chore(id): retire legacy issuer defaults

.env.example

@@ -51,7 +51,7 @@ AGENTHUB_UPLOAD_MAX_SIZE=10485760
 # Hub Server is the AgentHub relying party. Register the exact Hub callback
 # and public Web callback in TokenDance ID before enabling this in a shared
 # environment. Keep the client secret in the local/ops secret store only.
-AGENTHUB_TOKENDANCE_ID_ISSUER_URL=https://id.vectorcontrol.tech
+AGENTHUB_TOKENDANCE_ID_ISSUER_URL=https://id.tokendancelab.com
 AGENTHUB_TOKENDANCE_ID_JWKS_URI=
 AGENTHUB_TOKENDANCE_ID_CLIENT_ID=
 AGENTHUB_TOKENDANCE_ID_CLIENT_SECRET=
@@ -66,7 +66,7 @@ AGENTHUB_TOKENDANCE_ID_ALLOWED_REDIRECT_URIS=http://127.0.0.1/callback,http://lo
 # ── TokenDance ID no-secret login readiness ─
 # These values are script metadata for scripts/verify/verify-token-dance-id-login-readiness.ps1.
 # They are not Hub runtime secrets and do not replace AGENTHUB_TOKENDANCE_ID_*.
-AGENTHUB_TDID_LOGIN_ISSUER_URL=https://id.vectorcontrol.tech
+AGENTHUB_TDID_LOGIN_ISSUER_URL=https://id.tokendancelab.com
 AGENTHUB_TDID_LOGIN_CLIENT_ID=
 AGENTHUB_TDID_LOGIN_TEST_ACCOUNT_REF=
 # Optional local OIDC discovery JSON fixture for script contract tests only.

app/desktop/scripts/manual-chat-flow-check.mjs

@@ -14,7 +14,7 @@ fs.mkdirSync(outputDir, { recursive: true });
 const liveBackendHosts = new Set([
   'api.hub.vectorcontrol.tech',
   'hub.vectorcontrol.tech',
-  'id.vectorcontrol.tech',
+  'id.tokendancelab.com',
   'api.vectorcontrol.tech',
   'localhost:8080',
   '127.0.0.1:8080',

app/desktop/src/__e2e__/teamrun-ui-evidence.spec.ts

@@ -1,9 +1,9 @@
 import { expect, test, type Page, type TestInfo } from '@playwright/test';
 
 const LIVE_BACKEND_HOSTS = new Set([
   'api.hub.vectorcontrol.tech',
   'hub.vectorcontrol.tech',
-  'id.vectorcontrol.tech',
+  'id.tokendancelab.com',
   'api.vectorcontrol.tech',
   'localhost:8080',
   '127.0.0.1:8080',

app/desktop/src/api/hubAuth.test.ts

@@ -124,7 +124,7 @@ describe('Hub OIDC API contract (mocked)', () => {
   it('oidcAuthorize sends correct payload to Hub', async () => {
     const mockResponse = {
       state: 'hub-generated-state',
-      authorization_url: 'https://id.vectorcontrol.tech/oidc/auth?response_type=code&client_id=hub&redirect_uri=http://localhost:8080/callback&code_challenge=abc&code_challenge_method=S256&state=hub-generated-state',
+      authorization_url: 'https://id.tokendancelab.com/oidc/auth?response_type=code&client_id=hub&redirect_uri=http://localhost:8080/callback&code_challenge=abc&code_challenge_method=S256&state=hub-generated-state',
     };
 
     const fetchMock = vi.fn().mockResolvedValue({
@@ -152,7 +152,7 @@ describe('Hub OIDC API contract (mocked)', () => {
 
     const data = await res.json();
     expect(data.state).toBe('hub-generated-state');
-    expect(data.authorization_url).toContain('id.vectorcontrol.tech');
+    expect(data.authorization_url).toContain('id.tokendancelab.com');
     const [, authorizeInit] = fetchMock.mock.calls[0] as [string, RequestInit];
     const sent = JSON.parse(authorizeInit.body as string);
     expect(sent.redirect_uri).toBe('http://127.0.0.1:49152/callback');

