hub: named long-lived machine tokens, minted + revoked from the Machines page

'slmk_' tokens are hashed at rest in the hub's tokens.json, accepted anywhere a
bearer is, individually revocable, and survive restarts — so a worker can run
unattended past the 12h session-token TTL. The raw value is shown exactly once.

Author: patel-lyzr

frontend/src/api.ts

@@ -175,6 +175,13 @@ export interface WorkerInfo {
   last_seen: number; online: boolean; queued: number;
 }
 export const getWorkers = () => api<{ workers: WorkerInfo[] }>("/v1/workers");
+export interface MachineToken { name: string; created: number }
+export const getTokens = () => api<{ tokens: MachineToken[] }>("/v1/tokens");
+export const createToken = (name: string) =>
+  api<{ name: string; token: string }>("/v1/tokens", {
+    method: "POST", body: JSON.stringify({ name }) });
+export const revokeToken = (name: string) =>
+  api<{ ok: boolean }>(`/v1/tokens/${encodeURIComponent(name)}`, { method: "DELETE" });
 export const getJobs = () => api<{ jobs: JobSummary[] }>("/v1/finetunes");
 export const getJob = (id: string) => api<JobDetail>(`/v1/finetunes/${id}`);
 export const getMetrics = (id: string) =>

frontend/src/pages/Machines.tsx

@@ -1,38 +1,92 @@
 // Machines — every device serving this hub via `shadowlm worker`.
 import { useEffect, useState } from "react";
-import { Check, Copy, MonitorSmartphone } from "lucide-react";
-import { apiKey, getWorkers } from "../api";
-import type { WorkerInfo } from "../api";
+import { Check, Copy, KeyRound, MonitorSmartphone, Trash2 } from "lucide-react";
+import { createToken, getTokens, getWorkers, revokeToken } from "../api";
+import type { MachineToken, WorkerInfo } from "../api";
 import { PageHeader } from "../ui";
 
-function ConnectCmd() {
+function CopyBtn({ text }: { text: string }) {
   const [copied, setCopied] = useState(false);
-  const token = apiKey.get();
-  // your own studio session token — same credential, ~12h validity; reconnects
-  // after expiry need a fresh one from a new login
-  const cmd = `shadowlm worker --hub ${window.location.origin} --name my-machine` +
-    (token ? ` --api-key ${token}` : "");
-  const copy = () => {
-    navigator.clipboard.writeText(cmd).then(() => {
-      setCopied(true);
-      setTimeout(() => setCopied(false), 1500);
-    });
-  };
   return (
-    <div className="space-y-1.5">
-      <div className="flex items-start gap-2">
-        <pre className="flex-1 overflow-x-auto text-left text-xs font-mono bg-accent/40 border border-border rounded-md px-4 py-2.5">
-          {cmd}
-        </pre>
-        <button onClick={copy} title="copy"
-                className="shrink-0 p-2 rounded-md border border-border text-muted-foreground hover:text-foreground hover:bg-accent/40">
-          {copied ? <Check className="size-3.5 text-emerald-500" /> : <Copy className="size-3.5" />}
+    <button title="copy"
+      onClick={() => navigator.clipboard.writeText(text).then(() => {
+        setCopied(true); setTimeout(() => setCopied(false), 1500);
+      })}
+      className="shrink-0 p-2 rounded-md border border-border text-muted-foreground hover:text-foreground hover:bg-accent/40">
+      {copied ? <Check className="size-3.5 text-emerald-500" /> : <Copy className="size-3.5" />}
+    </button>
+  );
+}
+
+/** Mint + manage long-lived machine tokens; the raw token is shown exactly once. */
+function ConnectCmd() {
+  const [tokens, setTokens] = useState<MachineToken[]>([]);
+  const [name, setName] = useState("");
+  const [minted, setMinted] = useState<{ name: string; token: string } | null>(null);
+  const [err, setErr] = useState("");
+
+  const refresh = () => { getTokens().then((t) => setTokens(t.tokens)).catch(() => {}); };
+  useEffect(refresh, []);
+
+  async function mint() {
+    const n = name.trim() || "my-machine";
+    setErr("");
+    try {
+      setMinted(await createToken(n));
+      setName("");
+      refresh();
+    } catch (ex) { setErr((ex as Error).message); }
+  }
+
+  const cmd = minted
+    ? `shadowlm worker --hub ${window.location.origin} --name ${minted.name} --api-key ${minted.token}`
+    : null;
+
+  return (
+    <div className="space-y-3 text-left">
+      <div className="flex items-center gap-2">
+        <input value={name} onChange={(e) => setName(e.target.value)}
+               onKeyDown={(e) => e.key === "Enter" && mint()}
+               placeholder="machine name — e.g. macbook"
+               className="flex-1 font-mono text-sm" />
+        <button onClick={mint}
+                className="shrink-0 inline-flex items-center gap-1.5 text-xs px-3 py-2 rounded-md border border-border hover:bg-accent/40">
+          <KeyRound className="size-3.5" /> Create machine token
         </button>
       </div>
-      {token && (
-        <p className="text-[11px] text-muted-foreground">
-          includes your session token (valid ~12h) — the machine connects with the same access you have here.
-        </p>
+      {err && <p className="text-xs text-red-500">{err}</p>}
+
+      {cmd && (
+        <div className="space-y-1.5">
+          <div className="flex items-start gap-2">
+            <pre className="flex-1 overflow-x-auto text-xs font-mono bg-accent/40 border border-border rounded-md px-4 py-2.5">
+              {cmd}
+            </pre>
+            <CopyBtn text={cmd} />
+          </div>
+          <p className="text-[11px] text-muted-foreground">
+            long-lived token, shown once — copy it now. Revoke it here any time.
+          </p>
+        </div>
+      )}
+
+      {tokens.length > 0 && (
+        <div className="divide-y divide-border border border-border rounded-md">
+          {tokens.map((t) => (
+            <div key={t.name} className="px-3 py-2 flex items-center gap-2 text-xs">
+              <KeyRound className="size-3 text-muted-foreground" />
+              <span className="font-mono font-medium">{t.name}</span>
+              <span className="text-muted-foreground font-mono ml-auto">
+                created {new Date(t.created * 1000).toLocaleDateString()}
+              </span>
+              <button title="revoke"
+                onClick={() => revokeToken(t.name).then(refresh)}
+                className="p-1 rounded text-muted-foreground hover:text-red-500">
+                <Trash2 className="size-3.5" />
+              </button>
+            </div>
+          ))}
+        </div>
       )}
     </div>
   );

