jupyterlab_ai_code_assistants_extension 1.2.41 → 1.2.47

package/README.md

@@ -27,7 +27,7 @@ Chat-panel extensions re-implement the agent loop and trail the real tool. This
 
 - **One install, every assistant** - Claude Code, Codex, Kimi, Gemini and DeepSeek from a single package, each with its own right-side panel wearing its official mark
 - **Provider registry** - assistant-specific behaviour lives in one module per assistant behind capability flags; no core file names an assistant, and adding one touches no core file
-- **Joint settings page** - one settings section covering all assistants, with a per-assistant toggle (all on by default); toggling takes effect live, no JupyterLab reload
+- **Joint settings page** - one settings section covering all assistants, with a per-assistant toggle (all on by default); toggling takes effect live, no JupyterLab reload, and a change reaches the other JupyterLab windows of the same browser
 - **Three-section side panel** - Favorites, Recent, and All projects, each scrolling independently
 - **One-click resume** - click a row to jump back into that session in a terminal; an open terminal for the project is reused instead of duplicated. Exception: a Codex or Kimi conversation started with `+`, and a Codex fork, run without an id until the CLI writes one, so a click on that row meanwhile opens a second terminal
 - **Launcher tiles** - every enabled assistant has a tile in an "AI Assistants" section of the JupyterLab Launcher (after Other, under the extension's own robot-head icon); a click opens the assistant in the file browser's current folder, resuming the folder's conversation when one exists and starting a new one otherwise, through the companion `jupyterlab_basic_terminal_extension` (installed automatically). Disable an assistant and its tile goes; disable them all and the section goes with them
@@ -47,6 +47,7 @@ Chat-panel extensions re-implement the agent loop and trail the real tool. This
 - **Conflict-safe upgrade** - if a retired standalone extension is still installed, its panel wins and this extension stands down for that assistant instead of showing a duplicate
 - **DeepSeek in the browser** - the DeepSeek Harness has no terminal chat; its panel lists the projects under `~/.dsh/sessions` (or `$DSH_HOME`) and `Open Web UI` starts `dsh --profile web --no-open --port 0` in the project's terminal, which prints the URL to open. The conversation is then chosen in the harness's own browser UI; branching and deleting work from the panel as for every other assistant. The URL is on the machine running JupyterLab, so a remote server needs a port forward to reach it
 - **Auto-disabled when absent** - an assistant whose CLI is not on `PATH` does not show a panel
+- **Open Callback** - when an assistant's login sends your browser to an `http://127.0.0.1:...` link that fails to load, because the login is waiting on the machine running JupyterLab, run `Open Callback` from the command palette and paste the link; the Jupyter server requests it for you. Only `http` links to that machine's own loopback are accepted
 
 ## Requirements
 

package/lib/core/callback.d.ts

@@ -0,0 +1,15 @@
+import { JupyterFrontEnd } from '@jupyterlab/application';
+import { ICommandPalette } from '@jupyterlab/apputils';
+import { TranslationBundle } from '@jupyterlab/translation';
+/** The command that delivers a pasted login callback link. */
+export declare const CALLBACK_COMMAND = "open:callback";
+/**
+ * Register the command that sends a pasted login callback link to the login
+ * waiting on the Jupyter server.
+ *
+ * A CLI login waits for its OAuth redirect on the server's own loopback, but
+ * the browser that follows the redirect runs on the user's machine, where that
+ * address is another host - so the page fails to load, with the link left in
+ * the address bar. Pasted here, the server makes the request instead.
+ */
+export declare function addCallbackCommand(app: JupyterFrontEnd, palette: ICommandPalette | null, category: string, trans: TranslationBundle): void;