app/mobile-rn/app.config.ts

@@ -69,7 +69,7 @@ const config = {
   ],
   extra: {
     hubBaseUrl: resolveDefaultHubBaseUrl(),
-    oidcIssuer: env?.EXPO_PUBLIC_TOKENDANCE_ID_ISSUER ?? 'https://id.vectorcontrol.tech',
+    oidcIssuer: env?.EXPO_PUBLIC_TOKENDANCE_ID_ISSUER ?? 'https://id.tokendancelab.com',
   },
 } as ExpoConfig;
 

app/mobile-rn/src/integrations/deepLinking.test.ts

@@ -17,7 +17,7 @@ describe('AgentHub mobile deep links', () => {
     expect(isAgentHubAuthCallback('agenthub://auth/callback?code=abc&state=123')).toBe(true);
     expect(isAgentHubAuthCallback('agenthub://runs/123')).toBe(false);
     expect(isAgentHubAuthCallback('agenthub://auth/callback-extra?code=abc&state=123')).toBe(false);
-    expect(isAgentHubAuthCallback('https://id.vectorcontrol.tech/callback')).toBe(false);
+    expect(isAgentHubAuthCallback('https://id.tokendancelab.com/callback')).toBe(false);
   });
 
   it('parses TokenDance ID OIDC authorization code callbacks', () => {
@@ -50,7 +50,7 @@ describe('AgentHub mobile deep links', () => {
   });
 
   it('rejects non-AgentHub callbacks and malformed URLs', () => {
-    expect(parseOidcCallback('https://id.vectorcontrol.tech/callback?code=abc&state=123')).toEqual({
+    expect(parseOidcCallback('https://id.tokendancelab.com/callback?code=abc&state=123')).toEqual({
       kind: 'invalid',
       reason: 'invalid_callback',
     });
@@ -131,7 +131,7 @@ describe('AgentHub mobile deep links', () => {
       kind: 'invalid',
       reason: 'invalid_url',
     });
-    expect(parseAgentHubDeepLink('https://id.vectorcontrol.tech/callback')).toEqual({
+    expect(parseAgentHubDeepLink('https://id.tokendancelab.com/callback')).toEqual({
       kind: 'invalid',
       reason: 'invalid_scheme',
     });

app/shared/src/testing/e2eDataModeContract.test.ts

@@ -212,7 +212,7 @@ describe('e2e data-mode contract', () => {
   it('classifies backend requests by stable platform boundary', () => {
     expect(classifyE2ERequest('http://localhost:8080/client/auth/me')).toBe('hub');
     expect(classifyE2ERequest('http://127.0.0.1:3210/v1/runs')).toBe('local-edge');
-    expect(classifyE2ERequest('https://id.vectorcontrol.tech/oauth/authorize')).toBe('tokendance-id');
+    expect(classifyE2ERequest('https://id.tokendancelab.com/oauth/authorize')).toBe('tokendance-id');
     expect(classifyE2ERequest('https://api.vectorcontrol.tech/v1/chat/completions')).toBe('gateway');
     expect(classifyE2ERequest('http://127.0.0.1:5174/')).toBe('app');
   });

app/shared/src/testing/e2eDataModeContract.ts

@@ -295,7 +295,7 @@ const LOCAL_EDGE_HOSTS = new Set([
 ]);
 
 const TOKEN_DANCE_ID_HOSTS = new Set([
-  'id.vectorcontrol.tech',
+  'id.tokendancelab.com',
 ]);
 
 const GATEWAY_HOSTS = new Set([

app/web/scripts/manual-chat-flow-check.mjs

@@ -17,7 +17,7 @@ fs.mkdirSync(outputDir, { recursive: true });
 const blockedHosts = new Set([
   'api.hub.vectorcontrol.tech',
   'hub.vectorcontrol.tech',
-  'id.vectorcontrol.tech',
+  'id.tokendancelab.com',
   'api.vectorcontrol.tech',
   'localhost:3210',
   '127.0.0.1:3210',

