@rubytech/create-maxy-code 0.1.100 → 0.1.102

package/payload/server/server.js

@@ -598,9 +598,9 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync20, existsSync as existsSync22, watchFile } from "fs";
-import { resolve as resolve23, join as join13, basename as basename5 } from "path";
-import { homedir as homedir4 } from "os";
+import { readFileSync as readFileSync21, existsSync as existsSync23, watchFile } from "fs";
+import { resolve as resolve23, join as join14, basename as basename5 } from "path";
+import { homedir as homedir5 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
 // app/lib/agent-slug-pattern.ts
@@ -7056,12 +7056,53 @@ app10.get("/", (c) => {
 });
 var claude_info_default = app10;
 
+// server/routes/admin/claude-capabilities.ts
+import { existsSync as existsSync11, readFileSync as readFileSync12 } from "fs";
+import { dirname as dirname2, join as join10 } from "path";
+import { homedir as homedir2 } from "os";
+var app11 = new Hono();
+function resolveClaudeJsonPath() {
+  const configDir2 = process.env.CLAUDE_CONFIG_DIR ?? join10(homedir2(), ".claude");
+  return join10(dirname2(configDir2), ".claude.json");
+}
+function readSeatTier(path2) {
+  if (!existsSync11(path2)) return null;
+  let raw;
+  try {
+    raw = readFileSync12(path2, "utf8");
+  } catch {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  const oauth = parsed.oauthAccount;
+  if (!oauth || typeof oauth !== "object" || Array.isArray(oauth)) return null;
+  const seatTier = oauth.seatTier;
+  if (typeof seatTier !== "string") return null;
+  return seatTier;
+}
+app11.get("/", (c) => {
+  const path2 = resolveClaudeJsonPath();
+  const seatTier = readSeatTier(path2);
+  const body = {
+    seatTier,
+    autoModeAvailable: typeof seatTier === "string" && seatTier.length > 0
+  };
+  return c.json(body);
+});
+var claude_capabilities_default = app11;
+
 // server/routes/admin/attachment.ts
 import { readFile as readFile3, readdir } from "fs/promises";
-import { existsSync as existsSync11 } from "fs";
+import { existsSync as existsSync12 } from "fs";
 import { resolve as resolve9 } from "path";
-var app11 = new Hono();
-app11.get("/:attachmentId", requireAdminSession, async (c) => {
+var app12 = new Hono();
+app12.get("/:attachmentId", requireAdminSession, async (c) => {
   const attachmentId = c.req.param("attachmentId");
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
@@ -7072,11 +7113,11 @@ app11.get("/:attachmentId", requireAdminSession, async (c) => {
     return new Response("Not found", { status: 404 });
   }
   const dir = resolve9(ATTACHMENTS_ROOT, accountId, attachmentId);
-  if (!existsSync11(dir)) {
+  if (!existsSync12(dir)) {
     return new Response("Not found", { status: 404 });
   }
   const metaPath = resolve9(dir, `${attachmentId}.meta.json`);
-  if (!existsSync11(metaPath)) {
+  if (!existsSync12(metaPath)) {
     return new Response("Not found", { status: 404 });
   }
   let meta;
@@ -7100,17 +7141,17 @@ app11.get("/:attachmentId", requireAdminSession, async (c) => {
     }
   });
 });
-var attachment_default = app11;
+var attachment_default = app12;
 
 // server/routes/admin/agents.ts
 import { resolve as resolve10 } from "path";
-import { readdirSync as readdirSync6, readFileSync as readFileSync12, existsSync as existsSync12, rmSync } from "fs";
-var app12 = new Hono();
-app12.get("/", (c) => {
+import { readdirSync as readdirSync6, readFileSync as readFileSync13, existsSync as existsSync13, rmSync } from "fs";
+var app13 = new Hono();
+app13.get("/", (c) => {
   const account = resolveAccount();
   if (!account) return c.json({ agents: [] });
   const agentsDir = resolve10(account.accountDir, "agents");
-  if (!existsSync12(agentsDir)) return c.json({ agents: [] });
+  if (!existsSync13(agentsDir)) return c.json({ agents: [] });
   const agents = [];
   try {
     const entries = readdirSync6(agentsDir, { withFileTypes: true });
@@ -7118,9 +7159,9 @@ app12.get("/", (c) => {
       if (!entry.isDirectory()) continue;
       if (entry.name === "admin") continue;
       const configPath2 = resolve10(agentsDir, entry.name, "config.json");
-      if (!existsSync12(configPath2)) continue;
+      if (!existsSync13(configPath2)) continue;
       try {
-        const config = JSON.parse(readFileSync12(configPath2, "utf-8"));
+        const config = JSON.parse(readFileSync13(configPath2, "utf-8"));
         agents.push({
           slug: entry.name,
           displayName: config.displayName ?? entry.name,
@@ -7136,7 +7177,7 @@ app12.get("/", (c) => {
   }
   return c.json({ agents });
 });
-app12.delete("/:slug", async (c) => {
+app13.delete("/:slug", async (c) => {
   const slug = c.req.param("slug");
   const account = resolveAccount();
   if (!account) return c.json({ error: "No account resolved" }, 400);
@@ -7147,7 +7188,7 @@ app12.delete("/:slug", async (c) => {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
   const agentDir = resolve10(account.accountDir, "agents", slug);
-  if (!existsSync12(agentDir)) {
+  if (!existsSync13(agentDir)) {
     return c.json({ error: "Agent not found" }, 404);
   }
   try {
@@ -7166,7 +7207,7 @@ app12.delete("/:slug", async (c) => {
     return c.json({ error: "Failed to delete agent" }, 500);
   }
 });
-app12.post("/:slug/project", async (c) => {
+app13.post("/:slug/project", async (c) => {
   const slug = c.req.param("slug");
   const account = resolveAccount();
   if (!account) return c.json({ error: "No account resolved" }, 400);
@@ -7177,7 +7218,7 @@ app12.post("/:slug/project", async (c) => {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
   const agentDir = resolve10(account.accountDir, "agents", slug);
-  if (!existsSync12(agentDir)) {
+  if (!existsSync13(agentDir)) {
     return c.json({ error: "Agent not found on disk" }, 404);
   }
   try {
@@ -7188,12 +7229,12 @@ app12.post("/:slug/project", async (c) => {
     return c.json({ error: `Projection failed: ${msg}` }, 500);
   }
 });
-var agents_default = app12;
+var agents_default = app13;
 
 // server/routes/admin/sessions.ts
 import crypto from "crypto";
 import { resolve as resolvePath } from "path";
-import { existsSync as existsSync13, mkdirSync as mkdirSync3, createWriteStream } from "fs";
+import { existsSync as existsSync14, mkdirSync as mkdirSync3, createWriteStream } from "fs";
 
 // ../lib/admin-conversation-purge/src/index.ts
 async function purgeAdminConversationJsonls(args) {
@@ -7331,7 +7372,7 @@ var replayJsonl = (..._args) => null;
 var resolveJsonlPath = (..._args) => null;
 
 // server/routes/admin/sessions.ts
-import { homedir as homedir2 } from "os";
+import { homedir as homedir3 } from "os";
 
