instar 1.3.1237 → 1.3.1239

package/dashboard/index.html

@@ -9857,6 +9857,10 @@
         __subController = __subModule.createController({
           doc: document, els, fetchImpl,
           getOperatorSessionToken: () => operatorSessionToken,
+          requestUnlock: () => {
+            document.getElementById('authOverlay').style.display = 'flex';
+            document.getElementById('pinInput').focus();
+          },
         });
       }
       __subController.start();

package/dashboard/subscriptions.js

@@ -79,6 +79,31 @@ export function effectiveAccountStatus(account) {
   return account && account.status;
 }
 
+const KNOWN_REPAIR_STATES = new Set([
+  'suggested', 'approved', 'cli-starting', 'artifact-ready', 'browser-driving',
+  'cli-finishing', 'identity-verifying', 'auth-verifying', 'waiting-operator-only',
+  'succeeded', 'refused', 'cancelled', 'failed',
+]);
+
+/** A suggested/failed repair is actionable only while current pool truth still says
+ *  the account cell needs authentication. Terminal repair rows remain durable audit
+ *  history, but must never shadow a newer Active observation or offer a retry that
+ *  the server's admission policy is required to refuse. In-flight states remain
+ *  visible because pool activation can precede the controller's final ledger close. */
+export function repairAppliesToCurrentState(repair, currentState) {
+  if (!repair || !KNOWN_REPAIR_STATES.has(repair.state)) return false;
+  if (repair.state === 'suggested' || repair.state === 'failed') {
+    return currentState === 'needs-reauth';
+  }
+  return true;
+}
+
+export function repairConflictMessage(error) {
+  return /^(?:retry|approval)-revalidation-refused:account-not-needs-reauth$/.test(
+    typeof error === 'string' ? error : '',
+  ) ? 'This account is already active. Refreshing its status…' : null;
+}
+
 const PROVIDER_WORDS = { anthropic: 'Claude', openai: 'Codex', 'github-copilot': 'Copilot', google: 'Gemini' };
 export function friendlyProvider(provider) {
   return PROVIDER_WORDS[typeof provider === 'string' ? provider : ''] || sanitizeForDisplay(provider, 'label');
@@ -294,9 +319,12 @@ export function renderAccounts(doc, target, accounts, now = Date.now(), inUseAcc
     if (refAge) {
       card.appendChild(el(doc, 'div', 'sub-account-refresh', `Token auto-refreshed ${refAge}`));
     }
-    const repair = Array.isArray(reloginEpisodes)
+    const repairCandidate = Array.isArray(reloginEpisodes)
       ? reloginEpisodes.find((episode) => episode && a && episode.accountId === a.id)
       : null;
+    const repair = repairAppliesToCurrentState(repairCandidate, effectiveAccountStatus(a))
+      ? repairCandidate
+      : null;
     if (repair) {
       const repairBox = el(doc, 'div', 'sub-account-repair');
       const terminal = ['succeeded', 'refused', 'cancelled', 'failed'].includes(repair.state);
@@ -855,9 +883,12 @@ export function renderAccountMatrix(doc, target, poolScope, pendingScope, transi
     const tr = doc.createElement('tr');
     tr.appendChild(el(doc, 'th', 'sub-matrix-acct', sanitizeForDisplay(row.account.email, 'label')));
     for (const c of row.cells) {
-      const repair = Array.isArray(reloginEpisodes)
+      const repairCandidate = Array.isArray(reloginEpisodes)
         ? reloginEpisodes.find((episode) => episode && episode.accountId === c.accountId && episode.machineId === c.machineId)
         : null;
+      const repair = repairAppliesToCurrentState(repairCandidate, c.state)
+        ? repairCandidate
+        : null;
       const repairUnavailable = Array.isArray(reloginFailures)
         && reloginFailures.some((failure) => failure && failure.machineId === c.machineId);
       // just-verified rides a transient highlight on an otherwise-active cell (D4 ceremony).
@@ -1045,6 +1076,7 @@ export function createController(opts) {
     schedule = (fn, ms) => setTimeout(fn, ms),
     cancel = (id) => clearTimeout(id),
     getOperatorSessionToken = () => '',
+    requestUnlock = () => {},
   } = opts;
 