package/lib/core/callback.js

@@ -0,0 +1,65 @@
+import { InputDialog, Notification } from '@jupyterlab/apputils';
+import { requestAPI } from './request';
+/** The command that delivers a pasted login callback link. */
+export const CALLBACK_COMMAND = 'open:callback';
+/**
+ * Register the command that sends a pasted login callback link to the login
+ * waiting on the Jupyter server.
+ *
+ * A CLI login waits for its OAuth redirect on the server's own loopback, but
+ * the browser that follows the redirect runs on the user's machine, where that
+ * address is another host - so the page fails to load, with the link left in
+ * the address bar. Pasted here, the server makes the request instead.
+ */
+export function addCallbackCommand(app, palette, category, trans) {
+    app.commands.addCommand(CALLBACK_COMMAND, {
+        label: trans.__('Open Callback'),
+        caption: trans.__('Send a pasted login callback link to the login waiting on the Jupyter server'),
+        describedBy: {
+            args: {
+                type: 'object',
+                properties: {
+                    url: {
+                        type: 'string',
+                        description: 'The callback link. Asked for in a dialog when absent.'
+                    }
+                }
+            }
+        },
+        execute: async (args) => {
+            var _a;
+            let url = typeof args.url === 'string' ? args.url.trim() : '';
+            if (!url) {
+                const asked = await InputDialog.getText({
+                    title: trans.__('Open Callback'),
+                    label: trans.__('Callback link from the browser address bar'),
+                    placeholder: 'http://127.0.0.1:1455/auth/callback?code=...'
+                });
+                url = asked.button.accept ? ((_a = asked.value) !== null && _a !== void 0 ? _a : '').trim() : '';
+                if (!url) {
+                    return;
+                }
+            }
+            try {
+                const answer = await requestAPI('callback', app.serviceManager.serverSettings, { method: 'POST', body: JSON.stringify({ url }) });
+                if (answer.status < 400) {
+                    Notification.success(trans.__('Callback delivered - the login answered HTTP %1.', answer.status), { autoClose: 4000 });
+                }
+                else {
+                    Notification.warning(trans.__('The login refused the callback (HTTP %1). Start the login again and paste the new link.', answer.status), { autoClose: 8000 });
+                }
+            }
+            catch (err) {
+                // The server's own codes, never the link: it carries a login code.
+                const code = err instanceof Error ? err.message : String(err);
+                const message = code === 'callback_not_loopback'
+                    ? trans.__('Only an http link to 127.0.0.1 or localhost can be opened.')
+                    : code === 'callback_unreachable'
+                        ? trans.__('No login is waiting at that address. Start the login again and paste the new link.')
+                        : trans.__('Could not open the callback: %1', code);
+                Notification.error(message, { autoClose: 8000 });
+            }
+        }
+    });
+    palette === null || palette === void 0 ? void 0 : palette.addItem({ command: CALLBACK_COMMAND, category });
+}

