@zq-silk/yui 2.14.0 → 2.15.0

package/dist/config/configCatalog.js

@@ -8,7 +8,7 @@ export const CONFIG_DOMAINS = ["system", "runtime", "workflow", "resources", "to
 export const CONFIG_DEFINITIONS = Object.freeze([
     { key: "default-agent", domain: "system", property: "defaultAgent", label: "Default Agent", summary: "Configured Agent used when a Task or Role does not select one explicitly.", takesEffect: "Future Role and Task defaults; existing bindings are unchanged." },
     { key: "default-workspace", domain: "system", property: "defaultWorkspace", label: "Default workspace", summary: "Absolute workspace root outside YUI_HOME used when no workspace is selected.", takesEffect: "Future workspace selection; existing Roles and worktrees are unchanged." },
-    { key: "time-zone", domain: "system", property: "timeZone", label: "Time zone", summary: "IANA timezone for human-facing timestamps (default: Asia/Shanghai).", takesEffect: "The next human-readable timestamp rendering; durable JSON remains UTC." },
+    { key: "time-zone", domain: "system", property: "timeZone", label: "Time zone", summary: "IANA timezone for human-facing timestamps and new default Project sync plans (default: Asia/Shanghai).", takesEffect: "The next human-readable timestamp rendering and newly installed Project sync plans; existing Schedule rules stay unchanged and durable timestamps remain UTC." },
     { key: "reconciliation-interval-seconds", domain: "runtime", property: "reconciliationIntervalSeconds", label: "Reconciliation interval", summary: "Recovery reconciliation interval, 5-300 seconds (default: 120).", takesEffect: "The running Controller is refreshed after the value is saved." },
     { key: "controller-task-concurrency", domain: "runtime", property: "controllerTaskConcurrency", label: "Controller Task concurrency", summary: "Maximum Tasks reconciled concurrently, 1-32 (default: 4).", takesEffect: "After the Controller restarts." },
     { key: "runtime-health", domain: "runtime", property: "runtimeHealth", label: "Runtime health thresholds", summary: "Quiet, checkpoint-overdue, and read-only diagnostic thresholds in seconds; values must be strictly increasing (defaults: 300/900/1800).", takesEffect: "CLI and Web projections immediately; scheduler diagnostics after the Controller restarts." },

package/dist/controlPlaneCli.js

@@ -689,7 +689,7 @@ export async function main() {
             const describe = (status) => status
                 ? `Web listener: ${status.state}\n`
                     + (status.alreadyRunning ? "Existing listener reused; credentials were not reloaded.\n" : "")
-                    + (status.authentication === "basic" ? "Browser authentication: username yui; use the password from your private credential file.\n" : "")
+                    + (status.authentication === "password" ? "Browser sign-in: open the URL and enter the password from your private credential file on the Yui sign-in page.\n" : "")
                     + (status.urls ?? []).map(url => `Yui web control room: ${url}\n`).join("")
                     + (status.warnings ?? []).map(warning => `Warning: ${warning}\n`).join("")
                 : "Web is not running. Start it explicitly; Controller recovery does not restore listeners.\n";

package/dist/job/projectSync.js

@@ -7,9 +7,9 @@ import { requireRefreshProject, projectRefreshTargetDigest } from "../repository
 import { createJobDefinition, reviseJobDefinition, validateJobDefinition } from "./jobDefinition.js";
 import { nextScheduleDue, validateScheduleRule } from "../schedule/schedule.js";
 import { scheduleServiceBinding } from "./scheduleService.js";
+import { resolveTimeZone } from "../config/timeZone.js";
 const scope = { kind: "global" };
 const unavailable = "Project sync unavailable: ";
-export const PROJECT_SYNC_INTERVAL_MS = 6 * 60 * 60_000;
 /** Called under the maintenance lock immediately before Git, not a timer probe. */
 export function requireProjectSyncCheckout(store, job) {
     requireProjectSyncTarget(store, job);
@@ -86,8 +86,8 @@ export function reconcileProjectSync(store, now, onError = () => { }) {
                     reason = unavailable + (error instanceof Error ? error.message : String(error));
                 }
                 if (!plan) {
-                    const rule = { kind: "interval", anchor: new Date(now.getTime() + PROJECT_SYNC_INTERVAL_MS).toISOString(),
-                        everyMs: PROJECT_SYNC_INTERVAL_MS };
+                    const rule = { kind: "cron", expression: "0 */6 * * *",
+                        timezone: resolveTimeZone(tx.getConfig().timeZone) };
                     const grantId = randomUUID();
                     plan = { schemaVersion: 1, id, scope, jobId: id, target: { kind: "existing-job" }, rule,
                         builtin: { projectId, enabled: true }, revision: 1, generation: 1,

