diff --git a/kiosk/src/remote_debug.rs b/kiosk/src/remote_debug.rs
index c6ab3e8..14dce3a 100644
--- a/kiosk/src/remote_debug.rs
+++ b/kiosk/src/remote_debug.rs
@@ -195,6 +195,8 @@ pub fn validate_terminal_code(expected: &str, provided: &str) -> bool {
record_failed_attempt();
return false;
}
+ // Successful terminal auth resets all lockout state.
+ let _ = std::fs::remove_file(lockout_path());
true
}
diff --git a/server/src/plugins/service-admin-http/routes-admin.ts b/server/src/plugins/service-admin-http/routes-admin.ts
index dcc8d32..1f9bc94 100644
--- a/server/src/plugins/service-admin-http/routes-admin.ts
+++ b/server/src/plugins/service-admin-http/routes-admin.ts
@@ -1721,9 +1721,8 @@ export function registerAdminRoutes(app: H3, deps: AdminDeps): void {
if (!kiosk) return new Response(null, { status: 302, headers: { location: "/admin/kiosks" } });
const user = event.context.user!;
// Get or create an API key for the WS connection.
- // WS auth: pass session cookie name so JS can read it for the WS query param.
- // The coordinator WS endpoint also accepts session-based auth.
- const wsToken = "";
+ // WS auth: browser sends session cookie automatically on WS upgrade.
+ // Coordinator WS endpoint validates via resolveSession.
return htmlPage(`Logs: ${kiosk.name}