@certalis/agent-smith 0.1.1 → 0.1.2

package/dist/bin.js

@@ -1275,12 +1275,30 @@ function parseNumber(value) {
   const parsed = Number(value);
   return Number.isFinite(parsed) ? parsed : undefined;
 }
+function normalizeEnrollmentEmail(value) {
+  if (typeof value !== "string")
+    return;
+  const email = value.trim().toLowerCase();
+  return email.length <= 254 && patterns.email.test(email) ? email : undefined;
+}
+function sanitizeEnrollmentEmails(value) {
+  if (!Array.isArray(value))
+    return;
+  const emails = value.map(normalizeEnrollmentEmail).filter((email) => email !== undefined);
+  return [...new Set(emails)].slice(0, MAX_ENROLLMENT_EMAILS);
+}
 function sanitizeConfigData(value) {
   if (!isRecord(value)) {
     return {};
   }
   const sanitized = {};
   for (const [key, entry] of Object.entries(value)) {
+    if (key === "enrollment_emails") {
+      const emails = sanitizeEnrollmentEmails(entry);
+      if (emails)
+        sanitized.enrollment_emails = emails;
+      continue;
+    }
     if (key === "team_routing") {
       const teamRouting = sanitizeTeamRouting(entry);
       if (teamRouting)
@@ -1430,7 +1448,7 @@ function sanitizeTeamRouting(value) {
   }
   return result;
 }
-var log2, PROVIDER_STRATEGIES, BUILTIN_PROVIDER_CONFIGS, BUILTIN_PROVIDER_CONFIG_BY_NAME, PROVIDER_NAME_PATTERN, TEAM_ROUTING_DEFAULTS, Config;
+var log2, PROVIDER_STRATEGIES, BUILTIN_PROVIDER_CONFIGS, BUILTIN_PROVIDER_CONFIG_BY_NAME, PROVIDER_NAME_PATTERN, TEAM_ROUTING_DEFAULTS, MAX_ENROLLMENT_EMAILS = 200, Config;
 var init_src4 = __esm(() => {
   init_src2();
   init_src3();
@@ -1674,11 +1692,28 @@ var init_src4 = __esm(() => {
       this.persistAccountAllowlist(current.filter((uuid) => uuid !== accountUuid));
     }
     persistAccountAllowlist(accountUuids) {
-      const teamRouting = {
+      this.persistStrictly("team_routing", {
         ...this.data.team_routing,
         allowlisted_account_uuids: accountUuids
-      };
-      const next = { ...this.data, team_routing: teamRouting };
+      });
+    }
+    getEnrollmentEmails() {
+      return [...this.data.enrollment_emails ?? []];
+    }
+    setEnrollmentEmails(emails) {
+      const normalized = emails.map(normalizeEnrollmentEmail);
+      if (normalized.some((email) => email === undefined)) {
+        throw new ValidationError("Invalid enrollment email", "enrollment_emails");
+      }
+      const unique = [...new Set(normalized)];
+      if (unique.length > MAX_ENROLLMENT_EMAILS) {
+        throw new ValidationError(`At most ${MAX_ENROLLMENT_EMAILS} enrollment emails`, "enrollment_emails");
+      }
+      this.persistStrictly("enrollment_emails", unique);
+      return [...unique];
+    }
+    persistStrictly(key, value) {
+      const next = { ...this.data, [key]: value };
       const temporary = `${this.configPath}.${crypto.randomUUID()}.tmp`;
       try {
         writeFileSync(temporary, JSON.stringify(next, null, 2), {
@@ -1689,13 +1724,9 @@ var init_src4 = __esm(() => {
       } finally {
         rmSync(temporary, { force: true });
       }
-      const oldValue = this.data.team_routing;
+      const oldValue = this.data[key];
       this.data = next;
-      this.emit("change", {
-        key: "team_routing",
-        oldValue,
-        newValue: teamRouting
-      });
+      this.emit("change", { key, oldValue, newValue: value });
     }
     getRuntime() {
       const defaults = {
@@ -7014,72 +7045,157 @@ function enrollmentPage() {
   return new Response(`<!doctype html>
 <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
 <title>Connect a Claude subscription</title>
-<style nonce="${nonce}">
-:root{color-scheme:light;font-family:"Avenir Next",Avenir,"Segoe UI",sans-serif;color:#17334a;background:#edf3f7;line-height:1.6}
-body{margin:0;padding:clamp(20px,6vw,64px)}main{max-width:42rem;margin:auto;background:#fff;padding:clamp(24px,5vw,48px);border-top:6px solid #235e82}
-h1{font-size:clamp(1.8rem,5vw,2.5rem);line-height:1.2;margin:0 0 24px}h2{font-size:1.2rem;margin-top:32px}p{max-width:65ch}button,a.button{font:inherit;display:inline-block;border:0;border-radius:6px;background:#235e82;color:#fff;padding:12px 20px;text-decoration:none;cursor:pointer}button:disabled{opacity:.55;cursor:wait}button:focus-visible,a:focus-visible,input:focus-visible{outline:3px solid #b15c00;outline-offset:4px}input[type=password]{box-sizing:border-box;display:block;width:100%;font:inherit;padding:12px;border:1px solid #647686;border-radius:4px;margin:8px 0 16px}label{display:block}#account{font-weight:600;overflow-wrap:anywhere}#status{white-space:pre-line}small{display:block;margin-top:32px;color:#4b6172}[hidden]{display:none!important}
-</style></head><body><main>
-<h1>Connect your Claude subscription</h1>
-<p>This adds your subscription to the shared agents pool. Only connect an account you have permission to share. Your password stays with Claude; the pool stores the authorization needed to run agents.</p>
-<section id="begin"><h2>1. Sign in with Claude</h2><p>You will open Claude in a separate tab. Choose the account you want to share.</p><button id="start" type="button">Connect Claude</button><p><a id="authorize" class="button" target="_blank" rel="noopener noreferrer" hidden>Open Claude sign-in</a></p></section>
-<form id="verify" hidden><h2>2. Check your account</h2><label for="code">Paste the authorization code from Claude</label><input id="code" type="password" autocomplete="off" spellcheck="false" required maxlength="4096"><button type="submit">Check account</button></form>
-<form id="confirm" hidden><h2>3. Add this subscription</h2><p>Claude verified this account:</p><p id="account"></p><label><input id="consent" type="checkbox" required> I authorize the shared agents pool to use this subscription.</label><p><button type="submit">Add subscription to pool</button></p><p>Wrong account? Do not confirm. Close this page and ask the operator for a new link.</p></form>
-<section id="connected" hidden><h2>Subscription connected</h2><p id="connected-account"></p><p>Testing this flow? Disconnect removes this seat's saved credentials and pool membership before letting you sign in again.</p><button id="disconnect" type="button">Disconnect and try again</button><p>Keep this page open to disconnect. This button expires after 24 hours; a page reload or server restart requires operator help. It does not sign you out of Claude's website, cancel your subscription, or stop a request already running.</p></section>
-<p id="status" role="status" aria-live="polite"></p>
-<small>This private link works once. After starting, each step expires in 10 minutes. Do not share this link or paste authorization codes into chat. Reloading this page requires a new invitation.</small>
-<noscript>JavaScript is required for this private sign-in flow.</noscript>
-</main><script nonce="${nonce}">
+<style nonce="${nonce}">${styles}</style></head><body>
+<header>Shared agents pool<small>Connect a Claude subscription</small><div class="bar"><span id="progress"></span></div></header>
+<main>
+<ol id="stepper" aria-label="Progress">
+<li data-step="email"><span class="dot">1</span><span class="label">Email</span></li>
+<li data-step="signin"><span class="dot">2</span><span class="label">Sign in</span></li>
+<li data-step="code"><span class="dot">3</span><span class="label">Paste code</span></li>
+<li data-step="confirm"><span class="dot">4</span><span class="label">Confirm</span></li>
+<li data-step="done"><span class="dot">5</span><span class="label">Done</span></li>
+</ol>
+<section class="card" id="step-email" hidden>
+<div class="avatar">${icon("mail")}</div>
+<h1 tabindex="-1">Connect your Claude subscription</h1>
+<p class="lead">This adds your subscription to the shared agents pool. Start with your work email: if it is on this pool's list, the next step lets you sign in with Claude.</p>
+<form id="request">
+<p class="notice err" id="email-error" role="alert" hidden></p>
+<label for="email">Work email<input id="email" type="email" autocomplete="email" spellcheck="false" required maxlength="254"></label>
+<button class="button" type="submit">Continue</button>
+</form>
+</section>
+<section class="card" id="step-signin" hidden>
+<p class="notice" id="signin-notice" role="status" hidden></p>
+<div class="avatar">${icon("key")}</div>
+<h1 tabindex="-1">Sign in with Claude</h1>
+<p class="lead" id="signin-for" hidden>Use the Claude account of <strong id="signin-email"></strong>. Only connect an account you have permission to share.</p>
