From e414ab81c249e21d85b6e3aa138d82e5d5f7d322 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 21 Aug 2026 08:14:29 +0000
Subject: [PATCH] Wait visibly after an abandoned login, and keep a good
 token's schedule
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Follow-up to #82, which fixed the 500ms retry loop behind #83. Three things
that fix leaves open, plus the parts of the login path around it.

The one that matters: retryDelayMsAfterError() was applied to every non-abort
failure, including one that happens *after* the token was renewed. Those retries
re-enter getNewToken(), so a failing profiles or EKS step opened a login page
every 60 seconds while the token it already held was valid for another eight
hours — in default-browser mode, a tab a minute. scheduleAfterFailure() now
checks for a valid token first and keeps the ordinary expiry schedule there.

- Frost stopping after an abandoned login was invisible: the tray read
  `expiresAt`, so it announced "Next refresh 8 hours ago" with nothing
  scheduled. It now reads the scheduled time (getNextRefreshAt()) and says
  "Sign-in needed", and a single notification says so too — not when the user
  closed the window or refused the sign-in themselves, which LoginAbortedError
  now carries as `cancelledByUser`.
- Repeated failures back off 1m→30m instead of asking AWS the same question
  every minute forever; the streak resets on a clean run.
- AccessDeniedException ends the run like ExpiredTokenException already does,
  and SlowDownException widens the poll interval (RFC 8628 §3.5) instead of
  being logged and ignored.
- Default `expiresIn`/`interval` when AWS omits them: the first made the poll
  loop exit before it ran, the second made the sleep NaN and the loop hot.
- Describe the openExternal failure with describeError(), per AGENTS.md.
- docs/docs/{credential-refresh,login,troubleshooting}.html describe the new
  behaviour, and AGENTS.md gains schedule.ts with the two rules that keep #83
  fixed.

Also removes the assert-based self-check block from schedule.ts.

Verified with `npm run build`, `npm run lint`, and a headless harness that loads dist/aws-sso.js against stubbed electron and a faked
SSO OIDC client (15 checks). The post-login-failure case is the one that changed
against main: token valid for an hour with every later step failing opens 2
login pages in 70s on main, 1 here.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MgEBPwgAkov8Q1nFyJ78mt
---
 AGENTS.md                         | 942 ++++++++++++------------------
 docs/docs/credential-refresh.html |  10 +-
 docs/docs/login.html              |  17 +-
 docs/docs/troubleshooting.html    |  22 +-
 src/aws-sso.ts                    | 313 +++++++---
 src/schedule.ts                   |  74 +--
 src/tray.ts                       |  36 +-
 7 files changed, 673 insertions(+), 741 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index af16cc1..bb27b91 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,611 +1,393 @@
 # AGENTS.md
 
-Orientation and gotchas for working on Frost. Read this before changing build
-config, dependencies, or the release pipeline.
+Gotchas for working on Frost. Read before changing build config, dependencies,
+or the release pipeline.
 
-## What this is
+## Layout
 
-Frost is an Electron menu-bar/tray app (an AWS SSO credentials refresher).
-Almost every `src/*.ts` file executes in the **main process** — there is no
-bundler. The login window (`src/aws-sso.ts`) just loads a remote AWS URL.
+Frost is an Electron tray app (an AWS SSO credentials refresher) for macOS,
+Windows and Linux. There is no bundler; almost every `src/*.ts` runs in the
+main process. Two exceptions:
 
-Two files are exceptions, and both are worth knowing about before you touch the
-build:
-
-- `src/login-overlay.ts` runs **in the browser**, injected into the login page
-  (see "Login window credential overlay"). It has its own compile,
-  `tsconfig.overlay.json`, because the main build's ESM output is not
-  injectable and its Node types do not belong in a web page; the main
-  `tsconfig.json` excludes it so the two cannot fight over `dist/`.
-- `src/dashboard.html` is copied verbatim by `npm run build:html` and is
-  neither type-checked nor linted (see below).
-
-If you add another copied asset, remember to add its `copyfiles` step to the
-`build` script — a missing step only shows up at runtime.
+- `src/login-overlay.ts` is browser code injected into the login page. It has
+  its own compile (`tsconfig.overlay.json`); the main `tsconfig.json` excludes
+  it.
+- `src/dashboard.html` is copied verbatim by `build:html` and is neither
+  type-checked nor linted.
 
-It ships for **macOS, Windows and Linux** — see "Cross-platform gotchas" below
-before touching window chrome, tray icons, or anything path-shaped.
+Any other copied asset needs its own `copyfiles` step in the `build` script; a
+missing one fails at runtime only.
 
-Five small modules exist because they hold a decision that is easy to undo by
-accident. Prefer them over doing the thing inline:
+## Prefer these modules over doing it inline
 
 - **`src/atomic-write.ts`** — `writeFilePreservingMode()` for files the user
-  co-owns (`~/.aws/config`, `~/.kube/config`). Never hand-roll temp-file +
-  rename: the rename replaces the *inode*, which drops the destination's mode,
-  its owner, and its identity as a symlink — a config symlinked into a dotfiles
-  repo gets replaced by a regular file. `atomically` handles all of that plus
-  the fsync and the Windows EPERM/EBUSY retry. Anything that must be 0600
-  whatever it replaces (the SSO token cache) calls `atomically` directly.
-- **`src/logging.ts`** — transport configuration, the retention sweep, and
-  `describeError()`. Log errors through `describeError()`: `${err}` throws away
-  the AWS SDK's exception name, HTTP status and request id.
-- **`src/user-config.ts`** — `validateUserConfig()`, kept out of `config.ts`
-  because importing that constructs the electron-store and so needs a live
-  Electron app.
-- **`src/run-log.ts`** — the per-run step log the Activity panel renders. One
-  run is in flight at a time; `refresh()` guards on `isWorking` because a second
-  run would overwrite the current-run slot.
-- **`src/browsing-data.ts`** — `clearBrowsingData()`, behind Behavior → Login
-  Page's "Clear cookies and local storage". The login window takes no
+  co-owns (`~/.aws/config`, `~/.kube/config`). A hand-rolled temp-file +
+  rename replaces the inode, dropping the destination's mode, owner and
+  symlink identity. Files that must be 0600 whatever they replace (the SSO
+  token cache) call `atomically` directly.
+- **`src/logging.ts`** — transport config, retention sweep, `describeError()`.
+  Log errors through it; interpolating the error loses the AWS SDK's exception
+  name, HTTP status and request id.
+- **`src/user-config.ts`** — `validateUserConfig()`. Kept out of `config.ts`,
+  which constructs the electron-store and so needs a live Electron app.
+- **`src/run-log.ts`** — the per-run step log behind the Activity panel. One
+  run at a time; `refresh()` guards on `isWorking` because a second run would
+  overwrite the current-run slot.
+- **`src/schedule.ts`** — every delay `setNextTokenRefresh()` may use. Three
+  rules: a retry delay is never derived from the stored token expiry (after a
+  failure it is in the past, which collapses to the floor and reopens the login
+  page in a loop); a login nobody completed is not retried on a timer; a
+  failure *after* the token was renewed keeps the expiry schedule rather than
+  an error retry, which would reopen the login page for an unrelated failure.
+  No electron imports.
+- **`src/browsing-data.ts`** — `clearBrowsingData()`. The login window takes no
   partition, so it clears `session.defaultSession`: `clearData()` plus
-  `clearAuthCache()`, which that does not cover. The electron-store stays — the
-  point is to start the next login clean *without* resetting the SSO settings.
-
-The one renderer is the dashboard: `src/dashboard.html`, a single self-contained
-file (markup, CSS, and inline vanilla JS, no framework) that `npm run build:html`
-copies verbatim into `dist/`. It is **not** type-checked or linted — `tsc` and
-ESLint only see `src/*.ts` — so changes there are verified by eye and at runtime.
-It talks to the main process purely over the `window.frost` bridge in
-`src/preload.cts` (named operations + a `state-updated` push); the handlers live
-in `src/window.ts`, which takes an `IpcCallbacks` object so it never has to
-import `aws-sso.ts` (that would be a cycle). It runs sandboxed, with
-`contextIsolation: true` / `nodeIntegration: false` and a CSP, so an unescaped
-value is no longer code execution against a live token — but **every value
-interpolated into `innerHTML` must still go through the `esc()` helper** — account names, cluster names, and error
-strings all originate from AWS. For the same reason, never build a selector or
-an inline `onclick` out of a value: put it in a `data-` attribute and read it
-back (`esc()` is an HTML escaper, and an HTML attribute is decoded *before* its
-contents are parsed as JS or CSS, so escaping does not hold there).
-
-Register new IPC handlers with **`handleFromDashboard()`**, not `ipcMain.handle`
-directly: it rejects anything that is not the dashboard's own top frame. A new
-handler also needs a named method in `src/preload.cts` — the renderer has no
-`ipcRenderer` of its own, so a handler without a bridge entry is unreachable
-from the page, and `dashboard.html` is linted by nothing that would notice.
+  `clearAuthCache()`, which that does not cover. Settings are left alone.
+
+## Dashboard
+
+`src/dashboard.html` is the only renderer: one self-contained file, no
+framework, not type-checked or linted.
+
+- It reaches the main process only through the `window.frost` bridge in
+  `src/preload.cts`. Handlers live in `src/window.ts`, which takes an
+  `IpcCallbacks` object so it never imports `aws-sso.ts` — that would be a
+  cycle.
+- Every value interpolated into `innerHTML` must go through `esc()`; account
+  names, cluster names and error strings come from AWS. Never build a selector
+  or an inline handler out of a value — an HTML attribute is decoded before its
+  contents are parsed as JS or CSS, so escaping does not hold there. Put it in
+  a `data-` attribute and read it back.
+- New IPC handlers go through `handleFromDashboard()`, which rejects anything
+  but the dashboard's own top frame, and need a matching entry in
+  `src/preload.cts`. Nothing type-checks the two against each other, so a
+  missing entry is a button that silently does nothing.
 
 ## Commands
 
-This project uses **npm** (`package-lock.json`; CI runs `npm ci`). Do not add a
-`yarn.lock`.
+npm only (`package-lock.json`; CI runs `npm ci`). Do not add a `yarn.lock`.
 
-- `npm run build` — `tsc` (type-check + emit to `dist/`) then copies the tray
-  icons and `src/dashboard.html` into `dist/`.
-- `npm run lint` — ESLint (flat config, see below).
+- `npm run build` — `tsc`, then copies the tray icons and `dashboard.html`.
+- `npm run lint` — ESLint, flat config.
 - `npm start` / `npm run package` / `npm run make` — Electron Forge.
 