 // app/lib/claude-agent/component-attachment.ts
 var pickComponentBytes = (..._args) => null;
@@ -7371,7 +7412,7 @@ function validateAndShapeAttachments(raws, conversationAccountId, conversationId
     let reason = null;
     if (!a.attachmentId || !a.filename || !a.mimeType || !a.storagePath) reason = "schema-fail";
     else if (a.accountId !== conversationAccountId) reason = "account-mismatch";
-    else if (!existsSync13(a.storagePath)) reason = "missing-file";
+    else if (!existsSync14(a.storagePath)) reason = "missing-file";
     if (reason) {
       invalid++;
       try {
@@ -7478,8 +7519,8 @@ function formatAge(updatedAtStr) {
     return "unknown";
   }
 }
-var app13 = new Hono();
-app13.get("/", requireAdminSession, async (c) => {
+var app14 = new Hono();
+app14.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) return c.json({ error: "Account not found for session" }, 401);
@@ -7509,7 +7550,7 @@ app13.get("/", requireAdminSession, async (c) => {
     return c.json({ error: "Failed to fetch sessions" }, 500);
   }
 });
-app13.post("/new", requireAdminSession, async (c) => {
+app14.post("/new", requireAdminSession, async (c) => {
   const oldCacheKey = c.var.cacheKey;
   console.log(`[admin-chat] new-conversation outcome=ingress cacheKey=${oldCacheKey.slice(0, 8)}`);
   const accountId = getAccountIdForSession(oldCacheKey);
@@ -7526,7 +7567,7 @@ app13.post("/new", requireAdminSession, async (c) => {
   console.log(`[admin-chat] new-conversation outcome=ok oldKey=${oldCacheKey.slice(0, 8)} newKey=${newCacheKey.slice(0, 8)}`);
   return c.json({ session_key: newSignedSessionToken, conversationId: null });
 });
-app13.post("/switch", requireAdminSession, async (c) => {
+app14.post("/switch", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   const userId = getUserIdForSession(cacheKey);
@@ -7554,7 +7595,7 @@ app13.post("/switch", requireAdminSession, async (c) => {
   console.log(`[session-switch] from=${cacheKey.slice(0, 8)} to=${targetCacheKey.slice(0, 8)} targetConvId=${targetConversationId?.slice(0, 8) ?? "none"} accountId=${accountId.slice(0, 8)}`);
   return c.json({ session_key: targetSignedSessionToken, conversationId: targetConversationId });
 });
-app13.delete("/:id", requireAdminSession, async (c) => {
+app14.delete("/:id", requireAdminSession, async (c) => {
   const conversationId = c.req.param("id");
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
@@ -7600,7 +7641,7 @@ app13.delete("/:id", requireAdminSession, async (c) => {
     500
   );
 });
-app13.post("/:id/resume", async (c) => {
+app14.post("/:id/resume", async (c) => {
   const conversationId = c.req.param("id");
   const t0 = Date.now();
   const signedSessionToken = c.req.query("session_key") ?? "";
@@ -7665,7 +7706,7 @@ app13.post("/:id/resume", async (c) => {
     return c.json({ error: "Failed to load conversation messages" }, 500);
   }
   if (persistedAgentSessionId) {
-    const jsonlPath = resolveJsonlPath(homedir2(), resolvePath(ACCOUNTS_DIR, accountId), persistedAgentSessionId);
+    const jsonlPath = resolveJsonlPath(homedir3(), resolvePath(ACCOUNTS_DIR, accountId), persistedAgentSessionId);
     const replay = replayJsonl(jsonlPath);
     jsonlMissing = replay.jsonlMissing;
     jsonlMalformedLines = replay.malformedLines;
@@ -7873,7 +7914,7 @@ app13.post("/:id/resume", async (c) => {
     }
   });
 });
-app13.put("/:id/label", requireAdminSession, async (c) => {
+app14.put("/:id/label", requireAdminSession, async (c) => {
   const conversationId = c.req.param("id");
   const cacheKey = c.var.cacheKey;
   let body;
@@ -7899,11 +7940,11 @@ app13.put("/:id/label", requireAdminSession, async (c) => {
     return c.json({ error: "Failed to rename session" }, 500);
   }
 });
-var sessions_default = app13;
+var sessions_default = app14;
 
 // app/lib/claude-agent/spawn-context.ts
-import { existsSync as existsSync14, readFileSync as readFileSync13, readdirSync as readdirSync7, statSync as statSync6 } from "fs";
-import { dirname as dirname2, resolve as resolve11, join as join10 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync14, readdirSync as readdirSync7, statSync as statSync6 } from "fs";
+import { dirname as dirname3, resolve as resolve11, join as join11 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
   try {
@@ -7932,14 +7973,14 @@ function frontmatterField(manifest, field) {
 function extractPluginToolDescriptions(pluginDir) {
   const out = /* @__PURE__ */ new Map();
   const candidates = [
-    join10(pluginDir, "mcp/dist/index.js"),
-    join10(pluginDir, "mcp/src/index.ts")
+    join11(pluginDir, "mcp/dist/index.js"),
+    join11(pluginDir, "mcp/src/index.ts")
   ];
   let raw = null;
   for (const path2 of candidates) {
-    if (!existsSync14(path2)) continue;
+    if (!existsSync15(path2)) continue;
     try {
-      raw = readFileSync13(path2, "utf-8");
+      raw = readFileSync14(path2, "utf-8");
       break;
     } catch {
     }
@@ -7989,23 +8030,23 @@ function parseSkillPathsFromFrontmatter(fm) {
 function listPluginDirs() {
   const out = /* @__PURE__ */ new Map();
   const platformPlugins = resolve11(PLATFORM_ROOT, "plugins");
-  if (existsSync14(platformPlugins)) {
+  if (existsSync15(platformPlugins)) {
     for (const name of readdirSync7(platformPlugins)) {
-      const dir = join10(platformPlugins, name);
+      const dir = join11(platformPlugins, name);
       try {
         if (statSync6(dir).isDirectory()) out.set(name, dir);
       } catch {
       }
     }
   }
-  const premiumRoot = resolve11(dirname2(PLATFORM_ROOT), "premium-plugins");
-  if (existsSync14(premiumRoot)) {
+  const premiumRoot = resolve11(dirname3(PLATFORM_ROOT), "premium-plugins");
+  if (existsSync15(premiumRoot)) {
     for (const bundle of readdirSync7(premiumRoot)) {
-      const bundlePlugins = join10(premiumRoot, bundle, "plugins");
-      if (!existsSync14(bundlePlugins)) continue;
+      const bundlePlugins = join11(premiumRoot, bundle, "plugins");
+      if (!existsSync15(bundlePlugins)) continue;
       try {
         for (const name of readdirSync7(bundlePlugins)) {
-          const dir = join10(bundlePlugins, name);
+          const dir = join11(bundlePlugins, name);
           try {
             if (statSync6(dir).isDirectory()) out.set(name, dir);
           } catch {
@@ -8019,9 +8060,9 @@ function listPluginDirs() {
 }
 function readEnabledPlugins(accountId) {
   const accountFile = resolve11(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync14(accountFile)) return /* @__PURE__ */ new Set();
+  if (!existsSync15(accountFile)) return /* @__PURE__ */ new Set();
   try {
-    const parsed = JSON.parse(readFileSync13(accountFile, "utf-8"));
+    const parsed = JSON.parse(readFileSync14(accountFile, "utf-8"));
     return new Set(
       Array.isArray(parsed.enabledPlugins) ? parsed.enabledPlugins.filter((p) => typeof p === "string") : []
     );
@@ -8030,10 +8071,10 @@ function readEnabledPlugins(accountId) {
   }
 }
 function readFrontmatter(path2) {
-  if (!existsSync14(path2)) return null;
+  if (!existsSync15(path2)) return null;
   let raw;
   try {
-    raw = readFileSync13(path2, "utf-8");
+    raw = readFileSync14(path2, "utf-8");
   } catch {
     return null;
   }
@@ -8048,7 +8089,7 @@ function computeActivePlugins(accountId) {
   for (const name of Array.from(enabled).sort()) {
     const dir = pluginDirs.get(name);
     if (!dir) continue;
-    const fm = readFrontmatter(join10(dir, "PLUGIN.md"));
+    const fm = readFrontmatter(join11(dir, "PLUGIN.md"));
     if (!fm) continue;
     const description = frontmatterField(`---
 ${fm}
@@ -8065,7 +8106,7 @@ ${fm}
       `plugin-manifest-tool-coverage plugin=${name} tools=${tools.length} with-desc=${withDesc}`
     );
     if (toolNames.length > 0 && descMap.size === 0) {
-      const hasSource = existsSync14(join10(dir, "mcp/dist/index.js")) || existsSync14(join10(dir, "mcp/src/index.ts"));
+      const hasSource = existsSync15(join11(dir, "mcp/dist/index.js")) || existsSync15(join11(dir, "mcp/src/index.ts"));
       if (hasSource) {
         console.warn(
           `[spawn-context] WARN plugin=${name} mcp source present but tool-description regex matched zero entries \u2014 SDK upgrade may have changed the registration shape`
@@ -8075,7 +8116,7 @@ ${fm}
     const skillPaths = parseSkillPathsFromFrontmatter(fm);
     const skills = [];
     for (const relPath2 of skillPaths) {
-      const skillPath = join10(dir, relPath2);
+      const skillPath = join11(dir, relPath2);
       const skillFm = readFrontmatter(skillPath);
       if (!skillFm) continue;
       const skillName = frontmatterField(`---
@@ -8092,7 +8133,7 @@ ${skillFm}
 }
 function computeSpecialistDomains(accountId) {
   const specialistsDir = resolve11(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
-  if (!existsSync14(specialistsDir)) return [];
+  if (!existsSync15(specialistsDir)) return [];
   let entries;
   try {
     entries = readdirSync7(specialistsDir);
@@ -8119,7 +8160,7 @@ function computeSpecialistDomains(accountId) {
   const out = [];
   for (const file of entries.sort()) {
     if (!file.endsWith(".md")) continue;
-    const fm = readFrontmatter(join10(specialistsDir, file));
+    const fm = readFrontmatter(join11(specialistsDir, file));
     if (!fm) continue;
     const wrapped = `---
 ${fm}
@@ -8138,10 +8179,10 @@ ${fm}
 }
 function computeDormantPlugins(accountId) {
   const accountFile = resolve11(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync14(accountFile)) return [];
+  if (!existsSync15(accountFile)) return [];
   let enabled;
   try {
-    const raw = readFileSync13(accountFile, "utf-8");
+    const raw = readFileSync14(accountFile, "utf-8");
     const parsed = JSON.parse(raw);
     enabled = new Set(
       Array.isArray(parsed.enabledPlugins) ? parsed.enabledPlugins.filter((p) => typeof p === "string") : []
@@ -8153,7 +8194,7 @@ function computeDormantPlugins(accountId) {
     return [];
   }
   const pluginsDir = resolve11(PLATFORM_ROOT, "plugins");
-  if (!existsSync14(pluginsDir)) return [];
+  if (!existsSync15(pluginsDir)) return [];
   let entries;
   try {
     entries = readdirSync7(pluginsDir);
@@ -8164,10 +8205,10 @@ function computeDormantPlugins(accountId) {
   for (const name of entries) {
     if (enabled.has(name)) continue;
     const manifestPath = resolve11(pluginsDir, name, "PLUGIN.md");
-    if (!existsSync14(manifestPath)) continue;
+    if (!existsSync15(manifestPath)) continue;
     let manifest;
     try {
-      manifest = readFileSync13(manifestPath, "utf-8");
+      manifest = readFileSync14(manifestPath, "utf-8");
     } catch {
       continue;
     }
@@ -8180,13 +8221,13 @@ function computeDormantPlugins(accountId) {
 }
 
