[miguel-heygen]

What

The page the browser lands on after hyperframes login now follows the HyperFrames sign-in design: the corner mark and name, a check or cross tile, a left-aligned heading, a dark panel with the big mark (a green check on it when connected), paper or night from the system setting, stacked on a phone. It was a small dark card with a green or red title.

Why

The last step of sign-in looked unlike the rest of it, and every failure said "Sign-in failed", including a person pressing Cancel. A Cancel is not a failure, and a server problem is not the person's doing.

How

• New auth/callbackPage.ts builds the three pages; loopback.ts picks one: "You're connected" on success, "Not authorized" only when the authorize endpoint returned access_denied, and "Couldn't connect" with the error code and description for any other error, a state mismatch or a missing code.
• A timeout returns no page: nothing reaches the browser, as before.
• The page is one self-contained string: no script, no font or image request (the mark is inline SVG, the font the system's).

Test plan

fails without the fix: loopback.test.ts "says Not authorized only when the person pressed Cancel" and "says Couldn't connect, with the code, for a failure that is not a Cancel" (the old page said "Sign-in failed" for both).

• Unit tests added/updated: the success test reads the new title; two new tests for the Cancel and the other-failure pages. loopback.test.ts: 10 passed on a remote machine before the last formatting commit.
• Manual testing performed: rendered the three pages this code returns in a headless browser, paper and night, 1440 and 390 wide (frames below). Not run: a real hyperframes login against the live service.
• Documentation updated (if applicable): no docs describe this page.
• Comments follow CONTRIBUTING.md "Comments".

UX/Screenshot recording

Wide: Allow, Cancel, other failure; paper above and night below. Phone at 390 below that.

[miguel-heygen]

Re-ran loopback.test.ts on the final head (13c0b5b): 10 passed.

[heygengenesis]

Verdict: APPROVE · 0 blocker · 0 important · 1 nit · head 13c0b5bb

I re-ran the fails-without-fix check locally. With main's loopback.ts, the two named tests fail, plus the updated success test (3 failed, 7 passed). At head, 10 pass. Every value that comes from the query (error, error_description) still goes through escapeHtml before it reaches the page. The page still uses only an inline <style>, with no script or outside request, the same as the page it replaces.

• nit: callbackPage.ts:42 exports escapeHtml but nothing outside the file uses it, and the a.btn rule in STYLE matches no element on any of the three pages.

Scope

I read all 3 files in full. I checked that the response headers in respond are unchanged (no CSP to conflict with the inline style), and that the SVG gradient ids are unique per page. I grepped for other places that assert the old "Signed in" / "Sign-in failed" page text: only CLI console strings and comments mention them. CI was still running when I reviewed (no failures so far). I didn't check the visual design against the design source myself; I relied on the PR's screenshots for that.

[heygengenesis]

Verdict: APPROVE · 0 blocker · 0 important · 0 nits — 1 resolved, 0 open, 0 new · 13c0b5bb → 2f2f6248

✅ escapeHtml is no longer exported and the a.btn rule is gone. Folding the Cancel / other-failure pages into failurePage keeps the same branch on access_denied, so each of the three endings gets the same page as before. At head, loopback.test.ts passes (10). CI was still running when I reviewed.