instar 1.3.623 → 1.3.624

package/dashboard/subscriptions.js

@@ -271,6 +271,9 @@ export function renderPendingLogins(doc, target, logins, now = Date.now()) {
   }
   for (const l of logins) {
     const row = el(doc, 'div', 'sub-pending');
+    // Non-sensitive identifiers for the code-submit handler (never a credential).
+    row.setAttribute('data-login-id', sanitizeForDisplay(l && l.id, 'label'));
+    if (l && (l.machineId || l.machineNickname)) row.setAttribute('data-machine-id', sanitizeForDisplay(l.machineId, 'label'));
 
     // Lead with a plain-language headline naming what to do + where (machine).
     const machine = sanitizeForDisplay(l && (l.machineNickname || l.machineId), 'label');
@@ -300,6 +303,22 @@ export function renderPendingLogins(doc, target, logins, now = Date.now()) {
       row.appendChild(el(doc, 'div', 'sub-pending-code', `Code: ${sanitizeForDisplay(l.userCode, 'code')}`));
     }
 
+    // url-code-paste flow (Claude): after signing in, the provider hands the operator a
+    // CODE to paste back. Give them a field for it right here — so it goes straight to the
+    // machine doing the login (off-chat), not relayed by hand. (ws52-code-paste-back)
+    if (l && l.kind === 'url-code-paste') {
+      row.appendChild(el(doc, 'div', 'sub-pending-codehint', 'After you sign in, paste the code the page gives you here:'));
+      const input = doc.createElement('input');
+      input.setAttribute('type', 'text');
+      input.setAttribute('class', 'sub-pending-code-input');
+      input.setAttribute('placeholder', 'Paste your sign-in code');
+      input.setAttribute('autocomplete', 'off');
+      row.appendChild(input);
+      const submit = el(doc, 'button', 'sub-pending-code-submit', 'Submit code');
+      submit.setAttribute('data-submit-code', '1');
+      row.appendChild(submit);
+    }
+
     // One short secondary line: the TTL, and the flow notice only if present (trimmed).
     const ttl = l && l.ttlExpiresAt ? countdown(l.ttlExpiresAt, now) : '';
     if (ttl) row.appendChild(el(doc, 'div', 'sub-pending-ttl', `Link expires in ${ttl}`));
@@ -327,6 +346,7 @@ const URLS = {
   // operator's single dashboard (WS5.2 seam #3) — without it the device-code link never appears here.
   pending: '/subscription-pool/pending-logins?scope=pool',
   inUse: '/subscription-pool/in-use',
+  submitCode: '/subscription-pool/follow-me/submit-code', // POST — paste-back the sign-in code (ws52-code-paste-back)
   scan: '/subscription-pool/follow-me/scan', // POST — follow-me consent offers (one-tap card)
   issue: '/mandate/issue-for-machine',       // POST (PIN-gated) — Approve issues the mandate
 };
@@ -404,6 +424,7 @@ export function createController(opts) {
     const inUseAccountId = inUseBody && inUseBody.activeAccountId ? inUseBody.activeAccountId : null;
     renderAccounts(doc, els.accounts, accounts, now(), inUseAccountId);
     renderPendingLogins(doc, els.pending, logins, now());
+    wireCodeSubmit();
     // The one-tap follow-me Approve card(s) — rendered into els.followMe from the scan offers
     // (ws52-operator-tap-not-text Part A). Silent when there are none. The Approve click is wired
     // once (delegated) so re-renders never stack listeners.
@@ -456,6 +477,57 @@ export function createController(opts) {
     s.textContent = text;
   }
 
