diff --git a/AGENTS.md b/AGENTS.md
index 847f9a0a4..7a8f33b27 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -64,6 +64,8 @@ Keep comments light. Prefer self-documenting code — clear names, small functio
 - The _why_ is non-obvious (a hidden constraint, a workaround, a subtle invariant).
 - A non-trivial usage detail would otherwise trip the next reader.
 
+If comments need to be more than a line, its probably too long, and when it does need multiline comments, use multiline `/** ... */` JSDoc style for consistency. Use `//` for single-line comments.
+
 Don't restate what the code already says. Don't write comments that reference the current task or PR or version of something — those rot.
 
 **No ticket references in code or test comments.** Don't write `PUT-1234`, `AUTH-3`, `GUI-2`, `// fix for FOO-99`, `// per ROLLOUT-1`, or section headers like `// -- PUT-1020: ... --`. The ticket exists in git history and the issue tracker; the code should describe the _why_ in domain terms ("logout cascade transparently invalidates...") not project-management terms ("the cascade from AUTH-3..."). Same rule for test-block names and section dividers — describe what's being tested, not which ticket asked for it.
diff --git a/src/gui/src/UI/UIWindowSignup.js b/src/gui/src/UI/UIWindowSignup.js
index cd588567b..4b847b77b 100644
--- a/src/gui/src/UI/UIWindowSignup.js
+++ b/src/gui/src/UI/UIWindowSignup.js
@@ -24,7 +24,7 @@ import UIWindowPhoneVerificationRequired from './UIWindowPhoneVerificationRequir
 import UIWindowCardVerificationRequired from './UIWindowCardVerificationRequired.js';
 import UIWindowLogin from './UIWindowLogin.js';
 
-function UIWindowSignup (options) {
+function UIWindowSignup(options) {
     options = options ?? {};
     options.reload_on_success = options.reload_on_success ?? true;
     options.has_head = options.has_head ?? true;
@@ -34,15 +34,16 @@ function UIWindowSignup (options) {
     return new Promise(async (resolve) => {
         const internal_id = window.uuidv4();
 
-        const logo_clickable = !!options.window_options?.cover_page && !window.embedded_in_popup;
+        const logo_clickable =
+            !!options.window_options?.cover_page && !window.embedded_in_popup;
 
         let h = '';
-        h += '<div style="margin: 0 auto; max-width: 500px; min-width: 400px;">';
+        h +=
+            '<div style="margin: 0 auto; max-width: 500px; min-width: 400px;">';
         // logo
         h += `<img src="${window.icons['logo-white.svg']}" class="auth-logo" style="width: 40px; height: 40px; margin: 0 auto; display: block; padding: 10px; background-color: blue; border-radius: 5px;${logo_clickable ? ' cursor: pointer;' : ''}">`;
         // close button
-        if ( !options.has_head && options.show_close_button !== false )
-        {
+        if (!options.has_head && options.show_close_button !== false) {
             h += '<div class="generic-close-window-button"> &times; </div>';
         }
 
@@ -66,7 +67,8 @@ function UIWindowSignup (options) {
         h += `<input id="email-${internal_id}" value="${html_encode(options.email ?? '')}" class="email" type="email" autocomplete="email" spellcheck="false" autocorrect="off" autocapitalize="off" data-gramm_editor="false"/>`;
         h += '</div>';
         // password
-        h += '<div style="overflow: hidden; margin-top: 10px; position: relative;">';
+        h +=
+            '<div style="overflow: hidden; margin-top: 10px; position: relative;">';
         h += `<label for="password-${internal_id}">${i18n('password')}</label>`;
         h += `<input id="password-${internal_id}" class="password" type="${options.show_password ? 'text' : 'password'}" name="password" autocomplete="new-password" />`;
         // show/hide icon
@@ -75,7 +77,8 @@ function UIWindowSignup (options) {
                               </span>`;
         h += '</div>';
         // confirm password
-        h += '<div style="overflow: hidden; margin-top: 10px; margin-bottom: 10px; position: relative">';
+        h +=
+            '<div style="overflow: hidden; margin-top: 10px; margin-bottom: 10px; position: relative">';
         h += `<label for="confirm-password-${internal_id}">${i18n('signup_confirm_password')}</label>`;
         h += `<input id="confirm-password-${internal_id}" class="confirm-password" type="${options.show_password ? 'text' : 'password'}" name="confirm-password" autocomplete="new-password" />`;
         // show/hide icon
@@ -84,11 +87,13 @@ function UIWindowSignup (options) {
                               </span>`;
         h += '</div>';
         // bot trap - if this value is submitted server will ignore the request
-        h += '<input type="text" name="p102xyzname" class="p102xyzname" value="">';
+        h +=
+            '<input type="text" name="p102xyzname" class="p102xyzname" value="">';
 
         // Turnstile widget (only when enabled)
-        if ( window.gui_params?.turnstileSiteKey ) {
-            h += '<div style="min-height: 20px; display: flex; justify-content: center;">';
+        if (window.gui_params?.turnstileSiteKey) {
+            h +=
+                '<div style="min-height: 20px; display: flex; justify-content: center;">';
             // appearance: always/execute/interaction-only
             // docs: https://developers.cloudflare.com/turnstile/get-started/client-side-rendering/widget-configurations/?utm_source=chatgpt.com#appearance-modes
             h += `<div class="cf-turnstile" data-sitekey="${window.gui_params.turnstileSiteKey}" data-appearance="interaction-only"></div>`;
@@ -98,7 +103,8 @@ function UIWindowSignup (options) {
         // Create Account
         h += `<button class="signup-btn button button-primary button-block button-normal">${i18n('create_free_account')}</button>`;
         h += '</form>';
-        h += '<div class="oidc-providers-wrapper" style="display:none; padding: 10px 0;">';
+        h +=
+            '<div class="oidc-providers-wrapper" style="display:none; padding: 10px 0;">';
         h += `<button type="button" class="oidc-google-btn button button-block button-normal" style="display:none; align-items:center; justify-content:center; gap:8px;"><img style="width: 20px; height: 20px;" src="data:image/webp;base64,UklGRu4GAABXRUJQVlA4WAoAAAAQAAAAXwAAXwAAQUxQSAUDAAABoATJtmnbGs+23+vZtm3btm3btnHxjG/btm3bnI197tljzjXjtSNiAnAjmbNs8x5DR40e2qtFhTzuVJ2e+rrE/ODKwsZe5J90n9CfXVw6vLEvifIH87OHVOK0mLxSLpSyd4vZhyuGkP+amL45j7lVYn6+rQpfSYDvFzO0QgIdYeZJCTbNRpnfJeDXLTSQsH/X6yiBj1TrIoEPgnZzCXwwtMtL4AOhnfP/wPpC/X0Jux/Uj4jySzsGVskJADkq9dn4JKEP1NuJ6gMDELvrrTF6QP9fjX0FQc2xLZme0E8Tfko20LOmZdAD+tWF/lVlqNb7I9IFBt+hpUD9CZGuMNhT2ONh8GJvWPyK1QZedhdyS7j5Bqkf3Kwo3A3w8yTneTgq3NyOdOZMhqPplM/h6Z+Urp6UF+ZX8HQGZZIrVylw9SvGnRqP33ev2QdSEwlzpIaYTlCOUtSLQpGujN/hRePIFMZDbgyOrGUcdGNe5CBjoRtbIimMMW4ciVxgDHQjxb0LkRTGGF8OMha6kRZZyzjkxrHIFMbDbmyPdGX84cbiSDmGFPNiZASU0V60SvAV4y4vyiS4yhCNSuXZxb5lIOEMyngFRSF+nqg85YsAOjNuSoQ/GdLJXhpjfgbplE/tCbN2Bp0pMtHaBAoy5khOY78yHkjiJOdZW3OEOSmJihxZaymPUPMlgTc40sfQy5RnkWx3kjQ3c0ioI5LClyRpZWSRcJF8T5aMNbFKuHti4B2WnDVwUcj541SnyVeVlCp/KeQ0xE6jiZzNppD1jNDzxcO/PJG9BUhF9gl/B4jtNEQeGBAv55gnRfFfUI+oiMhLOwZWyRnJXKbltLOfim4nDt5XMn0N5Jz/e/Eb6OW9KMtDcx8GQrOLB6ug2zG8fdBuENoB6Jf5PaiVMPlkQP1hdEUov5aH2QpfBXETTK+y91dnGM9/zdh2BFj2bkNn8iHMEqeN7MiJgMe+pPZwP4Sef9J9vL8vD8oMH6tOT309zo+P7BlcAs7mLNu8x9BRY4b1aVO9MG4cAQBWUDggwgMAABAVAJ0BKmAAYAA+bSyTRqQiIaEtVEyQgA2JbAC++hZa3jl94/Jj2rrA/Tvv9y7x+OzH+L5o/8p7APMA/TPpD+YD+bf4T9bPfW/mfqo/wHqAf0v/hdYB6AH7Aemp+5HwS/uN+6XtXdQB1N/Rj+m/RWYp6GESYsQNCm+TZ3BvtEgBK+isF38GQzHNMrw+tkbAm5lUM4rWqU9srOS+RuAUa8nFYoFrGH73Fzd++s+LPyEGAAD+Yg+gQRuJCapqteWj86DdkHmfHdS+mWVn7Ue8RiK5AaWCIe7RXaDKn0baNe80expR5tTBclgnd+SEzNZ6N3NL1suPhGwRqKzB5wNnWUXD7R0IkT5uIwUhTsO/1ucVEMKvTZRe4j7WwrA+e53P8J1/cdIvKtrtZv9AH5u1heZ1dGQELuxMxbQUnrw6IUh0YLBKEjNnR3JIsFNwkC+WLw4wkCMati73lcMjT6U2KIYsr0g5bPzSmo3ir9qRjtIqthpPIvuvYt8AbMewSj96NIqTM14M6ABtOaY87d8HOU7baFGGQjU1f8vf7SV5AjDrfW0VVzQcBez+PYiPApyQUAozEmZFKBDvX9ifFFacoulG9NCPDXa1mRPVwzrKuN3VfwUfv8Bx8QJ88prsOCDd8UvNDnUzbRqBXOmQ4co+/xYy/iQV89GHs4pb0D2LYwv6aY8yPLCrYyAPUe4dKEh/FBqRBJ/716CJVMTCrvB+gSgPwNjN5LlnNQqkBsHnSqdUFddjvBKNdm6zm8ggLFJl14S37sJW1fAEbiB0IqxcqlJOWol+ecJy9xdESchmlROmo/4/9V34VN2cw8NUB5POPUNzivyMFfgF27QTFXgya/LF3OsfHMF6Itejgy4ab38VPFjez5f8Z/b/dhYV21SflE4KtUj8LZDrQXRp+Pzdf/gWfvm2oLh0x+Fr+ggo2jjG3DFn95Wj1P3ra1RtzYE8ffXBeR2lDhL+GPJiiZaVinGMkjVYup0AghAhIfVgFtsL8lhMyJY84ccksHz92o1/J3NfrGSM8NwOv7ieeBjq2eqCOmrUHpG3mlr8Hj/fR4d+orLlpipLTh3+cRY7suXQXw9SPYZieoKS/JE9y0f+BcWCzdNshWl2oVpeK2qm36iFltfGZUvXdfBKufE9RkZcyOBDUVeONlBchjuaLPNd6fSlk41Pp57nF5MmES2Kl7HqY+f2pvS71eIgUXpqtAFIY94JSmNre+g49tL8VnZlJNqgVhj/De//5zH/84h//5uJfunlawY99GgDkm8cYFbIAAAA" />${i18n('sign_up_with_google')}</button>`;
         h += `<button type="button" class="oidc-microsoft-btn button button-block button-normal" style="display:none; align-items:center; justify-content:center; gap:8px; margin-top:8px;"><svg style="width:20px; height:20px;" viewBox="0 0 23 23" fill="none"><rect x="1" y="1" width="10" height="10" fill="#f25022"/><rect x="12" y="1" width="10" height="10" fill="#7fba00"/><rect x="1" y="12" width="10" height="10" fill="#00a4ef"/><rect x="12" y="12" width="10" height="10" fill="#ffb900"/></svg>${i18n('sign_up_with_microsoft')}</button>`;
         h += `<button type="button" class="oidc-apple-btn button button-block button-normal" style="display:none; align-items:center; justify-content:center; gap:8px; margin-top:8px;"><svg style="width:20px; height:20px;" viewBox="0 0 384 512" fill="currentColor"><path d="M318.7 268.7c-.2-36.7 16.4-64.4 50-84.8-18.8-26.9-47.2-41.7-84.7-44.6-35.5-2.8-74.3 20.7-88.5 20.7-15 0-49.4-19.7-76.4-19.7C63.3 141.2 4 184.8 4 273.5q0 39.3 14.4 81.2c12.8 36.7 59 126.7 107.2 125.2 25.2-.6 43-17.9 75.8-17.9 31.8 0 48.3 17.9 76.4 17.9 48.6-.7 90.4-82.5 102.6-119.3-65.2-30.7-61.7-90-61.7-91.9zm-56.6-164.2c27.3-32.4 24.8-61.9 24-72.5-24.1 1.4-52 16.4-67.9 34.9-17.5 19.8-27.8 44.3-25.6 71.9 26.1 2 49.9-11.4 69.5-34.3z"/></svg>${i18n('sign_up_with_apple')}</button>`;
@@ -139,38 +145,63 @@ function UIWindowSignup (options) {
             dominant: true,
             center: true,
             onAppend: function (el_window) {
-                if ( options.authError ) {
-                    $(el_window).find('.signup-error-msg').html(html_encode(options.authError)).fadeIn();
+                if (options.authError) {
+                    $(el_window)
+                        .find('.signup-error-msg')
+                        .html(html_encode(options.authError))
+                        .fadeIn();
                 }
-                if ( ! window.disable_signup_autofocus )
-                {
-                    $(el_window).find('.username').get(0).focus({ preventScroll: true });
+                if (!window.disable_signup_autofocus) {
+                    $(el_window)
+                        .find('.username')
+                        .get(0)
+                        .focus({ preventScroll: true });
                 }
-                if ( logo_clickable ) {
-                    $(el_window).find('.auth-logo').on('click', function () {
-                        // keep desktop users on the desktop; everyone else goes to the root dashboard
-                        window.location.href = window.location.pathname === '/desktop' ? '/desktop' : '/';
-                    });
+                if (logo_clickable) {
+                    $(el_window)
+                        .find('.auth-logo')
+                        .on('click', function () {
+                            // keep desktop users on the desktop; everyone else goes to the root dashboard
+                            window.location.href =
+                                window.location.pathname === '/desktop'
+                                    ? '/desktop'
+                                    : '/';
+                        });
                 }
 
                 // Initialize Turnstile widget with callback to capture token
                 const initTurnstile = () => {
-                    if ( window.turnstile && window.gui_params?.turnstileSiteKey ) {
+                    if (
+                        window.turnstile &&
+                        window.gui_params?.turnstileSiteKey
+                    ) {
                         window.turnstile.render('.cf-turnstile', {
                             sitekey: window.gui_params.turnstileSiteKey,
                             callback: function (token) {
                                 // Store the token for the signup request
-                                $(el_window).find('.cf-turnstile').attr('data-token', token);
+                                $(el_window)
+                                    .find('.cf-turnstile')
+                                    .attr('data-token', token);
                                 // Enable the signup button once CAPTCHA is completed
-                                $(el_window).find('.signup-btn').prop('disabled', false);
+                                $(el_window)
+                                    .find('.signup-btn')
+                                    .prop('disabled', false);
                                 // Add visual feedback
-                                $(el_window).find('.cf-turnstile').addClass('captcha-completed');
+                                $(el_window)
+                                    .find('.cf-turnstile')
+                                    .addClass('captcha-completed');
                             },
                             'expired-callback': function () {
                                 // Reset when token expires
-                                $(el_window).find('.cf-turnstile').removeAttr('data-token');
-                                $(el_window).find('.cf-turnstile').removeClass('captcha-completed');
-                                $(el_window).find('.signup-btn').prop('disabled', true);
+                                $(el_window)
+                                    .find('.cf-turnstile')
+                                    .removeAttr('data-token');
+                                $(el_window)
+                                    .find('.cf-turnstile')
+                                    .removeClass('captcha-completed');
+                                $(el_window)
+                                    .find('.signup-btn')
+                                    .prop('disabled', true);
                             },
                         });
                     } else {
@@ -183,53 +214,83 @@ function UIWindowSignup (options) {
 
