@promptbook/cli 0.113.0-9 → 0.114.0-0

package/apps/agents-server/src/app/{admin/code-runners/CodeRunnersClient.tsx → superadmin/harness-auth/HarnessAuthClient.tsx}

@@ -2,19 +2,22 @@
 
 import { Loader2, Save, ServerCog } from 'lucide-react';
 import { useCallback, useEffect, useState } from 'react';
+import type { CodexLoginMethod } from '../../../../../../src/book-3.0/codexLoginMethod';
 import { AdminTerminalCard } from '../../../components/AdminTerminal/AdminTerminalCard';
-import { AdminXtermTerminal } from '../../../components/AdminTerminal/AdminXtermTerminal';
 import { useAdminTerminalSession } from '../../../components/AdminTerminal/useAdminTerminalSession';
 import { Card } from '../../../components/Homepage/Card';
+import { HARNESS_AUTH_API_PATH, HARNESS_AUTHENTICATION_API_PATH } from '../../../constants/harnessAuthRoutes';
+import { OpenAiCodexAuthWizard } from './OpenAiCodexAuthWizard';
 
 /**
- * Code-runner API response.
+ * Harness Auth API response.
  */
-type CodeRunnersResponse = {
-    readonly agent?: string;
+type HarnessAuthResponse = {
+    readonly harness?: string;
     readonly model?: string;
     readonly thinkingLevel?: string;
     readonly status?: string;
+    readonly codexLoginMethod?: CodexLoginMethod | null;
     readonly applyResult?: {
         readonly isAvailable: boolean;
         readonly output: string;
@@ -25,9 +28,9 @@ type CodeRunnersResponse = {
 /**
  * Browser-safe snapshot of one authentication terminal session.
  */
-type CodeRunnerAuthenticationSession = {
+type HarnessAuthenticationSession = {
     readonly id: string;
-    readonly agent: string;
+    readonly harness: string;
     readonly isRunning: boolean;
     readonly output: string;
     readonly startedAt: string;
@@ -37,9 +40,9 @@ type CodeRunnerAuthenticationSession = {
 };
 
 /**
- * Supported runner options shown by the standalone UI.
+ * Supported harness options shown by the standalone UI.
  */
-const RUNNER_OPTIONS = [
+const HARNESS_OPTIONS = [
     { value: 'github-copilot', label: 'GitHub Copilot' },
     { value: 'openai-codex', label: 'OpenAI Codex' },
     { value: 'claude-code', label: 'Claude Code' },
@@ -48,49 +51,88 @@ const RUNNER_OPTIONS = [
 ] as const;
 
 /**
- * Contextual UI copy for the runner authentication terminal.
+ * Contextual UI copy for the harness authentication terminal.
  */
 const AUTHENTICATION_HINTS: Record<string, string> = {
     'github-copilot':
         'Start the terminal, run `/login` if Copilot asks for it, trust the installation directory, and exit the CLI once the signed-in status is shown.',
     'openai-codex':
-        'Start the terminal and follow the Codex CLI login flow there. Paste any prompted device or browser code in your browser, then exit the CLI when authentication succeeds.',
+        'Start the terminal to run `codex login --device-auth`. It prints a verification URL and a one-time code — open the URL in your browser, enter the code, and approve access for your ChatGPT account. The terminal finishes on its own once you are signed in.',
     'claude-code':
         'Start the terminal and complete the Claude Code login or project-trust prompts directly in the embedded terminal, then exit the CLI once it is ready.',
     opencode:
         'Start the terminal and complete the Opencode authentication flow directly there, including any browser/device confirmation, then exit the CLI.',
     gemini:
-        'Start the terminal and complete the Gemini CLI authentication prompts there, then exit the CLI after it confirms that the runner is ready.',
+        'Start the terminal and complete the Gemini CLI authentication prompts there, then exit the CLI after it confirms that the harness is ready.',
 };
 
