@rubytech/create-sitedesk-code 0.1.523 → 0.1.525

package/payload/platform/scripts/lib/account-settings-mailbox-inject.sh

@@ -0,0 +1,91 @@
+# account-settings-mailbox-inject.sh — retrofit the per-turn <mailboxes>
+# injection hook onto existing accounts' .claude/settings.json. Task 2157.
+#
+# provision-account-dir.sh writes the UserPromptSubmit array only at provision
+# time, and setup-account.sh re-provisions the HOUSE account only: a client
+# sub-account's settings.json is written once, at creation, by the admin-core
+# account-lifecycle tool, and no install ever rewrites it. Without this lib the
+# hook reaches house accounts only, and no device gate would notice, because the
+# verification account on a single-account install IS that install's house
+# account. Same shape as account-settings-askgate.sh (Task 1683) and
+# account-settings-pdf-conformance.sh (Task 1929).
+#
+# Requires jq. Idempotent. Never echoes file contents. Fail-open (nudge, not
+# brick): any unusable file logs a status and is left untouched.
+#
+# Sourced by setup-account.sh; also runnable standalone for a manual repair.
+
+# The exact command string provision-account-dir.sh writes. $PLATFORM_ROOT is a
+# literal in the settings file, resolved by Claude Code at hook-run time.
+_MBXINJECT_CMD='bash $PLATFORM_ROOT/plugins/admin/hooks/mailbox-inject.sh'
+
+# ensure_mailbox_inject_hook <settings_file>
+# Guarantees the UserPromptSubmit array carries the mailbox-inject command:
+# appends it to the first entry when the array exists without it, or adds a whole
+# entry when the array is empty. Logs exactly one
+# `[backfill-2157] file=<f> status=<absent|no-hooks|already-set|updated|rewrite-failed>`
+# to stdout. Always returns 0.
+ensure_mailbox_inject_hook() {
+  local f="$1"
+  if [ ! -f "$f" ]; then
+    echo "[backfill-2157] file=$f status=absent"
+    return 0
+  fi
+  # Patchable only when the file is valid JSON with a UserPromptSubmit array.
+  if ! jq -e '.hooks.UserPromptSubmit | type == "array"' "$f" >/dev/null 2>&1; then
+    if jq -e . "$f" >/dev/null 2>&1; then
+      echo "[backfill-2157] file=$f status=no-hooks"
+    else
+      echo "[backfill-2157] file=$f status=rewrite-failed"
+    fi
+    return 0
+  fi
+  local tmp="$f.2157.tmp"
+  if ! jq --arg cmd "$_MBXINJECT_CMD" '
+      .hooks.UserPromptSubmit |= (
+        if length == 0
+        then [{hooks: [{type: "command", command: $cmd}]}]
+        else
+          if any(.[]; (.hooks // []) | any(.[]; .command == $cmd))
+          then .
+          else (.[0].hooks = ((.[0].hooks // []) + [{type: "command", command: $cmd}]))
+          end
+        end)
+    ' "$f" > "$tmp" 2>/dev/null; then
+    rm -f "$tmp"
+    echo "[backfill-2157] file=$f status=rewrite-failed"
+    return 0
+  fi
+  # Semantic no-op? Compare canonical forms; leave the file byte-identical if so.
+  # `|| true` keeps a jq failure here (e.g. $f truncated by a concurrent writer
+  # between the type-check above and this read) from tripping a caller's `set -e`
+  # and aborting the whole install — this lib is fail-open by contract.
+  local before after
+  before="$(jq -S . "$f" 2>/dev/null || true)"
+  after="$(jq -S . "$tmp" 2>/dev/null || true)"
+  if [ "$before" = "$after" ]; then
+    rm -f "$tmp"
+    echo "[backfill-2157] file=$f status=already-set"
+    return 0
+  fi
+  if mv "$tmp" "$f"; then
+    echo "[backfill-2157] file=$f status=updated"
+  else
+    rm -f "$tmp"
+    echo "[backfill-2157] file=$f status=rewrite-failed"
+  fi
+  return 0
+}
+
+# reconcile_all_accounts_mailbox_inject <accounts_dir>
+# Standing check + backfill: every account dir with an account.json gets the
+# mailbox-inject hook ensured. Mirrors reconcile_all_accounts_askgate.
+reconcile_all_accounts_mailbox_inject() {
+  local accts="$1"
+  [ -d "$accts" ] || return 0
+  local acct
+  for acct in "$accts"/*/; do
+    [ -f "$acct/account.json" ] || continue
+    ensure_mailbox_inject_hook "$acct/.claude/settings.json"
+  done
+}

package/payload/platform/scripts/lib/canonical-tool-names.mjs

@@ -36,44 +36,61 @@ function extractFrontmatter(md) {
   return md.slice(3, end)
 }
 
-// Collect `- name: <x>` entries under a bare `tools:` block and under a bare
-// `hidden:` block. Both contribute names a specialist may list in its `tools:`
+// Collect the declared entries under a bare `tools:` block and a bare `hidden:`
+// block. Both contribute names a specialist may list in its `tools:`
 // frontmatter, so both belong to the live set. Task 1998 gave the hidden block
-// the same name+riskClass shape as tools, so the two branches now read alike;
-// this parser stays separate from tool-surface.ts on purpose, so a drift in one
+// the same name+riskClass shape as tools, so the two branches read alike; this
+// parser stays separate from tool-surface.ts on purpose, so a drift in one
 // shows up as a diff rather than as agreement between a parser and itself.
-function parseToolNames(frontmatter) {
+//
+// Field values are returned as raw trimmed strings, or absent when the manifest
+// has no such line. Judging them is the caller's job: the generator wants only
+// names, and the gate wants to decide whether a value is one the session
+// manager would accept.
+export function parseToolEntries(frontmatter) {
   const lines = frontmatter.split('\n')
-  const names = []
+  const entries = []
   let mode = null // 'tools' | 'hidden' | null
+  let current = null
+  const flush = () => { if (current) { entries.push(current); current = null } }
   for (const line of lines) {
     if (/^tools\s*:/.test(line)) {
+      flush()
       mode = /^tools\s*:\s*$/.test(line) ? 'tools' : null
       continue
     }
     if (/^hidden\s*:/.test(line)) {
+      flush()
       mode = /^hidden\s*:\s*$/.test(line) ? 'hidden' : null
       continue
     }
-    if (/^\S/.test(line) && line.trim() !== '') { mode = null; continue }
-    if (mode === 'tools') {
-      const m = line.match(/^\s+-\s+name:\s*(.+?)\s*$/)
-      if (m) names.push(m[1])
-    } else if (mode === 'hidden') {
-      const m = line.match(/^\s+-\s+name:\s*(.+?)\s*$/)
-      if (m) names.push(m[1])
-    }
+    if (/^\S/.test(line) && line.trim() !== '') { flush(); mode = null; continue }
+    if (mode === null) continue
+    const name = line.match(/^\s+-\s+name:\s*(.+?)\s*$/)
+    if (name) { flush(); current = { block: mode, name: name[1] }; continue }
+    // A list item that does not lead with `name:` is malformed — a tools entry
+    // with no name, or a hidden entry written as a bare string. loadToolSurface
+    // throws on both, so the entry is recorded without a name and reported by
+    // validateToolEntries rather than silently dropped.
+    if (/^\s+-\s+/.test(line)) { flush(); current = { block: mode }; continue }
+    if (current === null) continue
+    const pub = line.match(/^\s+publicAllowlist:\s*(.+?)\s*$/)
+    if (pub) { current.publicAllowlist = pub[1].trim(); continue }
+    const adm = line.match(/^\s+adminAllowlist:\s*(.+?)\s*$/)
+    if (adm) { current.adminAllowlist = adm[1].trim(); continue }
+    const risk = line.match(/^\s+riskClass:\s*(.+?)\s*$/)
+    if (risk) { current.riskClass = risk[1].trim(); continue }
   }
-  return names
+  flush()
+  return entries
 }
 