                 (async () => {
                     try {
-                        const res = await fetch(`${window.api_origin}/auth/oidc/providers`);
-                        if ( ! res.ok ) return;
+                        const res = await fetch(
+                            `${window.api_origin}/auth/oidc/providers`,
+                        );
+                        if (!res.ok) return;
                         const data = await res.json();
-                        if ( ! data.providers ) return;
+                        if (!data.providers) return;
 
                         const wireOidcBtn = (provider, btnClass) => {
                             $(el_window).find(btnClass).css('display', 'flex');
-                            $(el_window).find(btnClass).on('click', function () {
-                                let url = `${window.gui_origin}/auth/oidc/${provider}/start?flow=signup`;
-                                // return to the interface the signup started from (backend whitelists the path)
-                                const return_to = window.location.pathname;
-                                if ( return_to === '/desktop' || return_to === '/dashboard' ) {
-                                    url += `&return_to=${encodeURIComponent(return_to)}`;
-                                }
-                                const referrer = options.referrer ?? window.referrerStr;
-                                if ( referrer ) {
-                                    url += `&referrer=${encodeURIComponent(referrer)}`;
-                                }
-                                if ( window.embedded_in_popup && window.url_query_params?.get('msg_id') ) {
-                                    url += `&embedded_in_popup=true&msg_id=${encodeURIComponent(window.url_query_params.get('msg_id'))}`;
-                                    if ( window.openerOrigin ) {
-                                        url += `&opener_origin=${encodeURIComponent(window.openerOrigin)}`;
+                            $(el_window)
+                                .find(btnClass)
+                                .on('click', function () {
+                                    let url = `${window.gui_origin}/auth/oidc/${provider}/start?flow=signup`;
+                                    // return to the interface the signup started from (backend whitelists the path)
+                                    const return_to = window.location.pathname;
+                                    if (
+                                        return_to === '/desktop' ||
+                                        return_to === '/dashboard'
+                                    ) {
+                                        url += `&return_to=${encodeURIComponent(return_to)}`;
                                     }
-                                }
-                                window.location.href = url;
-                            });
+                                    const referrer =
+                                        options.referrer ?? window.referrerStr;
+                                    if (referrer) {
+                                        url += `&referrer=${encodeURIComponent(referrer)}`;
+                                    }
+                                    if (
+                                        window.embedded_in_popup &&
+                                        window.url_query_params?.get('msg_id')
+                                    ) {
+                                        url += `&embedded_in_popup=true&msg_id=${encodeURIComponent(window.url_query_params.get('msg_id'))}`;
+                                        if (window.openerOrigin) {
+                                            url += `&opener_origin=${encodeURIComponent(window.openerOrigin)}`;
+                                        }
+                                    }
+                                    window.location.href = url;
+                                });
                         };
 
                         let hasProvider = false;
-                        if ( data.providers.includes('google') ) { hasProvider = true; wireOidcBtn('google', '.oidc-google-btn'); }
-                        if ( data.providers.includes('apple') ) { hasProvider = true; wireOidcBtn('apple', '.oidc-apple-btn'); }
-                        if ( data.providers.includes('microsoft') ) { hasProvider = true; wireOidcBtn('microsoft', '.oidc-microsoft-btn'); }
-                        if ( hasProvider ) {
+                        if (data.providers.includes('google')) {
+                            hasProvider = true;
+                            wireOidcBtn('google', '.oidc-google-btn');
+                        }
+                        if (data.providers.includes('apple')) {
+                            hasProvider = true;
+                            wireOidcBtn('apple', '.oidc-apple-btn');
+                        }
+                        if (data.providers.includes('microsoft')) {
+                            hasProvider = true;
+                            wireOidcBtn('microsoft', '.oidc-microsoft-btn');
+                        }
+                        if (hasProvider) {
                             $(el_window).find('.oidc-providers-wrapper').show();
                             // Hide the signup form and show the "Sign up with email" button
                             $(el_window).find('.signup-form').hide();
                             $(el_window).find('.signup-form-title').hide();
-                            $(el_window).find('.signup-with-email-wrapper').show();
-                            $(el_window).find('.signup-with-email-btn').on('click', function () {
-                                $(el_window).find('.signup-form').show();
-                                $(el_window).find('.signup-form-title').show();
-                                $(el_window).find('.signup-with-email-wrapper').hide();
-                                $(el_window).find('.username').get(0)?.focus({ preventScroll: true });
-                            });
+                            $(el_window)
+                                .find('.signup-with-email-wrapper')
+                                .show();
+                            $(el_window)
+                                .find('.signup-with-email-btn')
+                                .on('click', function () {
+                                    $(el_window).find('.signup-form').show();
+                                    $(el_window)
+                                        .find('.signup-form-title')
+                                        .show();
+                                    $(el_window)
+                                        .find('.signup-with-email-wrapper')
+                                        .hide();
+                                    $(el_window)
+                                        .find('.username')
+                                        .get(0)
+                                        ?.focus({ preventScroll: true });
+                                });
                         }
-                    } catch (_) {
-                    }
+                    } catch (_) {}
                 })();
             },
             window_class: 'window-signup',
@@ -240,7 +301,7 @@ function UIWindowSignup (options) {
                 width: 'initial',
                 'background-color': 'white',
                 'backdrop-filter': 'blur(3px)',
-                'display': 'flex',
+                display: 'flex',
                 'flex-direction': 'column',
                 'justify-content': 'center',
                 'align-items': 'center',
@@ -260,282 +321,346 @@ function UIWindowSignup (options) {
             `,
         });
 
-        $(el_window).find('.login-c2a-clickable').on('click', async function (e) {
-            $('.login-c2a-clickable').parents('.window').close();
-            const login = await UIWindowLogin({
-                referrer: options.referrer,
-                reload_on_success: options.reload_on_success,
-                redirect_url: options.redirect_url,
-                window_options: options.window_options,
-                show_close_button: options.show_close_button,
-                send_confirmation_code: options.send_confirmation_code,
-                show_password: false,
+        $(el_window)
+            .find('.login-c2a-clickable')
+            .on('click', async function (e) {
+                $('.login-c2a-clickable').parents('.window').close();
+                const login = await UIWindowLogin({
+                    referrer: options.referrer,
+                    reload_on_success: options.reload_on_success,
+                    redirect_url: options.redirect_url,
+                    window_options: options.window_options,
+                    show_close_button: options.show_close_button,
+                    send_confirmation_code: options.send_confirmation_code,
+                    show_password: false,
+                });
+                if (login) {
+                    resolve(true);
+                }
             });
-            if ( login )
-            {
-                resolve(true);
-            }
-        });
 
-        $(el_window).find('.signup-btn').on('click', async function (e) {
-            // Clear previous error states
-            $(el_window).find('.signup-error-msg').hide();
+        $(el_window)
+            .find('.signup-btn')
+            .on('click', async function (e) {
+                // Clear previous error states
+                $(el_window).find('.signup-error-msg').hide();
 
-            //Username
-            let username = $(el_window).find('.username').val();
+                //Username
+                let username = $(el_window).find('.username').val();
 
-            if ( ! username ) {
-                $(el_window).find('.signup-error-msg').html(i18n('username_required'));
-                $(el_window).find('.signup-error-msg').fadeIn();
-                return;
-            }
-
-            //Email
-            let email = $(el_window).find('.email').val();
-
-            // must have an email
-            if ( ! email ) {
-                $(el_window).find('.signup-error-msg').html(i18n('email_required'));
-                $(el_window).find('.signup-error-msg').fadeIn();
-                return;
-            }
-            // must be a valid email
-            else if ( ! window.is_email(email) ) {
-                $(el_window).find('.signup-error-msg').html(i18n('email_invalid'));
-                $(el_window).find('.signup-error-msg').fadeIn();
-                return;
-            }
-
-            //Password
-            let password = $(el_window).find('.password').val();
-
-            // must have a password
-            if ( ! password ) {
-                $(el_window).find('.signup-error-msg').html(i18n('password_required'));
-                $(el_window).find('.signup-error-msg').fadeIn();
-                return;
-            }
-            // check password strength
-            const pass_strength = check_password_strength(password);
-            if ( ! pass_strength.overallPass ) {
-                $(el_window).find('.signup-error-msg').html(i18n('password_strength_error'));
-                $(el_window).find('.signup-error-msg').fadeIn();
-                return;
-            }
-            // get confirm password value
-            const confirmPassword = $(el_window).find('.confirm-password').val();
-            if ( ! confirmPassword ) {
-                $(el_window).find('.signup-error-msg').html(i18n('confirm_password_required'));
-                $(el_window).find('.signup-error-msg').fadeIn();
-                return;
-            }
-            // check if passwords match
-            if ( password !== confirmPassword ) {
-                $(el_window).find('.signup-error-msg').html(i18n('passwords_do_not_match'));
-                $(el_window).find('.signup-error-msg').fadeIn();
-                return;
-            }
-
-            // Check if Cloudflare Turnstile CAPTCHA was completed
-            let turnstileToken = null;
-            if ( window.turnstile && window.gui_params?.turnstileSiteKey ) {
-                turnstileToken = $(el_window).find('.cf-turnstile').attr('data-token');
-                if ( ! turnstileToken ) {
-                    $(el_window).find('.signup-error-msg').html(i18n('captcha_required') || 'Please complete the CAPTCHA verification');
+                if (!username) {
+                    $(el_window)
+                        .find('.signup-error-msg')
+                        .html(i18n('username_required'));
                     $(el_window).find('.signup-error-msg').fadeIn();
                     return;
                 }
-            }
 
-            //xyzname
-            let p102xyzname = $(el_window).find('.p102xyzname').val();
+                //Email
+                let email = $(el_window).find('.email').val();
 
-            // disable 'Create Account' button
-            $(el_window).find('.signup-btn').prop('disabled', true);
+                // must have an email
+                if (!email) {
+                    $(el_window)
+                        .find('.signup-error-msg')
+                        .html(i18n('email_required'));
+                    $(el_window).find('.signup-error-msg').fadeIn();
+                    return;
+                }
+                // must be a valid email
+                else if (!window.is_email(email)) {
+                    $(el_window)
+                        .find('.signup-error-msg')
+                        .html(i18n('email_invalid'));
+                    $(el_window).find('.signup-error-msg').fadeIn();
+                    return;
+                }
 
-            let headers = {};
-            if ( window.custom_headers )
-            {
-                headers = window.custom_headers;
-            }
+                //Password
+                let password = $(el_window).find('.password').val();
 
-            // Device signal for abuse prevention; omitted when unavailable
-            let fingerprint = null;
-            try {
-                fingerprint = await window.getDeviceFingerprint?.();
-            } catch (_) {
-                // signup must never block or fail because of device signals
-            }
+                // must have a password
+                if (!password) {
+                    $(el_window)
+                        .find('.signup-error-msg')
+                        .html(i18n('password_required'));
+                    $(el_window).find('.signup-error-msg').fadeIn();
+                    return;
+                }
+                // check password strength
+                const pass_strength = check_password_strength(password);
+                if (!pass_strength.overallPass) {
+                    $(el_window)
+                        .find('.signup-error-msg')
+                        .html(i18n('password_strength_error'));
+                    $(el_window).find('.signup-error-msg').fadeIn();
+                    return;
+                }
+                // get confirm password value
+                const confirmPassword = $(el_window)
+                    .find('.confirm-password')
+                    .val();
+                if (!confirmPassword) {
+                    $(el_window)
+                        .find('.signup-error-msg')
+                        .html(i18n('confirm_password_required'));
+                    $(el_window).find('.signup-error-msg').fadeIn();
+                    return;
+                }
+                // check if passwords match
+                if (password !== confirmPassword) {
+                    $(el_window)
+                        .find('.signup-error-msg')
+                        .html(i18n('passwords_do_not_match'));
+                    $(el_window).find('.signup-error-msg').fadeIn();
+                    return;
+                }
 
-            // Include captcha in request only if required
-            const requestData = {
-                username: username,
-                email: email,
-                password: password,
-                referrer: options.referrer ?? window.referrerStr,
-                send_confirmation_code: options.send_confirmation_code,
-                p102xyzname: p102xyzname,
-                'cf-turnstile-response': turnstileToken,
-            };
-            if ( fingerprint ) {
-                requestData.fingerprint = fingerprint;
-            }
+                // Check if Cloudflare Turnstile CAPTCHA was completed
+                let turnstileToken = null;
+                if (window.turnstile && window.gui_params?.turnstileSiteKey) {
+                    turnstileToken = $(el_window)
+                        .find('.cf-turnstile')
+                        .attr('data-token');
+                    if (!turnstileToken) {
+                        $(el_window)
+                            .find('.signup-error-msg')
+                            .html(
+                                i18n('captcha_required') ||
+                                    'Please complete the CAPTCHA verification',
+                            );
+                        $(el_window).find('.signup-error-msg').fadeIn();
+                        return;
+                    }
+                }
 
-            $.ajax({
-                url: `${window.gui_origin }/signup`,
-                type: 'POST',
-                async: true,
-                headers: headers,
-                contentType: 'application/json',
-                data: JSON.stringify(requestData),
-                success: async function (data) {
-                    await window.update_auth_data(data.token, data.user);
+                //xyzname
+                let p102xyzname = $(el_window).find('.p102xyzname').val();
 
-                    // The phone (SMS) and card gates run before any reload:
-                    // reloading first would tear down the signup flow mid-way
-                    // and leave the dialogs to the boot-time whoami check,
-                    // which not every entry point reliably reaches. The email
-                    // dialog is closable (no retry loop), so in reload flows
-                    // it keeps its old post-reload timing — the boot check
-                    // shows the uncloseable variant — rather than risk a
-                    // dismissed dialog stranding the page before the reload.
-                    let email_verified = true;
-                    const show_email_dialog = !options.reload_on_success &&
-                        (options.send_confirmation_code || data.user?.requires_email_confirmation);
-                    if ( data.user?.requires_phone_verification || data.user?.requires_card_verification || show_email_dialog ) {
-                        $(el_window).close();
-                        // Low-reputation signups must clear every flagged gate.
-                        // Phone (SMS) and email come first; the card gate only
-                        // shows once those are cleared.
-                        if ( data.user?.requires_phone_verification ) {
-                            let phone_ok = false;
-                            do {
-                                phone_ok = await UIWindowPhoneVerificationRequired({
-                                    show_close_button: false,
-                                    stay_on_top: true,
-                                    has_head: true,
-                                    window_options: options.window_options ?? {},
-                                });
+                // disable 'Create Account' button
+                $(el_window).find('.signup-btn').prop('disabled', true);
+
+                let headers = {};
+                if (window.custom_headers) {
+                    headers = window.custom_headers;
+                }
+
+                // Device signal for abuse prevention; omitted when unavailable
+                let fingerprint = null;
+                try {
+                    fingerprint = await window.getDeviceFingerprint?.();
+                } catch (_) {
+                    // signup must never block or fail because of device signals
+                }
+
+                // Include captcha in request only if required
+                const requestData = {
+                    username: username,
+                    email: email,
+                    password: password,
+                    referrer: options.referrer ?? window.referrerStr,
+                    send_confirmation_code: options.send_confirmation_code,
+                    p102xyzname: p102xyzname,
+                    'cf-turnstile-response': turnstileToken,
+                };
+                if (fingerprint) {
+                    requestData.fingerprint = fingerprint;
+                }
+
+                $.ajax({
+                    url: `${window.gui_origin}/signup`,
+                    type: 'POST',
+                    async: true,
+                    headers: headers,
+                    contentType: 'application/json',
+                    data: JSON.stringify(requestData),
+                    success: async function (data) {
+                        await window.update_auth_data(data.token, data.user);
+
+                        let email_verified = true;
+                        const show_email_dialog =
+                            !options.reload_on_success &&
+                            (options.send_confirmation_code ||
+                                data.user?.requires_email_confirmation);
+                        if (
+                            data.user?.requires_phone_verification ||
+                            data.user?.requires_card_verification ||
+                            show_email_dialog
+                        ) {
+                            $(el_window).close();
+                            if (data.user?.requires_phone_verification) {
+                                let phone_ok = false;
+                                do {
+                                    phone_ok =
+                                        await UIWindowPhoneVerificationRequired(
+                                            {
+                                                show_close_button: false,
+                                                stay_on_top: true,
+                                                has_head: true,
+                                                window_options:
+                                                    options.window_options ??
+                                                    {},
+                                            },
+                                        );
+                                } while (!phone_ok);
                             }
-                            while ( !phone_ok );
-                        }
-                        if ( show_email_dialog ) {
-                            email_verified = await UIWindowEmailConfirmationRequired({
-                                stay_on_top: true,
-                                has_head: true,
-                                reload_on_success: options.reload_on_success,
-                                window_options: options.window_options ?? {},
-                            });
-                        }
-                        // Card verification is the last gate.
-                        if ( data.user?.requires_card_verification ) {
-                            let card_ok = false;
-                            do {
-                                card_ok = await UIWindowCardVerificationRequired({
-                                    show_close_button: false,
-                                    stay_on_top: true,
-                                    has_head: true,
-                                    window_options: options.window_options ?? {},
-                                });
+                            if (show_email_dialog) {
+                                email_verified =
+                                    await UIWindowEmailConfirmationRequired({
+                                        stay_on_top: true,
+                                        has_head: true,
+                                        reload_on_success:
+                                            options.reload_on_success,
+                                        window_options:
+                                            options.window_options ?? {},
+                                    });
+                            }
+                            // Card verification is the last gate.
+                            if (data.user?.requires_card_verification) {
+                                let card_ok = false;
+                                do {
+                                    card_ok =
+                                        await UIWindowCardVerificationRequired({
+                                            show_close_button: false,
+                                            stay_on_top: true,
+                                            has_head: true,
+                                            window_options:
+                                                options.window_options ?? {},
+                                        });
+                                } while (!card_ok);
                             }
-                            while ( !card_ok );
                         }
-                    }
 
