@aryacode/dsh-aryacode-polish 0.6.2 → 0.7.3

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## [0.7.3] - 2026-10-28
+
+### Fixed
+
+- **A sign-out that only looked like one.** gh auth logout --user removes the
+  account it names, and a machine with a second account in the CLI keyring makes
+  that one active, so the dialog quietly carried on as somebody else while the
+  sidebar still named the old account. Signing out now reports the account the
+  CLI fell back to, offers **Sign out all** when more than one account exists,
+  and the footer line follows the dialog immediately instead of waiting for the
+  next window focus.
+
+## [0.7.0] - 2026-10-28
+
+### Added
+
+- **Sign in and sign out of GitHub from the dialog.** Sign-in is still the GitHub
+  CLI's own session — this bundle stores no token — but it no longer sends the
+  owner to a terminal: the dialog runs `gh auth login --web`, shows the one-time
+  code it prints with a copy button and the device page, and refreshes the
+  repository list as soon as the CLI reports success. A signed-in machine gets a
+  two-step **Sign out** (`gh auth logout --hostname github.com --user <login>`),
+  and a pending sign-in can be cancelled. The footer row shows which state the
+  machine is in, so the answer to "am I signed in?" is visible without opening
+  anything.
+
 ## [0.6.2] - 2026-10-28
 
 ### Fixed

package/client/face.js

@@ -678,6 +678,29 @@ const githubStore = (() => {
   }
 })()
 
+/**
+ * The last GitHub status anyone read, shared by the dialog and the footer line.
+ *
+ * The footer used to re-read only on window focus, so signing out in the dialog
+ * left `GitHub · KonnectSuite` on screen while the CLI was already signed out (or
+ * signed in as another account). One store, written by every read, keeps them equal.
+ */
+const githubStatusStore = (() => {
+  let value
+  const listeners = new Set()
+  return {
+    get: () => value,
+    subscribe(listener) {
+      listeners.add(listener)
+      return () => { listeners.delete(listener) }
+    },
+    set(next) {
+      value = next
+      for (const listener of listeners) listener()
+    },
+  }
+})()
+
 /**
  * Post one action to the GitHub route.
  * @param action - `status`, `repos` or `clone`.
@@ -747,6 +770,20 @@ const GITHUB_LIST_STYLE = {
   borderTop: '0.5px solid var(--dsw-alias-border-l2, rgba(0,0,0,0.12))',
 }
 
+/** A secondary button in the sign-in block, sized like the harness's own. */
+const GITHUB_BUTTON_STYLE = {
+  display: 'inline-flex',
+  alignItems: 'center',
+  justifyContent: 'center',
+  padding: '4px 10px',
+  border: '0.5px solid var(--dsw-alias-border-l2, rgba(0, 0, 0, 0.16))',
+  borderRadius: 'var(--dsw-radius-sm, 6px)',
+  background: 'transparent',
+  color: 'inherit',
+  font: 'inherit',
+  cursor: 'pointer',
+}
+
 const GITHUB_ROW_STYLE = {
   display: 'flex',
   alignItems: 'center',
@@ -762,8 +799,7 @@ const GITHUB_ROW_STYLE = {
   borderBottom: '0.5px solid var(--dsw-alias-border-l2, rgba(0,0,0,0.08))',
 }
 
-const GITHUB_INPUT_STYLE = {
-  width: '100%',
+const GITHUB_INPUT_STYLE = {  width: '100%',
   boxSizing: 'border-box',
   padding: '6px 8px',
   font: 'inherit',
@@ -793,6 +829,33 @@ function GitHubPanel(props) {
   const [query, setQuery] = React.useState('')
   const [error, setError] = React.useState('')
   const [busy, setBusy] = React.useState('')
+  const [signIn, setSignIn] = React.useState({ state: 'idle', code: '', url: '', reason: '' })
+  const [confirmOut, setConfirmOut] = React.useState(false)
+  const [confirmAll, setConfirmAll] = React.useState(false)
+  const [notice, setNotice] = React.useState('')
+  const [copied, setCopied] = React.useState(false)
+
+  /** Put the one-time code on the clipboard, so it can be pasted in the browser. */
+  const copyCode = () => {
+    const clipboard = typeof navigator === 'undefined' ? undefined : navigator.clipboard
+    if (clipboard === undefined || typeof clipboard.writeText !== 'function') return
+    Promise.resolve(clipboard.writeText(signIn.code))
+      .then(() => {
+        setCopied(true)
+        setTimeout(() => setCopied(false), 2000)
+      })
+      .catch(() => setCopied(false))
+  }
+
+  /** Re-read the session, and the repository list when it is signed in. */
+  const refresh = () => Promise.resolve()
+    .then(() => githubCall('status'))
+    .then(status => {
+      setAccount(status)
+      githubStatusStore.set(status)
+      if (status.signedIn !== true) return undefined
+      return githubCall('repos').then(list => setRepos(Array.isArray(list.repos) ? list.repos : []))
+    })
 
   React.useEffect(() => {
     if (!open || !enabled) return undefined
@@ -801,17 +864,9 @@ function GitHubPanel(props) {
     setError('')
     setBusy('')
     setQuery('')
-    Promise.resolve()
-      .then(() => githubCall('status'))
-      .then(status => {
-        if (!live) return undefined
-        setAccount(status)
-        if (status.signedIn !== true) return undefined
-        return githubCall('repos').then(list => {
-          if (!live) return
-          setRepos(Array.isArray(list.repos) ? list.repos : [])
-        })
-      })
+    setConfirmOut(false)
+    setSignIn({ state: 'idle', code: '', url: '', reason: '' })
+    refresh()
       .then(() => { if (live) setPhase('ready') })
       .catch(reason => {
         if (!live) return
@@ -821,6 +876,29 @@ function GitHubPanel(props) {
     return () => { live = false }
   }, [open, enabled])
 
