wrapping everything is missing its closing tag.
+Structure should be:
+ ) : showBoardSurface ? (
+
<- opens here (line 6187)
+ {/* Left col */}
+
...
+ {/* Board col */}
+
...
+ {/* Right panel */}
+
+
+ {/* ELO Stakes */} ...
+ {/* Game Controls */} ...
+
+
<- needs to close here
+ ) : null}
+"""
+
+with open('src/App.tsx', 'r', encoding='utf-8') as f:
+ text = f.read()
+
+# The problem: the } that closes the showBoardSurface ternary reads:
+# {/* ELO Stakes */}
+# ...
+# ) : null}
+# But there are several unclosed divs because the right-panel closing div
+# from the old code was removed by the GamePanel patch.
+#
+# The new right panel structure (from GamePanel injection) ends with:
+# />
+# {/* ELO Stakes */}
+# (no closing
for the right panel wrapper div)
+# Then immediately: ) : null}
+#
+# Fix: after the GamePanel closing /> and ELO Stakes block, ensure we have:
+# <- closes the right panel column div
+# <- closes the outer showBoardSurface flex div
+# before ) : null}
+
+# Step 1: Find the right panel div opening
+# It opens with:
", rp_div_start) + 1
+ print(f"Right panel div: {repr(text[rp_div_start:rp_div_end][:80])}")
+else:
+ print("WARNING: Could not find right panel comment")
+
+# Step 2: Find the end of the showBoardSurface block
+# It ends with ) : null} somewhere before
+BS_END = " ) : null}\n "
+bs_pos = text.find(BS_END)
+if bs_pos == -1:
+ # Try alternate indentation
+ BS_END = " ) : null}\n "
+ bs_pos = text.rfind(") : null}")
+ if bs_pos != -1:
+ # Find the actual ) : null} before
+ appshell_close = text.find("", bs_pos)
+ print(f"Found ) : null}} at char {bs_pos}, at char {appshell_close}")
+ bs_end_line = text[max(0, bs_pos-100):bs_pos+20]
+ print(f"Context: {repr(bs_end_line)}")
+
+# Step 3: The actual fix - find the GamePanel closing /> followed by ELO Stakes
+# and ensure there are proper closing divs before ) : null}
+
+GAMEPANEL_END_MARKER = " />\n {/* ELO Stakes */}"
+gp_end = text.find(GAMEPANEL_END_MARKER)
+if gp_end == -1:
+ # Try with different spacing
+ GAMEPANEL_END_MARKER = "/>\n {/* ELO Stakes */}"
+ gp_end = text.rfind(GAMEPANEL_END_MARKER)
+
+if gp_end != -1:
+ print(f"Found GamePanel end marker at char {gp_end}")
+ # Show context around it
+ ctx = text[gp_end-100:gp_end+200]
+ print(f"Context: {repr(ctx[:300])}")
+else:
+ print("WARNING: Could not find GamePanel end marker")
+
+# Step 4: Find what comes between GamePanel close and ) : null}
+# We need to count what divs are open
+null_pos = text.rfind(") : null}")
+print(f"\n) : null}} at char {null_pos}")
+context_before_null = text[null_pos-500:null_pos+10]
+print(f"\nContext before ) : null}}:")
+for i, line in enumerate(context_before_null.split('\n')):
+ print(f" {i}: {repr(line)}")
diff --git a/apps/web/fix_app.py b/apps/web/fix_app.py
new file mode 100644
index 0000000..7223e0c
--- /dev/null
+++ b/apps/web/fix_app.py
@@ -0,0 +1,31 @@
+import sys
+
+with open('src/App.tsx', 'r', encoding='utf-8') as f:
+ lines = f.readlines()
+
+platform_import = "import { PlatformContext } from './contexts/PlatformContext';\n"
+router_import = "import { usePathname, useRouter } from 'next/navigation';\n"
+
+new_lines = []
+seen_platform_close = False
+injected_imports = False
+
+for i, line in enumerate(lines):
+ # Inject imports right after React import line
+ if not injected_imports and "import React from 'react';" in line:
+ new_lines.append(line)
+ new_lines.append(platform_import)
+ new_lines.append(router_import)
+ injected_imports = True
+ continue
+ # Skip duplicate closing Provider tag
+ if '' in line:
+ if seen_platform_close:
+ print(f'Skipping duplicate closing tag at line {i}')
+ continue
+ seen_platform_close = True
+ new_lines.append(line)
+
+with open('src/App.tsx', 'w', encoding='utf-8') as f:
+ f.writelines(new_lines)
+print(f'Done. Total lines: {len(new_lines)}')
diff --git a/apps/web/fix_app2.py b/apps/web/fix_app2.py
new file mode 100644
index 0000000..43b0f46
--- /dev/null
+++ b/apps/web/fix_app2.py
@@ -0,0 +1,178 @@
+"""
+Fix App.tsx:
+1. Ensure PlatformContext.Provider wraps the AppShell (and all content)