+<ul class="facts">
+<li>Claude opens in a new tab. Sign in and pick the account to share.</li>
+<li>Your password stays with Claude. The pool only keeps the authorization it needs to run agents.</li>
+<li>Claude then shows a code: you paste it here in the next step.</li>
+</ul>
+<button class="button" id="start" type="button">Continue to Claude ${icon("open")}</button>
+</section>
+<section class="card" id="step-code" hidden>
+<div class="avatar">${icon("code")}</div>
+<h1 tabindex="-1">Paste the code from Claude</h1>
+<p class="lead" id="code-lead">Claude opened in a new tab. Once you have signed in, it shows an authorization code: copy it and paste it below.</p>
+<form id="verify">
+<label for="code">Authorization code<input id="code" type="password" autocomplete="off" spellcheck="false" required maxlength="4096"><span class="hint">The code stays hidden on screen. Never paste it into chat.</span></label>
+<button class="button" type="submit">Verify account</button>
+</form>
+<p class="aside">Closed the Claude tab? <a class="link" id="reopen" target="_blank" rel="noopener noreferrer">Open Claude sign-in again ${icon("open")}</a></p>
+</section>
+<section class="card" id="step-confirm" hidden>
+<div class="avatar">${icon("person")}</div>
+<h1 tabindex="-1">Is this the right account?</h1>
+<p class="lead">Claude verified the account below. Check it before adding it to the pool.</p>
+<form id="confirm">
+<div class="account">${icon("check")}<span id="account"></span></div>
+<label class="consent"><input id="consent" type="checkbox" required><span>I authorize the shared agents pool to use this subscription.</span></label>
+<button class="button" type="submit">Add to the pool</button>
+</form>
+<p class="aside">Wrong account? Do not confirm: start again and sign in with the right one.<a class="button secondary" href="/pool-enroll">Start again</a></p>
+</section>
+<section class="card" id="step-done" hidden>
+<div class="avatar ok">${icon("check")}</div>
+<h1 tabindex="-1">Subscription connected</h1>
+<p class="lead"><strong id="connected-account"></strong> is now part of the shared agents pool. You can close this page.</p>
+<div class="aside"><strong>Only testing?</strong> Disconnect removes this account's saved authorization and pool membership, then lets you sign in again. It stays available for 24 hours while this page is open; it does not sign you out of Claude or cancel your subscription.<button class="button secondary" id="disconnect" type="button">Disconnect and try again</button></div>
+</section>
+<section class="card" id="step-error" hidden>
+<div class="avatar err">${icon("alert")}</div>
+<h1 tabindex="-1">This sign-in can't continue</h1>
+<p class="lead" id="error-message"></p>
+<p class="aside">Nothing was added to the pool from this step.<a class="button secondary" href="/pool-enroll">Start again</a></p>
+</section>
+<p id="status" class="notice err" role="alert" hidden></p>
+</main>
+<footer>Each step expires after 10 minutes. Nothing is added to the pool until you confirm.</footer>
+<noscript><p class="notice err">JavaScript is required for this sign-in.</p></noscript>
+<script nonce="${nonce}">
 let token = location.hash.slice(1);
 history.replaceState(null, '', location.pathname);
 addEventListener('hashchange', () => { if (location.hash) location.reload(); });
 const get = id => document.getElementById(id);
-const status = get('status');
-async function post(step, values) {
-  const response = await fetch('/pool-enroll/' + step, {method:'POST', credentials:'omit', cache:'no-store', redirect:'error', headers:{'content-type':'application/json'}, body:JSON.stringify({token, ...values})});
+const steps = ['email', 'signin', 'code', 'confirm', 'done'];
+let current = 'email';
+function show(step) {
+  const failed = step === 'error';
+  const index = steps.indexOf(failed ? current : step);
+  if (!failed) current = step;
+  for (const name of [...steps, 'error']) get('step-' + name).hidden = name !== step;
+  document.querySelectorAll('#stepper li').forEach((item, position) => {
+    item.className = position < index || step === 'done' ? 'done' : position === index ? (failed ? 'failed' : 'active') : '';
+    item.querySelector('.dot').innerHTML = item.className === 'done' ? '${icon("check")}' : String(position + 1);
+    if (position === index) item.setAttribute('aria-current', 'step'); else item.removeAttribute('aria-current');
+  });
+  get('progress').style.width = Math.max(5, ((index + (step === 'done' ? 1 : 0)) / steps.length) * 100) + '%';
+  (step === 'email' ? get('email') : get('step-' + step).querySelector('h1')).focus();
+}
+async function send(step, body) {
+  const response = await fetch('/pool-enroll/' + step, {method:'POST', credentials:'omit', cache:'no-store', redirect:'error', headers:{'content-type':'application/json'}, body:JSON.stringify(body)});
   const data = await response.json();
-  if (!response.ok) throw new Error(data.error || 'Sign-in failed. Ask the operator for a new link.');
+  if (!response.ok) throw new Error(data.error || 'Sign-in failed. Start again.');
   token = data.token || '';
   return data;
 }
+const post = (step, values) => send(step, {token, ...values});
 function fail(error) {
-  token = ''; get('code').value = ''; get('begin').hidden = true; get('verify').hidden = true; get('confirm').hidden = true;
-  status.textContent = error instanceof Error ? error.message : 'Sign-in failed. Ask for a new link.';
+  token = ''; get('code').value = '';
+  get('error-message').textContent = error instanceof Error ? error.message : 'Sign-in failed. Start again.';
+  show('error');
 }
-if (!/^[A-Za-z0-9_-]{43}$/.test(token)) fail(new Error('Open the private invitation link supplied by your pool operator.'));
+show(/^[A-Za-z0-9_-]{43}$/.test(token) ? 'signin' : 'email');
+get('request').addEventListener('submit', async event => {
+  event.preventDefault(); event.submitter.disabled = true; get('email-error').hidden = true;
+  try {
+    const data = await send('request', {email: get('email').value});
+    get('signin-email').textContent = data.email; get('signin-for').hidden = false;
+    show('signin');
+  } catch (error) {
+    get('email-error').textContent = error instanceof Error ? error.message : 'This email cannot connect. Ask the operator.';
+    get('email-error').hidden = false; get('email').focus();
+  } finally { event.submitter.disabled = false; }
+});
 get('start').addEventListener('click', async () => {
+  const tab = window.open('', '_blank');
   get('start').disabled = true;
   try {
     const data = await post('start', {});
     const url = new URL(data.authUrl);
-    if (url.origin !== 'https://claude.ai' || url.pathname !== '/oauth/authorize') throw new Error('Invalid sign-in destination. Ask the operator for help.');
-    get('authorize').href = url.href; get('authorize').hidden = false; get('start').hidden = true;
-    get('verify').hidden = false; status.textContent = 'Open Claude sign-in above, then return here with the code.';
-  } catch(error) { fail(error); }
+    if (url.origin !== 'https://claude.ai' || url.pathname !== '/oauth/authorize') throw new Error('Invalid sign-in destination. Ask for help.');
+    get('reopen').href = url.href;
+    if (tab) { tab.opener = null; tab.location.href = url.href; }
+    else get('code-lead').textContent = 'Your browser blocked the new tab. Open Claude sign-in with the link below, sign in, then paste the code it shows.';
+    show('code');
+  } catch (error) { if (tab) tab.close(); fail(error); }
 });
 get('verify').addEventListener('submit', async event => {
-  event.preventDefault(); const button = event.submitter; button.disabled = true;
+  event.preventDefault(); event.submitter.disabled = true;
   const code = get('code').value.trim(); get('code').value = '';
-  try { const data = await post('verify', {code}); get('begin').hidden = true; get('verify').hidden = true; get('account').textContent = data.email; get('confirm').hidden = false; status.textContent = 'Check the account above before confirming.'; }
-  catch(error) { fail(error); }
+  try { const data = await post('verify', {code}); get('account').textContent = data.email; show('confirm'); }
+  catch (error) { fail(error); }
 });
 get('confirm').addEventListener('submit', async event => {
   event.preventDefault(); if (!get('consent').checked) return; event.submitter.disabled = true;
