@omg-dev/admin 0.4.29 → 0.4.31

package/README.md

@@ -1,7 +1,7 @@
 # @omg-dev/admin
 
 Embeddable internal admin console — a panel-registry React component
-(**Feature Flags**, **Users**, **Reports**, and read-only **Pricing/Billing**)
+(**Feature Flags**, **Users**, and read-only **Pricing/Billing**)
 that drops into any host as a single `<AdminConsole/>`. Host-agnostic: you pass
 it where the control-plane lives and how to mint a bearer token; it does the
 rest. Self-styled (no Tailwind dependency), and every endpoint it calls is
@@ -56,7 +56,7 @@ if (res) return res;             // null = not our path; fall through
 <AdminConsole config={{ apiBase: "/_omg", getToken: () => null }} />
 ```
 
-The proxy only forwards `/api/flags/*`, `/api/users/*`, `/api/bugReports/*`,
+The proxy only forwards `/api/flags/*`, `/api/users/*`,
 and `/api/adminBilling/*` (the admin surface), so a leaked mount can't wield the
 token elsewhere. `OMG_ADMIN_TOKEN` is an `auth.omg.dev` JWT for an allowlisted
 admin — rotate it in server env, no client rebuild. Options:
@@ -108,7 +108,6 @@ mountAdminConsole(document.getElementById("root")!, {
   per-plan rule → rollout % (stable hash) → global default.
 - **Users** (read-only) — searchable account list with sessions, app counts,
   flag override counts, and on-demand billing balance for the selected user.
-- **Reports** (triage) — user-submitted bug reports with recovery context.
 - **Pricing** (read-only) — live plan→Stripe projection + the model catalog.
   Pricing is code-defined (`defineBilling`) and reconciled by the orchestrator;
   this is a window, not an editor.
@@ -119,7 +118,6 @@ Talks to the control-plane custom functions:
 
 - `POST /api/flags/{listFlags,upsert,setArchived,removeFlag,listOverrides,setOverride,removeOverride,findUsers,evaluate}`
 - `POST /api/users/{listUsers,findUsers}`
-- `POST /api/bugReports/{listReports,getReport,setStatus,addNote,removeReport}`
 - `POST /api/adminBilling/{planVersions,models,userBalance}`
 
 `flags.evaluate` is the consumer-facing endpoint (non-admin = self only) that

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import { a as ReportsPanel, c as AdminError, i as PricingPanel, l as STYLE_ID, n as BrainRoutingPanel, o as UsersPanel, r as FlagsPanel, s as AdminClient, t as AdminConsole, u as ensureStyles } from "./react-BNHn5Pe0.mjs";
-export { AdminClient, AdminConsole, AdminError, BrainRoutingPanel, FlagsPanel, PricingPanel, ReportsPanel, STYLE_ID, UsersPanel, ensureStyles };
+import { a as UsersPanel, c as STYLE_ID, i as PricingPanel, l as ensureStyles, n as BrainRoutingPanel, o as AdminClient, r as FlagsPanel, s as AdminError, t as AdminConsole } from "./react-6ZXjCUwb.mjs";
+export { AdminClient, AdminConsole, AdminError, BrainRoutingPanel, FlagsPanel, PricingPanel, STYLE_ID, UsersPanel, ensureStyles };

package/dist/{react-BNHn5Pe0.mjs → react-6ZXjCUwb.mjs}

@@ -443,8 +443,8 @@ a.vadm-flow-node:hover { border-color: var(--vadm-accent); }
 `;
 //#endregion
 //#region src/safe-url.ts
-/** URLs in the admin console can originate from reports or user-controlled
-* Computers. Only ordinary web links may become clickable operator actions. */
+/** URLs in the admin console can originate from user-controlled Computers.
