instar 1.3.1286 → 1.3.1288

package/dashboard/index.html

@@ -3720,6 +3720,20 @@
       .sub-provider-heading { font-size:12px; font-weight:700; letter-spacing:.06em; text-transform:uppercase;
         opacity:.6; margin:14px 0 8px; padding-bottom:6px; border-bottom:1px solid var(--border,#2a2a2a); }
       .sub-provider-heading:first-child { margin-top:0; }
+      /* Provider colors (operator request 2026-09-25): Claude and Codex are told apart
+         at a glance — a colored band on each group heading and a colored edge on every
+         account card and grid row. Claude = clay orange, Codex = blue. */
+      .sub-prov-claude { --prov:#e07a4f; --prov-tint:rgba(224,122,79,.12); }
+      .sub-prov-codex { --prov:#4f8ff0; --prov-tint:rgba(79,143,240,.12); }
+      .sub-prov-other { --prov:#9ca3af; --prov-tint:rgba(156,163,175,.10); }
+      .sub-provider-heading.sub-prov-claude, .sub-provider-heading.sub-prov-codex, .sub-provider-heading.sub-prov-other {
+        opacity:1; color:var(--prov); font-size:15px; background:var(--prov-tint); border-bottom:none;
+        border-left:6px solid var(--prov); border-radius:6px; padding:8px 12px; margin:20px 0 10px; }
+      .sub-account.sub-prov-claude, .sub-account.sub-prov-codex, .sub-account.sub-prov-other { border-left:6px solid var(--prov); }
+      .sub-matrix-group.sub-prov-claude, .sub-matrix-group.sub-prov-codex, .sub-matrix-group.sub-prov-other {
+        color:var(--prov); background:var(--prov-tint); font-size:14px; opacity:1; border-left:6px solid var(--prov); padding:10px 12px; }
+      .sub-matrix tr.sub-prov-claude > .sub-matrix-acct, .sub-matrix tr.sub-prov-codex > .sub-matrix-acct, .sub-matrix tr.sub-prov-other > .sub-matrix-acct {
+        border-left:6px solid var(--prov); background:var(--prov-tint); }
       .sub-account { border:1px solid var(--border,#2a2a2a); border-radius:10px; padding:14px 16px; margin-bottom:12px; }
       .sub-account-inuse { border-color:#16a34a; box-shadow:0 0 0 1px #16a34a44; }
       .sub-account-inuse-badge { font-size:11px; font-weight:600; color:#22c55e; margin-right:auto; }

package/dashboard/subscriptions.js

@@ -282,6 +282,15 @@ export function quotaBar(doc, label, pct, resetIso, now = Date.now()) {
  *   pinned by a test, because "we grouped everything" would quietly add a redundant
  *   heading to the common case.
  */
+/** CSS class that colors a provider's group at a glance (operator request 2026-09-25:
+ *  Claude and Codex must be distinguishable without reading). Closed mapping, so a
+ *  provider string never reaches a class name raw. */
+export function providerClass(provider) {
+  if (provider === 'anthropic') return 'sub-prov-claude';
+  if (provider === 'openai') return 'sub-prov-codex';
+  return 'sub-prov-other';
+}
+
 export function groupAccountsByProvider(accounts) {
   if (!Array.isArray(accounts)) return [];
   const groups = new Map(); // provider key (raw) → accounts, in first-appearance order
@@ -298,7 +307,7 @@ export function groupAccountsByProvider(accounts) {
       // else, so an unrecognised or hostile provider string cannot reach the DOM raw.
       // An absent provider has no honest name, so say so rather than invent one.
       const label = friendlyProvider(key) || 'Other';
-      out.push({ __providerHeading: label });
+      out.push({ __providerHeading: label, __providerKey: key });
     }
     for (const m of members) out.push(m);
   }
@@ -322,11 +331,11 @@ export function renderAccounts(doc, target, accounts, now = Date.now(), inUseAcc
     // accounts mixed together with only a small per-card meta line to tell them
     // apart. The heading is what makes the split scannable.)
