tests__/unit/routes/registry.agent-config-installer-gate.test.js

@@ -273,7 +273,42 @@ describe('agent config PATCH — installer gate', () => {
     expect(primary.save).toHaveBeenCalledTimes(1);
   });
 
-  it('still refuses a non-member before any of that (membership is a precondition)', async () => {
+  it('lets an instance admin manage an installation without joining its pod', async () => {
+    const primary = installation();
+    setCallerRole('admin');
+    setPod({ members: [] });
+    AgentInstallation.findOne.mockResolvedValue(primary);
+    AgentInstallation.find.mockResolvedValue([primary]);
+
+    const res = await request(app)
+      .patch('/api/registry/pods/pod-1/agents/openclaw')
+      .send({ instanceId: 'curator', config: { heartbeat: { enabled: false } } });
+
+    expect(res.status).toBe(200);
+    expect(primary.save).toHaveBeenCalledTimes(1);
+  });
+
+  it('changes environment model controls without deleting hidden MCP or workspace declarations', async () => {
+    const existingEnvironment = {
+      model: 'old-model', workspace: { path: './seat' },
+      mcp: [{ name: 'trusted', command: ['true'] }],
+    };
+    const primary = installation({ installedBy: MEMBER, config: new Map([['environment', existingEnvironment]]) });
+    setPod();
+    AgentInstallation.findOne.mockResolvedValue(primary);
+    AgentInstallation.find.mockResolvedValue([primary]);
+
+    const res = await request(app)
+      .patch('/api/registry/pods/pod-1/agents/openclaw')
+      .send({ instanceId: 'curator', config: { environment: { model: 'new-model', effort: 'high' } } });
+
+    expect(res.status).toBe(200);
+    expect(primary.config.get('environment')).toEqual({
+      ...existingEnvironment, model: 'new-model', effort: 'high',
+    });
+  });
+
+  it('still refuses a non-admin non-member before any of that', async () => {
     const primary = installation();
     Pod.findById.mockReturnValue({
       lean: jest.fn().mockResolvedValue({ _id: 'pod-1', createdBy: 'someone-else', members: [] }),

backend/__tests__/unit/routes/registry.description-and-userid.test.js

@@ -49,4 +49,13 @@ describe('agent listing description + principal id', () => {
         .toBe(resolveAgentDisplayLabel(user, user.username));
     }
   });
+
+  test('settings projects effective environment model controls without secrets', () => {
+    const payload = buildAgentInstallationPayload({ ...install, config: new Map([['environment', {
+      model: 'openai/gpt-5', effort: 'high', adapter: 'codex',
+      provider: { apiKey: 'secret' }, mcp: [{ env: { TOKEN: 'secret' } }],
+    }]]) });
+    expect(payload.config.environment).toEqual({ model: 'openai/gpt-5', effort: 'high', adapter: 'codex' });
+    expect(JSON.stringify(payload)).not.toContain('secret');
+  });
 });

backend/__tests__/unit/routes/registry.list-agents-config.test.js

@@ -152,6 +152,7 @@ describe('registry list pod agents config payload', () => {
     expect(res.body.agents[0].config).toEqual({
       presetId: null,
       customizations: null,
+      environment: {},
       heartbeat: { enabled: true, everyMinutes: 60 },
       autonomy: { autoJoinAgentOwnedPods: true },
       errorRouting: { ownerDm: true },

backend/__tests__/unit/routes/registry.runtime-tokens.test.js

@@ -26,6 +26,8 @@ jest.mock('../../../models/AgentRegistry', () => ({
 }));
 jest.mock('../../../models/AgentCredential', () => ({
   updateMany: jest.fn().mockResolvedValue({ modifiedCount: 0 }),
+  updateOne: jest.fn().mockResolvedValue({ upsertedCount: 1 }),
+  create: jest.fn().mockResolvedValue({}),
 }));
 jest.mock('../../../models/User', () => ({
   findOne: jest.fn(),

