Upload folder using huggingface_hub

TASKS.md

@@ -23,7 +23,7 @@ Legend:
 - [x] Landing + route split (`/` landing, `/login`, `/app`) and UI redirects updated.
 - [x] Split `static/dashboard.html` into JS/CSS files (`static/dashboard.js`, `static/dashboard.css`).
 - [x] Theme tokens shared across login + dashboard (single source of truth via `static/theme.css`).
-- [~] Separate Settings vs Admin dashboard (lightweight `/settings` and `/admin` entry pages; full dedicated pages pending).
+- [~] Separate Settings vs Admin dashboard (deep links + admin feature overrides done; full dedicated pages pending).
 
 ## P2 — Provider auth parity (Codex/Gemini/Claude)
 - [x] Codex auth file generation from env/secrets (`~/.codex/.auth.json` and `~/.codex/auth.json`).

app/feature_overrides.py

@@ -0,0 +1,78 @@
+from __future__ import annotations
+
+import json
+import threading
+import time
+from typing import Any
+
+from app.storage import global_data_dir
+
+_LOCK = threading.Lock()
+_CACHE_AT: float = 0.0
+_CACHE: dict[str, bool] = {}
+_TTL_SEC = 3.0
+_PATH = global_data_dir() / "feature-overrides.json"
+
+
+def load_feature_overrides() -> dict[str, bool]:
+    """
+    Loads persisted feature overrides (admin-managed).
+
+    Shape: {"version": 1, "overrides": {"terminal": true, "mcp": false, ...}}
+    """
+    global _CACHE_AT, _CACHE
+    now = time.monotonic()
+    if now - _CACHE_AT < _TTL_SEC:
+        return dict(_CACHE)
+
+    with _LOCK:
+        now = time.monotonic()
+        if now - _CACHE_AT < _TTL_SEC:
+            return dict(_CACHE)
+        path = _PATH
+        try:
+            data = json.loads(path.read_text(encoding="utf-8"))
+        except FileNotFoundError:
+            _CACHE = {}
+            _CACHE_AT = now
+            return {}
+        except Exception:
+            _CACHE_AT = now
+            return dict(_CACHE)
+
+        overrides = data.get("overrides") if isinstance(data, dict) else None
+        out: dict[str, bool] = {}
+        if isinstance(overrides, dict):
+            for k, v in overrides.items():
+                key = str(k).strip()
+                if not key:
+                    continue
+                if isinstance(v, bool):
+                    out[key] = v
+        _CACHE = out
+        _CACHE_AT = now
+        return dict(_CACHE)
+
+
+def save_feature_overrides(overrides: dict[str, Any]) -> dict[str, bool]:
+    """
+    Persists a partial or full overrides dict (values must be bool).
+    """
+    global _CACHE_AT, _CACHE
+    out: dict[str, bool] = {}
+    for k, v in (overrides or {}).items():
+        key = str(k).strip()
+        if not key:
+            continue
+        if isinstance(v, bool):
+            out[key] = v
+
+    payload = {"version": 1, "overrides": out}
+    path = _PATH
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps(payload, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
+
+    with _LOCK:
+        _CACHE = dict(out)
+        _CACHE_AT = time.monotonic()
+    return out

app/routes/admin.py

@@ -8,7 +8,9 @@ from fastapi import APIRouter, HTTPException, Request
 from pydantic import BaseModel
 
 from app.auth import require_user_from_request
+from app.feature_overrides import load_feature_overrides, save_feature_overrides
 from app.routes.user import _is_admin
+from app.settings import feature_enabled
 
 router = APIRouter()
 