-/** Returns { plugins, names } — `plugins` is the sorted list of maxy plugin
- *  directory basenames that declare a tool surface; `names` is the sorted list
- *  of canonical long-prefix tool names across all of them. */
-export function computeCanonicalToolNames(pluginsRoot = PLATFORM_PLUGINS_ROOT) {
-  const plugins = []
-  const names = new Set()
-  if (!existsSync(pluginsRoot)) return { plugins, names: [] }
+/** Walk every plugin directory that has a PLUGIN.md with a parseable
+ *  frontmatter and at least one declared entry. Shared by the name derivation
+ *  and the field validation so the two can never disagree about which
+ *  manifests are in scope. */
+function* walkPluginManifests(pluginsRoot) {
+  if (!existsSync(pluginsRoot)) return
   for (const entry of readdirSync(pluginsRoot).sort()) {
     if (entry.startsWith('.')) continue
     const dir = join(pluginsRoot, entry)
@@ -82,10 +99,97 @@ export function computeCanonicalToolNames(pluginsRoot = PLATFORM_PLUGINS_ROOT) {
     if (!existsSync(manifest)) continue
     const fm = extractFrontmatter(readFileSync(manifest, 'utf-8'))
     if (fm === null) continue
-    const toolNames = parseToolNames(fm)
-    if (toolNames.length === 0) continue
-    plugins.push(entry)
-    for (const t of toolNames) names.add(canonicalToolName(entry, t))
+    const entries = parseToolEntries(fm)
+    if (entries.length === 0) continue
+    yield { plugin: entry, entries }
+  }
+}
+
+/** Returns { plugins, names } — `plugins` is the sorted list of maxy plugin
+ *  directory basenames that declare a tool surface; `names` is the sorted list
+ *  of canonical long-prefix tool names across all of them. */
+export function computeCanonicalToolNames(pluginsRoot = PLATFORM_PLUGINS_ROOT) {
+  const plugins = []
+  const names = new Set()
+  for (const { plugin, entries } of walkPluginManifests(pluginsRoot)) {
+    plugins.push(plugin)
+    // A malformed entry has no name to derive a canonical name from. The gate
+    // reports it; this list stays exactly what it was before that shape was
+    // recorded, so the generated artifact does not move.
+    for (const e of entries) {
+      if (e.name !== undefined) names.add(canonicalToolName(plugin, e.name))
+    }
   }
   return { plugins: plugins.sort(), names: Array.from(names).sort() }
 }
+
+/** Every declared entry across every plugin, stamped with its plugin. The
+ *  build gate validates these against the session manager's RISK_CLASSES; see
+ *  validateToolEntries. */
+export function computeToolEntries(pluginsRoot = PLATFORM_PLUGINS_ROOT) {
+  const out = []
+  for (const { plugin, entries } of walkPluginManifests(pluginsRoot)) {
+    for (const e of entries) out.push({ plugin, ...e })
+  }
+  return out
+}
+
+// The gate validates risk classes against the session manager's own list rather
+// than a copy, so the two cannot drift. The gate is plain .mjs run by bare node
+// and the declaration is TypeScript, so it is read as text.
+const RISK_CLASSES_RE = /export const RISK_CLASSES:[^=]*=\s*\[([^\]]*)\]/
+
+/** The valid risk classes, read from tool-surface.ts. Throws rather than
+ *  returning a fallback: a gate that validated against a hardcoded copy could
+ *  drift from the parser it protects, and one that validated against an empty
+ *  set would accept every value. */
+export function readRiskClasses(tsPath) {
+  let src
+  try {
+    src = readFileSync(tsPath, 'utf-8')
+  } catch {
+    throw new Error(`cannot read ${tsPath}, which declares RISK_CLASSES — refusing to validate risk classes without it`)
+  }
+  const m = src.match(RISK_CLASSES_RE)
+  if (m === null) {
+    throw new Error(`no 'export const RISK_CLASSES ... = [...]' declaration in ${tsPath} — refusing to validate risk classes against a set that cannot be read`)
+  }
+  const classes = m[1]
+    .split(',')
+    .map((s) => s.trim().replace(/^['"]|['"]$/g, ''))
+    .filter((s) => s.length > 0)
+  if (classes.length === 0) {
+    throw new Error(`RISK_CLASSES in ${tsPath} parsed to an empty set — refusing to validate against it`)
+  }
+  return classes
+}
+
+/** Judge parsed entries against the rules loadToolSurface enforces. A tools
+ *  entry must declare both allowlist flags as YAML booleans and a riskClass in
+ *  the set; a hidden entry must declare a riskClass and carries no allowlist
+ *  flags at all. Missing and invalid are both violations, because
+ *  loadToolSurface throws on both. Returns every violation rather than the
+ *  first: an author who mistyped one field has often mistyped its sibling. */
+export function validateToolEntries(entries, riskClasses) {
+  const valid = new Set(riskClasses)
+  const list = riskClasses.join('|')
+  const violations = []
+  for (const e of entries) {
+    if (typeof e.name !== 'string' || e.name.length === 0) {
+      violations.push({ plugin: e.plugin, name: '<unnamed>', message: 'tool entry has no name' })
+      continue
+    }
+    const add = (message) => violations.push({ plugin: e.plugin, name: e.name, message })
+    const subject = e.block === 'hidden' ? 'every hidden tool' : 'every tool'
+    if (e.block === 'tools') {
+      for (const field of ['publicAllowlist', 'adminAllowlist']) {
+        const v = e[field]
+        if (v === undefined) add(`${subject} must declare ${field}: <true|false>`)
+        else if (v !== 'true' && v !== 'false') add(`${field} must be true or false, got ${JSON.stringify(v)}`)
+      }
+    }
+    if (e.riskClass === undefined) add(`${subject} must declare riskClass: <${list}>`)
+    else if (!valid.has(e.riskClass)) add(`riskClass must be one of ${list}, got ${JSON.stringify(e.riskClass)}`)
+  }
+  return violations
+}

package/payload/platform/scripts/lib/provision-account-dir.sh

@@ -186,6 +186,7 @@ provision_account_dir() {
           { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" },
           { "type": "command", "command": "bash $HOOKS_PATH/prompt-optimiser-directive.sh" },
           { "type": "command", "command": "bash $HOOKS_PATH/datetime-inject.sh" },
+          { "type": "command", "command": "bash $HOOKS_PATH/mailbox-inject.sh" },
           { "type": "command", "command": "bash $HOOKS_PATH/preference-consult-directive.sh" }
         ]
       }

package/payload/platform/scripts/lib/task-id-citation.mjs

@@ -0,0 +1,67 @@
+// Single source of truth for what counts as an internal task citation in
+// shipped markdown, and for how a markdown file is scanned for one.
+//
+// Two consumers, deliberately. `platform/scripts/check-no-task-id-leaks.mjs`
+// scans the SOURCE trees at commit time; `packages/create-maxy-code/scripts/
+// bundle.js` scans the ASSEMBLED payload at bundle time. They answer different
+// questions, "could this ship?" and "did this ship?", and a divergence between
+// two copies of the regex would let one pass what the other rejects, with the
+// payload audit failing a publish for something the commit gate allowed. The
+// regex and the scan live here so neither consumer carries its own copy.
+//
+// A shipped `.md` loads into a client-facing agent's context wholesale, so ANY
+// citation form leaks. Catches `Task NNN`, `(Task NNN)`, `Tasks NNN`,
+// `since Task NNN`. It deliberately does NOT match bare `#NNN`: every `#NNN` in
+// the corpus is a hex colour and there is no signal to separate `#732`-issue
+// from `#732`-hex.
+// Two alternatives:
+//   `\bTasks?[\s-]+\d{2,4}` — capital-T, any separator: `Task 732`, `(Task 732)`,
+//     `Tasks 12`, the hyphenated `Pre-Task-748` / `post-Task-904` forms.
+//   `\btasks?\s+\d{2,4}` — lowercase but SPACE-separated only: catches prose
+//     citations like "before task 127", while a lowercase HYPHENATED `task-537`
+//     stays exempt because that shape is a branch slug or a
+//     `.tasks/<n>-…-task-NNN.md` file-path reference (file paths are out of
+//     scope). The 2-digit floor keeps single-digit domain counts ("task 1 of
+//     3") out.
+export const MD_TASK_ID_RE = /\bTasks?[\s-]+\d{2,4}|\btasks?\s+\d{2,4}/
+
+// Scanned per paragraph, not per line: a markdown soft-wrap can split a single
+// citation across two source lines (`... (Task\n659) ...`), which renders as
+// `(Task 659)` but matches neither line in isolation. Consecutive non-blank
+// lines are joined with a space (the soft-break a renderer would insert) and
+// scanned as one string; a blank line ends the paragraph, so the join never
+// crosses a paragraph break. Every match in the paragraph is reported, mapped
+// back to the source line where the match starts, preserving exact-line and
+// multi-citation reporting.
+export function findCitations(content) {
+  const re = new RegExp(MD_TASK_ID_RE.source, 'g')
+  const found = []
+  const lines = content.split('\n')
+  let joined = ''
+  let lineStarts = []
+
+  function flush() {
+    if (joined === '') return
+    for (const m of joined.matchAll(re)) {
+      let lineNo = lineStarts[0].lineNo
+      for (const ls of lineStarts) {
+        if (ls.offset <= m.index) lineNo = ls.lineNo
+      }
+      found.push({ line: lineNo, match: m[0] })
+    }
+  }
+
+  for (let i = 0; i < lines.length; i++) {
+    if (lines[i].trim() === '') {
+      flush()
+      joined = ''
+      lineStarts = []
+      continue
+    }
+    if (joined !== '') joined += ' '
+    lineStarts.push({ offset: joined.length, lineNo: i + 1 })
+    joined += lines[i]
+  }
+  flush()
+  return found
+}

