@rubytech/create-maxy-code 0.1.535 → 0.1.537

package/payload/platform/services/claude-session-manager/dist/public-surface-audit.d.ts

@@ -0,0 +1,44 @@
+export type Logger = (line: string) => void;
+/** The channel servers a public session is allowed to hold: the three per-kind
+ *  servers and the unified server a multi-target session registers instead.
+ *  Anything else on a public session is a breach — the visitor's spawn holds a
+ *  server the lockdown should have excluded. */
+export declare const CHANNEL_SERVER_NAMES: ReadonlySet<string>;
+/** The server name in a spawn-tee log filename for THIS session, else null.
+ *  The filename is `mcp-<server>-<sessionId>.log` and the server name itself
+ *  contains dashes, so the match is anchored on the sessionId suffix rather
+ *  than split on '-'. The sessionless twin (`mcp-<server>-nosession.log`)
+ *  belongs to no session and is never a breach. */
+export declare function parseMcpLogServerName(filename: string, sessionId: string): string | null;
+/** Every server on a public session that is not a channel server, deduped and
+ *  sorted so the logged set is stable across ticks. */
+export declare function selectBreachServers(servers: readonly string[]): string[];
+/** The every-tick line. Emitted including zero, so a silent audit is
+ *  distinguishable from a healthy one. */
+export declare function formatPublicSurfaceSummary(p: {
+    publicSessions: number;
+    breaches: number;
+}): string;
+export declare function formatPublicSurfaceBreach(p: {
+    sessionId: string;
+    servers: readonly string[];
+}): string;
+export interface PublicSurfaceAuditDeps {
+    intervalMs: number;
+    logger: Logger;
+    /** Live sessions and the role their classification sidecar records. A role
+     *  that cannot be resolved is null, which is never a breach. */
+    listSessions(): readonly {
+        sessionId: string;
+        role: string | null;
+    }[];
+    /** MCP server names this session actually realised. */
+    serversForSession(sessionId: string): readonly string[];
+}
+export interface PublicSurfaceAudit {
+    start(): void;
+    stop(): void;
+    tickOnce(): void;
+}
+export declare function createPublicSurfaceAudit(deps: PublicSurfaceAuditDeps): PublicSurfaceAudit;
+//# sourceMappingURL=public-surface-audit.d.ts.map

package/payload/platform/services/claude-session-manager/dist/public-surface-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-surface-audit.d.ts","sourceRoot":"","sources":["../src/public-surface-audit.ts"],"names":[],"mappings":"AAiBA,MAAM,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;AAE3C;;;gDAGgD;AAChD,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAKnD,CAAA;AAEF;;;;mDAImD;AACnD,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMxF;AAED;uDACuD;AACvD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAExE;AAED;0CAC0C;AAC1C,wBAAgB,0BAA0B,CAAC,CAAC,EAAE;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAElG;AAED,wBAAgB,yBAAyB,CAAC,CAAC,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG,MAAM,CAEtG;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd;oEACgE;IAChE,YAAY,IAAI,SAAS;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAA;IACrE,uDAAuD;IACvD,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAA;CACxD;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,IAAI,IAAI,CAAA;IACb,IAAI,IAAI,IAAI,CAAA;IACZ,QAAQ,IAAI,IAAI,CAAA;CACjB;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,sBAAsB,GAAG,kBAAkB,CAmDzF"}

package/payload/platform/services/claude-session-manager/dist/public-surface-audit.js

@@ -0,0 +1,110 @@
+// Task 2260 — the transition-only `tool-allowlist` line records the surface a
+// spawn was GIVEN; it cannot see a session already running over-privileged —
+// every session live when the lockdown landed, and any future path that reopens
+// the surface without going through the lockdown. This standing audit closes
+// that gap: it reconciles each live session's classification-sidecar role
+// against the MCP server set its spawn actually realised.
+//
+// The realised set is read from the spawn-tee's own filenames. Every MCP child
+// writes `${LOG_DIR}/mcp-<server>-<sessionId>.log` (platform/lib/mcp-spawn-tee),
+// so a directory listing IS the realised surface — no log tailing, no parsing of
+// server.log.
+//
+// Shape mirrors skill-staleness-audit.ts: PURE parsers, selector and formatters
+// plus an impure factory whose setInterval is unref'd and whose readers are
+// injected.
+const TAG = '[public-surface]';
+/** The channel servers a public session is allowed to hold: the three per-kind
+ *  servers and the unified server a multi-target session registers instead.
+ *  Anything else on a public session is a breach — the visitor's spawn holds a
+ *  server the lockdown should have excluded. */
+export const CHANNEL_SERVER_NAMES = new Set([
+    'channel',
+    'whatsapp-channel',
+    'webchat-channel',
+    'telegram-channel',
+]);
+/** The server name in a spawn-tee log filename for THIS session, else null.
+ *  The filename is `mcp-<server>-<sessionId>.log` and the server name itself
+ *  contains dashes, so the match is anchored on the sessionId suffix rather
+ *  than split on '-'. The sessionless twin (`mcp-<server>-nosession.log`)
+ *  belongs to no session and is never a breach. */
+export function parseMcpLogServerName(filename, sessionId) {
+    const prefix = 'mcp-';
+    const suffix = `-${sessionId}.log`;
+    if (!filename.startsWith(prefix) || !filename.endsWith(suffix))
+        return null;
+    const name = filename.slice(prefix.length, filename.length - suffix.length);
+    return name.length > 0 ? name : null;
+}
+/** Every server on a public session that is not a channel server, deduped and
+ *  sorted so the logged set is stable across ticks. */
+export function selectBreachServers(servers) {
+    return Array.from(new Set(servers.filter((s) => !CHANNEL_SERVER_NAMES.has(s)))).sort();
+}
+/** The every-tick line. Emitted including zero, so a silent audit is
+ *  distinguishable from a healthy one. */
+export function formatPublicSurfaceSummary(p) {
+    return `${TAG} op=audit publicSessions=${p.publicSessions} breaches=${p.breaches}`;
+}
+export function formatPublicSurfaceBreach(p) {
+    return `${TAG} op=breach sessionId=${p.sessionId.slice(0, 8)} servers=${p.servers.join(',')}`;
+}
+export function createPublicSurfaceAudit(deps) {
+    // sessionId -> the breach set already logged, so a steady-state breach logs
+    // once rather than every tick; a changed set re-logs. Pruned when the session
+    // is no longer live or no longer breaching.
+    const loggedBreach = new Map();
+    let timer = null;
+    function tickOnce() {
+        let publicSessions = 0;
+        let breaches = 0;
+        const seen = new Set();
+        for (const s of deps.listSessions()) {
+            if (s.role !== 'public')
+                continue;
+            publicSessions++;
+            seen.add(s.sessionId);
+            const breach = selectBreachServers(deps.serversForSession(s.sessionId));
+            if (breach.length === 0) {
+                loggedBreach.delete(s.sessionId);
+                continue;
+            }
+            breaches++;
+            const key = breach.join(',');
+            if (loggedBreach.get(s.sessionId) === key)
+                continue;
+            deps.logger(formatPublicSurfaceBreach({ sessionId: s.sessionId, servers: breach }));
+            loggedBreach.set(s.sessionId, key);
+        }
+        for (const id of loggedBreach.keys())
+            if (!seen.has(id))
+                loggedBreach.delete(id);
+        deps.logger(formatPublicSurfaceSummary({ publicSessions, breaches }));
+    }
+    return {
+        tickOnce,
+        start() {
+            if (timer)
+                return;
+            timer = setInterval(() => {
+                try {
+                    tickOnce();
+                }
+                catch (err) {
+                    deps.logger(`${TAG} op=audit-tick-failed message=${err instanceof Error ? err.message : String(err)}`);
+                }
+            }, deps.intervalMs);
+            if (typeof timer.unref === 'function')
+                timer.unref();
+            deps.logger(`${TAG} op=audit-started intervalMs=${deps.intervalMs}`);
+        },
+        stop() {
+            if (timer) {
+                clearInterval(timer);
+                timer = null;
+            }
+        },
+    };
+}
+//# sourceMappingURL=public-surface-audit.js.map