     if (a && a.__providerHeading) {
-      target.appendChild(el(doc, 'div', 'sub-provider-heading', a.__providerHeading));
+      target.appendChild(el(doc, 'div', `sub-provider-heading ${providerClass(a.__providerKey)}`, a.__providerHeading));
       continue;
     }
     const inUse = !!(inUseAccountId && a && a.id === inUseAccountId);
-    const card = el(doc, 'div', inUse ? 'sub-account sub-account-inuse' : 'sub-account');
+    const card = el(doc, 'div', `${inUse ? 'sub-account sub-account-inuse' : 'sub-account'} ${providerClass(a && a.provider)}`);
     const head = el(doc, 'div', 'sub-account-head');
     head.appendChild(el(doc, 'span', 'sub-account-nick', sanitizeForDisplay(a && a.nickname, 'label')));
     if (inUse) head.appendChild(el(doc, 'span', 'sub-account-inuse-badge', '● In use now'));
@@ -924,7 +933,7 @@ export function renderAccountMatrix(doc, target, poolScope, pendingScope, transi
   for (const entry of groupMatrixRowsByProvider(model.rows)) {
     if (entry && entry.__providerHeading) {
       const gtr = doc.createElement('tr');
-      const gth = el(doc, 'th', 'sub-matrix-group', entry.__providerHeading);
+      const gth = el(doc, 'th', `sub-matrix-group ${providerClass(entry.__providerKey)}`, entry.__providerHeading);
       // Span the account column + every machine column so the heading reads as a band
       // across the grid rather than a stray cell.
       gth.setAttribute('colspan', String(model.machines.length + 1));
@@ -934,7 +943,7 @@ export function renderAccountMatrix(doc, target, poolScope, pendingScope, transi
       continue;
     }
     const row = entry.__row;
-    const tr = doc.createElement('tr');
+    const tr = el(doc, 'tr', providerClass(row && row.account && row.account.provider));
     tr.appendChild(el(doc, 'th', 'sub-matrix-acct', sanitizeForDisplay(row.account.email, 'label')));
     for (const c of row.cells) {
       const repairCandidate = Array.isArray(reloginEpisodes)
@@ -971,6 +980,16 @@ export function renderAccountMatrix(doc, target, poolScope, pendingScope, transi
           button.setAttribute('data-episode-id', sanitizeForDisplay(repair.id, 'label'));
           td.appendChild(button);
         }
+        // While a repair waits on the operator (a phone tap, a macOS Allow, no helper account), the
+        // operator can also finish the sign-in themselves from here — the same one-tap Sign in flow
+        // as a needs-reauth cell (spec skill-driven-signin-repair, operator contact).
+        if (repair.state === 'waiting-operator-only') {
+          const signIn = el(doc, 'button', 'sub-matrix-setup', 'Sign in');
+          signIn.setAttribute('data-matrix-setup', '1');
+          signIn.setAttribute('data-account-id', sanitizeForDisplay(c.accountId, 'label'));
+          signIn.setAttribute('data-machine-id', sanitizeForDisplay(c.machineId, 'label'));
+          td.appendChild(signIn);
+        }
       } else if (c.state === 'empty' || c.state === 'needs-reauth' || c.state === 'held' || c.state === 'cant-resolve' || c.state === 'email-missing' || c.state === 'expired' || c.state === 'broken') {
         // An actionable cell → a button that runs the SAME in-dashboard sign-in flow (PIN → link →
         // paste code). empty → "Set up"; needs-reauth (an existing account whose login expired) →

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAsGA,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAUjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA4BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAmI7D,OAAO,KAAK,EAAW,oBAAoB,EAAe,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAkFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA0ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAoDD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AAsrDD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CA8yBN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAs9vBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAsGA,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAUjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA4BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAmI7D,OAAO,KAAK,EAAW,oBAAoB,EAAe,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAkFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA0ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAoDD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AAsrDD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CA8yBN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAw/vBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -13442,12 +13442,21 @@ export async function startServer(options) {
         // pool is non-empty (started below); on-demand polling is always available
         // via POST /subscription-pool/poll.
         const { QuotaPoller } = await import('../core/QuotaPoller.js');
-        const { buildCodexLiveUsageReader } = await import('../providers/adapters/openai-codex/observability/codexLiveRateLimitReader.js');
+        const { buildCodexLiveUsageReader, buildCodexLiveUsageReaderDetailed } = await import('../providers/adapters/openai-codex/observability/codexLiveRateLimitReader.js');
+        // The Codex CLI's own login check (spec skill-driven-signin-repair), proven able to fail by
+        // its canary before any "signed in" answer is trusted. Shared by the poller and the sign-in
+        // repair's helper-seat pick.
+        const { CodexLoginStatusChecker } = await import('../core/CliLoginStatus.js');
+        const codexLoginStatusChecker = new CodexLoginStatusChecker();
         const quotaPoller = new QuotaPoller({
             pool: subscriptionPool,
             // Zero-spend live codex quota (app-server account/rateLimits/read). ON by
             // default; `subscriptionPool.codexLiveQuota: false` forces rollout-only.
             codexLiveUsageReader: buildCodexLiveUsageReader(config.subscriptionPool),
+            // The same live read with its failure KIND kept: an app-server "authentication required"
+            // refusal is told apart from a transport failure, and only a live read proves login.