package/lib/index.js

@@ -1,11 +1,12 @@
 import { ILabShell, ILayoutRestorer } from '@jupyterlab/application';
-import { Notification } from '@jupyterlab/apputils';
+import { ICommandPalette, Notification } from '@jupyterlab/apputils';
 import { IDefaultFileBrowser } from '@jupyterlab/filebrowser';
 import { ILauncher } from '@jupyterlab/launcher';
 import { ISettingRegistry } from '@jupyterlab/settingregistry';
 import { ITerminalTracker } from '@jupyterlab/terminal';
 import { ITranslator, nullTranslator } from '@jupyterlab/translation';
 import { IColourfulTabs } from 'jupyterlab_colourful_tab_extension';
+import { addCallbackCommand } from './core/callback';
 import { launcherTileIcon, providerIcon } from './core/icons';
 import { DEFAULT_RECENT_LIMIT } from './core/limits';
 import { AssistantSessionsPanel, DEFAULT_PRESENTATION_MODE, commandId, panelWidgetId } from './core/panel';
@@ -40,9 +41,10 @@ const plugin = {
         IDefaultFileBrowser,
         IColourfulTabs,
         ILauncher,
-        ITranslator
+        ITranslator,
+        ICommandPalette
     ],
-    activate: async (app, labShell, restorer, settingRegistry, terminalTracker, fileBrowser, colourfulTabs, launcher, translator) => {
+    activate: async (app, labShell, restorer, settingRegistry, terminalTracker, fileBrowser, colourfulTabs, launcher, translator, palette) => {
         console.log('JupyterLab extension jupyterlab_ai_code_assistants_extension is activated!');
         // Every user-visible string in the panels goes through this bundle.
         // `ITranslator` is optional, and the null translator returns each string
@@ -51,6 +53,7 @@ const plugin = {
         // A duplicate id throws here, at registration, rather than surfacing later
         // as two panels quietly fighting over one widget id.
         const registry = new ProviderRegistry(PROVIDERS);
+        addCallbackCommand(app, palette !== null && palette !== void 0 ? palette : null, LAUNCHER_CATEGORY, trans);
         const serverSettings = app.serviceManager.serverSettings;
         const live = new Map();
         const warnedUnknown = new Set();
@@ -402,6 +405,39 @@ const plugin = {
                 reprobe();
             }
         });
+        // Each JupyterLab window keeps its own copy of the settings and never
+        // reads them again, and every save writes that whole copy. So a window
+        // loaded before another window changed a setting put the old value back
+        // on its next save of any setting (DEF-PANE-282). A change in this window
+        // tells the other windows of this browser, and a window also checks when
+        // it gains focus, for a save from another browser or device. Either way
+        // it reloads only when the server's copy differs from its own: a reload
+        // replaces unsaved text in an open JSON settings editor, and the check
+        // also ends the echo, because the window that saved already holds the
+        // server's copy. Still open: another browser or device whose window saves
+        // without gaining focus first, or whose focusing click is itself the
+        // change - that needs a version check in JupyterLab's settings API
+        // (DEF-PANE-283).
+        if (settingRegistry && settings) {
+            const current = settings;
+            const channel = new BroadcastChannel(PLUGIN_ID);
+            const reload = async () => {
+                try {
+                    const fetched = await settingRegistry.connector.fetch(PLUGIN_ID);
+                    if (fetched && fetched.raw !== current.raw) {
+                        await settingRegistry.reload(PLUGIN_ID);
+                    }
+                }
+                catch (err) {
+                    console.warn(`${LOG_PREFIX} could not reload settings.`, err);
+                }
+            };
+            window.addEventListener('focus', () => void reload());
+            channel.onmessage = () => void reload();
+            current.changed.connect(() => {
+                channel.postMessage('changed');
+            });
+        }
         console.log(`${LOG_PREFIX} ${live.size} of ${registry.ids.length} assistant panel(s) docked.`);
     }
 };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "jupyterlab_ai_code_assistants_extension",
-    "version": "1.2.41",
+    "version": "1.2.47",
     "description": "A full launcher and manager for every AI code assistant in JupyterLab - Claude Code, Codex, Kimi, Gemini and DeepSeek. Start, resume, fork, switch, and clean up CLI sessions from a side panel per assistant - one click lands you in the right terminal with the assistant already running, no duplicate tabs, no UUID hunting.",
     "keywords": [
         "jupyter",

