try{(function(){var F=new URLSearchParams(location.hash.slice(1)),K=["integration","status","held","reset","guestChannel","guestLang","appLanguage","onboarding","setupReset","inviteNotice","inviteMail"],C=F.has("integration");F.forEach(function(v,k){if(K.indexOf(k)<0)C=false});if(F.get("miloHandoff")||F.get("miloSession")||C){var Q=new URLSearchParams(location.search),L=false;for(var i=0;i { // A document whose own script or stylesheet never loads never runs the app, so the error reporter's recovery // (client-error-reporter.ts, maybeRecoverFromStaleChunk) cannot fire: the reporter is one of the files that // failed. It runs as an inline async module, which does not wait for the stylesheets above it (a classic // script there waited for all of them, so a failed stylesheet was never caught: PROD-006, 2026-10-14). Same guard, same keys // and the same five-minute window as that recovery, so the two share one reload budget; the mark tells the next // load's beacon it was the recovery (PROD-006 judge, 2026-10-13: a new customer's first page, seven files 502). try { window.addEventListener("error", (event) => { try { // Only while the app has never run: once the reporter is installed (its flag) or the document has // finished loading, a failed file belongs to the reporter's narrower recovery, and a reload here // could destroy what a person is typing (review of #7996). if (window.__miloErrorReporterLive === true || document.readyState === "complete") return; // The Slack install's tab is leaving for its landing (slack-install-tab-forward.ts): a reload would cancel that. if (window.__miloSlackTabForward) return; const target = event && event.target; if (!target || target === window) return; // A script, or a stylesheet: a failed font preload (next/font, /_next/static/media/) leaves a usable page // on a fallback face and must not reload it (Codex review of #7996). const url = target.tagName === "SCRIPT" ? target.src : target.tagName === "LINK" && target.rel === "stylesheet" ? target.href : ""; if (typeof url !== "string" || url.indexOf("/_next/static/") === -1) return; const storage = window.sessionStorage; const now = Date.now(); const stamped = Number(storage.getItem("milo.chunkReloadAt")); if (Number.isFinite(stamped) && stamped > 0 && now - stamped < 300000) return; storage.setItem("milo.chunkReloadAt", String(now)); storage.setItem("milo.chunkRecoveryReload", String(now)); // In Safari, a sign-in's hand-off exchange still in flight is let finish first, 0.4 s at most (owner, Q16b = B, // 2026-10-15): its code is already spent, and WebKit keeps the session cookie only once the whole answer has // arrived, so a reload mid-exchange opened signed out. Every other engine stores it with the headers and reloads // at once. Same number and engine test as the reporter's (client-error-reporter.ts, reloadAfterSignInExchange). const pending = window.__miloHandoffExchange && window.__miloHandoffExchange.response; if (pending && typeof pending.then === "function" && window.navigator && window.navigator.vendor === "Apple Computer, Inc.") { Promise.race([pending, new Promise((resolve) => setTimeout(resolve, 400))]).then(() => location.reload(), () => location.reload()); } else location.reload(); } catch { /* No storage means no way to remember a reload: no reload, never a loop. */ } }, true); } catch { /* Recovery must never be what breaks the page. */ } })(); (() => { // Every dashboard document gets an attempt record; the standalone detail pages (replies, a routine, a run, // an errand) never mount the workspace, so they get the record and not the workspace preload. const path = location.pathname; // The Hexagon door's deep links land on its completion page, which spends the same one-time code: only the exchange below // runs there (PROD-006, 2026-10-16), none of the dashboard's records or reads, since that page moves on to the dashboard. // Every other Hexagon sign-in lands on the dashboard itself since 2026-10-26, a brand-new account's sealed registration // riding the fragment beside the code; the exchange below carries it wherever it lands. // The Slack install's own tab, back on Milo, is leaving for its landing before anything draws (slack-install-tab-forward.ts, // run just above this): no opening to record and no boot to read, so no "started" report waits for a "ready" that cannot come. if (window.