+* Only ordinary web links may become clickable operator actions. */
 function safeHref(value) {
 	if (typeof value !== "string") return void 0;
 	try {
@@ -537,37 +537,6 @@ var AdminClient = class {
 	userBalance(userId) {
 		return this.rpc("adminBilling", "userBalance", { userId });
 	}
-	listReports(args) {
-		return this.rpc("bugReports", "listReports", args ?? {});
-	}
-	getReport(id) {
-		return this.rpc("bugReports", "getReport", { id });
-	}
-	setReportStatus(id, status, assignee) {
-		return this.rpc("bugReports", "setStatus", {
-			id,
-			status,
-			assignee
-		});
-	}
-	addReportNote(id, note) {
-		return this.rpc("bugReports", "addNote", {
-			id,
-			note
-		});
-	}
-	setReportCluster(id, clusterKey) {
-		return this.rpc("bugReports", "setCluster", {
-			id,
-			clusterKey
-		});
-	}
-	listClusters() {
-		return this.rpc("bugReports", "listClusters", {});
-	}
-	removeReport(id) {
-		return this.rpc("bugReports", "removeReport", { id });
-	}
 	listImessageBrainRouting(args) {
 		return this.rpc("imessageDebug", "listBrainRouting", args ?? {});
 	}
@@ -1230,6 +1199,13 @@ function PricingPanel({ client }) {
 		})
 	] });
 }
+function fmtTime(ms) {
+	try {
+		return new Date(ms).toLocaleString();
+	} catch {
+		return String(ms);
+	}
+}
 function UsersPanel({ client }) {
 	const [queryInput, setQueryInput] = useState("");
 	const [query, setQuery] = useState("");
@@ -1413,405 +1389,6 @@ function UsersPanel({ client }) {
 		})
 	] });
 }
-const BUG_STATUSES = [
-	"open",
-	"triaged",
-	"in_progress",
-	"resolved",
-	"wont_fix"
-];
-const STATUS_LABEL = {
-	open: "Open",
-	triaged: "Triaged",
-	in_progress: "In progress",
-	resolved: "Resolved",
-	wont_fix: "Won't fix"
-};
-const OPEN_STATUSES = new Set([
-	"open",
-	"triaged",
-	"in_progress"
-]);
-function fmtTime(ms) {
-	try {
-		return new Date(ms).toLocaleString();
-	} catch {
-		return String(ms);
-	}
-}
-const STORAGE_HOSTS = ["t3.storage.dev"];
-function safeImageSrc(v) {
-	if (typeof v !== "string") return void 0;
-	try {
-		const u = new URL(v);
-		if (u.protocol !== "http:" && u.protocol !== "https:") return void 0;
-		const host = u.hostname.toLowerCase();
-		return STORAGE_HOSTS.some((h) => host === h || host.endsWith("." + h)) ? v : void 0;
-	} catch {
-		return;
-	}
-}
-function ReportsPanel({ client }) {
-	const [reports, setReports] = useState(null);
-	const [counts, setCounts] = useState({});
-	const [filter, setFilter] = useState("all");
-	const [selectedId, setSelectedId] = useState(null);
-	const [detail, setDetail] = useState(null);
-	const [error, setError] = useState(null);
-	const [busy, setBusy] = useState(false);
-	const [note, setNote] = useState("");
-	const load = useCallback(async () => {
-		try {
-			const res = await client.listReports(filter === "all" ? {} : { status: filter });
-			setReports(res.reports);
-			setCounts(res.counts);
-			setError(null);
-		} catch (e) {
-			setError(e);
-		}
-	}, [client, filter]);
-	useEffect(() => {
-		ensureStyles();
-		load();
-	}, [load]);
-	const openDetail = useCallback(async (id) => {
-		setSelectedId(id);
-		setDetail(null);
-		try {
-			const d = await client.getReport(id);
-			setDetail(d);
-			setNote(d?.adminNotes ?? "");
-		} catch (e) {
-			setError(e);
-		}
-	}, [client]);
-	async function mutate(fn) {
-		setBusy(true);
-		try {
-			await fn();
-			await load();
-			if (selectedId) await openDetail(selectedId);
-			setError(null);
-		} catch (e) {
-			setError(e);
-		} finally {
-			setBusy(false);
-		}
-	}
-	const totalOpen = BUG_STATUSES.filter((s) => OPEN_STATUSES.has(s)).reduce((n, s) => n + (counts[s] ?? 0), 0);
-	return /* @__PURE__ */ jsxs("div", { children: [
-		/* @__PURE__ */ jsxs("p", {
-			className: "vadm-sub",
-			children: [
-				"User-submitted bug reports. Each carries the context to ",
-				/* @__PURE__ */ jsx("strong", { children: "recover" }),
-				" — open or fork the exact app version the reporter saw. ",
-				totalOpen,
-				" open."
-			]
-		}),
-		/* @__PURE__ */ jsx(ErrorBanner, { error }),
-		/* @__PURE__ */ jsxs("div", {
-			className: "vadm-row",
-			style: {
-				marginBottom: 12,
-				gap: 6,
-				flexWrap: "wrap"
-			},
-			children: [/* @__PURE__ */ jsx("button", {
-				className: "vadm-tab",
-				"data-active": filter === "all",
-				onClick: () => setFilter("all"),
-				children: "All"
-			}), BUG_STATUSES.map((s) => /* @__PURE__ */ jsxs("button", {
-				className: "vadm-tab",
-				"data-active": filter === s,
-				onClick: () => setFilter(s),
-				children: [
-					STATUS_LABEL[s],
-					" ",
-					counts[s] ? `(${counts[s]})` : ""
-				]
-			}, s))]
-		}),
-		/* @__PURE__ */ jsxs("div", {
-			className: "vadm-spread",
-			style: {
-				alignItems: "flex-start",
-				gap: 16
-			},
-			children: [/* @__PURE__ */ jsx("div", {
-				className: "vadm-grow",
-				style: { minWidth: 0 },
-				children: reports === null ? /* @__PURE__ */ jsx("div", {
-					className: "vadm-empty",
-					children: "Loading…"
-				}) : reports.length === 0 ? /* @__PURE__ */ jsx("div", {
-					className: "vadm-empty",
-					children: "No reports."
