@geminixiang/mikan 1.0.0-beta.45 → 1.0.0-beta.47

package/dist/web/admin/types.d.ts

@@ -4,9 +4,9 @@ import type { LinkTokenStoreLike } from "../../commands/types.js";
 import type { SandboxConfig } from "../../sandbox/index.js";
 import type { EventStore } from "../../tools/types.js";
 import type { VaultManager } from "../../vault/index.js";
-import type { InMemorySessionViewTokenStore } from "../session-view/store.js";
+import type { InMemorySessionViewTokenStore } from "../session-view/portal.js";
 import type { TokenRecord } from "../types.js";
-import type { InMemoryAdminTokenStore } from "./store.js";
+import type { InMemoryAdminTokenStore } from "./portal.js";
 export interface AdminRuntimeBridge {
     getRunningSessions(): RunningSession[];
     switchConversationModel(address: OfficeAddress, provider: string, model: string): boolean;

package/dist/web/admin/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/web/admin/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,IAAI,cAAc,EAAE,CAAC;IACvC,uBAAuB,CAAC,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1F,8BAA8B,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC;IAChE,uBAAuB,IAAI;QAAE,IAAI,EAAE,aAAa,EAAE,CAAA;KAAE,CAAC;CACtD;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,YAAY,CAAC;IAC3B,cAAc,EAAE,kBAAkB,CAAC;IACnC,qBAAqB,CAAC,EAAE,6BAA6B,CAAC;IACtD,eAAe,EAAE,uBAAuB,CAAC;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,UAAW,SAAQ,WAAW;IAC7C,QAAQ,EAAE,YAAY,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oFAAoF;IACpF,cAAc,EAAE,MAAM,CAAC;CACxB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/web/admin/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,IAAI,cAAc,EAAE,CAAC;IACvC,uBAAuB,CAAC,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1F,8BAA8B,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC;IAChE,uBAAuB,IAAI;QAAE,IAAI,EAAE,aAAa,EAAE,CAAA;KAAE,CAAC;CACtD;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,YAAY,CAAC;IAC3B,cAAc,EAAE,kBAAkB,CAAC;IACnC,qBAAqB,CAAC,EAAE,6BAA6B,CAAC;IACtD,eAAe,EAAE,uBAAuB,CAAC;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,UAAW,SAAQ,WAAW;IAC7C,QAAQ,EAAE,YAAY,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oFAAoF;IACpF,cAAc,EAAE,MAAM,CAAC;CACxB"}

package/dist/web/admin/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/web/admin/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { MessagingBot, OfficeAddress, PlatformName, RunningSession } from \"../../adapter.js\";\nimport type { Workspace } from \"../../office/index.js\";\nimport type { LinkTokenStoreLike } from \"../../commands/types.js\";\nimport type { SandboxConfig } from \"../../sandbox/index.js\";\nimport type { EventStore } from \"../../tools/types.js\";\nimport type { VaultManager } from \"../../vault/index.js\";\nimport type { InMemorySessionViewTokenStore } from \"../session-view/store.js\";\nimport type { TokenRecord } from \"../types.js\";\nimport type { InMemoryAdminTokenStore } from \"./store.js\";\n\nexport interface AdminRuntimeBridge {\n  getRunningSessions(): RunningSession[];\n  switchConversationModel(address: OfficeAddress, provider: string, model: string): boolean;\n  refreshConversationEnvironment(address: OfficeAddress): boolean;\n  refreshAllConversations(): { busy: OfficeAddress[] };\n}\n\nexport interface AdminServices {\n  vaultManager: VaultManager;\n  linkTokenStore: LinkTokenStoreLike;\n  sessionViewTokenStore?: InMemorySessionViewTokenStore;\n  adminTokenStore: InMemoryAdminTokenStore;\n  portalBaseUrl?: string;\n  workspace?: Workspace;\n  /** Events read/delete go through the owning store, not raw