package/payload/platform/scripts/setup-account.sh

@@ -38,6 +38,8 @@ ACCOUNTS_DIR="$INSTALL_DIR/data/accounts"
 . "$SCRIPT_DIR/lib/account-settings-askgate.sh"
 # shellcheck source=lib/account-settings-pdf-conformance.sh
 . "$SCRIPT_DIR/lib/account-settings-pdf-conformance.sh"
+# shellcheck source=lib/account-settings-mailbox-inject.sh
+. "$SCRIPT_DIR/lib/account-settings-mailbox-inject.sh"
 # shellcheck source=lib/read-brand-json.sh
 . "$SCRIPT_DIR/lib/read-brand-json.sh"
 # Resolve brand-aware persistent users.json path before the resolver runs.
@@ -90,3 +92,16 @@ reconcile_all_accounts_askgate "$ACCOUNTS_DIR"
 # never runs the PDF gate. Reconcile every account on every install so the gate
 # reaches pre-1922 accounts. Idempotent; logs one [backfill-1929] line per account.
 reconcile_all_accounts_pdf_conformance "$ACCOUNTS_DIR"
+
+# ------------------------------------------------------------------
+# 6. Retrofit the per-turn <mailboxes> injection hook onto every account
+# ------------------------------------------------------------------
+# Standing check + durable backfill (Task 2157): provision_account_dir writes the
+# UserPromptSubmit array only at provision time, and this script re-provisions
+# only the house account. A client sub-account created by the account-lifecycle
+# tool keeps a settings.json without mailbox-inject.sh and never gets the
+# standing mailbox list, so its sessions go on learning attachment state by
+# polling one mail plugin and reading that plugin's miss as an account-wide fact.
+# Reconcile every account on every install. Idempotent; logs one [backfill-2157]
+# line per account.
+reconcile_all_accounts_mailbox_inject "$ACCOUNTS_DIR"

package/payload/server/public/activity.html

@@ -5,12 +5,12 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>Activity — Maxy</title>
   <link rel="icon" href="/favicon.ico">
-  <script type="module" crossorigin src="/assets/activity-B4KfMJqO.js"></script>
+  <script type="module" crossorigin src="/assets/activity-DGQt5ys_.js"></script>
   <link rel="modulepreload" crossorigin href="/assets/chunk-CltuBf4Z.js">
-  <link rel="modulepreload" crossorigin href="/assets/useSubAccountSwitcher-C_1E11Dv.js">
-  <link rel="modulepreload" crossorigin href="/assets/AdminShell-GqtMImyQ.js">
-  <link rel="modulepreload" crossorigin href="/assets/triangle-alert-DrwqhEog.js">
-  <link rel="stylesheet" crossorigin href="/assets/useSubAccountSwitcher-B-K8y5a4.css">
+  <link rel="modulepreload" crossorigin href="/assets/useSubAccountSwitcher-CnpeWIYq.js">
+  <link rel="modulepreload" crossorigin href="/assets/AdminShell-YctTrR-D.js">
+  <link rel="modulepreload" crossorigin href="/assets/triangle-alert--PCKaewD.js">
+  <link rel="stylesheet" crossorigin href="/assets/useSubAccountSwitcher-BYfe9vj8.css">
   <link rel="stylesheet" href="/brand-defaults.css">
 </head>
 <body>

package/payload/server/public/agents.html

@@ -5,11 +5,11 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>Agents — Maxy</title>
   <link rel="icon" href="/favicon.ico">
-  <script type="module" crossorigin src="/assets/agents-BtwBuO4G.js"></script>
+  <script type="module" crossorigin src="/assets/agents-Bc2LZjwC.js"></script>
   <link rel="modulepreload" crossorigin href="/assets/chunk-CltuBf4Z.js">
-  <link rel="modulepreload" crossorigin href="/assets/useSubAccountSwitcher-C_1E11Dv.js">
-  <link rel="modulepreload" crossorigin href="/assets/AdminShell-GqtMImyQ.js">
-  <link rel="stylesheet" crossorigin href="/assets/useSubAccountSwitcher-B-K8y5a4.css">
+  <link rel="modulepreload" crossorigin href="/assets/useSubAccountSwitcher-CnpeWIYq.js">
+  <link rel="modulepreload" crossorigin href="/assets/AdminShell-YctTrR-D.js">
+  <link rel="stylesheet" crossorigin href="/assets/useSubAccountSwitcher-BYfe9vj8.css">
   <link rel="stylesheet" href="/brand-defaults.css">
 </head>
 <body>

package/payload/server/public/assets/{AdminLoginScreens-uknqh2Pm.js → AdminLoginScreens-BgDjueVe.js}