package/dist/storage/sqliteSchema.js

@@ -10,6 +10,7 @@ import { GLOBAL_SESSION_TABLE_SQL, SESSION_HISTORY_UPGRADE_SQL } from "./session
 import { migrateJobDefinitions } from "./upgrade/jobDefinitionMigration.js";
 import { migrateJobBusinessResults } from "./upgrade/jobBusinessResultMigration.js";
 import { migrateScheduleDispatch } from "./upgrade/scheduleDispatchMigration.js";
+import { migrateProjectSyncClock } from "./upgrade/projectSyncClockMigration.js";
 import { CURRENT_STORAGE_VERSION, MIN_SUPPORTED_STORAGE_VERSION, STORAGE_FORMAT, isMinorStorageUpgrade, isStorageVersion, storageVersionParts } from "./storageVersions.js";
 export { BASELINE_SCHEMA_SQL };
 export const SQLITE_SCHEMA_TABLES = [...BASELINE_SCHEMA_TABLES, "job_definitions", "global_job_runs", "schedules", "agent_job_runs"];
@@ -233,6 +234,15 @@ const MINOR_UPGRADES = Object.freeze([{
         // Existing records and immutable artifacts remain byte-for-byte unchanged.
         // Declares Agent definitions/Runs and optional Job ownership of a non-Task Role.
         sql: AGENT_JOB_SCHEMA_SQL
+    }, {
+        fromVersion: "1.20",
+        toVersion: "1.21",
+        name: "project-sync-clock",
+        introducedIn: "next",
+        sourceChecksum: CURRENT_SCHEMA_CHECKSUM,
+        targetChecksum: CURRENT_SCHEMA_CHECKSUM,
+        sql: "",
+        dataMigration: "project-sync-clock"
     }]);
 export function storageMinorUpgradePlan(from) {
     if (from === CURRENT_STORAGE_VERSION)
@@ -363,6 +373,8 @@ export function applySqliteMinorUpgrades(db, home, createdRoots = []) {
                 migrateJobBusinessResults(db);
             if (step.dataMigration === "schedule-dispatch")
                 migrateScheduleDispatch(db);
+            if (step.dataMigration === "project-sync-clock")
+                migrateProjectSyncClock(db);
             const { major, minor } = storageVersionParts(step.toVersion);
             db.prepare("UPDATE storage_schema SET major=?,minor=?,checksum=? WHERE id=1")
                 .run(major, minor, step.targetChecksum);

package/dist/storage/storageVersions.js

@@ -1,4 +1,4 @@
-export const CURRENT_STORAGE_VERSION = "1.20";
+export const CURRENT_STORAGE_VERSION = "1.21";
 export const MIN_SUPPORTED_STORAGE_VERSION = "1.0";
 export const STORAGE_FORMAT = "yui-home";
 export function isStorageVersion(value) {

package/dist/storage/upgrade/projectSyncClockMigration.js

@@ -0,0 +1,30 @@
+import { resolveTimeZone } from "../../config/timeZone.js";
+import { nextScheduleDue, validateSchedule } from "../../schedule/schedule.js";
+/** 1.20 had no rule-edit provenance. Only revision 1 proves no user mutation.
+ * Higher revisions may be dispatch, recovery OR an equal-valued user edit;
+ * preserve them instead of guessing from interval values or generation.
+ */
+export function migrateProjectSyncClock(db) {
+    const now = new Date();
+    const rows = db.prepare("SELECT rowid,scope_key,schedule_id,payload FROM schedules").all();
+    for (const row of rows) {
+        const old = JSON.parse(row.payload);
+        if (!old.builtin || old.revision !== 1)
+            continue;
+        validateSchedule(old);
+        // Confirm the declared install shape, in addition to the mutation evidence.
+        if (old.generation !== 1 || old.rule.kind !== "interval" || old.rule.everyMs !== 21_600_000
+            || Date.parse(old.rule.anchor) !== Date.parse(old.createdAt) + 21_600_000)
+            continue;
+        const config = db.prepare("SELECT payload FROM config WHERE id=1").get();
+        const rule = { kind: "cron", expression: "0 */6 * * *",
+            timezone: resolveTimeZone(config ? JSON.parse(config.payload).timeZone : undefined) };
+        const after = new Date(Math.max(now.getTime(), Date.parse(old.processedThrough ?? "") || 0));
+        const next = validateSchedule({ ...old, rule, revision: old.revision + 1, generation: old.generation + 1,
+            processedThrough: after.toISOString(), nextDue: nextScheduleDue(rule, after), updatedAt: now.toISOString() });
+        db.prepare("INSERT INTO storage_migration_archive(migration_version,family,record_key,payload) VALUES(?,?,?,?)")
+            .run(21, "schedules", `${row.scope_key}/${row.schedule_id}`, row.payload);
+        db.prepare("UPDATE schedules SET payload=?,next_due=? WHERE rowid=?")
+            .run(JSON.stringify(next), next.nextDue, row.rowid);
+    }
+}

