instar 1.3.1236 → 1.3.1238

package/dashboard/index.html

@@ -9857,6 +9857,10 @@
         __subController = __subModule.createController({
           doc: document, els, fetchImpl,
           getOperatorSessionToken: () => operatorSessionToken,
+          requestUnlock: () => {
+            document.getElementById('authOverlay').style.display = 'flex';
+            document.getElementById('pinInput').focus();
+          },
         });
       }
       __subController.start();

package/dashboard/subscriptions.js

@@ -811,7 +811,7 @@ export function groupMatrixRowsByProvider(rows) {
 /** Render the account × machine grid. `target` is replaced. Each empty (reachable) cell
  *  gets a "Set up" button carrying its (accountId, machineId) as data-* attributes for the
  *  controller's delegated tap handler. Offline columns are disabled; no state is fabricated. */
-export function renderAccountMatrix(doc, target, poolScope, pendingScope, transient = {}) {
+export function renderAccountMatrix(doc, target, poolScope, pendingScope, transient = {}, reloginEpisodes = [], reloginFailures = []) {
   if (!target) return;
   target.replaceChildren();
   const model = buildMatrixModel(poolScope, pendingScope, transient);
@@ -855,12 +855,38 @@ export function renderAccountMatrix(doc, target, poolScope, pendingScope, transi
     const tr = doc.createElement('tr');
     tr.appendChild(el(doc, 'th', 'sub-matrix-acct', sanitizeForDisplay(row.account.email, 'label')));
     for (const c of row.cells) {
+      const repair = Array.isArray(reloginEpisodes)
+        ? reloginEpisodes.find((episode) => episode && episode.accountId === c.accountId && episode.machineId === c.machineId)
+        : null;
+      const repairUnavailable = Array.isArray(reloginFailures)
+        && reloginFailures.some((failure) => failure && failure.machineId === c.machineId);
       // just-verified rides a transient highlight on an otherwise-active cell (D4 ceremony).
       const justVerified = c.state === 'just-verified' || (c.state === 'active' && c.detail && c.detail.state === 'just-verified');
       const td = el(doc, 'td', `sub-matrix-cell sub-matrix-${c.state}${justVerified && c.state !== 'just-verified' ? ' sub-matrix-just-verified' : ''}`);
       // Stable cell identity for the interaction-hold rule + targeted merge updates (F9).
       td.setAttribute('data-cell-key', sanitizeForDisplay(`${c.accountId}::${c.machineId}`, 'url'));
-      if (c.state === 'empty' || c.state === 'needs-reauth' || c.state === 'held' || c.state === 'cant-resolve' || c.state === 'email-missing' || c.state === 'expired' || c.state === 'broken') {
+      if (repairUnavailable && ['needs-reauth', 'held', 'cant-resolve', 'expired', 'broken'].includes(c.state)) {
+        td.appendChild(el(doc, 'div', 'sub-account-repair-status', 'Repair status is unavailable for this machine.'));
+        td.appendChild(el(doc, 'div', 'sub-matrix-held-detail', 'Wait for the machine connection to recover, then try again.'));
+      } else if (repair && ['suggested', 'approved', 'cli-starting', 'artifact-ready', 'browser-driving', 'cli-finishing', 'identity-verifying', 'auth-verifying', 'waiting-operator-only', 'failed'].includes(repair.state)) {
+        const label = repair.state === 'suggested' ? 'Sign-in repair is ready.'
+          : repair.state === 'waiting-operator-only' ? 'Sign-in needs your help.'
+            : repair.state === 'failed' ? 'Sign-in repair stopped safely.'
+              : 'Repairing sign-in…';
+        td.appendChild(el(doc, 'div', 'sub-account-repair-status', label));
+        const repairAction = repair.state === 'suggested' ? ['approve', 'Repair sign-in']
+          : repair.state === 'failed' ? ['retry', 'Try repair again']
+            : ['cancel', 'Cancel repair'];
+        if (repairAction) {
+          const button = el(doc, 'button', `sub-matrix-repair sub-matrix-repair-${repairAction[0]}`, repairAction[1]);
+          button.setAttribute('data-matrix-relogin', '1');
+          button.setAttribute('data-repair-action', repairAction[0]);
+          button.setAttribute('data-account-id', sanitizeForDisplay(c.accountId, 'label'));
+          button.setAttribute('data-machine-id', sanitizeForDisplay(c.machineId, 'label'));
+          button.setAttribute('data-episode-id', sanitizeForDisplay(repair.id, 'label'));
+          td.appendChild(button);
+        }
+      } else if (c.state === 'empty' || c.state === 'needs-reauth' || c.state === 'held' || c.state === 'cant-resolve' || c.state === 'email-missing' || c.state === 'expired' || c.state === 'broken') {
         // An actionable cell → a button that runs the SAME in-dashboard sign-in flow (PIN → link →
         // paste code). empty → "Set up"; needs-reauth (an existing account whose login expired) →
         // "Sign in"; held/cant-resolve/expired/broken → "Retry". A needs-reauth account already
@@ -959,7 +985,9 @@ const URLS = {
   accountsPool: '/subscription-pool?scope=pool',
   startCell: '/subscription-pool/matrix/start-cell', // POST (PIN-gated) — start a cell's sign-in
   cancel: '/subscription-pool/follow-me/cancel', // POST (Bearer, no PIN) — cancel an in-flight cell (relay → self/peer)
-  relogin: '/subscription-relogin',
+  relogin: '/subscription-relogin?scope=pool',
+  reloginAction: '/subscription-relogin',
+  repairCell: '/subscription-relogin/repair-cell',
   provisionProfile: '/playwright-profiles/provision',
 };
 