+2. Remove stray/duplicate PlatformContext.Provider from the previous bad injection
+3. Add useRouter / usePathname usage inside the App function
+4. Ensure children prop is typed properly
+"""
+
+with open('src/App.tsx', 'r', encoding='utf-8') as f:
+ content = f.read()
+
+# -----------------------------------------------------------------
+# Step 1: Find and remove the broken PlatformContext.Provider block
+# that was injected *before* AppShell (added by previous Python script)
+# It starts with: " \n" (then the \n \n
+# -----------------------------------------------------------------
+
+# Build the provider value string
+provider_value = ''' { void copyLiveMatchLink(matchId); },
+ }}>
+'''
+
+# Find the main return JSX starting point
+# It's: " return (\n <>\n
+# Current end:
+#
+# <- this was the duplicate we removed
+#
+#
+#
+# New end should be:
+#
+#
+#
+#
+# -----------------------------------------------------------------
+
+# The current (broken) end has right after
+# We need to move it to just before
+
+old_end = " \n \n \n \n );\n}"
+new_end = " \n \n \n \n );\n}"
+
+if old_end in content:
+ content = content.replace(old_end, new_end, 1)
+ print("Fixed PlatformContext.Provider closing position")
+else:
+ # Try alternate - maybe whitespace differs
+ print("WARNING: Could not find PlatformContext.Provider closing - checking manually")
+ # Find end of file
+ end_idx = content.rfind('')
+ appl_idx = content.rfind('')
+ div_idx = content.rfind('', end_idx)
+ print(f" at char {appl_idx}")
+ print(f" at char {end_idx}")
+ print(f" Last after at char {div_idx}")
+
+# -----------------------------------------------------------------
+# Step 4: Add useRouter/usePathname usage if missing
+# -----------------------------------------------------------------
+
+if 'const router = useRouter()' not in content and 'useRouter' in content:
+ # Inject after: " const [activePage, setActivePage] = React.useState('Play');"
+ old_state = " const [activePage, setActivePage] = React.useState('Play');"
+ new_state = """ const [activePage, setActivePage] = React.useState('Play');
+ const router = useRouter();
+ const pathname = usePathname();
+ React.useEffect(() => {
+ if (!pathname) return;
+ if (pathname === '/play' || pathname === '/') setActivePage('Play');
+ else if (pathname === '/watch') setActivePage('Watch');
+ else if (pathname === '/history') setActivePage('History');
+ else if (pathname === '/friends') setActivePage('Friends');
+ else if (pathname === '/inbox') setActivePage('Inbox');
+ else if (pathname === '/profiles') setActivePage('Profiles');
+ else if (pathname === '/cards') setActivePage('Cards');
+ else if (pathname === '/rankings') setActivePage('Rankings');
+ else if (pathname === '/community') setActivePage('Community');
+ else if (pathname === '/status') setActivePage('Status');
+ else if (pathname === '/account') setActivePage('Account');
+ else if (pathname === '/admin') setActivePage('Admin');
+ else if (pathname.startsWith('/match/')) setActivePage('Match');
+ }, [pathname]);"""
+ if old_state in content:
+ content = content.replace(old_state, new_state, 1)
+ print("Added useRouter/usePathname usage")
+
+# -----------------------------------------------------------------
+# Step 5: Fix children prop signature
+# -----------------------------------------------------------------
+old_sig = "export default function App({ runtimeConfig }: { runtimeConfig?: { matchServiceHttpBase?: string; matchServiceWsBase?: string } })"
+new_sig = "export default function App({ runtimeConfig, children }: { runtimeConfig?: { matchServiceHttpBase?: string; matchServiceWsBase?: string }, children?: React.ReactNode })"
+if old_sig in content:
+ content = content.replace(old_sig, new_sig, 1)
+ print("Fixed children prop signature")
+elif 'children' in content and 'export default function App(' in content:
+ print("children prop already present")
+
+# -----------------------------------------------------------------
+# Step 6: Fix children rendering
+# Replace "{showPlayHub ? (" with the conditional children version