package/payload/platform/services/claude-session-manager/dist/public-surface-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-surface-audit.js","sourceRoot":"","sources":["../src/public-surface-audit.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,6EAA6E;AAC7E,gFAAgF;AAChF,6EAA6E;AAC7E,0EAA0E;AAC1E,0DAA0D;AAC1D,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,iFAAiF;AACjF,cAAc;AACd,EAAE;AACF,gFAAgF;AAChF,4EAA4E;AAC5E,YAAY;AAEZ,MAAM,GAAG,GAAG,kBAAkB,CAAA;AAG9B;;;gDAGgD;AAChD,MAAM,CAAC,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IAC/D,SAAS;IACT,kBAAkB;IAClB,iBAAiB;IACjB,kBAAkB;CACnB,CAAC,CAAA;AAEF;;;;mDAImD;AACnD,MAAM,UAAU,qBAAqB,CAAC,QAAgB,EAAE,SAAiB;IACvE,MAAM,MAAM,GAAG,MAAM,CAAA;IACrB,MAAM,MAAM,GAAG,IAAI,SAAS,MAAM,CAAA;IAClC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3E,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3E,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;AACtC,CAAC;AAED;uDACuD;AACvD,MAAM,UAAU,mBAAmB,CAAC,OAA0B;IAC5D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;AACxF,CAAC;AAED;0CAC0C;AAC1C,MAAM,UAAU,0BAA0B,CAAC,CAA+C;IACxF,OAAO,GAAG,GAAG,4BAA4B,CAAC,CAAC,cAAc,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAA;AACpF,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,CAAoD;IAC5F,OAAO,GAAG,GAAG,wBAAwB,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;AAC/F,CAAC;AAkBD,MAAM,UAAU,wBAAwB,CAAC,IAA4B;IACnE,4EAA4E;IAC5E,8EAA8E;IAC9E,4CAA4C;IAC5C,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC9C,IAAI,KAAK,GAA0B,IAAI,CAAA;IAEvC,SAAS,QAAQ;QACf,IAAI,cAAc,GAAG,CAAC,CAAA;QACtB,IAAI,QAAQ,GAAG,CAAC,CAAA;QAChB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;QAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAAE,SAAQ;YACjC,cAAc,EAAE,CAAA;YAChB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;YACrB,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;YACvE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;gBAChC,SAAQ;YACV,CAAC;YACD,QAAQ,EAAE,CAAA;YACV,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC5B,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,GAAG;gBAAE,SAAQ;YACnD,IAAI,CAAC,MAAM,CAAC,yBAAyB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;YACnF,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;QACpC,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,YAAY,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,MAAM,CAAC,0BAA0B,CAAC,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAA;IACvE,CAAC;IAED,OAAO;QACL,QAAQ;QACR,KAAK;YACH,IAAI,KAAK;gBAAE,OAAM;YACjB,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;gBACvB,IAAI,CAAC;oBACH,QAAQ,EAAE,CAAA;gBACZ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;gBACxG,CAAC;YACH,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;YACnB,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAA;YACpD,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,gCAAgC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;QACtE,CAAC;QACD,IAAI;YACF,IAAI,KAAK,EAAE,CAAC;gBACV,aAAa,CAAC,KAAK,CAAC,CAAA;gBACpB,KAAK,GAAG,IAAI,CAAA;YACd,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/payload/platform/services/claude-session-manager/dist/rc-public-lockdown.d.ts

@@ -0,0 +1,36 @@
+/** Task 609 — deny-basis sentinel for a dontAsk spawn whose resolved allowlist
+ *  is otherwise empty. Follows the `mcp__<server>__<tool>` grammar; server
+ *  `none` is never registered in any brand's .mcp.json, so the token matches no
+ *  real tool and grants nothing. It is absent from CC_NATIVE_TOOLS, so an
+ *  allowlist anchored on it stays native-excluding. Its only job is to make
+ *  `--allowed-tools` present and non-empty so dontAsk fails closed. Defined
+ *  here rather than in pty-spawner.ts, where it began, so both spawn paths
+ *  share one definition. */
+export declare const DONTASK_DENY_BASIS = "mcp__none__deny-basis";
+/** The single tool a public rc-spawn may call: the reply tool of whichever
+ *  channel server this spawn registered. Derived rather than hardcoded to
+ *  `whatsapp-channel` because /rc-spawn also serves role:'public' Telegram, and
+ *  a multi-target session registers one unified server named `channel`; naming
+ *  the WhatsApp tool on those spawns would allowlist a tool that is not
+ *  registered and leave the visitor unable to reply at all. */
+export declare function publicReplyToolFor(channelServerName: string | null): string;
+/** The exact argv fragment appended to a role:'public' rc-spawn. Three flags,
+ *  no more: one allowlist entry, `--strict-mcp-config` so only the per-spawn
+ *  channel server registers and none of the plugin servers do, and
+ *  `--permission-mode dontAsk`, which overrides the brand defaultMode and
+ *  auto-denies every unlisted tool including Bash, Write, Edit and Read. */
+export declare function buildRcPublicLockdownArgv(channelServerName: string | null): {
+    argv: string[];
+    allowedTools: string[];
+};
+/** The realised-surface line, emitted at spawn time on EVERY rc-spawn. Shares
+ *  the `tool-allowlist` tag with pty-spawner.ts so one grep covers both spawn
+ *  paths. Its absence on /rc-spawn is why the incident session was invisible to
+ *  every tool-surface audit. */
+export declare function formatToolAllowlistLine(p: {
+    role: string;
+    count: number;
+    strictMcp: boolean;
+    mode: string;
+}): string;
+//# sourceMappingURL=rc-public-lockdown.d.ts.map

