@trolleroof/tui 0.2.5 → 0.2.6

package/overlay-release.json

@@ -1,4 +1,4 @@
 {
-  "tag": "overlay-v0.2.3",
-  "version": "0.2.3"
+  "tag": "overlay-v0.2.6",
+  "version": "0.2.6"
 }

package/package.json

@@ -1,17 +1,39 @@
 {
   "name": "@trolleroof/tui",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "description": "Play familiar single-player games in a lightweight HTML overlay while your agents work.",
   "type": "module",
-  "bin": {
-    "gamepigeon": "./dist/index.js"
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Trolleroof/tui-gamepigeon.git"
   },
+  "homepage": "https://github.com/Trolleroof/tui-gamepigeon#readme",
+  "bugs": {
+    "url": "https://github.com/Trolleroof/tui-gamepigeon/issues"
+  },
+  "keywords": [
+    "arcade",
+    "overlay",
+    "claude-code",
+    "codex",
+    "games"
+  ],
   "files": [
     "dist",
     "scripts",
+    "src",
+    "overlay/dist",
     ".codex-plugin",
+    ".claude-plugin/plugin.json",
     "overlay-release.json"
   ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "bin": {
+    "gamepigeon": "./dist/index.js"
+  },
   "packageManager": "bun@1.3.11",
   "scripts": {
     "start": "bun src/index.ts",
@@ -29,10 +51,11 @@
     "test:overlay": "bun test scripts/overlay.test.ts scripts/plugin-update.test.ts scripts/version-bump.test.ts overlay/session.test.ts overlay/persistence.test.ts overlay/recording.test.ts overlay/renderers.test.ts overlay/motion.test.ts overlay/connect4-layout.test.ts overlay/analytics.test.ts overlay/tauri-bridge.test.ts",
     "test:plugin-update": "bun test scripts/plugin-update.test.ts scripts/run-plugin-update.test.ts",
     "test:launcher": "bun run test:overlay",
+    "test:npm-pack": "bun test scripts/npm-pack.test.ts",
     "typecheck": "tsc --noEmit && tsc -p overlay/tsconfig.json",
     "export:bc": "bun scripts/export-bc.ts",
     "version:bump": "bun scripts/version-bump.ts",
-    "prepack": "bun run build"
+    "prepack": "bun run build && bun run build:overlay:web"
   },
   "engines": {
     "bun": ">=1.3"

package/scripts/install-adapters.sh

@@ -112,7 +112,7 @@ if [[ "$install_codex" == true || "$install_claude" == true ]]; then
     cat > "$target/SKILL.md" <<EOF
 ---
 name: arcade
-description: Open or restore the native GamePigeon HTML overlay while the coding harness works.
+description: Open or restore the native Tui HTML overlay while the coding harness works.
 ---
 
 # Arcade
@@ -125,7 +125,7 @@ Execute this command exactly once:
 
 Do not inspect the user's repository. Do not spawn another agent or task. Do not run any other command.
 
-GamePigeon opens as a borderless HTML overlay without a Dock or taskbar entry. Running Arcade again focuses the existing overlay.
+Tui opens as a borderless HTML overlay without a Dock or taskbar entry. Running Arcade again focuses the existing overlay.
 
 On success, respond only with \`Arcade opened.\`. On failure, relay the launcher's error without attempting another launch method.
 EOF
@@ -137,14 +137,14 @@ if [[ "$install_opencode" == true ]]; then
   mkdir -p "$(dirname "$opencode_command")"
   cat > "$opencode_command" <<EOF
 ---
-description: Open or restore the GamePigeon Arcade overlay
+description: Open or restore the Tui Arcade overlay
 ---
 
 <!-- $MARKER -->
 
 !\`$launcher_command\`
 
-The command opens GamePigeon as a borderless HTML overlay without a Dock or taskbar entry. Running \`/arcade\` again focuses the existing overlay.
+The command opens Tui as a borderless HTML overlay without a Dock or taskbar entry. Running \`/arcade\` again focuses the existing overlay.
 
