npm - madarx - Versions diffs - 2.9.15 → 2.9.18 - Mend

madarx 2.9.15 → 2.9.18

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1171) hide show

package/lib/chat-uploads.js ADDED Viewed

@@ -0,0 +1,168 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { DATA_DIR } from './paths.js';
+// Chat attachment storage. Files uploaded from the main-agent composer land
+// under DATA_DIR/uploads as two files per upload: `<id>` (raw bytes) and
+// `<id>.json` (sidecar metadata). The client only ever holds the opaque `id`;
+// the server resolves bytes by id, so a malicious client cannot point the read
+// side at an arbitrary path (id is validated against a strict hex pattern).
+export const UPLOADS_DIR = path.join(DATA_DIR, 'uploads');
+// 20 MB hard cap per file. Anthropic's own limits are lower per modality
+// (images ~5 MB, PDF ~32 MB) but 20 MB is a sane upper bound for a local tool.
+export const MAX_UPLOAD_BYTES = 20 * 1024 * 1024;
+// Attachments per single message.
+export const MAX_ATTACHMENTS = 8;
+const IMAGE_MIMES = new Set(['image/png', 'image/jpeg', 'image/gif', 'image/webp']);
+const PDF_MIME = 'application/pdf';
+// Text-like extensions we inline directly into the prompt. MIME from the
+// browser is unreliable for code files (often application/octet-stream), so we
+// classify by extension as well.
+const TEXT_EXTS = new Set([
+  '.txt', '.md', '.markdown', '.csv', '.tsv', '.json', '.jsonl', '.log', '.yaml', '.yml',
+  '.xml', '.html', '.htm', '.css', '.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs',
+  '.py', '.rb', '.go', '.rs', '.java', '.c', '.h', '.cpp', '.hpp', '.cs', '.php',
+  '.sh', '.bash', '.zsh', '.sql', '.toml', '.ini', '.env', '.conf', '.tex', '.rst',
+]);
+const ID_RE = /^[0-9a-f]{32}$/;
+/**
+ * Classify an attachment so the orchestrator knows how to feed it to the model.
+ * - 'image' / 'pdf' → native Anthropic content blocks (vision / documents).
+ * - 'text' → inlined into the prompt as a fenced block (works on every engine).
+ * - 'other' → referenced by name only (binary we can't interpret).
+ */
+export function classifyAttachment(mime, name) {
+  const m = (mime || '').toLowerCase();
+  const ext = path.extname(name || '').toLowerCase();
+  if (IMAGE_MIMES.has(m)) return 'image';
+  if (m === PDF_MIME || ext === '.pdf') return 'pdf';
+  if (m.startsWith('text/') || m === 'application/json' || TEXT_EXTS.has(ext)) return 'text';
+  return 'other';
+}
+export function isAllowedAttachment(mime, name) {
+  return classifyAttachment(mime, name) !== 'other';
+}
+function sanitizeName(name) {
+  const base = path.basename(String(name || 'file')).replace(/[^\w.\- ]+/g, '_').trim();
+  return base.slice(0, 160) || 'file';
+}
+function ensureDir() {
+  fs.mkdirSync(UPLOADS_DIR, { recursive: true });
+}
+/**
+ * Persist an uploaded file. Returns the metadata the client echoes back on the
+ * next chat send. Never returns a filesystem path.
+ */
+export function saveUpload({ buffer, name, mime }) {
+  if (!Buffer.isBuffer(buffer)) throw new Error('buffer required');
+  if (buffer.length === 0) throw new Error('empty file');
+  if (buffer.length > MAX_UPLOAD_BYTES) throw new Error('file too large');
+  const cleanName = sanitizeName(name);
+  if (!isAllowedAttachment(mime, cleanName)) throw new Error('unsupported file type');
+  ensureDir();
+  const id = crypto.randomBytes(16).toString('hex');
+  const kind = classifyAttachment(mime, cleanName);
+  const meta = { id, name: cleanName, mime: String(mime || 'application/octet-stream'), size: buffer.length, kind };
+  fs.writeFileSync(path.join(UPLOADS_DIR, id), buffer);
+  fs.writeFileSync(path.join(UPLOADS_DIR, `${id}.json`), JSON.stringify(meta));
+  return meta;
+}
+/**
+ * Resolve an upload id to its bytes + metadata. Returns null if the id is
+ * malformed or missing. Strict id validation prevents path traversal.
+ */
+export function readUpload(id) {
+  if (typeof id !== 'string' || !ID_RE.test(id)) return null;
+  const dataPath = path.join(UPLOADS_DIR, id);
+  const metaPath = path.join(UPLOADS_DIR, `${id}.json`);
+  try {
+    const meta = JSON.parse(fs.readFileSync(metaPath, 'utf8'));
+    const buffer = fs.readFileSync(dataPath);
+    return { ...meta, buffer };
+  } catch {
+    return null;
+  }
+}
+/**
+ * Resolve a list of client-supplied attachment refs (each at least `{ id }`)
+ * into loaded attachments with bytes. Silently drops ids that don't resolve.
+ */
+export function loadAttachments(refs) {
+  if (!Array.isArray(refs)) return [];
+  const out = [];
+  for (const ref of refs.slice(0, MAX_ATTACHMENTS)) {
+    const id = ref && typeof ref === 'object' ? ref.id : ref;
+    const loaded = readUpload(id);
+    if (loaded) out.push(loaded);
+  }
+  return out;
+}
+const MAX_INLINE_TEXT = 60000; // chars of a text file inlined into the prompt
+/**
+ * Build Anthropic content blocks for a set of loaded attachments. Pair with the
+ * user's text in a single content array. Image/PDF become native blocks; text
+ * files are inlined; anything else is referenced by name.
+ */
+export function attachmentsToContentBlocks(loaded) {
+  const blocks = [];
+  for (const a of loaded) {
+    if (a.kind === 'image') {
+      blocks.push({
+        type: 'image',
+        source: { type: 'base64', media_type: a.mime, data: a.buffer.toString('base64') },
+      });
+    } else if (a.kind === 'pdf') {
+      blocks.push({
+        type: 'document',
+        source: { type: 'base64', media_type: 'application/pdf', data: a.buffer.toString('base64') },
+      });
+    } else if (a.kind === 'text') {
+      const text = a.buffer.toString('utf8').slice(0, MAX_INLINE_TEXT);
+      const truncated = a.buffer.length > MAX_INLINE_TEXT ? '\n…(truncated)' : '';
+      blocks.push({ type: 'text', text: `Attached file "${a.name}":\n\n\`\`\`\n${text}${truncated}\n\`\`\`` });
+    } else {
+      blocks.push({ type: 'text', text: `Attached file "${a.name}" (${a.mime}, ${a.size} bytes) — binary, contents not shown.` });
+    }
+  }
+  return blocks;
+}
+/**
+ * Plain-text representation of attachments for engines without content-block
+ * support (Ollama, Claude Code / Codex CLI subprocesses). Text files inline;
+ * images/PDF noted with a hint to switch engines for analysis.
+ */
+export function attachmentsToPromptText(loaded) {
+  if (!loaded.length) return '';
+  const parts = ['', '--- Attachments ---'];
+  for (const a of loaded) {
+    if (a.kind === 'text') {
+      const text = a.buffer.toString('utf8').slice(0, MAX_INLINE_TEXT);
+      const truncated = a.buffer.length > MAX_INLINE_TEXT ? '\n…(truncated)' : '';
+      parts.push(`\nFile "${a.name}":\n\`\`\`\n${text}${truncated}\n\`\`\``);
+    } else if (a.kind === 'image') {
+      parts.push(`\n[Image attached: "${a.name}". This engine cannot view images — switch to an Anthropic model to analyze it.]`);
+    } else if (a.kind === 'pdf') {
+      parts.push(`\n[PDF attached: "${a.name}". This engine cannot read PDFs — switch to an Anthropic model to analyze it.]`);
+    } else {
+      parts.push(`\n[Attached "${a.name}" (${a.mime}) — binary, not shown.]`);
+    }
+  }
+  return parts.join('\n');
+}

