instar 1.3.622 → 1.3.624

package/dashboard/subscriptions.js

@@ -247,6 +247,21 @@ export function buildFollowMeIssuePayload(card, offers, pinValue) {
 }
 
 /** Pending Logins panel: device code / verification URL (as TEXT) + TTL + reissues. */
+// Only render a verification URL as a TAPPABLE link when it is https AND points at a
+// known provider sign-in host. Anything else falls back to plain text (preserves the
+// "never make an arbitrary href clickable" intent while giving a real one-tap sign-in
+// for the legitimate provider OAuth URLs).
+const PROVIDER_LOGIN_HOSTS = ['claude.com', 'claude.ai', 'anthropic.com', 'openai.com', 'auth.openai.com', 'accounts.google.com', 'google.com'];
+function trustedLoginUrl(raw) {
+  if (typeof raw !== 'string' || !raw) return null;
+  try {
+    const u = new URL(raw);
+    if (u.protocol !== 'https:') return null;
+    const host = u.hostname.toLowerCase();
+    return PROVIDER_LOGIN_HOSTS.some((h) => host === h || host.endsWith('.' + h)) ? u.href : null;
+  } catch { return null; }
+}
+
 export function renderPendingLogins(doc, target, logins, now = Date.now()) {
   if (!target) return;
   target.replaceChildren();
@@ -256,25 +271,61 @@ export function renderPendingLogins(doc, target, logins, now = Date.now()) {
   }
   for (const l of logins) {
     const row = el(doc, 'div', 'sub-pending');
-    const head = el(doc, 'div', 'sub-pending-head');
-    head.appendChild(el(doc, 'span', 'sub-pending-label', sanitizeForDisplay(l && l.label, 'label')));
-    const ttl = l && l.ttlExpiresAt ? countdown(l.ttlExpiresAt, now) : '';
-    head.appendChild(el(doc, 'span', 'sub-pending-ttl', ttl ? `expires in ${ttl}` : 'expired'));
-    row.appendChild(head);
-    // Flow heads-up (e.g. the Claude two-code sequence) — shown before the code so
-    // the operator knows what to expect. Plain text, sanitized; never a live href.
-    if (l && l.notice) {
-      row.appendChild(el(doc, 'div', 'sub-pending-notice', sanitizeForDisplay(l.notice, 'summary')));
+    // Non-sensitive identifiers for the code-submit handler (never a credential).
+    row.setAttribute('data-login-id', sanitizeForDisplay(l && l.id, 'label'));
+    if (l && (l.machineId || l.machineNickname)) row.setAttribute('data-machine-id', sanitizeForDisplay(l.machineId, 'label'));
+
+    // Lead with a plain-language headline naming what to do + where (machine).
+    const machine = sanitizeForDisplay(l && (l.machineNickname || l.machineId), 'label');
+    const who = sanitizeForDisplay(l && l.label, 'label');
+    const headline = machine
+      ? `Sign in to finish setting up ${who} on ${machine}`
+      : `Sign in to finish setting up ${who}`;
+    row.appendChild(el(doc, 'div', 'sub-pending-headline', headline));
+
+    // The PRIMARY action: one tappable "Sign in" link to the provider's own OAuth URL.
+    // Falls back to copy-text only if the URL isn't a trusted provider sign-in host.
+    const href = trustedLoginUrl(l && l.verificationUrl);
+    if (href) {
+      const a = doc.createElement('a');
+      a.setAttribute('href', href);
+      a.setAttribute('target', '_blank');
+      a.setAttribute('rel', 'noopener noreferrer');
+      a.setAttribute('class', 'sub-pending-signin');
+      a.textContent = 'Sign in';
+      row.appendChild(a);
+    } else if (l && l.verificationUrl) {
+      row.appendChild(el(doc, 'div', 'sub-pending-url', sanitizeForDisplay(l.verificationUrl, 'url')));
     }
+
+    // A device code (only some flows) — shown compactly under the button.
     if (l && l.userCode) {
       row.appendChild(el(doc, 'div', 'sub-pending-code', `Code: ${sanitizeForDisplay(l.userCode, 'code')}`));
     }
-    // Verification URL shown as TEXT for the operator to copy — never a live href.
-    row.appendChild(el(doc, 'div', 'sub-pending-url', sanitizeForDisplay(l && l.verificationUrl, 'url')));
-    const rc = l && Number(l.reissueCount);
-    if (Number.isFinite(rc) && rc > 0) {
-      row.appendChild(el(doc, 'div', 'sub-pending-reissue', `Re-issued ${rc} time${rc === 1 ? '' : 's'}`));
+
+    // url-code-paste flow (Claude): after signing in, the provider hands the operator a
+    // CODE to paste back. Give them a field for it right here — so it goes straight to the
+    // machine doing the login (off-chat), not relayed by hand. (ws52-code-paste-back)
+    if (l && l.kind === 'url-code-paste') {
+      row.appendChild(el(doc, 'div', 'sub-pending-codehint', 'After you sign in, paste the code the page gives you here:'));
+      const input = doc.createElement('input');
+      input.setAttribute('type', 'text');
+      input.setAttribute('class', 'sub-pending-code-input');
+      input.setAttribute('placeholder', 'Paste your sign-in code');
+      input.setAttribute('autocomplete', 'off');
+      row.appendChild(input);
+      const submit = el(doc, 'button', 'sub-pending-code-submit', 'Submit code');
+      submit.setAttribute('data-submit-code', '1');
+      row.appendChild(submit);
     }
+
+    // One short secondary line: the TTL, and the flow notice only if present (trimmed).
+    const ttl = l && l.ttlExpiresAt ? countdown(l.ttlExpiresAt, now) : '';
+    if (ttl) row.appendChild(el(doc, 'div', 'sub-pending-ttl', `Link expires in ${ttl}`));
+    if (l && l.notice) {
+      row.appendChild(el(doc, 'div', 'sub-pending-notice', sanitizeForDisplay(l.notice, 'summary')));
+    }
+    // (No "re-issued N times" noise — it confused more than it informed.)
     target.appendChild(row);
   }
 }
@@ -295,6 +346,7 @@ const URLS = {
   // operator's single dashboard (WS5.2 seam #3) — without it the device-code link never appears here.
   pending: '/subscription-pool/pending-logins?scope=pool',
   inUse: '/subscription-pool/in-use',
+  submitCode: '/subscription-pool/follow-me/submit-code', // POST — paste-back the sign-in code (ws52-code-paste-back)
   scan: '/subscription-pool/follow-me/scan', // POST — follow-me consent offers (one-tap card)
   issue: '/mandate/issue-for-machine',       // POST (PIN-gated) — Approve issues the mandate
 };
@@ -372,6 +424,7 @@ export function createController(opts) {
     const inUseAccountId = inUseBody && inUseBody.activeAccountId ? inUseBody.activeAccountId : null;
     renderAccounts(doc, els.accounts, accounts, now(), inUseAccountId);
     renderPendingLogins(doc, els.pending, logins, now());
+    wireCodeSubmit();
     // The one-tap follow-me Approve card(s) — rendered into els.followMe from the scan offers
     // (ws52-operator-tap-not-text Part A). Silent when there are none. The Approve click is wired
     // once (delegated) so re-renders never stack listeners.
@@ -424,6 +477,57 @@ export function createController(opts) {
     s.textContent = text;
   }
 
