sealkeep 0.9.0 → 0.11.1

package/web/rail.js

@@ -8,10 +8,22 @@
  * `.acct` markup and an `api(path)` helper can render the same card with one
  * call; pages without the markup are a no-op, never an error.
  */
-function renderAccountRail(api, status) {
+function renderAccountRail(api, status, options = {}) {
   const $id = (id) => document.getElementById(id);
+  // Dashboard callers bind this render to one vault/account generation. A
+  // setup, target, or offer request can outlive a sign-in change, so every
+  // continuation checks the binding again before it touches the shared rail
+  // or its remembered snapshot.
+  const isCurrent = typeof options.isCurrent === "function" ? options.isCurrent : () => true;
+  if (!isCurrent()) return Promise.resolve();
+  try { localStorage.removeItem("sealkeep.localApiToken"); } catch { /* upgrade cleanup is best-effort */ }
   const card = $id("acct-card");
   if (!card) return Promise.resolve();
+  // A newer rail render owns upload polling from this point onward. Without
+  // stopping the prior generation here, its timer can remain installed until
+  // the next tick; the new generation then sees a timer and never starts its
+  // own poll after the old one retires itself as stale.
+  if (!options.cachedOnly) railStopUploadPoll();
 
   // Identical to the app's own bytes(): binary units, one decimal. The first
   // version divided by 1e9, so the same quota read "536.9 GB" in this card and
@@ -27,39 +39,119 @@ function renderAccountRail(api, status) {
 
