create-walle 0.10.0 → 0.10.2

package/template/coding-task-manager/public/js/app/models-tab.js

@@ -56,6 +56,16 @@ var _modelsAgentStatusPromise = null;
 // 2 s setTimeout while a flow is open — never an interval, and it stops itself as soon
 // as no flow is open, so an idle models page costs nothing.
 var _modelsProviderLogin = null;
+// WP-3 (docs/remote-agent-sign-in-from-hub-browser-2026-10-25.html §5 D-7/D-9): the last
+// login-state payload read for a REMOTE machine (keyed by instance id) — the Machines page's
+// machine-scoped poll keeps its box's truth here, deliberately apart from _modelsProviderLogin so a
+// box's sign-in state can never be painted as this machine's own card.
+var _modelsProviderLoginMachines = {};
+// WP-2 fix: the last payload fingerprint the card was painted from. The 2 s poll
+// re-reads login-state every tick, but the probe only moves `account.checkedAt`
+// between ticks — repainting for that alone rebuilt the whole section (and with it
+// the code box the user was typing into) every 2 s. See _modelsProviderLoginRenderKey.
+var _modelsProviderLoginLastRenderKey = '';
 var _modelsProviderLoginPollTimer = null;
 var _modelsProviderLoginPolling = false;
 var _MODELS_PROVIDER_LOGIN_OPEN_STATUSES = ['starting', 'running', 'awaiting_user'];
@@ -97,6 +107,10 @@ var _routingSuggestionHistory = [];
 var _routingBanditHistory = [];
 var _routingBanditReadiness = null;
 var _routingLaunchState = null;
+// WP-7 (lead-cost routing §6.9): the "Helper rules" pill's read model — the Wall-E cell list and
+// the one-line error the panel shows instead of an alert.
+var _helperRulesCells = null;
+var _helperRulesError = null;
 
 // AI Providers → Usage tab: token/cost consumption for the default model, split by
 // process (Wall-E chat vs CTM) and kept separate from the coding-agent model.
@@ -1857,6 +1871,9 @@ function _ensureModelsAgentStatus(force) {
   ]).then(function(results) {
     _modelsAutoUpdate = results[3];
     if (results[4] && results[4].providers) _modelsProviderLogin = results[4];
+    // WP-2 fix (A): this fan-out renders the card itself (below), so remember what it
+    // painted — the first poll after a page load must not repaint for nothing.
+    _modelsProviderLoginLastRenderKey = _modelsProviderLoginRenderKey(_modelsProviderLogin);
     _modelsCodingAgentMigrateLocalDismissals(results[1]);
     _modelsAgentStatus = {
       available: results[0] || { agents: {} },
@@ -1909,18 +1926,34 @@ function _modelsProviderLoginFlowIsOpen(flow) {
   return !!flow && _MODELS_PROVIDER_LOGIN_OPEN_STATUSES.indexOf(String(flow.status || '')) >= 0;
 }
 
-// The Account row: signed-in email + plan, "Not signed in", or the probe's reason.
+// The Account row (R-4): signed-in email + plan, "Not signed in", or -- when the
+// probe could not answer (signedIn === null: non-primary instance, hermetic env,
+// timeout, CLI missing) -- plain "Unknown". The probe's machine reason
+// ('probe_unavailable', 'cli_missing', ...) is a diagnostic, never user copy: it
+// rides in the value's title via _modelsCodingAgentAccountTitle below, exactly
+// like the status pill's own title.
 function _modelsCodingAgentAccountText(preset) {
   var entry = _modelsProviderLoginEntry(preset);
-  if (!entry) return 'Unknown (unavailable)';
-  var account = entry.account || null;
-  if (!account) return 'Unknown (no probe)';
-  if (account.signedIn === true) {
+  var account = (entry && entry.account) || null;
+  if (account && account.signedIn === true) {
     var who = account.email ? String(account.email) : 'signed in';
     return account.plan ? (who + ' · ' + account.plan) : who;
   }
-  if (account.signedIn === false) return 'Not signed in';
-  return 'Unknown (' + (account.reason ? String(account.reason) : 'unknown') + ')';
+  if (account && account.signedIn === false) return 'Not signed in';
+  return 'Unknown';
+}
+
+// The diagnostic behind an "Unknown" account: which machine reason kept the probe
+// from answering, plus the probe's own detail when it has one. Empty when the row
+// has nothing to explain (a probe that answered, signed in or not).
+function _modelsCodingAgentAccountTitle(preset) {
+  var entry = _modelsProviderLoginEntry(preset);
+  if (!entry) return 'Login probe: unavailable';
+  var account = entry.account || null;
+  if (!account) return 'Login probe: no probe';
+  if (typeof account.signedIn === 'boolean') return '';
+  var reason = account.reason ? String(account.reason) : 'unknown';
+  return 'Login probe: ' + reason + (account.detail ? ' — ' + String(account.detail) : '');
 }
 
 function _modelsCodingAgentAccountColor(preset) {
@@ -1930,17 +1963,154 @@ function _modelsCodingAgentAccountColor(preset) {
   return 'var(--fg-dim,#565f89)';
 }
 
-// Only a URL the browser parses as https may become an href — the CLI prints this
-// string, and the card must never turn it into a link of another scheme.
+// D-1 on the client (S-10, defence in depth): the CLI also opens an automatic
+// browser on ITS own machine, so a loopback URL is that machine's link, never one a
+// remote (hub / phone) viewer of this card can follow. Both halves of the URL are
+// checked — the link host and, when present, the OAuth redirect_uri it carries.
+//
+// true when `value` parses to a loopback host. A value that is not a URL at all is
+// not loopback: it just cannot promote an href (the caller drops it for its scheme).
+function _modelsProviderLoginLoopbackHost(value) {
+  var hosts = ['localhost', '127.0.0.1', '::1', '[::1]'];
+  var host = '';
+  try {
+    host = new URL(String(value || '')).hostname;
+  } catch (e) {
+    return false;
+  }
+  return hosts.indexOf(String(host).toLowerCase()) >= 0;
+}
+
+// Only a URL the browser parses as https — and whose host, and redirect_uri host,
+// are not loopback — may become an href. The CLI prints this string; the card must
+// never turn it into a link of another scheme, nor hand out its own machine's link.
 function _modelsProviderLoginUrl(value) {
   try {
     var parsed = new URL(String(value || ''));
-    return parsed.protocol === 'https:' ? parsed.href : '';
+    if (parsed.protocol !== 'https:') return '';
+    if (_modelsProviderLoginLoopbackHost(parsed.href)) return '';
+    var redirect = parsed.searchParams.get('redirect_uri');
+    if (redirect && _modelsProviderLoginLoopbackHost(redirect)) return '';
+    return parsed.href;
   } catch (e) {
     return '';
   }
 }
 
