create-principles-disciple 1.138.0 → 1.138.1

package/console/dist/ui/api.d.ts

@@ -18,6 +18,14 @@ declare function clearToken(): void;
  * derived from request data.
  */
 export declare function shouldRedirectToLoginOnUnauthorized(currentHash: string): boolean;
+/**
+ * Staleness guard for 401 responses (PR #1635 review race fix): a 401 may
+ * arrive AFTER the login form's restore flow set a newer token while this
+ * request was in flight. The stale response must neither erase the newer
+ * token nor trigger the login redirect. Pure on the two token snapshots, so
+ * the policy is unit-testable without a browser.
+ */
+export declare function shouldInvalidateSessionTokenOn401(requestToken: string | null, storedTokenNow: string | null): boolean;
 /**
  * Send an authenticated request to the Console API.
  *

package/console/dist/ui/api.js

@@ -23,6 +23,16 @@ function clearToken() {
 export function shouldRedirectToLoginOnUnauthorized(currentHash) {
     return !(currentHash === "#/login" || currentHash.startsWith("#/login?"));
 }
+/**
+ * Staleness guard for 401 responses (PR #1635 review race fix): a 401 may
+ * arrive AFTER the login form's restore flow set a newer token while this
+ * request was in flight. The stale response must neither erase the newer
+ * token nor trigger the login redirect. Pure on the two token snapshots, so
+ * the policy is unit-testable without a browser.
+ */
+export function shouldInvalidateSessionTokenOn401(requestToken, storedTokenNow) {
+    return storedTokenNow === requestToken;
+}
 async function request(path, options, validate) {
     const token = getToken();
     const headers = {
@@ -44,11 +54,17 @@ async function request(path, options, validate) {
                 // Any 401 invalidates the session: clear the token even when none was
                 // attached (page loaded before the server switched to token mode —
                 // PRI-643) and route to login so a token can be entered.
-                clearToken();
-                // eslint-disable-next-line no-undef
-                if (shouldRedirectToLoginOnUnauthorized(window.location.hash)) {
+                // Staleness guard (PR #1635 review): the login form's restore flow may
+                // have set a NEWER token while this request was in flight — a late 401
+                // from the earlier tokenless probe must not erase it and bounce the
+                // just-restored session back to login.
+                if (shouldInvalidateSessionTokenOn401(token, getToken())) {
+                    clearToken();
                     // eslint-disable-next-line no-undef
-                    window.location.hash = "#/login?session_expired=true";
+                    if (shouldRedirectToLoginOnUnauthorized(window.location.hash)) {
+                        // eslint-disable-next-line no-undef
+                        window.location.hash = "#/login?session_expired=true";
+                    }
                 }
             }
             let errorMessage = `HTTP ${response.status}`;

package/console/dist/ui/components/auth/login-form.js

@@ -2,35 +2,141 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import * as React from "react";
 import { useTranslation } from "react-i18next";
 import { ThemeToggle } from "../theme-toggle.js";
-import { setToken, checkAuth } from "../../api.js";
+import { setToken, clearToken, checkAuth } from "../../api.js";
+import { toast } from "sonner";
+function getCompanionBridge() {
+    if (typeof window === "undefined")
+        return undefined;
+    return window.pdCompanion;
+}
 export function LoginForm({ onAuthSuccess }) {
+    const { t } = useTranslation();
+    const [phase, setPhase] = React.useState({ kind: "checking" });
     const [token, setTokenInput] = React.useState("");
     const [error, setError] = React.useState(null);
-    const [loading, setLoading] = React.useState(false);
-    const { t } = useTranslation();
+    // Auto-restore: ask the Companion for the stored credential and connect
+    // without user input. Absent companion / absent credential degrade to the
+    // manual form; a rejected read degrades to the manual form PLUS an
+    // observable diagnostic (rc-9) so version skew is not mistaken for "no
+    // credential". Runs once per mount (onAuthSuccess is a stable useCallback
+    // in App.tsx); the 重新连接 button re-enters the route to re-run it.