 // server/routes/admin/claude-sessions.ts
-import { readFileSync as readFileSync14 } from "fs";
+import { readFileSync as readFileSync15 } from "fs";
 import { resolve as resolve12 } from "path";
 function resolveTunnelUrl() {
   const platformRoot = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve12(process.cwd(), "..");
   let brand;
   try {
-    brand = JSON.parse(readFileSync14(resolve12(platformRoot, "config", "brand.json"), "utf-8"));
+    brand = JSON.parse(readFileSync15(resolve12(platformRoot, "config", "brand.json"), "utf-8"));
   } catch {
     return null;
   }
@@ -8202,7 +8243,7 @@ function managerBase2() {
   const port2 = requirePortEnv("CLAUDE_SESSION_MANAGER_PORT", { tag: "claude-session-manager:wrapper" });
   return `http://127.0.0.1:${port2}`;
 }
-var app14 = new Hono();
+var app15 = new Hono();
 var UUID_PATTERN = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 async function performSpawnWithInitialMessage(args) {
   const ownerStart = Date.now();
@@ -8284,8 +8325,8 @@ var requireAdminSessionUnlessLoopbackSpawn = async (c, next) => {
   }
   return requireAdminSession(c, next);
 };
-app14.use("*", requireAdminSessionUnlessLoopbackSpawn);
-app14.post("/", async (c) => {
+app15.use("*", requireAdminSessionUnlessLoopbackSpawn);
+app15.post("/", async (c) => {
   const routeStart = Date.now();
   const cacheKey = c.get("cacheKey") ?? "";
   let body = {};
@@ -8348,7 +8389,7 @@ app14.post("/", async (c) => {
   console.log(`${TAG18} route-done surface=${authSurface} status=${response.status} route-ms=${Date.now() - routeStart}`);
   return response;
 });
-app14.get("/events", async (c) => {
+app15.get("/events", async (c) => {
   const upstream = await fetch(`${managerBase2()}/events`, {
     headers: { accept: "text/event-stream" }
   }).catch((err) => {
@@ -8366,7 +8407,7 @@ app14.get("/events", async (c) => {
     }
   });
 });
-app14.get("/", async (c) => {
+app15.get("/", async (c) => {
   const cacheKey = c.get("cacheKey") ?? "";
   const senderId = getAccountIdForSession(cacheKey) ?? "";
   if (!senderId) return c.json({ error: "admin-account-not-resolved" }, 500);
@@ -8379,7 +8420,7 @@ app14.get("/", async (c) => {
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
   return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
 });
-app14.post("/resume", async (c) => {
+app15.post("/resume", async (c) => {
   const cacheKey = c.get("cacheKey") ?? "";
   const senderId = getAccountIdForSession(cacheKey) ?? "";
   if (!senderId) return c.json({ error: "admin-account-not-resolved" }, 500);
@@ -8441,7 +8482,7 @@ app14.post("/resume", async (c) => {
   );
   return new Response(bodyText, { status: upstream.status, headers: upstream.headers });
 });
-app14.post("/:sessionId/stop", async (c) => {
+app15.post("/:sessionId/stop", async (c) => {
   const sessionId = c.req.param("sessionId");
   const upstream = await fetch(
     `${managerBase2()}/${encodeURIComponent(sessionId)}/stop`,
@@ -8453,7 +8494,7 @@ app14.post("/:sessionId/stop", async (c) => {
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
   return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
 });
-app14.post("/:sessionId/rename", async (c) => {
+app15.post("/:sessionId/rename", async (c) => {
   const sessionId = c.req.param("sessionId");
   const body = await c.req.text();
   const upstream = await fetch(
@@ -8470,7 +8511,7 @@ app14.post("/:sessionId/rename", async (c) => {
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
   return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
 });
-app14.delete("/:sessionId", async (c) => {
+app15.delete("/:sessionId", async (c) => {
   const sessionId = c.req.param("sessionId");
   const cacheKey = c.get("cacheKey") ?? "";
   const accountId = getAccountIdForSession(cacheKey) ?? "";
@@ -8533,7 +8574,7 @@ app14.delete("/:sessionId", async (c) => {
     500
   );
 });
-app14.post("/:sessionId/archive", async (c) => {
+app15.post("/:sessionId/archive", async (c) => {
   const sessionId = c.req.param("sessionId");
   const body = await c.req.text();
   const upstream = await fetch(
@@ -8550,19 +8591,7 @@ app14.post("/:sessionId/archive", async (c) => {
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
   return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
 });
-app14.post("/:sessionId/promote", async (c) => {
-  const sessionId = c.req.param("sessionId");
-  const upstream = await fetch(
-    `${managerBase2()}/${encodeURIComponent(sessionId)}/promote`,
-    { method: "POST" }
-  ).catch((err) => {
-    console.error(`${TAG18} fetch-failed op=promote message=${err instanceof Error ? err.message : String(err)}`);
-    return null;
-  });
-  if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
-  return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
-});
-app14.get("/:sessionId/meta", async (c) => {
+app15.get("/:sessionId/meta", async (c) => {
   const sessionId = c.req.param("sessionId");
   const upstream = await fetch(
     `${managerBase2()}/${encodeURIComponent(sessionId)}/meta`
@@ -8573,7 +8602,7 @@ app14.get("/:sessionId/meta", async (c) => {
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
   return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
 });
-app14.post("/:sessionId/input", async (c) => {
+app15.post("/:sessionId/input", async (c) => {
   const sessionId = c.req.param("sessionId");
   const rawBody = await c.req.text();
   const upstream = await fetch(
@@ -8590,7 +8619,7 @@ app14.post("/:sessionId/input", async (c) => {
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
   return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
 });
-app14.get("/:sessionId/log", async (c) => {
+app15.get("/:sessionId/log", async (c) => {
   const sessionId = c.req.param("sessionId");
   const search = new URLSearchParams();
   if (c.req.query("follow") === "1") search.set("follow", "1");
@@ -8605,18 +8634,18 @@ app14.get("/:sessionId/log", async (c) => {
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
   return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
 });
-var claude_sessions_default = app14;
+var claude_sessions_default = app15;
 