package/lib/cli/run.js CHANGED Viewed

@@ -97,7 +97,13 @@ function spawnWhatsApp(layout) {
   const child = spawn(process.execPath, ['--no-warnings', daemon], {
     cwd: PKG_ROOT,
     stdio: 'inherit',
-    env: { ...process.env, MADARX_HOME: layout.home },
+    // The WhatsApp daemon opens the DB (getDb), which auto-starts the in-process
+    // cron/heartbeat poke loop. That loop POSTs the web tier's /api/heartbeat/worker
+    // + /api/cron/tick over loopback — it belongs ONLY in the web-server process.
+    // If this child wins the machine-wide daemon lock it pokes the web tier from a
+    // DIFFERENT process, whose inproc token never matches → 401 on every tick.
+    // Disable the in-proc daemon here so only the web child owns the poke loop.
+    env: { ...process.env, MADARX_HOME: layout.home, MADARX_DISABLE_INPROC_DAEMON: '1' },
   });
   try { fs.writeFileSync(path.join(layout.runDir, 'whatsapp.pid'), String(child.pid)); } catch {}
   return child;

package/lib/inproc-token.js CHANGED Viewed

@@ -31,33 +31,73 @@
 //     layer, not the sole defense.
 import { randomBytes, timingSafeEqual } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { DATA_DIR } from './paths.js';
 const HEADER_NAME = 'x-inproc-token';
-// The token is pinned to globalThis, NOT a module-level `let`. The daemon
-// (lib/db.js) and the route handlers (app/api/**) both import this file, but
-// Next.js bundles the server runtime and each route segment into SEPARATE
-// module instances even inside ONE process — so a module-scoped singleton would
-// give the daemon one random token and the route a DIFFERENT one. The daemon's
-// ticks would then never match verifyInprocToken() and every /api/heartbeat/worker
-// and /api/cron/tick poke would fall through to requireSession and 401.
-// globalThis is per-isolate (per process), so all bundled copies share it.
+// Token resolution must be stable ACROSS PROCESSES for one install, not just
+// per-process. The poke loop (lib/db.js cron/heartbeat) and the route handlers
+// can run in DIFFERENT processes:
+//   - the machine-wide daemon lock (lib/db.js) lets any process that opened the
+//     DB own the loop — historically the WhatsApp daemon, the hermes job runner,
+//     or an orphaned web server from a prior `npm i -g` upgrade;
+//   - that owner POSTs the web tier's /api/heartbeat/worker over loopback.
+// A per-process random token (or even a globalThis-pinned one) means the poker
+// and the verifier mint different tokens → every tick 401s. So the token is
+// persisted to a 0600 file under DATA_DIR and shared by every process for this
+// install. globalThis still caches it per process to avoid re-reading the file.
+//
+// Precedence: MADARX_INPROC_TICK_TOKEN env (operator override, split-process
+// deploys) → globalThis cache → persisted DATA_DIR file → freshly generated +
+// persisted. Threat model matches MADARX_MASTER_KEY / the auth recovery token:
+// both are 0600 files in DATA_DIR; a reader of DATA_DIR already holds the vault.
+// The routes stay loopback-only at the network boundary regardless.
 const TOKEN_KEY = '__madarxInprocToken';
+const TOKEN_FILE = path.join(DATA_DIR, '.inproc-token');
 function generateToken() {
   return randomBytes(32).toString('base64url');
 }
+// Read the install-shared token from disk, or create it atomically. O_EXCL on
+// create means concurrent processes converge on the first writer's token instead
+// of clobbering each other. Falls back to a process-local token if DATA_DIR is
+// unwritable (degrades to the old per-process behavior — no worse than before).
+function loadOrCreatePersistentToken() {
+  try {
+    const existing = fs.readFileSync(TOKEN_FILE, 'utf8').trim();
+    if (existing) return existing;
+  } catch { /* not created yet */ }
+  const fresh = generateToken();
+  try {
+    fs.mkdirSync(DATA_DIR, { recursive: true });
+    const fd = fs.openSync(TOKEN_FILE, 'wx', 0o600); // O_EXCL — fail if it exists
+    try { fs.writeSync(fd, `${fresh}\n`); } finally { fs.closeSync(fd); }
+    try { fs.chmodSync(TOKEN_FILE, 0o600); } catch { /* best-effort */ }
+    return fresh;
+  } catch {
+    // Lost the create race (EEXIST) or FS unwritable — prefer the persisted value.
+    try {
+      const again = fs.readFileSync(TOKEN_FILE, 'utf8').trim();
+      if (again) return again;
+    } catch { /* unwritable */ }
+    return fresh; // last resort: process-local only
+  }
+}
 /**
- * Return the in-process token, resolving from env on first call or
- * generating a fresh one for the process lifetime. Shared across all module
- * instances in the process via globalThis.
+ * Return the in-process tick token. Resolves from the env override, the
+ * per-process globalThis cache, or the install-shared DATA_DIR file (creating
+ * it on first use). Stable across every process for this install.
  */
 export function getInprocToken() {
-  if (globalThis[TOKEN_KEY]) return globalThis[TOKEN_KEY];
   const envValue = process.env.MADARX_INPROC_TICK_TOKEN;
-  globalThis[TOKEN_KEY] =
-    envValue && envValue.trim().length > 0 ? envValue.trim() : generateToken();
+  if (envValue && envValue.trim().length > 0) return envValue.trim();
+  if (globalThis[TOKEN_KEY]) return globalThis[TOKEN_KEY];
+  globalThis[TOKEN_KEY] = loadOrCreatePersistentToken();
   return globalThis[TOKEN_KEY];
 }
@@ -82,7 +122,8 @@ export function verifyInprocToken(req) {
 export const INPROC_TOKEN_HEADER = HEADER_NAME;
-/** Reset the cached token (used in tests). */
+/** Reset the cached + persisted token (used in tests). */
 export function resetInprocToken() {
   delete globalThis[TOKEN_KEY];
+  try { fs.rmSync(TOKEN_FILE, { force: true }); } catch { /* best-effort */ }
 }

package/lib/whatsapp.js CHANGED Viewed

@@ -71,6 +71,11 @@ export async function sendWhatsAppDocument({ chat_id, content, filename, mimetyp
   }, { timeoutMs: 30000 });
 }
+export async function logoutWhatsApp() {
+  // Unlinks the paired device and wipes the bridge session, then re-offers a QR.
+  return request('POST', '/logout', {}, { timeoutMs: 15000 });
+}
 export async function setTyping(chatId, state = 'composing') {
   if (!chatId) throw new Error('chat_id is required');
   return request('POST', '/typing', { chat_id: chatId, state });

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "madarx",
-  "version": "2.9.15",
+  "version": "2.9.18",
   "type": "module",
   "description": "Madarx OS — Next.js product with SQLite-backed runtime, scheduled cron daemon, and approval-gated local runners.",
   "license": "MIT",

package/scripts/whatsapp-bridge/bridge.js CHANGED Viewed

@@ -286,6 +286,39 @@ app.post('/typing', async (req, res) => {
   }
 });
+app.post('/logout', async (req, res) => {
+  // True disconnect: unlink this device from WhatsApp server-side (so it
+  // disappears from Linked Devices), wipe local creds, then restart the
+  // socket so a fresh QR is offered for re-pairing.
+  try {
+    try {
+      if (sock?.logout) await sock.logout();
+    } catch (err) {
+      // logout may throw if the socket is already down — still wipe + restart.
+      console.error('[whatsapp-bridge] logout call failed (continuing):', err.message);
+    }
+    try { sock?.end?.(undefined); } catch {}
+    sock = null;
+    latestQr = null;
+    lastConnectedAt = null;
+    lastError = null;
+    pairingState = 'starting';
+    try {
+      fs.rmSync(SESSION_DIR, { recursive: true, force: true });
+    } catch (err) {
+      return res.status(500).json({ ok: false, error: `failed to wipe session: ${err.message}` });
+    }
+    fs.mkdirSync(SESSION_DIR, { recursive: true });
+    startSocket().catch((err) => {
+      console.error('[whatsapp-bridge] restart after logout failed:', err.message);
+    });
+    console.log('[whatsapp-bridge] logged out and wiped session; awaiting re-pair.');
+    res.json({ ok: true });
+  } catch (err) {
+    res.status(500).json({ ok: false, error: err.message });
+  }
+});
 app.get('/chat/:id', async (req, res) => {
   if (!requireReady(res)) return;
   const chatId = normalizeChatId(req.params.id);

