@saluzi/saluzi-edu 0.3.0 → 0.3.2

package/packages/remote-control-server/src/nodeServer.ts

@@ -7,6 +7,7 @@
  *
  * Usage:
  *   slz rcs                       (zero-config: API key defaults to sk-slz)
+ *   slz rcs one                   (single-user mode: admin/admin123, workers auto-owned)
  *   RCS_API_KEYS=sk-1234 slz rcs
  */
 import { serve } from '@hono/node-server'
@@ -23,18 +24,71 @@ import { closeAllConnections } from './transport/ws-handler.js'
 import { closeAllAcpConnections } from './transport/acp-ws-handler.js'
 import { closeAllRelayConnections } from './transport/acp-relay-handler.js'
 import { startDisconnectMonitor } from './services/disconnect-monitor.js'
+import {
+  ensureSingleUserAdmin,
+  SINGLE_USER_DEFAULT_PASSWORD,
+  SINGLE_USER_USERNAME,
+} from './services/single-user.js'
 
 export interface RcsServerOptions {
   apiKeys: string[]
   port?: number
   host?: string
+  /** Single-user mode (`slz rcs one`): auto-init admin account, workers
+   *  auto-owned, registration disabled, host defaults to 127.0.0.1. */
+  singleUser?: boolean
+  /** Embedded mode: the server shares its process with something else that
+   *  owns the terminal and the process lifecycle (e.g. `slz rcs one` boots
+   *  an in-process REPL as the single repl worker). Skips the SIGINT/SIGTERM
+   *  handlers — they would process.exit(0) on the REPL's first Ctrl+C — and
+   *  skips the block-forever await so the caller can continue booting. */
+  embedded?: boolean
 }
 
-export async function startRcsServer(opts: RcsServerOptions): Promise<void> {
+/** Bound server coordinates, as returned by startRcsServer. */
+export interface RcsServerInfo {
+  port: number
+  /** The address the server actually bound (may be 0.0.0.0). */
+  host: string
+  /** Browser-reachable origin (0.0.0.0/:: mapped to localhost). */
+  webUiUrl: string
+}
+
+export async function startRcsServer(
+  opts: RcsServerOptions,
+): Promise<RcsServerInfo> {
   // Set env vars so config module picks them up
   process.env.RCS_API_KEYS = opts.apiKeys.join(',')
-  if (opts.port) process.env.RCS_PORT = String(opts.port)
-  if (opts.host) process.env.RCS_HOST = opts.host
+  // The config module may already be evaluated (static import above) — its
+  // env-derived values are frozen, so apiKeys/host/port must also be applied
+  // to the live object or they would silently no-op.
+  config.apiKeys = opts.apiKeys
+  if (opts.port) {
+    process.env.RCS_PORT = String(opts.port)
+    config.port = opts.port
+  }
+  if (opts.host) {
+    process.env.RCS_HOST = opts.host
+    config.host = opts.host
+  }
+  if (opts.singleUser) process.env.RCS_SINGLE_USER = 'true'
+
+  // Effective single-user mode: the `one` argument OR RCS_SINGLE_USER=true
+  // set before process start (config.singleUser already reflects the env).
+  const singleUser = opts.singleUser || config.singleUser
+
+  // The config module may already be evaluated (static import above), so
+  // reflect single-user mode on the live object too — request-time reads
+  // (allowRegistration, route gates) must see it regardless of import order.
+  if (singleUser) {
+    config.singleUser = true
+    config.allowRegistration = false
+    // Local convenience mode: bind loopback unless the operator explicitly
+    // chose a host (RCS_HOST at process start or opts.host above).
+    if (!process.env.RCS_HOST) {
+      config.host = '127.0.0.1'
+    }
+  }
 
   const port = config.port
   const host = config.host
@@ -44,8 +98,13 @@ export async function startRcsServer(opts: RcsServerOptions): Promise<void> {
   // Create Node.js WebSocket adapter
   const { injectWebSocket, upgradeWebSocket } = createNodeWebSocket({ app })
 
-  // Middleware
-  app.use('*', logger())
+  // Middleware. Per-request hono logger only in standalone mode — embedded
+  // mode shares the terminal with the host flow (`slz rcs one` prints a
+  // clean banner; the worker logs to its own file), so request spam would
+  // just be noise.
+  if (!opts.embedded) {
+    app.use('*', logger())
+  }
   app.use('*', async (c: Context, next: Next) => {
     const path = new URL(c.req.url).pathname
     if (path.includes('//')) {
@@ -66,6 +125,26 @@ export async function startRcsServer(opts: RcsServerOptions): Promise<void> {
   // Register all routes with Node.js serveStatic and upgradeWebSocket
   registerRoutes(app, serveStatic as any, upgradeWebSocket)
 
+  // Single-user mode: bootstrap the sole admin account (admin/admin123 on
+  // first deployment) BEFORE the server accepts requests, so every worker
+  // registration can resolve an owner and no request ever races the setup.
+  let singleUserAdmin: Awaited<ReturnType<typeof ensureSingleUserAdmin>> = null
+  if (singleUser) {
+    try {
+      singleUserAdmin = await ensureSingleUserAdmin()
+    } catch (err) {
+      console.error('[RCS] Single-user admin bootstrap failed:', err)
+      throw err
+    }
+    if (!singleUserAdmin) {
+      throw new Error(
+        '[RCS] Single-user mode requires an empty or admin-bearing users ' +
+          'table, but the existing DB has neither. Run `slz rcs` (full mode) ' +
+          'or point RCS_DB_PATH at a fresh database.',
+      )
+    }
+  }
+
   // Start HTTP server
   const server = serve({
     fetch: app.fetch,
@@ -73,11 +152,28 @@ export async function startRcsServer(opts: RcsServerOptions): Promise<void> {
     hostname: host,
   })
 
