instar 1.3.1208 → 1.3.1210

package/dashboard/index.html

@@ -3706,6 +3706,15 @@
       .sub-account-meta { font-size:12px; opacity:.6; margin:2px 0 2px; }
       .sub-account-email { font-size:12px; opacity:.5; margin:0 0 10px; }
       .sub-account-noquota { font-size:12px; opacity:.6; }
+      .sub-profile-provision { border:1px solid var(--border,#2a2a2a); border-left:4px solid #16a34a;
+        border-radius:10px; padding:14px 16px; display:flex; flex-direction:column; gap:10px; }
+      .sub-profile-title { font-size:16px; font-weight:650; }
+      .sub-profile-copy { margin:0; font-size:13px; line-height:1.5; opacity:.78; }
+      .sub-profile-input { width:100%; box-sizing:border-box; min-height:44px; padding:10px 12px;
+        font-size:16px; border:1px solid var(--border,#2a2a2a); border-radius:8px; background:transparent; color:inherit; }
+      .sub-profile-create { min-height:44px; padding:10px 14px; font-size:14px; font-weight:600;
+        border-radius:8px; border:1px solid #16a34a; background:rgba(22,163,74,.12); color:inherit; cursor:pointer; }
+      .sub-profile-status { min-height:18px; font-size:12px; line-height:1.45; opacity:.8; }
       .sub-quota { margin:8px 0; }
       .sub-quota-head { display:flex; justify-content:space-between; font-size:12px; margin-bottom:4px; }
       .sub-quota-label { opacity:.8; }
@@ -3773,6 +3782,11 @@
            your subscriptions (ws52-operator-tap-not-text Part A). Leads the panel as the primary
            action when present; silent otherwise. -->
       <div id="subFollowMe"></div>
+      <section class="ph-section">
+        <h3 class="ph-h">Dedicated browser profiles</h3>
+        <p class="ph-h-sub">Prepare a private Chrome profile for one Google account. The agent handles the machine; you only respond to a secure password, verification, or approval link when the provider truly requires it.</p>
+        <div id="subProfileProvision"></div>
+      </section>
       <!-- Account × Machine matrix (account-machine-matrix) — at-a-glance "which account is set up
            on which machine," with a one-tap "Set up" per empty cell that runs the whole sign-in in
            the dashboard (PIN → sign-in link → paste the code). Hidden when there's nothing to show. -->
@@ -4146,6 +4160,9 @@
     // ── State ────────────────────────────────────────────────
     let ws = null;
     let token = '';
+    // Short-lived proof of a recent PIN unlock. Kept in memory only: the durable
+    // API token is intentionally insufficient for operator-only actions.
+    let operatorSessionToken = '';
     let sessions = [];
     // Sessions running on OTHER machines in the pool (GET /sessions?scope=pool).
     // Kept separate from `sessions` because the WebSocket replaces that array
@@ -4193,6 +4210,8 @@
         .then(data => {
           if (data && data.token) {
             token = data.token;
+            operatorSessionToken = typeof data.operatorSessionToken === 'string'
+              ? data.operatorSessionToken : '';
           } else {
             // Fall back: treat input as raw Bearer token
             token = pin;
@@ -9670,6 +9689,7 @@
           accounts: document.getElementById('subAccounts'),
           followMe: document.getElementById('subFollowMe'),
           matrix: document.getElementById('subMatrix'),
+          profileProvision: document.getElementById('subProfileProvision'),
         };
         // Pass opts through (method/body/signal) so the controller can POST the follow-me
         // scan + the PIN-gated issue-for-machine, not just GET.