@@ -74,3 +76,37 @@ async def put_mcp_templates(body: McpTemplates, http_request: Request):
         return {"ok": True, "count": len(templates)}
     except Exception as e:
         raise HTTPException(status_code=500, detail={"code": "internal_error", "message": str(e)}) from e
+
+
+class FeatureOverridesBody(BaseModel):
+    overrides: dict[str, bool]
+
+
+@router.get("/api/admin/features")
+async def get_feature_overrides(http_request: Request):
+    user = await require_user_from_request(http_request)
+    _require_admin(user)
+    overrides = load_feature_overrides()
+    features = ["terminal", "codex", "mcp", "indexing", "rooms"]
+    return {
+        "ok": True,
+        "features": {
+            f: {"enabled": feature_enabled(f), "override": overrides.get(f)}
+            for f in features
+        },
+        "overrides": overrides,
+    }
+
+
+@router.put("/api/admin/features")
+async def put_feature_overrides(body: FeatureOverridesBody, http_request: Request):
+    user = await require_user_from_request(http_request)
+    _require_admin(user)
+    allowed = {"terminal", "codex", "mcp", "indexing", "rooms"}
+    overrides = {}
+    for k, v in (body.overrides or {}).items():
+        key = str(k).strip()
+        if key in allowed and isinstance(v, bool):
+            overrides[key] = v
+    saved = save_feature_overrides(overrides)
+    return {"ok": True, "overrides": saved}

app/routes/rooms.py

@@ -200,12 +200,14 @@ async def websocket_rooms(websocket: WebSocket):
                 text = _limit_text(str(msg.get("text") or ""))
                 if not text:
                     continue
+                client_id = str(msg.get("clientId") or "").strip()
+                if not client_id or len(client_id) > 120:
+                    client_id = str(uuid.uuid4())
                 chat_msg = {
                     "type": "chat.message",
-                    "id": str(uuid.uuid4()),
+                    "id": client_id,
                     "roomId": room_id,
                     "ts": _now_iso(),
-                    "fromUserId": user_id,
                     "fromDeviceId": device_id,
                     "text": text,
                 }
@@ -244,4 +246,3 @@ async def websocket_rooms(websocket: WebSocket):
             if not peers:
                 websocket.app.state.rooms_connections.pop(room_id, None)
         await _broadcast(websocket.app, room_id, {"type": "presence.leave", "roomId": room_id, "deviceId": device_id})
-

app/settings.py

@@ -2,6 +2,8 @@ from __future__ import annotations
 
 import os
 
+from app.feature_overrides import load_feature_overrides
+
 
 def env_truthy(name: str, default: bool = False) -> bool:
     raw = os.environ.get(name)
@@ -15,12 +17,14 @@ def feature_enabled(feature: str) -> bool:
     Safety: when Supabase isn't configured, disable dangerous features by default.
     """
     has_supabase = bool(os.environ.get("SUPABASE_URL") and os.environ.get("SUPABASE_KEY"))
+    if not has_supabase:
+        return False
     defaults = {
-        "terminal": has_supabase,
-        "codex": has_supabase,
-        "mcp": has_supabase,
+        "terminal": True,
+        "codex": True,
+        "mcp": True,
         "indexing": False,
-        "rooms": has_supabase,
+        "rooms": True,
     }
     env_map = {
         "terminal": "ENABLE_TERMINAL",
@@ -31,4 +35,9 @@ def feature_enabled(feature: str) -> bool:
     }
     if feature not in env_map:
         return False
-    return env_truthy(env_map[feature], default=defaults[feature])
+
+    env_enabled = env_truthy(env_map[feature], default=defaults[feature])
+    overrides = load_feature_overrides()
+    if feature in overrides:
+        return bool(overrides[feature])
+    return env_enabled

docs/TROUBLESHOOTING.md

@@ -69,6 +69,8 @@ HF Spaces generally supports PTYs, but custom runtimes may not.
 
 Set `ENABLE_ROOMS=1` in your environment and restart the container.
 
+Admins can also toggle feature overrides from Settings → Admin.
+
 ## P2P isn’t connecting in Rooms
 
 The Rooms view uses WebRTC DataChannels (optional, behind “Prefer P2P”). Some networks block UDP/WebRTC.