   // The card is a fixed skeleton: the markup reserves every slot, and this
   // function only ever overwrites text in place — nothing appears or grows, so
-  // the nav below never jumps. Two paints: first from the last visit's
-  // snapshot (instant, this browser already knew these numbers), then from the
-  // live answer, which also refreshes the snapshot.
-  const SNAPSHOT_KEY = "vaultline.railSnapshot";
+  // the nav below never jumps. After live status identifies the vault, two
+  // paints: first from the last visit's matching snapshot, then from the
+  // remaining live answers, which also refresh the snapshot.
+  const SNAPSHOT_KEY = "sealkeep.railSnapshot";
+  let activeVaultId = status?.vaultId || null;
+  const authBinding = (() => {
+    const value = sessionStorage.getItem("sealkeep.localApiToken");
+    if (!value) return null;
+    let left = 0x811c9dc5;
+    let right = 0x9e3779b9;
+    for (let index = 0; index < value.length; index += 1) {
+      const code = value.charCodeAt(index);
+      left = Math.imul(left ^ code, 0x01000193);
+      right = Math.imul(right ^ (code + index), 0x85ebca6b);
+    }
+    return `${(left >>> 0).toString(36)}.${(right >>> 0).toString(36)}.${value.length}`;
+  })();
+  const readSnapshot = (expectedVaultId = null) => {
+    try {
+      const snapshot = JSON.parse(localStorage.getItem(SNAPSHOT_KEY) || sessionStorage.getItem(SNAPSHOT_KEY) || "{}");
+      // The same loopback origin can later serve another vault. Refuse a legacy
+      // or differently bound snapshot before painting even one account fact;
+      // live status will repopulate it for this service.
+      return authBinding && expectedVaultId && snapshot.authBinding === authBinding && snapshot.vaultId === expectedVaultId ? snapshot : {};
+    }
+    catch { return {}; }
+  };
+  const saveSnapshot = (patch) => {
+    if (!isCurrent()) return;
+    const vaultId = patch.vaultId || activeVaultId;
+    if (!vaultId) return;
+    try { localStorage.setItem(SNAPSHOT_KEY, JSON.stringify({ ...readSnapshot(vaultId), ...patch, vaultId })); }
+    catch { /* a browser refusing storage costs only the instant repaint */ }
+  };
+  // The HTML reserves these slots so the navigation never jumps, but a bare
+  // dash is not a fact. Start each render with unknown slots hidden; the last
+  // verified snapshot (or the live response below) unhides only what it can
+  // actually name. Re-renders happen in one JS turn, so a remembered rail does
+  // not flash away while it is repainted.
+  for (const id of ["acct-plan", "acct-email", "acct-meter", "acct-usage", "acct-phrase", "acct-storage", "acct-disk"]) {
+    const node = $id(id);
+    // Visibility keeps the skeleton's footprint, so the navigation below does
+    // not jump while still ensuring no placeholder is user-visible.
+    if (node) node.style.visibility = "hidden";
+  }
   const paintIdentity = (snap) => {
+    if (!isCurrent()) return;
     const plan = snap.plan;
     const isPro = plan === "pro" || plan === "pro_lite";
     $id("acct-plan").className = `acct-plan${isPro ? " pro" : ""}`;
     $id("acct-plan-name").textContent = plan === "pro" ? "Sealkeep Pro" : plan === "pro_lite" ? "Sealkeep Pro Lite" : plan ? plan.replace(/^./, (c) => c.toUpperCase()) : "Local vault";
+    $id("acct-plan").style.visibility = "visible";
     const emailEl = $id("acct-email");
-    if (emailEl) emailEl.textContent = snap.email || "no account — this machine only";
+    if (emailEl) {
+      emailEl.textContent = snap.email || "no account — this machine only";
+      emailEl.style.visibility = "visible";
+    }
     if (snap.limit) {
       const used = Number(snap.used) || 0;
       $id("acct-fill").style.width = `${Math.min(100, (used / snap.limit) * 100).toFixed(1)}%`;
       // A remembered answer is labelled as remembered, never passed off as live.
       $id("acct-usage").textContent = `${bytes(used)} of ${bytes(snap.limit)}${snap.cached ? " · last known" : ""}`;
+      $id("acct-meter").style.visibility = "visible";
+      $id("acct-usage").style.visibility = "visible";
     } else {
       $id("acct-fill").style.width = "0%";
-      $id("acct-usage").textContent = snap.plan ? "—" : "nothing stored off this machine";
+      // A paid-plan response without quota is incomplete, not a zero or a
+      // dash. Local-only is a complete answer and can be stated plainly.
+      $id("acct-meter").style.visibility = "hidden";
+      $id("acct-usage").style.visibility = snap.plan ? "hidden" : "visible";
+      if (!snap.plan) $id("acct-usage").textContent = "nothing stored off this machine";
     }
     if (snap.diskText) railWriteDiskFact(snap.diskText);
+    if (typeof snap.phraseHeld === "boolean") {
+      $id("acct-phrase").style.visibility = "visible";
+      $id("acct-phrase").className = snap.phraseHeld ? "good" : "warn";
+      $id("acct-phrase-text").textContent = snap.phraseHeld ? "Seals unattended — phrase stored here" : "Recovery phrase is not stored on this machine";
+    }
+    if (snap.storageText) {
+      $id("acct-storage").style.visibility = "visible";
+      $id("acct-storage").className = snap.storageWarn ? "warn" : "good";
+      $id("acct-storage-text").textContent = snap.storageText;
+    }
+    if (typeof snap.escrowVisible === "boolean") {
+      const escrow = $id("acct-escrow");
+      if (escrow) {
+        escrow.hidden = !snap.escrowVisible;
+        if (snap.escrowVisible && typeof snap.escrowBackedUp === "boolean") {
+          escrow.className = snap.escrowBackedUp ? "good" : "warn";
+          $id("acct-escrow-text").innerHTML = snap.escrowBackedUp
+            ? 'Key backup previously confirmed — <a href="./index.html#recovery-access" class="rail-connect">check access</a>'
+            : 'Key backup needs checking — <a href="./index.html#recovery-access" class="rail-connect">check access</a>';
+        }
+      }
+    }
     if (snap.panelUrl && snap.plan) railPlaceDoor(card, snap.panelUrl);
   };
   try {
-    const remembered = sessionStorage.getItem(SNAPSHOT_KEY);
-    if (remembered) paintIdentity({ ...JSON.parse(remembered), cached: true });
+    const remembered = readSnapshot(status?.vaultId);
+    if (Object.keys(remembered).length > 0) paintIdentity({ ...remembered, cached: true });
   } catch { /* a torn snapshot paints nothing; the live answer is seconds away */ }
 