@@ -9677,7 +9697,10 @@
           ...opts,
           headers: { 'Authorization': `Bearer ${token}`, ...(opts.headers || {}) },
         });
-        __subController = __subModule.createController({ doc: document, els, fetchImpl });
+        __subController = __subModule.createController({
+          doc: document, els, fetchImpl,
+          getOperatorSessionToken: () => operatorSessionToken,
+        });
       }
       __subController.start();
     }

package/dashboard/subscriptions.js

@@ -240,7 +240,7 @@ export function groupAccountsByProvider(accounts) {
  *  `inUseAccountId` (optional) is the account the agent is CURRENTLY running on —
  *  that card gets an "In use" marker so "active" (healthy) reads distinct from
  *  "actually running right now". */
-export function renderAccounts(doc, target, accounts, now = Date.now(), inUseAccountId = null) {
+export function renderAccounts(doc, target, accounts, now = Date.now(), inUseAccountId = null, reloginEpisodes = []) {
   if (!target) return;
   target.replaceChildren();
   if (!Array.isArray(accounts) || accounts.length === 0) {
@@ -294,6 +294,31 @@ export function renderAccounts(doc, target, accounts, now = Date.now(), inUseAcc
     if (refAge) {
       card.appendChild(el(doc, 'div', 'sub-account-refresh', `Token auto-refreshed ${refAge}`));
     }
+    const repair = Array.isArray(reloginEpisodes)
+      ? reloginEpisodes.find((episode) => episode && a && episode.accountId === a.id)
+      : null;
+    if (repair) {
+      const repairBox = el(doc, 'div', 'sub-account-repair');
+      const terminal = ['succeeded', 'refused', 'cancelled', 'failed'].includes(repair.state);
+      const label = repair.state === 'suggested' ? 'Sign-in repair is ready.'
+        : repair.state === 'succeeded' ? 'Sign-in repaired.'
+          : repair.state === 'waiting-operator-only' ? 'Sign-in needs your help.'
+            : repair.state === 'failed' ? 'Sign-in repair stopped safely.'
+              : repair.state === 'refused' ? 'Sign-in repair was refused for safety.'
+                : repair.state === 'cancelled' ? 'Sign-in repair cancelled.'
+                  : 'Repairing sign-in…';
+      repairBox.appendChild(el(doc, 'div', 'sub-account-repair-status', label));
+      const action = repair.state === 'suggested' ? ['approve', 'Repair sign-in']
+        : repair.state === 'failed' ? ['retry', 'Try repair again']
+          : (!terminal ? ['cancel', 'Cancel repair'] : null);
+      if (action) {
+        const button = el(doc, 'button', `sub-account-repair-${action[0]}`, action[1]);
+        button.setAttribute('data-relogin-action', action[0]);
+        button.setAttribute('data-relogin-id', sanitizeForDisplay(repair.id, 'label'));
+        repairBox.appendChild(button);
+      }
+      card.appendChild(repairBox);
+    }
     target.appendChild(card);
   }
 }
@@ -934,8 +959,54 @@ const URLS = {
   accountsPool: '/subscription-pool?scope=pool',
   startCell: '/subscription-pool/matrix/start-cell', // POST (PIN-gated) — start a cell's sign-in
   cancel: '/subscription-pool/follow-me/cancel', // POST (Bearer, no PIN) — cancel an in-flight cell (relay → self/peer)
+  relogin: '/subscription-relogin',
+  provisionProfile: '/playwright-profiles/provision',
 };
 
+export function renderProfileProvisioner(doc, target) {
+  if (!target) return;
+  const card = el(doc, 'div', 'sub-profile-provision');
+  card.setAttribute('data-interaction-open', '1');
+  card.appendChild(el(doc, 'div', 'sub-profile-title', 'Create a dedicated sign-in profile'));
+  card.appendChild(el(doc, 'p', 'sub-profile-copy',
+    'Instar prepares the private Chrome profile on this machine. If a password or verification step is needed, your agent will send a secure link — you never need to access this machine.'));
+
+  const identity = el(doc, 'input', 'sub-profile-input');
+  identity.setAttribute('type', 'email');
+  identity.setAttribute('inputmode', 'email');
+  identity.setAttribute('autocomplete', 'email');
+  identity.setAttribute('placeholder', 'Google account email');
+  identity.setAttribute('aria-label', 'Google account email');
+  card.appendChild(identity);
+
+  const profileId = el(doc, 'input', 'sub-profile-input');
+  profileId.setAttribute('type', 'text');
+  profileId.setAttribute('placeholder', 'Profile name, for example work-google');
+  profileId.setAttribute('aria-label', 'Profile name');
+  card.appendChild(profileId);
+
+  const method = el(doc, 'select', 'sub-profile-input');
+  method.setAttribute('aria-label', 'Sign-in method');
+  for (const [value, label] of [
+    ['session-cookie', 'Already signed in / provider approval'],
+    ['password', 'Password'],
+    ['password+totp', 'Password + authenticator'],
+  ]) {
+    const option = el(doc, 'option', '', label);
+    option.setAttribute('value', value);
+    method.appendChild(option);
+  }
+  card.appendChild(method);
+