   // matrixTransient: client-side last-attempt state per `${accountId}::${machineId}` cell (FD6 —
@@ -1139,7 +1171,11 @@ export function createController(opts) {
       const profileId = els.profileProvision.querySelector('[aria-label="Profile name"]')?.value?.trim() || '';
       const loginMethod = els.profileProvision.querySelector('[aria-label="Sign-in method"]')?.value || 'session-cookie';
       const status = els.profileProvision.querySelector('.sub-profile-status');
-      if (!proof) { status.textContent = 'Unlock the dashboard again, then retry.'; return; }
+      if (!proof) {
+        requestUnlock();
+        status.textContent = 'Enter your dashboard PIN, then retry.';
+        return;
+      }
       if (!identity || !profileId) { status.textContent = 'Enter the Google account and a profile name.'; return; }
       button.setAttribute('disabled', 'disabled');
       status.textContent = 'Preparing the private profile…';
@@ -1152,8 +1188,9 @@ export function createController(opts) {
           });
           const body = await response.json().catch(() => ({}));
           if (!response.ok) {
+            if (response.status === 401) requestUnlock();
             status.textContent = response.status === 401
-              ? 'Unlock the dashboard again, then retry.'
+              ? 'Enter your dashboard PIN, then retry.'
               : `Couldn’t create the profile: ${body.error || 'try again'}`;
             button.removeAttribute('disabled');
             return;
@@ -1336,7 +1373,8 @@ export function createController(opts) {
       if (!['approve', 'cancel', 'retry'].includes(action) || !episodeId) return;
       const proof = getOperatorSessionToken();
       if (!proof) {
-        button.textContent = 'Unlock the dashboard again';
+        requestUnlock();
+        button.textContent = 'Enter PIN, then try again';
         return;
       }
       button.setAttribute('disabled', 'disabled');
@@ -1352,8 +1390,13 @@ export function createController(opts) {
         body: '{}',
       });
       if (!response.ok) {
-        button.textContent = response.status === 401 ? 'Unlock the dashboard again' : 'Couldn’t start — try again';
+        if (response.status === 401) requestUnlock();
+        const body = await response.json().catch(() => ({}));
+        const resolvedConflict = repairConflictMessage(body.error);
+        button.textContent = response.status === 401 ? 'Enter PIN, then try again'
+          : resolvedConflict || 'Couldn’t start — try again';
         button.removeAttribute('disabled');
+        if (resolvedConflict) await tick();
         return;
       }
       await tick();
@@ -1540,7 +1583,8 @@ export function createController(opts) {
       return;
     }
     if (!proof) {
-      setCellStatus(cell, 'Unlock the dashboard again, then tap Repair sign-in once.');
+      requestUnlock();
+      setCellStatus(cell, 'Enter your dashboard PIN, then tap Repair sign-in once.');
       return;
     }
     btn.setAttribute('disabled', 'disabled');
@@ -1554,8 +1598,13 @@ export function createController(opts) {
         });
         const body = await response.json().catch(() => ({}));
         if (!response.ok) {
-          setCellStatus(cell, body.error || 'Couldn’t start the repair — try again.');
+          if (response.status === 401) requestUnlock();
+          const resolvedConflict = repairConflictMessage(body.error);
+          setCellStatus(cell, response.status === 401
+            ? 'Enter your dashboard PIN, then tap Repair sign-in once.'
+            : resolvedConflict || body.error || 'Couldn’t start the repair — try again.');
           btn.removeAttribute('disabled');
+          if (resolvedConflict) await tick();
           return;
         }
         setCellStatus(cell, 'Repair started — Instar is handling the sign-in.');

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAqGA,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAUjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA4BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAmI7D,OAAO,KAAK,EAAW,oBAAoB,EAAe,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAiFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA0ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAoDD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AAsrDD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CA8yBN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAurvBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAsGA,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAUjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA4BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAmI7D,OAAO,KAAK,EAAW,oBAAoB,EAAe,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAiFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA0ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAoDD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AAsrDD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CA8yBN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAisvBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -9,6 +9,7 @@ import { bindUnknownProducerTelegramSender, sendDeterministicTelegramNotice } fr
  *   topic message → find/spawn session → inject message → session replies via [telegram:N]
  */
 import { execFile, execFileSync } from 'node:child_process';
+import { createHmac } from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -13542,6 +13543,19 @@ export async function startServer(options) {
                     return null;
                 }
             },
+            // Claude's `.claude.json` is a settings file and commonly predates a
+            // repair, so its mere existence can never prove this login completed.
+            // Capture an HMAC revision of the machine-local keychain blob before the
+            // artifact is issued and require that revision to change. The auth bytes
+            // never leave memory; only the keyed digest enters pending state.
+            authRevisionWitness: async (login) => {
+                if (login.framework !== 'claude-code' || !login.configHome)
+                    return null;
+                const raw = await defaultKeychainExec.readService(credSwapService(login.configHome));
+                if (!raw)
+                    return null;
+                return createHmac('sha256', config.authToken ?? '').update(raw).digest('hex');
+            },
             driveLogin: new FrameworkLoginDriver({
                 // Capture with `tmux capture-pane -J` so a hard-WRAPPED verification URL is
                 // joined back into one line (the 2026-06-18 "code=t" truncation bug). Falls
@@ -13610,7 +13624,6 @@ export async function startServer(options) {
                 .catch(() => { });
             enrollmentWizard
                 .sweepFollowMeCompletions({
-                credentialReady: (l) => !!l.configHome && fs.existsSync(path.join(l.configHome, '.claude.json')),
                 onValidated: (login, email) => {
                     // Upsert (D5): a re-auth of an EXISTING pool account updates it back to
                     // active; only a genuinely-new account is added (add() refuses dup ids).