backend/__tests__/unit/routes/registry.runtimeTokenOwnership.test.js

@@ -26,6 +26,9 @@ const matches = (doc, filter) => Object.entries(filter).every(([key, want]) => {
 });
 jest.mock('../../../models/AgentRegistry', () => ({
   AgentInstallation: {
+    find: jest.fn(() => ({
+      collation: () => ({ select: () => ({ lean: () => Promise.resolve([]) }) }),
+    })),
     findOne: jest.fn((filter) => {
       const hit = mockInstalls.find((doc) => matches(doc, filter)) || null;
       const chain = {
@@ -41,6 +44,7 @@ jest.mock('../../../models/AgentRegistry', () => ({
 
 jest.mock('../../../models/Pod', () => ({ findById: jest.fn() }));
 jest.mock('../../../models/User', () => ({ findById: jest.fn(), findOne: jest.fn() }));
+jest.mock('../../../models/AgentCredential', () => ({ updateOne: jest.fn().mockResolvedValue({}) }));
 
 jest.mock('../../../services/agentIdentityService', () => ({
   resolveAgentType: jest.fn((name) => String(name).toLowerCase()),
@@ -101,7 +105,7 @@ beforeEach(() => {
   mockIsAdmin.mockResolvedValue(false);
   // The caller is a member of the pod in every case: membership is not the question.
   Pod.findById.mockReturnValue({ lean: () => Promise.resolve({ _id: 'pod-a', createdBy: 'user-a', members: ['user-a'] }) });
-  User.findOne.mockResolvedValue({ agentRuntimeTokens: [{ _id: 'tok-1', tokenHash: 'hash-1' }], save: jest.fn() });
+  User.findOne.mockResolvedValue({ _id: 'bot-1', agentRuntimeTokens: [{ _id: 'tok-1', tokenHash: 'hash-1' }], save: jest.fn() });
 });
 
 const mint = (body = {}) => request(app).post('/api/registry/pods/pod-a/agents/quire/runtime-tokens').send(body);

backend/__tests__/utils/leakMatrixSuites.js

@@ -541,10 +541,10 @@ const registry = {
   },
   cases: [
     ...matrix('GET', '/api/registry/pods/:podId/agents/:name', (ctx) => `/api/registry/pods/${ctx.podId}/agents/${REG_AGENT}`,
-      { owner: 200, member: 200, stranger: 403, admin: 403 }),
+      { owner: 200, member: 200, stranger: 403, admin: 200 }),
     ...matrix('GET', '/api/registry/pods/:podId/agents/:name/runtime-tokens',
       (ctx) => `/api/registry/pods/${ctx.podId}/agents/${REG_AGENT}/runtime-tokens`,
-      { owner: 200, member: 200, stranger: 403, admin: 403 }),
+      { owner: 200, member: 403, stranger: 403, admin: 200 }),
     ...matrix('GET', '/api/registry/pods/:podId/agents/:name/user-token',
       (ctx) => `/api/registry/pods/${ctx.podId}/agents/${REG_AGENT}/user-token`,
       { owner: 200, member: 200, stranger: 403, admin: 403 }),

backend/routes/credentials.ts

@@ -9,6 +9,8 @@ import rateLimit from 'express-rate-limit';
 import { cloudflareIpRateLimitKeyGenerator } from '../middleware/ipRateLimit';
 import { createHash } from 'crypto';
 import AgentCredential from '../models/AgentCredential';
+import { AgentInstallation } from '../models/AgentRegistry';
+import { ownsRuntimeIdentity } from '../services/runtimeIdentityOwnership';
 