@@ -1 +1 @@
-import{o as e}from"./chunk-CltuBf4Z.js";import{B as t,H as n,J as r,L as i,R as a,W as o}from"./useSubAccountSwitcher-C_1E11Dv.js";import{k as s}from"./useVoiceRecorder-DUBpVa2T.js";import{E as c,T as l,w as u}from"./AdminShell-GqtMImyQ.js";var d=e(r(),1);function f(e=`admin`){let[t,n]=(0,d.useState)(`loading`),[r,i]=(0,d.useState)(``),[a,l]=(0,d.useState)(``),[u,f]=(0,d.useState)(``),[p,m]=(0,d.useState)(!1),[h,g]=(0,d.useState)(!1),[_,v]=(0,d.useState)(!1),[y,b]=(0,d.useState)(!1),[x,S]=(0,d.useState)(!1),[C,w]=(0,d.useState)(null),[T,E]=(0,d.useState)(null),[D,O]=(0,d.useState)(void 0),[k,A]=(0,d.useState)(null),[j,M]=(0,d.useState)(void 0),[N,P]=(0,d.useState)(null),[F,I]=(0,d.useState)(null),[L,R]=(0,d.useState)(void 0),z=(0,d.useRef)(void 0),[B,V]=(0,d.useState)(!1),[H,U]=(0,d.useState)(!0);(0,d.useEffect)(()=>{typeof window>`u`||fetch(`/api/remote-auth/status`).then(e=>e.ok?e.json():null).then(e=>{e?.configured&&V(!0)}).catch(()=>{})},[]);let W=(0,d.useRef)(null),G=(0,d.useRef)(null);(0,d.useEffect)(()=>{async function e(){let e=null;try{e=sessionStorage.getItem(`maxy-admin-session-key`)}catch{}if(!e)return!1;try{let t=await fetch(`/api/admin/session?session_key=${encodeURIComponent(e)}`);if(t.status===401){try{sessionStorage.removeItem(`maxy-admin-session-key`)}catch{}return!1}if(!t.ok)return!1;let r=await t.json();w(r.session_key),I(r.sessionId??null),O(r.businessName),A(r.role??null),M(r.userName===void 0?null:r.userName),P(r.avatar??null);let i=s(r.thinkingView);return z.current=i,R(i),n(`chat`),!0}catch(e){return console.error(`[admin] session restore failed:`,e),!1}}async function t(r=2){try{let i=await fetch(`/api/health`);if(!i.ok){if(r>0)return await new Promise(e=>setTimeout(e,1500)),t(r-1);console.error(`[admin] health check returned ${i.status} after retries`),n(`set-pin`);return}let a=await i.json();if(!a.pin_configured){n(`set-pin`);return}U(!!a.claude_authenticated);let o=!1;try{o=new URLSearchParams(window.location.search).get(`connect`)===`claude`}catch{}if(o){try{let e=new URL(window.location.href);e.searchParams.delete(`connect`),window.history.replaceState(null,``,e.pathname+e.search+e.hash)}catch{}if(!a.claude_authenticated){n(`connect-claude`);return}}if(await e())return;n(`enter-pin`)}catch(e){if(r>0)return await new Promise(e=>setTimeout(e,1500)),t(r-1);console.error(`[admin] health check failed:`,e),n(`set-pin`)}}t()},[]),(0,d.useEffect)(()=>{t===`chat`&&C&&fetch(`/api/admin/claude-info?session_key=${encodeURIComponent(C)}`).then(e=>{if(e.ok)return e.json()}).then(e=>{e&&E(e)}).catch(()=>{})},[t,C]);let K=(0,d.useRef)(null);(0,d.useEffect)(()=>{if(t!==`chat`)return;let e=setInterval(async()=>{try{let e=await fetch(`/api/health`);if(e.ok){let t=await e.json();U(t.auth_status!==`dead`&&t.auth_status!==`missing`)}}catch{}if(C)try{let e=await fetch(`/api/admin/session?session_key=${encodeURIComponent(C)}`);if(e.status!==401)return;let t=(await e.clone().json().catch(()=>null))?.code??`unknown-401`;if(t===`remote-auth-required`){o(`heartbeat`,`/api/admin/session`);return}console.warn(`[admin-auth] outcome=heartbeat-detected-expiry code=${t}`),K.current?.()}catch{}},300*1e3);return()=>clearInterval(e)},[t,C]),(0,d.useEffect)(()=>{t===`connect-claude`&&fetch(`/api/health`).then(e=>e.ok?e.json():null).then(e=>{e?.claude_authenticated&&(U(!0),n(`enter-pin`))}).catch(()=>{})},[t]);async function q(e,t){g(!0);try{let r=await fetch(`/api/admin/session`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({pin:e,...t?{accountId:t}:{}})});if(!r.ok){let e=await r.json().catch(()=>({}));if(r.status===401&&e?.code===`remote-auth-required`){o(`enter-pin`,`/api/admin/session`);return}f(e.error||`Invalid PIN`);return}let a=await r.json();w(a.session_key),I(a.sessionId??null),O(a.businessName),A(a.role??null),M(a.userName===void 0?null:a.userName),P(a.avatar??null);let c=s(a.thinkingView);z.current=c,R(c);try{sessionStorage.setItem(`maxy-admin-session-key`,a.session_key)}catch{}i(``),n(`chat`)}catch(e){console.error(`[admin] connection error:`,e),f(`Could not connect.`)}finally{g(!1)}}let J=(0,d.useCallback)(async e=>{if(e.preventDefault(),h)return;f(``);let t=a.trim();if(!t){f(`Please enter your name.`);return}if(r.length<4){f(`PIN must be at least 4 characters.`);return}let s=r;g(!0);try{let e=await fetch(`/api/onboarding/set-pin`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({pin:s,name:t})});if(!e.ok){let t=await e.json().catch(()=>({}));if(e.status===401&&t?.code===`remote-auth-required`){o(`set-pin`,`/api/onboarding/set-pin`);return}if(e.status===409){console.log(`[admin] PIN already configured — re-checking health`);try{let e=await fetch(`/api/health`);if(e.ok){let r=await e.json();r.pin_configured&&r.claude_authenticated?n(`enter-pin`):r.pin_configured?n(`connect-claude`):f(t.error||`Failed to set PIN.`)}else n(`enter-pin`)}catch{n(`enter-pin`)}return}f(t.error||`Failed to set PIN.`);return}let r=await fetch(`/api/health`);if((r.ok?await r.json():null)?.claude_authenticated){await q(s);return}i(``),n(`connect-claude`)}catch(e){console.error(`[admin] connection error:`,e),f(`Could not connect.`)}finally{g(!1)}},[r,h,a]),Y=(0,d.useCallback)(async e=>{e.preventDefault(),f(``),await q(r)},[r]),X=(0,d.useCallback)(async()=>{S(!0);try{if(!await c())return console.warn(`[admin-ui] claude-disconnect not verified — credentials may persist; staying put`),!1;U(!1),w(null),A(null),M(void 0),P(null);try{sessionStorage.removeItem(`maxy-admin-session-key`)}catch{}return n(`connect-claude`),!0}finally{S(!1)}},[]),Z=(0,d.useCallback)(()=>{w(null),A(null),M(void 0),P(null);try{sessionStorage.removeItem(`maxy-admin-session-key`)}catch{}i(``),f(``),n(`enter-pin`)},[]);return(0,d.useEffect)(()=>{K.current=Z},[Z]),{appState:t,setAppState:n,pin:r,setPin:i,operatorName:a,setOperatorName:l,pinError:u,setPinError:f,showPin:p,setShowPin:m,pinLoading:h,authPolling:_,setAuthPolling:v,authLoading:y,setAuthLoading:b,disconnecting:x,cacheKey:C,setCacheKey:w,claudeInfo:T,setClaudeInfo:E,businessName:D,role:k,userName:j,userAvatar:N,sessionId:F,setSessionId:I,expandAll:L,setExpandAll:R,expandAllDefaultRef:z,remoteAuthEnabled:B,claudeConnected:H,pinInputRef:W,setPinFormRef:G,handleSetPin:J,handleLogin:Y,handleDisconnect:X,handleLogout:Z}}var p=n();function m({inputRef:e,value:t,onChange:n,onComplete:r,showPin:i,autoFocus:a}){let o=(0,d.useRef)([]);function s(e,r){r.key===`Backspace`?(r.preventDefault(),t[e]?n(t.slice(0,e)+t.slice(e+1)):e>0&&(n(t.slice(0,e-1)+t.slice(e)),o.current[e-1]?.focus())):r.key===`ArrowLeft`&&e>0?o.current[e-1]?.focus():r.key===`ArrowRight`&&e<5?o.current[e+1]?.focus():r.key===`Enter`&&(r.preventDefault(),r.currentTarget.form?.requestSubmit())}function c(e,i){let a=i.nativeEvent.data;if(!a||!/^\d$/.test(a))return;let s=t.split(``);for(s[e]=a;s.length<e;)s.push(``);let c=s.join(``).replace(/\D/g,``).slice(0,6);n(c),c.length===6?r?.