     React.useEffect(() => {
+        const companion = getCompanionBridge();
+        if (companion === undefined) {
+            setPhase({ kind: "form" });
+            return;
+        }
+        let cancelled = false;
+        void (async () => {
+            let status;
+            try {
+                status = await companion.getConsoleToken();
+            }
+            catch {
+                if (!cancelled)
+                    setPhase({ kind: "form-with-read-error" });
+                return;
+            }
+            if (cancelled)
+                return;
+            if (!status.available || status.token === undefined) {
+                setPhase({ kind: "form" });
+                return;
+            }
+            setPhase({ kind: "connecting" });
+            setToken(status.token);
+            const valid = await checkAuth();
+            if (cancelled)
+                return;
+            if (valid) {
+                onAuthSuccess();
+            }
+            else {
+                // checkAuth's 401 path only cleared the session when it was still
+                // this token (api.ts staleness guard).
+                setPhase({ kind: "recovery" });
+            }
+        })();
+        return () => {
+            cancelled = true;
+        };
+    }, [onAuthSuccess]);
+    // The 401 redirect appends session_expired=true before auto-restore has had
+    // a chance to run; that banner would be wrong ("expired") for a fresh
+    // browser session with a valid stored credential, so it is only surfaced on
+    // the manual-entry form.
+    React.useEffect(() => {
+        if (phase.kind !== "form" && phase.kind !== "form-with-read-error")
+            return;
         if (window.location.hash.includes("session_expired=true")) {
-            setError("会话已过期或令牌失效，请重新输入。");
+            setError(t("pages.login.errorExpired"));
         }
-    }, []);
+    }, [phase.kind, t]);
+    const persistToCompanion = async (value) => {
+        const companion = getCompanionBridge();
+        if (companion === undefined)
+            return;
+        try {
+            const result = await companion.configureConsoleToken(value);
+            if (!result.persisted) {
+                // rc-9: never fake success — the workspace opens, but the Owner must
+                // know the credential was NOT durably saved.
+                toast.error(t("pages.login.persistFailed"));
+                if (result.nextAction)
+                    toast.info(result.nextAction, { duration: 8000 });
+                return;
+            }
+            if (result.reason === "external_console_attached") {
+                toast.info(t("pages.login.persistAttached"));
+            }
+            else {
+                toast.success(t("pages.login.persistSucceeded"));
+            }
+        }
+        catch {
+            toast.error(t("pages.login.persistFailed"));
+        }
+    };
     const handleSubmit = async (e) => {
         e.preventDefault();
-        if (!token.trim())
+        const trimmed = token.trim();
+        if (!trimmed)
             return;
-        setLoading(true);
         setError(null);
-        setToken(token.trim());
+        setPhase({ kind: "connecting" });
+        setToken(trimmed);
         const valid = await checkAuth();
         if (valid) {
+            await persistToCompanion(trimmed);
             onAuthSuccess();
         }
         else {
-            setError("令牌无效或服务未就绪，请检查后重试。");
-            setLoading(false);
+            setError(t("pages.login.errorInvalid"));
+            setPhase({ kind: "form" });
         }
     };
-    return (_jsxs("div", { className: "min-h-screen flex items-center justify-center bg-paper relative", style: {
+    // The detection effect keys on mount, so an honest retry re-enters the
+    // route with a clean state instead of duplicating the async body here.