package/.next/standalone/.next/server/chunks/7237.js DELETED Viewed

@@ -1 +0,0 @@

- exports.id=7237,exports.ids=[7237],exports.modules={6974:(a,b,c)=>{Promise.resolve().then(c.bind(c,35271))},34791:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.r(b),c.d(b,{"400f7d3545eb5038a91ec7f82a5f8113f92db2fd26":()=>e.$$RSC_SERVER_ACTION_0});var e=c(91845),f=a([e]);e=(f.then?(await f)():f)[0],d()}catch(a){d(a)}})},35271:(a,b,c)=>{"use strict";c.d(b,{default:()=>d});let d=(0,c(97954).registerClientReference)(function(){throw Error("Attempted to call the default export of \"/home/runner/work/madarx-os/madarx-os/app/components/admin/project-switcher.jsx\" from the server, but it's on the client. It's not possible to invoke a client function from the server, it can only be rendered as a Component or passed to props of a Client Component.")},"/home/runner/work/madarx-os/madarx-os/app/components/admin/project-switcher.jsx","default")},86893:(a,b,c)=>{"use strict";c.d(b,{hI:()=>g,iN:()=>f,pp:()=>i,qs:()=>h});var d=c(75338),e=c(35271);function f({kicker:a="madarX OS v1.0",title:b,description:c,actions:f,hideProjectSwitcher:g,children:h}){return(0,d.jsxs)("main",{className:"admin-shell",children:[(0,d.jsxs)("header",{className:"admin-header",children:[(0,d.jsxs)("div",{children:[(0,d.jsx)("span",{className:"admin-kicker",children:a}),(0,d.jsx)("h1",{children:b}),c?(0,d.jsx)("p",{children:c}):null]}),(0,d.jsxs)("div",{className:"admin-header-actions",children:[g?null:(0,d.jsx)(e.default,{}),f]})]}),h]})}function g({label:a,value:b,tone:c}){return(0,d.jsxs)("div",{className:`admin-stat ${c||""}`,children:[(0,d.jsx)("b",{children:b}),(0,d.jsx)("span",{children:a})]})}function h({children:a,tone:b="neutral"}){return(0,d.jsx)("span",{className:`admin-pill ${b}`,children:a})}function i({title:a,children:b}){return(0,d.jsxs)("div",{className:"admin-empty",children:[(0,d.jsx)("b",{children:a}),(0,d.jsx)("p",{children:b})]})}},89670:(a,b,c)=>{Promise.resolve().then(c.bind(c,94657))},91845:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.r(b),c.d(b,{$$RSC_SERVER_ACTION_0:()=>u,default:()=>p,dynamic:()=>q,runtime:()=>r});var e=c(75338),f=c(75879);c(68633);var g=c(16780),h=c(82161),i=c(86893),j=c(83963),k=c(60105),l=a([j,k]);[j,k]=l.then?(await l)():l;let q="force-dynamic",r="nodejs",s={executive:"Executive",manager:"Manager",team_lead:"Team Lead",individual_contributor:"Contributor"},t={executive:"mars",manager:"ready",team_lead:"warn",individual_contributor:"neutral"};function m(a=""){return a.split(/\s+/).map(a=>a[0]).filter(Boolean).slice(0,2).join("").toUpperCase()||"\xb7"}let u=async function(a){let b=String(a.get("agent_id")||"").trim();if(!b)return;let c=String(a.get("reports_to")||"").trim(),d={reports_to:""===c?null:c},e=String(a.get("role")||"").trim();e&&(d.role=e);let f=String(a.get("title")||"").trim();(f||a.has("title"))&&(d.title=f||null);try{(0,j.jN)(b,d)}catch(a){console.warn("updateAgentOrg failed",a?.message)}(0,g.revalidatePath)("/org"),(0,g.revalidatePath)("/agents"),(0,h.redirect)("/org")};function n({node:a,workloadById:b}){let c=function(a){if(a.role&&s[a.role])return a.role;let b=a.reports?.length||0;return b>=4?"executive":b>=2?"manager":1===b?"team_lead":"individual_contributor"}(a),d=s[c],f=t[c],g=a.reports?.length||0,h=b.get(a.id),j=Number(h?.active_tasks||0),k=Number(h?.blocked_tasks||0),l=Number(h?.completed_tasks||0),n=a.status||"created";return(0,e.jsxs)("article",{className:`org-card org-card--${c}`,"data-reports":g>0?"has":"none",children:[(0,e.jsxs)("div",{className:"org-card-head",children:[(0,e.jsx)("div",{className:"org-card-avatar","aria-hidden":"true",children:m(a.name)}),(0,e.jsxs)("div",{className:"org-card-identity",children:[(0,e.jsx)("div",{className:"org-card-name",children:a.name}),(0,e.jsx)("div",{className:"org-card-title",children:a.title||a.mission?.slice(0,64)||"No title set"})]})]}),(0,e.jsxs)("div",{className:"org-card-meta",children:[(0,e.jsx)(i.qs,{tone:f,children:d}),(0,e.jsx)(i.qs,{tone:"heartbeat ok"===n?"ready":"terminated"===n?"danger":"neutral",children:n}),g>0?(0,e.jsxs)(i.qs,{tone:"neutral",children:[g," report",1===g?"":"s"]}):null]}),(0,e.jsxs)("dl",{className:"org-card-stats",children:[(0,e.jsxs)("div",{children:[(0,e.jsx)("dt",{children:"Active"}),(0,e.jsx)("dd",{children:j})]}),(0,e.jsxs)("div",{children:[(0,e.jsx)("dt",{children:"Blocked"}),(0,e.jsx)("dd",{className:k?"is-warn":"",children:k})]}),(0,e.jsxs)("div",{children:[(0,e.jsx)("dt",{children:"Done"}),(0,e.jsx)("dd",{children:l})]})]})]})}function o({node:a,workloadById:b}){let c=(a.reports||[]).length>0;return(0,e.jsxs)("li",{className:"org-branch",children:[(0,e.jsx)(n,{node:a,workloadById:b}),c?