(c):e<5&&o.current[e+1]?.focus()}function l(e){e.preventDefault();let t=e.clipboardData.getData(`text`).replace(/\D/g,``).slice(0,6);t&&(n(t),t.length===6?r?.(t):o.current[t.length]?.focus())}return(0,p.jsx)(`div`,{className:`pin-field`,children:Array.from({length:6}).map((n,r)=>(0,p.jsx)(`input`,{ref:t=>{o.current[r]=t,r===0&&e&&(e.current=t)},type:`text`,inputMode:`numeric`,className:`pin-box${t[r]?` pin-box-filled`:``}`,value:t[r]?i?t[r]:`•`:``,onKeyDown:e=>s(r,e),onInput:e=>c(r,e),onPaste:l,onFocus:e=>e.target.select(),autoFocus:a&&r===0,autoComplete:`off`,maxLength:1,"aria-label":`PIN digit ${r+1}`},r))})}function h(e){let{pin:n,setPin:r,showPin:i,setShowPin:o,pinLoading:s,pinError:c,pinInputRef:d,setPinFormRef:f,onSubmit:h,operatorName:g,setOperatorName:_}=e;return(0,p.jsx)(`div`,{className:`connect-page`,children:(0,p.jsxs)(`div`,{className:`connect-content`,children:[(0,p.jsx)(`img`,{src:t,alt:a.productName,className:`connect-logo connect-logo--maxy`}),!a.logoContainsName&&(0,p.jsxs)(`h1`,{className:`connect-title`,children:[`Welcome to `,a.productName]}),(0,p.jsxs)(`p`,{className:`connect-subtitle`,children:[`Tell `,a.productName,` who you are, then choose a PIN.`]}),(0,p.jsxs)(`form`,{ref:f,onSubmit:h,className:`connect-pin-form`,children:[(0,p.jsxs)(`div`,{className:`pin-input-row`,children:[(0,p.jsx)(`input`,{type:`text`,className:`connect-name-input`,placeholder:`Your full name`,value:g,onChange:e=>_(e.target.value),autoComplete:`name`,autoFocus:!0,required:!0,"aria-label":`Your full name`}),(0,p.jsx)(`div`,{style:{width:38,flexShrink:0},"aria-hidden":`true`})]}),(0,p.jsxs)(`div`,{className:`pin-input-row`,children:[(0,p.jsx)(m,{inputRef:d,value:n,onChange:r,onComplete:()=>{},showPin:i}),(0,p.jsx)(u,{variant:`send`,type:`submit`,disabled:!n||!g.trim(),loading:s,"aria-label":`Set PIN`,children:(0,p.jsxs)(`svg`,{viewBox:`0 0 24 24`,fill:`none`,stroke:`currentColor`,strokeWidth:`2`,strokeLinecap:`round`,strokeLinejoin:`round`,children:[(0,p.jsx)(`line`,{x1:`5`,y1:`12`,x2:`19`,y2:`12`}),(0,p.jsx)(`polyline`,{points:`12 5 19 12 12 19`})]})})]}),(0,p.jsx)(l,{checked:i,onChange:()=>o(e=>!e),label:`Show PIN`})]}),c&&(0,p.jsx)(`p`,{className:`admin-pin-error`,children:c})]})})}function g(e){let{pin:n,setPin:r,showPin:i,setShowPin:o,pinLoading:s,pinError:c,pinInputRef:d,onSubmit:f,remoteAuthEnabled:h,onSignOutRemote:g}=e;return(0,p.jsxs)(`div`,{className:`connect-page`,children:[h&&g&&(0,p.jsx)(`button`,{type:`button`,className:`connect-signout`,onClick:g,children:`Sign out`}),(0,p.jsxs)(`div`,{className:`connect-content`,children:[(0,p.jsx)(`img`,{src:t,alt:a.productName,className:`connect-logo connect-logo--maxy`}),!a.logoContainsName&&(0,p.jsx)(`h1`,{className:`connect-title`,children:a.productName}),(0,p.jsxs)(`form`,{onSubmit:f,className:`connect-pin-form`,children:[(0,p.jsxs)(`div`,{className:`pin-input-row`,children:[(0,p.jsx)(m,{inputRef:d,value:n,onChange:r,onComplete:()=>{},showPin:i,autoFocus:!0}),(0,p.jsx)(u,{variant:`send`,type:`submit`,disabled:!n,loading:s,children:(0,p.jsxs)(`svg`,{viewBox:`0 0 24 24`,fill:`none`,stroke:`currentColor`,strokeWidth:`2`,strokeLinecap:`round`,strokeLinejoin:`round`,children:[(0,p.jsx)(`line`,{x1:`5`,y1:`12`,x2:`19`,y2:`12`}),(0,p.jsx)(`polyline`,{points:`12 5 19 12 12 19`})]})})]}),(0,p.jsx)(`div`,{className:`pin-options`,children:(0,p.jsx)(l,{checked:i,onChange:()=>o(e=>!e),label:`Show PIN`})})]}),c&&(0,p.jsx)(`p`,{className:`admin-pin-error`,children:c})]})]})}function _(e){let{authPolling:n,setAuthPolling:r,authLoading:i,setAuthLoading:o,pinError:s,setPinError:c,setAppState:l}=e,[f,m]=(0,d.useState)(!1),[h,g]=(0,d.useState)(!1),[_,v]=(0,d.useState)(``),[y,b]=(0,d.useState)(``),[x,S]=(0,d.useState)(``);async function C(){S(``);try{let e=await(await fetch(`/api/onboarding/claude-auth`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({action:`paste-code`,code:y})})).json();e.accepted?(S(`Code submitted. Finishing sign-in…`),b(``)):S(e.error||`Could not submit code.`)}catch(e){console.error(`[admin] paste-code error:`,e),S(`Could not submit code.`)}}async function w(){g(!0),c(``);try{let e=await(await fetch(`/api/onboarding/claude-auth`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({action:`launch-browser`})})).json();e.launched?m(!0):e.error&&c(e.error)}catch(e){console.error(`[admin] browser launch error:`,e),c(`Could not launch browser.`)}g(!1)}async function T(){o(!0),c(``);try{let e=await(await fetch(`/api/onboarding/claude-auth`,{method:`POST`})).json();if(e.started){r(!0),m(!0),o(!1),v(e.transport||``);for(let e=0;e<120;e++)if(await new Promise(e=>setTimeout(e,2e3)),(await(await fetch(`/api/onboarding/claude-auth`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({action:`wait`})})).json()).authenticated){await fetch(`/api/onboarding/claude-auth`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({action:`stop`})}),l(`enter-pin`);return}c(`Timed out waiting for sign-in. Try again.`),r(!1)}else e.error&&c(e.error)}catch(e){console.error(`[admin] auth flow error:`,e),c(`Could not start auth flow.`)}o(!1)}async function E(){await fetch(`/api/onboarding/claude-auth`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({action:`stop`})}),r(!1),c(``)}return n||f?(0,p.jsxs)(`div`,{style:{display:`flex`,flexDirection:`column`,height:`100dvh`,overflow:`auto`},children:[(0,p.jsxs)(`header`,{className:`chat-header`,style:{paddingBottom:`12px`,flexShrink:0,position:`relative`,maxWidth:`680px`,width:`100%`,margin:`0 auto`,padding:`24px 20px 12px`},children:[n?(0,p.jsx)(`button`,{onClick:E,style:{position:`absolute`,top:`12px`,right:`12px`,background:`none`,border:`none`,color:`#999`,fontSize:`13px`,cursor:`pointer`,padding:`4px 8px`},"aria-label":`Cancel`,children:`✕`}):(0,p.jsx)(`button`,{onClick:()=>m(!1),style:{position:`absolute`,top:`12px`,right:`12px`,background:`none`,border:`none`,color:`#999`,fontSize:`13px`,cursor:`pointer`,padding:`4px 8px`},"aria-label":`Close browser`,children:`✕`}),(0,p.jsx)(`img`,{src:`/brand/claude.png`,alt:`Claude`,className:`chat-logo`}),(0,p.jsx)(`h1`,{className:`chat-tagline`,children:`Connect Claude`}),(0,p.jsx)(`p`,{className:`chat-intro`,children:n?`Sign in and authorize in the browser below.`:`Open your email or prepare your accounts, then sign in.`}),!n&&(0,p.jsx)(`div`,{style:{marginTop:`12px`},children:(0,p.jsx)(u,{variant:`primary`,onClick:T,disabled:i,children:i?