@@ -1017,6 +1045,7 @@ export function createController(opts) {
     schedule = (fn, ms) => setTimeout(fn, ms),
     cancel = (id) => clearTimeout(id),
     getOperatorSessionToken = () => '',
+    requestUnlock = () => {},
   } = opts;
 
   // matrixTransient: client-side last-attempt state per `${accountId}::${machineId}` cell (FD6 —
@@ -1027,7 +1056,7 @@ export function createController(opts) {
   // add the D4 ceremony when the episode lands. recentOutcomes: client-observed terminal
   // outcomes rendered as explicit cards in the pending panel (D4 — never a vanishing line).
   const state = { timerId: null, active: false, inFlight: null, offers: [], approveWired: false,
-    reloginWired: false, reloginEpisodes: [], profileProvisionWired: false,
+    reloginWired: false, reloginEpisodes: [], reloginFailures: [], profileProvisionWired: false,
     matrixWired: false, matrixTransient: {}, lastPoolBody: null, lastPendingBody: null,
     matrixEpisodes: {}, recentOutcomes: [] };
 
@@ -1090,6 +1119,8 @@ export function createController(opts) {
     }
     state.offers = scanBody && Array.isArray(scanBody.offered) ? scanBody.offered : [];
     state.reloginEpisodes = reloginBody && Array.isArray(reloginBody.episodes) ? reloginBody.episodes : [];
+    state.reloginFailures = reloginBody && reloginBody.pool && Array.isArray(reloginBody.pool.failed)
+      ? reloginBody.pool.failed : [];
     if (els.profileProvision && !state.profileProvisionWired) {
       renderProfileProvisioner(doc, els.profileProvision);
       wireProfileProvisioner();
@@ -1109,7 +1140,11 @@ export function createController(opts) {
       const profileId = els.profileProvision.querySelector('[aria-label="Profile name"]')?.value?.trim() || '';
       const loginMethod = els.profileProvision.querySelector('[aria-label="Sign-in method"]')?.value || 'session-cookie';
       const status = els.profileProvision.querySelector('.sub-profile-status');
-      if (!proof) { status.textContent = 'Unlock the dashboard again, then retry.'; return; }
+      if (!proof) {
+        requestUnlock();
+        status.textContent = 'Enter your dashboard PIN, then retry.';
+        return;
+      }
       if (!identity || !profileId) { status.textContent = 'Enter the Google account and a profile name.'; return; }
       button.setAttribute('disabled', 'disabled');
       status.textContent = 'Preparing the private profile…';
@@ -1122,8 +1157,9 @@ export function createController(opts) {
           });
           const body = await response.json().catch(() => ({}));
           if (!response.ok) {
+            if (response.status === 401) requestUnlock();
             status.textContent = response.status === 401
-              ? 'Unlock the dashboard again, then retry.'
+              ? 'Enter your dashboard PIN, then retry.'
               : `Couldn’t create the profile: ${body.error || 'try again'}`;
             button.removeAttribute('disabled');
             return;
@@ -1242,14 +1278,18 @@ export function createController(opts) {
   function rerenderMatrixFromCache() {
     if (!els.matrix || !state.lastPoolBody) return;
     if (hasOpenInteraction(doc, els.matrix)) return;
-    renderAccountMatrix(doc, els.matrix, state.lastPoolBody, state.lastPendingBody, state.matrixTransient);
+    renderAccountMatrix(doc, els.matrix, state.lastPoolBody, state.lastPendingBody, state.matrixTransient, state.reloginEpisodes, state.reloginFailures);
   }
 
