installer v1 (A+B): install-code enrollment, panel code UI, EXE publish; DPAPI credential store

agent/scripts/run_agent_service.py

@@ -76,7 +76,11 @@ class Config:
     def __init__(self, env):
         self.hub_url = env.get("GTI_HUB_URL") or env.get("HUB_URL") or "http://localhost:8000"
         self.agent_id = env.get("AGENT_ID", "")
-        self.agent_token = env.get("AGENT_TOKEN") or env.get("AGENT_DEV_TOKEN", "")
+        self.credential_file = env.get("GTI_CREDENTIAL_FILE") or str(Path(os.environ.get("PROGRAMFILES", r"C:\Program Files")) / "GTI" / "FiscalAgent" / "credentials.bin")
+        # The permanent token NEVER lives in agent.env: it is decrypted from
+        # credentials.bin (DPAPI LocalMachine + SYSTEM/Administrators ACL). An
+        # explicit AGENT_TOKEN/AGENT_DEV_TOKEN in env wins (dev override only).
+        self.agent_token = self._resolve_agent_token(env)
         self.company_id = env.get("COMPANY_ID", "")
         self.company_uf = env.get("COMPANY_UF", "")
         self.database_path = env["FIREBIRD_DATABASE_PATH"]
@@ -98,6 +102,22 @@ class Config:
         self.expected_schema_fingerprint = env.get("EXPECTED_SCHEMA_FINGERPRINT", REFERENCE_SCHEMA_V1)
         self.log_path = env.get("AGENT_LOG_PATH", str(AGENT_ROOT / "logs" / "agent.log"))
 
+    @staticmethod
+    def _resolve_agent_token(env):
+        """DPAPI credential from credentials.bin; explicit AGENT_TOKEN env wins
+        (dev override). Fail closed: never log or fabricate a token."""
+        from gti_fiscal_agent.credential_store import install_env_from_credentials
+
+        explicit = env.get("AGENT_TOKEN") or env.get("AGENT_DEV_TOKEN") or ""
+        if explicit:
+            return explicit
+        try:
+            return install_env_from_credentials(env.get("GTI_CREDENTIAL_FILE") or str(
+                Path(os.environ.get("PROGRAMFILES", r"C:\Program Files")) / "GTI" / "FiscalAgent" / "credentials.bin"), env)
+        except Exception as exc:  # noqa: BLE001 — fail closed: no token, no heartbeat
+            logger.warning("no usable agent credential: %s", exc)
+            return ""
+
 
 class GracefulStop:
     def __init__(self):