feat(auth): direct-connect via JWT in Fabric Connect mode (+ fix #1333)

[dawsontoth]

What & why

#1398 — direct-connect via JWT. Instead of routing every operation through the Fabric Connect proxy, Studio now:

1. Mints a JWT (+ refresh token) via the proxy (create_authentication_tokens, the op harper login uses).
2. Talks to the instance directly with Authorization: Bearer <jwt>.
3. Holds the tokens in memory only — re-fetched via the proxy after a reload.
4. Falls back to full proxy mode when direct connect isn't reachable (CORS / mixed-content / Safari-cloud-to-local). Because the JWT is a header (not a cookie), this also sidesteps the Safari cross-localhost cookie limitation.
5. Recovers from mid-session token expiry: a 401 on a direct request exchanges the refresh token for a new operation token directly at the instance (refresh_operation_token, no proxy round-trip), falling back to a fresh proxy mint, then replays the request once.

Harper 5.1.14 has no token→cookie login, so the issue's "drop the JWT, keep only an httpOnly cookie" ideal would need a coordinated Harper server change. This implements the in-memory-JWT variant, structured so a future cookie swap stays localized.

#1333 — Direct Sign In no longer falls back to Fabric Connect too aggressively. The cluster sign-in guard read the context.authentication router snapshot, which lags the live authStore (listeners notify asynchronously); right after "Direct Sign In" cleared the connection, the snapshot still showed the old user → bounced off the form → auto-Fabric-Connected. Both sign-in guards now read live authStore state, and the sign-in page resets the connected user (not just the flag) so an abandoned sign-in isn't mislabeled as "Direct Connect".

Adversarial review

Ran a multi-agent adversarial review (6 lenses → skeptic verification); 15 confirmed findings, all addressed. Highlights:

• HIGH: reset-password / Finish Setup broke in the Fabric Connect fallback (stale client) — the fallback now returns a client rebuilt from the established auth.
• MED: sign-in page cleared the user inside a render-phase useMemo keyed on the 10s-polled cluster object (could wipe a just-signed-in user) — moved to a once-per-id effect.
• Security (low): never send the Bearer JWT to the central-manager origin (only go direct with a concrete direct URL, and reject proxy-looking URLs via isDirectOperationsUrl); stop logging the raw axios error (carried the token in error.config.headers).
• The establish probe forces the token so a stale basic-auth entry can't shadow it; the instance sign-in guard keys off the instance's own state; no double-establish in one beforeLoad pass.

Both automated (Gemini) review threads were addressed and resolved.

Tests

~40 new tests: routing precedence (Bearer/proxy/basic/cookie/disableFabricConnect/cluster-proxy/forceOperationToken), establish direct/proxy-fallback/no-direct-URL/proxy-URL-guard/both-fail-cleanup/in-flight-dedupe, token recovery (refresh / proxy re-mint / both-fail / non-direct / dedupe) and the 401 interceptor (replay-once / no-token / non-401 / loop-guard), logout token cleanup, sign-in guards (live-state race + cluster-flag case + redirect target), and route-guard orchestration. Full suite green (1035 passing).

Verification & risk

Verified via typecheck + unit tests. Not browser-verified (needs a live cluster + Fabric Connect session). Main runtime assumption to confirm against a real cluster: the central-manager proxy forwards create_authentication_tokens / refresh_operation_token and returns the tokens. If an op allowlist excludes them, step 1 fails and we silently fall back to proxy mode (functional, just not the new direct path).

Fixes #1333
Refs #1398

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request introduces an in-memory Fabric Connect JWT authentication mechanism to allow direct Bearer token connections to instances, falling back to proxy routing if the direct connection is unreachable. It updates getInstanceClient to handle the token, integrates automatic connection establishment in instanceLayoutRoute, and adds corresponding unit tests. Feedback highlights two improvement opportunities: first, validating that the direct URL is defined and is not a proxy URL before attempting a direct connection to prevent redundant failures and security risks; second, tracking connection attempts in the route loader to avoid duplicate, expensive network requests when an instance is unreachable.