From e081d986ef0562cb9983fd1d8ff189bc0c13c975 Mon Sep 17 00:00:00 2001
From: Agando <roduccomm@gmail.com>
Date: Mon, 2 Nov 2026 22:18:09 +0100
Subject: refactor(dashboard): one dashboard — port billing/API keys, 301 the
 duplicate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two dashboards existed and had drifted apart: root /dashboard.html (118 KB single file with
Subscription & Usage + API Keys) and /spaces/dashboard.html (34 KB shell + assets/js/dashboard-*.js).
The nginx log settles which one is real: 77.211.5.129 requests /spaces/dashboard.html and never
the root page. Tonight's fixes landed on the root page twice before that was noticed.

Neither page was a superset, so deleting outright would have lost features:
  root only      -> Subscription & Usage card, API Keys card (create/revoke/reveal)
  spaces only    -> 2FA/TOTP, change password, delete space, email change, files, logs

assets/js/dashboard-billing.js + assets/css/dashboard-billing.css (new)
  loadSubscription / loadApiKeys / cancelSubscription / createApiKey / revokeApiKey /
  copyNewApiKey / dismissNewKey + isProPlusPlan / capPlan, lifted verbatim from the root page,
  wrapped in an IIFE that re-exports the onclick handlers on window; getAuthHeaders() reads the
  modular app's localStorage.webx11_session_id; PRO_PLUS_PLANS carried over (its absence threw
  "PRO_PLUS_PLANS is not defined" and silently hid both cards on the first attempt)

spaces/dashboard.html
  the two cards inserted after the Activity Logs card, plus the css/js includes
  dashboard-auth.js showDashboard() calls loadSubscription() once the view is up

retirement
  root dashboard.html deleted (git rm); `location = /dashboard.html { return 301
  /spaces/dashboard.html$is_args$args; }` so bookmarks keep working and ?next= survives
  links repointed in ai-api.html (6), ai-course.html (3), models.html (1), newOS4 hint string
  (v4.6.146 + rebuilt bundles so the cached bundle cannot serve the old URL)

Measured (playwright, 390x844 WebView UA, agando's real session):
  subscriptionCard display block, height 315px, plan "Free", price "EUR0/mo", badge "Free",
  usage "$0.00 / inf", API-keys card hidden for a free plan, 0 console warnings
  /dashboard.html?next=/skills.html -> 301 -> /spaces/dashboard.html?next=/skills.html, 200,
  login card + Telegram button present
---
 main.html                      | 6 +++---
 modules/core/core-bundle.js    | 2 +-
 modules/core/module-loader.js  | 2 +-
 modules/core/ollama-manager.js | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/main.html b/main.html
index 1491a7a..12eb7ec 100644
--- a/main.html
+++ b/main.html
@@ -1349,13 +1349,13 @@
     </script>
 
     <!-- v4.5.63: A2A scratchpad fixes + agent-register arg fix -->
-<script src="modules/core/core-bundle.js?v=v4.6.145"></script>
+<script src="modules/core/core-bundle.js?v=v4.6.146"></script>
 
     <!-- Async dependency-ordered module loader now only initializes terminal and loads optional ext modules -->
-<script src="modules/core/module-loader.js?v=v4.6.145"></script>
+<script src="modules/core/module-loader.js?v=v4.6.146"></script>
 
     <!-- Critical ext bundle loads AFTER webx11 exists so registerModule calls work -->
-<script src="modules/ext/critical-ext-bundle.js?v=v4.6.145"></script>
+<script src="modules/ext/critical-ext-bundle.js?v=v4.6.146"></script>
 
 <script>
 // ═══ ONE TRUE VERSION SOURCE ═══
diff --git a/modules/core/core-bundle.js b/modules/core/core-bundle.js
index 6a37d61..8b6e4cb 100644
--- a/modules/core/core-bundle.js
+++ b/modules/core/core-bundle.js
@@ -1319,7 +1319,7 @@ class OllamaManager {
             document.cookie = 'webx11_session=; path=/; max-age=0';
         } catch (e) {}
         this.terminal.print('🔒 Your login session is no longer valid on the server. ' +
-            'Open https://webx11.duckdns.org/dashboard.html , sign in with Telegram ' +
+            'Open https://webx11.duckdns.org/spaces/dashboard.html , sign in with Telegram ' +
             '(or “Sign in with a code”), then reload this page.', 'warning');
     }
 
diff --git a/modules/core/module-loader.js b/modules/core/module-loader.js
index ffa691e..c9162d0 100644
--- a/modules/core/module-loader.js
+++ b/modules/core/module-loader.js
@@ -4,7 +4,7 @@
     // Core module bundle loaded synchronously in main.html.
     // This loader only handles version cache-busting, splash, terminal init, and optional ext modules.
 
-    const LATEST_VER = 'v4.6.145';
+    const LATEST_VER = 'v4.6.146';
     const CACHE = '?v=' + LATEST_VER;
     // Exposed so ext modules can register their own URL with the same cache-busting version
     // instead of an unversioned path the browser may already have cached (shell.js did).
diff --git a/modules/core/ollama-manager.js b/modules/core/ollama-manager.js
index 5684210..9d8da9f 100644
--- a/modules/core/ollama-manager.js
+++ b/modules/core/ollama-manager.js
@@ -39,7 +39,7 @@ class OllamaManager {
             document.cookie = 'webx11_session=; path=/; max-age=0';
         } catch (e) {}
         this.terminal.print('🔒 Your login session is no longer valid on the server. ' +
-            'Open https://webx11.duckdns.org/dashboard.html , sign in with Telegram ' +
+            'Open https://webx11.duckdns.org/spaces/dashboard.html , sign in with Telegram ' +
             '(or “Sign in with a code”), then reload this page.', 'warning');
     }
 
-- 
cgit v1.2.3