+  const button = el(doc, 'button', 'sub-profile-create', 'Create dedicated profile');
+  button.setAttribute('type', 'button');
+  card.appendChild(button);
+  const status = el(doc, 'div', 'sub-profile-status', '');
+  status.setAttribute('aria-live', 'polite');
+  card.appendChild(status);
+  target.replaceChildren(card);
+}
+
 export function createController(opts) {
   const {
     doc,
@@ -945,6 +1016,7 @@ export function createController(opts) {
     cadenceMs = 30_000,
     schedule = (fn, ms) => setTimeout(fn, ms),
     cancel = (id) => clearTimeout(id),
+    getOperatorSessionToken = () => '',
   } = opts;
 
   // matrixTransient: client-side last-attempt state per `${accountId}::${machineId}` cell (FD6 —
@@ -955,6 +1027,7 @@ export function createController(opts) {
   // add the D4 ceremony when the episode lands. recentOutcomes: client-observed terminal
   // outcomes rendered as explicit cards in the pending panel (D4 — never a vanishing line).
   const state = { timerId: null, active: false, inFlight: null, offers: [], approveWired: false,
+    reloginWired: false, reloginEpisodes: [], profileProvisionWired: false,
     matrixWired: false, matrixTransient: {}, lastPoolBody: null, lastPendingBody: null,
     matrixEpisodes: {}, recentOutcomes: [] };
 
@@ -988,17 +1061,18 @@ export function createController(opts) {
     if (state.inFlight) { try { state.inFlight.abort(); } catch { /* superseded */ } }
     const controller = typeof AbortController !== 'undefined' ? new AbortController() : { signal: undefined, abort() {} };
     state.inFlight = controller;
-    let accountsBody, pendingBody, inUseBody, scanBody, poolBody;
+    let accountsBody, pendingBody, inUseBody, scanBody, poolBody, reloginBody;
     try {
       // in-use AND the follow-me scan are best-effort — their failure must not blank the
       // accounts list, so each is caught independently (in-use → "unknown"; scan → no card).
       // poolBody (scope=pool) feeds the account×machine matrix; best-effort (matrix is hidden if absent).
-      [accountsBody, pendingBody, inUseBody, scanBody, poolBody] = await Promise.all([
+      [accountsBody, pendingBody, inUseBody, scanBody, poolBody, reloginBody] = await Promise.all([
         fetchJson(URLS.accounts, controller),
         fetchJson(URLS.pending, controller),
         fetchJson(URLS.inUse, controller).catch(() => null),
         postJson(URLS.scan, {}, controller).then((r) => (r.ok ? r.json : null)).catch(() => null),
         fetchJson(URLS.accountsPool, controller).catch(() => null),
+        fetchJson(URLS.relogin, controller).catch(() => null),
       ]);
     } catch {
       if (controller.signal && controller.signal.aborted) return;
@@ -1015,10 +1089,57 @@ export function createController(opts) {
       return;
     }
     state.offers = scanBody && Array.isArray(scanBody.offered) ? scanBody.offered : [];
+    state.reloginEpisodes = reloginBody && Array.isArray(reloginBody.episodes) ? reloginBody.episodes : [];
+    if (els.profileProvision && !state.profileProvisionWired) {
+      renderProfileProvisioner(doc, els.profileProvision);
+      wireProfileProvisioner();
+    }
     render(accountsBody, pendingBody, inUseBody, poolBody);
     reschedule();
   }
 
+  function wireProfileProvisioner() {
+    if (!els.profileProvision || state.profileProvisionWired) return;
+    state.profileProvisionWired = true;
+    els.profileProvision.addEventListener('click', (event) => {
+      const button = event.target && event.target.closest ? event.target.closest('.sub-profile-create') : null;
+      if (!button) return;
+      const proof = getOperatorSessionToken();
+      const identity = els.profileProvision.querySelector('[aria-label="Google account email"]')?.value?.trim() || '';
+      const profileId = els.profileProvision.querySelector('[aria-label="Profile name"]')?.value?.trim() || '';
+      const loginMethod = els.profileProvision.querySelector('[aria-label="Sign-in method"]')?.value || 'session-cookie';
+      const status = els.profileProvision.querySelector('.sub-profile-status');
+      if (!proof) { status.textContent = 'Unlock the dashboard again, then retry.'; return; }
+      if (!identity || !profileId) { status.textContent = 'Enter the Google account and a profile name.'; return; }
+      button.setAttribute('disabled', 'disabled');
+      status.textContent = 'Preparing the private profile…';
+      void (async () => {
+        try {
+          const response = await fetchImpl(URLS.provisionProfile, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', 'X-Instar-Operator-Session': proof },
+            body: JSON.stringify({ profileId, identity, loginMethod }),
+          });
+          const body = await response.json().catch(() => ({}));
+          if (!response.ok) {
+            status.textContent = response.status === 401
+              ? 'Unlock the dashboard again, then retry.'