 // server/routes/admin/log-ingest.ts
 var TAG19 = "[log-ingest]";
 var TAG_PATTERN = /^[A-Za-z0-9_:-]{1,32}$/;
 var LEVELS = /* @__PURE__ */ new Set(["debug", "info", "warn", "error"]);
 var MAX_LINE_BYTES = 4096;
-var app15 = new Hono();
+var app16 = new Hono();
 function isLoopbackAddr(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-app15.post("/", async (c) => {
+app16.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr(remoteAddr)) {
     console.error(`${TAG19} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -8659,11 +8688,11 @@ app15.post("/", async (c) => {
   else console.log(formatted);
   return c.json({ ok: true }, 200);
 });
-var log_ingest_default = app15;
+var log_ingest_default = app16;
 
 // server/routes/admin/browser.ts
-var app16 = new Hono();
-app16.post("/launch", async (c) => {
+var app17 = new Hono();
+app17.post("/launch", async (c) => {
   try {
     const transport = resolveBrowserTransport(c.req.raw, c.env?.incoming?.socket?.remoteAddress);
     if (transport === "vnc") {
@@ -8685,7 +8714,7 @@ app16.post("/launch", async (c) => {
     );
   }
 });
-var browser_default = app16;
+var browser_default = app17;
 
 // server/routes/admin/browser-iframe.ts
 var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
@@ -8702,8 +8731,8 @@ function asString(v, max = 500) {
 function asNumber(v) {
   return typeof v === "number" && Number.isFinite(v) ? v : void 0;
 }
-var app17 = new Hono();
-app17.post("/event", async (c) => {
+var app18 = new Hono();
+app18.post("/event", async (c) => {
   let body = {};
   try {
     body = await c.req.json();
@@ -8724,7 +8753,7 @@ app17.post("/event", async (c) => {
   });
   return c.body(null, 204);
 });
-var browser_iframe_default = app17;
+var browser_iframe_default = app18;
 
 // app/lib/cdp-client.ts
 var CDP_HOST = "127.0.0.1";
@@ -8767,8 +8796,8 @@ async function cdpNavigateNewTab(url, opts = {}) {
 }
 
 // server/routes/admin/device-browser.ts
-var app18 = new Hono();
-app18.post("/navigate", async (c) => {
+var app19 = new Hono();
+app19.post("/navigate", async (c) => {
   const TAG22 = "[device-url:click]";
   let body;
   try {
@@ -8855,7 +8884,7 @@ app18.post("/navigate", async (c) => {
     targetId: outcome.targetId
   });
 });
-var device_browser_default = app18;
+var device_browser_default = app19;
 
 // server/routes/admin/events.ts
 var ALLOWED_EVENTS2 = /* @__PURE__ */ new Set([
@@ -8864,8 +8893,8 @@ var ALLOWED_EVENTS2 = /* @__PURE__ */ new Set([
   "device-url:vnc-surface-shown",
   "device-url:malformed"
 ]);
-var app19 = new Hono();
-app19.post("/", async (c) => {
+var app20 = new Hono();
+app20.post("/", async (c) => {
   const TAG22 = "[admin:events]";
   let body;
   try {
@@ -8896,12 +8925,12 @@ app19.post("/", async (c) => {
   console.error(`[${event}] ${formatted}`);
   return c.json({ ok: true });
 });
-var events_default = app19;
+var events_default = app20;
 
 // server/routes/admin/cloudflare.ts
-import { homedir as homedir3 } from "os";
+import { homedir as homedir4 } from "os";
 import { resolve as resolve14 } from "path";
-import { readFileSync as readFileSync16 } from "fs";
+import { readFileSync as readFileSync17 } from "fs";
 
 // app/lib/dns-label.ts
 var VALID_LABEL = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -8917,14 +8946,14 @@ function isValidDomain(value) {
 }
 
 // app/lib/alias-domains.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync4, readFileSync as readFileSync15, writeFileSync as writeFileSync7 } from "fs";
-import { dirname as dirname3 } from "path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync4, readFileSync as readFileSync16, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname4 } from "path";
 import { resolve as resolve13 } from "path";
 var ALIAS_DOMAINS_PATH = resolve13(MAXY_DIR, "alias-domains.json");
 function readExisting() {
-  if (!existsSync15(ALIAS_DOMAINS_PATH)) return /* @__PURE__ */ new Set();
+  if (!existsSync16(ALIAS_DOMAINS_PATH)) return /* @__PURE__ */ new Set();
   try {
-    const parsed = JSON.parse(readFileSync15(ALIAS_DOMAINS_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync16(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) return /* @__PURE__ */ new Set();
     return new Set(parsed.filter((h) => typeof h === "string"));
   } catch {
@@ -8935,14 +8964,14 @@ function addAliasDomain(hostname2) {
   const existing = readExisting();
   if (existing.has(hostname2)) return;
   existing.add(hostname2);
-  mkdirSync4(dirname3(ALIAS_DOMAINS_PATH), { recursive: true });
+  mkdirSync4(dirname4(ALIAS_DOMAINS_PATH), { recursive: true });
   writeFileSync7(ALIAS_DOMAINS_PATH, JSON.stringify([...existing], null, 2) + "\n", "utf-8");
 }
 
 // app/lib/script-stream-tailer.ts
 import * as childProcess from "child_process";
 import { appendFileSync as appendFileSync2, createReadStream as createReadStream2, mkdirSync as mkdirSync5, statSync as statSync7 } from "fs";
-import { dirname as dirname4 } from "path";
+import { dirname as dirname5 } from "path";
 import { StringDecoder } from "string_decoder";
 var SCRIPT_STREAM_RE = /^\[([^\]]+)\] \[script:([a-z][a-z0-9-]*)((?::[a-z0-9:_-]+)?)\] (.*)$/;
 function parseLine(line) {
@@ -9051,7 +9080,7 @@ function writeRouteMilestone(streamLogPath, scope, line) {
   }
   const ts = (/* @__PURE__ */ new Date()).toISOString();
   try {
-    mkdirSync5(dirname4(streamLogPath), { recursive: true });
+    mkdirSync5(dirname5(streamLogPath), { recursive: true });
     appendFileSync2(streamLogPath, `[${ts}] [script:${scope}] ${line}
 `);
   } catch (err) {
@@ -9252,7 +9281,7 @@ function loadBrandInfo() {
   const platformRoot = process.env.MAXY_PLATFORM_ROOT ?? resolve14(process.cwd(), "..");
   const brandPath = resolve14(platformRoot, "config", "brand.json");
   try {
-    const parsed = JSON.parse(readFileSync16(brandPath, "utf-8"));
+    const parsed = JSON.parse(readFileSync17(brandPath, "utf-8"));
     const hostname2 = typeof parsed.hostname === "string" && parsed.hostname ? parsed.hostname : "maxy";
     const configDir2 = typeof parsed.configDir === "string" && parsed.configDir ? parsed.configDir : ".maxy";
     return { hostname: hostname2, configDir: configDir2 };
@@ -9315,7 +9344,7 @@ function validateBody(body) {
   }
   return null;
 }
-var app20 = new Hono();
+var app21 = new Hono();
 function fieldFromReason(reason) {
   switch (reason) {
     case "not-signed-in":
@@ -9336,7 +9365,7 @@ function fieldFromReason(reason) {
       return "script";
   }
 }
-app20.get("/domains", requireAdminSession, async (c) => {
+app21.get("/domains", requireAdminSession, async (c) => {
   const started = Date.now();
   const cacheKey = c.var.cacheKey;
   let correlationId;
@@ -9380,7 +9409,7 @@ app20.get("/domains", requireAdminSession, async (c) => {
   streamLogPath = cloudflareStreamLogPath(accountId, correlationId);
   log(`phase=stream-log-resolved path=${streamLogPath}`);
   const brand = loadBrandInfo();
-  const scriptPath = resolve14(homedir3(), "list-cf-domains.sh");
+  const scriptPath = resolve14(homedir4(), "list-cf-domains.sh");
   const result = await runFormSpawn({
     scriptPath,
     args: [brand.hostname],
@@ -9432,7 +9461,7 @@ ${result.stderr}` : ""}`;
   return c.json(success, 200);
 });
 var TUNNELS_TIMEOUT_MS = 30 * 1e3;
-app20.get("/tunnels", requireAdminSession, async (c) => {
+app21.get("/tunnels", requireAdminSession, async (c) => {
   const started = Date.now();
   const cacheKey = c.var.cacheKey;
   let correlationId;
@@ -9471,9 +9500,9 @@ app20.get("/tunnels", requireAdminSession, async (c) => {
   if (!accountId) return err("session", "No account bound to session \u2014 refresh chat.");
   if (!correlationId) return err("session", "No active conversation for session \u2014 refresh chat.");
   streamLogPath = cloudflareStreamLogPath(accountId, correlationId);
-  const certPath = resolve14(homedir3(), brand.configDir, "cloudflared", "cert.pem");
-  const { existsSync: existsSync23 } = await import("fs");
-  if (!existsSync23(certPath)) {
+  const certPath = resolve14(homedir4(), brand.configDir, "cloudflared", "cert.pem");
+  const { existsSync: existsSync24 } = await import("fs");
+  if (!existsSync24(certPath)) {
     return err("cert", `Cloudflare origin certificate is not on disk yet (${certPath}). Complete the Cloudflare login first by submitting the form once \u2014 the OAuth flow writes cert.pem.`);
   }
   const result = await runFormSpawn({
@@ -9529,7 +9558,7 @@ ${result.stderr}` : ""}`;
   const success = { ok: true, tunnels, defaultName, correlationId, streamLogPath };
   return c.json(success, 200);
 });
-app20.post("/setup", requireAdminSession, async (c) => {
+app21.post("/setup", requireAdminSession, async (c) => {
   const started = Date.now();
   const cacheKey = c.var.cacheKey;
   let correlationId;
@@ -9787,13 +9816,13 @@ actionId: ${actionId}`,
   };
   return ok(success);
 });
-var cloudflare_default = app20;
+var cloudflare_default = app21;
 