-				}) : /* @__PURE__ */ jsxs("table", {
-					className: "vadm-table",
-					children: [/* @__PURE__ */ jsx("thead", { children: /* @__PURE__ */ jsxs("tr", { children: [
-						/* @__PURE__ */ jsx("th", { children: "Title" }),
-						/* @__PURE__ */ jsx("th", { children: "Sev" }),
-						/* @__PURE__ */ jsx("th", { children: "Status" }),
-						/* @__PURE__ */ jsx("th", { children: "Reporter" }),
-						/* @__PURE__ */ jsx("th", { children: "When" })
-					] }) }), /* @__PURE__ */ jsx("tbody", { children: reports.map((r) => /* @__PURE__ */ jsxs("tr", {
-						onClick: () => openDetail(r.id),
-						style: {
-							cursor: "pointer",
-							fontWeight: r.id === selectedId ? 600 : void 0
-						},
-						children: [
-							/* @__PURE__ */ jsx("td", {
-								style: {
-									maxWidth: 260,
-									overflow: "hidden",
-									textOverflow: "ellipsis",
-									whiteSpace: "nowrap"
-								},
-								children: r.title
-							}),
-							/* @__PURE__ */ jsx("td", { children: /* @__PURE__ */ jsx("span", {
-								className: "vadm-badge",
-								"data-on": r.severity === "critical" || r.severity === "high" ? "true" : void 0,
-								children: r.severity
-							}) }),
-							/* @__PURE__ */ jsx("td", { children: STATUS_LABEL[r.status] }),
-							/* @__PURE__ */ jsxs("td", {
-								className: "vadm-muted",
-								children: [r.reporterEmail ?? "—", r.reporterEmail && !r.reporterUserId && /* @__PURE__ */ jsx("span", {
-									className: "vadm-badge",
-									style: { marginLeft: 6 },
-									title: "Self-reported email — not verified",
-									children: "unverified"
-								})]
-							}),
-							/* @__PURE__ */ jsx("td", {
-								className: "vadm-muted",
-								children: fmtTime(r.createdAt)
-							})
-						]
-					}, r.id)) })]
-				})
-			}), detail && /* @__PURE__ */ jsxs("div", {
-				className: "vadm-detail vadm-card",
-				style: {
-					width: 360,
-					flexShrink: 0
-				},
-				children: [
-					/* @__PURE__ */ jsxs("div", {
-						style: {
-							border: "1px solid #f0d8a8",
-							background: "#fffaf0",
-							borderRadius: 8,
-							padding: "8px 10px",
-							margin: "0 0 12px"
-						},
-						children: [
-							/* @__PURE__ */ jsx("div", {
-								className: "vadm-muted",
-								style: {
-									fontSize: 11,
-									marginBottom: 4,
-									textTransform: "uppercase",
-									letterSpacing: .4
-								},
-								children: "Reported text · untrusted input"
-							}),
-							/* @__PURE__ */ jsx("p", {
-								className: "vadm-h",
-								style: { margin: "0 0 4px" },
-								children: detail.title
-							}),
-							/* @__PURE__ */ jsx("p", {
-								style: {
-									whiteSpace: "pre-wrap",
-									wordBreak: "break-word",
-									margin: 0
-								},
-								children: detail.body || /* @__PURE__ */ jsx("em", {
-									className: "vadm-muted",
-									children: "No description."
-								})
-							})
-						]
-					}),
-					/* @__PURE__ */ jsxs("div", {
-						className: "vadm-field",
-						children: [/* @__PURE__ */ jsx("label", {
-							className: "vadm-label",
-							children: "Status"
-						}), /* @__PURE__ */ jsx("select", {
-							className: "vadm-select",
-							value: detail.status,
-							disabled: busy,
-							onChange: (e) => mutate(() => client.setReportStatus(detail.id, e.target.value)),
-							children: BUG_STATUSES.map((s) => /* @__PURE__ */ jsx("option", {
-								value: s,
-								children: STATUS_LABEL[s]
-							}, s))
-						})]
-					}),
-					/* @__PURE__ */ jsxs("div", {
-						className: "vadm-field",
-						children: [/* @__PURE__ */ jsx("label", {
-							className: "vadm-label",
-							children: "Recover context"
-						}), /* @__PURE__ */ jsxs("div", {
-							className: "vadm-mono",
-							style: {
-								fontSize: 12,
-								lineHeight: 1.6
-							},
-							children: [
-								detail.slug ? /* @__PURE__ */ jsxs("div", { children: [
-									"app:",
-									" ",
-									/* @__PURE__ */ jsx("a", {
-										href: `https://app.omg.dev/${detail.slug}`,
-										target: "_blank",
-										rel: "noreferrer",
-										children: detail.slug
-									}),
-									detail.version != null ? ` · v${detail.version}` : ""
-								] }) : /* @__PURE__ */ jsx("div", {
-									className: "vadm-muted",
-									children: "no app linked"
-								}),
-								detail.snapshotId && /* @__PURE__ */ jsxs("div", { children: ["snapshot: ", detail.snapshotId] }),
