@agenticmail/enterprise 0.3.2 → 0.4.0

package/dashboards/php/index.php

@@ -1,414 +1,696 @@
 <?php
 /**
- * 🎀 AgenticMail Enterprise Dashboard — PHP Edition
- * 
+ * AgenticMail Enterprise Dashboard -- PHP Edition
+ *
  * ZERO dependencies. No Composer, no Laravel, no framework.
  * Just PHP 7.4+ and a web server.
  *
  * Setup:
- *   1. Edit $API_URL below
- *   2. Drop this file on any PHP web server (Apache, Nginx, XAMPP, MAMP)
- *   3. Open in browser
+ *   1. Set AGENTICMAIL_URL env var (or defaults to localhost:3000)
+ *   2. php -S localhost:8080 index.php
  *
- * Or run locally:
- *   php -S localhost:8080 index.php
+ * This file is the entry point: session management, routing, POST action
+ * dispatch, and inclusion of the appropriate page file.
  */
 
-$API_URL = getenv('AGENTICMAIL_URL') ?: 'http://localhost:3000';
+// ─── Serve Static Files ─────────────────────────────────
+// When using PHP's built-in server, serve static assets directly.
+$uri = $_SERVER['REQUEST_URI'] ?? '';
+$path = parse_url($uri, PHP_URL_PATH);
+if ($path && $path !== '/' && $path !== '/index.php') {
+    $file = __DIR__ . $path;
+    if (is_file($file)) {
+        $ext = pathinfo($file, PATHINFO_EXTENSION);
+        $types = ['css' => 'text/css', 'js' => 'application/javascript', 'png' => 'image/png', 'jpg' => 'image/jpeg', 'svg' => 'image/svg+xml', 'ico' => 'image/x-icon'];
+        if (isset($types[$ext])) {
+            header('Content-Type: ' . $types[$ext]);
+        }
+        readfile($file);
+        return true;
+    }
+}
 
-// ─── Session & Auth ─────────────────────────────────────
+// ─── Bootstrap ──────────────────────────────────────────
 session_start();
-$token = $_SESSION['am_token'] ?? null;
-$user = $_SESSION['am_user'] ?? null;
-$error = '';
-$success = '';
-
-// ─── API Helper ─────────────────────────────────────────
-function am_api(string $path, string $method = 'GET', ?array $body = null): array {
-    global $API_URL, $token;
-    $opts = [
-        'http' => [
-            'method' => $method,
-            'header' => "Content-Type: application/json\r\n" .
-                        ($token ? "Authorization: Bearer $token\r\n" : ''),
-            'timeout' => 10,
-            'ignore_errors' => true,
-        ],
-    ];
-    if ($body !== null) {
-        $opts['http']['content'] = json_encode($body);
-    }
-    $ctx = stream_context_create($opts);
-    $response = @file_get_contents($API_URL . $path, false, $ctx);
-    if ($response === false) return ['error' => 'Could not connect to AgenticMail server'];
-    return json_decode($response, true) ?: ['error' => 'Invalid response'];
-}
 
-// ─── Handle Actions ─────────────────────────────────────
+// Load libraries
+require_once __DIR__ . '/lib/helpers.php';
+require_once __DIR__ . '/lib/api.php';
+require_once __DIR__ . '/lib/auth.php';
+
+// Load components
+require_once __DIR__ . '/components/layout.php';
+require_once __DIR__ . '/components/modal.php';
+require_once __DIR__ . '/components/table.php';
+require_once __DIR__ . '/components/stats.php';
+
+// ─── Handle POST/GET Actions ────────────────────────────
 $action = $_POST['action'] ?? $_GET['action'] ?? '';
 
 if ($action === 'login') {
-    $data = am_api('/auth/login', 'POST', [
-        'email' => $_POST['email'] ?? '',
-        'password' => $_POST['password'] ?? '',
-    ]);
-    if (isset($data['token'])) {
-        $_SESSION['am_token'] = $data['token'];
-        $_SESSION['am_user'] = $data['user'];
-        $token = $data['token'];
-        $user = $data['user'];
-    } else {
-        $error = $data['error'] ?? 'Login failed';
+    handle_login();
+    // If login succeeded, redirect to dashboard to avoid re-POST
+    if (is_logged_in()) {
+        header('Location: ?page=dashboard');
+        exit;
     }
 }
 
 if ($action === 'logout') {
-    session_destroy();
-    header('Location: ?');
-    exit;
+    handle_logout();
+    // handle_logout() calls exit internally
 }
 
-if ($action === 'create_agent' && $token) {
-    $body = ['name' => $_POST['name'] ?? '', 'role' => $_POST['role'] ?? 'assistant'];
-    if (!empty($_POST['email'])) $body['email'] = $_POST['email'];
-    $result = am_api('/api/agents', 'POST', $body);
-    $success = isset($result['id']) ? "Agent '{$body['name']}' created!" : ($result['error'] ?? 'Failed');
-}
+// All remaining actions require authentication
+if ($action && is_logged_in()) {
+    if ($action === 'create_agent') {
+        $body = ['name' => $_POST['name'] ?? '', 'role' => $_POST['role'] ?? 'assistant', 'provider' => $_POST['provider'] ?? 'anthropic'];
+        if (!empty($_POST['email'])) $body['email'] = $_POST['email'];
+        if (!empty($_POST['soul_id'])) $body['soul_id'] = $_POST['soul_id'];
+        $persona = [
+            'gender' => $_POST['gender'] ?: null,
+            'dateOfBirth' => !empty($_POST['date_of_birth']) ? $_POST['date_of_birth'] : null,
+            'maritalStatus' => $_POST['marital_status'] ?: null,
+            'culturalBackground' => $_POST['cultural_background'] ?: null,
+            'language' => $_POST['language'] ?: null,
+            'traits' => [
+                'communication' => $_POST['trait_communication'] ?? 'direct',
+                'detail' => $_POST['trait_detail'] ?? 'detail-oriented',
+                'energy' => $_POST['trait_energy'] ?? 'calm',
+                'humor' => $_POST['humor'] ?? 'warm',
+                'formality' => $_POST['formality'] ?? 'adaptive',
+                'empathy' => $_POST['empathy'] ?? 'moderate',
+                'patience' => $_POST['patience'] ?? 'patient',
+                'creativity' => $_POST['creativity'] ?? 'creative',
+            ],
+        ];
+        $body['persona'] = $persona;
+        $result = am_api('/api/agents', 'POST', $body);
+        if (isset($result['id'])) {
+            set_flash("Agent '{$body['name']}' created!");
+        } else {
+            set_flash($result['error'] ?? 'Failed', 'error');
+        }
+        header('Location: ?page=agents');
+        exit;
+    }
 