-`npm run build` and `npm run lint` are the local signal and both run in CI. They
-do **not** prove the app launches — see "Verification limits".
-
-## Module system: ESM
-
-The project is **ESM** (`"type": "module"` in package.json, `tsconfig`
-`module`/`moduleResolution: NodeNext`). Consequences:
-
-- Relative imports **must** carry a `.js` extension, e.g. `import { config }
-  from "./config.js"` (even though the source is `.ts`).
-- No `__dirname`/`__filename`. Use
-  `path.dirname(fileURLToPath(import.meta.url))` (see `src/tray.ts`).
-- `tsconfig` needs an explicit `rootDir` (TypeScript 6 requirement).
-- `forge.config.js` and `eslint.config.js` are ESM (`export default` /
-  `import`). `process` is a global; no `require`.
-
-## Login window credential overlay
-
-Electron services WebAuthn (`navigator.credentials`) but ships **no UI** for it:
-a page waiting for a YubiKey touch renders nothing at all, which is what made
-hardware keys look broken (issue #17). `src/login-indicator.ts` fills that gap
-for the login window and is wired up in `aws-sso.ts` *before* `loadURL` — only
-on the built-in-window path, since the default-browser login mode gets the
-browser's own prompts:
-
-- `src/login-overlay.ts` is compiled to `dist/login-overlay.js`, read off disk,
-  and injected with `executeJavaScript` on every `dom-ready` — the main frame
-  plus any sub-frame reached through `frame-created`, since `executeJavaScript`
-  on the `WebContents` only sees the top frame. It wraps `navigator.credentials.{get,create}` and draws a toast for
-  as long as a request is pending. It guards itself with a `window` flag, so
-  re-injecting into the same document is a no-op.
-- Its compile (`tsconfig.overlay.json`) differs from the main one in three ways
-  that all matter: `module: ESNext` (NodeNext would append `export {}`, a syntax
-  error in an injected classic script), `lib: DOM` + `types: []` (so `document`
-  resolves and `process`/`require` do not), and no source map (the output is
-  read as text, never loaded as a file). Because it has no imports it stays a
-  plain script — adding one would make the emitted file a module and break
-  injection, which is the reason `SIGNAL` is duplicated rather than shared.
-- The overlay runs in the **page's** JavaScript world (no preload script), so
-  its only channel back to the main process is `console.info()` with a magic
-  prefix, read via the `console-message` event. Keep `SIGNAL` in the overlay and
-  `LOGIN_OVERLAY_SIGNAL` in the indicator in sync. The remote page could forge
-  those lines, so nothing security-relevant may ever hang off them — today they
-  only pick a window title and bounce the dock icon.
-- Because the overlay lands on pages Frost does not control, it avoids
-  `innerHTML` and `<style>` elements (CSP / Trusted Types would reject them),
-  renders into a closed shadow root, pins its host styles with `!important`, and
-  keeps `pointer-events: none` so it can never swallow a click on the page.
-- `session.on("select-webauthn-account")` is also registered here. Electron
-  **cancels** the request outright when no listener is registered, so without it
-  a key holding several discoverable credentials for the same relying party can
-  never sign in. The callback must be invoked exactly once on every path.
-  It is unregistered from the `Session` in the window's `closed` handler, and
-  that handler must use the `Session` captured while the window was alive —
-  reaching for `webContents.session` (or anything else off the `WebContents`)
-  once the window is gone throws `TypeError: Object has been destroyed`, which
-  Electron surfaces as a modal error dialog on window close.
-
-The overlay is pure browser logic with no Electron imports, so verify changes to
-it by running the built `dist/login-overlay.js` through
-`new Function("window", source)` with a stub `window` (per "Verification
-limits", the app itself cannot be launched here), or by loading it into a
-Playwright page — which is also the only way to check it against a page with a
-strict CSP or hostile `!important` CSS.
+Build and lint both run in CI. Neither proves the app launches; see
+"Verification limits".
+
+## ESM
+
+`"type": "module"`, `module`/`moduleResolution: NodeNext`.
+
+- Relative imports carry a `.js` extension even though the source is `.ts`.
+- No `__dirname`/`__filename`; derive it from `import.meta.url`.
+- `tsconfig` needs an explicit `rootDir`.
+- `forge.config.js` and `eslint.config.js` are ESM; no `require`.
+
+## Login window WebAuthn overlay
+
+Electron services `navigator.credentials` but draws no UI, so a page waiting
+for a security key looks broken. `src/login-indicator.ts` fills that gap, wired
+up before `loadURL` and only for the in-app window; the default-browser mode
+gets the browser's own prompts.
+
+- `src/login-overlay.ts` is compiled separately, read off disk, and injected on
+  every `dom-ready` — the main frame plus sub-frames reached through
+  `frame-created`, since injecting on the `WebContents` only reaches the top
+  frame. It re-injects safely; a `window` flag makes it a no-op.
+- Its compile differs deliberately: `module: ESNext` (NodeNext would append an
+  export statement, a syntax error in an injected classic script), `lib: DOM`
+  with no Node types, and no source map. It must stay import-free — an import
+  makes the output a module and breaks injection, which is why its signal
+  constant is duplicated rather than shared with the indicator. Keep the two
+  in sync.
+- The overlay runs in the page's world, so its only channel back is a
+  console line with a magic prefix. The remote page could forge those, so
+  nothing security-relevant may depend on them.
+- It lands on pages Frost does not control: no `innerHTML`, no `<style>`
+  elements (CSP and Trusted Types reject them), a closed shadow root, host
+  styles pinned `!important`, and `pointer-events: none` so it cannot swallow a
+  click.
+- `select-webauthn-account` is registered on the session here. Electron cancels
+  the request outright when nothing is listening, which blocks any key holding
+  several credentials for the same relying party. Invoke the callback exactly
+  once on every path, and unregister using the `Session` captured while the
+  window was alive — reaching through the destroyed `WebContents` throws, which
+  Electron shows as a modal dialog on close.
 