-								detail.runId && /* @__PURE__ */ jsxs("div", { children: ["run: ", detail.runId] }),
-								detail.pageUrl && /* @__PURE__ */ jsxs("div", {
-									style: {
-										overflow: "hidden",
-										textOverflow: "ellipsis",
-										whiteSpace: "nowrap"
-									},
-									children: [
-										"page:",
-										" ",
-										safeHref(detail.pageUrl) ? /* @__PURE__ */ jsx("a", {
-											href: detail.pageUrl,
-											target: "_blank",
-											rel: "noreferrer",
-											children: detail.pageUrl
-										}) : /* @__PURE__ */ jsx("span", { children: detail.pageUrl })
-									]
-								})
-							]
-						})]
-					}),
-					detail.slug && /* @__PURE__ */ jsxs("div", {
-						className: "vadm-row",
-						style: {
-							gap: 6,
-							marginBottom: 8
-						},
-						children: [/* @__PURE__ */ jsx("a", {
-							className: "vadm-btn vadm-btn-sm",
-							href: `https://app.omg.dev/${detail.slug}`,
-							target: "_blank",
-							rel: "noreferrer",
-							children: "Open app"
-						}), /* @__PURE__ */ jsx("a", {
-							className: "vadm-btn vadm-btn-sm",
-							href: `https://app.omg.dev/${detail.slug}/inspect/data`,
-							target: "_blank",
-							rel: "noreferrer",
-							children: "Inspect"
-						})]
-					}),
-					(() => {
-						const ctx = detail.context;
-						const url = safeImageSrc(ctx?.screenshotUrl) ?? null;
-						return url ? /* @__PURE__ */ jsxs("div", {
-							className: "vadm-field",
-							children: [/* @__PURE__ */ jsx("label", {
-								className: "vadm-label",
-								children: "Screenshot"
-							}), /* @__PURE__ */ jsx("a", {
-								href: url,
-								target: "_blank",
-								rel: "noreferrer",
-								children: /* @__PURE__ */ jsx("img", {
-									src: url,
-									alt: "screenshot",
-									style: {
-										width: "100%",
-										maxHeight: 200,
-										objectFit: "cover",
-										borderRadius: 8,
-										border: "1px solid #eee"
-									}
-								})
-							})]
-						}) : null;
-					})(),
-					detail.context != null && /* @__PURE__ */ jsxs("div", {
-						className: "vadm-field",
-						children: [/* @__PURE__ */ jsx("label", {
-							className: "vadm-label",
-							children: "Diagnostics"
-						}), /* @__PURE__ */ jsx("pre", {
-							className: "vadm-mono",
-							style: {
-								fontSize: 11,
-								maxHeight: 160,
-								overflow: "auto",
-								margin: 0
-							},
-							children: JSON.stringify(detail.context, null, 2)
-						})]
-					}),
-					/* @__PURE__ */ jsxs("div", {
-						className: "vadm-field",
-						children: [
-							/* @__PURE__ */ jsx("label", {
-								className: "vadm-label",
-								children: "Triage note"
-							}),
-							/* @__PURE__ */ jsx("textarea", {
-								className: "vadm-textarea",
-								rows: 3,
-								value: note,
-								onChange: (e) => setNote(e.target.value),
-								disabled: busy
-							}),
-							/* @__PURE__ */ jsx("button", {
-								className: "vadm-btn vadm-btn-sm",
-								disabled: busy || note === (detail.adminNotes ?? ""),
-								onClick: () => mutate(() => client.addReportNote(detail.id, note)),
-								style: { marginTop: 6 },
-								children: "Save note"
-							})
-						]
-					}),
-					/* @__PURE__ */ jsxs("div", {
-						className: "vadm-spread",
-						style: { marginTop: 12 },
-						children: [/* @__PURE__ */ jsxs("span", {
-							className: "vadm-muted",
-							style: { fontSize: 12 },
-							children: [detail.reporterEmail ?? "anonymous", detail.reporterEmail && !detail.reporterUserId && " · unverified"]
-						}), /* @__PURE__ */ jsx("button", {
-							className: "vadm-btn vadm-btn-sm",
-							disabled: busy,
-							onClick: () => {
-								if (confirm("Delete this report?")) mutate(() => client.removeReport(detail.id).then(() => {
-									setDetail(null);
-									setSelectedId(null);
-								}));
-							},
-							children: "Delete"
-						})]
-					})
-				]
-			})]
-		})
-	] });
-}
 function shortId(value) {
 	if (!value) return "none";
 	return value.length > 16 ? `${value.slice(0, 8)}…${value.slice(-5)}` : value;
@@ -2545,11 +2122,6 @@ const DEFAULT_PANELS = [
 		label: "Users",
 		render: (c) => /* @__PURE__ */ jsx(UsersPanel, { client: c })
 	},
-	{
-		id: "reports",
-		label: "Reports",
-		render: (c) => /* @__PURE__ */ jsx(ReportsPanel, { client: c })
-	},
 	{
 		id: "pricing",
 		label: "Pricing",
@@ -2584,4 +2156,4 @@ function AdminConsole({ client, config, panels = DEFAULT_PANELS }) {
