forge-cpp-mcp 0.2.4__tar.gz → 0.3.0__tar.gz

{forge_cpp_mcp-0.2.4 → forge_cpp_mcp-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: forge-cpp-mcp
-Version: 0.2.4
+Version: 0.3.0
 Summary: A safe MCP server for structured C++ project development workflows.
 Project-URL: Homepage, https://github.com/hardened-steel/ForgeMCP
 Project-URL: Repository, https://github.com/hardened-steel/ForgeMCP
@@ -12,8 +12,12 @@ License-File: LICENSE
 Requires-Python: >=3.13
 Requires-Dist: markdown-it-py>=4.0
 Requires-Dist: mcp[cli]==2.1.1
+Requires-Dist: psutil<8,>=7.2
 Requires-Dist: pydantic>=2.13
+Requires-Dist: pywin32>=311; sys_platform == 'win32'
 Requires-Dist: regex>=2024.11.6
+Requires-Dist: starlette>=0.48.0
+Requires-Dist: uvicorn>=0.31.1
 Provides-Extra: build
 Requires-Dist: build>=1.3; extra == 'build'
 Provides-Extra: dev
@@ -96,19 +100,20 @@ and install it in a virtual environment:
 
 ```powershell
 python -m venv .venv
-.\.venv\Scripts\python.exe -m pip install .\forge_cpp_mcp-0.2.4-py3-none-any.whl
+.\.venv\Scripts\python.exe -m pip install .\forge_cpp_mcp-0.3.0-py3-none-any.whl
 .\.venv\Scripts\forgemcp.exe --help
 ```
 
 The wheel includes the compiled HTML widgets and icons. No npm commands or separate
-frontend deployment are needed. CMake, Ninja, compilers, and clangd are external
+frontend deployment are needed. It also packages the local admin panel and its
+isolated widget host. CMake, Ninja, compilers, and clangd are external
 tools: install the ones needed by your workflows separately.
 The distribution name is `forge-cpp-mcp`; the Python module and server command are `forgemcp`.
 
 After the package is published to PyPI, the install command can instead be:
 
 ```powershell
-.\.venv\Scripts\python.exe -m pip install forge-cpp-mcp==0.2.4
+.\.venv\Scripts\python.exe -m pip install forge-cpp-mcp==0.3.0
 ```
 
 ## Setup from source
@@ -152,6 +157,75 @@ builds the wheel first and then starts the server for this repository.
 
 All MCP traffic uses stdout. Operational logs must go to stderr.
 
+## Local admin panel
+
+Normal CLI launches automatically join one admin Hub for the current OS user.
+Each server remains an independent stdio process with its own workspace,
+environment, toolsets, processes, and clangd sessions. The Hub presents them as
+separate browser tabs; it does not move their services into a shared process.
+
+Open the panel while at least one server is running:
+
+```powershell
+forgemcp --open-admin
+```
+
+This command retrieves the private browser URL through same-user local IPC and
+opens the system browser, then exits. The startup message contains the public
+address and this command; the authentication token is never printed. Opening the
+public address in a new browser session alone does not authenticate that session.
+
+Each instance tab offers:
+
+- tool-call history from both MCP clients and the browser, with original arguments,
+  results, progress, timestamps, and errors;
+- the original MCP App widget, text fallback, and complete JSON result;
+- tool schemas, static resources, resource templates, and resource reading;
+- startup settings, process status, discovered toolsets, CMake configurations,
+  and retained clangd sessions;
+- browser responses to SDK elicitation requests, including external-file read
+  confirmation for commands initiated from the panel.
+
+Settings are read-only. Command controls start hidden; select **Enable command
+controls** to call an existing tool with literal JSON arguments; the catalog shows
+its input schema. These
+calls pass through the same SDK handlers, validation, and feature locks as stdio
+calls. There is no panel-wide execution queue. Existing modules decide which
+operations may run concurrently.
+The panel can cancel its own running commands; calls initiated by an MCP client
+remain owned by that client.
+
+The panel listens on `127.0.0.1`, preferring port 8765 and choosing a free port when
+that port is unavailable. Widgets use a second loopback port for their isolated
+host. The Hub stops shortly after the last server session ends; browser tabs do
+not keep it running. A temporary IPC disconnect is shown as reconnecting while
+the underlying server process remains alive. Lost tool calls are never replayed
+automatically; read the instance history after reconnecting before repeating one.
+
+History and linked widget result resources live only in the server's memory.
+Stopping that server loses its history; there is no database or disk archive.
+Process transcripts retain their existing in-memory lifecycle and are not copied
+into a separate admin log.
+
+Use these operator options when needed:
+
+```powershell
+forgemcp --no-admin
+forgemcp --admin-port 9000
+forgemcp --admin-ipc forgemcp-other
+forgemcp --open-admin --admin-ipc forgemcp-other
+```
+
+`--no-admin` opts that instance out of the panel. `--admin-port` is a preference
+when starting a new Hub; it does not change an already running Hub's port.
+Instances using the same `--admin-ipc` name share a Hub; a different name creates
+a separate group for the same OS user.
+
+The normal wheel build includes `admin.html` and `sandbox.html` alongside the MCP
+widgets. After changing frontend source, use the documented wheel build or
+`npm run build --prefix frontend`. An unbuilt source checkout returns an explicit
+missing-assets page until those files are generated.
+
 ## Connect Codex or Claude Code
 