 ## `~/.aws/config` ownership
 
-`src/aws-config.ts` **merges** into the user's `~/.aws/config` — it must never
-rewrite the file wholesale (it's shared with the AWS CLI and with whatever the
-user put there by hand, including `[default]`). `mergeAwsConfig()` is a pure
-`(existing, profiles) => contents` function:
-
-- Frost's profiles are tagged with a `# frost:managed` comment line right under
-  the section header. Only sections carrying that token are rewritten/removed.
-- Unmarked sections are preserved **verbatim**, including comments, blank-line
-  placement and `[sso-session ...]`/`[services ...]` sections. Comments directly
-  above a header travel with that section, so removing a profile doesn't eat the
-  user's note about the next one.
-- An unmarked `[profile x]` whose keys/values are *exactly* what Frost would
-  generate is **adopted** (rewritten with the marker). That's the upgrade path
-  from versions that wrote no marker — without it the first refresh after an
-  upgrade would duplicate every profile.
-- A same-named profile the user wrote themselves is left alone and Frost skips
-  its own (logs a warning) rather than clobbering it.
-- Writes go through `writeFilePreservingMode()` (see `src/atomic-write.ts`), and
-  are skipped entirely when the merged contents are unchanged. The permissions
-  on this file are the user's, not ours — a plain temp-file + rename silently
-  resets them, which is exactly the bug that helper exists to prevent.
-
-If you change the generated key set in `profiles.ts`, remember adoption compares
-the **full** key set — a new key means existing profiles stop matching, and they
-will then be skipped as "not ours" rather than adopted.
-
-There is no test runner in this repo. The merge logic is pure and importable, so
-verify changes to it with a throwaway Node script against `dist/aws-config.js`
-(stub the `electron-log/main` import) rather than trusting `tsc` alone. Include
-a CRLF case: the parser preserves whichever line ending the file already uses,
-which is what keeps a Windows-authored config intact.
-
-## Cross-platform gotchas
-
-The app is written once and packaged per platform, so the platform branches are
-few and deliberate. Each one exists for a reason worth knowing before you
-"simplify" it:
-
-- **Window chrome** (`src/window.ts`). `titleBarStyle: "hiddenInset"` plus
-  `trafficLightPosition` are applied **only on darwin**. On Windows
-  `hiddenInset` degrades to `hidden`, which removes the title bar without
-  putting the caption buttons anywhere — the dashboard ends up closable only
-  with Alt+F4. `src/dashboard.html` mirrors the split: an inline script in
-  `<head>` stamps `document.documentElement.dataset.platform`, and
-  `html:not([data-platform="darwin"])` rules drop the 36px drag strip that
-  stands in for the hidden macOS title bar.
-- **Tray icons** (`src/tray.ts`). macOS and Linux use the `*.Template.png`
-  files — a black shape plus alpha that macOS inverts to match the menu bar.
-  Windows draws tray images verbatim, so it gets the non-template
-  `TrayIcon{Full,Empty}{,@2x}.png` instead: the same snowflakes in white on the
-  blue app badge, legible on a light or dark taskbar. Windows and Linux also
-  wire `tray.on("click")` to the dashboard, because only macOS opens the
-  context menu on a plain click.
-- **Icon assets.** `src/icons/AppIcon.ico` (Windows) and the non-template tray
-  PNGs are generated from the same vector data as `AppIcon.svg` by
-  `tools/generate-windows-icons.py` (needs Pillow). Re-run it if the artwork
-  changes; the `.icns` and `.afdesign` files remain the macOS source.
-  `build:icons` globs `TrayIcon*.png`, so both sets land in `dist/`.
-- **Hotkey rendering.** `src/hotkey.ts` renders an accelerator as `⌘⇧R` on
-  macOS and `Ctrl+Shift+R` elsewhere; `main.ts` and `aws-sso.ts` both use it for
-  notification bodies. `fmtHotkey()` in `dashboard.html` is a **hand-kept copy**
-  — the renderer can't import from `dist/` — so change the two together.
-- **Squirrel** (`src/squirrel.ts`). Windows installs go through
-  Squirrel.Windows, which means three things the other platforms don't need:
-  the install/update/uninstall command lines must be serviced and the process
-  must exit (`handleSquirrelStartup()`, called first in `main()`); the app must
-  claim the Application User Model ID Squirrel put on the Start Menu shortcut
-  (`com.squirrel.Frost.Frost`) or Windows silently drops every notification;
-  and the login item must point at `Update.exe --processStart`, because
-  `Frost.exe` lives in a versioned directory that moves on every update. The
-  AUMID is derived from maker-squirrel's `name`/`exe` in `forge.config.js` —
-  the three have to agree.
-- **Single instance.** `main()` takes `app.requestSingleInstanceLock()`. macOS
-  won't launch a second copy of a bundle anyway, but on Windows and Linux a
-  second launch would add a second tray icon; `second-instance` opens the
-  dashboard instead.
-- **Bundled authenticator** (`src/kubeconfig.ts`). The basename picks up `.exe`
-  on Windows, and `findAwsIamAuthenticator()` **probes** for the file rather
-  than assuming a layout — `extraResource` puts it in `resources/`, while the
-  packager's wholesale copy of the project directory also leaves one in
-  `resources/app/` (the only copy older builds had). The path is written into
-  the user's kubeconfig, so a wrong guess only surfaces later when kubectl runs
-  it.
-- **`~/.aws/config` writes** (`src/aws-config.ts`). Windows fails the
-  write-then-`rename` with EPERM/EBUSY while any other process has either file
-  open — an AWS CLI command mid-read, or an antivirus scanner on the temp file.
-  `renameWithRetry()` backs off a few times before giving up. The merge itself
-  is EOL-preserving already (`parseConfig` sniffs CRLF), which is what keeps a
-  Windows-authored config from being rewritten wholesale.
-
-## Dependency gotchas
-
-- **AWS SDK v3** (`@aws-sdk/client-*`). The app uses the modular v3 clients
-  (`@aws-sdk/client-sso-oidc`, `client-sso`, `client-ec2`, `client-eks`) with
-  the command pattern: `client.send(new XxxCommand({...}))`. SSO role
-  credentials come from `fromSSO({ profile })` (`@aws-sdk/credential-providers`),
-  which reads the `~/.aws/config` profiles and `~/.aws/sso/cache/<sha1(startUrl)>.json`
-  token that the app writes (see `aws-config.ts`). Service error types are
-  exported classes, so use `err instanceof AuthorizationPendingException`. The
-  old `aws-sdk` v2 (CJS, end-of-life) was removed — do not reintroduce it.
-- **electron-log v5**: import `electron-log/main` in the main process.
-  `log.catchErrors(...)` was removed → `log.errorHandler.startCatching(...)`.
-- **update-electron-app v3**: named export — `import { updateElectronApp }`.
+`src/aws-config.ts` merges into the user's file and must never rewrite it
+wholesale; it is shared with the AWS CLI and with whatever the user wrote by
+hand. `mergeAwsConfig()` is pure.
+
+- Frost's own profiles carry a marker comment under the section header. Only
+  marked sections are rewritten or removed.
+- Unmarked sections survive verbatim — comments, blank lines, `sso-session` and
+  `services` sections. Comments above a header travel with that section.
+- An unmarked profile whose keys and values exactly match what Frost would
+  generate is adopted and marked. That is the upgrade path from versions that
+  wrote no marker; without it the first refresh would duplicate every profile.
+  Adoption compares the **full** key set, so adding a generated key means
+  existing profiles stop matching and get skipped instead.
+- A same-named profile the user wrote is left alone and Frost skips its own.
+- Writes go through `writeFilePreservingMode()` and are skipped when the merged
+  contents are unchanged.
+
+## Cross-platform
+
+Each platform branch exists for a reason.
+
+- **Window chrome** (`src/window.ts`): the macOS hidden title bar and traffic
+  light position are darwin-only. On Windows the same setting removes the title
+  bar without placing caption buttons anywhere, leaving the dashboard closable
+  only by keyboard. `dashboard.html` mirrors the split off a platform attribute
+  stamped on `documentElement`.
+- **Tray icons** (`src/tray.ts`): macOS and Linux use the template PNGs, which
+  macOS inverts to match the menu bar. Windows draws images verbatim, so it
+  gets the non-template set. Windows and Linux also wire a tray click to the
+  dashboard; only macOS opens the context menu on a plain click.
+- **Icon assets**: the Windows `.ico` and non-template tray PNGs are generated
+  by `tools/generate-windows-icons.py` (needs Pillow) from the same vector data
+  as the SVG. The `.icns` and `.afdesign` files stay the macOS source.
+- **Hotkeys** (`src/hotkey.ts`): symbols on macOS, `Ctrl+Shift+…` elsewhere.
+  `dashboard.html` keeps a hand-copied version because the renderer cannot
+  import from `dist/`; change both together.
+- **Squirrel** (`src/squirrel.ts`): Windows installs need the
+  install/update/uninstall command lines serviced with an immediate exit
+  (first thing in `main()`); the app must claim the Application User Model ID
+  from the Start Menu shortcut or Windows drops every notification; and the
+  login item must point at Squirrel's updater, because the executable lives in
+  a versioned directory that moves on each update. The AUMID is derived from
+  maker-squirrel's `name`/`exe` — the two must agree.
+- **Single instance**: `main()` takes the single-instance lock. On Windows and
+  Linux a second launch would add a second tray icon; it opens the dashboard
+  instead.
+- **Bundled authenticator** (`src/kubeconfig.ts`): the basename gains `.exe` on
+  Windows, and the lookup probes for the file rather than assuming a layout —
+  it exists both where `extraResource` puts it and in the packager's wholesale
+  copy of the project directory. The resolved path is written into the user's
+  kubeconfig, so a wrong guess surfaces only when kubectl runs it.
+- **`~/.aws/config` writes**: Windows fails the rename with EPERM/EBUSY while
+  another process holds either file open, so the write retries with backoff.
+  The parser preserves whichever line ending the file already uses.
+
+## Dependencies
+
+- **AWS SDK v3** modular clients with the command pattern. SSO role credentials
+  come from `fromSSO`, reading the profiles and token cache the app writes.
+  Service errors are exported classes, so match them with `instanceof`. Do not
+  reintroduce SDK v2.
+- **electron-log v5**: import `electron-log/main` in the main process; error
+  catching moved to `log.errorHandler`.
+- **update-electron-app v3**: named export.
 - **@kubernetes/client-node v2**, **electron-store v11**, **delay v7**,
-  **uuid v14**: all pure ESM. Use named imports for the k8s client
-  (`import { KubeConfig }` — there is no default export). The v1 → v2 bump
-  didn't touch the surface `src/kubeconfig.ts` uses (`loadFromString`,
-  `addCluster`/`addUser`/`addContext`, the `clusters`/`users`/`contexts`
-  arrays, `exportConfig`) — verified by round-tripping a merge against a
-  hand-written kubeconfig. v2 does **not** declare `@types/ws`, but its `.d.ts`
-  files reach into `isomorphic-ws` → `ws`, so `@types/ws` must stay a devDep or
-  `tsc` fails with TS7016.
-- **ESLint 10**: flat config only. Config lives in `eslint.config.js` using the
-  `typescript-eslint` umbrella package + `@eslint/js` (the old `.eslintrc` and
-  `@typescript-eslint/{parser,eslint-plugin}` split are gone). The
-  `no-unassigned-vars` core rule catches `do/while` pagination loops that never
-  reassign their `nextToken` — make sure the loop body assigns
-  `nextToken = res.nextToken`.
-- **js-yaml v5**: ships its own type definitions, so `@types/js-yaml` was
-  dropped. The `dump`/`load` named exports are unchanged from v4, so
-  `import * as yaml from "js-yaml"` + `yaml.dump(...)` (see `src/kubeconfig.ts`)
-  still works.
-- Removed deprecated type stubs: `@types/aws-sdk`, `@types/uuid`, and
-  `@types/js-yaml` (the libs ship their own types), and `@types/request` (the
-  `request` lib isn't used). `@types/ini` is still required (ini ships no types),
-  and so is `@types/ws` (see the k8s note above).
-- `axios` was a dependency that nothing imported — it has been dropped. Don't
-  reintroduce it; the app makes no direct HTTP calls of its own.
-- **TypeScript stays on 6.x.** TypeScript 7 is out, but `typescript-eslint` 8
-  (including its `canary` tag) still declares
-  `peerDependencies.typescript: ">=4.8.4 <6.1.0"`, so installing TS 7 fails
-  `npm install` with `ERESOLVE` and would take `npm run lint` — a CI gate —
-  down with it. Revisit once typescript-eslint ships TS 7 support.
-- **No `overrides` block.** package.json used to carry `overrides` for `tar`,
-  `tmp`, `form-data` and `undici` to pull vulnerable transitives forward. After
-  the Forge 8 upgrade the whole block is gone: `tmp` left the tree entirely and
-  the rest now resolve to patched versions on their own. Prefer upgrading the
-  parent over adding an override, and re-check `npm audit` with the block empty
-  before adding one back.
-
-## AWS IAM Authenticator
-
-The `aws-iam-authenticator` binary is bundled into the app (`extraResource` in
-`forge.config.js`) so users don't need the AWS CLI. It is **not** committed —
-the build workflow downloads it at build time. The version is pinned as
-`AWS_IAM_AUTHENTICATOR_VERSION` in `.github/workflows/build.yaml`. Release
-asset naming is `aws-iam-authenticator_<version>_<os>_<arch>[.exe]` (os:
-`darwin` | `linux` | `windows`; arch: `amd64` | `arm64`; `.exe` on Windows
-only). At runtime the path is resolved in `src/kubeconfig.ts` (overridable via
-`AWS_IAM_AUTHENTICATOR_PATH`).
-
-**There is no `windows_arm64` asset** — upstream publishes none, as of 0.7.18.
-The windows/arm64 matrix row therefore bundles the `windows_amd64` build, which
-is why `arch.aws` is not simply a function of `arch` in `build.yaml`. That is a
-deliberate and cheap trade: the authenticator is a short-lived helper process
-kubectl spawns, and Windows on ARM emulates x64 processes transparently, so
-only that helper pays emulation while the app itself stays native. Do not
-"fix" this by dropping the arm64 row — emulating all of Chromium to keep one
-occasionally-invoked CLI native is the worse side of the trade. If upstream
-ever ships `windows_arm64`, the only change is `aws: amd64` → `aws: arm64` on
-that row.
+  **uuid v14**: pure ESM. The k8s client has no default export. It does not
+  declare `@types/ws` but its types reach `ws` through `isomorphic-ws`, so
+  `@types/ws` must stay a devDependency or `tsc` fails.
+- **ESLint 10**: flat config only, via the `typescript-eslint` umbrella package
+  and `@eslint/js`. Its `no-unassigned-vars` rule catches pagination loops that
+  never reassign their continuation token.
+- **js-yaml v5** ships its own types; `@types/js-yaml` was dropped. `@types/ini`
+  is still needed.
+- **TypeScript stays on 6.x.** `typescript-eslint` 8 declares a peer range
+  below 7, so installing TS 7 fails `npm install` and takes lint — a CI gate —
+  down with it. Revisit when typescript-eslint supports TS 7.
+- **No `overrides` block.** The former entries are resolved by upgrading
+  parents. Prefer that over adding an override, and re-check `npm audit` with
+  the block empty first.
+- `axios` was unused and was dropped. The app makes no direct HTTP calls.
+
+## AWS IAM authenticator
+
+Bundled via `extraResource` so users need no AWS CLI, and **not** committed —
+the build downloads it, pinned by version and per-row SHA-256 in
+`build.yaml`. The runtime path is resolved in `src/kubeconfig.ts` and can be
+overridden with `AWS_IAM_AUTHENTICATOR_PATH`.
+
+Upstream publishes no `windows_arm64` asset, so that matrix row bundles the
+amd64 build; this is why the AWS arch is not a function of the Electron arch.
+Windows on ARM emulates that short-lived helper transparently while the app
+stays native. Do not drop the arm64 row to "fix" it.
 