+              : `Couldn’t create the profile: ${body.error || 'try again'}`;
+            button.removeAttribute('disabled');
+            return;
+          }
+          status.textContent = loginMethod === 'session-cookie'
+            ? 'Profile ready. Your agent can now open the provider sign-in and send you any required approval link.'
+            : 'Profile ready. Your agent will send a secure credential link before the first sign-in.';
+          button.textContent = 'Profile created';
+        } catch {
+          status.textContent = 'Couldn’t reach the server — try again.';
+          button.removeAttribute('disabled');
+        }
+      })();
+    });
+  }
+
   // ── Episode + outcome bookkeeping (D1/D4/D5) ───────────────────────────────
   function purgeTransients() {
     const t = now();
@@ -1128,7 +1249,8 @@ export function createController(opts) {
     const accounts = accountsBody && Array.isArray(accountsBody.accounts) ? accountsBody.accounts : [];
     const logins = pendingBody && Array.isArray(pendingBody.logins) ? pendingBody.logins : [];
     const inUseAccountId = inUseBody && inUseBody.activeAccountId ? inUseBody.activeAccountId : null;
-    renderAccounts(doc, els.accounts, accounts, now(), inUseAccountId);
+    renderAccounts(doc, els.accounts, accounts, now(), inUseAccountId, state.reloginEpisodes);
+    wireReloginActions();
     purgeTransients();
     // Episode reconciliation runs FIRST so a terminal transition it derives (expired /
     // landed) is visible to BOTH surfaces on this same tick (the panel card + the cell).
@@ -1169,6 +1291,44 @@ export function createController(opts) {
     }
   }
 
+  function wireReloginActions() {
+    if (!els.accounts || state.reloginWired) return;
+    state.reloginWired = true;
+    els.accounts.addEventListener('click', (event) => {
+      const button = event.target && event.target.closest ? event.target.closest('[data-relogin-action]') : null;
+      if (!button) return;
+      const action = button.getAttribute('data-relogin-action');
+      const episodeId = button.getAttribute('data-relogin-id');
+      if (!['approve', 'cancel', 'retry'].includes(action) || !episodeId) return;
+      const proof = getOperatorSessionToken();
+      if (!proof) {
+        button.textContent = 'Unlock the dashboard again';
+        return;
+      }
+      button.setAttribute('disabled', 'disabled');
+      void postReloginAction(episodeId, action, proof, button);
+    });
+  }
+
+  async function postReloginAction(episodeId, action, proof, button) {
+    try {
+      const response = await fetchImpl(`${URLS.relogin}/${encodeURIComponent(episodeId)}/${action}`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', 'X-Instar-Operator-Session': proof },
+        body: '{}',
+      });
+      if (!response.ok) {
+        button.textContent = response.status === 401 ? 'Unlock the dashboard again' : 'Couldn’t start — try again';
+        button.removeAttribute('disabled');
+        return;
+      }
+      await tick();
+    } catch {
+      button.textContent = 'Couldn’t reach the server — try again';
+      button.removeAttribute('disabled');
+    }
+  }
+
   // Delegated, wired ONCE: an Approve tap reads the card's PIN, builds the issue-for-machine
   // payload from the held offers (FD2 agents resolved server-side — never typed), and POSTs the
   // PIN-gated mandate. The card carries only non-sensitive ids; the PIN is sent once, never stored.

