Allow Companion scoped access to own wrapped Locker keys (#694)

ddiff --git a/docs/companion-locker.md b/docs/companion-locker.md
nnew file mode 100644
iindex 00000000..b0f5cbbb
---- /dev/null
++++ b/docs/companion-locker.md
@@@ -0,0 +1,17 @@
++# Companion Locker capability
++
++`locker.login.manage` is an allowed scope for the public Companion OAuth client.
++Existing refresh grants retain their original scopes; the person must sign in again
++to approve this capability. Other public clients do not receive it.
++
++`GET /api/v1/me/keys/companion` accepts the scoped Dock token through the existing
++live session/family guard and returns only the caller's subject and wrapped Locker
++key backups. It sets `Cache-Control: private, no-store`. Locker forwards the Bearer
++to this endpoint for every `/api/v1/companion` request, then permits only owner login
++reads/creates. Revocation, bans and deleted/merged accounts follow the same live
++checks as the Dock. No private keys or login plaintext reach Network.
++
++The new token still cannot read `/api/v1/me/keys/backup`, update/delete keys or use
++ordinary account routes. Deploy Network before Locker and the Companion extension.
++`npm test -- oauth-extension` covers issuance, scope refusal, own-subject reads,
++key-write refusal and immediate revocation. No agent blind-fill permission is added.
ddiff --git a/migrations/0056_companion_locker_scope.sql b/migrations/0056_companion_locker_scope.sql
nnew file mode 100644
iindex 00000000..33c55b8b
---- /dev/null
++++ b/migrations/0056_companion_locker_scope.sql
@@@ -0,0 +1,4 @@
++-- phase: expand
++-- Existing grants stay unchanged; the person signs in again to grant Locker access.
++UPDATE oauth_clients SET allowed_scopes = concat(allowed_scopes, ' locker.login.manage')
++WHERE client_id = 'companion' AND position('locker.login.manage' in allowed_scopes) = 0;
ddiff --git a/server/auth/dock-tokens.js b/server/auth/dock-tokens.js
iindex 3a8834c8..54f418ff 100644
---- a/server/auth/dock-tokens.js
++++ b/server/auth/dock-tokens.js
@@@ -20,7 +20,7 @@ const jwt = require('jsonwebtoken');
  
  const CLIENT_ID = 'companion';
  const CLIENT_NAME = 'OpenVibe extension';
--const SCOPES = Object.freeze(['dock', 'activity', 'chat.read', 'agent.view', 'mail.mask.manage']);
++const SCOPES = Object.freeze(['dock', 'activity', 'chat.read', 'agent.view', 'mail.mask.manage', 'locker.login.manage']);
  const AUDIENCES = Object.freeze(['openvibe.network', 'openvibe.chat']);
  const FAMILY_RE = /^fam_[0-9a-f]{24}$/;
  const SCOPE_RE = /^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)*$/;
ddiff --git a/server/db/database.js b/server/db/database.js
iindex 89fff986..ba66ae86 100644
---- a/server/db/database.js
++++ b/server/db/database.js
@@@ -197,7 +197,7 @@ async function seedDb(db, { log = console } = {}) {
              // the add-on id (extension id -> getRedirectURL). Both are public values.
              // `agent.view` (2026-11-07) is the panel's read of Codes' agent view; Codes accepts it, and only it.
              { client_id: 'companion', name: 'OpenVibe extension', public: true,
--                allowed_scopes: 'dock activity chat.read agent.view mail.mask.manage', access_token_ttl_s: 3600,
++                allowed_scopes: 'dock activity chat.read agent.view mail.mask.manage locker.login.manage', access_token_ttl_s: 3600,
                  redirect_uris: [
                      'https://bjcjcfcecpkkmfndegkjekoipdmbgakd.chromiumapp.org/',
                      'https://bb6593a68b1dcfbb7acd9650f04a169f4c5b57a0.extensions.allizom.org/',
ddiff --git a/server/index.js b/server/index.js
iindex 608b3900..aaab03c2 100644
---- a/server/index.js
++++ b/server/index.js
@@@ -864,7 +864,7 @@ require('./developer/confirmations').start(db);
      const locker = require('./locker/keys');
      // Writes come from Network itself or from an OpenVibe site's exact origin (ov-locker.js), never from *.openvibe.tools.
