feat: add native password and sms login

.project-docs/30-worklog/tasks/20260819-makelore-native-login-1f3a9c.md

@@ -0,0 +1,128 @@
+# Task: Implement Makelore native password and SMS login
+
+## Identity
+
+- Task ID: 20260819-makelore-native-login-1f3a9c
+- Mode: Feature
+- Branch: codex/20260819-makelore-native-login-1f3a9c-makelore-native-login
+- Worktree: D:\w\makelore-native-login-1f3a9c
+- Base commit: abece81fdb178711d4dcbe1f87b987f54d71d6dd
+- Owner: codex-root
+- Status: Ready for integration
+
+## Scope
+
+- Replace the renderer-triggered browser authorization flow with native password
+  and SMS-code login that uses the existing Works Square authentication facade.
+- Preserve Main-owned session persistence, runtime cleanup, token refresh,
+  logout, and module-access projection behavior.
+- Add focused Main, store, and login-page regression coverage; keep README's
+  current-product description aligned with the new login surface.
+
+## Intent And Constraints
+
+- Renderer must use the existing Host API abstraction and never receive a
+  refresh token or call Works Square directly.
+- Password and SMS initial login must go through Works Square `/api/auth/*`,
+  so server-owned OAuth credentials, encryption, and SMS client configuration
+  remain server-side.
+- Retain the existing fail-closed cross-account runtime cleanup before a new
+  login; do not weaken the seven-day inactivity/session ownership model.
+- Do not change the established Main refresh/logout protocol until the
+  OneFeel-facing Works Square proxy contract has been separately verified.
+- Browser authorization routes may be retired only after code search confirms
+  there is no remaining client dependency; Works Square desktop broker APIs
+  are outside this task.
+
+## Plan
+
+1. Replace Main's legacy direct OneFeel password flow with bounded proxies for
+   password login, captcha image, SMS send, and SMS login, committing the
+   managed session through the existing session service.
+2. Replace the Renderer browser-login action with password and SMS actions
+   that consume only the safe Host API response and retain module-access
+   hydration semantics.
+3. Replace the browser-login page with the Web-aligned password/SMS tabs,
+   agreement gate, captcha lifecycle, SMS cooldown, safe error display, and
+   controlled help links.
+4. Run focused tests, typecheck, lint/build, a final independent review, and
+   task-scoped documentation checks.
+
+## Outcome
+
+- Replaced the retired browser-authorization entry point with native password
+  and SMS-code login in the Makelore client.
+- The Renderer now uses only Host API routes. Main proxies initial-login,
+  captcha, SMS, and public-link requests through Works Square, commits the
+  refresh token only to Main-owned secure persistence, and returns only the
+  safe token/session projection to the Renderer.
+- Preserved the existing managed-runtime cleanup, module-access hydration,
+  refresh, logout, and seven-day inactivity behaviors. The Main refresh/logout
+  transport remains on its existing direct protocol pending separately verified
+  Works Square lifecycle proxy support.
+- Retired the local browser-start route and UI. The native page implements
+  password/SMS tabs, agreement and configured help links, UUID/no-store PNG
+  captcha handling, stale-response rejection, fresh captcha on every SMS-tab
+  entry, SMS cooldown, and model-config synchronization rollback on failure.
+- Removed the Renderer-controlled logout gateway after independent review found
+  that it could leak the Main-held bearer token. Logout now accepts only an
+  access-token field and always targets the configured trusted gateway.
+- Produced the requested local Windows x64 installer from this native-login
+  worktree: `release\\Makelore-2.0.0-win-x64.exe`. It is intentionally
+  unsigned and unpublished; no workstation release credential was included.
+- The package includes a validated local OpenMAIC learner-player artifact built
+  in a separate disposable worktree at commit
+  `58d1ddc2644f4c8631d62eb0e5423365af95ef66`. Its HTML checksum is
+  `748d6d7c74d9d0ba444e0c051a50010f7070e7d6e46442b1e60f1e2be80fd020`.
+- GitHub repeatedly timed out while fetching the pinned uv `0.10.0` archive.
+  The local package therefore uses an already installed, version-verified
+  Windows `uv 0.10.9`; the resulting runtime was checked in the package
+  verifier and this is not a formal release substitute.
+
+## Verification
+
+- `pnpm exec vitest run --reporter=dot` — passed: 183 files, 2,177 tests.
+- Focused login/session suite — passed: 5 files, 95 tests.
+- `pnpm run typecheck` — passed.
+- `pnpm run lint:check` — passed with 7 pre-existing warnings and no errors.
+- `pnpm run build:vite` — passed (existing chunk-size and mixed-import notices
+  only).
+- `node ./node_modules/@playwright/test/cli.js test app-smoke.spec.ts --grep
+  "can skip setup and open the native login surface" --reporter=line` — passed:
+  1 desktop Electron smoke test.
+- Independent final review — PASS after the logout-target security fix;
+  reviewer traced Renderer-to-Works login/session/logout flows and verified the
+  attacker-controlled `authBase` regression.
+- `git diff --check` — passed.
+- `pnpm run package:stage:win-x64` with
+  `MAKELORE_LEARNING_PLAYER_ARTIFACT` set to the isolated artifact — passed;
+  Makelore accepted and copied the verified player resource.
+- `node scripts/run-electron-builder.mjs --win --publish never` — passed and
+  produced `release\\Makelore-2.0.0-win-x64.exe`.
+- `pnpm run verify:artifact:win -- --allow-dirty --installer
+  release\\Makelore-2.0.0-win-x64.exe` — passed. It verified Electron 43.4.0,
+  Node 24.18.1, OpenCode 1.18.9, Python, uv 0.10.9, npm 11.6.2, the bundled
+  player, and required native modules.
+- Installer SHA-256:
+  `EFA94BAED02A89A2BFCD8BB74B1B914C481419FBD10302D4606EDC5183ED67B7`
+  (302,496,674 bytes / 288.48 MiB). Authenticode status: `NotSigned`.
+
+## Follow-ups
+
+- Before release, perform a staging/production smoke test using real password
+  and SMS login: captcha load/refresh, SMS send/cooldown, login, `/me`, app
+  restart/session refresh, logout, and all configured legal/recovery links.
+- Verify and then migrate Main refresh/logout traffic to a Works Square proxy
+  only after the OneFeel lifecycle contract is confirmed. Do not alter the
+  current direct Main-owned path speculatively.
+- Retire the legacy Works Square `/api/auth/desktop/*` broker only in a
+  separately planned compatibility window for older desktop clients.
+- A signed or published release must rebuild using the release-controlled
+  pinned uv input and a retained/versioned OpenMAIC player artifact, then pass
+  the normal signing, provenance, and production smoke-test gates.
+
+## Promotion Candidates
+
+- No canonical project-document promotion is needed. The current product
+  boundary is reflected in README; the full Works Square refresh/logout proxy
+  decision remains pending protocol evidence.