+  if (options.cachedOnly) return Promise.resolve();
+
   const ready = status ? Promise.resolve(status) : api("/v1/status");
   return ready.then((state) => {
+    if (!isCurrent()) return;
+    activeVaultId = state.vaultId || null;
     const plan = state.plan;
     const quota = state.quota;
     const snapshot = {
+      authBinding,
+      vaultId: state.vaultId || null,
       plan,
       email: state.accountEmail || null,
       used: quota ? Number(quota.usedBytes) || 0 : null,
@@ -68,24 +160,121 @@ function renderAccountRail(api, status) {
       panelUrl: state.panelUrl || null
     };
     paintIdentity(snapshot);
-    try {
-      const prior = JSON.parse(sessionStorage.getItem(SNAPSHOT_KEY) || "{}");
-      sessionStorage.setItem(SNAPSHOT_KEY, JSON.stringify({ ...snapshot, diskText: prior.diskText || null }));
-    } catch { /* a browser refusing storage costs only the instant repaint */ }
+    saveSnapshot(snapshot);
 
     // The two facts come from setup state; tolerate its absence rather than
     // blocking the card.
     return api("/v1/setup/state").catch(() => null).then((setup) => {
-      const held = Boolean(setup && setup.vault && setup.vault.phraseRemembered);
+      if (!isCurrent()) return;
+      if (!setup) {
+        // No answer is not "no phrase". Keep the last verified facts painted
+        // while this request retries on the next refresh.
+        return;
+      }
+      const held = Boolean(setup.vault && setup.vault.phraseRemembered);
+      $id("acct-phrase").style.visibility = "visible";
       $id("acct-phrase").className = held ? "good" : "warn";
-      $id("acct-phrase-text").innerHTML = held ? "Seals on its own" : "<b>Phrase not stored</b> — Settings";
+      $id("acct-phrase-text").innerHTML = held ? "Seals unattended — phrase stored here" : '<b>Can\u2019t seal unattended</b> — <a href="./index.html#settings" class="rail-connect" id="rail-phrase-link">store your recovery phrase</a>';
+      const phraseLink = $id("rail-phrase-link");
+      if (phraseLink) phraseLink.addEventListener("click", () => {
+        // Same-page navigation: place the cursor. Cross-page, the settings
+        // loader finds the hash and does its own focusing on arrival.
+        setTimeout(() => document.getElementById("f-remember-phrase")?.focus(), 300);
+      });
 
