instar 1.3.401 → 1.3.403

package/dashboard/index.html

@@ -2692,6 +2692,7 @@
           <button class="tab" data-tab="threadline" onclick="switchTab('threadline')">Threadline</button>
           <button class="tab" data-tab="evidence" onclick="switchTab('evidence')">Evidence</button>
           <button class="tab" data-tab="process-health" onclick="switchTab('process-health')">Process Health</button>
+          <button class="tab" data-tab="subscriptions" onclick="switchTab('subscriptions')">Subscriptions</button>
           <button class="tab" data-tab="preferences-learning" onclick="switchTab('preferences-learning')">Preferences</button>
           <button class="tab" data-tab="machines" onclick="switchTab('machines')">Machines</button>
           <button class="tab" data-tab="mandates" onclick="switchTab('mandates')">Mandates</button>
@@ -3243,6 +3244,44 @@
       </details>
     </div>
 
+    <!-- subscriptions tab (Subscription & Auth Standard P2.2 — live quota + pending logins) -->
+    <style>
+      .sub-account { border:1px solid var(--border,#2a2a2a); border-radius:10px; padding:14px 16px; margin-bottom:12px; }
+      .sub-account-head { display:flex; justify-content:space-between; align-items:baseline; gap:12px; }
+      .sub-account-nick { font-weight:600; font-size:15px; }
+      .sub-account-status { font-size:12px; opacity:.75; }
+      .sub-account-meta { font-size:12px; opacity:.6; margin:2px 0 10px; }
+      .sub-account-noquota { font-size:12px; opacity:.6; }
+      .sub-quota { margin:8px 0; }
+      .sub-quota-head { display:flex; justify-content:space-between; font-size:12px; margin-bottom:4px; }
+      .sub-quota-label { opacity:.8; }
+      .sub-quota-pct { opacity:.65; }
+      .sub-quota-track { height:8px; border-radius:4px; background:var(--border,#2a2a2a); overflow:hidden; }
+      .sub-quota-fill { height:100%; background:linear-gradient(90deg,#4caf80,#3a9); }
+      .sub-pending { border:1px solid var(--border,#2a2a2a); border-radius:10px; padding:12px 16px; margin-bottom:10px; }
+      .sub-pending-head { display:flex; justify-content:space-between; align-items:baseline; gap:12px; }
+      .sub-pending-label { font-weight:600; }
+      .sub-pending-ttl { font-size:12px; opacity:.7; }
+      .sub-pending-code { font-family:monospace; font-size:14px; margin-top:6px; }
+      .sub-pending-url { font-size:12px; opacity:.7; word-break:break-all; margin-top:4px; }
+      .sub-pending-reissue { font-size:11px; opacity:.55; margin-top:4px; }
+      .sub-empty, .sub-disabled { font-size:13px; opacity:.7; padding:8px 0; }
+    </style>
+    <div id="subscriptionsPanel" class="ph-root" style="display:none;flex-direction:column;padding:28px;gap:24px;overflow-y:auto">
+      <h2 class="ph-title">Subscriptions</h2>
+      <p class="ph-intro">Your subscription accounts and how much of each is left before it resets — plus any logins waiting for you to approve on your phone.</p>
+      <section class="ph-section">
+        <h3 class="ph-h">Accounts</h3>
+        <p class="ph-h-sub">Each account’s live usage (5-hour and weekly) and when it resets.</p>
+        <div id="subAccounts"></div>
+      </section>
+      <section class="ph-section">
+        <h3 class="ph-h">Pending logins</h3>
+        <p class="ph-h-sub">Logins waiting for approval — open the link on your phone and confirm. An expired code is re-issued automatically.</p>
+        <div id="subPending"></div>
+      </section>
+    </div>
+
     <!-- mandates tab (coordination-mandate spec, decision 2A — the operator's PIN-gated surface) -->
     <div id="mandatesPanel" class="ph-root" style="display:none;flex-direction:column;padding:28px;gap:24px;overflow-y:auto">