-                    if ( options.reload_on_success ) {
-                        window.onbeforeunload = null;
-                        // either options.redirect_url or the current page
-                        const redirectUrl = options.redirect_url || '/';
-                        window.location.replace(redirectUrl);
-                    } else {
-                        resolve(email_verified);
-                    }
-                },
-                error: function (err) {
-                    // re-enable 'Create Account' button so user can try again
-                    $(el_window).find('.signup-btn').prop('disabled', false);
-
-                    // Reset Turnstile widget for retry
-                    try {
-                        if ( window.turnstile ) {
-                            window.turnstile?.reset('.cf-turnstile');
-                            $(el_window).find('.cf-turnstile').removeAttr('data-token');
-                            $(el_window).find('.cf-turnstile').removeClass('captcha-completed');
+                        if (options.reload_on_success) {
+                            window.onbeforeunload = null;
+                            // either options.redirect_url or the current page
+                            const redirectUrl = options.redirect_url || '/';
+                            window.location.replace(redirectUrl);
+                        } else {
+                            resolve(email_verified);
                         }
-                    } catch (e) {
-                        console.log(e);
-                    }
+                    },
+                    error: function (err) {
+                        // re-enable 'Create Account' button so user can try again
+                        $(el_window)
+                            .find('.signup-btn')
+                            .prop('disabled', false);
 
-                    // Process error response
-                    const errorText = err.responseText || '';
+                        // Reset Turnstile widget for retry
+                        try {
+                            if (window.turnstile) {
+                                window.turnstile?.reset('.cf-turnstile');
+                                $(el_window)
+                                    .find('.cf-turnstile')
+                                    .removeAttr('data-token');
+                                $(el_window)
+                                    .find('.cf-turnstile')
+                                    .removeClass('captcha-completed');
+                            }
+                        } catch (e) {
+                            console.log(e);
+                        }
 
-                    // Handle JSON error response
-                    try {
-                        // Try to parse error as JSON
-                        const errorJson = JSON.parse(errorText);
+                        // Process error response
+                        const errorText = err.responseText || '';
 
-                        // Handle signup blocked with full-screen overlay
-                        if ( errorJson?.code === 'signup_blocked' ) {
-                            const overlay = document.createElement('div');
-                            overlay.classList.add('signup-blocked-overlay');
-                            const blockedMsg = errorJson.message || 'Signup Not Allowed';
-                            overlay.innerHTML = `
+                        // Handle JSON error response
+                        try {
+                            // Try to parse error as JSON
+                            const errorJson = JSON.parse(errorText);
+
+                            // Handle signup blocked with full-screen overlay
+                            if (errorJson?.code === 'signup_blocked') {
+                                const overlay = document.createElement('div');
+                                overlay.classList.add('signup-blocked-overlay');
+                                const blockedMsg =
+                                    errorJson.message || 'Signup Not Allowed';
+                                overlay.innerHTML = `
                                 <div class="signup-blocked-content">
                                     <img src="${window.icons['logo.svg'] || window.icons['logo-white.svg'] || ''}" style="width:64px;margin-bottom:24px;" />
                                     <p>${html_encode(blockedMsg)}</p>
                                     <p>If you already have an account, try <a href="/action/login">logging in</a>. Otherwise, contact <a href="mailto:support@puter.com">support@puter.com</a> for assistance.</p>
                                 </div>
                             `;
-                            document.body.appendChild(overlay);
-                            return;
+                                document.body.appendChild(overlay);
+                                return;
+                            }
+
+                            // Handle timeout specifically
+                            if (
+                                errorJson?.code === 'response_timeout' ||
+                                errorText.includes('timeout')
+                            ) {
+                                $(el_window)
+                                    .find('.signup-error-msg')
+                                    .html(
+                                        i18n('server_timeout') ||
+                                            'The server took too long to respond. Please try again.',
+                                    );
+                                $(el_window).find('.signup-error-msg').fadeIn();
+                                return;
+                            }
+
+                            // If it's a message in the JSON, use that
+                            if (errorJson.message) {
+                                $(el_window)
+                                    .find('.signup-error-msg')
+                                    .html(errorJson.message);
+                                $(el_window).find('.signup-error-msg').fadeIn();
+                                return;
+                            }
+                        } catch (e) {
+                            console.log(e);
+                            // Not JSON, continue with text analysis
                         }
 
-                        // Handle timeout specifically
-                        if ( errorJson?.code === 'response_timeout' || errorText.includes('timeout') ) {
-                            $(el_window).find('.signup-error-msg').html(i18n('server_timeout') || 'The server took too long to respond. Please try again.');
-                            $(el_window).find('.signup-error-msg').fadeIn();
-                            return;
-                        }
-
-                        // If it's a message in the JSON, use that
-                        if ( errorJson.message ) {
-                            $(el_window).find('.signup-error-msg').html(errorJson.message);
-                            $(el_window).find('.signup-error-msg').fadeIn();
-                            return;
-                        }
-                    } catch (e) {
-                        console.log(e);
-                        // Not JSON, continue with text analysis
-                    }
-
-                    // Default general error handling
-                    $(el_window).find('.signup-error-msg').html(errorText || i18n('signup_error') || 'An error occurred during signup. Please try again.');
-                    $(el_window).find('.signup-error-msg').fadeIn();
-                },
-                timeout: 30000, // Add a reasonable timeout
+                        // Default general error handling
+                        $(el_window)
+                            .find('.signup-error-msg')
+                            .html(
+                                errorText ||
+                                    i18n('signup_error') ||
+                                    'An error occurred during signup. Please try again.',
+                            );
+                        $(el_window).find('.signup-error-msg').fadeIn();
+                    },
+                    timeout: 30000, // Add a reasonable timeout
+                });
             });
-        });
 
-        $(el_window).find('.signup-form').on('submit', function (e) {
-            e.preventDefault();
-            e.stopPropagation();
-            return false;
-        });
+        $(el_window)
+            .find('.signup-form')
+            .on('submit', function (e) {
+                e.preventDefault();
+                e.stopPropagation();
+                return false;
+            });
 
-        $(el_window).find(`#toggle-show-password-${internal_id}, #toggle-show-password-${internal_id}-confirm`).on('click', function (e) {
-            // hide/show password/confirm password and update icon
-            let inputField = $(this).siblings('input');
-            let isPasswordVisible = inputField.attr('type') === 'text';
-            inputField.attr('type', isPasswordVisible ? 'password' : 'text');
-            $(this).find('.toggle-show-password-icon').attr(
-                'src',
-                isPasswordVisible ? window.icons['eye-open.svg'] : window.icons['eye-closed.svg'],
-            );
-        });
+        $(el_window)
+            .find(
+                `#toggle-show-password-${internal_id}, #toggle-show-password-${internal_id}-confirm`,
+            )
+            .on('click', function (e) {
+                // hide/show password/confirm password and update icon
+                let inputField = $(this).siblings('input');
+                let isPasswordVisible = inputField.attr('type') === 'text';
+                inputField.attr(
+                    'type',
+                    isPasswordVisible ? 'password' : 'text',
+                );
+                $(this)
+                    .find('.toggle-show-password-icon')
+                    .attr(
+                        'src',
+                        isPasswordVisible
+                            ? window.icons['eye-open.svg']
+                            : window.icons['eye-closed.svg'],
+                    );
+            });
 
         //remove login window
         $('.signup-c2a-clickable').parents('.window').close();
     });
 }
 
-export default UIWindowSignup;
\ No newline at end of file
+export default UIWindowSignup;
diff --git a/src/gui/src/initgui.js b/src/gui/src/initgui.js
index 286848bca..83b51aa41 100644
--- a/src/gui/src/initgui.js
+++ b/src/gui/src/initgui.js
@@ -62,7 +62,7 @@ const launch_services = async function (options) {
     globalThis.services = {
         get: (name) => services_m_[name],
         emit: (id, args) => {
-            for ( const [_, instance] of services_l_ ) {
+            for (const [_, instance] of services_l_) {
                 instance.__on(id, args ?? []);
             }
         },
@@ -78,7 +78,7 @@ const launch_services = async function (options) {
     const service_script_deferred = { services: [], on_ready: [] };
     const service_script_api = {
         register: (...a) => service_script_deferred.services.push(a),
-        on_ready: fn => service_script_deferred.on_ready.push(fn),
+        on_ready: (fn) => service_script_deferred.on_ready.push(fn),
         // Some files can't be imported by service scripts,
         // so this hack makes that possible.
         def: globalThis.def,
@@ -99,24 +99,24 @@ const launch_services = async function (options) {
     register('__launch-on-init', new LaunchOnInitService());
 
     // === Service-Script Services ===
-    for ( const [name, script] of service_script_deferred.services ) {
+    for (const [name, script] of service_script_deferred.services) {
         register(name, script);
     }
 
-    for ( const [_, instance] of services_l_ ) {
+    for (const [_, instance] of services_l_) {
         await instance.construct({
             gui_params: options,
         });
     }
 
-    for ( const [_, instance] of services_l_ ) {
+    for (const [_, instance] of services_l_) {
         await instance.init({
             services: globalThis.services,
         });
     }
 
     // === Service-Script Ready ===
-    for ( const fn of service_script_deferred.on_ready ) {
+    for (const fn of service_script_deferred.on_ready) {
         await fn();
     }
 
@@ -133,24 +133,28 @@ const launch_services = async function (options) {
 // By setting the 'passive' option appropriately, it ensures that default browser
 // behavior is prevented when necessary, thereby improving page scroll performance.
 // More info: https://stackoverflow.com/a/62177358
-if ( jQuery ) {
+if (jQuery) {
     jQuery.event.special.touchstart = {
-        setup: function ( _, ns, handle ) {
-            this.addEventListener('touchstart', handle, { passive: !ns.includes('noPreventDefault') });
+        setup: function (_, ns, handle) {
+            this.addEventListener('touchstart', handle, {
+                passive: !ns.includes('noPreventDefault'),
+            });
         },
     };
     jQuery.event.special.touchmove = {
-        setup: function ( _, ns, handle ) {
-            this.addEventListener('touchmove', handle, { passive: !ns.includes('noPreventDefault') });
+        setup: function (_, ns, handle) {
+            this.addEventListener('touchmove', handle, {
+                passive: !ns.includes('noPreventDefault'),
+            });
         },
     };
     jQuery.event.special.wheel = {
-        setup: function ( _, ns, handle ) {
+        setup: function (_, ns, handle) {
             this.addEventListener('wheel', handle, { passive: true });
         },
     };
     jQuery.event.special.mousewheel = {
-        setup: function ( _, ns, handle ) {
+        setup: function (_, ns, handle) {
             this.addEventListener('mousewheel', handle, { passive: true });
         },
     };
@@ -165,18 +169,20 @@ if ( jQuery ) {
 {
     const pathname = window.location.pathname;
     const search_params = new URLSearchParams(window.location.search);
-    if ( ['true', '1'].includes(search_params.get('embedded_in_popup')) ) {
+    if (['true', '1'].includes(search_params.get('embedded_in_popup'))) {
         window.embedded_in_popup = true;
     }
     // note: iframe detection is inlined because globals.js (window.is_embedded) loads after this module
     const in_iframe = window.location !== window.parent.location;
-    const needs_desktop_at_root = window.embedded_in_popup
-        || in_iframe
-        || search_params.has('puter.fullpage')
-        || search_params.has('app')
-        || search_params.has('download');
-    const is_dashboard_alias = pathname === '/dashboard' || pathname === '/dashboard/';
-    if ( is_dashboard_alias || (pathname === '/' && !needs_desktop_at_root) ) {
+    const needs_desktop_at_root =
+        window.embedded_in_popup ||
+        in_iframe ||
+        search_params.has('puter.fullpage') ||
+        search_params.has('app') ||
+        search_params.has('download');
+    const is_dashboard_alias =
+        pathname === '/dashboard' || pathname === '/dashboard/';
+    if (is_dashboard_alias || (pathname === '/' && !needs_desktop_at_root)) {
         window.is_dashboard_mode = true;
         window.dashboard_initial_route = parseDashboardRoute();
     }
@@ -188,9 +194,9 @@ if ( jQuery ) {
  * Hash format: #home or #usage or #account etc.
  * @returns {{ tab: string }} Route object with tab name
  */
-function parseDashboardRoute () {
+function parseDashboardRoute() {
     const hash = decodeURIComponent(window.location.hash.slice(1));
-    if ( ! hash ) return { tab: 'apps' };
+    if (!hash) return { tab: 'apps' };
 
     const tab = hash.split('/').filter(Boolean)[0];
     return { tab: tab || 'apps' };
@@ -210,15 +216,16 @@ window.showTurnstileChallenge = function (options) {
         const modalId = 'turnstile-challenge-modal';
         const siteKey = window.gui_params?.turnstileSiteKey;
 
-        if ( ! siteKey ) {
+        if (!siteKey) {
             options.onError('Turnstile site key not configured');
             return resolve();
         }
 
         // message
         let message = 'Setting up your account...';
-        if ( window.embedded_in_popup ) {
-            message = 'Setting up your <a href="https://puter.com" target="_blank">Puter.com</a> account...';
+        if (window.embedded_in_popup) {
+            message =
+                'Setting up your <a href="https://puter.com" target="_blank">Puter.com</a> account...';
         }
         // Create modal HTML
         let modalHtml = `
@@ -252,7 +259,7 @@ window.showTurnstileChallenge = function (options) {
 
         // Initialize Turnstile widget
         const initTurnstile = () => {
-            if ( ! window.turnstile ) {
+            if (!window.turnstile) {
                 setTimeout(initTurnstile, 100);
                 return;
             }
@@ -277,13 +284,17 @@ window.showTurnstileChallenge = function (options) {
                         showError('Verification expired. Please try again.');
                     },
                     'error-callback': function () {
-                        showError('Verification failed. Please refresh the page and try again.');
+                        showError(
+                            'Verification failed. Please refresh the page and try again.',
+                        );
                         options.onError('Turnstile verification failed');
                     },
                 });
-            } catch ( error ) {
+            } catch (error) {
                 console.error('Failed to initialize Turnstile:', error);
-                showError('Failed to load security verification. Please refresh the page.');
+                showError(
+                    'Failed to load security verification. Please refresh the page.',
+                );
                 options.onError(error);
             }
         };
@@ -298,11 +309,11 @@ window.showTurnstileChallenge = function (options) {
 
