@rubytech/create-sitedesk-code 0.1.530 → 0.1.531

package/payload/server/{chunk-2YMGNYA3.js → chunk-SVB5NZ64.js}

@@ -2710,6 +2710,12 @@ function enumerateValidAccountIds(accountsDir) {
   cache2.set(accountsDir, valid);
   return valid;
 }
+function isProvisionedAccount(accountsDir, id) {
+  const cached = cache2.get(accountsDir);
+  if (cached?.includes(id)) return true;
+  cache2.delete(accountsDir);
+  return enumerateValidAccountIds(accountsDir).includes(id);
+}
 function resolveHouseOrSoleAccountId(accountsDir) {
   const valid = enumerateValidAccountIds(accountsDir);
   const houses = [];
@@ -2784,10 +2790,19 @@ function readChannelRoutingOverride(accountsDir, houseId) {
   }
   return target;
 }
-function resolvePlatformAccountId(accountsDir = ACCOUNTS_DIR) {
+function resolvePlatformAccountIdWithSource(accountsDir = ACCOUNTS_DIR) {
   const houseId = resolveHouseId(accountsDir);
   const routed = readChannelRoutingOverride(accountsDir, houseId);
-  return routed ?? houseId;
+  return routed !== null ? { accountId: routed, source: "routing" } : { accountId: houseId, source: "house" };
+}
+function resolvePlatformAccountId(accountsDir = ACCOUNTS_DIR) {
+  return resolvePlatformAccountIdWithSource(accountsDir).accountId;
+}
+function resolveConnectionPlatformAccountId(credentialAccountId, accountsDir = ACCOUNTS_DIR) {
+  if (isProvisionedAccount(accountsDir, credentialAccountId)) {
+    return { accountId: credentialAccountId, source: "self" };
+  }
+  return resolvePlatformAccountIdWithSource(accountsDir);
 }
 function resolveHouseAccountId(accountsDir = ACCOUNTS_DIR) {
   return resolveHouseId(accountsDir);
@@ -3964,22 +3979,14 @@ async function init(opts) {
     });
   }
 }
-async function startConnection(accountId) {
-  if (!configDir) throw new Error("WhatsApp manager not initialized");
-  const authDir = resolveAuthDir(configDir, accountId);
-  const hasAuth = await authExists(authDir);
-  if (!hasAuth) {
-    console.error(`${TAG17} no credentials for account=${accountId}`);
-    throw new Error(`no credentials for account=${accountId}`);
-  }
-  let platformAccountId;
-  let houseAccountId;
+function resolveConnectionAccountIds(accountId, accountsDir) {
   try {
-    platformAccountId = resolvePlatformAccountId();
-    houseAccountId = resolveHouseAccountId();
+    const resolved = resolveConnectionPlatformAccountId(accountId, accountsDir);
+    const houseAccountId = resolveHouseAccountId(accountsDir);
     console.error(
-      `[whatsapp-persist] resolved-account-id waname=${accountId} uuid=${platformAccountId} house=${houseAccountId}`
+      `[whatsapp-persist] resolved-account-id waname=${accountId} uuid=${resolved.accountId} house=${houseAccountId} source=${resolved.source}`
     );
+    return { platformAccountId: resolved.accountId, houseAccountId };
   } catch (err) {
     const reason = err instanceof Error ? err.message : String(err);
     console.error(
@@ -3987,6 +3994,16 @@ async function startConnection(accountId) {
     );
     throw err;
   }
+}
+async function startConnection(accountId) {
+  if (!configDir) throw new Error("WhatsApp manager not initialized");
+  const authDir = resolveAuthDir(configDir, accountId);
+  const hasAuth = await authExists(authDir);
+  if (!hasAuth) {
+    console.error(`${TAG17} no credentials for account=${accountId}`);
+    throw new Error(`no credentials for account=${accountId}`);
+  }
+  const { platformAccountId, houseAccountId } = resolveConnectionAccountIds(accountId);
   await stopConnection(accountId);
   const conn = {
     accountId,
@@ -4111,23 +4128,15 @@ function isAnyConnected() {
 function listConnectionPlatformAccountIds() {
   return [...connections.values()].map((conn) => conn.platformAccountId);
 }
+function listConnectionAccountStamps() {
+  return [...connections.values()].map((conn) => ({
+    accountId: conn.accountId,
+    platformAccountId: conn.platformAccountId
+  }));
+}
 async function registerLoginSocket(accountId, sock, authDir) {
   if (!configDir) throw new Error("WhatsApp manager not initialized");
-  let platformAccountId;
-  let houseAccountId;
-  try {
-    platformAccountId = resolvePlatformAccountId();
-    houseAccountId = resolveHouseAccountId();
-    console.error(
-      `[whatsapp-persist] resolved-account-id waname=${accountId} uuid=${platformAccountId} house=${houseAccountId}`
-    );
-  } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
-    console.error(
-      `[whatsapp-persist] resolved-account-id FAIL waname=${accountId} reason=${reason}`
-    );
-    throw err;
-  }
+  const { platformAccountId, houseAccountId } = resolveConnectionAccountIds(accountId);
   await stopConnection(accountId);
   const conn = {
     accountId,
@@ -5269,6 +5278,7 @@ export {
   deriveCacheKey,
   buildSelfChatDispatch,
   init,
+  resolveConnectionAccountIds,
   startConnection,
   stopConnection,
   getStatus,
@@ -5282,6 +5292,7 @@ export {
   resolveConversationPersistAccount,
   isAnyConnected,
   listConnectionPlatformAccountIds,
+  listConnectionAccountStamps,
   registerLoginSocket,
   reloadConfig,
   getMessages,