+  // Port conflicts (EADDRINUSE) surface asynchronously as an 'error' event —
+  // without a listener the process crashes with an ugly unhandled error.
+  // Embedded mode keeps running (the REPL owns the process; the bridge will
+  // talk to whatever server already owns the port); standalone exits loudly.
+  server.on('error', (err: NodeJS.ErrnoException) => {
+    console.error(`[RCS] Server error: ${err.message}`)
+    if (!opts.embedded) {
+      // eslint-disable-next-line custom-rules/no-process-exit
+      process.exit(1)
+    }
+  })
+
   // Inject WebSocket support for Node.js
   injectWebSocket(server)
 
-  // Start disconnect monitor
-  startDisconnectMonitor()
+  // Start disconnect monitor. Unref'd: the HTTP server (standalone) or the
+  // host process (embedded) owns the event loop — the interval must not
+  // keep an exited REPL's process alive.
+  const monitorTimer = startDisconnectMonitor()
+  if (monitorTimer.unref) {
+    monitorTimer.unref()
+  }
 
   console.log(
     `[RCS] Remote Control Server starting on ${host}:${port} (Node.js)`,
@@ -89,17 +185,48 @@ export async function startRcsServer(opts: RcsServerOptions): Promise<void> {
   const webUiHost = host === '0.0.0.0' || host === '::' ? 'localhost' : host
   console.log(`[RCS] Web UI: http://${webUiHost}:${port}/code/`)
 
+  if (singleUser) {
+    console.log('[RCS] Single-user mode (slz rcs one):')
+    if (singleUserAdmin?.created) {
+      console.log(
+        `[RCS]   admin account initialized — username: ${SINGLE_USER_USERNAME} password: ${SINGLE_USER_DEFAULT_PASSWORD}`,
+      )
+      console.log(
+        '[RCS]   (local convenience default — change it after first login)',
+      )
+    } else {
+      console.log(
+        `[RCS]   using existing account: ${singleUserAdmin?.username ?? SINGLE_USER_USERNAME}`,
+      )
+    }
+    console.log('[RCS]   registration disabled — this is the only account')
+    console.log(
+      '[RCS]   workers bind zero-config and are owned by this account (no claim)',
+    )
+  }
+
   const workerBaseUrl = config.baseUrl || `http://${webUiHost}:${port}`
   console.log('[RCS] Worker connect:')
   console.log(
     '[RCS]   same host: zero config — workers default to http://localhost:3000 + sk-slz',
   )
-  console.log(
-    `[RCS]   remote host: export SALUZI_BRIDGE_BASE_URL=${workerBaseUrl}`,
-  )
-  console.log(
-    '[RCS]                export SALUZI_BRIDGE_OAUTH_TOKEN=<your-api-key>',
-  )
+  if (!singleUser) {
+    console.log(
+      `[RCS]   remote host: export SALUZI_BRIDGE_BASE_URL=${workerBaseUrl}`,
+    )
+    console.log(
+      '[RCS]                export SALUZI_BRIDGE_OAUTH_TOKEN=<your-api-key>',
+    )
+  }
+
+  // Embedded mode: the caller owns the process lifecycle (e.g. `slz rcs one`
+  // boots an in-process REPL as the single repl worker). No signal handlers
+  // — they would process.exit(0) on the REPL's first Ctrl+C — and no
+  // block-forever: return the bound coordinates so the caller can wire the
+  // in-process bridge + browser to it.
+  if (opts.embedded) {
+    return { port, host, webUiUrl: `http://${webUiHost}:${port}` }
+  }
 
   // Graceful shutdown
   function gracefulShutdown(signal: string) {
@@ -114,6 +241,7 @@ export async function startRcsServer(opts: RcsServerOptions): Promise<void> {
   process.on('SIGINT', () => gracefulShutdown('SIGINT'))
   process.on('SIGTERM', () => gracefulShutdown('SIGTERM'))
 
-  // Block forever — server keeps running
-  await new Promise(() => {})
+  // Block forever — server keeps running. The promise never resolves; it
+  // only exists so the caller's await parks and the return type holds.
+  return new Promise<RcsServerInfo>(() => {})
 }

package/packages/remote-control-server/src/registerRoutes.ts

@@ -7,6 +7,11 @@ import { fileURLToPath } from 'node:url'
 import { createAcpApp } from './routes/acp'
 import { createSessionIngressApp } from './routes/v1/session-ingress'
 import { csrfCheck } from './auth/csrf'
+import { config } from './config'
+import { getDb } from './db/sqlite'
+import { issueSessionToken } from './auth/session'
+import { buildSessionCookies } from './auth/cookie'
+import { consumeWebLoginCode } from './services/web-login'
 