 /**
- * Shared input styling for code-runner controls.
+ * Shared input styling for harness controls.
  */
 const INPUT_CLASS_NAME =
     'w-full rounded-md border border-gray-300 px-3 py-2 text-sm text-gray-900 shadow-sm focus:border-blue-500 focus:outline-none focus:ring-2 focus:ring-blue-200 disabled:bg-gray-50 disabled:text-gray-500';
 
 /**
- * Client UI for configuring the local coding runner used by durable chats.
+ * Shared plain-output text styling for non-interactive harness command results.
  */
-export function CodeRunnersClient() {
-    const [agent, setAgent] = useState('github-copilot');
+const HARNESS_PLAIN_OUTPUT_TEXT_CLASS_NAME =
+    'whitespace-pre-wrap break-words font-mono text-xs leading-5 text-slate-600';
+
+/**
+ * Props for the non-terminal harness output block.
+ */
+type HarnessPlainOutputBlockProps = {
+    /**
+     * Visible output heading.
+     */
+    readonly title: string;
+
+    /**
+     * Plain output text to show.
+     */
+    readonly output: string;
+
+    /**
+     * Optional max-height and overflow classes for longer output.
+     */
+    readonly outputSizeClassName?: string;
+};
+
+/**
+ * Plain text command output block used when an interactive terminal would be misleading.
+ */
+function HarnessPlainOutputBlock({ title, output, outputSizeClassName = '' }: HarnessPlainOutputBlockProps) {
+    return (
+        <div className="rounded-lg border border-slate-200 bg-slate-50 px-4 py-3">
+            <p className="text-sm font-semibold text-slate-700">{title}</p>
+            <pre className={`mt-2 ${outputSizeClassName} ${HARNESS_PLAIN_OUTPUT_TEXT_CLASS_NAME}`}>{output}</pre>
+        </div>
+    );
+}
+
+/**
+ * Client UI for configuring the local harness used by durable chats.
+ */
+export function HarnessAuthClient() {
+    const [harness, setHarness] = useState('github-copilot');
     const [model, setModel] = useState('gpt-5.4');
     const [thinkingLevel, setThinkingLevel] = useState('xhigh');
     const [status, setStatus] = useState('');
+    const [codexLoginMethod, setCodexLoginMethod] = useState<CodexLoginMethod | null>(null);
     const [isLoading, setIsLoading] = useState(true);
     const [isSaving, setIsSaving] = useState(false);
     const [configurationErrorMessage, setConfigurationErrorMessage] = useState<string | null>(null);
     const [configurationSuccessMessage, setConfigurationSuccessMessage] = useState<string | null>(null);
     const [applyOutput, setApplyOutput] = useState<string | null>(null);
-    const authenticationTerminal = useAdminTerminalSession<CodeRunnerAuthenticationSession>({
-        basePath: '/api/admin/code-runners/authentication',
+    const authenticationTerminal = useAdminTerminalSession<HarnessAuthenticationSession>({
+        basePath: HARNESS_AUTHENTICATION_API_PATH,
         loadErrorMessage: 'Failed to load the authentication session.',
         startErrorMessage: 'Failed to start the authentication session.',
         sendErrorMessage: 'Failed to send authentication input.',
         stopErrorMessage: 'Failed to stop the authentication session.',
-        startSuccessMessage: 'Runner authentication terminal started.',
-        finishSuccessMessage: 'Runner authentication finished.',
-        finishErrorMessage: 'Runner authentication session ended with an error.',
+        startSuccessMessage: 'Harness authentication terminal started.',
+        finishSuccessMessage: 'Harness authentication finished.',
+        finishErrorMessage: 'Harness authentication session ended with an error.',
     });
     const {
         session: authenticationSession,
@@ -106,35 +148,36 @@ export function CodeRunnersClient() {
         stopSession: stopAuthenticationSession,
     } = authenticationTerminal;
     const authenticationHint =
-        AUTHENTICATION_HINTS[agent] ||
-        'Start the terminal, complete the runner authentication flow there, and exit the CLI when the runner is ready.';
+        AUTHENTICATION_HINTS[harness] ||
+        'Start the terminal, complete the harness authentication flow there, and exit the CLI when the harness is ready.';
     const errorMessage = configurationErrorMessage ?? authenticationErrorMessage;
     const successMessage = configurationSuccessMessage ?? authenticationSuccessMessage;
 