package/payload/server/{manager-XPRN5UF5.js → manager-4Q3DTLXO.js}

@@ -11,6 +11,7 @@ import {
   isAnyConnected,
   isManagerRoutedToHouse,
   isObserveAccount,
+  listConnectionAccountStamps,
   listConnectionPlatformAccountIds,
   listConnections,
   listConversationJids,
@@ -18,6 +19,7 @@ import {
   messageStoreKey,
   registerLoginSocket,
   reloadConfig,
+  resolveConnectionAccountIds,
   resolveConversationPersistAccount,
   resolveInboundPersistAccount,
   resolveReadStoreKey,
@@ -28,7 +30,7 @@ import {
   startConnection,
   stopConnection,
   storeMessage
-} from "./chunk-2YMGNYA3.js";
+} from "./chunk-SVB5NZ64.js";
 import "./chunk-BP7LH7MC.js";
 import "./chunk-PFF6I7KP.js";
 export {
@@ -43,6 +45,7 @@ export {
   isAnyConnected,
   isManagerRoutedToHouse,
   isObserveAccount,
+  listConnectionAccountStamps,
   listConnectionPlatformAccountIds,
   listConnections,
   listConversationJids,
@@ -50,6 +53,7 @@ export {
   messageStoreKey,
   registerLoginSocket,
   reloadConfig,
+  resolveConnectionAccountIds,
   resolveConversationPersistAccount,
   resolveInboundPersistAccount,
   resolveReadStoreKey,