 // Routes
 import v1Artifacts from './routes/v1/artifacts'
@@ -134,6 +139,38 @@ export function registerRoutes(
     app.get(`${p}/*`, ss({ root: webDir, path: 'index.html' }))
   }
 
+  // GET /otp/:code — one-time browser login for `slz rcs one`.
+  //
+  // The CLI mints a single-use code in-process right before opening the
+  // browser (services/web-login.ts). The browser hits this route, the
+  // server sets the single admin's session cookies and redirects to the
+  // stored target path — typically /code/<sessionId>, so a fresh browser
+  // lands straight in the just-created session instead of the login page.
+  // Codes are 2-minute TTL and only exist in single-user mode; full mode
+  // keeps the username/password ceremony.
+  app.get('/otp/:code', async c => {
+    if (!config.singleUser) {
+      return c.json({ error: 'Not found' }, 404)
+    }
+    const record = consumeWebLoginCode(c.req.param('code')!)
+    if (!record) {
+      // Unknown/expired/used — the manual login page still works
+      // (single-user mode hints the default credentials there).
+      return c.redirect('/login')
+    }
+    const db = getDb()
+    const { accessToken, refreshToken } = issueSessionToken(record.userId, db)
+    const secure =
+      c.req.header('X-Forwarded-Proto') === 'https' ||
+      c.req.url.startsWith('https')
+    for (const cookie of buildSessionCookies(accessToken, refreshToken, {
+      secure,
+    })) {
+      c.header('Set-Cookie', cookie, { append: true })
+    }
+    return c.redirect(record.targetPath)
+  })
+
   // Root redirect → /code/ (main dashboard entry point)
   app.get('/', c => c.redirect('/code/'))
 }

package/packages/remote-control-server/src/routes/v1/environments.ts

@@ -1,5 +1,6 @@
 import { Hono } from 'hono'
 import { randomUUID } from 'node:crypto'
+import { config } from '../../config'
 import {
   registerEnvironment,
   deregisterEnvironment,
@@ -14,6 +15,7 @@ import {
 } from '../../auth/bridge-auth'
 import { getDb } from '../../db/sqlite'
 import { isSessionClosedStatus } from '../../services/session'
+import { getSingleUserAdminUuid } from '../../services/single-user'
 import {
   storeBindEnvSessionsToTeam,
   storeGetEnvironment,
@@ -216,6 +218,15 @@ app.post('/bridge', acceptCliHeaders, bridgeAuth, async c => {
     }
   }
 
+  // Single-user mode (`slz rcs one`): every worker belongs to the sole
+  // admin account. Workers register with just the API key (no X-User-Id,
+  // no X-Username) — instead of falling into the claim flow below, the
+  // env is owned by the single admin immediately. Local convenience:
+  // the server binds 127.0.0.1, so the API key is the only credential.
+  if (config.singleUser && !ownerUserId && !teamId) {
+    ownerUserId = getSingleUserAdminUuid(db)
+  }
+
   // If neither X-User-Id nor the resolved userId yields an owner (or the
   // value is unresolvable), and X-Team-Id is also absent, the env is
   // "unowned" — a claim_token is generated and returned so the worker can

package/packages/remote-control-server/src/routes/web/auth-routes.ts

@@ -379,12 +379,18 @@ app.post('/logout', async c => {
 
 // GET /register-status — Whether self-registration is open
 app.get('/register-status', c => {
-  return c.json({ allowed: config.allowRegistration })
+  return c.json({ allowed: config.allowRegistration && !config.singleUser })
 })
 
 // POST /register — Self-register a new member account (no team association).
 // Only available when RCS_ALLOW_REGISTRATION !== 'false'.
 app.post('/register', async c => {
+  if (config.singleUser) {
+    return c.json(
+      { error: 'Registration is disabled in single-user mode' },
+      403,
+    )
+  }
   if (!config.allowRegistration) {
     return c.json({ error: 'Registration is disabled' }, 403)
   }
@@ -443,6 +449,15 @@ app.post('/register', async c => {
 
 // POST /join — Join via invitation token
 app.post('/join', async c => {
+  // Single-user mode: exactly one account exists, by design. New accounts
+  // would need an owner model the mode doesn't have — run full mode instead.
+  if (config.singleUser) {
+    return c.json(
+      { error: 'Invitations are disabled in single-user mode' },
+      403,
+    )
+  }
+
   let body: Record<string, unknown>
   try {
     body = await c.req.json()
@@ -605,10 +620,13 @@ app.get('/setup-status', c => {
     const count = db.query('SELECT COUNT(*) as count FROM users').get() as {
       count: number
     }
-    return c.json({ needsSetup: count.count === 0 })
+    return c.json({
+      needsSetup: count.count === 0,
+      singleUser: config.singleUser,
+    })
   } catch (err) {
     console.warn('[/setup-status] DB check failed:', err)
-    return c.json({ needsSetup: true })
+    return c.json({ needsSetup: true, singleUser: config.singleUser })
   }
 })
 

package/packages/remote-control-server/src/services/disconnect-monitor.ts

@@ -51,8 +51,8 @@ export function runDisconnectMonitorSweep(now = Date.now()) {
   }
 }
 