+function _modelsProviderLoginHintStyle() {
+  return 'font-size:11px;color:var(--fg-dim,#565f89);';
+}
+
+// §9 S-9: the server's refusal ids are machine copy — the card says what the user
+// can do about each one. Anything unrecognised still names its id, never a blank.
+function _modelsProviderLoginErrorText(errorId) {
+  var id = String(errorId === null || errorId === undefined ? '' : errorId);
+  if (id === 'code_format_invalid') return "That doesn't look like a sign-in code. Paste the code, or the page address, from the sign-in page.";
+  if (id === 'code_state_mismatch') return 'That code is from a different sign-in. Use the link above and try again.';
+  if (id === 'code_from_loopback_redirect') return 'That page came from a localhost link. Use the Open sign-in page link above.';
+  if (id === 'login_tab_gone' || id === 'provider_login_not_open') return 'The sign-in tab closed. Start Sign in again.';
+  if (id === 'code_entry_not_supported') return 'This sign-in does not take a code here.';
+  return 'Could not send the code (' + id + ').';
+}
+
+// D-3/D-7: the way the code travels decides the fragment — never the provider id.
+// 'browser' (Codex) shows the one-time code the tab printed for the browser,
+// 'paste' (Claude) takes the code the browser shows back, '' waits for the page.
+// Same markup and same labels on every host.
+function _modelsProviderLoginCodeEntryHtml(flow) {
+  var entry = (flow && flow.codeEntry) || '';
+  var hintStyle = _modelsProviderLoginHintStyle();
+  if (entry === 'browser') {
+    return '<code data-sign-in-user-code style="font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:11px;background:var(--bg,#1a1b26);border:1px solid var(--border,#414868);border-radius:4px;padding:2px 6px;color:var(--fg,#c0caf5);">'
+        + escHtml((flow && flow.userCode) || '') + '</code>'
+      + '<button type="button" data-sign-in-copy-code style="' + _modelsProviderLoginButtonStyle(false) + '">Copy code</button>'
+      + '<span data-sign-in-hint style="' + hintStyle + '">Enter this code on the sign-in page.</span>';
+  }
+  if (entry === 'paste') {
+    return '<input data-sign-in-code type="text" inputmode="text" autocomplete="off" spellcheck="false" placeholder="Paste the code from the sign-in page" style="font-size:11px;padding:4px 7px;border-radius:5px;border:1px solid var(--border,#414868);background:var(--bg,#1a1b26);color:var(--fg,#c0caf5);min-width:240px;" />'
+      + '<button type="button" data-sign-in-code-submit style="' + _modelsProviderLoginButtonStyle(true) + '">Submit code</button>'
+      + '<span data-sign-in-hint style="' + hintStyle + '">After you sign in, the page shows a code. Paste it here (the page address works too).</span>'
+      + '<span data-sign-in-error style="font-size:11px;color:#f7768e;"></span>';
+  }
+  return '<span data-sign-in-hint style="' + hintStyle + '">Waiting for the sign-in page…</span>';
+}
+
+// WP-3 (docs/remote-agent-sign-in-from-hub-browser-2026-10-25.html §5 D-7/D-9, §6, S-13):
+// the machine scope. The SAME `&machine=<id>` fragment the picker routes carry
+// (machineQueryParam(), public/js/core/session-commands.js) — spelled here rather than called,
+// because machineQueryParam() reads the PICKER's selection and the machine a card is scoped to is
+// an explicit argument, not that selection. '' produces nothing, so every unscoped URL is
+// byte-identical to its pre-WP-3 self.
+//
+// It is appended to the URL _modelsApiUrl() RETURNS, never to its argument: _modelsApiUrl appends
+// `?token=`/`&token=` to whatever it is handed, so a fragment spliced into the pathname would end
+// up before the token and the query would read `…/login&machine=x?token=…` — a route the hub does
+// not serve. `&machine=` is always well-formed here because _modelsApiUrl always emits a query.
+function _modelsProviderLoginMachineScope(machineId) {
+  var id = machineId === null || machineId === undefined ? '' : String(machineId).trim();
+  return id ? '&machine=' + encodeURIComponent(id) : '';
+}
+
+// One POST, one meaning: hand the pasted code to the sign-in tab (§5 D-4). The value
+// is never logged, toasted or written anywhere but the input itself, and the button
+// stays disabled until the answer arrives (so a second Enter cannot double-post).
+// WP-3: `opts.machineId` (S-13) targets the box that owns the flow — the hub forwards to it.
+function _modelsProviderLoginSubmitCode(providerId, inputEl, errorEl, btn, opts) {
+  var options = opts || {};
+  if (!providerId || !inputEl) return Promise.resolve();
+  var submitBtn = btn || null;
+  var errorSpan = errorEl || null;
+  if (submitBtn && submitBtn.disabled) return Promise.resolve();
+  if (submitBtn) submitBtn.disabled = true;
+  if (errorSpan) errorSpan.textContent = '';
+  var refuse = function(errorId) {
+    if (errorSpan) errorSpan.textContent = _modelsProviderLoginErrorText(errorId);
+    if (submitBtn) submitBtn.disabled = false;
+  };
+  return fetch(_modelsApiUrl('/api/providers/' + encodeURIComponent(providerId) + '/login/code')
+    + _modelsProviderLoginMachineScope(options.machineId), {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ code: String(inputEl.value || '') }),
+  })
+    .then(
+      function(r) {
+        return r.json().then(
+          function(data) { return { ok: r.ok, data: data }; },
+          function() { return { ok: r.ok, data: null }; },
+        );
+      },
+      function() { return null; },
+    )
+    .then(function(result) {
+      if (!result) {
+        refuse('network_error');
+        return null;
+      }
+      if (result.ok) {
+        if (typeof toast === 'function') toast('Code sent to the sign-in tab');
+        inputEl.value = '';
+        return _modelsProviderLoginRefresh(options);
+      }
+      refuse((result.data && result.data.error) || 'unknown_error');
+      return null;
+    });
+}
+
+// The clipboard is the browser's, and its refusal is a label, never an exception
+// escaping to the console. No timer: the label holds until the next render.
+function _modelsProviderLoginCopyCode(code, btn) {
+  var label = function(text) { if (btn) btn.textContent = text; };
+  try {
+    navigator.clipboard.writeText(String(code || '')).then(
+      function() { label('Copied'); },
+      function() { label('Copy failed'); },
+    );
+  } catch (e) {
+    label('Copy failed');
+  }
+}
+
 function _modelsProviderLoginButtonStyle(primary) {
   return primary
     ? 'padding:5px 10px;border-radius:5px;border:1px solid rgba(224,175,104,0.55);background:rgba(224,175,104,0.12);color:#e0af68;cursor:pointer;font-size:11px;font-weight:700;'
@@ -1948,9 +2118,17 @@ function _modelsProviderLoginButtonStyle(primary) {
 }
 