 	});
 }
 //#endregion
-export { ReportsPanel as a, AdminError as c, PricingPanel as i, STYLE_ID as l, BrainRoutingPanel as n, UsersPanel as o, FlagsPanel as r, AdminClient as s, AdminConsole as t, ensureStyles as u };
+export { UsersPanel as a, STYLE_ID as c, PricingPanel as i, ensureStyles as l, BrainRoutingPanel as n, AdminClient as o, FlagsPanel as r, AdminError as s, AdminConsole as t };

package/dist/server.mjs

@@ -2,7 +2,6 @@
 const ALLOWED = [
 	"/api/flags/",
 	"/api/adminBilling/",
-	"/api/bugReports/",
 	"/api/users/",
 	"/api/imessageDebug/"
 ];

package/dist/standalone.mjs

@@ -1,4 +1,4 @@
-import { s as AdminClient, t as AdminConsole } from "./react-BNHn5Pe0.mjs";
+import { o as AdminClient, t as AdminConsole } from "./react-6ZXjCUwb.mjs";
 import { createElement } from "react";
 import { createRoot } from "react-dom/client";
 //#region src/standalone.tsx

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@omg-dev/admin",
-  "version": "0.4.29",
+  "version": "0.4.31",
   "type": "module",
   "exports": {
     ".": {

package/src/client.ts

@@ -102,31 +102,6 @@ export class AdminClient {
     return this.rpc<UserBalance>("adminBilling", "userBalance", { userId })
   }
 
-  // ── bug reports (triage) ───────────────────────────────────────────────────
-  listReports(args?: { status?: BugStatus; limit?: number; clusterKey?: string }) {
-    return this.rpc<BugReportList>("bugReports", "listReports", args ?? {})
-  }
-  getReport(id: string) {
-    return this.rpc<BugReportDetail | null>("bugReports", "getReport", { id })
-  }
-  setReportStatus(id: string, status: BugStatus, assignee?: string) {
-    return this.rpc<{ ok: true }>("bugReports", "setStatus", { id, status, assignee })
-  }
-  addReportNote(id: string, note: string) {
-    return this.rpc<{ ok: true }>("bugReports", "addNote", { id, note })
-  }
-  // Dedupe surface: group a report under a root cause (clusterKey=null clears),
-  // and roll up clusters so triage can skip a duplicate fixer.
-  setReportCluster(id: string, clusterKey: string | null) {
-    return this.rpc<{ ok: true; clusterKey: string | null }>("bugReports", "setCluster", { id, clusterKey })
-  }
-  listClusters() {
-    return this.rpc<BugClusterList>("bugReports", "listClusters", {})
-  }
-  removeReport(id: string) {
-    return this.rpc<{ ok: boolean }>("bugReports", "removeReport", { id })
-  }
-
   // ── iMessage Brain (read-only routing ledger) ─────────────────────────────
   // `steps: true` also returns the per-turn step log (rules evaluated, prompt
   // blocks, tool calls with arguments, tool results, effects) — the waterfall.
@@ -297,59 +272,3 @@ export interface ImessageBrainMessage {
   media?: string[]
   at: number
 }
-
-// ── bug reports ───────────────────────────────────────────────────────────────
-
-export type BugStatus = "open" | "triaged" | "in_progress" | "resolved" | "wont_fix"
-export type BugSeverity = "low" | "normal" | "high" | "critical"
-
-export interface BugReportSummary {
-  id: string
-  title: string
-  severity: BugSeverity
-  status: BugStatus
-  assignee: string | null
-  reporterEmail: string | null
-  // null = anonymous app-submitted report → reporterEmail is self-claimed and
-  // unverified (the UI marks it). Non-null = dashboard report, email from JWT.
-  reporterUserId: string | null
-  slug: string | null
-  // Root-cause cluster key (null = unclustered). Reports sharing a key are
-  // duplicates of one root cause; triage uses it to dedupe.
-  clusterKey: string | null
-  createdAt: number
-  updatedAt: number
-}
-
-export interface BugReportList {
-  reports: BugReportSummary[]
-  counts: Record<string, number>
-}
-
-export interface BugCluster {
-  clusterKey: string
-  total: number
-  open: number
-  // Reports not yet resolved/wont_fix — non-zero means the root cause is still
-  // live, so a new duplicate should attach here instead of opening a new fixer.
-  unresolved: number
-  latestAt: number
-  latestTitle: string | null
-}
-
-export interface BugClusterList {
-  clusters: BugCluster[]
-}
-
-export interface BugReportDetail extends BugReportSummary {
-  body: string
-  projectId: string | null
-  runId: string | null
-  snapshotId: string | null
-  version: number | null
-  pageUrl: string | null
-  userAgent: string | null
-  adminNotes: string | null
-  resolvedAt: number | null
-  context: unknown
-}

package/src/index.ts

@@ -1,6 +1,6 @@
 // @omg-dev/admin — embeddable internal admin console.
