From 7a21a577b563f3d84ec2c710476dad8e281df7a3 Mon Sep 17 00:00:00 2001
From: Brett Chien <brettchien@users.noreply.github.com>
Date: Sat, 29 Aug 2026 21:39:50 +0800
Subject: [PATCH] fix(console): chat token/secret visibility bug + add ACP
 token field (studio#132/#136)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two things Brett caught live-testing the wizard (screenshot: Bot token +
Channel secret both showing with Chat platform = "— none —").

## Bug: hidden chat token/secret fields stayed visible

`.compose-form label { display: flex; ... }` has higher specificity
((0,1,1)) than the UA stylesheet's `[hidden] { display: none }` ((0,1,0)),
so toggling `.hidden` on `#deploy-chat-token-wrap`/`#deploy-chat-secret-wrap`
(both <label> elements inside .compose-form) did nothing — same CSS
gotcha already hit once in studio#83's implementation (see that memory),
missed again here since this sandbox can't render the app to catch it.
Added `.compose-form label[hidden] { display: none }` to force the
override, plus the same fix for `.deploy-identity label[hidden]` (the k8s
"new namespace" field has the identical latent bug, unconfirmed live but
same root cause — fixed proactively).

## Feature: ACP token field + Generate button

Brett: "when ACP is enabled, need a field for acp token, and we should
provide a token generator button." Previously the ACP auth key was always
silently auto-generated server-side (uuid v4) with no way for the operator
to see or choose it ahead of deploy.

- console: new "ACP token" field + Generate button (client-side
  crypto.randomUUID(), same shape the server generates), visible only
  while Enable ACP is checked+enabled (reuses the same show/hide-on-toggle
  pattern as the chat platform fields, via a new applyAcpMode() helper).
- studio-cp: AgentWizardInput gained acp_token: Option<String>.
  provision_acp_auth_secret/provision_acp_auth_k8s_secret now take a
  token: Option<&str> — use it if the caller supplied one, else generate
  as before (backward compatible: the compose-library path still always
  passes None). build_default_manifest/build_default_k8s_manifest thread
  it through; all 4 call sites updated.
- oab-mcp: deploy_provision_agent's schema gained acp_token (optional).
- src-tauri: bridge command threads the new param through.

Verification: npm run typecheck clean, npm test 100/100 passing, npm run
build succeeds. Rust side not locally compiled — same pre-existing
limitation as every other Rust change this week.
---
 console/index.html          |  7 ++++
 console/src/deploy.ts       | 26 +++++++++++++++
 console/src/styles.css      | 14 ++++++++
 crates/oab-mcp/src/lib.rs   |  2 ++
 crates/studio-cp/src/lib.rs | 65 +++++++++++++++++++++++++++----------
 src-tauri/src/lib.rs        |  4 +++
 6 files changed, 101 insertions(+), 17 deletions(-)

diff --git a/console/index.html b/console/index.html
index c01a320..747e9be 100644
--- a/console/index.html
+++ b/console/index.html
@@ -189,6 +189,13 @@
                 <p class="config-hint" id="deploy-acp-agy-hint" hidden>
                   agy doesn't support ACP — disabled for this vendor.
                 </p>
+                <label id="deploy-acp-token-wrap"
+                  >ACP token
+                  <span class="compose-name-row">
+                    <input id="deploy-acp-token" class="compose-input" type="password" spellcheck="false" autocomplete="off" />
+                    <button type="button" id="deploy-acp-token-generate" class="cfg-btn cfg-btn-ghost" title="Generate a random token">Generate</button>
+                  </span>
+                </label>
                 <label
                   >Agent name
                   <span class="compose-name-row">
diff --git a/console/src/deploy.ts b/console/src/deploy.ts
index e87710e..d09b5ec 100644
--- a/console/src/deploy.ts
+++ b/console/src/deploy.ts
@@ -140,6 +140,9 @@ export function initDeployPanel(deps: DeployPanelDeps): DeployPanelHandle | null
   const chatSecretInput = document.getElementById("deploy-chat-secret") as HTMLInputElement | null;
   const acpCheckbox = document.getElementById("deploy-acp-enabled") as HTMLInputElement | null;
   const acpAgyHint = document.getElementById("deploy-acp-agy-hint");
+  const acpTokenWrap = document.getElementById("deploy-acp-token-wrap");
+  const acpTokenInput = document.getElementById("deploy-acp-token") as HTMLInputElement | null;
+  const acpTokenGenerateBtn = document.getElementById("deploy-acp-token-generate") as HTMLButtonElement | null;
   const agentNameInput = document.getElementById("deploy-name") as HTMLInputElement | null;
   const agentNameShuffleBtn = document.getElementById("deploy-name-shuffle") as HTMLButtonElement | null;
   const deployBtn = document.getElementById("deploy-deploy-btn") as HTMLButtonElement | null;
@@ -174,6 +177,9 @@ export function initDeployPanel(deps: DeployPanelDeps): DeployPanelHandle | null
     !chatSecretInput ||
     !acpCheckbox ||
     !acpAgyHint ||
+    !acpTokenWrap ||
+    !acpTokenInput ||
+    !acpTokenGenerateBtn ||
     !agentNameInput ||
     !agentNameShuffleBtn ||
     !deployBtn
@@ -203,6 +209,16 @@ export function initDeployPanel(deps: DeployPanelDeps): DeployPanelHandle | null
     }
   };
 