+  // Delegated, wired ONCE: a "Submit code" tap on a pending-login row reads the pasted
+  // sign-in code and POSTs it (with the login's id + machineId) to the fronting relay,
+  // which carries it to the machine doing the login (off-chat). The code is never stored
+  // client-side beyond the input; it's cleared on success. (ws52-code-paste-back)
+  function wireCodeSubmit() {
+    if (state.codeSubmitWired || !els.pending) return;
+    state.codeSubmitWired = true;
+    els.pending.addEventListener('click', (ev) => {
+      const btn = ev.target && ev.target.closest ? ev.target.closest('[data-submit-code]') : null;
+      if (!btn || !els.pending.contains(btn)) return;
+      const row = btn.closest('.sub-pending');
+      if (!row) return;
+      const input = row.querySelector('.sub-pending-code-input');
+      const code = input ? input.value.trim() : '';
+      const id = row.getAttribute('data-login-id');
+      const machineId = row.getAttribute('data-machine-id') || undefined;
+      if (!code) { setRowStatus(row, 'Paste the code the sign-in page gave you, then tap Submit.'); return; }
+      if (!id) { setRowStatus(row, 'Couldn’t identify this login — please refresh.'); return; }
+      setRowStatus(row, 'Sending your code…');
+      btn.setAttribute('disabled', '1');
+      void (async () => {
+        try {
+          const r = await postJson(URLS.submitCode, { machineId, id, code });
+          if (r.ok && r.json && r.json.outcome === 'validated') {
+            setRowStatus(row, 'Done — this machine is set up with the account.');
+            if (input) input.value = '';
+          } else if (r.ok && r.json && r.json.outcome === 'submitted') {
+            setRowStatus(row, 'Code sent — finishing sign-in…');
+            if (input) input.value = '';
+          } else if (r.ok && r.json && r.json.outcome === 'held') {
+            setRowStatus(row, 'Signed in, but the account didn’t match what was approved — check with the operator.');
+            btn.removeAttribute('disabled');
+          } else {
+            const msg = (r.json && (r.json.error || r.json.reason)) ? (r.json.error || r.json.reason) : `failed (${r.status})`;
+            setRowStatus(row, `Couldn’t submit the code: ${msg}`);
+            btn.removeAttribute('disabled');
+          }
+        } catch (e) {
+          setRowStatus(row, 'Couldn’t reach the server — try again.');
+          btn.removeAttribute('disabled');
+        }
+      })();
+    });
+  }
+
+  function setRowStatus(row, text) {
+    let s = row.querySelector('.sub-pending-status');
+    if (!s) { s = el(doc, 'div', 'sub-pending-status', ''); row.appendChild(s); }
+    s.textContent = text;
+  }
+
   function reschedule() {
     if (!state.active) return;
     if (state.timerId != null) cancel(state.timerId);

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAoCH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAS3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAwBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAkH7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAsBtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAy4CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAk8etE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAoCH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAS3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAwBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAkH7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAsBtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAy4CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAi8etE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -9874,7 +9874,7 @@ export async function startServer(options) {
         // a 2nd account never clobbers the 1st.
         const { PendingLoginStore } = await import('../core/PendingLoginStore.js');
         const { EnrollmentWizard } = await import('../core/EnrollmentWizard.js');
-        const { FrameworkLoginDriver } = await import('../core/FrameworkLoginDriver.js');
+        const { FrameworkLoginDriver, enrollPaneSessionName } = await import('../core/FrameworkLoginDriver.js');
         const DEFAULT_ENROLL_LOGIN_COMMANDS = {
             'claude-code': 'claude auth login',
             'codex-cli': 'codex login',
@@ -9933,8 +9933,7 @@ export async function startServer(options) {
                     const cmd = configHome
                         ? `env CLAUDE_CONFIG_DIR=${JSON.stringify(configHome)} ${baseCmd}`
                         : baseCmd;
-                    const slug = (configHome ?? framework).replace(/[^a-zA-Z0-9]+/g, '-').slice(-24);
-                    const session = `instar-enroll-${framework}-${slug}`;
+                    const session = enrollPaneSessionName(framework, configHome);
                     try {
                         execFileSync(tmuxPath, ['kill-session', '-t', `=${session}`], { stdio: 'ignore' });
                     }