instar 1.3.613 → 1.3.615

package/dist/server/routes.js

@@ -6515,7 +6515,48 @@ export function createRoutes(ctx) {
             res.status(404).json({ error: `mandate "${req.params.id}" not found` });
             return;
         }
-        res.json({ revoked: true, mandate: m });
+        // WS5.2 R12 — Account Follow-Me revocation data-plane trigger (PER-SERVER model, OQ6). The
+        // control-plane revoke above already fired (every subsequent MandateGate.evaluate denies). If
+        // the revoked mandate carried an `account-follow-me` authority, run THIS machine's OWN local
+        // data-plane wipe (the operator revoked on the target's OWN dashboard ⇒ the target IS this
+        // machine ⇒ cooperative-online posture). Non-account-follow-me mandates are completely
+        // unaffected. Strict no-op when the executor is unwired OR the feature gate resolves dark
+        // (revoke() returns feature-disabled and runs nothing). Surfaces the honest data-plane outcome
+        // on the response so the operator/dashboard never sees a false "removed".
+        let accountFollowMeRevocation;
+        try {
+            const followMeAuthority = (m.authorities ?? []).find((a) => a.action === 'account-follow-me');
+            if (followMeAuthority && ctx.accountFollowMeRevocation) {
+                const bounds = (followMeAuthority.bounds ?? {});
+                const accountId = typeof bounds.accountId === 'string' ? bounds.accountId : '';
+                const targetMachineId = typeof bounds.targetMachineId === 'string' ? bounds.targetMachineId : '';
+                const mechanism = bounds.mechanism === 'credential-transport' ? 'credential-transport' : 're-mint';
+                if (accountId && targetMachineId) {
+                    const acct = ctx.subscriptionPool?.get(accountId) ?? null;
+                    accountFollowMeRevocation = ctx.accountFollowMeRevocation.revoke({
+                        accountId,
+                        accountEmail: acct?.email ?? accountId,
+                        targetMachineId,
+                        targetMachineNickname: typeof bounds.targetMachineNickname === 'string' ? bounds.targetMachineNickname : targetMachineId,
+                        provider: acct?.provider ?? (typeof bounds.provider === 'string' ? bounds.provider : 'the provider'),
+                        mandateId: m.id,
+                        mechanism,
+                    }, 
+                    // PER-SERVER: the operator revoked on the target's own dashboard ⇒ target is online &
+                    // cooperative (this very machine). The local wipe runs; an offline/de-paired posture is
+                    // only reachable on the cross-machine path, which the per-server model does not use.
+                    'cooperative-online');
+                }
+            }
+        }
+        catch {
+            // @silent-fallback-ok: the data-plane effect must never break the control-plane revoke (which
+            // already succeeded). A wipe error is surfaced honestly INSIDE the executor (fail-closed to
+            // pending) for the normal path; this catch is the last-resort backstop so the route always
+            // returns the successful revoke.
+            accountFollowMeRevocation = undefined;
+        }
+        res.json({ revoked: true, mandate: m, ...(accountFollowMeRevocation ? { accountFollowMeRevocation } : {}) });
     });
     // Add user→agent authority grant(s) to a mandate — PIN-GATED (the same human-
     // authenticated surface as issuance; an agent's Bearer token cannot mint a grant).
@@ -19111,6 +19152,14 @@ export function createRoutes(ctx) {
             res.status(201).json({ enabled: true, login });
         }
         catch (err) {
+            // WS5.2 R6b — a DRIVE failure is honest + retry-able (502), NOT an opaque 500.
+            // No pending-login was issued (the store is written only after the drive
+            // succeeds), so the caller can simply retry.
+            const { EnrollmentDriveError } = await import('../core/EnrollmentWizard.js');
+            if (err instanceof EnrollmentDriveError) {
+                res.status(502).json({ error: 'login-did-not-start', retryable: true, message: err.operatorMessage });
+                return;
+            }
             res.status(500).json({ error: err instanceof Error ? err.message : 'failed to start enrollment' });
         }
     });
@@ -19220,6 +19269,14 @@ export function createRoutes(ctx) {
             // Allocate this account's own config-home slot on THIS machine (one home per credential).
             const safeAccountId = accountId.replace(/[^a-z0-9-]/gi, '-');
             const configHome = path.join(os.homedir(), `.claude-followme-${safeAccountId}`);
+            // WS5.2 R6b — this IS the remote/cloud (follow-me) enrollment path, so use the
+            // remote-aware kind selection (device-code single-code flow where supported) and
+            // thread the LARGER scrape-timeout budget (cloud→provider latency + the two-code
+            // window). The budget comes from the config knob (default 180000); omitted ⇒ the
+            // driver's local-LAN default.
+            const remoteScrapeTimeoutMs = typeof afmCfg?.remoteScrapeTimeoutMs === 'number' && Number.isFinite(afmCfg.remoteScrapeTimeoutMs)
+                ? afmCfg.remoteScrapeTimeoutMs
+                : undefined;
             const login = await ctx.enrollmentWizard.start({
                 id: accountId,
                 label: target.label,
@@ -19227,10 +19284,24 @@ export function createRoutes(ctx) {
                 framework: target.framework,
                 configHome,
                 expectedEmail: target.expectedEmail,
+                remote: true,
+                remoteScrapeTimeoutMs,
             });
             res.status(201).json({ enabled: true, login });
         }
         catch (err) {
+            // WS5.2 R6b — a DRIVE failure is honest + retry-able (502), NOT an opaque 500.
+            // The store is written ONLY after the drive succeeds, so a drive throw leaves NO
+            // stuck pending-login behind — the caller can simply retry the enrollment.
+            const { EnrollmentDriveError } = await import('../core/EnrollmentWizard.js');
+            if (err instanceof EnrollmentDriveError) {
+                res.status(502).json({
+                    error: 'login-did-not-start',
+                    retryable: true,
+                    message: `couldn’t start the login on the target — ${err.operatorMessage}`,
+                });
+                return;
+            }
             res.status(500).json({ error: err instanceof Error ? err.message : 'follow-me enroll start failed' });
         }
     });