feat: fleet secret auth - zero-setup agent authentication, dashboard WS token, remove credential hints

server/main.go

@@ -1,6 +1,8 @@
 package main
 
 import (
+	"crypto/rand"
+	"encoding/hex"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -38,6 +40,23 @@ func main() {
 	cfg.DataDir = resolveDataDir(cfg.DataDir, projectRoot)
 	log.Printf("Configuration loaded: port=%d, dataDir=%s (project root: %s)", cfg.Port, cfg.DataDir, projectRoot)
 
+	// Generate fleet secret once — persisted in config.json so all future forges
+	// carry the same secret and agents keep working across server restarts.
+	if cfg.Server.FleetSecret == "" {
+		b := make([]byte, 32)
+		if _, err := rand.Read(b); err != nil {
+			log.Fatalf("Failed to generate fleet secret: %v", err)
+		}
+		cfg.Server.FleetSecret = hex.EncodeToString(b)
+		if err := cfg.Save(); err != nil {
+			log.Printf("[auth] Warning: could not persist fleet secret: %v — agents forged this session will still work", err)
+		} else {
+			log.Printf("[auth] Fleet secret generated and saved — re-forge agents to pick it up")
+		}
+	} else {
+		log.Printf("[auth] Fleet secret loaded (first 8 chars: %s...)", cfg.Server.FleetSecret[:8])
+	}
+
 	// Ensure data directories exist
 	dirs := []string{
 		cfg.DataDir,
@@ -66,6 +85,7 @@ func main() {
 	// Initialize WebSocket hub
 	wsHub := api.NewWSHub(database)
 	wsHub.SetAIHandler(aiHandler)
+	wsHub.SetFleetSecret(cfg.Server.FleetSecret)
 	aiHandler.SetEventBroadcaster(func(entry api.AIActivityEntry) {
 		wsHub.BroadcastAIActivity(entry)
 	})
@@ -78,6 +98,7 @@ func main() {
 	// The agent source is expected at ../agent relative to the server directory
 	agentSrcDir := findAgentSourceDir()
 	builderHandler := builder.NewHandler(database, cfg.DataDir, agentSrcDir, projectRoot)
+	builderHandler.SetFleetSecret(cfg.Server.FleetSecret)
 	log.Printf("Builder handler initialized (agent source: %s)", agentSrcDir)
 
 	defaultPoolCfg := pool.Config{