package/src/__tests__/callback.spec.ts

@@ -0,0 +1,157 @@
+/**
+ * The Open Callback command: a pasted login callback link, handed to the
+ * server. The server's side - loopback only, one request, nothing logged - is
+ * `tests/test_callback.py`; this is the popup, the request and what the user
+ * is told.
+ */
+
+// ESM-only packages that JupyterLab's apputils pulls in and jest cannot parse.
+jest.mock('@jupyter/react-components', () => ({}));
+jest.mock('@jupyter/web-components', () => ({
+  addJupyterLabThemeChangeListener: () => undefined,
+  applyJupyterTheme: () => undefined,
+  jpButton: () => undefined,
+  jpToolbar: () => undefined,
+  provideJupyterDesignSystem: () => ({ register: () => undefined })
+}));
+jest.mock('../core/request', () => ({
+  requestAPI: jest.fn()
+}));
+
+import { InputDialog, Notification } from '@jupyterlab/apputils';
+import { nullTranslator } from '@jupyterlab/translation';
+import { CommandRegistry } from '@lumino/commands';
+
+import { CALLBACK_COMMAND, addCallbackCommand } from '../core/callback';
+import { requestAPI } from '../core/request';
+
+const request = requestAPI as jest.Mock;
+const LINK = 'http://127.0.0.1:1455/auth/callback?code=one-time&state=s';
+
+function setup(): {
+  commands: CommandRegistry;
+  added: { command: string; category: string }[];
+  serverSettings: object;
+} {
+  const commands = new CommandRegistry();
+  const serverSettings = {};
+  const added: { command: string; category: string }[] = [];
+  addCallbackCommand(
+    { commands, serviceManager: { serverSettings } } as any,
+    { addItem: (item: any) => added.push(item) } as any,
+    'AI Assistants',
+    nullTranslator.load('test')
+  );
+  return { commands, added, serverSettings };
+}
+
+describe('the Open Callback command', () => {
+  let success: jest.SpyInstance;
+  let warning: jest.SpyInstance;
+  let error: jest.SpyInstance;
+  let dialog: jest.SpyInstance;
+
+  beforeEach(() => {
+    request.mockReset();
+    success = jest.spyOn(Notification, 'success').mockReturnValue('' as any);
+    warning = jest.spyOn(Notification, 'warning').mockReturnValue('' as any);
+    error = jest.spyOn(Notification, 'error').mockReturnValue('' as any);
+    dialog = jest.spyOn(InputDialog, 'getText');
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it('is on the command palette under the assistants category', () => {
+    const { commands, added } = setup();
+    expect(commands.hasCommand(CALLBACK_COMMAND)).toBe(true);
+    expect(commands.label(CALLBACK_COMMAND)).toBe('Open Callback');
+    expect(added).toEqual([
+      { command: CALLBACK_COMMAND, category: 'AI Assistants' }
+    ]);
+  });
+
+  it('registers without a palette', () => {
+    const commands = new CommandRegistry();
+    addCallbackCommand(
+      { commands, serviceManager: { serverSettings: {} } } as any,
+      null,
+      'AI Assistants',
+      nullTranslator.load('test')
+    );
+    expect(commands.hasCommand(CALLBACK_COMMAND)).toBe(true);
+  });
+
+  it('asks for the link in a popup and posts it, trimmed, to the server', async () => {
+    const { commands, serverSettings } = setup();
+    dialog.mockResolvedValue({
+      button: { accept: true },
+      value: `  ${LINK}\n`
+    } as any);
+    request.mockResolvedValue({ status: 302 });
+
+    await commands.execute(CALLBACK_COMMAND);
+
+    expect(dialog).toHaveBeenCalledTimes(1);
+    expect(request).toHaveBeenCalledWith('callback', serverSettings, {
+      method: 'POST',
+      body: JSON.stringify({ url: LINK })
+    });
+    expect(success).toHaveBeenCalledTimes(1);
+    expect(String(success.mock.calls[0][0])).toContain('302');
+  });
+
+  it('takes the link as an argument without a popup', async () => {
+    const { commands } = setup();
+    request.mockResolvedValue({ status: 200 });
+
+    await commands.execute(CALLBACK_COMMAND, { url: LINK });
+
+    expect(dialog).not.toHaveBeenCalled();
+    expect(request).toHaveBeenCalledTimes(1);
+    expect(success).toHaveBeenCalledTimes(1);
+  });
+
+  it.each([
+    ['cancelled', { button: { accept: false }, value: LINK }],
+    ['left empty', { button: { accept: true }, value: '   ' }]
+  ])('sends nothing when the popup is %s', async (_name, answer) => {
+    const { commands } = setup();
+    dialog.mockResolvedValue(answer as any);
+
+    await commands.execute(CALLBACK_COMMAND);
+
+    expect(request).not.toHaveBeenCalled();
+    expect(success).not.toHaveBeenCalled();
+    expect(error).not.toHaveBeenCalled();
+  });
+
+  it('says so when the login refused the callback', async () => {
+    const { commands } = setup();
+    request.mockResolvedValue({ status: 400 });
+
+    await commands.execute(CALLBACK_COMMAND, { url: LINK });
+
+    expect(success).not.toHaveBeenCalled();
+    expect(warning).toHaveBeenCalledTimes(1);
+    expect(String(warning.mock.calls[0][0])).toContain('400');
+  });
+
+  it.each([
+    ['callback_not_loopback', '127.0.0.1'],
+    ['callback_unreachable', 'No login is waiting'],
+    ['Internal Server Error', 'Internal Server Error']
+  ])('reports %s without repeating the link', async (code, expected) => {
+    const { commands } = setup();
+    request.mockRejectedValue(new Error(code));
+
+    await commands.execute(CALLBACK_COMMAND, { url: LINK });
+
+    expect(error).toHaveBeenCalledTimes(1);
+    const message = String(error.mock.calls[0][0]);
+    expect(message).toContain(expected);
+    // The link carries a login code.
+    expect(message).not.toContain('one-time');
+  });
+});