+  // The device flow is a long poll: ask the Host what the CLI child reports.
+  // `starting` has to be polled too — the Host answers `starting` the moment the
+  // child is spawned and only reports the code a tick later, so polling on
+  // `pending` alone left the dialog asking for a code that had already arrived.
+  React.useEffect(() => {
+    if (!open || (signIn.state !== 'pending' && signIn.state !== 'starting')) return undefined
+    const timer = setInterval(() => {
+      Promise.resolve()
+        .then(() => githubCall('loginStatus'))
+        .then(answer => {
+          setSignIn({ state: answer.state, code: answer.code ?? '', url: answer.url ?? '', reason: answer.reason ?? '' })
+          if (answer.state === 'succeeded') {
+            setPhase('loading')
+            return refresh().then(() => setPhase('ready'))
+          }
+          if (answer.state === 'failed' || answer.state === 'cancelled') setError(answer.reason ?? 'Sign-in did not finish.')
+          return undefined
+        })
+        .catch(reason => setError(reason instanceof Error ? reason.message : String(reason)))
+    }, 2000)
+    return () => clearInterval(timer)
+  }, [open, signIn.state])
+
   React.useEffect(() => {
     if (!open) return undefined
     const onKey = event => { if (event.key === 'Escape') githubStore.set(false) }
@@ -865,6 +943,78 @@ function GitHubPanel(props) {
       })
   }
 