package/payload/server/server.js

@@ -124,6 +124,7 @@ import {
   isUserJid,
   isWithinOwnAccountPartition,
   jidToE164,
+  listConnectionAccountStamps,
   listConnectionPlatformAccountIds,
   listConnections,
   listLedgerAccounts,
@@ -183,7 +184,7 @@ import {
   waitForConnection,
   warnNonUuidAccount,
   writeChatMetadataMerged
-} from "./chunk-2YMGNYA3.js";
+} from "./chunk-SVB5NZ64.js";
 import {
   ACCOUNTS_DIR,
   BIN_DIR,
@@ -1586,7 +1587,11 @@ var require_dist5 = __commonJS({
       "Risk",
       "Source",
       "Finding",
-      "Hypothesis"
+      "Hypothesis",
+      // Task 2220 — :Learning carries learning_embedding, which learnings-derive
+      // queries by name to reconcile a claim against an existing learning. Without
+      // it here the chokepoint cannot detect a null-embedding Learning write.
+      "Learning"
     ]);
     exports.DOCUMENT_ARCHIVE_LABELS = /* @__PURE__ */ new Set([
       "KnowledgeDocument",
@@ -4999,7 +5004,7 @@ async function defaultHttpGet(url) {
   }
 }
 async function defaultResolve(accountId) {
-  const { resolveSocket: resolveSocket2 } = await import("./manager-XPRN5UF5.js");
+  const { resolveSocket: resolveSocket2 } = await import("./manager-4Q3DTLXO.js");
   return resolveSocket2(accountId);
 }
 async function fetchAvatar(accountId, jid, deps = {}) {
@@ -6144,6 +6149,15 @@ function reconcileMessageStoreAccountKeys(input) {
   return { ok: orphanLiveKeys.length === 0, orphanLiveKeys };
 }
 