       <div style="display:flex;justify-content:space-between;align-items:baseline">
@@ -4650,6 +4689,13 @@
         onActivate: () => { if (typeof startProcessHealth === 'function') startProcessHealth(); },
         onDeactivate: () => { if (typeof stopProcessHealth === 'function') stopProcessHealth(); },
       },
+      {
+        id: 'subscriptions',
+        panels: ['subscriptionsPanel'],
+        display: ['flex'],
+        onActivate: () => { if (typeof startSubscriptions === 'function') startSubscriptions(); },
+        onDeactivate: () => { if (typeof stopSubscriptions === 'function') stopSubscriptions(); },
+      },
       {
         id: 'preferences-learning',
         panels: ['preferencesLearningPanel'],
@@ -8602,6 +8648,34 @@
       if (__phController) __phController.stop();
     }
 
+    // ── Subscriptions tab (Subscription & Auth Standard P2.2) ──
+    // Same lazy dynamic-import pattern as Process Health: the controller lives in
+    // this (classic) scope so it can read `token`; the module ships the pure
+    // renderers + the polling controller.
+    let __subController = null;
+    let __subModule = null;
+    async function startSubscriptions() {
+      if (!__subModule) {
+        try { __subModule = await import('/dashboard/subscriptions.js'); }
+        catch (e) { console.error('[subscriptions] module load failed', e); return; }
+      }
+      if (!__subController) {
+        const els = {
+          accounts: document.getElementById('subAccounts'),
+          pending: document.getElementById('subPending'),
+        };
+        const fetchImpl = (url, opts = {}) => fetch(url, {
+          headers: { 'Authorization': `Bearer ${token}`, ...(opts.headers || {}) },
+          signal: opts.signal,
+        });
+        __subController = __subModule.createController({ doc: document, els, fetchImpl });
+      }
+      __subController.start();
+    }
+    function stopSubscriptions() {
+      if (__subController) __subController.stop();
+    }
+
     // ── Mandates tab (coordination-mandate spec, decision 2A) ──
     // Same lazy dynamic-import pattern as Process Health. The PIN typed in this
     // tab is sent once per action and never stored anywhere.

package/dashboard/subscriptions.js

@@ -0,0 +1,264 @@
+// Subscriptions tab — a read surface for the multi-account Subscription & Auth
+// pool: per-account live quota bars (5h / weekly + reset countdown), status, and
+// the Pending Logins panel (device codes / verification URLs awaiting approval,
+// with TTL). Spec: docs/specs/_drafts/subscription-auth-standard-master-spec.md.
+//
+// Browser-native ESM (no build step; served at /dashboard/subscriptions.js and
+// loaded by index.html via <script type="module">). The pure functions are
+// exported so the 3-tier jsdom tests exercise the SHIPPED code, not a copy; the
+// controller is attached to window.Subscriptions so index.html drives start/stop
+// on tab activation.
+//
+// Load-bearing safety contract (mirrors the Process Health tab §4.6): every
+// dynamic value flows through sanitizeForDisplay before the DOM; all DOM writes
+// are textContent only (never innerHTML); the only dynamic ATTRIBUTE written is a
+// quota-bar width, set from a clamped NUMBER (0–100) — never a string from data.
+// No verification URL is ever rendered as a live href (defense-in-depth): it is
+// shown as sanitized TEXT for the operator to copy.
+
+const CAPS = { label: 64, code: 48, url: 320, summary: 240 };
+
+// Structural presentation-glyph class (NFKC-fold THEN strip), identical to the
+// Process Health tab: \p{So} + arrows + geometric + box-drawing + dingbats +
+// variation-selectors + bullet/middot — so a confusable can't impersonate chrome.