+            codexLiveUsageReaderDetailed: buildCodexLiveUsageReaderDetailed(config.subscriptionPool),
+            codexLoginStatus: (codexHome) => codexLoginStatusChecker.check(codexHome),
             loginObservationSink: subscriptionLoginLedger
                 ? (input) => subscriptionLoginLedger.recordObservation(input)
                 : undefined,
@@ -13857,7 +13866,7 @@ export async function startServer(options) {
         const reloginCfg = config.subscriptionPool?.assistedRelogin;
         if (reloginCfg?.enabled === true && subscriptionLoginLedger && subscriptionPoolMachineId && sharedIntelligence) {
             try {
-                const [{ createSubscriptionReloginRuntime, resolveReloginNavigation, takeFirstBackupCode }, { PlaywrightProfileRegistry }, { SecretStore }, { secretKeyPaths }, { ClaudePasteBackController }, { createReloginBrowser }] = await Promise.all([
+                const [{ createSubscriptionReloginRuntime, resolveReloginNavigation, takeFirstBackupCode, buildReloginHelperSessionPorts }, { PlaywrightProfileRegistry }, { SecretStore }, { secretKeyPaths }, { ClaudePasteBackController }, { createReloginBrowser }] = await Promise.all([
                     import('../core/SubscriptionReloginRuntime.js'), import('../core/PlaywrightProfileRegistry.js'),
                     import('../core/SecretStore.js'), import('../core/SecretSync.js'),
                     import('../core/ClaudePasteBackController.js'), import('../core/PlainChromeReloginBrowser.js'),
@@ -13890,18 +13899,42 @@ export async function startServer(options) {
                 });
                 const notify = telegram ? async (episode, deliveryKey, kind) => {
                     const doorway = episode.framework === 'codex-cli' ? 'Codex' : 'Claude Code';
+                    // The dashboard's Subscriptions tab, where the operator can finish from a phone.
+                    let subscriptionsLink = `http://localhost:${config.port}/dashboard?tab=subscriptions`;
+                    try {
+                        if (tunnel?.url)
+                            subscriptionsLink = `${tunnel.url}/dashboard?tab=subscriptions`;
+                    }
+                    catch { /* @silent-fallback-ok — tunnel URL is best-effort; the local link still names the tab */ }
+                    // A helper-reported macOS permission rides the reason token `agent-permission-<name>`.
+                    const permissionReason = episode.failureClass === 'automation-permission'
+                        ? (subscriptionReloginRuntime?.store.listEvents(episode.id, 5)
+                            .map((event) => event.reason ?? '').find((reason) => reason.startsWith('agent-permission-')) ?? null)
+                        : null;
+                    const permissionName = permissionReason === 'agent-permission-screen-recording' ? 'Screen Recording'
+                        : permissionReason === 'agent-permission-accessibility' ? 'Accessibility'
+                            : permissionReason === 'agent-permission-automation' ? 'Automation (control Google Chrome)' : null;
                     const summary = kind === 'approval'
-                        ? `A ${doorway} subscription sign-in needs repair. Open Subscriptions and tap Repair sign-in once.`
-                        : kind === 'operator-only'
-                            ? (episode.failureClass === 'automation-permission'
-                                ? `${doorway} sign-in repair needs a one-time permission on this machine: allow the agent to control Google Chrome. On that machine, signed in as the Mac user the agent runs as, click Allow on the "control Google Chrome" prompt if one is showing, or turn it on in System Settings, Privacy & Security, Automation. Then open Subscriptions and tap Try repair again.`
-                                : 'Automated sign-in paused at a provider security challenge. Open Subscriptions to continue.')
