@echomem/mcp 1.4.20 → 1.4.22

package/dist/setup-page/client-core.js

@@ -8,6 +8,9 @@ export const SETUP_PAGE_CLIENT_CORE = String.raw `      var params = new URLSear
       var status = document.getElementById("status");
       var report = null;
       var reportEnvelope = null;
+      // The local bridge is authoritative. Login never gets access to scan/import routes;
+      // onboarding may request the separate local-history permission.
+      var setupFlow = "onboarding";
       var activeScanId = "";
       var stats = null;
       var statsSlow = false;
@@ -23,28 +26,46 @@ export const SETUP_PAGE_CLIENT_CORE = String.raw `      var params = new URLSear
       var progressPollRunId = 0;    // invalidates older progress loops when extraction resumes
       var dashMounted = false;      // dashboard shell (incl. plate iframe) mounted once; persists across /stats polls
       var reportMounted = false;    // report shell (city iframe) mounted once; loading is an overlay on it, not a separate page
-      var authUrl = "";
-      var switchAccountUrl = "";
       var workspacePath = "";
       var billingStatus = null;
       var billingStatusLoading = false;
       var setupPlanChoice = "";
+      var setupPlanPreview = "free";
+      var billingActivationPendingPlan = "";
       var selectedSessionKeys = Object.create(null);
       var sessionSelectionTouched = false;
       var sessionPickerQuery = "";
       var sessionPickerSource = "all";
       var billingPollTimer = null;
-      var authWindow = null;
-      var connectionPollStarted = false;
+      var localAuthEmail = "";
+      var localAuthTermsAccepted = false;
+      var localAuthAgeConfirmed = false;
       var statsPollStarted = false;
       var reportPollStarted = false;
+      var reportEstimateDeadline = 0;
+      var reportEstimateTimer = null;
+      var readyStage = "";
       var NIGHT_HOURS = { 22: 1, 23: 1, 0: 1, 1: 1, 2: 1, 3: 1 };
 
+      try {
+        var storedSetupPlanChoice = sessionStorage.getItem("echomem:setup-plan:" + nonce) || "";
+        if (storedSetupPlanChoice === "free" || storedSetupPlanChoice === "pro" || storedSetupPlanChoice === "power") {
+          setupPlanChoice = storedSetupPlanChoice;
+        }
+      } catch (_) {}
+
       function esc(value) {
         return String(value == null ? "" : value).replace(/[&<>"']/g, function (ch) {
           return { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[ch];
         });
       }
+      function rememberSetupPlanChoice(choice) {
+        setupPlanChoice = choice === "free" || choice === "pro" || choice === "power" ? choice : "";
+        try {
+          if (setupPlanChoice) sessionStorage.setItem("echomem:setup-plan:" + nonce, setupPlanChoice);
+          else sessionStorage.removeItem("echomem:setup-plan:" + nonce);
+        } catch (_) {}
+      }
       function setupIcon(name) {
         var paths = {
           "shield-check": '<path d="M12 3 5 6v5c0 4.6 2.9 8.1 7 10 4.1-1.9 7-5.4 7-10V6l-7-3Z"/><path d="m8.8 12.1 2 2 4.4-4.5"/>',
@@ -142,10 +163,6 @@ export const SETUP_PAGE_CLIENT_CORE = String.raw `      var params = new URLSear
         if (code === "NOT_LOGGED_IN") return "Echo on this machine is not signed in yet. Sign in again and retry.";
         return code || "Something went wrong. Retry in a moment.";
       }
-      function closeAuthWindow() {
-        try { if (authWindow && !authWindow.closed) authWindow.close(); } catch (_) {}
-        authWindow = null;
-      }
       function notifyOpenerConnected() {
         try {
           if (window.opener && window.opener !== window && !window.opener.closed) {
@@ -156,25 +173,268 @@ export const SETUP_PAGE_CLIENT_CORE = String.raw `      var params = new URLSear
         } catch (_) {}
         return false;
       }
-      function openAuthWindow(url) {
-        var targetUrl = url || authUrl;
-        if (!targetUrl) return false;
+      function localAuthLegalHtml() {
+        return '<label class="localAuthConsent">' +
+          '<input type="checkbox" id="localAuthConsent" ' + (localAuthAgeConfirmed && localAuthTermsAccepted ? "checked" : "") + ' />' +
