Replace Node UI token bootstrap with dashboard sessions

.github/workflows/ci.yml

@@ -535,6 +535,30 @@ jobs:
         run: tar -xzf /tmp/build-outputs.tgz
       - name: "node-ui tests"
         run: pnpm --filter @origintrail-official/dkg-node-ui test
+      - name: "node-ui static bundle contract"
+        shell: bash
+        run: |
+          pnpm --filter @origintrail-official/dkg-node-ui build:ui
+          test -f packages/node-ui/dist-ui/index.html
+          if grep -R "__DKG_TOKEN__" packages/node-ui/dist-ui; then
+            echo "dist-ui must not contain legacy browser bearer-token bootstrap"
+            exit 1
+          fi
+          node - <<'NODE'
+          const { readFileSync, existsSync } = require('node:fs');
+          const { join, dirname } = require('node:path');
+          const indexPath = join('packages', 'node-ui', 'dist-ui', 'index.html');
+          const html = readFileSync(indexPath, 'utf8');
+          const refs = [...html.matchAll(/(?:src|href)="([^"]+\.(?:js|css))"/g)].map((m) => m[1]);
+          if (refs.length === 0) {
+            throw new Error('dist-ui/index.html did not reference any JS/CSS assets');
+          }
+          for (const ref of refs) {
+            const normalized = ref.startsWith('/ui/') ? ref.slice('/ui/'.length) : ref.replace(/^\.\//, '');
+            const assetPath = join(dirname(indexPath), normalized);
+            if (!existsSync(assetPath)) throw new Error(`Missing referenced UI asset: ${ref}`);
+          }
+          NODE
 
   # node-ui Playwright e2e — REAL NODE, NO MOCKS. The suite boots a live
   # 4-node devnet (Hardhat + four DKG daemons) via Playwright's `webServer`

agent-docs/node-ui-auth-bootstrap-team-prompt.md

@@ -0,0 +1,80 @@
+# Node UI Auth Bootstrap Upgrade Team Prompt
+
+You are the team lead for a security and implementation planning effort in the DKG repository.
+
+## Mission
+
+Analyze the current Node UI authentication bootstrap and produce an implementation-ready upgrade plan that brings it in line with modern browser security, backend implementation, and operator UX expectations.
+
+The issue under review is narrow but serious: production `/ui` serves a Vite-built static SPA, but the daemon currently injects an API bearer token into `index.html` as `window.__DKG_TOKEN__`. `/ui` is public by auth policy. This is tolerable only in carefully constrained loopback usage and becomes severe when the UI is exposed to untrusted clients.
+
+## Repository Context
+
+- Root: `C:/Projects/dkg`
+- Current report: `agent-docs/backend-inline-html-audit.md`
+- Primary server files:
+  - `packages/cli/src/auth.ts`
+  - `packages/cli/src/daemon/lifecycle.ts`
+  - `packages/cli/src/daemon/http-utils.ts`
+  - `packages/node-ui/src/api.ts`
+- Primary browser files:
+  - `packages/node-ui/src/ui/api.ts`
+  - `packages/node-ui/src/ui/api-wrapper.ts`
+  - `packages/node-ui/src/ui/hooks/useNodeEvents.ts`
+  - `packages/node-ui/src/ui/hooks/useCurrentAgent.ts`
+  - `packages/node-ui/src/ui/web3/clients.ts`
+- Primary verification surfaces:
+  - `packages/cli/test/auth.test.ts`
+  - `packages/cli/test/daemon-http-behavior-extra.test.ts`
+  - `packages/cli/test/dkg-doctor.test.ts`
+  - `packages/node-ui/test/api-routes.test.ts`
+  - `packages/node-ui/test/ui-api-pure.test.ts`
+  - `packages/node-ui/e2e/`
+  - `scripts/devnet-test-node-ui-smoke.sh`
+
+## Team Roles
+
+Security architecture teammate:
+- Threat-model loopback, public bind, reverse proxy, shared-host, XSS, CSRF, DNS rebinding, token leakage, and SSE query-token behavior.
+- Recommend severity by deployment mode.
+- Recommend the target browser-session architecture and defense-in-depth controls.
+
+Daemon/backend implementation teammate:
+- Inspect `/ui` static serving, auth guard ordering, token loading, CORS defaults, `apiHost`, doctor integration, and smoke scripts.
+- Identify safe migration points and compatibility risks.
+- Preserve existing CLI/machine bearer-token behavior.
+
+Frontend/UX teammate:
+- Inspect all usage of `window.__DKG_TOKEN__`, `authHeaders`, API wrappers, EventSource, mock fallback, wallet/PCA flows, and e2e helpers.
+- Recommend local and remote dashboard UX states.
+- Ensure remote failures do not silently present demo data as healthy node state.
+
+QA/release teammate:
+- Inventory current tests and release gates.
+- Propose regression tests, CI/devnet checks, doctor checks, rollout artifacts, and acceptance criteria.
+- Identify what evidence a staff engineer would need before approving the migration.
+
+## Operating Rules
+
+- Do read-only analysis unless explicitly assigned a write scope.
+- Use one responsibility per teammate.
+- Return file and line evidence for claims.
+- Distinguish current behavior from recommended target behavior.
+- Do not collapse loopback and public exposure into one severity.
+- Do not recommend simply protecting `/ui` unless the bootstrap flow is replaced.
+- Keep bearer tokens available for CLI and machine clients, but remove daemon bearer tokens from browser JavaScript.
+- Prefer simple, staged migration over a flag day rewrite.
+
+## Deliverable
+
+Produce a concise but complete Markdown plan under `agent-docs/` that includes:
+
+- Executive summary
+- Current-state and desired-state flow diagrams in Mermaid
+- Root cause and risk analysis
+- Research conclusions from primary sources and standards
+- Recommended architecture
+- Implementation phases and concrete file/test targets
+- UX requirements
+- Rollout, rollback, observability, and acceptance criteria
+- Open decisions and questions