-if ($action === 'archive_agent' && $token) {
-    $id = $_GET['id'] ?? '';
-    $result = am_api("/api/agents/$id/archive", 'POST');
-    $success = ($result['ok'] ?? false) ? 'Agent archived' : ($result['error'] ?? 'Failed');
-}
+    if ($action === 'agent_deploy') {
+        $id = $_POST['id'] ?? '';
+        $result = am_api("/engine/agents/$id/deploy", 'POST');
+        if ($result['ok'] ?? false) {
+            set_flash('Agent deployed');
+        } else {
+            set_flash($result['error'] ?? 'Failed', 'error');
+        }
+        header("Location: ?page=agent-detail&id=$id");
+        exit;
+    }
 
-if ($action === 'create_user' && $token) {
-    $result = am_api('/api/users', 'POST', [
-        'name' => $_POST['name'] ?? '',
-        'email' => $_POST['email'] ?? '',
-        'role' => $_POST['role'] ?? 'member',
-        'password' => $_POST['password'] ?? '',
-    ]);
-    $success = isset($result['id']) ? "User created!" : ($result['error'] ?? 'Failed');
-}
+    if ($action === 'agent_stop') {
+        $id = $_POST['id'] ?? '';
+        $result = am_api("/engine/agents/$id/stop", 'POST');
+        if ($result['ok'] ?? false) {
+            set_flash('Agent stopped');
+        } else {
+            set_flash($result['error'] ?? 'Failed', 'error');
+        }
+        header("Location: ?page=agent-detail&id=$id");
+        exit;
+    }
 
-if ($action === 'create_key' && $token) {
-    $result = am_api('/api/api-keys', 'POST', ['name' => $_POST['name'] ?? '']);
-    if (isset($result['plaintext'])) {
-        $success = "Key created: " . $result['plaintext'] . " (SAVE THIS NOW)";
-    } else {
-        $error = $result['error'] ?? 'Failed';
+    if ($action === 'agent_restart') {
+        $id = $_POST['id'] ?? '';
+        $result = am_api("/engine/agents/$id/restart", 'POST');
+        if ($result['ok'] ?? false) {
+            set_flash('Agent restarted');
+        } else {
+            set_flash($result['error'] ?? 'Failed', 'error');
+        }
+        header("Location: ?page=agent-detail&id=$id");
+        exit;
     }
-}
 
