@awak-app/simy-cli 0.5.62 → 0.5.64

package/README.md

@@ -16,6 +16,13 @@ and shows active memberships of the connected SIMY account. Switching opens brow
 and waits for active tasks to finish. Use the same account in the browser; cancel
 an unfinished switch from the sidebar.
 
+Browser authorization links expire after **20 minutes**. The app shows **Connection
+timed out** and **Reconnect** when an active request expires. Reconnect starts a
+new link; old or canceled links cannot complete authorization. Installed clients
+with the loopback redirect transport finish on a self-contained local browser page
+so Safari does not need an HTTPS-to-HTTP cross-origin fetch. The session itself
+still lasts 48 hours; the 20-minute limit is the browser connection window.
+
 **Local SQM**, above the connection status, allows this Mac's Codex / Claude Code
 to claim local SQM reviews. It defaults to off and is saved separately for each
 Web environment, account, and organization. Turning it off stops new claims;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.5.62",
+  "version": "0.5.64",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {

package/src/agent.js

@@ -1,3 +1,5 @@
+import { BROWSER_HANDOFF_TRANSPORT, browserHandoffPage, decryptBrowserHandoff } from "./browser-handoff.js";
+import { createAuthorizationWindow } from "./browser-authorization.js";
 import { createSqmHistoryStore, projectSqmHistory, sqmHistoryScope } from "./sqm/history-store.js";
 import { createDesktopAccessPolicy, desktopAccessReady, requireDesktopAccess } from './desktop-access.js';
 import { readSqmEnabled, writeSqmEnabled } from "./desktop-sqm-settings.js";
@@ -199,6 +201,23 @@ export async function startAgent({
   let organizationState = "unknown";
   let organizationRefresh = null;
   let pendingOrganization = null;
+  let desktopLoginPending = false;
+  let authorizationCompleting = false;
+  let expiredOrganizationId = null;
+  let expiredInteractiveAuthorization = false;
+  const authorizationWindow = createAuthorizationWindow({
+    ...dependencies.authorizationClock,
+    onExpire() {
+      expiredInteractiveAuthorization = Boolean(pendingOrganization || desktopLoginPending);
+      expiredOrganizationId = pendingOrganization?.id ?? null;
+      authNonce = randomBytes(16).toString("base64url");
+      pendingOrganization = null;
+      desktopLoginPending = false;
+      loginUrl = null;
+      refreshAvailableCapabilities();
+      notifyDesktopStatusChange();
+    },
+  });
   await cleanupExpiredRuns();
   for (const task of await restoreLocalTasks({ root: taskStorageRoot })) {
     localTaskRegistry.create(task);
@@ -469,7 +488,19 @@ export async function startAgent({
     })();
     return organizationRefresh;
   };
-  const requestDesktopLogin = (organizationId = null) => {
+  const requestDesktopLogin = (organizationId = null, { passive = false } = {}) => {
+    const authorization = authorizationWindow.snapshot();
+    if (authorization.state === "timed_out") {
+      if (passive) return null;
+      organizationId ??= expiredOrganizationId;
+    }
+    // Reopening the verification page must keep the original nonce and scope.
+    if (!organizationId && pendingOrganization) return loginUrl?.toString() ?? null;
+    // The first user action gets a full window, independent of app startup.
+    if (!passive && !organizationId && !pendingOrganization && !desktopLoginPending && loginUrl) {
+      authNonce = randomBytes(16).toString("base64url");
+      loginUrl = null;
+    }
     let organizationSlug = null;
     if (organizationId) {
       if (!isSessionValid(session, Date.now(), apiOrigin)) throw new Error("Sign in before switching organizations.");
@@ -486,13 +517,19 @@ export async function startAgent({
       notifyDesktopStatusChange();
     } else if (isSessionValid(session, Date.now(), apiOrigin)) {
       if (!enforceDesktopAccess || desktopAccess.snapshot().state !== 'signed_out') return null;
-      authNonce = randomBytes(16).toString("base64url");
-      loginUrl = null;
+      if (!passive || !loginUrl) {
+        authNonce = randomBytes(16).toString("base64url");
+        loginUrl = null;
+      }
     }
     if (!loginUrl) {
+      authorizationWindow.start();
+      expiredOrganizationId = null;
+      expiredInteractiveAuthorization = false;
       loginUrl = new URL("/local-cli/connect", apiOrigin);
       loginUrl.searchParams.set("port", String(port));
       loginUrl.searchParams.set("nonce", authNonce);
+      loginUrl.searchParams.set("auth_transport", BROWSER_HANDOFF_TRANSPORT);
       loginUrl.searchParams.set("cli_version", CLI_VERSION);
       loginUrl.searchParams.set("api_contract_version", String(CLI_API_CONTRACT_VERSION));
       if (installMode) loginUrl.searchParams.set("install_mode", installMode);
@@ -501,6 +538,7 @@ export async function startAgent({
         loginUrl.searchParams.set('org_slug', organizationSlug);
       }
     }
+    if (!passive) { desktopLoginPending = true; notifyDesktopStatusChange(); }
     return loginUrl.toString();
   };
 
