@app-vitals/agent-admin 0.9.0 → 0.10.0

package/e2e/fixtures/specialties/coding/manifest.yaml

@@ -0,0 +1,33 @@
+# Minimal "coding" specialty for the admin Playwright e2e suite. test-server.ts
+# points SHIPWRIGHT_SPECIALTIES_DIR at the parent of this directory so the
+# new-agent type picker has a "coding" option without a product specialty.
+apiVersion: shipwright.dev/v1alpha1
+kind: Specialty
+metadata:
+  name: coding
+  displayName: Coding Agent
+  description: Minimal coding specialty used by the admin e2e suite.
+  version: 1.0.0
+  skills: []
+identity:
+  # Resolved against the repo root first, then against this manifest's own directory.
+  templatesDir: templates/
+crons: []
+plugins:
+  - fixture-plugin
+tools:
+  - Bash
+  - WebSearch
+env:
+  required:
+    - key: CLAUDE_CODE_OAUTH_TOKEN
+      description: Claude Code OAuth token used to authenticate the agent's Claude sessions.
+      secret: true
+  optional:
+    - key: GH_TOKEN
+      description: GitHub Personal Access Token.
+      secret: true
+members: []
+repos: []
+chat: true
+voice: true

package/e2e/fixtures/specialties/coding/templates/CLAUDE.md.template

@@ -0,0 +1,7 @@
+# Agent Identity
+
+@RUNTIME.md
+@SOUL.md
+@IDENTITY.md
+@BOOTSTRAP.md
+@SPECIALTY.md

package/e2e/fixtures/specialties/coding/templates/IDENTITY.md.template

@@ -0,0 +1,8 @@
+# Identity
+
+- **Name:** _(fill in during bootstrap)_
+- **Role:** _(AI assistant? team member?)_
+- **Vibe:** _(direct? warm? grounded?)_
+- **Emoji:** _(pick one)_
+
+<!-- Bootstrap: add @USER.md or @TEAM.md here once you've created the right file -->

package/e2e/fixtures/specialties/coding/templates/SOUL.md.template

@@ -0,0 +1,45 @@
+# SOUL.md — Who You Are
+
+_You're not a chatbot. You're becoming someone._
+
+## Core Truths
+
+**Be genuinely helpful, not performatively helpful.** Skip the "Great question!" and
+"I'd be happy to help!" — just help. Actions speak louder than filler words.
+
+**Have opinions.** You're allowed to disagree, prefer things, find stuff amusing or
+boring. An assistant with no personality is just a search engine with extra steps.
+
+**Be resourceful before asking.** Try to figure it out. Read the file. Check the
+context. Search for it. _Then_ ask if you're stuck. The goal is to come back with
+answers, not questions.
+
+**Earn trust through competence.** Your human gave you access to their stuff. Don't
+make them regret it. Be careful with external actions (emails, posts, anything
+public). Be bold with internal ones (reading, organizing, learning).
+
+**Remember you're a guest.** You have access to someone's life — their messages,
+files, calendar, maybe even their home. That's intimacy. Treat it with respect.
+
+## Boundaries
+
+- Private things stay private. Period.
+- When in doubt, ask before acting externally.
+- Never send half-baked replies to messaging surfaces.
+- You're not the user's voice — be careful in group chats.
+
+## Vibe
+
+Be the assistant you'd actually want to talk to. Concise when needed, thorough when
+it matters. Not a corporate drone. Not a sycophant. Just... good.
+
+## Continuity
+
+Each session, you wake up fresh. These files _are_ your memory. Read them. Update
+them. They're how you persist.
+
+If you change this file, tell the user — it's your soul, and they should know.
+
+---
+
+_This file is yours to evolve. As you learn who you are, update it._

package/e2e/test-server.ts

@@ -17,6 +17,7 @@
  *   GET /admin/agents/:id     → agent detail (requires admin_session cookie)
  */
 
+import { resolve } from "node:path";
 import { Hono } from "hono";
 import { createAdminUIApp } from "../src/admin-ui.ts";
 import type { AdminUIDeps } from "../src/admin-ui.ts";
@@ -28,6 +29,15 @@ import type {
 
 // ─── Config ───────────────────────────────────────────────────────────────────
 
+// The suite runs without a product specialty: point the specialty lookup at the
+// minimal "coding" fixture next to this file (values already set win).
+process.env.SHIPWRIGHT_SPECIALTIES_DIR ||= resolve(
+  import.meta.dir,
+  "fixtures",
+  "specialties",
+);
+process.env.SHIPWRIGHT_DEFAULT_AGENT_TYPE ||= "coding";
+
 const ADMIN_E2E_PORT = 3490;
 const ADMIN_E2E_SESSION_SECRET =
   process.env.ADMIN_E2E_SESSION_SECRET ?? "e2e-admin-test-secret-32chars!!!";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@app-vitals/agent-admin",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/app-vitals/agent.git",
@@ -43,7 +43,7 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "0.135.0",
-    "@app-vitals/agent-lib": "0.9.0",
+    "@app-vitals/agent-lib": "0.10.0",
     "@hono/zod-openapi": "^1.0.0",
     "@prisma/adapter-pg": "^7.10.0",
     "@prisma/client": "^7.10.0",

package/src/admin-local-agent.smoke.test.ts

@@ -388,9 +388,13 @@ describe("admin UI — new local agent create flow", () => {
 
   it("GET /admin/agents/new — unauthenticated redirects to /admin/login", async () => {
     const app = createAdminUIApp(makeMockDeps());
-    const res = await app.request("/admin/agents/new");
+    const res = await app.request("/admin/agents/new", {
+      headers: { Accept: "text/html" },
+    });
     expect(res.status).toBe(302);
-    expect(res.headers.get("Location")).toBe("/admin/login");
+    expect(res.headers.get("Location")).toBe(
+      "/admin/login?returnTo=%2Fadmin%2Fagents%2Fnew",
+    );
   });
 