package/dist/web/assets/assetManifest.js

@@ -8,6 +8,7 @@ import { APP_SCRIPT, CLIENT_MODULES } from "./client/index.js";
 import { THEME_BOOTSTRAP_SCRIPT } from "./client/lib/theme.js";
 import { FONT_WOFF2_BASE64 } from "./fontData.js";
 import { DASHBOARD_HTML } from "./shell/index.js";
+import { LOGIN_HTML } from "./shell/login.js";
 import { STYLESHEETS } from "./styles/index.js";
 const require = createRequire(import.meta.url);
 const CSS = "text/css; charset=utf-8";
@@ -22,7 +23,28 @@ export const WEB_ASSETS = Object.freeze({
     "/assets/vendor/addon-fit.mjs": vendorAsset("@xterm/addon-fit/lib/addon-fit.mjs", JS),
     "/assets/vendor/xterm.css": vendorAsset("@xterm/xterm/css/xterm.css", CSS)
 });
-export { DASHBOARD_HTML };
+export { DASHBOARD_HTML, LOGIN_HTML };
+// The sign-in document's static closure (its stylesheets, fonts, theme script
+// and module import graph). Only these assets are served without a session;
+// every other asset, like every document and API, requires sign-in.
+const LOGIN_ASSETS = (() => {
+    const found = new Set();
+    const visit = (body) => {
+        for (const [path] of body.matchAll(/\/assets\/[\w./-]+/g)) {
+            const asset = WEB_ASSETS[path];
+            if (!asset || found.has(path))
+                continue;
+            found.add(path);
+            if (asset.encoding !== "base64")
+                visit(asset.body);
+        }
+    };
+    visit(LOGIN_HTML);
+    return found;
+})();
+export function isLoginAsset(pathname) {
+    return LOGIN_ASSETS.has(pathname);
+}
 // One content revision covers the complete import graph: changing a dependency
 // invalidates its importers too. Only these static assets may be cached.
 export const WEB_ASSET_VERSION = createHash("sha256")

