feat(dashboard): one-shot model connect, live connect-check, setup checklist

[aaronjmars]

Stacks on #1158 (credential manifest). The base is feat/aeon-init-credential-manifest, so this diff shows only the dashboard work. Merge #1158 first, then retarget this PR to main.

What

Connecting a model harness in the local dashboard is now one modal and two steps, followed by a live check that the credential really works on GitHub.

• One ConnectModal replaces AuthModal, GrokAuthModal and HarnessAuthModal. It adapts to the harness:
  • Step 1, run this on your computer: the exact command with a Copy button. Examples: claude setup-token, or codex login && tar -czf - -C ~ .codex/auth.json | base64 | pbcopy (there is also a Linux variant that prints the result). Key-only harnesses (pi, vibe, fx, cursor) get "get a key" links instead. It also shows the ./aeon auth ... command for people working inside their repo.
  • Step 2, paste the result: one box. Before you save, it shows what it detected, e.g. "Detected: Claude subscription -> CLAUDE_CODE_OAUTH_TOKEN".
    • Keys are recognized by prefix (sk-ant-oat, sk-ant-api, sk-or-, sk-, xai-, bk_, inf_).
    • Login captures are base64 tar.gz archives that the server opens and maps to CODEX_AUTH / KIMI_AUTH / HERMES_AUTH / GROK_CREDENTIALS.
    • A small provider dropdown covers keys with no prefix (UsePod, Venice, GLM, HivemindOS, Mistral, Moonshot, Cursor, AI Gateway).
  • Other ways:
    • One-click OpenRouter (OAuth PKCE in a popup) on every harness that takes OPENROUTER_API_KEY.
    • Only when the dashboard runs locally:
      • Do it for me runs the existing CLI login flows.
      • Found on this machine lists existing CLI logins and model env keys by name only, never values.
• Test connection: after any save, a tiny new connect-check skill runs on GitHub. The page (not the modal) follows the run, so HQ keeps updating after you close the modal.
  • For harnesses that report token counts, it only goes green if the run succeeded and the model used more than zero tokens.
  • cursor, kimi and vibe (token_usage: none in the manifest) pass on a successful run whose answer is exactly AEON_CONNECT_OK.
  • On failure it gives the reason and a next step. Example: a rejected Claude subscription token says to remove CLAUDE_CODE_OAUTH_TOKEN, and offers a one-click Remove subscription token button.
• Telegram chat id without copy-paste:
  • After the bot token is saved, Settings shows a t.me/<bot>?start=<code> link.
  • The server polls getUpdates without an offset and saves TELEGRAM_CHAT_ID when the /start <code> message arrives.
  • It falls back to the manual helper if the bot uses a webhook or has 100+ unread updates.
• ./aeon init tests the model too. After the model step, a new "Test connection" step asks first (default yes; without a terminal it only runs with --yes; --no-test skips it). It dispatches connect-check through the same lib the dashboard uses and reports either pass with the token count, or fail with the reason, the next step and ./aeon secrets rm CLAUDE_CODE_OAUTH_TOKEN when the subscription token is the cause. The result is a row in the Summary. An instance that predates connect-check is told to update instead of dispatching a run that would fail.
• HQ auto-test: when a model key exists but no check has ever run for the active harness (e.g. right after ./aeon init --no-test), HQ starts one automatically, once per repo and harness, remembered in localStorage. The checklist button reads "Test connection".
• HQ setup checklist, shown until everything is done: repo connected, Actions enabled, model connected and verified, notifications, first skill run. Each row has one action button.
• The top bar Auth button and the Settings Connect buttons open the ConnectModal.
• Other changes:
  • HIVEMINDOS_CREDIT_TOKEN is listed in Settings.
  • ensureActionsCanOpenPRs no longer forces default_workflow_permissions=write. It reads the current settings and only turns on PR creation.
  • aeon sync (lib/sync.ts) now pushes the same way as commitAndPush: git push origin HEAD:<branch> with one rebase-and-retry. It refuses, before committing, when origin is the Aeon template or missing. Both use the shared helpers originRefusal and pushHeadToOrigin in lib/github.ts.

Why

Connecting a model used to mean three different modals and knowing which secret name to use. The worst problem was a Claude subscription token: it saves fine, but GitHub runners often reject it, so the first real run exits instantly with zero usage. The live check catches that right away and says what to do.

