instar 1.3.1287 → 1.3.1289

package/dashboard/subscriptions.js

@@ -980,6 +980,16 @@ export function renderAccountMatrix(doc, target, poolScope, pendingScope, transi
           button.setAttribute('data-episode-id', sanitizeForDisplay(repair.id, 'label'));
           td.appendChild(button);
         }
+        // While a repair waits on the operator (a phone tap, a macOS Allow, no helper account), the
+        // operator can also finish the sign-in themselves from here — the same one-tap Sign in flow
+        // as a needs-reauth cell (spec skill-driven-signin-repair, operator contact).
+        if (repair.state === 'waiting-operator-only') {
+          const signIn = el(doc, 'button', 'sub-matrix-setup', 'Sign in');
+          signIn.setAttribute('data-matrix-setup', '1');
+          signIn.setAttribute('data-account-id', sanitizeForDisplay(c.accountId, 'label'));
+          signIn.setAttribute('data-machine-id', sanitizeForDisplay(c.machineId, 'label'));
+          td.appendChild(signIn);
+        }
       } else if (c.state === 'empty' || c.state === 'needs-reauth' || c.state === 'held' || c.state === 'cant-resolve' || c.state === 'email-missing' || c.state === 'expired' || c.state === 'broken') {
         // An actionable cell → a button that runs the SAME in-dashboard sign-in flow (PIN → link →
         // paste code). empty → "Set up"; needs-reauth (an existing account whose login expired) →

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAsGA,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAUjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA4BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAmI7D,OAAO,KAAK,EAAW,oBAAoB,EAAe,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAkFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA0ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAoDD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AAsrDD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CA8yBN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAs9vBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAsGA,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAUjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA4BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAmI7D,OAAO,KAAK,EAAW,oBAAoB,EAAe,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAkFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA0ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAoDD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AAsrDD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CA8yBN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA0/vBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -13442,12 +13442,21 @@ export async function startServer(options) {
         // pool is non-empty (started below); on-demand polling is always available
         // via POST /subscription-pool/poll.
         const { QuotaPoller } = await import('../core/QuotaPoller.js');
-        const { buildCodexLiveUsageReader } = await import('../providers/adapters/openai-codex/observability/codexLiveRateLimitReader.js');
+        const { buildCodexLiveUsageReader, buildCodexLiveUsageReaderDetailed } = await import('../providers/adapters/openai-codex/observability/codexLiveRateLimitReader.js');
+        // The Codex CLI's own login check (spec skill-driven-signin-repair), proven able to fail by
+        // its canary before any "signed in" answer is trusted. Shared by the poller and the sign-in
+        // repair's helper-seat pick.
+        const { CodexLoginStatusChecker } = await import('../core/CliLoginStatus.js');
+        const codexLoginStatusChecker = new CodexLoginStatusChecker();
         const quotaPoller = new QuotaPoller({
             pool: subscriptionPool,
             // Zero-spend live codex quota (app-server account/rateLimits/read). ON by
             // default; `subscriptionPool.codexLiveQuota: false` forces rollout-only.
             codexLiveUsageReader: buildCodexLiveUsageReader(config.subscriptionPool),
+            // The same live read with its failure KIND kept: an app-server "authentication required"
+            // refusal is told apart from a transport failure, and only a live read proves login.
+            codexLiveUsageReaderDetailed: buildCodexLiveUsageReaderDetailed(config.subscriptionPool),
+            codexLoginStatus: (codexHome) => codexLoginStatusChecker.check(codexHome),
             loginObservationSink: subscriptionLoginLedger
                 ? (input) => subscriptionLoginLedger.recordObservation(input)
                 : undefined,
@@ -13518,6 +13527,8 @@ export async function startServer(options) {
         const pendingLoginStore = new PendingLoginStore({ stateDir: config.stateDir });
         const enrollmentWizard = new EnrollmentWizard({
             store: pendingLoginStore,
+            // Agent-owned memory: a newly completed login links to this agent's memory at once.
