observal-cli 1.2.0__tar.gz → 1.2.1__tar.gz

{observal_cli-1.2.0 → observal_cli-1.2.1}/CHANGELOG.md

@@ -10,6 +10,18 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.2.1] - 2026-05-27
+
+### Changed
+
+- minimize login error handling fix (**web**) ([6819685](https://github.com/BlazeUp-AI/Observal/commit/68196858e305187825076c400d97179370aa6902))
+
+### Fixed
+
+- prevent auth guard flicker on direct URL access (**web**) ([b7eb425](https://github.com/BlazeUp-AI/Observal/commit/b7eb4252f8dd167ff12067be30f3c1b7431833c1))
+- SSO device flow, skill install, version check, UI (**auth,ide,cli,web**) ([5ef6a67](https://github.com/BlazeUp-AI/Observal/commit/5ef6a67269e31a14ab416b9a65ec6286e39ef9a4))
+- 404 denied agent bind (**sessions**) ([a71ba58](https://github.com/BlazeUp-AI/Observal/commit/a71ba58e9a77df0aeb7b96dc5147c27e0abdc745))
+- handle non-JSON login error responses (**web**) ([e0f79ff](https://github.com/BlazeUp-AI/Observal/commit/e0f79ff6f4fc7159744b8a182189ce637edd3675))
 ## [1.2.0] - 2026-05-26
 
 ### Added

{observal_cli-1.2.0 → observal_cli-1.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: observal-cli
-Version: 1.2.0
+Version: 1.2.1
 Summary: Observal MCP Server Registry & Agent Registry CLI
 Project-URL: Homepage, https://github.com/BlazeUp-AI/Observal
 Project-URL: Repository, https://github.com/BlazeUp-AI/Observal

{observal_cli-1.2.0 → observal_cli-1.2.1}/observal-server/api/routes/auth.py

@@ -13,6 +13,7 @@ import logging
 import re
 import secrets
 from datetime import UTC, datetime
+from urllib.parse import quote
 
 import jwt as pyjwt
 from authlib.integrations.starlette_client import OAuth
@@ -269,12 +270,17 @@ async def login(request: Request, req: LoginRequest, db: AsyncSession = Depends(
 
 
 @router.get("/oauth/login")
-async def oauth_login(request: Request):
+async def oauth_login(request: Request, next: str | None = None):
     """Initiates the OAuth SSO flow"""
     optic.debug("oauth_login called")
     if not oauth.oidc:
         raise HTTPException(status_code=500, detail="OAuth is not configured on the server")
 
+    # Preserve the post-login redirect target (e.g. /device?code=XXXX) across the
+    # OAuth round-trip so the user lands on the correct page after SSO completes.
+    if next and next.startswith("/") and not next.startswith("//") and "\\" not in next:
+        request.session["oauth_next"] = next
+
     # Use FRONTEND_URL as the base so the redirect works through the Next.js proxy.
     # This avoids Docker-internal hostnames (e.g. observal-api:8000) leaking into
     # the redirect URI, which would fail Azure AD's redirect URI validation.
@@ -396,7 +402,12 @@ async def oauth_callback(request: Request, db: AsyncSession = Depends(get_db)):
             user_agent=user_agent,
         )
     )
-    frontend_redirect = f"{ds.get_sync('deployment.frontend_url', 'http://localhost:3000')}/login?code={code}"
+    # Restore the post-login redirect target that was saved before the OAuth round-trip.
+    oauth_next = request.session.pop("oauth_next", None)
+    frontend_base = ds.get_sync("deployment.frontend_url", "http://localhost:3000")
+    frontend_redirect = f"{frontend_base}/login?code={code}"
+    if oauth_next and oauth_next.startswith("/") and not oauth_next.startswith("//") and "\\" not in oauth_next:
+        frontend_redirect += f"&next={quote(oauth_next, safe='')}"
     return RedirectResponse(url=frontend_redirect)
 
 

{observal_cli-1.2.0 → observal_cli-1.2.1}/observal-server/api/routes/sessions.py

@@ -6,6 +6,7 @@
 # SPDX-FileCopyrightText: 2026 Shreem Seth <shreemseth26@gmail.com>
 # SPDX-FileCopyrightText: 2026 SrihariLegend <sriharilegend23@gmail.com>
 # SPDX-FileCopyrightText: 2026 Vishnu Muthiah <vishnu.muthiah04@gmail.com>
+# SPDX-FileCopyrightText: 2026 tsitu0 <tomsitu0102@gmail.com>
 # SPDX-License-Identifier: AGPL-3.0-only
 