 The packager option is `extraResource`, **singular** — the plural is
-electron-builder's spelling and electron-packager ignores it silently. It was
-plural here for a long while and nothing appeared broken, because the packager
-also copies the whole project directory (repo root included) into
-`resources/app`, so the binary arrived there by accident. Both copies now exist
-in a packaged app, and `findAwsIamAuthenticator()` probes for either. Keep that
-in mind before adding packager `ignore` rules: trimming `resources/app` is a
-good idea, but the accidental copy is what older installs are running off.
-
-## CI / release pipeline
-
-Five workflows, with the matrix build factored out as a reusable workflow:
-
-- **`.github/workflows/build.yaml`** (reusable, `workflow_call`) — the
-  six-row build matrix (darwin, linux and win32 × x64/arm64) that checks out,
-  installs, optionally stamps a version, builds, downloads the IAM
-  authenticator, sets up the macOS signing keychain, and runs
-  `electron-forge make`. The `publish` input then decides where `out/make`
-  goes: to the `v<version>` GitHub release via `gh release upload --clobber`,
-  or to workflow artifacts. Owns `AWS_IAM_AUTHENTICATOR_VERSION` and the matrix
-  definition. Callers should pass `secrets: inherit` so it can read
-  `MAC_CERTS`, `APPLE_API_*`, and `GITHUB_TOKEN` without re-declaring them.
-
-  **There is no Forge publisher, and `electron-forge publish` must not come
-  back** — it fails outright on this repo. Assets go up with `gh release
-  upload`; the comment on build.yaml's upload step has the why.
-
-  Steps longer than a one-liner live in **`.github/scripts/`** rather than
-  inline `run:` blocks, and take their inputs from `env:`.
-
-  Two inputs beyond `publish`/`version` are load-bearing:
-
-  - **`sign`** decides whether the Developer ID is imported at all. `ci.yaml`
-    passes `false` for `pull_request` events, because that job has already run
-    `npm ci` and `npm run build` from the pull request and a compromised
-    dependency's postinstall must not be running alongside the certificate.
-    Pushes to `main` still sign, so the full notarized path is validated
-    before a tag. It reaches Forge as `FROST_SIGN`, which `forge.config.js`
-    keys `osxSign`/`osxNotarize` off — they have to be **absent**, not empty,
-    because `@electron/osx-sign` fails outright when told to sign with an
-    identity that is not in the keychain.
-  - **`authenticator_sha256`**, one per matrix row, pins the exact bytes of
-    the downloaded authenticator. Release assets are mutable and this binary
-    ends up in a signed app and in every user's kubeconfig as the `exec`
-    plugin. The comment above the matrix carries the one-liner to regenerate
-    the hashes when `AWS_IAM_AUTHENTICATOR_VERSION` moves; win32/arm64 shares
-    the windows_amd64 asset and therefore its hash.
-
-  The matrix is written as explicit `include` rows rather than an os × arch
-  product: `exclude` does not match reliably against object-valued dimensions,
-  and win32/arm64 needs a different `arch.aws` from its `arch.electron`
-  (upstream publishes no windows_arm64 authenticator). Two Windows-driven
-  details in the steps:
-  the authenticator download runs under `shell: bash` (Git Bash) so one script
-  covers all three runners, and Forge is invoked through `npx` because
-  PowerShell can't execute the extensionless `./node_modules/.bin/electron-forge`
-  shell script.
-- **`.github/workflows/ci.yaml`** (🔍 Build) runs on **pull requests to `main`
-  and pushes to `main`**. Lints, then calls `build.yaml` with `publish: false`
-  — packages, **signs and notarizes** the macOS app, and uploads the
-  distributable zips as artifacts. Never tags or publishes. Notarization needs
-  the Apple secrets, which are only available on same-repo PRs (not forks). On
-  pushes to `main` it also refreshes the release-drafter draft.
-- **`.github/workflows/release.yaml`** (🚀 Release Version) is
-  **`workflow_dispatch` only — run it from the Actions tab and it is the whole
-  release**: `prep` reads the tag off release-drafter's draft, `release-app`
-  builds the matrix and attaches the distributables to that draft, and
-  `publish` publishes it, pinned to the commit that was built. Releases are
-  therefore attributed to `github-actions[bot]`, not to whoever cut them.
-
-  **Never publish the draft from the GitHub UI, and never add a `push: tags`
-  or `release: published` trigger back.** Immutable releases are enabled here,
-  so publishing seals a release and a sealed one cannot be repaired — a botched
-  release costs the version number. release.yaml's header comment has the
-  detail.
-- **`.github/workflows/pages.yaml`** (🌐 Deploy Pages) publishes `docs/` — the
-  marketing site and the documentation at the project's GitHub Pages URL — on
-  pushes to `main` that touch `docs/**`. See "Documentation site" below.
-- **`.github/workflows/autolabeler.yaml`** (🏷️ Autolabel) applies
-  release-drafter's changelog labels to incoming PRs from branch-name patterns.
-
-**Version numbers come from PR labels, not from `package.json`.**
-`.github/release-drafter.yml` has a `version-resolver` that reads the labels on
-the merged PRs: `major` / `minor` / `patch`, defaulting to **patch**. To cut a
-minor release, put the `minor` label on the PR. `autolabeler.yaml` only assigns
-the changelog-category labels (`feature` / `fix` / `chore`) and only from
-branch-name patterns (`feat/…`, `fix/…`, `chore/…`), so a branch named anything
-else — e.g. `claude/…` — needs its labels set by hand.
-
-The draft's tag is therefore the version being released: `prep` strips the `v`
-and the upload reconstructs it, so `tag-template` has to stay
-`v$RESOLVED_VERSION`.
-
-The app version in `package.json` is overwritten in CI from the tag
-(`npm version --no-git-tag-version`), so **don't bump it manually**. The build
-runner Node version is `NODEJS_VERSION` (declared in both `ci.yaml` and
-`build.yaml` — keep them in sync). It must satisfy the toolchain: ESLint 10,
-TypeScript 6, Electron 43, and **Node >= 22.12** — `@electron/packager` 20 and
-`@electron/osx-sign` 2 both declare that engine floor. `NODEJS_VERSION: 22`
-resolves to the latest 22.x, which clears it; don't pin it to an exact 22.x
-below 22.12.
+electron-builder's spelling and is ignored silently. Both copies of the binary
+exist in a packaged app (the packager also copies the project directory into
+resources), and older installs run off the accidental one, so be careful
+adding packager `ignore` rules.
+
+## CI / release
+
+- **`build.yaml`** (reusable) — the six-row matrix (darwin, linux, win32 ×
+  x64/arm64): install, optionally stamp the version, build, download the
+  authenticator, set up the macOS keychain, `electron-forge make`. Its
+  `publish` input decides whether `out/make` goes to the GitHub release or to
+  workflow artifacts. Callers pass `secrets: inherit`. Steps longer than a
+  one-liner live in `.github/scripts/` and take inputs from `env:`.
+  - **There is no Forge publisher, and `electron-forge publish` must not come
+    back** — it fails outright here. Assets go up with the GitHub CLI.
+  - `sign` decides whether the Developer ID is imported at all. Pull requests
+    pass `false`, because that job has already run `npm ci` and `npm run build`
+    from the PR and a compromised postinstall must not run alongside the
+    certificate. It reaches Forge as an env var that the signing and
+    notarization options key off; they must be **absent**, not empty, or
+    signing fails against an identity that is not in the keychain.
+  - `authenticator_sha256` pins the exact bytes per row. Release assets are
+    mutable, and this binary ends up signed and in every user's kubeconfig.
+  - The matrix is explicit `include` rows: `exclude` does not match reliably
+    against object-valued dimensions. The authenticator download runs under
+    Git Bash so one script covers all runners, and Forge is invoked through
+    `npx` because PowerShell cannot execute the extensionless shim.
+- **`ci.yaml`** — pull requests to `main` and pushes to `main`. Lints, then
+  calls `build.yaml` with `publish: false`; signs and notarizes macOS and
+  uploads the zips as artifacts. Never tags or publishes. Notarization secrets
+  are unavailable to forks. Pushes to `main` also refresh the release-drafter
+  draft.
+- **`release.yaml`** — `workflow_dispatch` only, and it is the whole release:
+  read the tag off the draft, build the matrix, attach, publish, pinned to the
+  commit that was built. Releases are attributed to the actions bot.
+  **Never publish the draft from the GitHub UI, and never add a `push: tags` or
+  `release: published` trigger.** Immutable releases are on: publishing seals a
+  release, a sealed one cannot be repaired, and a botched one costs the version
+  number.
+- **`pages.yaml`** — publishes `docs/` on pushes to `main` touching `docs/**`.
+- **`autolabeler.yaml`** — applies changelog labels from branch-name patterns
+  (`feat/`, `fix/`, `chore/`). Any other prefix needs labels set by hand.
+
+**Version numbers come from PR labels, not `package.json`.** The
+release-drafter resolver reads `major`/`minor`/`patch` off merged PRs and
+defaults to patch. The draft's tag is the version being released, so the
+`v`-prefixed tag template has to stay. CI overwrites the version in
+`package.json` from the tag — do not bump it manually.
+
+`NODEJS_VERSION` is declared in both `ci.yaml` and `build.yaml`; keep them in
+sync. It must satisfy Node >= 22.12, the floor declared by the packager and the
+macOS signer.
 