+  // studio#136: the ACP token field only makes sense while ACP itself is
+  // on — hidden (not just left blank) when the checkbox is unchecked or
+  // disabled, same show/hide-on-selection pattern as the chat token
+  // fields above.
+  const applyAcpMode = (): void => {
+    const enabled = acpCheckbox.checked && !acpCheckbox.disabled;
+    acpTokenWrap.hidden = !enabled;
+    if (!enabled) acpTokenInput.value = "";
+  };
+
   // studio#128: agy's bridge bypasses openab-gateway's /acp route entirely
   // (confirmed by reading agy-acp/src/main.rs) — forced off, not just
   // defaulted off, so a leftover checked state from a previous vendor can't
@@ -215,6 +231,7 @@ export function initDeployPanel(deps: DeployPanelDeps): DeployPanelHandle | null
     acpCheckbox.disabled = isAgy;
     acpAgyHint.hidden = !isAgy;
     if (isAgy) acpCheckbox.checked = false;
+    applyAcpMode();
     deviceAuthHint.hidden = !DEVICE_AUTH_VENDORS.has(vendor);
   };
 
@@ -383,6 +400,14 @@ export function initDeployPanel(deps: DeployPanelDeps): DeployPanelHandle | null
     void loadVendorImage();
   });
   chatPlatformSel.addEventListener("change", applyChatPlatformMode);
+  acpCheckbox.addEventListener("change", applyAcpMode);
+  acpTokenGenerateBtn.addEventListener("click", () => {
+    // Same shape the sidecar generates itself (uuid v4) when this field is
+    // left blank — a convenience for operators who want to know the token
+    // before deploying (e.g. to hand it to a client ahead of time), not a
+    // requirement: an empty field still gets a server-generated one.
+    acpTokenInput.value = crypto.randomUUID();
+  });
   agentNameShuffleBtn.addEventListener("click", () => {
     agentNameInput.value = randomGreekName();
   });
@@ -487,6 +512,7 @@ export function initDeployPanel(deps: DeployPanelDeps): DeployPanelHandle | null
         chat_bot_token: chatTokenInput.value.trim() || undefined,
         chat_channel_secret: chatSecretInput.value.trim() || undefined,
         acp_enabled: acpCheckbox.checked,
+        acp_token: acpCheckbox.checked ? acpTokenInput.value.trim() || undefined : undefined,
         ...(isK8s ? { provider: "k8s", context, expected_principal: expectedPrincipal } : {}),
       });
     } catch (e) {
diff --git a/console/src/styles.css b/console/src/styles.css
index 9d89a8d..a3bfb55 100644
--- a/console/src/styles.css
+++ b/console/src/styles.css
@@ -1328,6 +1328,15 @@ button.act:disabled {
   font-size: 12px;
   color: var(--muted);
 }
+/* studio#128/#136 bug (Brett caught live): `.compose-form label`'s own
+   `display: flex` has equal-or-higher specificity than the UA stylesheet's
+   `[hidden] { display: none }`, so toggling `.hidden` on a <label> inside
+   `.compose-form` (chat token/secret wraps) did nothing — same CSS gotcha
+   already hit once in studio#83's implementation (see that memory). Force