     /**
-     * Loads current code-runner settings.
+     * Loads current harness settings.
      */
     const loadConfiguration = useCallback(async (): Promise<void> => {
         try {
             setIsLoading(true);
             setConfigurationErrorMessage(null);
 
-            const response = await fetch('/api/admin/code-runners', { cache: 'no-store' });
-            const payload = (await response.json()) as CodeRunnersResponse;
+            const response = await fetch(HARNESS_AUTH_API_PATH, { cache: 'no-store' });
+            const payload = (await response.json()) as HarnessAuthResponse;
 
             if (!response.ok) {
-                throw new Error(payload.error || 'Failed to load code-runner configuration.');
+                throw new Error(payload.error || 'Failed to load harness configuration.');
             }
 
-            setAgent(payload.agent || 'github-copilot');
+            setHarness(payload.harness || 'github-copilot');
             setModel(payload.model || 'gpt-5.4');
             setThinkingLevel(payload.thinkingLevel || 'xhigh');
             setStatus(payload.status || '');
+            setCodexLoginMethod(payload.codexLoginMethod ?? null);
 
             await loadAuthenticationSession();
         } catch (error) {
             setConfigurationErrorMessage(
-                error instanceof Error ? error.message : 'Failed to load code-runner configuration.',
+                error instanceof Error ? error.message : 'Failed to load harness configuration.',
             );
         } finally {
             setIsLoading(false);
@@ -154,7 +197,7 @@ export function CodeRunnersClient() {
     }, [authenticationSession?.finishedAt, loadConfiguration]);
 
     /**
-     * Saves code-runner settings into `.env`.
+     * Saves harness settings into `.env`.
      */
     async function saveConfiguration(applyRuntimeConfiguration: boolean): Promise<void> {
         try {
@@ -164,32 +207,33 @@ export function CodeRunnersClient() {
             clearAuthenticationMessages();
             setApplyOutput(null);
 
-            const response = await fetch('/api/admin/code-runners', {
+            const response = await fetch(HARNESS_AUTH_API_PATH, {
                 method: 'PATCH',
                 headers: {
                     'Content-Type': 'application/json',
                 },
-                body: JSON.stringify({ agent, model, thinkingLevel, applyRuntimeConfiguration }),
+                body: JSON.stringify({ harness, model, thinkingLevel, applyRuntimeConfiguration }),
             });
-            const payload = (await response.json()) as CodeRunnersResponse;
+            const payload = (await response.json()) as HarnessAuthResponse;
 
             if (!response.ok) {
-                throw new Error(payload.error || 'Failed to save code-runner configuration.');
+                throw new Error(payload.error || 'Failed to save harness configuration.');
             }
 
-            setAgent(payload.agent || agent);
+            setHarness(payload.harness || harness);
             setModel(payload.model || model);
             setThinkingLevel(payload.thinkingLevel || thinkingLevel);
             setStatus(payload.status || '');
+            setCodexLoginMethod(payload.codexLoginMethod ?? null);
             setApplyOutput(payload.applyResult?.output || null);
             setConfigurationSuccessMessage(
                 applyRuntimeConfiguration
-                    ? 'Code-runner configuration was saved and applied.'
-                    : 'Code-runner configuration was saved.',
+                    ? 'Harness configuration was saved and applied.'
+                    : 'Harness configuration was saved.',
             );
         } catch (error) {
             setConfigurationErrorMessage(
-                error instanceof Error ? error.message : 'Failed to save code-runner configuration.',
+                error instanceof Error ? error.message : 'Failed to save harness configuration.',
             );
         } finally {
             setIsSaving(false);
@@ -199,9 +243,10 @@ export function CodeRunnersClient() {
     return (
         <div className="container mx-auto space-y-6 px-4 py-8">
             <div className="mt-20">
-                <h1 className="text-3xl font-light text-gray-900">Code runners</h1>
+                <h1 className="text-3xl font-light text-gray-900">Harness Auth</h1>
                 <p className="mt-1 text-sm text-gray-500">
-                    Configure the local runner used by the standalone Agents Server durable chat worker.
+                    Configure the harness used by the standalone Agents Server durable chat worker and sign in to
+                    subscription-backed CLIs such as OpenAI Codex.
                 </p>
             </div>
 
