feat: enforce agent owner in UI, rename shared section, add auth docs

- Hide delete button for non-owners in MainPanel
- Rename sidebar section from "Shared with Me" to "Shared Agents"
- Document Okta multi-user auth and sharing model in CLAUDE.md

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: dougrathbone

CLAUDE.md

@@ -41,6 +41,63 @@ npm start         # Run production server
 - Server → Client: `{ type: 'response', id, result }` or `{ type: 'error', id, error }`
 - Server → All: `{ type: 'event', channel, payload }` (broadcasts)
 
+## Authentication & Multi-User
+
+Conduit supports multi-user authentication via Okta OIDC. When Okta is not configured, it runs in **dev bypass mode** — identical to the original single-user behavior with zero configuration.
+
+**Dev mode** (default): No login required. A synthetic `dev-user` owns all entities. Set no env vars.
+
+**Production mode**: Set these environment variables to enable Okta OIDC:
+
+| Variable | Description |
+|----------|-------------|
+| `CONDUIT_OKTA_ISSUER` | Okta issuer URL (e.g., `https://company.okta.com/oauth2/default`) |
+| `CONDUIT_OKTA_CLIENT_ID` | OIDC application client ID |
+| `CONDUIT_OKTA_CLIENT_SECRET` | OIDC application client secret |
+| `CONDUIT_OKTA_REDIRECT_URI` | Callback URL (default: `http://localhost:7456/auth/callback`) |
+| `CONDUIT_SESSION_SECRET` | Secret for signing session cookies |
+| `CONDUIT_SESSION_TTL_MS` | Session lifetime in ms (default: 86400000 / 24h) |
+
+**Auth flow**: OIDC Authorization Code + PKCE. Sessions stored in SQLite. Groups synced from Okta ID token `groups` claim on each login.
+
+**Auth routes** (HTTP, not WebSocket):
+- `GET /auth/login` — redirects to Okta
+- `GET /auth/callback` — exchanges code, creates session
+- `POST /auth/logout` — destroys session
+- `GET /auth/me` — returns current user + groups
+
+**Auth files**:
+- `src/server/auth/config.ts` — env var reading, `isAuthEnabled()`
+- `src/server/auth/okta.ts` — OIDC client (openid-client v6)
+- `src/server/auth/middleware.ts` — session validation middleware
+- `src/server/auth/devBypass.ts` — dev mode synthetic user
+- `src/server/auth/routes.ts` — Express auth router
+
+## Ownership & Sharing
+
+Every entity (agents, publish targets, repositories, global MCP servers) has an `ownerId` column linking to a user. Triggers inherit visibility from their parent agent.
+
+**Ownership rules:**
+- Entities are owned by whoever creates them (`ownerId` set on creation)
+- Only the owner can delete an entity or modify its shares
+- Shared users can view, edit, and run — but not delete or reshare
+
+**Sharing model**: Polymorphic `shares` table maps `(entityType, entityId)` → `(user | group | everyone)`.
+
+**Visibility rule** — a user sees an entity if any of:
+1. They own it
+2. It's shared directly with them
+3. It's shared with a group they belong to
+4. It's shared with everyone
+
+**Sharing files**:
+- `src/main/db/queries/access.ts` — visibility queries (`getVisibleEntityIds`, `canAccessEntity`, `isEntityOwner`)
+- `src/main/db/queries/shares.ts` — share CRUD
+- `src/renderer/components/ShareDialog.tsx` — sharing UI modal
+- `src/renderer/hooks/useShares.ts` — TanStack Query hooks for shares
+
+**Frontend**: The sidebar splits entities into "My Agents" / "Shared Agents" sections. The share button and delete button only appear for owners.
+
 ## Data Storage
 
 All data lives under `~/.conduit/` (or `$CONDUIT_DATA_DIR`):

src/renderer/components/agents/AgentList.tsx

@@ -146,7 +146,7 @@ export function AgentList() {
       {sharedAgents.length > 0 && (
         <>
           <div className="text-[10px] font-medium uppercase tracking-wider text-[var(--text-secondary)] px-3 py-1.5">
-            Shared with Me <span className="ml-1 opacity-60">{sharedAgents.length}</span>
+            Shared Agents <span className="ml-1 opacity-60">{sharedAgents.length}</span>
           </div>
           {sharedAgents.map((agent) => (
             <AgentItem

src/renderer/components/layout/MainPanel.tsx

@@ -10,6 +10,7 @@ import { RunDetail } from '@renderer/components/runs/RunDetail'
 import { TerminalPane } from '@renderer/components/layout/TerminalPane'
 import { useAgent, useDeleteAgent } from '@renderer/hooks/useAgents'
 import { useRuns } from '@renderer/hooks/useRuns'
+import { useAuth } from '@renderer/contexts/AuthContext'
 import { useUIStore } from '@renderer/store/ui'
 import { cn } from '@renderer/lib/utils'
 import { api } from '@renderer/lib/ipc'
@@ -25,7 +26,9 @@ export function MainPanel({ agentId }: MainPanelProps) {
   const { data: agent } = useAgent(agentId)
   const { data: runs } = useRuns(agentId)
   const deleteAgent = useDeleteAgent()
+  const { user } = useAuth()
   const { activeRunId, setActiveRun, selectAgent } = useUIStore()
+  const isOwner = agent?.ownerId === user?.id
   const queryClient = useQueryClient()
 
   const [tab, setTab] = useState<Tab>('configure')
@@ -119,15 +122,17 @@ export function MainPanel({ agentId }: MainPanelProps) {
               setTab('runs')
             }}
           />
-          <Button
-            variant="ghost"
-            size="sm"
-            onClick={handleDeleteAgent}
-            className="text-[var(--text-secondary)] hover:text-red-400 px-1.5"
-            title="Delete agent"
-          >
-            <Trash2 className="h-4 w-4" />
-          </Button>
+          {isOwner && (
+            <Button
+              variant="ghost"
+              size="sm"
+              onClick={handleDeleteAgent}
+              className="text-[var(--text-secondary)] hover:text-red-400 px-1.5"
+              title="Delete agent"
+            >
+              <Trash2 className="h-4 w-4" />
+            </Button>
+          )}
         </div>
       </div>