+// app/lib/whatsapp/connection-account-reconcile.ts
+function reconcileConnectionAccountStamps(input) {
+  const registered = new Set(input.registeredAccountIds);
+  const mismatches = input.connections.filter(
+    (c) => registered.has(c.accountId) && c.platformAccountId !== c.accountId
+  );
+  return { ok: mismatches.length === 0, mismatches };
+}
+
 // app/lib/whatsapp/outbound/send-document.ts
 import { realpathSync } from "fs";
 import { readFile as readFile3, stat as stat2 } from "fs/promises";
@@ -6513,20 +6527,39 @@ function houseSocketScopeDenial(c, op) {
   console.error(`${TAG14} op=authz-deny route=${op} caller=${callerAccountId ?? "none"} houseAdmin=${houseAdminScope ? "y" : "n"}`);
   return c.json({ ok: false, error: "Not authorized. The WhatsApp connection and its settings are house-scoped; this session may only act on its own account." }, 403);
 }
-function selfOrHouseScopeDenial(c, targetAccountId, op) {
+function selfOrHouseScopeDenial(c, targetAccountId, op, targetSource = "explicit") {
   const { decision, callerAccountId, houseAdminScope } = evaluateCallerScope(c, targetAccountId);
+  const tail = `target=${targetAccountId} targetSource=${targetSource} caller=${callerAccountId ?? "none"} houseAdmin=${houseAdminScope ? "y" : "n"}`;
   if (decision.authorized) {
-    console.error(`${TAG14} op=authz-ok route=${op} target=${targetAccountId} caller=${callerAccountId ?? "none"} houseAdmin=${houseAdminScope ? "y" : "n"}`);
+    console.error(`${TAG14} op=authz-ok route=${op} ${tail}`);
     return null;
   }
-  console.error(`${TAG14} op=authz-deny route=${op} target=${targetAccountId} caller=${callerAccountId ?? "none"} houseAdmin=${houseAdminScope ? "y" : "n"}`);
+  console.error(`${TAG14} op=authz-deny route=${op} ${tail}`);
   return c.json({ ok: false, error: "Not authorized. This session may only pair or manage its own account." }, 403);
 }
+function resolveLifecycleAccountId(c, raw) {
+  if (typeof raw === "string" && raw.trim().length > 0) {
+    return { accountId: validateAccountId(raw), targetSource: "explicit" };
+  }
+  const callerAccountId = c.req.header("x-maxy-caller-account")?.trim() || null;
+  const houseAdminScope = c.req.header("x-maxy-house-admin-scope")?.trim() || null;
+  const houseAccountId = resolveAccount()?.accountId ?? "";
+  const callerIsHouse = !!houseAdminScope || !!callerAccountId && callerAccountId === houseAccountId;
+  if (callerIsHouse || !callerAccountId) {
+    return { accountId: "default", targetSource: "house-default" };
+  }
+  return { accountId: validateAccountId(callerAccountId), targetSource: "caller-default" };
+}
 var app3 = new Hono();
 app3.get("/status", (c) => {
   try {
-    const denial = houseSocketScopeDenial(c, "status");
-    if (denial) return denial;
+    const houseAccountId = resolveAccount()?.accountId ?? "";
+    const { decision, callerAccountId, houseAdminScope } = evaluateCallerScope(c, houseAccountId);
+    const houseScoped = decision.authorized;
+    if (!houseScoped && !callerAccountId) {
+      console.error(`${TAG14} op=authz-deny route=status caller=none houseAdmin=${houseAdminScope ? "y" : "n"}`);
+      return c.json({ ok: false, error: "Not authorized. The WhatsApp connection and its settings are house-scoped; this session may only act on its own account." }, 403);
+    }
     const live = getStatus();
     const liveIds = new Set(live.map((a) => a.accountId));
     const activeLoginIds = new Set(listActiveLoginAccountIds());
@@ -6540,6 +6573,11 @@ app3.get("/status", (c) => {
     }));
     const summary = accounts.map((a) => `${a.accountId}:${a.connected ? "up" : a.linkedUnconfigured ? "linked-unconfigured" : "down"}:${a.dispatchInbound ? "dispatch" : "observe"}`).join(", ");
     console.error(`${TAG14} status accounts=${accounts.length} [${summary}]`);
+    if (!houseScoped) {
+      const own = accounts.filter((a) => a.accountId === callerAccountId);
+      console.error(`${TAG14} op=status-projection caller=${callerAccountId.slice(0, 8)} scope=self rows=${own.length}`);
+      return c.json({ accounts: own });
+    }
     const reachableAccountIds = [
       .../* @__PURE__ */ new Set([...listStoredAccountIds(), ...listConnectionPlatformAccountIds()])
     ];
@@ -6550,7 +6588,16 @@ app3.get("/status", (c) => {
     if (!storeKeyReconcile.ok) {
       console.warn(`${TAG14} store-key-drift orphanLiveKeys=[${storeKeyReconcile.orphanLiveKeys.join(",")}] \u2014 in-memory cache keyed by a value with no disk account; read tools will miss`);
     }
-    return c.json({ accounts, storeKeyReconcile });
+    const connectionAccountReconcile = reconcileConnectionAccountStamps({
+      connections: listConnectionAccountStamps(),
+      registeredAccountIds: listValidAccounts().map((a) => a.accountId)
+    });
+    if (!connectionAccountReconcile.ok) {
+      const pairs = connectionAccountReconcile.mismatches.map((m) => `${m.accountId}:${m.platformAccountId}`).join(",");
+      console.warn(`${TAG14} connection-account-drift mismatches=[${pairs}] \u2014 a socket keyed by a registered account is stamping a different one; its messages persist and read under that account`);
+    }
+    console.error(`${TAG14} op=status-projection caller=${callerAccountId?.slice(0, 8) ?? "none"} scope=house rows=${accounts.length}`);
+    return c.json({ accounts, storeKeyReconcile, connectionAccountReconcile });
   } catch (err) {
     console.error(`${TAG14} status error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
@@ -6559,8 +6606,8 @@ app3.get("/status", (c) => {
 app3.post("/login/start", async (c) => {
   try {
     const body = await c.req.json().catch(() => ({}));
-    const accountId = validateAccountId(body.accountId);
-    const denial = selfOrHouseScopeDenial(c, accountId, "login/start");
+    const { accountId, targetSource } = resolveLifecycleAccountId(c, body.accountId);
+    const denial = selfOrHouseScopeDenial(c, accountId, "login/start", targetSource);
     if (denial) return denial;
     const force = body.force ?? false;
     const phone = typeof body.phone === "string" ? body.phone.trim() : "";
@@ -6580,8 +6627,8 @@ app3.post("/login/start", async (c) => {
 app3.post("/login/wait", async (c) => {
   try {
     const body = await c.req.json().catch(() => ({}));
-    const accountId = validateAccountId(body.accountId);
-    const denial = selfOrHouseScopeDenial(c, accountId, "login/wait");
+    const { accountId, targetSource } = resolveLifecycleAccountId(c, body.accountId);
+    const denial = selfOrHouseScopeDenial(c, accountId, "login/wait", targetSource);
     if (denial) return denial;
     const timeoutMs = body.timeoutMs ?? 6e4;
     const result = await waitForLogin({ accountId, timeoutMs });
@@ -6600,8 +6647,8 @@ app3.post("/login/wait", async (c) => {
 app3.post("/disconnect", async (c) => {
   try {
     const body = await c.req.json().catch(() => ({}));
-    const accountId = validateAccountId(body.accountId);
-    const denial = selfOrHouseScopeDenial(c, accountId, "disconnect");
+    const { accountId, targetSource } = resolveLifecycleAccountId(c, body.accountId);
+    const denial = selfOrHouseScopeDenial(c, accountId, "disconnect", targetSource);
     if (denial) return denial;
     await stopConnection(accountId);
     return c.json({ disconnected: true, accountId });
@@ -6614,8 +6661,9 @@ app3.post("/reconnect", async (c) => {
   let accountId = "(unresolved)";
   try {
     const body = await c.req.json().catch(() => ({}));
-    accountId = validateAccountId(body.accountId);
-    const denial = selfOrHouseScopeDenial(c, accountId, "reconnect");
+    const resolved = resolveLifecycleAccountId(c, body.accountId);
+    accountId = resolved.accountId;
+    const denial = selfOrHouseScopeDenial(c, accountId, "reconnect", resolved.targetSource);
     if (denial) return denial;
     await startConnection(accountId);
     console.error(