+# -----------------------------------------------------------------
+old_render = " {showPlayHub ? ("
+new_render = " {(children && activePage !== 'Match') ? children : showPlayHub ? ("
+if old_render in content and new_render not in content:
+ content = content.replace(old_render, new_render, 1)
+ print("Fixed children rendering")
+elif new_render in content:
+ print("Children rendering already fixed")
+else:
+ print("WARNING: Could not fix children rendering")
+
+with open('src/App.tsx', 'w', encoding='utf-8') as f:
+ f.write(content)
+
+print(f"\nDone. Total chars: {len(content)}")
diff --git a/apps/web/next.config.mjs b/apps/web/next.config.mjs
index f536120..fb6addb 100644
--- a/apps/web/next.config.mjs
+++ b/apps/web/next.config.mjs
@@ -1,8 +1,34 @@
import path from 'node:path';
+const csp = [
+ "default-src 'self'",
+ "script-src 'self' 'unsafe-eval' 'unsafe-inline'",
+ "style-src 'self' 'unsafe-inline'",
+ "img-src 'self' data: blob:",
+ "font-src 'self' data:",
+ "connect-src 'self' ws: wss: https:",
+ "frame-ancestors 'none'",
+ "base-uri 'self'",
+ "form-action 'self'",
+].join('; ');
+
const nextConfig = {
transpilePackages: ['@chess404/contracts', '@chess404/game-core'],
- outputFileTracingRoot: path.join(process.cwd(), '../..')
+ outputFileTracingRoot: path.join(process.cwd(), '../..'),
+ async headers() {
+ return [
+ {
+ source: '/(.*)',
+ headers: [
+ { key: 'Content-Security-Policy', value: csp },
+ { key: 'X-Frame-Options', value: 'DENY' },
+ { key: 'X-Content-Type-Options', value: 'nosniff' },
+ { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
+ { key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' },
+ ],
+ },
+ ];
+ },
};
export default nextConfig;
diff --git a/apps/web/package.json b/apps/web/package.json
index 09d76db..3eb0771 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -6,7 +6,7 @@
"dev": "next dev",
"build": "next build",
"start": "next start",
- "lint": "next typegen && tsc -p tsconfig.json --noEmit",
+ "lint": "node ./scripts/lint-types.mjs",
"test": "npm run lint"
},
"dependencies": {
diff --git a/apps/web/patch_app.py b/apps/web/patch_app.py
new file mode 100644
index 0000000..121fdb7
--- /dev/null
+++ b/apps/web/patch_app.py
@@ -0,0 +1,273 @@
+"""
+Atomic patch for App.tsx:
+1. Add imports: PlatformContext, useRouter, usePathname, PlayerBar, GamePanel, MatchLayout, CardHand
+2. Add children prop to App signature
+3. Add useRouter / usePathname bridge effect after activePage state
+4. Wrap entire return JSX in PlatformContext.Provider
+5. Replace renderPlayerCard body with component
+6. Swap Move-History+Engine column + Chat column for
+7. Inject children-aware render logic
+"""
+
+import re
+
+SRC = "src/App.tsx"
+
+with open(SRC, "r", encoding="utf-8") as f:
+ text = f.read()
+
+# ── PATCH 1: Add imports after "import React from 'react';" ─────────────────
+NEW_IMPORTS = """\
+import { PlatformContext } from './contexts/PlatformContext';
+import { usePathname, useRouter } from 'next/navigation';
+import { PlayerBar } from './components/match/PlayerBar';
+import { GamePanel } from './components/match/GamePanel';
+"""
+text = text.replace(
+ "import React from 'react';",
+ "import React from 'react';\n" + NEW_IMPORTS,
+ 1,
+)
+
+# ── PATCH 2: Add `children` prop to App function signature ───────────────────
+text = text.replace(
+ "export default function App({ runtimeConfig }: { runtimeConfig?: { matchServiceHttpBase?: string; matchServiceWsBase?: string } })",
+ "export default function App({ runtimeConfig, children }: { runtimeConfig?: { matchServiceHttpBase?: string; matchServiceWsBase?: string }, children?: React.ReactNode })",
+ 1,
+)
+
+# ── PATCH 3: Add router bridge after activePage useState ────────────────────
+ROUTER_BRIDGE = """
+ // App Router pathname → activePage bridge
+ const router = useRouter();
+ const pathname = usePathname();
+ React.useEffect(() => {
+ if (!pathname) return;
+ if (pathname === '/' || pathname === '/play') setActivePage('Play');
+ else if (pathname === '/watch') setActivePage('Watch');
+ else if (pathname === '/history') setActivePage('History');