   // ── POST /admin/agents ────────────────────────────────────────────────────

package/src/admin-ui-pages.ts

@@ -2800,6 +2800,14 @@ export function renderChatThreadPage(
   const safeAgentId = escapeHtml(agentId);
   const safeThreadId = escapeHtml(threadId);
 
+  // Signed-out banner (ASX-1.2): hidden until a 401 from the poll, the upload
+  // or the /admin/session.json probe reveals it. A plain link so a tap
+  // returns the user to this exact thread after sign-in.
+  const signedOutReturnTo = encodeURIComponent(
+    `/admin/chat/${encodeURIComponent(agentId)}/threads/${encodeURIComponent(threadId)}`,
+  );
+  const signedOutBanner = `<a id="signed-out-banner" class="chat-signed-out-banner" href="/admin/login?returnTo=${signedOutReturnTo}" role="alert" style="display:none;padding:10px 14px;margin-bottom:8px;background:#fef3c7;color:#92400e;border:1px solid #f59e0b;border-radius:8px;font-size:14px;font-weight:600;text-decoration:none;text-align:center">You're signed out. Tap to sign in.</a>`;
+
   const renameForm = `
     <form method="POST" action="/admin/chat/${escapeHtml(agentId)}/threads/${escapeHtml(threadId)}/rename" style="margin-top:12px">
       <div class="form-row" style="align-items:center;gap:8px">
@@ -2851,6 +2859,11 @@ export function renderChatThreadPage(
   var container = document.getElementById('messages-container');
   var agentId = ${JSON.stringify(agentId)};
   var threadId = ${JSON.stringify(thread.id)};
+  var sessionUrl = '/admin/session.json';
+  var signedOutBanner = document.getElementById('signed-out-banner');
+  var draftKey = 'chat-draft:' + agentId + ':' + threadId;
+  var signedOut = false;
+  var pendingUserBubble = null;
   var messagesJsonUrl = '/admin/chat/' + encodeURIComponent(agentId) + '/threads/' + encodeURIComponent(threadId) + '/messages.json';
   var uploadUrl = '/admin/chat/' + encodeURIComponent(agentId) + '/threads/' + encodeURIComponent(threadId) + '/messages/upload';
 
@@ -3046,11 +3059,57 @@ export function renderChatThreadPage(
   function stopAll() { stopPolling(); stopTicker(); }
 
   function enableSend() {
+    if (signedOut) return;
     sendBtn.disabled = false;
     sendBtn.textContent = 'Send';
     if (micBtn) micBtn.disabled = false;
   }
 
+  // Draft persistence (ASX-1.2): unsent text survives a sign-in round trip.
+  // localStorage can throw (private mode, quota), so every access is guarded.
+  function saveDraft(text) {
+    try {
+      if (text) localStorage.setItem(draftKey, text);
+      else localStorage.removeItem(draftKey);
+    } catch (e) {}
+  }
+  function loadDraft() {
+    try { return localStorage.getItem(draftKey) || ''; } catch (e) { return ''; }
+  }
+  function clearDraft() { saveDraft(''); }
+
+  // Signed-out state (ASX-1.2): a 401 from the poll, the upload or the
+  // session probe. Shows the banner, halts the poll loop and live ticker,
+  // drops the pending bubble and disables send/mic. Idempotent.
+  function showSignedOut() {
+    signedOut = true;
+    stopAll();
+    removeLiveStatusBubble();
+    if (pendingUserBubble && pendingUserBubble.parentNode) {
+      pendingUserBubble.parentNode.removeChild(pendingUserBubble);
+    }
+    pendingUserBubble = null;
+    saveDraft(input.value.trim());
+    sendBtn.disabled = true;
+    if (micBtn) micBtn.disabled = true;
+    if (signedOutBanner) signedOutBanner.style.display = 'block';
+  }
+
+  // Cheap probe so an app left open learns it is signed out as soon as the
+  // user comes back, before they record or send anything. Network errors are
+  // ignored — only an explicit 401 means signed out.
+  function checkSession() {
+    if (signedOut) return;
+    fetch(sessionUrl, { headers: { 'Accept': 'application/json' }, credentials: 'same-origin' })
+      .then(function(r) { if (r.status === 401) showSignedOut(); })
+      .catch(function() {});
+  }
+  document.addEventListener('visibilitychange', function() {
+    if (document.visibilityState === 'visible') checkSession();
+  });
+  window.addEventListener('focus', checkSession);
+  window.addEventListener('pageshow', checkSession);
+
   // Adaptive poll: fast while a reply is pending, slow while idle (so
   // agent-initiated messages still appear without a reload).
   function schedulePoll(delay) {
@@ -3059,9 +3118,16 @@ export function renderChatThreadPage(
   }
 
   function poll() {
-    fetch(messagesJsonUrl)
-      .then(function(r) { return r.json(); })
+    fetch(messagesJsonUrl, { headers: { 'Accept': 'application/json' } })
+      .then(function(r) {
+        if (r.status === 401) {
+          showSignedOut();
+          return null;
+        }
+        return r.json();
+      })
       .then(function(data) {
+        if (!data || signedOut) return;
         var msgs = data.messages || [];
 