 // The card's sign-in action area. Same markup and same labels on every host (R-4).
-function _modelsProviderLoginActionsHtml(preset) {
+//
+// WP-3 (S-13): `flowOverride` (undefined = read the card's own payload) and `opts.machineId` let a
+// DIFFERENT surface — the Machines page — render this same block for a REMOTE machine. With a
+// machineId the block is machine-scoped: the tab button is never offered (D-9: the sign-in tab
+// lives on the box, there is no local session to activate), and the caller fills the block for its
+// own row. Called with no flow and no opts (the card's own call site) the output is unchanged.
+function _modelsProviderLoginActionsHtml(preset, flowOverride, opts) {
+  var options = opts || {};
+  var machineId = options.machineId === null || options.machineId === undefined ? '' : String(options.machineId).trim();
   if (!_modelsProviderIdForPreset(preset)) return '';
-  var flow = _modelsProviderLoginFlowFor(preset);
+  var flow = flowOverride === undefined ? _modelsProviderLoginFlowFor(preset) : flowOverride;
   var status = _modelsCodingAgentStatusFor(preset, _modelsCodingAgentAccountFor(preset));
   if (_modelsProviderLoginFlowIsOpen(flow)) {
     var parts = [];
@@ -1958,12 +2136,15 @@ function _modelsProviderLoginActionsHtml(preset) {
     if (url) {
       parts.push('<a data-open-sign-in-page href="' + escHtml(url) + '" target="_blank" rel="noopener" style="' + _modelsProviderLoginButtonStyle(true) + 'text-decoration:none;display:inline-block;">Open sign-in page</a>');
     }
-    parts.push('<span data-sign-in-hint style="font-size:11px;color:var(--fg-dim,#565f89);">Enter the code shown in the sign-in tab</span>');
-    if (flow.sessionId) {
+    parts.push(_modelsProviderLoginCodeEntryHtml(flow));
+    if (flow.sessionId && !machineId) {
       parts.push('<button type="button" data-show-sign-in-tab="' + escHtml(flow.sessionId) + '" style="' + _modelsProviderLoginButtonStyle(false) + '">Show sign-in tab</button>');
     }
     return parts.join('');
   }
+  // A machine-scoped block with no open flow renders nothing: the Machines page owns that row's
+  // own Sign in button (data-machine-sign-in), so a second one here would double the affordance.
+  if (machineId) return '';
   var failed = !!(flow && flow.status === 'failed');
   var html = '';
   if (failed) {
@@ -1978,8 +2159,11 @@ function _modelsProviderLoginActionsHtml(preset) {
   return html;
 }
 
-function _modelsProviderLoginHasOpenFlow() {
-  var providers = (_modelsProviderLogin && _modelsProviderLogin.providers) || {};
+// `login` defaults to the card's own payload, so the card's call sites are unchanged; a
+// machine-scoped poll passes the payload it just fetched for that box.
+function _modelsProviderLoginHasOpenFlow(login) {
+  var source = login === undefined ? _modelsProviderLogin : login;
+  var providers = (source && source.providers) || {};
   return Object.keys(providers).some(function(id) {
     return _modelsProviderLoginFlowIsOpen(providers[id] && providers[id].flow);
   });
@@ -1993,30 +2177,78 @@ function _modelsProviderLoginStopPoll() {
   _modelsProviderLoginPolling = false;
 }
 
+// WP-2 fix (A): what a login-state payload contributes to the card — per provider
+// (sorted, so key order never matters): `status`, `credential`, every field of `flow`
+// and every field of `account` EXCEPT `checkedAt`, which is the probe's own timestamp
+// and is not rendered anywhere. Two payloads with the same key paint the same card.
+function _modelsProviderLoginRenderKey(login) {
+  var stable = function stableJson(value) {
+    if (value === null || typeof value !== 'object') return JSON.stringify(value === undefined ? null : value);
+    if (Array.isArray(value)) return '[' + value.map(stableJson).join(',') + ']';
+    return '{' + Object.keys(value).sort().map(function(k) {
+      return JSON.stringify(k) + ':' + stableJson(value[k]);
+    }).join(',') + '}';
+  };
+  var providers = (login && login.providers) || {};
+  return Object.keys(providers).sort().map(function(id) {
+    var entry = providers[id] || {};
+    var account = entry.account;
+    if (account && typeof account === 'object' && !Array.isArray(account)) {
+      account = Object.keys(account).reduce(function(kept, k) {
+        if (k !== 'checkedAt') kept[k] = account[k];
+        return kept;
+      }, {});
+    }
+    return stable([id, entry.status, entry.credential, entry.flow, account]);
+  }).join('\n');
+}
+
 // Re-reads login-state and re-renders. Never rejects: a failed poll keeps the last
-// payload, so an open flow stays visible while the next poll retries.
-function _modelsProviderLoginRefresh() {
-  return fetch(_modelsApiUrl('/api/providers/login-state'), { cache: 'no-store' })
+// payload, so an open flow stays visible while the next poll retries. The repaint
+// happens only when the payload's fingerprint moved (WP-2 fix A): a tick that only
+// re-stamped `account.checkedAt` leaves the card — and any sign-in draft in it — alone.
+// WP-3 (S-13): `opts.machineId` reads the BOX's login-state through the hub's proxy. The payload
+// is kept per machine and never painted as this machine's own card (that is what
+// `opts.onPayload` is for: the Machines page repaints ITS row), so the two readers cannot
+// contaminate each other.
+function _modelsProviderLoginRefresh(opts) {
+  var options = opts || {};
+  var machineId = options.machineId === null || options.machineId === undefined ? '' : String(options.machineId).trim();
+  return fetch(_modelsApiUrl('/api/providers/login-state') + _modelsProviderLoginMachineScope(options.machineId), { cache: 'no-store' })
     .then(function(r) { return r.ok ? r.json() : null; })
     .then(function(data) {
+      if (machineId) {
+        if (data && data.providers) _modelsProviderLoginMachines[machineId] = data;
+        if (typeof options.onPayload === 'function') options.onPayload(_modelsProviderLoginMachines[machineId] || null);
+        return _modelsProviderLoginMachines[machineId] || null;
+      }
       if (data && data.providers) _modelsProviderLogin = data;
-      _modelsRefreshAgentStatusUi();
+      var key = _modelsProviderLoginRenderKey(_modelsProviderLogin);
+      if (key !== _modelsProviderLoginLastRenderKey) {
+        _modelsProviderLoginLastRenderKey = key;
+        _modelsRefreshAgentStatusUi();
+      }
       return _modelsProviderLogin;
     })
     .catch(function() {
-      return _modelsProviderLogin;
+      return machineId ? (_modelsProviderLoginMachines[machineId] || null) : _modelsProviderLogin;
     });
 }
 