 After [installation](#install-a-release) or [source setup](#setup-from-source), copy the appropriate example into the root of the C/C++
@@ -322,6 +396,36 @@ no source preview because explicit external reads require confirmation.
 
 ## CMake profiles
 
+CMake owns which configurations can supply clangd compilation contexts. After a
+successful configure/generate, ForgeMCP reads `cmakeFiles-v1` from a new CMake
+File API reply and records SHA-256 hashes of that build directory's configuration
+inputs in `project/` and `storage/`. Hashes and dependency lists live in memory;
+restart the server and run `cmake_configure` to confirm contexts again. Existing
+File API replies and `compile_commands.json` alone do not confirm current inputs.
+
+Workspace writes, edits, moves, deletions, and directory creation check known
+inputs at the operation boundary. Actual input changes withdraw affected contexts
+and notify clangd through the CMake subscription; identical content and ordinary
+source/header edits keep contexts available unless those files are CMake inputs.
+Known preset files are treated conservatively without resolving preset inheritance
+or includes. CONFIGURE_DEPENDS globs conservatively invalidate on structural
+changes; older File API replies without glob information use this policy for all
+configurations. No project-wide dependency scan or CMake/glob parser is used.
+
+Run `cmake_configure` to restore outdated or unknown contexts. `cmake_build` is
+also allowed for outdated configurations: a new successful File API generation
+can restore them even when later compilation fails. A successful build without
+regeneration does not refresh the input baseline. Failed configure/generate cannot
+reactivate old artifacts, and invalidation leaves build trees and databases intact.
+Unchanged contexts and database contents retain their clangd sessions.
+
+Checks occur only during Workspace mutations, configure, and build. There are no
+filesystem watchers, polling, or background scans, and no guarantee of detecting
+external editor/process changes. External `root/` dependencies are omitted from
+hash tracking without elicitation or reads; changes to those inputs require an
+explicit configure. Native preset contexts still require a known managed build
+directory and a compilation database.
+
 `cmake_profiles` lists profiles. `cmake_configure`, `cmake_build`, and `cmake_test`
 operate on all profiles unless a nonempty `profiles` list selects a subset.
 Configuration must precede building, and building must precede testing. Profiles

{forge_cpp_mcp-0.2.4 → forge_cpp_mcp-0.3.0}/README.md

@@ -71,19 +71,20 @@ and install it in a virtual environment:
 
 ```powershell
 python -m venv .venv
-.\.venv\Scripts\python.exe -m pip install .\forge_cpp_mcp-0.2.4-py3-none-any.whl
+.\.venv\Scripts\python.exe -m pip install .\forge_cpp_mcp-0.3.0-py3-none-any.whl
 .\.venv\Scripts\forgemcp.exe --help
 ```
 
 The wheel includes the compiled HTML widgets and icons. No npm commands or separate
-frontend deployment are needed. CMake, Ninja, compilers, and clangd are external
+frontend deployment are needed. It also packages the local admin panel and its
+isolated widget host. CMake, Ninja, compilers, and clangd are external
 tools: install the ones needed by your workflows separately.
 The distribution name is `forge-cpp-mcp`; the Python module and server command are `forgemcp`.
 