         // Prevent modal from closing by clicking outside
         modal.addEventListener('click', (e) => {
-            if ( e.target === modal ) {
+            if (e.target === modal) {
                 // Don't close - force users to complete verification
                 turnstileContainer.style.transform = 'scale(1.05)';
                 setTimeout(() => {
-                    if ( turnstileContainer ) {
+                    if (turnstileContainer) {
                         turnstileContainer.style.transform = 'scale(1)';
                     }
                 }, 200);
@@ -323,7 +334,9 @@ window.showTurnstileChallenge = function (options) {
 window.initgui = async function (options) {
     const url = new URL(window.location).href;
     window.url = url;
-    const url_paths = window.location.pathname.split('/').filter(element => element);
+    const url_paths = window.location.pathname
+        .split('/')
+        .filter((element) => element);
     window.url_paths = url_paths;
 
     // Install device signal helpers; collection is lazy. The fingerprint is
@@ -334,23 +347,26 @@ window.initgui = async function (options) {
     let picked_a_user_for_sdk_login = false;
 
     // update SDK if auth_token is different from the one in the SDK
-    if ( window.auth_token && puter.authToken !== window.auth_token )
-    {
+    if (window.auth_token && puter.authToken !== window.auth_token) {
         puter.setAuthToken(window.auth_token);
     }
     // update SDK if api_origin is different from the one in the SDK
-    if ( window.api_origin && puter.APIOrigin !== window.api_origin )
-    {
-        puter.setAPIOrigin(localStorage.getItem('api_origin') || window.api_origin);
+    if (window.api_origin && puter.APIOrigin !== window.api_origin) {
+        puter.setAPIOrigin(
+            localStorage.getItem('api_origin') || window.api_origin,
+        );
     }
 
     // Print the version to the console
-    puter.os.version()
-        .then(res => {
+    puter.os
+        .version()
+        .then((res) => {
             const deployed_date = new Date(res.deploy_timestamp);
-            console.log(`Your Puter information:\n• Version: ${(res.version)}\n• Server: ${(res.location)}\n• Deployed: ${(deployed_date)}`);
+            console.log(
+                `Your Puter information:\n• Version: ${res.version}\n• Server: ${res.location}\n• Deployed: ${deployed_date}`,
+            );
         })
-        .catch(error => {
+        .catch((error) => {
             console.error('Failed to fetch server info:', error);
         });
 
@@ -358,11 +374,15 @@ window.initgui = async function (options) {
     // Depending on the device type, it sets a class attribute on the body tag
     // to style or script the page differently for each device type.
 
-    if ( isMobile.phone ) {
+    if (isMobile.phone) {
         $('body').attr('class', 'device-phone');
-    } else if ( isMobile.tablet ) {
+    } else if (isMobile.tablet) {
         // This is our new, smarter check for tablets
-        if ( window.matchMedia && typeof window.matchMedia === 'function' && window.matchMedia('(hover: hover)').matches ) {
+        if (
+            window.matchMedia &&
+            typeof window.matchMedia === 'function' &&
+            window.matchMedia('(hover: hover)').matches
+        ) {
             // The user has a mouse/trackpad, so give them the desktop UI
             $('body').attr('class', 'device-desktop');
         } else {
@@ -379,7 +399,9 @@ window.initgui = async function (options) {
 
     // Appends a viewport meta tag to the head of the document, ensuring optimal display on mobile devices.
     // This tag sets the width of the viewport to the device width, and locks the zoom level to 1 (prevents user scaling).
-    $('head').append('<meta name="viewport" content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1, user-scalable=no, viewport-fit=cover">');
+    $('head').append(
+        '<meta name="viewport" content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1, user-scalable=no, viewport-fit=cover">',
+    );
 
     // GET query params provided
     window.url_query_params = new URLSearchParams(window.location.search);
@@ -391,9 +413,12 @@ window.initgui = async function (options) {
     // Extract 'action' from URL
     //--------------------------------------------------------------------------------------
     let action;
-    if ( window.url_paths[0]?.toLocaleLowerCase() === 'action' && window.url_paths[1] ) {
+    if (
+        window.url_paths[0]?.toLocaleLowerCase() === 'action' &&
+        window.url_paths[1]
+    ) {
         action = window.url_paths[1].toLowerCase();
-    } else if ( window.url_query_params.has('action') ) {
+    } else if (window.url_query_params.has('action')) {
         action = window.url_query_params.get('action').toLowerCase();
     }
 
@@ -401,15 +426,23 @@ window.initgui = async function (options) {
     // Determine if we are in full-page mode
     // i.e. https://puter.com/app/<app_name>/?puter.fullpage=true
     //--------------------------------------------------------------------------------------
-    if ( window.url_query_params.has('puter.fullpage') && (window.url_query_params.get('puter.fullpage') === 'false' || window.url_query_params.get('puter.fullpage') === '0') ) {
+    if (
+        window.url_query_params.has('puter.fullpage') &&
+        (window.url_query_params.get('puter.fullpage') === 'false' ||
+            window.url_query_params.get('puter.fullpage') === '0')
+    ) {
         window.is_fullpage_mode = false;
-    } else if ( window.url_query_params.has('puter.fullpage') && (window.url_query_params.get('puter.fullpage') === 'true' || window.url_query_params.get('puter.fullpage') === '1') ) {
+    } else if (
+        window.url_query_params.has('puter.fullpage') &&
+        (window.url_query_params.get('puter.fullpage') === 'true' ||
+            window.url_query_params.get('puter.fullpage') === '1')
+    ) {
         // In fullpage mode, we want to hide the taskbar for better UX
         window.taskbar_height = 0;
 
         // Puter is in fullpage mode.
         window.is_fullpage_mode = true;
-    } else if ( window.is_dashboard_mode ) {
+    } else if (window.is_dashboard_mode) {
         window.is_fullpage_mode = true;
     }
 
@@ -418,22 +451,39 @@ window.initgui = async function (options) {
 
     // If no token in storage but we have a session cookie (e.g. after OIDC redirect), fetch GUI token
     try {
-        const r = await fetch(`${window.gui_origin}/get-gui-token`, { credentials: 'include' });
-        if ( r.ok ) {
+        const r = await fetch(`${window.gui_origin}/get-gui-token`, {
+            credentials: 'include',
+        });
+        if (r.ok) {
             const { token } = await r.json();
             window.auth_token = token;
             // Write the v2 key; drop legacy v1 key.
-            localStorage.setItem(window.AUTH_TOKEN_KEY_V2 || 'auth_token_v2', token);
-            try { localStorage.removeItem(window.AUTH_TOKEN_KEY_V1 || 'auth_token'); } catch ( e ) { /* ignore */ }
-            if ( typeof puter !== 'undefined' ) puter.setAuthToken(token, window.api_origin);
+            localStorage.setItem(
+                window.AUTH_TOKEN_KEY_V2 || 'auth_token_v2',
+                token,
+            );
+            try {
+                localStorage.removeItem(
+                    window.AUTH_TOKEN_KEY_V1 || 'auth_token',
+                );
+            } catch (e) {
+                /* ignore */
+            }
+            if (typeof puter !== 'undefined')
+                puter.setAuthToken(token, window.api_origin);
             const tokenChanged = token !== window.auth_token;
-            if ( tokenChanged ) {
+            if (tokenChanged) {
                 // This will update the list of logged in users and set the current one
                 try {
-                    const whoami = await puter.os.user({ query: 'icon_size=64' });
-                    if ( whoami ) await window.update_auth_data(token, whoami);
+                    const whoami = await puter.os.user({
+                        query: 'icon_size=64',
+                    });
+                    if (whoami) await window.update_auth_data(token, whoami);
                 } catch (e) {
-                    console.error('get-gui-token follow-up whoami/update_auth_data', e);
+                    console.error(
+                        'get-gui-token follow-up whoami/update_auth_data',
+                        e,
+                    );
                 }
             }
         }
@@ -445,7 +495,11 @@ window.initgui = async function (options) {
     // Is attempt_temp_user_creation?
     // i.e. https://puter.com/?attempt_temp_user_creation=true
     //--------------------------------------------------------------------------------------
-    if ( window.url_query_params.has('attempt_temp_user_creation') && (window.url_query_params.get('attempt_temp_user_creation') === 'true' || window.url_query_params.get('attempt_temp_user_creation') === '1') ) {
+    if (
+        window.url_query_params.has('attempt_temp_user_creation') &&
+        (window.url_query_params.get('attempt_temp_user_creation') === 'true' ||
+            window.url_query_params.get('attempt_temp_user_creation') === '1')
+    ) {
         window.attempt_temp_user_creation = true;
     }
 
@@ -454,17 +508,18 @@ window.initgui = async function (options) {
     // i.e. https://puter.com/?embedded_in_popup=true
     // (the flag itself is parsed once at module level, alongside the dashboard-mode check)
     //--------------------------------------------------------------------------------------
-    if ( window.embedded_in_popup ) {
+    if (window.embedded_in_popup) {
         $('body').addClass('embedded-in-popup');
 
         // determine the origin of the opener (preserved across OIDC redirect via URL param, else referrer or messaging)
-        const openerOriginFromUrl = window.url_query_params.get('opener_origin');
-        if ( openerOriginFromUrl ) {
+        const openerOriginFromUrl =
+            window.url_query_params.get('opener_origin');
+        if (openerOriginFromUrl) {
             window.openerOrigin = openerOriginFromUrl;
         } else {
             window.openerOrigin = document.referrer;
         }
-        if ( ! window.openerOrigin ) {
+        if (!window.openerOrigin) {
             try {
                 window.openerOrigin = await requestOpenerOrigin();
             } catch (e) {
@@ -475,33 +530,46 @@ window.initgui = async function (options) {
         // this is the referrer in terms of user acquisition
         window.referrerStr = window.openerOrigin;
 
-        if ( action === 'sign-in' && !window.is_auth() && !(window.attempt_temp_user_creation && window.first_visit_ever) ) {
+        if (
+            action === 'sign-in' &&
+            !window.is_auth() &&
+            !(window.attempt_temp_user_creation && window.first_visit_ever)
+        ) {
             // show signup window
-            if ( await UIWindowSignup({
-                reload_on_success: false,
-                send_confirmation_code: true,
-                show_close_button: false,
-                window_options: {
-                    has_head: false,
-                    cover_page: true,
-                },
-            }) )
-            {
+            if (
+                await UIWindowSignup({
+                    reload_on_success: false,
+                    send_confirmation_code: true,
+                    show_close_button: false,
+                    window_options: {
+                        has_head: false,
+                        cover_page: true,
+                    },
+                })
+            ) {
                 await window.getUserAppToken(window.openerOrigin);
             }
-        }
-        else if ( action === 'sign-in' && window.is_auth() && !(window.attempt_temp_user_creation && window.first_visit_ever) ) {
+        } else if (
+            action === 'sign-in' &&
+            window.is_auth() &&
+            !(window.attempt_temp_user_creation && window.first_visit_ever)
+        ) {
             // Ensure current user is in logged_in_users (e.g. after OIDC redirect we have token but no user in list)
             try {
-                const whoami_popup = await puter.os.user({ query: 'icon_size=64' });
-                await window.update_auth_data(whoami_popup.token || window.auth_token, whoami_popup);
+                const whoami_popup = await puter.os.user({
+                    query: 'icon_size=64',
+                });
+                await window.update_auth_data(
+                    whoami_popup.token || window.auth_token,
+                    whoami_popup,
+                );
             } catch (e) {
                 // session/auth errors will be handled further ahead;
                 // let's log the error for now in case a change in state occurred.
-                console.error('error in \'sign-in\' flow', e);
+                console.error("error in 'sign-in' flow", e);
             }
 
-            if ( window.url_query_params.get('oidc_login') === 'true' ) {
+            if (window.url_query_params.get('oidc_login') === 'true') {
                 // OIDC login just completed in popup — skip session list and finish the flow
                 picked_a_user_for_sdk_login = true;
                 await window.getUserAppToken(window.openerOrigin);
@@ -514,7 +582,7 @@ window.initgui = async function (options) {
                     cover_page: true,
                 });
 
-                if ( picked_a_user_for_sdk_login ) {
+                if (picked_a_user_for_sdk_login) {
                     await window.getUserAppToken(window.openerOrigin);
                 }
             }
@@ -524,7 +592,7 @@ window.initgui = async function (options) {
     //--------------------------------------------------------------------------------------
     // Display an error if the query parameters have an error
     //--------------------------------------------------------------------------------------
-    if ( window.url_query_params.has('error') ) {
+    if (window.url_query_params.has('error')) {
         // TODO: i18n
         await UIAlert({
             message: window.url_query_params.get('message'),
@@ -534,7 +602,10 @@ window.initgui = async function (options) {
     //--------------------------------------------------------------------------------------
     // Inform the user if they chose "signup" but were logged into an existing account
     //--------------------------------------------------------------------------------------
-    if ( window.url_query_params.get('oidc_switched') === 'login' && window.is_auth() ) {
+    if (
+        window.url_query_params.get('oidc_switched') === 'login' &&
+        window.is_auth()
+    ) {
         await UIAlert({
             message: i18n('oidc_switched_to_login_message'),
         });
@@ -552,10 +623,16 @@ window.initgui = async function (options) {
     // If the user navigated to /app/<app_name> and the app has fullpage_on_landing,
     // set fullpage mode now so we can skip loading the desktop background and items.
     //--------------------------------------------------------------------------------------
-    if ( !window.is_fullpage_mode && window.url_paths[0]?.toLocaleLowerCase() === 'app' && window.url_paths[1] ) {
+    if (
+        !window.is_fullpage_mode &&
+        window.url_paths[0]?.toLocaleLowerCase() === 'app' &&
+        window.url_paths[1]
+    ) {
         try {
-            const app_info = await puter.apps.get(window.url_paths[1], { icon_size: 64 });
-            if ( app_info?.metadata?.fullpage_on_landing ) {
+            const app_info = await puter.apps.get(window.url_paths[1], {
+                icon_size: 64,
+            });
+            if (app_info?.metadata?.fullpage_on_landing) {
                 window.is_fullpage_mode = true;
                 window.taskbar_height = 0;
                 window.app_launched_from_url = app_info;
@@ -569,16 +646,17 @@ window.initgui = async function (options) {
     // Desktop background (early)
     // Set before action=login/signup so OIDC error redirects show the background behind the form.
     // -------------------------------------------------------------------------------------
-    if ( !window.is_fullpage_mode && !window.embedded_in_popup ) {
+    if (!window.is_fullpage_mode && !window.embedded_in_popup) {
         window.refresh_desktop_background();
     }
 
     //--------------------------------------------------------------------------------------
     // Action: Request Permission
     //--------------------------------------------------------------------------------------
-    if ( action === 'request-permission' ) {
+    if (action === 'request-permission') {
         let app_uid = window.url_query_params.get('app_uid');
-        let origin = window.openerOrigin ?? window.url_query_params.get('origin');
+        let origin =
+            window.openerOrigin ?? window.url_query_params.get('origin');
         let permission = window.url_query_params.get('permission');
 
         let granted = await UIWindowRequestPermission({
@@ -587,16 +665,21 @@ window.initgui = async function (options) {
             permission: permission,
         });
 
-        let messageTarget = window.embedded_in_popup ? window.opener : window.parent;
-        messageTarget.postMessage({
-            msg: 'permissionGranted',
-            granted: granted,
-        }, origin);
+        let messageTarget = window.embedded_in_popup
+            ? window.opener
+            : window.parent;
+        messageTarget.postMessage(
+            {
+                msg: 'permissionGranted',
+                granted: granted,
+            },
+            origin,
+        );
     }
     //--------------------------------------------------------------------------------------
     // Action: Password recovery
     //--------------------------------------------------------------------------------------
-    else if ( action === 'set-new-password' ) {
+    else if (action === 'set-new-password') {
         let user = window.url_query_params.get('user');
         let token = window.url_query_params.get('token');
 