-if ($action === 'revoke_key' && $token) {
-    $id = $_GET['id'] ?? '';
-    am_api("/api/api-keys/$id", 'DELETE');
-    $success = 'Key revoked';
-}
+    if ($action === 'archive_agent') {
+        $id = $_GET['id'] ?? '';
+        $result = am_api("/api/agents/$id/archive", 'POST');
+        if ($result['ok'] ?? false) {
+            set_flash('Agent archived');
+        } else {
+            set_flash($result['error'] ?? 'Failed', 'error');
+        }
+        header('Location: ?page=agents');
+        exit;
+    }
+
+    if ($action === 'create_user') {
+        $result = am_api('/api/users', 'POST', [
+            'name' => $_POST['name'] ?? '',
+            'email' => $_POST['email'] ?? '',
+            'role' => $_POST['role'] ?? 'member',
+            'password' => $_POST['password'] ?? '',
+        ]);
+        if (isset($result['id'])) {
+            set_flash('User created!');
+        } else {
+            set_flash($result['error'] ?? 'Failed', 'error');
+        }
+        header('Location: ?page=users');
+        exit;
+    }
+
+    if ($action === 'create_key') {
+        $result = am_api('/api/api-keys', 'POST', ['name' => $_POST['name'] ?? '']);
+        if (isset($result['plaintext'])) {
+            set_flash("Key created: " . $result['plaintext'] . " (SAVE THIS NOW)");
+        } else {
+            set_flash($result['error'] ?? 'Failed', 'error');
+        }
+        header('Location: ?page=api-keys');
+        exit;
+    }
+
+    if ($action === 'revoke_key') {
+        $id = $_GET['id'] ?? '';
+        am_api("/api/api-keys/$id", 'DELETE');
+        set_flash('Key revoked');
+        header('Location: ?page=api-keys');
+        exit;
+    }
+
+    if ($action === 'save_settings') {
+        $result = am_api('/api/settings', 'PATCH', [
+            'name' => $_POST['name'] ?? '',
+            'domain' => $_POST['domain'] ?? '',
+            'primaryColor' => $_POST['primaryColor'] ?? '#e84393',
+        ]);
+        if (isset($result['error'])) {
+            set_flash($result['error'], 'error');
+        } else {
+            set_flash('Settings saved!');
+        }
+        header('Location: ?page=settings');
+        exit;
+    }
+
+    if ($action === 'save_tool_security') {
+        // Parse comma-separated fields into arrays
+        $parseList = function(string $field): array {
+            $val = trim($_POST[$field] ?? '');
+            if ($val === '') return [];
+            return array_values(array_filter(array_map('trim', explode(',', $val))));
+        };
+        $body = [
+            'security' => [
+                'pathSandbox' => [
+                    'enabled' => isset($_POST['ps_enabled']),
+                    'allowedDirs' => $parseList('ps_allowedDirs'),
+                    'blockedPatterns' => $parseList('ps_blockedPatterns'),
+                ],
+                'ssrf' => [
+                    'enabled' => isset($_POST['ssrf_enabled']),
+                    'allowedHosts' => $parseList('ssrf_allowedHosts'),
+                    'blockedCidrs' => $parseList('ssrf_blockedCidrs'),
+                ],
+                'commandSanitizer' => [
+                    'enabled' => isset($_POST['cs_enabled']),
+                    'mode' => $_POST['cs_mode'] ?? 'blocklist',
+                    'allowedCommands' => $parseList('cs_allowedCommands'),
+                    'blockedPatterns' => $parseList('cs_blockedPatterns'),
+                ],
+            ],
+            'middleware' => [
+                'audit' => [
+                    'enabled' => isset($_POST['audit_enabled']),
+                    'redactKeys' => $parseList('audit_redactKeys'),
+                ],
+                'rateLimit' => [
+                    'enabled' => isset($_POST['rl_enabled']),
+                    'overrides' => (object)[],
+                ],
+                'circuitBreaker' => [
+                    'enabled' => isset($_POST['cb_enabled']),
+                ],
+                'telemetry' => [
+                    'enabled' => isset($_POST['tel_enabled']),
+                ],
+            ],
+        ];
+        $result = am_api('/api/settings/tool-security', 'PUT', $body);
+        if (isset($result['error'])) {
+            set_flash($result['error'], 'error');
+        } else {
+            set_flash('Tool security settings saved!');
+        }
+        header('Location: ?page=settings&tab=security');
+        exit;
+    }
+
+    if ($action === 'save_firewall') {
+        $parseList = function(string $field): array {
+            $val = trim($_POST[$field] ?? '');
+            if ($val === '') return [];
+            return array_values(array_filter(array_map('trim', explode(',', $val))));
+        };
+        $parseIntList = function(string $field) use ($parseList): array {
+            return array_map('intval', $parseList($field));
+        };
+        $body = [
+            'ipAccess' => [
+                'enabled' => isset($_POST['fw_ip_enabled']),
+                'mode' => $_POST['fw_ip_mode'] ?? 'allowlist',
+                'allowlist' => $parseList('fw_ip_allowlist'),
+                'blocklist' => $parseList('fw_ip_blocklist'),
+                'bypassPaths' => $parseList('fw_ip_bypass_paths'),
+            ],
+            'egress' => [
+                'enabled' => isset($_POST['fw_egress_enabled']),
+                'mode' => $_POST['fw_egress_mode'] ?? 'blocklist',
+                'allowedHosts' => $parseList('fw_egress_allowed_hosts'),
+                'blockedHosts' => $parseList('fw_egress_blocked_hosts'),
+                'allowedPorts' => $parseIntList('fw_egress_allowed_ports'),
+                'blockedPorts' => $parseIntList('fw_egress_blocked_ports'),
+            ],
+            'proxy' => [
+                'httpProxy' => $_POST['fw_proxy_http'] ?? '',
+                'httpsProxy' => $_POST['fw_proxy_https'] ?? '',
+                'noProxy' => $parseList('fw_proxy_no_proxy'),
+            ],
+            'trustedProxies' => [
+                'enabled' => isset($_POST['fw_tp_enabled']),
+                'ips' => $parseList('fw_tp_ips'),
+            ],
+            'network' => [
+                'corsOrigins' => $parseList('fw_cors_origins'),
+                'rateLimit' => [
+                    'enabled' => isset($_POST['fw_rl_enabled']),
+                    'requestsPerMinute' => (int)($_POST['fw_rl_rpm'] ?? 120),
+                    'skipPaths' => $parseList('fw_rl_skip_paths'),
+                ],
+                'httpsEnforcement' => [
+                    'enabled' => isset($_POST['fw_https_enabled']),
+                    'excludePaths' => $parseList('fw_https_exclude_paths'),
+                ],
+                'securityHeaders' => [
+                    'hsts' => isset($_POST['fw_hsts_enabled']),
+                    'hstsMaxAge' => (int)($_POST['fw_hsts_max_age'] ?? 31536000),
+                    'xFrameOptions' => $_POST['fw_x_frame_options'] ?? 'DENY',
+                    'xContentTypeOptions' => isset($_POST['fw_xcto_enabled']),
+                    'referrerPolicy' => $_POST['fw_referrer_policy'] ?? 'strict-origin-when-cross-origin',
+                    'permissionsPolicy' => $_POST['fw_permissions_policy'] ?? 'camera=(), microphone=(), geolocation=()',
+                ],
+            ],
+        ];
+        $result = am_api('/api/settings/firewall', 'PUT', $body);
+        if (isset($result['error'])) {
+            set_flash($result['error'], 'error');
+        } else {
+            set_flash('Network & firewall settings saved!');
+        }
+        header('Location: ?page=settings&tab=firewall');
+        exit;
+    }
+
+    if ($action === 'save_model_pricing') {
+        // Load current pricing, append new model, save back
+        $currentRes = am_api('/api/settings/model-pricing');
+        $currentConfig = $currentRes['modelPricingConfig'] ?? [];
+        $currentModels = $currentConfig['models'] ?? [];
+        $currency = $currentConfig['currency'] ?? 'USD';
+
+        $newModel = [
+            'provider' => $_POST['mp_provider'] ?? '',
+            'modelId' => $_POST['mp_model_id'] ?? '',
+            'displayName' => $_POST['mp_display_name'] ?? '',
+            'inputCostPerMillion' => (float)($_POST['mp_input_cost'] ?? 0),
+            'outputCostPerMillion' => (float)($_POST['mp_output_cost'] ?? 0),
+            'contextWindow' => (int)($_POST['mp_context_window'] ?? 0),
+        ];
+
+        $currentModels[] = $newModel;
+        $body = ['models' => $currentModels, 'currency' => $currency];
+        $result = am_api('/api/settings/model-pricing', 'PUT', $body);
+        if (isset($result['error'])) {
+            set_flash($result['error'], 'error');
+        } else {
+            set_flash('Model pricing added!');
+        }
+        header('Location: ?page=settings&tab=pricing');
+        exit;
+    }
+
+    if ($action === 'delete_model_pricing') {
+        // Load current pricing, remove matching model, save back
+        $currentRes = am_api('/api/settings/model-pricing');
+        $currentConfig = $currentRes['modelPricingConfig'] ?? [];
+        $currentModels = $currentConfig['models'] ?? [];
+        $currency = $currentConfig['currency'] ?? 'USD';
+
+        $delProvider = $_POST['mp_delete_provider'] ?? '';
+        $delModelId = $_POST['mp_delete_model_id'] ?? '';
+
+        $filtered = array_values(array_filter($currentModels, function($m) use ($delProvider, $delModelId) {
+            return !(($m['provider'] ?? '') === $delProvider && ($m['modelId'] ?? '') === $delModelId);
+        }));
+
+        $body = ['models' => $filtered, 'currency' => $currency];
+        $result = am_api('/api/settings/model-pricing', 'PUT', $body);
+        if (isset($result['error'])) {
+            set_flash($result['error'], 'error');
+        } else {
+            set_flash('Model removed from pricing.');
+        }
+        header('Location: ?page=settings&tab=pricing');
+        exit;
+    }
+
+    if ($action === 'save_agent_tool_security') {
+        $id = $_POST['agent_id'] ?? '';
+        $parseList = function(string $field): array {
+            $val = trim($_POST[$field] ?? '');
+            if ($val === '') return [];
+            return array_values(array_filter(array_map('trim', explode(',', $val))));
+        };
+        $body = [
+            'toolSecurity' => [
+                'security' => [
