Remove orphaned react-qr-code entries from lockfile

bun.lock was out of date with package.json (react-qr-code was removed
without reinstalling), failing the frozen-lockfile install in CI.

app/src/components/ServerTab/CloudSection.tsx

@@ -33,6 +33,22 @@ export function CloudSection() {
     }
   }, [connected, polling, status?.device_name, toast]);
 
+  // Give up after two minutes so an abandoned browser flow doesn't leave the
+  // button stuck on "Waiting for browser…". The backend state stays valid for
+  // ten, so the user can simply start again.
+  useEffect(() => {
+    if (!polling) return;
+    const timeoutId = window.setTimeout(() => {
+      setPolling(false);
+      toast({
+        title: 'Sign-in timed out',
+        description: 'The browser sign-in was not completed. Try again.',
+        variant: 'destructive',
+      });
+    }, 120_000);
+    return () => window.clearTimeout(timeoutId);
+  }, [polling, toast]);
+
   const startLogin = useMutation({
     mutationFn: () => apiClient.startCloudLogin(),
     onSuccess: () => {
@@ -56,7 +72,8 @@ export function CloudSection() {
       queryClient.invalidateQueries({ queryKey: ['cloud-status'] });
       toast({
         title: 'Disconnected',
-        description: 'This device is no longer linked. The key stays valid until revoked in your account.',
+        description:
+          'This device is no longer linked. The key stays valid until revoked in your account.',
       });
     },
     onError: (error: Error) =>
@@ -88,7 +105,10 @@ export function CloudSection() {
               variant="outline"
             >
               {disconnect.isPending ? (
-                <Loader2 className="h-3.5 w-3.5 animate-spin" />
+                <>
+                  <Loader2 className="h-3.5 w-3.5 mr-1.5 animate-spin" />
+                  Disconnecting…
+                </>
               ) : (
                 'Disconnect'
               )}
@@ -118,7 +138,7 @@ export function CloudSection() {
         >
           <a
             className="text-sm text-accent hover:underline"
-            href="https://voicebox.sh/account"
+            href={status?.dashboard_url ?? 'https://voicebox.sh/account'}
             rel="noopener noreferrer"
             target="_blank"
           >

app/src/lib/api/types.ts

@@ -534,4 +534,5 @@ export interface CloudStatus {
   account_user_id: string | null;
   key_prefix: string | null;
   connected_at: string | null;
+  dashboard_url: string;
 }

backend/models.py

@@ -813,3 +813,4 @@ class CloudStatusResponse(BaseModel):
     account_user_id: Optional[str] = None
     key_prefix: Optional[str] = None
     connected_at: Optional[datetime] = None
+    dashboard_url: str

backend/services/cloud.py

@@ -19,6 +19,7 @@ import webbrowser
 from urllib.parse import urlencode
 
 import httpx
+from sqlalchemy.exc import IntegrityError
 from sqlalchemy.orm import Session
 
 from .. import config
@@ -41,6 +42,15 @@ def _prune() -> None:
             _pending.pop(state, None)
 
 
+def _json_dict(response: httpx.Response) -> dict | None:
+    """Parsed JSON body, or None when it isn't a JSON object."""
+    try:
+        payload = response.json()
+    except ValueError:
+        return None
+    return payload if isinstance(payload, dict) else None
+
+
 def _consume_state(state: str) -> bool:
     """Validate and single-use-consume a pending state."""
     _prune()
@@ -84,7 +94,10 @@ async def handle_callback(db: Session, code: str, state: str) -> tuple[bool, str
             if exchanged.status_code != 200:
                 logger.warning("cloud exchange rejected code: %s", exchanged.status_code)
                 return False, "Could not complete sign-in — the code was rejected."
-            payload = exchanged.json()
+            payload = _json_dict(exchanged)
+            if payload is None:
+                logger.warning("cloud exchange returned a non-JSON payload")
+                return False, "Voicebox Cloud returned an unexpected response."
             api_key = payload.get("key")
             device_name = payload.get("label")
             if not api_key:
@@ -98,7 +111,9 @@ async def handle_callback(db: Session, code: str, state: str) -> tuple[bool, str
             if me.status_code != 200:
                 logger.warning("minted key failed verification: %s", me.status_code)
                 return False, "Sign-in succeeded but the key could not be verified."
-            account_user_id = (me.json().get("data") or {}).get("userId")
+            # The 200 above proves the key works; the user id is best-effort.
+            data = (_json_dict(me) or {}).get("data")
+            account_user_id = data.get("userId") if isinstance(data, dict) else None
     except httpx.HTTPError:
         logger.exception("network error during cloud exchange")
         return False, "Could not reach Voicebox Cloud. Check your connection and try again."
@@ -113,8 +128,14 @@ def _get_or_create_row(db: Session) -> DBCloudSettings:
     if row is None:
         row = DBCloudSettings(id=SINGLETON_ID)
         db.add(row)
-        db.commit()
-        db.refresh(row)
+        try:
+            db.commit()
+        except IntegrityError:
+            # Another request created the singleton concurrently.
+            db.rollback()
+            row = db.query(DBCloudSettings).filter(DBCloudSettings.id == SINGLETON_ID).one()
+        else:
+            db.refresh(row)
     return row
 