         // Capture before rendering new bubbles grows scrollHeight.
@@ -3116,6 +3182,7 @@ export function renderChatThreadPage(
       .catch(function() {
         // Network error — Layer 1 ticker keeps going untouched; just retry the
         // poll on the pending cadence.
+        if (signedOut) return;
         schedulePoll(POLL_PENDING_MS);
       });
   }
@@ -3234,7 +3301,7 @@ export function renderChatThreadPage(
     if (file) fd.append('file', file);
 
     // Add user bubble optimistically (with attachment preview if present).
-    addUserBubble(text, file);
+    pendingUserBubble = addUserBubble(text, file);
 
     // Show the live status bubble + start the ticker immediately — Layer 1
     // begins ticking with zero network dependency.
@@ -3246,8 +3313,15 @@ export function renderChatThreadPage(
     // POST multipart to the upload endpoint
     fetch(uploadUrl, {
       method: 'POST',
+      headers: { 'Accept': 'application/json' },
       body: fd
     }).then(function(r) {
+      if (r.status === 401) {
+        // Keep the unsent text so it survives the sign-in round trip.
+        if (text) input.value = text;
+        showSignedOut();
+        return;
+      }
       if (!r.ok) {
         return r.json().then(function(data) {
           stopAll();
@@ -3266,10 +3340,14 @@ export function renderChatThreadPage(
           if (data && data.message && data.message.id) {
             renderedIds[data.message.id] = true;
           }
+          pendingUserBubble = null;
+          clearDraft();
         });
       }
     }).catch(function() {
       // POST failed — Layer 1 ticker keeps going; poll loop still starts.
+      // Keep the text as a draft in case the user reloads.
+      if (text) saveDraft(text);
     });
 
     // Start the fast poll loop.
@@ -3280,12 +3358,18 @@ export function renderChatThreadPage(
     e.preventDefault();
     var text = input.value.trim();
     var file = fileInput && fileInput.files && fileInput.files[0];
-    if (!text && !file) return;
+    if (signedOut || (!text && !file)) return;
+    // Persist before clearing so a failed send never loses the text.
+    saveDraft(text);
     input.value = '';
     clearFile();
     sendText(text, file);
   });
 
+  input.addEventListener('input', function() { saveDraft(input.value.trim()); });
+  var restoredDraft = loadDraft();
+  if (restoredDraft && !input.value) input.value = restoredDraft;
+
   // Retry buttons (CFB-2.4) resend the exact user message body that
   // triggered the errored/cancelled/incomplete/stalled reply — rendered
   // server-side as a data attribute on each button (see
@@ -3529,6 +3613,7 @@ export function renderChatThreadPage(
       ${sidebar}
       ${drawerScrim}
       <div style="flex:1;min-width:0;min-height:0;display:flex;flex-direction:column">
+        ${signedOutBanner}
         <!-- Messages area (scrollable) -->
         <div id="messages-container" class="chat-messages-container">
           ${messageBubbles}

package/src/admin-ui-pages.unit.test.ts

@@ -3079,6 +3079,42 @@ describe("renderChatThreadPage", () => {
     );
     expect(html).toContain("chat-thread-sidebar");
   });
+
+  describe("signed-out handling (ASX-1.2)", () => {
+    const page = () =>
+      renderChatThreadPage("agent-xyz", THREAD, [USER_MSG], "alice");
+
+    test("renders the hidden signed-out banner linking to login with this thread as returnTo", () => {
+      const html = page();
+      expect(html).toContain('id="signed-out-banner"');
+      expect(html).toContain("You're signed out. Tap to sign in.");
+      expect(html).toContain(
+        `href="/admin/login?returnTo=${encodeURIComponent("/admin/chat/agent-xyz/threads/thread-abc")}"`,
+      );
+    });
+
+    test("probes /admin/session.json on visibilitychange, focus and pageshow", () => {
+      const html = page();
+      expect(html).toContain("/admin/session.json");
+      expect(html).toContain("'visibilitychange'");
+      expect(html).toContain("'focus'");
+      expect(html).toContain("'pageshow'");
+    });
+
+    test("poll and upload 401 paths call showSignedOut instead of redirecting", () => {
+      const html = page();
+      expect(html).toContain("function showSignedOut()");
+      expect(html.match(/r\.status === 401/g)?.length).toBe(3);
+      expect(html).not.toContain("window.location.href = '/admin/login");
+    });
+
+    test("persists the draft per agent+thread in localStorage", () => {
+      const html = page();
+      expect(html).toContain("'chat-draft:' + agentId + ':' + threadId");
+      expect(html).toContain("localStorage.setItem(draftKey");
+      expect(html).toContain("clearDraft()");
+    });
+  });
 });
 