+    const retryCompanionConnect = () => {
+        setError(null);
+        clearToken();
+        window.location.reload();
+    };
+    const showCard = (children) => (_jsxs("div", { className: "min-h-screen flex items-center justify-center bg-paper relative", style: {
             backgroundImage: `linear-gradient(color-mix(in srgb, var(--color-gov) 3.5%, transparent) 1px, transparent 1px), linear-gradient(90deg, color-mix(in srgb, var(--color-gov) 3.5%, transparent) 1px, transparent 1px)`,
             backgroundSize: "32px 32px",
-        }, children: [_jsx("div", { className: "absolute top-4 right-4", children: _jsx(ThemeToggle, {}) }), _jsxs("div", { className: "w-full max-w-[400px] mx-4 p-8 bg-surface rounded-[var(--radius-md)] border border-line shadow-card", children: [_jsxs("div", { className: "flex flex-col items-center mb-6", children: [_jsxs("svg", { viewBox: "0 0 28 28", className: "w-12 h-12 text-gov mb-3", fill: "none", stroke: "currentColor", strokeWidth: "1.5", children: [_jsx("path", { d: "M6 4V24M22 4V24M2 14H26", strokeLinecap: "square" }), _jsx("circle", { cx: "14", cy: "14", r: "2.5", fill: "currentColor", stroke: "none" })] }), _jsx("div", { className: "font-mono text-[14px] tracking-[0.16em] font-bold text-ink", children: "PD" }), _jsx("div", { className: "font-mono text-[11px] tracking-[0.14em] text-ink-3 mt-1", children: "GOVERNANCE WORKSPACE" }), _jsx("div", { className: "text-[13px] text-ink-3 mt-3", children: "\u62E5\u6709\u8005\u6CBB\u7406\u5DE5\u4F5C\u53F0" })] }), _jsx("div", { className: "border-t border-line my-5" }), _jsxs("form", { onSubmit: handleSubmit, children: [_jsx("label", { htmlFor: "bearer-token", className: "font-mono text-[11px] tracking-[0.08em] text-ink-3 uppercase mb-2 block", children: "Bearer Token" }), _jsx("input", { id: "bearer-token", type: "password", value: token, onChange: (e) => setTokenInput(e.target.value), className: "w-full px-3 py-2 bg-panel border border-line rounded-[var(--radius-sm)] font-mono text-[13px] text-ink focus:border-gov focus:outline-2 focus:outline-offset-2 focus:outline-gov transition-colors", placeholder: "\u8F93\u5165\u4EE4\u724C\u2026", autoFocus: true }), error && _jsx("p", { className: "mt-2 text-[13px] text-amber", children: error }), _jsx("button", { type: "submit", disabled: loading || !token.trim(), className: "mt-4 w-full py-2 px-4 bg-gov text-paper rounded-[var(--radius-sm)] text-[12.5px] font-medium hover:bg-gov-2 disabled:opacity-50 transition-colors focus:outline-2 focus:outline-offset-2 focus:outline-gov", children: loading ? "验证中…" : "进入工作台" })] })] })] }));
+        }, children: [_jsx("div", { className: "absolute top-4 right-4", children: _jsx(ThemeToggle, {}) }), _jsxs("div", { className: "w-full max-w-[400px] mx-4 p-8 bg-surface rounded-[var(--radius-md)] border border-line shadow-card", children: [_jsxs("div", { className: "flex flex-col items-center mb-6", children: [_jsxs("svg", { viewBox: "0 0 28 28", className: "w-12 h-12 text-gov mb-3", fill: "none", stroke: "currentColor", strokeWidth: "1.5", children: [_jsx("path", { d: "M6 4V24M22 4V24M2 14H26", strokeLinecap: "square" }), _jsx("circle", { cx: "14", cy: "14", r: "2.5", fill: "currentColor", stroke: "none" })] }), _jsx("div", { className: "font-mono text-[14px] tracking-[0.16em] font-bold text-ink", children: "PD" }), _jsx("div", { className: "font-mono text-[11px] tracking-[0.14em] text-ink-3 mt-1", children: "GOVERNANCE WORKSPACE" }), _jsx("div", { className: "text-[13px] text-ink-3 mt-3", children: t("pages.login.connectWorkspace") })] }), _jsx("div", { className: "border-t border-line my-5" }), children] })] }));
+    if (phase.kind === "checking" || phase.kind === "connecting") {
+        return showCard(_jsxs("div", { className: "flex flex-col items-center gap-4 py-6", "data-testid": "login-connecting", children: [_jsx("div", { className: "w-8 h-8 border-2 border-gov border-t-transparent rounded-full animate-spin" }), _jsx("span", { className: "text-[13px] text-ink-3", children: phase.kind === "checking" ? t("pages.login.detecting") : t("pages.login.connecting") })] }));
+    }
+    if (phase.kind === "recovery") {