+  // Delegated, wired ONCE: a "Submit code" tap on a pending-login row reads the pasted
+  // sign-in code and POSTs it (with the login's id + machineId) to the fronting relay,
+  // which carries it to the machine doing the login (off-chat). The code is never stored
+  // client-side beyond the input; it's cleared on success. (ws52-code-paste-back)
+  function wireCodeSubmit() {
+    if (state.codeSubmitWired || !els.pending) return;
+    state.codeSubmitWired = true;
+    els.pending.addEventListener('click', (ev) => {
+      const btn = ev.target && ev.target.closest ? ev.target.closest('[data-submit-code]') : null;
+      if (!btn || !els.pending.contains(btn)) return;
+      const row = btn.closest('.sub-pending');
+      if (!row) return;
+      const input = row.querySelector('.sub-pending-code-input');
+      const code = input ? input.value.trim() : '';
+      const id = row.getAttribute('data-login-id');
+      const machineId = row.getAttribute('data-machine-id') || undefined;
+      if (!code) { setRowStatus(row, 'Paste the code the sign-in page gave you, then tap Submit.'); return; }
+      if (!id) { setRowStatus(row, 'Couldn’t identify this login — please refresh.'); return; }
+      setRowStatus(row, 'Sending your code…');
+      btn.setAttribute('disabled', '1');
+      void (async () => {
+        try {
+          const r = await postJson(URLS.submitCode, { machineId, id, code });
+          if (r.ok && r.json && r.json.outcome === 'validated') {
+            setRowStatus(row, 'Done — this machine is set up with the account.');
+            if (input) input.value = '';
+          } else if (r.ok && r.json && r.json.outcome === 'submitted') {
+            setRowStatus(row, 'Code sent — finishing sign-in…');
+            if (input) input.value = '';
+          } else if (r.ok && r.json && r.json.outcome === 'held') {
+            setRowStatus(row, 'Signed in, but the account didn’t match what was approved — check with the operator.');
+            btn.removeAttribute('disabled');
+          } else {
+            const msg = (r.json && (r.json.error || r.json.reason)) ? (r.json.error || r.json.reason) : `failed (${r.status})`;
+            setRowStatus(row, `Couldn’t submit the code: ${msg}`);
+            btn.removeAttribute('disabled');
+          }
+        } catch (e) {
+          setRowStatus(row, 'Couldn’t reach the server — try again.');
+          btn.removeAttribute('disabled');
+        }
+      })();
+    });
+  }
+
+  function setRowStatus(row, text) {
+    let s = row.querySelector('.sub-pending-status');
+    if (!s) { s = el(doc, 'div', 'sub-pending-status', ''); row.appendChild(s); }
+    s.textContent = text;
+  }
+
   function reschedule() {
     if (!state.active) return;
     if (state.timerId != null) cancel(state.timerId);