 ## Documentation site
 
-`docs/` is plain static HTML with no build step — GitHub Pages serves it as it
-is committed, so anything added there has to work when opened directly.
-
-- `docs/index.html` (landing), `docs/download.html` (reads the latest GitHub
-  release at runtime) and `docs/style.css` are the marketing site.
-- `docs/docs/*.html` is the documentation: one page per feature, an
-  **Integrations** section (EKS and the authenticator it needs — new AWS
-  services get a page there), three settings pages, and a reference section. `docs/docs.css` layers the docs shell on top
-  of `style.css`; both pages of the marketing site link it too, because the
-  landing page reuses `.doc-cards` and `.section-more`.
-- **The page list lives in one place**: `SECTIONS` in `docs/docs/docs-nav.js`,
-  which renders the sidebar (marking the current page from
-  `location.pathname`) and the prev/next pager. A new page has to be added
-  there or it will exist without being linked; it can be checked headlessly by
-  `eval`-ing that file against a stub `document`/`location`/`window`.
-- Every page carries the same shell — header, `<details class="doc-sidebar"
-  id="doc-nav">`, article, `<nav id="doc-pager">`, footer. Copy an existing page
-  when adding one rather than assembling it by hand.
-- Content is written against the behaviour in `src/`, not against the README:
-  when you change a default, a setting, a generated key set or a file path,
-  the matching page in `docs/docs/` is part of that change. The pages that go
-  stale fastest are `settings*.html`, `files.html` and `profiles.html`.
-- Worth re-running after edits: a link/anchor check across `docs/**/*.html`
-  (every `href` that is not external should resolve to a file, and every
-  fragment to an `id`), and a Playwright pass in both colour schemes at a
-  narrow and a wide viewport — `docs.css` is not otherwise exercised by
-  anything.
-
-## Electron Forge 8 (prerelease — deliberate)
-
-The three `@electron-forge/*` devDeps are pinned to the **exact** version
-`8.0.0-alpha.10` (no `^` — a floating range on a prerelease line moves you
-across alphas silently). This is not an accident, and downgrading to the 7.x
-stable line reintroduces a high-severity advisory:
-
-- Forge 7.11.2 pins `@electron/packager` 18, whose `extract-zip` dependency has
-  an unfixable symlink path-traversal advisory (GHSA-jmr9-qjv8-65gv — *every*
-  published version is affected). `@electron/packager` 20 replaced it with
-  `@electron-internal/extract-zip`, which clears it.
-- Pulling packager 20 under Forge 7 via an override **does not work** — it was
-  tried and fails at the end of packaging with `TypeError: done is not a
-  function`, because packager 20 made its hooks promise-based while Forge 7's
-  `sequentialHooks` still passes a callback. Forge 8 is the version that adapted
-  to it.
-- `electron-forge package` and `electron-forge make` were both run under
-  8.0.0-alpha.10 on linux/x64 and succeed; `forge.config.js` needed no changes.
-
-When Forge 8 goes stable, move to `^8.x` and drop this section down to a note.
+`docs/` is static HTML with no build step, served as committed, so anything
+added has to work opened directly.
+
+- `docs/index.html`, `docs/download.html` (reads the latest release at runtime)
+  and `docs/style.css` are the marketing site.
+- `docs/docs/*.html` is the documentation, one page per feature, plus settings
+  and reference pages. `docs/docs.css` layers on `style.css`, which the
+  marketing pages also link because the landing page reuses its card styles.
+- **The page list lives only in `SECTIONS` in `docs/docs/docs-nav.js`**, which
+  renders the sidebar and the pager. A page missing from it exists but is
+  unlinked.
+- Every page carries the same shell. Copy an existing page rather than
+  assembling one.
+- Content is written against the behaviour in `src/`, not the README: changing
+  a default, a setting, a generated key set or a file path means updating the
+  matching page. `settings*.html`, `files.html` and `profiles.html` go stale
+  fastest.
+- Worth re-running after edits: a link and anchor check across `docs/**/*.html`,
+  and a Playwright pass in both colour schemes at a narrow and a wide viewport,
+  since nothing else exercises `docs.css`.
+
+## Electron Forge 8 (prerelease, deliberate)
+
+The `@electron-forge/*` devDeps are pinned to an exact alpha — no `^`, which
+would drift across alphas silently. Downgrading to the 7.x stable line
+reintroduces an unfixable symlink path-traversal advisory
+(GHSA-jmr9-qjv8-65gv) through the packager's zip extraction; the packager major
+that Forge 8 adapted to replaced that dependency. Pulling the newer packager
+under Forge 7 via an override does not work — its hooks became promise-based
+while Forge 7 still passes a callback. Move to `^8.x` when it goes stable.
 
 ## Windows packaging (Squirrel)
 
-`@electron-forge/maker-squirrel` builds the Windows installer; macOS and Linux
-still use `maker-zip`. Things worth knowing:
-
-- The maker's `config` is a **function of the target arch**, which is a
-  supported Forge API (`MakerBase` calls it `configOrConfigFetcher`). That is
-  how `setupExe` gets the real architecture in its name
-  (`Frost-win32-<arch>-<version>.exe`) instead of the runner's. The version is
-  read out of `package.json` at config-load time, which is correct because the
-  release pipeline stamps it there first.
-- `noMsi: true`. Squirrel would otherwise also emit an `.msi` that doesn't
-  auto-update; the `.exe` is the only artifact we ship.
-- `iconUrl` must be an **absolute HTTP URL** (Add/Remove Programs fetches it),
-  so it points at the raw `AppIcon.ico` on `main` — unlike `setupIcon`, which
-  is a local path.
-- `electron-packager` picks the icon extension per platform, so
-  `packagerConfig.icon: "./src/icons/AppIcon"` resolves to `AppIcon.ico` here.
-  That file has to exist in the source tree at package time, which is why it's
-  committed.
-- Squirrel emits `RELEASES` and a `.nupkg` alongside the installer. Those are
-  what `update-electron-app`/update.electronjs.org reads on Windows — don't
-  prune them from a release, and don't let the downloads page offer them
-  (`docs/download.html` filters them out by design).
-- **Two Windows architectures share one GitHub release, and Squirrel names its
-  output the same way every time.** Left alone, x64 and arm64 would both
-  upload `RELEASES` and `<id>-<version>-full.nupkg`, one would clobber the
-  other, and the survivor would feed its payload to *both* architectures on the
-  next auto-update. Two things keep them apart:
-  - `squirrelPackageName(arch)` puts the architecture in the **package id**
-    (`Frost-arm64`), so the nupkg is `Frost-arm64-<version>-full.nupkg`. It has
-    to be the id, not a suffix after the version: Squirrel parses
-    `<id>-<version>-full.nupkg` with the version in a fixed position, so
-    `Frost-<version>-arm64-full.nupkg` would not parse. x64 keeps the bare
-    `Frost`, and once it has shipped that id is fixed — changing it would
-    strand installed clients on a feed whose package no longer matches.
-  - The `postMake` hook renames arm64's `RELEASES` to `RELEASES-arm64`, which
-    is what update.electronjs.org looks for before falling back to plain
-    `RELEASES`. That fallback is why x64 needs no per-arch file and its asset
-    names are byte-identical to a single-architecture build.
-
-  Because the id feeds the AUMID, `src/squirrel.ts` derives its own from
-  `process.arch` using the same rule. A build is only ever installed by the
-  package of its own architecture, so the two always agree.
-- Windows builds are **unsigned**: there's no certificate, and SmartScreen
-  warns on first run. `forge.config.js` reads `WINDOWS_CERTIFICATE_FILE` /
-  `WINDOWS_CERTIFICATE_PASSWORD` from the environment and feeds them to
-  `windowsSign` when set, so wiring up signing later is a workflow change only
-  — the config is inert while they're unset. Use `windowsSign`
-  (`@electron/windows-sign`), not the top-level
-  `certificateFile`/`certificatePassword` pair: electron-winstaller still
-  accepts those but documents them as legacy, and only `windowsSign` extends to
-  EV certificates and cloud signing.
-
-## macOS signing/notarization (Forge 8)
-
-Forge 8 (via `@electron/packager` 20) uses `@electron/osx-sign` v2 and
-`@electron/notarize` v3. Both majors were ESM/Node-floor bumps and left the
-option shapes below untouched, so `forge.config.js` reads the same as it did
-under Forge 7. In `forge.config.js`:
-- `osxSign` uses `optionsForFile: () => ({ entitlements, hardenedRuntime,
-  signatureFlags })` — the old kebab-case keys (`hardened-runtime`,
-  `entitlements-inherit`, `signature-flags`) are silently ignored.
-- `osxNotarize` uses notarytool API-key auth: `appleApiKey` is the **path** to
-  the `.p8` file, plus `appleApiKeyId` and `appleApiIssuer`. The workflow writes
-  the key to `~/private_keys/AuthKey_<APPLE_API_KEY>.p8` (so `APPLE_API_KEY` is
-  the key ID).
-
-This path requires Apple certs/secrets and only runs in CI on a macOS runner —
-it cannot be validated locally.
+`maker-squirrel` builds the Windows installer; macOS and Linux use `maker-zip`.
+
+- The maker's config is a **function of the target arch**, a supported Forge
+  API, which is how the installer name gets the real architecture instead of
+  the runner's. It reads the version from `package.json` at config-load time,
+  after the pipeline has stamped it.
+- `noMsi: true` — the `.msi` would not auto-update and is not shipped.
+- `iconUrl` must be an absolute HTTP URL (Add/Remove Programs fetches it),
+  unlike `setupIcon`, which is a local path. The `.ico` must exist in the
+  source tree at package time, which is why it is committed.
+- Squirrel also emits `RELEASES` and a `.nupkg`; the Windows auto-updater reads
+  them. Do not prune them from a release, and keep the downloads page filtering
+  them out.
+- **Two Windows architectures share one release, and Squirrel names its output
+  identically each time.** Left alone they clobber each other and the survivor
+  feeds its payload to both architectures on the next update. Two things
+  prevent that:
+  - the architecture goes in the **package id**, so the nupkg name differs. It
+    has to be the id, not a suffix after the version, because Squirrel parses
+    the version from a fixed position. x64 keeps the bare id, and once shipped
+    that id is fixed — changing it strands installed clients.
+  - a `postMake` hook renames arm64's `RELEASES` to the per-arch name the
+    updater looks for before falling back to the plain one. That fallback is
+    why x64 needs no per-arch file.
+
+  Because the id feeds the AUMID, `src/squirrel.ts` derives its own the same
+  way from `process.arch`; a build is only ever installed by its own
+  architecture's package.
+- Windows builds are **unsigned** and SmartScreen warns on first run.
+  `forge.config.js` reads certificate path and password from the environment
+  and feeds `windowsSign` when set, so enabling signing is a workflow change
+  only. Use `windowsSign`, not the legacy top-level pair, which does not extend
+  to EV or cloud signing.
+
+## macOS signing/notarization
+
+Requires Apple certs and secrets, and runs only on a CI macOS runner — it
+cannot be validated locally.
+
+- Signing uses per-file options for entitlements, hardened runtime and
+  signature flags. The old kebab-case keys are silently ignored.
+- Notarization uses notarytool API-key auth: the key option is the **path** to
+  the `.p8`, plus key id and issuer. The workflow writes the key to the
+  location the tool expects.
 