package/payload/platform/services/claude-session-manager/dist/rc-public-lockdown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rc-public-lockdown.d.ts","sourceRoot":"","sources":["../src/rc-public-lockdown.ts"],"names":[],"mappings":"AAYA;;;;;;;4BAO4B;AAC5B,eAAO,MAAM,kBAAkB,0BAA0B,CAAA;AAEzD;;;;;+DAK+D;AAC/D,wBAAgB,kBAAkB,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAE3E;AAED;;;;4EAI4E;AAC5E,wBAAgB,yBAAyB,CACvC,iBAAiB,EAAE,MAAM,GAAG,IAAI,GAC/B;IAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,CAM5C;AAED;;;gCAGgC;AAChC,wBAAgB,uBAAuB,CAAC,CAAC,EAAE;IACzC,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,OAAO,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,MAAM,CAET"}

package/payload/platform/services/claude-session-manager/dist/rc-public-lockdown.js

@@ -0,0 +1,49 @@
+// Task 2260 — the public lockdown for POST /rc-spawn. `/rc-spawn` read `role`
+// and wrote it to the classification sidecar but constrained nothing: it pushed
+// `--allowed-tools` zero times, passed no `--strict-mcp-config` and no
+// `--permission-mode`, so a role:'public' WhatsApp visitor resolved the brand
+// `permissions.defaultMode` (bypassPermissions) with all 23 plugin MCP servers
+// registered. The lockdown that existed was on the other path (pty-spawner.ts,
+// serving /public-spawn), which WhatsApp never takes: server/index.ts calls
+// managerRcSpawn for every non-passive inbound, admin and public alike.
+//
+// Pure (no fs, no node-pty) so it unit-tests in isolation and so pty-spawner.ts
+// can import the shared deny-basis token without a cycle.
+/** Task 609 — deny-basis sentinel for a dontAsk spawn whose resolved allowlist
+ *  is otherwise empty. Follows the `mcp__<server>__<tool>` grammar; server
+ *  `none` is never registered in any brand's .mcp.json, so the token matches no
+ *  real tool and grants nothing. It is absent from CC_NATIVE_TOOLS, so an
+ *  allowlist anchored on it stays native-excluding. Its only job is to make
+ *  `--allowed-tools` present and non-empty so dontAsk fails closed. Defined
+ *  here rather than in pty-spawner.ts, where it began, so both spawn paths
+ *  share one definition. */
+export const DONTASK_DENY_BASIS = 'mcp__none__deny-basis';
+/** The single tool a public rc-spawn may call: the reply tool of whichever
+ *  channel server this spawn registered. Derived rather than hardcoded to
+ *  `whatsapp-channel` because /rc-spawn also serves role:'public' Telegram, and
+ *  a multi-target session registers one unified server named `channel`; naming
+ *  the WhatsApp tool on those spawns would allowlist a tool that is not
+ *  registered and leave the visitor unable to reply at all. */
+export function publicReplyToolFor(channelServerName) {
+    return channelServerName ? `mcp__${channelServerName}__reply` : DONTASK_DENY_BASIS;
+}
+/** The exact argv fragment appended to a role:'public' rc-spawn. Three flags,
+ *  no more: one allowlist entry, `--strict-mcp-config` so only the per-spawn
+ *  channel server registers and none of the plugin servers do, and
+ *  `--permission-mode dontAsk`, which overrides the brand defaultMode and
+ *  auto-denies every unlisted tool including Bash, Write, Edit and Read. */
+export function buildRcPublicLockdownArgv(channelServerName) {
+    const tool = publicReplyToolFor(channelServerName);
+    return {
+        argv: ['--allowed-tools', tool, '--strict-mcp-config', '--permission-mode', 'dontAsk'],
+        allowedTools: [tool],
+    };
+}
+/** The realised-surface line, emitted at spawn time on EVERY rc-spawn. Shares
+ *  the `tool-allowlist` tag with pty-spawner.ts so one grep covers both spawn
+ *  paths. Its absence on /rc-spawn is why the incident session was invisible to
+ *  every tool-surface audit. */
+export function formatToolAllowlistLine(p) {
+    return `tool-allowlist role=${p.role} count=${p.count} strictMcp=${p.strictMcp ? 'y' : 'n'} mode=${p.mode}`;
+}
+//# sourceMappingURL=rc-public-lockdown.js.map

package/payload/platform/services/claude-session-manager/dist/rc-public-lockdown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rc-public-lockdown.js","sourceRoot":"","sources":["../src/rc-public-lockdown.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,gFAAgF;AAChF,uEAAuE;AACvE,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AACxE,EAAE;AACF,gFAAgF;AAChF,0DAA0D;AAE1D;;;;;;;4BAO4B;AAC5B,MAAM,CAAC,MAAM,kBAAkB,GAAG,uBAAuB,CAAA;AAEzD;;;;;+DAK+D;AAC/D,MAAM,UAAU,kBAAkB,CAAC,iBAAgC;IACjE,OAAO,iBAAiB,CAAC,CAAC,CAAC,QAAQ,iBAAiB,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAA;AACpF,CAAC;AAED;;;;4EAI4E;AAC5E,MAAM,UAAU,yBAAyB,CACvC,iBAAgC;IAEhC,MAAM,IAAI,GAAG,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAClD,OAAO;QACL,IAAI,EAAE,CAAC,iBAAiB,EAAE,IAAI,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,SAAS,CAAC;QACtF,YAAY,EAAE,CAAC,IAAI,CAAC;KACrB,CAAA;AACH,CAAC;AAED;;;gCAGgC;AAChC,MAAM,UAAU,uBAAuB,CAAC,CAKvC;IACC,OAAO,uBAAuB,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAA;AAC7G,CAAC"}

