fix(auth): route session lifecycle through Square

.project-docs/30-worklog/tasks/20260819-square-auth-proxy-client-8c4f2a.md

@@ -0,0 +1,57 @@
+# Task: Route Makelore auth lifecycle through Works Square
+
+## Identity
+
+- Task ID: 20260819-square-auth-proxy-client-8c4f2a
+- Mode: Feature
+- Branch: codex/20260819-square-auth-proxy-client-8c4f2a-square-auth-proxy-client
+- Worktree: D:\Datas\OthersProjects\makelore-square-auth-proxy-8c4f2a
+- Base commit: 1907924203a1a998182c8e44e8884682ef216d95
+- Owner: codex-root
+- Status: Ready for Integration
+
+## Scope
+
+- Route Works Square access-token refresh through `POST /api/auth/refresh` instead of calling the one-feel OAuth endpoint from Electron Main.
+- Route remote logout through `POST /api/auth/logout` on Works Square while preserving Main-owned session cleanup behavior.
+- Update focused session and auth-route regression tests, including rotated refresh-token persistence.
+
+## Intent And Constraints
+
+- Login, refresh, and logout must share the Works Square authentication boundary.
+- Do not embed the deployed `custom` OAuth client secret in Makelore.
+- Preserve Main ownership of tokens, the seven-day inactivity policy, refresh single-flight behavior, fail-closed persistence semantics, and local runtime cleanup.
+- Do not change unrelated browser/OAuth-provider integrations.
+
+## Outcome
+
+- Electron Main now refreshes managed Works Square sessions with `POST https://square.nianxx.cn/api/auth/refresh` and a JSON refresh-token payload. It no longer sends an OAuth Basic credential or calls the one-feel token endpoint directly.
+- Main-owned logout now calls `POST https://square.nianxx.cn/api/auth/logout` with the current Main access token, while retaining the existing local session, secure persistence, event-session, provider-key, and runtime cleanup behavior.
+- Removed the now-unused Electron auth configuration module that embedded the legacy `app` client secret and password encryption key.
+- Preserved refresh-token rotation, single-flight behavior, terminal 400/401 clearing, transient-error retention, and persistence-before-return semantics.
+
+## Verification
+
+- Red phase: focused tests failed in five expected places because refresh and logout still targeted `biz.nianxx.cn` with the legacy method/credential contract.
+- `pnpm exec vitest run tests/unit/works-square-session.test.ts tests/unit/auth-routes.test.ts`: 56 passed.
+- Focused session/auth compatibility suite: 86 passed across five test files.
+- Full `pnpm exec vitest run`: 184 test files and 2190 tests passed.
+- `pnpm run typecheck`: passed.
+- `pnpm run lint:check`: passed with 0 errors and 7 pre-existing React warnings in unrelated files.
+- `pnpm run build:vite`: passed for Renderer, Electron Main, preload, and utility worker.
+- Full `pnpm run build` stopped before compilation because the required Learning Player artifact/source was not supplied; the subsequent direct Vite production build passed.
+- `git diff --check`: passed. Source scan found no direct one-feel refresh/logout URL, Basic auth header, embedded client secret, or deleted auth-config import under `electron/`.
+
+## Follow-ups
+
+- Deploy the Works Square refresh/logout endpoints before distributing a Makelore build containing this client change.
+- Supply the separately managed Learning Player artifact when producing the final packaged installer.
+
+## Promotion Candidates
+
+- Target canonical document: `.project-docs/20-architecture/data-flow.md` and the authentication decision index.
+  Proposal: record Works Square as the required boundary for the complete desktop authentication lifecycle (login, refresh, and logout), with confidential OAuth clients owned only by Works Square.
+  Evidence: focused request-contract tests, full 2190-test client suite, typecheck, lint, and production Vite build.
+  Future impact: new desktop authentication operations must be added to Square rather than embedding service credentials or direct one-feel calls in Makelore.
+  Semantic conflicts: none; this completes the proxy work explicitly deferred by the integrated native-login task.
+  Human confirmation required: no; the user explicitly selected the unified Square boundary.