+const CHROME_GLYPH_RE = new RegExp(
+  '[\\p{So}\\u2190-\\u21FF\\u25A0-\\u25FF\\u2500-\\u257F\\u2700-\\u27BF\\uFE00-\\uFE0F\\u2022\\u00B7\\u2027\\u2043]',
+  'gu',
+);
+const CONTROL_RE = new RegExp('[\\u0000-\\u0008\\u000B\\u000C\\u000E-\\u001F\\u007F-\\u009F]', 'g');
+const BIDI_RE = new RegExp('[\\u202A-\\u202E\\u2066-\\u2069]', 'g');
+
+/** Sanitize a dynamic value before it touches the DOM (see contract above). */
+export function sanitizeForDisplay(value, fieldKind = 'summary') {
+  let s = value == null ? '' : String(value);
+  s = s.normalize('NFKC');
+  s = s.replace(CONTROL_RE, '');
+  s = s.replace(BIDI_RE, '');
+  s = s.replace(/\n{2,}/g, '\n').replace(/[ \t]{5,}/g, '    ');
+  s = s.replace(CHROME_GLYPH_RE, '');
+  s = capGraphemes(s, CAPS[fieldKind] ?? CAPS.summary);
+  return s;
+}
+
+function capGraphemes(s, max) {
+  if (s.length <= max) return s;
+  if (typeof Intl !== 'undefined' && Intl.Segmenter) {
+    const arr = Array.from(new Intl.Segmenter(undefined, { granularity: 'grapheme' }).segment(s), (x) => x.segment);
+    if (arr.length <= max) return s;
+    return arr.slice(0, max - 1).join('') + '…';
+  }
+  let cut = max - 1;
+  const c = s.charCodeAt(cut - 1);
+  if (c >= 0xd800 && c <= 0xdbff) cut -= 1;
+  return s.slice(0, cut) + '…';
+}
+
+/** Clamp a utilization value to an integer 0–100 (the only dynamic attribute). */
+export function clampPct(value) {
+  const n = Number(value);
+  if (!Number.isFinite(n)) return 0;
+  return Math.max(0, Math.min(100, Math.round(n)));
+}
+
+const STATUS_WORDS = {
+  active: 'Active',
+  warming: 'Warming up',
+  'rate-limited': 'At its limit',
+  'needs-reauth': 'Needs sign-in',
+  disabled: 'Disabled',
+};
+export function friendlyStatus(status) {
+  return STATUS_WORDS[typeof status === 'string' ? status : ''] || 'Unknown';
+}
+
+const PROVIDER_WORDS = { anthropic: 'Claude', openai: 'Codex', 'github-copilot': 'Copilot', google: 'Gemini' };
+export function friendlyProvider(provider) {
+  return PROVIDER_WORDS[typeof provider === 'string' ? provider : ''] || sanitizeForDisplay(provider, 'label');
+}
+
+/** Human countdown to a reset/expiry instant: "resets in 2h 15m" / "expired". */
+export function countdown(iso, now = Date.now(), { expiredWord = 'expired' } = {}) {
+  const t = typeof iso === 'string' ? Date.parse(iso) : NaN;
+  if (Number.isNaN(t)) return '';
+  const sec = Math.floor((t - now) / 1000);
+  if (sec <= 0) return expiredWord;
+  const hr = Math.floor(sec / 3600);
+  const min = Math.floor((sec % 3600) / 60);
+  if (hr >= 24) { const d = Math.floor(hr / 24); return `${d}d ${hr % 24}h`; }
+  if (hr >= 1) return `${hr}h ${min}m`;
+  if (min >= 1) return `${min}m`;
+  return `${sec}s`;
+}
+
+// ── DOM helpers (textContent ONLY — never innerHTML) ────────────────────────
+function el(doc, tag, cls, text) {
+  const node = doc.createElement(tag);
+  if (cls) node.setAttribute('class', cls); // static literal
+  if (text != null) node.textContent = text; // dynamic text → textContent ONLY
+  return node;
+}
+
+/** A labelled quota bar. `pct` is clamped to a 0–100 NUMBER before it reaches the
+ *  only dynamic attribute (style width); the percent text is also from that number. */