+        return showCard(_jsxs("div", { className: "flex flex-col gap-4", "data-testid": "login-recovery", children: [_jsx("p", { className: "text-[13px] text-amber", children: t("pages.login.recoveryTitle") }), _jsx("p", { className: "text-[13px] text-ink-3 leading-relaxed", children: t("pages.login.recoveryReason") }), _jsxs("div", { className: "flex flex-col gap-2", children: [_jsx("button", { type: "button", onClick: retryCompanionConnect, className: "w-full py-2 px-4 bg-gov text-paper rounded-[var(--radius-sm)] text-[12.5px] font-medium hover:bg-gov-2 transition-colors focus:outline-2 focus:outline-offset-2 focus:outline-gov", children: t("pages.login.reconnect") }), _jsx("button", { type: "button", onClick: () => {
+                                clearToken();
+                                setTokenInput("");
+                                setError(null);
+                                setPhase({ kind: "form" });
+                            }, className: "w-full py-2 px-4 border border-line text-ink rounded-[var(--radius-sm)] text-[12.5px] font-medium hover:border-gov transition-colors focus:outline-2 focus:outline-offset-2 focus:outline-gov", children: t("pages.login.manualEntry") })] }), _jsx("p", { className: "text-[12px] text-ink-4 leading-relaxed", children: t("pages.login.manualEntryHint") })] }));
+    }
+    const showReadError = phase.kind === "form-with-read-error";
+    return showCard(_jsxs("form", { onSubmit: handleSubmit, children: [showReadError && (_jsxs("div", { className: "mb-4 border border-amber rounded-[var(--radius-sm)] px-3 py-2", "data-testid": "login-read-error", children: [_jsx("p", { className: "text-[12.5px] font-medium text-amber", children: t("pages.login.readFailedTitle") }), _jsx("p", { className: "text-[12px] text-ink-3 mt-1 leading-relaxed", children: t("pages.login.readFailedHint") })] })), _jsx("label", { htmlFor: "access-token", className: "font-mono text-[11px] tracking-[0.08em] text-ink-3 uppercase mb-2 block", children: t("pages.login.accessToken") }), _jsx("input", { id: "access-token", type: "password", value: token, onChange: (e) => setTokenInput(e.target.value), className: "w-full px-3 py-2 bg-panel border border-line rounded-[var(--radius-sm)] font-mono text-[13px] text-ink focus:border-gov focus:outline-2 focus:outline-offset-2 focus:outline-gov transition-colors", placeholder: t("pages.login.enterAccessToken"), autoFocus: true }), error && _jsx("p", { className: "mt-2 text-[13px] text-amber", children: error }), _jsx("button", { type: "submit", disabled: !token.trim(), className: "mt-4 w-full py-2 px-4 bg-gov text-paper rounded-[var(--radius-sm)] text-[12.5px] font-medium hover:bg-gov-2 disabled:opacity-50 transition-colors focus:outline-2 focus:outline-offset-2 focus:outline-gov", children: t("pages.login.connect") })] }));
 }

package/console/dist/ui/i18n/en.json

@@ -1054,6 +1054,14 @@
             "tokenExternalAttached": "Token saved, but an external Console is still connected.",
             "tokenSessionOnly": "Token is stored in browser session only.",
             "tokenDesktopStored": "Desktop: encrypted with the Windows system store.",
+            "clearToken": "Clear credential",
+            "clearTokenConfirm": "Confirm clear",
+            "tokenCleared": "Credential cleared",
+            "tokenClearedRestarting": "Credential cleared; restarting Console without authentication…",
+            "tokenClearedSession": "Browser session token cleared.",
+            "tokenClearedExternalAttached": "Companion credential cleared, but the externally started Console still requires its token.",
+            "tokenInheritedEnv": "The token comes from the PD_CONSOLE_TOKEN environment variable set outside PD; clearing is not durable — it will return on the next launch. Remove the variable at its source (launcher/terminal).",
+            "tokenClearFailed": "Failed to clear the credential.",
             "ownerIdentity": {
                 "title": "Owner identity",
                 "intro": "The Owner identity gates governance decision entry points (RuleCode promotion, emergency pause, etc.). Register to ~/.pd/owner.json (install-level, shared across workspaces). If the PD_OWNER_ID and PD_OWNER_CREDENTIAL_ID environment variables are set together, they take precedence as a pair.",