-function _modelsProviderLoginPoll() {
+// The ONE 2 s poll. `opts.machineId` scopes it to a box (WP-3): same timer, same stop condition —
+// a machine-scoped poll stops as soon as THAT box reports no open flow.
+function _modelsProviderLoginPoll(opts) {
+  var options = opts || {};
+  var machineId = options.machineId === null || options.machineId === undefined ? '' : String(options.machineId).trim();
   if (_modelsProviderLoginPollTimer) return;
   _modelsProviderLoginPolling = true;
   _modelsProviderLoginPollTimer = setTimeout(function() {
     _modelsProviderLoginPollTimer = null;
-    _modelsProviderLoginRefresh().then(function() {
+    _modelsProviderLoginRefresh(options).then(function() {
       if (!_modelsProviderLoginPolling) return;
-      if (!_modelsProviderLoginHasOpenFlow()) { _modelsProviderLoginPolling = false; return; }
-      _modelsProviderLoginPoll();
+      var source = machineId ? _modelsProviderLoginMachines[machineId] : _modelsProviderLogin;
+      if (!_modelsProviderLoginHasOpenFlow(source)) { _modelsProviderLoginPolling = false; return; }
+      _modelsProviderLoginPoll(options);
     });
   }, _MODELS_PROVIDER_LOGIN_POLL_MS);
 }
@@ -2028,11 +2260,14 @@ function _modelsProviderLoginEnsurePoll() {
 }
 
 // POST opens the login tab; the flow then arrives through the login-state poll.
-function _modelsProviderLoginStart(preset, btn) {
+// WP-3: `opts.machineId` opens the tab on THAT box through the hub's proxy.
+function _modelsProviderLoginStart(preset, btn, opts) {
+  var options = opts || {};
   var providerId = _modelsProviderIdForPreset(preset);
   if (!providerId) return Promise.resolve(null);
   if (btn) { btn.disabled = true; btn.textContent = 'Opening...'; }
-  return fetch(_modelsApiUrl('/api/providers/' + encodeURIComponent(providerId) + '/login'), {
+  return fetch(_modelsApiUrl('/api/providers/' + encodeURIComponent(providerId) + '/login')
+    + _modelsProviderLoginMachineScope(options.machineId), {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: '{}',
@@ -2046,8 +2281,8 @@ function _modelsProviderLoginStart(preset, btn) {
       if (typeof toast === 'function') toast('Could not start sign-in: ' + reason, { type: 'error', duration: 5000 });
     }
     _modelsProviderLoginPolling = true;
-    return _modelsProviderLoginRefresh().then(function() {
-      if (_modelsProviderLoginHasOpenFlow()) _modelsProviderLoginPoll();
+    return _modelsProviderLoginRefresh(options).then(function() {
+      if (_modelsProviderLoginHasOpenFlow(options.machineId ? _modelsProviderLoginMachines[String(options.machineId).trim()] : undefined)) _modelsProviderLoginPoll(options);
       else _modelsProviderLoginPolling = false;
       return result;
     });
@@ -2903,7 +3138,7 @@ function _routingConfirm(title, detail, acceptLabel) {
 
 function _routingWorkflowPills() {
   return '<div role="tablist" aria-label="Routing views" style="display:flex;gap:4px;margin-bottom:14px;overflow-x:auto;">' +
-    [['workflows','Workflows'],['policies','Policies'],['measurements','Measurements']].map(function(item) {
+    [['workflows','Workflows'],['policies','Policies'],['measurements','Measurements'],['helper-rules','Helper rules']].map(function(item) {
       var active = _routingWorkflowPill === item[0];
       return '<button type="button" data-routing-pill="' + item[0] + '" style="padding:7px 12px;border-radius:6px;border:1px solid ' + (active ? 'var(--accent,#7aa2f7)' : 'var(--border,#414868)') + ';background:' + (active ? 'rgba(122,162,247,.16)' : 'transparent') + ';color:' + (active ? '#7aa2f7' : 'var(--fg-dim,#565f89)') + ';font-weight:700;cursor:pointer;white-space:nowrap;">' + item[1] + '</button>';
     }).join('') + '</div>';
@@ -3158,15 +3393,200 @@ function _routingMeasurementsMarkup() {
     '<div style="margin-top:14px;"><strong style="font-size:12px;">Suggestions</strong>' + (suggestions || '<div style="font-size:11px;color:var(--fg-dim,#565f89);margin-top:5px;">Suggestions appear after two arms each have at least 30 measured runs.</div>') + (audit?'<div style="margin-top:8px;">'+audit+'</div>':'') + '</div>' + banditPanel;
 }
 