 //
-// A panel-registry React console (Feature Flags, Users, Reports + read-only
+// A panel-registry React console (Feature Flags, Users + read-only
 // Pricing/Billing) that drops into any host as a single <AdminConsole/> — the
 // omg dashboard, the LFG app, or Inspect. Host-agnostic: you pass an AdminClient
 // (control-plane base URL + a bearer-token getter); the console does the rest.
@@ -13,7 +13,6 @@ export {
   AdminConsole,
   FlagsPanel,
   PricingPanel,
-  ReportsPanel,
   UsersPanel,
   BrainRoutingPanel,
   AdminClient,
@@ -37,11 +36,6 @@ export {
   type ImessageBrainTrace,
   type ImessageBrainMessage,
   type ValueType,
-  type BugStatus,
-  type BugSeverity,
-  type BugReportSummary,
-  type BugReportList,
-  type BugReportDetail,
 } from "./client"
 
 export { ensureStyles, STYLE_ID } from "./styles"

package/src/react.tsx

@@ -26,9 +26,6 @@ import {
   type ImessageBrainTrace,
   type ImessageBrainTraceStep,
   type ImessageBrainMessage,
-  type BugReportSummary,
-  type BugReportDetail,
-  type BugStatus,
 } from "./client"
 
 export type { AdminClientConfig }
@@ -460,6 +457,14 @@ export function PricingPanel({ client }: { client: AdminClient }) {
   )
 }
 
+function fmtTime(ms: number): string {
+  try {
+    return new Date(ms).toLocaleString()
+  } catch {
+    return String(ms)
+  }
+}
+
 // ── Users panel ────────────────────────────────────────────────────────────
 
 export function UsersPanel({ client }: { client: AdminClient }) {
@@ -623,308 +628,6 @@ export function UsersPanel({ client }: { client: AdminClient }) {
   )
 }
 
-// ── Reports panel (triage) ─────────────────────────────────────────────────
-
-const BUG_STATUSES: BugStatus[] = ["open", "triaged", "in_progress", "resolved", "wont_fix"]
-const STATUS_LABEL: Record<BugStatus, string> = {
-  open: "Open",
-  triaged: "Triaged",
-  in_progress: "In progress",
-  resolved: "Resolved",
-  wont_fix: "Won't fix",
-}
-const OPEN_STATUSES = new Set<BugStatus>(["open", "triaged", "in_progress"])
-
-function fmtTime(ms: number): string {
-  try {
-    return new Date(ms).toLocaleString()
-  } catch {
-    return String(ms)
-  }
-}
-
-// Screenshots come from a report (untrusted). An <img src> to an arbitrary host
-// is a tracking pixel / IP-leak / cookie beacon against the admin. Only render
-// images served from our storage CDN; otherwise show nothing (the report still
-// carries the durable screenshotKey for manual lookup). Mirrors the ingestion
-// allowlist in control-plane/lib/sanitize.ts → storageImageUrl.
-const STORAGE_HOSTS = ["t3.storage.dev"]
-function safeImageSrc(v: unknown): string | undefined {
-  if (typeof v !== "string") return undefined
-  try {
-    const u = new URL(v)
-    if (u.protocol !== "http:" && u.protocol !== "https:") return undefined
-    const host = u.hostname.toLowerCase()
-    return STORAGE_HOSTS.some((h) => host === h || host.endsWith("." + h)) ? v : undefined
-  } catch {
-    return undefined
-  }
-}
-
-export function ReportsPanel({ client }: { client: AdminClient }) {
-  const [reports, setReports] = useState<BugReportSummary[] | null>(null)
-  const [counts, setCounts] = useState<Record<string, number>>({})
-  const [filter, setFilter] = useState<BugStatus | "all">("all")
-  const [selectedId, setSelectedId] = useState<string | null>(null)
-  const [detail, setDetail] = useState<BugReportDetail | null>(null)
-  const [error, setError] = useState<unknown>(null)
-  const [busy, setBusy] = useState(false)
-  const [note, setNote] = useState("")
-
-  const load = useCallback(async () => {
-    try {
-      const res = await client.listReports(filter === "all" ? {} : { status: filter })
-      setReports(res.reports)
-      setCounts(res.counts)
-      setError(null)
-    } catch (e) {
-      setError(e)
-    }
-  }, [client, filter])
-
-  useEffect(() => {
-    ensureStyles()
-    void load()
-  }, [load])
-
-  const openDetail = useCallback(
-    async (id: string) => {
-      setSelectedId(id)
-      setDetail(null)
-      try {
-        const d = await client.getReport(id)
-        setDetail(d)
-        setNote(d?.adminNotes ?? "")
-      } catch (e) {
-        setError(e)
-      }
-    },
-    [client],
-  )
-
-  async function mutate(fn: () => Promise<unknown>) {
-    setBusy(true)
-    try {
-      await fn()
-      await load()
-      if (selectedId) await openDetail(selectedId)
-      setError(null)
-    } catch (e) {
-      setError(e)
-    } finally {
-      setBusy(false)
-    }
-  }
-
-  const totalOpen = BUG_STATUSES.filter((s) => OPEN_STATUSES.has(s)).reduce((n, s) => n + (counts[s] ?? 0), 0)
-
-  return (
-    <div>
-      <p className="vadm-sub">
-        User-submitted bug reports. Each carries the context to <strong>recover</strong> — open or fork the exact app
-        version the reporter saw. {totalOpen} open.
