[mehfuzh]

Problem

docent's /login (and the desktop app) open /login?mode=desktop&port=…. Desktop mode always showed the sign-in form, even when the browser was already signed in to the dashboard: only the access token was kept, and the local agent needs a refresh token as well.

Change

• Keep the refresh token in localStorage beside token at sign-in (email code, Google). Apple returns none, so nothing is kept for it.
• In desktop mode, if a refresh token is stored, exchange it at /auth/jwt/refresh for a fresh pair and post it to the agent's /v1/auth/callback, landing on /redirect?mode=desktop, with no form. With no stored token, or a refused one, the form shows as before.
• Logout (account menu, userService.logout) and a failed code entry clear the refresh token.
• The hand-off to the agent, duplicated in the login and OAuth callback pages, moves to src/app/shared/desktop.ts.

Notes

• Sessions from before this change have no refresh token, so they see the form once more.
• tsc --noEmit passes; not yet exercised in a browser.

Test plan

• Sign in on the dashboard, then /login in docent → no form, docent reports signed in
• Log out on the dashboard, then /login → form shows
• Safari: hand-off falls back to the GET callback

🤖 Generated with Claude Code