(0,e.jsx)("ul",{className:"org-children",children:a.reports.map(a=>(0,e.jsx)(o,{node:a,workloadById:b},a.id))}):null]})}function p(){let a=(0,j.zP)(),b=(0,j.hC)(),c=(0,k.vc)(),d=new Map((b.workload||[]).map(a=>[a.agent_id,a])),f=c.filter(a=>c.some(b=>b.reports_to===a.id)).length,g=c.filter(a=>!a.reports_to&&a.id).length;return(0,e.jsxs)(i.iN,{title:"Org",description:"Company-style structure for your agent workforce. Set managers, define roles, and see workload at a glance.",children:[(0,e.jsxs)("section",{className:"admin-stats",children:[(0,e.jsx)(i.hI,{label:"Headcount",value:b.totals.active_agents}),(0,e.jsx)(i.hI,{label:"Leaders",value:f}),(0,e.jsx)(i.hI,{label:"Root nodes",value:g}),(0,e.jsx)(i.hI,{label:"Active tasks",value:b.totals.active_tasks})]}),(0,e.jsxs)("section",{className:"admin-panel",children:[(0,e.jsxs)("div",{className:"admin-panel-head",children:[(0,e.jsx)("span",{children:"Organisation chart"}),(0,e.jsx)("small",{children:"Top-down hierarchy. Each card shows role, status, and current workload."})]}),a.length?(0,e.jsx)("div",{className:"org-chart-scroll",children:(0,e.jsx)("ul",{className:"org-chart",children:a.map(a=>(0,e.jsx)(o,{node:a,workloadById:d},a.id))})}):(0,e.jsx)(i.pp,{title:"No agents yet",children:"Create an agent on the Agents page, then come back here to assign managers."})]}),(0,e.jsxs)("section",{className:"admin-grid reports-layout",children:[(0,e.jsxs)("div",{className:"admin-panel",children:[(0,e.jsxs)("div",{className:"admin-panel-head",children:[(0,e.jsx)("span",{children:"Reporting lines"}),(0,e.jsx)("small",{children:"Re-parent any agent. Cycles are blocked automatically."})]}),c.length?(0,e.jsx)("div",{className:"admin-card-list compact",children:c.map(a=>{let b=a.reports_to?c.find(b=>b.id===a.reports_to):null,d=c.filter(b=>b.id!==a.id),f=a.role&&s[a.role]?a.role:"individual_contributor";return(0,e.jsxs)("form",{action:u,className:"org-reporting-row",children:[(0,e.jsx)("input",{type:"hidden",name:"agent_id",value:a.id}),(0,e.jsxs)("div",{className:"org-reporting-identity",children:[(0,e.jsx)("div",{className:"org-card-avatar small","aria-hidden":"true",children:m(a.name)}),(0,e.jsxs)("div",{children:[(0,e.jsx)("div",{className:"org-reporting-name",children:a.name}),(0,e.jsx)("div",{className:"org-reporting-sub",children:b?`Reports to ${b.name}`:"Top of chain"})]})]}),(0,e.jsxs)("div",{className:"org-reporting-fields",children:[(0,e.jsxs)("label",{className:"org-reporting-field",children:[(0,e.jsx)("span",{children:"Title"}),(0,e.jsx)("input",{type:"text",name:"title",defaultValue:a.title||"",placeholder:"e.g. Marketing Manager"})]}),(0,e.jsxs)("label",{className:"org-reporting-field",children:[(0,e.jsx)("span",{children:"Role"}),(0,e.jsx)("select",{name:"role",defaultValue:f,children:Object.entries(s).map(([a,b])=>(0,e.jsx)("option",{value:a,children:b},a))})]}),(0,e.jsxs)("label",{className:"org-reporting-field",children:[(0,e.jsx)("span",{children:"Manager"}),(0,e.jsxs)("select",{name:"reports_to",defaultValue:a.reports_to||"",children:[(0,e.jsx)("option",{value:"",children:"— None (top of chain)"}),d.map(a=>(0,e.jsx)("option",{value:a.id,children:a.name},a.id))]})]}),(0,e.jsx)("button",{className:"admin-button",type:"submit",children:"Save"})]})]},a.id)})}):(0,e.jsx)(i.pp,{title:"No agents yet",children:"Create agents to start building your org."})]}),(0,e.jsxs)("div",{className:"admin-panel",children:[(0,e.jsxs)("div",{className:"admin-panel-head",children:[(0,e.jsx)("span",{children:"Workload by agent"}),(0,e.jsx)("small",{children:"Derived from active tasks."})]}),b.workload.length?(0,e.jsx)("div",{className:"admin-card-list compact",children:b.workload.map(a=>(0,e.jsxs)("div",{className:"admin-record compact",children:[(0,e.jsxs)("div",{className:"admin-record-top",children:[(0,e.jsx)("b",{children:a.agent_name||a.agent_id}),(0,e.jsxs)(i.qs,{tone:a.blocked_tasks?"danger":a.active_tasks?"ready":"neutral",children:[a.active_tasks," active"]})]}),(0,e.jsxs)("p",{children:[a.total_tasks," total \xb7 ",a.blocked_tasks," blocked \xb7 ",a.completed_tasks," complete"]})]},a.agent_id))}):(0,e.jsx)(i.pp,{title:"No workload data",children:"Assign tasks to see workload distribution."})]})]})]})}(0,f.A)(u,"400f7d3545eb5038a91ec7f82a5f8113f92db2fd26",null),d()}catch(a){d(a)}})},94657:(a,b,c)=>{"use strict";c.d(b,{default:()=>f});var d=c(21124),e=c(38301);function f(){let[a,b]=(0,e.useState)([]),[c,f]=(0,e.useState)("");return(0,d.jsx)("div",{className:"project-switcher","data-project-switcher":!0,children:(0,d.jsxs)("select",{value:c,onChange:a=>{var b;f(b=a.target.value),b?localStorage.setItem("madarx.activeProjectId",b):localStorage.removeItem("madarx.activeProjectId"),window.dispatchEvent(new CustomEvent("madarx:project-change",{detail:{project_id:b||null}}))},"aria-label":"Active project",children:[(0,d.jsx)("option",{value:"",children:"All projects"}),a.map(a=>(0,d.jsx)("option",{value:a.id,children:a.name},a.id))]})})}}};

package/.next/standalone/.next/static/chunks/4119-5297b212ff79d264.js DELETED Viewed