package/dist/web/assets/client/app/login.js

@@ -0,0 +1,156 @@
+export const LOGIN_SCRIPT = String.raw `
+// Sign-in page controller. Posts the password once per submission as
+// same-origin JSON; the server sets an HttpOnly session cookie and returns a
+// validated same-origin destination. The password is never written to the
+// URL, storage or console, and the field is cleared after a rejection.
+import { createI18n } from "/assets/js/lib/i18n.js";
+
+const form = document.querySelector("#login-form");
+const password = document.querySelector("#login-password");
+const reveal = document.querySelector("#login-reveal");
+const submit = document.querySelector("#login-submit");
+const submitLabel = document.querySelector("#login-submit-label");
+const errorBox = document.querySelector("#login-error");
+const notice = document.querySelector("#login-notice");
+const transport = document.querySelector("#login-transport");
+
+const i18n = createI18n(document.querySelector("#locale-select"));
+const t = i18n.t;
+const params = new URLSearchParams(window.location.search);
+const next = params.get("next") || "/";
+const reason = params.get("reason");
+let busy = false;
+let lockedUntil = 0;
+let lockTimer = null;
+let currentError = null;
+
+function isLoopbackHost(host) {
+  return host === "localhost" || host === "[::1]" || /^127\./.test(host);
+}
+
+function showError(key, values) {
+  currentError = { key: key, values: values || {} };
+  let text = t(key);
+  Object.keys(currentError.values).forEach(function (name) { text = text.split("{" + name + "}").join(String(currentError.values[name])); });
+  errorBox.textContent = text;
+  errorBox.hidden = false;
+  password.setAttribute("aria-invalid", key === "login.error.network" || key === "login.error.origin" ? "false" : "true");
+}
+
+function clearError() {
+  currentError = null;
+  errorBox.hidden = true;
+  errorBox.textContent = "";
+  password.setAttribute("aria-invalid", "false");
+}
+
+function setBusy(value) {
+  busy = value;
+  form.setAttribute("aria-busy", value ? "true" : "false");
+  password.readOnly = value;
+  updateSubmit();
+}
+
+function updateSubmit() {
+  const locked = Date.now() < lockedUntil;
+  submit.disabled = busy || locked;
+  submitLabel.textContent = t(busy ? "login.submitting" : "login.submit");
+}
+
+function renderStatic() {
+  document.title = t("login.title");
+  if (reason === "expired" || reason === "signed-out") {
+    notice.className = "login-notice " + (reason === "expired" ? "tone-warn" : "tone-ok");
+    notice.textContent = t(reason === "expired" ? "login.notice.expired" : "login.notice.signedOut");
+    notice.hidden = false;
+  }
+  const revealed = reveal.getAttribute("aria-pressed") === "true";
+  reveal.setAttribute("aria-label", t(revealed ? "login.hide" : "login.show"));
+  reveal.title = t(revealed ? "login.hide" : "login.show");
+  if (currentError) showError(currentError.key, currentError.values);
+  updateSubmit();
+}
+
+function lockFor(seconds) {
+  lockedUntil = Date.now() + seconds * 1000;
+  window.clearInterval(lockTimer);
+  const tick = function () {
+    const remaining = Math.ceil((lockedUntil - Date.now()) / 1000);
+    if (remaining <= 0) {
+      window.clearInterval(lockTimer);
+      lockTimer = null;
+      clearError();
+      updateSubmit();
+      return;
+    }
+    showError("login.error.throttled", { seconds: remaining });
+    updateSubmit();
+  };
+  tick();
+  lockTimer = window.setInterval(tick, 1000);
+}
+
+reveal.addEventListener("click", function () {
+  const revealed = reveal.getAttribute("aria-pressed") !== "true";
+  reveal.setAttribute("aria-pressed", revealed ? "true" : "false");
+  password.type = revealed ? "text" : "password";
+  renderStatic();
+  password.focus();
+});
+
+password.addEventListener("input", function () {
+  if (currentError && currentError.key !== "login.error.throttled") clearError();
+});
+
+form.addEventListener("submit", async function (event) {
+  event.preventDefault();
+  if (busy || Date.now() < lockedUntil) return;
+  if (!password.value) {
+    showError("login.error.empty");
+    password.focus();
+    return;
+  }
+  clearError();
+  setBusy(true);
+  let response;
+  let body = null;
+  try {
+    response = await fetch("/auth/login", {
+      method: "POST", credentials: "same-origin", cache: "no-store",
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({ password: password.value, next: next })
+    });
+    try { body = await response.json(); } catch {}
+  } catch {
+    setBusy(false);
+    showError("login.error.network");
+    password.focus();
+    return;
+  }
+  if (response.ok && body && typeof body.location === "string" && body.location.startsWith("/") && !body.location.startsWith("//")) {
+    // Keep the busy state while the browser navigates to the destination.
+    window.location.replace(body.location + window.location.hash);
+    return;
+  }
+  setBusy(false);
+  if (response.status === 429) {
+    lockFor(Math.max(1, Number(body && body.retryAfterSeconds) || Number(response.headers.get("retry-after")) || 30));
+  } else if (response.status === 401) {
+    password.value = "";
+    showError("login.error.invalid");
+  } else if (response.status === 403) {
+    showError("login.error.origin");
+  } else if (response.status === 404 && body && body.code === "password-not-configured") {
+    window.location.replace("/");
+    return;
+  } else {
+    showError("login.error.network");
+  }
+  password.focus();
+});
+
+i18n.subscribe(renderStatic);
+transport.hidden = window.location.protocol !== "http:" || isLoopbackHost(window.location.hostname);
+renderStatic();
+password.focus();
+`;