-export function startDisconnectMonitor() {
-  setInterval(() => {
+export function startDisconnectMonitor(): ReturnType<typeof setInterval> {
+  return setInterval(() => {
     runDisconnectMonitorSweep()
   }, 60_000) // Check every minute
 }

package/packages/remote-control-server/src/services/single-user.ts

@@ -0,0 +1,123 @@
+import { randomUUID } from 'node:crypto'
+import type { Database } from 'bun:sqlite'
+import { getDb } from '../db/sqlite'
+import { hashPasswordAsync } from '../auth/password'
+
+/**
+ * Single-user mode (`slz rcs one`) — the server runs with exactly one
+ * admin account, auto-created on first deployment. Every worker that
+ * binds is owned by this account (no X-User-Id, no claim flow), and
+ * self-registration / invitation joins are disabled (see auth-routes).
+ * Intended for local deployments (host binds 127.0.0.1) where multi-user
+ * auth is ceremony, not protection.
+ */
+export const SINGLE_USER_USERNAME = 'admin'
+export const SINGLE_USER_DEFAULT_PASSWORD = 'admin123'
+
+interface UserRow {
+  id: string
+  username: string
+  role: string
+}
+
+export interface SingleUserAdmin {
+  userId: string
+  username: string
+  /** True when this call created the account (first deployment). */
+  created: boolean
+}
+
+/**
+ * Idempotent bootstrap of the single-user admin account.
+ *
+ * Resolution order:
+ * 1. An existing user named `admin` — reuse it (previously initialized
+ *    single-user DB, or a full-mode DB where someone already chose that
+ *    name).
+ * 2. Any existing admin — reuse the first one (full-mode DB set up via
+ *    /setup: that admin IS the single user; never mint a second account).
+ * 3. Empty users table — create `admin` / `admin123` with role=admin.
+ *
+ * Returns null only when the users table has rows but none is an admin
+ * and none is named `admin` (a corrupted/mixed DB) — the caller decides
+ * whether that is fatal.
+ */
+export async function ensureSingleUserAdmin(
+  db?: Database,
+): Promise<SingleUserAdmin | null> {
+  const database = db ?? getDb()
+
+  const byName = database
+    .query('SELECT id, username, role FROM users WHERE username = $u LIMIT 1')
+    .get({ $u: SINGLE_USER_USERNAME }) as UserRow | null
+  if (byName) {
+    return { userId: byName.id, username: byName.username, created: false }
+  }
+
+  const anyAdmin = database
+    .query(
+      'SELECT id, username, role FROM users WHERE role = $r ORDER BY created_at LIMIT 1',
+    )
+    .get({ $r: 'admin' }) as UserRow | null
+  if (anyAdmin) {
+    return { userId: anyAdmin.id, username: anyAdmin.username, created: false }
+  }
+
+  const count = database.query('SELECT COUNT(*) as count FROM users').get() as {
+    count: number
+  }
+  if (count.count > 0) {
+    // Users exist but no admin and no `admin` — cannot pick a single user
+    // without silently granting it admin rights. Let the caller surface it.
+    return null
+  }
+
+  const userId = `usr_${randomUUID().replace(/-/g, '')}`
+  const passwordHash = await hashPasswordAsync(SINGLE_USER_DEFAULT_PASSWORD)
+  const now = new Date().toISOString()
+  database
+    .query(
+      `INSERT OR IGNORE INTO users (id, username, password_hash, role, created_at)
+       VALUES ($id, $username, $passwordHash, 'admin', $now)`,
+    )
+    .run({
+      $id: userId,
+      $username: SINGLE_USER_USERNAME,
+      $passwordHash: passwordHash,
+      $now: now,
+    })
+
+  const inserted = database
+    .query('SELECT id, username, role FROM users WHERE username = $u LIMIT 1')
+    .get({ $u: SINGLE_USER_USERNAME }) as UserRow | null
+  if (!inserted) {
+    // INSERT OR IGNORE lost a race (concurrent bootstrap) — resolve the winner.
+    return ensureSingleUserAdmin(database)
+  }
+  return { userId: inserted.id, username: inserted.username, created: true }
+}
+
+/**
+ * Resolve the single-user admin's users.id for worker auto-ownership.
+ *
+ * Sync and cheap — called on every unowned worker registration in
+ * single-user mode. Returns null when no admin exists yet (bootstrap not
+ * run / DB error) — the caller falls back to the regular claim flow.
+ */
+export function getSingleUserAdminUuid(db?: Database): string | null {
+  try {
+    const database = db ?? getDb()
+    const row = database
+      .query(
+        `SELECT id FROM users
+         WHERE username = $u OR role = $r
+         ORDER BY CASE WHEN username = $u THEN 0 ELSE 1 END, created_at
+         LIMIT 1`,
+      )
+      .get({ $u: SINGLE_USER_USERNAME, $r: 'admin' }) as { id: string } | null
+    return row?.id ?? null
+  } catch (err) {
+    console.error('[single-user] admin lookup failed:', err)
+    return null
+  }
+}