@@ -691,6 +729,8 @@ export async function startAgent({
             if (session?.device_id && session.token) reclaimableSession = session;
             session = null;
             loginUrl = null;
+            pendingOrganization = null;
+            desktopLoginPending = false;
             refreshAvailableCapabilities();
             requestDesktopLogin();
           }
@@ -878,7 +918,11 @@ export async function startAgent({
 
   const server = createServer(async (req, res) => {
     try {
-      if (!isRequestOriginAllowed(req.headers.origin, apiOrigin)) {
+      const url = new URL(req.url || "/", `http://${req.headers.host || "127.0.0.1"}`);
+      const localHandoff = url.pathname === "/v1/auth/browser-complete";
+      const localOrigin = `http://127.0.0.1:${port}`;
+      if (localHandoff ? (req.headers.origin !== localOrigin || req.headers.host !== `127.0.0.1:${port}`)
+          : !isRequestOriginAllowed(req.headers.origin, apiOrigin)) {
         json(res, 403, { error: "request origin does not match the configured SIMY Web host" });
         return;
       }
@@ -888,9 +932,14 @@ export async function startAgent({
         return;
       }
 
-      const url = new URL(req.url || "/", `http://${req.headers.host || "127.0.0.1"}`);
+      if (req.method === "GET" && url.pathname === "/v1/auth/browser") {
+        if (req.headers.host !== `127.0.0.1:${port}`) { json(res, 403, { error: "Invalid local host." }); return; }
+        const page = browserHandoffPage();
+        res.writeHead(200, page.headers).end(page.html);
+        return;
+      }
       const agenticLoopPath = canonicalAgenticLoopPath(url.pathname);
-      const desktopRecoveryRoute = ['/v1/health', '/v1/capabilities', '/v1/auth/complete'].includes(url.pathname) ||
+      const desktopRecoveryRoute = ['/v1/health', '/v1/capabilities', '/v1/auth/complete', '/v1/auth/browser-complete'].includes(url.pathname) ||
         req.method === 'POST' && (/^\/v1\/local-tasks\/[^/]+\/control$/.test(url.pathname) || /^\/v1\/agentic-loop\/[^/]+\/control$/.test(agenticLoopPath));
       let requestAccessScope;
       if (enforceDesktopAccess && !desktopRecoveryRoute) {
@@ -1112,105 +1161,127 @@ export async function startAgent({
         json(res, 200, environment);
         return;
       }
-      if (req.method === "POST" && url.pathname === "/v1/auth/complete") {
-        const body = await readJson(req);
-        if (body.nonce !== authNonce) {
-          json(res, 401, { error: "invalid nonce" });
-          return;
-        }
-        if (body.api_origin !== apiOrigin) {
-          json(res, 403, { error: "authorization origin does not match the configured host" });
-          return;
-        }
-        let apiBaseUrl;
+      if (req.method === "POST" && ["/v1/auth/complete", "/v1/auth/browser-complete"].includes(url.pathname)) {
+        if (authorizationCompleting) { json(res, 409, { error: "Authorization is already completing." }); return; }
+        authorizationCompleting = true;
         try {
-          apiBaseUrl = resolveWebApiBaseUrl(apiOrigin, body.api_base_url);
-        } catch (error) {
-          json(res, 503, {
-            error: error instanceof Error ? error.message : "CLI API endpoint is unavailable",
-          });
-          return;
-        }
-        const nextOrganization = body.organization_id ?? body.org_id;
-        const nextAccount = body.account_id ?? body.auth_user_id;
-        const changingScope = session && (session.organization_id !== nextOrganization || session.account_id !== nextAccount);
-        if ((changingScope && organizationBusy()) || (pendingOrganization &&
-            (pendingOrganization.id !== nextOrganization || pendingOrganization.accountId !== nextAccount))) {
-          json(res, 409, { error: "Organization authorization does not match, or tasks are still running." });
-          return;
-        }
-        const previousSession = session ?? reclaimableSession;
-        reclaimableSession = null;
-        session = {
-          token: String(body.token || ""),
-          device_id: typeof body.device_id === "string" ? body.device_id : null,
-          api_origin: apiOrigin,
-          api_base_url: apiBaseUrl,
-          account_id: typeof body.account_id === "string"
-            ? body.account_id
-            : typeof body.auth_user_id === "string"
-            ? body.auth_user_id