package/dist/web/assets/client/i18n/en.js

@@ -1226,5 +1226,22 @@ export const EN = {
     "discussion.older": "Show {count} earlier messages",
     "discussion.olderLoading": "Reading earlier messages…",
     "record.raw": "Raw record",
-    "record.reading": "Reading the exact record…"
+    "record.reading": "Reading the exact record…",
+    "login.title": "Sign in · Yui",
+    "login.heading": "Sign in to Yui",
+    "login.subtitle": "Enter the Web access password from this listener's private credential file.",
+    "login.password": "Password",
+    "login.show": "Show password",
+    "login.hide": "Hide password",
+    "login.submit": "Sign in",
+    "login.submitting": "Signing in…",
+    "login.error.empty": "Enter the password.",
+    "login.error.invalid": "Incorrect password. Check the credential file and try again.",
+    "login.error.throttled": "Too many failed attempts. Try again in {seconds} s.",
+    "login.error.origin": "This address is not accepted by the Web listener. Open one of the URLs printed by yui web.",
+    "login.error.network": "Cannot reach Yui Web. Check that the listener is running, then try again.",
+    "login.notice.expired": "Your session has expired. Sign in again to continue.",
+    "login.notice.signedOut": "You have signed out.",
+    "login.httpWarning": "This connection uses plain HTTP and is not encrypted. Sign in only on a trusted network.",
+    "login.noscript": "JavaScript is required to sign in."
 };

package/dist/web/assets/client/i18n/zh-CN.js

@@ -1222,5 +1222,22 @@ export const ZH_CN = {
     "discussion.older": "显示更早的 {count} 条消息",
     "discussion.olderLoading": "正在读取更早的消息…",
     "record.raw": "原始记录",
-    "record.reading": "正在读取完整记录…"
+    "record.reading": "正在读取完整记录…",
+    "login.title": "登录 · Yui",
+    "login.heading": "登录 Yui",
+    "login.subtitle": "输入此 Web 监听所用私有凭证文件中的访问密码。",
+    "login.password": "密码",
+    "login.show": "显示密码",
+    "login.hide": "隐藏密码",
+    "login.submit": "登录",
+    "login.submitting": "正在登录…",
+    "login.error.empty": "请输入密码。",
+    "login.error.invalid": "密码不正确。请核对凭证文件后重试。",
+    "login.error.throttled": "失败次数过多，请在 {seconds} 秒后重试。",
+    "login.error.origin": "Web 监听不接受当前地址。请打开 yui web 输出的访问地址。",
+    "login.error.network": "无法连接 Yui Web。请确认监听仍在运行后重试。",
+    "login.notice.expired": "会话已过期，请重新登录以继续。",
+    "login.notice.signedOut": "你已退出登录。",
+    "login.httpWarning": "当前连接为未加密的 HTTP。请仅在可信网络中登录。",
+    "login.noscript": "需要启用 JavaScript 才能登录。"
 };

package/dist/web/assets/client/index.js

@@ -17,6 +17,7 @@ import { FORMAT_SCRIPT } from "./lib/format.js";
 import { I18N_SCRIPT } from "./lib/i18n.js";
 import { MARKDOWN_SCRIPT } from "./lib/markdown.js";
 import { PREFS_SCRIPT } from "./lib/prefs.js";
+import { SESSION_SCRIPT } from "./lib/session.js";
 import { THEME_SCRIPT } from "./lib/theme.js";
 import { CONTAINERS_SCRIPT } from "./ui/containers.js";
 import { CONTROLS_SCRIPT } from "./ui/controls.js";
@@ -66,6 +67,7 @@ import { MODELS_VIEW_SCRIPT } from "./views/models.js";
 import { MODELS_SCRIPT } from "./app/models.js";
 import { MANAGE_SHELL_SCRIPT } from "./layout/manageShell.js";
 import { MANAGE_SCRIPT } from "./app/manage.js";
+import { LOGIN_SCRIPT } from "./app/login.js";
 export { APP_SCRIPT } from "./app/main.js";
 export const CLIENT_MODULES = Object.freeze({
     "views/skills": SKILLS_SCRIPT,
@@ -78,6 +80,7 @@ export const CLIENT_MODULES = Object.freeze({
     "lib/i18n": I18N_SCRIPT,
     "lib/theme": THEME_SCRIPT,
     "lib/api": API_SCRIPT,
+    "lib/session": SESSION_SCRIPT,
     "lib/markdown": MARKDOWN_SCRIPT,
     "ui/primitives": PRIMITIVES_SCRIPT,
     "ui/containers": CONTAINERS_SCRIPT,
@@ -121,6 +124,7 @@ export const CLIENT_MODULES = Object.freeze({
     "app/taskView": TASK_VIEW_SCRIPT,
     "app/settings": SETTINGS_SCRIPT,
     "app/manage": MANAGE_SCRIPT,
+    "app/login": LOGIN_SCRIPT,
     "app/models": MODELS_SCRIPT,
     "app/selection": SELECTION_SCRIPT
 });