-      </p>
-      <ErrorBanner error={error} />
-
-      <div className="vadm-row" style={{ marginBottom: 12, gap: 6, flexWrap: "wrap" }}>
-        <button className="vadm-tab" data-active={filter === "all"} onClick={() => setFilter("all")}>
-          All
-        </button>
-        {BUG_STATUSES.map((s) => (
-          <button key={s} className="vadm-tab" data-active={filter === s} onClick={() => setFilter(s)}>
-            {STATUS_LABEL[s]} {counts[s] ? `(${counts[s]})` : ""}
-          </button>
-        ))}
-      </div>
-
-      <div className="vadm-spread" style={{ alignItems: "flex-start", gap: 16 }}>
-        {/* List */}
-        <div className="vadm-grow" style={{ minWidth: 0 }}>
-          {reports === null ? (
-            <div className="vadm-empty">Loading…</div>
-          ) : reports.length === 0 ? (
-            <div className="vadm-empty">No reports.</div>
-          ) : (
-            <table className="vadm-table">
-              <thead>
-                <tr>
-                  <th>Title</th>
-                  <th>Sev</th>
-                  <th>Status</th>
-                  <th>Reporter</th>
-                  <th>When</th>
-                </tr>
-              </thead>
-              <tbody>
-                {reports.map((r) => (
-                  <tr
-                    key={r.id}
-                    onClick={() => openDetail(r.id)}
-                    style={{ cursor: "pointer", fontWeight: r.id === selectedId ? 600 : undefined }}
-                  >
-                    <td style={{ maxWidth: 260, overflow: "hidden", textOverflow: "ellipsis", whiteSpace: "nowrap" }}>
-                      {r.title}
-                    </td>
-                    <td>
-                      <span className="vadm-badge" data-on={r.severity === "critical" || r.severity === "high" ? "true" : undefined}>
-                        {r.severity}
-                      </span>
-                    </td>
-                    <td>{STATUS_LABEL[r.status]}</td>
-                    <td className="vadm-muted">
-                      {r.reporterEmail ?? "—"}
-                      {r.reporterEmail && !r.reporterUserId && (
-                        <span className="vadm-badge" style={{ marginLeft: 6 }} title="Self-reported email — not verified">
-                          unverified
-                        </span>
-                      )}
-                    </td>
-                    <td className="vadm-muted">{fmtTime(r.createdAt)}</td>
-                  </tr>
-                ))}
-              </tbody>
-            </table>
-          )}
-        </div>
-
-        {/* Detail */}
-        {detail && (
-          <div className="vadm-detail vadm-card" style={{ width: 360, flexShrink: 0 }}>
-            {/* The title + body are UNTRUSTED visitor text (potential prompt
-                injection if pasted into an LLM). Fence them visually so a
-                triager never mistakes embedded "instructions" for system copy.
-                React already escapes the content; this is provenance, not XSS. */}
-            <div
-              style={{
-                border: "1px solid #f0d8a8",
-                background: "#fffaf0",
-                borderRadius: 8,
-                padding: "8px 10px",
-                margin: "0 0 12px",
-              }}
-            >
-              <div className="vadm-muted" style={{ fontSize: 11, marginBottom: 4, textTransform: "uppercase", letterSpacing: 0.4 }}>
-                Reported text · untrusted input
-              </div>
-              <p className="vadm-h" style={{ margin: "0 0 4px" }}>{detail.title}</p>
-              <p style={{ whiteSpace: "pre-wrap", wordBreak: "break-word", margin: 0 }}>
-                {detail.body || <em className="vadm-muted">No description.</em>}
-              </p>
-            </div>
-
-            <div className="vadm-field">
-              <label className="vadm-label">Status</label>
-              <select
-                className="vadm-select"
-                value={detail.status}
-                disabled={busy}
-                onChange={(e) => mutate(() => client.setReportStatus(detail.id, e.target.value as BugStatus))}
-              >
-                {BUG_STATUSES.map((s) => (
-                  <option key={s} value={s}>{STATUS_LABEL[s]}</option>
-                ))}
-              </select>
-            </div>
-
-            <div className="vadm-field">
-              <label className="vadm-label">Recover context</label>
-              <div className="vadm-mono" style={{ fontSize: 12, lineHeight: 1.6 }}>
-                {detail.slug ? (
-                  <div>
-                    app:{" "}
-                    <a href={`https://app.omg.dev/${detail.slug}`} target="_blank" rel="noreferrer">{detail.slug}</a>
-                    {detail.version != null ? ` · v${detail.version}` : ""}
-                  </div>
-                ) : (
-                  <div className="vadm-muted">no app linked</div>
-                )}
-                {detail.snapshotId && <div>snapshot: {detail.snapshotId}</div>}
-                {detail.runId && <div>run: {detail.runId}</div>}
-                {detail.pageUrl && (