-            : null,
-          organization_id: typeof body.organization_id === "string"
-            ? body.organization_id
-            : typeof body.org_id === "string"
-            ? body.org_id
-            : null,
-          expires_at: typeof body.expires_at === "string" ? body.expires_at : expiresAtFromNow(),
-        };
-        // A fresh sign-in issues a new device. Keep running as the device used
-        // before (its desktop WorkFlow evidence stays resumable) when this agent
-        // still holds that device's token. Otherwise continue as the new device.
-        if (
-          previousSession?.device_id &&
-          previousSession.token &&
-          session.device_id &&
-          previousSession.device_id !== session.device_id &&
-          previousSession.api_origin &&
-          (previousSession.account_id ?? null) === (session.account_id ?? null) &&
-          (previousSession.organization_id ?? null) === (session.organization_id ?? null) &&
-          previousApiBaseUrl(previousSession) === session.api_base_url
-        ) {
+          const requestNonce = authNonce;
+          let body;
           try {
-            const reclaimed = await reclaimDevice({
-              apiOrigin,
-              apiBaseUrl: session.api_base_url,
-              token: session.token,
-              previousDeviceId: previousSession.device_id,
-              previousToken: previousSession.token,
-            });
-            if (reclaimed?.device_id === previousSession.device_id) {
-              session.device_id = reclaimed.device_id;
-              if (typeof reclaimed.expires_at === "string") session.expires_at = reclaimed.expires_at;
-            }
+            const input = await readBoundedJson(req, 32768);
+            body = localHandoff ? decryptBrowserHandoff(input.handoff, { nonce: requestNonce, apiOrigin, port }) : input;
+          } catch { json(res, 400, { error: "Invalid browser authorization. Reconnect from SIMY." }); return; }
+          if (authorizationWindow.snapshot().state === "timed_out") {
+            json(res, 410, { error: "Browser connection timed out after 20 minutes. Reconnect from SIMY.", code: "authorization_timed_out" });
+            return;
+          }
+          if (body.nonce !== authNonce) {
+            json(res, 401, { error: "invalid nonce" });
+            return;
+          }
+          if (body.api_origin !== apiOrigin) {
+            json(res, 403, { error: "authorization origin does not match the configured host" });
+            return;
+          }
+          let apiBaseUrl;
+          try {
+            apiBaseUrl = resolveWebApiBaseUrl(apiOrigin, body.api_base_url);
           } catch (error) {
-            if (!quiet) {
-              console.error(
-                `SIMY could not continue as the previous device: ${error instanceof Error ? error.message : String(error)}`,
-              );
+            json(res, 503, {
+              error: error instanceof Error ? error.message : "CLI API endpoint is unavailable",
+            });
+            return;
+          }
+          const nextOrganization = body.organization_id ?? body.org_id;
+          const nextAccount = body.account_id ?? body.auth_user_id;
+          const changingScope = session && (session.organization_id !== nextOrganization || session.account_id !== nextAccount);
+          if ((changingScope && organizationBusy()) || (pendingOrganization &&
+              (pendingOrganization.id !== nextOrganization || pendingOrganization.accountId !== nextAccount))) {
+            json(res, 409, { error: "Organization authorization does not match, or tasks are still running." });
+            return;
+          }
+          const previousSession = session ?? reclaimableSession;
+          const authorizedSession = {
+            token: String(body.token || ""),
+            device_id: typeof body.device_id === "string" ? body.device_id : null,
+            api_origin: apiOrigin,
+            api_base_url: apiBaseUrl,
+            account_id: typeof body.account_id === "string"
+              ? body.account_id
+              : typeof body.auth_user_id === "string"
+              ? body.auth_user_id
+              : null,
+            organization_id: typeof body.organization_id === "string"
+              ? body.organization_id
+              : typeof body.org_id === "string"
+              ? body.org_id