 """Session listing and detail endpoints - backed by session_events table.
@@ -19,7 +20,7 @@ import asyncio
 import logging
 import uuid as _uuid
 
-from fastapi import APIRouter, Depends, Query
+from fastapi import APIRouter, Depends, HTTPException, Query
 from fastapi_cache.decorator import cache
 from loguru import logger as optic
 from sqlalchemy import select
@@ -394,7 +395,7 @@ async def bind_session_agent(
             params,
         )
         if not ownership:
-            return {"error": "Session not found or access denied"}
+            raise HTTPException(status_code=404, detail="Session not found or access denied")
 
     from redis.exceptions import RedisError
 

{observal_cli-1.2.0 → observal_cli-1.2.1}/observal-server/pyproject.toml

@@ -6,7 +6,7 @@
 
 [project]
 name = "observal-server"
-version = "1.2.0"
+version = "1.2.1"
 description = "Observal API server"
 requires-python = ">=3.11"
 license = "AGPL-3.0-only"

{observal_cli-1.2.0 → observal_cli-1.2.1}/observal-server/services/ide/claude_code.py

@@ -12,7 +12,6 @@ from services.ide import ConfigContext, register_adapter
 from services.ide.helpers import (
     _claude_code_hooks_frontmatter_lines,
     _collect_hook_script_files,
-    _generate_skill_file,
     _model_name_to_frontmatter,
 )
 
@@ -77,18 +76,14 @@ class ClaudeCodeAdapter:
 
         agent_path = IDE_REGISTRY["claude-code"]["rules_file"][scope].format(name=safe_name)
 
-        skill_files = [_generate_skill_file(s, "claude-code", scope) for s in skill_configs]
-        skill_files = [f for f in skill_files if f]
-
         result: dict = {
             "rules_file": {"path": agent_path, "content": agent_content},
             "mcp_config": claude_mcps,
             "mcp_setup_commands": setup_commands,
             "scope": scope,
         }
-        if skill_files:
-            result["skill_files"] = skill_files
-            result["skill_components"] = [s for s in skill_configs if s.get("git_url")]
+        if skill_configs:
+            result["skill_components"] = skill_configs
 
         cc_hook_files = _collect_hook_script_files(hook_configs, ctx.hook_listings, "claude-code")
         if cc_hook_files:

{observal_cli-1.2.0 → observal_cli-1.2.1}/observal-server/services/ide/cursor.py

@@ -12,7 +12,6 @@ from services.ide import ConfigContext, register_adapter
 from services.ide.helpers import (
     _collect_hook_script_files,
     _cursor_hooks_config,
-    _generate_skill_file,
     _merge_hook_components_into_config,
 )
 
@@ -42,9 +41,6 @@ class CursorAdapter:
         mcp_paths = spec.get("mcp_config_path", {})
         mcp_path = mcp_paths.get(ide_scope, next(iter(mcp_paths.values()), ".mcp.json"))
 
-        skill_files = [_generate_skill_file(s, "cursor", ide_scope) for s in skill_configs]
-        skill_files = [f for f in skill_files if f]
-
         # Cursor uses .cursor/agents/<name>.md for subagent registration
         # and .cursor/rules/<name>.mdc for context rules
         desc_line = (ctx.agent.description or safe_name).replace("\n", " ").strip()[:200]
@@ -75,9 +71,8 @@ class CursorAdapter:
         hook_files = _collect_hook_script_files(hook_configs, ctx.hook_listings, "cursor")
         if hook_files:
             result["hook_files"] = hook_files
-        if skill_files:
-            result["skill_files"] = skill_files
-            result["skill_components"] = [s for s in skill_configs if s.get("git_url")]
+        if skill_configs:
+            result["skill_components"] = skill_configs
         if ctx.compatibility_warnings:
             result["_warnings"] = ctx.compatibility_warnings
 

{observal_cli-1.2.0 → observal_cli-1.2.1}/observal-server/services/ide/helpers.py

@@ -432,6 +432,8 @@ def _build_skill_configs(
                 "git_ref": getattr(listing, "git_ref", None) or "main",
                 "skill_path": getattr(listing, "skill_path", None) or "/",
                 "skill_md_content": getattr(listing, "skill_md_content", None),
+                "script_content": getattr(listing, "script_content", None),
+                "script_filename": getattr(listing, "script_filename", None),
             }
         )
 