@@ -1 +0,0 @@

- "use strict";(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[4119],{4119:(e,s,a)=>{a.d(s,{A:()=>c});var t=a(5155),n=a(2115),i=a(2769);let l=[["pairing","Pairing","Bridge status + QR"],["allowlist","Allowlist","Permitted senders"],["messages","Messages","Inbound + outbound"],["send","Send","Manual message"]];async function r(e,s){let a=await fetch(e,s),t=await a.text();try{return{ok:a.ok,status:a.status,json:t?JSON.parse(t):null}}catch(e){return{ok:a.ok,status:a.status,json:null,text:t}}}function c(){var e;let[s,a]=(0,n.useState)("pairing"),[c,d]=(0,n.useState)(null),[o,h]=(0,n.useState)(null),[p,m]=(0,n.useState)(""),[u,x]=(0,n.useState)([]),[j,g]=(0,n.useState)(null),[v,f]=(0,n.useState)(""),[N,w]=(0,n.useState)(""),[b,y]=(0,n.useState)(!1),[S,_]=(0,n.useState)(""),[k,C]=(0,n.useState)(null),[A,q]=(0,n.useState)(""),[T,D]=(0,n.useState)(""),[L,W]=(0,n.useState)(!1),[R,P]=(0,n.useState)(""),[X,O]=(0,n.useState)(!1),E=(0,n.useCallback)(async()=>{try{var e;let[s,a,t]=await Promise.all([r("/api/whatsapp/status"),r("/api/whatsapp/qr"),r("/api/whatsapp/messages?limit=50")]);d(s.json),h(a.json),x((null==(e=t.json)?void 0:e.messages)||[]),g(null)}catch(e){g(e.message)}},[]);(0,n.useEffect)(()=>{E();let e=setInterval(E,3500);return()=>clearInterval(e)},[E]),(0,n.useEffect)(()=>{let e=!1;return async function(){if((null==o?void 0:o.paired)||!(null==o?void 0:o.qr))return m("");try{let s=await i.toDataURL(o.qr,{margin:1,width:220,errorCorrectionLevel:"M"});e||m(s)}catch(s){e||m("")}}(),()=>{e=!0}},[o]);let I=(null==c?void 0:c.health)||{},z=(null==c?void 0:c.allowlist)||[],M=I.pairing_state||(!1===I.ok?"offline":"unknown"),B=I.last_connected_at?new Date(I.last_connected_at).toLocaleTimeString():"—",F=(0,n.useMemo)(()=>(0,t.jsx)("p",{className:"whatsapp-warn-copy",children:"Pair only a dedicated WhatsApp number, not your personal account. Baileys is an unofficial WhatsApp Web client and the paired account can be banned."}),[]);async function J(e){if(e.preventDefault(),!v.trim())return;y(!0),_("");let s=await r("/api/whatsapp/allowlist",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({chat_id:v.trim(),label:N.trim()||null})});if(y(!1),!s.ok){var a;_((null==(a=s.json)?void 0:a.error)||"Failed to add");return}f(""),w(""),E()}async function Q(e){var s;C(e);let a=await r("/api/whatsapp/allowlist?chat_id=".concat(encodeURIComponent(e)),{method:"DELETE"});C(null),a.ok?E():g((null==(s=a.json)?void 0:s.error)||"Failed to remove")}async function U(e){if(e.preventDefault(),!A.trim()||!T.trim())return;W(!0),P(""),O(!1);let s=await r("/api/whatsapp/send",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({chat_id:A.trim(),text:T.trim()})});if(W(!1),!s.ok){var a;P((null==(a=s.json)?void 0:a.error)||"Failed to send");return}D(""),O(!0),E()}return(0,t.jsxs)("div",{className:"wa-section",children:[(0,t.jsxs)("div",{className:"wa-status-row",children:[(0,t.jsx)("span",{className:"admin-pill ".concat("paired"===M?"ready":"qr_required"===M||"reconnecting"===M||"starting"===M?"warn":"danger"),children:"paired"===M?"Connected":"qr_required"===M?"Awaiting QR scan":"reconnecting"===M?"Reconnecting":"logged_out"===M?"Logged out — reset session":"starting"===M?"Starting":"Bridge offline"}),I.user&&(0,t.jsx)("span",{className:"wa-status-user",children:I.user})]}),j&&(0,t.jsx)("div",{className:"wa-error-banner",children:j}),(0,t.jsx)("nav",{className:"tools-subnav",role:"tablist","aria-label":"WhatsApp sections",children:l.map(e=>{let[n,i,l]=e;return(0,t.jsxs)("button",{type:"button",role:"tab","aria-selected":s===n,className:"tools-subnav-pill"+(s===n?" on":""),onClick:()=>a(n),children:[(0,t.jsx)("b",{children:i}),(0,t.jsx)("small",{children:l})]},n)})}),"pairing"===s&&(0,t.jsxs)("div",{className:"tools-pane",children:[(0,t.jsxs)("div",{className:"wa-stats-row",children:[(0,t.jsxs)("div",{className:"wa-stat",children:[(0,t.jsx)("span",{className:"wa-stat-label",children:"Paired account"}),(0,t.jsx)("span",{className:"wa-stat-value",children:I.user||"—"})]}),(0,t.jsxs)("div",{className:"wa-stat",children:[(0,t.jsx)("span",{className:"wa-stat-label",children:"Bridge queue"}),(0,t.jsx)("span",{className:"wa-stat-value",children:null!