[MainSequenceDev]

What changes

devtools 0.3.15 reports when the saved login ends: sessionEndsAt in auth-status, which is the refresh token's expiry and doesn't move when the session is renewed. Once that time has passed, devtools reports the account signed out without contacting the backend. This plugin now shows that end to Codex users:

• Panel header. From a day before the end, the account dot turns amber and the header says "MainSequence session ends today at 14:30 — sign in again (/ms login)", in local time. Once the end has passed, the header shows Session ended with when it ended and points to /ms login. While the panel stays open, a timer redraws the header at the warning and at the end.
• /ms output. The account in login, auth-status, refresh-token and status results gives the same warning and end. Before the warning starts, it names when the login ends.
• FORBIDDEN (HTTP 403) stays an ordinary error in the panel, discovery.ts and /ms output. It keeps the panel's context and offers no sign-in. Only AUTH_REJECTED and NOT_AUTHENTICATED end the view, as before. Comments mark the spot, and tests cover all three surfaces.
• The exact devtools pin is now 0.3.15 (npm install --save-exact). The lockfile integrity sha512-YBU65IB…cj1kWQ== matches the registry's dist.integrity.
• README and docs/agents-tools-panel.md describe the login end and how FORBIDDEN is handled. Both stay version-free.

The plugin version stays 0.7.12. This PR doesn't publish, tag or repoint the marketplace; those steps wait for the owner's approval.

Verified

• npm run release:check passes: typecheck, 73/73 tests, release metadata (devtools 0.3.15, integrity matches the lockfile), docs check, Codex pack, npm pack, and verify:package installing from the archive.
• New tests:
  • /ms warning, ended and active wording, plus FORBIDDEN with no sign-in line.
  • Discovery through the real devtools 0.3.15 session service:
    • A future refresh-token exp reaches the verified account.
    • An ended login is signed out with no backend call.
    • FORBIDDEN keeps the context, and a refused tool call is returned rather than turned into a context change.
  • Panel:
    • The header goes from no notice to the amber warning to Session ended as the timer fires, with a controlled clock.
    • A panel opened after the end shows it.
    • FORBIDDEN leaves the account and environment in place.
• The new tests also pass under TZ Pacific/Kiritimati, America/Los_Angeles and Asia/Kolkata.
• Not checked: the panel inside a live Codex host. The header was checked only through the DOM-level panel tests.

🤖 Generated with Claude Code