@monster-orange/den 0.4.26 → 0.4.27

package/src/ui/cli/agent-ops.ts

@@ -265,6 +265,8 @@ export interface AgentsDeps extends SessionsDeps {
     url: string;
     token: string;
     allowTools?: boolean;
+    /** HUB-1.7: Hub's MCP endpoint (default <url>/mcp). */
+    mcpUrl?: string;
   } | null>;
   /** HUB-1.5: workspace `ws`'s repos as owner/repo (X-Den-Repos). */
   workspaceRepos?: (ws: string) => string[];
@@ -288,6 +290,7 @@ export interface AgentsResolved extends Resolved {
     url: string;
     token: string;
     allowTools?: boolean;
+    mcpUrl?: string;
   } | null>;
   workspaceRepos: (ws: string) => string[];
 }
@@ -395,6 +398,7 @@ export async function agentHub(
   d: AgentsResolved,
   ws: string,
   name: string,
+  agentId?: string,
 ): Promise<AgentMcp["hub"] | undefined> {
   const h = await d.hub().catch(() => null);
   if (!h) return undefined;
@@ -407,10 +411,11 @@ export async function agentHub(
   }
   return {
     name: HUB_SERVER,
-    url: h.url,
+    url: h.mcpUrl || `${h.url}/mcp`,
     allowTools: h.allowTools !== false,
     headers: hubHeaders(h.token, {
       agent: name,
+      ...(agentId ? { agentId } : {}),
       session: crypto.randomUUID(),
       workspace: ws,
       repos,
@@ -480,6 +485,7 @@ async function defaultHub(): Promise<{
   url: string;
   token: string;
   allowTools: boolean;
+  mcpUrl: string;
 } | null> {
   const { readHubConfig, readHubToken } = await import("../../shared/hub.js");
   let cfg;
@@ -490,7 +496,9 @@ async function defaultHub(): Promise<{
   }
   if (!cfg) return null;
   const token = await readHubToken(cfg);
-  return token ? { url: cfg.url, token, allowTools: cfg.allowTools } : null;
+  return token
+    ? { url: cfg.url, token, allowTools: cfg.allowTools, mcpUrl: cfg.mcpUrl }
+    : null;
 }
 
 /**
@@ -1901,6 +1909,7 @@ export async function startAgent(
     d,
     ws,
     given ?? prev?.displayName ?? persona.displayName ?? id,
+    id,
   );
   const input = {
     ...base,
@@ -2443,7 +2452,12 @@ export async function resumeAgent(
     // Resume in the cwd the agent had, wherever the workspace points now.
     // D24 (and D25: a rename since) the name peers see it by.
     const peerName = peerSessionName(d.cli, rec.workspace, rec);
-    const hub = await agentHub(d, rec.workspace, rec.displayName ?? rec.id);
+    const hub = await agentHub(
+      d,
+      rec.workspace,
+      rec.displayName ?? rec.id,
+      rec.id,
+    );
     const at = {
       ...input,
       ...(hub ? { mcp: { ...input.mcp, hub } } : {}),

package/src/ui/cli/doctor-command.ts

@@ -482,12 +482,21 @@ export function hubLines(
   title: string,
 ): { lines: string[]; problem: boolean; check?: OnboardCheck } {
   if (!st.configured) return { lines: [], problem: false };
-  const who = [st.team && `team ${st.team}`, st.label && `install ${st.label}`]
+  const who = [
+    st.team && `company ${st.team}`,
+    st.label && `install ${st.label}`,
+    st.role && `role ${st.role}`,
+  ]
     .filter(Boolean)
     .join(", ");
+  // HUB-1.7: what to do about it is in Settings (Connect, Reconnect).
+  const fix =
+    st.state === "no_token" || st.state === "rejected"
+      ? ` (Settings › Agents › Hub: ${st.state === "rejected" ? "Reconnect" : "Connect"})`
+      : "";
   const detail = st.connected
     ? `${st.url}: connected${who ? ` (${who})` : ""}`
-    : `${st.url || "hub.url"}: not connected: ${st.problem ?? "no answer"}`;
+    : `${st.url || "hub.url"}: not connected: ${st.problem ?? "no answer"}${fix}`;
   return {
     lines: [
       "",

package/src/ui/server/agent-routes.ts

@@ -164,6 +164,7 @@ import {
   agentResumeRefusal,
 } from "./agent-resume-grant.js";
 import { readBody, sendJson } from "./http-helpers.js";
+import { product } from "../../shared/product.js";
 import type { Actor } from "../../shared/agent-actor.js";
 