 After the package is published to PyPI, the install command can instead be:
 
 ```powershell
-.\.venv\Scripts\python.exe -m pip install forge-cpp-mcp==0.2.4
+.\.venv\Scripts\python.exe -m pip install forge-cpp-mcp==0.3.0
 ```
 
 ## Setup from source
@@ -127,6 +128,75 @@ builds the wheel first and then starts the server for this repository.
 
 All MCP traffic uses stdout. Operational logs must go to stderr.
 
+## Local admin panel
+
+Normal CLI launches automatically join one admin Hub for the current OS user.
+Each server remains an independent stdio process with its own workspace,
+environment, toolsets, processes, and clangd sessions. The Hub presents them as
+separate browser tabs; it does not move their services into a shared process.
+
+Open the panel while at least one server is running:
+
+```powershell
+forgemcp --open-admin
+```
+
+This command retrieves the private browser URL through same-user local IPC and
+opens the system browser, then exits. The startup message contains the public
+address and this command; the authentication token is never printed. Opening the
+public address in a new browser session alone does not authenticate that session.
+
+Each instance tab offers:
+
+- tool-call history from both MCP clients and the browser, with original arguments,
+  results, progress, timestamps, and errors;
+- the original MCP App widget, text fallback, and complete JSON result;
+- tool schemas, static resources, resource templates, and resource reading;
+- startup settings, process status, discovered toolsets, CMake configurations,
+  and retained clangd sessions;
+- browser responses to SDK elicitation requests, including external-file read
+  confirmation for commands initiated from the panel.
+
+Settings are read-only. Command controls start hidden; select **Enable command
+controls** to call an existing tool with literal JSON arguments; the catalog shows
+its input schema. These
+calls pass through the same SDK handlers, validation, and feature locks as stdio
+calls. There is no panel-wide execution queue. Existing modules decide which
+operations may run concurrently.
+The panel can cancel its own running commands; calls initiated by an MCP client
+remain owned by that client.
+
+The panel listens on `127.0.0.1`, preferring port 8765 and choosing a free port when
+that port is unavailable. Widgets use a second loopback port for their isolated
+host. The Hub stops shortly after the last server session ends; browser tabs do
+not keep it running. A temporary IPC disconnect is shown as reconnecting while
+the underlying server process remains alive. Lost tool calls are never replayed
+automatically; read the instance history after reconnecting before repeating one.
+
+History and linked widget result resources live only in the server's memory.
+Stopping that server loses its history; there is no database or disk archive.
+Process transcripts retain their existing in-memory lifecycle and are not copied
+into a separate admin log.
+
+Use these operator options when needed:
+
+```powershell
+forgemcp --no-admin
+forgemcp --admin-port 9000
+forgemcp --admin-ipc forgemcp-other
+forgemcp --open-admin --admin-ipc forgemcp-other
+```
+
+`--no-admin` opts that instance out of the panel. `--admin-port` is a preference
+when starting a new Hub; it does not change an already running Hub's port.
+Instances using the same `--admin-ipc` name share a Hub; a different name creates
+a separate group for the same OS user.
+
+The normal wheel build includes `admin.html` and `sandbox.html` alongside the MCP
+widgets. After changing frontend source, use the documented wheel build or
+`npm run build --prefix frontend`. An unbuilt source checkout returns an explicit
+missing-assets page until those files are generated.
+
 ## Connect Codex or Claude Code
 
 After [installation](#install-a-release) or [source setup](#setup-from-source), copy the appropriate example into the root of the C/C++
@@ -297,6 +367,36 @@ no source preview because explicit external reads require confirmation.
 