+                    'pathSandbox' => [
+                        'enabled' => isset($_POST['ps_enabled']),
+                        'allowedDirs' => $parseList('ps_allowedDirs'),
+                        'blockedPatterns' => $parseList('ps_blockedPatterns'),
+                    ],
+                    'ssrf' => [
+                        'enabled' => isset($_POST['ssrf_enabled']),
+                        'allowedHosts' => $parseList('ssrf_allowedHosts'),
+                        'blockedCidrs' => $parseList('ssrf_blockedCidrs'),
+                    ],
+                    'commandSanitizer' => [
+                        'enabled' => isset($_POST['cs_enabled']),
+                        'mode' => $_POST['cs_mode'] ?? 'blocklist',
+                        'allowedCommands' => $parseList('cs_allowedCommands'),
+                        'blockedPatterns' => $parseList('cs_blockedPatterns'),
+                    ],
+                ],
+                'middleware' => [
+                    'audit' => [
+                        'enabled' => isset($_POST['audit_enabled']),
+                        'redactKeys' => $parseList('audit_redactKeys'),
+                    ],
+                    'rateLimit' => [
+                        'enabled' => isset($_POST['rl_enabled']),
+                    ],
+                    'circuitBreaker' => [
+                        'enabled' => isset($_POST['cb_enabled']),
+                    ],
+                    'telemetry' => [
+                        'enabled' => isset($_POST['tel_enabled']),
+                    ],
+                ],
+            ],
+            'updatedBy' => 'dashboard',
+        ];
+        $result = am_api("/engine/agents/$id/tool-security", 'PATCH', $body);
+        if (isset($result['error'])) {
+            set_flash($result['error'], 'error');
+        } else {
+            set_flash('Agent tool security saved!');
+        }
+        header("Location: ?page=agent-detail&id=$id");
+        exit;
+    }
+
+    if ($action === 'reset_agent_tool_security') {
+        $id = $_POST['agent_id'] ?? '';
+        $result = am_api("/engine/agents/$id/tool-security", 'PATCH', [
+            'toolSecurity' => (object)[],
+            'updatedBy' => 'dashboard',
+        ]);
+        if (isset($result['error'])) {
+            set_flash($result['error'], 'error');
+        } else {
+            set_flash('Agent tool security reset to org defaults!');
+        }
+        header("Location: ?page=agent-detail&id=$id");
+        exit;
+    }
+
+    if ($action === 'create_dlp_rule') {
+        $result = am_api('/engine/dlp/rules', 'POST', [
+            'name' => $_POST['name'] ?? '',
+            'pattern' => $_POST['pattern'] ?? '',
+            'action' => $_POST['action_type'] ?? 'block',
+            'severity' => $_POST['severity'] ?? 'medium',
+            'orgId' => 'default',
+        ]);
+        if (isset($result['id'])) {
+            set_flash('DLP rule created!');
+        } else {
+            set_flash($result['error'] ?? 'Failed', 'error');
+        }
+        header('Location: ?page=dlp');
+        exit;
+    }
+
+    if ($action === 'delete_dlp_rule') {
+        $id = $_GET['id'] ?? '';
+        am_api("/engine/dlp/rules/$id", 'DELETE');
+        set_flash('DLP rule deleted');
+        header('Location: ?page=dlp');
+        exit;
+    }
+
+    if ($action === 'dlp_scan') {
+        $result = am_api('/engine/dlp/scan', 'POST', [
+            'content' => $_POST['content'] ?? '',
+            'orgId' => 'default',
+        ]);
+        if (isset($result['violations']) && count($result['violations']) > 0) {
+            set_flash('Scan found ' . count($result['violations']) . ' violation(s)');
+        } elseif (isset($result['error'])) {
+            set_flash($result['error'], 'error');
+        } else {
+            set_flash('Scan clean — no violations found');
+        }
+        header('Location: ?page=dlp');
+        exit;
+    }
+
+    if ($action === 'guardrail_pause') {
+        $id = $_POST['id'] ?? '';
+        $result = am_api("/engine/guardrails/pause/$id", 'POST');
+        if ($result['ok'] ?? false) {
+            set_flash('Agent paused');
+        } else {
+            set_flash($result['error'] ?? 'Failed', 'error');
+        }
+        header('Location: ?page=guardrails');
+        exit;
+    }
+
+    if ($action === 'guardrail_resume') {
+        $id = $_POST['id'] ?? '';
+        $result = am_api("/engine/guardrails/resume/$id", 'POST');
+        if ($result['ok'] ?? false) {
+            set_flash('Agent resumed');
+        } else {
+            set_flash($result['error'] ?? 'Failed', 'error');
+        }
+        header('Location: ?page=guardrails');
+        exit;
+    }
+
+    if ($action === 'guardrail_kill') {
+        $id = $_POST['id'] ?? '';
+        $result = am_api("/engine/guardrails/kill/$id", 'POST');
+        if ($result['ok'] ?? false) {
+            set_flash('Agent killed');
+        } else {
+            set_flash($result['error'] ?? 'Failed', 'error');
+        }
+        header('Location: ?page=guardrails');
+        exit;
+    }
+
+    if ($action === 'create_anomaly_rule') {
+        $result = am_api('/engine/anomaly-rules', 'POST', [
+            'name' => $_POST['name'] ?? '',
+            'metric' => $_POST['metric'] ?? '',
+            'threshold' => (int)($_POST['threshold'] ?? 0),
+            'action' => $_POST['action_type'] ?? 'alert',
+            'orgId' => 'default',
+        ]);
+        if (isset($result['id'])) {
+            set_flash('Anomaly rule created!');
+        } else {
+            set_flash($result['error'] ?? 'Failed', 'error');
+        }
+        header('Location: ?page=guardrails');
+        exit;
+    }
+
+    if ($action === 'journal_rollback') {
+        $id = $_GET['id'] ?? '';
+        $result = am_api("/engine/journal/$id/rollback", 'POST');
+        if ($result['ok'] ?? false) {
+            set_flash('Entry rolled back');
+        } else {
+            set_flash($result['error'] ?? 'Failed', 'error');
+        }
+        header('Location: ?page=journal');
+        exit;
+    }
+
+    if ($action === 'send_message') {
+        $result = am_api('/engine/messages', 'POST', [
+            'from' => $_POST['from'] ?? '',
+            'to' => $_POST['to'] ?? '',
+            'subject' => $_POST['subject'] ?? '',
+            'body' => $_POST['body'] ?? '',
+            'orgId' => 'default',
+        ]);
+        if (isset($result['id'])) {
+            set_flash('Message sent!');
+        } else {
+            set_flash($result['error'] ?? 'Failed', 'error');
+        }
+        header('Location: ?page=messages');
+        exit;
+    }
+
+    if ($action === 'generate_report') {
+        $type = $_POST['report_type'] ?? 'soc2';
+        $result = am_api("/engine/compliance/reports/$type", 'POST', [
+            'periodStart' => $_POST['period_start'] ?? '',
+            'periodEnd' => $_POST['period_end'] ?? '',
+            'orgId' => 'default',
+        ]);
+        if (isset($result['id'])) {
+            set_flash("$type report generated!");
+        } else {
+            set_flash($result['error'] ?? 'Failed', 'error');
+        }
+        header('Location: ?page=compliance');
+        exit;
+    }
+
+    if ($action === 'download_report') {
+        $id = $_GET['id'] ?? '';
+        $result = am_api("/engine/compliance/reports/$id/download");
+        if (isset($result['url'])) {
+            header('Location: ' . $result['url']);
+            exit;
+        }
+        set_flash($result['error'] ?? 'Download not available', 'error');
+        header('Location: ?page=compliance');
+        exit;
+    }
+
+    // ── Vault Actions ───────────────────────────────────────
+    if ($action === 'create_secret') {
+        $result = am_api('/engine/vault/secrets', 'POST', [
+            'orgId' => 'default',
+            'name' => $_POST['name'] ?? '',
+            'value' => $_POST['value'] ?? '',
+            'category' => $_POST['category'] ?? 'custom',
+        ]);
+        if (isset($result['id'])) {
+            set_flash('Secret stored securely!');
+        } else {
+            set_flash($result['error'] ?? 'Failed to store secret', 'error');
+        }
+        header('Location: ?page=vault');
+        exit;
+    }
+
+    if ($action === 'delete_secret') {
+        $id = $_GET['id'] ?? '';
+        $result = am_api("/engine/vault/secrets/$id", 'DELETE');
+        if ($result['ok'] ?? false) {
+            set_flash('Secret deleted');
+        } else {
+            set_flash($result['error'] ?? 'Failed to delete secret', 'error');
+        }
+        header('Location: ?page=vault');
+        exit;
+    }
+
+    if ($action === 'rotate_secret') {
+        $id = $_GET['id'] ?? '';
+        $result = am_api("/engine/vault/secrets/$id/rotate", 'POST');
+        if ($result['ok'] ?? false) {
+            set_flash('Secret rotated');
+        } else {
+            set_flash($result['error'] ?? 'Failed to rotate secret', 'error');
+        }
+        header('Location: ?page=vault');
+        exit;
+    }
+
+    if ($action === 'rotate_all_secrets') {
+        $result = am_api('/engine/vault/rotate-all', 'POST', ['orgId' => 'default']);
+        $count = $result['rotated'] ?? 0;
+        if (isset($result['error'])) {
+            set_flash($result['error'], 'error');
+        } else {
+            set_flash("Rotated $count secrets");
+        }
+        header('Location: ?page=vault');
+        exit;
+    }
+
+    // ── Skills Actions ──────────────────────────────────────
+    if ($action === 'enable_skill') {
+        $skillId = $_POST['skill_id'] ?? '';
+        $result = am_api("/engine/community/skills/$skillId/enable", 'PUT', ['orgId' => 'default']);
+        if (isset($result['error'])) {
+            set_flash($result['error'], 'error');
+        } else {
+            set_flash('Skill enabled');
+        }
+        header('Location: ?page=skills');
+        exit;
+    }
+
+    if ($action === 'disable_skill') {
+        $skillId = $_POST['skill_id'] ?? '';
+        $result = am_api("/engine/community/skills/$skillId/disable", 'PUT', ['orgId' => 'default']);
+        if (isset($result['error'])) {
+            set_flash($result['error'], 'error');
+        } else {
+            set_flash('Skill disabled');
+        }
+        header('Location: ?page=skills');
+        exit;
+    }
 