+  /**
+   * Start the CLI's device flow. The Host runs it, so this dialog only renders
+   * the code the CLI printed and the page it wants opened.
+   */
+  const beginSignIn = () => {
+    setError('')
+    setSignIn({ state: 'starting', code: '', url: '', reason: '' })
+    Promise.resolve()
+      .then(() => githubCall('login'))
+      .then(answer => setSignIn({
+        state: answer.state ?? 'failed',
+        code: answer.code ?? '',
+        url: answer.url ?? '',
+        reason: answer.reason ?? '',
+      }))
+      .catch(reason => {
+        setSignIn({ state: 'failed', code: '', url: '', reason: '' })
+        setError(reason instanceof Error ? reason.message : String(reason))
+      })
+  }
+
+  const cancelSignIn = () => {
+    Promise.resolve()
+      .then(() => githubCall('loginCancel'))
+      .then(() => setSignIn({ state: 'idle', code: '', url: '', reason: '' }))
+      .catch(() => setSignIn({ state: 'idle', code: '', url: '', reason: '' }))
+  }
+
+  /** Sign the CLI out, which is what every read in this feature depends on. */
+  const signOutNow = () => {
+    setConfirmOut(false)
+    setBusy('sign-out')
+    setError('')
+    setNotice('')
+    Promise.resolve()
+      .then(() => githubCall('logout'))
+      .then(answer => {
+        const remaining = typeof answer.remaining === 'string' ? answer.remaining : ''
+        setAccount(undefined)
+        setRepos([])
+        setSignIn({ state: 'idle', code: '', url: '', reason: '' })
+        setNotice(remaining === ''
+          ? `Signed out of ${String(answer.login)}.`
+          : `Signed out of ${String(answer.login)}. The GitHub CLI is now signed in as ${remaining}.`)
+        return refresh()
+      })
+      .catch(reason => setError(reason instanceof Error ? reason.message : String(reason)))
+      .then(() => setBusy(''))
+  }
+
+  /** Sign every account in the CLI's keyring out, so no silent fallback is left. */
+  const signOutAllNow = () => {
+    setConfirmAll(false)
+    setBusy('sign-out-all')
+    setError('')
+    setNotice('')
+    Promise.resolve()
+      .then(() => githubCall('logoutAll'))
+      .then(answer => {
+        const logins = Array.isArray(answer.logins) ? answer.logins.map(String) : []
+        setAccount(undefined)
+        setRepos([])
+        setSignIn({ state: 'idle', code: '', url: '', reason: '' })
+        setNotice(logins.length === 0
+          ? 'No GitHub account was signed in.'
+          : `Signed out of ${logins.join(', ')}.`)
+        return refresh()
+      })
+      .catch(reason => setError(reason instanceof Error ? reason.message : String(reason)))
+      .then(() => setBusy(''))
+  }
+
   const rows = visible.slice(0, 200).map(repo => React.createElement('button', {
     key: repo.fullName,
     type: 'button',
@@ -892,18 +1042,45 @@ function GitHubPanel(props) {
     React.createElement('div', { style: GITHUB_CARD_STYLE, role: 'dialog', 'aria-label': 'Add a workspace from GitHub' },
       React.createElement('div', { style: { ...PANEL_TITLE_STYLE, marginBottom: '4px' } },
         React.createElement('span', null, 'Add a workspace from GitHub'),
-        React.createElement('button', {
-          type: 'button',
-          onClick: () => githubStore.set(false),
-          style: { border: 'none', background: 'transparent', color: 'inherit', font: 'inherit', cursor: 'pointer', opacity: 0.7 },
-          'aria-label': 'Close',
-        }, '×')),
+        React.createElement('span', { style: { display: 'flex', alignItems: 'center', gap: '10px' } },
+          signedIn && (Array.isArray(account?.accounts) ? account.accounts.length : 0) > 1
+            ? React.createElement('button', {
+              type: 'button',
+              'data-polish-github': 'signoutall',
+              disabled: busy === 'sign-out-all',
+              onClick: () => { if (confirmAll) signOutAllNow(); else setConfirmAll(true) },
+              title: 'Sign every GitHub account in the CLI out of this machine',
+              style: { border: 'none', background: 'transparent', color: 'inherit', font: 'inherit', cursor: 'pointer', opacity: 0.7, padding: 0 },
+            }, busy === 'sign-out-all' ? 'Signing out…' : confirmAll ? 'Sign out all now?' : 'Sign out all')
+            : null,
+          signedIn
+            ? React.createElement('button', {
+              type: 'button',
+              'data-polish-github': 'signout',
+              disabled: busy === 'sign-out',
+              onClick: () => { if (confirmOut) signOutNow(); else setConfirmOut(true) },
+              title: 'Sign the GitHub CLI out of this machine',
+              style: { border: 'none', background: 'transparent', color: 'inherit', font: 'inherit', cursor: 'pointer', opacity: 0.7, padding: 0 },
+            }, busy === 'sign-out' ? 'Signing out…' : confirmOut ? 'Sign out now?' : 'Sign out')
+            : null,
+          React.createElement('button', {
+            type: 'button',
+            onClick: () => githubStore.set(false),
+            style: { border: 'none', background: 'transparent', color: 'inherit', font: 'inherit', cursor: 'pointer', opacity: 0.7 },
+            'aria-label': 'Close',
+          }, '×'))),
       React.createElement('div', { style: { opacity: 0.75, minHeight: '18px' } },
         phase === 'loading' && !signedIn ? 'Checking the GitHub CLI session…' : null,
         signedIn ? `Signed in as ${String(account.login)} · cloning into ${root}` : null,
         !signedIn && phase !== 'loading'
-          ? 'The GitHub CLI is not signed in. Run `gh auth login` in a terminal, then reopen this dialog.'
+          ? 'GitHub is not signed in on this machine. The sign-in below is the GitHub CLI device flow, so no token is ever typed here or stored by this plugin.'
           : null),
+      notice === ''
+        ? null
+        : React.createElement('div', {
+          'data-polish-github': 'notice',
+          style: { marginTop: '6px', opacity: 0.85 },
+        }, notice),
       signedIn
         ? React.createElement('input', {
           style: { ...GITHUB_INPUT_STYLE, marginTop: '10px' },
@@ -917,6 +1094,48 @@ function GitHubPanel(props) {
       error !== ''
         ? React.createElement('div', { style: { marginTop: '10px', color: 'var(--dsw-alias-label-error, #b42318)' } }, error)
         : null,
+      !signedIn && phase !== 'loading'
+        ? React.createElement('div', { style: { marginTop: '12px' } },
+          signIn.state === 'pending' || signIn.state === 'starting'
+            ? React.createElement('div', null,
+              React.createElement('div', { style: { marginBottom: '8px' } },
+                signIn.state === 'starting' ? 'Asking the GitHub CLI for a code…' : 'Approve this one-time code in your browser:'),
+              signIn.code === ''
+                ? null
+                : React.createElement('div', {
+                  'data-polish-github': 'code',
+                  style: {
+                    fontFamily: 'ui-monospace, SFMono-Regular, Menlo, Consolas, monospace',
+                    fontSize: '18px',
+                    letterSpacing: '2px',
+                    padding: '8px 10px',
+                    borderRadius: 'var(--dsw-radius-sm, 6px)',
+                    border: '0.5px solid var(--dsw-alias-border-l2, rgba(0,0,0,0.12))',
+                  },
+                }, signIn.code),
+              React.createElement('div', { style: { display: 'flex', gap: '8px', marginTop: '10px', flexWrap: 'wrap' } },
+                React.createElement('button', { type: 'button', onClick: copyCode, style: GITHUB_BUTTON_STYLE, 'data-polish-github': 'copy' },
+                  copied ? 'Copied' : 'Copy code'),
+                React.createElement('a', {
+                  href: signIn.url === '' ? 'https://github.com/login/device' : signIn.url,
+                  target: '_blank',
+                  rel: 'noreferrer',
+                  style: { ...GITHUB_BUTTON_STYLE, textDecoration: 'none', display: 'inline-flex', alignItems: 'center' },
+                }, 'Open the device page'),
+                React.createElement('button', { type: 'button', onClick: cancelSignIn, style: GITHUB_BUTTON_STYLE, 'data-polish-github': 'cancel' }, 'Cancel')))
+            : React.createElement('div', null,
+              React.createElement('button', {
+                type: 'button',
+                onClick: beginSignIn,
+                // The attribute belongs on the element: inside `style` it is ignored,
+                // which is exactly why the first verification could not find this button.
+                'data-polish-github': 'signin',
+                style: GITHUB_BUTTON_STYLE,
+              }, 'Sign in with GitHub'),
+              signIn.state === 'failed' && signIn.reason !== ''
+                ? React.createElement('div', { style: { marginTop: '8px', color: 'var(--dsw-alias-label-error, #b42318)' } }, signIn.reason)
+                : null))
+        : null,
       signedIn
         ? React.createElement('div', { style: GITHUB_LIST_STYLE, 'data-polish-github-list': String(visible.length) },
           phase === 'loading' && visible.length === 0 ? React.createElement('div', { style: { padding: '10px 4px', opacity: 0.7 } }, 'Loading repositories…') : null,
@@ -961,6 +1180,9 @@ const FOOT_ROW_STYLE = {
  */
 function GithubStatus(props) {
   const enabled = useSwitch(props.configForms, 'githubWorkspace', true)
+  // The dialog publishes every status it reads, so a sign-out in the dialog lands
+  // in this line immediately instead of waiting for the next window focus.
+  const shared = React.useSyncExternalStore(githubStatusStore.subscribe, githubStatusStore.get)
   const [status, setStatus] = React.useState(undefined)
   React.useEffect(() => {
     if (!enabled) return undefined
@@ -968,7 +1190,11 @@ function GithubStatus(props) {
     const read = () => {
       Promise.resolve()
         .then(() => githubCall('status'))
-        .then(next => { if (live) setStatus(next) })
+        .then(next => {
+          if (!live) return
+          setStatus(next)
+          githubStatusStore.set(next)
+        })
         .catch(() => { if (live) setStatus({ signedIn: false }) })
     }
     read()
@@ -980,15 +1206,16 @@ function GithubStatus(props) {
     }
   }, [enabled])
   if (!enabled) return null
-  const signedIn = status !== undefined && status.signedIn === true
-  const label = status === undefined
+  const current = shared === undefined ? status : shared
+  const signedIn = current !== undefined && current.signedIn === true
+  const label = current === undefined
     ? 'GitHub · checking…'
-    : signedIn ? `GitHub · ${String(status.login)}` : 'GitHub · signed out'
+    : signedIn ? `GitHub · ${String(current.login)}` : 'GitHub · signed out'
   return React.createElement('div', { style: { padding: '2px 8px 0', minWidth: 0 } },
     React.createElement('button', {
       type: 'button',
       'data-polish-github': 'status',
-      'data-polish-github-state': signedIn ? 'in' : status === undefined ? 'checking' : 'out',
+      'data-polish-github-state': signedIn ? 'in' : current === undefined ? 'checking' : 'out',
       title: signedIn
         ? 'Add a workspace from GitHub'
         : 'Sign in with the GitHub CLI (gh auth login), then add a repository as a workspace',

package/docs/github-workspaces.md

@@ -31,6 +31,30 @@ server rejects a bearer token for clone, which is why the header carries
 `x-access-token` basic auth. Every line of git output is scrubbed of the token
 before it can reach the browser, and the route answers `cache-control: no-store`.
 