package/payload/platform/plugins/linkedin-extension/extension/assets/pill.css

@@ -1,52 +0,0 @@
-/* "Add to SiteDesk" pill injected into LinkedIn profile and DM thread pages. */
-
-#maxy-linkedin-pill.maxy-pill {
-  position: relative;
-  z-index: 9999;
-  display: inline-flex;
-  align-items: center;
-  gap: 6px;
-  margin: 12px;
-  padding: 6px 14px;
-  border: 1px solid #0a66c2;
-  border-radius: 999px;
-  background: #ffffff;
-  color: #0a66c2;
-  font: 600 13px/1.2 -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
-  cursor: pointer;
-  box-shadow: 0 1px 2px rgba(0, 0, 0, 0.06);
-  transition: background 120ms ease, color 120ms ease, border-color 120ms ease;
-}
-
-#maxy-linkedin-pill.maxy-pill:hover {
-  background: #0a66c2;
-  color: #ffffff;
-}
-
-#maxy-linkedin-pill.maxy-pill[data-state="busy"] {
-  background: #f4f7fb;
-  border-color: #a3b6c9;
-  color: #46596d;
-  cursor: progress;
-}
-
-#maxy-linkedin-pill.maxy-pill[data-state="ok"] {
-  background: #e6f4ea;
-  border-color: #2e7d32;
-  color: #2e7d32;
-  cursor: default;
-}
-
-#maxy-linkedin-pill.maxy-pill[data-state="error"] {
-  background: #fdecea;
-  border-color: #b00020;
-  color: #b00020;
-  cursor: pointer;
-}
-
-#maxy-linkedin-pill.maxy-pill[data-state="auth"] {
-  background: #fff7e0;
-  border-color: #b8860b;
-  color: #b8860b;
-  cursor: pointer;
-}