 // server/routes/admin/files.ts
 import { createReadStream as createReadStream3 } from "fs";
 import { readdir as readdir2, readFile as readFile4, stat as stat4, mkdir as mkdir3, writeFile as writeFile4, unlink as unlink2 } from "fs/promises";
 import { realpathSync as realpathSync4 } from "fs";
-import { basename as basename4, dirname as dirname5, join as join11, resolve as resolve16, sep as sep3 } from "path";
+import { basename as basename4, dirname as dirname6, join as join12, resolve as resolve16, sep as sep3 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // app/lib/data-path.ts
@@ -10150,7 +10179,7 @@ async function cascadeDeleteDocument(params) {
 var UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function readMeta(absDir, baseName) {
   try {
-    const raw = await readFile4(join11(absDir, `${baseName}.meta.json`), "utf8");
+    const raw = await readFile4(join12(absDir, `${baseName}.meta.json`), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.filename === "string") {
       return { filename: parsed.filename, mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0 };
@@ -10188,7 +10217,7 @@ async function readAccountNames() {
 }
 async function enrich(absolute, entry, accountNames) {
   if (entry.kind === "directory" && UUID_RE3.test(entry.name)) {
-    const meta = await readMeta(join11(absolute, entry.name), entry.name);
+    const meta = await readMeta(join12(absolute, entry.name), entry.name);
     if (meta?.filename) {
       entry.displayName = meta.filename;
       entry.mimeType = meta.mimeType;
@@ -10219,8 +10248,8 @@ function buildDisplayPath(relPath2, accountNames) {
     return dn ? { name: seg, displayName: dn } : { name: seg };
   });
 }
-var app21 = new Hono();
-app21.get("/", requireAdminSession, async (c) => {
+var app22 = new Hono();
+app22.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   if (!getAccountIdForSession(cacheKey)) {
     console.error(`[data] auth-rejected endpoint="/api/admin/files" reason="no account for session"`);
@@ -10247,7 +10276,7 @@ app21.get("/", requireAdminSession, async (c) => {
         continue;
       }
       try {
-        const entryPath = join11(absolute, name);
+        const entryPath = join12(absolute, name);
         const s = await stat4(entryPath);
         entries.push({
           name,
@@ -10281,7 +10310,7 @@ app21.get("/", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-app21.get("/download", requireAdminSession, async (c) => {
+app22.get("/download", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   if (!getAccountIdForSession(cacheKey)) {
     console.error(`[data] auth-rejected endpoint="/api/admin/files/download" reason="no account for session"`);
@@ -10329,7 +10358,7 @@ app21.get("/download", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-app21.post("/upload", requireAdminSession, async (c) => {
+app22.post("/upload", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -10387,7 +10416,7 @@ app21.post("/upload", requireAdminSession, async (c) => {
     mimeType: file.type
   });
 });
-app21.delete("/", requireAdminSession, async (c) => {
+app22.delete("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -10420,7 +10449,7 @@ app21.delete("/", requireAdminSession, async (c) => {
     }
     const dot = base.lastIndexOf(".");
     const stem = dot === -1 ? base : base.slice(0, dot);
-    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join11(dirname5(absolute), `${stem}.meta.json`) : null;
+    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join12(dirname6(absolute), `${stem}.meta.json`) : null;
     await unlink2(absolute);
     if (sidecarPath) {
       try {
@@ -10454,7 +10483,7 @@ app21.delete("/", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-var files_default = app21;
+var files_default = app22;
 
 // ../lib/graph-search/src/index.ts
 var import_dist = __toESM(require_dist());
@@ -10834,8 +10863,8 @@ var MAX_LIMIT = 2e3;
 var DEFAULT_VECTOR_THRESHOLD = 0.82;
 var MESSAGE_FAMILY_LABELS = ["Message", "UserMessage", "AssistantMessage", "WhatsAppMessage"];
 var CONVERSATION_PARENT_LABELS = /* @__PURE__ */ new Set(["AdminConversation", "PublicConversation"]);
-var app22 = new Hono();
-app22.get("/", requireAdminSession, async (c) => {
+var app23 = new Hono();
+app23.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const q = (c.req.query("q") ?? "").trim();
   const rawLimit = c.req.query("limit");
@@ -10966,7 +10995,7 @@ app22.get("/", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-var graph_search_default = app22;
+var graph_search_default = app23;
 
 // server/routes/admin/graph-subgraph.ts
 import neo4j from "neo4j-driver";
@@ -11120,8 +11149,8 @@ var STRIPPED_PROPERTIES = /* @__PURE__ */ new Set([
   "otpCode",
   "cacheKey"
 ]);
-var app23 = new Hono();
-app23.get("/", requireAdminSession, async (c) => {
+var app24 = new Hono();
+app24.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -11704,12 +11733,12 @@ function pruneNode(node, warnedClasses, conversationWarnings) {
   }
   return trashed ? { id: node.id, labels, properties, trashed: true } : { id: node.id, labels, properties };
 }
-var graph_subgraph_default = app23;
+var graph_subgraph_default = app24;
 
 // server/routes/admin/graph-delete.ts
 var ALLOWED_BY = ["graph-page", "graph-drag-trash", "graph-side-panel-trash"];
-var app24 = new Hono();
-app24.post("/", requireAdminSession, async (c) => {
+var app25 = new Hono();
+app25.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -11872,11 +11901,11 @@ app24.post("/", requireAdminSession, async (c) => {
     }
   }
 });
-var graph_delete_default = app24;
+var graph_delete_default = app25;
 
 // server/routes/admin/graph-restore.ts
-var app25 = new Hono();
-app25.post("/", requireAdminSession, async (c) => {
+var app26 = new Hono();
+app26.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -11940,11 +11969,11 @@ app25.post("/", requireAdminSession, async (c) => {
     }
   }
 });
-var graph_restore_default = app25;
+var graph_restore_default = app26;
 
 // server/routes/admin/graph-labels-in-graph.ts
-var app26 = new Hono();
-app26.get("/", requireAdminSession, async (c) => {
+var app27 = new Hono();
+app27.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -12010,11 +12039,11 @@ var LABELS_IN_GRAPH_CYPHER = `
        sum(halfEdges) AS relDegree
   RETURN label, nodeCount, relDegree
 `;
-var graph_labels_in_graph_default = app26;
+var graph_labels_in_graph_default = app27;
 