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAoFH,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAUjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA4BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAiI7D,OAAO,KAAK,EAAW,oBAAoB,EAAe,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAgFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAuID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAouDD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CAivBN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA41sBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAqFH,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAUjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA4BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAiI7D,OAAO,KAAK,EAAW,oBAAoB,EAAe,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAgFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA0ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAouDD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CAivBN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA48sBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -74,6 +74,7 @@ import { gapBEligibleForTopic, recentUserMessageFromHistory, recentUserMessageAt
 import { TopicProfileTransferCarrier, createTopicProfilePullHandler } from '../core/TopicProfileTransferCarrier.js';
 import { resolveFrameworkBinaryPath, computeGrokInteractiveOptIn } from '../core/frameworkSessionLaunch.js';
 import { closeAllSqlite } from '../core/SqliteRegistry.js';
+import { DP_SUBSCRIPTION_RELOGIN_ACTION } from '../data/provenanceCoverage.js';
 import { SessionManager, IDLE_PROMPT_PATTERNS } from '../core/SessionManager.js';
 import { configureSyncOpMarker, defaultInflightMarkerReader } from '../core/InFlightSyncOpMarker.js';
 import { StateManager } from '../core/StateManager.js';
@@ -419,7 +420,10 @@ async function handleFixCommand(topicId, text, deps) {
         else {
             for (const s of stale) {
                 try {
-                    deps.sessionManager.killSession(s.tmuxSession);
+                    // killSession() resolves BY ID; handing it a tmux name misses the
+                    // lookup and returns false silently ("the stop that does not stop").
+                    // killSessionByTmuxName is the single place that resolution lives.
+                    deps.sessionManager.killSessionByTmuxName(s.tmuxSession);
                 }
                 catch { /* best effort */ }
             }
@@ -13503,6 +13507,101 @@ export async function startServer(options) {
             interactiveReservePct: 0.4,
             maxDailyCents: promiseBeaconCfg.maxDailyLlmSpendCents ?? 100,
         });
+        // Assisted subscription re-login — explicit opt-in, dry-run/observe by default.
+        // Constructed from the existing authority owners; no credential/token is copied.
+        let subscriptionReloginRuntime = null;
+        const reloginCfg = config.subscriptionPool?.assistedRelogin;
+        if (reloginCfg?.enabled === true && subscriptionLoginLedger && subscriptionPoolMachineId && sharedIntelligence) {
+            try {
+                const [{ createSubscriptionReloginRuntime }, { PlaywrightProfileRegistry }, { SecretStore }, { secretKeyPaths }, { ClaudePasteBackController }, { ChromeCdpReloginBrowser }] = await Promise.all([
+                    import('../core/SubscriptionReloginRuntime.js'), import('../core/PlaywrightProfileRegistry.js'),
+                    import('../core/SecretStore.js'), import('../core/SecretSync.js'),
+                    import('../core/ClaudePasteBackController.js'), import('../core/ChromeCdpReloginBrowser.js'),
+                ]);
+                const vault = new SecretStore({ stateDir: config.stateDir, forceFileKey: config.secrets?.forceFileKey });
+                const profiles = new PlaywrightProfileRegistry({ stateDir: config.stateDir, projectDir: config.projectDir,
+                    listVaultNames: () => {
+                        try {
+                            return secretKeyPaths(vault.read());
+                        }
+                        catch {
+                            return null;
+                        }
+                    } });
+                const pasteBack = new ClaudePasteBackController({
+                    captureOutput: (session, lines) => sessionManager.captureOutput(session, lines),
+                    sendInput: (session, input) => sessionManager.sendInput(session, input),
+                    clearHistory: (session) => {
+                        const tmux = detectTmuxPath();
+                        if (!tmux)
+                            throw new Error('tmux-unavailable');
+                        execFileSync(tmux, ['clear-history', '-t', `=${session}:`], { stdio: 'ignore' });
+                    },
+                    credentialReady: async (login) => {
+                        if (!login.configHome)
+                            return false;
+                        const result = await subscriptionIdentityOracle.resolveSlotTenant(login.configHome);
+                        return !('unavailable' in result) && typeof result.email === 'string' && result.email.length > 0;
+                    },
+                });
+                const notify = telegram ? async (episode, deliveryKey, kind) => {
+                    const summary = kind === 'approval'
+                        ? 'A Claude Code subscription sign-in needs repair. Open Subscriptions and tap Repair sign-in once.'