@@ -219,14 +264,14 @@ export function CodeRunnersClient() {
             <Card className="hover:border-gray-200 hover:shadow-md">
                 <div className="grid gap-5 md:grid-cols-3">
                     <label className="space-y-2">
-                        <span className="text-sm font-semibold text-slate-700">Runner</span>
+                        <span className="text-sm font-semibold text-slate-700">Harness</span>
                         <select
-                            value={agent}
-                            onChange={(event) => setAgent(event.target.value)}
+                            value={harness}
+                            onChange={(event) => setHarness(event.target.value)}
                             disabled={isLoading || isSaving || isStartingAuthentication}
                             className={INPUT_CLASS_NAME}
                         >
-                            {RUNNER_OPTIONS.map((option) => (
+                            {HARNESS_OPTIONS.map((option) => (
                                 <option key={option.value} value={option.value}>
                                     {option.label}
                                 </option>
@@ -263,7 +308,7 @@ export function CodeRunnersClient() {
                         className="inline-flex items-center gap-2 rounded-md bg-blue-600 px-4 py-2 text-sm font-semibold text-white hover:bg-blue-700 disabled:cursor-not-allowed disabled:opacity-60"
                     >
                         {isSaving ? <Loader2 className="h-4 w-4 animate-spin" /> : <Save className="h-4 w-4" />}
-                        Save runner
+                        Save harness
                     </button>
                     <button
                         type="button"
@@ -272,26 +317,31 @@ export function CodeRunnersClient() {
                         className="inline-flex items-center gap-2 rounded-md border border-slate-300 bg-white px-4 py-2 text-sm font-semibold text-slate-700 hover:bg-slate-50 disabled:cursor-not-allowed disabled:opacity-60"
                     >
                         {isSaving ? <Loader2 className="h-4 w-4 animate-spin" /> : <ServerCog className="h-4 w-4" />}
-                        Save and apply runner
+                        Save and apply harness
                     </button>
                 </div>
+
+                <div className="mt-6">
+                    <HarnessPlainOutputBlock
+                        title="Harness status"
+                        output={status || 'Harness status was not available.'}
+                    />
+                </div>
             </Card>
 
             {applyOutput ? (
-                <AdminXtermTerminal
-                    terminalId="code-runner-apply-output"
+                <HarnessPlainOutputBlock
+                    title="Harness apply output"
                     output={applyOutput}
-                    emptyState="No apply output returned."
-                    isReadOnly
-                    isPlainTextOutput
-                    heightClassName="h-72"
-                    ariaLabel="Code-runner apply output"
+                    outputSizeClassName="max-h-72 overflow-auto"
                 />
             ) : null}
 
+            {harness === 'openai-codex' ? <OpenAiCodexAuthWizard codexLoginMethod={codexLoginMethod} /> : null}
+
             <AdminTerminalCard
                 title="Authentication"
-                description="Save runner changes first if you want to authenticate a different CLI, then start the saved-runner terminal here instead of SSHing into the VPS."
+                description="Save harness changes first if you want to authenticate a different CLI, then start the saved-harness terminal here instead of SSHing into the VPS."
                 hint={authenticationHint}
                 session={authenticationSession}
                 onStart={() => void startAuthenticationSession()}
@@ -301,23 +351,14 @@ export function CodeRunnersClient() {
                 isStarting={isStartingAuthentication}
                 isSending={isSendingAuthenticationInput}
                 isStopping={isStoppingAuthentication}
-                startLabel="Authenticate saved runner"
+                startLabel="Authenticate saved harness"
                 runningLabel="Authentication running"
                 stopLabel="Stop terminal"
                 outputLabel="Live authentication terminal"
-                outputEmptyState="No authentication session output yet. Start the saved-runner terminal to see the live authentication log here."
+                outputEmptyState="No authentication session output yet. Start the saved-harness terminal to see the live authentication log here."
+                isOutputVisible={Boolean(authenticationSession?.isRunning)}
                 quickActions={[{ label: 'Send Enter', input: '\n' }]}
-            >
-                <AdminXtermTerminal
-                    terminalId="code-runner-status"
-                    output={status || 'Runner status was not available.'}
-                    emptyState="Runner status was not available."
-                    isReadOnly
-                    isPlainTextOutput
-                    heightClassName="h-64"
-                    ariaLabel="Runner status"
-                />
-            </AdminTerminalCard>
+            />
         </div>
     );
 }