 Respond only with \`Arcade opened.\` when the launcher succeeds. If its output reports an error, relay that error without attempting another launch method.
 EOF
@@ -166,7 +166,7 @@ if [[ "$install_openclaw" == true ]]; then
   cat > "$OPENCLAW_HOME/hooks/arcade/HOOK.md" <<EOF
 ---
 name: arcade
-description: "Open or restore the GamePigeon Arcade overlay"
+description: "Open or restore the Tui Arcade overlay"
 metadata:
   {
     "openclaw":
@@ -178,7 +178,7 @@ metadata:
   }
 ---
 # Arcade Hook
-This hook manages the GamePigeon Arcade overlay lifecycle.
+This hook manages the Tui Arcade overlay lifecycle.
 EOF
 
   cat > "$OPENCLAW_HOME/hooks/arcade/handler.js" <<EOF

package/scripts/install-adapters.test.sh

@@ -22,7 +22,7 @@ for skill_file in \
   grep -q '^name: arcade$' "$skill_file"
   grep -Fq "bun $ROOT_DIR/scripts/overlay.ts --enable" "$skill_file"
   grep -Fq 'Do not spawn another agent or task.' "$skill_file"
-  grep -Fq 'GamePigeon opens as a borderless HTML overlay' "$skill_file"
+  grep -Fq 'Tui opens as a borderless HTML overlay' "$skill_file"
 done
 
 test -f "$TEMP_DIR/openclaw/hooks/arcade/HOOK.md"
@@ -31,7 +31,7 @@ test -f "$TEMP_DIR/antigravity/.agents/plugins/tui-gamepigeon/plugin.json"
 
 opencode_command="$TEMP_DIR/opencode/commands/arcade.md"
 test -f "$opencode_command"
-grep -q '^description: Open or restore the GamePigeon Arcade overlay$' "$opencode_command"
+grep -q '^description: Open or restore the Tui Arcade overlay$' "$opencode_command"
 grep -Fq "!\`bun $ROOT_DIR/scripts/overlay.ts --enable\`" "$opencode_command"
 grep -Fq 'Running `/arcade` again focuses the existing overlay.' "$opencode_command"
 

package/scripts/materialize-agents-plugin.sh

@@ -19,7 +19,7 @@ cat > "$WORKSPACE_DIR/.agents/plugins/marketplace.json" <<EOF
 {
   "name": "tui-gamepigeon-dev",
   "interface": {
-    "displayName": "GamePigeon (local checkout)"
+    "displayName": "Tui (local checkout)"
   },
   "plugins": [
     {
@@ -40,7 +40,7 @@ EOF
 cat > "$PLUGIN_DIR/skills/arcade/SKILL.md" <<EOF
 ---
 name: arcade
-description: Open or restore the native GamePigeon HTML overlay while the coding harness works.
+description: Open or restore the native Tui HTML overlay while the coding harness works.
 ---
 
 # Arcade
@@ -53,7 +53,7 @@ Execute this command exactly once:
 
 Do not inspect the user's repository. Do not spawn another agent or task. Do not run any other command.
 
-GamePigeon opens as a borderless HTML overlay without a Dock or taskbar entry. Running Arcade again focuses the existing overlay.
+Tui opens as a borderless HTML overlay without a Dock or taskbar entry. Running Arcade again focuses the existing overlay.
 