package/src/__tests__/index.spec.ts

@@ -61,6 +61,34 @@ async function flush(turns = 8): Promise<void> {
   }
 }
 
+/** jsdom has no BroadcastChannel. This one joins every window of the test
+ * process and delivers as a microtask, so `flush` settles it and, as in a
+ * browser, a sender never hears its own message. Two windows reloading each
+ * other would post forever and starve every timer, jest's own included, so
+ * past a cap no legitimate run reaches it throws instead of hanging. */
+class TestBroadcastChannel {
+  private static _open: TestBroadcastChannel[] = [];
+  private static _posted = 0;
+  onmessage: ((event: { data: unknown }) => void) | null = null;
+
+  constructor(readonly name: string) {
+    TestBroadcastChannel._open.push(this);
+  }
+
+  postMessage(data: unknown): void {
+    TestBroadcastChannel._posted += 1;
+    if (TestBroadcastChannel._posted > 1000) {
+      throw new Error('windows are reloading each other without end');
+    }
+    for (const other of TestBroadcastChannel._open) {
+      if (other !== this && other.name === this.name) {
+        queueMicrotask(() => other.onmessage?.({ data }));
+      }
+    }
+  }
+}
+(globalThis as any).BroadcastChannel = TestBroadcastChannel;
+
 describe('DEF-GUARD-139 - reconcile hands a late roster to a docked panel', () => {
   it('a panel docked before the first roster gains the root and the trash flag', async () => {
     let roster: unknown = null;
@@ -82,12 +110,16 @@ describe('DEF-GUARD-139 - reconcile hands a late roster to a docked panel', () =
       hasPlugin: () => false
     } as any;
     const settings = {
+      raw: '{}',
       composite: {},
       get: () => ({ composite: undefined, user: undefined }),
       set: async () => undefined,
       changed: new Signal<unknown, void>({})
     };
-    const settingRegistry = { load: async () => settings } as any;
+    const settingRegistry = {
+      connector: { fetch: async () => ({ raw: settings.raw }) },
+      load: async () => settings
+    } as any;
     const fileBrowser = { model: { path: 'data/raw' } } as any;
 
     await (plugin.activate as any)(
@@ -302,6 +334,10 @@ describe('ACC-LNCH-143..146 - the Launcher tile has the panel lifecycle', () =>
 });
 
 describe('ACC-PROV - the activation contract', () => {
+  /** The settings file on the server, shared by every window activated here. */
+  let serverRaw = '{}';
+  let saves = 0;
+
   /** A roster in which every assistant is present, or every one but `absent`. */
   const roster = (absent?: string): unknown => ({
     root_dir: '/srv/lab',
@@ -319,6 +355,11 @@ describe('ACC-PROV - the activation contract', () => {
     restored: [AssistantSessionsPanel, string][];
     /** How many times the status route has been asked. */
     probes: () => number;
+    /** Plugin ids passed to `ISettingRegistry.reload`, in order. */
+    reloaded: string[];
+    /** Save from this window: the server and this window hold the new copy,
+     * and `changed` fires. */
+    save: () => void;
   }
 