+      // The sealed key backup: a lost laptop is not a lost vault only if a
+      // sealed copy of the key lives in the account. Surfaced from setup state,
+      // with the fix one click into Settings.
+      const escrowLi = $id("acct-escrow");
+      const backedUp = typeof setup.vault?.escrowStored === 'boolean' ? setup.vault.escrowStored : null;
+      const onAccount = Boolean(plan);
+      if (escrowLi) {
+        if (!onAccount) { escrowLi.hidden = true; }
+        else {
+          escrowLi.hidden = false;
+          escrowLi.className = backedUp ? "good" : "warn";
+          $id("acct-escrow-text").innerHTML = backedUp === true
+            ? "Key backed up to your account"
+            : backedUp === false
+              ? '<b>No sealed key backup found</b> — <a href="./index.html#recovery-access" class="rail-connect">check recovery options</a>'
+              : 'Key backup not verified right now — <a href="./index.html#recovery-access" class="rail-connect">check recovery access</a>';
+        }
+      }
+      // (No "setup unfinished" chip: a local-only vault is a finished state by
+      // design, and managed sign-in configures storage without a BYO bucket, so
+      // storage.configured is false for a fully set-up account — there is no
+      // honest rail-wide signal that setup is incomplete. The road back to the
+      // wizard lives on the overview metric when a vault truly has no storage.)
+
+      const NAMES = { s3: "S3-compatible", r2: "Cloudflare R2", b2: "Backblaze B2", gcs: "Google Cloud Storage", gdrive: "Google Drive", vaultline: "Sealkeep Cloud" };
       const provider = (state.remoteStorage && state.remoteStorage.provider) || (setup && setup.storage && setup.storage.provider);
       const label = provider
-        ? { s3: "Amazon S3", r2: "Cloudflare R2", b2: "Backblaze B2", gcs: "Google Cloud", vaultline: "Sealkeep managed" }[provider] || provider
+        ? NAMES[provider] || provider
         : (plan ? "Sealkeep managed" : null);
-      $id("acct-storage").className = label ? "good" : "";
-      $id("acct-storage-text").textContent = label ? `Storage: ${label}` : "This disk only";
+      const fallbackStorageText = label ? `Storage: ${label}` : "This disk only";
+      const rememberedStorageText = readSnapshot(state.vaultId).storageText;
+      // `status` only knows the account's default provider. The routing call
+      // below knows the complete list. Keep the previous complete answer on
+      // screen instead of briefly downgrading it to "Sealkeep managed".
+      if (!rememberedStorageText) {
+        $id("acct-storage").style.visibility = "visible";
+        $id("acct-storage").className = label ? "good" : "";
+        $id("acct-storage-text").textContent = fallbackStorageText;
+      }
+      saveSnapshot({
+        phraseHeld: held,
+        escrowVisible: onAccount,
+        escrowBackedUp: backedUp,
+        ...(!rememberedStorageText ? { storageText: fallbackStorageText, storageWarn: false } : {})
+      });
+      // Every destination, not the first one: a vault routing to managed
+      // storage AND Google Drive showed only one, and the other simply did
+      // not exist anywhere on the page.
+      api("/v1/storage/targets").catch(() => null).then((routed) => {
+        if (!isCurrent()) return;
+        if (!routed) return;
+        const targets = Array.isArray(routed.targets) ? routed.targets : [];
+        const finalStorageText = targets.length
+          ? `Storage: ${targets.map((t) => NAMES[t.provider] || t.provider).join(" + ")}`
+          : fallbackStorageText;
+        $id("acct-storage").style.visibility = "visible";
+        $id("acct-storage").className = targets.length || label ? "good" : "";
+        $id("acct-storage-text").textContent = finalStorageText;
+        // A destination this machine cannot reach is named as such, with the
+        // fix one click away — not discovered at seal time as a routing error.
+        // This must cover every provider. Showing Cloud/R2/S3 as green merely
+        // because Drive happened to be the first failed row hid broken routes.
+        const disconnected = targets.filter((target) => target.connected === false);
+        if (disconnected.length === 0) {
+          saveSnapshot({ storageText: finalStorageText, storageWarn: false });
+          return;
+        }
+        const line = $id("acct-storage-text");
+        disconnected.forEach((target, index) => {
+          line.append(index === 0 ? " · " : " / ");
+          const providerName = NAMES[target.provider] || target.provider || "storage";
+          const fix = document.createElement("a");
+          fix.className = "rail-connect";
+          if (target.provider === "gdrive") {
+            fix.href = "#";
+            fix.textContent = `connect ${providerName}`;
+            fix.title = `${providerName} is a destination, but this machine is not signed in. Connect this exact destination to let seals land there.`;
+            fix.addEventListener("click", (event) => {
+              event.preventDefault();
+              fix.textContent = "opening Google…";
+              connectGdrive(api, fix, target.id);
+            });
+          } else {
+            fix.href = "./index.html#settings";
+            fix.textContent = `reconnect ${providerName}`;
+            fix.title = `${providerName} is configured for this account but unavailable on this machine. Open Settings to reconnect it.`;
+          }
+          line.append(fix);
+        });
+        $id("acct-storage").className = "warn";
+        const unavailable = disconnected.map((target) => NAMES[target.provider] || target.provider || "storage").join(" + ");
+        saveSnapshot({ storageText: `${finalStorageText} · ${unavailable} disconnected on this machine`, storageWarn: true });
+      });
 