 ## Verification limits
 
-This is a GUI Electron app. In headless/sandboxed environments you can run
-`npm run build`, `npm run lint`, isolated Node runtime checks of individual
-libraries, and — given network access to the Electron release downloads —
-`electron-forge package`/`make` **for linux** (packaging never opens a window).
-You **cannot** launch the app, and you cannot validate macOS
-signing/notarization. Treat those as "verify in CI / on a real desktop" and say
-so explicitly rather than claiming the app works. The PR Build workflow (above)
-is what actually exercises the packaging/signing/notarization path on macOS.
-
-Windows packaging can't be exercised here either: `maker-squirrel` needs a
-Windows host, and even plain `electron-forge package --platform win32` shells
-out to `rcedit` to stamp the icon, which needs Wine off Windows.
-
-That matters most for the multi-architecture asset naming above, where a
-mistake corrupts auto-update for people who already installed. What *is*
-checkable without Windows: reproduce the artifact list from `MakerSquirrel`'s
-own logic (`prepareConfig(arch)` plus the three names its `make()` returns),
-run `forge.config.js`'s `postMake` hook over real temp files, flatten both
-architectures into one list, and assert the names are disjoint. That catches
-every collision; it does not tell you whether Squirrel installs an arm64
-payload correctly, which needs real hardware.
-
-**Squirrel's own binaries are all x86** — `Setup.exe`, `Squirrel.exe`,
-`StubExecutable.exe`, `SyncReleases.exe` in `electron-winstaller/vendor` are
-i386 (only the bundled 7-Zip has an arm64 variant). They run under emulation on
-Windows on ARM and then launch the native app. Squirrel.Windows historically had
-an arm64 bug (Squirrel.Windows#1616, fixed by #1617 for v2); whether the
-vendored build carries the fix has not been confirmed on hardware, so treat
-arm64 installs as needing a real-device smoke test before you trust them.
-
-A few things that *are* checkable headlessly and worth doing, since nothing
-else covers them:
-
-- **`dashboard.html`** is neither type-checked nor linted. Its `<script>`
-  blocks can be pulled out and run in `node:vm` against a stub `document` /
-  `require("electron")`, once per `process.platform`, which catches load-time
-  breakage (a temporal dead zone, a typo) that would otherwise only show up as
-  a blank window. Stub the timers — the script installs a 30s interval that
-  keeps Node alive.
-
-  Better, where a change is about *behaviour* rather than load: load the built
-  `dist/dashboard.html` in headless Chromium (Playwright, with Chromium already
-  on most sandboxes) after injecting a `<script>` that defines `window.require`
-  to return a fake `ipcRenderer` and `window.process = { platform }`. That
-  exercises real rendering, clicks and state pushes. Seed the fake state with
-  hostile values — `<img src=x onerror=…>` in an account or cluster name, a
-  quote in an id — and assert nothing executes; it is the only mechanical check
-  on the `esc()` rule above. One caveat: the `<head>` script at the top of the
-  file reads `process.platform` before any injected stub can load, so expect one
-  harmless `ReferenceError` in the page-error log.
-- **The preload bridge**: assert every `frost.<name>` in `dashboard.html` has an
-  entry in `src/preload.cts`. Nothing type-checks the two against each other, so
-  a missing one is a button that does nothing (#76).
-- **`forge.config.js`** can be imported directly, and the maker instantiated
-  the same way Forge does (`new MakerSquirrel(cfg, platforms)` then
-  `await maker.prepareConfig(arch)`), to confirm the per-arch config resolves
-  and that the AUMID in `src/squirrel.ts` still matches `name`/`exe`.
-- **`docs/download.html`**'s release-parsing script runs the same way against a
-  synthetic GitHub release payload, which is how you check asset-name changes
-  without cutting a release.
-- **File-permission behaviour** (`src/atomic-write.ts`) is checkable directly:
-  import the built module and run it over a scratch directory. Cover an
-  existing 0600 and an existing 0640 (a preserved mode must not be narrowed by
-  the umask), a file that does not exist yet, and — the case a hand-rolled
-  implementation gets wrong — a path that is a **symlink** into another
-  directory, asserting the link survives and the target is what changed.
-
-Windows-specific behaviour — Squirrel install/update events, the tray icon and
-click handling, toast notifications, the login item — cannot be exercised
-anywhere but a real Windows machine. The CI matrix proves the installer
-*builds*; it does not prove it installs.
+Headless, you can run build, lint, isolated Node checks of individual modules,
+and — with network access to the Electron downloads — `package`/`make` **for
+linux**. You **cannot** launch the app or validate macOS signing. Say so rather
+than claiming the app works.
+
+Windows packaging cannot be exercised either: the maker needs a Windows host,
+and even plain packaging shells out to `rcedit`, which needs Wine off Windows.
+That matters most for the multi-architecture asset naming, where a mistake
+corrupts auto-update for existing installs. What is checkable: reproduce the
+artifact list from the maker's own logic, run the `postMake` hook over temp
+files, flatten both architectures into one list, and assert the names are
+disjoint. That catches every collision but says nothing about whether an arm64
+install works — Squirrel's own vendored binaries are x86 and run under
+emulation, and it historically had an arm64 bug whose fix is unconfirmed here,
+so treat arm64 installs as needing a real-device smoke test.
+
+Worth doing headlessly, since nothing else covers it:
+
+- **`dashboard.html`**: pull its scripts into `node:vm` against a stub
+  `document` and `electron`, once per platform, to catch load-time breakage
+  that would otherwise show as a blank window. Stub the timers; the script
+  installs a long-lived interval. For behaviour rather than load, load the
+  built file in headless Chromium with a fake IPC bridge injected — that
+  exercises real rendering and state pushes, and seeding hostile values into
+  account and cluster names is the only mechanical check on the `esc()` rule.
+  The head script reads the platform before any stub can load, so expect one
+  harmless error in the page log.
+- **The preload bridge**: assert every `frost.<name>` used in the dashboard has
+  an entry in `src/preload.cts`.
+- **`forge.config.js`** can be imported and the maker instantiated the way
+  Forge does, to confirm the per-arch config resolves and the AUMID still
+  matches.
+- **`docs/download.html`**'s release parsing runs against a synthetic release
+  payload, which checks asset-name changes without cutting a release.
+- **`src/atomic-write.ts`**: run the built module over a scratch directory.
+  Cover an existing 0600 and 0640 (a preserved mode must not be narrowed by the
+  umask), a file that does not exist, and a path that is a **symlink** into
+  another directory — assert the link survives and the target changed.
+- **`src/aws-config.ts`**: the merge is pure and importable, so exercise it
+  with a throwaway script (stub the logging import). Include a CRLF case.
+- **`src/schedule.ts`**: pure and electron-free, so its delay arithmetic can be
+  exercised directly.
+
+Windows behaviour — Squirrel install and update events, the tray icon, toast
+notifications, the login item — needs a real Windows machine. CI proves the
+installer builds, not that it installs.
diff --git a/docs/docs/credential-refresh.html b/docs/docs/credential-refresh.html
index 099beec..3f67a96 100644
--- a/docs/docs/credential-refresh.html
+++ b/docs/docs/credential-refresh.html
@@ -145,18 +145,20 @@ <h2 id="notify">Auto-open or notify first</h2>
       </p>
       <ul>
         <li><strong>Auto-open browser</strong> (default) — the login page opens as soon as the token needs replacing. With federated SSO it usually completes without asking you anything.</li>
-        <li><strong>Notification + hotkey</strong> — Frost posts a system notification and waits. Click the notification or press the refresh hotkey when you are ready, and the login page opens then. If you never do, the run gives up when the device code expires.</li>
+        <li><strong>Notification + hotkey</strong> — Frost posts a system notification and waits. Click the notification or press the refresh hotkey when you are ready, and the login page opens then. If you never do, the run gives up when the device code expires, and Frost waits for you rather than notifying again.</li>
       </ul>
       <p>See <a href="settings-behavior.html">behavior settings</a> for the trade-off between the two.</p>
 
       <h2 id="failures">When a run fails</h2>
       <p>
-        A failed run does not retry immediately and does not leave Frost stuck:
+        What happens next depends on <em>why</em> it failed, because the two
+        kinds of failure want opposite treatment:
       </p>
       <ul>
+        <li><strong>Nobody finished the sign-in</strong> — the login window was closed, the notification was never answered, the device code expired unapproved, AWS reported the sign-in denied. Frost stops and waits for you. Trying again would only open another login page for nobody to complete, and an unattended machine would collect one every few minutes all night. The tray menu says <em>Sign-in needed</em>, a single notification tells you so unless you closed the window yourself, and the next refresh is the one <em>you</em> start.</li>
+        <li><strong>Something else failed</strong> — no network, an AWS error before any login page opened. Nothing is on your screen to pile up, so Frost retries on its own: a minute later, then two, doubling up to half-hourly until one succeeds.</li>
+        <li>If the token was renewed and a <em>later</em> step failed — profiles, EKS — the credentials are good, so Frost stays on the normal schedule and tries the whole run again when they expire.</li>
         <li>The error is stored and shown on the <strong>Credentials</strong> page, with the failing step marked on the <strong>Activity</strong> page.</li>
-        <li>The next refresh is rescheduled — if the token is already expired, that is essentially straight away, so a transient failure resolves itself.</li>
-        <li>Closing the login window is treated as "not now": the run aborts rather than holding the refresh lock until the device code expires.</li>
         <li>Errors are recorded with the AWS exception name, HTTP status and request id where AWS provides them, which is what makes them worth pasting into a bug report.</li>
       </ul>
       <p>
diff --git a/docs/docs/login.html b/docs/docs/login.html
index ec89e04..a588b7a 100644
--- a/docs/docs/login.html
+++ b/docs/docs/login.html
@@ -103,7 +103,8 @@ <h3>Default browser</h3>
       <p>
         The trade-off is that Frost has no window to watch: it keeps polling
         until you approve or until the device code expires, so abandoning a
-        sign-in leaves the run waiting rather than failing fast.
+        sign-in leaves the run waiting rather than failing fast. It gives up
+        once, quietly, when the code expires — it does not open a second tab.
       </p>
       <p><a href="settings-behavior.html#login-page">Behavior settings →</a></p>
 
@@ -155,16 +156,24 @@ <h2 id="timeouts">Timeouts and cancellation</h2>
           <thead><tr><th>What you do</th><th>What Frost does</th></tr></thead>
           <tbody>
             <tr><td>Approve the sign-in</td><td>Collects the token on the next poll and continues the run</td></tr>
-            <tr><td>Close the login window</td><td>Aborts the run, records "Login window closed", reschedules</td></tr>
+            <tr><td>Close the login window</td><td>Aborts the run at once and records "Login window closed"</td></tr>
             <tr><td>Ignore it (in-app window)</td><td>Polls until AWS expires the device code, then records "Login timed out"</td></tr>
+            <tr><td>Ignore it (default browser)</td><td>The same — Frost has no window to watch, so it polls the code out</td></tr>
             <tr><td>Ignore the notification (notify mode)</td><td>Waits for the hotkey or a click until the device code expires, then gives up</td></tr>
+            <tr><td>Refuse the sign-in at your identity provider</td><td>Ends the run as soon as AWS reports it, rather than polling on</td></tr>
           </tbody>
         </table>
       </div>
       <p>
         In every case the failure is recorded on the
-        <a href="activity.html">Activity</a> page and the next refresh is
-        rescheduled — a cancelled sign-in never leaves Frost wedged.
+        <a href="activity.html">Activity</a> page — and then Frost waits for you.
+        A sign-in nobody completed is not retried on a timer: the retry would
+        open another login page with nobody there to finish it, and by morning
+        you would have one for every few minutes you were away. The tray menu
+        says <em>Sign-in needed</em>, and a notification says so once — unless
+        you closed the window or refused the sign-in yourself, in which case you
+        already know. The next attempt is the one you start, from the tray, the
+        Credentials page or the hotkey.
       </p>
 