 // server/routes/admin/graph-default-view.ts
-var app27 = new Hono();
-app27.get("/", requireAdminSession, async (c) => {
+var app28 = new Hono();
+app28.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   const userId = getUserIdForSession(cacheKey);
@@ -12052,7 +12081,7 @@ app27.get("/", requireAdminSession, async (c) => {
     }
   }
 });
-app27.put("/", requireAdminSession, async (c) => {
+app28.put("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   const userId = getUserIdForSession(cacheKey);
@@ -12141,13 +12170,13 @@ var WRITE_CYPHER = `
       p.updatedAt = $updatedAt
   RETURN p.labels AS labels
 `;
-var graph_default_view_default = app27;
+var graph_default_view_default = app28;
 
 // server/routes/admin/session-defaults.ts
-var app28 = new Hono();
+var app29 = new Hono();
 var MODE_OPTIONS = ["default", "acceptEdits", "plan", "auto", "bypassPermissions"];
 var MODEL_OPTIONS = ["claude-opus-4-7", "claude-sonnet-4-6", "claude-haiku-4-5"];
-app28.get("/", requireAdminSession, async (c) => {
+app29.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   const userId = getUserIdForSession(cacheKey);
@@ -12185,7 +12214,7 @@ app28.get("/", requireAdminSession, async (c) => {
     }
   }
 });
-app28.put("/", requireAdminSession, async (c) => {
+app29.put("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   const userId = getUserIdForSession(cacheKey);
@@ -12269,11 +12298,11 @@ var WRITE_CYPHER2 = `
       p.updatedAt = $updatedAt
   RETURN p.permissionMode AS permissionMode
 `;
-var session_defaults_default = app28;
+var session_defaults_default = app29;
 
 // server/routes/admin/file-attach.ts
-var app29 = new Hono();
-app29.post("/", async (c) => {
+var app30 = new Hono();
+app30.post("/", async (c) => {
   try {
     const body = await c.req.json();
     const { filePath, accountId } = body;
@@ -12296,18 +12325,18 @@ app29.post("/", async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-var file_attach_default = app29;
+var file_attach_default = app30;
 
 // server/routes/admin/sidebar-artefacts.ts
 import neo4j2 from "neo4j-driver";
 import { readFile as readFile5, readdir as readdir3, stat as stat5 } from "fs/promises";
 import { resolve as resolve17, relative as relative2, isAbsolute } from "path";
-import { existsSync as existsSync16 } from "fs";
+import { existsSync as existsSync17 } from "fs";
 var LIMIT = 50;
 var TEXT_MIME_PREFIXES = ["text/", "application/json", "application/markdown"];
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
-var app30 = new Hono();
-app30.get("/", requireAdminSession, async (c) => {
+var app31 = new Hono();
+app31.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -12450,7 +12479,7 @@ async function fetchAgentTemplateRows(accountDir) {
 async function unionSpecialistFilenames(overrideDir, bundledDir) {
   const names = /* @__PURE__ */ new Set();
   for (const dir of [overrideDir, bundledDir]) {
-    if (!existsSync16(dir)) continue;
+    if (!existsSync17(dir)) continue;
     try {
       const entries = await readdir3(dir);
       for (const entry of entries) {
@@ -12465,7 +12494,7 @@ async function unionSpecialistFilenames(overrideDir, bundledDir) {
 }
 async function readAgentTemplateRow(inp) {
   let chosenPath = null;
-  if (existsSync16(inp.overridePath)) {
+  if (existsSync17(inp.overridePath)) {
     try {
       validateFilePathInAccount(inp.overridePath, inp.overrideRoot);
       chosenPath = inp.overridePath;
@@ -12476,7 +12505,7 @@ async function readAgentTemplateRow(inp) {
       );
       return null;
     }
-  } else if (existsSync16(inp.bundledPath)) {
+  } else if (existsSync17(inp.bundledPath)) {
     if (!isWithin(inp.bundledPath, inp.bundledRoot)) {
       console.error(
         `[admin/sidebar-artefacts] agent-template-read-failed agent=${inp.displayName} kind=${inp.logName} error="bundled path outside PLATFORM_ROOT"`
@@ -12513,16 +12542,16 @@ function isWithin(target, root) {
   const rel = relative2(root, target);
   return !rel.startsWith("..") && !isAbsolute(rel);
 }
-var sidebar_artefacts_default = app30;
+var sidebar_artefacts_default = app31;
 
 // server/routes/admin/sidebar-artefact-save.ts
 import { mkdir as mkdir4, readdir as readdir4, stat as stat6, writeFile as writeFile5 } from "fs/promises";
 import { resolve as resolve18 } from "path";
-import { existsSync as existsSync17 } from "fs";
+import { existsSync as existsSync18 } from "fs";
 var ADMIN_AGENT_FILES2 = /* @__PURE__ */ new Set(["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"]);
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-var app31 = new Hono();
-app31.post("/", requireAdminSession, async (c) => {
+var app32 = new Hono();
+app32.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) return c.json({ error: "Account not found for session" }, 401);
@@ -12586,7 +12615,7 @@ async function resolveSavePath(id, accountId, accountDir) {
   }
   if (UUID_RE4.test(id)) {
     const dir = resolve18(ATTACHMENTS_ROOT, accountId, id);
-    if (!existsSync17(dir)) {
+    if (!existsSync18(dir)) {
       const attShort = id.slice(0, 8);
       if (isHealPending(accountId, id)) {
         console.error(`[admin/sidebar-artefact-save] heal-race attachmentId=${attShort} outcome=503-retry source=heal-pending`);
@@ -12634,15 +12663,15 @@ async function resolveSavePath(id, accountId, accountDir) {
 function relPath(absPath, root) {
   return absPath.startsWith(root) ? absPath.slice(root.length + 1) : absPath;
 }
-var sidebar_artefact_save_default = app31;
+var sidebar_artefact_save_default = app32;
 