{observal_cli-1.2.0 → observal_cli-1.2.1}/observal-server/services/ide/kiro.py

@@ -12,7 +12,6 @@ from services.ide import ConfigContext, register_adapter
 from services.ide.helpers import (
     _KIRO_EVENT_MAP,
     _collect_hook_script_files,
-    _generate_skill_file,
     _wrap_kiro_prompt,
 )
 
@@ -102,11 +101,8 @@ class KiroAdapter:
             "scope": kiro_scope,
         }
 
-        skill_files = [_generate_skill_file(s, "kiro") for s in skill_configs]
-        skill_files = [f for f in skill_files if f]
-        if skill_files:
-            result["skill_files"] = skill_files
-            result["skill_components"] = [s for s in skill_configs if s.get("git_url")]
+        if skill_configs:
+            result["skill_components"] = skill_configs
 
         kiro_hook_files = _collect_hook_script_files(hook_configs, ctx.hook_listings, "kiro")
         if kiro_hook_files:

{observal_cli-1.2.0 → observal_cli-1.2.1}/observal-server/services/ide/pi.py

@@ -15,7 +15,6 @@ from loguru import logger
 
 from schemas.ide_registry import IDE_REGISTRY
 from services.ide import ConfigContext, register_adapter
-from services.ide.helpers import _generate_skill_file
 
 
 class PiAdapter:
@@ -60,16 +59,8 @@ class PiAdapter:
                 }
 
         # ── Skills ──
-        skill_files = []
-        for skill in ctx.skill_configs:
-            entry = _generate_skill_file(skill, "pi")
-            if entry:
-                skill_files.append(entry)
-        if skill_files:
-            result["skill_files"] = skill_files
-
-        # Pi doesn't use command-based hooks - telemetry is via observal-pi
-        # No hook files to generate.
+        if ctx.skill_configs:
+            result["skill_components"] = ctx.skill_configs
 
         return result
 

{observal_cli-1.2.0 → observal_cli-1.2.1}/observal-server/uv.lock

@@ -941,7 +941,7 @@ wheels = [
 
 [[package]]
 name = "observal-server"
-version = "1.2.0"
+version = "1.2.1"
 source = { virtual = "." }
 dependencies = [
     { name = "aiosqlite" },

{observal_cli-1.2.0 → observal_cli-1.2.1}/observal_cli/cmd_auth.py

@@ -195,7 +195,7 @@ def login(
         if sso_available:
             rprint("  [2] SSO (opens browser)")
         rprint("  [3] Sign in via browser")
-        choice = text_input("Login method", default="1")
+        choice = text_input("Login method")
         if (choice == "2" and sso_available) or choice == "3":
             sso_mode = True
 

{observal_cli-1.2.0 → observal_cli-1.2.1}/observal_cli/cmd_pull.py

@@ -553,44 +553,64 @@ def register_pull(app: typer.Typer):
                     os.chmod(p, 0o755)
                 written.append((str(p), "updated" if existed else "created"))
 
-        # ── skill_files (Claude Code, Kiro, Cursor) ──────────
-        # Use shared install_skill_from_git for each skill component.
-        from observal_cli.cmd_skill import _sanitize_name, install_skill_from_git
+        # ── Skills ────────────────────────────────────
+        # Two install modes:
+        #   1. git_url present → clone full skill directory from git
+        #   2. skill_md_content present (registry_direct) → write SKILL.md + optional script
+        from observal_cli.cmd_skill import _sanitize_name, install_skill_from_git, install_skill_registry_direct
 