+// WP-7 (design §6.9): the "Helper rules" panel — one row per rule cell as Wall-E reports it.
+// The rule evaluator (Wall-E, lib/helper-rules/store.js) owns every write; this panel only reads
+// and asks: Veto / Enable go through _routingConfirm and then straight to the API (D-18).
+var HELPER_RULE_STATE_COLOR = { on: '#9ece6a', probe: '#e0af68', off: '#f7768e' };
+// WP-6 (§6.9): the panel's outcome disclosure, keyed by cell. An entry exists only while the row is
+// open: { rows: array|null (null = in flight), error: string|null }. Session-only, never persisted.
+var _helperRulesOutcomes = {};
+
+function _helperRulesPct(value) {
+  var n = Number(value);
+  return (value == null || !isFinite(n)) ? '-' : (n * 100).toFixed(1) + '%';
+}
+
+// WP-6 (design §6.9, D-7): the rate column reports the measurability the evaluator stores
+// (`collecting` = "not enough measured rows to judge") instead of always showing a percentage, and
+// names the rows that measure nothing so a fallback rate is never read off an all-unmeasured window.
+function _helperRulesCount(metrics, key) {
+  return Math.max(0, Number(metrics[key] || 0) || 0);
+}
+
+function _helperRulesRate(cell) {
+  var metrics = cell.metrics || {};
+  if (cell.collecting) {
+    var collecting = ['collecting'];
+    if (cell.kind === 'explore' && _helperRulesCount(metrics, 'unmeasured') > 0) collecting.push('unmeasured ' + _helperRulesCount(metrics, 'unmeasured'));
+    return collecting.join(' · ');
+  }
+  if (cell.kind === 'explore') {
+    var parts = ['fallback ' + _helperRulesPct(metrics.fallback_rate)];
+    if (_helperRulesCount(metrics, 'unmeasured') > 0) parts.push('unmeasured ' + _helperRulesCount(metrics, 'unmeasured'));
+    if (_helperRulesCount(metrics, 'abandoned') > 0) parts.push('abandoned ' + _helperRulesCount(metrics, 'abandoned'));
+    if (Number(metrics.graded || 0) >= 1) parts.push('sufficient ' + _helperRulesPct(metrics.sufficient_rate));
+    if (_helperRulesCount(metrics, 'grade_unavailable') > 0) parts.push('grade unavailable ' + _helperRulesCount(metrics, 'grade_unavailable'));
+    return parts.join(' · ');
+  }
+  var watch = [_helperRulesPct(metrics.precision)];
+  if (typeof metrics.watcher_usd_window === 'number' && isFinite(metrics.watcher_usd_window)) {
+    watch.push('$' + metrics.watcher_usd_window.toFixed(4) + ' watched');
+  }
+  return watch.join(' · ');
+}
+
+function _helperRulesStateChip(cell) {
+  var state = HELPER_RULE_STATE_COLOR[cell.state] ? cell.state : 'on';
+  return '<span style="color:' + HELPER_RULE_STATE_COLOR[state] + ';font-weight:700;white-space:nowrap;">' + escHtml(state) + (cell.user_veto ? ' · vetoed' : '') + '</span>';
+}
+
+function _helperRulesLastEvent(cell) {
+  var event = cell.last_event;
+  if (!event) return '<span style="color:var(--fg-dim,#565f89);">-</span>';
+  return escHtml([event.to_state, event.reason, event.created_at].filter(function(part) { return part != null && part !== ''; }).join(' · '));
+}
+
+function _helperRulesActions(cell) {
+  var key = escHtml(cell.cell_key);
+  var html = '';
+  if (cell.state !== 'off' || Number(cell.user_veto) === 0) {
+    html += '<button type="button" class="btn small" data-helper-cell="' + key + '" data-helper-action="veto">Veto</button>';
+  }
+  if (Number(cell.user_veto) === 1 || cell.state === 'off') {
+    html += (html ? ' ' : '') + '<button type="button" class="btn small" data-helper-cell="' + key + '" data-helper-action="enable">Enable</button>';
+  }
+  html += (html ? ' ' : '') + '<button type="button" class="btn small" data-helper-outcomes="' + key + '">Outcomes</button>';
+  return html;
+}
+
+// --- WP-6 (§6.9): the per-cell outcome disclosure -------------------------------------------
+// Every value is escaped; a missing field renders '-'. The five facts are the API's allow-list
+// (terminal_status, report_source, report_citation_rows, wait_variant, harness) -- no paths, no
+// brief/report text, never the raw row.
+function _helperRulesText(value) {
+  return (value == null || value === '') ? '-' : String(value);
+}
+
+function _helperRulesOutcomeRows(cellKey) {
+  var state = _helperRulesOutcomes[cellKey];
+  if (!state) return '';
+  var empty = function(message, color) {
+    return '<tr><td colspan="9" style="color:' + (color || 'var(--fg-dim,#565f89)') + ';">' + escHtml(message) + '</td></tr>';
+  };
+  if (state.error) return empty(state.error, '#f7768e');
+  if (!state.rows) return empty('Loading outcomes...');
+  if (!state.rows.length) return empty('No outcomes in this window.');
+  return state.rows.map(function(row) {
+    var facts = row.facts || {};
+    var decision = [row.decision, row.label].filter(function(part) { return part != null && part !== ''; }).join(' / ');
+    return '<tr>' +
+      '<td>' + escHtml(_helperRulesText(row.seq)) + '</td>' +
+      '<td>' + escHtml(decision || '-') + '</td>' +
+      '<td>' + escHtml(_helperRulesText(row.report_rows)) + '</td>' +
+      '<td>' + escHtml(_helperRulesText(facts.terminal_status)) + '</td>' +
+      '<td>' + escHtml(_helperRulesText(facts.report_source)) + '</td>' +
+      '<td>' + escHtml(_helperRulesText(facts.wait_variant)) + '</td>' +
+      '<td>' + escHtml(_helperRulesText(facts.harness)) + '</td>' +
+      '<td>' + escHtml('v' + _helperRulesText(row.label_version)) + '</td>' +
+      '<td>' + escHtml(_helperRulesText(row.created_at)) + '</td>' +
+    '</tr>';
+  }).join('');
+}
+
+/** The extra `<tr>` under an opened cell: the cell's trailing outcome window as a nested table. */
+function _helperRulesOutcomesRow(cellKey) {
+  if (!_helperRulesOutcomes[cellKey]) return '';
+  return '<tr><td colspan="7" style="background:rgba(122,162,247,.06);">' +
+    '<table style="width:100%;border-collapse:collapse;font-size:10px;"><thead><tr>' +
+    '<th style="text-align:left;">Seq</th><th style="text-align:left;">Decision / label</th><th style="text-align:left;">Report rows</th>' +
+    '<th style="text-align:left;">Terminal</th><th style="text-align:left;">Source</th><th style="text-align:left;">Wait</th>' +
+    '<th style="text-align:left;">Harness</th><th style="text-align:left;">Version</th><th style="text-align:left;">Created</th>' +
+    '</tr></thead><tbody>' + _helperRulesOutcomeRows(cellKey) + '</tbody></table></td></tr>';
+}
+
+/** Open/close one cell's disclosure, fetching its window once per open. */
+function _helperRulesToggleOutcomes(cellKey) {
+  if (_helperRulesOutcomes[cellKey]) {
+    delete _helperRulesOutcomes[cellKey];
+    _renderRoutingWorkflows();
+    return null;
+  }
+  _helperRulesOutcomes[cellKey] = { rows: null, error: null };
+  _renderRoutingWorkflows();
+  return fetch('/api/wall-e/helper-rules/cells/' + encodeURIComponent(cellKey) + '/outcomes?limit=20')
+    .then(function(res) { return res.json(); })
+    .then(function(data) {
+      _helperRulesOutcomes[cellKey] = { rows: (data && data.outcomes) || [], error: null };
+      _renderRoutingWorkflows();
+    })
+    .catch(function(err) {
+      _helperRulesOutcomes[cellKey] = { rows: [], error: (err && err.message) || 'Failed to load outcomes' };
+      _renderRoutingWorkflows();
+    });
+}
+
+function _routingHelperRulesMarkup() {
+  if (!_helperRulesCells) {
+    return '<div style="font-size:11px;color:var(--fg-dim,#565f89);">' + escHtml(_helperRulesError || 'Loading helper rules...') + '</div>';
+  }
+  var rows = _helperRulesCells.map(function(cell) {
+    return '<tr data-helper-cell="' + escHtml(cell.cell_key) + '"' + (cell.collecting ? ' style="opacity:.58;"' : '') + '>' +
+      '<td style="overflow-wrap:anywhere;">' + escHtml(cell.cell_key) + '</td>' +
+      '<td>' + escHtml(cell.kind || '-') + '</td>' +
+      '<td>' + _helperRulesStateChip(cell) + '</td>' +
+      '<td>' + Number(cell.n_window || 0) + '</td>' +
+      '<td>' + escHtml(_helperRulesRate(cell)) + '</td>' +