   interface IOptions {
@@ -377,17 +418,29 @@ describe('ACC-PROV - the activation contract', () => {
 
     const composite = options.composite;
     const userSet = new Set(options.userSet ?? Object.keys(composite ?? {}));
-    const settingRegistry = composite
+    const reloaded: string[] = [];
+    const changed = new Signal<unknown, void>({});
+    const loaded = composite && {
+      raw: serverRaw,
+      composite,
+      get: (key: string) => ({
+        composite: composite[key],
+        user: userSet.has(key) ? composite[key] : undefined
+      }),
+      set: async () => undefined,
+      changed
+    };
+    const settingRegistry = loaded
       ? ({
-          load: async () => ({
-            composite,
-            get: (key: string) => ({
-              composite: composite[key],
-              user: userSet.has(key) ? composite[key] : undefined
-            }),
-            set: async () => undefined,
-            changed: new Signal<unknown, void>({})
-          })
+          connector: { fetch: async () => ({ raw: serverRaw }) },
+          // JupyterLab's reload takes the server's copy and fires `changed`
+          // before it resolves.
+          reload: async (id: string) => {
+            reloaded.push(id);
+            loaded.raw = serverRaw;
+            changed.emit(undefined);
+          },
+          load: async () => loaded
         } as any)
       : null;
 
@@ -401,7 +454,21 @@ describe('ACC-PROV - the activation contract', () => {
       null
     );
     await flush();
-    return { app, docked, restored, probes: () => call };
+    return {
+      app,
+      docked,
+      restored,
+      probes: () => call,
+      reloaded,
+      save: () => {
+        saves += 1;
+        serverRaw = `{"saves": ${saves}}`;
+        if (loaded) {
+          loaded.raw = serverRaw;
+        }
+        changed.emit(undefined);
+      }
+    };
   }
 
   /** Every assistant, turned off. */
@@ -413,6 +480,12 @@ describe('ACC-PROV - the activation contract', () => {
       ])
     );
 
+  it('registers the Open Callback command at activation', async () => {
+    const live = await activate();
+    expect(live.app.commands.hasCommand('open:callback')).toBe(true);
+    live.docked.forEach(widget => widget.dispose());
+  });
+
   it('ACC-PROV-10, ACC-PROV-11 - each panel carries its own widget id and registers it for restore', async () => {
     const live = await activate();
     // How this fails: pass a constant to `restorer.add` and two panels claim
@@ -534,6 +607,50 @@ describe('ACC-PROV - the activation contract', () => {
     live.docked.forEach(widget => widget.dispose());
   });
 
+  it('DEF-PANE-282 - a focus with no newer save leaves the settings alone', async () => {
+    const live = await activate({ composite: {} });
+
+    // A reload fires `changed`, and an open JSON settings editor then drops
+    // its unsaved text - so a focus that brings nothing newer must not reload.
+    window.dispatchEvent(new Event('focus'));
+    await flush(32);
+    expect(live.reloaded).toEqual([]);
+
+    live.docked.forEach(widget => widget.dispose());
+  });
+
+  it('DEF-PANE-282 - a focus after another device saved reloads the settings', async () => {
+    const live = await activate({ composite: {} });
+
+    // Saved elsewhere since this window loaded; this window's next save
+    // would write the old copy back.
+    serverRaw = '{"savedElsewhere": true}';
+    window.dispatchEvent(new Event('focus'));
+    await flush(32);
+    expect(live.reloaded).toEqual([
+      'jupyterlab_ai_code_assistants_extension:plugin'
+    ]);
+
+    live.docked.forEach(widget => widget.dispose());
+  });
+
+  it('DEF-PANE-282 - a change in one window makes the other windows of the browser reload', async () => {
+    const one = await activate({ composite: {} });
+    const other = await activate({ composite: {} });
+
+    one.save();
+    await flush(32);
+    expect(other.reloaded).toEqual([
+      'jupyterlab_ai_code_assistants_extension:plugin'
+    ]);
+    // The other window's reload fires `changed` and posts in turn; the window
+    // that saved already holds the server's copy, so the echo stops there.
+    expect(one.reloaded).toEqual([]);
+
+    one.docked.forEach(widget => widget.dispose());
+    other.docked.forEach(widget => widget.dispose());
+  });
+
   it('ACC-PROV-16 - a binary installed after start gains its panel on the next probe', async () => {
     const late = PROVIDERS[2].descriptor.id;
     let present = false;
@@ -734,9 +851,11 @@ describe('ACC-SETT - settings drive the panels', () => {
         user: key in composite ? composite[key] : undefined
       }),
       set: async () => undefined,
-      changed
+      changed,
+      raw: '{}'
     };
     const settingRegistry = {
+      connector: { fetch: async () => ({ raw: settings.raw }) },
       load: async () => {
         if (options.loadThrows) {
           throw new Error('settings registry unavailable');