static/dashboard.html

@@ -433,6 +433,43 @@
                             <div class="text-xs text-gray-400 mb-2">Read-only admin status and server feature flags.</div>
                             <div id="admin-status" class="text-sm text-gray-200">Loading...</div>
                             <div id="admin-features" class="mt-2 grid grid-cols-2 gap-2 text-xs text-gray-300"></div>
+                            <div class="mt-3 bg-gray-900/30 border border-gray-700 rounded-lg p-3 space-y-2">
+                                <div class="flex items-center justify-between gap-2">
+                                    <div class="text-xs font-semibold text-gray-300 uppercase">Feature Overrides</div>
+                                    <div class="flex gap-2">
+                                        <button onclick="loadAdminFeatureOverrides()"
+                                            class="bg-gray-700 hover:bg-gray-600 text-white px-2 py-1 rounded text-xs">Load</button>
+                                        <button onclick="saveAdminFeatureOverrides()"
+                                            class="bg-blue-600 hover:bg-blue-700 text-white px-2 py-1 rounded text-xs">Save</button>
+                                    </div>
+                                </div>
+                                <div class="text-xs text-gray-400">
+                                    Overrides are persisted server-side (requires admin). Useful for temporarily disabling high-risk features without a redeploy.
+                                </div>
+                                <div class="grid grid-cols-2 gap-2 text-xs text-gray-200">
+                                    <label class="flex items-center gap-2 bg-gray-800/40 border border-gray-700 rounded-lg px-3 py-2">
+                                        <input id="admin-override-terminal" type="checkbox" class="h-4 w-4 accent-blue-600">
+                                        Terminal
+                                    </label>
+                                    <label class="flex items-center gap-2 bg-gray-800/40 border border-gray-700 rounded-lg px-3 py-2">
+                                        <input id="admin-override-codex" type="checkbox" class="h-4 w-4 accent-blue-600">
+                                        Codex
+                                    </label>
+                                    <label class="flex items-center gap-2 bg-gray-800/40 border border-gray-700 rounded-lg px-3 py-2">
+                                        <input id="admin-override-mcp" type="checkbox" class="h-4 w-4 accent-blue-600">
+                                        MCP
+                                    </label>
+                                    <label class="flex items-center gap-2 bg-gray-800/40 border border-gray-700 rounded-lg px-3 py-2">
+                                        <input id="admin-override-indexing" type="checkbox" class="h-4 w-4 accent-blue-600">
+                                        Indexing
+                                    </label>
+                                    <label class="flex items-center gap-2 bg-gray-800/40 border border-gray-700 rounded-lg px-3 py-2">
+                                        <input id="admin-override-rooms" type="checkbox" class="h-4 w-4 accent-blue-600">
+                                        Rooms
+                                    </label>
+                                </div>
+                                <div id="admin-overrides-status" class="text-xs text-gray-500"></div>
+                            </div>
                             <div class="mt-3">
                                 <div class="text-xs font-semibold text-gray-400 mb-1 uppercase">MCP Templates (server)</div>
                                 <textarea id="admin-mcp-templates" rows="6"

static/dashboard.js

@@ -197,7 +197,10 @@ let supabase;
             const admin = document.getElementById('admin-panel');
             if (admin) admin.scrollIntoView({ block: 'nearest' });
             // Best-effort auto-load templates for admins.
-            setTimeout(() => loadAdminMcpTemplates(), 0);
+            setTimeout(() => {
+                loadAdminFeatureOverrides();
+                loadAdminMcpTemplates();
+            }, 0);
         }
 
         function closeSettings() {
@@ -767,6 +770,72 @@ let supabase;
             }
         }
 