+              : null,
+            expires_at: typeof body.expires_at === "string" ? body.expires_at : expiresAtFromNow(),
+          };
+          // A fresh sign-in issues a new device. Keep running as the device used
+          // before (its desktop WorkFlow evidence stays resumable) when this agent
+          // still holds that device's token. Otherwise continue as the new device.
+          if (
+            previousSession?.device_id &&
+            previousSession.token &&
+            authorizedSession.device_id &&
+            previousSession.device_id !== authorizedSession.device_id &&
+            previousSession.api_origin &&
+            (previousSession.account_id ?? null) === (authorizedSession.account_id ?? null) &&
+            (previousSession.organization_id ?? null) === (authorizedSession.organization_id ?? null) &&
+            previousApiBaseUrl(previousSession) === authorizedSession.api_base_url
+          ) {
+            try {
+              const reclaimed = await reclaimDevice({
+                apiOrigin,
+                apiBaseUrl: authorizedSession.api_base_url,
+                token: authorizedSession.token,
+                previousDeviceId: previousSession.device_id,
+                previousToken: previousSession.token,
+              });
+              if (reclaimed?.device_id === previousSession.device_id) {
+                authorizedSession.device_id = reclaimed.device_id;
+                if (typeof reclaimed.expires_at === "string") authorizedSession.expires_at = reclaimed.expires_at;
+              }
+            } catch (error) {
+              if (!quiet) {
+                console.error(
+                  `SIMY could not continue as the previous device: ${error instanceof Error ? error.message : String(error)}`,
+                );
+              }
             }
           }
-        }
-        await writeSession(apiOrigin, session, sessionRoot);
-        authNonce = randomBytes(16).toString("base64url");
-        pendingOrganization = null;
-        sqmEnabled = await readSqmEnabled(sessionRoot, apiOrigin, session);
-        if (changingScope) sqmLocalReviewWorker?.resetHistory?.();
-        organizationState = "unknown";
-        organizationItems = [];
-        void refreshOrganizations();
-        refreshAvailableCapabilities();
-        startHeartbeatTimer();
-        loginUrl = null;
-        registry.emit("change", registry.list());
-        json(res, 200, {
-          ok: true,
-          expires_at: session.expires_at,
-          cli_version: CLI_VERSION,
-          api_contract_version: CLI_API_CONTRACT_VERSION,
-        });
-        void synchronizeAuthorizedSession();
-        return;
+          // A cancellation, timeout or new request during device reclaim must
+          // not let this old callback overwrite the current authorization.
+          if (authorizationWindow.snapshot().state === "timed_out" || requestNonce !== authNonce) {
+            json(res, 410, { error: "Connection expired. Reconnect from SIMY." }); return;
+          }
+          await writeSession(apiOrigin, authorizedSession, sessionRoot);
+          session = authorizedSession;
+          reclaimableSession = null;
+          authorizationWindow.clear();
+          expiredOrganizationId = null;
+          authNonce = randomBytes(16).toString("base64url");
+          pendingOrganization = null;
+          desktopLoginPending = false;
+          sqmEnabled = await readSqmEnabled(sessionRoot, apiOrigin, session);
+          if (changingScope) sqmLocalReviewWorker?.resetHistory?.();
+          organizationState = "unknown";
+          organizationItems = [];
+          void refreshOrganizations();
+          refreshAvailableCapabilities();
+          startHeartbeatTimer();
+          loginUrl = null;
+          registry.emit("change", registry.list());
+          json(res, 200, {
+            ok: true,
+            expires_at: session.expires_at,
+            cli_version: CLI_VERSION,
+            api_contract_version: CLI_API_CONTRACT_VERSION,
+          });
+          void synchronizeAuthorizedSession();
+          return;
+        } finally { authorizationCompleting = false; }
       }
       const localTaskArtifactMatch = url.pathname.match(
         /^\/v1\/local-tasks\/([^/]+)\/artifacts\/([^/]+)$/,
@@ -2156,7 +2227,7 @@ export async function startAgent({
   }
 