 ## CMake profiles
 
+CMake owns which configurations can supply clangd compilation contexts. After a
+successful configure/generate, ForgeMCP reads `cmakeFiles-v1` from a new CMake
+File API reply and records SHA-256 hashes of that build directory's configuration
+inputs in `project/` and `storage/`. Hashes and dependency lists live in memory;
+restart the server and run `cmake_configure` to confirm contexts again. Existing
+File API replies and `compile_commands.json` alone do not confirm current inputs.
+
+Workspace writes, edits, moves, deletions, and directory creation check known
+inputs at the operation boundary. Actual input changes withdraw affected contexts
+and notify clangd through the CMake subscription; identical content and ordinary
+source/header edits keep contexts available unless those files are CMake inputs.
+Known preset files are treated conservatively without resolving preset inheritance
+or includes. CONFIGURE_DEPENDS globs conservatively invalidate on structural
+changes; older File API replies without glob information use this policy for all
+configurations. No project-wide dependency scan or CMake/glob parser is used.
+
+Run `cmake_configure` to restore outdated or unknown contexts. `cmake_build` is
+also allowed for outdated configurations: a new successful File API generation
+can restore them even when later compilation fails. A successful build without
+regeneration does not refresh the input baseline. Failed configure/generate cannot
+reactivate old artifacts, and invalidation leaves build trees and databases intact.
+Unchanged contexts and database contents retain their clangd sessions.
+
+Checks occur only during Workspace mutations, configure, and build. There are no
+filesystem watchers, polling, or background scans, and no guarantee of detecting
+external editor/process changes. External `root/` dependencies are omitted from
+hash tracking without elicitation or reads; changes to those inputs require an
+explicit configure. Native preset contexts still require a known managed build
+directory and a compilation database.
+
 `cmake_profiles` lists profiles. `cmake_configure`, `cmake_build`, and `cmake_test`
 operate on all profiles unless a nonempty `profiles` list selects a subset.
 Configuration must precede building, and building must precede testing. Profiles

forge_cpp_mcp-0.3.0/frontend/admin.html

@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>ForgeMCP admin</title>
+  </head>
+  <body>
+    <main id="admin" class="fm-widget fm-admin" aria-label="ForgeMCP administration"></main>
+    <script type="module" src="/src/admin.js"></script>
+  </body>
+</html>

{forge_cpp_mcp-0.2.4 → forge_cpp_mcp-0.3.0}/frontend/package.json

@@ -3,7 +3,7 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "build": "vite build --mode workspace && vite build --mode file && vite build --mode search && vite build --mode result && vite build --mode process && vite build --mode process-details && vite build --mode toolsets && vite build --mode cmake-profiles && vite build --mode cmake-configure && vite build --mode cmake-build && vite build --mode cmake-test && vite build --mode cmake-run-test && vite build --mode clangd",
+    "build": "vite build --mode workspace && vite build --mode file && vite build --mode search && vite build --mode result && vite build --mode process && vite build --mode process-details && vite build --mode toolsets && vite build --mode cmake-profiles && vite build --mode cmake-configure && vite build --mode cmake-build && vite build --mode cmake-test && vite build --mode cmake-run-test && vite build --mode clangd && vite build --mode admin && vite build --mode sandbox",
     "test": "node --test tests/*.test.js"
   },
   "dependencies": {

forge_cpp_mcp-0.3.0/frontend/sandbox.html

@@ -0,0 +1,11 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>ForgeMCP widget sandbox</title>
+  </head>
+  <body>
+    <script type="module" src="/src/admin-sandbox.js"></script>
+  </body>
+</html>