package/packages/remote-control-server/src/services/web-login.ts

@@ -0,0 +1,96 @@
+import { randomUUID } from 'node:crypto'
+
+/**
+ * One-time browser login codes for single-user mode (`slz rcs one`).
+ *
+ * `slz rcs one` auto-opens the Web UI straight into the freshly created
+ * session — but a fresh browser has no session cookies, so a plain deep
+ * link would bounce off the login page. Instead the CLI mints a
+ * short-lived one-time code in-process (only the server process itself
+ * can mint one), the browser hits GET /otp/<code>, and the server sets
+ * the single admin's session cookies before redirecting to the stored
+ * target path (see registerRoutes.ts).
+ *
+ * Trust model: same as the rest of single-user mode — loopback binding,
+ * the API key is the only real credential, and the code is a random
+ * 122-bit value that is single-use and expires in two minutes. Codes
+ * live in memory only: a server restart invalidates any unspent ones.
+ */
+
+export interface WebLoginCodeRecord {
+  code: string
+  userId: string
+  /** Path the browser is redirected to after login (must start with '/'). */
+  targetPath: string
+  expiresAt: number
+}
+
+const CODE_TTL_MS = 2 * 60 * 1000
+/** Upper bound so a pathological minter can't grow the map forever. */
+export const MAX_PENDING_CODES = 64
+
+const pendingCodes = new Map<string, WebLoginCodeRecord>()
+
+function pruneExpired(now = Date.now()): void {
+  for (const [code, record] of pendingCodes) {
+    if (record.expiresAt <= now) {
+      pendingCodes.delete(code)
+    }
+  }
+}
+
+/** Clamp a redirect target to a same-origin path ('/…', never '//…'). */
+function toSafeTargetPath(targetPath: string): string {
+  return targetPath.startsWith('/') && !targetPath.startsWith('//')
+    ? targetPath
+    : '/'
+}
+
+/**
+ * Mint a one-time login code for a user + redirect target.
+ * The target path is clamped to a same-origin path — protocol-relative
+ * ('//host') and absolute URLs are rejected to block open redirects.
+ */
+export function issueWebLoginCode(
+  userId: string,
+  targetPath: string,
+): WebLoginCodeRecord {
+  pruneExpired()
+  if (pendingCodes.size >= MAX_PENDING_CODES) {
+    // Drop the oldest — Map preserves insertion order.
+    const oldest = pendingCodes.keys().next().value
+    if (oldest !== undefined) {
+      pendingCodes.delete(oldest)
+    }
+  }
+  const record: WebLoginCodeRecord = {
+    code: `wlc_${randomUUID().replace(/-/g, '')}`,
+    userId,
+    targetPath: toSafeTargetPath(targetPath),
+    expiresAt: Date.now() + CODE_TTL_MS,
+  }
+  pendingCodes.set(record.code, record)
+  return record
+}
+
+/**
+ * Consume a login code (single use). Returns null when the code is
+ * unknown, already used, or expired.
+ */
+export function consumeWebLoginCode(code: string): WebLoginCodeRecord | null {
+  pruneExpired()
+  const record = pendingCodes.get(code)
+  if (!record) {
+    return null
+  }
+  pendingCodes.delete(code)
+  if (record.expiresAt <= Date.now()) {
+    return null
+  }
+  return record
+}
+
+/** Test hook — clear all pending codes. */
+export function _resetWebLoginCodes(): void {
+  pendingCodes.clear()
+}

package/packages/remote-control-server/web/dist/assets/{AdminPanel-DgLYaHiP.js → AdminPanel-Dw_WcoUm.js}