@@ -1299,15 +1307,24 @@
             "title": "Login",
             "description": "Login to PD Governance Workspace",
             "slogan": "Turn repeated corrections into governed principles",
-            "password": "Password",
-            "showPassword": "Show password",
-            "hidePassword": "Hide password",
-            "signIn": "Enter Workspace",
-            "errorInvalid": "Invalid password",
-            "errorEmpty": "Please enter password",
-            "enterAccessToken": "Enter access token",
-            "verifying": "Verifying…",
-            "bearerToken": "Bearer Token",
+            "connectWorkspace": "Connect to PD Workspace",
+            "detecting": "Detecting local Companion…",
+            "connecting": "Connecting to PD Workspace…",
+            "accessToken": "Access token",
+            "enterAccessToken": "Enter the access token to connect",
+            "connect": "Connect",
+            "errorInvalid": "Invalid access credential or service not ready. Check and retry.",
+            "errorExpired": "Session expired or token invalid. Please re-enter.",
+            "recoveryTitle": "Cannot connect to PD Workspace",
+            "recoveryReason": "Reason: the stored Owner credential has expired or does not match the local Console.",
+            "reconnect": "Reconnect",
+            "manualEntry": "Enter access token manually",
+            "manualEntryHint": "A manually entered token updates the credential saved in Companion.",
+            "readFailedTitle": "Companion credential read failed",
+            "readFailedHint": "Could not read the credential saved by Companion (possible version mismatch). Please enter the token manually; if this persists, restart Companion.",
+            "persistFailed": "Connected, but the credential was not securely saved — the token will be needed again next time.",
+            "persistSucceeded": "Owner credential securely saved by Companion; the next open will connect automatically.",
+            "persistAttached": "Credential saved, but the Console in use was started externally — restart Companion to apply it.",
             "tokenSessionOnly": "Token is stored in browser session only.",
             "noAuthFlag": "Use --no-auth flag to disable authentication."
         },

package/console/dist/ui/i18n/zh-CN.json

@@ -1054,6 +1054,14 @@
             "tokenExternalAttached": "令牌已保存，但当前仍连接着外部控制台。",
             "tokenSessionOnly": "令牌仅存储在浏览器会话中。",
             "tokenDesktopStored": "桌面版：已通过 Windows 系统加密安全保存。",
+            "clearToken": "清除凭证",
+            "clearTokenConfirm": "确认清除",
+            "tokenCleared": "凭证已清除",
+            "tokenClearedRestarting": "凭证已清除，正在重启控制台为免认证模式…",
+            "tokenClearedSession": "浏览器会话令牌已清除。",
+            "tokenClearedExternalAttached": "Companion 凭证已清除，但外部启动的控制台仍要求令牌。",
+            "tokenInheritedEnv": "令牌来自外部设置的 PD_CONSOLE_TOKEN 环境变量，本次清除不会持久——下次启动会恢复。请在其来源处（启动器/终端）删除该变量。",
+            "tokenClearFailed": "清除凭证失败。",
             "ownerIdentity": {
                 "title": "拥有者身份",
                 "intro": "拥有者身份决定治理决策入口（RuleCode 晋升、紧急暂停等）。登记到 ~/.pd/owner.json（安装级，跨工作区生效）。若环境变量 PD_OWNER_ID 与 PD_OWNER_CREDENTIAL_ID 成对设置，则作为一对整体优先生效。",
@@ -1299,15 +1307,24 @@
             "title": "登录",
             "description": "登录 PD 治理工作台",
             "slogan": "把反复纠正，沉淀为可治理的原则",
-            "password": "密码",
-            "showPassword": "显示密码",
-            "hidePassword": "隐藏密码",
-            "signIn": "进入工作台",
-            "errorInvalid": "密码错误",
-            "errorEmpty": "请输入密码",
-            "enterAccessToken": "输入访问令牌",
-            "verifying": "验证中…",
-            "bearerToken": "Bearer 令牌",
+            "connectWorkspace": "连接 PD 工作台",
+            "detecting": "正在检测本机 Companion…",
+            "connecting": "正在连接 PD 工作台…",
+            "accessToken": "访问令牌",
+            "enterAccessToken": "输入访问令牌完成连接",
+            "connect": "连接",
+            "errorInvalid": "访问凭证无效或服务未就绪，请检查后重试。",
+            "errorExpired": "会话已过期或令牌失效，请重新输入。",