   if (!isSessionValid(session, Date.now(), apiOrigin)) {
-    requestDesktopLogin();
+    requestDesktopLogin(null, { passive: true });
     if (!quiet) {
       console.log(`Sign in to SIMY: ${loginUrl.toString()}`);
       console.log(`Session file: ${sessionPath(apiOrigin, sessionRoot)}`);
@@ -2194,6 +2265,7 @@ export async function startAgent({
   const shutdown = () => {
     if (shutdownPromise) return shutdownPromise;
     shuttingDown = true;
+    authorizationWindow.clear();
     shutdownPromise = (async () => {
       if (heartbeatTimer) clearInterval(heartbeatTimer);
       if (codingRunMonitorTimer) clearInterval(codingRunMonitorTimer);
@@ -2225,6 +2297,7 @@ export async function startAgent({
     return JSON.stringify(scope) === JSON.stringify(currentHistoryScope()) ? items : [];
   };
   const getDesktopStatus = async () => {
+    const authorization = authorizationWindow.snapshot();
     const auth = desktopAuthStatus(session, { webOrigin: apiOrigin });
     if (auth.state === "signed_in" && organizationState === "unknown") void refreshOrganizations();
     if (enforceDesktopAccess) void desktopAccess.refresh().catch(() => {});
@@ -2242,6 +2315,9 @@ export async function startAgent({
       version: CLI_VERSION,
       webOrigin: apiOrigin,
       auth,
+      authorization: { ...authorization,
+        state: authorization.state === "timed_out" && !expiredInteractiveAuthorization ? "idle" : authorization.state,
+        pending: Boolean(pendingOrganization || desktopLoginPending) },
       ...(enforceDesktopAccess ? { access: { ...desktopAccess.snapshot(), revision: desktopScopeRevision() } } : {}),
       connection: connectionStatus.snapshot({ authenticated: auth.state === "signed_in" }),
       tasks: desktopTaskStatus([registry, directRegistry, localTaskRegistry]),
@@ -2256,7 +2332,8 @@ export async function startAgent({
       codex,
       claude,
       providers: { codex, claude },
-      loginUrl: auth.state === "signed_in" ? null : requestDesktopLogin(),
+      // URLs stay inside the host; native UI reopens the current request by action.
+      loginUrl: auth.state === "signed_in" ? null : requestDesktopLogin(null, { passive: true }),
     };
   };
   return {
@@ -2270,9 +2347,14 @@ export async function startAgent({
     shutdown,
     webOrigin: apiOrigin,
     get loginUrl() {
-      return requestDesktopLogin();
+      return requestDesktopLogin(null, { passive: true });
     },
     requestDesktopLogin,
+    getPendingAuthorizationUrl: () => {
+      authorizationWindow.snapshot();
+      return pendingOrganization || desktopLoginPending ? loginUrl?.toString() ?? null : null;
+    },
+    retryAuthorization: () => authorizationWindow.snapshot().state === "timed_out" ? requestDesktopLogin() : null,
     async refreshDesktopAccess() {
       const previous = desktopAccess.snapshot().state;
       const result = await desktopAccess.refresh(true);
@@ -2284,7 +2366,7 @@ export async function startAgent({
     getDesktopAccess: () => ({ ...desktopAccess.snapshot(), revision: desktopScopeRevision() }),
     requireDesktopAccess: authorizeDesktopWork,
     refreshOrganizations,
-    cancelOrganizationSelection() { authNonce = randomBytes(16).toString("base64url"); pendingOrganization = null; loginUrl = null; refreshAvailableCapabilities(); notifyDesktopStatusChange(); },
+    cancelOrganizationSelection() { authorizationWindow.clear(); expiredOrganizationId = null; expiredInteractiveAuthorization = false; authNonce = randomBytes(16).toString("base64url"); pendingOrganization = null; desktopLoginPending = false; loginUrl = null; refreshAvailableCapabilities(); notifyDesktopStatusChange(); },
     async setSqmEnabled(enabled) {
       if (enabled) await authorizeDesktopWork();
       if (!isSessionValid(session, Date.now(), apiOrigin) || pendingOrganization) throw new Error("Sign in to an organization first.");