 export interface AgentRouteDeps {
@@ -175,6 +176,8 @@ export interface AgentRouteDeps {
   personaWait?: { pollMs?: number; maxMs?: number };
   /** HUB-1.5: GET /api/hub's answer (tests: a fake Hub). */
   hubStatus?: () => Promise<import("../../shared/hub.js").HubStatus>;
+  /** HUB-1.7: Connect to Hub's state (tests: fake Hub calls and store). */
+  hubConnect?: import("./hub-connect.js").HubConnect;
 }
 
 const AGENTS_PATH =
@@ -434,9 +437,19 @@ export async function handleAgentRoutes(
     if (method !== "GET" && method !== "HEAD")
       return methodNotAllowed(res, "GET");
     const { hubStatus } = await import("../../shared/hub.js");
-    sendJson(res, await (deps.hubStatus ?? (() => hubStatus()))());
+    const st = await (deps.hubStatus ?? (() => hubStatus()))();
+    // HUB-1.7: what the last Connect came to, once (words only).
+    const last = (deps.hubConnect ?? defaultConnect)?.lastResult();
+    sendJson(res, last ? { ...st, connect: last } : st);
     return true;
   }
+  // HUB-1.7: Connect to Hub, and its callback (see hub-connect.ts).
+  if (
+    pathname === "/api/hub/connect" ||
+    pathname === "/api/hub/disconnect" ||
+    pathname === "/hub/callback"
+  )
+    return hubConnectRoute(req, res, pathname, deps);
   if (
     pathname !== "/api/personas" &&
     pathname !== "/api/agents/runtimes" &&
@@ -1381,3 +1394,68 @@ async function rotationRoute(
   }
   return true;
 }
+
+let defaultConnect: import("./hub-connect.js").HubConnect | null = null;
+
+/** HUB-1.7: start a connect, finish it (Hub's redirect), or disconnect. */
+async function hubConnectRoute(
+  req: http.IncomingMessage,
+  res: http.ServerResponse,
+  pathname: string,
+  deps: AgentRouteDeps,
+): Promise<true> {
+  const m = await import("./hub-connect.js");
+  const hc = deps.hubConnect ?? (defaultConnect ??= new m.HubConnect());
+  res.setHeader("Cache-Control", "no-store");
+  const method = req.method ?? "GET";
+  if (pathname === "/hub/callback") {
+    if (method !== "GET") return methodNotAllowed(res, "GET");
+    const q = new URL(req.url ?? "/", "http://localhost").searchParams;
+    const r = await hc.finish(q);
+    res.writeHead(r.ok ? 200 : 400, {
+      "Content-Type": "text/html; charset=utf-8",
+      "Referrer-Policy": "no-referrer",
+      "Cache-Control": "no-store",
+    });
+    res.end(
+      m.callbackPage(product().title, {
+        ok: r.ok,
+        ...(r.ok ? {} : { reason: r.reason }),
+        message: r.ok
+          ? `Connected to Hub${r.team ? ` (${r.team})` : ""}. Going back to Settings…`
+          : r.message,
+      }),
+    );
+    return true;
+  }
+  if (method !== "POST") return methodNotAllowed(res, "POST");
+  let body: Record<string, unknown> = {};
+  try {
+    const raw = await readBody(req);
+    body = raw ? ((JSON.parse(raw) as Record<string, unknown>) ?? {}) : {};
+  } catch {
+    sendJson(res, { ok: false, error: "the body must be JSON" }, 400);
+    return true;
+  }
+  if (pathname === "/api/hub/connect") {
+    // The browser's Origin (request-guard checked it is this Den's).
+    const origin = String(req.headers.origin ?? "");
+    if (!origin) {
+      sendJson(
+        res,
+        {
+          ok: false,
+          error: "Connect from Settings › Agents › Hub in a browser",
+        },
+        400,
+      );
+      return true;
+    }
+    const r = hc.start(origin, body.url);
+    sendJson(res, r, r.ok ? 200 : 400);
+    return true;
+  }
+  const r = await hc.disconnect(body.force === true);
+  sendJson(res, r, r.ok ? 200 : 502);
+  return true;
+}