 On success, respond only with \`Arcade opened.\`. On failure, relay the launcher's error without attempting another launch method.
 EOF

package/scripts/npm-pack.test.ts

@@ -0,0 +1,51 @@
+import { describe, expect, test } from "bun:test";
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+describe("npm pack layout", () => {
+  test("tarball includes overlay web bundle and excludes native build tree", () => {
+    const dir = mkdtempSync(join(tmpdir(), "gamepigeon-pack-list-"));
+    try {
+      const pack = spawnSync("npm", ["pack", "--pack-destination", dir], {
+        encoding: "utf8",
+        cwd: join(import.meta.dir, ".."),
+      });
+      expect(pack.status).toBe(0);
+      const tgz = pack.stdout.trim().split("\n").pop()!;
+      const list = spawnSync("tar", ["-tzf", join(dir, tgz)], { encoding: "utf8" });
+      expect(list.status).toBe(0);
+      const paths = list.stdout.split("\n").filter(Boolean);
+      expect(paths.some((p) => p.includes("package/overlay/dist/"))).toBe(true);
+      // install-adapters.sh generates the Codex/Claude "Arcade" skill as a direct
+      // `bun scripts/overlay.ts --enable` invocation; dist/index.js has no equivalent
+      // flag, so the raw script (and its ../src imports) must ship too.
+      expect(paths.some((p) => p.endsWith("package/scripts/overlay.ts"))).toBe(true);
+      expect(paths.some((p) => p.endsWith("package/dist/index.js"))).toBe(true);
+      expect(paths.some((p) => p.endsWith("package/overlay-release.json"))).toBe(true);
+      expect(paths.some((p) => p.includes("/tauri/"))).toBe(false);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("packed install exposes gamepigeon bin", () => {
+    const dir = mkdtempSync(join(tmpdir(), "gamepigeon-pack-"));
+    try {
+      const pack = spawnSync("npm", ["pack", "--pack-destination", dir], {
+        encoding: "utf8",
+        cwd: join(import.meta.dir, ".."),
+      });
+      expect(pack.status).toBe(0);
+      const tgz = pack.stdout.trim().split("\n").pop()!;
+      const tgzPath = join(dir, tgz);
+      const extract = spawnSync("tar", ["-xzf", tgzPath, "-C", dir], { encoding: "utf8" });
+      expect(extract.status).toBe(0);
+      const pkg = JSON.parse(readFileSync(join(dir, "package", "package.json"), "utf8"));
+      expect(pkg.bin.gamepigeon).toBe("./dist/index.js");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});

package/scripts/overlay.ts

@@ -161,7 +161,7 @@ export function resolveOverlayBinary(root = ROOT_DIR, manifest = readReleaseMani
     if (isLaunchable(candidate)) return candidate;
   }
   throw new Error(
-    "GamePigeon overlay binary was not found. Run `bun run build:overlay` or install a packaged release.",
+    "Tui overlay binary was not found. Run `bun run build:overlay` or install a packaged release.",
   );
 }
 

package/src/analytics/events.test.ts

@@ -0,0 +1,77 @@
+import { describe, expect, it } from "vitest";
+import {
+  ANALYTICS_EVENT_TYPES,
+  createAnalyticsEvent,
+  createAuthAnalyticsEvent,
+} from "./events.js";
+
+describe("analytics CloudEvents contract", () => {
+  it("builds a CloudEvents 1.0 envelope with typed product data", () => {
+    expect(createAnalyticsEvent(
+      ANALYTICS_EVENT_TYPES.gameEnded,
+      {
+        game_type: "2048",
+        variation_id: "classic",
+        outcome: "completed",
+        score: 2048,
+        success: true,
+        duration_ms: 12_000,
+        actions_taken: 42,
+      },
+      {
+        id: "evt_test",
+        subject: "game_test",
+        time: new Date("2026-07-17T12:00:00.000Z"),
+      },
+    )).toEqual({
+      specversion: "1.0",
+      id: "evt_test",
+      source: "/tui-gamepigeon/client",
+      type: "game.ended",
+      time: "2026-07-17T12:00:00.000Z",
+      datacontenttype: "application/json",
+      subject: "game_test",
+      data: {
+        game_type: "2048",
+        variation_id: "classic",
+        outcome: "completed",
+        score: 2048,
+        success: true,
+        duration_ms: 12_000,
+        actions_taken: 42,
+      },
+    });
+  });
+
+  it("keeps application and game-start payloads to their public product fields", () => {
+    const options = { id: "evt_test", time: new Date("2026-07-17T12:00:00.000Z") };
+
+    expect(createAnalyticsEvent(
+      ANALYTICS_EVENT_TYPES.appOpened,
+      { app_version: "0.2.0", platform: "tui" },
+      options,
+    ).data).toEqual({ app_version: "0.2.0", platform: "tui" });
+
+    expect(createAnalyticsEvent(
+      ANALYTICS_EVENT_TYPES.gameStarted,
+      { game_type: "2048", variation_id: "classic" },
+      { ...options, subject: "game_test" },
+    )).toMatchObject({
+      type: "game.started",
+      subject: "game_test",
+      data: { game_type: "2048", variation_id: "classic" },
+    });
+  });
+
+  it("keeps auth events pseudonymous and limited to the sign-in method", () => {
+    expect(createAuthAnalyticsEvent({
+      kind: "signed_in",
+      method: "github",
+      userId: "usr_test",
+    })).toMatchObject({
+      type: "account.signed_in",
+      subject: "usr_test",
+      data: { method: "github" },
+    });
+  });
+});