forge_cpp_mcp-0.3.0/frontend/src/admin-sandbox.js

@@ -0,0 +1,43 @@
+/** Relay one packaged App through a separate-origin, network-restricted sandbox. */
+const parentOrigin = new URLSearchParams(location.hash.slice(1)).get("parent_origin");
+let parentUrl;
+try { parentUrl = new URL(parentOrigin); } catch { /* An invalid parent never receives messages. */ }
+const loopback = (url) => url?.protocol === "http:"
+  && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
+
+if (window.parent !== window && loopback(parentUrl) && parentUrl.origin !== location.origin) {
+  let view = null;
+  const internal = (message) => typeof message?.method === "string"
+    && message.method.startsWith("ui/notifications/sandbox-");
+  window.addEventListener("message", (event) => {
+    const message = event.data;
+    if (!message || message.jsonrpc !== "2.0") return;
+    if (event.source === window.parent && event.origin === parentUrl.origin) {
+      if (message.method === "ui/notifications/sandbox-resource-ready") {
+        if (view || typeof message.params?.html !== "string") return;
+        const parsed = new DOMParser().parseFromString(message.params.html, "text/html");
+        const csp = parsed.createElement("meta");
+        csp.httpEquiv = "Content-Security-Policy";
+        csp.content = "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; "
+          + "img-src data: blob:; font-src data:; connect-src 'none'; frame-src 'none'; "
+          + "object-src 'none'; base-uri 'none'; form-action 'none'; navigate-to 'none'";
+        parsed.head.prepend(csp);
+        view = document.createElement("iframe");
+        view.title = "Tool result";
+        view.setAttribute("sandbox", "allow-scripts");
+        view.style.cssText = "display:block;width:100%;height:100%;border:0";
+        view.srcdoc = `<!doctype html>${parsed.documentElement.outerHTML}`;
+        document.body.replaceChildren(view);
+      } else if (!internal(message) && view) {
+        view.contentWindow.postMessage(message, "*");
+      }
+    } else if (view && event.source === view.contentWindow && !internal(message)) {
+      window.parent.postMessage(message, parentUrl.origin);
+    }
+  });
+  document.documentElement.style.cssText = "height:100%;margin:0;background:transparent";
+  document.body.style.cssText = "height:100%;margin:0;background:transparent";
+  window.parent.postMessage({
+    jsonrpc: "2.0", method: "ui/notifications/sandbox-proxy-ready", params: {},
+  }, parentUrl.origin);
+}