-  try { await post('confirm', {consent:true}); get('confirm').hidden = true; get('connected-account').textContent = get('account').textContent; get('connected').hidden = false; status.textContent = 'Subscription connected. If you are testing, disconnect before closing this page.'; }
-  catch(error) { fail(error); }
+  try { await post('confirm', {consent:true}); get('connected-account').textContent = get('account').textContent; show('done'); }
+  catch (error) { fail(error); }
 });
 get('disconnect').addEventListener('click', async () => {
-  get('disconnect').disabled = true;
+  get('disconnect').disabled = true; get('status').hidden = true;
   try {
     await post('disconnect', {});
-    get('connected').hidden = true; get('connected-account').textContent = ''; get('account').textContent = '';
-    get('consent').checked = false; get('code').value = '';
-    get('authorize').removeAttribute('href'); get('authorize').hidden = true;
+    get('account').textContent = ''; get('connected-account').textContent = ''; get('consent').checked = false;
     document.querySelectorAll('button').forEach(button => { button.disabled = false; });
-    get('start').hidden = false; get('begin').hidden = false;
-    status.textContent = 'Subscription disconnected. It is no longer in the pool. You can close this page or connect again.';
-  } catch(error) {
+    get('signin-notice').textContent = 'Subscription disconnected: it is no longer in the pool. You can connect again or close this page.';
+    get('signin-notice').hidden = false;
+    show('signin');
+  } catch (error) {
     get('disconnect').disabled = false;
-    status.textContent = 'Removal is not confirmed. ' + (error instanceof Error ? error.message : 'Keep this page open and ask the operator to check this seat.');
+    get('status').textContent = 'Removal is not confirmed. ' + (error instanceof Error ? error.message : 'Keep this page open and ask for help with this seat.');
+    get('status').hidden = false;
   }
 });
 </script></body></html>`, {
@@ -7093,7 +7209,61 @@ get('disconnect').addEventListener('click', async () => {
     }
   });
 }
-var init_enrollment_page = () => {};
+var icons, icon = (name) => `<svg viewBox="0 0 24 24" aria-hidden="true">${icons[name]}</svg>`, styles = `
+:root{--page:#faf9f6;--card:#fff;--text:#191b21;--muted:#5a606b;--faint:#9aa0ab;--line:#e6e8ec;--border:rgba(25,27,33,.14);--brand:#fb5d22;--accent:#dc5518;--tint:#fff3ec;--ink:#182025;--ink-hover:#2a333b;--ok:#17a06b;--ok-bg:#e3f6ed;--ok-text:#0c6444;--err:#d92d20;--err-bg:#fef3f2;--err-text:#912018;color-scheme:light;font:15px/1.55 "Public Sans",ui-sans-serif,system-ui,-apple-system,"Segoe UI",sans-serif;color:var(--text);background:var(--page)}
+*{box-sizing:border-box}body{margin:0;min-height:100vh}
+header{position:relative;background:#fff;border-bottom:1px solid var(--line);padding:16px clamp(16px,4vw,32px);font-weight:600}
+header small{display:block;font-weight:400;color:var(--muted);font-size:13px}
+.bar{position:absolute;left:0;right:0;bottom:-1px;height:4px;background:#f2f1ec}.bar span{display:block;height:100%;width:5%;background:var(--ink);transition:width .3s ease-in-out}
+main{max-width:560px;margin:0 auto;padding:32px 16px 48px}
+ol{list-style:none;display:flex;margin:0 0 28px;padding:0}
+ol li{flex:1;display:flex;flex-direction:column;align-items:center;gap:6px;position:relative;font-size:13px;color:var(--faint)}
+ol li+li::before{content:"";position:absolute;top:15px;right:calc(50% + 20px);width:calc(100% - 40px);height:2px;background:var(--line)}
+ol li.done+li::before{background:var(--ok-text)}
+ol .dot{width:32px;height:32px;border-radius:50%;display:grid;place-items:center;font-weight:600;background:var(--line);color:var(--faint);border:2px solid var(--line)}
+ol .dot svg{width:16px;height:16px;stroke:#fff;stroke-width:3}
+ol li.active{color:var(--accent);font-weight:600}ol li.active .dot{background:var(--brand);border-color:var(--brand);color:#fff}
+ol li.done{color:var(--muted)}ol li.done .dot{background:var(--ok);border-color:var(--ok)}
+ol li.failed .dot{background:var(--err);border-color:var(--err);color:#fff}
+.card{background:var(--card);border-radius:16px;box-shadow:0 1px 2px rgba(16,18,24,.05);border:1px solid rgba(25,27,33,.08);padding:clamp(24px,5vw,40px);text-align:center}
+.avatar{width:64px;height:64px;margin:0 auto 16px;border-radius:50%;display:grid;place-items:center;background:var(--tint)}
+.avatar svg,.button svg{width:28px;height:28px;fill:none;stroke:var(--accent);stroke-width:1.8;stroke-linecap:round;stroke-linejoin:round}
+.avatar.ok{background:var(--ok-bg)}.avatar.ok svg{stroke:var(--ok-text);stroke-width:2.4}.avatar.err{background:var(--err-bg)}.avatar.err svg{stroke:var(--err)}
+h1{font-size:22px;line-height:1.3;margin:0 0 8px;outline:none}
+.lead{color:var(--muted);margin:0 auto 24px;max-width:42ch}
+.facts{list-style:none;padding:0;margin:0 0 28px;text-align:left;display:grid;gap:10px}
+.facts li{display:flex;gap:10px;align-items:flex-start}.facts li::before{content:"";flex:none;width:6px;height:6px;margin-top:9px;border-radius:50%;background:var(--brand)}
+.button{font:inherit;font-weight:600;display:inline-flex;align-items:center;justify-content:center;gap:8px;width:100%;min-height:44px;padding:10px 16px;border-radius:9px;border:0;background:var(--ink);color:#fff;cursor:pointer;text-decoration:none}
+.button:hover{background:var(--ink-hover);box-shadow:0 6px 18px -6px rgb(24 32 37/.5)}.button svg{width:18px;height:18px;stroke:currentColor}
+.button.secondary{background:#fff;color:var(--text);border:1px solid var(--border)}.button.secondary:hover{box-shadow:0 1px 3px rgba(47,43,67,.12)}
+.button:disabled{opacity:.5;cursor:progress;box-shadow:none}
+.button:focus-visible,input:focus-visible,a:focus-visible{outline:3px solid var(--brand);outline-offset:3px}
+.link{display:inline-flex;align-items:center;gap:6px;color:var(--accent);font-weight:600;text-decoration:none}.link svg{width:16px;height:16px;fill:none;stroke:currentColor;stroke-width:2}
+form{text-align:left;display:grid;gap:16px}label{font-weight:600}
+input[type=password],input[type=email]{display:block;width:100%;font:inherit;padding:11px 12px;margin-top:6px;border:1px solid var(--border);border-radius:9px;background:#fff}
+.hint{font-size:13px;color:var(--muted);margin:6px 0 0;font-weight:400}
+.account{display:flex;align-items:center;gap:12px;padding:14px 16px;border-radius:12px;background:var(--page);border:1px solid rgba(25,27,33,.08);font-weight:600;overflow-wrap:anywhere}
+.account svg{flex:none;width:22px;height:22px;fill:none;stroke:var(--ok-text);stroke-width:2.4}
+.consent{display:flex;gap:10px;align-items:flex-start;font-weight:400}.consent input{width:18px;height:18px;margin:2px 0 0;accent-color:var(--ink)}
+.notice{border-radius:12px;padding:12px 16px;margin:0 0 20px;text-align:left;background:var(--ok-bg);color:var(--ok-text)}
+.notice.err{background:var(--err-bg);color:var(--err-text)}
+.aside{margin-top:24px;padding-top:20px;border-top:1px solid var(--line);text-align:left;color:var(--muted);font-size:14px}
+.aside .button{margin-top:12px}
+footer{max-width:560px;margin:0 auto;padding:0 16px 32px;color:var(--muted);font-size:13px;text-align:center}
+@media (max-width:480px){ol li:not(.active) .label{display:none}}
+[hidden]{display:none!important}
+`;
+var init_enrollment_page = __esm(() => {
+  icons = {
+    mail: '<rect x="3" y="5" width="18" height="14" rx="2"/><path d="m3 7 9 6 9-6"/>',
+    key: '<path d="M15 7.5a3.5 3.5 0 1 1-3.4 4.3L4 19.5V22h3v-2h2v-2h2l1.2-1.2A3.5 3.5 0 0 1 15 7.5Z"/><circle cx="16" cy="11" r="1"/>',
+    code: '<rect x="4" y="6" width="16" height="12" rx="2"/><path d="M8 10h.01M12 10h.01M16 10h.01M8 14h8"/>',
+    person: '<circle cx="12" cy="8" r="4"/><path d="M4 21a8 8 0 0 1 16 0"/>',
+    check: '<path d="m5 12.5 4.5 4.5L19 7.5"/>',
+    alert: '<path d="M12 8v5M12 16.5h.01"/><circle cx="12" cy="12" r="9"/>',
+    open: '<path d="M14 5h5v5M19 5l-8 8M18 14v4a1 1 0 0 1-1 1H6a1 1 0 0 1-1-1V7a1 1 0 0 1 1-1h4"/>'
+  };
+});
 
 // ../../packages/api/src/handlers/enrollment.ts
 import { createHash, randomBytes as randomBytes2 } from "crypto";
@@ -7135,13 +7305,59 @@ class EnrollmentHandlers {
       return await action();
     } catch (error) {
       return error instanceof EnrollmentError ? json({ error: error.message }, error.status) : json({
-        error: "Enrollment could not be saved. Ask the operator to check the seat and issue a new link."
+        error: "Enrollment could not be saved. Ask the operator to check the seat."