package/payload/server/{chunk-4QCYFTAI.js → chunk-44Z4ZFYS.js}

@@ -28,6 +28,7 @@ var WhatsAppAccountSchema = z.object({
   }).strict().optional().describe("React to incoming messages with an emoji to acknowledge receipt before the agent responds."),
   debounceMs: z.number().int().nonnegative().optional().default(2e3).describe("Wait this many milliseconds after the last message before processing, to batch rapid multi-message input into a single agent turn. Default 2000ms catches most multi-message bursts. 0 means process each message immediately."),
   publicAgent: z.string().optional().describe("Slug of the public agent that handles WhatsApp inbound from non-admin phones for this account. Overrides the top-level publicAgent when set."),
+  publicAgentEnabled: z.boolean().optional().describe("When true, WhatsApp inbound from non-admin phones for this account is answered by the resolved public agent. When false (the default), a public inbound notifies the account managers and spawns nothing \u2014 the visitor receives no reply. Overrides the top-level publicAgentEnabled when set."),
   afterHoursMessage: z.string().optional().describe("Auto-reply text sent to public senders when the business is closed (outside opening hours). If not set, messages received outside business hours are silently skipped with no reply."),
   dispatchInbound: z.boolean().optional().describe("When false, this account's WhatsApp socket only observes: inbound is stored and readable but never dispatched to an agent. Default true. Set with set-dispatch-inbound.")
 }).strict().superRefine((value, ctx) => {
@@ -75,6 +76,7 @@ var WhatsAppConfigSchema = z.object({
   textChunkLimit: z.number().int().positive().optional().default(4e3).describe("Maximum characters per outbound message. Longer replies are split into multiple messages."),
   debounceMs: z.number().int().nonnegative().optional().default(2e3).describe("Wait this many milliseconds after the last message before processing, to batch rapid multi-message input into a single agent turn. Default 2000ms catches most multi-message bursts. 0 means process each message immediately."),
   publicAgent: z.string().optional().describe("Slug of the public agent that handles WhatsApp inbound from non-admin phones. Per-account overrides take precedence."),
+  publicAgentEnabled: z.boolean().optional().describe("Default for whether WhatsApp inbound from non-admin phones is answered by the resolved public agent. False by default. Per-account overrides take precedence."),
   afterHoursMessage: z.string().optional().describe("Default auto-reply text sent to public senders when the business is closed (outside opening hours). Per-account overrides take precedence. If not set, messages received outside business hours are silently skipped.")
 }).strict().superRefine((value, ctx) => {
   if (value.dmPolicy !== "open") return;

package/payload/server/{chunk-DLG7XSLA.js → chunk-IALJPXIO.js}

@@ -4098,7 +4098,13 @@ var CLIENT_SCREENCAST_OPS = [
   "send-failed",
   "frame",
   "input",
-  "teardown"
+  "teardown",
+  // Task 2264 — the chrome's own ops. They belong on this side of the allowlist
+  // because each is an action the browser observes itself taking, not a decision
+  // the server made; admitting them cannot let a client forge a security line.
+  "navigate",
+  "history",
+  "chrome-mounted"
 ];
 function isClientScreencastOp(v) {
   return typeof v === "string" && CLIENT_SCREENCAST_OPS.includes(v);
@@ -4219,7 +4225,16 @@ var EVENT_DETAIL_KEYS = [
   "stopSent",
   "ackMs",
   "err",
-  "method"
+  "method",
+  // Task 2264 — `host` is the navigate target's HOST ONLY. A full URL is the
+  // operator's private browsing and server.log is not the place for it, which is
+  // why the client sends the host rather than the log line truncating one.
+  // `surface` and `chrome` carry the mount marker that detects a stale bundle.
+  "host",
+  "dir",
+  "outcome",
+  "surface",
+  "chrome"
 ];
 var DETAIL_MAX_LEN = 128;
 function parseScreencastEvent(body) {
@@ -4282,6 +4297,55 @@ function parseOriginHost(origin) {
     return null;
   }
 }
+function tabsLog(op, fields = {}) {
+  const rendered = renderFields(fields);
+  console.error(`[admin/browser/tabs] op=${sanitizeLogValue(op)}${rendered ? " " + rendered : ""}`);
+}
+async function createPageTarget(deps) {
+  if (deps.platform !== "linux") {
+    return { ok: false, status: 501, error: "The device browser is available on the Linux display stack only." };
+  }
+  let res;
+  try {
+    res = await deps.fetchImpl(`http://127.0.0.1:${deps.cdpPort}/json/new`, {
+      method: "PUT",
+      signal: AbortSignal.timeout(5e3)
+    });
+  } catch {
+    return { ok: false, status: 502, error: "Chromium is not reachable on this device." };
+  }
+  if (!res.ok) return { ok: false, status: 502, error: `CDP /json/new returned ${res.status}` };
+  let parsed;
+  try {
+    parsed = await res.json();
+  } catch {
+    return { ok: false, status: 502, error: "CDP /json/new response was not JSON." };
+  }
+  const id = typeof parsed.id === "string" ? parsed.id : "";
+  if (!TARGET_ID_RE.test(id)) {
+    return { ok: false, status: 502, error: "CDP /json/new returned no usable target id." };
+  }
+  return { ok: true, id };
+}
+async function closePageTarget(deps, targetId) {
+  if (deps.platform !== "linux") {
+    return { ok: false, status: 501, error: "The device browser is available on the Linux display stack only." };
+  }
+  if (!TARGET_ID_RE.test(targetId)) {
+    return { ok: false, status: 400, error: "Not a target id." };
+  }
+  let res;
+  try {
+    res = await deps.fetchImpl(`http://127.0.0.1:${deps.cdpPort}/json/close/${targetId}`, {
+      method: "PUT",
+      signal: AbortSignal.timeout(5e3)
+    });
+  } catch {
+    return { ok: false, status: 502, error: "Chromium is not reachable on this device." };
+  }
+  if (!res.ok) return { ok: false, status: 502, error: `CDP /json/close returned ${res.status}` };
+  return { ok: true };
+}
 
 export {
   HTTPException,
@@ -4352,5 +4416,8 @@ export {
   fetchPageTargets,
   parseScreencastEvent,
   screencastLog,
-  cdpWsCensusLog
+  cdpWsCensusLog,
+  tabsLog,
+  createPageTarget,
+  closePageTarget
 };

package/payload/server/{manager-ZNHQQCED.js → manager-AJSPM6X2.js}

@@ -30,7 +30,7 @@ import {
   startConnection,
   stopConnection,
   storeMessage
-} from "./chunk-4QCYFTAI.js";
+} from "./chunk-44Z4ZFYS.js";
 import "./chunk-BP7LH7MC.js";
 import "./chunk-PFF6I7KP.js";
 export {