@@ -608,16 +691,18 @@ window.initgui = async function (options) {
     //--------------------------------------------------------------------------------------
     // Action: Change Username
     //--------------------------------------------------------------------------------------
-    else if ( action === 'change-username' ) {
+    else if (action === 'change-username') {
         await UIWindowChangeUsername();
     }
     //--------------------------------------------------------------------------------------
     // Action: Login
     //--------------------------------------------------------------------------------------
-    else if ( action === 'login' ) {
+    else if (action === 'login') {
         const authError = window.url_query_params.get('message') || null;
-        const opts = window.url_query_params.has('auth_error') ? { authError } : {};
-        if ( ! window.is_auth() ) {
+        const opts = window.url_query_params.has('auth_error')
+            ? { authError }
+            : {};
+        if (!window.is_auth()) {
             opts.window_options = { cover_page: true, has_head: false };
         }
         await UIWindowLogin(Object.keys(opts).length ? opts : undefined);
@@ -625,7 +710,7 @@ window.initgui = async function (options) {
     //--------------------------------------------------------------------------------------
     // Action: Password recovery
     //--------------------------------------------------------------------------------------
-    else if ( action === 'password-recovery' ) {
+    else if (action === 'password-recovery') {
         await UIWindowRecoverPassword({
             window_options: {
                 cover_page: true,
@@ -636,10 +721,12 @@ window.initgui = async function (options) {
     //--------------------------------------------------------------------------------------
     // Action: Signup
     //--------------------------------------------------------------------------------------
-    else if ( action === 'signup' ) {
+    else if (action === 'signup') {
         const authError = window.url_query_params.get('message') || null;
-        const opts = window.url_query_params.has('auth_error') ? { authError } : {};
-        if ( ! window.is_auth() ) {
+        const opts = window.url_query_params.has('auth_error')
+            ? { authError }
+            : {};
+        if (!window.is_auth()) {
             opts.window_options = { cover_page: true, has_head: false };
         }
         opts.send_confirmation_code = true;
@@ -650,11 +737,18 @@ window.initgui = async function (options) {
     // if yes, we need to get the user app token and send it to the opener
     // if not, we need to ask the user for confirmation before proceeding BUT only if the action is a file-picker action
     // -------------------------------------------------------------------------------------
-    if ( window.embedded_in_popup && window.openerOrigin ) {
-        let response = await window.checkUserSiteRelationship(window.openerOrigin);
+    if (window.embedded_in_popup && window.openerOrigin) {
+        let response = await window.checkUserSiteRelationship(
+            window.openerOrigin,
+        );
         window.userAppToken = response.token;
 
-        if ( !picked_a_user_for_sdk_login && window.logged_in_users.length > 1 && (!window.userAppToken || window.url_query_params.get('request_auth') ) ) {
+        if (
+            !picked_a_user_for_sdk_login &&
+            window.logged_in_users.length > 1 &&
+            (!window.userAppToken ||
+                window.url_query_params.get('request_auth'))
+        ) {
             picked_a_user_for_sdk_login = await UIWindowSessionList({
                 reload_on_success: false,
                 draggable_body: false,
@@ -666,12 +760,12 @@ window.initgui = async function (options) {
     // -------------------------------------------------------------------------------------
     // `auth_token` provided in URL, use it to log in
     // -------------------------------------------------------------------------------------
-    else if ( window.url_query_params.has('auth_token') ) {
+    else if (window.url_query_params.has('auth_token')) {
         let query_param_auth_token = window.url_query_params.get('auth_token');
         let api_origin;
 
         // check if we have api_origin in the URL query params
-        if ( window.url_query_params.has('api_origin') ) {
+        if (window.url_query_params.has('api_origin')) {
             api_origin = window.url_query_params.get('api_origin');
             puter.setAPIOrigin(api_origin);
         }
@@ -681,15 +775,15 @@ window.initgui = async function (options) {
         try {
             whoami = await puter.os.user({ query: 'icon_size=64' });
         } catch (e) {
-            if ( e.status === 401 ) {
+            if (e.status === 401) {
                 window.logout();
                 return;
             }
         }
 
-        if ( whoami ) {
+        if (whoami) {
             // is phone verification required? (hard gate for low-rep signups)
-            if ( whoami.requires_phone_verification ) {
+            if (whoami.requires_phone_verification) {
                 let is_verified;
                 do {
                     is_verified = await UIWindowPhoneVerificationRequired({
@@ -700,10 +794,9 @@ window.initgui = async function (options) {
                             is_draggable: false,
                         },
                     });
-                }
-                while ( !is_verified );
+                } while (!is_verified);
             }
-            if ( whoami.requires_email_confirmation ) {
+            if (whoami.requires_email_confirmation) {
                 let is_verified;
                 do {
                     is_verified = await UIWindowEmailConfirmationRequired({
@@ -714,12 +807,11 @@ window.initgui = async function (options) {
                             is_draggable: false,
                         },
                     });
-                }
-                while ( !is_verified );
+                } while (!is_verified);
             }
             // Card verification is the last gate: only show it once the email and
             // phone (SMS) gates are cleared, since those show up first.
-            if ( whoami.requires_card_verification ) {
+            if (whoami.requires_card_verification) {
                 let is_verified;
                 do {
                     is_verified = await UIWindowCardVerificationRequired({
@@ -730,8 +822,7 @@ window.initgui = async function (options) {
                             is_draggable: false,
                         },
                     });
-                }
-                while ( !is_verified );
+                } while (!is_verified);
             }
             // if user is logging in using an auth token that means it's not their first ever visit to Puter.com
             // it might be their first visit to Puter on this specific device but it's not their first time ever visiting Puter.
@@ -739,11 +830,19 @@ window.initgui = async function (options) {
             // show login progress window
             UIWindowLoginInProgress({ user_info: whoami });
             // update auth data
-            await window.update_auth_data(query_param_auth_token, whoami, api_origin);
+            await window.update_auth_data(
+                query_param_auth_token,
+                whoami,
+                api_origin,
+            );
         }
         // remove auth_token from URL, keeping the current path (e.g. `/` or `/desktop`)
         // and hash (dashboard tab links like /#usage)
-        window.history.pushState(null, document.title, window.location.pathname + window.location.hash);
+        window.history.pushState(
+            null,
+            document.title,
+            window.location.pathname + window.location.hash,
+        );
     }
 
     /**
@@ -763,7 +862,8 @@ window.initgui = async function (options) {
         } catch (e) {
             // TODO: i18n
             await UIAlert({
-                message: 'Session is invalid and logout failed; ' +
+                message:
+                    'Session is invalid and logout failed; ' +
                     'please clear local storage manually.',
             });
         }
@@ -782,9 +882,10 @@ window.initgui = async function (options) {
      */
     $(document).on('logout', async function (event) {
         // is temp user?
-        if ( window.user && window.user.is_temp && !window.user.deleted ) {
+        if (window.user && window.user.is_temp && !window.user.deleted) {
             const alert_resp = await UIAlert({
-                message: '<strong>Save account before logging out!</strong><p>You are using a temporary account and logging out will erase all your data.</p>',
+                message:
+                    '<strong>Save account before logging out!</strong><p>You are using a temporary account and logging out will erase all your data.</p>',
                 buttons: [
                     {
                         label: i18n('save_account'),
@@ -801,19 +902,17 @@ window.initgui = async function (options) {
                     },
                 ],
             });
-            if ( alert_resp === 'save_account' ) {
+            if (alert_resp === 'save_account') {
                 let saved = await UIWindowSaveAccount({
                     send_confirmation_code: false,
                     default_username: window.user.username,
                 });
-                if ( saved )
-                {
+                if (saved) {
                     window.logout();
                 }
-            } else if ( alert_resp === 'log_out' ) {
+            } else if (alert_resp === 'log_out') {
                 window.logout();
-            }
-            else {
+            } else {
                 return;
             }
         }
@@ -823,17 +922,16 @@ window.initgui = async function (options) {
             const resp = await fetch(`${window.gui_origin}/get-anticsrf-token`);
             const { token } = await resp.json();
             await $.ajax({
-                url: `${window.gui_origin }/logout`,
+                url: `${window.gui_origin}/logout`,
                 type: 'POST',
                 async: true,
                 contentType: 'application/json',
                 headers: {
-                    'Authorization': `Bearer ${ window.auth_token}`,
+                    Authorization: `Bearer ${window.auth_token}`,
                 },
                 data: JSON.stringify({ anti_csrf: token }),
                 statusCode: {
-                    401: function () {
-                    },
+                    401: function () {},
                 },
             });
         } catch (e) {
@@ -841,15 +939,18 @@ window.initgui = async function (options) {
         }
 
         // remove this user from the array of logged_in_users
-        for ( let i = 0; i < window.logged_in_users.length; i++ ) {
-            if ( window.logged_in_users[i].uuid === window.user.uuid ) {
+        for (let i = 0; i < window.logged_in_users.length; i++) {
+            if (window.logged_in_users[i].uuid === window.user.uuid) {
                 window.logged_in_users.splice(i, 1);
                 break;
             }
         }
 
         // update logged_in_users in local storage
-        localStorage.setItem('logged_in_users', JSON.stringify(window.logged_in_users));
+        localStorage.setItem(
+            'logged_in_users',
+            JSON.stringify(window.logged_in_users),
+        );
 
         // delete this user from local storage
         window.user = null;
@@ -872,15 +973,6 @@ window.initgui = async function (options) {
         window.location.replace(window.is_dashboard_mode ? '/' : '/desktop');
     });
 
-    // -------------------------------------------------------------------------------------
-    // Safety net for pending-verification 403s. The backend rejects every
-    // authenticated call while a signup-time verification (SMS phone, email,
-    // card) is pending, but the dialogs are normally only opened at boot or
-    // right after signup. Any session that misses them — temp-user creation,
-    // save-account, a flag set after this page loaded — lands here, so the
-    // user gets the right dialog instead of a desktop where every request
-    // silently fails.
-    // -------------------------------------------------------------------------------------
     const verification_gate_windows = {
         phone_verification_required: UIWindowPhoneVerificationRequired,
         email_confirmation_required: UIWindowEmailConfirmationRequired,
@@ -888,23 +980,23 @@ window.initgui = async function (options) {
     };
     let verification_gate_open = false;
     $(document).ajaxError(async function (event, jqxhr) {
-        if ( jqxhr?.status !== 403 || verification_gate_open ) {
+        if (jqxhr?.status !== 403 || verification_gate_open) {
             return;
         }
         let body = jqxhr.responseJSON;
-        if ( ! body && jqxhr.responseText ) {
-            try { body = JSON.parse(jqxhr.responseText); } catch (e) { body = null; }
+        if (!body && jqxhr.responseText) {
+            try {
+                body = JSON.parse(jqxhr.responseText);
+            } catch (e) {
+                body = null;
+            }
         }
         const UIWindowVerificationGate = verification_gate_windows[body?.code];
-        if ( ! UIWindowVerificationGate ) {
+        if (!UIWindowVerificationGate) {
             return;
         }
         verification_gate_open = true;
         try {
-            // Shown once, not in a retry loop: if the gate is somehow
-            // dismissed while still pending, the next rejected call lands
-            // here again and re-opens it. Looping here could stack a second
-            // dialog on top of the boot-time or signup-flow gate.
             const is_verified = await UIWindowVerificationGate({
                 show_close_button: false,
                 stay_on_top: true,
@@ -914,7 +1006,7 @@ window.initgui = async function (options) {
                     is_draggable: false,
                 },
             });
-            if ( is_verified ) {
+            if (is_verified) {
                 await window.refresh_user_data(window.auth_token);
             }
         } catch (e) {
@@ -927,22 +1019,22 @@ window.initgui = async function (options) {
     // -------------------------------------------------------------------------------------
     // Authed
     // -------------------------------------------------------------------------------------
-    if ( window.is_auth() ) {
+    if (window.is_auth()) {
         // try to get user data using /whoami, only if that data is missing
-        if ( ! whoami ) {
+        if (!whoami) {
             try {
                 whoami = await puter.os.user({ query: 'icon_size=64' });
             } catch (e) {
-                if ( e.status === 401 ) {
+                if (e.status === 401) {
                     bad_session_logout();
                     return;
                 }
             }
         }
         // update local user data
-        if ( whoami ) {
+        if (whoami) {
             // is phone verification required? (hard gate for low-rep signups)
-            if ( whoami.requires_phone_verification ) {
+            if (whoami.requires_phone_verification) {
                 let is_verified;
                 do {
                     is_verified = await UIWindowPhoneVerificationRequired({
@@ -955,11 +1047,10 @@ window.initgui = async function (options) {
                             cover_page: window.is_embedded,
                         },
                     });
-                }
-                while ( !is_verified );
+                } while (!is_verified);
             }
             // is email confirmation required?
-            if ( whoami.requires_email_confirmation ) {
+            if (whoami.requires_email_confirmation) {
                 let is_verified;
                 do {
                     is_verified = await UIWindowEmailConfirmationRequired({
@@ -972,12 +1063,11 @@ window.initgui = async function (options) {
                             cover_page: window.is_embedded,
                         },
                     });
-                }
-                while ( !is_verified );
+                } while (!is_verified);
             }
             // Card verification is the last gate: only show it once the email and
             // phone (SMS) gates are cleared, since those show up first.
-            if ( whoami.requires_card_verification ) {
+            if (whoami.requires_card_verification) {
                 let is_verified;
                 do {
                     is_verified = await UIWindowCardVerificationRequired({
@@ -990,26 +1080,32 @@ window.initgui = async function (options) {
                             cover_page: window.is_embedded,
                         },
                     });
-                }
-                while ( !is_verified );
+                } while (!is_verified);
             }
-            await window.update_auth_data(whoami.token || window.auth_token, whoami);
+            await window.update_auth_data(
+                whoami.token || window.auth_token,
+                whoami,
+            );
 
             // -------------------------------------------------------------------------------------
             // Action: AuthMe — redirect to a third-party URL with the user's auth token
             // -------------------------------------------------------------------------------------
-            if ( action === 'authme' ) {
+            if (action === 'authme') {
                 const redirectURL = window.url_query_params.get('redirectURL');
-                if ( redirectURL ) {
+                if (redirectURL) {
                     const approved = await UIWindowAuthMe({
                         redirect_url: redirectURL,
                     });
-                    if ( approved ) {
+                    if (approved) {
                         // Hand the app a named, revocable full-API-access
                         // token instead of the raw GUI/session token: it can
                         // use the whole API but can't manage the account.
                         let host = '';
-                        try { host = new URL(redirectURL).host; } catch ( e ) { /* ignore */ }
+                        try {
+                            host = new URL(redirectURL).host;
+                        } catch (e) {
+                            /* ignore */
+                        }
                         let token;
                         try {
                             token = await create_access_token({
@@ -1017,7 +1113,7 @@ window.initgui = async function (options) {
                                     ? `${i18n('token_label_external_app')} (${host})`
                                     : i18n('token_label_external_app'),
                             });
-                        } catch ( e ) {
+                        } catch (e) {
                             await UIAlert({ message: e?.message ?? String(e) });
                             return;
                         }
@@ -1032,28 +1128,33 @@ window.initgui = async function (options) {
             // -------------------------------------------------------------------------------------
             // Action: CopyAuth — show dialog to copy auth token
             // -------------------------------------------------------------------------------------
-            if ( action === 'copyauth' ) {
+            if (action === 'copyauth') {
                 await UIWindowCopyToken({ show_header: true });
             }
 
