fix: ask in the page instead of native confirm/alert

A native confirm() or alert() leaves the desktop client unable to type
until the window is refocused. ask.js draws both in the page; the SPA
test now bans all three browser dialogs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 4 insertions, 3 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/admin-page.js b/packages/meshbay-hub/src/meshbay_hub/static/admin-page.js
index d5cc7a8..b3d71dd 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/admin-page.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/admin-page.js
@@ -2,6 +2,7 @@ import {
   html, useState, useEffect, useCallback,
 } from './vendor/htm-preact.js';
 import { t } from './i18n.js';
+import { ask, tell } from './ask.js';
 import { hubFetch } from './hub-client.js';
 import { GroupName } from './group-name.js';
 
@@ -129,12 +130,12 @@ export function AdminPage({ token, role }) {
   const deleteUser = useCallback(async (u) => {
     // Suspension is the reversible tool and stays one click away; this one is
     // not, so it names the account and says what it cannot reach.
-    if (!confirm(t('admin.delete_confirm', { user: u.username }))) return;
+    if (!await ask(t('admin.delete_confirm', { user: u.username }))) return;
     try {
       await hubFetch(`/v1/admin/users/${u.id}`, { method: 'DELETE', token });
       loadUsers(userSearch);
     } catch (err) {
-      alert(err.message);
+      tell(err.message);
     }
   }, [token, userSearch, loadUsers]);
 
@@ -157,7 +158,7 @@ export function AdminPage({ token, role }) {
     // Suspending is the reversible tool and stays one click away; revoking
     // pushes a signed revocation to every node hosting the group and there is
     // no undo from here, so it names the group and asks first.
-    if (!confirm(t('admin.revoke_group_confirm', { group: g.name }))) return;
+    if (!await ask(t('admin.revoke_group_confirm', { group: g.name }))) return;
     try {
       await hubFetch('/v1/admin/revoke',
         { method: 'POST', body: { target: 'group', target_id: g.id }, token });