package/payload/server/maxy-edge.js

@@ -19,7 +19,7 @@ import {
   screencastLog,
   vncLog,
   websockifyLog
-} from "./chunk-DLG7XSLA.js";
+} from "./chunk-IALJPXIO.js";
 import {
   CDP_PORT,
   LOG_DIR,

package/payload/server/public/activity.html

@@ -5,12 +5,12 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>Activity — Maxy</title>
   <link rel="icon" href="/favicon.ico">
-  <script type="module" crossorigin src="/assets/activity-DKeRUjQ9.js"></script>
+  <script type="module" crossorigin src="/assets/activity-BH65sm9Q.js"></script>
   <link rel="modulepreload" crossorigin href="/assets/chunk-CltuBf4Z.js">
-  <link rel="modulepreload" crossorigin href="/assets/useSubAccountSwitcher-D1VtIEp2.js">
-  <link rel="modulepreload" crossorigin href="/assets/AdminShell-B6H3J5C2.js">
-  <link rel="modulepreload" crossorigin href="/assets/triangle-alert-CuRAK3jk.js">
-  <link rel="stylesheet" crossorigin href="/assets/useSubAccountSwitcher-BDQ8Wsdt.css">
+  <link rel="modulepreload" crossorigin href="/assets/useSubAccountSwitcher-UMg53kKF.js">
+  <link rel="modulepreload" crossorigin href="/assets/AdminShell-7l3ubYFZ.js">
+  <link rel="modulepreload" crossorigin href="/assets/triangle-alert-CjsLPsBD.js">
+  <link rel="stylesheet" crossorigin href="/assets/useSubAccountSwitcher-D8jXV7R5.css">
   <link rel="stylesheet" href="/brand-defaults.css">
 </head>
 <body>

package/payload/server/public/agents.html

@@ -5,11 +5,11 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>Agents — Maxy</title>
   <link rel="icon" href="/favicon.ico">
-  <script type="module" crossorigin src="/assets/agents-CrR_OMe8.js"></script>
+  <script type="module" crossorigin src="/assets/agents-CjhOWwl5.js"></script>
   <link rel="modulepreload" crossorigin href="/assets/chunk-CltuBf4Z.js">
-  <link rel="modulepreload" crossorigin href="/assets/useSubAccountSwitcher-D1VtIEp2.js">
-  <link rel="modulepreload" crossorigin href="/assets/AdminShell-B6H3J5C2.js">
-  <link rel="stylesheet" crossorigin href="/assets/useSubAccountSwitcher-BDQ8Wsdt.css">
+  <link rel="modulepreload" crossorigin href="/assets/useSubAccountSwitcher-UMg53kKF.js">
+  <link rel="modulepreload" crossorigin href="/assets/AdminShell-7l3ubYFZ.js">
+  <link rel="stylesheet" crossorigin href="/assets/useSubAccountSwitcher-D8jXV7R5.css">
   <link rel="stylesheet" href="/brand-defaults.css">
 </head>
 <body>