=(e=I.queue_size)?e:0})]}),(0,t.jsxs)("div",{className:"wa-stat",children:[(0,t.jsx)("span",{className:"wa-stat-label",children:"Last connected"}),(0,t.jsx)("span",{className:"wa-stat-value",children:B})]})]}),I.last_error&&(0,t.jsx)("div",{className:"wa-error-banner",children:I.last_error}),"paired"!==M?(0,t.jsxs)("div",{className:"config-secrets-panel",style:{marginTop:0},children:[(0,t.jsx)("div",{className:"config-secrets-head",children:(0,t.jsxs)("div",{children:[(0,t.jsx)("span",{className:"config-section-title",children:"Pair device"}),(0,t.jsx)("p",{children:"Open WhatsApp → Settings → Linked Devices → Link a Device, then scan the code."})]})}),(0,t.jsxs)("div",{className:"whatsapp-pair-row",children:[p?(0,t.jsx)("div",{className:"whatsapp-qr-box",children:(0,t.jsx)("img",{src:p,alt:"WhatsApp pairing QR code",width:220,height:220})}):(0,t.jsx)("div",{className:"whatsapp-qr-pending",children:"Waiting for QR — make sure the daemon is running."}),(0,t.jsxs)("div",{className:"whatsapp-pair-copy",children:[(0,t.jsxs)("p",{children:["Code rotates roughly every 20 seconds. The dashboard re-fetches automatically. The session is saved at ",(0,t.jsx)("code",{children:"data/whatsapp/session/"}),"."]}),F]})]})]}):(0,t.jsxs)("div",{className:"config-secrets-panel",style:{marginTop:0},children:[(0,t.jsx)("div",{className:"config-secrets-head",children:(0,t.jsxs)("div",{children:[(0,t.jsx)("span",{className:"config-section-title",children:"Bridge is paired"}),(0,t.jsx)("p",{children:"The WhatsApp session is active. Allowlisted senders can message this agent directly."})]})}),F]})]}),"allowlist"===s&&(0,t.jsx)("div",{className:"tools-pane",children:(0,t.jsxs)("div",{className:"config-secrets-panel",children:[(0,t.jsx)("div",{className:"config-secrets-head",children:(0,t.jsxs)("div",{children:[(0,t.jsx)("span",{className:"config-section-title",children:"Allowed senders"}),(0,t.jsx)("p",{children:"Only chats on this list can message the agent. Add new entries below."})]})}),(0,t.jsxs)("form",{className:"secrets-add-form",onSubmit:J,children:[(0,t.jsxs)("div",{className:"secrets-add-fields",children:[(0,t.jsxs)("label",{className:"config-env-field",children:[(0,t.jsx)("span",{className:"config-env-field-top",children:(0,t.jsx)("b",{children:"Chat id"})}),(0,t.jsx)("input",{type:"text",autoComplete:"off",placeholder:"9715XXXXXXXX or full JID",value:v,onChange:e=>f(e.target.value),required:!0})]}),(0,t.jsxs)("label",{className:"config-env-field",children:[(0,t.jsxs)("span",{className:"config-env-field-top",children:[(0,t.jsx)("b",{children:"Label"}),(0,t.jsx)("em",{style:{fontStyle:"normal",fontSize:"10px",color:"#68707b",background:"transparent",padding:0},children:"optional"})]}),(0,t.jsx)("input",{type:"text",autoComplete:"off",placeholder:"e.g. Founder phone",value:N,onChange:e=>w(e.target.value)})]})]}),(0,t.jsxs)("div",{className:"secrets-add-footer",children:[S&&(0,t.jsx)("span",{className:"secrets-error",children:S}),(0,t.jsx)("button",{type:"submit",className:"config-save-btn",disabled:b||!v.trim(),children:b?"Adding...":"Add to allowlist"})]})]}),0===z.length?(0,t.jsx)("div",{className:"allowlists-entries-empty",children:"No senders allowlisted — all inbound messages are dropped. Add at least one chat id above."