package/src/analytics/events.ts

@@ -0,0 +1,85 @@
+import { createEventId } from "../recording/ids.js";
+
+export const ANALYTICS_EVENT_TYPES = {
+  appOpened: "app.opened",
+  accountSignedUp: "account.signed_up",
+  accountSignedIn: "account.signed_in",
+  gameStarted: "game.started",
+  gameEnded: "game.ended",
+  pluginLaunched: "plugin.launched",
+  pluginReattached: "plugin.reattached",
+  agentTaskCompleted: "agent.task_completed",
+  siteVisited: "site.visited",
+  referralCreated: "referral.created",
+  referralRedeemed: "referral.redeemed",
+  paymentSucceeded: "payment.succeeded",
+} as const;
+
+export type AnalyticsEventType =
+  (typeof ANALYTICS_EVENT_TYPES)[keyof typeof ANALYTICS_EVENT_TYPES];
+export type AuthMethod = "password" | "google" | "github";
+
+export interface AnalyticsEventDataMap {
+  "app.opened": { app_version: string; platform: "tui" | "overlay" };
+  "account.signed_up": { method: AuthMethod };
+  "account.signed_in": { method: AuthMethod };
+  "game.started": { game_type: string; variation_id: string };
+  "game.ended": {
+    game_type: string;
+    variation_id: string;
+    outcome: "completed" | "abandoned";
+    score: number;
+    success: boolean;
+    duration_ms: number;
+    actions_taken: number;
+  };
+  "plugin.launched": { harness: string };
+  "plugin.reattached": { harness: string };
+  "agent.task_completed": { harness: string };
+  "site.visited": { referrer_host?: string; campaign?: string };
+  "referral.created": { channel?: string };
+  "referral.redeemed": { channel?: string };
+  "payment.succeeded": { plan: string; currency: string; amount_minor: number };
+}
+
+export interface AnalyticsCloudEvent<T extends AnalyticsEventType = AnalyticsEventType> {
+  specversion: "1.0";
+  id: string;
+  source: string;
+  type: T;
+  time: string;
+  datacontenttype: "application/json";
+  subject?: string;
+  data: AnalyticsEventDataMap[T];
+}
+
+export function createAnalyticsEvent<T extends AnalyticsEventType>(
+  type: T,
+  data: AnalyticsEventDataMap[T],
+  options: { id?: string; source?: string; subject?: string; time?: Date } = {},
+): AnalyticsCloudEvent<T> {
+  return {
+    specversion: "1.0",
+    id: options.id ?? createEventId(),
+    source: options.source ?? "/tui-gamepigeon/client",
+    type,
+    time: (options.time ?? new Date()).toISOString(),
+    datacontenttype: "application/json",
+    ...(options.subject ? { subject: options.subject } : {}),
+    data,
+  };
+}
+
+export function createAuthAnalyticsEvent(input: {
+  kind: "signed_up" | "signed_in";
+  method: AuthMethod;
+  userId?: string;
+}): AnalyticsCloudEvent<"account.signed_up" | "account.signed_in"> {
+  return createAnalyticsEvent(
+    input.kind === "signed_up"
+      ? ANALYTICS_EVENT_TYPES.accountSignedUp
+      : ANALYTICS_EVENT_TYPES.accountSignedIn,
+    { method: input.method },
+    { subject: input.userId },
+  );
+}