@@ -1 +1 @@
-import{e as d,j as e}from"./vendor-DE_-CLIE.js";import{at as c,au as o,Q as m,ao as s,ag as l,x as u}from"./main-bilGpQlS.js";import"./shiki-mEP5vQQu.js";import"./motion-BILbV7YQ.js";function j(){c();const[a,i]=d.useState([]),{myTeams:r,isLoading:x}=o(),n=d.useCallback(async()=>{try{const t=await m();i(t||[])}catch(t){console.error("Admin: failed to load sessions",t)}},[]);return d.useEffect(()=>{n()},[n]),e.jsx("div",{className:"flex-1 overflow-y-auto",children:e.jsxs("div",{className:"mx-auto max-w-5xl px-4 py-8",children:[e.jsx("h1",{className:"mb-6 font-display text-2xl font-semibold text-text-primary",children:s("admin.title")}),e.jsxs("section",{className:"mb-10",children:[e.jsxs("h2",{className:"mb-4 font-display text-lg font-semibold text-text-primary",children:[s("admin.teams")," (",r.length,")"]}),x?e.jsx("div",{className:"rounded-xl border border-border bg-surface-1 p-4 text-center text-text-muted",children:s("common.loading")}):r.length===0?e.jsx("div",{className:"rounded-xl border border-border bg-surface-1 p-4 text-center text-text-muted",children:s("admin.noTeams")}):e.jsx("div",{className:"space-y-2",children:r.map(t=>e.jsxs("a",{href:`/teams/${t.slug}`,className:"flex items-center justify-between rounded-xl border border-border bg-surface-1 px-4 py-3 no-underline transition-colors hover:border-border-light hover:bg-surface-2",children:[e.jsxs("div",{className:"min-w-0",children:[e.jsx("span",{className:"font-medium text-text-primary",children:t.name}),e.jsx("span",{className:"ml-2 text-xs text-text-muted",children:t.slug})]}),e.jsx("span",{className:"text-xs text-text-muted",children:l(new Date(t.created_at).getTime()/1e3)})]},t.id))})]}),e.jsxs("section",{children:[e.jsxs("h2",{className:"mb-4 font-display text-lg font-semibold text-text-primary",children:[s("admin.sessions")," (",a.length,")"]}),a.length===0?e.jsx("div",{className:"rounded-xl border border-border bg-surface-1 p-4 text-center text-text-muted",children:s("admin.noSessions")}):e.jsx("div",{className:"space-y-2",children:a.map(t=>e.jsxs("a",{href:`/code/${t.id}`,className:"flex items-center justify-between rounded-xl border border-border bg-surface-1 px-4 py-3 no-underline transition-colors hover:border-border-light hover:bg-surface-2",children:[e.jsxs("div",{className:"min-w-0 flex-1",children:[e.jsxs("div",{className:"flex items-center gap-2",children:[e.jsx("span",{className:"truncate font-medium text-text-primary",children:t.title||t.id}),e.jsx("span",{className:"rounded-full bg-surface-2 px-2 py-0.5 text-xs text-text-muted",children:t.source||"unknown"})]}),e.jsx("div",{className:"truncate text-xs text-text-muted",children:t.id})]}),e.jsxs("div",{className:"ml-4 flex items-center gap-3",children:[e.jsx(u,{status:t.status}),e.jsx("span",{className:"text-xs text-text-muted",children:l(t.updated_at||t.created_at)})]})]},t.id))})]})]})})}export{j as AdminPanel};
+import{e as d,j as e}from"./vendor-DE_-CLIE.js";import{at as c,au as o,Q as m,ao as s,ag as l,x as u}from"./main-5C_gChTh.js";import"./shiki-mEP5vQQu.js";import"./motion-BILbV7YQ.js";function j(){c();const[a,i]=d.useState([]),{myTeams:r,isLoading:x}=o(),n=d.useCallback(async()=>{try{const t=await m();i(t||[])}catch(t){console.error("Admin: failed to load sessions",t)}},[]);return d.useEffect(()=>{n()},[n]),e.jsx("div",{className:"flex-1 overflow-y-auto",children:e.jsxs("div",{className:"mx-auto max-w-5xl px-4 py-8",children:[e.jsx("h1",{className:"mb-6 font-display text-2xl font-semibold text-text-primary",children:s("admin.title")}),e.jsxs("section",{className:"mb-10",children:[e.jsxs("h2",{className:"mb-4 font-display text-lg font-semibold text-text-primary",children:[s("admin.teams")," (",r.length,")"]}),x?e.jsx("div",{className:"rounded-xl border border-border bg-surface-1 p-4 text-center text-text-muted",children:s("common.loading")}):r.length===0?e.jsx("div",{className:"rounded-xl border border-border bg-surface-1 p-4 text-center text-text-muted",children:s("admin.noTeams")}):e.jsx("div",{className:"space-y-2",children:r.map(t=>e.jsxs("a",{href:`/teams/${t.slug}`,className:"flex items-center justify-between rounded-xl border border-border bg-surface-1 px-4 py-3 no-underline transition-colors hover:border-border-light hover:bg-surface-2",children:[e.jsxs("div",{className:"min-w-0",children:[e.jsx("span",{className:"font-medium text-text-primary",children:t.name}),e.jsx("span",{className:"ml-2 text-xs text-text-muted",children:t.slug})]}),e.jsx("span",{className:"text-xs text-text-muted",children:l(new Date(t.created_at).getTime()/1e3)})]},t.id))})]}),e.jsxs("section",{children:[e.jsxs("h2",{className:"mb-4 font-display text-lg font-semibold text-text-primary",children:[s("admin.sessions")," (",a.length,")"]}),a.length===0?e.jsx("div",{className:"rounded-xl border border-border bg-surface-1 p-4 text-center text-text-muted",children:s("admin.noSessions")}):e.jsx("div",{className:"space-y-2",children:a.map(t=>e.jsxs("a",{href:`/code/${t.id}`,className:"flex items-center justify-between rounded-xl border border-border bg-surface-1 px-4 py-3 no-underline transition-colors hover:border-border-light hover:bg-surface-2",children:[e.jsxs("div",{className:"min-w-0 flex-1",children:[e.jsxs("div",{className:"flex items-center gap-2",children:[e.jsx("span",{className:"truncate font-medium text-text-primary",children:t.title||t.id}),e.jsx("span",{className:"rounded-full bg-surface-2 px-2 py-0.5 text-xs text-text-muted",children:t.source||"unknown"})]}),e.jsx("div",{className:"truncate text-xs text-text-muted",children:t.id})]}),e.jsxs("div",{className:"ml-4 flex items-center gap-3",children:[e.jsx(u,{status:t.status}),e.jsx("span",{className:"text-xs text-text-muted",children:l(t.updated_at||t.created_at)})]})]},t.id))})]})]})})}export{j as AdminPanel};

package/{dist/rcs-web/assets/ArtifactView-CY2q-o_P.js → packages/remote-control-server/web/dist/assets/ArtifactView-1QwTt1_U.js}