-                            : episode.state === 'succeeded'
-                                ? `${doorway} subscription sign-in was repaired and verified.`
-                                : `${doorway} subscription repair ended in ${episode.state}. Open Subscriptions for the redacted audit.`;
+                        ? `A ${doorway} subscription sign-in needs repair. Open Subscriptions and tap Repair sign-in once: ${subscriptionsLink}`
+                        : kind === 'phone-tap'
+                            ? `${doorway} sign-in repair is waiting on your phone: tap "Yes, it's me" on the Google prompt now. The helper continues on its own after that.`
+                            : kind === 'operator-only'
+                                ? (episode.failureClass === 'no-healthy-seat'
+                                    ? `${doorway} sign-in repair has no other healthy account on this machine to run its helper. Finish the sign-in from your phone: open ${subscriptionsLink} and tap Sign in on that account.`
+                                    : episode.failureClass === 'automation-permission' && permissionName
+                                        ? `${doorway} sign-in repair needs a one-time macOS permission on this machine: ${permissionName}. On that machine, click Allow if the prompt is showing, or turn it on in System Settings, Privacy & Security. Then open ${subscriptionsLink} and tap Try repair again, or tap Sign in to finish it yourself.`
+                                        : episode.failureClass === 'automation-permission'
+                                            ? `${doorway} sign-in repair needs a one-time permission on this machine: allow the agent to control Google Chrome. On that machine, signed in as the Mac user the agent runs as, click Allow on the "control Google Chrome" prompt if one is showing, or turn it on in System Settings, Privacy & Security, Automation. Then open Subscriptions and tap Try repair again: ${subscriptionsLink}`
+                                            : `Automated sign-in paused and needs you. Open ${subscriptionsLink} to continue, or tap Sign in to finish it from your phone.`)
+                                : episode.failureClass === 'resolved-elsewhere'
+                                    ? `${doorway} subscription is signed in again (verified), so its open sign-in repair was closed. Nothing to do.`
+                                    : episode.state === 'succeeded'
+                                        ? `${doorway} subscription sign-in was repaired and verified.`
+                                        : `${doorway} subscription repair ended in ${episode.state}. Open ${subscriptionsLink} for the redacted audit, or tap Sign in to finish it from your phone.`;
                     await telegram.createAttentionItem({ id: deliveryKey.replace(/:/g, '-'), title: `${doorway} sign-in repair`,
                         summary, description: summary, category: 'subscription-relogin',
-                        priority: kind === 'terminal' && episode.state === 'succeeded' ? 'NORMAL' : 'HIGH',
+                        priority: kind === 'phone-tap' ? 'URGENT'
+                            : kind === 'terminal' && (episode.state === 'succeeded' || episode.failureClass === 'resolved-elsewhere') ? 'NORMAL' : 'HIGH',
                         sourceContext: 'assisted-subscription-relogin' });
                 } : undefined;
                 subscriptionReloginRuntime = createSubscriptionReloginRuntime({ stateDir: config.stateDir,
@@ -13940,7 +13973,13 @@ export async function startServer(options) {
                         return action;
                     },
                     // Agent navigation (spec agent-driven-relogin): omitted ⇒ the development-agent gate.
+                    // `agent-session` (spec skill-driven-signin-repair) is macOS-only; omitted ⇒ agent-session
+                    // on a macOS development agent.
                     navigation: resolveReloginNavigation(reloginCfg.navigation, config),
+                    // A Codex repair can only be proven by a LIVE app-server read (spec skill-driven-signin-repair).
+                    codexLiveReadAvailable: config.subscriptionPool?.codexLiveQuota !== false,
+                    helperSession: buildReloginHelperSessionPorts({ sessionManager, maxSessions: config.sessions.maxSessions,
+                        serverPort: config.port, codexLoginStatus: (codexHome) => codexLoginStatusChecker.check(codexHome) }),
                     navigate: async (input) => {
                         const prompt = [
                             'You are signing an expired subscription account back in, in that account\'s own browser, the way a careful person would.',
@@ -13969,6 +14008,7 @@ export async function startServer(options) {
                     onSuggested: notify ? (episode, key) => notify(episode, key, 'approval') : undefined,
                     onOperatorOnly: notify ? (episode, key) => notify(episode, key, 'operator-only') : undefined,
                     onTerminal: notify ? (episode, key) => notify(episode, key, 'terminal') : undefined,
+                    onPhoneTap: notify ? (episode, key) => notify(episode, key, 'phone-tap') : undefined,
                     allowedScopes: reloginCfg.allowedScopes ?? [], tickMs: reloginCfg.tickMs,
                     maxAttempts: reloginCfg.maxAttempts, retryBaseMs: reloginCfg.retryBaseMs,
                     unattendedPolicy: reloginCfg.unattendedPolicy, });
@@ -26543,13 +26583,10 @@ export async function startServer(options) {
             });
         }
         server.setSubscriptionLoginLedger(subscriptionLoginLedger);
-        server.setSubscriptionRelogin(subscriptionReloginRuntime ? {
-            store: subscriptionReloginRuntime.store,
-            approve: (episodeId) => subscriptionReloginRuntime.service.approve(episodeId),
-            cancel: (episodeId) => subscriptionReloginRuntime.service.cancel(episodeId),
-            retry: (episodeId) => subscriptionReloginRuntime.service.retry(episodeId),
-            close: () => subscriptionReloginRuntime.close(),
-        } : null);
+        {
+            const { subscriptionReloginRouteContext } = await import('../core/SubscriptionReloginRuntime.js');
+            server.setSubscriptionRelogin(subscriptionReloginRuntime ? subscriptionReloginRouteContext(subscriptionReloginRuntime) : null);
+        }
         server.setWorkQueue(workQueue);
         if (_stateSyncStoresResolved?.classReview?.enabled && replicatedPeerStreamReader) {
             const { CLASS_REVIEW_STORE_KEY, classReviewFromOriginRecord } = await import('../core/ClassReviewReplicatedStore.js');