+                        : kind === 'operator-only'
+                            ? 'Automated sign-in paused at a provider security challenge. Open Subscriptions to continue.'
+                            : episode.state === 'succeeded'
+                                ? 'Claude Code subscription sign-in was repaired and verified.'
+                                : `Claude Code subscription repair ended in ${episode.state}. Open Subscriptions for the redacted audit.`;
+                    await telegram.createAttentionItem({ id: deliveryKey.replace(/:/g, '-'), title: 'Claude Code sign-in repair',
+                        summary, description: summary, category: 'subscription-relogin',
+                        priority: kind === 'terminal' && episode.state === 'succeeded' ? 'NORMAL' : 'HIGH',
+                        sourceContext: 'assisted-subscription-relogin' });
+                } : undefined;
+                subscriptionReloginRuntime = createSubscriptionReloginRuntime({ stateDir: config.stateDir,
+                    projectDir: config.projectDir, machineId: subscriptionPoolMachineId,
+                    mode: reloginCfg.dryRun !== false ? 'observe' : (reloginCfg.mode ?? 'approval'),
+                    pool: subscriptionPool, ledger: subscriptionLoginLedger, enrollment: enrollmentWizard,
+                    profiles, quotaPoller, identityOracle: subscriptionIdentityOracle, pasteBack,
+                    createBrowser: (userDataDir) => new ChromeCdpReloginBrowser({ userDataDir }),
+                    resolveSecret: async (name) => { const value = vault.get(name); return typeof value === 'string' ? value : null; },
+                    supervise: async ({ snapshot, allowedActions }) => {
+                        const prompt = [
+                            'You are a Tier-1 validator for a bounded Claude sign-in browser worker.',
+                            'Choose exactly one action from allowedActions. Output only that action token.',
+                            'You cannot authorize an account, broaden scopes/origins, retrieve secrets, or declare success.',
+                            `closedSnapshot=${JSON.stringify(snapshot)}`,
+                            `allowedActions=${JSON.stringify(allowedActions)}`,
+                        ].join('\n');
+                        const raw = await sharedLlmQueue.enqueue('background', (signal) => sharedIntelligence.evaluate(prompt, {
+                            model: 'fast', maxTokens: 20, temperature: 0, signal,
+                            attribution: { component: 'subscription-relogin-supervisor' },
+                            provenance: {
+                                decisionPoint: DP_SUBSCRIPTION_RELOGIN_ACTION,
+                                context: { ...snapshot },
+                                optionsPresented: [...allowedActions],
+                                promptId: 'subscription-relogin-action-v1',
+                            },
+                        }), 1);
+                        const action = raw.trim();
+                        if (!allowedActions.includes(action))
+                            throw new Error('relogin-supervisor-invalid-action');
+                        return action;
+                    },
+                    onSuggested: notify ? (episode, key) => notify(episode, key, 'approval') : undefined,
+                    onOperatorOnly: notify ? (episode, key) => notify(episode, key, 'operator-only') : undefined,
+                    onTerminal: notify ? (episode, key) => notify(episode, key, 'terminal') : undefined,
+                    allowedScopes: reloginCfg.allowedScopes ?? [], tickMs: reloginCfg.tickMs,
+                    maxAttempts: reloginCfg.maxAttempts, retryBaseMs: reloginCfg.retryBaseMs, });
+                subscriptionReloginRuntime.start();
+                console.log(pc.green(`  Assisted subscription re-login: ${reloginCfg.dryRun !== false ? 'observe' : (reloginCfg.mode ?? 'approval')}`));
+            }
+            catch (error) {
+                // @silent-fallback-ok — bootstrap refusal is logged and the runtime is explicitly darkened; routes return typed 503.