disk parsing. */\n  eventStore?: EventStore;\n  sandbox?: SandboxConfig;\n  runtime?: AdminRuntimeBridge;\n  botsByPlatform?: Partial<Record<PlatformName, MessagingBot>>;\n}\n\nexport interface EventSummary {\n  name: string;\n  size: number;\n  mtimeMs: number;\n  type: string | null;\n  platform: string | null;\n  conversationId: string | null;\n  text: string | null;\n  at: string | null;\n  schedule: string | null;\n  timezone: string | null;\n}\n\nexport interface AdminToken extends TokenRecord {\n  platform: PlatformName;\n  platformUserId: string;\n  platformUserName?: string;\n  /** The conversation where /admin was invoked. Default scope for the 3 sub-pages. */\n  conversationId: string;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/web/admin/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { MessagingBot, OfficeAddress, PlatformName, RunningSession } from \"../../adapter.js\";\nimport type { Workspace } from \"../../office/index.js\";\nimport type { LinkTokenStoreLike } from \"../../commands/types.js\";\nimport type { SandboxConfig } from \"../../sandbox/index.js\";\nimport type { EventStore } from \"../../tools/types.js\";\nimport type { VaultManager } from \"../../vault/index.js\";\nimport type { InMemorySessionViewTokenStore } from \"../session-view/portal.js\";\nimport type { TokenRecord } from \"../types.js\";\nimport type { InMemoryAdminTokenStore } from \"./portal.js\";\n\nexport interface AdminRuntimeBridge {\n  getRunningSessions(): RunningSession[];\n  switchConversationModel(address: OfficeAddress, provider: string, model: string): boolean;\n  refreshConversationEnvironment(address: OfficeAddress): boolean;\n  refreshAllConversations(): { busy: OfficeAddress[] };\n}\n\nexport interface AdminServices {\n  vaultManager: VaultManager;\n  linkTokenStore: LinkTokenStoreLike;\n  sessionViewTokenStore?: InMemorySessionViewTokenStore;\n  adminTokenStore: InMemoryAdminTokenStore;\n  portalBaseUrl?: string;\n  workspace?: Workspace;\n  /** Events read/delete go through the owning store, not raw disk parsing. */\n  eventStore?: EventStore;\n  sandbox?: SandboxConfig;\n  runtime?: AdminRuntimeBridge;\n  botsByPlatform?: Partial<Record<PlatformName, MessagingBot>>;\n}\n\nexport interface EventSummary {\n  name: string;\n  size: number;\n  mtimeMs: number;\n  type: string | null;\n  platform: string | null;\n  conversationId: string | null;\n  text: string | null;\n  at: string | null;\n  schedule: string | null;\n  timezone: string | null;\n}\n\nexport interface AdminToken extends TokenRecord {\n  platform: PlatformName;\n  platformUserId: string;\n  platformUserName?: string;\n  /** The conversation where /admin was invoked. Default scope for the 3 sub-pages. */\n  conversationId: string;\n}\n"]}

package/dist/web/login/portal.d.ts

@@ -1,7 +1,13 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
-import type { InMemoryLinkTokenStore } from "./store.js";
+import type { PlatformName } from "../../adapter.js";
+import { InMemoryTokenStore } from "../token-store.js";
+import type { LinkToken } from "./types.js";
+export type { LinkToken } from "./types.js";
 import { type VaultManager } from "../../vault/index.js";
 export type { NotifyFn } from "./types.js";
+export declare class InMemoryLinkTokenStore extends InMemoryTokenStore<LinkToken> {
+    create(platform: PlatformName, platformUserId: string, conversationId: string, vaultId: string, providerId: string): LinkToken;
+}
 import type { NotifyFn } from "./types.js";
 /**
  * Start a small HTTP server that receives credential onboarding callbacks from the web portal.