 // server/routes/admin/sidebar-artefact-content.ts
 import { readFile as readFile6, readdir as readdir5 } from "fs/promises";
-import { existsSync as existsSync18 } from "fs";
+import { existsSync as existsSync19 } from "fs";
 import { resolve as resolve19 } from "path";
 var UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-var app32 = new Hono();
-app32.get("/", requireAdminSession, async (c) => {
+var app33 = new Hono();
+app33.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) return new Response("Unauthorized", { status: 401 });
@@ -12652,7 +12681,7 @@ app32.get("/", requireAdminSession, async (c) => {
     return new Response("Not found", { status: 404 });
   }
   const dir = resolve19(ATTACHMENTS_ROOT, accountId, id);
-  if (!existsSync18(dir)) {
+  if (!existsSync19(dir)) {
     console.error(`[admin/sidebar-artefact-content] not-found id=${id.slice(0, 8)}`);
     return new Response("Not found", { status: 404 });
   }
@@ -12683,17 +12712,138 @@ app32.get("/", requireAdminSession, async (c) => {
     }
   });
 });
-var sidebar_artefact_content_default = app32;
+var sidebar_artefact_content_default = app33;
+
+// server/routes/admin/system-stats.ts
+import { readFile as readFile7 } from "fs/promises";
+import { cpus, loadavg, totalmem, freemem } from "os";
+function parseCpuStat(blob) {
+  const line = blob.split("\n", 1)[0] ?? "";
+  const parts = line.trim().split(/\s+/);
+  if (parts[0] !== "cpu") throw new Error(`unexpected /proc/stat header: ${parts[0] ?? "(empty)"}`);
+  const fields = parts.slice(1).map((n) => Number.parseInt(n, 10));
+  if (fields.length < 4 || fields.some((n) => !Number.isFinite(n))) {
+    throw new Error("malformed /proc/stat cpu line");
+  }
+  const idle = fields[3] + (fields[4] ?? 0);
+  const total = fields.reduce((a, b) => a + b, 0);
+  return { idle, total };
+}
+function cpuPctFromSamples(a, b) {
+  const idleDelta = b.idle - a.idle;
+  const totalDelta = b.total - a.total;
+  if (totalDelta <= 0) return 0;
+  const busy = 1 - idleDelta / totalDelta;
+  if (!Number.isFinite(busy)) return 0;
+  return Math.max(0, Math.min(1, busy));
+}
+function parseMeminfo(blob) {
+  const read = (key) => {
+    const re = new RegExp(`^${key}:\\s+(\\d+)\\s*kB`, "m");
+    const m = blob.match(re);
+    if (!m) throw new Error(`/proc/meminfo missing ${key}`);
+    return Number.parseInt(m[1], 10) * 1024;
+  };
+  const memTotalBytes = read("MemTotal");
+  const memAvailBytes = read("MemAvailable");
+  let swapTotalBytes = 0;
+  let swapFreeBytes = 0;
+  try {
+    swapTotalBytes = read("SwapTotal");
+    swapFreeBytes = read("SwapFree");
+  } catch {
+    swapTotalBytes = 0;
+    swapFreeBytes = 0;
+  }
+  return { memTotalBytes, memAvailBytes, swapTotalBytes, swapFreeBytes };
+}
+var SAMPLE_DELAY_MS = 100;
+async function sampleLinux() {
+  const a = parseCpuStat(await readFile7("/proc/stat", "utf-8"));
+  await new Promise((r) => setTimeout(r, SAMPLE_DELAY_MS));
+  const b = parseCpuStat(await readFile7("/proc/stat", "utf-8"));
+  const meminfo = parseMeminfo(await readFile7("/proc/meminfo", "utf-8"));
+  const loadavgRaw = (await readFile7("/proc/loadavg", "utf-8")).trim();
+  const [l1, l5, l15] = loadavgRaw.split(/\s+/, 3).map(Number);
+  if (![l1, l5, l15].every(Number.isFinite)) {
+    throw new Error(`malformed /proc/loadavg: ${loadavgRaw}`);
+  }
+  const memUsedBytes = meminfo.memTotalBytes - meminfo.memAvailBytes;
+  const memUsedPct = meminfo.memTotalBytes > 0 ? memUsedBytes / meminfo.memTotalBytes : null;
+  const swapUsedPct = meminfo.swapTotalBytes > 0 ? (meminfo.swapTotalBytes - meminfo.swapFreeBytes) / meminfo.swapTotalBytes : 0;
+  return {
+    cpuPct: cpuPctFromSamples(a, b),
+    memUsedPct,
+    memUsedBytes,
+    memTotalBytes: meminfo.memTotalBytes,
+    loadAvg1: l1,
+    loadAvg5: l5,
+    loadAvg15: l15,
+    cores: cpus().length,
+    swapUsedPct,
+    platform: "linux",
+    sampledAtMs: Date.now()
+  };
+}
+function sampleOsFallback() {
+  const total = totalmem();
+  const free = freemem();
+  const memUsedBytes = total - free;
+  const [l1, l5, l15] = loadavg();
+  return {
+    cpuPct: null,
+    memUsedPct: total > 0 ? memUsedBytes / total : null,
+    memUsedBytes,
+    memTotalBytes: total,
+    loadAvg1: l1,
+    loadAvg5: l5,
+    loadAvg15: l15,
+    cores: cpus().length,
+    swapUsedPct: null,
+    platform: process.platform === "darwin" ? "darwin" : "other",
+    sampledAtMs: Date.now()
+  };
+}
+var inflight = null;
+async function sample() {
+  if (process.platform === "linux") return sampleLinux();
+  return sampleOsFallback();
+}
+var app34 = new Hono();
+app34.get("/", async (c) => {
+  const started = Date.now();
+  if (!inflight) {
+    inflight = sample().finally(() => {
+      inflight = null;
+    });
+  }
+  try {
+    const snap = await inflight;
+    const ms = Date.now() - started;
+    const fmt = (n) => n === null ? "null" : n.toFixed(3);
+    console.log(
+      `[system-stats] poll cpuPct=${fmt(snap.cpuPct)} memUsedPct=${fmt(snap.memUsedPct)} loadAvg1=${snap.loadAvg1.toFixed(2)} swapUsedPct=${fmt(snap.swapUsedPct)} platform=${snap.platform} ms=${ms}`
+    );
+    return c.json(snap);
+  } catch (err) {
+    const reason = (err instanceof Error ? err.message : String(err)).replace(/\s+/g, " ").trim() || "unknown";
+    const errPath = err?.path;
+    const file = errPath || "parse";
+    console.log(`[system-stats] error file=${file} reason=${reason}`);
+    return c.json({ degraded: true, reason, sampledAtMs: Date.now() });
+  }
+});
+var system_stats_default = app34;
 
 // server/routes/admin/health.ts
-import { existsSync as existsSync19, readFileSync as readFileSync17 } from "fs";
-import { resolve as resolve20, join as join12 } from "path";
+import { existsSync as existsSync20, readFileSync as readFileSync18 } from "fs";
+import { resolve as resolve20, join as join13 } from "path";
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve20(process.cwd(), "..");
 var brandHostname = "maxy";
-var brandJsonPath = join12(PLATFORM_ROOT6, "config", "brand.json");
-if (existsSync19(brandJsonPath)) {
+var brandJsonPath = join13(PLATFORM_ROOT6, "config", "brand.json");
+if (existsSync20(brandJsonPath)) {
   try {
-    const brand = JSON.parse(readFileSync17(brandJsonPath, "utf-8"));
+    const brand = JSON.parse(readFileSync18(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
   } catch {
   }
@@ -12702,8 +12852,8 @@ var VERSION_FILE = resolve20(PLATFORM_ROOT6, `config/.${brandHostname}-version`)
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
-  if (!existsSync19(VERSION_FILE)) return "unknown";
-  return readFileSync17(VERSION_FILE, "utf-8").trim() || "unknown";
+  if (!existsSync20(VERSION_FILE)) return "unknown";
+  return readFileSync18(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
   let session;
@@ -12728,8 +12878,8 @@ async function probeConversationDb() {
     });
   }
 }
-var app33 = new Hono();
-app33.get("/", async (c) => {
+var app35 = new Hono();
+app35.get("/", async (c) => {
   const version = readVersion();
   const probe = await probeConversationDb();
   const uptimeMs = Date.now() - new Date(PROCESS_STARTED_AT).getTime();
@@ -12751,7 +12901,7 @@ app33.get("/", async (c) => {
     uptimeMs
   });
 });
-var health_default2 = app33;
+var health_default2 = app35;
 
 // server/routes/admin/linkedin-ingest.ts
 var TAG20 = "[linkedin-ingest-route]";
@@ -12847,8 +12997,8 @@ function buildInitialMessage(env) {
   }
   return header;
 }
-var app34 = new Hono();
-app34.post("/", requireAdminSession, async (c) => {
+var app36 = new Hono();
+app36.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -12898,43 +13048,45 @@ app34.post("/", requireAdminSession, async (c) => {
   );
   return c.json({ ok: true, dispatchId: envelope.dispatchId, taskId: claudeSessionId }, 202);
 });
-var linkedin_ingest_default = app34;
+var linkedin_ingest_default = app36;
 