package/src/ui/server/hub-connect.ts

@@ -0,0 +1,433 @@
+/**
+ * HUB-1.7: Connect to Hub. A person connects this install from Settings ›
+ * Agents › Hub; nobody copies a token or edits config.
+ *
+ *   1. POST /api/hub/connect { url? }  (signed in, CSRF): a PKCE verifier
+ *      and a single-use state are made and kept here (10 min); the answer
+ *      is Hub's /connect URL, and the page goes there.
+ *   2. Hub signs the person in; they pick a company and approve. Hub sends
+ *      the browser to <this Den>/hub/callback?code&state (or error=…).
+ *   3. GET /hub/callback (sign-in free: the session cookie is SameSite
+ *      Strict, so a redirect from Hub doesn't carry it; the single-use state
+ *      and the verifier only this server holds are what protect it) trades
+ *      the code for the install's token server to server (POST
+ *      /connect/token), stores the token and points hub.token at it, then
+ *      answers a page that moves on to Settings by script, a same-site
+ *      navigation that carries the cookie again.
+ *   4. POST /api/hub/disconnect revokes the token on Hub, then removes it
+ *      here and clears hub.token.
+ *
+ * Where the token goes (SEC-0: the install's, never Den's): the install's
+ * own secrets store when it keeps secrets (1Password, Doppler: a new item
+ * or key, like the saved admin password), else a file Den keeps for this
+ * install, <state dir>/hub/token (mode 600, its folder 700). Either way the
+ * value travels on stdin or into the file, never in argv, and never to the
+ * browser, a log or an API answer.
+ */
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import {
+  hubExchange,
+  HubCallError,
+  hubRevoke,
+  hubUrlProblem,
+  newHubState,
+  newPkce,
+  readHubConfig,
+  readHubToken,
+  type HubConfig,
+  type HubGrant,
+} from "../../shared/hub.js";
+import { readUserConfig, writeUserConfig } from "../../shared/den-config.js";
+import { getStateDir } from "../../shared/paths.js";
+import { envKey, product } from "../../shared/product.js";
+import {
+  getSecretsProvider,
+  readSecretsConfig,
+  secretsStatus,
+  type SecretRef,
+} from "../../shared/secrets/index.js";
+
+/** How long a started connect waits for Hub to send the person back. */
+export const CONNECT_TTL_MS = 10 * 60_000;
+/** At most this many connects waiting at once (oldest dropped first). */
+const MAX_PENDING = 16;
+
+interface Pending {
+  verifier: string;
+  hubUrl: string;
+  redirectUri: string;
+  at: number;
+}
+
+/** What hub.token becomes after a connect: a store ref, or a file source. */
+export type StoredToken =
+  | { kind: "ref"; ref: Partial<SecretRef>; where: string }
+  | { kind: "file"; source: string; where: string };
+
+export interface HubConnectDeps {
+  now: () => number;
+  /** hub.* as configured now (a distribution may preset hub.url). */
+  config: () => HubConfig | null;
+  exchange: typeof hubExchange;
+  revoke: typeof hubRevoke;
+  /** Keep the token for this install; what hub.token should say. */
+  store: (token: string) => Promise<StoredToken>;
+  /** Remove a token Connect stored (best effort). */
+  forget: (cfg: HubConfig) => Promise<void>;
+  readToken: (cfg: HubConfig) => Promise<string | null>;
+  readUser: () => Record<string, unknown>;
+  writeUser: (u: Record<string, unknown>) => void;
+  /** This install's label on Hub (1–40 characters). */
+  installLabel: () => string;
+}
+
+/** `<cli> on <machine>`: how Hub lists this install (Hub's label rule). */
+export function defaultInstallLabel(
+  cli = product().cli,
+  host = os.hostname(),
+): string {
+  const machine = host.split(".")[0] || "this machine";
+  // Hub's rule: 1–40 of [A-Za-z0-9 ._-], starting with a letter or digit.
+  const label = `${cli} on ${machine}`
+    .replace(/[^A-Za-z0-9 ._-]/g, "-")
+    .replace(/^[^A-Za-z0-9]+/, "")
+    .slice(0, 40)
+    .trimEnd();
+  return label || "den";
+}
+
+/** The file Den keeps an install's Hub token in, when its store can't. */
+export function hubTokenFile(stateDir = getStateDir()): string {
+  return path.join(stateDir, "hub", "token");
+}
+
+/** Write the token to its 0600 file (folder 0700), replacing any old one. */