package/src/analytics/posthog.test.ts

@@ -0,0 +1,85 @@
+import { describe, expect, it } from "vitest";
+import type { PostHog } from "posthog-node";
+import { ANALYTICS_EVENT_TYPES, createAnalyticsEvent } from "./events.js";
+import { Analytics } from "./posthog.js";
+
+type Client = Pick<PostHog, "capture" | "shutdown">;
+
+const gameEnded = createAnalyticsEvent(
+  ANALYTICS_EVENT_TYPES.gameEnded,
+  {
+    game_type: "2048",
+    variation_id: "classic",
+    outcome: "completed",
+    score: 2048,
+    success: true,
+    duration_ms: 12_000,
+    actions_taken: 42,
+  },
+  {
+    id: "evt_test",
+    subject: "game_test",
+    time: new Date("2026-07-17T12:00:00.000Z"),
+  },
+);
+
+describe("PostHog analytics", () => {
+  it("maps a CloudEvent into one PostHog event", () => {
+    const captures: unknown[] = [];
+    const client = {
+      capture: (event: unknown) => { captures.push(event); },
+      shutdown: async () => {},
+    } as Client;
+
+    new Analytics(client, "usr_test").capture(gameEnded);
+
+    expect(captures).toEqual([{
+      distinctId: "usr_test",
+      event: "game.ended",
+      timestamp: new Date("2026-07-17T12:00:00.000Z"),
+      properties: {
+        game_type: "2048",
+        variation_id: "classic",
+        outcome: "completed",
+        score: 2048,
+        success: true,
+        duration_ms: 12_000,
+        actions_taken: 42,
+        $insert_id: "evt_test",
+        cloud_event_id: "evt_test",
+        cloud_event_source: "/tui-gamepigeon/client",
+        cloud_event_specversion: "1.0",
+        cloud_event_datacontenttype: "application/json",
+        cloud_event_subject: "game_test",
+      },
+    }]);
+  });
+
+  it("is a no-op without a configured client", () => {
+    expect(() => new Analytics(null, "usr_test").capture(gameEnded)).not.toThrow();
+  });
+
+  it("does not leak capture failures into gameplay", () => {
+    const client = {
+      capture: () => { throw new Error("offline"); },
+      shutdown: async () => {},
+    } as Client;
+
+    expect(() => new Analytics(client, "usr_test").capture(gameEnded)).not.toThrow();
+  });
+
+  it("uses a newly authenticated user id for later events", () => {
+    const distinctIds: unknown[] = [];
+    const client = {
+      capture: (event: { distinctId?: string }) => { distinctIds.push(event.distinctId); },
+      shutdown: async () => {},
+    } as Client;
+    const instance = new Analytics(client, "device_test");
+
+    instance.capture(gameEnded);
+    instance.setDistinctId("usr_test");
+    instance.capture(gameEnded);
+
+    expect(distinctIds).toEqual(["device_test", "usr_test"]);
+  });
+});