+   the override explicitly rather than relying on cascade order. */
+.compose-form label[hidden] {
+  display: none;
+}
 .compose-select {
   padding: 6px 8px;
   border: 1px solid var(--border);
@@ -1491,6 +1500,11 @@ button.act:disabled {
   font-size: 12px;
   color: var(--muted);
 }
+/* Same specificity gotcha as `.compose-form label[hidden]` above — applies
+   here too (the k8s "new namespace" field). */
+.deploy-identity label[hidden] {
+  display: none;
+}
 .deploy-compose-head {
   font-size: 12px;
   font-weight: 600;
diff --git a/crates/oab-mcp/src/lib.rs b/crates/oab-mcp/src/lib.rs
index 87e0c04..f7ea033 100644
--- a/crates/oab-mcp/src/lib.rs
+++ b/crates/oab-mcp/src/lib.rs
@@ -179,6 +179,7 @@ pub fn tools() -> Vec<Tool> {
                     "chat_bot_token": { "type": "string", "description": "Discord/Telegram bot token, or LINE's channel access token." },
                     "chat_channel_secret": { "type": "string", "description": "LINE only." },
                     "acp_enabled": { "type": "boolean", "description": "Enable the reverse-MCP-over-ACP tunnel on this agent. Defaults to true when omitted (studio#119: Studio-deployed agents default to ACP on). Not honorable for every vendor — the caller is responsible for not setting this true for a vendor that can't support it (e.g. agy, whose bridge bypasses /acp entirely)." },
+                    "acp_token": { "type": "string", "description": "Optional (studio#136), only meaningful when acp_enabled is true. The OPENAB_ACP_AUTH_KEY to use, instead of generating a random one." },
                     "provider": { "type": "string", "description": "\"aws\" (default) or \"k8s\" — which driver applies the result." },
                     "fleet": { "type": "string", "description": "AWS only. Fleet name (see fleet_config): targets the fleet's cluster and managing credential; a write to a service outside the fleet's members is refused. Overrides the cluster arg." },
                     "cluster": { "type": "string", "description": "AWS only. ECS cluster (defaults to the server's configured cluster)." },
@@ -736,6 +737,7 @@ impl OabMcp {
             // build_default_manifest's original hardcoded behavior before
             // studio#128 made it caller-controlled.
             acp_enabled: args.get("acp_enabled").and_then(Value::as_bool).unwrap_or(true),
+            acp_token: args.get("acp_token").and_then(Value::as_str).map(str::to_string),
         };
 
         if args.get("provider").and_then(Value::as_str) == Some("k8s") {
diff --git a/crates/studio-cp/src/lib.rs b/crates/studio-cp/src/lib.rs
index ba71823..031f1b3 100644
--- a/crates/studio-cp/src/lib.rs
+++ b/crates/studio-cp/src/lib.rs
@@ -1058,11 +1058,13 @@ fn default_config_from_uri(bucket: &str, namespace: &str, name: &str) -> String
     format!("s3://{bucket}/{}/config.toml", studio_compose::artifacts_prefix(namespace, name))
 }
 
