Replace Node UI token bootstrap with dashboard sessions

.github/workflows/ci.yml

@@ -535,6 +535,37 @@ jobs:
         run: tar -xzf /tmp/build-outputs.tgz
       - name: "node-ui tests"
         run: pnpm --filter @origintrail-official/dkg-node-ui test
+      - name: "node-ui static bundle contract"
+        shell: bash
+        run: |
+          pnpm --filter @origintrail-official/dkg-node-ui build:ui
+          test -f packages/node-ui/dist-ui/index.html
+          if grep -R "__DKG_TOKEN__" packages/node-ui/dist-ui; then
+            echo "dist-ui must not contain legacy browser bearer-token bootstrap"
+            exit 1
+          fi
+          node - <<'NODE'
+          const { readFileSync, existsSync } = require('node:fs');
+          const { join, dirname } = require('node:path');
+          const indexPath = join('packages', 'node-ui', 'dist-ui', 'index.html');
+          const html = readFileSync(indexPath, 'utf8');
+          const refs = [...html.matchAll(/(?:src|href)="([^"]+\.(?:js|css))"/g)].map((m) => m[1]);
+          if (refs.length === 0) {
+            throw new Error('dist-ui/index.html did not reference any JS/CSS assets');
+          }
+          for (const ref of refs) {
+            if (ref.startsWith('/') && !ref.startsWith('/ui/')) {
+              throw new Error(`UI asset reference must be relative or rooted under /ui/: ${ref}`);
+            }
+            const normalized = ref.startsWith('/ui/') ? ref.slice('/ui/'.length) : ref.replace(/^\.\//, '');
+            const assetPath = join(dirname(indexPath), normalized);
+            if (!existsSync(assetPath)) throw new Error(`Missing referenced UI asset: ${ref}`);
+          }
+          NODE
+      - name: Install Playwright Chromium for production-static smoke
+        run: pnpm --filter @origintrail-official/dkg-node-ui exec playwright install chromium --with-deps
+      - name: "node-ui production-static Playwright smoke"
+        run: pnpm --filter @origintrail-official/dkg-node-ui test:e2e:static
 
   # node-ui Playwright e2e — REAL NODE, NO MOCKS. The suite boots a live
   # 4-node devnet (Hardhat + four DKG daemons) via Playwright's `webServer`

packages/adapter-hermes/src/setup.ts

@@ -661,7 +661,23 @@ function rewriteActiveProviderLine(raw: string, newProvider: string): string | n
  * request so the adapter stays free of a `@origintrail-official/dkg-agent`
  * dependency: the cli layer (which has dkg-agent) provides `loadOpWallets`.
  */
+type PostConfigSetupHook = (dkgHome: string) => Promise<unknown>;
+
 export interface RunHermesSetupDeps {
+  /**
+   * Optional setup lifecycle hook invoked after DKG node config bootstrap and
+   * before wallet creation / daemon start. CLI setup entry points use this for
+   * CLI-owned best-effort side effects while daemon/UI-driven adapter setup
+   * omits it. Required setup work should stay explicit instead of being hidden
+   * behind this optional hook.
+   */
+  afterConfigBootstrap?: PostConfigSetupHook;
+  /**
+   * @deprecated Use `afterConfigBootstrap`. Kept as a runtime fallback so
+   * JavaScript callers on the previous dependency shape do not silently lose
+   * dashboard credential provisioning.
+   */
+  ensureDashboardCredentials?: PostConfigSetupHook;
   /**
    * Eagerly create the node's operational wallets (generate-if-absent) after
    * the config bootstrap and before the daemon starts, so faucet funding and
@@ -704,6 +720,7 @@ export async function runHermesSetup(
   // one they chose. Gating on `config.json` alone (the pre-#960 behavior) misses
   // the YAML-only install.
   const dkgConfigHome = resolveDkgConfigHome({ startDir: __dirname });
+  const dashboardCredentialHome = shouldStart ? dkgConfigHome : dkgDir(setupOptions.daemonUrl);
   const dkgConfigExists =
     existsSync(join(dkgConfigHome, 'config.json')) ||
     existsSync(join(dkgConfigHome, 'config.yaml'));
@@ -750,6 +767,18 @@ export async function runHermesSetup(
     console.log('[hermes-setup] [dry-run] Would bootstrap ~/.dkg/config.json if missing');
   }
 