package/dist/web/assets/client/lib/api.js

@@ -1,6 +1,8 @@
 export const API_SCRIPT = String.raw `
 // Loopback API client. Every request carries the page token; a write is keyed
 // so an unresolved submission can never be silently replayed from this page.
+import { sessionExpired } from "/assets/js/lib/session.js";
+
 const token = document.querySelector('meta[name="yui-web-token"]').content;
 const unresolved = new Set();
 
@@ -22,6 +24,9 @@ export async function requestJson(path, options) {
       const body = await response.json();
       if (body && body.error) message = body.error;
       if (body && body.disposition === "not-submitted") disposition = "not-submitted";
+      // The server rejected the request before reading it: the browser session
+      // is missing or expired. Return to the sign-in page for this view.
+      if (response.status === 401 && body && body.code === "authentication-required") sessionExpired();
     } catch {}
     throw Object.assign(new Error(message), { disposition, status: response.status });
   }

package/dist/web/assets/client/lib/session.js

@@ -0,0 +1,21 @@
+export const SESSION_SCRIPT = String.raw `
+// Browser session helper for password-protected listeners. The session
+// itself is an HttpOnly cookie owned by the server; this module never reads
+// or stores a credential. It only routes an expired page back to the
+// sign-in page with a same-origin return path.
+let redirecting = false;
+
+export function returnTarget() {
+  return window.location.pathname + window.location.search;
+}
+
+// Called when any API read/write answers 401. Navigates once; the fragment
+// survives on the sign-in URL and is restored after a successful sign-in.
+export function sessionExpired() {
+  if (redirecting) return;
+  redirecting = true;
+  const query = new URLSearchParams({ reason: "expired" });
+  if (returnTarget() !== "/") query.set("next", returnTarget());
+  window.location.assign("/login?" + query.toString() + window.location.hash);
+}
+`;

package/dist/web/assets/client/views/dock/terminal.js

@@ -8,6 +8,7 @@ import { h, icon, clear } from "/assets/js/lib/dom.js";
 import { fill } from "/assets/js/lib/format.js";
 import { pageToken, requestJson } from "/assets/js/lib/api.js";
 import { dot } from "/assets/js/ui/primitives.js";
+import { sessionExpired } from "/assets/js/lib/session.js";
 
 function cssVar(name, fallback) {
   const value = getComputedStyle(document.documentElement).getPropertyValue(name).trim();
@@ -172,9 +173,11 @@ function bindSocket(ctl, socket, terminal, link, generation) {
       terminal.writeln("\r\n" + message.message);
     }
   });
-  socket.addEventListener("close", function () {
+  socket.addEventListener("close", function (event) {
     if (generation !== ctl.generation) return;
     link.writable = false;
+    // 1008: the server closed this terminal because its browser session ended.
+    if (event && event.code === 1008) { sessionExpired(); return; }
     if (ctl.stateKey !== "terminal.error") setState(ctl, "terminal.closed", "closed");
   });
   socket.addEventListener("error", function () {

package/dist/web/assets/shared/icons.js

@@ -32,6 +32,7 @@ export const ICON_PATHS = Object.freeze({
     dots: ["M5 12h.01", "M12 12h.01", "M19 12h.01"],
     inbox: ["M4 13l2.5-8h11L20 13", "M4 13v6h16v-6", "M4 13h5l1 2h4l1-2h5"],
     user: ["M12 12a4 4 0 1 0 0-8 4 4 0 0 0 0 8z", "M4 20a8 8 0 0 1 16 0"],
+    eyeOff: ["M3 3l18 18", "M10.6 5.1A10 10 0 0 1 12 5c6.4 0 10 7 10 7a17 17 0 0 1-3 3.9", "M6.6 6.6C3.9 8.3 2 12 2 12s3.6 7 10 7a9.6 9.6 0 0 0 5.4-1.6", "M9.9 9.9a3 3 0 0 0 4.2 4.2"],
     eye: ["M2 12s3.6-7 10-7 10 7 10 7-3.6 7-10 7S2 12 2 12z", "M12 15a3 3 0 1 0 0-6 3 3 0 0 0 0 6z"],
     plus: ["M12 5v14", "M5 12h14"],
     play: ["M8 5v14l11-7z"],