@@ -1,4 +1,4 @@
-import{e as a,j as t}from"./vendor-DE_-CLIE.js";import{ad as q,at as A,V as j,ao as r,K as M,ac as U,P as F,z as O}from"./main-bilGpQlS.js";import{S as R,E as K,C as G}from"./ArtifactsGallery-CjZFQhYm.js";import{C as P}from"./copy-BId_ACIH.js";import"./shiki-mEP5vQQu.js";import"./motion-BILbV7YQ.js";import"./dialog-DfUuWIZS.js";/**
+import{e as a,j as t}from"./vendor-DE_-CLIE.js";import{ad as q,at as A,V as j,ao as r,K as M,ac as U,P as F,z as O}from"./main-5C_gChTh.js";import{S as R,E as K,C as G}from"./ArtifactsGallery-BaqQmrpp.js";import{C as P}from"./copy-CIv8ifYN.js";import"./shiki-mEP5vQQu.js";import"./motion-BILbV7YQ.js";import"./dialog-D__YHb1u.js";/**
  * @license lucide-react v0.555.0 - ISC
  *
  * This source code is licensed under the ISC license.

package/packages/remote-control-server/web/dist/assets/{ArtifactsGallery-CjZFQhYm.js → ArtifactsGallery-BaqQmrpp.js}

@@ -1,4 +1,4 @@
-var ht=Object.defineProperty;var ut=(t,e,r)=>e in t?ht(t,e,{enumerable:!0,configurable:!0,writable:!0,value:r}):t[e]=r;var S=(t,e,r)=>ut(t,typeof e!="symbol"?e+"":e,r);import{e as k,j as o}from"./vendor-DE_-CLIE.js";import{ad as Re,ah as ft,at as Ve,au as mt,W as xt,ao as f,K as gt,ac as bt,F as kt,g as yt,P as wt,z as vt,p as He,V as St,a0 as Rt,al as Tt,$ as $t,a6 as jt,a7 as Et,H as Nt,b as Ct}from"./main-bilGpQlS.js";import{D as It,a as At,c as Lt,d as zt,b as _t}from"./dialog-DfUuWIZS.js";import{C as Dt}from"./copy-BId_ACIH.js";/**
+var ht=Object.defineProperty;var ut=(t,e,r)=>e in t?ht(t,e,{enumerable:!0,configurable:!0,writable:!0,value:r}):t[e]=r;var S=(t,e,r)=>ut(t,typeof e!="symbol"?e+"":e,r);import{e as k,j as o}from"./vendor-DE_-CLIE.js";import{ad as Re,ah as ft,at as Ve,au as mt,W as xt,ao as f,K as gt,ac as bt,F as kt,g as yt,P as wt,z as vt,p as He,V as St,a0 as Rt,al as Tt,$ as $t,a6 as jt,a7 as Et,H as Nt,b as Ct}from"./main-5C_gChTh.js";import{D as It,a as At,c as Lt,d as zt,b as _t}from"./dialog-D__YHb1u.js";import{C as Dt}from"./copy-CIv8ifYN.js";/**
  * @license lucide-react v0.555.0 - ISC
  *
  * This source code is licensed under the ISC license.

package/{dist/rcs-web/assets/Claim-CjEYu8Jg.js → packages/remote-control-server/web/dist/assets/Claim-DbnYUnUa.js}