__miloSlackTabForward) return; const hexagonCompletion = path === "/auth/hexagon/complete"; // THE ADMIN CONSOLE IS A PAGE PEOPLE WAIT FOR TOO (PROD-006, 2026-10-18): a team re-sign-in to it was timed by its first // admin read because /admin sent nothing. It gets the record and the started report, never the workspace preload. const adminConsole = path === "/admin"; // the console itself; its sub-pages mark nothing usable yet, so they stay unrecorded if (!hexagonCompletion && !adminConsole && path !== "/dashboard" && !path.startsWith("/dashboard/")) return; const standalone = adminConsole || /^\/dashboard\/(replies(\/|$)|(routines|runs|errands)\/.)/.test(path); // a bare /dashboard/routines is the Routines page (dashboard/static-views.mjs) // THE PAGE'S OWN LONG TASKS, FROM THE HEAD ON (PROD-006, 2026-10-19). A customer's Windows app opening had every file served // by 1.4 s and the boot answered by 2.6 s, yet painted at 3.5 s and hydrated at 6.7 s, and no record could say whether // her machine was busy running the page or the bytes were reaching her slowly. Every main-thread task of 50 ms or more // (the browser's own "long task") is kept here as [start, duration], from this script on (and, where the engine buffers // them, the parse before it); the ready report sums them against the paint and the hydration (boot-timing.ts, // longTaskTiming). Chromium only (the desktop apps and Chrome); elsewhere the list stays absent and the report says null. try { if (!window.__miloLongTasks && typeof PerformanceObserver === "function" && (PerformanceObserver.supportedEntryTypes || []).indexOf("longtask") !== -1) { const tasks = (window.__miloLongTasks = []); new PerformanceObserver((list) => { for (const task of list.getEntries()) if (tasks.length < 400) tasks.push([Math.round(task.startTime), Math.round(task.duration)]); }).observe({ type: "longtask", buffered: true }); } // THE SCRIPTS BEHIND THOSE TASKS (PROD-006, 2026-10-24). A customer's Android first page spent 2,371 ms in long tasks before it // was usable, and the row could not name one script: a long task carries no attribution, a long animation frame does // (Chrome 123+). Every frame of 50 ms or more is kept with the three scripts it blames (the 200 longest: a later, longer // frame takes the shortest kept one's place, so a two-second block after two hundred small ones still reaches the report); // the ready report sends the six longest, shaped as the long-task rows are (long-task-beacon.ts scriptsOf), so the // opening's busiest stretches are read at a file and position instead of guessed. if (!window.__miloLongFrames && typeof PerformanceObserver === "function" && (PerformanceObserver.supportedEntryTypes || []).indexOf("long-animation-frame") !== -1) { const frames = (window.__miloLongFrames = []); new PerformanceObserver((list) => { for (const frame of list.getEntries()) { if (frame.duration < 50) continue; const kept = { startTime: frame.startTime, duration: frame.duration, blockingDuration: frame.blockingDuration, scripts: (frame.scripts || []).map((s) => ({ duration: s.duration, invoker: s.invoker, invokerType: s.invokerType, sourceURL: s.sourceURL, sourceFunctionName: s.sourceFunctionName, sourceCharPosition: s.sourceCharPosition })) }; if (frames.length < 200) { frames.push(kept); continue; } let shortest = 0; for (let n = 1; n < frames.length; n += 1) if (frames[n].duration < frames[shortest].duration) shortest = n; if (kept.duration > frames[shortest].duration) frames[shortest] = kept; } }).observe({ type: "long-animation-frame", buffered: true }); } } catch { /* no observer, no list: the report says null */ } // EVERY EARLY READ IS A REAL REQUEST, PARKED ON THE WINDOW UNDER ITS EXACT PATH, WHICH THE APP TAKES (parked-reads.ts; // PROD-006, 2026-10-15). A `` was handed to the app's own fetch by Chromium only: Safari built // the boot twice on 3 of 3 loads and the counted one left after hydration, 1.3 s late. A parked promise is the same // request in every engine, the shape the sign-in exchange below already uses. Same-origin cookie read, the thirty-second // deadline the app gives the same reads; a failed one parks null and the app then asks for itself. const park = (href) => { const reads = window.