package/src/browser-authorization.js

@@ -0,0 +1,32 @@
+// Browser sign-in and SQM command sign-in share one authorization window.
+export const BROWSER_AUTHORIZATION_TIMEOUT_MS = 20 * 60 * 1000;
+
+export function createAuthorizationWindow({ now = Date.now, schedule = setTimeout,
+  cancel = clearTimeout, onExpire = () => {} } = {}) {
+  let deadline = null, timer = null, state = "idle";
+  const expire = () => {
+    if (deadline === null || now() < deadline) return;
+    if (timer !== null) cancel(timer);
+    deadline = timer = null;
+    state = "timed_out";
+    onExpire();
+  };
+  return {
+    start() {
+      if (timer !== null) cancel(timer);
+      state = "pending";
+      deadline = now() + BROWSER_AUTHORIZATION_TIMEOUT_MS;
+      timer = schedule(expire, BROWSER_AUTHORIZATION_TIMEOUT_MS);
+      timer?.unref?.();
+    },
+    clear() {
+      if (timer !== null) cancel(timer);
+      deadline = timer = null;
+      state = "idle";
+    },
+    snapshot() {
+      expire(); // Also enforce the deadline after suspend/resume.
+      return { state, expiresAt: deadline === null ? null : new Date(deadline).toISOString() };
+    },
+  };
+}