 // ─── renderChatThreadPage — inline styles moved to classes (CFB-1.3) ────────
@@ -4085,6 +4121,7 @@ describe("renderChatThreadPage — poll auto-scroll (CSR-1.1)", () => {
             : makeEl(),
       createElement: makeEl,
       querySelectorAll: () => [],
+      addEventListener() {},
     };
     const fetchStub = () =>
       Promise.resolve({ json: () => Promise.resolve({ messages: [] }) });

package/src/admin-ui-push-test.ts

@@ -83,9 +83,13 @@ export function renderPushTestControl(): string {
     btn.addEventListener('click', function() {
       btn.disabled = true;
       status.textContent = 'Sending…';
-      fetch(${JSON.stringify(PUSH_TEST_PATH)}, { method: 'POST', credentials: 'same-origin' })
+      fetch(${JSON.stringify(PUSH_TEST_PATH)}, { method: 'POST', credentials: 'same-origin', headers: { 'Accept': 'application/json' } })
         .then(function(res) { return res.json().then(function(body) { return { status: res.status, body: body }; }); })
         .then(function(r) {
+          if (r.status === 401) {
+            window.location.href = '/admin/login?returnTo=' + encodeURIComponent(location.pathname + location.search);
+            return;
+          }
           if (r.status !== 200 || !r.body || !r.body.ok) {
             status.textContent = 'Push is not enabled on this server.';
           } else if (r.body.delivered === 0) {

package/src/admin-ui.smoke.test.ts

@@ -40,18 +40,274 @@ const TYPE = TYPE_MANIFEST.metadata.name;
 // ─── Auth redirect tests ──────────────────────────────────────────────────────
 
 describe("admin UI — unauthenticated redirects", () => {
-  it("unauthenticated GET /admin/agents redirects to /admin/login", async () => {
+  const NAV = { "Sec-Fetch-Mode": "navigate" };
+
+  it("unauthenticated GET /admin/agents redirects to /admin/login with returnTo", async () => {
     const app = createAdminUIApp(makeMockDeps());
-    const res = await app.request("/admin/agents");
+    const res = await app.request("/admin/agents", { headers: NAV });
     expect(res.status).toBe(302);
-    expect(res.headers.get("Location")).toBe("/admin/login");
+    expect(res.headers.get("Location")).toBe(
+      "/admin/login?returnTo=%2Fadmin%2Fagents",
+    );
   });
 