      const isFirstPartyOrigin = (o) => { const n = normalizeOriginForCors(o); return !!n && buildAllowedOriginsSet().has(n); };
--    app.use('/api/v1/me/keys', locker.meRouter(requireAuth, { notifications: notificationService, isFirstPartyOrigin }));
++    app.use('/api/v1/me/keys', locker.meRouter(requireAuth, { notifications: notificationService, isFirstPartyOrigin, requireCompanion: requireDock('locker.login.manage') }));
      app.use('/api/v1/people', locker.peopleRouter(requireAuth));
  }
  
ddiff --git a/server/locker/keys.js b/server/locker/keys.js
iindex c1420d78..c8179123 100644
---- a/server/locker/keys.js
++++ b/server/locker/keys.js
@@@ -267,10 +267,19 @@ function send(req, res, fn) {
  /**
   * The person's own locker: PUT /api/v1/me/keys, GET /api/v1/me/keys/backup, DELETE /api/v1/me/keys.
   */
--function meRouter(requireAuth, { notifications = null, isFirstPartyOrigin = null } = {}) {
++function meRouter(requireAuth, { notifications = null, isFirstPartyOrigin = null, requireCompanion = requireAuth } = {}) {
      const router = express.Router();
      router.use(http.middleware());
  
++    // Narrow capability for Companion: only this person's wrapped keys. No key writes or resets.
++    // Locker forwards the Bearer on every login request, so revocation is checked live by Network.
++    router.get('/companion', requireCompanion, async (req, res) => await send(req, res, async (db) => {
++        const me = await meOf(db, req.user);
++        const rows = await db.prepare('SELECT kind, blob FROM locker_key_backups WHERE subject = ? ORDER BY kind').all(me);
++        res.set('Cache-Control', 'private, no-store');
++        res.json({ subject: me, backups: Object.fromEntries(rows.map((row) => [row.kind, row.blob])) });
++    }));
++
      // Set or rotate my keys. The same keys again change nothing and announce nothing.
      router.put('/', requireAuth, async (req, res) => await send(req, res, async (db) => {
          if (crossSite(req, isFirstPartyOrigin)) throw new LockerError(403, 'locker.cross_site', 'this write came from another site');
ddiff --git a/test/agent-schema.test.js b/test/agent-schema.test.js
iindex 1f2739b4..863ff529 100644
---- a/test/agent-schema.test.js
++++ b/test/agent-schema.test.js
@@@ -44,7 +44,7 @@ const quiet = { log() {}, warn() {}, error() {} };
  
          // The real directory: 0016 applies on top of 0015, once.
          const first = await asOwner((db) => db.migrate({ dir: MIGRATIONS, log: quiet }));
--        assert.deepStrictEqual(first.applied.map((m) => [m.id, m.name, m.phase]), [['0016', 'agents', 'expand'], ['0017', 'agent_grants', 'expand'], ['0018', 'confirmations', 'expand'], ['0019', 'agent_budgets', 'expand'], ['0020', 'user_owned_trust', 'expand'], ['0021', 'services_portal', 'migrate'], ['0022', 'public_profiles', 'expand'], ['0023', 'project_secrets', 'expand'], ['0024', 'retired_theme_campfire', 'migrate'], ['0026', 'theme_history', 'expand'], ['0027', 'notification_quiet_digest', 