+  // Run CLI-owned setup side effects after node config bootstrap and before
+  // wallets / daemon startup. Best-effort so adapter setup remains recoverable
+  // and daemon/UI-driven setup can omit terminal-only side effects entirely.
+  const afterConfigBootstrap = deps.afterConfigBootstrap ?? deps.ensureDashboardCredentials;
+  if (!dryRun && afterConfigBootstrap) {
+    try {
+      await afterConfigBootstrap(dashboardCredentialHome);
+    } catch (err: any) {
+      console.warn(`[hermes-setup] Post-config setup hook failed (${err?.message ?? String(err)}); continuing.`);
+    }
+  }
+
   // Eagerly ensure the node's wallets exist BEFORE the daemon starts (issue
   // #1306) — matching `dkg init` — so faucet funding (testnet) and manual
   // mainnet funding have wallets even if the daemon never fully boots. Runs

packages/adapter-hermes/test/hermes-adapter.part-07.test.ts

@@ -11,9 +11,10 @@ vi.mock('@origintrail-official/dkg-core', async () => {
     ...actual,
     resolveDkgConfigHome: vi.fn((opts) => actual.resolveDkgConfigHome(opts)),
     resolveDkgHome: vi.fn((opts) => actual.resolveDkgHome(opts)),
+    startDaemon: vi.fn(async () => {}),
   };
 });
-import { resolveDkgHome } from '@origintrail-official/dkg-core';
+import { resolveDkgConfigHome, resolveDkgHome, startDaemon } from '@origintrail-official/dkg-core';
 import { HermesAdapterPlugin } from '../src/HermesAdapterPlugin.js';
 import { registerHermesRoutes } from '../src/hermes-routes.js';
 import { HermesDkgClient, redact } from '../src/dkg-client.js';
@@ -115,6 +116,186 @@ describe('Hermes profile setup helpers', () => {
     }
   });
 