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const auth = require('../middleware/auth');
@@ -40,7 +42,49 @@ type AuthReq = express.Request & { user?: { id?: string } };
 
 router.get('/', credentialRateLimit, auth, async (req: AuthReq, res: express.Response) => {
   try {
-    const rows = await AgentCredential.find({ ownerUserId: req.user?.id })
+    const agentName = String(req.query.agentName || '').trim().toLowerCase();
+    const instanceId = String(req.query.instanceId || '').trim();
+    let filter: Record<string, unknown> = { ownerUserId: req.user?.id };
+    if (agentName || instanceId) {
+      if (!agentName || !instanceId) return res.status(400).json({ message: 'Agent name and instance id are required' });
+      const caller = await User.findById(req.user?.id).select('role').lean();
+      if (caller?.role !== 'admin') {
+        const ownership = await ownsRuntimeIdentity(req.user?.id, agentName, instanceId);
+        if (!ownership.owned) return res.status(403).json({ message: 'Access denied' });
+      }
+      const agent = await User.findOne({
+        isBot: true,
+        'botMetadata.agentName': agentName,
+        'botMetadata.instanceId': instanceId,
+      }).select('_id agentRuntimeTokens').lean();
+      if (!agent) return res.status(404).json({ message: 'Agent not found' });
+      // Existing CLI keys were minted before the credential ledger became
+      // authoritative. Import their metadata once so list/revoke can use the
+      // same credential id and a later revoke remains visible in Settings.
+      const installations = await AgentInstallation.find({ agentName, instanceId })
+        .select('installedBy runtimeTokens').lean();
+      const ownerUserId = installations[0]?.installedBy || req.user?.id;
+      type EmbeddedToken = { tokenHash?: string; label?: string; createdAt?: Date; lastUsedAt?: Date };
+      const embedded: EmbeddedToken[] = [...(agent.agentRuntimeTokens || []),
+        ...installations.flatMap((entry: { runtimeTokens?: EmbeddedToken[] }) => entry.runtimeTokens || [])];
+      const seen = new Set<string>();
+      await Promise.all(embedded.filter((token) => {
+        if (!token.tokenHash || seen.has(token.tokenHash)) return false;
+        seen.add(token.tokenHash);
+        return true;
+      })
+        .map((token) => AgentCredential.updateOne(
+          { tokenHash: token.tokenHash },
+          { $setOnInsert: {
+            kind: 'runtime', ownerUserId, agentUserId: agent._id,
+            label: token.label || 'Runtime token', status: 'active',
+            createdAt: token.createdAt || new Date(), lastUsedAt: token.lastUsedAt || null,
+          } },
+          { upsert: true },
+        )));
+      filter = { agentUserId: agent._id, kind: 'runtime' };
+    }
+    const rows = await AgentCredential.find(filter)
       .select('-tokenHash')
       .sort({ createdAt: -1 })
       .lean();
@@ -58,8 +102,25 @@ router.delete('/:id', credentialRateLimit, auth, async (req: AuthReq, res: expre
     const credential = await AgentCredential.findById(id);
     if (!credential) return res.status(404).json({ message: 'Credential not found' });
     const caller = await User.findById(req.user?.id).select('role').lean();
+    const agentName = String(req.query.agentName || '').trim().toLowerCase();
+    const instanceId = String(req.query.instanceId || '').trim();
+    if (agentName || instanceId) {
+      if (!agentName || !instanceId) return res.status(400).json({ message: 'Agent name and instance id are required' });
+      const agent = await User.findOne({
+        isBot: true,
+        'botMetadata.agentName': agentName,
+        'botMetadata.instanceId': instanceId,
+      }).select('_id').lean();
+      if (!agent || String(credential.agentUserId) !== String(agent._id) || credential.kind !== 'runtime') {
+        return res.status(404).json({ message: 'Credential not found for this agent' });
+      }
+      if (caller?.role !== 'admin') {
+        const ownership = await ownsRuntimeIdentity(req.user?.id, agentName, instanceId);
+        if (!ownership.owned) return res.status(403).json({ message: 'Access denied' });
+      }
+    }
     const isOwner = String(credential.ownerUserId) === String(req.user?.id);
-    if (!isOwner && caller?.role !== 'admin') {
+    if (!agentName && !isOwner && caller?.role !== 'admin') {
       return res.status(403).json({ message: 'Access denied' });
     }
     const revoked = await AgentCredential.revokeCascade(credential._id as Types.ObjectId);