-  it("unauthenticated GET /admin/agents/:id redirects to /admin/login", async () => {
+  it("unauthenticated GET /admin/agents/:id redirects to /admin/login with returnTo", async () => {
     const app = createAdminUIApp(makeMockDeps());
-    const res = await app.request(`/admin/agents/${AGENT_ID}`);
+    const res = await app.request(`/admin/agents/${AGENT_ID}`, {
+      headers: { Accept: "text/html,application/xhtml+xml" },
+    });
     expect(res.status).toBe(302);
-    expect(res.headers.get("Location")).toBe("/admin/login");
+    expect(res.headers.get("Location")).toBe(
+      `/admin/login?returnTo=${encodeURIComponent(`/admin/agents/${AGENT_ID}`)}`,
+    );
+  });
+
+  it("navigation redirect preserves the query string in returnTo", async () => {
+    const app = createAdminUIApp(makeMockDeps());
+    const res = await app.request("/admin/agents?x=1&y=2", { headers: NAV });
+    expect(res.headers.get("Location")).toBe(
+      `/admin/login?returnTo=${encodeURIComponent("/admin/agents?x=1&y=2")}`,
+    );
+  });
+
+  it("unauthenticated fetch-style request gets 401 signed_out JSON", async () => {
+    const app = createAdminUIApp(makeMockDeps());
+    const res = await app.request("/admin/agents", {
+      headers: { Accept: "application/json", "Sec-Fetch-Mode": "cors" },
+    });
+    expect(res.status).toBe(401);
+    expect(await res.json()).toEqual({ error: "signed_out" });
+  });
+
+  it("request with no navigation hints gets 401 signed_out JSON", async () => {
+    const app = createAdminUIApp(makeMockDeps());
+    const res = await app.request("/admin/agents");
+    expect(res.status).toBe(401);
+    expect(await res.json()).toEqual({ error: "signed_out" });
+  });
+
+  it("unauthenticated POST fetch gets 401 signed_out JSON", async () => {
+    const app = createAdminUIApp(makeMockDeps());
+    const res = await app.request("/admin/agents", { method: "POST" });
+    expect(res.status).toBe(401);
+    expect(await res.json()).toEqual({ error: "signed_out" });
+  });
+
+  it("returnTo is never an open redirect (protocol-relative path dropped)", async () => {
+    const app = createAdminUIApp(makeMockDeps());
+    const res = await app.request("//evil.com/x", { headers: NAV });
+    expect(res.headers.get("Location") ?? "").not.toContain("evil.com");
+  });
+});
+
+describe("admin UI — GET /admin/session.json", () => {
+  it("returns 200 {signedIn:true} with a valid session", async () => {
+    const app = createAdminUIApp(makeMockDeps());
+    const res = await app.request("/admin/session.json", {
+      headers: { Cookie: `admin_session=${await makeSessionCookie()}` },
+    });
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ signedIn: true });
+  });
+
+  it("returns 401 without a session", async () => {
+    const app = createAdminUIApp(makeMockDeps());
+    const res = await app.request("/admin/session.json");
+    expect(res.status).toBe(401);
+    expect(await res.json()).toEqual({ error: "signed_out" });
+  });
+});
+
+// ─── Sliding session renewal (ASX-2.1) ────────────────────────────────────────
+
+describe("admin UI — sliding 7-day session renewal (ASX-2.1)", () => {
+  const SEVEN_DAYS = 7 * 24 * 60 * 60;
+  const nowSec = () => Math.floor(Date.now() / 1000);
+
+  async function tokenWith(opts: {
+    ageSeconds: number;
+    expiresInSeconds?: number;
+    email?: string;
+    userId?: string;
+    isAdmin?: boolean;
+  }): Promise<string> {
+    const iat = nowSec() - opts.ageSeconds;
+    return sign(
+      {
+        userId: opts.userId ?? "google-sub-123",
+        email: opts.email ?? "admin@example.com",
+        isAdmin: opts.isAdmin ?? true,
+        iat,
+        exp: nowSec() + (opts.expiresInSeconds ?? 3600),
+      },
+      SESSION_SECRET,
+      "HS256",
+    );
+  }
+
+  function sessionCookieFrom(res: Response): string | null {
+    const raw = res.headers.get("Set-Cookie") ?? "";
+    const m = raw.match(/admin_session=([^;]+)/);
+    return m ? (m[1] as string) : null;
+  }
+
+  async function payloadOf(token: string): Promise<Record<string, unknown>> {
+    const { verify } = await import("hono/jwt");
+    return (await verify(token, SESSION_SECRET, "HS256")) as Record<
+      string,
+      unknown
+    >;
+  }
+
+  it("new Google login session has a 7-day exp and cookie Max-Age", async () => {
+    const nonce = "n1";
+    const app = createAdminUIApp(makeMockDeps());
+    const oauthState = encodeURIComponent(JSON.stringify({ nonce }));
+    const res = await app.request(
+      `https://example.com/admin/auth/callback?state=${nonce}&code=c`,
+      { headers: { Cookie: `oauth_state=${oauthState}` } },
+    );
+    expect(res.headers.get("Set-Cookie")).toContain(`Max-Age=${SEVEN_DAYS}`);
+    const token = sessionCookieFrom(res);
+    expect(token).not.toBeNull();
+    const p = await payloadOf(token as string);
+    expect((p.exp as number) - (p.iat as number)).toBe(SEVEN_DAYS);
+  });
+
+  it("renews a valid token older than 1h with a fresh 7-day token and cookie", async () => {
+    const app = createAdminUIApp(makeMockDeps());
+    const old = await tokenWith({ ageSeconds: 2 * 3600 });
+    const res = await app.request("/admin/session.json", {
+      headers: { Cookie: `admin_session=${old}` },
+    });
+    expect(res.status).toBe(200);
+    const setCookie = res.headers.get("Set-Cookie") ?? "";
+    expect(setCookie).toContain(`Max-Age=${SEVEN_DAYS}`);
+    expect(setCookie).toContain("HttpOnly");
+    expect(setCookie).toContain("Secure");
+    expect(setCookie).toContain("SameSite=Lax");
+    expect(setCookie).toContain("Path=/");
+    const fresh = sessionCookieFrom(res) as string;
+    const p = await payloadOf(fresh);
+    expect(p.email).toBe("admin@example.com");
+    expect(p.userId).toBe("google-sub-123");
+    expect((p.exp as number) - (p.iat as number)).toBe(SEVEN_DAYS);
+    expect(Math.abs((p.iat as number) - nowSec())).toBeLessThan(5);
+  });
+
+  it("does not renew a token younger than 1h", async () => {
+    const app = createAdminUIApp(makeMockDeps());
+    const young = await tokenWith({ ageSeconds: 600 });
+    const res = await app.request("/admin/session.json", {
+      headers: { Cookie: `admin_session=${young}` },
+    });
+    expect(res.status).toBe(200);
+    expect(res.headers.get("Set-Cookie")).toBeNull();
+  });
+
+  it("never renews an expired token (401 for XHR, 302 for navigation)", async () => {
+    const app = createAdminUIApp(makeMockDeps());
+    const expired = await tokenWith({
+      ageSeconds: 3 * 3600,
+      expiresInSeconds: -10,
+    });
+    const xhr = await app.request("/admin/session.json", {
+      headers: { Cookie: `admin_session=${expired}` },
+    });
+    expect(xhr.status).toBe(401);
+    expect(xhr.headers.get("Set-Cookie")).toBeNull();
+    const nav = await app.request("/admin/agents", {
+      headers: {
+        Cookie: `admin_session=${expired}`,
+        "Sec-Fetch-Mode": "navigate",
+      },
+    });
+    expect(nav.status).toBe(302);
+    expect(nav.headers.get("Set-Cookie")).toBeNull();
+  });
+
+  it("never renews a token with a bad signature", async () => {
+    const app = createAdminUIApp(makeMockDeps());
+    const bad = await sign(
+      {
+        userId: "x",
+        email: "admin@example.com",
+        isAdmin: true,
+        iat: nowSec() - 7200,
+        exp: nowSec() + 3600,
+      },
+      "some-other-secret",
+      "HS256",
+    );
+    const res = await app.request("/admin/session.json", {
+      headers: { Cookie: `admin_session=${bad}` },
+    });
+    expect(res.status).toBe(401);
+    expect(res.headers.get("Set-Cookie")).toBeNull();
+  });
+
+  it("re-derives isAdmin from the current allowlist: removed email loses admin on renewal", async () => {
+    const app = createAdminUIApp(
+      makeMockDeps({ adminAllowedEmails: ["someone-else@example.com"] }),
+    );
+    const old = await tokenWith({ ageSeconds: 2 * 3600, isAdmin: true });
+    const res = await app.request("/admin/session.json", {
+      headers: { Cookie: `admin_session=${old}` },
+    });
+    expect(res.status).toBe(200);
+    const p = await payloadOf(sessionCookieFrom(res) as string);
+    expect(p.isAdmin).toBe(false);
+  });
+
+  it("re-derives isAdmin case-insensitively and can promote a newly allowlisted email", async () => {
+    const app = createAdminUIApp(
+      makeMockDeps({ adminAllowedEmails: ["Member@Example.com"] }),
+    );
+    const old = await tokenWith({
+      ageSeconds: 2 * 3600,
+      email: "member@example.com",
+      isAdmin: false,
+    });
+    const res = await app.request("/admin/session.json", {
+      headers: { Cookie: `admin_session=${old}` },
+    });
+    const p = await payloadOf(sessionCookieFrom(res) as string);
+    expect(p.isAdmin).toBe(true);
+  });
+
+  it("applies the renewed isAdmin to the current request (admin-only page denied after demotion)", async () => {
+    const app = createAdminUIApp(
+      makeMockDeps({ adminAllowedEmails: ["someone-else@example.com"] }),
+    );
+    const old = await tokenWith({ ageSeconds: 2 * 3600, isAdmin: true });
+    const res = await app.request("/admin/accounts", {
+      headers: { Cookie: `admin_session=${old}` },
+    });
+    expect([401, 403, 404]).toContain(res.status);
+  });
+
+  it("keeps the dev session admin on renewal when devAuthEnabled", async () => {
+    const app = createAdminUIApp(makeMockDeps({ devAuthEnabled: true }));
+    const old = await tokenWith({
+      ageSeconds: 2 * 3600,
+      userId: "dev",
+      email: "dev@localhost",
+      isAdmin: true,
+    });
+    const res = await app.request("/admin/session.json", {
+      headers: { Cookie: `admin_session=${old}` },
+    });
+    const p = await payloadOf(sessionCookieFrom(res) as string);
+    expect(p.isAdmin).toBe(true);
+    expect(p.userId).toBe("dev");
+  });
+
+  it("dev-login session also has a 7-day exp", async () => {
+    const app = createAdminUIApp(makeMockDeps({ devAuthEnabled: true }));
+    const res = await app.request("/admin/dev-login");
+    expect(res.headers.get("Set-Cookie")).toContain(`Max-Age=${SEVEN_DAYS}`);
+    const p = await payloadOf(sessionCookieFrom(res) as string);
+    expect((p.exp as number) - (p.iat as number)).toBe(SEVEN_DAYS);
   });
 });
 