+function writeTokenFile(file: string, token: string): void {
+  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+  fs.chmodSync(path.dirname(file), 0o700);
+  const tmp = `${file}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, `${token}\n`, { mode: 0o600 });
+  fs.chmodSync(tmp, 0o600);
+  fs.renameSync(tmp, file);
+}
+
+/**
+ * The install's store, when it keeps secrets: a 1Password item or a Doppler
+ * key, named from the distribution (never Den's own vault). Null for env
+ * (gone at restart) and none, and for a backend nobody chose.
+ */
+export function storeRefFor(backend: string): Partial<SecretRef> | null {
+  switch (backend) {
+    case "1password":
+      return { item: `${product().title} Hub token`, field: "token" };
+    case "doppler":
+      return { key: envKey("HUB_TOKEN") };
+    default:
+      return null;
+  }
+}
+
+async function defaultStore(token: string): Promise<StoredToken> {
+  const st = secretsStatus(readSecretsConfig(), process.env);
+  const ref =
+    !st.implicit && st.detect.available ? storeRefFor(st.backend) : null;
+  if (ref) {
+    const full: SecretRef = {
+      vault: ref.vault ?? "",
+      item: ref.item ?? "",
+      field: ref.field ?? ref.key ?? "",
+      ...(ref.key ? { key: ref.key } : {}),
+    };
+    try {
+      await getSecretsProvider().set(full, token);
+      return {
+        kind: "ref",
+        ref,
+        where: ref.item
+          ? `${st.label}: ${ref.item}`
+          : `${st.label}: ${ref.key}`,
+      };
+    } catch {
+      // The store refused (signed out, locked): keep it in the file instead.
+    }
+  }
+  const file = hubTokenFile();
+  writeTokenFile(file, token);
+  return { kind: "file", source: `file:${file}`, where: file };
+}
+
+async function defaultForget(cfg: HubConfig): Promise<void> {
+  if (cfg.tokenSource?.kind === "file") {
+    // Only the file Connect made: never a path a distribution chose.
+    if (path.resolve(cfg.tokenSource.path) === path.resolve(hubTokenFile()))
+      fs.rmSync(hubTokenFile(), { force: true });
+    return;
+  }
+  if (cfg.tokenRef) {
+    // Stores have no delete here: blank the value (the token is revoked).
+    const st = secretsStatus(readSecretsConfig(), process.env);
+    const ours = storeRefFor(st.backend);
+    const same =
+      !!ours &&
+      (ours.item
+        ? cfg.tokenRef.item === ours.item
+        : cfg.tokenRef.key === ours.key);
+    if (same)
+      await getSecretsProvider()
+        .set(cfg.tokenRef, " ")
+        .catch(() => undefined);
+  }
+}
+
+export function defaultHubConnectDeps(): HubConnectDeps {
+  return {
+    now: () => Date.now(),
+    config: () => {
+      try {
+        return readHubConfig();
+      } catch {
+        return null;
+      }
+    },
+    exchange: hubExchange,
+    revoke: hubRevoke,
+    store: defaultStore,
+    forget: defaultForget,
+    readToken: (c) => readHubToken(c),
+    readUser: () => readUserConfig() as Record<string, unknown>,
+    writeUser: (u) => writeUserConfig(u as never),
+    installLabel: () => defaultInstallLabel(),
+  };
+}
+
+/** An origin Hub will send the person back to: https, or loopback http. */
+export function callbackOriginProblem(origin: string): string | null {
+  let u: URL;
+  try {
+    u = new URL(origin);
+  } catch {
+    return "this page's address isn't one Hub can send you back to";
+  }
+  const loop = u.hostname === "localhost" || u.hostname === "127.0.0.1";
+  if (u.protocol === "https:" || (u.protocol === "http:" && loop)) return null;
+  return `Hub can only send you back to https or to localhost; open ${product().title} over https (its edge address) or on this machine, then Connect`;
+}
+
+export type ConnectResult =
+  | { ok: true; team?: string; where: string }
+  | { ok: false; reason: "denied" | "expired" | "failed"; message: string };
+
+export class HubConnect {
+  private readonly pending = new Map<string, Pending>();
+  constructor(readonly deps: HubConnectDeps = defaultHubConnectDeps()) {}
+
+  private sweep(): void {
+    const now = this.deps.now();
+    for (const [k, v] of this.pending)
+      if (now - v.at > CONNECT_TTL_MS) this.pending.delete(k);