package/dist/web/assets/shell/login.js

@@ -0,0 +1,56 @@
+import { DEFAULT_DARK_THEME } from "../shared/themes.js";
+import { iconSvg } from "../shared/icons.js";
+// The only document served without a session. It carries no page token and
+// no Task data; the client module posts the password as same-origin JSON and
+// the server answers with a session cookie. CSP form-action 'none' means the
+// form can never submit natively (so a password cannot end up in a URL).
+const SHEETS = ["fonts", "tokens", "base", "ui/controls", "ui/forms", "views/login"];
+export const LOGIN_HTML = `<!doctype html>
+<html lang="en" data-theme="${DEFAULT_DARK_THEME.id}">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
+  <meta name="color-scheme" content="dark light">
+  <script src="/assets/theme.js"></script>
+  <link rel="icon" href="data:,">
+  <title>Sign in · Yui</title>
+  <link rel="preload" href="/assets/fonts/inter-500.woff2" as="font" type="font/woff2" crossorigin>
+  <link rel="preload" href="/assets/fonts/inter-600.woff2" as="font" type="font/woff2" crossorigin>
+${SHEETS.map(name => `  <link rel="stylesheet" href="/assets/css/${name}.css">`).join("\n")}
+</head>
+<body class="login-body">
+  <main class="login-shell">
+    <div class="login-top">
+      <label class="login-locale"><span class="sr-only" data-i18n="settings.language">Language</span><select id="locale-select"><option value="en">English</option><option value="zh-CN">简体中文</option></select></label>
+    </div>
+    <section class="login-card" aria-labelledby="login-title">
+      <div class="login-brand">
+        <span class="brand-mark" aria-hidden="true">結</span>
+        <span class="brand-name">Yui</span>
+      </div>
+      <header class="login-heading">
+        <h1 id="login-title" data-i18n="login.heading">Sign in to Yui</h1>
+        <p id="login-subtitle" class="login-sub" data-i18n="login.subtitle">Enter the Web access password from this listener's private credential file.</p>
+      </header>
+      <p id="login-notice" class="login-notice" role="status" hidden></p>
+      <form id="login-form" class="login-form" method="post" novalidate aria-describedby="login-subtitle">
+        <input class="sr-only" type="text" name="username" value="yui" autocomplete="username" tabindex="-1" aria-hidden="true" readonly>
+        <div class="login-field">
+          <label class="login-label" for="login-password" data-i18n="login.password">Password</label>
+          <div class="login-password">
+            <input id="login-password" name="password" type="password" autocomplete="current-password" required maxlength="256" spellcheck="false" autocapitalize="off" autocorrect="off" aria-describedby="login-error" aria-invalid="false" autofocus>
+            <button id="login-reveal" class="icon-btn login-reveal" type="button" aria-controls="login-password" aria-pressed="false" aria-label="Show password" data-i18n-aria-label="login.show" title="Show password" data-i18n-title="login.show">${iconSvg("eye", "icon icon-show")}${iconSvg("eyeOff", "icon icon-hide")}</button>
+          </div>
+          <p id="login-error" class="login-error" role="alert" hidden></p>
+        </div>
+        <button id="login-submit" class="btn btn-primary login-submit" type="submit" disabled>
+          <span class="login-spinner" aria-hidden="true"></span><span id="login-submit-label" data-i18n="login.submit">Sign in</span>
+        </button>
+      </form>
+      <p id="login-transport" class="login-transport" hidden>${iconSvg("alert")}<span data-i18n="login.httpWarning">This connection uses plain HTTP and is not encrypted. Sign in only on a trusted network.</span></p>
+      <noscript><p class="login-error" data-i18n="login.noscript">JavaScript is required to sign in.</p></noscript>
+    </section>
+  </main>
+  <script type="module" src="/assets/js/app/login.js"></script>
+</body>
+</html>`;

package/dist/web/assets/styles/index.js

@@ -19,6 +19,7 @@ import { MANAGE_STYLES } from "./views/manage.js";
 import { SETTINGS_STYLES } from "./views/settings.js";
 import { MODELS_STYLES } from "./views/models.js";
 import { JOBS_STYLES } from "./views/jobs.js";
+import { LOGIN_STYLES } from "./views/login.js";
 // The stylesheet registry, in cascade order: foundations (fonts, tokens,
 // element defaults), the workspace frame, shared UI primitives, then one
 // sheet per view, rendered prose, and breakpoints last so they override
@@ -44,6 +45,7 @@ export const STYLESHEETS = Object.freeze([
     { name: "views/settings", body: SETTINGS_STYLES },
     { name: "views/models", body: MODELS_STYLES },
     { name: "views/jobs", body: JOBS_STYLES },
+    { name: "views/login", body: LOGIN_STYLES },
     { name: "markdown", body: MARKDOWN_STYLES },
     { name: "layout/responsive", body: RESPONSIVE_STYLES }
 ]);

