instar 1.3.1237 → 1.3.1238

package/dashboard/index.html

@@ -9857,6 +9857,10 @@
         __subController = __subModule.createController({
           doc: document, els, fetchImpl,
           getOperatorSessionToken: () => operatorSessionToken,
+          requestUnlock: () => {
+            document.getElementById('authOverlay').style.display = 'flex';
+            document.getElementById('pinInput').focus();
+          },
         });
       }
       __subController.start();

package/dashboard/subscriptions.js

@@ -1045,6 +1045,7 @@ export function createController(opts) {
     schedule = (fn, ms) => setTimeout(fn, ms),
     cancel = (id) => clearTimeout(id),
     getOperatorSessionToken = () => '',
+    requestUnlock = () => {},
   } = opts;
 
   // matrixTransient: client-side last-attempt state per `${accountId}::${machineId}` cell (FD6 —
@@ -1139,7 +1140,11 @@ export function createController(opts) {
       const profileId = els.profileProvision.querySelector('[aria-label="Profile name"]')?.value?.trim() || '';
       const loginMethod = els.profileProvision.querySelector('[aria-label="Sign-in method"]')?.value || 'session-cookie';
       const status = els.profileProvision.querySelector('.sub-profile-status');
-      if (!proof) { status.textContent = 'Unlock the dashboard again, then retry.'; return; }
+      if (!proof) {
+        requestUnlock();
+        status.textContent = 'Enter your dashboard PIN, then retry.';
+        return;
+      }
       if (!identity || !profileId) { status.textContent = 'Enter the Google account and a profile name.'; return; }
       button.setAttribute('disabled', 'disabled');
       status.textContent = 'Preparing the private profile…';
@@ -1152,8 +1157,9 @@ export function createController(opts) {
           });
           const body = await response.json().catch(() => ({}));
           if (!response.ok) {
+            if (response.status === 401) requestUnlock();
             status.textContent = response.status === 401
-              ? 'Unlock the dashboard again, then retry.'
+              ? 'Enter your dashboard PIN, then retry.'
               : `Couldn’t create the profile: ${body.error || 'try again'}`;
             button.removeAttribute('disabled');
             return;
@@ -1336,7 +1342,8 @@ export function createController(opts) {
       if (!['approve', 'cancel', 'retry'].includes(action) || !episodeId) return;
       const proof = getOperatorSessionToken();
       if (!proof) {
-        button.textContent = 'Unlock the dashboard again';
+        requestUnlock();
+        button.textContent = 'Enter PIN, then try again';
         return;
       }
       button.setAttribute('disabled', 'disabled');
@@ -1352,7 +1359,8 @@ export function createController(opts) {
         body: '{}',
       });
       if (!response.ok) {
-        button.textContent = response.status === 401 ? 'Unlock the dashboard again' : 'Couldn’t start — try again';
+        if (response.status === 401) requestUnlock();
+        button.textContent = response.status === 401 ? 'Enter PIN, then try again' : 'Couldn’t start — try again';
         button.removeAttribute('disabled');
         return;
       }
@@ -1540,7 +1548,8 @@ export function createController(opts) {
       return;
     }
     if (!proof) {
-      setCellStatus(cell, 'Unlock the dashboard again, then tap Repair sign-in once.');
+      requestUnlock();
+      setCellStatus(cell, 'Enter your dashboard PIN, then tap Repair sign-in once.');
       return;
     }
     btn.setAttribute('disabled', 'disabled');
@@ -1554,7 +1563,10 @@ export function createController(opts) {
         });
         const body = await response.json().catch(() => ({}));
         if (!response.ok) {
-          setCellStatus(cell, body.error || 'Couldn’t start the repair — try again.');
+          if (response.status === 401) requestUnlock();
+          setCellStatus(cell, response.status === 401
+            ? 'Enter your dashboard PIN, then tap Repair sign-in once.'
+            : body.error || 'Couldn’t start the repair — try again.');
           btn.removeAttribute('disabled');
           return;
         }

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAqGA,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAUjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA4BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAmI7D,OAAO,KAAK,EAAW,oBAAoB,EAAe,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAiFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA0ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAoDD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AAsrDD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CA8yBN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAurvBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAsGA,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAUjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA4BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAmI7D,OAAO,KAAK,EAAW,oBAAoB,EAAe,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAiFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA0ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAoDD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AAsrDD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CA8yBN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAisvBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -9,6 +9,7 @@ import { bindUnknownProducerTelegramSender, sendDeterministicTelegramNotice } fr
  *   topic message → find/spawn session → inject message → session replies via [telegram:N]
  */
 import { execFile, execFileSync } from 'node:child_process';
+import { createHmac } from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -13542,6 +13543,19 @@ export async function startServer(options) {
                     return null;
                 }
             },
+            // Claude's `.claude.json` is a settings file and commonly predates a
+            // repair, so its mere existence can never prove this login completed.
+            // Capture an HMAC revision of the machine-local keychain blob before the
+            // artifact is issued and require that revision to change. The auth bytes
+            // never leave memory; only the keyed digest enters pending state.
+            authRevisionWitness: async (login) => {
+                if (login.framework !== 'claude-code' || !login.configHome)
+                    return null;
+                const raw = await defaultKeychainExec.readService(credSwapService(login.configHome));
+                if (!raw)
+                    return null;
+                return createHmac('sha256', config.authToken ?? '').update(raw).digest('hex');
+            },
             driveLogin: new FrameworkLoginDriver({
                 // Capture with `tmux capture-pane -J` so a hard-WRAPPED verification URL is
                 // joined back into one line (the 2026-06-18 "code=t" truncation bug). Falls
@@ -13610,7 +13624,6 @@ export async function startServer(options) {
                 .catch(() => { });
             enrollmentWizard
                 .sweepFollowMeCompletions({
-                credentialReady: (l) => !!l.configHome && fs.existsSync(path.join(l.configHome, '.claude.json')),
                 onValidated: (login, email) => {
                     // Upsert (D5): a re-auth of an EXISTING pool account updates it back to
                     // active; only a genuinely-new account is added (add() refuses dup ids).