-                  <div style={{ overflow: "hidden", textOverflow: "ellipsis", whiteSpace: "nowrap" }}>
-                    page:{" "}
-                    {safeHref(detail.pageUrl) ? (
-                      <a href={detail.pageUrl} target="_blank" rel="noreferrer">{detail.pageUrl}</a>
-                    ) : (
-                      <span>{detail.pageUrl}</span>
-                    )}
-                  </div>
-                )}
-              </div>
-            </div>
-
-            {detail.slug && (
-              <div className="vadm-row" style={{ gap: 6, marginBottom: 8 }}>
-                <a className="vadm-btn vadm-btn-sm" href={`https://app.omg.dev/${detail.slug}`} target="_blank" rel="noreferrer">
-                  Open app
-                </a>
-                <a className="vadm-btn vadm-btn-sm" href={`https://app.omg.dev/${detail.slug}/inspect/data`} target="_blank" rel="noreferrer">
-                  Inspect
-                </a>
-              </div>
-            )}
-
-            {(() => {
-              const ctx = detail.context as { screenshotUrl?: unknown } | null
-              const url = safeImageSrc(ctx?.screenshotUrl) ?? null
-              return url ? (
-                <div className="vadm-field">
-                  <label className="vadm-label">Screenshot</label>
-                  <a href={url} target="_blank" rel="noreferrer">
-                    <img
-                      src={url}
-                      alt="screenshot"
-                      style={{ width: "100%", maxHeight: 200, objectFit: "cover", borderRadius: 8, border: "1px solid #eee" }}
-                    />
-                  </a>
-                </div>
-              ) : null
-            })()}
-
-            {detail.context != null && (
-              <div className="vadm-field">
-                <label className="vadm-label">Diagnostics</label>
-                <pre className="vadm-mono" style={{ fontSize: 11, maxHeight: 160, overflow: "auto", margin: 0 }}>
-                  {JSON.stringify(detail.context, null, 2)}
-                </pre>
-              </div>
-            )}
-
-            <div className="vadm-field">
-              <label className="vadm-label">Triage note</label>
-              <textarea className="vadm-textarea" rows={3} value={note} onChange={(e) => setNote(e.target.value)} disabled={busy} />
-              <button
-                className="vadm-btn vadm-btn-sm"
-                disabled={busy || note === (detail.adminNotes ?? "")}
-                onClick={() => mutate(() => client.addReportNote(detail.id, note))}
-                style={{ marginTop: 6 }}
-              >
-                Save note
-              </button>
-            </div>
-
-            <div className="vadm-spread" style={{ marginTop: 12 }}>
-              <span className="vadm-muted" style={{ fontSize: 12 }}>
-                {detail.reporterEmail ?? "anonymous"}
-                {detail.reporterEmail && !detail.reporterUserId && " · unverified"}
-              </span>
-              <button
-                className="vadm-btn vadm-btn-sm"
-                disabled={busy}
-                onClick={() => {
-                  if (confirm("Delete this report?")) void mutate(() => client.removeReport(detail.id).then(() => { setDetail(null); setSelectedId(null) }))
-                }}
-              >
-                Delete
-              </button>
-            </div>
-          </div>
-        )}
-      </div>
-    </div>
-  )
-}
-
 // ── iMessage Brain routing panel ────────────────────────────────────────────
 
 function shortId(value: string | null): string {
@@ -1585,7 +1288,6 @@ const DEFAULT_PANELS: PanelDef[] = [
   { id: "brain", label: "Chat Brain", render: (c) => <BrainRoutingPanel client={c} /> },
   { id: "flags", label: "Flags", render: (c) => <FlagsPanel client={c} /> },
   { id: "users", label: "Users", render: (c) => <UsersPanel client={c} /> },
-  { id: "reports", label: "Reports", render: (c) => <ReportsPanel client={c} /> },
   { id: "pricing", label: "Pricing", render: (c) => <PricingPanel client={c} /> },
 ]
 

package/src/safe-url.ts

@@ -1,5 +1,5 @@
-/** URLs in the admin console can originate from reports or user-controlled
- * Computers. Only ordinary web links may become clickable operator actions. */
+/** URLs in the admin console can originate from user-controlled Computers.
+ * Only ordinary web links may become clickable operator actions. */
 export function safeHref(value: unknown): string | undefined {
   if (typeof value !== "string") return undefined
   try {

package/src/server.ts

@@ -30,7 +30,7 @@ export interface OmgAdminProxyOptions {
 // The proxy only forwards the admin surface — never arbitrary control-plane
 // paths — so a leaked mount can't wield the powerful admin token against other
 // endpoints. Keep in sync with the console's AdminClient modules.
-const ALLOWED = ["/api/flags/", "/api/adminBilling/", "/api/bugReports/", "/api/users/", "/api/imessageDebug/"];
+const ALLOWED = ["/api/flags/", "/api/adminBilling/", "/api/users/", "/api/imessageDebug/"];
 
 function json(body: unknown, status: number): Response {
   return new Response(JSON.stringify(body), {