             // -------------------------------------------------------------------------------------
             // Load desktop, only if we're not embedded in a popup and not on the dashboard page
             // -------------------------------------------------------------------------------------
-            if ( !window.embedded_in_popup && !window.is_dashboard_mode ) {
-                if ( window.is_fullpage_mode ) {
+            if (!window.embedded_in_popup && !window.is_dashboard_mode) {
+                if (window.is_fullpage_mode) {
                     // In fullpage mode, skip loading desktop items and background
                     UIDesktop({});
                 } else {
                     await window.get_auto_arrange_data();
-                    puter.fs.stat({ path: window.desktop_path, consistency: 'eventual' }).then(desktop_fsentry => {
-                        UIDesktop({ desktop_fsentry: desktop_fsentry });
-                    });
+                    puter.fs
+                        .stat({
+                            path: window.desktop_path,
+                            consistency: 'eventual',
+                        })
+                        .then((desktop_fsentry) => {
+                            UIDesktop({ desktop_fsentry: desktop_fsentry });
+                        });
                 }
             }
             // -------------------------------------------------------------------------------------
             // Dashboard mode
             // -------------------------------------------------------------------------------------
-            else if ( window.is_dashboard_mode ) {
+            else if (window.is_dashboard_mode) {
                 UIDashboard();
             }
             // -------------------------------------------------------------------------------------
@@ -1062,32 +1163,40 @@ window.initgui = async function (options) {
             else {
                 let msg_id = window.url_query_params.get('msg_id');
                 try {
-                    let data = await window.getUserAppToken(new URL(window.openerOrigin).origin);
+                    let data = await window.getUserAppToken(
+                        new URL(window.openerOrigin).origin,
+                    );
                     // This is an implicit app and the app_uid is sent back from the server
                     // we cache it here so that we can use it later
                     window.host_app_uid = data.app_uid;
                     // send token to parent
-                    window.opener.postMessage({
-                        msg: 'puter.token',
-                        success: true,
-                        token: data.token,
-                        app_uid: data.app_uid,
-                        username: window.user.username,
-                        msg_id: msg_id,
-                    }, window.openerOrigin);
+                    window.opener.postMessage(
+                        {
+                            msg: 'puter.token',
+                            success: true,
+                            token: data.token,
+                            app_uid: data.app_uid,
+                            username: window.user.username,
+                            msg_id: msg_id,
+                        },
+                        window.openerOrigin,
+                    );
                     // close popup
-                    if ( !action || action === 'sign-in' ) {
+                    if (!action || action === 'sign-in') {
                         window.close();
                         window.open('', '_self').close();
                     }
-                } catch ( err ) {
+                } catch (err) {
                     // send error to parent
-                    window.opener.postMessage({
-                        msg: 'puter.token',
-                        success: false,
-                        token: null,
-                        msg_id: msg_id,
-                    }, window.openerOrigin);
+                    window.opener.postMessage(
+                        {
+                            msg: 'puter.token',
+                            success: false,
+                            token: null,
+                            msg_id: msg_id,
+                        },
+                        window.openerOrigin,
+                    );
                     // close popup
                     window.close();
                     window.open('', '_self').close();
@@ -1095,12 +1204,14 @@ window.initgui = async function (options) {
 
                 let app_uid;
 
-                if ( window.openerOrigin ) {
-                    app_uid = await window.getAppUIDFromOrigin(window.openerOrigin);
+                if (window.openerOrigin) {
+                    app_uid = await window.getAppUIDFromOrigin(
+                        window.openerOrigin,
+                    );
                     window.host_app_uid = app_uid;
                 }
 
-                if ( action === 'show-open-file-picker' ) {
+                if (action === 'show-open-file-picker') {
                     let options = window.url_query_params.get('options');
                     options = JSON.parse(options ?? '{}');
 
@@ -1108,7 +1219,7 @@ window.initgui = async function (options) {
                     UIWindow({
                         allowed_file_types: options?.accept,
                         selectable_body: options?.multiple,
-                        path: `/${ window.user.username }/Desktop`,
+                        path: `/${window.user.username}/Desktop`,
                         // this is the uuid of the window to which this dialog will return
                         return_to_parent_window: true,
                         show_maximize_button: false,
@@ -1124,20 +1235,23 @@ window.initgui = async function (options) {
                         center: true,
                         initiating_app_uuid: app_uid,
                         on_close: function () {
-                            window.opener.postMessage({
-                                msg: 'fileOpenCanceled',
-                                original_msg_id: msg_id,
-                            }, '*');
+                            window.opener.postMessage(
+                                {
+                                    msg: 'fileOpenCanceled',
+                                    original_msg_id: msg_id,
+                                },
+                                '*',
+                            );
                         },
                     });
                 }
                 //--------------------------------------------------------------------------------------
                 // Action: Show Directory Picker
                 //--------------------------------------------------------------------------------------
-                else if ( action === 'show-directory-picker' ) {
+                else if (action === 'show-directory-picker') {
                     // open directory picker dialog
                     UIWindow({
-                        path: `/${ window.user.username }/Desktop`,
+                        path: `/${window.user.username}/Desktop`,
                         // this is the uuid of the window to which this dialog will return
                         // parent_uuid: event.data.appInstanceID,
                         return_to_parent_window: true,
@@ -1154,35 +1268,41 @@ window.initgui = async function (options) {
                         center: true,
                         initiating_app_uuid: app_uid,
                         on_close: function () {
-                            window.opener.postMessage({
-                                msg: 'directoryOpenCanceled',
-                                original_msg_id: msg_id,
-                            }, '*');
+                            window.opener.postMessage(
+                                {
+                                    msg: 'directoryOpenCanceled',
+                                    original_msg_id: msg_id,
+                                },
+                                '*',
+                            );
                         },
                     });
                 }
                 //--------------------------------------------------------------------------------------
                 // Action: Show Save File Dialog
                 //--------------------------------------------------------------------------------------
-                else if ( action === 'show-save-file-picker' ) {
-                    let allowed_file_types = window.url_query_params.get('allowed_file_types');
+                else if (action === 'show-save-file-picker') {
+                    let allowed_file_types =
+                        window.url_query_params.get('allowed_file_types');
 
                     // send 'sendMeFileData' event to parent
-                    window.opener.postMessage({
-                        msg: 'sendMeFileData',
-                    }, '*');
+                    window.opener.postMessage(
+                        {
+                            msg: 'sendMeFileData',
+                        },
+                        '*',
+                    );
 
                     // listen for 'showSaveFilePickerPopup' event from parent
                     window.addEventListener('message', async (event) => {
-                        if ( event.data.msg !== 'showSaveFilePickerPopup' )
-                        {
+                        if (event.data.msg !== 'showSaveFilePickerPopup') {
                             return;
                         }
 
                         // Open dialog
                         UIWindow({
                             allowed_file_types: allowed_file_types,
-                            path: `/${ window.user.username }/Desktop`,
+                            path: `/${window.user.username}/Desktop`,
                             // this is the uuid of the window to which this dialog will return
                             return_to_parent_window: true,
                             show_maximize_button: false,
@@ -1198,22 +1318,34 @@ window.initgui = async function (options) {
                             center: true,
                             initiating_app_uuid: app_uid,
                             on_close: function () {
-                                window.opener.postMessage({
-                                    msg: 'fileSaveCanceled',
-                                    original_msg_id: msg_id,
-                                }, '*');
+                                window.opener.postMessage(
+                                    {
+                                        msg: 'fileSaveCanceled',
+                                        original_msg_id: msg_id,
+                                    },
+                                    '*',
+                                );
                             },
-                            onSaveFileDialogSave: async function (target_path, el_filedialog_window) {
-                                $(el_filedialog_window).find('.window-disable-mask, .busy-indicator').show();
+                            onSaveFileDialogSave: async function (
+                                target_path,
+                                el_filedialog_window,
+                            ) {
+                                $(el_filedialog_window)
+                                    .find(
+                                        '.window-disable-mask, .busy-indicator',
+                                    )
+                                    .show();
                                 let busy_init_ts = Date.now();
 
                                 let overwrite = false;
-                                let file_to_upload = new File([event.data.content], path.basename(target_path));
+                                let file_to_upload = new File(
+                                    [event.data.content],
+                                    path.basename(target_path),
+                                );
                                 let item_with_same_name_already_exists = true;
-                                while ( item_with_same_name_already_exists ) {
+                                while (item_with_same_name_already_exists) {
                                     // overwrite?
-                                    if ( overwrite )
-                                    {
+                                    if (overwrite) {
                                         item_with_same_name_already_exists = false;
                                     }
                                     // upload
@@ -1227,31 +1359,45 @@ window.initgui = async function (options) {
                                             },
                                         );
 
-                                        let file_signature = await puter.fs.sign(app_uid, { uid: res.uid, action: 'write' });
+                                        let file_signature =
+                                            await puter.fs.sign(app_uid, {
+                                                uid: res.uid,
+                                                action: 'write',
+                                            });
                                         file_signature = file_signature.items;
 
                                         item_with_same_name_already_exists = false;
-                                        window.opener.postMessage({
-                                            msg: 'fileSaved',
-                                            original_msg_id: msg_id,
-                                            filename: res.name,
-                                            saved_file: {
-                                                name: file_signature.fsentry_name,
-                                                readURL: file_signature.read_url,
-                                                writeURL: file_signature.write_url,
-                                                metadataURL: file_signature.metadata_url,
-                                                type: file_signature.type,
-                                                uid: file_signature.uid,
-                                                path: privacy_aware_path(res.path),
+                                        window.opener.postMessage(
+                                            {
+                                                msg: 'fileSaved',
+                                                original_msg_id: msg_id,
+                                                filename: res.name,
+                                                saved_file: {
+                                                    name: file_signature.fsentry_name,
+                                                    readURL:
+                                                        file_signature.read_url,
+                                                    writeURL:
+                                                        file_signature.write_url,
+                                                    metadataURL:
+                                                        file_signature.metadata_url,
+                                                    type: file_signature.type,
+                                                    uid: file_signature.uid,
+                                                    path: privacy_aware_path(
+                                                        res.path,
+                                                    ),
+                                                },
                                             },
-                                        }, '*');
+                                            '*',
+                                        );
 
                                         window.close();
                                         window.open('', '_self').close();
-                                    }
-                                    catch ( err ) {
+                                    } catch (err) {
                                         // item with same name exists
-                                        if ( err.code === 'item_with_same_name_exists' ) {
+                                        if (
+                                            err.code ===
+                                            'item_with_same_name_exists'
+                                        ) {
                                             const alert_resp = await UIAlert({
                                                 message: `<strong>${html_encode(err.entry_name)}</strong> already exists.`,
                                                 buttons: [
@@ -1265,39 +1411,65 @@ window.initgui = async function (options) {
                                                         value: 'cancel',
                                                     },
                                                 ],
-                                                parent_uuid: $(el_filedialog_window).attr('data-element_uuid'),
+                                                parent_uuid:
+                                                    $(
+                                                        el_filedialog_window,
+                                                    ).attr('data-element_uuid'),
                                             });
-                                            if ( alert_resp === 'replace' ) {
+                                            if (alert_resp === 'replace') {
                                                 overwrite = true;
-                                            } else if ( alert_resp === 'cancel' ) {
+                                            } else if (
+                                                alert_resp === 'cancel'
+                                            ) {
                                                 // enable parent window
-                                                $(el_filedialog_window).find('.window-disable-mask, .busy-indicator').hide();
+                                                $(el_filedialog_window)
+                                                    .find(
+                                                        '.window-disable-mask, .busy-indicator',
+                                                    )
+                                                    .hide();
                                                 return;
                                             }
-                                        }
-                                        else {
+                                        } else {
                                             console.log(err);
                                             // show error
                                             await UIAlert({
-                                                message: err.message ?? 'Upload failed.',
-                                                parent_uuid: $(el_filedialog_window).attr('data-element_uuid'),
+                                                message:
+                                                    err.message ??
+                                                    'Upload failed.',
+                                                parent_uuid:
+                                                    $(
+                                                        el_filedialog_window,
+                                                    ).attr('data-element_uuid'),
                                             });
                                             // enable parent window
-                                            $(el_filedialog_window).find('.window-disable-mask, .busy-indicator').hide();
+                                            $(el_filedialog_window)
+                                                .find(
+                                                    '.window-disable-mask, .busy-indicator',
+                                                )
+                                                .hide();
                                             return;
                                         }
                                     }
                                 }
 
                                 // done
-                                let busy_duration = (Date.now() - busy_init_ts);
-                                if ( busy_duration >= window.busy_indicator_hide_delay ) {
+                                let busy_duration = Date.now() - busy_init_ts;
+                                if (
+                                    busy_duration >=
+                                    window.busy_indicator_hide_delay
+                                ) {
                                     $(el_filedialog_window).close();
                                 } else {
-                                    setTimeout(() => {
-                                        // close this dialog
-                                        $(el_filedialog_window).close();
-                                    }, Math.abs(window.busy_indicator_hide_delay - busy_duration));
+                                    setTimeout(
+                                        () => {
+                                            // close this dialog
+                                            $(el_filedialog_window).close();
+                                        },
+                                        Math.abs(
+                                            window.busy_indicator_hide_delay -
+                                                busy_duration,
+                                        ),
+                                    );
                                 }
                             },
                         });
@@ -1316,32 +1488,34 @@ window.initgui = async function (options) {
     // If we're in fullpage/emebedded/Auth Popup mode, we don't want to load the custom background
     // because it's not visible anyway and it's a waste of bandwidth
     // -------------------------------------------------------------------------------------
-    if ( !window.is_fullpage_mode && !window.embedded_in_popup ) {
+    if (!window.is_fullpage_mode && !window.embedded_in_popup) {
         window.refresh_desktop_background();
     }
     // -------------------------------------------------------------------------------------
     // Un-authed but not first visit -> try to log in/sign up
     // -------------------------------------------------------------------------------------
-    if ( !window.is_auth() && (!window.first_visit_ever || window.disable_temp_users) ) {
+    if (
+        !window.is_auth() &&
+        (!window.first_visit_ever || window.disable_temp_users)
+    ) {
         const needs_action = action === 'authme' || action === 'copyauth';
         const reload_on_success = needs_action;
-        if ( window.logged_in_users.length > 0 ) {
+        if (window.logged_in_users.length > 0) {
             // dashboard mode skips the wallpaper (fullpage), but the session list
             // has no cover page — restore the wallpaper so it isn't on a blank page
-            if ( window.is_dashboard_mode ) {
+            if (window.is_dashboard_mode) {
                 window.refresh_desktop_background();
             }
             await UIWindowSessionList({
                 redirect_url: needs_action ? window.location.href : undefined,
             });
-        }
-        else {
-            const resp = await fetch(`${window.gui_origin }/whoarewe`);
+        } else {
+            const resp = await fetch(`${window.gui_origin}/whoarewe`);
             const whoarewe = await resp.json();
             await UIWindowLogin({
                 reload_on_success: !window.embedded_in_popup,
                 send_confirmation_code: true,
-                show_signup_button: ( !whoarewe.disable_user_signup ),
+                show_signup_button: !whoarewe.disable_user_signup,
                 redirect_url: needs_action ? window.location.href : undefined,
                 window_options: {
                     cover_page: true,
@@ -1349,7 +1523,7 @@ window.initgui = async function (options) {
                 },
             });
         }
-        if ( !reload_on_success && window.is_auth() ) {
+        if (!reload_on_success && window.is_auth()) {
             window.__login_completed = true;
         }
     }
@@ -1377,17 +1551,15 @@ window.initgui = async function (options) {
         window.referrerStr = referrer;
 
         // in case there is also a referrer query param, add it to the referrer URL
-        if ( window.url_query_params.has('ref') ) {
-            if ( ! referrer )
-            {
+        if (window.url_query_params.has('ref')) {
+            if (!referrer) {
                 referrer = '/';
             }
-            referrer += `?ref=${ html_encode(window.url_query_params.get('ref'))}`;
+            referrer += `?ref=${html_encode(window.url_query_params.get('ref'))}`;
         }
 
         let headers = {};
-        if ( window.custom_headers )
-        {
+        if (window.custom_headers) {
             headers = window.custom_headers;
         }
 
@@ -1401,14 +1573,14 @@ window.initgui = async function (options) {
             };
 
             // Add Turnstile token if available
-            if ( turnstileToken ) {
+            if (turnstileToken) {
                 requestData['cf-turnstile-response'] = turnstileToken;
             }
 
             // Device signal for abuse prevention; omitted when unavailable
             try {
                 const fingerprint = await window.getDeviceFingerprint?.();
-                if ( fingerprint ) {
+                if (fingerprint) {
                     requestData.fingerprint = fingerprint;
                 }
             } catch (e) {
@@ -1416,7 +1588,7 @@ window.initgui = async function (options) {
             }
 
