feat(security): token-issuance UI + served agent-skill (server-verified step-up; anon agent skill)#1619

Merged

JasonWildMe merged 10 commits into

mainfrom

token-ui-agent-skill

Jun 19, 2026

Commits on Jun 11, 2026

Add token-UI + agent-skill design spec & implementation plan (Codex-reviewed)

JasonWildMe
and
claude
committed
User: add checkPassword(clearText) for fresh credential verification

JasonWildMe
and
claude
committed
AuthToken: server-side step-up — require+verify fresh Basic, reject session-only

JasonWildMe
and
claude
committed
agent-skill: add curated agent-skill markdown resource

JasonWildMe
and
claude
committed
agent-skill: serve curated skill at GET /api/v3/agent-skill (anon) + SearchApi allowlist constant + drift-guard

JasonWildMe
and
claude
committed
frontend: useMintToken hook (cookie-less step-up Basic mint)

JasonWildMe
and
claude
committed
frontend: ApiAccessPage — step-up modal + one-time token display

JasonWildMe
and
claude
committed
frontend: route /api-access + API Access avatar menu item

JasonWildMe
and
claude
committed

Commits on Jun 12, 2026

token-ui: fold final review — UTF-8 Basic, assert real mint 200, guard username, copy fix

JasonWildMe
and
claude
committed

Commits on Jun 14, 2026

docs(agent-skill): drop dangling field-reference pointer, add References section

JasonWildMe
and
claude
committed