       <h2 id="client">The OAuth client registration</h2>
diff --git a/docs/docs/troubleshooting.html b/docs/docs/troubleshooting.html
index 2232a2b..2dadb0e 100644
--- a/docs/docs/troubleshooting.html
+++ b/docs/docs/troubleshooting.html
@@ -54,18 +54,30 @@ <h2 id="login">Sign-in fails or never completes</h2>
       <h4>"Login window closed"</h4>
       <p>
         The login window was closed before AWS confirmed the approval. Frost
-        treats that as "not now", aborts the run and reschedules. Trigger a
-        refresh from the tray or the Credentials page when you are ready.
+        treats that as "not now" and aborts the run. It does not start another
+        one on its own — trigger a refresh from the tray or the Credentials page
+        when you are ready.
       </p>
 
       <h4>"Login timed out"</h4>
       <p>
-        The device code AWS issued expired before the sign-in was approved. Start
-        another refresh; if this happens repeatedly in notify mode, you may
-        simply not be getting the notification —
+        The device code AWS issued expired before the sign-in was approved. Frost
+        stops there and the tray menu shows <em>Sign-in needed</em>; start
+        another refresh when you are back. If this happens repeatedly in notify
+        mode, you may simply not be getting the notification —
         <a href="#notifications">see below</a>.
       </p>
 
+      <h4>A pile of login tabs or windows waiting for me</h4>
+      <p>
+        Fixed in the version after 0.1.0. A failed sign-in used to be retried
+        twice a second from the moment the token expired, and in
+        <strong>Default browser</strong> mode each attempt opened a tab, so a
+        machine left alone overnight collected one every few minutes. Frost now
+        waits for you after a sign-in nobody completed, and only retries by
+        itself for failures that never put anything on your screen.
+      </p>
+
       <h4>An AWS error naming the client or the endpoint</h4>
       <p>
         Almost always a region mismatch: a client registered in one region means
diff --git a/src/aws-sso.ts b/src/aws-sso.ts
index d3a0232..0fa1734 100644
--- a/src/aws-sso.ts
+++ b/src/aws-sso.ts
@@ -8,7 +8,9 @@ import {
     StartDeviceAuthorizationCommand,
     CreateTokenCommand,
     AuthorizationPendingException,
+    AccessDeniedException,
     ExpiredTokenException,
+    SlowDownException,
     type CreateTokenCommandOutput,
 } from "@aws-sdk/client-sso-oidc";
 import { v4 as uuidv4 } from "uuid";
@@ -39,6 +41,8 @@ import {
 } from "./schedule.js";
 
 let timeoutId: NodeJS.Timeout | undefined;
+let nextRefreshAt: number | null = null;
+let consecutiveFailures = 0;
 let pendingAuthResolve: (() => void) | null = null;
 
 export function hasPendingAuth(): boolean {
@@ -82,10 +86,33 @@ export function setNextTokenRefresh(delayMs?: number) {
     const timeoutMs =
         delayMs ?? nextRefreshDelayMs(expiresAtConfig, Date.now());
 
-    timeoutId = setTimeout(refresh, timeoutMs);
+    nextRefreshAt = Date.now() + timeoutMs;
+    timeoutId = setTimeout(() => {
+        timeoutId = undefined;
+        nextRefreshAt = null;
+        refresh();
+    }, timeoutMs);
     log.info("[setNextTokenRefresh] New timeout set to %sms", timeoutMs);
 }
 
+/**
+ * Stop refreshing until the user asks for one. The tray reads
+ * getNextRefreshAt(), so "waiting for you" is visible rather than silent.
+ */
+export function cancelTokenRefresh() {
+    if (timeoutId) {
+        log.info("[cancelTokenRefresh] Clearing existing timeout");
+        clearTimeout(timeoutId);
+        timeoutId = undefined;
+    }
+    nextRefreshAt = null;
+}
+
+/** Epoch ms of the scheduled refresh, or null when none is pending. */
+export function getNextRefreshAt(): number | null {
+    return nextRefreshAt;
+}
+
 export async function refresh() {
     log.info("[refresh] Refreshing credentials");
 
@@ -131,6 +158,7 @@ export async function refresh() {
         const profiles = await refreshProfiles();
         await updateKubeConfig(profiles);
 
+        consecutiveFailures = 0;
         completeRun("success");
         log.info("[refresh] Run %s completed", runId);
     } catch (err) {
@@ -144,25 +172,89 @@ export async function refresh() {
         }
         config.set("lastError", described);
         completeRun("error", described);
-
-        // A failed run leaves `expiresAt` in the past, so scheduling off it would
-        // retry in MIN_REFRESH_DELAY_MS and start a whole new login every half
-        // second. Retry on a fixed delay, and not at all when the reason we failed
-        // is that nobody completed the login.
-        const retryDelayMs = retryDelayMsAfterError(err);
-        if (retryDelayMs === undefined) {
-            log.warn(
-                "[refresh] Login was not completed, waiting for a manual refresh"
-            );
-        } else {
-            setNextTokenRefresh(retryDelayMs);
-        }
+        scheduleAfterFailure(err);
     } finally {
         config.set("isWorking", false);
         updateTrayIcon();
     }
 }
 
+/** Whether the token Frost already holds is still good. */
+function hasValidToken(): boolean {
+    const expiresAt = config.get("expiresAt") as string | undefined;
+    if (!expiresAt) {
+        return false;
+    }
+    const parsed = moment(expiresAt, moment.ISO_8601);
+    return parsed.isValid() && parsed.isAfter(moment());
+}
+
+/**
+ * Decide when — or whether — to try again after a failed run.
+ *
+ * A failed run leaves `expiresAt` in the past, so scheduling off it would retry
+ * in MIN_REFRESH_DELAY_MS and start a whole new login every half second. These
+ * three outcomes want three different answers instead.
+ */
+function scheduleAfterFailure(err: unknown) {
+    // The token step succeeded and something afterwards (profiles, EKS) did
+    // not. The credentials are good, so stay on the ordinary expiry schedule:
+    // an error retry here would re-run getNewToken() and put a login page on
+    // screen every minute for a failure that has nothing to do with logging in.
+    if (hasValidToken()) {
+        consecutiveFailures = 0;
+        setNextTokenRefresh();
+        return;
+    }
+
+    const retryDelayMs = retryDelayMsAfterError(err, consecutiveFailures + 1);
+
+    // Nobody completed the login. Another attempt would just open another
+    // login page for nobody to complete.
+    if (retryDelayMs === undefined) {
+        consecutiveFailures = 0;
+        cancelTokenRefresh();
+        log.warn(
+            "[refresh] Login was not completed, waiting for a manual refresh"
+        );
+        if (!(err instanceof LoginAbortedError) || !err.cancelledByUser) {
+            notifyLoginNeeded();
+        }
+        return;
+    }
+
+    // Something failed before any login page opened — no network, an AWS error
+    // registering the client. Nothing is on screen to pile up, and it may well
+    // fix itself, so back off and retry.
+    consecutiveFailures += 1;
+    log.info(
+        "[refresh] Failure %s in a row, retrying in %sms",
+        consecutiveFailures,
+        retryDelayMs
+    );
+    setNextTokenRefresh(retryDelayMs);
+}
+
+/**
+ * Say once that Frost has stopped trying. Not retrying an abandoned login is
+ * what keeps the browser clean; without this it would also be silent, and the
+ * user would come back to credentials that expired hours ago with nothing
+ * working on it.
+ */
+function notifyLoginNeeded() {
+    const behavior =
+        (config.get("behaviorConfig") as BehaviorConfig | undefined) ||
+        DEFAULT_BEHAVIOR;
+    const note = new Notification({
+        title: "Frost — Sign-in Needed",
+        body: `The AWS login was not completed. Press ${formatHotkey(
+            behavior.refreshHotkey
+        )} or use the tray to try again.`,
+    });
+    note.on("click", () => refresh());
+    note.show();
+}
+
 async function getNewToken(
     userConfig: UserConfig
 ): Promise<CreateTokenCommandOutput> {
@@ -186,7 +278,13 @@ async function getNewToken(
         startAuth.expiresIn,
         startAuth.interval
     );
-    const tokenExpires = moment().add(startAuth.expiresIn, "seconds");
+    // Both fields are optional in the model. Without defaults an absent
+    // `expiresIn` made `tokenExpires` equal to now (the poll loop never ran)
+    // and an absent `interval` made the sleep NaN, which resolves at once and
+    // turns the loop into a hot poll against AWS.
+    const expiresInSec = startAuth.expiresIn ?? 600;
+    const tokenExpires = moment().add(expiresInSec, "seconds");
+    let pollIntervalMs = (startAuth.interval ?? 5) * 1000;
 
     const behavior =
         (config.get("behaviorConfig") as BehaviorConfig | undefined) ||
@@ -202,7 +300,7 @@ async function getNewToken(
         });
         note.on("click", () => triggerPendingAuth());
         note.show();
-        await waitForUserTrigger(startAuth.expiresIn! * 1000);
+        await waitForUserTrigger(expiresInSec * 1000);
     }
 
     // In default-browser mode there is no window to watch, so windowOpen stays
@@ -215,93 +313,124 @@ async function getNewToken(
         throw new Error("Missing verification URL from device authorization");
     }
 
-    if (behavior.loginMethod === "default_browser") {
-        log.debug("[getNewToken] Opening login in default browser");
-        try {
-            await shell.openExternal(verificationUrl);
-        } catch (err) {
-            throw new Error(
-                `Failed opening login page in browser: ${err}`,
-                { cause: err }
+    // Opening the login page happens inside the try: each attempt starts its
+    // own device authorization, so a window left behind by a throw would sit
+    // there pointing at a code nothing polls any more.
+    try {
+        if (behavior.loginMethod === "default_browser") {
+            log.debug("[getNewToken] Opening login in default browser");
+            try {
+                await shell.openExternal(verificationUrl);
+            } catch (err) {
+                throw new Error(
+                    `Failed opening login page in browser: ${describeError(
+                        err
+                    )}`,
+                    { cause: err }
+                );
+            }
+        } else {
+            log.debug("[getNewToken] Opening login window");
+            if (app.dock) await app.dock.show();
+
+            window = new BrowserWindow({
+                width: 550,
+                height: 700,
+                center: true,
+                webPreferences: {
+                    nodeIntegration: false,
+                },
+            });
+
+            // The page is remote, and Electron's default is to cancel a close
+            // that a `beforeunload` handler objects to. That would strand this
+            // window — and the user's own close with it. Unload regardless.
+            window.webContents.on("will-prevent-unload", (event) =>
+                event.preventDefault()
             );
-        }
-    } else {
-        log.debug("[getNewToken] Opening login window");
-        if (app.dock) await app.dock.show();
-
-        window = new BrowserWindow({
-            width: 550,
-            height: 700,
-            center: true,
-            webPreferences: {
-                nodeIntegration: false,
-            },
-        });
-
-        // Before loadURL, so the very first document gets the overlay that
-        // shows when the page is waiting for a security key or passkey. The
-        // default-browser path needs nothing: the browser has its own UI.
-        attachLoginIndicator(window);
 