+          '<span>I confirm that I am at least 18 years old and that I have read and agree to Echo\'s <a href="https://echoknows.com/terms-of-use" target="_blank" rel="noopener noreferrer">Terms of Use</a>, <a href="https://echoknows.com/memory-terms" target="_blank" rel="noopener noreferrer">Memory Usage Terms</a>, and <a href="https://echoknows.com/privacy-policy" target="_blank" rel="noopener noreferrer">Privacy Policy</a>. See our <a href="https://echoknows.com/subprocessor-list" target="_blank" rel="noopener noreferrer">Subprocessor List</a>.</span>' +
+        '</label>';
+      }
+      function captureLocalAuthConsents() {
+        var consent = document.getElementById("localAuthConsent");
+        if (consent) {
+          localAuthTermsAccepted = !!consent.checked;
+          localAuthAgeConfirmed = !!consent.checked;
+          return;
+        }
+        var terms = document.getElementById("localAuthTerms");
+        var age = document.getElementById("localAuthAge");
+        localAuthTermsAccepted = !!(terms && terms.checked);
+        localAuthAgeConfirmed = !!(age && age.checked);
+      }
+      function setLocalAuthStatus(message, tone) {
+        var node = document.getElementById("localAuthStatus");
+        if (!node) return;
+        node.textContent = message || "";
+        node.classList.toggle("is-error", tone === "error");
+      }
+      function updateLocalAuthSendButton() {
+        captureLocalAuthConsents();
+        var email = document.getElementById("localAuthEmail");
+        var button = document.getElementById("localAuthSend");
+        if (!button) return;
+        var value = email && email.value ? String(email.value).trim() : "";
+        button.disabled = !value || !localAuthTermsAccepted || !localAuthAgeConfirmed;
+      }
+      function renderLocalLogin(message) {
+        setCityMode(false);
+        setScanMode(false);
+        setExtractMode(false);
+        setReadyMode(true);
+        setHead("Connect EchoMem", "Local login");
+        app.className = "localAuthStage localAuthWelcomeStage";
+        app.innerHTML =
+          '<section class="localAuthWelcome" aria-labelledby="localAuthWelcomeTitle">' +
+            '<div class="localAuthOrbScene" aria-hidden="true"><span class="localAuthOrb"></span><span class="localAuthOrbShadow"></span></div>' +
+            '<div class="localAuthWelcomeCopy">' +
+              '<h2 id="localAuthWelcomeTitle">Welcome to Echo</h2>' +
+              '<p>Your memories, sovereign and shared.</p>' +
+            '</div>' +
+            '<form class="localAuthWelcomeForm" id="localAuthEmailForm">' +
+              '<div class="localAuthEmailCapsule">' +
+                '<label class="srOnly" for="localAuthEmail">Email</label>' +
+                '<input id="localAuthEmail" type="email" autocomplete="email" placeholder="Enter your email" value="' + esc(localAuthEmail) + '" />' +
+                '<button id="localAuthSend" type="submit" aria-label="Send one-time code"><span aria-hidden="true">→</span></button>' +
+              '</div>' +
+              localAuthLegalHtml() +
+              '<p class="localAuthStatus' + (message ? " is-error" : "") + '" id="localAuthStatus" role="status" aria-live="polite">' + esc(message || "") + '</p>' +
+            '</form>' +
+          '</section>';
+        var form = document.getElementById("localAuthEmailForm");
+        if (form) form.onsubmit = function (event) { event.preventDefault(); void sendLocalOtp(); };
+        var email = document.getElementById("localAuthEmail");
+        if (email) {
+          email.oninput = function () { localAuthEmail = String(email.value || ""); updateLocalAuthSendButton(); };
+          email.focus();
+        }
+        var consent = document.getElementById("localAuthConsent");
+        if (consent) consent.onchange = updateLocalAuthSendButton;
+        updateLocalAuthSendButton();
+      }
+      function renderLocalLoginComplete() {
+        setCityMode(false);
+        setScanMode(false);
+        setExtractMode(false);
+        setReadyMode(true);
+        setHead("EchoMem connected", "Done");
+        app.className = "notice";
+        app.innerHTML =
+          '<section class="localAuthCard localAuthComplete">' +
+            '<div class="localAuthLead">' +
+              '<img src="/hud-assets/echo-face-cutout.png" alt="" />' +
+              '<p class="consentEyebrow">This device is connected</p>' +
