create-principles-disciple 1.142.0 → 1.142.2

package/console/dist/ui/api.js

@@ -1,14 +1,17 @@
+import { clearStoredToken, loadStoredToken, storeToken } from "./utils/token-storage.js";
 import { listActiveSignalKeywords, listPendingSignalTerms, fetchKeywordStore, fetchPendingTerms, updateKeywordStore, admitPendingTerm, rejectPendingTerm, } from "./utils/signal-keywords-api.js";
 import { validateErrorResponse, validateHeaders, validateFeedbackReport, validateFeedbackDraftsList, validateFeedbackDraftEnvelope, validateFeedbackChannels, validateFeedbackSubmitResult, validateDeleteEnvelope, validateWorkspaceEntry, validateWorkspaceList, validateRemovedEnvelope, validateSyncResult, validateConfigSummary, validateConfigCatalog, validateAgentBindingUpdate, validateDefaultRuntimeUpdate, validateRuntimeProfileMutation, validateReadinessCheck, validateFeatureFlagUpdate, validateOutputLanguage, validateGovernanceQueue, validateRecoveryResult, validateFailedTaskDetail, validateOwnerDecisionsData, validateOwnerResolutionResult, validateActivations, validateDisableActivation, validateLifecycleMetrics, validateUpdateStatus, validateUpdateHistory, validateApplyUpdateResult, validateRollbackResult, validateApprovalRecordDirect, validatePrinciplesList, validateCorePrinciples, validateApprovalsGrouped, validateEvidenceChain, validateTrajectoryData, validateIntentSummary, validateIntentDecisionList, validateIntentDecisionResult, validateIntentDecisionSummary, validateFollowUpResponse, validateIntentInitResult, validateIntentSaveResult, validateIntentRawContent, validateIntentVersions, validateOwnerGovernanceView, validateGovernanceExperienceSnapshot, validateRuleCodeOwnerReview, validateRuleCodeMutation, validateOwnerIdentityView, validateOwnerIdentityRegister, validateOwnerIdentityUnregister, } from "./utils/validators.js";
 // ── Auth ──────────────────────────────────────────────────────────────────────
 function getToken() {
-    return sessionStorage.getItem("pd_token");
+    // PRI-793: localStorage-backed (with one-time migration from the legacy
+    // sessionStorage copy) so the token survives browser restarts.
+    return loadStoredToken();
 }
 function setToken(token) {
-    sessionStorage.setItem("pd_token", token);
+    storeToken(token);
 }
 function clearToken() {
-    sessionStorage.removeItem("pd_token");
+    clearStoredToken();
 }
 /**
  * True when an unauthorized response should route the UI to the login route.

package/console/dist/ui/utils/__tests__/token-storage.test.d.ts

@@ -0,0 +1 @@
+export {};

package/console/dist/ui/utils/__tests__/token-storage.test.js

@@ -0,0 +1,64 @@
+import { describe, expect, it } from "vitest";
+import { clearStoredToken, loadStoredToken, storeToken } from "../token-storage.js";
+/** Minimal in-memory Storage double (no window dependency). */
+function fakeStorage() {
+    const map = new Map();
+    return {
+        get length() {
+            return map.size;
+        },
+        clear: () => map.clear(),
+        getItem: (k) => (map.has(k) ? map.get(k) : null),
+        key: (i) => Array.from(map.keys())[i] ?? null,
+        removeItem: (k) => void map.delete(k),
+        setItem: (k, v) => void map.set(k, v),
+    };
+}
+describe("token-storage (PRI-793)", () => {
+    it("stores into localStorage and leaves no sessionStorage copy", () => {
+        const main = fakeStorage();
+        const legacy = fakeStorage();
+        storeToken("tok-1", main, legacy);
+        expect(main.getItem("pd_token")).toBe("tok-1");
+        expect(legacy.getItem("pd_token")).toBe(null);
+    });
+    it("loads the persisted token across 'browser restarts'", () => {
+        const main = fakeStorage();
+        const legacy = fakeStorage();
+        storeToken("tok-2", main, legacy);
+        expect(loadStoredToken(main, legacy)).toBe("tok-2");
+    });
+    it("migrates a legacy sessionStorage token once, then owns it in localStorage only", () => {
+        const main = fakeStorage();
+        const legacy = fakeStorage();
+        legacy.setItem("pd_token", "legacy-tok");
+        expect(loadStoredToken(main, legacy)).toBe("legacy-tok");
+        expect(main.getItem("pd_token")).toBe("legacy-tok");
+        expect(legacy.getItem("pd_token")).toBe(null);
+    });
+    it("returns null when nothing is stored anywhere", () => {
+        expect(loadStoredToken(fakeStorage(), fakeStorage())).toBe(null);
+    });
+    it("clear removes both storage copies so a stale token cannot resurrect", () => {
+        const main = fakeStorage();
+        const legacy = fakeStorage();
+        storeToken("tok-3", main, legacy);
+        legacy.setItem("pd_token", "stale");
+        clearStoredToken(main, legacy);
+        expect(main.getItem("pd_token")).toBe(null);
+        expect(legacy.getItem("pd_token")).toBe(null);
+        expect(loadStoredToken(main, legacy)).toBe(null);
+    });
+    it("re-login overwrites the persisted token", () => {
+        const main = fakeStorage();
+        const legacy = fakeStorage();
+        storeToken("old", main, legacy);
+        storeToken("new", main, legacy);
+        expect(loadStoredToken(main, legacy)).toBe("new");
+    });
+    it("degrades gracefully when no Storage exists (non-DOM environment)", () => {
+        expect(loadStoredToken(null, null)).toBe(null);
+        expect(() => storeToken("tok", null, null)).not.toThrow();
+        expect(() => clearStoredToken(null, null)).not.toThrow();
+    });
+});