package/apps/agents-server/src/app/superadmin/harness-auth/OpenAiCodexAuthWizard.tsx

@@ -0,0 +1,208 @@
+'use client';
+
+import { KeyRound, ListChecks, Sparkles } from 'lucide-react';
+import type { CodexLoginMethod } from '../../../../../../src/book-3.0/codexLoginMethod';
+import { Card } from '../../../components/Homepage/Card';
+
+/**
+ * Props for the OpenAI Codex authentication wizard.
+ */
+type OpenAiCodexAuthWizardProps = {
+    /**
+     * Login method OpenAI Codex currently uses, or `null` while it is still being resolved.
+     */
+    readonly codexLoginMethod: CodexLoginMethod | null;
+};
+
+/**
+ * One OpenAI Codex authentication option explained to the admin.
+ */
+type CodexAuthenticationOption = {
+    /**
+     * Login method this option represents.
+     */
+    readonly method: CodexLoginMethod;
+
+    /**
+     * Short option title, also reused as the "currently used" badge label.
+     */
+    readonly title: string;
+
+    /**
+     * Whether this option is the recommended one.
+     */
+    readonly isRecommended: boolean;
+
+    /**
+     * Longer explanation of how the option authenticates and how it is billed.
+     */
+    readonly description: string;
+};
+
+/**
+ * The two ways the OpenAI Codex harness can authenticate, shown side by side so the admin understands
+ * the difference between the ChatGPT subscription and the OpenAI API key.
+ */
+const CODEX_AUTHENTICATION_OPTIONS: ReadonlyArray<CodexAuthenticationOption> = [
+    {
+        method: 'chatgpt',
+        title: 'ChatGPT subscription',
+        isRecommended: true,
+        description:
+            'Uses the ChatGPT account (Plus, Pro, Business, or Enterprise) that you sign in below. The quota included in that subscription is used and there are no per-token OpenAI API charges. It needs a one-time interactive sign-in with "codex login --device-auth".',
+    },
+    {
+        method: 'api',
+        title: 'OpenAI API key',
+        isRecommended: false,
+        description:
+            'Uses the OPENAI_API_KEY environment variable. OpenAI Codex is then billed per token through the OpenAI API. No interactive sign-in is needed — just set OPENAI_API_KEY on the Environment variables page.',
+    },
+];
+
+/**
+ * Step-by-step instructions that walk an admin who has never done it through the device sign-in.
+ */
+const CODEX_AUTHENTICATION_STEPS: ReadonlyArray<string> = [
+    'Make sure OpenAI Codex is selected as the harness above and saved.',
+    'Click "Authenticate saved harness" below to run "codex login --device-auth" in the terminal.',
+    'Wait for the terminal to print a verification URL and a short one-time code.',
+    'Open that URL in your browser, sign in to ChatGPT, enter the code, and approve access.',
+    'When the terminal reports success it closes on its own; this page then shows ChatGPT subscription as the current method.',
+];
+
+/**
+ * Guided wizard that explains OpenAI Codex authentication, shows which method is currently used, and
+ * walks the admin through signing in with the ChatGPT subscription via `codex login --device-auth`.
+ */
+export function OpenAiCodexAuthWizard({ codexLoginMethod }: OpenAiCodexAuthWizardProps) {
+    const activeOption = CODEX_AUTHENTICATION_OPTIONS.find((option) => option.method === codexLoginMethod) ?? null;
+
+    return (
+        <Card className="hover:border-gray-200 hover:shadow-md">
+            <div className="space-y-6">
+                <div className="space-y-2">
+                    <h2 className="text-lg font-semibold text-slate-900">Sign in to OpenAI Codex</h2>
+                    <p className="text-sm text-slate-600">
+                        The OpenAI Codex harness can run either on your ChatGPT subscription or on an OpenAI API key.
+                        Sign in below to use the subscription instead of paying per token.
+                    </p>
+                </div>
+
+                <div className="flex flex-wrap items-center gap-2">
+                    <span className="text-sm font-semibold text-slate-700">Currently used:</span>
+                    <CodexCurrentMethodBadge activeOption={activeOption} />
+                </div>
+
+                <div className="grid gap-4 md:grid-cols-2">