-        window.on("close", () => {
-            log.warn("[getNewToken] Login window closed");
-            windowOpen = false;
-        });
+            // Before loadURL, so the very first document gets the overlay that
+            // shows when the page is waiting for a security key or passkey. The
+            // default-browser path needs nothing: the browser has its own UI.
+            attachLoginIndicator(window);
 
-        window.loadURL(verificationUrl);
-    }
+            window.on("close", () => {
+                log.warn("[getNewToken] Login window closed");
+                windowOpen = false;
+            });
 
-    try {
-        while (moment().isBefore(tokenExpires)) {
-            log.debug("[getNewToken] Sleeping for %ss", startAuth.interval!);
-            await delay(startAuth.interval! * 1000);
+            window.loadURL(verificationUrl);
+        }
 
-            try {
-                log.debug("[getNewToken] Trying to get token");
-                return await ssooidc.send(
-                    new CreateTokenCommand({
-                        clientId: client.clientId,
-                        clientSecret: client.clientSecret,
-                        deviceCode: startAuth.deviceCode!,
-                        grantType:
-                            "urn:ietf:params:oauth:grant-type:device_code",
-                    })
-                );
-            } catch (err) {
-                if (isAuthorizationPendingException(err)) {
-                    log.debug("[getNewToken] Authorization pending...");
-                } else if (err instanceof ExpiredTokenException) {
-                    // The device code is dead, so there is nothing left to poll for.
-                    throw new LoginAbortedError(
-                        "Login page expired before it was approved"
-                    );
-                } else {
-                    log.warn(
-                        "[getNewToken] Failed getting token: %s",
-                        describeError(err)
+            while (moment().isBefore(tokenExpires)) {
+                log.debug("[getNewToken] Sleeping for %sms", pollIntervalMs);
+                await delay(pollIntervalMs);
+
+                try {
+                    log.debug("[getNewToken] Trying to get token");
+                    return await ssooidc.send(
+                        new CreateTokenCommand({
+                            clientId: client.clientId,
+                            clientSecret: client.clientSecret,
+                            deviceCode: startAuth.deviceCode!,
+                            grantType:
+                                "urn:ietf:params:oauth:grant-type:device_code",
+                        })
                     );
+                } catch (err) {
+                    if (isAuthorizationPendingException(err)) {
+                        log.debug("[getNewToken] Authorization pending...");
+                    } else if (err instanceof SlowDownException) {
+                        // RFC 8628 §3.5: widen the interval by 5s each time, or
+                        // AWS keeps answering "slow down" instead of the token.
+                        pollIntervalMs += 5000;
+                        log.warn(
+                            "[getNewToken] Polling too fast, interval now %sms",
+                            pollIntervalMs
+                        );
+                    } else if (err instanceof AccessDeniedException) {
+                        // The user said no at the identity provider.
+                        throw new LoginAbortedError(describeError(err), {
+                            cause: err,
+                            cancelledByUser: true,
+                        });
+                    } else if (err instanceof ExpiredTokenException) {
+                        // The device code is dead, so there is nothing left to poll for.
+                        throw new LoginAbortedError(
+                            "Login page expired before it was approved",
+                            { cause: err }
+                        );
+                    } else {
+                        log.warn(
+                            "[getNewToken] Failed getting token: %s",
+                            describeError(err)
+                        );
+                    }
                 }
-            }
 
-            // Closing the window means "I'm not logging in now". Give up here
-            // rather than waiting for a non-pending token error, which may
-            // never come — the run would then hold `isWorking` (and block every
-            // new refresh) until the device code expires.
-            //
-            // This has to come *after* the poll above, not before it. AWS tells
-            // the user to close the window as soon as they approve, so between
-            // the approval and the next poll the window is usually already
-            // gone — and checking first threw away a token that was waiting to
-            // be collected.
-            if (!windowOpen) {
-                log.warn("[getNewToken] User closed login window, aborting");
-                throw new LoginAbortedError("Login window closed");
+                // Closing the window means "I'm not logging in now". Give up here
+                // rather than waiting for a non-pending token error, which may
+                // never come — the run would then hold `isWorking` (and block every
+                // new refresh) until the device code expires.
+                //
+                // This has to come *after* the poll above, not before it. AWS tells
+                // the user to close the window as soon as they approve, so between
+                // the approval and the next poll the window is usually already
+                // gone — and checking first threw away a token that was waiting to
+                // be collected.
+                if (!windowOpen) {
+                    log.warn("[getNewToken] User closed login window, aborting");
+                    throw new LoginAbortedError("Login window closed", {
+                        cancelledByUser: true,
+                    });
+                }
             }
-        }
-        throw new LoginAbortedError("Login timed out");
+            throw new LoginAbortedError("Login timed out");
     } finally {
+        // destroy(), not close(): cleanup must not depend on the remote page
+        // agreeing to unload.
         if (window && !window.isDestroyed()) {
-            window.close();
+            window.destroy();
         }
     }
 }
diff --git a/src/schedule.ts b/src/schedule.ts
index 6d20249..b737c61 100644
--- a/src/schedule.ts
+++ b/src/schedule.ts
@@ -1,20 +1,30 @@
-// Pure scheduling helpers. Deliberately free of electron imports so this file can
-// run (and self-check) under plain node: `node dist/schedule.js`.
-
-import assert from "assert";
-import { pathToFileURL } from "url";
+// Pure scheduling helpers. Deliberately free of electron imports.
 
 export const MIN_REFRESH_DELAY_MS = 500;
+/** The first error retry. Each consecutive failure doubles it from here. */
 export const ERROR_RETRY_DELAY_MS = 60 * 1000;
+/** Ceiling for that doubling, so a long outage settles at half-hourly. */
+export const MAX_ERROR_RETRY_DELAY_MS = 30 * 60 * 1000;
 
 /**
  * A login run that ended because nobody completed it: the window was closed, the
  * device code expired, or it timed out waiting for the user.
  */
 export class LoginAbortedError extends Error {
-    constructor(message: string) {
-        super(message);
+    /**
+     * True when the user ended it themselves — closed the window, refused the
+     * sign-in at the identity provider. They already know it did not happen, so
+     * Frost stays quiet; the passive endings are the ones worth a word.
+     */
+    readonly cancelledByUser: boolean;
+
+    constructor(
+        message: string,
+        options?: ErrorOptions & { cancelledByUser?: boolean }
+    ) {
+        super(message, options);
         this.name = "LoginAbortedError";
+        this.cancelledByUser = options?.cancelledByUser ?? false;
     }
 }
 
@@ -39,46 +49,24 @@ export function nextRefreshDelayMs(
  * stale `expiresAt` made the delay collapse to MIN_REFRESH_DELAY_MS, which is how one
  * unattended login became dozens of browser tabs overnight. Those wait for the user to
  * refresh (tray, dashboard, or the hotkey) instead.
+ *
+ * Everything else backs off as failures repeat. A cause that is not going to fix
+ * itself — a start URL in the wrong region, an SSO instance that has been deleted —
+ * otherwise asks AWS the same question every minute forever, silently.
  */
-export function retryDelayMsAfterError(err: unknown): number | undefined {
+export function retryDelayMsAfterError(
+    err: unknown,
+    consecutiveFailures = 1
+): number | undefined {
     if (err instanceof LoginAbortedError) {
         return undefined;
     }
 
-    return ERROR_RETRY_DELAY_MS;
-}
-
-function demo() {
-    const now = Date.parse("2026-08-20T09:00:00.000Z");
-    assert.strictEqual(
-        nextRefreshDelayMs("2026-08-20T10:00:00.000Z", now),
-        60 * 60 * 1000
-    );
-    // An expiry in the past must not become an immediate, spinning timeout.
-    assert.strictEqual(
-        nextRefreshDelayMs("2026-08-20T08:00:00.000Z", now),
-        MIN_REFRESH_DELAY_MS
+    const doublings = Math.max(consecutiveFailures, 1) - 1;
+    // 2 ** doublings reaches Infinity long before this matters, and Math.min
+    // brings it back to the cap.
+    return Math.min(
+        ERROR_RETRY_DELAY_MS * 2 ** doublings,
+        MAX_ERROR_RETRY_DELAY_MS
     );
-    assert.strictEqual(nextRefreshDelayMs(undefined, now), MIN_REFRESH_DELAY_MS);
-    assert.strictEqual(
-        nextRefreshDelayMs("not-a-date", now),
-        MIN_REFRESH_DELAY_MS
-    );
-    // A login nobody completed must not re-open the login page on its own.
-    assert.strictEqual(
-        retryDelayMsAfterError(new LoginAbortedError("Login timed out")),
-        undefined
-    );
-    assert.strictEqual(
-        retryDelayMsAfterError(new Error("network down")),
-        ERROR_RETRY_DELAY_MS
-    );
-    console.log("schedule self-check OK");
-}
-
-if (
-    process.argv[1] &&
-    import.meta.url === pathToFileURL(process.argv[1]).href
-) {
-    demo();
 }
diff --git a/src/tray.ts b/src/tray.ts
index 84c804b..40348de 100644
--- a/src/tray.ts
+++ b/src/tray.ts
@@ -4,7 +4,7 @@ import { app, shell, Menu, Tray } from "electron";
 import log from "electron-log/main";
 import moment from "moment";
 import { config } from "./config.js";
-import { refresh } from "./aws-sso.js";
+import { getNextRefreshAt, refresh } from "./aws-sso.js";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
@@ -54,19 +54,29 @@ export function updateTrayIcon(onOpenDashboard?: () => void) {
     log.debug("[updateTrayIcon] Updating tray icon");
     const refreshItems = [] as Electron.MenuItemConstructorOptions[];
 
-    const expiresAt = config.get("expiresAt");
-    if (expiresAt) {
-        const timeUntil = moment(
-            expiresAt as string,
-            moment.ISO_8601
-        ).fromNow();
-        refreshItems.push({
-            label: `Next refresh ${timeUntil}`,
-            enabled: false,
-        });
-    }
-
     if (config.get("userConfig")) {
+        // The scheduled time, not the token expiry: after an abandoned login
+        // there is deliberately nothing scheduled (#83), and reading
+        // `expiresAt` here would claim a refresh was due hours ago instead of
+        // saying that Frost is waiting for the user.
+        const nextRefreshAt = getNextRefreshAt();
+        if (nextRefreshAt !== null) {
+            refreshItems.push({
+                label: `Next refresh ${moment(nextRefreshAt).fromNow()}`,
+                enabled: false,
+            });
+        } else if (config.get("isWorking")) {
+            refreshItems.push({
+                label: "Refreshing…",
+                enabled: false,
+            });
+        } else {
+            refreshItems.push({
+                label: "Sign-in needed",
+                enabled: false,
+            });
+        }
+
         refreshItems.push({
             label: "Refresh now",
             click() {