+## Signing in and out
+
+The session belongs to the GitHub CLI, and both directions stay inside the app:
+
+- **Sign in** runs `gh auth login --hostname github.com --git-protocol https
+  --web --clipboard --skip-ssh-key` on the Host. With piped stdio that command
+  needs no terminal: it prints `! One-time code (XXXX-XXXX) copied to clipboard`
+  and `https://github.com/login/device`, then polls GitHub until the code is
+  approved. The dialog shows exactly that code with a copy button and the device
+  page, polls `loginStatus` every two seconds, and refreshes the repository list
+  the moment the CLI reports success. A flow that is never approved is killed
+  after five minutes, and cancelling it kills the child immediately; the child
+  also dies with the feature, because a pending sign-in is a live process.
+- **Sign out** runs `gh auth logout --hostname github.com --user <login>` after a
+  second confirming click, then re-reads the session. "not logged in" counts as
+  success, because that is the state the click asked for.
+- **Where you see it** is the sidebar foot: `GitHub · <login>` or
+  `GitHub · signed out`, on the same line as the balance. The dialog repeats it,
+  and the footer row re-reads on window focus so a `gh auth login` run in a
+  terminal shows up without a restart.
+
+Nothing about this stores a credential of its own: the code is a one-time device
+code, and the token never leaves the CLI's own credential store.
+
 ## How the entry point works
 
 The "+" menu's **Add workspace…** entry only appears when something occupies

package/entries/github.js

@@ -114,6 +114,189 @@ export async function ghToken(run = runCommand) {
   return token === '' ? undefined : token
 }
 