-if ($action === 'save_settings' && $token) {
-    $result = am_api('/api/settings', 'PATCH', [
-        'name' => $_POST['name'] ?? '',
-        'domain' => $_POST['domain'] ?? '',
-        'primaryColor' => $_POST['primaryColor'] ?? '#e84393',
-    ]);
-    $success = isset($result['error']) ? $result['error'] : 'Settings saved!';
+    if ($action === 'uninstall_skill') {
+        $skillId = $_POST['skill_id'] ?? '';
+        $result = am_api("/engine/community/skills/$skillId/uninstall", 'DELETE', ['orgId' => 'default']);
+        if (isset($result['error'])) {
+            set_flash($result['error'], 'error');
+        } else {
+            set_flash('Skill uninstalled');
+        }
+        header('Location: ?page=skills');
+        exit;
+    }
 }
 
-// ─── Load Data ──────────────────────────────────────────
+// ─── Routing ────────────────────────────────────────────
 $page = $_GET['page'] ?? 'dashboard';
-$stats = $agents = $users = $keys = $audit = $settings = $retention = null;
-
-if ($token) {
-    if ($page === 'dashboard') {
-        $stats = am_api('/api/stats');
-        $audit = am_api('/api/audit?limit=8');
-    } elseif ($page === 'agents') {
-        $agents = am_api('/api/agents');
-    } elseif ($page === 'users') {
-        $users = am_api('/api/users');
-    } elseif ($page === 'api-keys') {
-        $keys = am_api('/api/api-keys');
-    } elseif ($page === 'audit') {
-        $p = max(0, (int)($_GET['p'] ?? 0));
-        $audit = am_api("/api/audit?limit=25&offset=" . ($p * 25));
-    } elseif ($page === 'settings') {
-        $settings = am_api('/api/settings');
-        $retention = am_api('/api/retention');
-    }
+
+// If not logged in, show the login page
+if (!is_logged_in()) {
+    require __DIR__ . '/pages/login.php';
+    exit;
 }
 