deployments/production/docker-compose.yml

@@ -80,7 +80,7 @@ services:
       AGENTHUB_UPLOAD_DIR: /app/uploads
       AGENTHUB_UPLOAD_MAX_SIZE: "10485760"
       # TokenDance ID OIDC
-      AGENTHUB_TOKENDANCE_ID_ISSUER_URL: https://id.vectorcontrol.tech
+      AGENTHUB_TOKENDANCE_ID_ISSUER_URL: https://id.tokendancelab.com
       AGENTHUB_TOKENDANCE_ID_CLIENT_ID: ${AGENTHUB_TOKENDANCE_ID_CLIENT_ID:-}
       AGENTHUB_TOKENDANCE_ID_CLIENT_SECRET: ${AGENTHUB_TOKENDANCE_ID_CLIENT_SECRET:-}
       AGENTHUB_TOKENDANCE_ID_REDIRECT_URI: https://hub.vectorcontrol.tech/auth/tokendance/callback

hub-server/configs/config.yaml

@@ -57,7 +57,7 @@ agent_team:
   max_team_run_budget_tokens: 200000
   max_team_run_budget_usage_pct: 95
 tokendance_id:
-  issuer_url: "https://id.vectorcontrol.tech"
+  issuer_url: "https://id.tokendancelab.com"
   jwks_uri: ""
   client_id: ""
   client_secret: ""

hub-server/deployments/.env.production.example

@@ -72,7 +72,7 @@ AGENTHUB_CORS_ORIGINS=https://hub.tokendancelab.com,https://hub.vectorcontrol.te
 # Hub still exchanges the code through POST /client/auth/oidc/callback after
 # Web/Desktop sends code, state, PKCE verifier, device, and redirect_uri.
 # Keep http://127.0.0.1/callback only for Desktop/native dynamic loopback ports.
-# AGENTHUB_TOKENDANCE_ID_ISSUER_URL=https://id.vectorcontrol.tech
+# AGENTHUB_TOKENDANCE_ID_ISSUER_URL=https://id.tokendancelab.com
 # AGENTHUB_TOKENDANCE_ID_JWKS_URI=
 # AGENTHUB_TOKENDANCE_ID_CLIENT_ID=<your-client-id>
 # AGENTHUB_TOKENDANCE_ID_CLIENT_SECRET=<your-client-secret>

hub-server/deployments/docker-compose.prod.yml

@@ -143,7 +143,7 @@ services:
       # Web browser callback; Hub-owned code exchange remains
       # POST /client/auth/oidc/callback. Keep 127.0.0.1/callback only for
       # Desktop/native dynamic loopback ports.
-      AGENTHUB_TOKENDANCE_ID_ISSUER_URL: ${AGENTHUB_TOKENDANCE_ID_ISSUER_URL:-https://id.vectorcontrol.tech}
+      AGENTHUB_TOKENDANCE_ID_ISSUER_URL: ${AGENTHUB_TOKENDANCE_ID_ISSUER_URL:-https://id.tokendancelab.com}
       AGENTHUB_TOKENDANCE_ID_JWKS_URI: ${AGENTHUB_TOKENDANCE_ID_JWKS_URI:-}
       AGENTHUB_TOKENDANCE_ID_CLIENT_ID: ${AGENTHUB_TOKENDANCE_ID_CLIENT_ID:-}
       AGENTHUB_TOKENDANCE_ID_CLIENT_SECRET: ${AGENTHUB_TOKENDANCE_ID_CLIENT_SECRET:-}