+    while (this.pending.size >= MAX_PENDING) {
+      const oldest = this.pending.keys().next().value;
+      if (oldest === undefined) break;
+      this.pending.delete(oldest);
+    }
+  }
+
+  /**
+   * Step 1: where to send the browser. `origin` is this Den as the browser
+   * sees it (the request's checked Origin); `url` a Hub the person typed,
+   * else hub.url.
+   */
+  start(
+    origin: string,
+    url?: unknown,
+  ): { ok: true; location: string } | { ok: false; error: string } {
+    const typed = typeof url === "string" ? url.trim().replace(/\/+$/, "") : "";
+    const hubUrl = typed || this.deps.config()?.url || "";
+    if (!hubUrl) return { ok: false, error: "type Hub's address first" };
+    const bad = hubUrlProblem(hubUrl);
+    if (bad)
+      return { ok: false, error: bad.replace("hub.url", "Hub's address") };
+    const badOrigin = callbackOriginProblem(origin);
+    if (badOrigin) return { ok: false, error: badOrigin };
+    this.sweep();
+    const state = newHubState();
+    const { verifier, challenge } = newPkce();
+    const redirectUri = `${new URL(origin).origin}/hub/callback`;
+    this.pending.set(state, {
+      verifier,
+      hubUrl,
+      redirectUri,
+      at: this.deps.now(),
+    });
+    const q = new URLSearchParams({
+      install: this.deps.installLabel(),
+      redirect_uri: redirectUri,
+      state,
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+    });
+    return { ok: true, location: `${hubUrl}/connect?${q}` };
+  }
+
+  /**
+   * Steps 2–3: Hub sent the person back. The state is used once, whatever
+   * happens. On success the token is stored and hub.* written to user.yml.
+   * The result names what happened in words (never the token or the code).
+   */
+  async finish(q: URLSearchParams): Promise<ConnectResult> {
+    const r = await this.finishOnce(q);
+    this.last = {
+      ok: r.ok,
+      message: r.ok
+        ? `Connected to Hub${r.team ? ` (${r.team})` : ""}.`
+        : r.message,
+      at: this.deps.now(),
+    };
+    return r;
+  }
+
+  /**
+   * What the last Connect came to, in words, read once (Settings shows it
+   * after Hub's redirect; the callback page only flashes by). Never the
+   * token or the code.
+   */
+  lastResult(): { ok: boolean; message: string } | null {
+    const l = this.last;
+    this.last = null;
+    if (!l || this.deps.now() - l.at > CONNECT_TTL_MS) return null;
+    return { ok: l.ok, message: l.message };
+  }
+
+  private last: { ok: boolean; message: string; at: number } | null = null;
+
+  private async finishOnce(q: URLSearchParams): Promise<ConnectResult> {
+    const state = q.get("state") ?? "";
+    const p = this.pending.get(state);
+    this.pending.delete(state);
+    if (!p || this.deps.now() - p.at > CONNECT_TTL_MS)
+      return {
+        ok: false,
+        reason: "expired",
+        message: "That connect link is used or too old: press Connect again.",
+      };
+    if (q.get("error"))
+      return {
+        ok: false,
+        reason: "denied",
+        message:
+          q.get("error") === "access_denied"
+            ? "Not connected: the request was declined on Hub."
+            : "Not connected: Hub didn't finish the connect.",
+      };
+    const code = q.get("code") ?? "";
+    if (!code)
+      return { ok: false, reason: "failed", message: "Hub sent no code back." };
+    let grant: HubGrant;
+    try {
+      grant = await this.deps.exchange(p.hubUrl, {
+        code,
+        redirectUri: p.redirectUri,
+        verifier: p.verifier,
+      });
+    } catch (e) {
+      const m =
+        e instanceof HubCallError &&
+        e.kind === "refused" &&
+        e.code === "invalid_grant"
+          ? "Hub didn't accept the code (used, expired or for another address): press Connect again."
+          : `Hub didn't give a token: ${(e as Error).message}`;
+      return { ok: false, reason: "failed", message: m };
+    }
+    const hubUrl =
+      grant.hubUrl && !hubUrlProblem(grant.hubUrl) ? grant.hubUrl : p.hubUrl;
+    let stored: StoredToken;
+    try {
+      stored = await this.deps.store(grant.token);
+    } catch (e) {