       // A paying plan gets its door: the panel where the subscription,
       // machines and stored copies are managed. The slot for it is reserved in
@@ -98,9 +287,10 @@ function renderAccountRail(api, status) {
       // dismissed until the backend publishes a different one (new id).
       if (!state.plan && !document.getElementById("rail-offer")) {
         return api("/v1/offer").catch(() => null).then((body) => {
+          if (!isCurrent()) return;
           const offer = body && body.offer;
           if (!offer || !offer.headline) return;
-          const dismissed = localStorage.getItem("vaultline.offer.dismissed");
+          const dismissed = localStorage.getItem("sealkeep.offer.dismissed");
           if (dismissed && String(offer.id) === dismissed) return;
           const box = document.createElement("div");
           box.id = "rail-offer";
@@ -112,7 +302,7 @@ function renderAccountRail(api, status) {
           const go = document.createElement("a");
           go.className = "action";
           go.textContent = offer.cta_label || "Learn more";
-          go.href = offer.cta_url || "#";
+          go.href = sealkeepCloudLink(offer.cta_url || "#");
           go.target = "_blank";
           go.rel = "noreferrer";
           const close = document.createElement("button");
@@ -120,20 +310,23 @@ function renderAccountRail(api, status) {
           close.className = "rail-offer-close";
           close.textContent = "✕";
           close.title = "Dismiss";
-          close.onclick = () => { localStorage.setItem("vaultline.offer.dismissed", String(offer.id)); box.remove(); };
+          close.onclick = () => { localStorage.setItem("sealkeep.offer.dismissed", String(offer.id)); box.remove(); };
           box.append(close, head, text, go);
           card.after(box);
         });
       }
     }).then(() => {
+      if (!isCurrent()) return;
       // Rendered last, and each self-guarded: neither the upload strip nor the
       // disk-footprint fact may cost the card above them a single field.
-      railSyncUpload(api, bytes, card, state && state.upload);
-      return railDiskFact(api, bytes);
+      railSyncUpload(api, bytes, card, state && state.upload, isCurrent);
+      if (options.skipDisk) return;
+      return railDiskFact(api, bytes, isCurrent);
     });
   }).catch((error) => {
-    // The skeleton stays put on failure — placeholders are already honest
-    // ("—") — and the reason is kept for inspection rather than swallowed.
+    if (!isCurrent()) return;
+    // The last verified facts stay put on failure. Slots that have never had
+    // an answer remain hidden, and the reason is kept for inspection.
     if (typeof window !== "undefined") window.__railError = String((error && error.message) || error);
   });
 }
@@ -148,7 +341,12 @@ function renderAccountRail(api, status) {
  */
 function railWriteDiskFact(text) {
   const slot = document.getElementById("acct-disk-text");
-  if (slot) { slot.textContent = text; return true; }
+  if (slot) {
+    slot.textContent = text;
+    const row = document.getElementById("acct-disk");
+    if (row) row.style.visibility = "visible";
+    return true;
+  }
   // Older markup without the reserved row: append one, as before.
   const storage = document.getElementById("acct-storage");
   const list = storage && storage.parentElement;
@@ -174,27 +372,50 @@ function railPlaceDoor(card, panelUrl) {
     door.className = "action acct-door";
     door.target = "_blank";
     door.rel = "noreferrer";
-    door.textContent = "Cloud panel ↗";
+    door.textContent = "Account panel ↗";
     const slot = document.getElementById("acct-door-slot");
     if (slot) slot.append(door);
     else if (card && typeof card.append === "function") card.append(door);
   }
-  door.href = panelUrl;
+  door.href = sealkeepCloudLink(panelUrl);
+}
+
+// Only a public loopback address travels to Cloud, never the local bearer.
+function sealkeepCloudLink(value) {
+  try {
+    const url = new URL(value);
+    if (url.origin === 'https://sealkeep.spala.ai' && location.protocol === 'http:' && ['127.0.0.1','localhost','[::1]'].includes(location.hostname)) {
+      url.searchParams.set('local_return', `${location.origin}/index.html`);
+    }
+    return url.href;
+  } catch { return value; }
+}
+
+// Static account links need the same return path as dynamically rendered ones.
+// Run after the page markup (rail.js is loaded at the end of the document).
+function sealkeepCloudLinks(root = document) {
+  for (const link of root.querySelectorAll('a[href]')) {
+    link.href = sealkeepCloudLink(link.href);
+  }
 }
 
