helmd hub: central server på Pi5 + agent-uplink + helmd ctl + web-login

Hub-läge i samma binär (doc/hub-plan.md): agenter ansluter utåt med
delad agent-nyckel (hub-sektion i config.json), web-/CLI-klienter
loggar in (lokala konton, pbkdf2; Authenticator-interface för LDAP
senare) och styr alla agenters sessioner via proxy + merged SSE.
Webbklienten autodetekterar hub/local via /api/mode. Nya kommandon:
helmd hub [setpass|users|agentkey], helmd ctl (login/agents/sessions/
prompt/screen/answer/events …). Enhetstester + scripts/run-hub-smoke.sh
(15-stegs e2e: hub + agent + ctl).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011KikHkfCiC3yELbsMN8fT9

helmd/scripts/run-hub-smoke.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+# End-to-end-smoke för hub-flödet: hub + agent (bash i tmux) + ctl.
+# Kör allt lokalt och isolerat (egen XDG_CONFIG_HOME i en temp-katalog)
+# — rör inte dina riktiga configs, men kräver tmux på maskinen.
+#
+#   bash scripts/run-hub-smoke.sh
+set -u
+cd "$(dirname "$0")/.."
+BIN="$PWD/build/helmd"
+[ -x "$BIN" ] || { echo "bygg först: CGO_ENABLED=0 go build -o build/helmd ."; exit 2; }
+
+SCRATCH=$(mktemp -d /tmp/helm-hub-smoke.XXXXXX)
+export XDG_CONFIG_HOME="$SCRATCH/cfg"
+mkdir -p "$XDG_CONFIG_HOME/helmd"
+
+PASS=0; FAIL=0
+ok()   { PASS=$((PASS+1)); echo "ok  $1"; }
+fail() { FAIL=$((FAIL+1)); echo "FAIL $1"; }
+
+cleanup() {
+  kill "${HUB_PID:-}" "${AGENT_PID:-}" 2>/dev/null
+  tmux kill-session -t helm-smoketest 2>/dev/null
+  rm -rf "$SCRATCH"
+}
+trap cleanup EXIT
+
+# --- 1. starta hubben ---
+HELMD_HUB_ADMIN_PASSWORD=testpass "$BIN" hub --listen 127.0.0.1:18790 \
+  >"$SCRATCH/hub.log" 2>&1 &
+HUB_PID=$!
+sleep 1
+curl -sf http://127.0.0.1:18790/api/mode | grep -q '"hub"' && ok "hubben svarar med mode=hub" || fail "hubben svarar inte"
+
+AGENTKEY=$("$BIN" hub agentkey)
+[ -n "$AGENTKEY" ] && ok "agentkey läsbar ur hub-config" || fail "ingen agentkey"
+
+# --- 2. agent-config med hub-sektion (configfilen väljer server) ---
+cat > "$XDG_CONFIG_HOME/helmd/config.json" <<EOF
+{
+  "listen": "127.0.0.1:18788",
+  "token": "smoke-local-token",
+  "agent_cmd": "bash",
+  "agent_args": [],
+  "workdir": "$SCRATCH",
+  "share_dir": "$SCRATCH/shares",
+  "share_exts": [".txt", ".md"],
+  "poll_ms": 300,
+  "cols": 120, "rows": 30,
+  "ntfy": {"server": "", "topic": "", "allowed_topics": [], "enabled": false, "notify_on_question": false},
+  "hub": {"url": "http://127.0.0.1:18790", "name": "smokeagent", "key": "$AGENTKEY", "enabled": true}
+}
+EOF
+"$BIN" serve >"$SCRATCH/agent.log" 2>&1 &
+AGENT_PID=$!
+sleep 2
+
+# --- 3. ctl: login (fel + rätt lösenord) ---
+"$BIN" ctl login --server http://127.0.0.1:18790 --user admin --password fellösen >/dev/null 2>&1 \
+  && fail "login med fel lösenord gick igenom" || ok "login med fel lösenord avvisas"
+"$BIN" ctl login --server http://127.0.0.1:18790 --user admin --password testpass >/dev/null \
+  && ok "ctl login" || fail "ctl login"
+
+# --- 4. agenten syns och är online ---
+"$BIN" ctl agents | grep -q "smokeagent.*online" && ok "agenten online i ctl agents" || fail "agent inte online"
+
+# --- 5. agentkey via inloggad klient ---
+[ "$("$BIN" ctl agentkey)" = "$AGENTKEY" ] && ok "ctl agentkey matchar hub-config" || fail "ctl agentkey"
+
+# --- 6. session: skapa, prompta, läsa skärm ---
+"$BIN" ctl new smokeagent smoketest --cmd bash >/dev/null && ok "ctl new" || fail "ctl new"
+sleep 1
+"$BIN" ctl prompt smokeagent smoketest "echo HUB_FLOW_WORKS_42" >/dev/null && ok "ctl prompt" || fail "ctl prompt"
+sleep 1.5
+"$BIN" ctl screen smokeagent smoketest | grep -q "HUB_FLOW_WORKS_42" && ok "ctl screen visar output" || fail "ctl screen"
+"$BIN" ctl sessions smokeagent | grep -q "smoketest" && ok "ctl sessions listar" || fail "ctl sessions"
+"$BIN" ctl keys smokeagent smoketest Enter >/dev/null && ok "ctl keys" || fail "ctl keys"
+
+# --- 7. events-strömmen ---
+timeout 6 "$BIN" ctl events > "$SCRATCH/events.out" 2>/dev/null &
+EV_PID=$!
+sleep 1
+"$BIN" ctl prompt smokeagent smoketest "echo EVENT_TRIGGER" >/dev/null
+wait $EV_PID 2>/dev/null
+grep -q "smokeagent" "$SCRATCH/events.out" && ok "events strömmar med agentnamn" || fail "inga events"
+
+# --- 8. lokala API:t funkar parallellt (graceful degradation) ---
+curl -sf -H "Authorization: Bearer smoke-local-token" http://127.0.0.1:18788/api/sessions \
+  | grep -q "smoketest" && ok "lokalt API parallellt med hubben" || fail "lokalt API"
+
+# --- 9. städa session ---
+"$BIN" ctl kill smokeagent smoketest >/dev/null && ok "ctl kill" || fail "ctl kill"
+
+# --- 10. fel agent-nyckel avvisas ---
+CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST http://127.0.0.1:18790/hub/register \
+  -H 'Content-Type: application/json' -d '{"name":"evil","host":"x","version":"x","key":"fel"}')
+[ "$CODE" = "401" ] && ok "registrering med fel agent-nyckel → 401" || fail "fel nyckel gav $CODE"
+
+echo
+echo "RESULTAT: $PASS ok, $FAIL fail"
+[ "$FAIL" = 0 ]