package/payload/server/public/assets/AdminLoginScreens-CYFf2awh.js

@@ -0,0 +1 @@
+import{o as e}from"./chunk-CltuBf4Z.js";import{B as t,H as n,K as r,W as i,X as a,_ as o}from"./useSubAccountSwitcher-UMg53kKF.js";import{k as s}from"./useVoiceRecorder-tzfqfXni.js";import{D as c,O as l,k as u,m as d}from"./AdminShell-7l3ubYFZ.js";var f=e(a(),1);function p(e=`admin`){let[t,n]=(0,f.useState)(`loading`),[i,a]=(0,f.useState)(``),[o,c]=(0,f.useState)(``),[l,d]=(0,f.useState)(``),[p,m]=(0,f.useState)(!1),[h,g]=(0,f.useState)(!1),[_,v]=(0,f.useState)(!1),[y,b]=(0,f.useState)(!1),[x,S]=(0,f.useState)(!1),[C,w]=(0,f.useState)(null),[T,E]=(0,f.useState)(null),[D,O]=(0,f.useState)(void 0),[k,A]=(0,f.useState)(null),[j,M]=(0,f.useState)(void 0),[N,P]=(0,f.useState)(null),[F,I]=(0,f.useState)(null),[L,R]=(0,f.useState)(void 0),z=(0,f.useRef)(void 0),[B,V]=(0,f.useState)(!1),[H,U]=(0,f.useState)(!0);(0,f.useEffect)(()=>{typeof window>`u`||fetch(`/api/remote-auth/status`).then(e=>e.ok?e.json():null).then(e=>{e?.configured&&V(!0)}).catch(()=>{})},[]);let W=(0,f.useRef)(null),G=(0,f.useRef)(null);(0,f.useEffect)(()=>{async function e(){let e=null;try{e=sessionStorage.getItem(`maxy-admin-session-key`)}catch{}if(!e)return!1;try{let t=await fetch(`/api/admin/session?session_key=${encodeURIComponent(e)}`);if(t.status===401){try{sessionStorage.removeItem(`maxy-admin-session-key`)}catch{}return!1}if(!t.ok)return!1;let r=await t.json();w(r.session_key),I(r.sessionId??null),O(r.businessName),A(r.role??null),M(r.userName===void 0?null:r.userName),P(r.avatar??null);let i=s(r.thinkingView);return z.current=i,R(i),n(`chat`),!0}catch(e){return console.error(`[admin] session restore failed:`,e),!1}}async function t(r=2){try{let i=await fetch(`/api/health`);if(!i.ok){if(r>0)return await new Promise(e=>setTimeout(e,1500)),t(r-1);console.error(`[admin] health check returned ${i.status} after retries`),n(`set-pin`);return}let a=await i.json();if(!a.pin_configured){n(`set-pin`);return}U(!!a.claude_authenticated);let o=!1;try{o=new URLSearchParams(window.location.search).get(`connect`)===`claude`}catch{}if(o){try{let e=new URL(window.location.href);e.searchParams.delete(`connect`),window.history.replaceState(null,``,e.pathname+e.search+e.hash)}catch{}if(!a.claude_authenticated){n(`connect-claude`);return}}if(await e())return;n(`enter-pin`)}catch(e){if(r>0)return await new Promise(e=>setTimeout(e,1500)),t(r-1);console.error(`[admin] health check failed:`,e),n(`set-pin`)}}t()},[]),(0,f.useEffect)(()=>{t===`chat`&&C&&fetch(`/api/admin/claude-info?session_key=${encodeURIComponent(C)}`).then(e=>{if(e.ok)return e.json()}).then(e=>{e&&E(e)}).catch(()=>{})},[t,C]);let K=(0,f.useRef)(null);(0,f.useEffect)(()=>{if(t!==`chat`)return;let e=setInterval(async()=>{try{let e=await fetch(`/api/health`);if(e.ok){let t=await e.json();U(t.auth_status!==`dead`&&t.auth_status!==`missing`)}}catch{}if(C)try{let e=await fetch(`/api/admin/session?session_key=${encodeURIComponent(C)}`);if(e.status!==401)return;let t=(await e.clone().json().catch(()=>null))?.code??`unknown-401`;if(t===`remote-auth-required`){r(`heartbeat`,`/api/admin/session`);return}console.warn(`[admin-auth] outcome=heartbeat-detected-expiry code=${t}`),K.current?.()}catch{}},300*1e3);return()=>clearInterval(e)},[t,C]),(0,f.useEffect)(()=>{t===`connect-claude`&&fetch(`/api/health`).then(e=>e.ok?e.json():null).then(e=>{e?.claude_authenticated&&(U(!0),n(`enter-pin`))}).catch(()=>{})},[t]);async function q(e,t){g(!0);try{let i=await fetch(`/api/admin/session`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({pin:e,...t?{accountId:t}:{}})});if(!i.ok){let e=await i.json().catch(()=>({}));if(i.status===401&&e?.code===`remote-auth-required`){r(`enter-pin`,`/api/admin/session`);return}d(e.error||`Invalid PIN`);return}let o=await i.json();w(o.session_key),I(o.sessionId??null),O(o.businessName),A(o.role??null),M(o.userName===void 0?null:o.userName),P(o.avatar??null);let c=s(o.thinkingView);z.current=c,R(c);try{sessionStorage.setItem(`maxy-admin-session-key`,o.session_key)}catch{}a(``),n(`chat`)}catch(e){console.error(`[admin] connection error:`,e),d(`Could not connect.`)}finally{g(!1)}}let J=(0,f.useCallback)(async e=>{if(e.preventDefault(),h)return;d(``);let t=o.trim();if(!t){d(`Please enter your name.`);return}if(i.length<4){d(`PIN must be at least 4 characters.`);return}let s=i;g(!0);try{let e=await fetch(`/api/onboarding/set-pin`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({pin:s,name:t})});if(!e.ok){let t=await e.json().catch(()=>({}));if(e.status===401&&t?.code===`remote-auth-required`){r(`set-pin`,`/api/onboarding/set-pin`);return}if(e.status===409){try{let e=await fetch(`/api/health`);if(e.ok){let r=await e.json();r.pin_configured&&r.claude_authenticated?n(`enter-pin`):r.pin_configured?n(`connect-claude`):d(t.error||`Failed to set PIN.`)}else n(`enter-pin`)}catch{n(`enter-pin`)}return}d(t.error||`Failed to set PIN.`);return}let i=await fetch(`/api/health`);if((i.ok?await i.json():null)?.claude_authenticated){await q(s);return}a(``),n(`connect-claude`)}catch(e){console.error(`[admin] connection error:`,e),d(`Could not connect.`)}finally{g(!1)}},[i,h,o]),Y=(0,f.useCallback)(async e=>{e.preventDefault(),d(``),await q(i)},[i]),X=(0,f.useCallback)(async()=>{S(!0);try{if(!await u())return console.warn(`[admin-ui] claude-disconnect not verified — credentials may persist; staying put`),!1;U(!1),w(null),A(null),M(void 0),P(null);try{sessionStorage.removeItem(`maxy-admin-session-key`)}catch{}return n(`connect-claude`),!0}finally{S(!1)}},[]),Z=(0,f.useCallback)(()=>{w(null),A(null),M(void 0),P(null);try{sessionStorage.removeItem(`maxy-admin-session-key`)}catch{}a(``),d(``),n(`enter-pin`)},[]);return(0,f.useEffect)(()=>{K.current=Z},[Z]),{appState:t,setAppState:n,pin:i,setPin:a,operatorName:o,setOperatorName:c,pinError:l,setPinError:d,showPin:p,setShowPin:m,pinLoading:h,authPolling:_,setAuthPolling:v,authLoading:y,setAuthLoading:b,disconnecting:x,cacheKey:C,setCacheKey:w,claudeInfo:T,setClaudeInfo:E,businessName:D,role:k,userName:j,userAvatar:N,sessionId:F,setSessionId:I,expandAll:L,setExpandAll:R,expandAllDefaultRef:z,remoteAuthEnabled:B,claudeConnected:H,pinInputRef:W,setPinFormRef:G,handleSetPin:J,handleLogin:Y,handleDisconnect:X,handleLogout:Z}}var m=i();function h({inputRef:e,value:t,onChange:n,onComplete:r,showPin:i,autoFocus:a}){let o=(0,f.useRef)([]);function s(e,r){r.key===`Backspace`?