package/src/analytics/posthog.ts

@@ -0,0 +1,88 @@
+import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { PostHog } from "posthog-node";
+import { storedUserId } from "../auth.js";
+import type { AnalyticsCloudEvent } from "./events.js";
+
+/**
+ * Product analytics (DAU / feature usage), separate from the RL trajectory
+ * pipeline in data/trajectory.ts. This never blocks or crashes gameplay —
+ * if there's no API key or a network error, capture() calls are no-ops.
+ */
+
+function createClient(): PostHog | null {
+  const apiKey = process.env.POSTHOG_API_KEY;
+  return apiKey
+    ? new PostHog(apiKey, { host: process.env.POSTHOG_HOST ?? "https://us.i.posthog.com" })
+    : null;
+}
+
+function deviceIdFile(): string {
+  return join(homedir(), ".tui-gamepigeon", "device_id");
+}
+
+function getDeviceId(): string {
+  const file = deviceIdFile();
+  try {
+    if (existsSync(file)) return readFileSync(file, "utf8").trim();
+  } catch {
+    // fall through to generating a fresh id
+  }
+  const id = randomUUID();
+  try {
+    mkdirSync(join(homedir(), ".tui-gamepigeon"), { recursive: true });
+    writeFileSync(file, id);
+  } catch {
+    // best-effort; an in-memory id still works for this process
+  }
+  return id;
+}
+
+export class Analytics {
+  constructor(
+    private client: Pick<PostHog, "capture" | "shutdown"> | null = createClient(),
+    private distinctId = storedUserId() ?? getDeviceId(),
+  ) {}
+
+  setDistinctId(distinctId: string): void {
+    if (distinctId) this.distinctId = distinctId;
+  }
+
+  resetDistinctId(): void {
+    this.distinctId = getDeviceId();
+  }
+
+  capture(event: AnalyticsCloudEvent): void {
+    if (!this.client) return;
+    try {
+      this.client.capture({
+        distinctId: this.distinctId,
+        event: event.type,
+        timestamp: new Date(event.time),
+        properties: {
+          ...event.data,
+          $insert_id: event.id,
+          cloud_event_id: event.id,
+          cloud_event_source: event.source,
+          cloud_event_specversion: event.specversion,
+          cloud_event_datacontenttype: event.datacontenttype,
+          ...(event.subject ? { cloud_event_subject: event.subject } : {}),
+        },
+      });
+    } catch {
+      // analytics must never crash gameplay
+    }
+  }
+
+  async shutdown(): Promise<void> {
+    try {
+      await this.client?.shutdown();
+    } catch {
+      // ignore
+    }
+  }
+}
+
+export const analytics = new Analytics();