       }, 500);
     }
   }
-  issue = (req) => this.guarded(async () => {
+  requireClaudeCode() {
     if (!this.context.providerRegistry.getOAuthProvider("claude-code"))
       throw new EnrollmentError(400, "Provider 'claude-code' is disabled. Set providers.claude-code.enabled to true in your config.");
+  }
+  reserve(name) {
+    if (this.context.dbOps.getAccountByName(name))
+      throw new EnrollmentError(409, "This seat is already in the pool.");
+    for (const entry of this.entries.values())
+      if (entry.details.name === name && entry.state.kind === "busy")
+        throw new EnrollmentError(409, "Sign-in is already in progress");
+    for (const [key, entry] of this.entries)
+      if (entry.details.name === name)
+        this.entries.delete(key);
+    if (this.entries.size >= 100)
+      throw new EnrollmentError(429, "Too many pending invitations");
+  }
+  request(body) {
+    this.requireClaudeCode();
+    if (Object.keys(body).some((key) => key !== "email"))
+      throw new EnrollmentError(400, "Unknown request field");
+    const email = typeof body.email === "string" ? body.email.trim().toLowerCase() : "";
+    if (!this.context.config.getEnrollmentEmails().includes(email))
+      throw new EnrollmentError(403, "This email is not on the list. Ask the operator to add it.");
+    const name = email.slice(0, email.indexOf("@")).replace(/[^a-z0-9._+-]/g, "-").slice(0, 64);
+    this.reserve(name);
+    const issued = this.mint({ name, email, contactEmail: email }, { kind: "invited" }, tenMinutes);
+    return json({ ...issued, email });
+  }
+  emails = (req) => this.guarded(async () => {
+    const body = await readBody(req);
+    const lists = Object.entries(body);
+    if (lists.some(([key, value]) => key !== "add" && key !== "remove" || !Array.isArray(value) || value.some((email) => typeof email !== "string")))
+      throw new EnrollmentError(400, "Expected { add?: string[], remove?: string[] }");
+    const { config } = this.context;
+    const add = body.add ?? [];
+    const remove = new Set((body.remove ?? []).map((email) => email.trim().toLowerCase()));
+    if (add.length === 0 && remove.size === 0)
+      return json({ emails: config.getEnrollmentEmails() });
+    const next = [...config.getEnrollmentEmails(), ...add].filter((email) => !remove.has(email.trim().toLowerCase()));
+    try {
+      return json({ emails: config.setEnrollmentEmails(next) });
+    } catch (error) {
+      if (error instanceof ValidationError)
+        throw new EnrollmentError(400, error.message);
+      throw error;
+    }
+  });
+  issue = (req) => this.guarded(async () => {
+    this.requireClaudeCode();
     const input = await readBody(req);
     const allowed = new Set(["name", "email", "contactEmail", "slackUserId"]);
     if (Object.keys(input).some((key) => !allowed.has(key)))
@@ -7164,16 +7380,7 @@ class EnrollmentHandlers {
     }
     if (details.name.length > 80 || details.slackUserId && !/^U[A-Z0-9]{8,20}$/.test(details.slackUserId) || [details.email, details.contactEmail].some((email) => email && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)))
       throw new EnrollmentError(400, "Invalid invitation details");
-    if (this.context.dbOps.getAccountByName(details.name))
-      throw new EnrollmentError(409, "Seat already exists");
-    for (const entry of this.entries.values())
-      if (entry.details.name === details.name && entry.state.kind === "busy")
-        throw new EnrollmentError(409, "Sign-in is already in progress");
-    for (const [key, entry] of this.entries)
-      if (entry.details.name === details.name)
-        this.entries.delete(key);
-    if (this.entries.size >= 100)
-      throw new EnrollmentError(429, "Too many pending invitations");
+    this.reserve(details.name);
     const issued = this.mint(details, { kind: "invited" }, oneDay);
     return json({
       url: `${this.origin.origin}/pool-enroll#${issued.token}`,
@@ -7195,12 +7402,14 @@ class EnrollmentHandlers {
       if (req.headers.get("origin") !== this.origin.origin)
         throw new EnrollmentError(403, "Untrusted enrollment origin");
       const body = await readBody(req);
+      if (url.pathname === "/pool-enroll/request")
+        return this.request(body);
       const token = typeof body.token === "string" && /^[A-Za-z0-9_-]{43}$/.test(body.token) ? body.token : "";
       const key = hash(token);
       const entry = this.entries.get(key);
       const expected = url.pathname === "/pool-enroll/start" ? "invited" : url.pathname === "/pool-enroll/verify" ? "started" : url.pathname === "/pool-enroll/confirm" ? "verified" : "connected";
       if (!entry || entry.expiresAt <= this.now() || entry.state.kind !== expected)
-        throw new EnrollmentError(410, "This link has expired or was already used. Ask the operator for a new link.");
+        throw new EnrollmentError(410, "This sign-in has expired or was already used. Start again.");
       const state = entry.state;
       entry.state = { kind: "busy" };
       try {
@@ -7219,12 +7428,12 @@ class EnrollmentHandlers {
           try {
             seat = await this.oauth.verifyClaudeSeat(state.flow, body.code.trim());
           } catch {
-            throw new EnrollmentError(400, "Claude sign-in could not be verified. Ask for a new link and try again.");
+            throw new EnrollmentError(400, "Claude sign-in could not be verified. Start again.");
           }
           this.assertCurrent(key, entry);
           const { email } = seat.identity;
           if (!email || entry.details.email && email.toLowerCase() !== entry.details.email.toLowerCase())
-            throw new EnrollmentError(400, "This Claude account does not match the invitation. Ask for a new link.");
+            throw new EnrollmentError(400, "This Claude account does not match your email. Start again and sign in with the matching account.");
           this.assertNewSeat(entry.details.name, seat);
           return json({
             ...this.mint(entry.details, { kind: "verified", seat }, tenMinutes),
@@ -7267,7 +7476,7 @@ class EnrollmentHandlers {
   }
   assertCurrent(key, entry) {
     if (this.entries.get(key) !== entry || entry.expiresAt <= this.now())
-      throw new EnrollmentError(410, "Sign-in expired. Ask for a new link.");
+      throw new EnrollmentError(410, "Sign-in expired. Start again.");
   }
   assertNewSeat(name, seat) {
     if (this.context.dbOps.getAccountByName(name) || this.context.dbOps.getAccountsByProvider("claude-code").some((account2) => account2.account_uuid === seat.identity.accountUuid))
@@ -7347,11 +7556,13 @@ async function readBody(req) {
 }
 var paths, tenMinutes = 600000, oneDay = 86400000, headers2, json = (value, status = 200) => Response.json(value, { status, headers: headers2 }), hash = (token) => createHash("sha256").update(token).digest("hex"), EnrollmentError;
 var init_enrollment = __esm(() => {
+  init_src2();
   init_src8();
   init_src();
   init_enrollment_page();
   paths = new Set([
     "/pool-enroll",
+    "/pool-enroll/request",
     "/pool-enroll/start",
     "/pool-enroll/verify",
     "/pool-enroll/confirm",
@@ -7768,8 +7979,10 @@ class APIRouter {
     this.registerHandlers();
   }
   registerHandlers() {
-    if (this.enrollment)
+    if (this.enrollment) {
       this.staticHandlers.set("POST:/api/enrollment-invitations", this.enrollment.issue);
+      this.staticHandlers.set("POST:/api/enrollment-emails", this.enrollment.emails);
+    }
     const { config, dbOps, getProviders, getRuntimeHealth, providerRegistry } = this.context;
     const healthHandler = createHealthHandler(dbOps, config, getProviders, getRuntimeHealth);
     const statsHandler = createStatsHandler(dbOps);

package/dist/post-processor.worker.js

@@ -1327,12 +1327,30 @@ function parseNumber(value) {
   const parsed = Number(value);
   return Number.isFinite(parsed) ? parsed : undefined;
 }
+function normalizeEnrollmentEmail(value) {
+  if (typeof value !== "string")
+    return;
+  const email = value.trim().toLowerCase();
+  return email.length <= 254 && patterns.email.test(email) ? email : undefined;
+}
+function sanitizeEnrollmentEmails(value) {
+  if (!Array.isArray(value))
+    return;
+  const emails = value.map(normalizeEnrollmentEmail).filter((email) => email !== undefined);
+  return [...new Set(emails)].slice(0, MAX_ENROLLMENT_EMAILS);
+}
 function sanitizeConfigData(value) {
   if (!isRecord(value)) {
     return {};
   }
   const sanitized = {};
   for (const [key, entry] of Object.entries(value)) {
+    if (key === "enrollment_emails") {
+      const emails = sanitizeEnrollmentEmails(entry);
+      if (emails)
+        sanitized.enrollment_emails = emails;
+      continue;
+    }
     if (key === "team_routing") {
       const teamRouting = sanitizeTeamRouting(entry);
       if (teamRouting)
@@ -1482,7 +1500,7 @@ function sanitizeTeamRouting(value) {
   }
   return result;
 }
-var log2, PROVIDER_STRATEGIES, BUILTIN_PROVIDER_CONFIGS, BUILTIN_PROVIDER_CONFIG_BY_NAME, PROVIDER_NAME_PATTERN, TEAM_ROUTING_DEFAULTS, Config;