-function e(string $s): string { return htmlspecialchars($s, ENT_QUOTES, 'UTF-8'); }
-function badge(string $status): string {
-    $colors = ['active'=>'#22c55e','archived'=>'#888','suspended'=>'#ef4444','owner'=>'#f59e0b','admin'=>'#e84393','member'=>'#888','viewer'=>'#555'];
-    $c = $colors[$status] ?? '#888';
-    return "<span style='display:inline-block;padding:2px 10px;border-radius:999px;font-size:11px;font-weight:600;background:{$c}20;color:$c'>$status</span>";
+// Authenticated pages
+$validPages = ['dashboard', 'agents', 'agent-detail', 'users', 'api-keys', 'vault', 'skills', 'audit', 'settings', 'dlp', 'guardrails', 'journal', 'messages', 'compliance'];
+if (!in_array($page, $validPages)) {
+    $page = 'dashboard';
 }
-?>
-<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="UTF-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>🎀 AgenticMail Enterprise — PHP Dashboard</title>
-  <style>
-    *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
-    :root,[data-theme="light"] { --bg:#f8f9fa; --surface:#fff; --border:#dee2e6; --text:#212529; --dim:#495057; --muted:#868e96; --primary:#e84393; --success:#2b8a3e; --danger:#c92a2a; --warning:#e67700; --r:6px; color-scheme:light dark; } [data-theme="dark"] { --bg:#0f1114; --surface:#16181d; --border:#2c3038; --text:#e1e4e8; --dim:#b0b8c4; --muted:#6b7280; --primary:#f06595; --success:#37b24d; --danger:#f03e3e; --warning:#f08c00; } @media(prefers-color-scheme:dark){ :root:not([data-theme="light"]){ --bg:#0f1114; --surface:#16181d; --border:#2c3038; --text:#e1e4e8; --dim:#b0b8c4; --muted:#6b7280; --primary:#f06595; --success:#37b24d; --danger:#f03e3e; --warning:#f08c00; }}
-    body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; background: var(--bg); color: var(--text); line-height: 1.6; }
-    .layout { display: flex; min-height: 100vh; }
-    .sidebar { width: 240px; background: var(--surface); border-right: 1px solid var(--border); position: fixed; top: 0; left: 0; bottom: 0; display: flex; flex-direction: column; }
-    .sidebar-header { padding: 20px; border-bottom: 1px solid var(--border); }
-    .sidebar-header h2 { font-size: 16px; } .sidebar-header h2 em { font-style:normal; color: var(--primary); }
-    .sidebar-header small { font-size: 11px; color: var(--muted); display: block; margin-top: 2px; }
-    .nav { flex: 1; padding: 8px 0; }
-    .nav-sec { font-size:10px; text-transform:uppercase; letter-spacing:0.08em; color:var(--muted); padding:12px 20px 4px; }
-    .nav a { display:flex; align-items:center; gap:10px; padding:10px 20px; color:var(--dim); text-decoration:none; font-size:13px; }
-    .nav a:hover { color:var(--text); background:rgba(255,255,255,0.03); }
-    .nav a.active { color:var(--primary); background:rgba(232,67,147,0.12); border-right:2px solid var(--primary); }
-    .sidebar-footer { padding:16px 20px; border-top:1px solid var(--border); font-size:12px; }
-    .content { flex:1; margin-left:240px; padding:32px; max-width:1100px; }
-    h2.title { font-size:22px; font-weight:700; margin-bottom:4px; }
-    .desc { font-size:13px; color:var(--dim); margin-bottom:24px; }
-    .stats { display:grid; grid-template-columns:repeat(auto-fit,minmax(180px,1fr)); gap:16px; margin-bottom:24px; }
-    .stat { background:var(--surface); border:1px solid var(--border); border-radius:12px; padding:20px; }
-    .stat .l { font-size:11px; color:var(--muted); text-transform:uppercase; letter-spacing:0.06em; }
-    .stat .v { font-size:30px; font-weight:700; margin-top:4px; }
-    .card { background:var(--surface); border:1px solid var(--border); border-radius:12px; padding:20px; margin-bottom:16px; }
-    .card-t { font-size:13px; color:var(--dim); text-transform:uppercase; letter-spacing:0.05em; font-weight:600; margin-bottom:12px; }
-    table { width:100%; border-collapse:collapse; font-size:13px; }
-    th { text-align:left; padding:10px 12px; color:var(--muted); font-size:11px; text-transform:uppercase; letter-spacing:0.05em; border-bottom:1px solid var(--border); font-weight:600; }
-    td { padding:12px; border-bottom:1px solid var(--border); }
-    tr:hover td { background:rgba(255,255,255,0.015); }
-    .btn { display:inline-flex; align-items:center; padding:8px 16px; border-radius:var(--r); font-size:13px; font-weight:600; cursor:pointer; border:1px solid var(--border); background:var(--surface); color:var(--text); text-decoration:none; }
-    .btn:hover { background:rgba(255,255,255,0.05); }
-    .btn-p { background:var(--primary); border-color:var(--primary); color:#fff; }
-    .btn-p:hover { background:#f06595; }
-    .btn-d { color:var(--danger); border-color:var(--danger); }
-    .btn-sm { padding:4px 10px; font-size:12px; }
-    .input { width:100%; padding:10px 14px; background:var(--bg); border:1px solid var(--border); border-radius:var(--r); color:var(--text); font-size:14px; }
-    .input:focus { outline:none; border-color:var(--primary); }
-    .fg { margin-bottom:14px; }
-    .fl { display:block; font-size:12px; color:var(--dim); margin-bottom:4px; font-weight:500; }
-    .alert { padding:12px 16px; border-radius:var(--r); margin-bottom:16px; font-size:13px; }
-    .alert-e { background:rgba(239,68,68,0.1); border:1px solid var(--danger); color:var(--danger); }
-    .alert-s { background:rgba(34,197,94,0.1); border:1px solid var(--success); color:var(--success); }
-    .empty { text-align:center; padding:48px 20px; color:var(--muted); }
-    .empty-i { font-size:36px; margin-bottom:10px; }
-    .login-wrap { display:flex; align-items:center; justify-content:center; min-height:100vh; }
-    .login-box { width:380px; max-width:90vw; }
-    .login-box h1 { text-align:center; font-size:22px; margin-bottom:4px; }
-    .login-box h1 em { font-style:normal; color:var(--primary); }
-    .login-box .sub { text-align:center; color:var(--dim); font-size:13px; margin-bottom:32px; }
-    select.input { appearance:auto; }
-    @media(max-width:768px) { .sidebar{width:56px;} .sidebar-header h2,.sidebar-header small,.nav a span,.nav-sec,.sidebar-footer{display:none;} .nav a{justify-content:center;padding:14px 0;font-size:18px;} .content{margin-left:56px;padding:16px;} }
-  </style>
-</head>
-<body>
-
-<?php if (!$token): ?>
-<!-- ═══ Login ═══ -->
-<div class="login-wrap">
-  <div class="login-box">
-    <h1>🏢 <em>AgenticMail</em> Enterprise</h1>
-    <p class="sub">Sign in to your dashboard</p>
-    <?php if ($error): ?><div class="alert alert-e"><?= e($error) ?></div><?php endif; ?>
-    <form method="POST">
-      <input type="hidden" name="action" value="login">
-      <div class="fg"><label class="fl">Email</label><input class="input" type="email" name="email" required autofocus></div>
-      <div class="fg"><label class="fl">Password</label><input class="input" type="password" name="password" required></div>
-      <button class="btn btn-p" style="width:100%;justify-content:center" type="submit">Sign In</button>
-    </form>