+        function setAdminOverridesStatus(msg) {
+            const el = document.getElementById('admin-overrides-status');
+            if (el) el.textContent = msg || '';
+        }
+
+        function getAdminOverrideInputs() {
+            return {
+                terminal: document.getElementById('admin-override-terminal'),
+                codex: document.getElementById('admin-override-codex'),
+                mcp: document.getElementById('admin-override-mcp'),
+                indexing: document.getElementById('admin-override-indexing'),
+                rooms: document.getElementById('admin-override-rooms'),
+            };
+        }
+
+        async function loadAdminFeatureOverrides() {
+            const inputs = getAdminOverrideInputs();
+            if (!inputs.terminal) return;
+            try {
+                setAdminOverridesStatus('Loading…');
+                const res = await authFetch('/api/admin/features');
+                if (!res.ok) throw new Error(await res.text());
+                const data = await res.json();
+                const overrides = data?.overrides || {};
+                for (const key of Object.keys(inputs)) {
+                    const el = inputs[key];
+                    if (!el) continue;
+                    if (Object.prototype.hasOwnProperty.call(overrides, key)) {
+                        el.checked = !!overrides[key];
+                    } else {
+                        // If no override is set, fall back to effective state as the default UI value.
+                        el.checked = !!data?.features?.[key]?.enabled;
+                    }
+                }
+                setAdminOverridesStatus('Loaded.');
+            } catch (e) {
+                const msg = String(e?.message || e);
+                if (msg.includes('403')) return;
+                setAdminOverridesStatus(`Load failed: ${msg}`);
+            }
+        }
+
+        async function saveAdminFeatureOverrides() {
+            const inputs = getAdminOverrideInputs();
+            if (!inputs.terminal) return;
+            const overrides = {};
+            for (const key of Object.keys(inputs)) {
+                const el = inputs[key];
+                if (!el) continue;
+                overrides[key] = !!el.checked;
+            }
+            try {
+                setAdminOverridesStatus('Saving…');
+                const res = await authFetch('/api/admin/features', {
+                    method: 'PUT',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({ overrides }),
+                });
+                if (!res.ok) throw new Error(await res.text());
+                await res.json();
+                setAdminOverridesStatus('Saved.');
+            } catch (e) {
+                setAdminOverridesStatus(`Save failed: ${e?.message || e}`);
+            }
+        }
+
         async function refreshCodexMcpServers() {
             const out = document.getElementById('codex-mcp-list');
             if (out) out.textContent = 'Loading...';
@@ -3094,6 +3163,10 @@ let supabase;
         let roomsActiveRoomId = null;
         let roomsPeers = [];
         let roomsP2P = new Map(); // deviceId -> { pc, dc, polite, makingOffer, ignoreOffer }
+        let roomsMessageEls = new Map(); // messageId -> { el, statusEl }
+        let roomsReconnectAttempts = 0;
+        let roomsReconnectTimer = null;
+        let roomsWsClosing = false;
 
         function getDeviceId() {
             const key = 'device_id_v1';
@@ -3142,9 +3215,10 @@ let supabase;
             box.appendChild(div);
         }
 
-        function appendRoomMessage(msg) {
+        function appendRoomMessage(msg, { status = '' } = {}) {
             const box = document.getElementById('rooms-messages');
             if (!box) return;
+            const msgId = String(msg?.id || '').trim();
             const fromDevice = String(msg?.fromDeviceId || '').trim();
             const isMe = fromDevice && fromDevice === getDeviceId();
 
@@ -3156,15 +3230,22 @@ let supabase;
                 ? 'bg-blue-600/20 border-blue-500/30 text-gray-100'
                 : 'bg-gray-800/60 border-gray-700 text-gray-100'
                 }`;
+            if (msgId) bubble.dataset.messageId = msgId;
 
             const meta = document.createElement('div');
             meta.className = 'text-[11px] text-gray-400 mb-1 flex items-center justify-between gap-3';
             const who = document.createElement('span');
             who.textContent = isMe ? 'you' : (fromDevice ? fromDevice.slice(0, 8) : 'peer');
+            const right = document.createElement('span');
             const ts = document.createElement('span');
             ts.textContent = String(msg?.ts || '');
+            const st = document.createElement('span');
+            st.className = 'ml-2 text-gray-500';
+            st.textContent = status ? String(status) : '';
+            right.appendChild(ts);
+            right.appendChild(st);
             meta.appendChild(who);
-            meta.appendChild(ts);
+            meta.appendChild(right);
 
             const text = document.createElement('div');
             text.textContent = String(msg?.text || '');
@@ -3174,6 +3255,8 @@ let supabase;
             wrap.appendChild(bubble);
             box.appendChild(wrap);
             box.scrollTop = box.scrollHeight;
+            if (msgId) roomsMessageEls.set(msgId, { el: bubble, statusEl: st });
+            return bubble;
         }
 
         function renderRoomsList(rooms) {
@@ -3304,6 +3387,7 @@ let supabase;
 
         async function setActiveRoom(roomId, name) {
             roomsActiveRoomId = String(roomId || '').trim();
+            roomsMessageEls = new Map();
             updateRoomsHeader(roomsActiveRoomId, name || 'Room');
             renderRoomsMessagesEmpty('Loading…');
             await loadRoomsList();
@@ -3333,11 +3417,30 @@ let supabase;
         }
 
