Enable password manager autofill for admin tokens - #873

sequenceDiagram
  participant ApiAuthFetch
  participant requestAdminToken
  participant verifyAdminToken
  participant promptForAdminToken
  participant BrowserForm
  ApiAuthFetch->>requestAdminToken: receive unauthorized response
  requestAdminToken->>promptForAdminToken: request admin token
  promptForAdminToken->>BrowserForm: show localized password form
  BrowserForm-->>promptForAdminToken: submit token or cancel
  promptForAdminToken->>verifyAdminToken: verify submitted token
  verifyAdminToken-->>promptForAdminToken: accepted, rejected, or unavailable
  promptForAdminToken-->>requestAdminToken: return token or null
  requestAdminToken-->>ApiAuthFetch: retry authenticated request

_{Comment @coderabbitai help to get the list of available commands.}

[shipping-github] Verdict: approve-comment

PR: #873 - Enable password manager autofill for admin tokens
Head: 2411b18a on dev (mergeStateStatus: CLEAN)

Semantic propagation

• Concepts audited: admin-token entry flow (prompt primitive), management-auth verification, active-locale handoff, dashboard docs contract
• Authoritative sources: src/server/management-auth.ts requireManagementAuth (401/503 semantics), src/server/auth-cors.ts (token source), gui/src/i18n/en.ts (TKey source of truth)
• Producers and consumers checked: gui/src/api.ts 401 gate -> promptForAdminToken -> verifyAdminToken (/api/settings) -> storeToken/retry; CLI header consumers (cli/opencode.ts, cli/login-cli.ts) unaffected
• Public/derived representations checked: X-OpenCodex-API-Key header contract; docs-site web-dashboard.md (en/ja/ko/ru/zh-cn); reference/management-api.md still accurate (server unchanged)
• Material variant partitions checked: loopback GUI session vs raw admin token; 401 vs 503 vs network failure; six GUI locales; environment vs file token source
• Positive and negative assertions checked: accepted/rejected/whitespace/cancel/locale dialog tests; memory-only, cross-origin and concurrent-401 API tests; privacy scan
• Unmapped surfaces: none
• Unproven equivalence assumptions: none
• Representation mismatches: none
• Variant coverage gaps: the dialog unavailable branch (network error / 503) has no direct unit test; branch is trivial and fail-safe (keeps the form open). Non-blocking
• Axis verdict: pass

Linked: none

Usefulness

Real UX gap: window.prompt() exposes no username/password fields or autocomplete metadata, so password managers cannot save or autofill the admin token on remote dashboards. The new dialog (gui/src/admin-token-dialog.ts) exposes stable username + current-password fields with autocomplete attributes, and the earlier Codex review feedback (keep the form open until verified; use the active UI locale) is implemented in 2411b18a.

Bugs / correctness

• Method: bug-review.md - Bugbot: n/a (Codex host) - complementary lenses: done (silent_failures, resource_leaks, edge_cases, error propagation, cancellation, races)
• Findings: none blocking. Residual Low: the verification request has no timeout/abort; a hung /api/settings keeps the submit disabled until the user cancels (cancel works and restores focus). Not a regression versus the old prompt
• Fixed this session: none (review-only run)

Security

• Scope reviewed: authn, authz, secrets/config, SSRF/outbound, removed controls (scope: full)
• Findings: none confirmed. The token stays module-memory only (memoryToken); the dialog builds DOM via textContent (no HTML injection); verification is a same-origin authenticated GET with cache: no-store; a 401 keeps the form open (no fail-open); no new storage writes; bun run privacy:scan green
• Fixed this session: none

Spec / standards

• Spec source: PR body (no linked issue). Claimed items all implemented: sign-in form, memory-only token, shared 401 gate, cancellation + focus restoration, localized copy (all six locales), regression tests, docs in all five doc locales
• Standards: gui/AGENTS.md i18n rules satisfied (visible strings via DICTS; ADMIN_TOKEN_USERNAME is an allowed product-name literal); bun run lint:i18n green; no changelog practice in this repo

Reviews

• Owners/maintainers: no open human threads
• Bots (CodeRabbit / Codex): 5/5 threads resolved or acknowledged in 2411b18a (keep-open + token validation, active-locale handoff, localized labels, whitespace test, translated docs); 0 unresolved

Base / CI

• Behind/conflicts: clean (mergeStateStatus: CLEAN, head 2411b18a)
• Required checks: green on head - ubuntu, windows (17m32s), macos, npm-global x3, react-doctor, enforce-target, label, CodeRabbit
• Local tip compile/tests: bun x tsc --noEmit pass; cd gui && bun test tests 492 pass; GUI lint, lint:i18n, GUI build, docs-site build, privacy:scan all pass; the full bun test --isolate tests suite is green in the CI matrix

Gate

none (not draft, no WIP/do-not-merge)

Bottom line

Useful and clean: the dialog replaces the prompt primitive with a standard sign-in form while preserving the shared 401 gate and memory-only token handling; all bot feedback is addressed, required CI is green on the reviewed head, and the authoritative ship gate returns ready. Verdict only - no approval or merge performed by this run.

Thanks @mincia1110 - merging this.

Why it helps: remote dashboards can now sign in with a real password form instead of window.prompt(), so browser password managers can save and autofill the admin token. The dialog verifies the token with a safe read before closing, keeps it memory-only, and the sign-in flow is documented in every dashboard guide locale.