+              '<h2 class="siteHeadline">You\'re signed in.</h2>' +
+              '<p>Your local device token and encryption key are ready. Return to Terminal, or run <code>echomem-mcp init</code> when you want to start local-history onboarding.</p>' +
+            '</div>' +
+          '</section>';
+      }
+      async function finishLocalLogin() {
+        connected = true;
+        if (setupFlow === "login") {
+          renderLocalLoginComplete();
+          return;
+        }
+        rememberSetupPlanChoice("");
+        try { await refreshBillingStatus(); } catch (_) {}
+        await waitForStats();
+      }
+      async function sendLocalOtp() {
+        var email = document.getElementById("localAuthEmail");
+        localAuthEmail = email && email.value ? String(email.value).trim().toLowerCase() : "";
+        captureLocalAuthConsents();
+        if (!localAuthEmail) { setLocalAuthStatus("Enter your email.", "error"); return; }
+        if (!localAuthAgeConfirmed || !localAuthTermsAccepted) {
+          setLocalAuthStatus("Confirm your age and accept Echo's terms before continuing.", "error");
+          return;
+        }
+        var button = document.getElementById("localAuthSend");
+        if (button) { button.disabled = true; button.innerHTML = '<span class="localAuthSpinner" aria-hidden="true"></span>'; }
+        setLocalAuthStatus("Sending verification code...");
         try {
-          authWindow = window.open(targetUrl, "echomem-signin-" + nonce, "popup=yes,width=560,height=760");
-          if (!authWindow) return false;
-          authWindow.focus();
-          return true;
-        } catch (_) { return false; }
-      }
-      function showPopupFallback(message, url) {
-        Array.prototype.forEach.call(document.querySelectorAll("[data-signin-help]"), function (hint) {
-          hint.textContent = message || "Your browser blocked the secure sign-in window. Use the button below, then this page will resume when sign-in returns.";
-        });
-        Array.prototype.forEach.call(document.querySelectorAll("[data-signin-fallback]"), function (fallback) {
-          fallback.setAttribute("href", url || authUrl);
-          fallback.classList.remove("hidden");
+          var data = await postJson("/local-auth/send-otp", {
+            email: localAuthEmail,
+            acceptedTerms: localAuthTermsAccepted,
+            ageConfirmed: localAuthAgeConfirmed
+          }, 12000);
+          localAuthEmail = data.email || localAuthEmail;
+          renderLocalOtp("Code sent. Check your inbox.");
+        } catch (error) {
+          if (button) { button.disabled = false; button.innerHTML = '<span aria-hidden="true">→</span>'; }
+          setLocalAuthStatus(error && error.message ? error.message : "Could not send the code.", "error");
+        }
+      }
+      function renderLocalOtp(message) {
+        setCityMode(false);
+        setScanMode(false);
+        setExtractMode(false);
+        setReadyMode(true);
+        setHead("Check your email", "Local login");
+        app.className = "localAuthStage localAuthWelcomeStage localAuthOtpStage";
+        app.innerHTML =
+          '<section class="localAuthWelcome localAuthOtpWelcome" aria-labelledby="localAuthOtpTitle">' +
+            '<div class="localAuthOrbScene" aria-hidden="true"><span class="localAuthOrb"></span><span class="localAuthOrbShadow"></span></div>' +
+            '<div class="localAuthWelcomeCopy">' +
+              '<h2 id="localAuthOtpTitle">Check your inbox</h2>' +
+              '<p>We sent a 6-digit code to <strong>' + esc(localAuthEmail) + '</strong></p>' +
+            '</div>' +
+            '<form class="localAuthWelcomeForm localAuthOtpForm" id="localAuthOtpForm">' +
+              '<label class="srOnly" for="localAuthOtp0">6-digit code</label>' +
+              '<div class="localAuthOtpCells" aria-label="6-digit verification code">' +
+                '<input id="localAuthOtp0" data-otp-cell type="text" inputmode="numeric" autocomplete="one-time-code" maxlength="1" />' +
+                '<input data-otp-cell type="text" inputmode="numeric" maxlength="1" />' +
+                '<input data-otp-cell type="text" inputmode="numeric" maxlength="1" />' +
+                '<input data-otp-cell type="text" inputmode="numeric" maxlength="1" />' +