+var log2, PROVIDER_STRATEGIES, BUILTIN_PROVIDER_CONFIGS, BUILTIN_PROVIDER_CONFIG_BY_NAME, PROVIDER_NAME_PATTERN, TEAM_ROUTING_DEFAULTS, MAX_ENROLLMENT_EMAILS = 200, Config;
 var init_src4 = __esm(() => {
   init_src2();
   init_src3();
@@ -1726,11 +1744,28 @@ var init_src4 = __esm(() => {
       this.persistAccountAllowlist(current.filter((uuid) => uuid !== accountUuid));
     }
     persistAccountAllowlist(accountUuids) {
-      const teamRouting = {
+      this.persistStrictly("team_routing", {
         ...this.data.team_routing,
         allowlisted_account_uuids: accountUuids
-      };
-      const next = { ...this.data, team_routing: teamRouting };
+      });
+    }
+    getEnrollmentEmails() {
+      return [...this.data.enrollment_emails ?? []];
+    }
+    setEnrollmentEmails(emails) {
+      const normalized = emails.map(normalizeEnrollmentEmail);
+      if (normalized.some((email) => email === undefined)) {
+        throw new ValidationError("Invalid enrollment email", "enrollment_emails");
+      }
+      const unique = [...new Set(normalized)];
+      if (unique.length > MAX_ENROLLMENT_EMAILS) {
+        throw new ValidationError(`At most ${MAX_ENROLLMENT_EMAILS} enrollment emails`, "enrollment_emails");
+      }
+      this.persistStrictly("enrollment_emails", unique);
+      return [...unique];
+    }
+    persistStrictly(key, value) {
+      const next = { ...this.data, [key]: value };
       const temporary = `${this.configPath}.${crypto.randomUUID()}.tmp`;
       try {
         writeFileSync(temporary, JSON.stringify(next, null, 2), {
@@ -1741,13 +1776,9 @@ var init_src4 = __esm(() => {
       } finally {
         rmSync(temporary, { force: true });
       }
-      const oldValue = this.data.team_routing;
+      const oldValue = this.data[key];
       this.data = next;
-      this.emit("change", {
-        key: "team_routing",
-        oldValue,
-        newValue: teamRouting
-      });
+      this.emit("change", { key, oldValue, newValue: value });
     }
     getRuntime() {
       const defaults = {

package/dist/server.js

@@ -3831,12 +3831,30 @@ function parseNumber(value) {
   const parsed = Number(value);
   return Number.isFinite(parsed) ? parsed : undefined;
 }
+function normalizeEnrollmentEmail(value) {
+  if (typeof value !== "string")
+    return;
+  const email = value.trim().toLowerCase();
+  return email.length <= 254 && patterns.email.test(email) ? email : undefined;
+}
+function sanitizeEnrollmentEmails(value) {
+  if (!Array.isArray(value))
+    return;
+  const emails = value.map(normalizeEnrollmentEmail).filter((email) => email !== undefined);
+  return [...new Set(emails)].slice(0, MAX_ENROLLMENT_EMAILS);
+}
 function sanitizeConfigData(value) {
   if (!isRecord(value)) {
     return {};
   }
   const sanitized = {};
   for (const [key, entry] of Object.entries(value)) {
+    if (key === "enrollment_emails") {
+      const emails = sanitizeEnrollmentEmails(entry);
+      if (emails)
+        sanitized.enrollment_emails = emails;
+      continue;
+    }
     if (key === "team_routing") {
       const teamRouting = sanitizeTeamRouting(entry);
       if (teamRouting)
@@ -3986,7 +4004,7 @@ function sanitizeTeamRouting(value) {
   }
   return result;
 }
-var log6, PROVIDER_STRATEGIES, BUILTIN_PROVIDER_CONFIGS, BUILTIN_PROVIDER_CONFIG_BY_NAME, PROVIDER_NAME_PATTERN, TEAM_ROUTING_DEFAULTS, Config;
+var log6, PROVIDER_STRATEGIES, BUILTIN_PROVIDER_CONFIGS, BUILTIN_PROVIDER_CONFIG_BY_NAME, PROVIDER_NAME_PATTERN, TEAM_ROUTING_DEFAULTS, MAX_ENROLLMENT_EMAILS = 200, Config;
 var init_src7 = __esm(() => {
   init_src2();
   init_src4();
@@ -4230,11 +4248,28 @@ var init_src7 = __esm(() => {
       this.persistAccountAllowlist(current.filter((uuid) => uuid !== accountUuid));
     }
     persistAccountAllowlist(accountUuids) {
-      const teamRouting = {
+      this.persistStrictly("team_routing", {
         ...this.data.team_routing,
         allowlisted_account_uuids: accountUuids
-      };
-      const next = { ...this.data, team_routing: teamRouting };
+      });
+    }
+    getEnrollmentEmails() {
+      return [...this.data.enrollment_emails ?? []];
+    }
+    setEnrollmentEmails(emails) {
+      const normalized = emails.map(normalizeEnrollmentEmail);
+      if (normalized.some((email) => email === undefined)) {
+        throw new ValidationError("Invalid enrollment email", "enrollment_emails");
+      }
+      const unique = [...new Set(normalized)];
+      if (unique.length > MAX_ENROLLMENT_EMAILS) {
+        throw new ValidationError(`At most ${MAX_ENROLLMENT_EMAILS} enrollment emails`, "enrollment_emails");
+      }
+      this.persistStrictly("enrollment_emails", unique);
+      return [...unique];
+    }
+    persistStrictly(key, value) {
+      const next = { ...this.data, [key]: value };
       const temporary = `${this.configPath}.${crypto.randomUUID()}.tmp`;
       try {
         writeFileSync(temporary, JSON.stringify(next, null, 2), {
@@ -4245,13 +4280,9 @@ var init_src7 = __esm(() => {
       } finally {
         rmSync(temporary, { force: true });
       }
-      const oldValue = this.data.team_routing;
+      const oldValue = this.data[key];
       this.data = next;
-      this.emit("change", {
-        key: "team_routing",
-        oldValue,
-        newValue: teamRouting
-      });
+      this.emit("change", { key, oldValue, newValue: value });
     }
     getRuntime() {
       const defaults = {
@@ -7013,72 +7044,157 @@ function enrollmentPage() {
   return new Response(`<!doctype html>
 <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
 <title>Connect a Claude subscription</title>
-<style nonce="${nonce}">
-:root{color-scheme:light;font-family:"Avenir Next",Avenir,"Segoe UI",sans-serif;color:#17334a;background:#edf3f7;line-height:1.6}
-body{margin:0;padding:clamp(20px,6vw,64px)}main{max-width:42rem;margin:auto;background:#fff;padding:clamp(24px,5vw,48px);border-top:6px solid #235e82}
-h1{font-size:clamp(1.8rem,5vw,2.5rem);line-height:1.2;margin:0 0 24px}h2{font-size:1.2rem;margin-top:32px}p{max-width:65ch}button,a.button{font:inherit;display:inline-block;border:0;border-radius:6px;background:#235e82;color:#fff;padding:12px 20px;text-decoration:none;cursor:pointer}button:disabled{opacity:.55;cursor:wait}button:focus-visible,a:focus-visible,input:focus-visible{outline:3px solid #b15c00;outline-offset:4px}input[type=password]{box-sizing:border-box;display:block;width:100%;font:inherit;padding:12px;border:1px solid #647686;border-radius:4px;margin:8px 0 16px}label{display:block}#account{font-weight:600;overflow-wrap:anywhere}#status{white-space:pre-line}small{display:block;margin-top:32px;color:#4b6172}[hidden]{display:none!important}
-</style></head><body><main>
-<h1>Connect your Claude subscription</h1>
-<p>This adds your subscription to the shared agents pool. Only connect an account you have permission to share. Your password stays with Claude; the pool stores the authorization needed to run agents.</p>
-<section id="begin"><h2>1. Sign in with Claude</h2><p>You will open Claude in a separate tab. Choose the account you want to share.</p><button id="start" type="button">Connect Claude</button><p><a id="authorize" class="button" target="_blank" rel="noopener noreferrer" hidden>Open Claude sign-in</a></p></section>
-<form id="verify" hidden><h2>2. Check your account</h2><label for="code">Paste the authorization code from Claude</label><input id="code" type="password" autocomplete="off" spellcheck="false" required maxlength="4096"><button type="submit">Check account</button></form>
-<form id="confirm" hidden><h2>3. Add this subscription</h2><p>Claude verified this account:</p><p id="account"></p><label><input id="consent" type="checkbox" required> I authorize the shared agents pool to use this subscription.</label><p><button type="submit">Add subscription to pool</button></p><p>Wrong account? Do not confirm. Close this page and ask the operator for a new link.</p></form>
-<section id="connected" hidden><h2>Subscription connected</h2><p id="connected-account"></p><p>Testing this flow? Disconnect removes this seat's saved credentials and pool membership before letting you sign in again.</p><button id="disconnect" type="button">Disconnect and try again</button><p>Keep this page open to disconnect. This button expires after 24 hours; a page reload or server restart requires operator help. It does not sign you out of Claude's website, cancel your subscription, or stop a request already running.</p></section>
-<p id="status" role="status" aria-live="polite"></p>
-<small>This private link works once. After starting, each step expires in 10 minutes. Do not share this link or paste authorization codes into chat. Reloading this page requires a new invitation.</small>
-<noscript>JavaScript is required for this private sign-in flow.</noscript>
-</main><script nonce="${nonce}">
+<style nonce="${nonce}">${styles}</style></head><body>
+<header>Shared agents pool<small>Connect a Claude subscription</small><div class="bar"><span id="progress"></span></div></header>
+<main>
+<ol id="stepper" aria-label="Progress">
+<li data-step="email"><span class="dot">1</span><span class="label">Email</span></li>
