4 Commits

Include renames

Author	SHA1	Message	Date
shad	300024964f	fix(login): persona click signs in directly + friendly error copy (#3)	2026-06-14 21:26:01 +00:00
shad	1cfd787179	test(api): add 401-retry fail-closed regression ... Oracle round-5 PASS verdict was non-blocking on this. Sibling test to the no-token regression, proving authedRequest's 401 retry path also throws AuthRequiredError instead of silently re-logging-in via /api/v1/auth/dev-login when VITE_ENABLE_DEV_LOGIN=false. 31/31 unit tests green.	2026-06-14 13:42:29 +04:00
shad	5acdde3e27	fix(api): close second silent dev-login path in authedRequest ... Oracle round-4 finding: authedRequest() called the private login() helper whenever no bearer token existed AND on 401 retry. That helper posts to /api/v1/auth/dev-login, so any authenticated API call could silently issue dev-login regardless of UI gating. - authedRequest checks devLoginAllowed() (VITE_ENABLE_DEV_LOGIN !== 'false') before calling login(). When dev-login is disabled it throws AuthRequiredError instead. - 401 retry path gated the same way. - New AuthRequiredError exported so callers (store, scenes) can route unauthenticated users to the login page instead of swallowing. - src/lib/api.test.ts: regression test 'throws AuthRequiredError instead of silently calling /dev-login when no token'. With VITE_ENABLE_DEV_LOGIN=false api.me() rejects with /Sign in required/ and no POST to /dev-login is observed. 30/30 unit tests green.	2026-06-14 13:39:03 +04:00
shad	3ffd0e68a7	Mission Control demo v2 ... Polished command-center for FlowMaster with two data modes: - SNAPSHOT: bundled src/scenarios.json from demo.flow-master.ai - LIVE: in-browser fetch via src/lib/api.ts (dev-login + bearer) Scenarios: - procurement, extra-1, extra-2 (live from EA2) - ar, hcm, gl, service (industry blueprints, same typed shell) Honesty pass after Oracle review: - No invented numbers (Telemetry derives SLA + agent acceptance from real data) - Preview-only actions fire toasts naming the endpoint to wire them - Blueprint tours framed as 'industry blueprint', not 'we don't have this yet' - Mode pill + last-fetch age + refresh in topbar - Dev CORS dodged via vite proxy; production deploys same-origin 18 vitest tests + 26 playwright smoke assertions + DOM layout audit. Constraint: cross-origin live mode rejected by browser → fall back to snapshot Rejected: hardcoded SLA % | dishonest demo metrics Directive: wire preview-only action handlers to /api/runtime/transactions/{id}/actions to ship them for real Confidence: high Scope-risk: narrow Not-tested: production deployment via flowmaster-ops overlay	2026-06-14 00:09:32 +04:00