package/src/browser-handoff.js

@@ -0,0 +1,68 @@
+import { createDecipheriv, createHash } from "node:crypto";
+
+export const BROWSER_HANDOFF_TRANSPORT = "loopback_redirect_v1";
+
+// Versioned wire protocol also implemented by simy-web's browser WebCrypto.
+// Bind the encrypted fragment to this request, Web host and listening port.
+export function decryptBrowserHandoff(handoff, { nonce, apiOrigin, port }) {
+  if (typeof handoff !== "string" || handoff.length > 16384 ||
+      !/^v1\.[A-Za-z0-9_-]{16}\.[A-Za-z0-9_-]+$/.test(handoff)) throw new Error("Invalid browser handoff.");
+  const [, iv, encrypted] = handoff.split(".");
+  const ciphertext = Buffer.from(encrypted, "base64url");
+  if (ciphertext.length < 17) throw new Error("Invalid browser handoff.");
+  const context = Buffer.from(`simy-browser-handoff-v1\0${apiOrigin}\0${port}`);
+  const key = createHash("sha256").update(context).update("\0").update(nonce).digest();
+  const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(iv, "base64url"));
+  decipher.setAAD(context);
+  decipher.setAuthTag(ciphertext.subarray(-16));
+  const body = JSON.parse(Buffer.concat([decipher.update(ciphertext.subarray(0, -16)), decipher.final()]).toString("utf8"));
+  if (!body || typeof body !== "object" || body.nonce !== nonce) throw new Error("Invalid browser handoff.");
+  return body;
+}
+
+const script = `
+const ja = navigator.language.startsWith('ja');
+const copy = ja ? {
+  title: 'SIMY に接続しています', waiting: 'このページで接続を完了します。SIMY は開いたままにしてください。',
+  connected: '接続しました', done: 'SIMY に戻ってください。このタブは閉じても大丈夫です。',
+  failed: '接続できませんでした', retry: 'SIMY に戻り、もう一度接続してください。接続リンクの有効期限は20分です。'
+} : {
+  title: 'Connecting to SIMY', waiting: 'Keep SIMY open while this page completes the connection.',
+  connected: 'Connected', done: 'Return to SIMY. You can close this tab.',
+  failed: 'Could not connect', retry: 'Return to SIMY and reconnect. Connection links expire after 20 minutes.'
+};
+document.documentElement.lang = ja ? 'ja' : 'en';
+const title = document.getElementById('title'), message = document.getElementById('message');
+title.textContent = copy.title; message.textContent = copy.waiting;
+const handoff = new URLSearchParams(location.hash.slice(1)).get('handoff');
+history.replaceState(null, '', location.pathname);
+(async () => {
+  try {
+    if (!handoff) throw new Error('Missing handoff');
+    const response = await fetch('/v1/auth/browser-complete', {
+      method: 'POST', headers: {'Content-Type': 'application/json'},
+      body: JSON.stringify({handoff}), signal: AbortSignal.timeout(30000)
+    });
+    if (!response.ok) throw new Error('Rejected handoff');
+    title.textContent = copy.connected; message.textContent = copy.done;
+    document.body.dataset.state = 'connected';
+  } catch {
+    title.textContent = copy.failed; message.textContent = copy.retry;
+    document.body.dataset.state = 'failed';
+  }
+})();`;
+
+// A self-contained local page: credentials never enter the URL query, HTTP
+// request, history or third-party resources. Only the encrypted fragment does.
+const style = `:root{color-scheme:light dark;--bg:#ffffff;--card:#f6f5f4;--ink:#0d0d0d;--muted:#615d59;--line:#e6e6e6;--accent:#0075de} @media(prefers-color-scheme:dark){:root{--bg:#1a1918;--card:#252320;--ink:#f5f3f0;--muted:#b8b3ad;--line:#31302f;--accent:#3b9eff}}*{box-sizing:border-box}body{margin:0;min-height:100dvh;display:grid;place-items:center;padding:24px;background:var(--bg);color:var(--ink);font:16px/1.5 system-ui,sans-serif}main{max-width:480px;width:100%;padding:32px;border:1px solid var(--line);border-radius:12px;background:var(--card)}.brand{color:var(--accent);font-weight:600;font-size:14px}h1{font-size:24px;font-weight:600;margin:16px 0}p{color:var(--muted);margin:0}body[data-state=failed] h1{color:var(--ink)}`;
+const hash = value => createHash("sha256").update(value).digest("base64");
+export function browserHandoffPage() {
+  return {
+    headers: {
+      "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store",
+      "Referrer-Policy": "no-referrer", "X-Content-Type-Options": "nosniff",
+      "Content-Security-Policy": `default-src 'none'; script-src 'sha256-${hash(script)}'; style-src 'sha256-${hash(style)}'; connect-src 'self'; img-src data:; frame-ancestors 'none'; base-uri 'none'; form-action 'none'`,
+    },
+    html: `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>SIMY connection</title><link rel="icon" href="data:,"><style>${style}</style></head><body><main aria-live="polite" aria-atomic="true"><div class="brand">SIMY</div><h1 id="title">Connecting to SIMY</h1><p id="message">Keep SIMY open while connecting.</p><noscript>JavaScript is required. Return to SIMY and reconnect using a browser with JavaScript enabled.</noscript></main><script>${script}</script></body></html>`,
+  };
+}

package/src/cli-contract.js

@@ -13,7 +13,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.5.62";
+export const CLI_VERSION = "0.5.64";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function withCliContract(

package/src/desktop-access.js

@@ -7,7 +7,7 @@ export function validDesktopAccessPath(path, slug) {
   return path === expected || path === `${expected}/`;
 }
 export const desktopAccessReady = value => value?.state === 'ready';
-const recoveryActions = new Set(['refresh', 'reconnect', 'login', 'organization_select', 'organization_cancel', 'organizations_refresh',
+const recoveryActions = new Set(['refresh', 'reconnect', 'login', 'authorization_open', 'organization_select', 'organization_cancel', 'organizations_refresh',
   'check_update', 'update', 'quit', 'delivery_stop', 'delivery_pause', 'delivery_reject',
   'desktop_access_refresh', 'desktop_access_settings', 'desktop_access_members']);
 export function desktopActionAllowed(access, command) {