+export function quotaBar(doc, label, pct, resetIso, now = Date.now()) {
+  const wrap = el(doc, 'div', 'sub-quota');
+  const used = clampPct(pct);
+  const head = el(doc, 'div', 'sub-quota-head');
+  head.appendChild(el(doc, 'span', 'sub-quota-label', sanitizeForDisplay(label, 'label')));
+  const resetTxt = resetIso ? countdown(resetIso, now, { expiredWord: 'resetting' }) : '';
+  head.appendChild(el(doc, 'span', 'sub-quota-pct', `${used}% used${resetTxt ? ` · resets in ${resetTxt}` : ''}`));
+  wrap.appendChild(head);
+  const track = el(doc, 'div', 'sub-quota-track');
+  const fill = el(doc, 'div', 'sub-quota-fill');
+  fill.style.width = `${used}%`; // safe: `used` is a clamped integer
+  track.appendChild(fill);
+  wrap.appendChild(track);
+  return wrap;
+}
+
+/** Per-account rows: nickname, status, provider·framework, 5h + weekly quota bars. */
+export function renderAccounts(doc, target, accounts, now = Date.now()) {
+  if (!target) return;
+  target.replaceChildren();
+  if (!Array.isArray(accounts) || accounts.length === 0) {
+    target.appendChild(el(doc, 'div', 'sub-empty', 'No subscription accounts enrolled yet.'));
+    return;
+  }
+  for (const a of accounts) {
+    const card = el(doc, 'div', 'sub-account');
+    const head = el(doc, 'div', 'sub-account-head');
+    head.appendChild(el(doc, 'span', 'sub-account-nick', sanitizeForDisplay(a && a.nickname, 'label')));
+    head.appendChild(el(doc, 'span', 'sub-account-status', friendlyStatus(a && a.status)));
+    card.appendChild(head);
+    card.appendChild(el(doc, 'div', 'sub-account-meta',
+      `${friendlyProvider(a && a.provider)} · ${sanitizeForDisplay(a && a.framework, 'label')}`));
+    const q = (a && a.lastQuota) || null;
+    if (q && (q.fiveHour || q.sevenDay)) {
+      if (q.fiveHour) card.appendChild(quotaBar(doc, '5-hour', q.fiveHour.utilizationPct, q.fiveHour.resetsAt, now));
+      if (q.sevenDay) card.appendChild(quotaBar(doc, 'Weekly', q.sevenDay.utilizationPct, q.sevenDay.resetsAt, now));
+    } else {
+      card.appendChild(el(doc, 'div', 'sub-account-noquota', 'No quota reading yet.'));
+    }
+    target.appendChild(card);
+  }
+}
+
+/** Pending Logins panel: device code / verification URL (as TEXT) + TTL + reissues. */
+export function renderPendingLogins(doc, target, logins, now = Date.now()) {
+  if (!target) return;
+  target.replaceChildren();
+  if (!Array.isArray(logins) || logins.length === 0) {
+    target.appendChild(el(doc, 'div', 'sub-empty', 'No logins waiting for approval.'));
+    return;
+  }
+  for (const l of logins) {
+    const row = el(doc, 'div', 'sub-pending');
+    const head = el(doc, 'div', 'sub-pending-head');
+    head.appendChild(el(doc, 'span', 'sub-pending-label', sanitizeForDisplay(l && l.label, 'label')));
+    const ttl = l && l.ttlExpiresAt ? countdown(l.ttlExpiresAt, now) : '';
+    head.appendChild(el(doc, 'span', 'sub-pending-ttl', ttl ? `expires in ${ttl}` : 'expired'));
+    row.appendChild(head);
+    if (l && l.userCode) {
+      row.appendChild(el(doc, 'div', 'sub-pending-code', `Code: ${sanitizeForDisplay(l.userCode, 'code')}`));
+    }
+    // Verification URL shown as TEXT for the operator to copy — never a live href.