+            "recoveryTitle": "无法连接 PD 工作台",
+            "recoveryReason": "原因：拥有者凭证已失效或与本机控制台不匹配。",
+            "reconnect": "重新连接",
+            "manualEntry": "手动输入访问令牌",
+            "manualEntryHint": "手动输入的新令牌会更新 Companion 中保存的凭证。",
+            "readFailedTitle": "Companion 凭证读取失败",
+            "readFailedHint": "无法读取 Companion 保存的凭证（版本可能不匹配）。请手动输入令牌；若持续失败请重启 Companion。",
+            "persistFailed": "已连接，但凭证未能安全保存，下次需重新输入令牌。",
+            "persistSucceeded": "拥有者凭证已由 Companion 安全保存，下次打开将自动连接。",
+            "persistAttached": "凭证已保存，但当前使用的是外部启动的控制台，重启 Companion 后生效。",
             "tokenSessionOnly": "令牌仅存储在浏览器会话中。",
             "noAuthFlag": "使用 --no-auth 标志禁用身份验证。"
         },

package/console/dist/ui/pages/settings/SettingsPage.js

@@ -7,7 +7,7 @@ import { cn } from "../../../lib/utils.js";
 import { PageShell } from "../../components/layout/page-shell.js";
 import { PageLoading } from "../../components/layout/page-loading.js";
 import { SectionTitle } from "../../components/layout/section-title.js";
-import { getToken, setToken, fetchWorkspaces, addWorkspace, removeWorkspace, syncWorkspace, fetchOutputLanguage, updateOutputLanguage, fetchConfigSummary, patchFeatureFlag, fetchOwnerIdentity, registerOwnerIdentity, unregisterOwnerIdentity, } from "../../api.js";
+import { getToken, setToken, clearToken, fetchWorkspaces, addWorkspace, removeWorkspace, syncWorkspace, fetchOutputLanguage, updateOutputLanguage, fetchConfigSummary, patchFeatureFlag, fetchOwnerIdentity, registerOwnerIdentity, unregisterOwnerIdentity, } from "../../api.js";
 import { resetOnboardingState } from "../../utils/onboarding-state.js";
 // ── Runtime validators (H section / ERR-001/005/009/013) ─────────────────────
 /** Type guard: is this a non-null object with own properties (not inherited)? */
@@ -87,6 +87,8 @@ export function SettingsPage() {
     const [errorMessage, setErrorMessage] = useState(null);
     // Auth token state
     const [tokenInput, setTokenInput] = useState("");
+    // Inline confirm for credential clearing (J.1 pattern, same as workspace removal)
+    const [confirmClearToken, setConfirmClearToken] = useState(false);
     // ADR-0022 (PRI-578): Owner identity registration state
     const [ownerIdentity, setOwnerIdentity] = useState(null);
     const [ownerIdInput, setOwnerIdInput] = useState("");
@@ -241,6 +243,54 @@ export function SettingsPage() {
             toast.error(t("pages.settings.tokenSaveFailed"));
         }
     }, [tokenInput, loadOnboardingFlag, t]);
+    // Credential lifecycle rollback (SPEC §6.4 清除凭证): drop the durable
+    // credential and return the Console to its pre-binding no-auth state. In a
+    // plain browser there is nothing durable — only the session cache.
+    const handleClearToken = useCallback(async () => {
+        setConfirmClearToken(false);
+        const companion = getCompanionBridge();
+        if (companion === undefined) {
+            clearToken();
+            setTokenInput("");
+            toast.success(t("pages.settings.tokenClearedSession"));
+            return;
+        }
+        try {
+            const result = await companion.clearConsoleToken();
+            if (!result.cleared) {
+                // inherited_env_token: the token comes from the OS environment and
+                // would return on the next launch — refuse the fake-durable clear and
+                // tell the Owner where the real authority lives (rc-9).
+                if (result.reason === "inherited_env_token") {
+                    toast.info(t("pages.settings.tokenInheritedEnv"));
+                }
+                else {
+                    toast.error(t("pages.settings.tokenClearFailed"));
+                }
+                if (result.nextAction)
+                    toast.info(result.nextAction, { duration: 8000 });
+                return;
+            }
+            clearToken();
+            setTokenInput("");
+            if (result.reason === "external_console_attached") {
+                // Clear-specific message: the credential IS cleared on this side;
+                // the external server still enforces its own copy.