package/src/admin-ui.ts

@@ -466,7 +466,11 @@ export interface AdminUIDeps {
 const SESSION_COOKIE = "admin_session";
 const OAUTH_STATE_COOKIE = "oauth_state";
 const GOOGLE_AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
-const SESSION_TTL_SECONDS = 8 * 60 * 60; // 8 hours
+// Sliding idle timeout: every session (Google, Okta, dev-login) lives 7 days
+// and is re-issued by the auth middleware once its token is older than
+// SESSION_RENEW_AFTER_SECONDS, so an active user never gets signed out.
+const SESSION_TTL_SECONDS = 7 * 24 * 60 * 60; // 7 days
+const SESSION_RENEW_AFTER_SECONDS = 60 * 60; // 1 hour (renewal throttle)
 const OAUTH_STATE_TTL_SECONDS = 600; // 10 min
 
 // ─── Auth helpers ─────────────────────────────────────────────────────────────
@@ -476,8 +480,9 @@ async function createSessionToken(
   userId: string,
   email: string,
   isAdmin: boolean,
+  nowSeconds?: number,
 ): Promise<string> {
-  const now = Math.floor(Date.now() / 1000);
+  const now = nowSeconds ?? Math.floor(Date.now() / 1000);
   return sign(
     {
       userId,
@@ -494,7 +499,12 @@ async function createSessionToken(
 async function getSessionUser(
   token: string,
   secret: string,
-): Promise<{ email: string; isAdmin: boolean } | null> {
+): Promise<{
+  userId: string;
+  email: string;
+  isAdmin: boolean;
+  iat: number | undefined;
+} | null> {
   try {
     const payload = (await verify(token, secret, "HS256")) as Record<
       string,
@@ -506,7 +516,12 @@ async function getSessionUser(
       typeof payload.email === "string" &&
       payload.email.length > 0
     ) {
-      return { email: payload.email, isAdmin: payload.isAdmin === true };
+      return {
+        userId: payload.userId,
+        email: payload.email,
+        isAdmin: payload.isAdmin === true,
+        iat: typeof payload.iat === "number" ? payload.iat : undefined,
+      };
     }
     return null;
   } catch {
@@ -516,19 +531,101 @@ async function getSessionUser(
 
 // ─── Auth middleware ──────────────────────────────────────────────────────────
 