(0,p.jsxs)(p.Fragment,{children:[(0,p.jsx)(`span`,{className:`spin`,style:{display:`inline-block`},children:`✱`}),` Connecting…`]}):`Sign in to Claude`})}),n&&_===`native`&&(0,p.jsxs)(`div`,{style:{marginTop:`14px`,maxWidth:`420px`,margin:`14px auto 0`,display:`flex`,flexDirection:`column`,gap:`8px`},children:[(0,p.jsx)(`label`,{style:{fontSize:`12px`,color:`#999`,lineHeight:1.4},children:`If the browser didn't finish sign-in, paste the code or full redirect URL from Claude's page:`}),(0,p.jsxs)(`div`,{style:{display:`flex`,gap:`8px`},children:[(0,p.jsx)(`input`,{type:`text`,value:y,onChange:e=>b(e.target.value),placeholder:`Paste code or redirect URL`,style:{flex:1,padding:`8px 10px`,fontSize:`13px`,border:`1px solid #ccc`,borderRadius:`6px`}}),(0,p.jsx)(u,{variant:`primary`,onClick:C,disabled:!y.trim(),children:`Submit`})]}),x&&(0,p.jsx)(`p`,{style:{fontSize:`12px`,color:`#999`,margin:0},children:x})]})]}),(0,p.jsx)(`div`,{style:{flex:1,display:`flex`,flexDirection:`column`,minHeight:0,gap:`10px`,padding:`0 0 16px`},children:(0,p.jsx)(`iframe`,{src:`/vnc-viewer.html`,style:{flex:1,width:`100%`,minHeight:0,border:`none`,background:`#111`,display:`block`},title:`Claude Sign-in`})}),s&&(0,p.jsx)(`p`,{className:`admin-pin-error`,style:{textAlign:`center`,padding:`0 20px 16px`},children:s})]}):(0,p.jsx)(`div`,{className:`connect-page`,children:(0,p.jsxs)(`div`,{className:`connect-content`,children:[(0,p.jsxs)(`div`,{className:`connect-logos`,children:[(0,p.jsx)(`div`,{className:`connect-logo-wrap`,children:(0,p.jsx)(`img`,{src:`/brand/claude.png`,alt:`Claude`,className:`connect-logo`})}),(0,p.jsx)(`svg`,{className:`connect-arrow`,viewBox:`0 0 48 24`,fill:`none`,xmlns:`http://www.w3.org/2000/svg`,children:(0,p.jsx)(`path`,{d:`M0 12h44m0 0l-8-8m8 8l-8 8`,stroke:`currentColor`,strokeWidth:`2`,strokeLinecap:`round`,strokeLinejoin:`round`})}),(0,p.jsxs)(`div`,{className:`connect-logo-wrap`,children:[(0,p.jsx)(`img`,{src:t,alt:a.productName,className:`connect-logo connect-logo--maxy`}),!a.logoContainsName&&(0,p.jsx)(`span`,{className:`connect-logo-label`,children:a.productName})]})]}),(0,p.jsxs)(`h1`,{className:`connect-title`,children:[`Connect Claude to power `,a.productName]}),(0,p.jsx)(`p`,{className:`connect-subtitle`,children:`Sign in with your Anthropic account to get started.`}),(0,p.jsx)(u,{variant:`primary`,onClick:T,disabled:i,children:i?(0,p.jsxs)(p.Fragment,{children:[(0,p.jsx)(`span`,{className:`spin`,style:{display:`inline-block`},children:`✱`}),` Connecting…`]}):`Sign in to Claude`}),(0,p.jsx)(`p`,{style:{marginTop:`6px`,fontSize:`11px`,color:`#999`,maxWidth:`300px`,textAlign:`center`,lineHeight:`1.4`},children:`First time? You may need to sign into your email and Anthropic account in the browser before connecting.`}),(0,p.jsx)(`button`,{onClick:w,disabled:h,style:{marginTop:`12px`,background:`none`,border:`none`,color:`var(--color-primary, #666)`,fontSize:`13px`,cursor:`pointer`,textDecoration:`underline`,textUnderlineOffset:`3px`},children:h?`Launching…`:`Open browser first`}),s&&(0,p.jsx)(`p`,{className:`admin-pin-error`,children:s})]})})}function v({auth:e}){return e.appState===`loading`?(0,p.jsx)(i,{surface:`gate`}):e.appState===`set-pin`?(0,p.jsx)(h,{pin:e.pin,setPin:e.setPin,showPin:e.showPin,setShowPin:e.setShowPin,pinLoading:e.pinLoading,pinError:e.pinError,pinInputRef:e.pinInputRef,setPinFormRef:e.setPinFormRef,onSubmit:e.handleSetPin,operatorName:e.operatorName,setOperatorName:e.setOperatorName}):e.appState===`connect-claude`?(0,p.jsx)(_,{authPolling:e.authPolling,setAuthPolling:e.setAuthPolling,authLoading:e.authLoading,setAuthLoading:e.setAuthLoading,pinError:e.pinError,setPinError:e.setPinError,setAppState:e.setAppState}):e.appState===`enter-pin`?(0,p.jsx)(g,{pin:e.pin,setPin:e.setPin,showPin:e.showPin,setShowPin:e.setShowPin,pinLoading:e.pinLoading,pinError:e.pinError,pinInputRef:e.pinInputRef,onSubmit:e.handleLogin,remoteAuthEnabled:e.remoteAuthEnabled,onSignOutRemote:()=>{console.info(`[admin-ui] remote-auth sign-out → /__remote-auth/logout`),window.location.href=`/__remote-auth/logout`}}):null}export{f as n,v as t};
+import{o as e}from"./chunk-CltuBf4Z.js";import{B as t,H as n,J as r,L as i,R as a,W as o}from"./useSubAccountSwitcher-CnpeWIYq.js";import{k as s}from"./useVoiceRecorder-BY6ZsGMH.js";import{E as c,T as l,w as u}from"./AdminShell-YctTrR-D.js";var d=e(r(),1);function f(e=`admin`){let[t,n]=(0,d.useState)(`loading`),[r,i]=(0,d.useState)(``),[a,l]=(0,d.useState)(``),[u,f]=(0,d.useState)(``),[p,m]=(0,d.useState)(!1),[h,g]=(0,d.useState)(!1),[_,v]=(0,d.useState)(!1),[y,b]=(0,d.useState)(!1),[x,S]=(0,d.useState)(!1),[C,w]=(0,d.useState)(null),[T,E]=(0,d.useState)(null),[D,O]=(0,d.useState)(void 0),[k,A]=(0,d.useState)(null),[j,M]=(0,d.useState)(void 0),[N,P]=(0,d.useState)(null),[F,I]=(0,d.useState)(null),[L,R]=(0,d.useState)(void 0),z=(0,d.useRef)(void 0),[B,V]=(0,d.useState)(!1),[H,U]=(0,d.useState)(!0);(0,d.useEffect)(()=>{typeof window>`u`||fetch(`/api/remote-auth/status`).then(e=>e.ok?e.json():null).then(e=>{e?.configured&&V(!0)}).catch(()=>{})},[]);let W=(0,d.useRef)(null),G=(0,d.useRef)(null);(0,d.useEffect)(()=>{async function e(){let e=null;try{e=sessionStorage.getItem(`maxy-admin-session-key`)}catch{}if(!e)return!1;try{let t=await fetch(`/api/admin/session?session_key=${encodeURIComponent(e)}`);if(t.status===401){try{sessionStorage.removeItem(`maxy-admin-session-key`)}catch{}return!1}if(!t.ok)return!1;let r=await t.json();w(r.session_key),I(r.sessionId??null),O(r.businessName),A(r.role??null),M(r.userName===void 0?null:r.userName),P(r.avatar??null);let i=s(r.thinkingView);return z.current=i,R(i),n(`chat`),!0}catch(e){return console.error(`[admin] session restore failed:`,e),!1}}async function t(r=2){try{let i=await fetch(`/api/health`);if(!i.ok){if(r>0)return await new Promise(e=>setTimeout(e,1500)),t(r-1);console.error(`[admin] health check returned ${i.status} after retries`),n(`set-pin`);return}let a=await i.json();if(!a.pin_configured){n(`set-pin`);return}U(!!a.claude_authenticated);let o=!1;try{o=new URLSearchParams(window.location.search).get(`connect`)===`claude`}catch{}if(o){try{let e=new URL(window.location.href);e.searchParams.delete(`connect`),window.history.replaceState(null,``,e.pathname+e.search+e.hash)}catch{}if(!a.claude_authenticated){n(`connect-claude`);return}}if(await e())return;n(`enter-pin`)}catch(e){if(r>0)return await new Promise(e=>setTimeout(e,1500)),t(r-1);console.error(`[admin] health check failed:`,e),n(`set-pin`)}}t()},[]),(0,d.useEffect)(()=>{t===`chat`&&C&&fetch(`/api/admin/claude-info?session_key=${encodeURIComponent(C)}`).then(e=>{if(e.ok)return e.json()}).then(e=>{e&&E(e)}).catch(()=>{})},[t,C]);let K=(0,d.useRef)(null);(0,d.useEffect)(()=>{if(t!==`chat`)return;let e=setInterval(async()=>{try{let e=await fetch(`/api/health`);if(e.ok){let t=await e.json();U(t.auth_status!==`dead`&&t.auth_status!==`missing`)}}catch{}if(C)try{let e=await fetch(`/api/admin/session?session_key=${encodeURIComponent(C)}`);if(e.status!==401)return;let t=(await e.clone().json().catch(()=>null))?.code??`unknown-401`;if(t===`remote-auth-required`){o(`heartbeat`,`/api/admin/session`);return}console.warn(`[admin-auth] outcome=heartbeat-detected-expiry code=${t}`),K.current?.()}catch{}},300*1e3);return()=>clearInterval(e)},[t,C]),(0,d.useEffect)(()=>{t===`connect-claude`&&fetch(`/api/health`).then(e=>e.ok?e.json():null).then(e=>{e?.claude_authenticated&&(U(!0),n(`enter-pin`))}).catch(()=>{})},[t]);async function q(e,t){g(!0);try{let r=await fetch(`/api/admin/session`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({pin:e,...t?