+    row.appendChild(el(doc, 'div', 'sub-pending-url', sanitizeForDisplay(l && l.verificationUrl, 'url')));
+    const rc = l && Number(l.reissueCount);
+    if (Number.isFinite(rc) && rc > 0) {
+      row.appendChild(el(doc, 'div', 'sub-pending-reissue', `Re-issued ${rc} time${rc === 1 ? '' : 's'}`));
+    }
+    target.appendChild(row);
+  }
+}
+
+export function renderDisabled(doc, els) {
+  if (els && els.accounts) {
+    els.accounts.replaceChildren(
+      el(doc, 'div', 'sub-disabled', 'The subscription pool isn’t set up yet. Enroll an account to get started.'),
+    );
+  }
+  if (els && els.pending) els.pending.replaceChildren();
+}
+
+// ── Controller (fetch /subscription-pool + /pending-logins, render) ─────────
+const URLS = {
+  accounts: '/subscription-pool',
+  pending: '/subscription-pool/pending-logins',
+};
+
+export function createController(opts) {
+  const {
+    doc,
+    els = {},
+    fetchImpl,
+    now = () => Date.now(),
+    cadenceMs = 30_000,
+    schedule = (fn, ms) => setTimeout(fn, ms),
+    cancel = (id) => clearTimeout(id),
+  } = opts;
+
+  const state = { timerId: null, active: false, inFlight: null };
+
+  async function fetchJson(url, controller) {
+    const resp = await fetchImpl(url, { signal: controller.signal });
+    if (!resp.ok) throw new Error(`${url} ${resp.status}`);
+    return resp.json();
+  }
+
+  async function tick() {
+    if (!state.active) return;
+    if (state.inFlight) { try { state.inFlight.abort(); } catch { /* superseded */ } }
+    const controller = typeof AbortController !== 'undefined' ? new AbortController() : { signal: undefined, abort() {} };
+    state.inFlight = controller;
+    let accountsBody, pendingBody;
+    try {
+      [accountsBody, pendingBody] = await Promise.all([
+        fetchJson(URLS.accounts, controller),
+        fetchJson(URLS.pending, controller),
+      ]);
+    } catch {
+      if (controller.signal && controller.signal.aborted) return;
+      state.inFlight = null;
+      reschedule();
+      return;
+    }
+    if (controller.signal && controller.signal.aborted) return;
+    state.inFlight = null;
+    // Feature dark → both routes answer { enabled:false }. Show the friendly copy.
+    if (accountsBody && accountsBody.enabled === false && pendingBody && pendingBody.enabled === false) {
+      renderDisabled(doc, els);
+      reschedule();
+      return;
+    }
+    render(accountsBody, pendingBody);
+    reschedule();
+  }
+
+  function render(accountsBody, pendingBody) {
+    const accounts = accountsBody && Array.isArray(accountsBody.accounts) ? accountsBody.accounts : [];
+    const logins = pendingBody && Array.isArray(pendingBody.logins) ? pendingBody.logins : [];
+    renderAccounts(doc, els.accounts, accounts, now());
+    renderPendingLogins(doc, els.pending, logins, now());
+  }
+
+  function reschedule() {
+    if (!state.active) return;
+    if (state.timerId != null) cancel(state.timerId);
+    state.timerId = schedule(() => { void tick(); }, cadenceMs);
+  }
+
+  function start() { if (state.active) return; state.active = true; void tick(); }
+  function stop() {
+    state.active = false;
+    if (state.timerId != null) { cancel(state.timerId); state.timerId = null; }
+    if (state.inFlight) { try { state.inFlight.abort(); } catch { /* ignore */ } state.inFlight = null; }
+  }
+  function onVisible() { if (!state.active) start(); }
+  function onHidden() { stop(); }
+
+  return { start, stop, onVisible, onHidden, tick, render, _state: state };
+}
+
+if (typeof window !== 'undefined') {
+  window.Subscriptions = { createController, sanitizeForDisplay, renderAccounts, renderPendingLogins };
+}