__miloParkedReads || (window.__miloParkedReads = {}); if (reads[href]) return; // AbortSignal.timeout where the engine has it; an AbortController and a timer where it does not (Safari 15), so a // parked read the app waits on can never hang the boot past the deadline its own read would have. let signal; try { signal = AbortSignal.timeout(30000); } catch { try { const controller = new AbortController(); setTimeout(() => controller.abort(), 30000); signal = controller.signal; } catch { /* no abort at all: no deadline, never no read */ } } reads[href] = fetch(href, { credentials: "same-origin", signal }).catch(() => null); // When it left: a read taken only once its view mounts (a project's page) is too old to show after ten seconds. try { (window.__miloParkedAt || (window.__miloParkedAt = {}))[href] = Date.now(); } catch { /* no stamp: taken as before */ } }; (() => { try { if (hexagonCompletion || window.__miloBootAttempt) return; const attemptId = crypto.randomUUID(); // Whether this document is the one Google sent back: the callback's parameters on the navigation itself // (hydration strips them from the address later). Read for the sign-in span, never stored. const entry = performance.getEntriesByType("navigation")[0]; // The door's parameters ride the fragment since 2026-10-15 (arrival-params.ts): read both, as every consumer does. const arrivalOf = (search, hash) => { const p = new URLSearchParams(search); new URLSearchParams((hash || "").replace(/^#/, "")).forEach((v, k) => { if (!p.has(k)) p.set(k, v); }); return p; }; const arrived = entry && entry.name ? arrivalOf(new URL(entry.name).search, new URL(entry.name).hash) : arrivalOf(location.search, location.hash); // The admin console's return from its Google re-sign-in lands on the dashboard, which replaces itself with /admin // (admin-auth.ts) before any report: that dashboard leaves a one-shot note so this document is the return. // The note carries that dashboard's attempt id, so this document's rows can be joined to the sign-in's callback. let hopFromAttemptId = null; if (adminConsole) { try { hopFromAttemptId = sessionStorage.getItem("milo.adminReturn.v1"); sessionStorage.removeItem("milo.adminReturn.v1"); } catch { /* no storage: no note */ } } window.__miloBootAttempt = { attemptId, tabHidden: document.visibilityState === "hidden", signInReturn: Boolean(arrived.get("miloSession") || arrived.get("miloHandoff")) || hopFromAttemptId !== null, // The document a successful connect sent back (the Google door lands on /dashboard/connections?integration=google&status=connected, // 2026-10-18, and the Microsoft door on the same page with integration=outlook, 2026-10-19); a refused or cancelled // connect lands with another status and is not a connect return. // A sign-in carries a hand-off code (a Microsoft sign-in lands on /dashboard with integration=outlook since 2026-10-20): // that is the sign-in return above, never a connect return. connectReturn: !(arrived.get("miloSession") || arrived.get("miloHandoff")) && (arrived.get("integration") === "google" || arrived.get("integration") === "outlook") && arrived.get("status") === "connected", hopFromAttemptId: hopFromAttemptId }; document.addEventListener("visibilitychange", () => { if (document.visibilityState === "hidden") window.__miloBootAttempt.tabHidden = true; }); const navigation = performance.getEntriesByType("navigation")[0]; const launch = typeof window.miloDesktopShell === "object" && window.miloDesktopShell.launch || null; void fetch("/v1/telemetry/web-boot", { method: "POST", headers: { "content-type": "application/json" }, keepalive: true, body: JSON.stringify({ attemptId, observation: "started", usableReadyMs: null, documentRelease: "9fcea461b46d5d15d67fe58e0ac522a4f36c6f87", shellPainted: null, hydrated: null, workspaceLanded: null, rowsSettled: null, path: location.pathname, tabHidden: window.