@@ -1 +1 @@
-import{e as r,j as e}from"./vendor-DE_-CLIE.js";import{E as u,Q as f}from"./main-bilGpQlS.js";import"./shiki-mEP5vQQu.js";import"./motion-BILbV7YQ.js";const v=2e3,N=3e4;function E(){const c=window.location.pathname.split("/"),i=c[c.length-1]||"",[s,n]=r.useState("idle"),[m,l]=r.useState(null),[a,d]=r.useState(null);return r.useEffect(()=>{if(!i||!i.startsWith("clm_")){l("Invalid claim token"),n("error");return}n("claiming"),u(i).then(t=>{d(t.environment_id),n("waiting")}).catch(t=>{l(t instanceof Error?t.message:"Claim failed"),n("error")})},[i]),r.useEffect(()=>{if(s!=="waiting"||!a)return;let t=!1;const x=Date.now(),o=setInterval(()=>{if(Date.now()-x>N){clearInterval(o),t||n("timeout");return}f().then(h=>{t||(h||[]).some(p=>p.environment_id===a)&&(clearInterval(o),window.location.href="/code/")}).catch(()=>{})},v);return()=>{t=!0,clearInterval(o)}},[s,a]),s==="claiming"?e.jsx("div",{className:"px-6 py-16 sm:px-10 sm:py-20",children:e.jsx("p",{className:"text-sm text-text-muted",children:"Claiming environment..."})}):s==="error"?e.jsxs("div",{className:"px-6 py-16 sm:px-10 sm:py-20",children:[e.jsx("p",{className:"text-sm text-destructive",children:m}),e.jsx("a",{href:"/code",className:"mt-4 inline-block text-accent hover:underline",children:"Back to dashboard"})]}):s==="waiting"||s==="timeout"?e.jsxs("div",{className:"px-6 py-16 sm:px-10 sm:py-20",children:[e.jsxs("header",{className:"mb-10",children:[e.jsx("h1",{className:"font-display text-2xl font-semibold tracking-tight text-text-primary",children:"Environment claimed"}),e.jsx("p",{className:"mt-2 text-sm text-text-muted",children:"You are now the owner of this environment."})]}),e.jsxs("div",{className:"space-y-4",children:[a&&e.jsx("p",{className:"font-mono text-xs text-text-muted",children:a}),s==="waiting"?e.jsxs("p",{className:"text-sm text-text-muted",children:["Waiting for the worker to create a session",e.jsx("span",{className:"animate-pulse",children:"…"})]}):e.jsx("p",{className:"text-sm text-text-muted",children:"The worker has not created a session yet — it may be offline or stopped. The session will appear on the dashboard once the worker connects."}),e.jsx("a",{href:"/code",className:"inline-block rounded-md bg-accent px-4 py-2 text-sm font-medium text-white hover:bg-accent/90 transition-colors",children:"Go to dashboard"})]})]}):e.jsx("div",{className:"px-6 py-16 sm:px-10 sm:py-20",children:e.jsx("p",{className:"text-sm text-text-muted",children:"Claiming environment..."})})}export{E as Claim};
+import{e as r,j as e}from"./vendor-DE_-CLIE.js";import{E as u,Q as f}from"./main-5C_gChTh.js";import"./shiki-mEP5vQQu.js";import"./motion-BILbV7YQ.js";const v=2e3,N=3e4;function E(){const c=window.location.pathname.split("/"),i=c[c.length-1]||"",[s,n]=r.useState("idle"),[m,l]=r.useState(null),[a,d]=r.useState(null);return r.useEffect(()=>{if(!i||!i.startsWith("clm_")){l("Invalid claim token"),n("error");return}n("claiming"),u(i).then(t=>{d(t.environment_id),n("waiting")}).catch(t=>{l(t instanceof Error?t.message:"Claim failed"),n("error")})},[i]),r.useEffect(()=>{if(s!=="waiting"||!a)return;let t=!1;const x=Date.now(),o=setInterval(()=>{if(Date.now()-x>N){clearInterval(o),t||n("timeout");return}f().then(h=>{t||(h||[]).some(p=>p.environment_id===a)&&(clearInterval(o),window.location.href="/code/")}).catch(()=>{})},v);return()=>{t=!0,clearInterval(o)}},[s,a]),s==="claiming"?e.jsx("div",{className:"px-6 py-16 sm:px-10 sm:py-20",children:e.jsx("p",{className:"text-sm text-text-muted",children:"Claiming environment..."})}):s==="error"?e.jsxs("div",{className:"px-6 py-16 sm:px-10 sm:py-20",children:[e.jsx("p",{className:"text-sm text-destructive",children:m}),e.jsx("a",{href:"/code",className:"mt-4 inline-block text-accent hover:underline",children:"Back to dashboard"})]}):s==="waiting"||s==="timeout"?e.jsxs("div",{className:"px-6 py-16 sm:px-10 sm:py-20",children:[e.jsxs("header",{className:"mb-10",children:[e.jsx("h1",{className:"font-display text-2xl font-semibold tracking-tight text-text-primary",children:"Environment claimed"}),e.jsx("p",{className:"mt-2 text-sm text-text-muted",children:"You are now the owner of this environment."})]}),e.jsxs("div",{className:"space-y-4",children:[a&&e.jsx("p",{className:"font-mono text-xs text-text-muted",children:a}),s==="waiting"?e.jsxs("p",{className:"text-sm text-text-muted",children:["Waiting for the worker to create a session",e.jsx("span",{className:"animate-pulse",children:"…"})]}):e.jsx("p",{className:"text-sm text-text-muted",children:"The worker has not created a session yet — it may be offline or stopped. The session will appear on the dashboard once the worker connects."}),e.jsx("a",{href:"/code",className:"inline-block rounded-md bg-accent px-4 py-2 text-sm font-medium text-white hover:bg-accent/90 transition-colors",children:"Go to dashboard"})]})]}):e.jsx("div",{className:"px-6 py-16 sm:px-10 sm:py-20",children:e.jsx("p",{className:"text-sm text-text-muted",children:"Claiming environment..."})})}export{E as Claim};

package/packages/remote-control-server/web/dist/assets/{Dashboard-g2VnKR61.js → Dashboard-I2zDQu_C.js}

@@ -1,4 +1,4 @@
-import{j as e,e as l}from"./vendor-DE_-CLIE.js";import{ad as O,ab as _,au as E,as as T,x as F,at as L,ao as a,ag as A,q as $,s as W,e as H,r as V,d as P,aj as q,I as Q,Q as R,Y as U,N as Y}from"./main-bilGpQlS.js";import{g as D}from"./workerType-Bd-zteMi.js";import{S as Z}from"./SessionVisibilityBadge-DJB8gn6j.js";import{D as z,a as G,c as J,d as K,b as X}from"./dialog-DfUuWIZS.js";import"./shiki-mEP5vQQu.js";import"./motion-BILbV7YQ.js";/**
+import{j as e,e as l}from"./vendor-DE_-CLIE.js";import{ad as O,ab as _,au as E,as as T,x as F,at as L,ao as a,ag as A,q as $,s as W,e as H,r as V,d as P,aj as q,I as Q,Q as R,Y as U,N as Y}from"./main-5C_gChTh.js";import{g as D}from"./workerType-Bd-zteMi.js";import{S as Z}from"./SessionVisibilityBadge-BKEoqr7V.js";import{D as z,a as G,c as J,d as K,b as X}from"./dialog-D__YHb1u.js";import"./shiki-mEP5vQQu.js";import"./motion-BILbV7YQ.js";/**
  * @license lucide-react v0.555.0 - ISC
  *
  * This source code is licensed under the ISC license.