}):(0,t.jsx)("div",{className:"config-tools-list",children:z.map(e=>(0,t.jsx)("div",{className:"config-tool-row on",children:(0,t.jsxs)("div",{className:"secrets-row-inner",children:[(0,t.jsxs)("div",{className:"secrets-row-meta",children:[(0,t.jsxs)("div",{className:"config-tool-titleline",children:[(0,t.jsx)("span",{className:"config-tool-name",style:{textTransform:"none"},children:(0,t.jsx)("code",{className:"whatsapp-mono",children:e.chat_id})}),e.kind&&(0,t.jsx)("span",{className:"config-tool-risk",children:e.kind})]}),(e.label||e.created_at)&&(0,t.jsxs)("div",{className:"config-tool-status",children:[e.label&&(0,t.jsx)("span",{children:e.label}),e.created_at&&(0,t.jsx)("span",{children:new Date(e.created_at).toLocaleString()})]})]}),(0,t.jsx)("div",{className:"secrets-row-actions",children:(0,t.jsx)("button",{type:"button",className:"secrets-action-btn danger",disabled:k===e.chat_id,onClick:()=>Q(e.chat_id),children:k===e.chat_id?"...":"Remove"})})]})},e.chat_id))})]})}),"messages"===s&&(0,t.jsx)("div",{className:"tools-pane",children:(0,t.jsxs)("div",{className:"config-secrets-panel",children:[(0,t.jsx)("div",{className:"config-secrets-head",children:(0,t.jsxs)("div",{children:[(0,t.jsx)("span",{className:"config-section-title",children:"Recent messages"}),(0,t.jsxs)("p",{children:[u.length," of last 50 inbound + outbound."]})]})}),0===u.length?(0,t.jsx)("div",{className:"secrets-empty",children:"No messages yet. Inbound and outbound traffic from the bridge will appear here."}):(0,t.jsx)("div",{style:{overflowX:"auto"},children:(0,t.jsxs)("table",{className:"admin-table",style:{minWidth:520},children:[(0,t.jsx)("thead",{children:(0,t.jsxs)("tr",{children:[(0,t.jsx)("th",{children:"When"}),(0,t.jsx)("th",{children:"Dir"}),(0,t.jsx)("th",{children:"Chat"}),(0,t.jsx)("th",{children:"Sender"}),(0,t.jsx)("th",{children:"Text"})]})}),(0,t.jsx)("tbody",{children:u.map(e=>(0,t.jsxs)("tr",{children:[(0,t.jsx)("td",{style:{whiteSpace:"nowrap"},children:new Date(e.created_at).toLocaleTimeString()}),(0,t.jsx)("td",{children:(0,t.jsx)("span",{className:"admin-pill ".concat("inbound"===e.direction?"warn":"ready"),children:e.direction})}),(0,t.jsx)("td",{children:(0,t.jsx)("code",{className:"whatsapp-mono",children:e.chat_id})}),(0,t.jsx)("td",{children:(0,t.jsx)("code",{className:"whatsapp-mono",children:e.sender||"—"})}),(0,t.jsx)("td",{style:{maxWidth:260,overflow:"hidden",textOverflow:"ellipsis",whiteSpace:"nowrap"},children:e.text})]},e.id))})]})})]})}),"send"===s&&(0,t.jsx)("div",{className:"tools-pane",children:(0,t.jsxs)("div",{className:"config-secrets-panel",children:[(0,t.jsx)("div",{className:"config-secrets-head",children:(0,t.jsxs)("div",{children:[(0,t.jsx)("span",{className:"config-section-title",children:"Send a message"}),(0,t.jsx)("p",{children:"Manual outbound send. Logs to whatsapp_messages with an audit row."})]})}),(0,t.jsxs)("form",{className:"secrets-add-form",onSubmit:U,children:[(0,t.jsxs)("div",{className:"secrets-add-fields",children:[(0,t.jsxs)("label",{className:"config-env-field",children:[(0,t.jsx)("span",{className:"config-env-field-top",children:(0,t.jsx)("b",{children:"Chat id"})}),(0,t.jsx)("input",{type:"text",autoComplete:"off",placeholder:"Digits or full JID",value:A,onChange:e=>{q(e.target.value),O(!1)},required:!0})]}),(0,t.jsxs)("label",{className:"config-env-field",children:[(0,t.jsx)("span",{className:"config-env-field-top",children:(0,t.jsx)("b",{children:"Message"})}),(0,t.jsx)("textarea",{rows:4,placeholder:"Plain text only",value:T,onChange:e=>{D(e.target.value),O(!1)},required:!0,style:{resize:"vertical",fontFamily:"inherit",fontSize:"13px",padding:"8px 10px",borderRadius:8,border:"1px solid rgba(17,19,24,.12)",outline:"none",width:"100%",boxSizing:"border-box"}})]})]}),(0,t.jsxs)("div",{className:"secrets-add-footer",children:[R&&(0,t.jsx)("span",{className:"secrets-error",children:R}),X&&(0,t.jsx)("span",{style:{fontSize:12,color:"#2d7044",fontWeight:650},children:"Sent"}),(0,t.jsx)("button",{type:"submit",className:"config-save-btn",disabled:L||!A.trim()||!T.trim(),children:L?"Sending...":"Send message"})]})]})]})})]})}}}]);