+            agentHome: config.projectDir,
             logger: { log: (m) => console.log(m), warn: (m) => console.warn(m) },
             // WS5.2 §5.3/S7 — the follow-me completion gate reads the minted login's account email
             // from its config-home slot and validates it against operator expectation before the
@@ -13857,7 +13868,7 @@ export async function startServer(options) {
         const reloginCfg = config.subscriptionPool?.assistedRelogin;
         if (reloginCfg?.enabled === true && subscriptionLoginLedger && subscriptionPoolMachineId && sharedIntelligence) {
             try {
-                const [{ createSubscriptionReloginRuntime, resolveReloginNavigation, takeFirstBackupCode }, { PlaywrightProfileRegistry }, { SecretStore }, { secretKeyPaths }, { ClaudePasteBackController }, { createReloginBrowser }] = await Promise.all([
+                const [{ createSubscriptionReloginRuntime, resolveReloginNavigation, takeFirstBackupCode, buildReloginHelperSessionPorts }, { PlaywrightProfileRegistry }, { SecretStore }, { secretKeyPaths }, { ClaudePasteBackController }, { createReloginBrowser }] = await Promise.all([
                     import('../core/SubscriptionReloginRuntime.js'), import('../core/PlaywrightProfileRegistry.js'),
                     import('../core/SecretStore.js'), import('../core/SecretSync.js'),
                     import('../core/ClaudePasteBackController.js'), import('../core/PlainChromeReloginBrowser.js'),
@@ -13890,18 +13901,42 @@ export async function startServer(options) {
                 });
                 const notify = telegram ? async (episode, deliveryKey, kind) => {
                     const doorway = episode.framework === 'codex-cli' ? 'Codex' : 'Claude Code';
+                    // The dashboard's Subscriptions tab, where the operator can finish from a phone.
+                    let subscriptionsLink = `http://localhost:${config.port}/dashboard?tab=subscriptions`;
+                    try {
+                        if (tunnel?.url)
+                            subscriptionsLink = `${tunnel.url}/dashboard?tab=subscriptions`;
+                    }
+                    catch { /* @silent-fallback-ok — tunnel URL is best-effort; the local link still names the tab */ }
+                    // A helper-reported macOS permission rides the reason token `agent-permission-<name>`.
+                    const permissionReason = episode.failureClass === 'automation-permission'
+                        ? (subscriptionReloginRuntime?.store.listEvents(episode.id, 5)
+                            .map((event) => event.reason ?? '').find((reason) => reason.startsWith('agent-permission-')) ?? null)
+                        : null;
+                    const permissionName = permissionReason === 'agent-permission-screen-recording' ? 'Screen Recording'
+                        : permissionReason === 'agent-permission-accessibility' ? 'Accessibility'
+                            : permissionReason === 'agent-permission-automation' ? 'Automation (control Google Chrome)' : null;
                     const summary = kind === 'approval'
-                        ? `A ${doorway} subscription sign-in needs repair. Open Subscriptions and tap Repair sign-in once.`
-                        : kind === 'operator-only'
-                            ? (episode.failureClass === 'automation-permission'
-                                ? `${doorway} sign-in repair needs a one-time permission on this machine: allow the agent to control Google Chrome. On that machine, signed in as the Mac user the agent runs as, click Allow on the "control Google Chrome" prompt if one is showing, or turn it on in System Settings, Privacy & Security, Automation. Then open Subscriptions and tap Try repair again.`
-                                : 'Automated sign-in paused at a provider security challenge. Open Subscriptions to continue.')
-                            : episode.state === 'succeeded'
-                                ? `${doorway} subscription sign-in was repaired and verified.`
-                                : `${doorway} subscription repair ended in ${episode.state}. Open Subscriptions for the redacted audit.`;
+                        ? `A ${doorway} subscription sign-in needs repair. Open Subscriptions and tap Repair sign-in once: ${subscriptionsLink}`
+                        : kind === 'phone-tap'
+                            ? `${doorway} sign-in repair is waiting on your phone: tap "Yes, it's me" on the Google prompt now. The helper continues on its own after that.`
+                            : kind === 'operator-only'
+                                ? (episode.failureClass === 'no-healthy-seat'
+                                    ? `${doorway} sign-in repair has no other healthy account on this machine to run its helper. Finish the sign-in from your phone: open ${subscriptionsLink} and tap Sign in on that account.`
+                                    : episode.failureClass === 'automation-permission' && permissionName
+                                        ? `${doorway} sign-in repair needs a one-time macOS permission on this machine: ${permissionName}. On that machine, click Allow if the prompt is showing, or turn it on in System Settings, Privacy & Security. Then open ${subscriptionsLink} and tap Try repair again, or tap Sign in to finish it yourself.`