+ else if (pathname === '/friends') setActivePage('Friends');
+ else if (pathname === '/inbox') setActivePage('Inbox');
+ else if (pathname === '/profiles') setActivePage('Profiles');
+ else if (pathname === '/cards') setActivePage('Cards');
+ else if (pathname === '/rankings') setActivePage('Rankings');
+ else if (pathname === '/community') setActivePage('Community');
+ else if (pathname === '/status') setActivePage('Status');
+ else if (pathname === '/account') setActivePage('Account');
+ else if (pathname === '/admin') setActivePage('Admin');
+ else if (pathname.startsWith('/match/')) setActivePage('Match');
+ }, [pathname]);
+"""
+text = text.replace(
+ " const [activePage, setActivePage] = React.useState('Play');",
+ " const [activePage, setActivePage] = React.useState('Play');" + ROUTER_BRIDGE,
+ 1,
+)
+
+# ── PATCH 4: Replace renderPlayerCard body with ────────────────
+OLD_RENDER_PC = """\
+ return (
+
Last seen: {formatDateTime(activeAccount.lastSeenAt)}
+
+
+
+
+
+ )}
+
+ {activeAccount && (
+
+
+
+
Active sessions
+
+ This account can now stay signed in on multiple devices. The current seat keeps one active session token, and you can revoke any of the others here.
+
- No season summary exists yet because this account has not completed an account-owned rated result.
+ No season summary exists yet for the selected official mode because this account has not completed an account-owned rated result there.
+ Create a full reusable account directly, or add sign-in credentials to a handle you already claimed on this seat.
+
+
+
+
+
+
+ {!accountSession && (
+
+ This path creates the account immediately and signs this seat in, while still bridging through the seat guest identity underneath.
+
+ )}
+
+
+
+
+
+
Email verification
+
+ Verified email is the gate for real recovery. Requests now queue into a durable account email outbox so verification and reset actions survive across sessions and devices.
+
+ Use a handle or email. Successful sign-in also restores the playable guest identity for this seat.
+
+
+
+
+
+
+ {accountSession && (
+
+ )}
+
+
+
Password reset preview
+
+ Verified accounts can request a reset token. If preview mode is enabled, the token also appears here so recovery can still be tested locally while the real delivery pipeline runs.
+
+
+
+
+ {resetPreview?.previewToken && (
+
+
Preview account: {resetPreview.previewAccountId}
+
Preview token: {resetPreview.previewToken}
+ {resetPreview.expiresAt &&
Expires {formatDateTime(resetPreview.expiresAt)}
}
+
+ )}
+
+
+
+
+
+
+
+
+
+
+
+
Recent auth emails
+
+ This durable auth outbox tracks verification and password-reset delivery activity, including queued, delivered, retrying, and failed messages. You can still load the action link directly into this page or copy it for another device.
+
+
+ {emailOutboxLoading ? (
+
Loading account email activity...
+ ) : emailOutboxError ? (
+
{emailOutboxError}
+ ) : !accountSession ? (
+
+ Sign in on this seat to inspect the durable auth outbox for this account.
+
- This is the first real account slice on top of guest identity. Each seat can claim a reusable handle and keep a renewable local account session without changing the live match flow yet.
+ Chess404 still bridges through seat guest identity for live play, but this page now supports direct account creation, cross-device sign-in, verification, and recovery so the platform can move toward real account-first onboarding without breaking hosted matches.
+ This review queue turns player reports into a real launch-grade moderation workflow. Admins can triage reports, move them into review, resolve them with action or dismissal, and apply real suspensions or bans when needed.
+
+
+
+ {!canManage ? (
+
+ Sign in with an account session on this device to load the moderation admin queue.
+
+ ) : (
+ <>
+
+
+
+ {overview?.viewer?.handle ? (
+
+ Signed in as @{overview.viewer.handle}
+
+ ) : null}
+
+
+ {error ? (
+
+ {error}
+
+ ) : null}
+
+
+
+
+
+
Report queue
+
+ Reports here are authoritative backend records, not browser-only flags.
+