+      '<td>' + _helperRulesLastEvent(cell) + '</td>' +
+      '<td>' + _helperRulesActions(cell) + '</td></tr>' +
+      _helperRulesOutcomesRow(cell.cell_key);
+  }).join('');
+  return '<div style="font-size:11px;color:var(--fg-dim,#565f89);margin-bottom:9px;">The two routing rule cells: the wait-watch wake and the exploration hand-off. A veto is final until you enable the cell again.</div>' +
+    '<div style="overflow-x:auto;"><table style="width:100%;border-collapse:collapse;font-size:11px;"><thead><tr><th>Cell</th><th>Kind</th><th>State</th><th>n</th><th>Precision / fallback</th><th>Last event</th><th>Action</th></tr></thead><tbody>' +
+    (rows || '<tr><td colspan="7">No rule cells yet.</td></tr>') + '</tbody></table></div>' +
+    (_helperRulesError ? '<div style="font-size:10px;color:#f7768e;margin-top:7px;">' + escHtml(_helperRulesError) + '</div>' : '');
+}
+
+function _loadHelperRules() {
+  _helperRulesError = null;
+  return fetch('/api/wall-e/helper-rules/cells').then(function(res) { return res.json(); }).then(function(data) {
+    _helperRulesCells = (data && data.cells) || [];
+    _renderRoutingWorkflows();
+  }).catch(function(err) {
+    _helperRulesCells = null;
+    _helperRulesError = (err && err.message) || 'Failed to load helper rules';
+    _renderRoutingWorkflows();
+  });
+}
+
+function _helperRulesSetState(cellKey, action) {
+  var label = action === 'veto' ? 'Veto' : 'Enable';
+  return _routingConfirm(label + ' helper rule', label + ' ' + cellKey + '?', label).then(function(ok) {
+    if (!ok) { _renderRoutingWorkflows(); return null; } // re-enable the button the click disabled
+    return fetch('/api/wall-e/helper-rules/cells/' + encodeURIComponent(cellKey) + '/' + action, { method: 'POST' })
+      .then(function(res) { return res.json(); })
+      .then(function(data) {
+        if (!data || data.ok === false) throw new Error((data && data.error) || 'request failed');
+        return _loadHelperRules();
+      })
+      .catch(function(err) {
+        _helperRulesError = cellKey + ': ' + ((err && err.message) || 'request failed');
+        _renderRoutingWorkflows();
+      });
+  });
+}
+
 function _renderRoutingWorkflows() {
   var el = document.getElementById('models-routing-workflows'); if (!el) return;
   var body = _routingWorkflowPill === 'measurements' ? _routingMeasurementsMarkup()
-    : (_routingWorkflowView === 'editor' ? _routingWorkflowEditorMarkup(_routingWorkflowSelected()) : _routingWorkflowLibraryMarkup());
-  el.innerHTML = DOMPurify.sanitize('<section>' + _routingWorkflowPills() + body + '</section>', { ADD_TAGS: ['article','fieldset','legend'], ADD_ATTR: ['style','data-routing-pill','data-routing-new','data-routing-import','data-routing-edit','data-routing-duplicate','data-routing-export','data-routing-dryrun','data-routing-run','data-routing-back','data-routing-save','data-routing-editor-test','data-node-field','data-node-remove','data-node-add','data-routing-default-policy','data-routing-measure-workflow','data-routing-load-measure','data-routing-refresh-suggestions','data-suggestion-action','data-suggestion-id','data-run-rating','data-run-control','data-run-id','data-run-node','data-run-attempt','data-run-type','data-run-choice','data-policy-fields','data-policy-arm','data-policy-index','data-arm-field','data-arm-saved','data-policy-sample','data-policy-auto','data-policy-cost-lambda','data-policy-latency-budget','data-policy-exploration-budget','data-routing-launch-mode','data-routing-bandit-preview','data-routing-bandit-apply','data-bandit-readiness','data-routing-bandit-readiness-save','aria-label','role','rows','placeholder','value','selected','disabled','checked','min','max','step','type','title'] });
+    : (_routingWorkflowPill === 'helper-rules' ? _routingHelperRulesMarkup()
+    : (_routingWorkflowView === 'editor' ? _routingWorkflowEditorMarkup(_routingWorkflowSelected()) : _routingWorkflowLibraryMarkup()));
+  el.innerHTML = DOMPurify.sanitize('<section>' + _routingWorkflowPills() + body + '</section>', { ADD_TAGS: ['article','fieldset','legend'], ADD_ATTR: ['style','data-routing-pill','data-routing-new','data-routing-import','data-routing-edit','data-routing-duplicate','data-routing-export','data-routing-dryrun','data-routing-run','data-routing-back','data-routing-save','data-routing-editor-test','data-node-field','data-node-remove','data-node-add','data-routing-default-policy','data-routing-measure-workflow','data-routing-load-measure','data-routing-refresh-suggestions','data-suggestion-action','data-suggestion-id','data-run-rating','data-run-control','data-run-id','data-run-node','data-run-attempt','data-run-type','data-run-choice','data-policy-fields','data-policy-arm','data-policy-index','data-arm-field','data-arm-saved','data-policy-sample','data-policy-auto','data-policy-cost-lambda','data-policy-latency-budget','data-policy-exploration-budget','data-routing-launch-mode','data-routing-bandit-preview','data-routing-bandit-apply','data-bandit-readiness','data-routing-bandit-readiness-save','data-helper-cell','data-helper-action','data-helper-outcomes','aria-label','role','rows','placeholder','value','selected','disabled','checked','min','max','step','type','title'] });
   _routingBindArmModelFilters(el);
   var launchAutoOption = el.querySelector('[data-routing-launch-mode] option[value="auto"]');
   if (launchAutoOption) launchAutoOption.disabled = !(_routingLaunchState && (_routingLaunchState.ready || _routingLaunchState.mode === 'auto'));
-  el.querySelectorAll('[data-routing-pill]').forEach(function(btn) { btn.onclick = function() { _routingWorkflowPill = btn.dataset.routingPill; if (_routingWorkflowPill === 'policies') { var routes = document.getElementById('models-task-routes'); if (routes) routes.scrollIntoView({ block: 'start' }); } _renderRoutingWorkflows(); }; });
+  el.querySelectorAll('[data-routing-pill]').forEach(function(btn) { btn.onclick = function() { _routingWorkflowPill = btn.dataset.routingPill; if (_routingWorkflowPill === 'policies') { var routes = document.getElementById('models-task-routes'); if (routes) routes.scrollIntoView({ block: 'start' }); } _renderRoutingWorkflows(); if (_routingWorkflowPill === 'helper-rules' && !_helperRulesCells) _loadHelperRules(); }; });
+  el.querySelectorAll('[data-helper-action]').forEach(function(btn) { btn.onclick = function() { var cellKey = btn.dataset.helperCell; var action = btn.dataset.helperAction; btn.disabled = true; _helperRulesSetState(cellKey, action); }; });
+  el.querySelectorAll('[data-helper-outcomes]').forEach(function(btn) { btn.onclick = function() { _helperRulesToggleOutcomes(btn.dataset.helperOutcomes); }; });
   el.querySelectorAll('[data-routing-edit]').forEach(function(btn) { btn.onclick = function() { _routingWorkflowId = btn.dataset.routingEdit; _routingWorkflowView = 'editor'; _renderRoutingWorkflows(); }; });
   var back = el.querySelector('[data-routing-back]'); if (back) back.onclick = function() { _routingWorkflowView = 'library'; _renderRoutingWorkflows(); };
   var add = el.querySelector('[data-routing-new]'); if (add) add.onclick = function() { var id = 'wf_new-' + Date.now(); _routingWorkflows.push({ id:id,name:'New workflow',summary:'Describe when this workflow should run.',category:'coding',version:0,source:'user',enabled:true,autoMatch:true,matchThreshold:.62,defaultPolicy:{type:'inherit'},nodes:[] }); _routingWorkflowId=id; _routingWorkflowView='editor'; _renderRoutingWorkflows(); };
@@ -3473,8 +3893,11 @@ function _delegatedWorkerSkillButtonMarkup(agentId, plan) {
   return '<button type="button" data-install-cli-skill="' + escHtml(agentId) + '"' + extra + ' style="padding:4px 10px;border-radius:5px;border:1px solid var(--border,#414868);background:transparent;color:var(--fg,#c0caf5);cursor:pointer;font-size:11px;">' + escHtml(label) + '</button>';
 }
 