package/src/desktop-host.js

@@ -39,6 +39,7 @@ const silentLogger = { log() {}, error() {} };
 const MAX_DESKTOP_FRAME_BYTES = 8 * 1024 * 1024;
 
 function desktopActionError(action, error) {
+  if (action === 'authorization_open' || error?.code === 'desktop_browser_unavailable') return "Could not open your browser. Open the verification link again, or check your default browser.";
   if (error?.code === "desktop_access_required") return "Sign in to an organization with SQM and Developer access before using SIMY.";
   if (action === "session_deadline_decide") return error?.code === "conflict"
     ? "Deadline changed; refresh before deciding." : "The deadline is unavailable. Refresh this conversation before deciding.";
@@ -436,16 +437,22 @@ export async function startDesktopHost({ input = process.stdin, output = process
         else if (action === "organizations_refresh") await agent.refreshOrganizations();
         else if (action === "sqm_set_enabled") await agent.setSqmEnabled(command.enabled);
         else if (action === "organization_cancel") agent.cancelOrganizationSelection();
-        else if (action === "login" || action === "organization_select") {
+        else if (action === "login" || action === "organization_select" || action === "authorization_open") {
           if (action === "organization_select" && (typeof command.organizationId !== "string" || !command.organizationId)) throw new Error("Select an organization first.");
           if (action === "organization_select" && activeQueuedAction && !["refresh", "reconnect", "task_detail", "organizations_refresh", "check_update"].includes(activeQueuedAction)) {
             throw Object.assign(new Error("Wait for the current action to finish before switching organizations."), { code: "desktop_organization_busy" });
           }
-          const url = await agent.requestDesktopLogin(action === "organization_select" ? command.organizationId : null);
+          const url = action === "authorization_open" ? (agent.getPendingAuthorizationUrl?.() ?? agent.retryAuthorization?.())
+            : await agent.requestDesktopLogin(action === "organization_select" ? command.organizationId : null);
+          if (action === 'authorization_open' && !url) throw new Error('No pending authorization.');
           if (url) {
             if (new URL(url).origin !== webOrigin) throw new Error("Invalid login origin.");
-            const result = await (dependencies.openLogin || openAuthorizationUrl)(url, { logger: silentLogger });
-            if (!result.opened) { agent.cancelOrganizationSelection?.(); throw new Error("Could not open the login page."); }
+            // Keep the pending request after an OS/browser failure so the user can
+            // use the visible fallback without silently canceling authorization.
+            try {
+              const result = await (dependencies.openLogin || openAuthorizationUrl)(url, { logger: silentLogger });
+              if (!result.opened) throw new Error('Browser unavailable.');
+            } catch { throw Object.assign(new Error('Browser unavailable.'), { code: 'desktop_browser_unavailable' }); }
           }
         } else if (action === "check_update") await updater.checkNow();
         else if (action === "update") {
@@ -560,7 +567,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
         emit({ type: "result", id: command.id, ok: false, message: desktopActionError(command.action, error) });
       }
     };
-    if (["login", "organization_select", "organization_cancel"].includes(command.action)) {
+    if (["login", "organization_select", "organization_cancel", "authorization_open"].includes(command.action)) {
       authorizationQueue = authorizationQueue.then(execute).catch(() => {});
     } else {
       queue = queue.then(async () => {

package/src/sqm/session.js

@@ -3,13 +3,13 @@ import { openAuthorizationUrl } from "../browser.js";
 import { isSessionValid, readSession } from "../session-store.js";
 import { createAgentShutdown } from "../shutdown.js";
 
-const DEFAULT_AUTH_TIMEOUT_MS = 2 * 60 * 1000;
+import { BROWSER_AUTHORIZATION_TIMEOUT_MS } from "../browser-authorization.js";
 
 export async function ensureSqmSession(
   webOrigin,
   {
     noOpen = false,
-    timeoutMs = DEFAULT_AUTH_TIMEOUT_MS,
+    timeoutMs = BROWSER_AUTHORIZATION_TIMEOUT_MS,
     logger = console,
     now = Date.now,
     sleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),