## emiCRM — Copilot / AI agent instructions

This file gives focused, actionable context for AI coding agents working in this repository. Keep suggestions small, explicit and tied to files referenced below.

- Project type: small procedural PHP app served with XAMPP (no framework).
- Run locally: place repo under your Apache htdocs (example path in this workspace: `/Applications/XAMPP/xamppfiles/htdocs/emicrm`) and open http://localhost/emicrm/ in a browser.

Key places to look (examples):

- Authentication and entry points:
  - `login.php` (session-based auth; redirects to `/panel` on success)
  - `index.html` (simple login form pointing to `login.php`)

- Database and data model:
  - `config/db.php` — mysqli connection used across the app (included via relative paths). Tables referenced: `usuarios`, `prospectos`, `tareas`, `email_templates`, etc.
  - SQL is written inline in files (prepared statements are used in many places — follow that pattern).

- UI / dashboard:
  - `panel/index_chatgpt.php` — example dashboard with KPI queries, Charts (Chart.js) and server-side data -> JS embedding.
  - Frontend uses Bootstrap 5 and Chart.js via CDN.

- Services / integrations:
  - `servicios/ia_conversacion.php` — calls external GenAI (Gemini) via cURL. NOTE: API key is currently hard-coded; replace with environment/config secrets before production.
  - `servicios/get_template_content.php` — returns email template HTML from `email_templates` table.
  - `comunicaciones/enviar_correo.php` — PHPMailer integration (check `vendor/phpmailer/phpmailer`).

Project-specific conventions and patterns

- Flat, folder-per-feature layout (no MVC framework). URL paths map directly to filesystem paths (e.g., `/panel`, `/prospectos`, `/tareas`).
- DB connection is a single mysqli instance in `config/db.php` included with `require_once` or `include_once` from scripts. Do not open new persistent DB connections—reuse `config/db.php` when possible.
- Prepared statements are commonly used. When adding queries, mirror existing style: prepare -> bind_param -> execute -> get_result()/fetch_assoc() -> close.
- Session-based auth: pages check `$_SESSION['loggedin']` and redirect to `login.php` if not set (see `panel/index_chatgpt.php`). Maintain this check when adding protected pages.
- JSON endpoints set `Content-Type: application/json` and return small JSON objects with `status` keys (see `servicios/*`). Follow same shape for new endpoints.

Security & secrets

- Secrets in repo: `servicios/ia_conversacion.php` contains an inline API key. Treat this as a TODO to move to environment variables or a protected config file. When changing, update all files that reference GEMINI_API_KEY/GEMINI_API_URL.
- Passwords/credentials: `config/db.php` currently includes plaintext credentials for local dev. For prod-like changes, prefer using environment variables and avoid committing secrets.

Developer workflows and debugging

- Local dev server: XAMPP (Apache + MySQL + PHP). Typical dev flow:
  - Start XAMPP and ensure Apache + MySQL running.
  - Place project under `htdocs` and visit `http://localhost/emicrm/`.
- PHP errors: some files (e.g., `login.php`) enable `display_errors` for dev. Use `php.ini` or per-file `ini_set` for debugging but avoid leaving this on in production.
- No automated tests or build steps are present. Use manual testing in the browser and simple PHP scripts to validate DB queries.

Cross-component notes

- Many UI pages embed PHP-generated JSON arrays directly into JS (see `panel/index_chatgpt.php` charts). When modifying data shapes, update both PHP and embedded JS sections.
- Email templates are stored in DB and fetched by `servicios/get_template_content.php`. Email sending uses PHPMailer in `comunicaciones/enviar_correo.php`.

What to do first as an AI contributor

1. Avoid touching secrets: flag any inline API keys or passwords and suggest moving them to env or `config/` with a clear migration step.
2. When adding endpoints, copy the response shape and session checks from existing `servicios/*` files.
3. For SQL, follow the prepared-statement pattern used in `panel/index_chatgpt.php` and `servicios/get_template_content.php`.
4. For UI work, use the existing Bootstrap classes and Chart.js usage as examples (no build step required).

Files of interest to reference in PRs or suggestions:
- `config/db.php` — DB connection
- `login.php` — auth onboarding
- `panel/index_chatgpt.php` — canonical dashboard + DB query patterns
- `servicios/ia_conversacion.php` — AI integration and cURL example
- `servicios/get_template_content.php` — JSON endpoint example
- `comunicaciones/enviar_correo.php` — PHPMailer usage

If something is missing or a secret is required to run a feature, ask the human: "Do you want me to move X key into an `.env` or into `config/secret.php`?" and propose the minimal code change.

Questions for the maintainer

- Preferred secret storage pattern (env, config file, or leave inline for dev)?
- Any staging server URL or API keys we can use for integration testing?

---
Update requested: Review these instructions and tell me if you want them shorter, translated to English, or to include a short checklist for safe PRs (e.g., "no secrets in code, DB migration notes").