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAaH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAQ3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAuBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAiG7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA6JtD,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA05BD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,GAC/F,IAAI,CAyUN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAk9TtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAaH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAQ3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAuBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAiG7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA6JtD,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA05BD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,GAC/F,IAAI,CAyUN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA0gUtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -6494,6 +6494,64 @@ export async function startServer(options) {
             quotaPoller.start();
             console.log(pc.green('  Subscription quota poller started'));
         }
+        // EnrollmentWizard — mobile-first new-account login (P2.1 of the Subscription
+        // & Auth Standard). Dark with the pool: the /subscription-pool/enroll routes
+        // do nothing until an operator starts an enrollment. The login driver reuses
+        // the proven tmux-spawn + capture-pane primitive (the same one /login uses) to
+        // scrape the PUBLIC verification URL / device code — NEVER a token. The new
+        // account's CLAUDE_CONFIG_DIR isolates the login to its own slot, so enrolling
+        // a 2nd account never clobbers the 1st.
+        const { PendingLoginStore } = await import('../core/PendingLoginStore.js');
+        const { EnrollmentWizard } = await import('../core/EnrollmentWizard.js');
+        const { FrameworkLoginDriver } = await import('../core/FrameworkLoginDriver.js');
+        const DEFAULT_ENROLL_LOGIN_COMMANDS = {
+            'claude-code': 'claude auth login',
+            'codex-cli': 'codex login',
+            'gemini-cli': 'gemini',
+            'pi-cli': 'pi login',
+        };
+        const enrollLoginCommands = {
+            ...DEFAULT_ENROLL_LOGIN_COMMANDS,
+            ...(config.subscriptionPool?.enrollment?.loginCommands ?? {}),
+        };
+        const pendingLoginStore = new PendingLoginStore({ stateDir: config.stateDir });
+        const enrollmentWizard = new EnrollmentWizard({
+            store: pendingLoginStore,
+            logger: { log: (m) => console.log(m), warn: (m) => console.warn(m) },
+            driveLogin: new FrameworkLoginDriver({
+                capture: async (session) => sessionManager.captureOutput(session, 120) || '',
+                spawn: async ({ framework, configHome }) => {
+                    const tmuxPath = detectTmuxPath();
+                    if (!tmuxPath)
+                        throw new Error('tmux not available for enrollment login');
+                    const baseCmd = enrollLoginCommands[framework] ?? `${framework} login`;
+                    // env-prefix sets the per-account config home for the login process so
+                    // the credential lands in its own slot (CLAUDE_CONFIG_DIR isolation).
+                    const cmd = configHome
+                        ? `env CLAUDE_CONFIG_DIR=${JSON.stringify(configHome)} ${baseCmd}`
+                        : baseCmd;
+                    const slug = (configHome ?? framework).replace(/[^a-zA-Z0-9]+/g, '-').slice(-24);
+                    const session = `instar-enroll-${framework}-${slug}`;
+                    try {
+                        execFileSync(tmuxPath, ['kill-session', '-t', `=${session}`], { stdio: 'ignore' });
+                    }
+                    catch { /* @silent-fallback-ok: no prior enroll session for this slot */ }
+                    execFileSync(tmuxPath, ['new-session', '-d', '-s', session, cmd], { timeout: 10000 });
+                    return { session };
+                },
+                logger: { log: (m) => console.log(m), warn: (m) => console.warn(m) },
+            }).asLoginDriver(),
+        });
+        // Background auto-reissue sweep — refreshes an expired login code without the
+        // operator asking (the pi-live-test gap). Inert with no pending logins; the
+        // timer is unref'd so it never holds the process open.