'expand'], ['0028', 'theme_site_overrides', 'expand'], ['0029', 'site_prefs', 'expand'], ['0030', 'run_tokens', 'expand'], ['0031', 'dock_states', 'expand'], ['0032', 'oauth_public_clients', 'expand'], ['0033', 'consents', 'expand'], ['0034', 'look_dates', 'expand'], ['0035', 'dev_api_keys', 'expand'], ['0036', 'qr_signin', 'expand'], ['0037', 'analytics_bot_api', 'expand'], ['0038', 'sharing', 'expand'], ['0039', 'locker_keys', 'expand'], ['0040', 'ai_offers', 'expand'], ['0041', 'adult_confirmation', 'expand'], ['0042', 'chat_app_links', 'expand'], ['0043', 'connect_apps', 'expand'], ['0044', 'consent_refusals', 'expand'], ['0045', 'machine_pools', 'expand'], ['0046', 'menu_clicks', 'expand'], ['0047', 'presence', 'expand'], ['0048', 'menu_feeds', 'expand'], ['0049', 'oauth_session_public_clients', 'expand'], ['0050', 'oauth_token_session_families', 'expand'], ['0051', 'outbox_rejected_index', 'expand'], ['0052', 'public_person_pages', 'expand'], ['0053', 'link_send_relay', 'expand'], ['0054', 'account_emails', 'expand'], ['0055', 'companion_mask_scope', 'expand']]);
++        assert.deepStrictEqual(first.applied.map((m) => [m.id, m.name, m.phase]), [['0016', 'agents', 'expand'], ['0017', 'agent_grants', 'expand'], ['0018', 'confirmations', 'expand'], ['0019', 'agent_budgets', 'expand'], ['0020', 'user_owned_trust', 'expand'], ['0021', 'services_portal', 'migrate'], ['0022', 'public_profiles', 'expand'], ['0023', 'project_secrets', 'expand'], ['0024', 'retired_theme_campfire', 'migrate'], ['0026', 'theme_history', 'expand'], ['0027', 'notification_quiet_digest', 'expand'], ['0028', 'theme_site_overrides', 'expand'], ['0029', 'site_prefs', 'expand'], ['0030', 'run_tokens', 'expand'], ['0031', 'dock_states', 'expand'], ['0032', 'oauth_public_clients', 'expand'], ['0033', 'consents', 'expand'], ['0034', 'look_dates', 'expand'], ['0035', 'dev_api_keys', 'expand'], ['0036', 'qr_signin', 'expand'], ['0037', 'analytics_bot_api', 'expand'], ['0038', 'sharing', 'expand'], ['0039', 'locker_keys', 'expand'], ['0040', 'ai_offers', 'expand'], ['0041', 'adult_confirmation', 'expand'], ['0042', 'chat_app_links', 'expand'], ['0043', 'connect_apps', 'expand'], ['0044', 'consent_refusals', 'expand'], ['0045', 'machine_pools', 'expand'], ['0046', 'menu_clicks', 'expand'], ['0047', 'presence', 'expand'], ['0048', 'menu_feeds', 'expand'], ['0049', 'oauth_session_public_clients', 'expand'], ['0050', 'oauth_token_session_families', 'expand'], ['0051', 'outbox_rejected_index', 'expand'], ['0052', 'public_person_pages', 'expand'], ['0053', 'link_send_relay', 'expand'], ['0054', 'account_emails', 'expand'], ['0055', 'companion_mask_scope', 'expand'], ['0056', 'companion_locker_scope', 'expand']]);
          assert.ok(await hasAgents());
          assert.deepStrictEqual((await asOwner((db) => db.migrate({ dir: MIGRATIONS, log: quiet }))).applied, [], 'already applied');
          // Expand only, IF NOT EXISTS throughout: running the file again changes nothing and fails nothing.