shadowlm/_static/assets/index-Bg6O8DuN.js

@@ -5,8 +5,8 @@
     <link rel="icon" type="image/png" href="/logo.png" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>ShadowLM · slm♥</title>
-    <script type="module" crossorigin src="./assets/index-DS_pTSs3.js"></script>
-    <link rel="stylesheet" crossorigin href="./assets/index-CRBLqQg9.css">
+    <script type="module" crossorigin src="./assets/index-Bg6O8DuN.js"></script>
+    <link rel="stylesheet" crossorigin href="./assets/index-CTi3GkyQ.css">
   </head>
   <body>
     <div id="root"></div>

…adowlm/_static/assets/index-CRBLqQg9.css …adowlm/_static/assets/index-CTi3GkyQ.cssshadowlm/_static/assets/index-CRBLqQg9.css renamed to shadowlm/_static/assets/index-CTi3GkyQ.css shadowlm/_static/assets/index-CRBLqQg9.css renamed to shadowlm/_static/assets/index-CTi3GkyQ.css

@@ -418,7 +418,9 @@ def __init__(self, *, backend: str, accelerator: str, device: str,
         self._downloads: dict[str, dict] = {}  # model id → prefetch status
         self._settings_path = work_root / "settings.json"
         self._custom_path = work_root / "custom_models.json"
+        self._tokens_path = work_root / "tokens.json"
         self._custom_models = self._load_custom_models()  # user-added HF repos
+        self._machine_tokens = self._load_tokens()  # name → {hash, created}
         self._load_settings()
         self._load_jobs()
         threading.Thread(target=self._worker, daemon=True).start()
@@ -457,6 +459,56 @@ def set_hf_token(self, token: str | None) -> None:
         except OSError:
             pass  # in-memory still works for this process
 