+<li data-step="signin"><span class="dot">2</span><span class="label">Sign in</span></li>
+<li data-step="code"><span class="dot">3</span><span class="label">Paste code</span></li>
+<li data-step="confirm"><span class="dot">4</span><span class="label">Confirm</span></li>
+<li data-step="done"><span class="dot">5</span><span class="label">Done</span></li>
+</ol>
+<section class="card" id="step-email" hidden>
+<div class="avatar">${icon("mail")}</div>
+<h1 tabindex="-1">Connect your Claude subscription</h1>
+<p class="lead">This adds your subscription to the shared agents pool. Start with your work email: if it is on this pool's list, the next step lets you sign in with Claude.</p>
+<form id="request">
+<p class="notice err" id="email-error" role="alert" hidden></p>
+<label for="email">Work email<input id="email" type="email" autocomplete="email" spellcheck="false" required maxlength="254"></label>
+<button class="button" type="submit">Continue</button>
+</form>
+</section>
+<section class="card" id="step-signin" hidden>
+<p class="notice" id="signin-notice" role="status" hidden></p>
+<div class="avatar">${icon("key")}</div>
+<h1 tabindex="-1">Sign in with Claude</h1>
+<p class="lead" id="signin-for" hidden>Use the Claude account of <strong id="signin-email"></strong>. Only connect an account you have permission to share.</p>
+<ul class="facts">
+<li>Claude opens in a new tab. Sign in and pick the account to share.</li>
+<li>Your password stays with Claude. The pool only keeps the authorization it needs to run agents.</li>
+<li>Claude then shows a code: you paste it here in the next step.</li>
+</ul>
+<button class="button" id="start" type="button">Continue to Claude ${icon("open")}</button>
+</section>
+<section class="card" id="step-code" hidden>
+<div class="avatar">${icon("code")}</div>
+<h1 tabindex="-1">Paste the code from Claude</h1>
+<p class="lead" id="code-lead">Claude opened in a new tab. Once you have signed in, it shows an authorization code: copy it and paste it below.</p>
+<form id="verify">
+<label for="code">Authorization code<input id="code" type="password" autocomplete="off" spellcheck="false" required maxlength="4096"><span class="hint">The code stays hidden on screen. Never paste it into chat.</span></label>
+<button class="button" type="submit">Verify account</button>
+</form>
+<p class="aside">Closed the Claude tab? <a class="link" id="reopen" target="_blank" rel="noopener noreferrer">Open Claude sign-in again ${icon("open")}</a></p>
+</section>
+<section class="card" id="step-confirm" hidden>
+<div class="avatar">${icon("person")}</div>
+<h1 tabindex="-1">Is this the right account?</h1>
+<p class="lead">Claude verified the account below. Check it before adding it to the pool.</p>
+<form id="confirm">
+<div class="account">${icon("check")}<span id="account"></span></div>
+<label class="consent"><input id="consent" type="checkbox" required><span>I authorize the shared agents pool to use this subscription.</span></label>
+<button class="button" type="submit">Add to the pool</button>
+</form>
+<p class="aside">Wrong account? Do not confirm: start again and sign in with the right one.<a class="button secondary" href="/pool-enroll">Start again</a></p>
+</section>
+<section class="card" id="step-done" hidden>
+<div class="avatar ok">${icon("check")}</div>
+<h1 tabindex="-1">Subscription connected</h1>
+<p class="lead"><strong id="connected-account"></strong> is now part of the shared agents pool. You can close this page.</p>
+<div class="aside"><strong>Only testing?</strong> Disconnect removes this account's saved authorization and pool membership, then lets you sign in again. It stays available for 24 hours while this page is open; it does not sign you out of Claude or cancel your subscription.<button class="button secondary" id="disconnect" type="button">Disconnect and try again</button></div>
+</section>
+<section class="card" id="step-error" hidden>
+<div class="avatar err">${icon("alert")}</div>
+<h1 tabindex="-1">This sign-in can't continue</h1>
+<p class="lead" id="error-message"></p>
+<p class="aside">Nothing was added to the pool from this step.<a class="button secondary" href="/pool-enroll">Start again</a></p>
+</section>
+<p id="status" class="notice err" role="alert" hidden></p>
+</main>
+<footer>Each step expires after 10 minutes. Nothing is added to the pool until you confirm.</footer>
+<noscript><p class="notice err">JavaScript is required for this sign-in.</p></noscript>
+<script nonce="${nonce}">
 let token = location.hash.slice(1);
 history.replaceState(null, '', location.pathname);
 addEventListener('hashchange', () => { if (location.hash) location.reload(); });
 const get = id => document.getElementById(id);
-const status = get('status');
-async function post(step, values) {
-  const response = await fetch('/pool-enroll/' + step, {method:'POST', credentials:'omit', cache:'no-store', redirect:'error', headers:{'content-type':'application/json'}, body:JSON.stringify({token, ...values})});
+const steps = ['email', 'signin', 'code', 'confirm', 'done'];
+let current = 'email';
+function show(step) {
+  const failed = step === 'error';
+  const index = steps.indexOf(failed ? current : step);
+  if (!failed) current = step;
+  for (const name of [...steps, 'error']) get('step-' + name).hidden = name !== step;
+  document.querySelectorAll('#stepper li').forEach((item, position) => {
+    item.className = position < index || step === 'done' ? 'done' : position === index ? (failed ? 'failed' : 'active') : '';
+    item.querySelector('.dot').innerHTML = item.className === 'done' ? '${icon("check")}' : String(position + 1);
+    if (position === index) item.setAttribute('aria-current', 'step'); else item.removeAttribute('aria-current');
+  });
+  get('progress').style.width = Math.max(5, ((index + (step === 'done' ? 1 : 0)) / steps.length) * 100) + '%';
+  (step === 'email' ? get('email') : get('step-' + step).querySelector('h1')).focus();
+}
+async function send(step, body) {
+  const response = await fetch('/pool-enroll/' + step, {method:'POST', credentials:'omit', cache:'no-store', redirect:'error', headers:{'content-type':'application/json'}, body:JSON.stringify(body)});
   const data = await response.json();
-  if (!response.ok) throw new Error(data.error || 'Sign-in failed. Ask the operator for a new link.');
+  if (!response.ok) throw new Error(data.error || 'Sign-in failed. Start again.');
   token = data.token || '';
   return data;
 }
+const post = (step, values) => send(step, {token, ...values});
 function fail(error) {
-  token = ''; get('code').value = ''; get('begin').hidden = true; get('verify').hidden = true; get('confirm').hidden = true;
-  status.textContent = error instanceof Error ? error.message : 'Sign-in failed. Ask for a new link.';
+  token = ''; get('code').value = '';
+  get('error-message').textContent = error instanceof Error ? error.message : 'Sign-in failed. Start again.';
+  show('error');
 }
-if (!/^[A-Za-z0-9_-]{43}$/.test(token)) fail(new Error('Open the private invitation link supplied by your pool operator.'));
+show(/^[A-Za-z0-9_-]{43}$/.test(token) ? 'signin' : 'email');
+get('request').addEventListener('submit', async event => {
+  event.preventDefault(); event.submitter.disabled = true; get('email-error').hidden = true;
+  try {
+    const data = await send('request', {email: get('email').value});
+    get('signin-email').textContent = data.email; get('signin-for').hidden = false;
+    show('signin');
+  } catch (error) {
+    get('email-error').textContent = error instanceof Error ? error.message : 'This email cannot connect. Ask the operator.';
+    get('email-error').hidden = false; get('email').focus();
+  } finally { event.submitter.disabled = false; }
+});
 get('start').addEventListener('click', async () => {
+  const tab = window.open('', '_blank');
   get('start').disabled = true;
   try {
     const data = await post('start', {});
     const url = new URL(data.authUrl);
-    if (url.origin !== 'https://claude.ai' || url.pathname !== '/oauth/authorize') throw new Error('Invalid sign-in destination. Ask the operator for help.');
-    get('authorize').href = url.href; get('authorize').hidden = false; get('start').hidden = true;
-    get('verify').hidden = false; status.textContent = 'Open Claude sign-in above, then return here with the code.';
-  } catch(error) { fail(error); }
+    if (url.origin !== 'https://claude.ai' || url.pathname !== '/oauth/authorize') throw new Error('Invalid sign-in destination. Ask for help.');
+    get('reopen').href = url.href;
+    if (tab) { tab.opener = null; tab.location.href = url.href; }
+    else get('code-lead').textContent = 'Your browser blocked the new tab. Open Claude sign-in with the link below, sign in, then paste the code it shows.';
+    show('code');
+  } catch (error) { if (tab) tab.close(); fail(error); }
 });
 get('verify').addEventListener('submit', async event => {
-  event.preventDefault(); const button = event.submitter; button.disabled = true;
+  event.preventDefault(); event.submitter.disabled = true;