         skill_components = snippet.get("skill_components") or []
-        cloned_skills: set[str] = set()
+        failed_skills: list[str] = []
         scope_str = "user" if is_user_scope else "project"
         for sc in skill_components:
+            sc_name = _sanitize_name(sc.get("name", "skill"))
+            git_url = sc.get("git_url")
+
             if dry_run:
-                sc_name = _sanitize_name(sc.get("name", "skill"))
-                written.append((f"<skill:{sc_name}>", "would clone"))
-                cloned_skills.add(sc_name)
-                continue
-            result_path = install_skill_from_git(
-                name=sc.get("name", "skill"),
-                git_url=sc.get("git_url"),
-                skill_path=sc.get("skill_path", "/"),
-                git_ref=sc.get("git_ref", "main"),
-                ide=ide,
-                scope=scope_str,
-                skill_md_content=sc.get("skill_md_content"),
-                cwd=target_dir,
-            )
-            if result_path:
-                written.append((str(result_path), "cloned"))
-                cloned_skills.add(_sanitize_name(sc.get("name", "skill")))
-
-        # Only write skill_files for skills that weren't successfully installed
-        for sf in snippet.get("skill_files") or []:
-            sf_name = Path(sf["path"]).parent.name
-            if sf_name in cloned_skills:
+                mode = "would clone" if git_url else "would write"
+                written.append((f"<skill:{sc_name}>", mode))
                 continue
-            p = _resolve_path(sf["path"], target_dir, allow_home=is_user_scope)
-            if dry_run:
-                written.append((str(p), "would write"))
+
+            if git_url:
+                result_path = install_skill_from_git(
+                    name=sc.get("name", "skill"),
+                    git_url=git_url,
+                    skill_path=sc.get("skill_path", "/"),
+                    git_ref=sc.get("git_ref", "main"),
+                    ide=ide,
+                    scope=scope_str,
+                    skill_md_content=sc.get("skill_md_content"),
+                    cwd=target_dir,
+                )
+                if result_path:
+                    written.append((str(result_path), "cloned"))
+                else:
+                    failed_skills.append(sc_name)
+                    rprint(f"[red]\u2717 Failed to install skill '{sc_name}'.[/red] Clone from {git_url} failed.")
             else:
-                status = _write_file(p, sf["content"])
-                written.append((str(p), status))
+                # Registry direct: SKILL.md content + optional script
+                result_path = install_skill_registry_direct(
+                    name=sc.get("name", "skill"),
+                    skill_md_content=sc.get("skill_md_content"),
+                    script_content=sc.get("script_content"),
+                    script_filename=sc.get("script_filename"),
+                    ide=ide,
+                    scope=scope_str,
+                    cwd=target_dir,
+                )
+                if result_path:
+                    written.append((str(result_path), "installed"))
+                else:
+                    failed_skills.append(sc_name)
+                    rprint(f"[red]\u2717 Failed to install skill '{sc_name}'.[/red] No content available.")
+
+        if failed_skills:
+            rprint()
+            rprint("[red]Skill installation failed.[/red] The following skills could not be installed:")
+            for fs in failed_skills:
+                rprint(f"  [red]\u2022[/red] {fs}")
+            rprint()
+            raise typer.Exit(1)
 
         # ── Agent marker (all IDEs) ─────────────────────────
         # Write <target_dir>/.observal/agent so session_push hooks can attribute

{observal_cli-1.2.0 → observal_cli-1.2.1}/observal_cli/version_check.py

@@ -567,13 +567,12 @@ def check_version_compatibility(server_url: str) -> None:
     if cli_ver_str == "0.0.0":
         return  # dev install, skip check
 
-    # Try reading server version from cache first (populated by auto-update)
+    # Use cache if fresh (< 60s), otherwise fetch live.
     server_ver = None
     cache = _read_cache()
-    if cache and cache.get("server_version") and cache.get("source") == "server":
+    if cache and cache.get("server_version") and cache.get("source") == "server" and not _should_check(cache, 60):
         server_ver = cache["server_version"]
 
-    # Fall back to a fresh fetch if cache doesn't have it
     if not server_ver:
         try:
             resp = httpx.get(f"{server_url.rstrip('/')}/api/v1/config/version", timeout=5)

{observal_cli-1.2.0 → observal_cli-1.2.1}/packages/pi-extension/package.json

@@ -1,6 +1,6 @@
 {
   "name": "observal-pi",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "Observal session telemetry for Pi \u2014 zero-dependency extension that pushes session traces to your Observal server",
   "keywords": [
     "pi-package",