+                console.warn(`[subscription-relogin] bootstrap refused: ${error instanceof Error ? error.message : String(error)}`);
+                subscriptionReloginRuntime?.close();
+                subscriptionReloginRuntime = null;
+            }
+        }
         // sharedLlmQueue is wired into both PromiseBeacon (background lane) and
         // PresenceProxy (interactive lane) below.
         // ── WS3 one-voice speaker election (MULTI-MACHINE-SEAMLESSNESS-SPEC) ──
@@ -24771,6 +24870,13 @@ export async function startServer(options) {
             } if (peers.length === 0)
                 return []; const { fetchPeerSubscriptionViews } = await import('../core/fetchPeerSubscriptionViews.js'); return fetchPeerSubscriptionViews({ peers: () => peers, fetchImpl: fetch, authToken: config.authToken ?? '' }); }, quotaPoller, quotaAwareScheduler: _quotaAwareScheduler ?? undefined, proactiveSwapMonitor: _proactiveSwapMonitor ?? undefined, inUseAccountResolver, enrollmentWizard, accountFollowMeRevocation, credentialRepointing, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, greenPrAutoMerger: greenPrAutoMerger ?? undefined, guardLatchStore: guardLatchStore ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, topicProfile: _topicProfileCtx ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, meshBindActive: coordinator.managers.identityManager.hasIdentity() && config.multiMachine?.meshTransport?.enabled !== false, localSigningKeyPem, leaseTransport, peerEndpointRecorder, getSelfMeshEndpoints, onLeasePullRequest: () => leaseCoordinatorRef?.currentLease() ?? null, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, conversationRegistry, conversationBindAuth, conversationFollowThrough, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, threadLog, threadMessageRecorder, warrantsReplyGate, collaborationSurfacer, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, getLastRelayEvent: threadlineGetLastRelayEvent, threadlineReplyWaiters, listenerManager: listenerManager ?? undefined, a2aDeliveryTracker: a2aDeliveryTracker ?? undefined, responseReviewGate, reviewCanaryBattery, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, machinePoolRegistry, ropeHealthMonitor, writeAdmission: writeAdmission ?? undefined, getInboundQueue: () => _inboundQueue, getMachineCoherence: () => _machineCoherenceSentinel, getSingleMachineFailoverGap: () => _singleMachineFailoverGap, getMissingLoginSession: () => _missingLoginSession, getSessionPoolFailoverRunner: () => _sessionPoolFailoverRunnerDriver?.status() ?? null, sessionPoolPromotionActivation: _sessionPoolPromotionActivation, meshRpcDispatcher, deliverA2aToMachine: _deliverA2aToMachine ?? undefined, workingSetPullCoordinator, workingSetArtifactManager, orchestratorPoller, commitmentReplicaStore, preferenceReplicaStore, replicatedRecordEmitter, conflictStore, rollbackUnmerge, droppedOriginRegistry, preferencesUnionReader, forwardCommitmentMutate, sessionOwnershipRegistry, sendDrain: _sendDrain ?? undefined, topicPinStore: _topicPinStore ?? undefined, topicPinSkewQuarantine: _topicPinSkewQuarantine ?? undefined, topicPinFoldView: _topicPinFoldView ?? undefined, ownershipReconciler: _ownershipReconciler ?? undefined, staleOwnerEngine: _staleOwnerEngine ?? undefined, duplicateReconciler: _duplicateReconciler ?? undefined, ownerDarkLadder: _ownerDarkLadder ?? undefined, spawnAdmission: _spawnAdmission ?? undefined, judgmentProvenance: _judgmentProvenance ?? undefined, leaseHandback: _leaseHandbackCtx ?? undefined, streamTicketStore: _streamTicketStore ?? undefined, poolStreamAllowRemoteInput: config.dashboard?.poolStream?.allowRemoteInput ?? false, poolStreamConnector: _poolStreamConnector ?? undefined, secretSync: _secretSyncHandle ?? undefined, meshSelfId: _meshSelfId ?? undefined, resolveRouterUrl: _resolveRouterUrl ?? undefined, resolvePeerUrls: _resolvePeerUrls ?? undefined, guardRegistry, listPoolMachines: _listPoolMachines ?? undefined, deliverMandateToMachine: _deliverMandateToMachine ?? undefined, poolLink: _poolLink ?? undefined, poolPollCache: _poolPollCache ?? undefined, sessionPoolE2EResultStore, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, agentWorktreeReaper, externalHogSentinel, orphanedWorkSentinel, mcpProcessReaper, geminiLoopRunner, sleepController, agentActivityState, reapLog, resumeQueue, resumeDrainer, autonomousLivenessReconciler, enforcedTerminationStatus: () => enforcedTerminationWatchdog?.guardStatus() ?? null, prHandLease: prHandLease ?? undefined, standDownRegistry: _standDownRegistry ?? undefined, standDownAudit: _standDownAudit ?? undefined, operatorStopRecorder: recordOperatorStop, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier, liveTestGate, liveTestGateMode, liveTestRunnerCtx }); // Resolve the late-bound topic-operator getter (increment 2e): routing was