+/**
+ * Pull the one-time code out of what `gh auth login --web` prints.
+ *
+ * The CLI writes `! One-time code (AE22-76C7) copied to clipboard` to stderr —
+ * the dash is the one the browser form accepts, so it is kept verbatim.
+ * @param text - captured output.
+ * @returns the code, or undefined when the line has not arrived yet.
+ */
+export function parseDeviceCode(text) {
+  const match = /one-time code \(([A-Z0-9]{4}-[A-Z0-9]{4})\)/i.exec(String(text))
+  return match === null ? undefined : match[1].toUpperCase()
+}
+
+/**
+ * Pull the verification URL out of what `gh auth login --web` prints.
+ * @param text - captured output.
+ * @returns the URL, defaulting to GitHub's device page.
+ */
+export function parseDeviceUrl(text) {
+  const match = /(https:\/\/github\.com\/login\/device)/.exec(String(text))
+  return match === null ? 'https://github.com/login/device' : match[1]
+}
+
+/** The single sign-in this process is running, if any. */
+let loginSession
+
+/** Default ceiling on a pending sign-in: the CLI polls until the code is used. */
+export const LOGIN_TIMEOUT_MS = 5 * 60 * 1000
+
+/**
+ * Start the GitHub CLI's device flow for this machine.
+ *
+ * `gh auth login --web` needs no terminal: with piped stdio it prints the
+ * one-time code and then polls GitHub until the code is approved, which is
+ * exactly the shape a dialog can render. The child is kept alive here so the
+ * browser can poll for the outcome, and killed when the flow is cancelled,
+ * times out, or the feature is disposed.
+ * @param options - spawn override plus the timeout.
+ * @returns the code and URL to show, or the reason it could not start.
+ */
+export function startLogin(options = {}) {
+  if (loginSession !== undefined && loginSession.state === 'pending') {
+    return { ok: true, value: { state: 'pending', code: loginSession.code, url: loginSession.url } }
+  }
+  const spawnImpl = options.spawn ?? spawn
+  const timeoutMs = options.timeoutMs ?? LOGIN_TIMEOUT_MS
+  const session = { state: 'starting', code: undefined, url: 'https://github.com/login/device', reason: '', child: undefined, timer: undefined }
+  let text = ''
+  const read = chunk => {
+    text += chunk.toString()
+    const code = parseDeviceCode(text)
+    if (code !== undefined && session.code === undefined) {
+      session.code = code
+      session.url = parseDeviceUrl(text)
+      session.state = 'pending'
+    }
+  }
+  try {
+    const child = spawnImpl('gh', ['auth', 'login', '--hostname', 'github.com', '--git-protocol', 'https', '--web', '--clipboard', '--skip-ssh-key'], {
+      stdio: ['pipe', 'pipe', 'pipe'],
+      windowsHide: true,
+      env: { ...process.env, GIT_TERMINAL_PROMPT: '0', GH_PROMPT_DISABLED: '' },
+    })
+    session.child = child
+    child.stdout?.setEncoding?.('utf8')
+    child.stderr?.setEncoding?.('utf8')
+    child.stdout?.on?.('data', read)
+    child.stderr?.on?.('data', read)
+    child.on?.('error', error => {
+      session.state = 'failed'
+      session.reason = error instanceof Error ? error.message : 'the GitHub CLI could not be started'
+    })
+    child.on?.('close', code => {
+      if (session.state === 'cancelled') return
+      if (code === 0) {
+        session.state = 'succeeded'
+        session.reason = ''
+        return
+      }
+      session.state = 'failed'
+      const parsed = parseDeviceCode(text)
+      session.reason = parsed === undefined
+        ? 'the GitHub CLI stopped before showing a one-time code'
+        : 'the one-time code was not approved'
+    })
+    session.timer = setTimeout(() => {
+      if (session.state !== 'pending' && session.state !== 'starting') return
+      session.state = 'failed'
+      session.reason = 'the one-time code expired before it was approved'
+      session.child?.kill?.()
+    }, timeoutMs)
+    session.timer?.unref?.()
+    loginSession = session
+    return { ok: true, value: { state: session.state, code: session.code, url: session.url } }
+  } catch (error) {
+    session.state = 'failed'
+    session.reason = error instanceof Error ? error.message : 'the GitHub CLI could not be started'
+    loginSession = session
+    return { ok: false, error: session.reason }
+  }
+}
+
+/**
+ * Report the sign-in this process is running.
+ * @returns the state, plus the code and URL while it is pending.
+ */
+export function loginStatus() {
+  if (loginSession === undefined) return { state: 'idle', code: undefined, url: 'https://github.com/login/device', reason: '' }
+  return { state: loginSession.state, code: loginSession.code, url: loginSession.url, reason: loginSession.reason }
+}
+
+/**
+ * Stop a pending sign-in and forget it.
+ * @returns the state after cancelling.
+ */
+export function cancelLogin() {
+  if (loginSession === undefined) return { state: 'idle', code: undefined, url: 'https://github.com/login/device', reason: '' }
+  if (loginSession.timer !== undefined) clearTimeout(loginSession.timer)
+  try {
+    loginSession.child?.kill?.()
+  } catch {
+    // A child that already exited is the normal case here.
+  }
+  loginSession.state = 'cancelled'
+  loginSession.reason = 'sign-in was cancelled'
+  return { state: loginSession.state, code: loginSession.code, url: loginSession.url, reason: loginSession.reason }
+}
+
+/**
+ * Sign the GitHub CLI out, which is what this feature's sign-in state reads.
+ * @param login - the account to remove; the CLI prompts without it.
+ * @param run - command runner, injected by tests.
+ * @returns ok when the account is gone (including when it was never there).
+ */
+export async function signOut(login, run = runCommand) {
+  const args = ['auth', 'logout', '--hostname', 'github.com']
+  if (typeof login === 'string' && login !== '') args.push('--user', login)
+  const answer = await run('gh', args)
+  if (answer.code === 0) return { ok: true }
+  const text = `${answer.stdout}${answer.stderr}`.trim()
+  if (/not logged in/i.test(text)) return { ok: true }
+  return { ok: false, error: text === '' ? 'the GitHub CLI could not sign out' : text }
+}
+
+/**
+ * Read every account the GitHub CLI holds for github.com.
+ *
+ * A machine can carry more than one account in the CLI keyring, and `gh auth
+ * logout --user` only removes the one it names — the CLI then makes another one
+ * active, which is why a sign-out can appear to do nothing.
+ *
+ * @param run - command runner, injected by tests.
+ * @returns the accounts in the CLI's own order, the active one first when known.
+ */
+export async function listAccounts(run = runCommand) {
+  const answer = await run('gh', ['auth', 'status'])
+  const text = `${answer.stdout}${answer.stderr}`
+  const logins = []
+  const pattern = /Logged in to github\.com account ([^\s]+)/g
+  let match = pattern.exec(text)
+  while (match !== null) {
+    if (logins.indexOf(match[1]) === -1) logins.push(match[1])
+    match = pattern.exec(text)
+  }
+  return logins
+}
+
+/**
+ * Sign every account out of the GitHub CLI.
+ * @param logins - accounts to remove.
+ * @param run - command runner, injected by tests.
+ * @returns ok when no account is left, else the first failure.
+ */
+export async function signOutAll(logins, run = runCommand) {
+  const removed = []
+  for (const login of logins) {
+    const answer = await signOut(login, run)
+    if (answer.ok !== true) return { ok: false, error: answer.error, removed }
+    removed.push(login)
+  }
+  return { ok: true, removed }
+}
+
 /**
  * Read the login that owns a token.
  * @param token - GitHub access token.
@@ -257,19 +440,49 @@ export async function cloneRepo(owner, name, token, options = {}) {
  */
 export async function handleRequest(body, deps = {}) {
   const action = body?.action
+  // Sign-in is reachable while signed out: it is how a machine gets there.
+  if (action === 'login') return (deps.startLogin ?? startLogin)()
+  if (action === 'loginStatus') return { ok: true, value: (deps.loginStatus ?? loginStatus)() }
+  if (action === 'loginCancel') return { ok: true, value: (deps.cancelLogin ?? cancelLogin)() }
+  // Signing everything out is reachable while signed in, so it belongs above the
+  // token gate together with the sign-in verbs.
+  if (action === 'logoutAll') {
+    const accounts = await (deps.accounts ?? listAccounts)()
+    if (accounts.length === 0) return { ok: true, value: { logins: [] } }
+    const answer = await (deps.signOutAll ?? signOutAll)(accounts)
+    if (answer.ok !== true) return { ok: false, error: answer.error }
+    return { ok: true, value: { logins: answer.removed } }
+  }
   const token = await (deps.token ?? ghToken)()
   if (action === 'status') {
+    const accounts = await (deps.accounts ?? listAccounts)().catch(() => [])
     if (token === undefined) {
       return {
         ok: true,
-        value: { signedIn: false, login: '', root: cloneRoot(deps.home), reason: 'The GitHub CLI is missing or not signed in: run `gh auth login` in a terminal.' },
+        value: {
+          signedIn: false,
+          login: '',
+          accounts: [],
+          root: cloneRoot(deps.home),
+          reason: 'The GitHub CLI is not signed in on this machine. Sign in from this dialog, or run `gh auth login` in a terminal.',
+        },
       }
     }
     const login = await (deps.login ?? fetchLogin)(token)
-    return { ok: true, value: { signedIn: true, login, root: cloneRoot(deps.home), reason: '' } }
+    return { ok: true, value: { signedIn: true, login, accounts, root: cloneRoot(deps.home), reason: '' } }
   }
   if (token === undefined) {
-    return { ok: false, error: 'Sign in with the GitHub CLI first: run `gh auth login` in a terminal, then try again.' }
+    return { ok: false, error: 'Sign in to GitHub first: use Sign in here, or run `gh auth login` in a terminal.' }
+  }
+  if (action === 'logout') {
+    const login = await (deps.login ?? fetchLogin)(token)
+    const answer = await (deps.signOut ?? signOut)(login)
+    if (answer.ok !== true) return { ok: false, error: answer.error }
+    // The CLI may fall back to another account in its keyring; report which one,
+    // so the dialog can say what is signed in now instead of going silent.
+    const after = await (deps.token ?? ghToken)().catch(() => undefined)
+    const remaining = after === undefined ? '' : await (deps.login ?? fetchLogin)(after).catch(() => '')
+    return { ok: true, value: { login, remaining } }
   }
   if (action === 'repos') {
     const repos = await (deps.repos ?? fetchRepos)(token)
@@ -307,6 +520,8 @@ export const githubFeature = {
   name: 'polish-github',
   inject: ['connection'],
   apply(ctx, config = {}) {
+    // A pending device flow holds a child process: it must die with the feature.
+    ctx.effect(() => () => { cancelLogin() })
     ctx.effect(() => ctx.connection.fetch.register({
       path: GITHUB_ROUTE,
       // Without a method list the platform would only route GET, which is why the

package/lib/client.js

@@ -41,7 +41,7 @@ window.__ModuleLoader__.load({
     ]
     const ROW_ID = "polish"
     const ROW_KEY = "@aryacode/dsh-aryacode-polish" + '#' + ROW_ID
-    const CLIENT_VERSION = "0.6.2"
+    const CLIENT_VERSION = "0.7.3"
 