{accountId:t}:{}})});if(!r.ok){let e=await r.json().catch(()=>({}));if(r.status===401&&e?.code===`remote-auth-required`){o(`enter-pin`,`/api/admin/session`);return}f(e.error||`Invalid PIN`);return}let a=await r.json();w(a.session_key),I(a.sessionId??null),O(a.businessName),A(a.role??null),M(a.userName===void 0?null:a.userName),P(a.avatar??null);let c=s(a.thinkingView);z.current=c,R(c);try{sessionStorage.setItem(`maxy-admin-session-key`,a.session_key)}catch{}i(``),n(`chat`)}catch(e){console.error(`[admin] connection error:`,e),f(`Could not connect.`)}finally{g(!1)}}let J=(0,d.useCallback)(async e=>{if(e.preventDefault(),h)return;f(``);let t=a.trim();if(!t){f(`Please enter your name.`);return}if(r.length<4){f(`PIN must be at least 4 characters.`);return}let s=r;g(!0);try{let e=await fetch(`/api/onboarding/set-pin`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({pin:s,name:t})});if(!e.ok){let t=await e.json().catch(()=>({}));if(e.status===401&&t?.code===`remote-auth-required`){o(`set-pin`,`/api/onboarding/set-pin`);return}if(e.status===409){console.log(`[admin] PIN already configured — re-checking health`);try{let e=await fetch(`/api/health`);if(e.ok){let r=await e.json();r.pin_configured&&r.claude_authenticated?n(`enter-pin`):r.pin_configured?n(`connect-claude`):f(t.error||`Failed to set PIN.`)}else n(`enter-pin`)}catch{n(`enter-pin`)}return}f(t.error||`Failed to set PIN.`);return}let r=await fetch(`/api/health`);if((r.ok?await r.json():null)?.claude_authenticated){await q(s);return}i(``),n(`connect-claude`)}catch(e){console.error(`[admin] connection error:`,e),f(`Could not connect.`)}finally{g(!1)}},[r,h,a]),Y=(0,d.useCallback)(async e=>{e.preventDefault(),f(``),await q(r)},[r]),X=(0,d.useCallback)(async()=>{S(!0);try{if(!await c())return console.warn(`[admin-ui] claude-disconnect not verified — credentials may persist; staying put`),!1;U(!1),w(null),A(null),M(void 0),P(null);try{sessionStorage.removeItem(`maxy-admin-session-key`)}catch{}return n(`connect-claude`),!0}finally{S(!1)}},[]),Z=(0,d.useCallback)(()=>{w(null),A(null),M(void 0),P(null);try{sessionStorage.removeItem(`maxy-admin-session-key`)}catch{}i(``),f(``),n(`enter-pin`)},[]);return(0,d.useEffect)(()=>{K.current=Z},[Z]),{appState:t,setAppState:n,pin:r,setPin:i,operatorName:a,setOperatorName:l,pinError:u,setPinError:f,showPin:p,setShowPin:m,pinLoading:h,authPolling:_,setAuthPolling:v,authLoading:y,setAuthLoading:b,disconnecting:x,cacheKey:C,setCacheKey:w,claudeInfo:T,setClaudeInfo:E,businessName:D,role:k,userName:j,userAvatar:N,sessionId:F,setSessionId:I,expandAll:L,setExpandAll:R,expandAllDefaultRef:z,remoteAuthEnabled:B,claudeConnected:H,pinInputRef:W,setPinFormRef:G,handleSetPin:J,handleLogin:Y,handleDisconnect:X,handleLogout:Z}}var p=n();function m({inputRef:e,value:t,onChange:n,onComplete:r,showPin:i,autoFocus:a}){let o=(0,d.useRef)([]);function s(e,r){r.key===`Backspace`?(r.preventDefault(),t[e]?n(t.slice(0,e)+t.slice(e+1)):e>0&&(n(t.slice(0,e-1)+t.slice(e)),o.current[e-1]?.focus())):r.key===`ArrowLeft`&&e>0?o.current[e-1]?.focus():r.key===`ArrowRight`&&e<5?o.current[e+1]?.focus():r.key===`Enter`&&(r.preventDefault(),r.currentTarget.form?.requestSubmit())}function c(e,i){let a=i.nativeEvent.data;if(!a||!/^\d$/.test(a))return;let s=t.split(``);for(s[e]=a;s.length<e;)s.push(``);let c=s.join(``).replace(/\D/g,``).slice(0,6);n(c),c.length===6?r?.(c):e<5&&o.current[e+1]?.focus()}function l(e){e.preventDefault();let t=e.clipboardData.getData(`text`).replace(/\D/g,``).slice(0,6);t&&(n(t),t.length===6?r?.(t):o.current[t.length]?.focus())}return(0,p.jsx)(`div`,{className:`pin-field`,children:Array.from({length:6}).map((n,r)=>(0,p.jsx)(`input`,{ref:t=>{o.current[r]=t,r===0&&e&&(e.current=t)},type:`text`,inputMode:`numeric`,className:`pin-box${t[r]?` pin-box-filled`:``}`,value:t[r]?i?t[r]:`•`:``,onKeyDown:e=>s(r,e),onInput:e=>c(r,e),onPaste:l,onFocus:e=>e.target.select(),autoFocus:a&&r===0,autoComplete:`off`,maxLength:1,"aria-label":`PIN digit ${r+1}`},r))})}function h(e){let{pin:n,setPin:r,showPin:i,setShowPin:o,pinLoading:s,pinError:c,pinInputRef:d,setPinFormRef:f,onSubmit:h,operatorName:g,setOperatorName:_}=e;return(0,p.jsx)(`div`,{className:`connect-page`,children:(0,p.jsxs)(`div`,{className:`connect-content`,children:[(0,p.jsx)(`img`,{src:t,alt:a.productName,className:`connect-logo connect-logo--maxy`}),!a.logoContainsName&&(0,p.jsxs)(`h1`,{className:`connect-title`,children:[`Welcome to `,a.productName]}),(0,p.jsxs)(`p`,{className:`connect-subtitle`,children:[`Tell `,a.productName,` who you are, then choose a PIN.`]}),(0,p.jsxs)(`form`,{ref:f,onSubmit:h,className:`connect-pin-form`,children:[(0,p.jsxs)(`div`,{className:`pin-input-row`,children:[(0,p.jsx)(`input`,{type:`text`,className:`connect-name-input`,placeholder:`Your full name`,value:g,onChange:e=>_(e.target.value),autoComplete:`name`,autoFocus:!0,required:!0,"aria-label":`Your full name`}),(0,p.jsx)(`div`,{style:{width:38,flexShrink:0},"aria-hidden":`true`})]}),(0,p.jsxs)(`div`,{className:`pin-input-row`,children:[(0,p.jsx)(m,{inputRef:d,value:n,onChange:r,onComplete:()=>{},showPin:i}),(0,p.jsx)(u,{variant:`send`,type:`submit`,disabled:!n||!g.trim(),loading:s,"aria-label":`Set PIN`,children:(0,p.jsxs)(`svg`,{viewBox:`0 0 24 24`,fill:`none`,stroke:`currentColor`,strokeWidth:`2`,strokeLinecap:`round`,strokeLinejoin:`round`,children:[(0,p.jsx)(`line`,{x1:`5`,y1:`12`,x2:`19`,y2:`12`}),(0,p.jsx)(`polyline`,{points:`12 5 19 12 12 19`})]})})]}),(0,p.jsx)(l,{checked:i,onChange:()=>o(e=>!e),label:`Show PIN`})]}),c&&(0,p.jsx)(`p`,{className:`admin-pin-error`,children:c})]})})}function g(e){let{pin:n,setPin:r,showPin:i,setShowPin:o,pinLoading:s,pinError:c,pinInputRef:d,onSubmit:f,remoteAuthEnabled:h,onSignOutRemote:g}=e;return(0,p.jsxs)(`div`,{className:`connect-page`,children:[h&&g&&(0,p.jsx)(`button`,{type:`button`,className:`connect-signout`,onClick:g,children:`Sign out`}),(0,p.jsxs)(`div`,{className:`connect-content`,children:[(0,p.jsx)(`img`,{src:t,alt:a.productName,className:`connect-logo connect-logo--maxy`}),!a.logoContainsName&&(0,p.jsx)(`h1`,{className:`connect-title`,children:a.productName}),(0,p.jsxs)(`form`,{onSubmit:f,className:`connect-pin-form`,children:[(0,p.jsxs)(`div`,{className:`pin-input-row`,children:[(0,p.jsx)(m,{inputRef:d,value:n,onChange:r,onComplete:()=>{},showPin:i,autoFocus:!0}),(0,p.jsx)(u,{variant:`send`,type:`submit`,disabled:!n,loading:s,children:(0,p.jsxs)(`svg`,{viewBox:`0 0 24 24`,fill:`none`,stroke:`currentColor`,strokeWidth:`2`,strokeLinecap:`round`,strokeLinejoin:`round`,children:[(0,p.jsx)(`line`,{x1:`5`,y1:`12`,x2:`19`,y2:`12`}),(0,p.jsx)(`polyline`,{points:`12 5 19 12 12 19`})]})})]}),(0,p.jsx)(`div`,{className:`pin-options`,children:(0,p.jsx)(l,{checked:i,onChange:()=>o(e=>!e),label:`Show PIN`})})]}),c&&(0,p.jsx)(`p`,{className:`admin-pin-error`,children:c})]})]})}function _(e){let{authPolling:n,setAuthPolling:r,authLoading:i,setAuthLoading:o,pinError:s,setPinError:c,setAppState:l}=e,[f,m]=(0,d.useState)(!1),[h,g]=(0,d.useState)(!1),[_,v]=(0,d.useState)(``),[y,b]=(0,d.useState)(``),[x,S]=(0,d.useState)(``);async function C(){S(``);try{let e=await(await fetch(`/api/onboarding/claude-auth`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({action:`paste-code`,code:y})})).json();e.accepted?