 
@@ -141,6 +162,7 @@ def get_status(db: Session) -> dict:
         "account_user_id": row.account_user_id if connected else None,
         "key_prefix": key_prefix,
         "connected_at": row.connected_at if connected else None,
+        "dashboard_url": f"{config.get_cloud_web_url()}/account",
     }
 
 
@@ -149,6 +171,7 @@ def disconnect(db: Session) -> None:
     revoked from the account dashboard — surface that in the UI."""
     row = _get_or_create_row(db)
     row.api_key = None
+    row.device_name = None
     row.account_user_id = None
     row.connected_at = None
     db.commit()

bun.lock

@@ -57,7 +57,6 @@
         "react-dom": "^18.3.0",
         "react-hook-form": "^7.53.0",
         "react-i18next": "^17.0.4",
-        "react-qr-code": "^2.0.18",
         "react-sound-visualizer": "^1.4.0",
         "tailwind-merge": "^2.5.4",
         "wavesurfer.js": "^7.0.0",
@@ -1006,8 +1005,6 @@
 
     "punycode": ["[email protected]", "", {}, "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg=="],
 
-    "qr.js": ["[email protected]", "", {}, "sha512-c4iYnWb+k2E+vYpRimHqSu575b1/wKl4XFeJGpFmrJQz5I88v9aY2czh7s0w36srfCM1sXgC/xpoJz5dJfq+OQ=="],
-
     "queue-microtask": ["[email protected]", "", {}, "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A=="],
 
     "react": ["[email protected]", "", { "dependencies": { "loose-envify": "^1.1.0" } }, "sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ=="],
@@ -1022,8 +1019,6 @@
 
     "react-loaders": ["[email protected]", "", { "dependencies": { "classnames": "^2.2.3" }, "peerDependencies": { "prop-types": ">=15.6.0", "react": ">=15" } }, "sha512-4igMNqs9Fb3d4Z+0UHIGQNJsw/37gX0nUO8QxupnEKRn1dtyYC1LGwk5GuaoDciMQCQc/MmPwb4Fn6ZfdoX1FQ=="],
 
-    "react-qr-code": ["[email protected]", "", { "dependencies": { "prop-types": "^15.8.1", "qr.js": "0.0.0" }, "peerDependencies": { "react": "*" } }, "sha512-v1Jqz7urLMhkO6jkgJuBYhnqvXagzceg3qJUWayuCK/c6LTIonpWbwxR1f1APGd4xrW/QcQEovNrAojbUz65Tg=="],
-
     "react-refresh": ["[email protected]", "", {}, "sha512-z6F7K9bV85EfseRCp2bzrpyQ0Gkw1uLoCel9XBVWPg/TjRj94SkJzUTGfOa4bs7iJvBWtQG0Wq7wnI0syw3EBQ=="],
 
     "react-remove-scroll": ["[email protected]", "", { "dependencies": { "react-remove-scroll-bar": "^2.3.7", "react-style-singleton": "^2.2.3", "tslib": "^2.1.0", "use-callback-ref": "^1.3.3", "use-sidecar": "^1.1.3" }, "peerDependencies": { "@types/react": "*", "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-Iqb9NjCCTt6Hf+vOdNIZGdTiH1QSqr27H/Ek9sv/a97gfueI/5h1s3yRi1nngzMUaOOToin5dI1dXKdXiF+u0Q=="],