   const code = get('code').value.trim(); get('code').value = '';
-  try { const data = await post('verify', {code}); get('begin').hidden = true; get('verify').hidden = true; get('account').textContent = data.email; get('confirm').hidden = false; status.textContent = 'Check the account above before confirming.'; }
-  catch(error) { fail(error); }
+  try { const data = await post('verify', {code}); get('account').textContent = data.email; show('confirm'); }
+  catch (error) { fail(error); }
 });
 get('confirm').addEventListener('submit', async event => {
   event.preventDefault(); if (!get('consent').checked) return; event.submitter.disabled = true;
-  try { await post('confirm', {consent:true}); get('confirm').hidden = true; get('connected-account').textContent = get('account').textContent; get('connected').hidden = false; status.textContent = 'Subscription connected. If you are testing, disconnect before closing this page.'; }
-  catch(error) { fail(error); }
+  try { await post('confirm', {consent:true}); get('connected-account').textContent = get('account').textContent; show('done'); }
+  catch (error) { fail(error); }
 });
 get('disconnect').addEventListener('click', async () => {
-  get('disconnect').disabled = true;
+  get('disconnect').disabled = true; get('status').hidden = true;
   try {
     await post('disconnect', {});
-    get('connected').hidden = true; get('connected-account').textContent = ''; get('account').textContent = '';
-    get('consent').checked = false; get('code').value = '';
-    get('authorize').removeAttribute('href'); get('authorize').hidden = true;
+    get('account').textContent = ''; get('connected-account').textContent = ''; get('consent').checked = false;
     document.querySelectorAll('button').forEach(button => { button.disabled = false; });
-    get('start').hidden = false; get('begin').hidden = false;
-    status.textContent = 'Subscription disconnected. It is no longer in the pool. You can close this page or connect again.';
-  } catch(error) {
+    get('signin-notice').textContent = 'Subscription disconnected: it is no longer in the pool. You can connect again or close this page.';
+    get('signin-notice').hidden = false;
+    show('signin');
+  } catch (error) {
     get('disconnect').disabled = false;
-    status.textContent = 'Removal is not confirmed. ' + (error instanceof Error ? error.message : 'Keep this page open and ask the operator to check this seat.');
+    get('status').textContent = 'Removal is not confirmed. ' + (error instanceof Error ? error.message : 'Keep this page open and ask for help with this seat.');
+    get('status').hidden = false;
   }
 });
 </script></body></html>`, {
@@ -7092,7 +7208,61 @@ get('disconnect').addEventListener('click', async () => {
     }
   });
 }
-var init_enrollment_page = () => {};
+var icons, icon = (name) => `<svg viewBox="0 0 24 24" aria-hidden="true">${icons[name]}</svg>`, styles = `
+:root{--page:#faf9f6;--card:#fff;--text:#191b21;--muted:#5a606b;--faint:#9aa0ab;--line:#e6e8ec;--border:rgba(25,27,33,.14);--brand:#fb5d22;--accent:#dc5518;--tint:#fff3ec;--ink:#182025;--ink-hover:#2a333b;--ok:#17a06b;--ok-bg:#e3f6ed;--ok-text:#0c6444;--err:#d92d20;--err-bg:#fef3f2;--err-text:#912018;color-scheme:light;font:15px/1.55 "Public Sans",ui-sans-serif,system-ui,-apple-system,"Segoe UI",sans-serif;color:var(--text);background:var(--page)}
+*{box-sizing:border-box}body{margin:0;min-height:100vh}
+header{position:relative;background:#fff;border-bottom:1px solid var(--line);padding:16px clamp(16px,4vw,32px);font-weight:600}
+header small{display:block;font-weight:400;color:var(--muted);font-size:13px}
+.bar{position:absolute;left:0;right:0;bottom:-1px;height:4px;background:#f2f1ec}.bar span{display:block;height:100%;width:5%;background:var(--ink);transition:width .3s ease-in-out}
+main{max-width:560px;margin:0 auto;padding:32px 16px 48px}
+ol{list-style:none;display:flex;margin:0 0 28px;padding:0}
+ol li{flex:1;display:flex;flex-direction:column;align-items:center;gap:6px;position:relative;font-size:13px;color:var(--faint)}
+ol li+li::before{content:"";position:absolute;top:15px;right:calc(50% + 20px);width:calc(100% - 40px);height:2px;background:var(--line)}
+ol li.done+li::before{background:var(--ok-text)}
+ol .dot{width:32px;height:32px;border-radius:50%;display:grid;place-items:center;font-weight:600;background:var(--line);color:var(--faint);border:2px solid var(--line)}
+ol .dot svg{width:16px;height:16px;stroke:#fff;stroke-width:3}
+ol li.active{color:var(--accent);font-weight:600}ol li.active .dot{background:var(--brand);border-color:var(--brand);color:#fff}
+ol li.done{color:var(--muted)}ol li.done .dot{background:var(--ok);border-color:var(--ok)}
+ol li.failed .dot{background:var(--err);border-color:var(--err);color:#fff}
+.card{background:var(--card);border-radius:16px;box-shadow:0 1px 2px rgba(16,18,24,.05);border:1px solid rgba(25,27,33,.08);padding:clamp(24px,5vw,40px);text-align:center}
+.avatar{width:64px;height:64px;margin:0 auto 16px;border-radius:50%;display:grid;place-items:center;background:var(--tint)}
+.avatar svg,.button svg{width:28px;height:28px;fill:none;stroke:var(--accent);stroke-width:1.8;stroke-linecap:round;stroke-linejoin:round}
+.avatar.ok{background:var(--ok-bg)}.avatar.ok svg{stroke:var(--ok-text);stroke-width:2.4}.avatar.err{background:var(--err-bg)}.avatar.err svg{stroke:var(--err)}
+h1{font-size:22px;line-height:1.3;margin:0 0 8px;outline:none}
+.lead{color:var(--muted);margin:0 auto 24px;max-width:42ch}
+.facts{list-style:none;padding:0;margin:0 0 28px;text-align:left;display:grid;gap:10px}
+.facts li{display:flex;gap:10px;align-items:flex-start}.facts li::before{content:"";flex:none;width:6px;height:6px;margin-top:9px;border-radius:50%;background:var(--brand)}
+.button{font:inherit;font-weight:600;display:inline-flex;align-items:center;justify-content:center;gap:8px;width:100%;min-height:44px;padding:10px 16px;border-radius:9px;border:0;background:var(--ink);color:#fff;cursor:pointer;text-decoration:none}
+.button:hover{background:var(--ink-hover);box-shadow:0 6px 18px -6px rgb(24 32 37/.5)}.button svg{width:18px;height:18px;stroke:currentColor}
+.button.secondary{background:#fff;color:var(--text);border:1px solid var(--border)}.button.secondary:hover{box-shadow:0 1px 3px rgba(47,43,67,.12)}
+.button:disabled{opacity:.5;cursor:progress;box-shadow:none}
+.button:focus-visible,input:focus-visible,a:focus-visible{outline:3px solid var(--brand);outline-offset:3px}
+.link{display:inline-flex;align-items:center;gap:6px;color:var(--accent);font-weight:600;text-decoration:none}.link svg{width:16px;height:16px;fill:none;stroke:currentColor;stroke-width:2}
+form{text-align:left;display:grid;gap:16px}label{font-weight:600}
+input[type=password],input[type=email]{display:block;width:100%;font:inherit;padding:11px 12px;margin-top:6px;border:1px solid var(--border);border-radius:9px;background:#fff}
+.hint{font-size:13px;color:var(--muted);margin:6px 0 0;font-weight:400}
+.account{display:flex;align-items:center;gap:12px;padding:14px 16px;border-radius:12px;background:var(--page);border:1px solid rgba(25,27,33,.08);font-weight:600;overflow-wrap:anywhere}
+.account svg{flex:none;width:22px;height:22px;fill:none;stroke:var(--ok-text);stroke-width:2.4}
+.consent{display:flex;gap:10px;align-items:flex-start;font-weight:400}.consent input{width:18px;height:18px;margin:2px 0 0;accent-color:var(--ink)}
+.notice{border-radius:12px;padding:12px 16px;margin:0 0 20px;text-align:left;background:var(--ok-bg);color:var(--ok-text)}
+.notice.err{background:var(--err-bg);color:var(--err-text)}
+.aside{margin-top:24px;padding-top:20px;border-top:1px solid var(--line);text-align:left;color:var(--muted);font-size:14px}
+.aside .button{margin-top:12px}
+footer{max-width:560px;margin:0 auto;padding:0 16px 32px;color:var(--muted);font-size:13px;text-align:center}
+@media (max-width:480px){ol li:not(.active) .label{display:none}}
+[hidden]{display:none!important}
+`;
+var init_enrollment_page = __esm(() => {
+  icons = {
+    mail: '<rect x="3" y="5" width="18" height="14" rx="2"/><path d="m3 7 9 6 9-6"/>',
+    key: '<path d="M15 7.5a3.5 3.5 0 1 1-3.4 4.3L4 19.5V22h3v-2h2v-2h2l1.2-1.2A3.5 3.5 0 0 1 15 7.5Z"/><circle cx="16" cy="11" r="1"/>',
+    code: '<rect x="4" y="6" width="16" height="12" rx="2"/><path d="M8 10h.01M12 10h.01M16 10h.01M8 14h8"/>',
+    person: '<circle cx="12" cy="8" r="4"/><path d="M4 21a8 8 0 0 1 16 0"/>',
+    check: '<path d="m5 12.5 4.5 4.5L19 7.5"/>',
+    alert: '<path d="M12 8v5M12 16.5h.01"/><circle cx="12" cy="12" r="9"/>',
+    open: '<path d="M14 5h5v5M19 5l-8 8M18 14v4a1 1 0 0 1-1 1H6a1 1 0 0 1-1-1V7a1 1 0 0 1 1-1h4"/>'
+  };
+});
 
 // ../../packages/api/src/handlers/enrollment.ts
 import { createHash, randomBytes as randomBytes2 } from "crypto";
@@ -7134,13 +7304,59 @@ class EnrollmentHandlers {
       return await action();
     } catch (error) {
       return error instanceof EnrollmentError ? json({ error: error.message }, error.status) : json({
-        error: "Enrollment could not be saved. Ask the operator to check the seat and issue a new link."