     /**
      * The two pure decisions behind the balance line: which wallet to show, and how
@@ -845,6 +845,29 @@ window.__ModuleLoader__.load({
       }
     })()
 
+    /**
+     * The last GitHub status anyone read, shared by the dialog and the footer line.
+     *
+     * The footer used to re-read only on window focus, so signing out in the dialog
+     * left `GitHub · KonnectSuite` on screen while the CLI was already signed out (or
+     * signed in as another account). One store, written by every read, keeps them equal.
+     */
+    const githubStatusStore = (() => {
+      let value
+      const listeners = new Set()
+      return {
+        get: () => value,
+        subscribe(listener) {
+          listeners.add(listener)
+          return () => { listeners.delete(listener) }
+        },
+        set(next) {
+          value = next
+          for (const listener of listeners) listener()
+        },
+      }
+    })()
+
     /**
      * Post one action to the GitHub route.
      * @param action - `status`, `repos` or `clone`.
@@ -914,6 +937,20 @@ window.__ModuleLoader__.load({
       borderTop: '0.5px solid var(--dsw-alias-border-l2, rgba(0,0,0,0.12))',
     }
 
+    /** A secondary button in the sign-in block, sized like the harness's own. */
+    const GITHUB_BUTTON_STYLE = {
+      display: 'inline-flex',
+      alignItems: 'center',
+      justifyContent: 'center',
+      padding: '4px 10px',
+      border: '0.5px solid var(--dsw-alias-border-l2, rgba(0, 0, 0, 0.16))',
+      borderRadius: 'var(--dsw-radius-sm, 6px)',
+      background: 'transparent',
+      color: 'inherit',
+      font: 'inherit',
+      cursor: 'pointer',
+    }
+
     const GITHUB_ROW_STYLE = {
       display: 'flex',
       alignItems: 'center',
@@ -929,8 +966,7 @@ window.__ModuleLoader__.load({
       borderBottom: '0.5px solid var(--dsw-alias-border-l2, rgba(0,0,0,0.08))',
     }
 
-    const GITHUB_INPUT_STYLE = {
-      width: '100%',
+    const GITHUB_INPUT_STYLE = {  width: '100%',
       boxSizing: 'border-box',
       padding: '6px 8px',
       font: 'inherit',
@@ -960,6 +996,33 @@ window.__ModuleLoader__.load({
       const [query, setQuery] = React.useState('')
       const [error, setError] = React.useState('')
       const [busy, setBusy] = React.useState('')
+      const [signIn, setSignIn] = React.useState({ state: 'idle', code: '', url: '', reason: '' })
+      const [confirmOut, setConfirmOut] = React.useState(false)
+      const [confirmAll, setConfirmAll] = React.useState(false)
+      const [notice, setNotice] = React.useState('')
+      const [copied, setCopied] = React.useState(false)
+
+      /** Put the one-time code on the clipboard, so it can be pasted in the browser. */
+      const copyCode = () => {
+        const clipboard = typeof navigator === 'undefined' ? undefined : navigator.clipboard
+        if (clipboard === undefined || typeof clipboard.writeText !== 'function') return
+        Promise.resolve(clipboard.writeText(signIn.code))
+          .then(() => {
+            setCopied(true)
+            setTimeout(() => setCopied(false), 2000)
+          })
+          .catch(() => setCopied(false))
+      }
+
+      /** Re-read the session, and the repository list when it is signed in. */
+      const refresh = () => Promise.resolve()
+        .then(() => githubCall('status'))
+        .then(status => {
+          setAccount(status)
+          githubStatusStore.set(status)
+          if (status.signedIn !== true) return undefined
+          return githubCall('repos').then(list => setRepos(Array.isArray(list.repos) ? list.repos : []))
+        })
 
       React.useEffect(() => {
         if (!open || !enabled) return undefined
@@ -968,17 +1031,9 @@ window.__ModuleLoader__.load({
         setError('')
         setBusy('')
         setQuery('')
-        Promise.resolve()
-          .then(() => githubCall('status'))
-          .then(status => {
-            if (!live) return undefined
-            setAccount(status)
-            if (status.signedIn !== true) return undefined
-            return githubCall('repos').then(list => {
-              if (!live) return
-              setRepos(Array.isArray(list.repos) ? list.repos : [])
-            })
-          })
+        setConfirmOut(false)
+        setSignIn({ state: 'idle', code: '', url: '', reason: '' })
+        refresh()
           .then(() => { if (live) setPhase('ready') })
           .catch(reason => {
             if (!live) return
@@ -988,6 +1043,29 @@ window.__ModuleLoader__.load({
         return () => { live = false }
       }, [open, enabled])
 
+      // The device flow is a long poll: ask the Host what the CLI child reports.
+      // `starting` has to be polled too — the Host answers `starting` the moment the
+      // child is spawned and only reports the code a tick later, so polling on
+      // `pending` alone left the dialog asking for a code that had already arrived.
+      React.useEffect(() => {
+        if (!open || (signIn.state !== 'pending' && signIn.state !== 'starting')) return undefined
+        const timer = setInterval(() => {
+          Promise.resolve()
+            .then(() => githubCall('loginStatus'))
+            .then(answer => {
+              setSignIn({ state: answer.state, code: answer.code ?? '', url: answer.url ?? '', reason: answer.reason ?? '' })
+              if (answer.state === 'succeeded') {
+                setPhase('loading')
+                return refresh().then(() => setPhase('ready'))
+              }
+              if (answer.state === 'failed' || answer.state === 'cancelled') setError(answer.reason ?? 'Sign-in did not finish.')
+              return undefined
+            })
+            .catch(reason => setError(reason instanceof Error ? reason.message : String(reason)))
+        }, 2000)
+        return () => clearInterval(timer)
+      }, [open, signIn.state])
+
       React.useEffect(() => {
         if (!open) return undefined
         const onKey = event => { if (event.key === 'Escape') githubStore.set(false) }
@@ -1032,6 +1110,78 @@ window.__ModuleLoader__.load({
           })
       }
 