+        const enrollReissueTimer = setInterval(() => {
+            enrollmentWizard
+                .reissueExpired()
+                .catch(() => { });
+        }, config.subscriptionPool?.enrollment?.reissueSweepMs ?? 5 * 60_000);
+        if (enrollReissueTimer.unref)
+            enrollReissueTimer.unref();
         // Commitment Sentinel — LLM-powered scanner that finds unregistered commitments.
         let commitmentSentinel;
         if (sharedIntelligence) {
@@ -11282,7 +11340,7 @@ export async function startServer(options) {
         catch (err) {
             console.log(pc.dim(`  [session-pool] rollout gate not wired: ${err instanceof Error ? err.message : String(err)}`));
         }
-        const server = new AgentServer({ config, sessionManager, state, scheduler, telegram, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, subscriptionPool, quotaPoller, quotaAwareScheduler: _quotaAwareScheduler ?? undefined, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, localSigningKeyPem, leaseTransport, onLeasePullRequest: () => leaseCoordinatorRef?.currentLease() ?? null, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, warrantsReplyGate, collaborationSurfacer, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, threadlineReplyWaiters, listenerManager: listenerManager ?? undefined, a2aDeliveryTracker: a2aDeliveryTracker ?? undefined, responseReviewGate, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, machinePoolRegistry, meshRpcDispatcher, workingSetPullCoordinator, commitmentReplicaStore, forwardCommitmentMutate, sessionOwnershipRegistry, topicPinStore: _topicPinStore ?? undefined, streamTicketStore: _streamTicketStore ?? undefined, poolStreamAllowRemoteInput: config.dashboard?.poolStream?.allowRemoteInput ?? false, poolStreamConnector: _poolStreamConnector ?? undefined, secretSync: _secretSyncHandle ?? undefined, meshSelfId: _meshSelfId ?? undefined, resolveRouterUrl: _resolveRouterUrl ?? undefined, resolvePeerUrls: _resolvePeerUrls ?? undefined, sessionPoolE2EResultStore, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, agentWorktreeReaper, mcpProcessReaper, geminiLoopRunner, sleepController, agentActivityState, reapLog, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier });
+        const server = new AgentServer({ config, sessionManager, state, scheduler, telegram, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, subscriptionPool, quotaPoller, quotaAwareScheduler: _quotaAwareScheduler ?? undefined, enrollmentWizard, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, localSigningKeyPem, leaseTransport, onLeasePullRequest: () => leaseCoordinatorRef?.currentLease() ?? null, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, warrantsReplyGate, collaborationSurfacer, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, threadlineReplyWaiters, listenerManager: listenerManager ?? undefined, a2aDeliveryTracker: a2aDeliveryTracker ?? undefined, responseReviewGate, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, machinePoolRegistry, meshRpcDispatcher, workingSetPullCoordinator, commitmentReplicaStore, forwardCommitmentMutate, sessionOwnershipRegistry, topicPinStore: _topicPinStore ?? undefined, streamTicketStore: _streamTicketStore ?? undefined, poolStreamAllowRemoteInput: config.dashboard?.poolStream?.allowRemoteInput ?? false, poolStreamConnector: _poolStreamConnector ?? undefined, secretSync: _secretSyncHandle ?? undefined, meshSelfId: _meshSelfId ?? undefined, resolveRouterUrl: _resolveRouterUrl ?? undefined, resolvePeerUrls: _resolvePeerUrls ?? undefined, sessionPoolE2EResultStore, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, agentWorktreeReaper, mcpProcessReaper, geminiLoopRunner, sleepController, agentActivityState, reapLog, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier });
         // Resolve the late-bound topic-operator getter (increment 2e): routing was
         // wired before the server existed; from here on inbound binds use the
         // server's own store instance.