+// One agent's row, anchored by `data-delegated-worker-skill-row="<agentId>"` so a
+// reader (or a spec) can scope to THIS row instead of a bare text match that any
+// unrelated "unavailable"/version string elsewhere in the section also satisfies.
 function _delegatedWorkerSkillRowMarkup(agentId, agentName, plan) {
-  return '<div style="display:flex;justify-content:space-between;gap:10px;align-items:center;flex-wrap:wrap;padding:3px 0;">' +
+  return '<div data-delegated-worker-skill-row="' + escHtml(agentId) + '" style="display:flex;justify-content:space-between;gap:10px;align-items:center;flex-wrap:wrap;padding:3px 0;">' +
     '<div style="font-size:11px;color:var(--fg-dim,#565f89);">delegate · ' + escHtml(agentName) + '</div>' +
     '<div style="display:flex;gap:8px;align-items:center;">' +
       '<span style="font-size:10px;color:var(--fg-dim,#565f89);">' + escHtml(_delegatedWorkerSkillPlanLabel(plan)) + '</span>' +
@@ -4281,6 +4704,54 @@ function _codingAgentUpgradeRenderJobDialog(job) {
   };
 }
 
+// WP-2 fix (B): the card is rebuilt with `el.innerHTML = …`, so a legitimate repaint
+// (flow moved on, account changed) also throws away whatever the user had typed into
+// the sign-in code box, its focus and its caret. Capture the drafts before the swap
+// and put them back on the matching card after the bindings are attached. Pure DOM,
+// no timers: a card whose new markup has no code box (the flow closed) drops its draft.
+function _modelsCodingAgentCaptureSignInDrafts(el) {
+  var drafts = [];
+  if (!el || typeof el.querySelectorAll !== 'function') return drafts;
+  var doc = el.ownerDocument || (typeof document !== 'undefined' ? document : null);
+  el.querySelectorAll('[data-coding-agent-card]').forEach(function(card) {
+    var code = typeof card.querySelector === 'function' ? card.querySelector('[data-sign-in-code]') : null;
+    if (!code) return;
+    var error = typeof card.querySelector === 'function' ? card.querySelector('[data-sign-in-error]') : null;
+    drafts.push({
+      cardId: (card.dataset && card.dataset.codingAgentCard) || '',
+      value: code.value,
+      selectionStart: typeof code.selectionStart === 'number' ? code.selectionStart : null,
+      selectionEnd: typeof code.selectionEnd === 'number' ? code.selectionEnd : null,
+      focused: !!(doc && doc.activeElement && doc.activeElement === code),
+      error: error ? error.textContent : null,
+    });
+  });
+  return drafts;
+}
+
+function _modelsCodingAgentRestoreSignInDrafts(el, drafts) {
+  if (!el || !drafts || !drafts.length) return;
+  if (typeof el.querySelectorAll !== 'function') return;
+  var byCard = {};
+  drafts.forEach(function(draft) { byCard[draft.cardId] = draft; });
+  el.querySelectorAll('[data-coding-agent-card]').forEach(function(card) {
+    var draft = byCard[(card.dataset && card.dataset.codingAgentCard) || ''];
+    if (!draft) return;
+    var code = typeof card.querySelector === 'function' ? card.querySelector('[data-sign-in-code]') : null;
+    if (!code) return;
+    if (typeof draft.value === 'string') code.value = draft.value;
+    if (typeof draft.error === 'string') {
+      var error = typeof card.querySelector === 'function' ? card.querySelector('[data-sign-in-error]') : null;
+      if (error) error.textContent = draft.error;
+    }
+    if (!draft.focused) return;
+    if (typeof code.focus === 'function') code.focus();
+    if (typeof code.setSelectionRange === 'function' && draft.selectionStart !== null && draft.selectionEnd !== null) {
+      code.setSelectionRange(draft.selectionStart, draft.selectionEnd);
+    }
+  });
+}
+
 function renderModelsCodingAgentRoutes(providers, models) {
   var el = document.getElementById('models-coding-agents-section');
   if (!el) return;
@@ -4392,7 +4863,7 @@ function renderModelsCodingAgentRoutes(providers, models) {
         _modelsCodingAgentMeta('CLI', cliLabel, status.cliReady ? '#9ece6a' : '#e0af68') +
         _modelsCodingAgentOtherInstallsHtml(versionInfo) +
         _modelsCodingAgentMeta('Version', upgradeRunning ? _codingAgentUpgradePhaseText(upgradeJob) : _modelsCodingAgentVersionText(versionInfo), upgradeRunning ? '#7aa2f7' : ((versionInfo && versionInfo.hasUpdate) ? '#e0af68' : 'var(--fg,#c0caf5)'), upgradeRunning ? null : { title: _modelsCodingAgentVersionTitle(versionInfo), dim: _modelsCodingAgentVersionDim(versionInfo) }) +
-        (_modelsProviderIdForPreset(preset) ? _modelsCodingAgentMeta('Account', _modelsCodingAgentAccountText(preset), _modelsCodingAgentAccountColor(preset)) : '') +
+        (_modelsProviderIdForPreset(preset) ? _modelsCodingAgentMeta('Account', _modelsCodingAgentAccountText(preset), _modelsCodingAgentAccountColor(preset), { title: _modelsCodingAgentAccountTitle(preset) }) : '') +
         _modelsCodingAgentMeta('CTM Status', hookLabel, (status.hooksSupported === false) ? (status.cliReady ? '#9ece6a' : 'var(--fg-dim,#565f89)') : (status.hookReady ? '#9ece6a' : '#e0af68')) +
         ((preset.id === 'codex' || preset.id === 'claude-code') && status.hooksSupported !== false ? _modelsCodingAgentMeta('OTLP telemetry', _modelsOtelReceiptText((((_modelsAgentStatus || {}).hooks || {}).agents || {})[preset.id]), 'var(--fg-dim,#565f89)') : '') +