+      /**
+       * Start the CLI's device flow. The Host runs it, so this dialog only renders
+       * the code the CLI printed and the page it wants opened.
+       */
+      const beginSignIn = () => {
+        setError('')
+        setSignIn({ state: 'starting', code: '', url: '', reason: '' })
+        Promise.resolve()
+          .then(() => githubCall('login'))
+          .then(answer => setSignIn({
+            state: answer.state ?? 'failed',
+            code: answer.code ?? '',
+            url: answer.url ?? '',
+            reason: answer.reason ?? '',
+          }))
+          .catch(reason => {
+            setSignIn({ state: 'failed', code: '', url: '', reason: '' })
+            setError(reason instanceof Error ? reason.message : String(reason))
+          })
+      }
+
+      const cancelSignIn = () => {
+        Promise.resolve()
+          .then(() => githubCall('loginCancel'))
+          .then(() => setSignIn({ state: 'idle', code: '', url: '', reason: '' }))
+          .catch(() => setSignIn({ state: 'idle', code: '', url: '', reason: '' }))
+      }
+
+      /** Sign the CLI out, which is what every read in this feature depends on. */
+      const signOutNow = () => {
+        setConfirmOut(false)
+        setBusy('sign-out')
+        setError('')
+        setNotice('')
+        Promise.resolve()
+          .then(() => githubCall('logout'))
+          .then(answer => {
+            const remaining = typeof answer.remaining === 'string' ? answer.remaining : ''
+            setAccount(undefined)
+            setRepos([])
+            setSignIn({ state: 'idle', code: '', url: '', reason: '' })
+            setNotice(remaining === ''
+              ? `Signed out of ${String(answer.login)}.`
+              : `Signed out of ${String(answer.login)}. The GitHub CLI is now signed in as ${remaining}.`)
+            return refresh()
+          })
+          .catch(reason => setError(reason instanceof Error ? reason.message : String(reason)))
+          .then(() => setBusy(''))
+      }
+
+      /** Sign every account in the CLI's keyring out, so no silent fallback is left. */
+      const signOutAllNow = () => {
+        setConfirmAll(false)
+        setBusy('sign-out-all')
+        setError('')
+        setNotice('')
+        Promise.resolve()
+          .then(() => githubCall('logoutAll'))
+          .then(answer => {
+            const logins = Array.isArray(answer.logins) ? answer.logins.map(String) : []
+            setAccount(undefined)
+            setRepos([])
+            setSignIn({ state: 'idle', code: '', url: '', reason: '' })
+            setNotice(logins.length === 0
+              ? 'No GitHub account was signed in.'
+              : `Signed out of ${logins.join(', ')}.`)
+            return refresh()
+          })
+          .catch(reason => setError(reason instanceof Error ? reason.message : String(reason)))
+          .then(() => setBusy(''))
+      }
+
       const rows = visible.slice(0, 200).map(repo => React.createElement('button', {
         key: repo.fullName,
         type: 'button',
@@ -1059,18 +1209,45 @@ window.__ModuleLoader__.load({
         React.createElement('div', { style: GITHUB_CARD_STYLE, role: 'dialog', 'aria-label': 'Add a workspace from GitHub' },
           React.createElement('div', { style: { ...PANEL_TITLE_STYLE, marginBottom: '4px' } },
             React.createElement('span', null, 'Add a workspace from GitHub'),
-            React.createElement('button', {
-              type: 'button',
-              onClick: () => githubStore.set(false),
-              style: { border: 'none', background: 'transparent', color: 'inherit', font: 'inherit', cursor: 'pointer', opacity: 0.7 },
-              'aria-label': 'Close',
-            }, '×')),
+            React.createElement('span', { style: { display: 'flex', alignItems: 'center', gap: '10px' } },
+              signedIn && (Array.isArray(account?.accounts) ? account.accounts.length : 0) > 1
+                ? React.createElement('button', {
+                  type: 'button',
+                  'data-polish-github': 'signoutall',
+                  disabled: busy === 'sign-out-all',
+                  onClick: () => { if (confirmAll) signOutAllNow(); else setConfirmAll(true) },
+                  title: 'Sign every GitHub account in the CLI out of this machine',
+                  style: { border: 'none', background: 'transparent', color: 'inherit', font: 'inherit', cursor: 'pointer', opacity: 0.7, padding: 0 },
+                }, busy === 'sign-out-all' ? 'Signing out…' : confirmAll ? 'Sign out all now?' : 'Sign out all')
+                : null,
+              signedIn
+                ? React.createElement('button', {
+                  type: 'button',
+                  'data-polish-github': 'signout',
+                  disabled: busy === 'sign-out',
+                  onClick: () => { if (confirmOut) signOutNow(); else setConfirmOut(true) },
+                  title: 'Sign the GitHub CLI out of this machine',
+                  style: { border: 'none', background: 'transparent', color: 'inherit', font: 'inherit', cursor: 'pointer', opacity: 0.7, padding: 0 },
+                }, busy === 'sign-out' ? 'Signing out…' : confirmOut ? 'Sign out now?' : 'Sign out')
+                : null,
+              React.createElement('button', {
+                type: 'button',
+                onClick: () => githubStore.set(false),
+                style: { border: 'none', background: 'transparent', color: 'inherit', font: 'inherit', cursor: 'pointer', opacity: 0.7 },
+                'aria-label': 'Close',
+              }, '×'))),
           React.createElement('div', { style: { opacity: 0.75, minHeight: '18px' } },
             phase === 'loading' && !signedIn ? 'Checking the GitHub CLI session…' : null,
             signedIn ? `Signed in as ${String(account.login)} · cloning into ${root}` : null,
             !signedIn && phase !== 'loading'
-              ? 'The GitHub CLI is not signed in. Run `gh auth login` in a terminal, then reopen this dialog.'
+              ? 'GitHub is not signed in on this machine. The sign-in below is the GitHub CLI device flow, so no token is ever typed here or stored by this plugin.'
               : null),
