Optional sign-in client: pan account, Settings → Anywhere, and "Continue from another machine" #4330

Design: .pan/drafts/anywhere-accounts.md §6.4, §6.9, §6.10

Part of PAN-2350 (#2350). Depends on: PAN-4293 (#4293) in tester mode, PAN-4297 (#4297).

Problem

PAN-4293 builds the overdeck.ai account service and PAN-4297 builds the hosted vault. Neither covers the client: how a user signs in from npx @overdeck/core (dashboard) or from a terminal (standalone), where the device token lives, and the first-run path "Continue from another machine". Without this, the operator's scenario (sign in on a second machine and see and continue the other machine's conversations) has no entry point.

Design

• Sign in:
  • Dashboard: PKCE with a loopback redirect to the local dashboard's /api/account/callback; the server exchanges the code.
  • CLI and headless: RFC 8628 device authorization served by overdeck.ai (overdeck.ai/activate + code).
  • The device token is stored at ${OVERDECK_HOME}/account.json (0600), server-side only; never in browser storage or the frontend bundle.
• Device registration: send environmentId and platform once. The server mints deviceId. The label defaults to "<OS> device", not the hostname.
• Unlock: if the account already has a vault, show "Enter your vault passphrase" (PAN-4328, Session Vault: optional passphrase unlock so a new machine needs no 24 words #4328) or the recovery phrase; never offer "create".
• Machine list: join the account's devices (the authority for revocation) with the vault's encrypted machine records (the authority for existence and last-synced time) on deviceId.
• Surfaces:
  • Home "Get set up" card item "Use your conversations on other machines".
  • A first-run card "Continue from another machine" beside "Use a git remote instead"; dismissible for good.
  • Settings → Anywhere: account, machines, revoke, passphrase, backend.
• CLI: pan account login [--device-code] | status | logout | devices | revoke <deviceId>, and pan vault setup --hosted. Logout removes the device token and never the vault key.
• Invariants:
  • No surface blocks local use; nothing prompts for sign-in unprompted after dismissal.
  • The account never receives K, the passphrase or plaintext.

Work items

1. src/lib/account/ (token store, PKCE, device-code client, me/devices API client). Imports only Node built-ins, so the standalone CLI stays light (PAN-2609 NFR-7).
2. Dashboard routes /api/account/*, each with a no-loss-matrix row; frontend Settings → Anywhere and the first-run card.
3. pan account verbs with wrapper skill; pan vault setup --hosted.
4. Tests: the PKCE state mismatch is rejected; the device-code poll respects slow_down (fake timers); the token file mode is 0600; logout keeps vault/key; the frontend never receives the token (route test); Playwright screenshots of the first-run card and Settings → Anywhere, inspected.

Acceptance criteria

• Given a fresh OVERDECK_HOME and an allowlisted GitHub account, when the user clicks "Continue from another machine", signs in, and enters the vault passphrase, then the machine list shows the other machine with its last-synced time, and its conversations appear as browse copies.
• Given a non-allowlisted GitHub account, sign-in ends with the invite-only message and a link to the git-remote path; local features are unaffected.
• pan account login --device-code works over SSH with no browser on the machine.
• After pan account revoke <deviceId> from another machine, the revoked machine's next sync fails with "this device was revoked" within one sync interval, and its local data is untouched.
• With the first-run card dismissed, no sign-in prompt appears again on that machine.

Docs

New configuration/anywhere-sign-in.mdx: optional sign-in, what the account holds, what it never holds, and revocation limits (a revoked device already knows K; key rotation is PAN-4333, #4333). Link it from anywhere.mdx.