(S(`Code submitted. Finishing sign-in…`),b(``)):S(e.error||`Could not submit code.`)}catch(e){console.error(`[admin] paste-code error:`,e),S(`Could not submit code.`)}}async function w(){g(!0),c(``);try{let e=await(await fetch(`/api/onboarding/claude-auth`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({action:`launch-browser`})})).json();e.launched?m(!0):e.error&&c(e.error)}catch(e){console.error(`[admin] browser launch error:`,e),c(`Could not launch browser.`)}g(!1)}async function T(){o(!0),c(``);try{let e=await(await fetch(`/api/onboarding/claude-auth`,{method:`POST`})).json();if(e.started){r(!0),m(!0),o(!1),v(e.transport||``);for(let e=0;e<120;e++)if(await new Promise(e=>setTimeout(e,2e3)),(await(await fetch(`/api/onboarding/claude-auth`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({action:`wait`})})).json()).authenticated){await fetch(`/api/onboarding/claude-auth`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({action:`stop`})}),l(`enter-pin`);return}c(`Timed out waiting for sign-in. Try again.`),r(!1)}else e.error&&c(e.error)}catch(e){console.error(`[admin] auth flow error:`,e),c(`Could not start auth flow.`)}o(!1)}async function E(){await fetch(`/api/onboarding/claude-auth`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({action:`stop`})}),r(!1),c(``)}return n||f?(0,p.jsxs)(`div`,{style:{display:`flex`,flexDirection:`column`,height:`100dvh`,overflow:`auto`},children:[(0,p.jsxs)(`header`,{className:`chat-header`,style:{paddingBottom:`12px`,flexShrink:0,position:`relative`,maxWidth:`680px`,width:`100%`,margin:`0 auto`,padding:`24px 20px 12px`},children:[n?(0,p.jsx)(`button`,{onClick:E,style:{position:`absolute`,top:`12px`,right:`12px`,background:`none`,border:`none`,color:`#999`,fontSize:`13px`,cursor:`pointer`,padding:`4px 8px`},"aria-label":`Cancel`,children:`✕`}):(0,p.jsx)(`button`,{onClick:()=>m(!1),style:{position:`absolute`,top:`12px`,right:`12px`,background:`none`,border:`none`,color:`#999`,fontSize:`13px`,cursor:`pointer`,padding:`4px 8px`},"aria-label":`Close browser`,children:`✕`}),(0,p.jsx)(`img`,{src:`/brand/claude.png`,alt:`Claude`,className:`chat-logo`}),(0,p.jsx)(`h1`,{className:`chat-tagline`,children:`Connect Claude`}),(0,p.jsx)(`p`,{className:`chat-intro`,children:n?`Sign in and authorize in the browser below.`:`Open your email or prepare your accounts, then sign in.`}),!n&&(0,p.jsx)(`div`,{style:{marginTop:`12px`},children:(0,p.jsx)(u,{variant:`primary`,onClick:T,disabled:i,children:i?(0,p.jsxs)(p.Fragment,{children:[(0,p.jsx)(`span`,{className:`spin`,style:{display:`inline-block`},children:`✱`}),` Connecting…`]}):`Sign in to Claude`})}),n&&_===`native`&&(0,p.jsxs)(`div`,{style:{marginTop:`14px`,maxWidth:`420px`,margin:`14px auto 0`,display:`flex`,flexDirection:`column`,gap:`8px`},children:[(0,p.jsx)(`label`,{style:{fontSize:`12px`,color:`#999`,lineHeight:1.4},children:`If the browser didn't finish sign-in, paste the code or full redirect URL from Claude's page:`}),(0,p.jsxs)(`div`,{style:{display:`flex`,gap:`8px`},children:[(0,p.jsx)(`input`,{type:`text`,value:y,onChange:e=>b(e.target.value),placeholder:`Paste code or redirect URL`,style:{flex:1,padding:`8px 10px`,fontSize:`13px`,border:`1px solid #ccc`,borderRadius:`6px`}}),(0,p.jsx)(u,{variant:`primary`,onClick:C,disabled:!y.trim(),children:`Submit`})]}),x&&(0,p.jsx)(`p`,{style:{fontSize:`12px`,color:`#999`,margin:0},children:x})]})]}),(0,p.jsx)(`div`,{style:{flex:1,display:`flex`,flexDirection:`column`,minHeight:0,gap:`10px`,padding:`0 0 16px`},children:(0,p.jsx)(`iframe`,{src:`/vnc-viewer.html`,style:{flex:1,width:`100%`,minHeight:0,border:`none`,background:`#111`,display:`block`},title:`Claude Sign-in`})}),s&&(0,p.jsx)(`p`,{className:`admin-pin-error`,style:{textAlign:`center`,padding:`0 20px 16px`},children:s})]}):(0,p.jsx)(`div`,{className:`connect-page`,children:(0,p.jsxs)(`div`,{className:`connect-content`,children:[(0,p.jsxs)(`div`,{className:`connect-logos`,children:[(0,p.jsx)(`div`,{className:`connect-logo-wrap`,children:(0,p.jsx)(`img`,{src:`/brand/claude.png`,alt:`Claude`,className:`connect-logo`})}),(0,p.jsx)(`svg`,{className:`connect-arrow`,viewBox:`0 0 48 24`,fill:`none`,xmlns:`http://www.w3.org/2000/svg`,children:(0,p.jsx)(`path`,{d:`M0 12h44m0 0l-8-8m8 8l-8 8`,stroke:`currentColor`,strokeWidth:`2`,strokeLinecap:`round`,strokeLinejoin:`round`})}),(0,p.jsxs)(`div`,{className:`connect-logo-wrap`,children:[(0,p.jsx)(`img`,{src:t,alt:a.productName,className:`connect-logo connect-logo--maxy`}),!a.logoContainsName&&(0,p.jsx)(`span`,{className:`connect-logo-label`,children:a.productName})]})]}),(0,p.jsxs)(`h1`,{className:`connect-title`,children:[`Connect Claude to power `,a.productName]}),(0,p.jsx)(`p`,{className:`connect-subtitle`,children:`Sign in with your Anthropic account to get started.`}),(0,p.jsx)(u,{variant:`primary`,onClick:T,disabled:i,children:i?(0,p.jsxs)(p.Fragment,{children:[(0,p.jsx)(`span`,{className:`spin`,style:{display:`inline-block`},children:`✱`}),` Connecting…`]}):`Sign in to Claude`}),(0,p.jsx)(`p`,{style:{marginTop:`6px`,fontSize:`11px`,color:`#999`,maxWidth:`300px`,textAlign:`center`,lineHeight:`1.4`},children:`First time? You may need to sign into your email and Anthropic account in the browser before connecting.`}),(0,p.jsx)(`button`,{onClick:w,disabled:h,style:{marginTop:`12px`,background:`none`,border:`none`,color:`var(--color-primary, #666)`,fontSize:`13px`,cursor:`pointer`,textDecoration:`underline`,textUnderlineOffset:`3px`},children:h?`Launching…`:`Open browser first`}),s&&(0,p.jsx)(`p`,{className:`admin-pin-error`,children:s})]})})}function v({auth:e}){return e.appState===`loading`?(0,p.jsx)(i,{surface:`gate`}):e.appState===`set-pin`?(0,p.jsx)(h,{pin:e.pin,setPin:e.setPin,showPin:e.showPin,setShowPin:e.setShowPin,pinLoading:e.pinLoading,pinError:e.pinError,pinInputRef:e.pinInputRef,setPinFormRef:e.setPinFormRef,onSubmit:e.handleSetPin,operatorName:e.operatorName,setOperatorName:e.setOperatorName}):e.appState===`connect-claude`?(0,p.jsx)(_,{authPolling:e.authPolling,setAuthPolling:e.setAuthPolling,authLoading:e.authLoading,setAuthLoading:e.setAuthLoading,pinError:e.pinError,setPinError:e.setPinError,setAppState:e.setAppState}):e.appState===`enter-pin`?(0,p.jsx)(g,{pin:e.pin,setPin:e.setPin,showPin:e.showPin,setShowPin:e.setShowPin,pinLoading:e.pinLoading,pinError:e.pinError,pinInputRef:e.pinInputRef,onSubmit:e.handleLogin,remoteAuthEnabled:e.remoteAuthEnabled,onSignOutRemote:()=>{console.info(`[admin-ui] remote-auth sign-out → /__remote-auth/logout`),window.location.href=`/__remote-auth/logout`}}):null}export{f as n,v as t};