How

• One source of truth. lib/manifest.ts imports harness-adapter/harnesses.json and gateways.json from feat: aeon init + credential manifest with drift test #1158.
  • Detection takes its prefixes, labels and provider list from them.
  • The step 1 commands take the login command, ./aeon auth command, credential paths and get-a-key links from them.
  • The connect check takes token_usage from them.
  • Only UI wording and the OS clipboard wrapper are local.
  • next.config.ts sets the turbopack root to the repo so the JSON can be imported.
• Pure modules, easy to copy to the hosted fork:
  • connect-detect.ts: detection, the tar check and re-pack
  • connect-commands.ts
  • connect-check.ts: log slicing, the verdict and the poller
  • telegram-link.ts
  • openrouter-oauth.ts
• Server modules: connect-server.ts and connect-check-server.ts.
• Short-lived state goes through KvStore in lib/connect-store.ts (get / set with TTL / take / del). It is in memory here; Upstash Redis can be swapped in for the hosted fork.
• Capture safety.
  • The server reads every pax record and uses the last path, as tar does.
  • It allows only metadata pax keys. It refuses size/linkpath/GNU.sparse records, global headers, long-name records, links and special files, and checks header checksums.
  • It then stores a clean re-pack of just the verified regular files, never the pasted bytes.
  • The runner's own restore (base64 -d | tar xzf - -C $HOME) is tested against the re-pack.
• Reading the connect-check run.
  • Real gh run view --log output (gh 2.10x) says UNKNOWN STEP for every line, and a logs zip often has no per-step files. So the slice is anchored on the last Token usage ... input: N notice: it runs from the end of the nearest ##[group]Run script block up to that notice, with group blocks dropped. Real step names are used as a fast path when present.
  • Failure patterns read only ##[error]/##[warning] lines plus that sliced output. The workflow script text (which mentions rate_limited) is never read.
  • The answer is the line right before the notice (the echo "$RESULT_TEXT" line; the harness stderr tail comes before it), so an echoed prompt or an empty result never counts.
  • "Remove subscription token" is only offered when the run succeeded, reached the model call, and reported zero usage.
• connect-check is dispatched with -f harness=<h> -f dispatch_id=cc-<h>-<random> and found again by the [dispatch: ...] run-name suffix.
• New skill skills/connect-check is read-only and on demand only (enabled: false, schedule: "workflow_dispatch").
  • The catalog was regenerated in a separate commit.
  • Its eyebrowlock entry comes from a scan by the CI-pinned eyebrow v0.5.6 (checksum verified).
  • Skill counts are updated.

Verified

• apps/dashboard: npm run typecheck, npm run lint (0 errors; the existing warnings are unchanged), and npm run build pass. npm test passes 303 tests. They include the review regressions:
  • a sanitized skeleton of a real gh log (lib/fixtures/connect-check-run.log): pass with tokens, zero usage giving the subscription hint, failed-before-model with no fix, and the zip form
  • the repeated pax path attack, non-finite or huge pax mtime, and files named like folders
  • refused pax keys and record types
  • the re-pack restoring through the runner's command
  • zero usage not being called rate-limited
  • token_usage-none pass and fail, including a log that echoes the prompt with no real answer
  • the subscription remove-advice and fix
  • page-level polling with timeout and cancel
  • the Telegram backlog case, and 409 webhook vs transient
  • the workflow-permissions change
  • the gateway sync for direct Claude credentials
• apps/cli: typecheck and lint pass, and apps/cli/test/init-sandbox.sh passes. fake-gh now answers workflow run / run list / run view from the fixture log. The new sandbox cases: pass with 22584 tokens, zero-usage fail with the remove command, --no-test, no dispatch without confirmation, and an instance without the skill.
• The new log reader was also checked against two real logs (aeon-agent run 34677070781, miroshark-aeon run 36101660961): both pass with their token counts.
• lib/sync-push.test.ts tests aeon sync against real local git repos: a branch tracking the template, rebase-and-retry, the template refusal, and a missing origin.
• Scripts:
  • scripts/tests/test_credential_manifest.sh: 266 checks pass.
  • The ci-tests scripts for skill registration, model choices, harness choices and manifests pass: skill_mode, skill_requires, all_secrets_allowlist, validate_readme_catalog, validate_skill_packs, dashboard_model_choices, workflow_harness_choices, generate_harnesses_json, readonly_notify, resolve_harness.
• Skill gates pass:
  • the regenerate-and-diff steps of ci-skills-json and ci-packs-json (LC_ALL=C)
  • generate-skill-icons --check
  • validate-readme-catalog
  • check-skill-categories
  • validate-config
  • gen-agents-md --check
  • the eyebrow "lockfile covers every skill" loop
• Dashboard screenshots via agent-browser on a random local port: HQ checklist; Connect modals for Claude, Codex and Pi; paste previews. After the manifest change, the Claude modal shows the manifest command ./aeon auth --harness claude-code and the OpenRouter key detection.
• Nothing was saved or dispatched while testing.

Not verified live

• A real OpenRouter code exchange (needs a signed-in account).
• A real connect-check run on an instance.
• The Telegram link against a real bot.