package/dist/web/login/portal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"portal.d.ts","sourceRoot":"","sources":["../../../src/web/login/portal.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAGjE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAUzD,OAAO,EAA0B,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAIjF,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAyN3C;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,cAAc,EAAE,sBAAsB,EACtC,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,QAAQ,GACf,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,KAAK,OAAO,CAqGlE"}
+{"version":3,"file":"portal.d.ts","sourceRoot":"","sources":["../../../src/web/login/portal.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAIjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAU5C,OAAO,EAA0B,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAIjF,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAI3C,qBAAa,sBAAuB,SAAQ,kBAAkB,CAAC,SAAS,CAAC;IACvE,MAAM,CACJ,QAAQ,EAAE,YAAY,EACtB,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,SAAS,CAWX;CACF;AACD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAyN3C;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,cAAc,EAAE,sBAAsB,EACtC,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,QAAQ,GACf,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,KAAK,OAAO,CAqGlE"}

package/dist/web/login/portal.js

@@ -1,11 +1,26 @@
 import { createHash, randomBytes } from "node:crypto";
 import { escapeHtml, readJsonBody, renderPortalShell, requestBaseUrl } from "../portal-shell.js";
 import { resolveLinkBaseUrl } from "../../config.js";
+import { readEnv } from "../../env-manifest.js";
+import { InMemoryTokenStore } from "../token-store.js";
 import { getOAuthServices, resolveOAuthService, } from "./oauth.js";
 import * as log from "../../log.js";
 import { reportUserFacingError } from "../../observability/sentry.js";
 import { PRODUCT_NAME } from "../../platform-messages.js";
 import { defaultVaultTargetPath } from "../../vault/index.js";
+const TTL_MS = 15 * 60 * 1000;
+export class InMemoryLinkTokenStore extends InMemoryTokenStore {
+    create(platform, platformUserId, conversationId, vaultId, providerId) {
+        this.deleteWhere((token) => token.platform === platform && token.platformUserId === platformUserId);
+        return this.createRecord(TTL_MS, {
+            platform,
+            platformUserId,
+            vaultId,
+            providerId,
+            conversationId,
+        });
+    }
+}
 const OAUTH_STATE_TTL_MS = 10 * 60 * 1000;
 const DEFAULT_SECRET_CONFIG_ID = "manual";
 const SECRET_PRESETS = [
@@ -202,9 +217,20 @@ export function createLoginRequestHandler(linkTokenStore, vaultManager, notify)
             const defaultMode = oauthServiceHint ? "oauth" : "api_key";
             const existingSecrets = describeVaultSecrets(vaultManager, linkToken.vaultId);
             res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-            res.end(renderCredentialPage(rawToken, oauthServiceHint ? `${oauthServiceHint.label} OAuth` : "Store Secret", defaultMode, "", "Secret value", "sk-...", oauthServiceHint
-                ? `Authorize ${oauthServiceHint.label} and store tokens in your vault.`
-                : "Set any environment variable key/value pair in your vault.", oauthServices, oauthServiceHint?.id, existingSecrets));
+            res.end(renderCredentialPage({
+                token: rawToken,
+                title: oauthServiceHint ? `${oauthServiceHint.label} OAuth` : "Store Secret",
+                defaultMode,
+                initialEnvKey: "",
+                secretLabel: "Secret value",
+                placeholder: "sk-...",
+                helpText: oauthServiceHint
+                    ? `Authorize ${oauthServiceHint.label} and store tokens in your vault.`
+                    : "Set any environment variable key/value pair in your vault.",
+                oauthServices,
+                oauthServiceIdHint: oauthServiceHint?.id,
+                existingSecrets,
+            }));
             return true;
         }
         if (req.method === "POST" && url.pathname === "/api/link/complete") {
@@ -228,7 +254,15 @@ export function createLoginRequestHandler(linkTokenStore, vaultManager, notify)
             return true;
         }
         if (req.method === "GET" && url.pathname === "/oauth/callback") {