+          notice === ''
+            ? null
+            : React.createElement('div', {
+              'data-polish-github': 'notice',
+              style: { marginTop: '6px', opacity: 0.85 },
+            }, notice),
           signedIn
             ? React.createElement('input', {
               style: { ...GITHUB_INPUT_STYLE, marginTop: '10px' },
@@ -1084,6 +1261,48 @@ window.__ModuleLoader__.load({
           error !== ''
             ? React.createElement('div', { style: { marginTop: '10px', color: 'var(--dsw-alias-label-error, #b42318)' } }, error)
             : null,
+          !signedIn && phase !== 'loading'
+            ? React.createElement('div', { style: { marginTop: '12px' } },
+              signIn.state === 'pending' || signIn.state === 'starting'
+                ? React.createElement('div', null,
+                  React.createElement('div', { style: { marginBottom: '8px' } },
+                    signIn.state === 'starting' ? 'Asking the GitHub CLI for a code…' : 'Approve this one-time code in your browser:'),
+                  signIn.code === ''
+                    ? null
+                    : React.createElement('div', {
+                      'data-polish-github': 'code',
+                      style: {
+                        fontFamily: 'ui-monospace, SFMono-Regular, Menlo, Consolas, monospace',
+                        fontSize: '18px',
+                        letterSpacing: '2px',
+                        padding: '8px 10px',
+                        borderRadius: 'var(--dsw-radius-sm, 6px)',
+                        border: '0.5px solid var(--dsw-alias-border-l2, rgba(0,0,0,0.12))',
+                      },
+                    }, signIn.code),
+                  React.createElement('div', { style: { display: 'flex', gap: '8px', marginTop: '10px', flexWrap: 'wrap' } },
+                    React.createElement('button', { type: 'button', onClick: copyCode, style: GITHUB_BUTTON_STYLE, 'data-polish-github': 'copy' },
+                      copied ? 'Copied' : 'Copy code'),
+                    React.createElement('a', {
+                      href: signIn.url === '' ? 'https://github.com/login/device' : signIn.url,
+                      target: '_blank',
+                      rel: 'noreferrer',
+                      style: { ...GITHUB_BUTTON_STYLE, textDecoration: 'none', display: 'inline-flex', alignItems: 'center' },
+                    }, 'Open the device page'),
+                    React.createElement('button', { type: 'button', onClick: cancelSignIn, style: GITHUB_BUTTON_STYLE, 'data-polish-github': 'cancel' }, 'Cancel')))
+                : React.createElement('div', null,
+                  React.createElement('button', {
+                    type: 'button',
+                    onClick: beginSignIn,
+                    // The attribute belongs on the element: inside `style` it is ignored,
+                    // which is exactly why the first verification could not find this button.
+                    'data-polish-github': 'signin',
+                    style: GITHUB_BUTTON_STYLE,
+                  }, 'Sign in with GitHub'),
+                  signIn.state === 'failed' && signIn.reason !== ''
+                    ? React.createElement('div', { style: { marginTop: '8px', color: 'var(--dsw-alias-label-error, #b42318)' } }, signIn.reason)
+                    : null))
+            : null,
           signedIn
             ? React.createElement('div', { style: GITHUB_LIST_STYLE, 'data-polish-github-list': String(visible.length) },
               phase === 'loading' && visible.length === 0 ? React.createElement('div', { style: { padding: '10px 4px', opacity: 0.7 } }, 'Loading repositories…') : null,
@@ -1128,6 +1347,9 @@ window.__ModuleLoader__.load({
      */
     function GithubStatus(props) {
       const enabled = useSwitch(props.configForms, 'githubWorkspace', true)
+      // The dialog publishes every status it reads, so a sign-out in the dialog lands
+      // in this line immediately instead of waiting for the next window focus.
+      const shared = React.useSyncExternalStore(githubStatusStore.subscribe, githubStatusStore.get)
       const [status, setStatus] = React.useState(undefined)
       React.useEffect(() => {
         if (!enabled) return undefined
@@ -1135,7 +1357,11 @@ window.__ModuleLoader__.load({
         const read = () => {
           Promise.resolve()
             .then(() => githubCall('status'))
-            .then(next => { if (live) setStatus(next) })
+            .then(next => {
+              if (!live) return
+              setStatus(next)
+              githubStatusStore.set(next)
+            })
             .catch(() => { if (live) setStatus({ signedIn: false }) })
         }
         read()
@@ -1147,15 +1373,16 @@ window.__ModuleLoader__.load({
         }
       }, [enabled])
       if (!enabled) return null
-      const signedIn = status !== undefined && status.signedIn === true
-      const label = status === undefined
+      const current = shared === undefined ? status : shared
+      const signedIn = current !== undefined && current.signedIn === true
+      const label = current === undefined
         ? 'GitHub · checking…'
-        : signedIn ? `GitHub · ${String(status.login)}` : 'GitHub · signed out'
+        : signedIn ? `GitHub · ${String(current.login)}` : 'GitHub · signed out'
       return React.createElement('div', { style: { padding: '2px 8px 0', minWidth: 0 } },
         React.createElement('button', {
           type: 'button',
           'data-polish-github': 'status',
-          'data-polish-github-state': signedIn ? 'in' : status === undefined ? 'checking' : 'out',
+          'data-polish-github-state': signedIn ? 'in' : current === undefined ? 'checking' : 'out',
           title: signedIn
             ? 'Add a workspace from GitHub'
             : 'Sign in with the GitHub CLI (gh auth login), then add a repository as a workspace',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aryacode/dsh-aryacode-polish",
-  "version": "0.6.2",
+  "version": "0.7.3",
   "description": "AryaCode Polish: one install for the small things that make AryaCode feel finished. One Plugins row, one switch per quality-of-life feature.",
   "keywords": [
     "dsh",