+        error: "Enrollment could not be saved. Ask the operator to check the seat."
       }, 500);
     }
   }
-  issue = (req) => this.guarded(async () => {
+  requireClaudeCode() {
     if (!this.context.providerRegistry.getOAuthProvider("claude-code"))
       throw new EnrollmentError(400, "Provider 'claude-code' is disabled. Set providers.claude-code.enabled to true in your config.");
+  }
+  reserve(name) {
+    if (this.context.dbOps.getAccountByName(name))
+      throw new EnrollmentError(409, "This seat is already in the pool.");
+    for (const entry of this.entries.values())
+      if (entry.details.name === name && entry.state.kind === "busy")
+        throw new EnrollmentError(409, "Sign-in is already in progress");
+    for (const [key, entry] of this.entries)
+      if (entry.details.name === name)
+        this.entries.delete(key);
+    if (this.entries.size >= 100)
+      throw new EnrollmentError(429, "Too many pending invitations");
+  }
+  request(body) {
+    this.requireClaudeCode();
+    if (Object.keys(body).some((key) => key !== "email"))
+      throw new EnrollmentError(400, "Unknown request field");
+    const email = typeof body.email === "string" ? body.email.trim().toLowerCase() : "";
+    if (!this.context.config.getEnrollmentEmails().includes(email))
+      throw new EnrollmentError(403, "This email is not on the list. Ask the operator to add it.");
+    const name = email.slice(0, email.indexOf("@")).replace(/[^a-z0-9._+-]/g, "-").slice(0, 64);
+    this.reserve(name);
+    const issued = this.mint({ name, email, contactEmail: email }, { kind: "invited" }, tenMinutes);
+    return json({ ...issued, email });
+  }
+  emails = (req) => this.guarded(async () => {
+    const body = await readBody(req);
+    const lists = Object.entries(body);
+    if (lists.some(([key, value]) => key !== "add" && key !== "remove" || !Array.isArray(value) || value.some((email) => typeof email !== "string")))
+      throw new EnrollmentError(400, "Expected { add?: string[], remove?: string[] }");
+    const { config } = this.context;
+    const add = body.add ?? [];
+    const remove = new Set((body.remove ?? []).map((email) => email.trim().toLowerCase()));
+    if (add.length === 0 && remove.size === 0)
+      return json({ emails: config.getEnrollmentEmails() });
+    const next = [...config.getEnrollmentEmails(), ...add].filter((email) => !remove.has(email.trim().toLowerCase()));
+    try {
+      return json({ emails: config.setEnrollmentEmails(next) });
+    } catch (error) {
+      if (error instanceof ValidationError)
+        throw new EnrollmentError(400, error.message);
+      throw error;
+    }
+  });
+  issue = (req) => this.guarded(async () => {
+    this.requireClaudeCode();
     const input = await readBody(req);
     const allowed = new Set(["name", "email", "contactEmail", "slackUserId"]);
     if (Object.keys(input).some((key) => !allowed.has(key)))
@@ -7163,16 +7379,7 @@ class EnrollmentHandlers {
     }
     if (details.name.length > 80 || details.slackUserId && !/^U[A-Z0-9]{8,20}$/.test(details.slackUserId) || [details.email, details.contactEmail].some((email) => email && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)))
       throw new EnrollmentError(400, "Invalid invitation details");
-    if (this.context.dbOps.getAccountByName(details.name))
-      throw new EnrollmentError(409, "Seat already exists");
-    for (const entry of this.entries.values())
-      if (entry.details.name === details.name && entry.state.kind === "busy")
-        throw new EnrollmentError(409, "Sign-in is already in progress");
-    for (const [key, entry] of this.entries)
-      if (entry.details.name === details.name)
-        this.entries.delete(key);
-    if (this.entries.size >= 100)
-      throw new EnrollmentError(429, "Too many pending invitations");
+    this.reserve(details.name);
     const issued = this.mint(details, { kind: "invited" }, oneDay);
     return json({
       url: `${this.origin.origin}/pool-enroll#${issued.token}`,
@@ -7194,12 +7401,14 @@ class EnrollmentHandlers {
       if (req.headers.get("origin") !== this.origin.origin)
         throw new EnrollmentError(403, "Untrusted enrollment origin");
       const body = await readBody(req);
+      if (url.pathname === "/pool-enroll/request")
+        return this.request(body);
       const token = typeof body.token === "string" && /^[A-Za-z0-9_-]{43}$/.test(body.token) ? body.token : "";
       const key = hash(token);
       const entry = this.entries.get(key);
       const expected = url.pathname === "/pool-enroll/start" ? "invited" : url.pathname === "/pool-enroll/verify" ? "started" : url.pathname === "/pool-enroll/confirm" ? "verified" : "connected";
       if (!entry || entry.expiresAt <= this.now() || entry.state.kind !== expected)
-        throw new EnrollmentError(410, "This link has expired or was already used. Ask the operator for a new link.");
+        throw new EnrollmentError(410, "This sign-in has expired or was already used. Start again.");
       const state = entry.state;
       entry.state = { kind: "busy" };
       try {
@@ -7218,12 +7427,12 @@ class EnrollmentHandlers {
           try {
             seat = await this.oauth.verifyClaudeSeat(state.flow, body.code.trim());
           } catch {
-            throw new EnrollmentError(400, "Claude sign-in could not be verified. Ask for a new link and try again.");
+            throw new EnrollmentError(400, "Claude sign-in could not be verified. Start again.");
           }
           this.assertCurrent(key, entry);
           const { email } = seat.identity;
           if (!email || entry.details.email && email.toLowerCase() !== entry.details.email.toLowerCase())
-            throw new EnrollmentError(400, "This Claude account does not match the invitation. Ask for a new link.");
+            throw new EnrollmentError(400, "This Claude account does not match your email. Start again and sign in with the matching account.");
           this.assertNewSeat(entry.details.name, seat);
           return json({
             ...this.mint(entry.details, { kind: "verified", seat }, tenMinutes),
@@ -7266,7 +7475,7 @@ class EnrollmentHandlers {
   }
   assertCurrent(key, entry) {
     if (this.entries.get(key) !== entry || entry.expiresAt <= this.now())
-      throw new EnrollmentError(410, "Sign-in expired. Ask for a new link.");
+      throw new EnrollmentError(410, "Sign-in expired. Start again.");
   }
   assertNewSeat(name, seat) {
     if (this.context.dbOps.getAccountByName(name) || this.context.dbOps.getAccountsByProvider("claude-code").some((account2) => account2.account_uuid === seat.identity.accountUuid))
@@ -7346,11 +7555,13 @@ async function readBody(req) {
 }
 var paths, tenMinutes = 600000, oneDay = 86400000, headers2, json = (value, status = 200) => Response.json(value, { status, headers: headers2 }), hash = (token) => createHash("sha256").update(token).digest("hex"), EnrollmentError;
 var init_enrollment = __esm(() => {
+  init_src2();
   init_src6();
   init_src();
   init_enrollment_page();
   paths = new Set([
     "/pool-enroll",
+    "/pool-enroll/request",
     "/pool-enroll/start",
     "/pool-enroll/verify",
     "/pool-enroll/confirm",
@@ -7767,8 +7978,10 @@ class APIRouter {
     this.registerHandlers();
   }
   registerHandlers() {
-    if (this.enrollment)
+    if (this.enrollment) {
       this.staticHandlers.set("POST:/api/enrollment-invitations", this.enrollment.issue);
+      this.staticHandlers.set("POST:/api/enrollment-emails", this.enrollment.emails);
+    }
     const { config, dbOps, getProviders, getRuntimeHealth, providerRegistry } = this.context;
     const healthHandler = createHealthHandler(dbOps, config, getProviders, getRuntimeHealth);
     const statsHandler = createStatsHandler(dbOps);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@certalis/agent-smith",
-	"version": "0.1.1",
+	"version": "0.1.2",
 	"description": "PROOF OF CONCEPT for ideation only: an experimental local proxy and provider pool for Claude Code and Codex",
 	"license": "MIT",
 	"author": "Certalis",