@panguard-ai/panguard-guard 1.8.8 → 1.8.9

package/dist/dashboard/dashboard.html

@@ -2606,22 +2606,45 @@
           t.classList.remove('show');
         }, 2500);
       }
-      function af(path, opts) {
+      function af(path, opts, _retriesLeft) {
         opts = opts || {};
         opts.credentials = 'same-origin';
         return fetch(path, opts).then(function (r) {
           if (r.status === 401) {
+            // A 401 is rejected at the auth gate BEFORE the handler runs, so the
+            // request had no side effect and is safe to retry. A proxying or
+            // embedded browser (and some cross-origin isolation modes) can drop
+            // the HttpOnly SameSite=Strict launch cookie mid-flight, so a single
+            // /api call 401s even though the session is valid — the next one
+            // succeeds. Overview hid this by polling; a one-shot tab load (Rules,
+            // Skills, Coverage, Runtime, Settings) did NOT — it failed to empty on
+            // the first flap. So retry a few times before declaring the dashboard
+            // unauthenticated; a genuinely bad/absent token still 401s every retry
+            // and falls through to the overlay.
+            var left = _retriesLeft === undefined ? 4 : _retriesLeft;
+            if (left > 0) {
+              return new Promise(function (resolve) {
+                setTimeout(function () {
+                  resolve(af(path, opts, left - 1));
+                }, 250);
+              });
+            }
             var wl = document.getElementById('wl');
             if (wl) wl.textContent = 'Invalid token';
-            // An unauthenticated visit (bare URL, expired/cleared cookie, wrong
-            // token) used to silently no-op and leave a static green "Active"
-            // badge — a dead end with no path forward. Render an explicit screen
-            // that tells the user exactly how to get an authenticated URL.
             showUnauthenticated();
+            return r;
           }
+          // A real success proves the session IS authenticated — clear any overlay
+          // a transient 401 flap put up, so the dashboard heals itself.
+          if (r.ok && _unauthShown) hideUnauthenticated();
           return r;
         });
       }
+      function hideUnauthenticated() {
+        _unauthShown = false;
+        var ov = document.getElementById('unauth-overlay');
+        if (ov) ov.style.display = 'none';
+      }
       /* Explicit unauthenticated state: the cookie that authorizes /api/* is
          minted only by opening the launch URL `pga up` prints. A bare visit has
          no cookie, so every /api/* call 401s. Instead of a fake-green dead end,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@panguard-ai/panguard-guard",
-  "version": "1.8.8",
+  "version": "1.8.9",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -46,13 +46,13 @@
     "js-yaml": "^4.1.0",
     "ws": "^8.21.0",
     "zod": "^3.24.0",
-    "@panguard-ai/core": "1.8.8",
-    "@panguard-ai/panguard-mcp": "1.8.8",
-    "@panguard-ai/panguard-skill-auditor": "1.8.8",
-    "@panguard-ai/panguard-trap": "1.8.8",
-    "@panguard-ai/security-hardening": "1.8.8",
-    "@panguard-ai/scan-core": "1.8.8",
-    "@panguard-ai/atr": "1.8.8"
+    "@panguard-ai/atr": "1.8.9",
+    "@panguard-ai/core": "1.8.9",
+    "@panguard-ai/panguard-trap": "1.8.9",
+    "@panguard-ai/panguard-skill-auditor": "1.8.9",
+    "@panguard-ai/scan-core": "1.8.9",
+    "@panguard-ai/panguard-mcp": "1.8.9",
+    "@panguard-ai/security-hardening": "1.8.9"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",