ddiff --git a/test/oauth-extension.test.js b/test/oauth-extension.test.js
iindex 28966bf1..2090256d 100644
---- a/test/oauth-extension.test.js
++++ b/test/oauth-extension.test.js
@@@ -50,6 +50,7 @@ const challenge = (v) => b64(crypto.createHash('sha256').update(v).digest());
      Object.assign(app.locals, { db, config, privateKey: keys.privateKey, publicKey: keys.publicKey });
      app.use('/oauth', oauthRoutes);
      app.use('/api/v1/me/dock', dockMod.router({ dock, requireAuth: requireDock('dock') }));
++    app.use('/api/v1/me/keys', require('../server/locker/keys').meRouter(requireAuth, { requireCompanion: requireDock('locker.login.manage') }));
      app.get('/api/v1/me/private', requireAuth, (req, res) => res.json({ ok: true }));
      app.get('/api/v1/me/actions', requireDock('activity'), (req, res) => res.json({ ok: true, scope: req.dockScope }));
      app.post('/api/v1/me/actions', requireAuth, (req, res) => res.json({ ok: true }));
@@@ -137,6 +138,22 @@ const challenge = (v) => b64(crypto.createHash('sha256').update(v).digest());
          assert.strictEqual(maskToken.body.scope, 'dock activity chat.read agent.view mail.mask.manage');
          assert.strictEqual(jwt.decode(maskToken.body.access_token).scope, 'dock activity chat.read agent.view mail.mask.manage');
  
++        const lockerVerifier = verifier();
++        const lockerCx = await confirm({ client_id: 'companion', redirect_uri: CHROME, response_type: 'code', scope: 'locker.login.manage', state: 'locker-test', code_challenge: challenge(lockerVerifier), code_challenge_method: 'S256' });
++        assert.strictEqual(lockerCx.status, 200);
++        const lockerToken = await token({ grant_type: 'authorization_code', client_id: 'companion', code: new URL(lockerCx.body.redirect).searchParams.get('code'), redirect_uri: CHROME, code_verifier: lockerVerifier });
++        assert.strictEqual(lockerToken.status, 200);
++        const lk = lockerToken.body.access_token;
++        assert.strictEqual((await api('GET', '/api/v1/me/keys/companion', maskToken.body.access_token)).status, 403);
++        const backup = await api('GET', '/api/v1/me/keys/companion', lk);
++        assert.strictEqual(backup.status, 200);
++        assert.strictEqual(backup.body.subject, (await db.prepare('SELECT subject_id FROM users WHERE id = 1').get()).subject_id);
++        assert.strictEqual((await api('PUT', '/api/v1/me/keys', lk)).status, 401);
++        assert.strictEqual((await api('DELETE', '/api/v1/me/keys', lk)).status, 401);
++        assert.strictEqual((await api('GET', '/api/v1/me/keys/backup', lk)).status, 401);
++        await fetch(`${base}/oauth/revoke`, { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ client_id: 'companion', token: lockerToken.body.refresh_token }) });
++        assert.strictEqual((await api('GET', '/api/v1/me/keys/companion', lk)).status, 401, 'revocation is immediate');
++
          // The agent view's scope is Companion's alone: another public client may not ask for it.
          await db.prepare('INSERT INTO oauth_clients (client_id, client_secret, name, redirect_uris, is_first_party, is_public, allowed_scopes, access_token_ttl_s) VALUES (?, NULL, ?, ?, 1, 1, ?, 3600)')
              .run('companion-other', 'Other extension', JSON.stringify(['https://other.example/cb']), 'dock activity chat.read');
@@@ -144,6 +161,8 @@ const challenge = (v) => b64(crypto.createHash('sha256').update(v).digest());
          assert.strictEqual((await authorize({ client_id: 'companion-other', redirect_uri: 'https://other.example/cb', response_type: 'code', state: 'o', scope: 'agent.view', code_challenge: challenge(verifier()), code_challenge_method: 'S256' })).status, 400, 'agent.view is not its scope');
          assert.strictEqual((await authorize({ client_id: 'companion-other', redirect_uri: 'https://other.example/cb', response_type: 'code', state: 'o', scope: 'mail.mask.manage', code_challenge: challenge(verifier()), code_challenge_method: 'S256' })).status, 400, 'mail.mask.manage is not its scope');
  
++        assert.strictEqual((await authorize({ client_id: 'companion-other', redirect_uri: 'https://other.example/cb', response_type: 'code', state: 'o', scope: 'locker.login.manage', code_challenge: challenge(verifier()), code_challenge_method: 'S256' })).status, 400, 'Locker scope belongs to Companion');
++
          // The Dock accepts it; a normal account route refuses it. Activity reads are open, action
          // writes are not, and a token that only has `dock` is refused the activity route.
          assert.strictEqual((await api('GET', '/api/v1/me/dock', noSecret.body.access_token)).status, 200);
ddiff --git a/test/user-owned-trust.test.js b/test/user-owned-trust.test.js
iindex 169bf310..6b4a62bd 100644
---- a/test/user-owned-trust.test.js
++++ b/test/user-owned-trust.test.js
@@@ -52,7 +52,7 @@ const quiet = { log() {}, warn() {}, error() {} };
  
          // ── 0020 applies on top of 0019, once, and rewrites nothing.