             $.ajax({
-                url: `${window.gui_origin }/signup`,
+                url: `${window.gui_origin}/signup`,
                 type: 'POST',
                 async: true,
                 headers: headers,
@@ -1424,63 +1596,74 @@ window.initgui = async function (options) {
                 data: JSON.stringify(requestData),
                 success: async function (data) {
                     /*eslint-disable*/
-                    const turnstile_duration = Date.now() - window.turnstile_success_ts;
+                    const turnstile_duration =
+                        Date.now() - window.turnstile_success_ts;
                     if (turnstile_duration < 2000) {
                         // Sleep until 2 seconds have passed
                         await window.sleep(2000 - turnstile_duration);
                     }
 
                     const $captchaModal = $('.captcha-modal');
-                    if ( $captchaModal.length > 0 ) await new Promise(async resolve => {
-                        // The callback operand for fadeOut could be called
-                        // more than once if there are multiple `.captcha-modal`
-                        // elements, but only the first call to `resolve()` will
-                        // have any effect.
-                        $captchaModal.fadeOut(200, function () {
-                            $(this).remove();
+                    if ($captchaModal.length > 0)
+                        await new Promise(async (resolve) => {
+                            // The callback operand for fadeOut could be called
+                            // more than once if there are multiple `.captcha-modal`
+                            // elements, but only the first call to `resolve()` will
+                            // have any effect.
+                            $captchaModal.fadeOut(200, function () {
+                                $(this).remove();
+                                resolve();
+                            });
+
+                            // Just in case anything fails, also resolve after 500ms
+                            await window.sleep(500);
                             resolve();
                         });
-                        
-                        // Just in case anything fails, also resolve after 500ms
-                        await window.sleep(500);
-                        resolve();
-                    });
 
                     await window.update_auth_data(data.token, data.user);
 
                     // if this is a popup, hide the spinner, make sure it was visible for at least 2 seconds
-                    if(window.embedded_in_popup) await new Promise(async resolve => {
-                        let spinner_duration = (Date.now() - spinner_init_ts);
+                    if (window.embedded_in_popup)
+                        await new Promise(async (resolve) => {
+                            let spinner_duration = Date.now() - spinner_init_ts;
 
-                        (async () => {
-                            let msg_id = window.url_query_params.get('msg_id');
-                            let data = await window.getUserAppToken(new URL(window.openerOrigin).origin);
-                            // This is an implicit app and the app_uid is sent back from the server
-                            // we cache it here so that we can use it later
-                            window.host_app_uid = data.app_uid;
-                            // send token to parent
-                            window.opener.postMessage({
-                                msg: 'puter.token',
-                                success: true,
-                                msg_id: msg_id,
-                                token: data.token,
-                                username: window.user.username,
-                                app_uid: data.app_uid,
-                            }, window.openerOrigin);
-                            // close popup
-                            if ( !action || action === 'sign-in' ) {
-                                window.close();
-                                window.open('', '_self').close();
+                            (async () => {
+                                let msg_id =
+                                    window.url_query_params.get('msg_id');
+                                let data = await window.getUserAppToken(
+                                    new URL(window.openerOrigin).origin,
+                                );
+                                // This is an implicit app and the app_uid is sent back from the server
+                                // we cache it here so that we can use it later
+                                window.host_app_uid = data.app_uid;
+                                // send token to parent
+                                window.opener.postMessage(
+                                    {
+                                        msg: 'puter.token',
+                                        success: true,
+                                        msg_id: msg_id,
+                                        token: data.token,
+                                        username: window.user.username,
+                                        app_uid: data.app_uid,
+                                    },
+                                    window.openerOrigin,
+                                );
+                                // close popup
+                                if (!action || action === 'sign-in') {
+                                    window.close();
+                                    window.open('', '_self').close();
+                                }
+                            })();
+                            if (spinner_duration < 2000) {
+                                await window.sleep(2000 - spinner_duration);
+                                resolve();
                             }
-                        })();
-                        if (spinner_duration < 2000) {
-                            await window.sleep(2000 - spinner_duration);
-                            resolve();
-                        }
-                    });
+                        });
                     /*eslint-enable*/
 
-                    document.dispatchEvent(new Event('login', { bubbles: true }));
+                    document.dispatchEvent(
+                        new Event('login', { bubbles: true }),
+                    );
                 },
                 error: async (err) => {
                     let err_obj = null;
@@ -1489,7 +1672,7 @@ window.initgui = async function (options) {
                     } catch (e) {
                         err_obj = e;
                     }
-                    if ( err_obj.code === 'must_login_or_signup' ) {
+                    if (err_obj.code === 'must_login_or_signup') {
                         // hide Turnstile challenge
                         $('.captcha-modal').hide();
 
@@ -1504,26 +1687,31 @@ window.initgui = async function (options) {
 
                         (async () => {
                             let msg_id = window.url_query_params.get('msg_id');
-                            let data = await window.getUserAppToken(new URL(window.openerOrigin).origin);
+                            let data = await window.getUserAppToken(
+                                new URL(window.openerOrigin).origin,
+                            );
                             // This is an implicit app and the app_uid is sent back from the server
                             // we cache it here so that we can use it later
                             window.host_app_uid = data.app_uid;
                             // send token to parent
-                            window.opener.postMessage({
-                                msg: 'puter.token',
-                                success: true,
-                                msg_id: msg_id,
-                                token: data.token,
-                                username: window.user.username,
-                                app_uid: data.app_uid,
-                            }, window.openerOrigin);
+                            window.opener.postMessage(
+                                {
+                                    msg: 'puter.token',
+                                    success: true,
+                                    msg_id: msg_id,
+                                    token: data.token,
+                                    username: window.user.username,
+                                    app_uid: data.app_uid,
+                                },
+                                window.openerOrigin,
+                            );
                             // close popup
-                            if ( !action || action === 'sign-in' ) {
+                            if (!action || action === 'sign-in') {
                                 window.close();
                                 window.open('', '_self').close();
                             }
                         })();
-                    } else if ( err_obj.code === 'signup_blocked' ) {
+                    } else if (err_obj.code === 'signup_blocked') {
                         // Hide any captcha modal
                         $('.captcha-modal').hide();
 
@@ -1540,23 +1728,25 @@ window.initgui = async function (options) {
                         document.body.appendChild(overlay);
                     } else {
                         UIAlert({
-                            message: err_obj.message ?? 'There was an error creating your account. Please try again.',
+                            message:
+                                err_obj.message ??
+                                'There was an error creating your account. Please try again.',
                         });
                     }
                 },
-                complete: function () {
-                },
+                complete: function () {},
             });
         };
 
         // Check if Turnstile is enabled and show challenge
-        if ( window.gui_params?.turnstileSiteKey ) {
+        if (window.gui_params?.turnstileSiteKey) {
             window.showTurnstileChallenge({
                 onSuccess: createTempUser,
                 onError: (error) => {
                     console.error('Turnstile verification failed:', error);
                     UIAlert({
-                        message: 'Security verification failed. Please refresh the page and try again.',
+                        message:
+                            'Security verification failed. Please refresh the page and try again.',
                     });
                 },
             });
@@ -1567,10 +1757,9 @@ window.initgui = async function (options) {
     }
 
     // if there is at least one window open (only non-Explorer windows), ask user for confirmation when navigating away from puter
-    if ( window.feature_flags.prompt_user_when_navigation_away_from_puter ) {
+    if (window.feature_flags.prompt_user_when_navigation_away_from_puter) {
         window.onbeforeunload = function () {
-            if ( $('.window:not(.window[data-app="explorer"])').length > 0 )
-            {
+            if ($('.window:not(.window[data-app="explorer"])').length > 0) {
                 return true;
             }
         };
@@ -1586,18 +1775,22 @@ window.initgui = async function (options) {
         // -------------------------------------------------------------------------------------
         // Action: AuthMe — redirect to a third-party URL with the user's auth token
         // -------------------------------------------------------------------------------------
-        if ( action === 'authme' ) {
+        if (action === 'authme') {
             const redirectURL = window.url_query_params.get('redirectURL');
-            if ( redirectURL ) {
+            if (redirectURL) {
                 const approved = await UIWindowAuthMe({
                     redirect_url: redirectURL,
                 });
-                if ( approved ) {
+                if (approved) {
                     // Hand the app a named, revocable full-API-access token
                     // instead of the raw GUI/session token: it can use the
                     // whole API but can't manage the account.
                     let host = '';
-                    try { host = new URL(redirectURL).host; } catch ( e ) { /* ignore */ }
+                    try {
+                        host = new URL(redirectURL).host;
+                    } catch (e) {
+                        /* ignore */
+                    }
                     let token;
                     try {
                         token = await create_access_token({
@@ -1605,7 +1798,7 @@ window.initgui = async function (options) {
                                 ? `${i18n('token_label_external_app')} (${host})`
                                 : i18n('token_label_external_app'),
                         });
-                    } catch ( e ) {
+                    } catch (e) {
                         await UIAlert({ message: e?.message ?? String(e) });
                         return;
                     }
@@ -1620,17 +1813,23 @@ window.initgui = async function (options) {
         // -------------------------------------------------------------------------------------
         // Action: CopyAuth — show dialog to copy auth token
         // -------------------------------------------------------------------------------------
-        if ( action === 'copyauth' ) {
+        if (action === 'copyauth') {
             await UIWindowCopyToken({ show_header: true });
         }
 
         // -------------------------------------------------------------------------------------
         // Early check for fullpage mode from app metadata (after login)
         // -------------------------------------------------------------------------------------
-        if ( !window.is_fullpage_mode && window.url_paths[0]?.toLocaleLowerCase() === 'app' && window.url_paths[1] ) {
+        if (
+            !window.is_fullpage_mode &&
+            window.url_paths[0]?.toLocaleLowerCase() === 'app' &&
+            window.url_paths[1]
+        ) {
             try {
-                const app_info = await puter.apps.get(window.url_paths[1], { icon_size: 64 });
-                if ( app_info?.metadata?.fullpage_on_landing ) {
+                const app_info = await puter.apps.get(window.url_paths[1], {
+                    icon_size: 64,
+                });
+                if (app_info?.metadata?.fullpage_on_landing) {
                     window.is_fullpage_mode = true;
                     window.taskbar_height = 0;
                     window.app_launched_from_url = app_info;
@@ -1643,21 +1842,26 @@ window.initgui = async function (options) {
         // -------------------------------------------------------------------------------------
         // Load desktop, if not embedded in a popup and not on the dashboard page
         // -------------------------------------------------------------------------------------
-        if ( !window.embedded_in_popup && !window.is_dashboard_mode ) {
-            if ( window.is_fullpage_mode ) {
+        if (!window.embedded_in_popup && !window.is_dashboard_mode) {
+            if (window.is_fullpage_mode) {
                 // In fullpage mode, skip loading desktop items and background
                 UIDesktop({});
             } else {
                 await window.get_auto_arrange_data();
-                puter.fs.stat({ path: window.desktop_path, consistency: 'eventual' }).then(desktop_fsentry => {
-                    UIDesktop({ desktop_fsentry: desktop_fsentry });
-                });
+                puter.fs
+                    .stat({
+                        path: window.desktop_path,
+                        consistency: 'eventual',
+                    })
+                    .then((desktop_fsentry) => {
+                        UIDesktop({ desktop_fsentry: desktop_fsentry });
+                    });
             }
         }
         // -------------------------------------------------------------------------------------
         // Dashboard mode: open explorer pointing to home directory
         // -------------------------------------------------------------------------------------
-        else if ( window.is_dashboard_mode ) {
+        else if (window.is_dashboard_mode) {
             UIDashboard();
         }
         // -------------------------------------------------------------------------------------
@@ -1666,33 +1870,40 @@ window.initgui = async function (options) {
         else {
             let msg_id = window.url_query_params.get('msg_id');
             try {
-
-                let data = await window.getUserAppToken(new URL(window.openerOrigin).origin);
+                let data = await window.getUserAppToken(
+                    new URL(window.openerOrigin).origin,
+                );
                 // This is an implicit app and the app_uid is sent back from the server
                 // we cache it here so that we can use it later
                 window.host_app_uid = data.app_uid;
                 // send token to parent
-                window.opener.postMessage({
-                    msg: 'puter.token',
-                    success: true,
-                    msg_id: msg_id,
-                    token: data.token,
-                    username: window.user.username,
-                    app_uid: data.app_uid,
-                }, window.openerOrigin);
+                window.opener.postMessage(
+                    {
+                        msg: 'puter.token',
+                        success: true,
+                        msg_id: msg_id,
+                        token: data.token,
+                        username: window.user.username,
+                        app_uid: data.app_uid,
+                    },
+                    window.openerOrigin,
+                );
                 // close popup
-                if ( !action || action === 'sign-in' ) {
+                if (!action || action === 'sign-in') {
                     window.close();
                     window.open('', '_self').close();
                 }
-            } catch ( err ) {
+            } catch (err) {
                 // send error to parent
-                window.opener.postMessage({
-                    msg: 'puter.token',
-                    msg_id: msg_id,
-                    success: false,
-                    token: null,
-                }, window.openerOrigin);
+                window.opener.postMessage(
+                    {
+                        msg: 'puter.token',
+                        msg_id: msg_id,
+                        success: false,
+                        token: null,
+                    },
+                    window.openerOrigin,
+                );
                 // close popup
                 window.close();
                 window.open('', '_self').close();
@@ -1700,7 +1911,7 @@ window.initgui = async function (options) {
 
             let app_uid;
 
-            if ( window.openerOrigin ) {
+            if (window.openerOrigin) {
                 app_uid = await window.getAppUIDFromOrigin(window.openerOrigin);
                 window.host_app_uid = app_uid;
             }
@@ -1708,7 +1919,7 @@ window.initgui = async function (options) {
             //--------------------------------------------------------------------------------------
             // Action: Show Open File Picker
             //--------------------------------------------------------------------------------------
-            if ( action === 'show-open-file-picker' ) {
+            if (action === 'show-open-file-picker') {
                 let options = window.url_query_params.get('options');
                 options = JSON.parse(options ?? '{}');
 
@@ -1716,7 +1927,7 @@ window.initgui = async function (options) {
                 UIWindow({
                     allowed_file_types: options?.accept,
                     selectable_body: options?.multiple,
-                    path: `/${ window.user.username }/Desktop`,
+                    path: `/${window.user.username}/Desktop`,
                     return_to_parent_window: true,
                     show_maximize_button: false,
                     show_minimize_button: false,
@@ -1730,20 +1941,23 @@ window.initgui = async function (options) {
                     center: true,
                     initiating_app_uuid: app_uid,
                     on_close: function () {
-                        window.opener.postMessage({
-                            msg: 'fileOpenCanceled',
-                            original_msg_id: msg_id,
-                        }, '*');
+                        window.opener.postMessage(
+                            {
+                                msg: 'fileOpenCanceled',
+                                original_msg_id: msg_id,
+                            },
+                            '*',
+                        );
                     },
                 });
             }
             //--------------------------------------------------------------------------------------
             // Action: Show Directory Picker
             //--------------------------------------------------------------------------------------
-            else if ( action === 'show-directory-picker' ) {
+            else if (action === 'show-directory-picker') {
                 // open directory picker dialog
                 UIWindow({
-                    path: `/${ window.user.username }/Desktop`,
+                    path: `/${window.user.username}/Desktop`,
                     // this is the uuid of the window to which this dialog will return
                     // parent_uuid: event.data.appInstanceID,
                     return_to_parent_window: true,
@@ -1760,10 +1974,13 @@ window.initgui = async function (options) {
                     center: true,
                     initiating_app_uuid: app_uid,
                     on_close: function () {
-                        window.opener.postMessage({
-                            msg: 'directoryOpenCanceled',
-                            original_msg_id: msg_id,
-                        }, '*');
+                        window.opener.postMessage(
+                            {
+                                msg: 'directoryOpenCanceled',
+                                original_msg_id: msg_id,
+                            },
+                            '*',
+                        );
                     },
                 });
             }
@@ -1771,25 +1988,28 @@ window.initgui = async function (options) {
             //--------------------------------------------------------------------------------------
             // Action: Show Save File Dialog
             //--------------------------------------------------------------------------------------
-            else if ( action === 'show-save-file-picker' ) {
-                let allowed_file_types = window.url_query_params.get('allowed_file_types');
+            else if (action === 'show-save-file-picker') {
+                let allowed_file_types =
+                    window.url_query_params.get('allowed_file_types');
 