forge_cpp_mcp-0.3.0/frontend/src/admin-widget.js

@@ -0,0 +1,133 @@
+import { AppBridge, PostMessageTransport, getToolUiResourceUri } from "@modelcontextprotocol/ext-apps/app-bridge";
+
+/** Identify only immutable result resources linked by the original invocation. */
+function linkedUris(result) {
+  const uris = new Set();
+  const resources = result?.structuredContent?.resources;
+  if (!resources || typeof resources !== "object") return uris;
+  for (const resource of Object.values(resources)) {
+    if (typeof resource?.uri === "string"
+      && /^forgemcp:\/\/workspace\/results\/[0-9a-f]{32}\/[a-zA-Z0-9_-]+\.(json|md)$/.test(resource.uri)) {
+      uris.add(resource.uri);
+    }
+  }
+  return uris;
+}
+
+/** Mount one original tool invocation; the frame receives no execution capability. */
+export async function mountInvocationWidget({ container, tool, call, sandboxOrigin, readResource, theme, signal }) {
+  const uri = getToolUiResourceUri(tool);
+  if (!uri) throw new Error("This tool has no widget resource.");
+  const sandbox = new URL(sandboxOrigin);
+  if (sandbox.origin === location.origin || sandbox.protocol !== "http:"
+    || !["127.0.0.1", "localhost", "[::1]"].includes(sandbox.hostname)) {
+    throw new Error("The widget sandbox requires a separate local origin.");
+  }
+  const resource = await readResource(uri);
+  if (signal?.aborted) throw new DOMException("Widget loading cancelled.", "AbortError");
+  const html = resource?.contents?.find((item) => item.uri === uri && typeof item.text === "string");
+  if (!html || !String(html.mimeType ?? "").startsWith("text/html")) {
+    throw new Error("The widget HTML resource is unavailable.");
+  }
+  const allowed = linkedUris(call.result);
+  const frame = document.createElement("iframe");
+  frame.title = `${call.tool_name} result widget`;
+  frame.className = "admin-widget-frame";
+  frame.setAttribute("sandbox", "allow-scripts allow-same-origin");
+  let disposed = false;
+  let initialized = false;
+  let timeout;
+  let resize;
+  const context = () => ({
+    toolInfo: { id: call.id, tool },
+    theme: theme(),
+    displayMode: "inline",
+    availableDisplayModes: ["inline"],
+    locale: navigator.language,
+    timeZone: Intl.DateTimeFormat().resolvedOptions().timeZone,
+    platform: "web",
+    containerDimensions: { width: Math.max(1, container.clientWidth), maxHeight: 420 },
+    safeAreaInsets: { top: 0, right: 0, bottom: 0, left: 0 },
+    styles: { variables: { "--font-mono": '"Cascadia Code", Consolas, monospace' } },
+  });
+  const bridge = new AppBridge(
+    null,
+    { name: "ForgeMCP admin", version: "1.0.0" },
+    { serverResources: {} },
+    { hostContext: context() },
+  );
+  bridge.onreadresource = async ({ uri: requested }) => {
+    if (disposed || !allowed.has(requested)) throw new Error("Only resources linked by this invocation are available.");
+    return readResource(requested);
+  };
+  bridge.oncalltool = async () => { throw new Error("Result widgets cannot execute tools."); };
+  bridge.onlistresources = async () => ({ resources: [] });
+  bridge.onlistresourcetemplates = async () => ({ resourceTemplates: [] });
+  bridge.onlistprompts = async () => ({ prompts: [] });
+  bridge.onopenlink = async () => { throw new Error("External links are unavailable in result widgets."); };
+  bridge.onsizechange = ({ height }) => {
+    if (!disposed && Number.isFinite(height) && height > 0) frame.style.height = `${Math.min(420, height)}px`;
+  };
+  let resolveReady;
+  let rejectReady;
+  const ready = new Promise((resolve, reject) => { resolveReady = resolve; rejectReady = reject; });
+  ready.catch(() => {});
+  bridge.onsandboxready = async () => {
+    try {
+      if (!disposed) await bridge.sendSandboxResourceReady({
+        html: html.text,
+        sandbox: "allow-scripts",
+        csp: { connectDomains: [], resourceDomains: [], frameDomains: [] },
+      });
+    } catch (error) { rejectReady(error); }
+  };
+  bridge.oninitialized = async () => {
+    if (disposed) return;
+    try {
+      initialized = true;
+      await bridge.sendToolInput({ arguments: call.arguments ?? {} });
+      if (call.result) await bridge.sendToolResult(call.result);
+      else if (["cancelled", "interrupted"].includes(call.status)) {
+        await bridge.sendToolCancelled({ reason: call.error ?? call.status });
+      }
+      clearTimeout(timeout);
+      resolveReady();
+    } catch (error) { rejectReady(error); }
+  };
+  const dispose = async () => {
+    if (disposed) return;
+    disposed = true;
+    clearTimeout(timeout);
+    resize?.disconnect();
+    if (initialized) {
+      try { await bridge.teardownResource({}, { timeout: 1000 }); } catch { /* A closed frame may no longer answer. */ }
+    }
+    try { await bridge.close(); } catch { /* Closing a disconnected bridge is harmless. */ }
+    frame.remove();
+  };
+  const aborted = () => {
+    rejectReady(new DOMException("Widget loading cancelled.", "AbortError"));
+    void dispose();
+  };
+  signal?.addEventListener("abort", aborted, { once: true });
+  container.append(frame);
+  try {
+    await bridge.connect(new PostMessageTransport(frame.contentWindow, frame.contentWindow));
+    if (disposed || signal?.aborted) throw new DOMException("Widget loading cancelled.", "AbortError");
+    timeout = setTimeout(() => rejectReady(new Error("The widget did not complete its connection handshake.")), 12000);
+    const url = new URL("/sandbox.html", sandbox);
+    url.hash = new URLSearchParams({ parent_origin: location.origin }).toString();
+    frame.src = url.href;
+    await ready;
+    resize = new ResizeObserver(() => { if (!disposed) bridge.setHostContext(context()); });
+    resize.observe(container);
+    return {
+      dispose: async () => { signal?.removeEventListener("abort", aborted); await dispose(); },
+      refreshContext: () => { if (!disposed) bridge.setHostContext(context()); },
+    };
+  } catch (error) {
+    signal?.removeEventListener("abort", aborted);
+    await dispose();
+    throw error;
+  }
+}