-            void handleOAuthCallback(url, req, linkTokenStore, vaultManager, notify, oauthStates, res).catch((err) => {
+            void handleOAuthCallback({
+                url,
+                req,
+                linkTokenStore,
+                vaultManager,
+                notify,
+                oauthStates,
+                res,
+            }).catch((err) => {
                 log.logWarning("OAuth callback failed", err.message);
                 reportUserFacingError(err, {
                     domain: "login",
@@ -734,42 +768,8 @@ function renderManualProviderCard(initialEnvKey, secretLabel, placeholder) {
     </div>
   </section>`;
 }
-function renderCredentialPage(token, title, defaultMode, initialEnvKey, secretLabel, placeholder, helpText, oauthServices, oauthServiceIdHint, existingSecrets) {
-    const oauthOptions = oauthServices
-        .map((service) => {
-        const selected = service.id === oauthServiceIdHint ? ' selected="selected"' : "";
-        return `<option value="${esc(service.id)}"${selected}>${esc(service.label)}</option>`;
-    })
-        .join("\n");
-    const presetCards = SECRET_PRESETS.map(renderPresetProviderCard).join("\n");
-    return renderHtmlDocument("Login", `<section class="card stack">
-  <p class="eyebrow">${PRODUCT_NAME}</p>
-  <h1 class="page-title">${esc(title)}</h1>
-  <p>Your personal sandbox is already provisioned automatically.</p>
-  <p>${esc(helpText)}</p>
-  ${renderSecretsSummary(existingSecrets)}
-  <div class="mode">
-    <label><input type="radio" name="mode" value="api_key" ${defaultMode === "api_key" ? "checked" : ""}> Secrets / API tokens</label>
-    <label><input type="radio" name="mode" value="oauth" ${defaultMode === "oauth" ? "checked" : ""}> OAuth login</label>
-  </div>
-</section>
-
-<div id="api-panel" class="panel">
-  ${presetCards}
-  ${renderManualProviderCard(initialEnvKey, secretLabel, placeholder)}
-</div>
-
-<div id="oauth-panel" class="panel card stack">
-  <label for="oauthService">OAuth service</label>
-  <select id="oauthService" name="oauthService">${oauthOptions}</select>
-  <p class="panel-note">You'll be redirected to the selected service's authorization page.</p>
-</div>
-
-<div>
-  <button id="btn" class="primary-button" onclick="connect()">Continue</button>
-  <div id="result" class="result" aria-live="polite"></div>
-</div>
-  <script>
+const CREDENTIAL_PAGE_TOKEN = "__MIKAN_LOGIN_TOKEN__";
+const CREDENTIAL_PAGE_SCRIPT = `  <script>
     const envKeyPattern = /^[A-Za-z_][A-Za-z0-9_]*$/;
 
     function selectedMode() {
@@ -853,7 +853,7 @@ function renderCredentialPage(token, title, defaultMode, initialEnvKey, secretLa
       const r = await fetch('/api/oauth/start', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ token: '${esc(token)}', serviceId }),
+        body: JSON.stringify({ token: '__MIKAN_LOGIN_TOKEN__', serviceId }),
       });
       const data = await r.json();
       if (!r.ok) {
@@ -875,7 +875,7 @@ function renderCredentialPage(token, title, defaultMode, initialEnvKey, secretLa
       const r = await fetch('/api/link/complete', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ token: '${esc(token)}', mode: 'api_key', env: payload.env }),
+        body: JSON.stringify({ token: '__MIKAN_LOGIN_TOKEN__', mode: 'api_key', env: payload.env }),
       });
       const data = await r.json();
       if (r.ok) {
@@ -936,7 +936,47 @@ function renderCredentialPage(token, title, defaultMode, initialEnvKey, secretLa
         resetContinueButton();
       }
     }
-  </script>`);
+  </script>`;
+function renderCredentialPageScript(token) {
+    return CREDENTIAL_PAGE_SCRIPT.replaceAll(CREDENTIAL_PAGE_TOKEN, () => esc(token));
+}
+function renderCredentialPage(options) {
+    const { token, title, defaultMode, initialEnvKey, secretLabel, placeholder, helpText, oauthServices, oauthServiceIdHint, existingSecrets, } = options;
+    const oauthOptions = oauthServices
+        .map((service) => {
+        const selected = service.id === oauthServiceIdHint ? ' selected="selected"' : "";
+        return `<option value="${esc(service.id)}"${selected}>${esc(service.label)}</option>`;
+    })
+        .join("\n");
+    const presetCards = SECRET_PRESETS.map(renderPresetProviderCard).join("\n");
+    return renderHtmlDocument("Login", `<section class="card stack">
+  <p class="eyebrow">${PRODUCT_NAME}</p>
+  <h1 class="page-title">${esc(title)}</h1>