hub-server/deployments/docker-compose.us1.yml

@@ -136,7 +136,7 @@ services:
       # CORS
       AGENTHUB_CORS_ORIGINS: ${AGENTHUB_CORS_ORIGINS:-https://hub.vectorcontrol.tech,https://tauri.localhost}
       # TokenDance ID OIDC
-      AGENTHUB_TOKENDANCE_ID_ISSUER_URL: ${AGENTHUB_TOKENDANCE_ID_ISSUER_URL:-https://id.vectorcontrol.tech}
+      AGENTHUB_TOKENDANCE_ID_ISSUER_URL: ${AGENTHUB_TOKENDANCE_ID_ISSUER_URL:-https://id.tokendancelab.com}
       AGENTHUB_TOKENDANCE_ID_JWKS_URI: ${AGENTHUB_TOKENDANCE_ID_JWKS_URI:-}
       AGENTHUB_TOKENDANCE_ID_CLIENT_ID: ${AGENTHUB_TOKENDANCE_ID_CLIENT_ID:-}
       AGENTHUB_TOKENDANCE_ID_CLIENT_SECRET: ${AGENTHUB_TOKENDANCE_ID_CLIENT_SECRET:-}

hub-server/deployments/hk2/.env.hk2.example → hub-server/deployments/hk2/.env.example

@@ -2,7 +2,7 @@
 # AgentHub Hub Server — hk2 Production Environment Template
 # ──────────────────────────────────────────────
 # Copy to .env.hk2 and fill in real values:
-#   cp .env.hk2.example .env.hk2
+#   cp .env.example .env.hk2
 #
 # IMPORTANT: This file contains secrets. Never commit to version control.
 # Production secrets should be stored in:
@@ -86,9 +86,9 @@ AGENTHUB_CORS_ORIGINS=https://hub.vectorcontrol.tech,https://tauri.localhost
 
 # ── TokenDance ID OIDC ────────────────────────
 # Register/retrieve from TokenDance ID admin panel at:
-#   https://id.vectorcontrol.tech
+#   https://id.tokendancelab.com
 # Production Web callback; Desktop uses http://127.0.0.1/callback loopback.
-# AGENTHUB_TOKENDANCE_ID_ISSUER_URL=https://id.vectorcontrol.tech
+# AGENTHUB_TOKENDANCE_ID_ISSUER_URL=https://id.tokendancelab.com
 # AGENTHUB_TOKENDANCE_ID_JWKS_URI=
 # AGENTHUB_TOKENDANCE_ID_CLIENT_ID=<your-client-id>
 # AGENTHUB_TOKENDANCE_ID_CLIENT_SECRET=<your-client-secret>

hub-server/deployments/hk2/docker-compose.hk2.yml

@@ -138,7 +138,7 @@ services:
       # CORS
       AGENTHUB_CORS_ORIGINS: ${AGENTHUB_CORS_ORIGINS:-https://hub.vectorcontrol.tech,https://tauri.localhost}
       # TokenDance ID OIDC
-      AGENTHUB_TOKENDANCE_ID_ISSUER_URL: ${AGENTHUB_TOKENDANCE_ID_ISSUER_URL:-https://id.vectorcontrol.tech}
+      AGENTHUB_TOKENDANCE_ID_ISSUER_URL: ${AGENTHUB_TOKENDANCE_ID_ISSUER_URL:-https://id.tokendancelab.com}
       AGENTHUB_TOKENDANCE_ID_JWKS_URI: ${AGENTHUB_TOKENDANCE_ID_JWKS_URI:-}
       AGENTHUB_TOKENDANCE_ID_CLIENT_ID: ${AGENTHUB_TOKENDANCE_ID_CLIENT_ID:-}
       AGENTHUB_TOKENDANCE_ID_CLIENT_SECRET: ${AGENTHUB_TOKENDANCE_ID_CLIENT_SECRET:-}

hub-server/internal/config/config_tokendance.go

@@ -6,7 +6,7 @@ import "log/slog"
 