-/// Generates a random `OPENAB_ACP_AUTH_KEY` and stores it in Secrets
-/// Manager under the same `oab/{namespace}/{name}` convention `oabctl
-/// create`'s CLI wizard uses for the Discord bot token (studio#119
-/// follow-up — Studio-deployed agents default to ACP enabled). Fresh JSON
-/// blob rather than a read-merge-write: this only ever runs from
+/// Stores an `OPENAB_ACP_AUTH_KEY` in Secrets Manager under the same
+/// `oab/{namespace}/{name}` convention `oabctl create`'s CLI wizard uses
+/// for the Discord bot token (studio#119 follow-up — Studio-deployed
+/// agents default to ACP enabled). Uses `token` if the caller supplied one
+/// (studio#136 — the wizard's "Generate" button / operator-typed value),
+/// otherwise generates a fresh one. Fresh JSON blob rather than a
+/// read-merge-write: this only ever runs from
 /// `build_default_manifest`/`build_default_k8s_manifest`, both exclusively
 /// on the first-ever-deploy path, so nothing else has written to this
 /// secret name yet at this point in the flow.
@@ -1070,10 +1072,11 @@ async fn provision_acp_auth_secret(
     aws_config: &aws_config::SdkConfig,
     namespace: &str,
     name: &str,
+    token: Option<&str>,
 ) -> anyhow::Result<String> {
     let sm = aws_sdk_secretsmanager::Client::new(aws_config);
     let secret_name = format!("oab/{namespace}/{name}");
-    let key = uuid::Uuid::new_v4().to_string();
+    let key = token.map(str::to_string).unwrap_or_else(|| uuid::Uuid::new_v4().to_string());
     let secret_obj = serde_json::json!({ "OPENAB_ACP_AUTH_KEY": key });
     oabctl::create::store_secret(&sm, &secret_name, &secret_obj.to_string()).await?;
     Ok(format!("aws-sm://{secret_name}#OPENAB_ACP_AUTH_KEY"))
@@ -1098,12 +1101,13 @@ async fn build_default_manifest(
     image: &str,
     bucket: &str,
     acp_enabled: bool,
+    acp_token: Option<&str>,
 ) -> anyhow::Result<oabctl::manifest::OABServiceManifest> {
     let net = oabctl::create::default_networking(aws_config, name).await?;
     let config_from = default_config_from_uri(bucket, namespace, name);
     let mut secrets = std::collections::HashMap::new();
     if acp_enabled {
-        let acp_auth_ref = provision_acp_auth_secret(aws_config, namespace, name).await?;
+        let acp_auth_ref = provision_acp_auth_secret(aws_config, namespace, name, acp_token).await?;
         secrets.insert("OPENAB_ACP_AUTH_KEY".to_string(), acp_auth_ref);
     }
     Ok(oabctl::manifest::OABServiceManifest {
@@ -1219,7 +1223,7 @@ pub async fn provision_from_library(
             // (compose-library) path; the caller-controlled toggle is
             // studio#128's wizard-only `provision_agent`.
             let mut manifest =
-                build_default_manifest(aws_config, namespace, name, &image, &bucket, true).await?;
+                build_default_manifest(aws_config, namespace, name, &image, &bucket, true, None).await?;
             manifest.spec.bundle_from = Some(oabctl::studio_api::bundle_from_uri(&bucket, namespace, name));
             oabctl::studio_api::provision_manifest(aws_config, cluster, &manifest, &objects, Some(&bucket))
                 .await?
@@ -1269,6 +1273,12 @@ pub struct AgentWizardInput {
     /// non-empty `chat_platform` regardless of this field — unrelated
     /// constraints.
     pub acp_enabled: bool,
+    /// studio#136: operator-supplied ACP auth key, wired through when
+    /// `acp_enabled` is true (ignored otherwise). `None`/empty falls back
+    /// to a freshly generated one, same as before this field existed —
+    /// this is a convenience for an operator who wants to know the token
+    /// ahead of deploy, not a requirement.
+    pub acp_token: Option<String>,
 }
 
 /// Stores [`AgentWizardInput`]'s secret-bearing fields in the same
@@ -1473,8 +1483,16 @@ pub async fn provision_agent(
             .await?
         }
         None => {
-            let mut manifest =
-                build_default_manifest(aws_config, namespace, name, image, &bucket, input.acp_enabled).await?;
+            let mut manifest = build_default_manifest(
+                aws_config,
+                namespace,
+                name,
+                image,
+                &bucket,
+                input.acp_enabled,
+                input.acp_token.as_deref(),
+            )
+            .await?;
             manifest.spec.bundle_from = Some(oabctl::studio_api::bundle_from_uri(&bucket, namespace, name));
             oabctl::studio_api::provision_manifest(aws_config, cluster, &manifest, &objects, Some(&bucket))
                 .await?
@@ -1567,6 +1585,7 @@ pub async fn provision_agent_k8s(
                 &bucket,
                 expected_principal,
                 input.acp_enabled,
+                input.acp_token.as_deref(),
             )
             .await?
         }
@@ -1605,9 +1624,10 @@ fn k8s_service_account_from_principal(expected_principal: Option<&str>) -> Optio
         .map(|(_namespace, name)| name.to_string())
 }
 