+                '<input data-otp-cell type="text" inputmode="numeric" maxlength="1" />' +
+                '<input data-otp-cell type="text" inputmode="numeric" maxlength="1" />' +
+              '</div>' +
+              '<button class="primary localAuthVerifyWide" id="localAuthVerify" type="submit">Verify</button>' +
+              '<button class="secondary localAuthBackWide" id="localAuthBack" type="button">Use another email</button>' +
+              '<p class="localAuthStatus" id="localAuthStatus" role="status" aria-live="polite">' + esc(message || "") + '</p>' +
+            '</form>' +
+          '</section>';
+        var form = document.getElementById("localAuthOtpForm");
+        if (form) form.onsubmit = function (event) { event.preventDefault(); void verifyLocalOtp(); };
+        var back = document.getElementById("localAuthBack");
+        if (back) back.onclick = function () { renderLocalLogin(""); };
+        bindLocalOtpCells();
+        var otp = document.querySelector("[data-otp-cell]");
+        if (otp) otp.focus();
+      }
+      function localOtpCellValues() {
+        return Array.prototype.map.call(document.querySelectorAll("[data-otp-cell]"), function (node) {
+          return String(node.value || "").replace(/\\D/g, "").slice(0, 1);
+        }).join("");
+      }
+      function fillLocalOtpCells(value) {
+        var digits = String(value || "").replace(/\\D/g, "").slice(0, 6);
+        var cells = Array.prototype.slice.call(document.querySelectorAll("[data-otp-cell]"));
+        cells.forEach(function (cell, index) { cell.value = digits.charAt(index) || ""; });
+        var focusIndex = Math.min(digits.length, cells.length - 1);
+        if (cells[focusIndex]) cells[focusIndex].focus();
+      }
+      function bindLocalOtpCells() {
+        var cells = Array.prototype.slice.call(document.querySelectorAll("[data-otp-cell]"));
+        cells.forEach(function (cell, index) {
+          cell.oninput = function () {
+            var value = String(cell.value || "").replace(/\\D/g, "");
+            if (value.length > 1) { fillLocalOtpCells(value); return; }
+            cell.value = value;
+            if (value && cells[index + 1]) cells[index + 1].focus();
+          };
+          cell.onkeydown = function (event) {
+            if (event.key === "Backspace" && !cell.value && cells[index - 1]) cells[index - 1].focus();
+          };
+          cell.onpaste = function (event) {
+            var text = event.clipboardData && event.clipboardData.getData ? event.clipboardData.getData("text") : "";
+            if (text) {
+              event.preventDefault();
+              fillLocalOtpCells(text);
+            }
+          };
         });
       }
+      async function verifyLocalOtp() {
+        var otp = localOtpCellValues();
+        if (otp.length !== 6) { setLocalAuthStatus("Enter the 6-digit code.", "error"); return; }
+        var button = document.getElementById("localAuthVerify");
+        if (button) { button.disabled = true; button.textContent = "Verifying..."; }
+        setLocalAuthStatus("Verifying code...");
+        try {
+          var data = await postJson("/local-auth/verify-otp", {
+            email: localAuthEmail,
+            otp: otp,
+            acceptedTerms: localAuthTermsAccepted,
+            ageConfirmed: localAuthAgeConfirmed
+          }, 18000);
+          if (data && data.stage === "passphrase") {
+            renderLocalPassphrase(data.mode || "unlock", data.email || localAuthEmail);
+            return;
+          }
+          await finishLocalLogin();
+        } catch (error) {
+          if (button) { button.disabled = false; button.textContent = "Verify code"; }
+          setLocalAuthStatus(error && error.message ? error.message : "Could not verify the code.", "error");
+        }
+      }
+      function renderLocalPassphrase(mode, email, message) {
+        localAuthEmail = email || localAuthEmail;
+        var setupMode = mode === "setup";
+        setCityMode(false);
+        setScanMode(false);
+        setExtractMode(false);
+        setReadyMode(true);
+        setHead(setupMode ? "Create encrypted vault" : "Unlock encrypted vault", "Local passphrase");
+        app.className = "localAuthStage localAuthWelcomeStage localAuthPassphraseStage";