-    <p style="text-align:center;margin-top:16px;font-size:11px;color:var(--muted)">Connected to: <?= e($API_URL) ?></p>
-  </div>
-</div>
-
-<?php else: ?>
-<!-- ═══ App ═══ -->
-<div class="layout">
-  <div class="sidebar">
-    <div class="sidebar-header">
-      <h2>🏢 <em>Agentic</em>Mail</h2>
-      <small>Enterprise · PHP</small>
-    </div>
-    <div class="nav">
-      <div class="nav-sec">Overview</div>
-      <a href="?page=dashboard" class="<?= $page === 'dashboard' ? 'active' : '' ?>">📊 <span>Dashboard</span></a>
-      <div class="nav-sec">Manage</div>
-      <a href="?page=agents" class="<?= $page === 'agents' ? 'active' : '' ?>">🤖 <span>Agents</span></a>
-      <a href="?page=users" class="<?= $page === 'users' ? 'active' : '' ?>">👥 <span>Users</span></a>
-      <a href="?page=api-keys" class="<?= $page === 'api-keys' ? 'active' : '' ?>">🔑 <span>API Keys</span></a>
-      <div class="nav-sec">System</div>
-      <a href="?page=audit" class="<?= $page === 'audit' ? 'active' : '' ?>">📋 <span>Audit Log</span></a>
-      <a href="?page=settings" class="<?= $page === 'settings' ? 'active' : '' ?>">⚙️ <span>Settings</span></a>
-    </div>
-    <div class="sidebar-footer">
-      <div style="color:var(--dim)"><?= e($user['name'] ?? '') ?></div>
-      <div style="color:var(--muted);font-size:11px"><?= e($user['email'] ?? '') ?></div>
-      <a href="?action=logout" style="color:var(--muted);font-size:11px;margin-top:6px;display:inline-block">Sign out</a>
-    </div>
-  </div>
-
-  <div class="content">
-    <?php if ($error): ?><div class="alert alert-e"><?= e($error) ?></div><?php endif; ?>
-    <?php if ($success): ?><div class="alert alert-s"><?= e($success) ?></div><?php endif; ?>
-
-    <?php if ($page === 'dashboard' && $stats): ?>
-      <h2 class="title">Dashboard</h2>
-      <p class="desc">Overview of your AgenticMail instance</p>
-      <div class="stats">
-        <div class="stat"><div class="l">Total Agents</div><div class="v" style="color:var(--primary)"><?= (int)($stats['totalAgents'] ?? 0) ?></div></div>
-        <div class="stat"><div class="l">Active Agents</div><div class="v" style="color:var(--success)"><?= (int)($stats['activeAgents'] ?? 0) ?></div></div>
-        <div class="stat"><div class="l">Users</div><div class="v"><?= (int)($stats['totalUsers'] ?? 0) ?></div></div>
-        <div class="stat"><div class="l">Audit Events</div><div class="v"><?= (int)($stats['totalAuditEvents'] ?? 0) ?></div></div>
-      </div>
-      <div class="card">
-        <div class="card-t">Recent Activity</div>
-        <?php $events = $audit['events'] ?? []; if (empty($events)): ?>
-          <div class="empty"><div class="empty-i">📋</div>No activity yet</div>
-        <?php else: foreach ($events as $ev): ?>
-          <div style="padding:10px 0;border-bottom:1px solid var(--border);font-size:13px">
-            <span style="color:var(--primary);font-weight:500"><?= e($ev['action']) ?></span> on <?= e($ev['resource']) ?>
-            <div style="font-size:11px;color:var(--muted)"><?= date('M j, Y g:i A', strtotime($ev['timestamp'])) ?><?= $ev['ip'] ? " · {$ev['ip']}" : '' ?></div>
-          </div>
-        <?php endforeach; endif; ?>
-      </div>
-
-    <?php elseif ($page === 'agents'): ?>
-      <div style="display:flex;justify-content:space-between;align-items:center;margin-bottom:24px">
-        <div><h2 class="title">Agents</h2><p class="desc" style="margin:0">Manage AI agent identities</p></div>
-        <button class="btn btn-p" onclick="document.getElementById('modal-agent').style.display='flex'">+ New Agent</button>
-      </div>
-      <div class="card">
-        <?php $list = $agents['agents'] ?? []; if (empty($list)): ?>
-          <div class="empty"><div class="empty-i">🤖</div>No agents yet</div>
-        <?php else: ?>
-          <table><thead><tr><th>Name</th><th>Email</th><th>Role</th><th>Status</th><th>Created</th><th></th></tr></thead><tbody>
-          <?php foreach ($list as $a): ?>
-            <tr><td style="font-weight:600"><?= e($a['name']) ?></td><td style="color:var(--dim)"><?= e($a['email']) ?></td><td><?= e($a['role']) ?></td><td><?= badge($a['status']) ?></td><td style="color:var(--muted);font-size:12px"><?= date('M j, Y', strtotime($a['createdAt'])) ?></td><td><?php if ($a['status'] === 'active'): ?><a class="btn btn-sm btn-d" href="?page=agents&action=archive_agent&id=<?= e($a['id']) ?>">Archive</a><?php endif; ?></td></tr>
-          <?php endforeach; ?>
-          </tbody></table>
-        <?php endif; ?>
-      </div>
-      <!-- Modal -->
-      <div id="modal-agent" style="display:none;position:fixed;inset:0;background:rgba(0,0,0,0.6);align-items:center;justify-content:center;z-index:100">
-        <div class="card" style="width:440px;max-width:90vw">
-          <h3 style="margin-bottom:16px">Create Agent</h3>
-          <form method="POST"><input type="hidden" name="action" value="create_agent">
-            <div class="fg"><label class="fl">Name</label><input class="input" name="name" required placeholder="e.g. researcher"></div>
-            <div class="fg"><label class="fl">Email (optional)</label><input class="input" name="email" placeholder="auto-generated"></div>
-            <div class="fg"><label class="fl">Role</label><select class="input" name="role"><option>assistant</option><option>secretary</option><option>researcher</option><option>writer</option><option>custom</option></select></div>
-            <div style="display:flex;gap:8px;justify-content:flex-end"><button class="btn" type="button" onclick="this.closest('[id]').style.display='none'">Cancel</button><button class="btn btn-p" type="submit">Create</button></div>
-          </form>
-        </div>
-      </div>
-
-    <?php elseif ($page === 'users'): ?>
-      <div style="display:flex;justify-content:space-between;align-items:center;margin-bottom:24px">
-        <div><h2 class="title">Users</h2><p class="desc" style="margin:0">Manage team members</p></div>
-        <button class="btn btn-p" onclick="document.getElementById('modal-user').style.display='flex'">+ New User</button>
-      </div>
-      <div class="card">
-        <?php $list = $users['users'] ?? []; if (empty($list)): ?>
-          <div class="empty"><div class="empty-i">👥</div>No users yet</div>
-        <?php else: ?>
-          <table><thead><tr><th>Name</th><th>Email</th><th>Role</th><th>Last Login</th></tr></thead><tbody>
-          <?php foreach ($list as $u2): ?>
-            <tr><td style="font-weight:600"><?= e($u2['name']) ?></td><td style="color:var(--dim)"><?= e($u2['email']) ?></td><td><?= badge($u2['role']) ?></td><td style="color:var(--muted);font-size:12px"><?= isset($u2['lastLoginAt']) ? date('M j, Y g:i A', strtotime($u2['lastLoginAt'])) : 'Never' ?></td></tr>
-          <?php endforeach; ?>
-          </tbody></table>
-        <?php endif; ?>
-      </div>
-      <div id="modal-user" style="display:none;position:fixed;inset:0;background:rgba(0,0,0,0.6);align-items:center;justify-content:center;z-index:100">