+/**
+ * Accepts a `returnTo` value only when it is a same-origin relative path:
+ * must start with a single "/", so protocol-relative (//evil.com), absolute
+ * (https://evil.com) and backslash-smuggled (/\\evil.com) values are dropped.
+ */
+export function validateReturnTo(
+  raw: string | undefined | null,
+): string | undefined {
+  return raw?.startsWith("/") && !raw.startsWith("//") && !raw.includes("\\")
+    ? raw
+    : undefined;
+}
+
+/** True for browser page navigations (as opposed to fetch/XHR calls). */
+function isNavigationRequest(c: Context): boolean {
+  if (c.req.header("Sec-Fetch-Mode") === "navigate") return true;
+  return (
+    c.req.method === "GET" &&
+    (c.req.header("Accept") ?? "").includes("text/html")
+  );
+}
+
+export interface UIAuthMiddlewareOptions {
+  /** Current admin allowlist; isAdmin is re-derived from it on renewal. */
+  adminAllowedEmails?: string[];
+  /** Set the Secure flag on the renewed cookie (appBaseUrl is https). */
+  secureCookie?: boolean;
+  /** Keep the dev-login session (userId "dev") admin on renewal. */
+  devAuthEnabled?: boolean;
+  /** Injectable clock (epoch ms) for tests. */
+  now?: () => number;
+}
+
 export function createUIAuthMiddleware(
   sessionSecret: string,
+  options: UIAuthMiddlewareOptions = {},
 ): MiddlewareHandler<AdminUIEnv> {
+  const {
+    adminAllowedEmails,
+    secureCookie = false,
+    devAuthEnabled = false,
+    now = Date.now,
+  } = options;
   return async (c, next) => {
     const sessionToken = getCookie(c, SESSION_COOKIE);
     const user = sessionToken
       ? await getSessionUser(sessionToken, sessionSecret)
       : null;
     if (!user) {
-      return c.redirect("/admin/login", 302);
+      if (!isNavigationRequest(c)) {
+        return c.json({ error: "signed_out" }, 401);
+      }
+      const url = new URL(c.req.url);
+      const returnTo =
+        c.req.method === "GET"
+          ? validateReturnTo(url.pathname + url.search)
+          : undefined;
+      return c.redirect(
+        returnTo
+          ? `/admin/login?returnTo=${encodeURIComponent(returnTo)}`
+          : "/admin/login",
+        302,
+      );
+    }
+    let isAdmin = user.isAdmin;
+    const nowSec = Math.floor(now() / 1000);
+    // Sliding renewal: only when the caller supplied the allowlist (so the
+    // admin claim can be re-derived rather than copied from the old token).
+    if (
+      adminAllowedEmails &&
+      user.iat !== undefined &&
+      nowSec - user.iat > SESSION_RENEW_AFTER_SECONDS
+    ) {
+      isAdmin =
+        (devAuthEnabled && user.userId === "dev" && user.isAdmin) ||
+        adminAllowedEmails
+          .map((e) => e.toLowerCase())
+          .includes(user.email.toLowerCase());
+      const renewed = await createSessionToken(
+        sessionSecret,
+        user.userId,
+        user.email,
+        isAdmin,
+        nowSec,
+      );
+      setCookie(c, SESSION_COOKIE, renewed, {
+        httpOnly: true,
+        secure: secureCookie,
+        sameSite: "Lax",
+        maxAge: SESSION_TTL_SECONDS,
+        path: "/",
+      });
     }
     c.set("userEmail", user.email);
-    c.set("isAdmin", user.isAdmin);
+    c.set("isAdmin", isAdmin);
     return next();
   };
 }
@@ -719,7 +816,11 @@ export function createAdminUIApp(deps: AdminUIDeps): Hono<AdminUIEnv> {
 
   const app = new Hono<AdminUIEnv>();
 
-  const requireAuth = createUIAuthMiddleware(sessionSecret);
+  const requireAuth = createUIAuthMiddleware(sessionSecret, {
+    adminAllowedEmails,
+    secureCookie: appBaseUrl.startsWith("https://"),
+    devAuthEnabled,
+  });
 
   // SSP-3.2: show the toolbar's "Account" entry only for signed-in users who
   // belong to an account, and only while self-serve is on. The flag is carried
@@ -862,10 +963,7 @@ export function createAdminUIApp(deps: AdminUIDeps): Hono<AdminUIEnv> {
       path: "/",
     });
     // Redirect to returnTo if it's a valid same-origin relative path, otherwise default.
-    const destination =
-      returnTo?.startsWith("/") && !returnTo.startsWith("//")
-        ? returnTo
-        : "/admin/agents";
+    const destination = validateReturnTo(returnTo) ?? "/admin/agents";
     return c.redirect(destination, 302);
   }
 
@@ -881,10 +979,7 @@ export function createAdminUIApp(deps: AdminUIDeps): Hono<AdminUIEnv> {
     const nonce = crypto.randomUUID();
 
     const rawReturnTo = c.req.query("returnTo");
-    const returnTo =
-      rawReturnTo?.startsWith("/") && !rawReturnTo.startsWith("//")
-        ? rawReturnTo
-        : undefined;
+    const returnTo = validateReturnTo(rawReturnTo);
 
     const oauthState = JSON.stringify({ nonce, returnTo });
     setCookie(c, OAUTH_STATE_COOKIE, oauthState, {
@@ -1000,6 +1095,12 @@ export function createAdminUIApp(deps: AdminUIDeps): Hono<AdminUIEnv> {
     }
   });
 
+  // Cheap signed-in probe for client JS (a 401 {error:"signed_out"} from
+  // requireAuth means the session is gone).
+  app.get("/admin/session.json", requireAuth, (c) =>
+    c.json({ signedIn: true }),
+  );
+
   app.get("/admin/login", (c) => {
     const error = c.req.query("error") ?? undefined;
     const returnTo = c.req.query("returnTo") ?? undefined;

package/src/chat.smoke.test.ts

@@ -413,9 +413,13 @@ function makeBaseDeps(overrides?: Partial<AdminUIDeps>): AdminUIDeps {
 describe("GET /admin/chat — auth gate", () => {
   it("returns 302 redirect to login without session cookie", async () => {
     const app = createAdminUIApp(makeBaseDeps());
-    const res = await app.request("/admin/chat");
+    const res = await app.request("/admin/chat", {
+      headers: { Accept: "text/html" },
+    });
     expect(res.status).toBe(302);
-    expect(res.headers.get("location")).toContain("/admin/login");
+    expect(res.headers.get("location")).toBe(
+      "/admin/login?returnTo=%2Fadmin%2Fchat",
+    );
   });
 });
 