+  it('#1443: invokes the post-config setup hook, skipped on --dry-run', async () => {
+    const hermesHome = mkdtempSync(join(tmpdir(), 'hermes-profile-'));
+    const dkgHome = mkdtempSync(join(tmpdir(), 'dkg-home-1439-'));
+    vi.stubGlobal('fetch', async () =>
+      new Response(JSON.stringify({ ok: true }), {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+      }),
+    );
+    const oldDkgHome = process.env.DKG_HOME;
+    process.env.DKG_HOME = dkgHome;
+    try {
+      const afterConfigBootstrap = vi.fn(async () => {});
+
+      await runSetup(
+        { hermesHome, verify: false, start: false, fund: false },
+        { afterConfigBootstrap },
+      );
+      expect(afterConfigBootstrap).toHaveBeenCalledTimes(1);
+      expect(afterConfigBootstrap.mock.calls[0][0]).toBe(dkgHome);
+
+      afterConfigBootstrap.mockClear();
+      await runSetup(
+        { hermesHome, verify: false, start: false, fund: false, dryRun: true },
+        { afterConfigBootstrap },
+      );
+      expect(afterConfigBootstrap).not.toHaveBeenCalled();
+    } finally {
+      if (oldDkgHome === undefined) delete process.env.DKG_HOME;
+      else process.env.DKG_HOME = oldDkgHome;
+      rmSync(hermesHome, { recursive: true, force: true });
+      rmSync(dkgHome, { recursive: true, force: true });
+    }
+  });
+
+  it('#1451: honors deprecated ensureDashboardCredentials hook as a runtime fallback', async () => {
+    const hermesHome = mkdtempSync(join(tmpdir(), 'hermes-profile-'));
+    const dkgHome = mkdtempSync(join(tmpdir(), 'dkg-home-legacy-hook-'));
+    vi.stubGlobal('fetch', async () =>
+      new Response(JSON.stringify({ ok: true }), {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+      }),
+    );
+    const oldDkgHome = process.env.DKG_HOME;
+    process.env.DKG_HOME = dkgHome;
+    try {
+      const ensureDashboardCredentials = vi.fn(async () => {});
+
+      await runSetup(
+        { hermesHome, verify: false, start: false, fund: false },
+        { ensureDashboardCredentials },
+      );
+      expect(ensureDashboardCredentials).toHaveBeenCalledTimes(1);
+      expect(ensureDashboardCredentials.mock.calls[0][0]).toBe(dkgHome);
+    } finally {
+      if (oldDkgHome === undefined) delete process.env.DKG_HOME;
+      else process.env.DKG_HOME = oldDkgHome;
+      rmSync(hermesHome, { recursive: true, force: true });
+      rmSync(dkgHome, { recursive: true, force: true });
+    }
+  });
+
+  it('#1439: creates dashboard credentials in the config DKG home when setup starts the daemon', async () => {
+    const hermesHome = mkdtempSync(join(tmpdir(), 'hermes-profile-'));
+    const configDkgHome = mkdtempSync(join(tmpdir(), 'dkg-home-config-'));
+    const daemonDkgHome = mkdtempSync(join(tmpdir(), 'dkg-home-daemon-url-'));
+    vi.stubGlobal('fetch', async () =>
+      new Response(JSON.stringify({ ok: true }), {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+      }),
+    );
+    const oldDkgHome = process.env.DKG_HOME;
+    delete process.env.DKG_HOME;
+    const configResolver = vi.mocked(resolveDkgConfigHome);
+    const homeResolver = vi.mocked(resolveDkgHome);
+    const originalResolveDkgConfigHome = configResolver.getMockImplementation();
+    const originalResolveDkgHome = homeResolver.getMockImplementation();
+    configResolver.mockReturnValue(configDkgHome);
+    homeResolver.mockReturnValue(daemonDkgHome);
+    vi.mocked(startDaemon).mockClear();
+    try {
+      const afterConfigBootstrap = vi.fn(async () => {});
+
+      await runSetup(
+        {
+          hermesHome,
+          daemonUrl: 'http://127.0.0.1:9300',
+          verify: false,
+          fund: false,
+        },
+        { afterConfigBootstrap },
+      );
+
+      expect(startDaemon).toHaveBeenCalledWith(9300);
+      expect(resolveDkgHome).toHaveBeenCalledWith({ daemonUrl: 'http://127.0.0.1:9300' });
+      expect(afterConfigBootstrap).toHaveBeenCalledTimes(1);
+      expect(afterConfigBootstrap.mock.calls[0][0]).toBe(configDkgHome);
+      expect(afterConfigBootstrap.mock.calls[0][0]).not.toBe(daemonDkgHome);
+    } finally {
+      if (originalResolveDkgConfigHome) configResolver.mockImplementation(originalResolveDkgConfigHome);
+      if (originalResolveDkgHome) homeResolver.mockImplementation(originalResolveDkgHome);
+      vi.mocked(startDaemon).mockClear();
+      if (oldDkgHome === undefined) delete process.env.DKG_HOME;
+      else process.env.DKG_HOME = oldDkgHome;
+      rmSync(hermesHome, { recursive: true, force: true });
+      rmSync(configDkgHome, { recursive: true, force: true });
+      rmSync(daemonDkgHome, { recursive: true, force: true });
+    }
+  });
+
+  it('#1439: creates dashboard credentials in the daemon-url resolved DKG home when setup does not start the daemon', async () => {
+    const hermesHome = mkdtempSync(join(tmpdir(), 'hermes-profile-'));
+    const daemonDkgHome = mkdtempSync(join(tmpdir(), 'dkg-home-daemon-url-'));
+    vi.stubGlobal('fetch', async () =>
+      new Response(JSON.stringify({ ok: true }), {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+      }),
+    );
+    const oldDkgHome = process.env.DKG_HOME;
+    delete process.env.DKG_HOME;
+    const resolver = vi.mocked(resolveDkgHome);
+    const originalResolveDkgHome = resolver.getMockImplementation();
+    resolver.mockReturnValue(daemonDkgHome);
+    try {
+      const afterConfigBootstrap = vi.fn(async () => {});
+
+      await runSetup(
+        {
+          hermesHome,
+          daemonUrl: 'http://127.0.0.1:9300',
+          verify: false,
+          start: false,
+          fund: false,
+        },
+        { afterConfigBootstrap },
+      );
+
+      expect(resolveDkgHome).toHaveBeenCalledWith({ daemonUrl: 'http://127.0.0.1:9300' });
+      expect(afterConfigBootstrap).toHaveBeenCalledTimes(1);
+      expect(afterConfigBootstrap.mock.calls[0][0]).toBe(daemonDkgHome);
+    } finally {
+      if (originalResolveDkgHome) resolver.mockImplementation(originalResolveDkgHome);
+      if (oldDkgHome === undefined) delete process.env.DKG_HOME;
+      else process.env.DKG_HOME = oldDkgHome;
+      rmSync(hermesHome, { recursive: true, force: true });
+      rmSync(daemonDkgHome, { recursive: true, force: true });
+    }
+  });
+
+  it('#1443: a failing post-config setup hook does not flip setup to degraded', async () => {
+    const hermesHome = mkdtempSync(join(tmpdir(), 'hermes-profile-'));
+    const dkgHome = mkdtempSync(join(tmpdir(), 'dkg-home-1439f-'));
+    vi.stubGlobal('fetch', async () =>
+      new Response(JSON.stringify({ ok: true }), {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+      }),
+    );
+    const oldDkgHome = process.env.DKG_HOME;
+    process.env.DKG_HOME = dkgHome;
+    try {
+      const afterConfigBootstrap = vi.fn(async () => { throw new Error('invalid credential file'); });
+      const result = await runHermesSetup(
+        { hermesHome, verify: false, start: false, fund: false },
+        { afterConfigBootstrap },
+      );
+      expect(afterConfigBootstrap).toHaveBeenCalledTimes(1);
+      expect(result.warnings.join('\n')).not.toContain('dashboard login credentials');
+      expect(result.errors.join('\n')).not.toContain('dashboard login credentials');
+    } finally {
+      if (oldDkgHome === undefined) delete process.env.DKG_HOME;
+      else process.env.DKG_HOME = oldDkgHome;
+      rmSync(hermesHome, { recursive: true, force: true });
+      rmSync(dkgHome, { recursive: true, force: true });
+    }
+  });
+
   // issue #1306 — a failing wallet pre-creation is best-effort and must NOT push
   // into the status-bearing `warnings[]` (which would flip the integration to
   // `degraded` in the daemon-UI). It goes to console.warn instead. Call