 let railDiskFactAsked = false;
-function railDiskFact(api, bytes) {
-  if (railDiskFactAsked) return;
+function railDiskFact(api, bytes, isCurrent = () => true) {
+  if (!isCurrent() || railDiskFactAsked) return;
   railDiskFactAsked = true;
   return api("/v1/sessions").catch(() => null).then((disk) => {
+    if (!isCurrent()) return;
     const total = disk == null ? NaN : Number(disk.totalBytes);
     if (!Number.isFinite(total)) return;
-    const line = `${bytes(total)} of sessions on this disk`;
+    // Reworded: "…of sessions on this disk" collided with the Overview
+    // headline's "still on this disk", which counts only the UNARCHIVED
+    // subset — same words, different numbers, one screen apart.
+    const line = `${bytes(total)} across ${(disk.sessions || []).length} sessions found on disk`;
     railWriteDiskFact(line);
     // The slow fact joins the snapshot so the NEXT load paints it instantly.
     try {
-      const prior = JSON.parse(sessionStorage.getItem("vaultline.railSnapshot") || "{}");
-      sessionStorage.setItem("vaultline.railSnapshot", JSON.stringify({ ...prior, diskText: line }));
+      const prior = JSON.parse(localStorage.getItem("sealkeep.railSnapshot") || sessionStorage.getItem("sealkeep.railSnapshot") || "{}");
+      localStorage.setItem("sealkeep.railSnapshot", JSON.stringify({ ...prior, diskText: line }));
     } catch { /* snapshot is a convenience, never a requirement */ }
   });
 }
@@ -228,8 +449,10 @@ function railDrawUpload(run, bytes) {
   if (!railUploadEls) return;
   const total = Number(run.totalBytes) || 0;
   const done = Number(run.doneBytes) || 0;
+  const resolved = Array.isArray(run.resolvedAfterRun) ? run.resolvedAfterRun : [];
+  const resolvedBytes = resolved.reduce((sum, item) => sum + (Number.isFinite(item?.bytes) ? item.bytes : 0), 0);
   const active = !run.finishedAt;
-  const pct = total > 0 ? Math.min(100, (done / total) * 100) : active ? 0 : 100;
+  const pct = total > 0 ? Math.min(100, ((active ? done : done + resolvedBytes) / total) * 100) : active ? 0 : 100;
   railUploadEls.fill.style.width = `${pct.toFixed(1)}%`;
   const sent = (run.done || []).length;
   if (active) {
@@ -239,8 +462,10 @@ function railDrawUpload(run, bytes) {
     const failed = run.failed || [];
     const word = run.cancelled ? "Stopped" : "Done";
     railUploadEls.line.textContent = failed.length
-      ? `${word} — ${sent} sent, ${failed.length} failed — ${failed[0].error}`
-      : `${word} — ${sent} sent, ${bytes(Number(run.freedBytes) || 0)} freed locally`;
+      ? `${word} — ${sent} sent, ${resolved.length} stored later, ${failed.length} failed — ${failed[0].error}`
+      : resolved.length
+        ? `${word} — ${sent} sent, ${resolved.length} stored later automatically`
+        : `${word} — ${sent} sent, ${bytes(Number(run.freedBytes) || 0)} freed locally`;
   }
 }
 