package/src/core/callback.ts

@@ -0,0 +1,99 @@
+import { JupyterFrontEnd } from '@jupyterlab/application';
+import {
+  ICommandPalette,
+  InputDialog,
+  Notification
+} from '@jupyterlab/apputils';
+import { TranslationBundle } from '@jupyterlab/translation';
+
+import { requestAPI } from './request';
+
+/** The command that delivers a pasted login callback link. */
+export const CALLBACK_COMMAND = 'open:callback';
+
+/**
+ * Register the command that sends a pasted login callback link to the login
+ * waiting on the Jupyter server.
+ *
+ * A CLI login waits for its OAuth redirect on the server's own loopback, but
+ * the browser that follows the redirect runs on the user's machine, where that
+ * address is another host - so the page fails to load, with the link left in
+ * the address bar. Pasted here, the server makes the request instead.
+ */
+export function addCallbackCommand(
+  app: JupyterFrontEnd,
+  palette: ICommandPalette | null,
+  category: string,
+  trans: TranslationBundle
+): void {
+  app.commands.addCommand(CALLBACK_COMMAND, {
+    label: trans.__('Open Callback'),
+    caption: trans.__(
+      'Send a pasted login callback link to the login waiting on the Jupyter server'
+    ),
+    describedBy: {
+      args: {
+        type: 'object',
+        properties: {
+          url: {
+            type: 'string',
+            description: 'The callback link. Asked for in a dialog when absent.'
+          }
+        }
+      }
+    },
+    execute: async args => {
+      let url = typeof args.url === 'string' ? args.url.trim() : '';
+      if (!url) {
+        const asked = await InputDialog.getText({
+          title: trans.__('Open Callback'),
+          label: trans.__('Callback link from the browser address bar'),
+          placeholder: 'http://127.0.0.1:1455/auth/callback?code=...'
+        });
+        url = asked.button.accept ? (asked.value ?? '').trim() : '';
+        if (!url) {
+          return;
+        }
+      }
+      try {
+        const answer = await requestAPI<{ status: number }>(
+          'callback',
+          app.serviceManager.serverSettings,
+          { method: 'POST', body: JSON.stringify({ url }) }
+        );
+        if (answer.status < 400) {
+          Notification.success(
+            trans.__(
+              'Callback delivered - the login answered HTTP %1.',
+              answer.status
+            ),
+            { autoClose: 4000 }
+          );
+        } else {
+          Notification.warning(
+            trans.__(
+              'The login refused the callback (HTTP %1). Start the login again and paste the new link.',
+              answer.status
+            ),
+            { autoClose: 8000 }
+          );
+        }
+      } catch (err) {
+        // The server's own codes, never the link: it carries a login code.
+        const code = err instanceof Error ? err.message : String(err);
+        const message =
+          code === 'callback_not_loopback'
+            ? trans.__(
+                'Only an http link to 127.0.0.1 or localhost can be opened.'
+              )
+            : code === 'callback_unreachable'
+              ? trans.__(
+                  'No login is waiting at that address. Start the login again and paste the new link.'
+                )
+              : trans.__('Could not open the callback: %1', code);
+        Notification.error(message, { autoClose: 8000 });
+      }
+    }
+  });
+  palette?.addItem({ command: CALLBACK_COMMAND, category });
+}