package/src/auth-pages.ts

@@ -0,0 +1,108 @@
+// The pages the browser lands on at the end of a sign-in handoff, served by the
+// localhost listener in `auth.ts`. This is the last thing a user sees before
+// returning to the terminal, so it confirms the outcome instead of leaving a
+// bare sentence on a white page.
+//
+// The same design is rendered by `cloudflare/auth-worker/src/handoff-page.ts`
+// and `tauri/src/main.rs`; the three copies exist because they run in three
+// different runtimes. Keep the copy and palette in sync when changing one.
+
+const STYLE = `
+:root{color-scheme:light}
+*{box-sizing:border-box}
+body{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;padding:24px;
+background:radial-gradient(900px 500px at 50% -20%,#fff 0%,#eef2f8 60%,#e3eaf4 100%);color:#0f172a;
+font:15px/1.6 system-ui,-apple-system,"Segoe UI",Roboto,"Helvetica Neue",sans-serif;-webkit-font-smoothing:antialiased}
+.card{position:relative;overflow:hidden;width:min(100%,420px);padding:34px 28px 30px;text-align:center;
+background:#fff;border:1px solid #e2e8f0;border-radius:16px;
+box-shadow:0 20px 50px rgba(15,23,42,.12),0 8px 20px rgba(15,23,42,.06)}
+.card::before{content:"";position:absolute;top:0;left:0;right:0;height:4px;
+background:linear-gradient(90deg,#2955c9 0%,#3772ff 38%,#3bb273 72%,#e6a830 100%)}
+.badge{display:flex;align-items:center;justify-content:center;width:44px;height:44px;margin:0 auto 16px;border-radius:999px}
+.badge svg{width:22px;height:22px}
+[data-tone=ok] .badge{background:rgba(59,178,115,.14);color:#2e8f5c}
+[data-tone=warn] .badge{background:rgba(223,41,53,.12);color:#b81f2a}
+.eyebrow{margin:0 0 6px;font-size:11px;font-weight:600;letter-spacing:.14em;text-transform:uppercase;color:#2955c9}
+h1{margin:0 0 10px;font-size:23px;line-height:1.25;letter-spacing:-.01em}
+.lead{margin:0;color:#475569}
+.steps{margin:18px 0 0;padding:0;list-style:none;text-align:left;border-top:1px solid #e2e8f0}
+.steps li{position:relative;margin:0;padding:10px 0 0 18px;font-size:13.5px;color:#475569}
+.steps li:first-child{padding-top:14px}
+.steps li::before{content:"";position:absolute;left:2px;top:18px;width:5px;height:5px;border-radius:999px;background:#cbd5e1}
+.steps li:first-child::before{top:22px}
+.hint{margin:16px 0 0;font-size:12.5px;color:#64748b}
+code{font:600 12.5px/1.4 ui-monospace,"SF Mono",Menlo,monospace;background:#f3f6fb;border:1px solid #e2e8f0;border-radius:5px;padding:2px 5px;overflow-wrap:anywhere;-webkit-box-decoration-break:clone;box-decoration-break:clone}
+@media (max-width:400px){.card{padding:28px 20px 24px}h1{font-size:21px}}
+`.trim();
+
+const CHECK_ICON =
+  '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M20 6 9 17l-5-5"/></svg>';
+const ALERT_ICON =
+  '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><circle cx="12" cy="12" r="9"/><path d="M12 7.5v5.5"/><path d="M12 16.5h.01"/></svg>';
+
+export function escapeHtml(value: string): string {
+  return value.replace(
+    /[&<>"']/g,
+    (char) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[char]!,
+  );
+}
+
+// `lead` and `steps` are interpolated as trusted HTML so copy can carry <code>
+// spans; the title is escaped. Escape anything request-derived at the call site.
+interface PageOptions {
+  tone: "ok" | "warn";
+  title: string;
+  lead: string;
+  steps?: string[];
+  hint?: string;
+}
+
+/** Renders one self-contained Arcade page — no external CSS, fonts, or images. */
+function arcadePage({ tone, title, lead, steps, hint }: PageOptions): string {
+  const list = steps?.length
+    ? `<ul class="steps">${steps.map((step) => `<li>${step}</li>`).join("")}</ul>`
+    : "";
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex">
+<title>Retro Arcade — ${escapeHtml(title)}</title>
+<style>${STYLE}</style>
+</head>
+<body>
+<main class="card" data-tone="${tone}">
+<span class="badge">${tone === "ok" ? CHECK_ICON : ALERT_ICON}</span>
+<p class="eyebrow">Retro Arcade</p>
+<h1>${escapeHtml(title)}</h1>
+<p class="lead">${lead}</p>
+${list}
+${hint ? `<p class="hint">${hint}</p>` : ""}
+</main>
+</body>
+</html>`;
+}
+
+export function signedInPage(): string {
+  return arcadePage({
+    tone: "ok",
+    title: "You're signed in",
+    lead: "Retro Arcade has your session. You can close this tab and return to your terminal.",
+    hint: "Your session is saved in <code>~/.tui-gamepigeon/auth.json</code>, so you stay signed in next time.",
+  });
+}
+
+/** `reason` is shown verbatim — pass short, already-escaped copy. */
+export function signInFailedPage(reason: string): string {
+  return arcadePage({
+    tone: "warn",
+    title: "Sign-in didn't finish",
+    lead: reason,
+    steps: [
+      "Return to your terminal and run <code>gamepigeon auth login</code> again.",
+      "If the browser blocked the redirect back, allow pop-ups for the Arcade login page.",
+      "Signing in with Google or GitHub? Approve the consent screen rather than closing it.",
+    ],
+  });
+}