@floless/app 0.34.0 → 0.34.1

package/dist/floless-server.cjs

@@ -52454,6 +52454,24 @@ function isTrustedFlolessHost(url) {
 var OFFLINE_GRACE_MS = 24 * 60 * 60 * 1e3;
 var MEM_CACHE_MS = 60 * 1e3;
 var REFRESH_SKEW_MS = 60 * 1e3;
+function normalizeSeatReason(raw) {
+  switch ((raw ?? "").toLowerCase().replace(/-/g, "_")) {
+    case "self_takeover":
+    case "takeover":
+      return "takeover";
+    case "inactivity":
+    case "inactive":
+    case "timeout":
+      return "inactivity";
+    case "admin_revoke":
+    case "admin_revoked":
+    case "revoked":
+    case "revoke":
+      return "revoked";
+    default:
+      return "unknown";
+  }
+}
 function isSea() {
   try {
     return (0, import_node_module2.createRequire)(__import_meta_url)("node:sea").isSea();
@@ -52584,11 +52602,12 @@ async function accessToken() {
 }
 var mem = null;
 var seatLost = false;
+var seatLostReason;
 async function getLicenseStatus(opts = {}) {
   const url = signInUrl();
   if (seatLost) {
     mem = null;
-    return { state: "unlicensed", reason: "seat-taken", signInUrl: url };
+    return { state: "unlicensed", reason: "seat-taken", seatReason: seatLostReason, signInUrl: url };
   }
   if (!opts.force && mem && Date.now() - mem.at < MEM_CACHE_MS) return mem.status;
   const finish = (s) => {
@@ -52671,7 +52690,7 @@ async function seatHeartbeat() {
       return;
     }
     if (res.status === 401) {
-      let reason = "self_takeover";
+      let reason = "unknown";
       try {
         const b = await res.json();
         reason = b.details?.reason ?? b.reason ?? reason;
@@ -52701,16 +52720,18 @@ async function seatHeartbeat() {
 }
 function loseSeat(reason) {
   seatLost = true;
+  seatLostReason = normalizeSeatReason(reason);
   seat = null;
   mem = null;
   if (hbTimer) {
     clearInterval(hbTimer);
     hbTimer = null;
   }
-  onSeatLostCb?.(reason);
+  onSeatLostCb?.(seatLostReason);
 }
 function resetSeat() {
   seatLost = false;
+  seatLostReason = void 0;
   seat = null;
   if (hbTimer) {
     clearInterval(hbTimer);
@@ -52835,7 +52856,7 @@ function appVersion() {
   return resolveVersion({
     isSea: isSea2(),
     sqVersionXml: readSqVersionXml(),
-    define: true ? "0.34.0" : void 0,
+    define: true ? "0.34.1" : void 0,
     pkgVersion: readPkgVersion()
   });
 }
@@ -52845,7 +52866,7 @@ function resolveChannel(s) {
   return "dev";
 }
 function appChannel() {
-  return resolveChannel({ isSea: isSea2(), define: true ? "0.34.0" : void 0 });
+  return resolveChannel({ isSea: isSea2(), define: true ? "0.34.1" : void 0 });
 }
 
 // oauth-presets.ts
@@ -58425,7 +58446,10 @@ async function startServer() {
     }
     return { ok: true, bootstrap: getBootstrapState().status };
   });
-  onSeatLost((reason) => broadcast({ type: "seat-taken", reason }));
+  onSeatLost((reason) => {
+    app.log.warn({ reason }, "license seat lost \u2014 gating this session until re-login");
+    broadcast({ type: "seat-taken", reason });
+  });
   app.get("/api/apps", async () => {
     const apps = await aware.list();
     return { ok: true, apps: apps.map((a) => ({ ...a, provider: appProvider(a.id), baked: appBaked(a.id) })) };

package/dist/web/aware.js

@@ -3742,8 +3742,14 @@
           loadApp(currentId).catch(reportErr);
         }, 250);
       } else if (m.type === 'seat-taken') {
-        // This session's seat was claimed by another device (newest-login-wins).
-        showToast('Signed in on another device — sign in here to continue.', 'err');
+        // This session's seat was lost. m.reason (normalized server-side) says why — only a
+        // genuine takeover should claim "another device"; an inactivity/revoke reads neutrally (#142).
+        const SEAT_TOAST = {
+          takeover: 'Signed in on another device — sign in here to continue.',
+          inactivity: 'Your session timed out — sign in here to continue.',
+          revoked: 'Your session was ended by an administrator — sign in here to continue.',
+        };
+        showToast(SEAT_TOAST[m.reason] || 'Your session ended — sign in here to continue.', 'err');
         recheckLicenseAndGate();
       }
     };
@@ -5573,7 +5579,21 @@
         body: 'Sign in with your FloLess account to use floless.app.',
         secondary: { label: 'No subscription yet? Subscribe →', href: subUrl } },
     };
-    const copy = COPY[reason] || COPY['signed-out']; // neutral fallback for an unknown/absent reason
+    let copy = COPY[reason] || COPY['signed-out']; // neutral fallback for an unknown/absent reason
+    // A lost seat carries a sub-reason; only a genuine takeover should claim "another device".
+    // Inactivity/revoke/unknown read neutrally so the gate stops misattributing the cause (#142).
+    if (reason === 'seat-taken') {
+      const SEAT_COPY = {
+        inactivity: { headline: 'Session timed out',
+          body: 'Your session ended after a period of inactivity. Sign in to continue.' },
+        revoked: { headline: 'Session ended by an administrator',
+          body: 'Your session was ended by an administrator. Sign in again to continue.' },
+        unknown: { headline: 'Session ended',
+          body: 'Your session has ended. Sign in to continue using floless.app.' },
+      };
+      const sc = SEAT_COPY[status.seatReason]; // 'takeover'/absent → keep the default takeover copy
+      if (sc) copy = { ...copy, ...sc };
+    }
     const style = document.createElement('style');
     style.textContent = `
       #license-gate{position:fixed;inset:0;z-index:99999;display:flex;align-items:center;justify-content:center;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floless/app",
-  "version": "0.34.0",
+  "version": "0.34.1",
   "type": "module",
   "description": "Thin localhost host for floless.app — serves web/ and shells the aware CLI. No engine, no LLM.",
   "bin": {