packages/adapter-openclaw/src/setup.ts

@@ -1645,7 +1645,23 @@ export function verifyMemorySlotInvariants(configPath?: string): void {
  * `SetupOptions` so the adapter stays free of a `@origintrail-official/dkg-agent`
  * dependency: the cli layer (which has dkg-agent) provides `loadOpWallets`.
  */
+type PostConfigSetupHook = (dkgHome: string) => Promise<unknown>;
+
 export interface RunSetupDeps {
+  /**
+   * Optional setup lifecycle hook invoked after DKG node config bootstrap and
+   * before wallet creation / daemon start. CLI setup entry points use this for
+   * CLI-owned best-effort side effects while daemon/UI-driven adapter setup
+   * omits it. Required setup work should stay explicit instead of being hidden
+   * behind this optional hook.
+   */
+  afterConfigBootstrap?: PostConfigSetupHook;
+  /**
+   * @deprecated Use `afterConfigBootstrap`. Kept as a runtime fallback so
+   * JavaScript callers on the previous dependency shape do not silently lose
+   * dashboard credential provisioning.
+   */
+  ensureDashboardCredentials?: PostConfigSetupHook;
   /**
    * Eagerly create the node's operational wallets (generate-if-absent) after
    * the config write and before the daemon starts, so faucet funding and
@@ -1742,6 +1758,19 @@ export async function runSetup(options: SetupOptions, deps: RunSetupDeps = {}):
     log(`[dry-run] Would write ${join(dkgDir(), 'config.json')} (${network.networkName}, port ${apiPort})`);
   }
 