 // TokenDanceIDConfig holds OIDC/OAuth2 configuration for TokenDance ID integration.
 type TokenDanceIDConfig struct {
-	// IssuerURL is the TokenDance ID issuer base URL (e.g. https://id.vectorcontrol.tech).
+	// IssuerURL is the TokenDance ID issuer base URL (e.g. https://id.tokendancelab.com).
 	IssuerURL string `mapstructure:"issuer_url"`
 	// JWKSURI overrides the JWKS endpoint. Derived from issuer_url/oidc/jwks when empty.
 	JWKSURI string `mapstructure:"jwks_uri"`

hub-server/tests/oidc/oidc_smoke_test.go

@@ -108,7 +108,7 @@ func TestOIDCSmoke(t *testing.T) {
 	jwtSecret := "test-secret-at-least-32-bytes-long!!"
 
 	mockSvc := &mockOIDCService{
-		authorizeURL: "https://id.vectorcontrol.tech/oidc/authorize",
+		authorizeURL: "https://id.tokendancelab.com/oidc/authorize",
 		state:        "test-state-" + uuid.NewString(),
 		accessToken:  "",
 		refreshToken: "mock-refresh-" + uuid.NewString(),

scripts/verify/check-secrets.sh

@@ -162,6 +162,15 @@ check_added_line() {
   [[ -z "$trimmed" ]] && return
   [[ "$trimmed" == \#* || "$trimmed" == //* || "$trimmed" == \** || "$trimmed" == "/*"* ]] && return
 
+  # *_URL=…://… assignments are endpoint configuration (e.g.
+  # AGENTHUB_TOKENDANCE_ID_ISSUER_URL=https://id.example.com or the
+  # ${VAR:-https://…} default form in docker-compose files), not secrets.
+  # Without this, any variable name containing "token" (TOKENDANCE,
+  # TOKEN_EXCHANGE…) gets flagged for its public endpoint value.
+  if [[ "$trimmed" =~ ^[A-Za-z0-9_.-]*_URL[\"\']?[[:space:]]*[:=][[:space:]]*.*:// ]]; then
+    return
+  fi
+
   if [[ "$trimmed" =~ -----BEGIN[[:space:]]+.*PRIVATE[[:space:]]+KEY----- ]]; then
     report "$path" "$line_no" "private key block detected"
   fi