+      // Don't leave a live token nobody can find: revoke it.
+      await this.deps.revoke(hubUrl, grant.token).catch(() => undefined);
+      return {
+        ok: false,
+        reason: "failed",
+        message: `Connected, but the token couldn't be kept here (${(e as Error).message}); it was revoked. Press Connect again.`,
+      };
+    }
+    const user = this.deps.readUser();
+    const hub = {
+      ...((user.hub as Record<string, unknown> | undefined) ?? {}),
+    };
+    hub.url = hubUrl;
+    hub.token = stored.kind === "ref" ? stored.ref : stored.source;
+    if (grant.mcpUrl && !hubUrlProblem(grant.mcpUrl))
+      hub.mcp_url = grant.mcpUrl;
+    else delete hub.mcp_url;
+    this.deps.writeUser({ ...user, hub });
+    return {
+      ok: true,
+      ...(grant.company?.name ? { team: grant.company.name } : {}),
+      where: stored.where,
+    };
+  }
+
+  /**
+   * Step 4: revoke on Hub, then remove it here and clear hub.token (hub.url
+   * stays, so Connect is one click). Hub unreachable: nothing is removed,
+   * so it can be tried again; `force` removes it here anyway and says Hub
+   * still has it.
+   */
+  async disconnect(
+    force = false,
+  ): Promise<
+    | { ok: true; revoked: boolean; message: string }
+    | { ok: false; error: string }
+  > {
+    const cfg = this.deps.config();
+    if (!cfg || (!cfg.tokenRef && !cfg.tokenSource))
+      return { ok: true, revoked: false, message: "Not connected." };
+    const token = await this.deps.readToken(cfg);
+    let revoked = false;
+    let note = "";
+    if (token) {
+      try {
+        revoked = await this.deps.revoke(cfg.url, token);
+        if (!revoked) note = " Hub had already revoked it.";
+      } catch (e) {
+        if (!force)
+          return {
+            ok: false,
+            error: `Hub couldn't revoke the token (${(e as Error).message}). Nothing was removed. Try again, or remove it here anyway.`,
+          };
+        note =
+          " Hub couldn't be reached, so the token still works there until an admin revokes this install.";
+      }
+    }
+    await this.deps.forget(cfg).catch(() => undefined);
+    const user = this.deps.readUser();
+    const hub = {
+      ...((user.hub as Record<string, unknown> | undefined) ?? {}),
+    };
+    delete hub.token;
+    delete hub.mcp_url;
+    if (Object.keys(hub).length) user.hub = hub;
+    else delete user.hub;
+    this.deps.writeUser(user);
+    return {
+      ok: true,
+      revoked,
+      message: `Disconnected.${revoked ? " Hub revoked this install's token." : ""}${note}`,
+    };
+  }
+}
+
+/** The page /hub/callback answers: it moves on to Settings by script. */
+export function callbackPage(
+  title: string,
+  result: { ok: boolean; message: string; reason?: string },
+): string {
+  const next = `/settings?hub=${result.ok ? "connected" : (result.reason ?? "failed")}#agents.hub`;
+  const esc = (s: string) =>
+    s.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="referrer" content="no-referrer"><title>${esc(title)}: Hub</title></head><body style="font:15px system-ui,sans-serif;margin:2rem;max-width:40rem"><p data-hub-result="${result.ok ? "connected" : (result.reason ?? "failed")}">${esc(result.message)}</p><p><a href="${next}">Back to Settings</a></p><script>location.replace(${JSON.stringify(next)})</script></body></html>`;
+}

package/src/ui/server/public/i18n/es.js

@@ -197,6 +197,8 @@
     "lock.note":
       "Den la usa solo para sudo. Los agentes no pueden introducirla.",
     "lock.saved": "Contraseña de administrador guardada para esta sesión",
+    "lock.savedTo":
+      "Contraseña de administrador guardada para esta sesión y en {s}",
     "lock.saveFailed":
       "Guardada para esta sesión, pero no se pudo guardar en {s}: {err}",
     "lock.wrong": "Contraseña incorrecta; inténtalo de nuevo",

package/src/ui/server/public/i18n/ja.js

@@ -186,6 +186,8 @@
     "lock.note":
       "Den はこれを sudo にだけ使います。エージェントは入力できません。",
     "lock.saved": "このセッションの間、管理者パスワードを保持します",
+    "lock.savedTo":
+      "このセッションの間、管理者パスワードを保持し、{s} に保存しました",
     "lock.saveFailed":
       "このセッションの間は保持しますが、{s} への保存に失敗しました: {err}",
     "lock.wrong": "パスワードが違います。もう一度お試しください",