package/dist/web/assets/styles/views/login.js

@@ -0,0 +1,42 @@
+/*
+ * LOGIN VIEW — the standalone sign-in document: one centred card on the
+ * canvas with the workbench brand, a password field (with reveal toggle),
+ * inline error/notice states and the plain-HTTP reminder. Colour comes only
+ * from theme tokens; the card collapses to the full width on narrow screens.
+ */
+export const LOGIN_STYLES = `
+.login-body{height:auto;min-height:100vh;min-height:100dvh;overflow:auto}
+.login-shell{position:relative;display:grid;place-items:center;min-height:100vh;min-height:100dvh;padding:72px 16px 48px;background:radial-gradient(120% 70% at 50% -10%,var(--accent-soft),transparent 60%),var(--canvas)}
+.login-top{position:absolute;top:16px;right:16px}
+.login-locale select{height:30px;width:auto;max-width:132px;padding:0 26px 0 9px;line-height:28px;font-size:var(--fs-xs);background-color:var(--surface)}
+.login-card{display:grid;gap:20px;width:min(400px,100%);padding:32px 28px 28px;border:1px solid var(--line-2);border-radius:var(--r-lg);background:var(--surface);box-shadow:var(--shadow-2)}
+.login-brand{display:flex;align-items:center;gap:10px}
+.login-brand .brand-mark{display:grid;place-items:center;width:32px;height:32px;flex:none;border-radius:9px;background:var(--accent);color:var(--accent-ink);font-size:17px;font-weight:700;line-height:1}
+.login-brand .brand-name{font-size:var(--fs-lg);font-weight:650;letter-spacing:-.02em}
+.login-heading{display:grid;gap:6px}
+.login-heading h1{font-size:var(--fs-2xl)}
+.login-sub{color:var(--ink-3);font-size:var(--fs-sm);overflow-wrap:anywhere}
+.login-notice{margin:0;padding:10px 12px;border:1px solid var(--line-2);border-left:3px solid var(--tone,var(--info));border-radius:var(--r-sm);background:var(--tone-soft,var(--info-soft));color:var(--ink);font-size:var(--fs-sm)}
+.login-form{display:grid;gap:16px}
+.login-field{display:grid;gap:6px;min-width:0}
+.login-label{color:var(--ink-2);font-size:var(--fs-xs);font-weight:500}
+.login-password{position:relative}
+.login-password input{height:40px;padding-right:44px}
+.login-password input[aria-invalid="true"]{border-color:var(--bad)}
+.login-password input[aria-invalid="true"]:focus{box-shadow:0 0 0 3px var(--bad-soft)}
+.login-reveal{position:absolute;top:4px;right:4px}
+.login-reveal .icon-hide,.login-reveal[aria-pressed="true"] .icon-show{display:none}
+.login-reveal[aria-pressed="true"] .icon-hide{display:block}
+.login-error{margin:0;color:var(--bad);font-size:var(--fs-sm);overflow-wrap:anywhere}
+.login-submit{width:100%;height:40px;font-size:var(--fs-md)}
+.login-spinner{display:none;width:14px;height:14px;flex:none;border:2px solid currentColor;border-right-color:transparent;border-radius:50%;animation:login-spin .8s linear infinite}
+.login-form[aria-busy="true"] .login-spinner{display:inline-block}
+@keyframes login-spin{to{transform:rotate(360deg)}}
+.login-transport{display:flex;align-items:flex-start;gap:8px;margin:0;padding-top:16px;border-top:1px solid var(--line);color:var(--ink-3);font-size:var(--fs-xs)}
+.login-transport .icon{width:14px;height:14px;margin-top:2px;color:var(--warn)}
+@media(max-width:480px){
+  .login-shell{place-items:start center;padding:64px 12px 32px}
+  .login-card{padding:24px 20px;border-radius:var(--r-md)}
+  .login-heading h1{font-size:var(--fs-xl)}
+}
+`;