Lab #1900: dashboard device-login poll checks for an error code serve never sends, so all failures show as an endless spinner

Summary

The dashboard's OAuth device-login poll tests for an error code that swamp serve never sends. As a result no failure mode is ever displayed: expiry, user denial, admission refusal and upstream errors all render identically as an indefinite "Waiting for you to approve...".

Environment

swamp 20260828.202201.0-sha.2a5bcb89
swamp serve --auth-mode oauth --dashboard

The mismatch

packages/dashboard/src/views/Login.tsx:173-178:

if (data.token) {
  onToken(data.token);
} else if (data.error === "expired_token") {
  setError("Login expired. Please try again.");
  setState("error");
}
// every other response: silently ignored, keep polling

src/serve/device_auth_handler.ts emits these, and only these:

Condition	Response
pending	`202 {"status":"pending"}`
expired	`410 {"error":"Device code expired"}`
denied by user	`403 {"error":"Authorization denied by user"}`
not admitted	`403 {"error":"Not admitted","reason":...}`
upstream failure	`502 {"error":"Upstream provider returned an unexpected error"}`

"expired_token" is the OAuth error code from the upstream provider, which the handler translates before responding. The route in src/cli/commands/serve.ts:3734 passes the handler's response through unmodified, so the string the client checks for never appears on the wire.

The response status is also ignored — resp.ok is never consulted, so a 410, 403 or 502 is parsed as JSON and discarded exactly like a 202.

Impact

Every device-login failure looks identical to "still waiting". In particular a user who is authenticated but outside --allowed-collectives gets 403 Not admitted — the one message that would tell them exactly what is wrong — and sees a spinner instead, indefinitely.

This was hit in practice while diagnosing a server-side crash: the server was aborting mid-flow and the dashboard reported nothing at all, which made the crash considerably harder to find.

Suggested fix

Branch on the HTTP status rather than an error string, and surface data.error / data.reason verbatim. Something like:

202 → keep polling
403 → show data.error plus data.reason when present (terminal)
410 → "Login expired, please try again" (terminal)
5xx → show the error and offer retry (terminal)

Continuing to poll should be the explicitly-handled case, not the default for everything unrecognised.

s3-datastore: every fast-path miss re-downloads every _index shard, so a busy serve pulls the whole index every poll (~230 GB/day S3 egress)

studio: no favicon — /favicon.ico 404s and the page declares no icon

Expose run provenance (definitionHash, modelVersion, triggeredBy) in method-summary reports or the extension context

swamp serve: remote 'model method history get|logs' cannot find a run that remote 'history search' lists

s3-datastore: pull never removes files deleted on the remote, so a peer's next push re-uploads them and undoes `swamp data gc`

@swamp/digitalocean/space-key: update and sync call /v2/spaces/keys/undefined

model method run holds the per-model lock across the datastore pull, so a 40ms method holds it ~70s and any concurrent call hits the 60s LOCK_TIMEOUT

Supported vault-write API for extension model methods (per-instance vault target)

serve still panics on successful OAuth device-flow completion after #1899 fix (200 branch only)

swamp serve panics on successful OAuth device-flow completion (Deno HTTP invariant)

dashboard device-login poll checks for an error code serve never sends, so all failures show as an endless spinner

serve dashboard hardcodes swamp-club.com in OAuth login, ignoring --oauth-provider

CEL expressions have timestamp/duration but no current-time value, so no guard can express "older than N"

Add a :micdrop: emoji / reaction shortcode (swamp-native art included)

migrate-index still drops shallow-path entries on 2026.08.07.1 — #1584 marked shipped but no released version carries the fix (self-contained repro)

migrate-index silently drops entries with shallow paths — all of workflows-evaluated/ and any root-level file

swamp serve writes outputs/ outside the bound namespace — silently never persisted to the remote datastore

s3-datastore: bulk pull writes to cache root instead of the namespace, wedging push and arming a full-datastore delete

Reusable long-lived invite link: one URL to bring people into the swamp

access token mint prints an invalid retrieval command (vault get, not vault read-secret)

s3-datastore: bidirectional sync pull writes namespace-stripped copies to cache root, wedging push with no supported recovery

Scaleway models: create methods should not require the resource ID they generate (ipId/gatewayId/serverId/...)

Surface cloud-provider labels (scaleway, digitalocean, oracle/oci) as first-class search/filter facets on the Extensions page

Profile link in genesis subdirectory does not navigate back to main profile

Add a command to re-trigger repository verification (repositoryVerified)

Quests can be farmed by repeating the same command in a loop

#welcome channel references "System Initiative" instead of "Swamp"

remote-execution.md tutorial claims hello-world repo already has a vault configured, but it doesn't

Relationships

#1900 dashboard device-login poll checks for an error code serve never sends, so all failures show as an endless spinner