package/src/index.ts

@@ -4,7 +4,7 @@ import {
   JupyterFrontEnd,
   JupyterFrontEndPlugin
 } from '@jupyterlab/application';
-import { Notification } from '@jupyterlab/apputils';
+import { ICommandPalette, Notification } from '@jupyterlab/apputils';
 import { IDefaultFileBrowser } from '@jupyterlab/filebrowser';
 import { ILauncher } from '@jupyterlab/launcher';
 import { ISettingRegistry } from '@jupyterlab/settingregistry';
@@ -13,6 +13,7 @@ import { ITranslator, nullTranslator } from '@jupyterlab/translation';
 import { IColourfulTabs } from 'jupyterlab_colourful_tab_extension';
 import { IDisposable } from '@lumino/disposable';
 
+import { addCallbackCommand } from './core/callback';
 import { launcherTileIcon, providerIcon } from './core/icons';
 import { DEFAULT_RECENT_LIMIT } from './core/limits';
 import {
@@ -75,7 +76,8 @@ const plugin: JupyterFrontEndPlugin<void> = {
     IDefaultFileBrowser,
     IColourfulTabs,
     ILauncher,
-    ITranslator
+    ITranslator,
+    ICommandPalette
   ],
   activate: async (
     app: JupyterFrontEnd,
@@ -86,7 +88,8 @@ const plugin: JupyterFrontEndPlugin<void> = {
     fileBrowser: IDefaultFileBrowser | null,
     colourfulTabs: IColourfulTabs | null,
     launcher: ILauncher | null,
-    translator: ITranslator | null
+    translator: ITranslator | null,
+    palette: ICommandPalette | null
   ) => {
     console.log(
       'JupyterLab extension jupyterlab_ai_code_assistants_extension is activated!'
@@ -103,6 +106,8 @@ const plugin: JupyterFrontEndPlugin<void> = {
     // as two panels quietly fighting over one widget id.
     const registry = new ProviderRegistry(PROVIDERS);
 
+    addCallbackCommand(app, palette ?? null, LAUNCHER_CATEGORY, trans);
+
     const serverSettings = app.serviceManager.serverSettings;
     const live = new Map<string, ILivePanel>();
     const warnedUnknown = new Set<string>();
@@ -502,6 +507,39 @@ const plugin: JupyterFrontEndPlugin<void> = {
       }
     });
 
+    // Each JupyterLab window keeps its own copy of the settings and never
+    // reads them again, and every save writes that whole copy. So a window
+    // loaded before another window changed a setting put the old value back
+    // on its next save of any setting (DEF-PANE-282). A change in this window
+    // tells the other windows of this browser, and a window also checks when
+    // it gains focus, for a save from another browser or device. Either way
+    // it reloads only when the server's copy differs from its own: a reload
+    // replaces unsaved text in an open JSON settings editor, and the check
+    // also ends the echo, because the window that saved already holds the
+    // server's copy. Still open: another browser or device whose window saves
+    // without gaining focus first, or whose focusing click is itself the
+    // change - that needs a version check in JupyterLab's settings API
+    // (DEF-PANE-283).
+    if (settingRegistry && settings) {
+      const current = settings;
+      const channel = new BroadcastChannel(PLUGIN_ID);
+      const reload = async (): Promise<void> => {
+        try {
+          const fetched = await settingRegistry.connector.fetch(PLUGIN_ID);
+          if (fetched && fetched.raw !== current.raw) {
+            await settingRegistry.reload(PLUGIN_ID);
+          }
+        } catch (err) {
+          console.warn(`${LOG_PREFIX} could not reload settings.`, err);
+        }
+      };
+      window.addEventListener('focus', () => void reload());
+      channel.onmessage = () => void reload();
+      current.changed.connect(() => {
+        channel.postMessage('changed');
+      });
+    }
+
     console.log(
       `${LOG_PREFIX} ${live.size} of ${registry.ids.length} assistant panel(s) docked.`
     );