package/payload/platform/plugins/linkedin-extension/extension/content/profile.js

@@ -1,100 +0,0 @@
-// Profile content script. Runs on linkedin.com/in/*.
-// Manifest concatenates extractors.js + this file, so MaxyLinkedinExtractors
-// is in scope. One click → scrape → post to the service worker → pill state.
-
-;(function () {
-  const TAG_MOUNT = '[linkedin-ext-mount]'
-  const TAG_SCRAPE = '[linkedin-ext-scrape]'
-  const TAG_ERROR = '[linkedin-ext-error]'
-  const PILL_ID = 'maxy-linkedin-pill'
-
-  function setState(pill, state, label) {
-    pill.dataset.state = state
-    if (label) pill.textContent = label
-  }
-
-  async function onClick(pill) {
-    const dispatchId = crypto.randomUUID()
-    setState(pill, 'busy', 'Capturing…')
-
-    const result = globalThis.MaxyLinkedinExtractors.extractProfile(document)
-    if (!result.ok) {
-      console.error(TAG_SCRAPE + ' page=profile ok=false missing=' + result.missing.join(','))
-      setState(pill, 'error', 'Missing: ' + result.missing.join(', '))
-      return
-    }
-    console.log(TAG_SCRAPE + ' page=profile ok=true fields=' + Object.keys(result.payload).join(','))
-
-    const envelope = {
-      source: 'linkedin',
-      kind: 'profile',
-      capturedAt: new Date().toISOString(),
-      pageUrl: location.href.split('?')[0].split('#')[0],
-      dispatchId: dispatchId,
-      profile: result.payload,
-    }
-
-    let reply
-    try {
-      reply = await chrome.runtime.sendMessage({ type: 'linkedin-ingest', envelope: envelope })
-    } catch (err) {
-      console.error(TAG_ERROR + ' reason=worker-unreachable detail=' + (err && err.message ? err.message : String(err)))
-      setState(pill, 'error', 'Capture failed')
-      return
-    }
-
-    if (!reply || !reply.ok) {
-      // `worker-unreachable` is the extension's OWN service worker failing to
-      // answer. It is not `unreachable`, which means the admin host did not
-      // answer — blaming SiteDesk here sends the operator to check a tunnel that
-      // was never involved.
-      const reason = (reply && reply.reason) || 'worker-unreachable'
-      const detail = (reply && reply.detail) || ''
-      console.error(TAG_ERROR + ' reason=' + reason + ' detail=' + detail)
-      // Task 2208 — the ingest token is missing or was refused. There is no
-      // sign-in to perform: the operator asks the SiteDesk agent for the token and
-      // pastes it on the options page.
-      if (reason === 'auth') {
-        setState(pill, 'auth', 'Paste SiteDesk token')
-        pill.onclick = function () { chrome.runtime.openOptionsPage() }
-        return
-      }
-      // Task 2185 — the admin host was never granted, so the POST never left
-      // the browser. Sending the operator to the options page is the fix.
-      if (reason === 'permission') {
-        setState(pill, 'auth', 'Grant access')
-        pill.onclick = function () { chrome.runtime.openOptionsPage() }
-        return
-      }
-      if (reason === 'unreachable') {
-        setState(pill, 'error', 'SiteDesk unreachable')
-        return
-      }
-      setState(pill, 'error', 'Capture failed')
-      return
-    }
-
-    setState(pill, 'ok', 'Captured ✓')
-  }
-
-  function mount() {
-    if (document.getElementById(PILL_ID)) return
-    const anchor = document.querySelector('section.top-card-layout, main') || document.body
-    if (!anchor) return
-    const pill = document.createElement('button')
-    pill.id = PILL_ID
-    pill.className = 'maxy-pill'
-    pill.type = 'button'
-    pill.textContent = 'Add to SiteDesk'
-    pill.dataset.state = 'idle'
-    pill.addEventListener('click', function () { onClick(pill) })
-    anchor.prepend(pill)
-    console.log(TAG_MOUNT + ' page=profile url=' + location.href)
-  }
-
-  if (document.readyState === 'loading') {
-    document.addEventListener('DOMContentLoaded', mount, { once: true })
-  } else {
-    mount()
-  }
-})()