         function disconnectRoomsWs() {
+            roomsWsClosing = true;
             if (roomsWs) {
                 try { roomsWs.close(); } catch { }
                 roomsWs = null;
             }
+            if (roomsReconnectTimer) {
+                clearTimeout(roomsReconnectTimer);
+                roomsReconnectTimer = null;
+            }
             setRoomsConnStatus('Disconnected');
+            setTimeout(() => { roomsWsClosing = false; }, 250);
+        }
+
+        function scheduleRoomsReconnect() {
+            if (roomsReconnectTimer) return;
+            if (!roomsActiveRoomId) return;
+            roomsReconnectAttempts += 1;
+            if (roomsReconnectAttempts > 5) return;
+            const delay = Math.min(8000, 600 * roomsReconnectAttempts);
+            roomsReconnectTimer = setTimeout(() => {
+                roomsReconnectTimer = null;
+                connectRoomsWs().catch(() => { });
+            }, delay);
+            setRoomsConnStatus(`Reconnecting… (${roomsReconnectAttempts})`);
         }
 
         async function connectRoomsWs() {
@@ -3359,12 +3462,14 @@ let supabase;
             setRoomsConnStatus('Connecting…');
 
             roomsWs.onopen = () => {
+                roomsReconnectAttempts = 0;
                 setRoomsConnStatus('WS connected');
                 maybeStartRoomP2p();
             };
             roomsWs.onclose = () => {
                 setRoomsConnStatus('Disconnected');
                 closeAllRoomP2p();
+                if (!roomsWsClosing) scheduleRoomsReconnect();
             };
             roomsWs.onmessage = (event) => {
                 let msg;
@@ -3392,6 +3497,14 @@ let supabase;
                     return;
                 }
                 if (t === 'chat.message') {
+                    const msgId = String(msg?.id || '').trim();
+                    const fromDevice = String(msg?.fromDeviceId || '').trim();
+                    const isMe = fromDevice && fromDevice === getDeviceId();
+                    if (msgId && isMe && roomsMessageEls.has(msgId)) {
+                        const entry = roomsMessageEls.get(msgId);
+                        if (entry?.statusEl) entry.statusEl.textContent = 'delivered';
+                        return;
+                    }
                     appendRoomMessage(msg);
                     return;
                 }
@@ -3418,20 +3531,23 @@ let supabase;
                 const sent = sendRoomMessageViaP2p(text);
                 if (sent) return;
             }
-            sendRoomsWs({ type: 'chat.send', text });
+            const clientId = (crypto.randomUUID ? crypto.randomUUID() : String(Date.now())) + '-' + Math.random().toString(16).slice(2);
+            appendRoomMessage({ id: clientId, text, ts: new Date().toISOString(), fromDeviceId: getDeviceId() }, { status: 'sending' });
+            sendRoomsWs({ type: 'chat.send', text, clientId });
         }
 
         function sendRoomMessageViaP2p(text) {
+            const clientId = (crypto.randomUUID ? crypto.randomUUID() : String(Date.now())) + '-' + Math.random().toString(16).slice(2);
             let any = false;
             for (const entry of roomsP2P.values()) {
                 if (!entry?.dc || entry.dc.readyState !== 'open') continue;
                 try {
-                    entry.dc.send(JSON.stringify({ type: 'chat.message', text, ts: new Date().toISOString() }));
+                    entry.dc.send(JSON.stringify({ type: 'chat.message', id: clientId, text, ts: new Date().toISOString() }));
                     any = true;
                 } catch { }
             }
             if (any) {
-                appendRoomMessage({ text, ts: new Date().toISOString(), fromDeviceId: getDeviceId() });
+                appendRoomMessage({ id: clientId, text, ts: new Date().toISOString(), fromDeviceId: getDeviceId() }, { status: 'p2p' });
             }
             return any;
         }
@@ -3514,7 +3630,7 @@ let supabase;
                 let msg;
                 try { msg = JSON.parse(e.data); } catch { return; }
                 if (msg?.type === 'chat.message') {
-                    appendRoomMessage({ text: msg.text, ts: msg.ts, fromDeviceId: peerId });
+                    appendRoomMessage({ id: msg.id, text: msg.text, ts: msg.ts, fromDeviceId: peerId });
                 }
             };
             dc.onclose = () => {