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAoCH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAS3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAwBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAkH7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAsBtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAy4CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAs7etE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAoCH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAS3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAwBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAkH7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAsBtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAy4CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAi8etE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -9874,7 +9874,7 @@ export async function startServer(options) {
         // a 2nd account never clobbers the 1st.
         const { PendingLoginStore } = await import('../core/PendingLoginStore.js');
         const { EnrollmentWizard } = await import('../core/EnrollmentWizard.js');
-        const { FrameworkLoginDriver } = await import('../core/FrameworkLoginDriver.js');
+        const { FrameworkLoginDriver, enrollPaneSessionName } = await import('../core/FrameworkLoginDriver.js');
         const DEFAULT_ENROLL_LOGIN_COMMANDS = {
             'claude-code': 'claude auth login',
             'codex-cli': 'codex login',
@@ -9909,7 +9909,20 @@ export async function startServer(options) {
                 })
                 : undefined,
             driveLogin: new FrameworkLoginDriver({
-                capture: async (session) => sessionManager.captureOutput(session, 120) || '',
+                // Capture with `tmux capture-pane -J` so a hard-WRAPPED verification URL is
+                // joined back into one line (the 2026-06-18 "code=t" truncation bug). Falls
+                // back to the generic capture if tmux/the -J capture is unavailable;
+                // parseArtifact ALSO de-wraps defensively.
+                capture: async (session) => {
+                    const tmuxPath = detectTmuxPath();
+                    if (tmuxPath) {
+                        try {
+                            return execFileSync(tmuxPath, ['capture-pane', '-p', '-J', '-S', '-300', '-t', `=${session}:`], { encoding: 'utf-8', timeout: 5000 }) || '';
+                        }
+                        catch { /* @silent-fallback-ok — fall through to the generic capture */ }
+                    }
+                    return sessionManager.captureOutput(session, 120) || '';
+                },
                 spawn: async ({ framework, configHome }) => {
                     const tmuxPath = detectTmuxPath();
                     if (!tmuxPath)
@@ -9920,8 +9933,7 @@ export async function startServer(options) {
                     const cmd = configHome
                         ? `env CLAUDE_CONFIG_DIR=${JSON.stringify(configHome)} ${baseCmd}`
                         : baseCmd;
-                    const slug = (configHome ?? framework).replace(/[^a-zA-Z0-9]+/g, '-').slice(-24);
-                    const session = `instar-enroll-${framework}-${slug}`;
+                    const session = enrollPaneSessionName(framework, configHome);
                     try {
                         execFileSync(tmuxPath, ['kill-session', '-t', `=${session}`], { stdio: 'ignore' });
                     }