-/// Generates a random `OPENAB_ACP_AUTH_KEY` and server-side-applies it into
-/// a k8s `Secret` named `{name}-acp` in `namespace` (studio#119 follow-up —
-/// k8s counterpart of [`provision_acp_auth_secret`]). `Patch::Apply` rather
+/// Server-side-applies an `OPENAB_ACP_AUTH_KEY` into a k8s `Secret` named
+/// `{name}-acp` in `namespace` (studio#119 follow-up — k8s counterpart of
+/// [`provision_acp_auth_secret`]). Uses `token` if the caller supplied one
+/// (studio#136), otherwise generates a fresh one. `Patch::Apply` rather
 /// than a plain `create()`: this only ever runs from
 /// `build_default_k8s_manifest` on the first-ever-deploy path, so a fresh
 /// object is expected, but apply is idempotent if a retried deploy attempt
@@ -1617,6 +1637,7 @@ async fn provision_acp_auth_k8s_secret(
     context: Option<&str>,
     namespace: &str,
     name: &str,
+    token: Option<&str>,
 ) -> anyhow::Result<String> {
     use k8s_openapi::api::core::v1::Secret;
     use k8s_openapi::apimachinery::pkg::apis::meta::v1::ObjectMeta;
@@ -1624,7 +1645,7 @@ async fn provision_acp_auth_k8s_secret(
 
     let client = k8s_client_for(context).await?;
     let secret_name = format!("{name}-acp");
-    let key = uuid::Uuid::new_v4().to_string();
+    let key = token.map(str::to_string).unwrap_or_else(|| uuid::Uuid::new_v4().to_string());
     let mut string_data = std::collections::BTreeMap::new();
     string_data.insert("OPENAB_ACP_AUTH_KEY".to_string(), key);
     let secret = Secret {
@@ -1664,11 +1685,12 @@ async fn build_default_k8s_manifest(
     bucket: &str,
     expected_principal: Option<&str>,
     acp_enabled: bool,
+    acp_token: Option<&str>,
 ) -> anyhow::Result<oabctl::manifest::OABServiceManifest> {
     let config_from = default_config_from_uri(bucket, namespace, name);
     let mut secrets = std::collections::HashMap::new();
     if acp_enabled {
-        let acp_auth_ref = provision_acp_auth_k8s_secret(context, namespace, name).await?;
+        let acp_auth_ref = provision_acp_auth_k8s_secret(context, namespace, name, acp_token).await?;
         secrets.insert("OPENAB_ACP_AUTH_KEY".to_string(), acp_auth_ref);
     }
     Ok(oabctl::manifest::OABServiceManifest {
@@ -1764,8 +1786,17 @@ pub async fn provision_from_library_k8s(
         // (compose-library) path; the caller-controlled toggle is
         // studio#128's wizard-only `provision_agent_k8s`.
         None => {
-            build_default_k8s_manifest(context, namespace, name, &image, &bucket, expected_principal, true)
-                .await?
+            build_default_k8s_manifest(
+                context,
+                namespace,
+                name,
+                &image,
+                &bucket,
+                expected_principal,
+                true,
+                None,
+            )
+            .await?
         }
     };
     manifest.spec.bundle_from = Some(oabctl::studio_api::bundle_from_uri(&bucket, namespace, name));
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index 6e551da..0d51b87 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -193,6 +193,7 @@ async fn deploy_provision_agent(
     chat_bot_token: Option<String>,
     chat_channel_secret: Option<String>,
     acp_enabled: Option<bool>,
+    acp_token: Option<String>,
     cluster: Option<String>,
     provider: Option<String>,
     context: Option<String>,
@@ -229,6 +230,9 @@ async fn deploy_provision_agent(
     if let Some(a) = acp_enabled {
         params["acp_enabled"] = json!(a);
     }
+    if let Some(t) = acp_token.filter(|s| !s.is_empty()) {
+        params["acp_token"] = json!(t);
+    }
     if let Some(p) = provider.filter(|s| !s.is_empty()) {
         params["provider"] = json!(p);
     }