   function render(accountsBody, pendingBody, inUseBody, poolBody) {
     const accounts = accountsBody && Array.isArray(accountsBody.accounts) ? accountsBody.accounts : [];
     const logins = pendingBody && Array.isArray(pendingBody.logins) ? pendingBody.logins : [];
     const inUseAccountId = inUseBody && inUseBody.activeAccountId ? inUseBody.activeAccountId : null;
-    renderAccounts(doc, els.accounts, accounts, now(), inUseAccountId, state.reloginEpisodes);
+    // The account-card pane is machine-local. Do not attach a remote machine's
+    // episode to a same-account local card; remote repairs belong to the exact
+    // account×machine matrix cell below.
+    const localReloginEpisodes = state.reloginEpisodes.filter((episode) => episode && episode.remote !== true);
+    renderAccounts(doc, els.accounts, accounts, now(), inUseAccountId, localReloginEpisodes);
     wireReloginActions();
     purgeTransients();
     // Episode reconciliation runs FIRST so a terminal transition it derives (expired /
@@ -1273,7 +1313,7 @@ export function createController(opts) {
     // the (already pool-scope) pending logins. Hidden when the pool-scope read is unavailable.
     if (els.matrix) {
       if (!hasOpenInteraction(doc, els.matrix)) {
-        renderAccountMatrix(doc, els.matrix, poolBody, pendingBody, state.matrixTransient);
+        renderAccountMatrix(doc, els.matrix, poolBody, pendingBody, state.matrixTransient, state.reloginEpisodes, state.reloginFailures);
       } else {
         updateCountdowns(doc, els.matrix, now());
       }
@@ -1302,7 +1342,8 @@ export function createController(opts) {
       if (!['approve', 'cancel', 'retry'].includes(action) || !episodeId) return;
       const proof = getOperatorSessionToken();
       if (!proof) {
-        button.textContent = 'Unlock the dashboard again';
+        requestUnlock();
+        button.textContent = 'Enter PIN, then try again';
         return;
       }
       button.setAttribute('disabled', 'disabled');
@@ -1312,13 +1353,14 @@ export function createController(opts) {
 
   async function postReloginAction(episodeId, action, proof, button) {
     try {
-      const response = await fetchImpl(`${URLS.relogin}/${encodeURIComponent(episodeId)}/${action}`, {
+      const response = await fetchImpl(`${URLS.reloginAction}/${encodeURIComponent(episodeId)}/${action}`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json', 'X-Instar-Operator-Session': proof },
         body: '{}',
       });
       if (!response.ok) {
-        button.textContent = response.status === 401 ? 'Unlock the dashboard again' : 'Couldn’t start — try again';
+        if (response.status === 401) requestUnlock();
+        button.textContent = response.status === 401 ? 'Enter PIN, then try again' : 'Couldn’t start — try again';
         button.removeAttribute('disabled');
         return;
       }
@@ -1466,6 +1508,8 @@ export function createController(opts) {
     els.matrix.addEventListener('click', (ev) => {
       const t = ev.target;
       if (!t || typeof t.closest !== 'function') return;
+      const repairBtn = t.closest('[data-matrix-relogin]');
+      if (repairBtn && els.matrix.contains(repairBtn)) { onRepairTap(repairBtn); return; }
       const setupBtn = t.closest('[data-matrix-setup]');
       if (setupBtn && els.matrix.contains(setupBtn)) { onSetupTap(setupBtn); return; }
       const confirmBtn = t.closest('[data-matrix-confirm]');
@@ -1488,6 +1532,53 @@ export function createController(opts) {
     s.textContent = text;
   }
 
