makelore/.project-docs/30-worklog/tasks/20260819-makelore-native-login-1f3a9c.md

Task: Implement Makelore native password and SMS login

Identity

• Task ID: 20260819-makelore-native-login-1f3a9c
• Mode: Feature
• Branch: codex/20260819-makelore-native-login-1f3a9c-makelore-native-login
• Worktree: D:\w\makelore-native-login-1f3a9c
• Base commit: abece81fdb
• Owner: codex-root
• Status: Ready for integration

Scope

• Replace the renderer-triggered browser authorization flow with native password and SMS-code login that uses the existing Works Square authentication facade.
• Preserve Main-owned session persistence, runtime cleanup, token refresh, logout, and module-access projection behavior.
• Add focused Main, store, and login-page regression coverage; keep README's current-product description aligned with the new login surface.

Intent And Constraints

• Renderer must use the existing Host API abstraction and never receive a refresh token or call Works Square directly.
• Password and SMS initial login must go through Works Square /api/auth/*, so server-owned OAuth credentials, encryption, and SMS client configuration remain server-side.
• Retain the existing fail-closed cross-account runtime cleanup before a new login; do not weaken the seven-day inactivity/session ownership model.
• Do not change the established Main refresh/logout protocol until the OneFeel-facing Works Square proxy contract has been separately verified.
• Browser authorization routes may be retired only after code search confirms there is no remaining client dependency; Works Square desktop broker APIs are outside this task.

Plan

1. Replace Main's legacy direct OneFeel password flow with bounded proxies for password login, captcha image, SMS send, and SMS login, committing the managed session through the existing session service.
2. Replace the Renderer browser-login action with password and SMS actions that consume only the safe Host API response and retain module-access hydration semantics.
3. Replace the browser-login page with the Web-aligned password/SMS tabs, agreement gate, captcha lifecycle, SMS cooldown, safe error display, and controlled help links.
4. Run focused tests, typecheck, lint/build, a final independent review, and task-scoped documentation checks.

Outcome

• Replaced the retired browser-authorization entry point with native password and SMS-code login in the Makelore client.
• The Renderer now uses only Host API routes. Main proxies initial-login, captcha, SMS, and public-link requests through Works Square, commits the refresh token only to Main-owned secure persistence, and returns only the safe token/session projection to the Renderer.
• Preserved the existing managed-runtime cleanup, module-access hydration, refresh, logout, and seven-day inactivity behaviors. The Main refresh/logout transport remains on its existing direct protocol pending separately verified Works Square lifecycle proxy support.
• Retired the local browser-start route and UI. The native page implements password/SMS tabs, agreement and configured help links, UUID/no-store PNG captcha handling, stale-response rejection, fresh captcha on every SMS-tab entry, SMS cooldown, and model-config synchronization rollback on failure.
• Removed the Renderer-controlled logout gateway after independent review found that it could leak the Main-held bearer token. Logout now accepts only an access-token field and always targets the configured trusted gateway.
• Produced the requested local Windows x64 installer from this native-login worktree: release\\Makelore-2.0.0-win-x64.exe. It is intentionally unsigned and unpublished; no workstation release credential was included.
• The package includes a validated local OpenMAIC learner-player artifact built in a separate disposable worktree at commit 58d1ddc2644f4c8631d62eb0e5423365af95ef66. Its HTML checksum is 748d6d7c74d9d0ba444e0c051a50010f7070e7d6e46442b1e60f1e2be80fd020.
• GitHub repeatedly timed out while fetching the pinned uv 0.10.0 archive. The local package therefore uses an already installed, version-verified Windows uv 0.10.9; the resulting runtime was checked in the package verifier and this is not a formal release substitute.

Verification

• pnpm exec vitest run --reporter=dot — passed: 183 files, 2,177 tests.
• Focused login/session suite — passed: 5 files, 95 tests.
• pnpm run typecheck — passed.
• pnpm run lint:check — passed with 7 pre-existing warnings and no errors.
• pnpm run build:vite — passed (existing chunk-size and mixed-import notices only).
• node ./node_modules/@playwright/test/cli.js test app-smoke.spec.ts --grep "can skip setup and open the native login surface" --reporter=line — passed: 1 desktop Electron smoke test.
• Independent final review — PASS after the logout-target security fix; reviewer traced Renderer-to-Works login/session/logout flows and verified the attacker-controlled authBase regression.
• git diff --check — passed.
• pnpm run package:stage:win-x64 with MAKELORE_LEARNING_PLAYER_ARTIFACT set to the isolated artifact — passed; Makelore accepted and copied the verified player resource.
• node scripts/run-electron-builder.mjs --win --publish never — passed and produced release\\Makelore-2.0.0-win-x64.exe.
• pnpm run verify:artifact:win -- --allow-dirty --installer release\\Makelore-2.0.0-win-x64.exe — passed. It verified Electron 43.4.0, Node 24.18.1, OpenCode 1.18.9, Python, uv 0.10.9, npm 11.6.2, the bundled player, and required native modules.
• Installer SHA-256: EFA94BAED02A89A2BFCD8BB74B1B914C481419FBD10302D4606EDC5183ED67B7 (302,496,674 bytes / 288.48 MiB). Authenticode status: NotSigned.

Follow-ups

• Before release, perform a staging/production smoke test using real password and SMS login: captcha load/refresh, SMS send/cooldown, login, /me, app restart/session refresh, logout, and all configured legal/recovery links.
• Verify and then migrate Main refresh/logout traffic to a Works Square proxy only after the OneFeel lifecycle contract is confirmed. Do not alter the current direct Main-owned path speculatively.
• Retire the legacy Works Square /api/auth/desktop/* broker only in a separately planned compatibility window for older desktop clients.
• A signed or published release must rebuild using the release-controlled pinned uv input and a retained/versioned OpenMAIC player artifact, then pass the normal signing, provenance, and production smoke-test gates.

Promotion Candidates

• No canonical project-document promotion is needed. The current product boundary is reflected in README; the full Works Square refresh/logout proxy decision remains pending protocol evidence.