@@ -278,8 +503,9 @@ function railInjectUploadStrip(card) {
   railUploadEls = { strip, fill, line, done: false };
 }
 
-function railSyncUpload(api, bytes, card, run) {
+function railSyncUpload(api, bytes, card, run, isCurrent = () => true) {
   try {
+    if (!isCurrent()) return;
     const active = Boolean(run && !run.finishedAt);
     if (!active) {
       railStopUploadPoll();
@@ -299,10 +525,61 @@ function railSyncUpload(api, bytes, card, run) {
     railUploadEls.done = false;
     railDrawUpload(run, bytes);
     if (railUploadTimer) return;
-    railUploadTimer = setInterval(() => {
+    const timer = setInterval(() => {
+      if (!isCurrent()) {
+        clearInterval(timer);
+        if (railUploadTimer === timer) railUploadTimer = null;
+        return;
+      }
       api("/v1/status")
-        .then((fresh) => railSyncUpload(api, bytes, card, fresh && fresh.upload))
-        .catch(() => { /* a missed poll is the next poll's problem */ });
+        .then((fresh) => {
+          if (isCurrent()) railSyncUpload(api, bytes, card, fresh && fresh.upload, isCurrent);
+        })
+        .catch(() => {
+          if (!isCurrent()) {
+            clearInterval(timer);
+            if (railUploadTimer === timer) railUploadTimer = null;
+          }
+          // A current missed poll is the next poll's problem.
+        });
     }, 3000);
+    railUploadTimer = timer;
   } catch { /* the strip is a garnish: no failure here may cost the rail */ }
 }
+
+// Drive consent, driven from the rail: ask the daemon to start the flow, open
+// Google's consent screen in the user's own tab, then watch until the grant
+// lands in this machine's keystore (or the attempt fails with a reason).
+async function connectGdrive(api, anchor, targetId) {
+  try {
+    const consentTab = window.open("about:blank", "_blank");
+    const started = await api("/v1/storage/targets/gdrive/connect", {
+      method: "POST",
+      body: JSON.stringify({ targetId })
+    }).catch(() => null);
+    if (!started || !started.consent_url) {
+      consentTab?.close();
+      anchor.textContent = (started && started.error) ? `Drive: ${started.error}` : "Drive: could not start";
+      return;
+    }
+    if (consentTab) consentTab.location = started.consent_url;
+    else window.open(started.consent_url, "_blank", "noopener");
+    anchor.textContent = "waiting for Google…";
+    const until = Date.now() + 5 * 60 * 1000;
+    while (Date.now() < until) {
+      await new Promise((rest) => setTimeout(rest, 2000));
+      const state = await api(`/v1/storage/targets/gdrive/connect?targetId=${encodeURIComponent(targetId)}`).catch(() => null);
+      if (state && state.status === "connected") {
+        anchor.textContent = "Drive connected ✓";
+        return;
+      }
+      if (state && state.status === "failed") {
+        anchor.textContent = `Drive: ${state.error || "consent failed"}`;
+        return;
+      }
+    }
+    anchor.textContent = "Drive: no consent arrived — click to retry";
+  } catch (error) {
+    anchor.textContent = "Drive: " + (error && error.message ? error.message : "connect failed");
+  }
+}

package/web/retention.html

@@ -9,10 +9,10 @@
 <body>
 <!-- The rules editor is a dashboard view now (index.html#rules) — one page,
      no reloads between views. This stub keeps old bookmarks and links working,
-     preserving a #token=… fragment when one is carried. -->
+     preserving a #ticket=… fragment when one is carried. -->
 <script>
   const h = location.hash.replace(/^#/, "");
-  location.replace(h.includes("token=") ? `./index.html#${h}` : "./index.html#rules");
+  location.replace(new URLSearchParams(h).has("ticket") ? `./index.html#${h}` : "./index.html#rules");
 </script>
 </body>
 </html>