(r.preventDefault(),t[e]?n(t.slice(0,e)+t.slice(e+1)):e>0&&(n(t.slice(0,e-1)+t.slice(e)),o.current[e-1]?.focus())):r.key===`ArrowLeft`&&e>0?o.current[e-1]?.focus():r.key===`ArrowRight`&&e<5?o.current[e+1]?.focus():r.key===`Enter`&&(r.preventDefault(),r.currentTarget.form?.requestSubmit())}function c(e,i){let a=i.nativeEvent.data;if(!a||!/^\d$/.test(a))return;let s=t.split(``);for(s[e]=a;s.length<e;)s.push(``);let c=s.join(``).replace(/\D/g,``).slice(0,6);n(c),c.length===6?r?.(c):e<5&&o.current[e+1]?.focus()}function l(e){e.preventDefault();let t=e.clipboardData.getData(`text`).replace(/\D/g,``).slice(0,6);t&&(n(t),t.length===6?r?.(t):o.current[t.length]?.focus())}return(0,m.jsx)(`div`,{className:`pin-field`,children:Array.from({length:6}).map((n,r)=>(0,m.jsx)(`input`,{ref:t=>{o.current[r]=t,r===0&&e&&(e.current=t)},type:`text`,inputMode:`numeric`,className:`pin-box${t[r]?` pin-box-filled`:``}`,value:t[r]?i?t[r]:`•`:``,onKeyDown:e=>s(r,e),onInput:e=>c(r,e),onPaste:l,onFocus:e=>e.target.select(),autoFocus:a&&r===0,autoComplete:`off`,maxLength:1,"aria-label":`PIN digit ${r+1}`},r))})}function g(e){let{pin:r,setPin:i,showPin:a,setShowPin:o,pinLoading:s,pinError:u,pinInputRef:d,setPinFormRef:f,onSubmit:p,operatorName:g,setOperatorName:_}=e;return(0,m.jsx)(`div`,{className:`connect-page`,children:(0,m.jsxs)(`div`,{className:`connect-content`,children:[(0,m.jsx)(`img`,{src:n,alt:t.productName,className:`connect-logo connect-logo--maxy`}),!t.logoContainsName&&(0,m.jsxs)(`h1`,{className:`connect-title`,children:[`Welcome to `,t.productName]}),(0,m.jsxs)(`p`,{className:`connect-subtitle`,children:[`Tell `,t.productName,` who you are, then choose a PIN.`]}),(0,m.jsxs)(`form`,{ref:f,onSubmit:p,className:`connect-pin-form`,children:[(0,m.jsxs)(`div`,{className:`pin-input-row`,children:[(0,m.jsx)(`input`,{type:`text`,className:`connect-name-input`,placeholder:`Your full name`,value:g,onChange:e=>_(e.target.value),autoComplete:`name`,autoFocus:!0,required:!0,"aria-label":`Your full name`}),(0,m.jsx)(`div`,{style:{width:38,flexShrink:0},"aria-hidden":`true`})]}),(0,m.jsxs)(`div`,{className:`pin-input-row`,children:[(0,m.jsx)(h,{inputRef:d,value:r,onChange:i,onComplete:()=>{},showPin:a}),(0,m.jsx)(c,{variant:`send`,type:`submit`,disabled:!r||!g.trim(),loading:s,"aria-label":`Set PIN`,children:(0,m.jsxs)(`svg`,{viewBox:`0 0 24 24`,fill:`none`,stroke:`currentColor`,strokeWidth:`2`,strokeLinecap:`round`,strokeLinejoin:`round`,children:[(0,m.jsx)(`line`,{x1:`5`,y1:`12`,x2:`19`,y2:`12`}),(0,m.jsx)(`polyline`,{points:`12 5 19 12 12 19`})]})})]}),(0,m.jsx)(l,{checked:a,onChange:()=>o(e=>!e),label:`Show PIN`})]}),u&&(0,m.jsx)(`p`,{className:`admin-pin-error`,children:u})]})})}function _(e){let{pin:r,setPin:i,showPin:a,setShowPin:o,pinLoading:s,pinError:u,pinInputRef:d,onSubmit:f,remoteAuthEnabled:p,onSignOutRemote:g}=e;return(0,m.jsxs)(`div`,{className:`connect-page`,children:[p&&g&&(0,m.jsx)(`button`,{type:`button`,className:`connect-signout`,onClick:g,children:`Sign out`}),(0,m.jsxs)(`div`,{className:`connect-content`,children:[(0,m.jsx)(`img`,{src:n,alt:t.productName,className:`connect-logo connect-logo--maxy`}),!t.logoContainsName&&(0,m.jsx)(`h1`,{className:`connect-title`,children:t.productName}),(0,m.jsxs)(`form`,{onSubmit:f,className:`connect-pin-form`,children:[(0,m.jsxs)(`div`,{className:`pin-input-row`,children:[(0,m.jsx)(h,{inputRef:d,value:r,onChange:i,onComplete:()=>{},showPin:a,autoFocus:!0}),(0,m.jsx)(c,{variant:`send`,type:`submit`,disabled:!r,loading:s,children:(0,m.jsxs)(`svg`,{viewBox:`0 0 24 24`,fill:`none`,stroke:`currentColor`,strokeWidth:`2`,strokeLinecap:`round`,strokeLinejoin:`round`,children:[(0,m.jsx)(`line`,{x1:`5`,y1:`12`,x2:`19`,y2:`12`}),(0,m.jsx)(`polyline`,{points:`12 5 19 12 12 19`})]})})]}),(0,m.jsx)(`div`,{className:`pin-options`,children:(0,m.jsx)(l,{checked:a,onChange:()=>o(e=>!e),label:`Show PIN`})})]}),u&&(0,m.jsx)(`p`,{className:`admin-pin-error`,children:u})]})]})}function v(e){let{authPolling:r,setAuthPolling:i,authLoading:a,setAuthLoading:o,pinError:s,setPinError:l,setAppState:u}=e,[p,h]=(0,f.useState)(!1),[g,_]=(0,f.useState)(!1),[v,y]=(0,f.useState)(``),[b,x]=(0,f.useState)(``),[S,C]=(0,f.useState)(``),[w,T]=(0,f.useState)(null),[E,D]=(0,f.useState)(null),[O,k]=(0,f.useState)(!1);(0,f.useEffect)(()=>{try{D(sessionStorage.getItem(`maxy-admin-session-key`))}catch{}k(!0)},[]);async function A(){C(``);try{let e=await(await fetch(`/api/onboarding/claude-auth`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({action:`paste-code`,code:b})})).json();e.accepted?(C(`Code submitted. Finishing sign-in…`),x(``)):C(e.error||`Could not submit code.`)}catch(e){console.error(`[admin] paste-code error:`,e),C(`Could not submit code.`)}}async function j(){_(!0),l(``);try{let e=await(await fetch(`/api/onboarding/claude-auth`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({action:`launch-browser`})})).json();e.launched?h(!0):e.error&&l(e.error)}catch(e){console.error(`[admin] browser launch error:`,e),l(`Could not launch browser.