+    # ---- machine tokens: long-lived credentials for `shadowlm worker` --------
+    # Named + individually revocable, hashed at rest in tokens.json — the same
+    # single-box persistence every other piece of hub state uses.
+    # ponytail: a JSON file, not a database — swap the store when a hub outgrows
+    # one box, which is also when this whole tier hands off to Studio.
+    def _load_tokens(self) -> dict:
+        try:
+            data = json.loads(self._tokens_path.read_text())
+            return data if isinstance(data, dict) else {}
+        except (OSError, ValueError):
+            return {}
+
+    def _save_tokens(self) -> None:
+        try:
+            self._tokens_path.write_text(json.dumps(self._machine_tokens, indent=1))
+        except OSError:
+            pass  # in-memory still works for this process
+
+    def mint_machine_token(self, name: str) -> str:
+        """A long-lived worker credential; the raw value is shown exactly once."""
+        import secrets  # noqa: PLC0415
+
+        raw = "slmk_" + secrets.token_urlsafe(32)
+        with self._lock:
+            self._machine_tokens[name] = {
+                "hash": hashlib.sha256(raw.encode()).hexdigest(),
+                "created": int(time.time())}
+            self._save_tokens()
+        return raw
+
+    def revoke_machine_token(self, name: str) -> bool:
+        with self._lock:
+            if name not in self._machine_tokens:
+                return False
+            del self._machine_tokens[name]
+            self._save_tokens()
+        return True
+
+    def valid_machine_token(self, raw: str) -> bool:
+        if not raw.startswith("slmk_"):
+            return False
+        digest = hashlib.sha256(raw.encode()).hexdigest()
+        return any(hmac.compare_digest(digest, t.get("hash", ""))
+                   for t in self._machine_tokens.values())
+
+    def machine_tokens(self) -> list[dict]:
+        with self._lock:
+            return [{"name": n, "created": t.get("created", 0)}
+                    for n, t in sorted(self._machine_tokens.items())]
+
     # ---- custom models: user-added HF repos beyond the curated catalog -------
     def _load_custom_models(self) -> list:
         try:
@@ -981,7 +1033,9 @@ def _authed(self) -> bool:
             if not auth.enabled:
                 return True
             got = self.headers.get("Authorization", "")
-            if got.startswith("Bearer ") and auth.valid_bearer(got[7:]):
+            if got.startswith("Bearer ") and (
+                    auth.valid_bearer(got[7:])
+                    or server.valid_machine_token(got[7:])):
                 return True
             self._error(401, "authentication required")
             return False
@@ -1093,6 +1147,8 @@ def do_GET(self):  # noqa: N802
                 with server._lock:
                     infos = [w.info() for w in server.workers.values()]
                 self._send(200, {"workers": sorted(infos, key=lambda w: w["name"])})
+            elif parts == ["v1", "tokens"]:
+                self._send(200, {"tokens": server.machine_tokens()})
             elif len(parts) == 4 and parts[:2] == ["v1", "workers"] \
                     and parts[3] == "socket":
                 from . import ws  # noqa: PLC0415
@@ -1209,6 +1265,13 @@ def do_POST(self):  # noqa: N802
                         job.cancel.set()
                         server.push_cancel(job)  # instant over the socket
                         self._send(200, {"ok": True})
+                elif parts == ["v1", "tokens"]:
+                    b = self._body()
+                    tname = (b.get("name") or "").strip()
+                    if not tname:
+                        return self._error(422, "provide a token 'name'")
+                    self._send(201, {"name": tname,
+                                     "token": server.mint_machine_token(tname)})
                 elif len(parts) == 6 and parts[:2] == ["v1", "workers"] \
                         and parts[3] == "jobs" and parts[5] == "artifact":
                     if (job := self._job_or_404(parts[4])):
@@ -1249,6 +1312,11 @@ def do_DELETE(self):  # noqa: N802
                     self._send(200, {"ok": True})
                 else:
                     self._error(404, f"unknown dataset {parts[2]!r}")
+            elif len(parts) == 3 and parts[:2] == ["v1", "tokens"]:
+                if server.revoke_machine_token(parts[2]):
+                    self._send(200, {"ok": True})
+                else:
+                    self._error(404, f"unknown token {parts[2]!r}")
             else:
                 self._error(404, f"no route: DELETE {self.path}")
 

shadowlm/_static/assets/index-DS_pTSs3.js

@@ -209,6 +209,47 @@ def load(self, name, **kw):
     assert j.status == "failed" and "no such model" in j.error
 
 
+def test_machine_tokens_mint_authenticate_revoke(tmp_path):
+    """Against an auth-enabled hub: a minted machine token opens the worker
+    socket, survives a hub restart (tokens.json), and dies on revoke."""
+    server = Server(backend="auto", accelerator="auto", device="auto",
+                    work_root=tmp_path)
+    auth = Auth(user="admin", password=None, api_key="ADMIN_KEY")
+    httpd = ThreadingHTTPServer(("127.0.0.1", 0), make_handler(server, auth))
+    threading.Thread(target=httpd.serve_forever, daemon=True).start()
+    url = f"http://127.0.0.1:{httpd.server_address[1]}"
+    try:
+        admin = RemoteClient(url, "ADMIN_KEY")
+        with pytest.raises(Exception, match="401|auth"):
+            RemoteClient(url, "slmk_forged").health()  # unknown token: rejected
+
+        out = admin._request("POST", "/v1/tokens", {"name": "macbook"})
+        token = out["token"]
+        assert token.startswith("slmk_")
+        assert RemoteClient(url, token).health()["ok"]  # HTTP accepts it
+
+        conn = ws.connect(url, "/v1/workers/macbook/socket", api_key=token)
+        conn.send_json({"type": "register", "backend": "mlx",
+                        "device": "t", "gpus": 0})  # socket accepts it
+        deadline = time.time() + 5
+        while not admin.workers() and time.time() < deadline:
+            time.sleep(0.05)
+        assert admin.workers()[0]["name"] == "macbook"
+        conn.close()
+
+        # raw value is never stored — only the hash is on disk
+        assert token not in (tmp_path / "tokens.json").read_text()
+        # a fresh Server over the same work_root still honors it (persistence)
+        assert Server(backend="auto", accelerator="auto", device="auto",
+                      work_root=tmp_path).valid_machine_token(token)
+
+        admin._request("DELETE", "/v1/tokens/macbook")
+        with pytest.raises(Exception, match="401|auth"):
+            RemoteClient(url, token).health()  # revoked: rejected
+    finally:
+        httpd.shutdown()
+
+
 def test_cancelled_before_pickup_never_dispatches(hub):
     server, client, url = hub
     job_id = _submit(client, worker="ghost")  # no such worker connected