+  <p>Your personal sandbox is already provisioned automatically.</p>
+  <p>${esc(helpText)}</p>
+  ${renderSecretsSummary(existingSecrets)}
+  <div class="mode">
+    <label><input type="radio" name="mode" value="api_key" ${defaultMode === "api_key" ? "checked" : ""}> Secrets / API tokens</label>
+    <label><input type="radio" name="mode" value="oauth" ${defaultMode === "oauth" ? "checked" : ""}> OAuth login</label>
+  </div>
+</section>
+
+<div id="api-panel" class="panel">
+  ${presetCards}
+  ${renderManualProviderCard(initialEnvKey, secretLabel, placeholder)}
+</div>
+
+<div id="oauth-panel" class="panel card stack">
+  <label for="oauthService">OAuth service</label>
+  <select id="oauthService" name="oauthService">${oauthOptions}</select>
+  <p class="panel-note">You'll be redirected to the selected service's authorization page.</p>
+</div>
+
+<div>
+  <button id="btn" class="primary-button" onclick="connect()">Continue</button>
+  <div id="result" class="result" aria-live="polite"></div>
+</div>
+${renderCredentialPageScript(token)}`);
 }
 function renderErrorPage(message) {
     return renderStatusPage("Login Error", message, "err");
@@ -1090,8 +1130,8 @@ async function handleOAuthStart(data, req, linkTokenStore, oauthStates, res) {
         res.end(JSON.stringify({ error: `Unsupported OAuth service: ${data.serviceId}` }));
         return;
     }
-    const clientId = process.env[service.clientIdEnvKey];
-    const clientSecret = process.env[service.clientSecretEnvKey];
+    const clientId = readEnv(service.clientIdEnvKey);
+    const clientSecret = readEnv(service.clientSecretEnvKey);
     if (!clientId || !clientSecret) {
         res.writeHead(400, { "Content-Type": "application/json" });
         res.end(JSON.stringify({
@@ -1130,69 +1170,66 @@ async function handleOAuthStart(data, req, linkTokenStore, oauthStates, res) {
     res.writeHead(200, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ ok: true, redirectUrl: authorizeUrl.toString() }));
 }
-async function handleOAuthCallback(url, req, linkTokenStore, vaultManager, notify, oauthStates, res) {
+function resolveOAuthCallback(options) {
+    const { url, oauthStates, linkTokenStore, res } = options;
     const state = url.searchParams.get("state") ?? "";
     const code = url.searchParams.get("code") ?? "";
     const oauthError = url.searchParams.get("error");
     // Atomic pop: whatever path we take from here, this state is spent.
-    // Done before any `await` to close the TOCTOU window between the state
-    // lookup and the final delete.
     const pending = oauthStates.get(state);
     if (pending)
         oauthStates.delete(state);
     if (oauthError) {
         res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
         res.end(renderErrorPage(`OAuth authorization failed: ${oauthError}`));
-        return;
+        return undefined;
     }
     if (!pending || Date.now() > pending.expiresAt) {
         res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
         res.end(renderErrorPage("OAuth state is invalid or expired. Please run /login again."));
-        return;
+        return undefined;
     }
     if (!code) {
         res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
         res.end(renderErrorPage("Missing OAuth authorization code."));
-        return;
+        return undefined;
     }
     const service = resolveOAuthService(pending.serviceId);
     if (!service) {
         res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
         res.end(renderErrorPage("Unsupported OAuth service."));
-        return;
+        return undefined;
     }
-    const clientId = process.env[service.clientIdEnvKey];
-    const clientSecret = process.env[service.clientSecretEnvKey];
+    const clientId = readEnv(service.clientIdEnvKey);
+    const clientSecret = readEnv(service.clientSecretEnvKey);
     if (!clientId || !clientSecret) {
         res.writeHead(500, { "Content-Type": "text/html; charset=utf-8" });
         res.end(renderErrorPage("OAuth service is not configured on server."));
-        return;
+        return undefined;
     }
-    // Atomic consume: pairs with the callback being one-shot. Two concurrent
-    // callbacks for the same state would previously both pass `peek` and both
-    // run `exchangeOAuthCode` across the await; only one reaches `consume`.
+    // Atomic consume keeps the callback one-shot across the token exchange await.