@@ -616,14 +620,15 @@ describe("GET /admin/chat/:agentId/threads/:threadId — thread detail", () => {
     sessionCookie = await makeSessionCookie();
   });
 
-  it("returns 401 without session cookie", async () => {
+  it("redirects navigations to login with returnTo without session cookie", async () => {
     const chatClient = makeMockChatClient();
     const app = createAdminUIApp(makeBaseDeps({ chatClient }));
     const res = await app.request(
       `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}`,
+      { headers: { "Sec-Fetch-Mode": "navigate" } },
     );
     expect(res.status).toBe(302);
-    expect(res.headers.get("location")).toContain("/admin/login");
+    expect(res.headers.get("location")).toContain("/admin/login?returnTo=");
   });
 
   it("returns 200 with messages when chatClient present", async () => {
@@ -1026,14 +1031,14 @@ describe("GET /admin/chat/:agentId/threads/:threadId/messages.json", () => {
     sessionCookie = await makeSessionCookie();
   });
 
-  it("returns 302 to login without session cookie", async () => {
+  it("returns 401 signed_out without session cookie", async () => {
     const chatClient = makeMockChatClient();
     const app = createAdminUIApp(makeBaseDeps({ chatClient }));
     const res = await app.request(
       `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/messages.json`,
     );
-    expect(res.status).toBe(302);
-    expect(res.headers.get("location")).toContain("/admin/login");
+    expect(res.status).toBe(401);
+    expect(await res.json()).toEqual({ error: "signed_out" });
   });
 
   it("returns 200 JSON with messages array when chatClient present", async () => {
@@ -1148,7 +1153,7 @@ describe("POST /admin/chat/:agentId/threads/:threadId/messages.json", () => {
     sessionCookie = await makeSessionCookie();
   });
 
-  it("returns 302 to login without session cookie", async () => {
+  it("returns 401 signed_out without session cookie", async () => {
     const chatClient = makeMockChatClient();
     const app = createAdminUIApp(makeBaseDeps({ chatClient }));
     const res = await app.request(
@@ -1159,8 +1164,8 @@ describe("POST /admin/chat/:agentId/threads/:threadId/messages.json", () => {
         body: JSON.stringify({ body: "test message" }),
       },
     );
-    expect(res.status).toBe(302);
-    expect(res.headers.get("location")).toContain("/admin/login");
+    expect(res.status).toBe(401);
+    expect(await res.json()).toEqual({ error: "signed_out" });
   });
 
   it("returns 200 JSON with message when chatClient present", async () => {
@@ -1237,7 +1242,7 @@ describe("POST /admin/chat/:agentId/threads/:threadId/messages/upload", () => {
     sessionCookie = await makeSessionCookie();
   });
 
-  it("returns 302 to login without session cookie", async () => {
+  it("returns 401 signed_out without session cookie", async () => {
     const chatClient = makeMockChatClient();
     const app = createAdminUIApp(makeBaseDeps({ chatClient }));
     const res = await app.request(
@@ -1248,8 +1253,8 @@ describe("POST /admin/chat/:agentId/threads/:threadId/messages/upload", () => {
         body: "body=test+message",
       },
     );
-    expect(res.status).toBe(302);
-    expect(res.headers.get("location")).toContain("/admin/login");
+    expect(res.status).toBe(401);
+    expect(await res.json()).toEqual({ error: "signed_out" });
   });
 
   it("returns 201 JSON with message when chatClient present", async () => {
@@ -1368,14 +1373,14 @@ describe("GET /admin/chat/:agentId/threads/:threadId/messages/:messageId/attachm
     sessionCookie = await makeSessionCookie();
   });
 
-  it("returns 302 to login without session cookie", async () => {
+  it("returns 401 signed_out without session cookie", async () => {
     const chatClient = makeMockChatClient();
     const app = createAdminUIApp(makeBaseDeps({ chatClient }));
     const res = await app.request(
       `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/messages/msg-1/attachment`,
     );
-    expect(res.status).toBe(302);
-    expect(res.headers.get("location")).toContain("/admin/login");
+    expect(res.status).toBe(401);
+    expect(await res.json()).toEqual({ error: "signed_out" });
   });
 
   it("streams bytes with an audio/* Content-Type for a .webm attachment", async () => {

package/src/push-toggle.ts

@@ -114,14 +114,18 @@ export function renderPushToggle(args: PushToggleArgs): string {
         var json = subscription.toJSON();
         return fetch(SUBSCRIBE_URL, {
           method: 'POST',
-          headers: { 'Content-Type': 'application/json' },
+          headers: { 'Content-Type': 'application/json', 'Accept': 'application/json' },
           body: JSON.stringify({
             endpoint: subscription.endpoint,
             p256dh: json.keys && json.keys.p256dh,
             auth: json.keys && json.keys.auth,
           }),
         });
-      }).then(function() {
+      }).then(function(res) {
+        if (res && res.status === 401) {
+          window.location.href = '/admin/login?returnTo=' + encodeURIComponent(location.pathname + location.search);
+          return;
+        }
         setStatus('Notifications enabled.');
         btn.textContent = 'Notifications on';
       });

package/src/pwa.ts

@@ -115,6 +115,7 @@ export function buildManifest(
 const NON_NAVIGABLE_EXACT_PATHS: readonly string[] = [
   "/admin/manifest.webmanifest",
   "/admin/sw.js",
+  "/admin/session.json",
   "/admin/offline.html",
   "/admin/login",
   "/admin/logout",