          const first = await asOwner((o) => o.migrate({ dir: MIGRATIONS, log: quiet }));
--        assert.deepStrictEqual(first.applied.map((m) => [m.id, m.name, m.phase]), [['0020', 'user_owned_trust', 'expand'], ['0021', 'services_portal', 'migrate'], ['0022', 'public_profiles', 'expand'], ['0023', 'project_secrets', 'expand'], ['0024', 'retired_theme_campfire', 'migrate'], ['0026', 'theme_history', 'expand'], ['0027', 'notification_quiet_digest', 'expand'], ['0028', 'theme_site_overrides', 'expand'], ['0029', 'site_prefs', 'expand'], ['0030', 'run_tokens', 'expand'], ['0031', 'dock_states', 'expand'], ['0032', 'oauth_public_clients', 'expand'], ['0033', 'consents', 'expand'], ['0034', 'look_dates', 'expand'], ['0035', 'dev_api_keys', 'expand'], ['0036', 'qr_signin', 'expand'], ['0037', 'analytics_bot_api', 'expand'], ['0038', 'sharing', 'expand'], ['0039', 'locker_keys', 'expand'], ['0040', 'ai_offers', 'expand'], ['0041', 'adult_confirmation', 'expand'], ['0042', 'chat_app_links', 'expand'], ['0043', 'connect_apps', 'expand'], ['0044', 'consent_refusals', 'expand'], ['0045', 'machine_pools', 'expand'], ['0046', 'menu_clicks', 'expand'], ['0047', 'presence', 'expand'], ['0048', 'menu_feeds', 'expand'], ['0049', 'oauth_session_public_clients', 'expand'], ['0050', 'oauth_token_session_families', 'expand'], ['0051', 'outbox_rejected_index', 'expand'], ['0052', 'public_person_pages', 'expand'], ['0053', 'link_send_relay', 'expand'], ['0054', 'account_emails', 'expand'], ['0055', 'companion_mask_scope', 'expand']]);
++        assert.deepStrictEqual(first.applied.map((m) => [m.id, m.name, m.phase]), [['0020', 'user_owned_trust', 'expand'], ['0021', 'services_portal', 'migrate'], ['0022', 'public_profiles', 'expand'], ['0023', 'project_secrets', 'expand'], ['0024', 'retired_theme_campfire', 'migrate'], ['0026', 'theme_history', 'expand'], ['0027', 'notification_quiet_digest', 'expand'], ['0028', 'theme_site_overrides', 'expand'], ['0029', 'site_prefs', 'expand'], ['0030', 'run_tokens', 'expand'], ['0031', 'dock_states', 'expand'], ['0032', 'oauth_public_clients', 'expand'], ['0033', 'consents', 'expand'], ['0034', 'look_dates', 'expand'], ['0035', 'dev_api_keys', 'expand'], ['0036', 'qr_signin', 'expand'], ['0037', 'analytics_bot_api', 'expand'], ['0038', 'sharing', 'expand'], ['0039', 'locker_keys', 'expand'], ['0040', 'ai_offers', 'expand'], ['0041', 'adult_confirmation', 'expand'], ['0042', 'chat_app_links', 'expand'], ['0043', 'connect_apps', 'expand'], ['0044', 'consent_refusals', 'expand'], ['0045', 'machine_pools', 'expand'], ['0046', 'menu_clicks', 'expand'], ['0047', 'presence', 'expand'], ['0048', 'menu_feeds', 'expand'], ['0049', 'oauth_session_public_clients', 'expand'], ['0050', 'oauth_token_session_families', 'expand'], ['0051', 'outbox_rejected_index', 'expand'], ['0052', 'public_person_pages', 'expand'], ['0053', 'link_send_relay', 'expand'], ['0054', 'account_emails', 'expand'], ['0055', 'companion_mask_scope', 'expand'], ['0056', 'companion_locker_scope', 'expand']]);
          assert.deepStrictEqual((await asOwner((o) => o.migrate({ dir: MIGRATIONS, log: quiet }))).applied, [], 'already applied');
          await asOwner((o) => o.exec(fs.readFileSync(path.join(MIGRATIONS, '0020_user_owned_trust.sql'), 'utf8'))); // safe to run twice
          assert.deepStrictEqual(await rows(), seeded, 'no existing row changes');