                 // send 'sendMeFileData' event to parent
-                window.opener.postMessage({
-                    msg: 'sendMeFileData',
-                }, '*');
+                window.opener.postMessage(
+                    {
+                        msg: 'sendMeFileData',
+                    },
+                    '*',
+                );
 
                 // listen for 'showSaveFilePickerPopup' event from parent
                 window.addEventListener('message', async (event) => {
-                    if ( event.data.msg !== 'showSaveFilePickerPopup' )
-                    {
+                    if (event.data.msg !== 'showSaveFilePickerPopup') {
                         return;
                     }
 
                     // Open dialog
                     UIWindow({
                         allowed_file_types: allowed_file_types,
-                        path: `/${ window.user.username }/Desktop`,
+                        path: `/${window.user.username}/Desktop`,
                         // this is the uuid of the window to which this dialog will return
                         return_to_parent_window: true,
                         show_maximize_button: false,
@@ -1805,22 +2025,32 @@ window.initgui = async function (options) {
                         center: true,
                         initiating_app_uuid: app_uid,
                         on_close: function () {
-                            window.opener.postMessage({
-                                msg: 'fileSaveCanceled',
-                                original_msg_id: msg_id,
-                            }, '*');
+                            window.opener.postMessage(
+                                {
+                                    msg: 'fileSaveCanceled',
+                                    original_msg_id: msg_id,
+                                },
+                                '*',
+                            );
                         },
-                        onSaveFileDialogSave: async function (target_path, el_filedialog_window) {
-                            $(el_filedialog_window).find('.window-disable-mask, .busy-indicator').show();
+                        onSaveFileDialogSave: async function (
+                            target_path,
+                            el_filedialog_window,
+                        ) {
+                            $(el_filedialog_window)
+                                .find('.window-disable-mask, .busy-indicator')
+                                .show();
                             let busy_init_ts = Date.now();
 
                             let overwrite = false;
-                            let file_to_upload = new File([event.data.content], path.basename(target_path));
+                            let file_to_upload = new File(
+                                [event.data.content],
+                                path.basename(target_path),
+                            );
                             let item_with_same_name_already_exists = true;
-                            while ( item_with_same_name_already_exists ) {
+                            while (item_with_same_name_already_exists) {
                                 // overwrite?
-                                if ( overwrite )
-                                {
+                                if (overwrite) {
                                     item_with_same_name_already_exists = false;
                                 }
                                 // upload
@@ -1834,32 +2064,45 @@ window.initgui = async function (options) {
                                         },
                                     );
 
-                                    let file_signature = await puter.fs.sign(app_uid, { uid: res.uid, action: 'write' });
+                                    let file_signature = await puter.fs.sign(
+                                        app_uid,
+                                        { uid: res.uid, action: 'write' },
+                                    );
                                     file_signature = file_signature.items;
 
                                     item_with_same_name_already_exists = false;
-                                    window.opener.postMessage({
-                                        msg: 'fileSaved',
-                                        original_msg_id: msg_id,
-                                        filename: res.name,
-                                        saved_file: {
-                                            name: file_signature.fsentry_name,
-                                            readURL: file_signature.read_url,
-                                            writeURL: file_signature.write_url,
-                                            metadataURL: file_signature.metadata_url,
-                                            type: file_signature.type,
-                                            uid: file_signature.uid,
-                                            path: privacy_aware_path(res.path),
+                                    window.opener.postMessage(
+                                        {
+                                            msg: 'fileSaved',
+                                            original_msg_id: msg_id,
+                                            filename: res.name,
+                                            saved_file: {
+                                                name: file_signature.fsentry_name,
+                                                readURL:
+                                                    file_signature.read_url,
+                                                writeURL:
+                                                    file_signature.write_url,
+                                                metadataURL:
+                                                    file_signature.metadata_url,
+                                                type: file_signature.type,
+                                                uid: file_signature.uid,
+                                                path: privacy_aware_path(
+                                                    res.path,
+                                                ),
+                                            },
                                         },
-                                    }, '*');
+                                        '*',
+                                    );
 
                                     window.close();
                                     window.open('', '_self').close();
                                     // show_save_account_notice_if_needed();
-                                }
-                                catch ( err ) {
+                                } catch (err) {
                                     // item with same name exists
-                                    if ( err.code === 'item_with_same_name_exists' ) {
+                                    if (
+                                        err.code ===
+                                        'item_with_same_name_exists'
+                                    ) {
                                         const alert_resp = await UIAlert({
                                             message: `<strong>${html_encode(err.entry_name)}</strong> already exists.`,
                                             buttons: [
@@ -1873,51 +2116,71 @@ window.initgui = async function (options) {
                                                     value: 'cancel',
                                                 },
                                             ],
-                                            parent_uuid: $(el_filedialog_window).attr('data-element_uuid'),
+                                            parent_uuid:
+                                                $(el_filedialog_window).attr(
+                                                    'data-element_uuid',
+                                                ),
                                         });
-                                        if ( alert_resp === 'replace' ) {
+                                        if (alert_resp === 'replace') {
                                             overwrite = true;
-                                        } else if ( alert_resp === 'cancel' ) {
+                                        } else if (alert_resp === 'cancel') {
                                             // enable parent window
-                                            $(el_filedialog_window).find('.window-disable-mask, .busy-indicator').hide();
+                                            $(el_filedialog_window)
+                                                .find(
+                                                    '.window-disable-mask, .busy-indicator',
+                                                )
+                                                .hide();
                                             return;
                                         }
-                                    }
-                                    else {
+                                    } else {
                                         console.log(err);
                                         // show error
                                         await UIAlert({
-                                            message: err.message ?? 'Upload failed.',
-                                            parent_uuid: $(el_filedialog_window).attr('data-element_uuid'),
+                                            message:
+                                                err.message ?? 'Upload failed.',
+                                            parent_uuid:
+                                                $(el_filedialog_window).attr(
+                                                    'data-element_uuid',
+                                                ),
                                         });
                                         // enable parent window
-                                        $(el_filedialog_window).find('.window-disable-mask, .busy-indicator').hide();
+                                        $(el_filedialog_window)
+                                            .find(
+                                                '.window-disable-mask, .busy-indicator',
+                                            )
+                                            .hide();
                                         return;
                                     }
                                 }
                             }
 
                             // done
-                            let busy_duration = (Date.now() - busy_init_ts);
-                            if ( busy_duration >= window.busy_indicator_hide_delay ) {
+                            let busy_duration = Date.now() - busy_init_ts;
+                            if (
+                                busy_duration >=
+                                window.busy_indicator_hide_delay
+                            ) {
                                 $(el_filedialog_window).close();
                             } else {
-                                setTimeout(() => {
-                                    // close this dialog
-                                    $(el_filedialog_window).close();
-                                }, Math.abs(window.busy_indicator_hide_delay - busy_duration));
+                                setTimeout(
+                                    () => {
+                                        // close this dialog
+                                        $(el_filedialog_window).close();
+                                    },
+                                    Math.abs(
+                                        window.busy_indicator_hide_delay -
+                                            busy_duration,
+                                    ),
+                                );
                             }
                         },
-
                     });
                 });
             }
-
         }
-
     });
 
-    if ( window.__login_completed ) {
+    if (window.__login_completed) {
         document.dispatchEvent(new Event('login', { bubbles: true }));
         window.__login_completed = false;
     }
@@ -1932,33 +2195,38 @@ window.initgui = async function (options) {
         update_last_touch_coordinates(e);
 
         // dismiss touchstart on regular devices
-        if ( e.type === 'touchstart' && !isMobile.phone && !isMobile.tablet )
-        {
+        if (e.type === 'touchstart' && !isMobile.phone && !isMobile.tablet) {
             return;
         }
 
         // If .item-container clicked, unselect all its item children
-        if ( $(e.target).hasClass('item-container') && !e.ctrlKey && !e.metaKey ) {
+        if (
+            $(e.target).hasClass('item-container') &&
+            !e.ctrlKey &&
+            !e.metaKey
+        ) {
             $(e.target).children('.item-selected').removeClass('item-selected');
             window.update_explorer_footer_selected_items_count(e.target);
         }
 
         // If the clicked element is not a context menu, remove all context menus
-        if ( $(e.target).parents('.context-menu').length === 0 ) {
+        if ($(e.target).parents('.context-menu').length === 0) {
             $('.context-menu').fadeOut(200, function () {
                 $(this).remove();
             });
         }
 
         // click on anything will close all popovers, but there are some exceptions
-        if ( !$(e.target).hasClass('start-app')
-            && !$(e.target).hasClass('launch-search')
-            && !$(e.target).hasClass('launch-search-clear')
-            && $(e.target).closest('.start-app').length === 0
-            && !isMobile.phone && !isMobile.tablet
-            && !$(e.target).hasClass('popover')
-            && $(e.target).parents('.popover').length === 0 ) {
-
+        if (
+            !$(e.target).hasClass('start-app') &&
+            !$(e.target).hasClass('launch-search') &&
+            !$(e.target).hasClass('launch-search-clear') &&
+            $(e.target).closest('.start-app').length === 0 &&
+            !isMobile.phone &&
+            !isMobile.tablet &&
+            !$(e.target).hasClass('popover') &&
+            $(e.target).parents('.popover').length === 0
+        ) {
             $('.popover').fadeOut(200, function () {
                 $('.popover').remove();
             });
@@ -1968,21 +2236,21 @@ window.initgui = async function (options) {
         $('.ui-tooltip').remove();
 
         // rename items whose names were being edited
-        if ( ! $(e.target).hasClass('item-name-editor') ) {
+        if (!$(e.target).hasClass('item-name-editor')) {
             // blurring an Item Name Editor will automatically trigger renaming the item
             $('.item-name-editor-active').blur();
         }
 
         // update active_item_container
-        if ( $(e.target).hasClass('item-container') ) {
+        if ($(e.target).hasClass('item-container')) {
             window.active_item_container = e.target;
         } else {
             let ic = $(e.target).closest('.item-container');
-            if ( ic.length > 0 ) {
+            if (ic.length > 0) {
                 window.active_item_container = ic.get(0);
             } else {
                 let pp = $(e.target).find('.item-container');
-                if ( pp.length > 0 ) {
+                if (pp.length > 0) {
                     window.active_item_container = pp.get(0);
                 }
             }
@@ -2002,25 +2270,37 @@ window.initgui = async function (options) {
     //--------------------------------------------------------
     $(document).on('mousedown', function (e) {
         // if taskbar or any parts of it is clicked, drop the event
-        if ( $(e.target).hasClass('taskbar') || $(e.target).closest('.taskbar').length > 0 ) {
+        if (
+            $(e.target).hasClass('taskbar') ||
+            $(e.target).closest('.taskbar').length > 0
+        ) {
             return;
         }
         // if toolbar or any parts of it is clicked, drop the event
-        if ( $(e.target).hasClass('toolbar') || $(e.target).closest('.toolbar').length > 0 ) {
+        if (
+            $(e.target).hasClass('toolbar') ||
+            $(e.target).closest('.toolbar').length > 0
+        ) {
             return;
         }
 
         // if close or minimize button clicked, drop the event
-        if ( document.elementFromPoint(e.clientX, e.clientY).closest('.window-close-btn, .window-minimize-btn') ) {
+        if (
+            document
+                .elementFromPoint(e.clientX, e.clientY)
+                .closest('.window-close-btn, .window-minimize-btn')
+        ) {
             return;
         }
 
         // if mouse is clicked on a window, activate it
-        if ( window.mouseover_window !== undefined ) {
+        if (window.mouseover_window !== undefined) {
             // if popover clicked on, don't activate window. This is because if an app
             // is using the popover API to show a popover, the popover will be closed if the window is activated
-            if ( $(e.target).hasClass('popover') || $(e.target).parents('.popover').length > 0 )
-            {
+            if (
+                $(e.target).hasClass('popover') ||
+                $(e.target).parents('.popover').length > 0
+            ) {
                 return;
             }
             $(window.mouseover_window).focusWindow(e);
@@ -2041,21 +2321,20 @@ window.initgui = async function (options) {
     });
 
     document.addEventListener('visibilitychange', (event) => {
-        if ( document.visibilityState !== 'visible' ) {
+        if (document.visibilityState !== 'visible') {
             window.doc_title_before_blur = document.title;
-            if ( Object.keys(window.active_uploads).length > 0 ) {
+            if (Object.keys(window.active_uploads).length > 0) {
                 update_title_based_on_uploads();
             }
-        } else if ( window.active_uploads ) {
+        } else if (window.active_uploads) {
             document.title = window.doc_title_before_blur ?? 'Puter';
         }
     });
-
 };
 
-function requestOpenerOrigin () {
+function requestOpenerOrigin() {
     return new Promise((resolve, reject) => {
-        if ( ! window.opener ) {
+        if (!window.opener) {
             reject(new Error('No window.opener available'));
             return;
         }
@@ -2063,7 +2342,7 @@ function requestOpenerOrigin () {
         // Function to handle the message event
         const handleMessage = (event) => {
             // Check if the message is the expected response
-            if ( event.data.msg === 'originResponse' ) {
+            if (event.data.msg === 'originResponse') {
                 // Clean up by removing the event listener
                 window.removeEventListener('message', handleMessage);
                 resolve(event.origin);
@@ -2089,7 +2368,11 @@ $(document).on('click', '.generic-close-window-button', function (e) {
 });
 
 $(document).on('click', function (e) {
-    if ( !$(e.target).hasClass('window-search') && $(e.target).closest('.window-search').length === 0 && !$(e.target).is('.toolbar-btn.search-btn') ) {
+    if (
+        !$(e.target).hasClass('window-search') &&
+        $(e.target).closest('.window-search').length === 0 &&
+        !$(e.target).is('.toolbar-btn.search-btn')
+    ) {
         $('.window-search').close();
     }
 });
@@ -2097,14 +2380,14 @@ $(document).on('click', function (e) {
 // Re-calculate desktop height and width on window resize and re-position the login and signup windows
 $(window).on('resize', function () {
     // If host env is popup, don't continue because the popup window has its own resize requirements.
-    if ( window.embedded_in_popup )
-    {
+    if (window.embedded_in_popup) {
         return;
     }
 
     const ratio = window.desktop_width / window.innerWidth;
 
-    window.desktop_height = window.innerHeight - window.toolbar_height - window.taskbar_height;
+    window.desktop_height =
+        window.innerHeight - window.toolbar_height - window.taskbar_height;
     window.desktop_width = window.innerWidth;
 
     // Re-center the login window
@@ -2125,7 +2408,7 @@ $(window).on('resize', function () {
 });
 
 $(document).on('contextmenu', '.disable-context-menu', function (e) {
-    if ( $(e.target).hasClass('disable-context-menu') ) {
+    if ($(e.target).hasClass('disable-context-menu')) {
         e.preventDefault();
         return false;
     }
diff --git a/src/puter-js/src/index.js b/src/puter-js/src/index.js
index 8697836c4..6d69508e2 100644
--- a/src/puter-js/src/index.js
+++ b/src/puter-js/src/index.js
@@ -946,18 +946,6 @@ const puterInit = function () {
                     return;
                 }
                 if (this.env === 'app') {
-                    // We're inside an iframe in the GUI. Ask the parent to
-                    // surface the reauth modal; once the user signs in there,
-                    // the existing `puter.token` postMessage delivers the
-                    // fresh token back to us.
-                    //
-                    // targetOrigin is locked to the configured GUI origin, by
-                    // exact match. We deliberately do NOT trust a URL-supplied
-                    // origin here: postMessage('*') — or an attacker-chosen
-                    // origin — would leak the reauth signal + auth_id to a
-                    // malicious parent and could let it inject a token. The
-                    // configured GUI origin is the only origin allowed to drive
-                    // reauth.
                     try {
                         globalThis.parent?.postMessage?.(
                             {