+                toast.info(t("pages.settings.tokenClearedExternalAttached"));
+            }
+            else if (result.restartRequested) {
+                toast.success(t("pages.settings.tokenClearedRestarting"));
+            }
+            else {
+                toast.success(t("pages.settings.tokenCleared"));
+            }
+            if (result.nextAction)
+                toast.info(result.nextAction, { duration: 8000 });
+        }
+        catch {
+            toast.error(t("pages.settings.tokenClearFailed"));
+        }
+    }, [t]);
     // ── Workspace handlers ─────────────────────────────────────────────────
     const handleAddWorkspace = useCallback(async () => {
         const name = addName.trim();
@@ -345,7 +395,7 @@ export function SettingsPage() {
         return (_jsxs(PageShell, { children: [_jsx("div", { className: "font-mono text-[12px] tracking-[0.14em] text-ink-3 uppercase mb-3", children: t("pages.settings.eyebrow") }), _jsx("h1", { className: "text-[29px] font-semibold tracking-tight text-ink mb-2", children: t("pages.settings.title") }), _jsxs("div", { className: "mt-6 p-4 bg-panel border border-line rounded-[6px] text-ink-2 text-sm", children: [_jsx("p", { children: t("pages.settings.loadError") }), errorMessage && (_jsx("p", { className: "mt-2 text-ink-4 text-[13px] font-mono", children: errorMessage }))] })] }));
     }
     // ── Loaded state ─────────────────────────────────────────────────────────
-    return (_jsx(PageShell, { children: _jsxs("div", { className: "animate-[pdFadeIn_400ms_ease-out]", children: [_jsx("div", { className: "font-mono text-[12px] tracking-[0.14em] text-ink-3 uppercase mb-3", children: t("pages.settings.eyebrow") }), _jsx("h1", { className: "text-[29px] font-semibold tracking-tight text-ink mb-2", children: t("pages.settings.title") }), _jsx("p", { className: "text-ink-3 text-[14px] max-w-[760px] leading-relaxed mb-7", children: t("pages.settings.subtitle") }), _jsxs("section", { className: "mb-8", "aria-labelledby": "section-auth", children: [_jsx(SectionTitle, { id: "section-auth", children: t("pages.settings.auth") }), _jsxs("div", { className: "bg-panel border border-line rounded-[6px] p-5", children: [_jsx("label", { htmlFor: "bearer-token-input", className: "block text-sm font-medium text-ink mb-2", children: t("pages.settings.bearerToken") }), _jsx("input", { id: "bearer-token-input", type: "password", value: tokenInput, onChange: (e) => setTokenInput(e.target.value), placeholder: t("pages.settings.enterAccessToken"), className: "w-full border border-line bg-surface rounded-[3px] px-3 py-2 text-sm text-ink focus:outline-none focus:border-gov focus:ring-1 focus:ring-gov" }), _jsxs("div", { className: "flex items-center justify-between mt-3", children: [_jsx("button", { onClick: handleSaveToken, disabled: tokenInput.trim().length === 0, className: "border border-gov bg-gov text-paper rounded-[3px] px-[14px] py-[6px] text-[12.5px] font-medium hover:bg-gov-2 transition-colors disabled:opacity-50 disabled:cursor-not-allowed focus-visible:outline-2 focus-visible:outline-gov focus-visible:outline-offset-2", children: t("common.save") }), _jsx("span", { className: "text-ink-4 text-[12px]", children: getCompanionBridge() === undefined
+    return (_jsx(PageShell, { children: _jsxs("div", { className: "animate-[pdFadeIn_400ms_ease-out]", children: [_jsx("div", { className: "font-mono text-[12px] tracking-[0.14em] text-ink-3 uppercase mb-3", children: t("pages.settings.eyebrow") }), _jsx("h1", { className: "text-[29px] font-semibold tracking-tight text-ink mb-2", children: t("pages.settings.title") }), _jsx("p", { className: "text-ink-3 text-[14px] max-w-[760px] leading-relaxed mb-7", children: t("pages.settings.subtitle") }), _jsxs("section", { className: "mb-8", "aria-labelledby": "section-auth", children: [_jsx(SectionTitle, { id: "section-auth", children: t("pages.settings.auth") }), _jsxs("div", { className: "bg-panel border border-line rounded-[6px] p-5", children: [_jsx("label", { htmlFor: "bearer-token-input", className: "block text-sm font-medium text-ink mb-2", children: t("pages.settings.bearerToken") }), _jsx("input", { id: "bearer-token-input", type: "password", value: tokenInput, onChange: (e) => setTokenInput(e.target.value), placeholder: t("pages.settings.enterAccessToken"), className: "w-full border border-line bg-surface rounded-[3px] px-3 py-2 text-sm text-ink focus:outline-none focus:border-gov focus:ring-1 focus:ring-gov" }), _jsxs("div", { className: "flex items-center justify-between mt-3 gap-3", children: [_jsxs("div", { className: "flex items-center gap-2", children: [_jsx("button", { onClick: handleSaveToken, disabled: tokenInput.trim().length === 0, className: "border border-gov bg-gov text-paper rounded-[3px] px-[14px] py-[6px] text-[12.5px] font-medium hover:bg-gov-2 transition-colors disabled:opacity-50 disabled:cursor-not-allowed focus-visible:outline-2 focus-visible:outline-gov focus-visible:outline-offset-2", children: t("common.save") }), confirmClearToken ? (_jsxs(_Fragment, { children: [_jsx("button", { onClick: handleClearToken, className: "border border-amber bg-amber text-ink rounded-[3px] px-[14px] py-[6px] text-[12.5px] font-medium hover:opacity-90 transition-colors focus-visible:outline-2 focus-visible:outline-gov focus-visible:outline-offset-2", children: t("pages.settings.clearTokenConfirm") }), _jsx("button", { onClick: () => setConfirmClearToken(false), className: "border border-line text-ink rounded-[3px] px-[14px] py-[6px] text-[12.5px] font-medium hover:border-gov transition-colors focus-visible:outline-2 focus-visible:outline-gov focus-visible:outline-offset-2", children: t("common.cancel") })] })) : (_jsx("button", { onClick: () => setConfirmClearToken(true), className: "border border-line text-ink-3 rounded-[3px] px-[14px] py-[6px] text-[12.5px] font-medium hover:border-gov hover:text-ink transition-colors focus-visible:outline-2 focus-visible:outline-gov focus-visible:outline-offset-2", children: t("pages.settings.clearToken") }))] }), _jsx("span", { className: "text-ink-4 text-[12px]", children: getCompanionBridge() === undefined
                                                 ? t("pages.settings.tokenSessionOnly")
                                                 : t("pages.settings.tokenDesktopStored") })] })] })] }), _jsxs("section", { className: "mb-8", "aria-labelledby": "section-owner-identity", children: [_jsx(SectionTitle, { id: "section-owner-identity", children: t("pages.settings.ownerIdentity.title") }), _jsxs("div", { className: "bg-panel border border-line rounded-[6px] p-5", children: [_jsx("p", { className: "text-ink-3 text-[13px] leading-relaxed mb-3", children: t("pages.settings.ownerIdentity.intro") }), ownerIdentity === null ? (_jsx("div", { className: "text-ink-4 text-[12px]", children: t("pages.settings.ownerIdentity.loading") })) : (_jsxs(_Fragment, { children: [_jsxs("div", { className: "flex items-center gap-2 text-[13px] mb-2", "data-testid": "owner-identity-status", children: [_jsx("span", { className: `inline-flex items-center rounded-[2px] px-[7px] py-1 font-mono text-[11px] uppercase ${ownerIdentity.resolved.source === "none"
                                                         ? "bg-amber text-ink"

package/console/dist/web/assets/app.css

@@ -1767,6 +1767,9 @@
   .py-4 {
     padding-block: calc(var(--spacing) * 4);
   }
+  .py-6 {
+    padding-block: calc(var(--spacing) * 6);
+  }
   .py-8 {
     padding-block: calc(var(--spacing) * 8);
   }
@@ -2488,6 +2491,9 @@
         border-color: color-mix(in oklab, var(--color-danger) 30%, transparent);
       }
     }
+    .hover\:border-gov:hover {
+      border-color: var(--color-gov);
+    }
     .hover\:border-line:hover {
       border-color: var(--color-line);
     }