forge_cpp_mcp-0.3.0/frontend/src/admin.css

@@ -0,0 +1,82 @@
+/* The admin shell uses the same palette, fonts and compact controls as result widgets. */
+.fm-admin { height: 100dvh; min-height: 380px; display: flex; flex-direction: column; background: var(--fm-bg); }
+.fm-admin button, .fm-admin input, .fm-admin select, .fm-admin textarea { font: inherit; color: inherit; border: 1px solid var(--fm-border); background: var(--fm-bar); border-radius: 0; }
+.fm-admin button { padding: 5px 9px; cursor: pointer; }
+.fm-admin button:disabled { cursor: default; opacity: .55; }
+.fm-admin :is(button, input, select, textarea):focus-visible { outline: 2px solid var(--fm-accent); outline-offset: 2px; }
+.fm-admin button[aria-selected="true"], .fm-admin button[aria-pressed="true"] { color: var(--fm-accent); border-color: var(--fm-accent); }
+.fm-admin h1, .fm-admin h2, .fm-admin h3 { margin: 0; font: inherit; font-weight: 600; overflow-wrap: anywhere; }
+.admin-header { display: flex; align-items: center; gap: 12px; padding: 9px 14px; background: var(--fm-bar); border-bottom: 1px solid var(--fm-border); flex-wrap: wrap; }
+.admin-header h1 { color: var(--fm-warning); margin-right: auto; }
+.admin-header label { display: flex; align-items: center; gap: 6px; }
+.admin-connection { color: var(--fm-muted); }
+.admin-connection[data-live="true"] { color: var(--fm-success); }
+.admin-instances { display: flex; gap: 5px; padding: 7px 10px; flex: none; border-bottom: 1px solid var(--fm-border); overflow-x: auto; }
+.admin-instance-tab { display: flex; align-items: center; gap: 8px; max-width: 48ch; flex: none; text-align: left; white-space: normal; overflow-wrap: anywhere; }
+.admin-dot { height: 7px; width: 7px; min-width: 7px; background: var(--fm-muted); }
+.admin-dot[data-connected="true"] { background: var(--fm-success); }
+.admin-statusbar { padding: 7px 14px; display: flex; gap: 6px 20px; flex-wrap: wrap; color: var(--fm-muted); border-bottom: 1px solid var(--fm-border); }
+.admin-statusbar span { overflow-wrap: anywhere; }
+.admin-pages { display: flex; gap: 5px; padding: 7px 10px; border-bottom: 1px solid var(--fm-border); flex-wrap: wrap; }
+.admin-pages .admin-refresh { margin-left: auto; }
+.admin-body { flex: 1; min-height: 0; overflow: auto; }
+.admin-elicitations { flex: none; max-height: 50dvh; overflow: auto; border-bottom: 1px solid var(--fm-border); }
+.admin-elicitations:empty { display: none; }
+.admin-confirmation-link { color: var(--fm-accent); overflow-wrap: anywhere; }
+.admin-notice { margin: 0; padding: 8px 14px; color: var(--fm-warning); background: var(--fm-bar); border-bottom: 1px solid var(--fm-border); overflow-wrap: anywhere; }
+.admin-notice[hidden] { display: none; }
+.admin-empty { padding: 28px 18px; color: var(--fm-muted); }
+.admin-history { display: grid; grid-template-columns: minmax(230px, 29%) minmax(0, 1fr); height: 100%; }
+.admin-history-sidebar { display: flex; flex-direction: column; min-height: 0; border-right: 1px solid var(--fm-border); }
+.admin-history-filter { display: flex; gap: 7px; flex-wrap: wrap; padding: 10px; border-bottom: 1px solid var(--fm-border); }
+.admin-history-filter input { width: 100%; padding: 6px 8px; }
+.admin-history-count { color: var(--fm-muted); }
+.admin-history-list { overflow-y: auto; flex: 1; }
+.admin-call { width: 100%; display: grid; grid-template-columns: minmax(0, 1fr) auto; gap: 3px 8px; text-align: left; border-width: 0 0 1px !important; padding: 9px 10px !important; background: transparent !important; overflow-wrap: anywhere; }