+  // Run CLI-owned setup side effects after the node config home is known and
+  // before wallets / daemon startup. Best-effort so adapter setup remains
+  // recoverable and daemon/UI-driven setup can omit terminal-only side effects.
+  const afterConfigBootstrap = deps.afterConfigBootstrap ?? deps.ensureDashboardCredentials;
+  if (!dryRun && afterConfigBootstrap) {
+    const dashboardCredentialHome = dkgDir();
+    try {
+      await afterConfigBootstrap(dashboardCredentialHome);
+    } catch (err: any) {
+      warn(`Post-config setup hook failed (${err?.message ?? String(err)}); continuing.`);
+    }
+  }
+
   // Eagerly ensure the node's wallets exist BEFORE the daemon starts (issue
   // #1306) — matching `dkg init` — so faucet funding (testnet) and manual
   // mainnet funding have wallets to target even if the daemon never fully

packages/adapter-openclaw/test/setup.part-26.test.ts

@@ -490,6 +490,59 @@ describe('runSetup Step 5 — faucet funding', () => {
     }
   });
 
+  it('#1443: invokes the post-config setup hook, skipped on --dry-run', async () => {
+    const env = setupFaucetEnv();
+    try {
+      const afterConfigBootstrap = vi.fn(async () => {});
+      await runSetup(
+        { workspace: env.workspace, network: 'testnet', start: false, verify: false, fund: false },
+        { afterConfigBootstrap },
+      );
+      expect(afterConfigBootstrap).toHaveBeenCalledTimes(1);
+      expect(afterConfigBootstrap.mock.calls[0][0]).toBe(env.dkgHome);
+
+      afterConfigBootstrap.mockClear();
+      await runSetup(
+        { workspace: env.workspace, network: 'testnet', start: false, verify: false, dryRun: true },
+        { afterConfigBootstrap },
+      );
+      expect(afterConfigBootstrap).not.toHaveBeenCalled();
+    } finally {
+      env.restore();
+    }
+  });
+
+  it('#1451: honors deprecated ensureDashboardCredentials hook as a runtime fallback', async () => {
+    const env = setupFaucetEnv();
+    try {
+      const ensureDashboardCredentials = vi.fn(async () => {});
+      await runSetup(
+        { workspace: env.workspace, network: 'testnet', start: false, verify: false, fund: false },
+        { ensureDashboardCredentials },
+      );
+      expect(ensureDashboardCredentials).toHaveBeenCalledTimes(1);
+      expect(ensureDashboardCredentials.mock.calls[0][0]).toBe(env.dkgHome);
+    } finally {
+      env.restore();
+    }
+  });
+
+  it('#1443: a failing post-config setup hook is best-effort', async () => {
+    const env = setupFaucetEnv();
+    try {
+      const afterConfigBootstrap = vi.fn(async () => { throw new Error('invalid credential file'); });
+      await expect(
+        runSetup(
+          { workspace: env.workspace, network: 'testnet', start: false, verify: false, fund: false },
+          { afterConfigBootstrap },
+        ),
+      ).resolves.toBeUndefined();
+      expect(afterConfigBootstrap).toHaveBeenCalledTimes(1);
+    } finally {
+      env.restore();
+    }
+  });
+
   it('#1306: a failing loadOpWallets is best-effort — setup still completes', async () => {
     const env = setupFaucetEnv();
     try {