__miloBootAttempt.tabHidden, hopFromAttemptId: hopFromAttemptId, // A negative first byte is no clock (PROD-006, 2026-10-23: Safari on a phone sent one, and the report was refused whole). documentFirstByte: navigation && navigation.responseStart > 0 ? Math.round(navigation.responseStart) : null, navigationType: navigation && typeof navigation.type === "string" ? navigation.type : null, // The Mac app's launch clock, on its launch window's first document only (apps/desktop launch-clock.ts). launchToDocumentMs: launch ? launch.launchToDocumentMs : null, launchMilestonesMs: launch ? launch.milestonesMs : null, shell: typeof window.miloDesktopShell === "object" ? "desktop" : "web" }) }).catch(() => {}); } catch { /* Telemetry cannot delay or prevent opening the page. */ } })(); // Start the remembered member's workspace read without waiting for stylesheets or hydration. // Cookie identity must match fetchBoot's exactly; bearer boots never take it; the page a sign-in sends back parks its own, below, once its exchange answers. (() => { try { if (standalone || hexagonCompletion) return; if (true && document.cookie.split(";").some((part) => part.trim() === "milo_signed_out=1")) return; // The early script can execute after the app starts its own read. Do not send a second request then. if (window.__miloBootStarted) return; const stored = localStorage.getItem("milo.bridge.user"); const identity = stored ? JSON.parse(stored) : null; const arrivalOf = (search, hash) => { const p = new URLSearchParams(search); new URLSearchParams((hash || "").replace(/^#/, "")).forEach((v, k) => { if (!p.has(k)) p.set(k, v); }); return p; }; const query = arrivalOf(location.search, location.hash); // Hydration can remove callback parameters. The original navigation still names the sign-in, // whose existing cookie may belong to the previous account and must never be preloaded. const navigation = performance.getEntriesByType("navigation")[0]; const originalQuery = navigation ? arrivalOf(new URL(navigation.name).search, new URL(navigation.name).hash) : query; if (!identity?.userId || !identity.tenantId || localStorage.getItem("milo.session") || localStorage.getItem("milo.session.cookieFallback") || [query, originalQuery].some((params) => params.get("miloSession") || params.get("miloHandoff") || params.get("bridgeToken"))) return; // Only where the api answers on this page's origin (the app's getApiUrl rule, as the hand-off branch below reads it): // on a split local setup the app asks another origin, so a read here would be a request nothing takes. const local = ["localhost", "127.0.0.1", "::1"].includes(location.hostname); const apiOrigin = null ? null : (local && location.port && location.port !== "4100" ? null : location.origin); if (!apiOrigin || location.origin !== apiOrigin) return; // The page's attempt id rides the URL, in the order bootUrl() writes it, so the app's own boot names the same path // and takes this read; the server's timing line then names the attempt. const attempt = window.__miloBootAttempt ? window.__miloBootAttempt.attemptId : null; park("/v1/boot?" + new URLSearchParams(Object.assign({ tenantId: identity.tenantId, userId: identity.userId, }, attempt ? { attempt } : {})).toString()); // The connection picture's read leaves beside the boot's, from here, not from the app's boot effect: that effect runs // after hydration, which on a slow machine is seconds after this line, and "the rows settled" waited on it (PROD-006, // 2026-10-14: a Mac load hydrated at 1.6 s and settled 466 ms after landing). The app's boot-time read takes it by the // exact path diagnosticsUrl writes. park("/v1/diagnostics?" + new URLSearchParams({ tenantId: identity.tenantId, userId: identity.userId }).toString()); // A PROJECT'S OWN PAGE READ LEAVES BESIDE THE BOOT (PROD-006, 2026-10-16). The projects view mounts only once the boot // has landed, and its read of the project (and of the task, on a task's page) then left as a second round trip: a cold // project page was usable about 300 ms after it landed (battery C, 2026-10-16: landed p50 1,475, usable 1,794 ms). The // app's page read takes these by the exact paths scopedUrl writes (workspace-live.ts projectPageRead). const segments = path.split("/").filter(Boolean); if (segments[1] === "projects" && segments[2]) { const scope = new URLSearchParams({ tenantId: identity.tenantId, userId: identity.userId }).toString(); const segment = (value) => { try { return decodeURIComponent(value) ? encodeURIComponent(decodeURIComponent(value)) : null; } catch { return null; } }; const project = segment(segments[2]); const task = segments[3] ? segment(segments[3]) : null; if (project) park("/v1/projects/" + project + "?" + scope); if (project && task) park("/v1/projects/" + project + "/tasks/" + task + "?" + scope); } } catch { // Unavailable browser storage leaves no remembered session to preload. } })(); // A COOKIE-SIGNED-IN PAGE WITH NO REMEMBERED IDENTITY ASKS WHO IT IS NOW, NOT AFTER HYDRATION (PROD-006, 2026-10-16). The // app's cookie-profile recovery (cookie-profile-recovery.ts) asks GET /v1/auth/session once its bundle has hydrated, and a // browser with the session cookie but no remembered identity (a first opening on this browser, or storage cleared) could // only ask for its boot after that answer: two round trips in series after hydration. Real cold openings of that kind // started the boot 460 ms to 1.2 s after the document's first byte, against 75 ms where the identity was remembered (the // six days to 2026-10-16). The same read leaves here, bounded by an eight-second deadline of its own (the recovery's // number; a parked read that times out answers null and the recovery asks again), parked for the recovery to take by // its exact path, together with the remembered identity this module saw, so the recovery takes it only when storage // still holds exactly that (another tab may switch accounts before hydration); when it names an identity and nobody remembered one, that identity's boot and // connection reads leave beside it, as the sign-in exchange below does with the identity it answers. The cookie is the // session, so the answer names the account the boot will be read as. Never on a page a sign-in sent back (that cookie may // still be the previous account's), nor in the half minute after one's exchange left (a recovery reload mid-exchange // strips the code from the address while the new cookie is still on its way), after a local sign-out, where a bearer // still rides in storage, or in a build without cookie sessions (no recovery would take it). (() => { try { if (!true || standalone || hexagonCompletion || window.__miloBootStarted) return; try { const pending = Number(sessionStorage.getItem("milo.handoffPendingAt")); if (pending > 0 && Date.now() - pending < 30000) return; } catch { /* no storage: no note to read */ } if (document.cookie.split(";").some((part) => part.trim() === "milo_signed_out=1")) return; if (localStorage.getItem("milo.session") || localStorage.getItem("milo.session.cookieFallback")) return; const arrivalOf = (search, hash) => { const p = new URLSearchParams(search); new URLSearchParams((hash || "").replace(/^#/, "")).forEach((v, k) => { if (!p.has(k)) p.set(k, v); }); return p; }; const navigation = performance.getEntriesByType("navigation")[0]; const originalQuery = navigation ? arrivalOf(new URL(navigation.name).search, new URL(navigation.name).hash) : null; if ([arrivalOf(location.search, location.hash), originalQuery].some((params) => params && (params.get("miloSession") || params.get("miloHandoff") || params.get("bridgeToken")))) return; const local = ["localhost", "127.0.0.1", "::1"].includes(location.hostname); const apiOrigin = null ? null : (local && location.port && location.port !== "4100" ? null : location.origin); if (!apiOrigin || location.origin !== apiOrigin) return; const reads = window.__miloParkedReads || (window.__miloParkedReads = {}); if (reads["/v1/auth/session"]) return; let signal; try { signal = AbortSignal.timeout(8000); } catch { try { const controller = new AbortController(); setTimeout(() => controller.abort(), 8000); signal = controller.signal; } catch { /* no deadline: never no read */ } } const check = fetch("/v1/auth/session", { credentials: "same-origin", cache: "no-store", signal }).catch(() => null); reads["/v1/auth/session"] = check; try { (window.