         server.setSubscriptionLoginLedger(subscriptionLoginLedger);
+        server.setSubscriptionRelogin(subscriptionReloginRuntime ? {
+            store: subscriptionReloginRuntime.store,
+            approve: (episodeId) => subscriptionReloginRuntime.service.approve(episodeId),
+            cancel: (episodeId) => subscriptionReloginRuntime.service.cancel(episodeId),
+            retry: (episodeId) => subscriptionReloginRuntime.service.retry(episodeId),
+            close: () => subscriptionReloginRuntime.close(),
+        } : null);
         server.setWorkQueue(workQueue);
         if (_stateSyncStoresResolved?.classReview?.enabled && replicatedPeerStreamReader) {
             const { CLASS_REVIEW_STORE_KEY, classReviewFromOriginRecord } = await import('../core/ClassReviewReplicatedStore.js');
@@ -24909,14 +25015,29 @@ export async function startServer(options) {
                                 return 'unconfirmed';
                             return paneIdleWithEmptyInput(tail) ? 'confirmed-idle' : 'busy';
                         },
-                        killForResume: async (sessionName) => sessionManager.killSession(sessionName),
+                        // NB: listTopicSessions() supplies `sessionName` as the session's
+                        // TMUX NAME. killSession() resolves BY ID (state/sessions/<id>.json),
+                        // so passing a name here missed the lookup and returned false with no
+                        // kill — "the stop that does not stop". The respawn then found the old
+                        // session still alive and merely injected into it, so a framework swap
+                        // silently never happened. killSessionByTmuxName is the single place
+                        // that name→id resolution lives; its boolean is the REAL outcome and
+                        // the orchestrator now aborts the respawn when it is false.
+                        killForResume: async (sessionName) => sessionManager.killSessionByTmuxName(sessionName),
                         killFresh: async (sessionName) => {
-                            // Fresh respawn: clear the resume entry first so the next spawn does
-                            // NOT --resume the (possibly cross-framework) transcript, then kill.
-                            const topic = telegram?.getTopicForSession?.(sessionName);
-                            if (topic != null && Number.isFinite(Number(topic)))
-                                _topicResumeMap?.remove(Number(topic));
-                            return sessionManager.killSession(sessionName);
+                            // Fresh respawn: the orchestrator has ALREADY parked this topic's
+                            // resume entry (claudeResume.park -> _topicResumeMap.park) before
+                            // calling us, and a parked entry is invisible to get() /
+                            // getForFramework() / getProvenance() — so the next spawn cannot
+                            // --resume the cross-framework transcript. This port used to ALSO
+                            // call _topicResumeMap.remove(), which DELETES rather than parks;
+                            // that was redundant with the park and destroyed the cheap
+                            // recovery TopicResumeMap's own §8 rule protects ("'remove' means
+                            // PARK, not delete"). It also made the kill-failure abort
+                            // unrecoverable: unpark() finds no entry and restores nothing, so
+                            // a still-live session lost its resume id to an attempt that was
+                            // supposed to be a no-op.
+                            return sessionManager.killSessionByTmuxName(sessionName);
                         },
                         spawn: async (topicKey, _resolved, _directive) => {
                             // The orchestrator already killed; respawn re-resolves the (now