package/.next/standalone/.next/static/chunks/app/activity/loading-abb4b18098f1d93e.js DELETED Viewed

@@ -1 +0,0 @@

- (self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[64,72,167,178,232,332,489,497,552,658,723,767,769,796,870,888,939,972,1053,1115,1177,1426,1523,1557,1562,1581,1672,1851,1990,2008,2139,2153,2162,2164,2175,2254,2334,2343,2433,2635,2640,2711,2726,2748,2837,2873,2943,3033,3076,3159,3190,3203,3395,3437,3465,3492,3499,3554,3558,3577,3629,3630,3641,3659,3745,3756,3802,3839,3870,3886,3904,3905,3942,3975,3976,4094,4095,4104,4115,4190,4204,4209,4218,4229,4231,4269,4373,4410,4431,4475,4507,4519,4530,4537,4662,4721,4819,4890,4999,5049,5085,5092,5098,5118,5120,5130,5169,5180,5207,5223,5289,5324,5331,5441,5520,5551,5588,5610,5689,5707,5722,5743,5794,5810,5850,5887,5903,5906,6002,6079,6113,6147,6186,6234,6278,6279,6341,6365,6403,6456,6496,6591,6595,6621,6667,6701,6725,6779,6799,6816,6862,7020,7060,7070,7092,7113,7237,7276,7324,7361,7440,7750,7765,7795,7823,7903,7920,7986,8059,8093,8100,8159,8227,8252,8273,8298,8312,8397,8401,8405,8578,8591,8665,8679,8732,8765,8828,8887,8907,8994,9e3,9037,9040,9154,9160,9183,9413,9442,9504,9554,9628,9873],{4441:()=>{}},_=>{_.O(0,[8441,1255,7358],()=>_(_.s=4441)),_N_E=_.O()}]);

package/.next/standalone/.next/static/chunks/app/agents/[id]/loading-abb4b18098f1d93e.js DELETED Viewed

@@ -1 +0,0 @@