+.admin-call[aria-selected="true"] { background: var(--fm-hover) !important; box-shadow: inset 3px 0 var(--fm-accent); }
+.admin-call-name { color: var(--fm-text); grid-column: 1 / -1; }
+.admin-call-time { color: var(--fm-muted); font-size: 11px; }
+.admin-state { color: var(--fm-muted); overflow-wrap: anywhere; }
+.admin-state[data-state="running"], .admin-state[data-state="queued"] { color: var(--fm-warning); }
+.admin-state[data-state="failed"], .admin-state[data-state="error"], .admin-state[data-state="interrupted"] { color: var(--fm-error); }
+.admin-state[data-state="cancelled"] { color: var(--fm-warning); }
+.admin-state[data-state="completed"], .admin-state[data-state="succeeded"] { color: var(--fm-success); }
+.admin-detail { min-height: 0; overflow: auto; padding: 14px; }
+.admin-detail-heading { display: flex; gap: 8px 16px; align-items: baseline; flex-wrap: wrap; margin-bottom: 10px; }
+.admin-detail-heading h2 { color: var(--fm-accent); }
+.admin-detail-meta { display: grid; grid-template-columns: 14ch minmax(0, 1fr); gap: 4px 10px; margin: 10px 0; }
+.admin-detail-meta dt { color: var(--fm-muted); overflow-wrap: anywhere; }
+.admin-detail-meta dd { margin: 0; overflow-wrap: anywhere; }
+.admin-detail details { margin: 10px 0; }
+.admin-detail summary, .admin-card summary { cursor: pointer; color: var(--fm-muted); }
+.admin-result-tabs { display: flex; gap: 5px; padding: 7px 0; }
+.admin-result { min-height: 70px; }
+.admin-widget-frame { display: block; width: 100%; height: 420px; border: 0; }
+.admin-pre { margin: 7px 0; padding: 10px; border: 1px solid var(--fm-border); background: var(--fm-bar); white-space: pre-wrap; overflow-wrap: anywhere; tab-size: 4; user-select: text; }
+.admin-error { color: var(--fm-error); white-space: pre-wrap; overflow-wrap: anywhere; }
+.admin-section { padding: 14px; }
+.admin-section > h2 { margin-bottom: 12px; color: var(--fm-accent); }
+.admin-cards { display: grid; grid-template-columns: repeat(auto-fit, minmax(min(100%, 310px), 1fr)); gap: 12px; }
+.admin-card { border: 1px solid var(--fm-border); padding: 12px; min-width: 0; }
+.admin-card h3 { margin-bottom: 8px; }
+.admin-card p { white-space: pre-wrap; overflow-wrap: anywhere; margin: 7px 0; }
+.admin-card .admin-pre { max-height: 500px; overflow: auto; }
+.admin-table-scroll { overflow: auto; margin: 10px 0; }
+.admin-table { width: 100%; border-collapse: collapse; text-align: left; }
+.admin-table :is(th, td) { padding: 7px 9px; vertical-align: top; border: 1px solid var(--fm-border); overflow-wrap: anywhere; }
+.admin-table th { color: var(--fm-muted); background: var(--fm-bar); font-weight: 400; }
+.admin-catalog-group { margin-top: 18px; }
+.admin-command-form { display: grid; gap: 9px; margin-bottom: 15px; border: 1px solid var(--fm-accent); padding: 12px; }
+.admin-command-form label { display: grid; gap: 5px; }
+.admin-command-form textarea { min-height: 140px; width: 100%; padding: 8px; resize: vertical; }
+.admin-command-form select { width: 100%; padding: 6px; }
+.admin-command-form button { justify-self: start; }
+.admin-muted { color: var(--fm-muted); }
+.admin-resource-title { overflow-wrap: anywhere; }
+@media (max-width: 760px) {
+  .admin-history { grid-template-columns: 1fr; height: auto; min-height: 100%; }
+  .admin-history-sidebar { max-height: 40dvh; min-height: 160px; border-right: 0; border-bottom: 1px solid var(--fm-border); }
+  .admin-detail { overflow: visible; }
+  .admin-header { gap: 8px; }
+  .admin-header label { font-size: 11px; }
+}