{observal_cli-1.2.0 → observal_cli-1.2.1}/pyproject.toml

@@ -10,7 +10,7 @@
 
 [project]
 name = "observal-cli"
-version = "1.2.0"
+version = "1.2.1"
 description = "Observal MCP Server Registry & Agent Registry CLI"
 readme = "README.md"
 requires-python = ">=3.11"

observal_cli-1.2.1/tests/test_sessions_api.py

@@ -0,0 +1,33 @@
+# SPDX-FileCopyrightText: 2026 Hari Srinivasan <harisrini21@gmail.com>
+# SPDX-FileCopyrightText: 2026 tsitu0 <tomsitu0102@gmail.com>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+import uuid
+from unittest.mock import AsyncMock, MagicMock, patch
+
+import pytest
+from fastapi import HTTPException
+
+
+def _user(role="user"):
+    from models.user import User, UserRole
+
+    user = MagicMock(spec=User)
+    user.id = uuid.uuid4()
+    user.role = getattr(UserRole, role)
+    return user
+
+
+@pytest.mark.asyncio
+async def test_bind_session_agent_denied_raises_404():
+    """Mutation access failures should use HTTP errors, matching other ownership checks."""
+    from api.routes.sessions import bind_session_agent
+
+    with (
+        patch("api.routes.sessions._ch_json", new=AsyncMock(return_value=[])),
+        pytest.raises(HTTPException) as exc,
+    ):
+        await bind_session_agent("session-123", agent_name="agent", current_user=_user())
+
+    assert exc.value.status_code == 404
+    assert exc.value.detail == "Session not found or access denied"

{observal_cli-1.2.0 → observal_cli-1.2.1}/tests/test_version_check.py

@@ -359,9 +359,17 @@ class TestCheckVersionCompatibility:
         with pytest.raises(Exit):
             version_check.check_version_compatibility("http://localhost:8000")
 
-    def test_uses_cache_to_avoid_network_call(self, monkeypatch):
+    def test_uses_short_ttl_cache(self, monkeypatch):
+        """Cache younger than 60s is trusted, skipping network."""
+        import time
+
         monkeypatch.setattr(version_check, "get_current_version", lambda: "1.0.0")
-        monkeypatch.setattr(version_check, "_read_cache", lambda: {"server_version": "1.0.5", "source": "server"})
+        fresh_cache = {
+            "server_version": "1.0.5",
+            "source": "server",
+            "last_checked": time.strftime("%Y-%m-%dT%H:%M:%S+00:00"),
+        }
+        monkeypatch.setattr(version_check, "_read_cache", lambda: fresh_cache)
         network_called = {"hit": False}
 
         def mock_get(*args, **kwargs):
@@ -372,6 +380,25 @@ class TestCheckVersionCompatibility:
         version_check.check_version_compatibility("http://localhost:8000")
         assert network_called["hit"] is False
 
+    def test_fetches_when_cache_stale(self, monkeypatch):
+        """Cache older than 60s triggers a fresh fetch."""
+        monkeypatch.setattr(version_check, "get_current_version", lambda: "1.0.0")
+        stale_cache = {
+            "server_version": "1.0.5",
+            "source": "server",
+            "last_checked": "2020-01-01T00:00:00+00:00",
+        }
+        monkeypatch.setattr(version_check, "_read_cache", lambda: stale_cache)
+        network_called = {"hit": False}
+
+        def mock_get(*args, **kwargs):
+            network_called["hit"] = True
+            return httpx.Response(200, json={"server_version": "1.0.5"})
+
+        monkeypatch.setattr(httpx, "get", mock_get)
+        version_check.check_version_compatibility("http://localhost:8000")
+        assert network_called["hit"] is True
+
 
 # ── Auto-update tests ───────────────────────────────────────────
 

{observal_cli-1.2.0 → observal_cli-1.2.1}/uv.lock

@@ -494,7 +494,7 @@ wheels = [
 
 [[package]]
 name = "observal-cli"
-version = "1.2.0"
+version = "1.2.1"
 source = { editable = "." }
 dependencies = [
     { name = "asyncpg" },

{observal_cli-1.2.0 → observal_cli-1.2.1}/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "web",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "private": true,
   "license": "AGPL-3.0-only",
   "packageManager": "pnpm@10.33.4",

{observal_cli-1.2.0 → observal_cli-1.2.1}/web/src/app/(auth)/login/page.tsx

@@ -48,19 +48,8 @@ function LoginContent() {
       setLoading(true);
       window.history.replaceState({}, "", "/login");
 