+                                        : episode.failureClass === 'automation-permission'
+                                            ? `${doorway} sign-in repair needs a one-time permission on this machine: allow the agent to control Google Chrome. On that machine, signed in as the Mac user the agent runs as, click Allow on the "control Google Chrome" prompt if one is showing, or turn it on in System Settings, Privacy & Security, Automation. Then open Subscriptions and tap Try repair again: ${subscriptionsLink}`
+                                            : `Automated sign-in paused and needs you. Open ${subscriptionsLink} to continue, or tap Sign in to finish it from your phone.`)
+                                : episode.failureClass === 'resolved-elsewhere'
+                                    ? `${doorway} subscription is signed in again (verified), so its open sign-in repair was closed. Nothing to do.`
+                                    : episode.state === 'succeeded'
+                                        ? `${doorway} subscription sign-in was repaired and verified.`
+                                        : `${doorway} subscription repair ended in ${episode.state}. Open ${subscriptionsLink} for the redacted audit, or tap Sign in to finish it from your phone.`;
                     await telegram.createAttentionItem({ id: deliveryKey.replace(/:/g, '-'), title: `${doorway} sign-in repair`,
                         summary, description: summary, category: 'subscription-relogin',
-                        priority: kind === 'terminal' && episode.state === 'succeeded' ? 'NORMAL' : 'HIGH',
+                        priority: kind === 'phone-tap' ? 'URGENT'
+                            : kind === 'terminal' && (episode.state === 'succeeded' || episode.failureClass === 'resolved-elsewhere') ? 'NORMAL' : 'HIGH',
                         sourceContext: 'assisted-subscription-relogin' });
                 } : undefined;
                 subscriptionReloginRuntime = createSubscriptionReloginRuntime({ stateDir: config.stateDir,
@@ -13940,7 +13975,13 @@ export async function startServer(options) {
                         return action;
                     },
                     // Agent navigation (spec agent-driven-relogin): omitted ⇒ the development-agent gate.
+                    // `agent-session` (spec skill-driven-signin-repair) is macOS-only; omitted ⇒ agent-session
+                    // on a macOS development agent.
                     navigation: resolveReloginNavigation(reloginCfg.navigation, config),
+                    // A Codex repair can only be proven by a LIVE app-server read (spec skill-driven-signin-repair).
+                    codexLiveReadAvailable: config.subscriptionPool?.codexLiveQuota !== false,
+                    helperSession: buildReloginHelperSessionPorts({ sessionManager, maxSessions: config.sessions.maxSessions,
+                        serverPort: config.port, codexLoginStatus: (codexHome) => codexLoginStatusChecker.check(codexHome) }),
                     navigate: async (input) => {
                         const prompt = [
                             'You are signing an expired subscription account back in, in that account\'s own browser, the way a careful person would.',
@@ -13969,6 +14010,7 @@ export async function startServer(options) {
                     onSuggested: notify ? (episode, key) => notify(episode, key, 'approval') : undefined,
                     onOperatorOnly: notify ? (episode, key) => notify(episode, key, 'operator-only') : undefined,
                     onTerminal: notify ? (episode, key) => notify(episode, key, 'terminal') : undefined,
+                    onPhoneTap: notify ? (episode, key) => notify(episode, key, 'phone-tap') : undefined,
                     allowedScopes: reloginCfg.allowedScopes ?? [], tickMs: reloginCfg.tickMs,
                     maxAttempts: reloginCfg.maxAttempts, retryBaseMs: reloginCfg.retryBaseMs,
                     unattendedPolicy: reloginCfg.unattendedPolicy, });
@@ -26543,13 +26585,10 @@ export async function startServer(options) {
             });
         }
         server.setSubscriptionLoginLedger(subscriptionLoginLedger);
-        server.setSubscriptionRelogin(subscriptionReloginRuntime ? {
-            store: subscriptionReloginRuntime.store,
-            approve: (episodeId) => subscriptionReloginRuntime.service.approve(episodeId),
-            cancel: (episodeId) => subscriptionReloginRuntime.service.cancel(episodeId),
-            retry: (episodeId) => subscriptionReloginRuntime.service.retry(episodeId),
-            close: () => subscriptionReloginRuntime.close(),
-        } : null);
+        {
+            const { subscriptionReloginRouteContext } = await import('../core/SubscriptionReloginRuntime.js');
+            server.setSubscriptionRelogin(subscriptionReloginRuntime ? subscriptionReloginRouteContext(subscriptionReloginRuntime) : null);
+        }
         server.setWorkQueue(workQueue);
         if (_stateSyncStoresResolved?.classReview?.enabled && replicatedPeerStreamReader) {
             const { CLASS_REVIEW_STORE_KEY, classReviewFromOriginRecord } = await import('../core/ClassReviewReplicatedStore.js');