+                    {CODEX_AUTHENTICATION_OPTIONS.map((option) => (
+                        <CodexAuthenticationOptionCard
+                            key={option.method}
+                            option={option}
+                            isActive={option.method === codexLoginMethod}
+                        />
+                    ))}
+                </div>
+
+                <div className="rounded-lg border border-slate-200 bg-slate-50 px-4 py-3">
+                    <div className="flex items-center gap-2">
+                        <ListChecks className="h-4 w-4 text-slate-500" />
+                        <p className="text-sm font-semibold text-slate-700">
+                            How to sign in with your ChatGPT subscription
+                        </p>
+                    </div>
+                    <ol className="mt-3 list-decimal space-y-1 pl-6 text-sm text-slate-600">
+                        {CODEX_AUTHENTICATION_STEPS.map((step) => (
+                            <li key={step}>{step}</li>
+                        ))}
+                    </ol>
+                </div>
+            </div>
+        </Card>
+    );
+}
+
+/**
+ * Props for the current-method badge.
+ */
+type CodexCurrentMethodBadgeProps = {
+    /**
+     * Currently active authentication option, or `null` when Codex is not signed in.
+     */
+    readonly activeOption: CodexAuthenticationOption | null;
+};
+
+/**
+ * Small colored badge that names the OpenAI Codex authentication method currently in use.
+ */
+function CodexCurrentMethodBadge({ activeOption }: CodexCurrentMethodBadgeProps) {
+    if (!activeOption) {
+        return (
+            <span className="inline-flex items-center rounded-full border border-slate-300 bg-slate-100 px-3 py-1 text-xs font-semibold text-slate-600">
+                Not signed in
+            </span>
+        );
+    }
+
+    if (activeOption.method === 'chatgpt') {
+        return (
+            <span className="inline-flex items-center gap-1 rounded-full border border-emerald-200 bg-emerald-50 px-3 py-1 text-xs font-semibold text-emerald-700">
+                <Sparkles className="h-3.5 w-3.5" />
+                {activeOption.title}
+            </span>
+        );
+    }
+
+    return (
+        <span className="inline-flex items-center gap-1 rounded-full border border-amber-200 bg-amber-50 px-3 py-1 text-xs font-semibold text-amber-700">
+            <KeyRound className="h-3.5 w-3.5" />
+            {activeOption.title}
+        </span>
+    );
+}
+
+/**
+ * Props for one explained authentication option card.
+ */
+type CodexAuthenticationOptionCardProps = {
+    /**
+     * Option to render.
+     */
+    readonly option: CodexAuthenticationOption;
+
+    /**
+     * Whether this option is the one currently in use.
+     */
+    readonly isActive: boolean;
+};
+
+/**
+ * One explanation card describing an OpenAI Codex authentication option, highlighted when it is active.
+ */
+function CodexAuthenticationOptionCard({ option, isActive }: CodexAuthenticationOptionCardProps) {
+    const Icon = option.method === 'chatgpt' ? Sparkles : KeyRound;
+
+    return (
+        <div
+            className={`rounded-lg border px-4 py-3 ${
+                isActive ? 'border-blue-300 bg-blue-50' : 'border-slate-200 bg-white'
+            }`}
+        >
+            <div className="flex items-center gap-2">
+                <Icon className="h-4 w-4 text-slate-500" />
+                <p className="text-sm font-semibold text-slate-800">{option.title}</p>
+                {option.isRecommended ? (
+                    <span className="inline-flex items-center rounded-full bg-emerald-100 px-2 py-0.5 text-xs font-semibold text-emerald-700">
+                        Recommended
+                    </span>
+                ) : null}
+                {isActive ? (
+                    <span className="inline-flex items-center rounded-full bg-blue-100 px-2 py-0.5 text-xs font-semibold text-blue-700">
+                        In use
+                    </span>
+                ) : null}
+            </div>
+            <p className="mt-2 text-sm text-slate-600">{option.description}</p>
+        </div>
+    );
+}