package/payload/platform/plugins/linkedin-extension/extension/content/thread.js

@@ -1,102 +0,0 @@
-// Thread content script. Runs on linkedin.com/messaging/thread/*.
-// Manifest concatenates extractors.js + this file.
-
-;(function () {
-  const TAG_MOUNT = '[linkedin-ext-mount]'
-  const TAG_SCRAPE = '[linkedin-ext-scrape]'
-  const TAG_ERROR = '[linkedin-ext-error]'
-  const PILL_ID = 'maxy-linkedin-pill'
-
-  function setState(pill, state, label) {
-    pill.dataset.state = state
-    if (label) pill.textContent = label
-  }
-
-  async function onClick(pill) {
-    const dispatchId = crypto.randomUUID()
-    setState(pill, 'busy', 'Capturing…')
-
-    const result = globalThis.MaxyLinkedinExtractors.extractThread(document)
-    if (!result.ok) {
-      console.error(TAG_SCRAPE + ' page=thread ok=false missing=' + result.missing.join(','))
-      setState(pill, 'error', 'Missing: ' + result.missing.join(', '))
-      return
-    }
-    console.log(
-      TAG_SCRAPE + ' page=thread ok=true fields=participants,bodyText participantCount=' +
-        result.payload.participants.length,
-    )
-
-    const envelope = {
-      source: 'linkedin',
-      kind: 'thread',
-      capturedAt: new Date().toISOString(),
-      pageUrl: location.href.split('?')[0].split('#')[0],
-      dispatchId: dispatchId,
-      thread: result.payload,
-    }
-
-    let reply
-    try {
-      reply = await chrome.runtime.sendMessage({ type: 'linkedin-ingest', envelope: envelope })
-    } catch (err) {
-      console.error(TAG_ERROR + ' reason=worker-unreachable detail=' + (err && err.message ? err.message : String(err)))
-      setState(pill, 'error', 'Capture failed')
-      return
-    }
-
-    if (!reply || !reply.ok) {
-      // `worker-unreachable` is the extension's OWN service worker failing to
-      // answer. It is not `unreachable`, which means the admin host did not
-      // answer — blaming SiteDesk here sends the operator to check a tunnel that
-      // was never involved.
-      const reason = (reply && reply.reason) || 'worker-unreachable'
-      const detail = (reply && reply.detail) || ''
-      console.error(TAG_ERROR + ' reason=' + reason + ' detail=' + detail)
-      // Task 2208 — the ingest token is missing or was refused. There is no
-      // sign-in to perform: the operator asks the SiteDesk agent for the token and
-      // pastes it on the options page.
-      if (reason === 'auth') {
-        setState(pill, 'auth', 'Paste SiteDesk token')
-        pill.onclick = function () { chrome.runtime.openOptionsPage() }
-        return
-      }
-      // Task 2185 — the admin host was never granted, so the POST never left
-      // the browser. Sending the operator to the options page is the fix.
-      if (reason === 'permission') {
-        setState(pill, 'auth', 'Grant access')
-        pill.onclick = function () { chrome.runtime.openOptionsPage() }
-        return
-      }
-      if (reason === 'unreachable') {
-        setState(pill, 'error', 'SiteDesk unreachable')
-        return
-      }
-      setState(pill, 'error', 'Capture failed')
-      return
-    }
-
-    setState(pill, 'ok', 'Captured ✓')
-  }
-
-  function mount() {
-    if (document.getElementById(PILL_ID)) return
-    const anchor = document.querySelector('.msg-thread, header.msg-overlay-bubble-header, main') || document.body
-    if (!anchor) return
-    const pill = document.createElement('button')
-    pill.id = PILL_ID
-    pill.className = 'maxy-pill'
-    pill.type = 'button'
-    pill.textContent = 'Add to SiteDesk'
-    pill.dataset.state = 'idle'
-    pill.addEventListener('click', function () { onClick(pill) })
-    anchor.prepend(pill)
-    console.log(TAG_MOUNT + ' page=thread url=' + location.href)
-  }
-
-  if (document.readyState === 'loading') {
-    document.addEventListener('DOMContentLoaded', mount, { once: true })
-  } else {
-    mount()
-  }
-})()