tests/contract/scripts/verify-token-dance-id-login-readiness.ps1

@@ -96,7 +96,7 @@ try {
         $blocked = Invoke-RepoScript @(
             $scriptPath,
             "-RepoRoot", $RepoRoot,
-            "-DiscoveryDocumentPath", (New-DiscoveryFixture $tmpRoot "blocked-discovery.json" '{"issuer":"https://id.vectorcontrol.tech","authorization_endpoint":"https://id.vectorcontrol.tech/oidc/authorize","token_endpoint":"https://id.vectorcontrol.tech/oidc/token","jwks_uri":"https://id.vectorcontrol.tech/oidc/jwks"}')
+            "-DiscoveryDocumentPath", (New-DiscoveryFixture $tmpRoot "blocked-discovery.json" '{"issuer":"https://id.tokendancelab.com","authorization_endpoint":"https://id.tokendancelab.com/oidc/authorize","token_endpoint":"https://id.tokendancelab.com/oidc/token","jwks_uri":"https://id.tokendancelab.com/oidc/jwks"}')
         )
         Assert-True ($blocked.ExitCode -ne 0) "default run blocks when approved env is absent" $blocked.Output
         Assert-True ($blocked.Output -match "Status: BLOCKED") "blocked run reports BLOCKED" $blocked.Output
@@ -106,10 +106,10 @@ try {
         $badDiscovery = Invoke-RepoScript @(
             $scriptPath,
             "-RepoRoot", $RepoRoot,
-            "-IssuerUrl", "https://id.vectorcontrol.tech",
+            "-IssuerUrl", "https://id.tokendancelab.com",
             "-ClientId", "agenthub-approved-client",
             "-TestAccountRef", "approved-test-account:agenthub-login-smoke",
-            "-DiscoveryDocumentPath", (New-DiscoveryFixture $tmpRoot "bad-discovery.json" '{"issuer":"https://wrong.example","authorization_endpoint":"https://id.vectorcontrol.tech/oidc/authorize","token_endpoint":"https://id.vectorcontrol.tech/oidc/token","jwks_uri":"https://id.vectorcontrol.tech/oidc/jwks"}')
+            "-DiscoveryDocumentPath", (New-DiscoveryFixture $tmpRoot "bad-discovery.json" '{"issuer":"https://wrong.example","authorization_endpoint":"https://id.tokendancelab.com/oidc/authorize","token_endpoint":"https://id.tokendancelab.com/oidc/token","jwks_uri":"https://id.tokendancelab.com/oidc/jwks"}')
         )
         Assert-True ($badDiscovery.ExitCode -ne 0) "issuer mismatch blocks readiness" $badDiscovery.Output
         Assert-True ($badDiscovery.Output -match "discovery issuer") "issuer mismatch is explicit" $badDiscovery.Output
@@ -119,10 +119,10 @@ try {
         $secretRun = Invoke-RepoScript @(
             $scriptPath,
             "-RepoRoot", $RepoRoot,
-            "-IssuerUrl", "https://id.vectorcontrol.tech",
+            "-IssuerUrl", "https://id.tokendancelab.com",
             "-ClientId", $secretLike,
             "-TestAccountRef", "approved-test-account:agenthub-login-smoke",
-            "-DiscoveryDocumentPath", (New-DiscoveryFixture $tmpRoot "secret-discovery.json" '{"issuer":"https://id.vectorcontrol.tech","authorization_endpoint":"https://id.vectorcontrol.tech/oidc/authorize","token_endpoint":"https://id.vectorcontrol.tech/oidc/token","jwks_uri":"https://id.vectorcontrol.tech/oidc/jwks"}')
+            "-DiscoveryDocumentPath", (New-DiscoveryFixture $tmpRoot "secret-discovery.json" '{"issuer":"https://id.tokendancelab.com","authorization_endpoint":"https://id.tokendancelab.com/oidc/authorize","token_endpoint":"https://id.tokendancelab.com/oidc/token","jwks_uri":"https://id.tokendancelab.com/oidc/jwks"}')
         )
         Assert-True ($secretRun.ExitCode -ne 0) "secret-like client input fails closed" $secretRun.Output
         Assert-True ($secretRun.Output -match "secret-like") "secret-like failure is generic" $secretRun.Output
@@ -132,10 +132,10 @@ try {
         $ready = Invoke-RepoScript @(
             $scriptPath,
             "-RepoRoot", $RepoRoot,
-            "-IssuerUrl", "https://id.vectorcontrol.tech",
+            "-IssuerUrl", "https://id.tokendancelab.com",
             "-ClientId", "agenthub-approved-client",
             "-TestAccountRef", "approved-test-account:agenthub-login-smoke",
-            "-DiscoveryDocumentPath", (New-DiscoveryFixture $tmpRoot "ready-discovery.json" '{"issuer":"https://id.vectorcontrol.tech","authorization_endpoint":"https://id.vectorcontrol.tech/oidc/authorize","token_endpoint":"https://id.vectorcontrol.tech/oidc/token","jwks_uri":"https://id.vectorcontrol.tech/oidc/jwks","response_types_supported":["code"],"code_challenge_methods_supported":["S256"]}'),
+            "-DiscoveryDocumentPath", (New-DiscoveryFixture $tmpRoot "ready-discovery.json" '{"issuer":"https://id.tokendancelab.com","authorization_endpoint":"https://id.tokendancelab.com/oidc/authorize","token_endpoint":"https://id.tokendancelab.com/oidc/token","jwks_uri":"https://id.tokendancelab.com/oidc/jwks","response_types_supported":["code"],"code_challenge_methods_supported":["S256"]}'),
             "-OutputPath", $outputPath
         )
         Assert-True ($ready.ExitCode -eq 0) "approved metadata and discovery report READY_FOR_OPERATOR" $ready.Output