package/apps/agents-server/src/app/{admin/code-runners → superadmin/harness-auth}/page.tsx

@@ -1,14 +1,14 @@
 import { ForbiddenPage } from '../../../components/ForbiddenPage/ForbiddenPage';
 import { isUserGlobalAdmin } from '../../../utils/isUserGlobalAdmin';
-import { CodeRunnersClient } from './CodeRunnersClient';
+import { HarnessAuthClient } from './HarnessAuthClient';
 
 /**
- * Super-admin page for configuring standalone code runners.
+ * Super-admin page for configuring standalone harness authentication.
  */
-export default async function CodeRunnersPage() {
+export default async function HarnessAuthPage() {
     if (!(await isUserGlobalAdmin())) {
         return <ForbiddenPage />;
     }
 
-    return <CodeRunnersClient />;
+    return <HarnessAuthClient />;
 }

package/apps/agents-server/src/app/superadmin/internal-s3/page.tsx

@@ -0,0 +1,53 @@
+import { redirect } from 'next/navigation';
+
+/**
+ * Forces legacy super-admin storage links to resolve on every request.
+ */
+export const dynamic = 'force-dynamic';
+
+/**
+ * Canonical internal S3 route.
+ *
+ * @private legacy route helper of `/superadmin/internal-s3`
+ */
+const INTERNAL_S3_ADMIN_ROUTE = '/admin/internal-s3';
+
+/**
+ * Props accepted by the legacy internal S3 route.
+ *
+ * @private route props of `/superadmin/internal-s3`
+ */
+type LegacyInternalS3PageProps = {
+    /**
+     * Query parameters forwarded to the canonical browser route.
+     */
+    readonly searchParams?: Promise<{
+        readonly prefix?: string;
+    }>;
+};
+
+/**
+ * Redirects the previous internal S3 page to its canonical admin route.
+ */
+export default async function LegacyInternalS3Page({ searchParams }: LegacyInternalS3PageProps) {
+    const resolvedSearchParams = await searchParams;
+
+    redirect(buildLegacyInternalS3RedirectHref(resolvedSearchParams?.prefix));
+}
+
+/**
+ * Builds the canonical redirect target for the legacy route.
+ *
+ * @param prefix - Optional browser prefix to preserve.
+ * @returns Canonical internal S3 route href.
+ * @private legacy route helper of `/superadmin/internal-s3`
+ */
+function buildLegacyInternalS3RedirectHref(prefix: string | undefined): string {
+    if (!prefix) {
+        return INTERNAL_S3_ADMIN_ROUTE;
+    }
+
+    const searchParams = new URLSearchParams();
+    searchParams.set('prefix', prefix);
+    return `${INTERNAL_S3_ADMIN_ROUTE}?${searchParams.toString()}`;
+}

package/apps/agents-server/src/app/superadmin/loading.tsx

@@ -0,0 +1,14 @@
+import { ConsolePageLoadingSkeleton } from '../../components/Skeleton/ConsolePageLoadingSkeleton';
+
+/**
+ * Renders the shared admin control-panel skeleton while super-admin routes stream.
+ */
+export default function Loading() {
+    return (
+        <ConsolePageLoadingSkeleton
+            ariaLabel="Loading super administration"
+            showSummaryCards={true}
+            showFiltersCard={true}
+        />
+    );
+}