+        app.innerHTML =
+          '<section class="localAuthWelcome localAuthPassphraseWelcome">' +
+            '<div class="localAuthOrbScene" aria-hidden="true"><span class="localAuthOrb"></span><span class="localAuthOrbShadow"></span></div>' +
+            '<div class="localAuthWelcomeCopy">' +
+              '<h2>' + (setupMode ? 'Create your local vault passphrase.' : 'Enter your vault passphrase.') + '</h2>' +
+              '<p>' + (setupMode ? 'Echo derives your encryption key on this device. The passphrase and key are never sent to EchoMem. If you forget it, encrypted memories cannot be recovered.' : 'Echo verifies this passphrase locally against your account encryption token. The passphrase is never sent to EchoMem.') + '</p>' +
+            '</div>' +
+            '<form class="localAuthWelcomeForm localAuthPassphraseForm" id="localAuthPassphraseForm">' +
+              '<label class="localAuthField"><span>Passphrase</span><input id="localAuthPassphrase" type="password" autocomplete="' + (setupMode ? "new-password" : "current-password") + '" placeholder="Encryption passphrase" /></label>' +
+              (setupMode ? '<label class="localAuthField"><span>Confirm passphrase</span><input id="localAuthPassphraseConfirm" type="password" autocomplete="new-password" placeholder="Confirm passphrase" /></label>' : '') +
+              '<button class="primary localAuthPassphraseSubmit" id="localAuthUnlock" type="submit">' + (setupMode ? "Create vault" : "Unlock") + '</button>' +
+              '<button class="secondary localAuthBackWide" id="localAuthRestart" type="button">Use a different email</button>' +
+              '<p class="localAuthStatus' + (message ? " is-error" : "") + '" id="localAuthStatus" role="status" aria-live="polite">' + esc(message || "") + '</p>' +
+            '</form>' +
+          '</section>';
+        var form = document.getElementById("localAuthPassphraseForm");
+        if (form) form.onsubmit = function (event) { event.preventDefault(); void submitLocalPassphrase(setupMode); };
+        var restart = document.getElementById("localAuthRestart");
+        if (restart) restart.onclick = function () { renderLocalLogin(""); };
+        var pass = document.getElementById("localAuthPassphrase");
+        if (pass) pass.focus();
+      }
+      async function submitLocalPassphrase(setupMode) {
+        var pass = document.getElementById("localAuthPassphrase");
+        var confirm = document.getElementById("localAuthPassphraseConfirm");
+        var passphrase = pass && typeof pass.value === "string" ? pass.value : "";
+        var confirmValue = confirm && typeof confirm.value === "string" ? confirm.value : "";
+        if (passphrase.length < 4) { setLocalAuthStatus("Use at least 4 characters.", "error"); return; }
+        if (setupMode && passphrase !== confirmValue) { setLocalAuthStatus("Passphrases do not match.", "error"); return; }
+        var button = document.getElementById("localAuthUnlock");
+        if (button) { button.disabled = true; button.textContent = setupMode ? "Creating..." : "Unlocking..."; }
+        setLocalAuthStatus(setupMode ? "Creating encrypted vault..." : "Unlocking vault...");
+        try {
+          await postJson("/local-auth/passphrase", { passphrase: passphrase }, 30000);
+          await finishLocalLogin();
+        } catch (error) {
+          if (button) { button.disabled = false; button.textContent = setupMode ? "Create vault" : "Unlock"; }
+          var msg = error && error.message ? error.message : "Could not unlock encrypted memory.";
+          renderLocalPassphrase(setupMode ? "setup" : "unlock", localAuthEmail, msg);
+        }
+      }
       function onConnectClick() {
         if (!localHistoryConsentGranted) {
           renderLocalScanConsent();
@@ -182,8 +442,8 @@ export const SETUP_PAGE_CLIENT_CORE = String.raw `      var params = new URLSear
           return;
         }
         if (connected) { void waitForStats(); return; }
-        if (!openAuthWindow(authUrl)) showPopupFallback("", authUrl);
-        startConnectionPoll();
+        rememberSetupPlanChoice("");
+        renderLocalLogin("");
       }
       function bindConnect() {
         Array.prototype.forEach.call(document.querySelectorAll("[data-connect-echo]"), function (signin) {