+  // One click after dashboard unlock authorizes exactly one account×machine
+  // repair. The short-lived operator proof stays on the fronting machine; the
+  // server converts it into an exact, signed mandate for the target machine.
+  function onRepairTap(btn) {
+    const cell = matrixCellOf(btn);
+    if (!cell) return;
+    const accountId = btn.getAttribute('data-account-id');
+    const machineId = btn.getAttribute('data-machine-id');
+    const episodeId = btn.getAttribute('data-episode-id');
+    const action = btn.getAttribute('data-repair-action') || 'approve';
+    const proof = getOperatorSessionToken();
+    if (!accountId || !machineId || !episodeId) {
+      setCellStatus(cell, 'Couldn’t prepare this repair — refresh and try again.');
+      return;
+    }
+    if (!proof) {
+      requestUnlock();
+      setCellStatus(cell, 'Enter your dashboard PIN, then tap Repair sign-in once.');
+      return;
+    }
+    btn.setAttribute('disabled', 'disabled');
+    setCellStatus(cell, 'Starting autonomous sign-in repair…');
+    void (async () => {
+      try {
+        const response = await fetchImpl(URLS.repairCell, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json', 'X-Instar-Operator-Session': proof },
+          body: JSON.stringify({ accountId, machineId, episodeId, action }),
+        });
+        const body = await response.json().catch(() => ({}));
+        if (!response.ok) {
+          if (response.status === 401) requestUnlock();
+          setCellStatus(cell, response.status === 401
+            ? 'Enter your dashboard PIN, then tap Repair sign-in once.'
+            : body.error || 'Couldn’t start the repair — try again.');
+          btn.removeAttribute('disabled');
+          return;
+        }
+        setCellStatus(cell, 'Repair started — Instar is handling the sign-in.');
+        await tick();
+      } catch {
+        setCellStatus(cell, 'Couldn’t reach the target machine — try again.');
+        btn.removeAttribute('disabled');
+      }
+    })();
+  }
+
   // Expand the cell into a PIN input + Confirm (replacing the "Set up"/"Retry" button).
   // The cell becomes an OPEN INTERACTION the moment it expands (F9): the marker holds it
   // through the poll until the flow reaches a terminal state or the operator backs out.

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAqGA,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAUjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA4BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAmI7D,OAAO,KAAK,EAAW,oBAAoB,EAAe,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAiFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA0ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAoDD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AAsrDD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CA8yBN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAurvBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAsGA,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAUjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA4BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAmI7D,OAAO,KAAK,EAAW,oBAAoB,EAAe,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAiFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA0ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAoDD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AAsrDD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CA8yBN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAisvBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -9,6 +9,7 @@ import { bindUnknownProducerTelegramSender, sendDeterministicTelegramNotice } fr
  *   topic message → find/spawn session → inject message → session replies via [telegram:N]
  */
 import { execFile, execFileSync } from 'node:child_process';
+import { createHmac } from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -13542,6 +13543,19 @@ export async function startServer(options) {
                     return null;
                 }
             },
+            // Claude's `.claude.json` is a settings file and commonly predates a
+            // repair, so its mere existence can never prove this login completed.
+            // Capture an HMAC revision of the machine-local keychain blob before the
+            // artifact is issued and require that revision to change. The auth bytes
+            // never leave memory; only the keyed digest enters pending state.
+            authRevisionWitness: async (login) => {
+                if (login.framework !== 'claude-code' || !login.configHome)
+                    return null;
+                const raw = await defaultKeychainExec.readService(credSwapService(login.configHome));
+                if (!raw)
+                    return null;
+                return createHmac('sha256', config.authToken ?? '').update(raw).digest('hex');
+            },
             driveLogin: new FrameworkLoginDriver({
                 // Capture with `tmux capture-pane -J` so a hard-WRAPPED verification URL is
                 // joined back into one line (the 2026-06-18 "code=t" truncation bug). Falls
@@ -13610,7 +13624,6 @@ export async function startServer(options) {
                 .catch(() => { });
             enrollmentWizard
                 .sweepFollowMeCompletions({
-                credentialReady: (l) => !!l.configHome && fs.existsSync(path.join(l.configHome, '.claude.json')),
                 onValidated: (login, email) => {
                     // Upsert (D5): a re-auth of an EXISTING pool account updates it back to
                     // active; only a genuinely-new account is added (add() refuses dup ids).