`)}_(!1)}async function M(){o(!0),l(``);try{let e=await(await fetch(`/api/onboarding/claude-auth`,{method:`POST`})).json();if(e.started){i(!0),h(!0),o(!1),y(e.transport||``);for(let e=0;e<120;e++){await new Promise(e=>setTimeout(e,2e3));let e=await(await fetch(`/api/onboarding/claude-auth`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({action:`wait`})})).json();if(typeof e.authTargetId==`string`&&T(e.authTargetId),e.authenticated){await fetch(`/api/onboarding/claude-auth`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({action:`stop`})}),u(`enter-pin`);return}}l(`Timed out waiting for sign-in. Try again.`),i(!1)}else e.error&&l(e.error)}catch(e){console.error(`[admin] auth flow error:`,e),l(`Could not start auth flow.`)}o(!1)}async function N(){await fetch(`/api/onboarding/claude-auth`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({action:`stop`})}),i(!1),l(``)}return r||p?(0,m.jsxs)(`div`,{style:{display:`flex`,flexDirection:`column`,height:`100dvh`,overflow:`auto`},children:[(0,m.jsxs)(`header`,{className:`chat-header`,style:{paddingBottom:`12px`,flexShrink:0,position:`relative`,maxWidth:`680px`,width:`100%`,margin:`0 auto`,padding:`24px 20px 12px`},children:[r?(0,m.jsx)(`button`,{onClick:N,style:{position:`absolute`,top:`12px`,right:`12px`,background:`none`,border:`none`,color:`#999`,fontSize:`13px`,cursor:`pointer`,padding:`4px 8px`},"aria-label":`Cancel`,children:`✕`}):(0,m.jsx)(`button`,{onClick:()=>h(!1),style:{position:`absolute`,top:`12px`,right:`12px`,background:`none`,border:`none`,color:`#999`,fontSize:`13px`,cursor:`pointer`,padding:`4px 8px`},"aria-label":`Close browser`,children:`✕`}),(0,m.jsx)(`img`,{src:`/brand/claude.png`,alt:`Claude`,className:`chat-logo`}),(0,m.jsx)(`h1`,{className:`chat-tagline`,children:`Connect Claude`}),(0,m.jsx)(`p`,{className:`chat-intro`,children:r?`Sign in and authorize in the browser below.`:`Open your email or prepare your accounts, then sign in.`}),!r&&(0,m.jsx)(`div`,{style:{marginTop:`12px`},children:(0,m.jsx)(c,{variant:`primary`,onClick:M,disabled:a,children:a?(0,m.jsxs)(m.Fragment,{children:[(0,m.jsx)(`span`,{className:`spin`,style:{display:`inline-block`},children:`✱`}),` Connecting…`]}):`Sign in to Claude`})}),r&&v===`native`&&(0,m.jsxs)(`div`,{style:{marginTop:`14px`,maxWidth:`420px`,margin:`14px auto 0`,display:`flex`,flexDirection:`column`,gap:`8px`},children:[(0,m.jsx)(`label`,{style:{fontSize:`12px`,color:`#999`,lineHeight:1.4},children:`If the browser didn't finish sign-in, paste the code or full redirect URL from Claude's page:`}),(0,m.jsxs)(`div`,{style:{display:`flex`,gap:`8px`},children:[(0,m.jsx)(`input`,{type:`text`,value:b,onChange:e=>x(e.target.value),placeholder:`Paste code or redirect URL`,style:{flex:1,padding:`8px 10px`,fontSize:`13px`,border:`1px solid #ccc`,borderRadius:`6px`}}),(0,m.jsx)(c,{variant:`primary`,onClick:A,disabled:!b.trim(),children:`Submit`})]}),S&&(0,m.jsx)(`p`,{style:{fontSize:`12px`,color:`#999`,margin:0},children:S})]})]}),(0,m.jsx)(`div`,{style:{flex:1,display:`flex`,flexDirection:`column`,minHeight:0,gap:`10px`,padding:`0 0 16px`},children:O&&(0,m.jsx)(d,{preferTargetId:w,cacheKey:E,chrome:!1})}),s&&(0,m.jsx)(`p`,{className:`admin-pin-error`,style:{textAlign:`center`,padding:`0 20px 16px`},children:s})]}):(0,m.jsx)(`div`,{className:`connect-page`,children:(0,m.jsxs)(`div`,{className:`connect-content`,children:[(0,m.jsxs)(`div`,{className:`connect-logos`,children:[(0,m.jsx)(`div`,{className:`connect-logo-wrap`,children:(0,m.jsx)(`img`,{src:`/brand/claude.png`,alt:`Claude`,className:`connect-logo`})}),(0,m.jsx)(`svg`,{className:`connect-arrow`,viewBox:`0 0 48 24`,fill:`none`,xmlns:`http://www.w3.org/2000/svg`,children:(0,m.jsx)(`path`,{d:`M0 12h44m0 0l-8-8m8 8l-8 8`,stroke:`currentColor`,strokeWidth:`2`,strokeLinecap:`round`,strokeLinejoin:`round`})}),(0,m.jsxs)(`div`,{className:`connect-logo-wrap`,children:[(0,m.jsx)(`img`,{src:n,alt:t.productName,className:`connect-logo connect-logo--maxy`}),!t.logoContainsName&&(0,m.jsx)(`span`,{className:`connect-logo-label`,children:t.productName})]})]}),(0,m.jsxs)(`h1`,{className:`connect-title`,children:[`Connect Claude to power `,t.productName]}),(0,m.jsx)(`p`,{className:`connect-subtitle`,children:`Sign in with your Anthropic account to get started.`}),(0,m.jsx)(c,{variant:`primary`,onClick:M,disabled:a,children:a?(0,m.jsxs)(m.Fragment,{children:[(0,m.jsx)(`span`,{className:`spin`,style:{display:`inline-block`},children:`✱`}),` Connecting…`]}):`Sign in to Claude`}),(0,m.jsx)(`p`,{style:{marginTop:`6px`,fontSize:`11px`,color:`#999`,maxWidth:`300px`,textAlign:`center`,lineHeight:`1.4`},children:`First time? You may need to sign into your email and Anthropic account in the browser before connecting.`}),(0,m.jsx)(`button`,{onClick:j,disabled:g,style:{marginTop:`12px`,background:`none`,border:`none`,color:`var(--color-primary, #666)`,fontSize:`13px`,cursor:`pointer`,textDecoration:`underline`,textUnderlineOffset:`3px`},children:g?`Launching…`:`Open browser first`}),s&&(0,m.jsx)(`p`,{className:`admin-pin-error`,children:s})]})})}function y({auth:e}){return e.appState===`loading`?(0,m.jsx)(o,{surface:`gate`}):e.appState===`set-pin`?(0,m.jsx)(g,{pin:e.pin,setPin:e.setPin,showPin:e.showPin,setShowPin:e.setShowPin,pinLoading:e.pinLoading,pinError:e.pinError,pinInputRef:e.pinInputRef,setPinFormRef:e.setPinFormRef,onSubmit:e.handleSetPin,operatorName:e.operatorName,setOperatorName:e.setOperatorName}):e.appState===`connect-claude`?(0,m.jsx)(v,{authPolling:e.authPolling,setAuthPolling:e.setAuthPolling,authLoading:e.authLoading,setAuthLoading:e.setAuthLoading,pinError:e.pinError,setPinError:e.setPinError,setAppState:e.setAppState}):e.appState===`enter-pin`?(0,m.jsx)(_,{pin:e.pin,setPin:e.setPin,showPin:e.showPin,setShowPin:e.setShowPin,pinLoading:e.pinLoading,pinError:e.pinError,pinInputRef:e.pinInputRef,onSubmit:e.handleLogin,remoteAuthEnabled:e.remoteAuthEnabled,onSignOutRemote:()=>{window.location.href=`/__remote-auth/logout`}}):null}export{p as n,y as t};