package/console/dist/ui/utils/token-storage.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Browser-side persistence for the Console login token (PRI-793).
+ *
+ * The token lives in localStorage so the Owner is not re-prompted on every
+ * browser start. sessionStorage is only a migration source: a token left
+ * there by older builds is promoted to localStorage once and then removed —
+ * localStorage is the single source of truth afterwards (P4).
+ *
+ * Clearing (logout / Settings "清除凭证") removes both keys so a stale copy
+ * can never resurrect the session.
+ *
+ * Storages are resolved from globalThis (browsers expose localStorage /
+ * sessionStorage there) and may be absent — non-DOM test environments run
+ * the same code path with null storages, where persistence degrades to
+ * "no stored token" instead of crashing. Explicit arguments override the
+ * builtins for tests.
+ */
+type TokenStorage = Storage | null | undefined;
+export declare function loadStoredToken(storage?: TokenStorage, legacy?: TokenStorage): string | null;
+export declare function storeToken(token: string, storage?: TokenStorage, legacy?: TokenStorage): void;
+export declare function clearStoredToken(storage?: TokenStorage, legacy?: TokenStorage): void;
+export {};

package/console/dist/ui/utils/token-storage.js

@@ -0,0 +1,47 @@
+/**
+ * Browser-side persistence for the Console login token (PRI-793).
+ *
+ * The token lives in localStorage so the Owner is not re-prompted on every
+ * browser start. sessionStorage is only a migration source: a token left
+ * there by older builds is promoted to localStorage once and then removed —
+ * localStorage is the single source of truth afterwards (P4).
+ *
+ * Clearing (logout / Settings "清除凭证") removes both keys so a stale copy
+ * can never resurrect the session.
+ *
+ * Storages are resolved from globalThis (browsers expose localStorage /
+ * sessionStorage there) and may be absent — non-DOM test environments run
+ * the same code path with null storages, where persistence degrades to
+ * "no stored token" instead of crashing. Explicit arguments override the
+ * builtins for tests.
+ */
+const TOKEN_KEY = "pd_token";
+function builtin(kind) {
+    const g = globalThis;
+    return (kind === "local" ? g.localStorage : g.sessionStorage) ?? null;
+}
+export function loadStoredToken(storage, legacy) {
+    const main = storage ?? builtin("local");
+    const old = legacy ?? builtin("session");
+    const current = main?.getItem(TOKEN_KEY) ?? null;
+    if (current !== null)
+        return current;
+    const legacyToken = old?.getItem(TOKEN_KEY) ?? null;
+    if (legacyToken === null)
+        return null;
+    main?.setItem(TOKEN_KEY, legacyToken);
+    old?.removeItem(TOKEN_KEY);
+    return legacyToken;
+}
+export function storeToken(token, storage, legacy) {
+    const main = storage ?? builtin("local");
+    const old = legacy ?? builtin("session");
+    main?.setItem(TOKEN_KEY, token);
+    old?.removeItem(TOKEN_KEY);
+}
+export function clearStoredToken(storage, legacy) {
+    const main = storage ?? builtin("local");
+    const old = legacy ?? builtin("session");
+    main?.removeItem(TOKEN_KEY);
+    old?.removeItem(TOKEN_KEY);
+}