-        <div class="card" style="width:440px;max-width:90vw">
-          <h3 style="margin-bottom:16px">Create User</h3>
-          <form method="POST"><input type="hidden" name="action" value="create_user">
-            <div class="fg"><label class="fl">Name</label><input class="input" name="name" required></div>
-            <div class="fg"><label class="fl">Email</label><input class="input" type="email" name="email" required></div>
-            <div class="fg"><label class="fl">Role</label><select class="input" name="role"><option>member</option><option>admin</option><option>owner</option><option>viewer</option></select></div>
-            <div class="fg"><label class="fl">Password</label><input class="input" type="password" name="password" required minlength="8"></div>
-            <div style="display:flex;gap:8px;justify-content:flex-end"><button class="btn" type="button" onclick="this.closest('[id]').style.display='none'">Cancel</button><button class="btn btn-p" type="submit">Create</button></div>
-          </form>
-        </div>
-      </div>
-
-    <?php elseif ($page === 'api-keys'): ?>
-      <div style="display:flex;justify-content:space-between;align-items:center;margin-bottom:24px">
-        <div><h2 class="title">API Keys</h2><p class="desc" style="margin:0">Manage programmatic access</p></div>
-        <button class="btn btn-p" onclick="document.getElementById('modal-key').style.display='flex'">+ New Key</button>
-      </div>
-      <div class="card">
-        <?php $list = $keys['keys'] ?? []; if (empty($list)): ?>
-          <div class="empty"><div class="empty-i">🔑</div>No API keys</div>
-        <?php else: ?>
-          <table><thead><tr><th>Name</th><th>Key</th><th>Last Used</th><th>Status</th><th></th></tr></thead><tbody>
-          <?php foreach ($list as $k): ?>
-            <tr><td style="font-weight:600"><?= e($k['name']) ?></td><td><code style="font-size:12px"><?= e($k['keyPrefix']) ?>...</code></td><td style="color:var(--muted);font-size:12px"><?= isset($k['lastUsedAt']) ? date('M j g:i A', strtotime($k['lastUsedAt'])) : 'Never' ?></td><td><?= badge($k['revoked'] ? 'archived' : 'active') ?></td><td><?php if (!($k['revoked'] ?? false)): ?><a class="btn btn-sm btn-d" href="?page=api-keys&action=revoke_key&id=<?= e($k['id']) ?>">Revoke</a><?php endif; ?></td></tr>
-          <?php endforeach; ?>
-          </tbody></table>
-        <?php endif; ?>
-      </div>
-      <div id="modal-key" style="display:none;position:fixed;inset:0;background:rgba(0,0,0,0.6);align-items:center;justify-content:center;z-index:100">
-        <div class="card" style="width:440px;max-width:90vw">
-          <h3 style="margin-bottom:16px">Create API Key</h3>
-          <form method="POST"><input type="hidden" name="action" value="create_key">
-            <div class="fg"><label class="fl">Key Name</label><input class="input" name="name" required placeholder="e.g. CI/CD pipeline"></div>
-            <div style="display:flex;gap:8px;justify-content:flex-end"><button class="btn" type="button" onclick="this.closest('[id]').style.display='none'">Cancel</button><button class="btn btn-p" type="submit">Create</button></div>
-          </form>
-        </div>
-      </div>
-
-    <?php elseif ($page === 'audit'): ?>
-      <?php $p = max(0, (int)($_GET['p'] ?? 0)); $total = $audit['total'] ?? 0; $pages = max(1, ceil($total / 25)); ?>
-      <h2 class="title">Audit Log</h2>
-      <p class="desc"><?= $total ?> total events</p>
-      <div class="card">
-        <?php $events = $audit['events'] ?? []; if (empty($events)): ?>
-          <div class="empty"><div class="empty-i">📋</div>No audit events yet</div>
-        <?php else: ?>
-          <table><thead><tr><th>Time</th><th>Actor</th><th>Action</th><th>Resource</th><th>IP</th></tr></thead><tbody>
-          <?php foreach ($events as $ev): ?>
-            <tr><td style="font-size:12px;color:var(--muted);white-space:nowrap"><?= date('M j g:i A', strtotime($ev['timestamp'])) ?></td><td><?= e($ev['actor']) ?></td><td style="color:var(--primary);font-weight:500"><?= e($ev['action']) ?></td><td style="font-size:12px"><?= e($ev['resource']) ?></td><td style="font-size:12px;color:var(--muted)"><?= $ev['ip'] ?: '-' ?></td></tr>
-          <?php endforeach; ?>
-          </tbody></table>
-          <div style="display:flex;gap:8px;justify-content:center;margin-top:16px">
-            <?php if ($p > 0): ?><a class="btn btn-sm" href="?page=audit&p=<?= $p - 1 ?>">← Prev</a><?php endif; ?>
-            <span style="padding:6px 12px;font-size:12px;color:var(--muted)">Page <?= $p + 1 ?> of <?= $pages ?></span>
-            <?php if (($p + 1) * 25 < $total): ?><a class="btn btn-sm" href="?page=audit&p=<?= $p + 1 ?>">Next →</a><?php endif; ?>
-          </div>
-        <?php endif; ?>
-      </div>
-
-    <?php elseif ($page === 'settings' && $settings): ?>
-      <h2 class="title">Settings</h2>
-      <p class="desc">Configure your organization</p>
-      <div class="card">
-        <div class="card-t">General</div>
-        <form method="POST" style="display:grid;grid-template-columns:1fr 1fr;gap:14px">
-          <input type="hidden" name="action" value="save_settings">
-          <div class="fg"><label class="fl">Organization Name</label><input class="input" name="name" value="<?= e($settings['name'] ?? '') ?>"></div>
-          <div class="fg"><label class="fl">Domain</label><input class="input" name="domain" value="<?= e($settings['domain'] ?? '') ?>" placeholder="agents.acme.com"></div>
-          <div class="fg"><label class="fl">Primary Color</label><input class="input" type="color" name="primaryColor" value="<?= e($settings['primaryColor'] ?? '#e84393') ?>" style="height:38px;padding:4px"></div>
-          <div></div>
-          <div><button class="btn btn-p" type="submit">Save Settings</button></div>
-        </form>
-      </div>
-      <div class="card">
-        <div class="card-t">Plan</div>
-        <?= badge(strtoupper($settings['plan'] ?? 'free')) ?>
-        <span style="font-size:13px;color:var(--dim);margin-left:12px">Subdomain: <?= e($settings['subdomain'] ?? 'not set') ?>.agenticmail.cloud</span>
-      </div>
-      <?php if ($retention): ?>
-      <div class="card">
-        <div class="card-t">Data Retention</div>
-        <div style="font-size:13px">
-          Status: <span style="color:<?= ($retention['enabled'] ?? false) ? 'var(--success)' : 'var(--muted)' ?>"><?= ($retention['enabled'] ?? false) ? 'Enabled' : 'Disabled' ?></span><br>
-          <span style="color:var(--dim)">Retain emails for <?= (int)($retention['retainDays'] ?? 365) ?> days<?= ($retention['archiveFirst'] ?? true) ? ' (archive before delete)' : '' ?></span>
-        </div>
-      </div>
-      <?php endif; ?>
-    <?php endif; ?>
-  </div>
-</div>
-<?php endif; ?>
-</body>
-</html>
+
+// Map page slug to file
+$pageFile = __DIR__ . '/pages/' . $page . '.php';
+require $pageFile;