__miloParkedAt || (window.__miloParkedAt = {}))["/v1/auth/session"] = Date.now(); } catch { /* no stamp */ } let remembered = null; let seen = null; try { seen = localStorage.getItem("milo.bridge.user"); remembered = seen ? JSON.parse(seen) : null; } catch { remembered = null; } window.__miloParkedSessionSeen = seen; if (remembered && remembered.userId && remembered.tenantId) return; // its boot already left above check.then((response) => (response && response.status === 200 ? response.clone().json() : null)).then((body) => { if (!body || typeof body !== "object" || !body.tenantId || !body.userId || !body.email) return; if (window.__miloBootStarted) return; const attempt = window.__miloBootAttempt ? window.__miloBootAttempt.attemptId : null; park("/v1/boot?" + new URLSearchParams(Object.assign({ tenantId: body.tenantId, userId: body.userId }, attempt ? { attempt } : {})).toString()); park("/v1/diagnostics?" + new URLSearchParams({ tenantId: body.tenantId, userId: body.userId }).toString()); }).catch(() => {}); } catch { // No early check means the recovery asks for itself after hydration, as it always did. } })(); // THE PAGE A SIGN-IN SENDS BACK STARTS ITS SESSION AND ITS BOOT NOW, NOT AFTER HYDRATION (PROD-006, 2026-10-14). The // Google door, and the admin console's re-authentication, hand the page a one-time code, `miloHandoff` (the Hexagon // login lands on its own completion page first), which the app exchanged for the session cookie only once its bundle // had hydrated, and booted only after that: on a customer's first sign-in the exchange left 2.6 s after the document's // first byte. This runs the SAME exchange (same endpoint, same single-use code, the response Set-Cookies the session) at // HTML time and parks it on the window; the app's own exchangeSessionHandoffCode adopts the parked promise before it // would POST, so the code is spent exactly once (and when the app's POST comes first, it parks itself here the same way, // so a late run of this module sends nothing). THE CODE LEAVES THE ADDRESS THE MOMENT IT IS SPENT: a reload, a duplicated // tab or the file-recovery reload above would otherwise send a spent code and read as a failed sign-in, although the // cookie is already set; stripped, such a page opens as a cookie-signed-in page (cookie-profile-recovery.ts). The app // reads the code from the parked record when the address no longer carries it. Only on the api's own origin: this // module posts by relative path, and the app adopts only on that origin. When the exchange answers an identity and no // bearer (the server's hand-off mode, where the cookie is the session), the boot read the remembered-member path // parks above is parked here too, naming the EXCHANGED identity, never a remembered one: the app's cookie boot names the // same path and takes it. A bearer in the answer, or one lingering in storage, means a boot that carries an Authorization // header this cookie read does not; nothing is parked then. A failed exchange parks null, which the app // treats exactly as its own failed POST. (() => { try { if (standalone) return; // The api's origin by the rule getApiUrl() applies (api-url.ts): the baked NEXT_PUBLIC_MILO_API_URL when the image // bakes one, else this origin, except a local web host on a port of its own, whose api is on 4100. Production's // image bakes none into the browser bundle; the document's server render may read the spec's run-time value // (https://app.joinhexagon.com), and both name the dashboard's own origin, where the api answers through the front // door. The same rule as the app's, or the app would POST a code this module has spent. const local = ["localhost", "127.0.0.1", "::1"].includes(location.hostname); const apiOrigin = null ? null : (local && location.port && location.port !== "4100" ? null : location.origin); if (!apiOrigin || location.origin !== apiOrigin) return; const arrivalOf = (search, hash) => { const p = new URLSearchParams(search); new URLSearchParams((hash || "").replace(/^#/, "")).forEach((v, k) => { if (!p.has(k)) p.set(k, v); }); return p; }; const query = arrivalOf(location.search, location.hash); if (query.get("miloSession") || query.get("bridgeToken")) return; const code = query.get("miloHandoff"); if (!code || !