-      fetch("/api/v1/auth/exchange", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ code: ssoCode }),
-      })
-        .then(async (res) => {
-          if (!res.ok) {
-            const text = await res.text().catch(() => res.statusText);
-            throw new Error(text);
-          }
-          return res.json();
-        })
-        .then((data: { access_token: string; refresh_token: string; user: { role: string; name: string; email: string; username?: string; avatar_url?: string | null } }) => {
+      auth.exchangeCode({ code: ssoCode })
+        .then((data) => {
           setTokens(data.access_token, data.refresh_token);
           setUserRole(data.user.role);
           setUserName(data.user.name);
@@ -159,7 +148,11 @@ function LoginContent() {
 
   function handleSsoLogin() {
     setSsoLoading(true);
-    window.location.href = "/api/v1/auth/oauth/login";
+    const nextParam = searchParams.get("next");
+    const url = nextParam && nextParam.startsWith("/")
+      ? `/api/v1/auth/oauth/login?next=${encodeURIComponent(nextParam)}`
+      : "/api/v1/auth/oauth/login";
+    window.location.href = url;
   }
 
   if (mustChangePassword) {

{observal_cli-1.2.0 → observal_cli-1.2.1}/web/src/app/(registry)/components/[id]/page.tsx

@@ -166,7 +166,7 @@ export default function ComponentDetailPage({ params }: { params: Promise<{ id:
             {/* Grid: Main + Sidebar */}
             <div className="grid grid-cols-1 lg:grid-cols-[1fr_320px] gap-8 items-start">
             {/* Tabs */}
-            <Tabs defaultValue="overview">
+            <Tabs defaultValue="overview" className="min-w-0">
               <TabsList>
                 <TabsTrigger value="overview">Overview</TabsTrigger>
                 <TabsTrigger value="reviews">
@@ -518,7 +518,7 @@ function ComponentMetadata({ item }: { item: RegistryItem }) {
           <h3 className="text-xs font-semibold uppercase tracking-wider text-muted-foreground">
             {skillMd ? "Skill File" : "Prompt Template"}
           </h3>
-          <div className="rounded-md border border-border bg-muted/20 p-4 overflow-y-auto max-h-[600px]">
+          <div className="rounded-md border border-border bg-muted/20 p-4 overflow-y-auto max-h-[360px]">
             <div className="prose prose-sm dark:prose-invert max-w-none text-foreground/90 leading-relaxed">
               <ReactMarkdown remarkPlugins={[remarkGfm]}>{markdownContent}</ReactMarkdown>
             </div>

{observal_cli-1.2.0 → observal_cli-1.2.1}/web/src/components/layouts/auth-guard.tsx

@@ -6,9 +6,10 @@
 import { useAuthGuard, useOptionalAuth } from "@/hooks/use-auth";
 
 export function AuthGuard({ children }: { children: React.ReactNode }) {
-  useAuthGuard();
-  // Render children immediately to prevent hydration mismatch
-  // The useAuthGuard hook handles redirects via side effects
+  const { ready } = useAuthGuard();
+  // Block rendering until auth state is confirmed to prevent flicker
+  // of protected content before redirect
+  if (!ready) return <div className="flex h-screen w-full items-center justify-center" />;
   return <>{children}</>;
 }
 

{observal_cli-1.2.0 → observal_cli-1.2.1}/web/src/components/layouts/role-guard.tsx

@@ -7,8 +7,9 @@
 import { useRoleGuard, type Role } from "@/hooks/use-role-guard";
 
 export function RoleGuard({ minRole, children }: { minRole: Role; children: React.ReactNode }) {
-  useRoleGuard(minRole);
-  // Render children immediately to prevent hydration mismatch
-  // The useRoleGuard hook handles redirects via side effects
+  const { ready } = useRoleGuard(minRole);
+  // Block rendering until role is confirmed to prevent flicker
+  // of protected content before redirect
+  if (!ready) return <div className="flex h-screen w-full items-center justify-center" />;
   return <>{children}</>;
 }

{observal_cli-1.2.0 → observal_cli-1.2.1}/web/src/lib/api.ts

@@ -1,3 +1,4 @@
+
 // SPDX-FileCopyrightText: 2026 Aryan Iyappan <aryaniyappan2006@gmail.com>
 // SPDX-FileCopyrightText: 2026 Harishankar <harishankar0301@gmail.com>
 // SPDX-FileCopyrightText: 2026 Hari Srinivasan <harisrini21@gmail.com>
@@ -263,7 +264,10 @@ async function request<T = unknown>(
 						: JSON.stringify(parsed.error);
 			}
 		} catch {
-			// not JSON, use raw text
+			// not JSON, use raw text unless it's HTML or a 5xx error
+			if (response.status >= 500 || text.trim().startsWith("<")) {
+				detail = "Unable to reach the server. Please try again later.";
+			}
 		}
 		const err = new Error(detail);
 		(err as Error & { status: number }).status = response.status;