         _modelsCodingAgentMeta('Model Source', preset.modelSource) +
@@ -4435,9 +4906,12 @@ function renderModelsCodingAgentRoutes(providers, models) {
     '</div>' +
     _delegatedWorkersGroupMarkup(providers, models, _delegatedWorkerStatus) +
   '</section>';
+  // WP-2 fix (B): whatever the user had typed into a sign-in code box survives this
+  // rebuild — captured here, put back once the new markup is bound below.
+  var signInDrafts = _modelsCodingAgentCaptureSignInDrafts(el);
   el.innerHTML = DOMPurify.sanitize(h, {
     ADD_TAGS: ['article', 'code', 'select', 'option'],
-    ADD_ATTR: ['style', 'data-coding-agent-card', 'data-agent-state', 'data-agent-update', 'data-agent-update-banner', 'data-agent-upgrade-job', 'data-install-agent-hooks', 'data-install-missing-agent-hooks', 'data-install-outdated-agent-hooks', 'data-live-status-update-banner', 'data-live-status-missing-banner', 'data-refresh-agent-status', 'data-upgrade-agent', 'data-agent-auto-update-toggle', 'data-agent-other-installs', 'data-agent-auto-attempt', 'checked', 'data-upgrade-all-agents', 'data-view-upgrade-job', 'data-view-upgrade-batch', 'data-review-agent-updates', 'data-dismiss-agent-updates', 'data-delegated-worker-route', 'data-delegated-worker-route-filter', 'data-delegated-worker-effective', 'placeholder', 'aria-label', 'autocomplete', 'data-delegated-workers-group', 'data-install-cli-skill', 'data-install-cli-overwrite', 'type', 'disabled', 'title', 'id', 'for', 'value', 'selected', 'data-sign-in-agent', 'data-show-sign-in-tab', 'data-open-sign-in-page', 'data-sign-in-hint', 'data-sign-in-failed', 'href', 'target', 'rel'],
+    ADD_ATTR: ['style', 'data-coding-agent-card', 'data-agent-state', 'data-agent-update', 'data-agent-update-banner', 'data-agent-upgrade-job', 'data-install-agent-hooks', 'data-install-missing-agent-hooks', 'data-install-outdated-agent-hooks', 'data-live-status-update-banner', 'data-live-status-missing-banner', 'data-refresh-agent-status', 'data-upgrade-agent', 'data-agent-auto-update-toggle', 'data-agent-other-installs', 'data-agent-auto-attempt', 'checked', 'data-upgrade-all-agents', 'data-view-upgrade-job', 'data-view-upgrade-batch', 'data-review-agent-updates', 'data-dismiss-agent-updates', 'data-delegated-worker-route', 'data-delegated-worker-route-filter', 'data-delegated-worker-effective', 'placeholder', 'aria-label', 'autocomplete', 'data-delegated-workers-group', 'data-delegated-worker-skill-row', 'data-install-cli-skill', 'data-install-cli-overwrite', 'type', 'disabled', 'title', 'id', 'for', 'value', 'selected', 'data-sign-in-agent', 'data-show-sign-in-tab', 'data-open-sign-in-page', 'data-sign-in-hint', 'data-sign-in-failed', 'data-sign-in-user-code', 'data-sign-in-copy-code', 'data-sign-in-code', 'data-sign-in-code-submit', 'data-sign-in-error', 'inputmode', 'spellcheck', 'href', 'target', 'rel'],
   });
   el.querySelectorAll('[data-delegated-worker-route]').forEach(function(select) {
     var filter = select.parentNode.querySelector('[data-delegated-worker-route-filter]');
@@ -4623,6 +5097,42 @@ function renderModelsCodingAgentRoutes(providers, models) {
       try { activateTab(sessionId); } catch (e) { /* expected: an already-closed tab cannot be activated */ }
     });
   });
+  // The code entry (WP-2): the submit button and Enter in the box both POST the
+  // pasted value to the flow's provider, resolved from the card the markup sits in.
+  el.querySelectorAll('[data-sign-in-code-submit], [data-sign-in-code]').forEach(function(node) {
+    var submit = function() {
+      var card = node.closest('[data-coding-agent-card]');
+      var preset = card ? _modelsCodingAgentPresetById(card.dataset.codingAgentCard) : null;
+      var providerId = preset ? _modelsProviderIdForPreset(preset) : '';
+      var submitBtn = node.hasAttribute('data-sign-in-code-submit')
+        ? node
+        : node.parentNode.querySelector('[data-sign-in-code-submit]');
+      _modelsProviderLoginSubmitCode(
+        providerId,
+        node.hasAttribute('data-sign-in-code') ? node : node.parentNode.querySelector('[data-sign-in-code]'),
+        node.parentNode.querySelector('[data-sign-in-error]'),
+        submitBtn,
+      );
+    };
+    if (node.hasAttribute('data-sign-in-code-submit')) {
+      node.addEventListener('click', submit);
+      return;
+    }
+    node.addEventListener('keydown', function(ev) {
+      if (ev.key !== 'Enter') return;
+      ev.preventDefault();
+      submit();
+    });
+  });
+  el.querySelectorAll('[data-sign-in-copy-code]').forEach(function(btn) {
+    btn.addEventListener('click', function() {
+      var codeEl = btn.parentNode.querySelector('[data-sign-in-user-code]');
+      if (codeEl) _modelsProviderLoginCopyCode(codeEl.textContent, btn);
+    });
+  });
+  // WP-2 fix (B): the bindings are attached — a draft the user was typing survives the
+  // rebuild above, focus and caret included.
+  _modelsCodingAgentRestoreSignInDrafts(el, signInDrafts);
   // Resumes the 2 s poll after a re-render while a flow is still open.
   _modelsProviderLoginEnsurePoll();
   if (!_codingAgentUpgradeHasRunningJob()) _maybePromptCodingAgentHookSetupFromAgentsTab();