     const linkToken = linkTokenStore.consume(pending.linkToken);
     if (!linkToken) {
         res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
         res.end(renderErrorPage("Login link is invalid or expired. Please run /login again."));
-        return;
+        return undefined;
     }
-    const redirectUri = `${requestBaseUrl(req)}/oauth/callback`;
-    const tokenResp = await exchangeOAuthCode(service, code, clientId, clientSecret, redirectUri, pending.codeVerifier);
-    const accessToken = tokenResp.access_token?.trim();
-    const refreshToken = tokenResp.refresh_token?.trim();
+    return { code, codeVerifier: pending.codeVerifier, service, clientId, clientSecret, linkToken };
+}
+function storeOAuthCredentials(options) {
+    const { tokenResponse, service, clientId, clientSecret, linkToken, vaultManager, res } = options;
+    const accessToken = tokenResponse.access_token?.trim();
+    const refreshToken = tokenResponse.refresh_token?.trim();
     if (!accessToken) {
         res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
         res.end(renderErrorPage("OAuth token exchange did not return an access_token."));
-        return;
+        return undefined;
     }
     const updates = {};
-    for (const key of service.accessTokenEnvKeys ?? []) {
+    for (const key of service.accessTokenEnvKeys ?? [])
         updates[key] = accessToken;
-    }
-    if (refreshToken && service.refreshTokenEnvKey) {
+    if (refreshToken && service.refreshTokenEnvKey)
         updates[service.refreshTokenEnvKey] = refreshToken;
-    }
     const fileOutput = service.fileOutput;
     let mountedPath;
     if (fileOutput?.type === "authorized_user") {
@@ -1200,15 +1237,13 @@ async function handleOAuthCallback(url, req, linkTokenStore, vaultManager, notif
             res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
             res.end(renderErrorPage("OAuth token exchange did not return a refresh_token. " +
                 "Retry after revoking prior consent or ensure prompt=consent is applied."));
-            return;
+            return undefined;
         }
         mountedPath = fileOutput.targetPath ?? defaultVaultTargetPath(fileOutput.relativePath);
-        if (fileOutput.envKey) {
+        if (fileOutput.envKey)
             updates[fileOutput.envKey] = mountedPath;
-        }
-        for (const key of fileOutput.additionalEnvKeys ?? []) {
+        for (const key of fileOutput.additionalEnvKeys ?? [])
             updates[key] = mountedPath;
-        }
     }
     const storedTargets = [];
     try {
@@ -1240,10 +1275,39 @@ async function handleOAuthCallback(url, req, linkTokenStore, vaultManager, notif
         });
         res.writeHead(500, { "Content-Type": "text/html; charset=utf-8" });
         res.end(renderErrorPage("OAuth tokens were received but could not be stored on the server. Fix the server issue and run /login again."));
-        return;
+        return undefined;
     }
+    return storedTargets;
+}
+async function handleOAuthCallback(options) {
+    const resolved = resolveOAuthCallback(options);
+    if (!resolved)
+        return;
+    const { service, code, clientId, clientSecret, codeVerifier, linkToken } = resolved;
+    const redirectUri = `${requestBaseUrl(options.req)}/oauth/callback`;
+    const tokenResponse = await exchangeOAuthCode({
+        service,
+        code,
+        clientId,
+        clientSecret,
+        redirectUri,
+        codeVerifier,
+    });
+    const storedTargets = storeOAuthCredentials({
+        tokenResponse,
+        service,
+        clientId,
+        clientSecret,
+        linkToken,
+        vaultManager: options.vaultManager,
+        res: options.res,
+    });
+    if (!storedTargets)
+        return;
     log.logInfo(`Stored [${storedTargets.join(", ")}] for ${linkToken.platform}/${linkToken.platformUserId} in vault:${linkToken.vaultId}`);
-    notify(linkToken.platform, linkToken.conversationId, `${service.label} OAuth stored (${storedTargets.join(", ")}) in vault \`${linkToken.vaultId}\`.`).catch((err) => {
+    options
+        .notify(linkToken.platform, linkToken.conversationId, `${service.label} OAuth stored (${storedTargets.join(", ")}) in vault \`${linkToken.vaultId}\`.`)
+        .catch((err) => {
         log.logWarning("Failed to notify user after OAuth login", err.message);
         reportUserFacingError(err, {
             domain: "login",
@@ -1260,10 +1324,11 @@ async function handleOAuthCallback(url, req, linkTokenStore, vaultManager, notif
             },
         });
     });
-    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-    res.end(renderSuccessPage(`${service.label} OAuth connected successfully.`));
+    options.res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+    options.res.end(renderSuccessPage(`${service.label} OAuth connected successfully.`));
 }
-async function exchangeOAuthCode(service, code, clientId, clientSecret, redirectUri, codeVerifier) {
+async function exchangeOAuthCode(options) {
+    const { service, code, clientId, clientSecret, redirectUri, codeVerifier } = options;
     const params = new URLSearchParams();
     params.set("grant_type", "authorization_code");
     params.set("code", code);