/^[A-Za-z0-9_-]{16,512}$/.test(code)) return; if (window.__miloHandoffExchange) return; // keepalive: the file-recovery reload (the first module above) can unload this document while the exchange is in // flight; the request then completes in the browser's network layer and the cookie it answers with still lands, so // the reloaded page opens signed in from the cookie instead of asking for the sign-in again. const exchange = fetch("/v1/auth/session/handoff", { method: "POST", headers: { "content-type": "application/json" }, credentials: "include", keepalive: true, body: JSON.stringify(Object.assign({ code, withBoot: !hexagonCompletion }, query.get("miloRegistration") ? { registration: query.get("miloRegistration") } : {}, window.__miloBootAttempt ? { attempt: window.__miloBootAttempt.attemptId } : {})), }).then((response) => (response && response.ok ? response.json() : null)).catch(() => null); window.__miloHandoffExchange = { code, response: exchange }; // While this exchange is on its way, a reloaded page must not ask who it is with the cookie it is replacing (the early // check above reads this note). Cleared when it answers; a reload that cuts it short leaves it to age out. try { sessionStorage.setItem("milo.handoffPendingAt", String(Date.now())); } catch { /* no storage: no note */ } exchange.then(() => { try { sessionStorage.removeItem("milo.handoffPendingAt"); } catch { /* no storage */ } }, () => {}); try { const address = new URL(location.href); address.searchParams.delete("miloHandoff"); address.searchParams.delete("miloRegistration"); const fragment = new URLSearchParams(address.hash.replace(/^#/, "")); if (fragment.has("miloHandoff") || fragment.has("miloRegistration")) { fragment.delete("miloHandoff"); fragment.delete("miloRegistration"); address.hash = fragment.toString() ? "#" + fragment.toString() : ""; } window.history.replaceState(window.history.state, "", address.toString()); } catch { // An address that cannot be rewritten keeps the code; the app strips it after adoption, as it always did. } exchange.then((body) => { if (!body || typeof body !== "object" || !body.tenantId || !body.userId || !body.email) return; // The person has signed in: the local sign-out note (cookie-session.ts) goes now, as persistSignedInSession takes it // at adoption, so a reload before adoption recovers this cookie session instead of reading the note and staying out. try { document.cookie = "milo_signed_out=; Path=/; SameSite=Lax; Max-Age=0" + (location.protocol === "https:" ? "; Secure" : ""); } catch {} if (body.miloSession || hexagonCompletion) return; if (window.__miloBootStarted) return; // THE BOOT RODE THE EXCHANGE'S OWN ANSWER when the server could build it (PROD-006, 2026-10-15): the page cannot ask // for its boot until this answer gives it a session, so asking for it here saves a whole round trip. It is parked // for the app's cookie boot, which takes it once for the identity it was built for (takeHandoffBoot); without it // the boot read is parked as on any other page. // Parked before the stale-storage check below: a legacy bearer still in storage is cleared at adoption, and the // app's cookie boot then takes this boot for the exchanged identity (takeHandoffBoot checks it), so a migrating or // switching browser does not build the boot twice (review of #8568). if (typeof body.boot === "string") window.__miloHandoffBoot = { tenantId: body.tenantId, userId: body.userId, raw: body.boot }; else { if (localStorage.getItem("milo.session") || localStorage.getItem("milo.session.cookieFallback")) return; const attempt = window.__miloBootAttempt ? window.__miloBootAttempt.attemptId : null; park("/v1/boot?" + new URLSearchParams(Object.assign({ tenantId: body.tenantId, userId: body.userId, }, attempt ? { attempt } : {})).toString()); } park("/v1/diagnostics?" + new URLSearchParams({ tenantId: body.tenantId, userId: body.userId }).toString()); }).catch(() => {}); } catch { // No exchange here means the app runs its own, as it always did. } })(); })();