 // server/routes/admin/index.ts
-var app35 = new Hono();
-app35.route("/session", session_default);
-app35.route("/new-session-failure", new_session_failure_default);
-app35.route("/new-session-submit", new_session_submit_default);
-app35.route("/logs", logs_default);
-app35.route("/claude-info", claude_info_default);
-app35.route("/attachment", attachment_default);
-app35.route("/agents", agents_default);
-app35.route("/sessions", sessions_default);
-app35.route("/claude-sessions", claude_sessions_default);
-app35.route("/log-ingest", log_ingest_default);
-app35.route("/browser", browser_default);
-app35.route("/browser-iframe", browser_iframe_default);
-app35.route("/device-browser", device_browser_default);
-app35.route("/events", events_default);
-app35.route("/cloudflare", cloudflare_default);
-app35.route("/files", files_default);
-app35.route("/graph-search", graph_search_default);
-app35.route("/graph-subgraph", graph_subgraph_default);
-app35.route("/graph-delete", graph_delete_default);
-app35.route("/graph-restore", graph_restore_default);
-app35.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app35.route("/graph-default-view", graph_default_view_default);
-app35.route("/session-defaults", session_defaults_default);
-app35.route("/file-attach", file_attach_default);
-app35.route("/sidebar-artefacts", sidebar_artefacts_default);
-app35.route("/sidebar-artefact-save", sidebar_artefact_save_default);
-app35.route("/sidebar-artefact-content", sidebar_artefact_content_default);
-app35.route("/health-brand", health_default2);
-app35.route("/linkedin-ingest", linkedin_ingest_default);
-var admin_default = app35;
+var app37 = new Hono();
+app37.route("/session", session_default);
+app37.route("/new-session-failure", new_session_failure_default);
+app37.route("/new-session-submit", new_session_submit_default);
+app37.route("/logs", logs_default);
+app37.route("/claude-info", claude_info_default);
+app37.route("/claude-capabilities", claude_capabilities_default);
+app37.route("/attachment", attachment_default);
+app37.route("/agents", agents_default);
+app37.route("/sessions", sessions_default);
+app37.route("/claude-sessions", claude_sessions_default);
+app37.route("/log-ingest", log_ingest_default);
+app37.route("/browser", browser_default);
+app37.route("/browser-iframe", browser_iframe_default);
+app37.route("/device-browser", device_browser_default);
+app37.route("/events", events_default);
+app37.route("/cloudflare", cloudflare_default);
+app37.route("/files", files_default);
+app37.route("/graph-search", graph_search_default);
+app37.route("/graph-subgraph", graph_subgraph_default);
+app37.route("/graph-delete", graph_delete_default);
+app37.route("/graph-restore", graph_restore_default);
+app37.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app37.route("/graph-default-view", graph_default_view_default);
+app37.route("/session-defaults", session_defaults_default);
+app37.route("/file-attach", file_attach_default);
+app37.route("/sidebar-artefacts", sidebar_artefacts_default);
+app37.route("/sidebar-artefact-save", sidebar_artefact_save_default);
+app37.route("/sidebar-artefact-content", sidebar_artefact_content_default);
+app37.route("/system-stats", system_stats_default);
+app37.route("/health-brand", health_default2);
+app37.route("/linkedin-ingest", linkedin_ingest_default);
+var admin_default = app37;
 
 // server/routes/sites.ts
-import { existsSync as existsSync20, readFileSync as readFileSync18, realpathSync as realpathSync5, statSync as statSync9 } from "fs";
+import { existsSync as existsSync21, readFileSync as readFileSync19, realpathSync as realpathSync5, statSync as statSync9 } from "fs";
 import { resolve as resolve21 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
@@ -12966,8 +13118,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app36 = new Hono();
-app36.get("/:rel{.*}", (c) => {
+var app38 = new Hono();
+app38.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -13000,7 +13152,7 @@ app36.get("/:rel{.*}", (c) => {
   }
   let stat7;
   try {
-    stat7 = existsSync20(filePath) ? statSync9(filePath) : null;
+    stat7 = existsSync21(filePath) ? statSync9(filePath) : null;
   } catch {
     stat7 = null;
   }
@@ -13019,7 +13171,7 @@ app36.get("/:rel{.*}", (c) => {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync20(filePath)) {
+  if (!existsSync21(filePath)) {
     console.error(`[sites] not-found path=${reqPath} status=404`);
     return c.text("Not found", 404);
   }
@@ -13038,7 +13190,7 @@ app36.get("/:rel{.*}", (c) => {
   }
   let body;
   try {
-    body = readFileSync18(realPath);
+    body = readFileSync19(realPath);
   } catch (err) {
     const code = err?.code;
     if (code === "EISDIR") {
@@ -13070,7 +13222,7 @@ app36.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app36;
+var sites_default = app38;
 
 // app/lib/graph-health.ts
 var HOUR_MS = 60 * 60 * 1e3;
@@ -13184,7 +13336,7 @@ function startReaper2() {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash3, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync21, readFileSync as readFileSync19, statSync as statSync10 } from "fs";
+import { existsSync as existsSync22, readFileSync as readFileSync20, statSync as statSync10 } from "fs";
 import { resolve as resolve22 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
@@ -13233,7 +13385,7 @@ function resolveEntitlement(brand, account) {
     return logResolved(implicitTrust(account), null);
   }
   const entitlementPath = resolve22(brand.configDir, "entitlement.json");
-  if (!existsSync21(entitlementPath)) {
+  if (!existsSync22(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
   const stat7 = statSync10(entitlementPath);
@@ -13248,7 +13400,7 @@ function resolveEntitlement(brand, account) {
 function verifyAndResolve(brand, entitlementPath, account) {
   let pubkeyPem;
   try {
-    pubkeyPem = readFileSync19(pubkeyPath(brand), "utf-8");
+    pubkeyPem = readFileSync20(pubkeyPath(brand), "utf-8");
   } catch (err) {
     return logResolved(anonymousFallback("pubkey-missing"), {
       reason: "pubkey-missing"
@@ -13262,7 +13414,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(readFileSync19(entitlementPath, "utf-8"));
+    envelope = JSON.parse(readFileSync20(entitlementPath, "utf-8"));
   } catch {
     return logResolved(anonymousFallback("malformed"), { reason: "malformed" });
   }
@@ -13423,14 +13575,14 @@ function clientFrom(c) {
   );
 }
 var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT7 ? join13(PLATFORM_ROOT7, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT7 ? join14(PLATFORM_ROOT7, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync22(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync23(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync22(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync23(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync20(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync21(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -13449,11 +13601,11 @@ var brandLoginOpts = {
   bodyFont: BRAND.defaultFonts?.body,
   logoContainsName: !!BRAND.logoContainsName
 };
-var ALIAS_DOMAINS_PATH2 = join13(homedir4(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH2 = join14(homedir5(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync22(ALIAS_DOMAINS_PATH2)) return null;
-    const parsed = JSON.parse(readFileSync20(ALIAS_DOMAINS_PATH2, "utf-8"));
+    if (!existsSync23(ALIAS_DOMAINS_PATH2)) return null;
+    const parsed = JSON.parse(readFileSync21(ALIAS_DOMAINS_PATH2, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -13477,9 +13629,9 @@ watchFile(ALIAS_DOMAINS_PATH2, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app37 = new Hono();
-app37.use("*", clientIpMiddleware);
-app37.use("*", async (c, next) => {
+var app39 = new Hono();
+app39.use("*", clientIpMiddleware);
+app39.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -13489,7 +13641,7 @@ app37.use("*", async (c, next) => {
   );
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app37.use("*", async (c, next) => {
+app39.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -13522,7 +13674,7 @@ var PUBLIC_ALLOWED_PREFIXES = [
   "/sites/"
 ];
 var PUBLIC_ALLOWED_EXACT = ["/favicon.ico"];
-app37.use("*", async (c, next) => {
+app39.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (!isPublicHost(host)) {
     await next();
@@ -13562,7 +13714,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app37.post("/__remote-auth/login", async (c) => {
+app39.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -13607,7 +13759,7 @@ app37.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app37.get("/__remote-auth/logout", (c) => {
+app39.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -13620,7 +13772,7 @@ app37.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app37.post("/__remote-auth/change-password", async (c) => {
+app39.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -13671,13 +13823,13 @@ app37.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app37.get("/__remote-auth/setup", (c) => {
+app39.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app37.post("/__remote-auth/set-initial-password", async (c) => {
+app39.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -13715,10 +13867,10 @@ app37.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app37.get("/api/remote-auth/status", (c) => {
+app39.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app37.post("/api/remote-auth/set-password", async (c) => {
+app39.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -13749,9 +13901,9 @@ app37.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app37.route("/api/_client-error", client_error_default);
+app39.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
-app37.use("*", async (c, next) => {
+app39.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
@@ -13791,11 +13943,11 @@ app37.use("*", async (c, next) => {
   console.error(`[remote-auth] login required ip=${clientIp} path=${path2} ${disambig}`);
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), redirect: path2 }), 200);
 });
-app37.route("/api/health", health_default);
-app37.route("/api/chat", chat_default);
-app37.route("/api/whatsapp", whatsapp_default);
-app37.route("/api/onboarding", onboarding_default);
-app37.route("/api/admin", admin_default);
+app39.route("/api/health", health_default);
+app39.route("/api/chat", chat_default);
+app39.route("/api/whatsapp", whatsapp_default);
+app39.route("/api/onboarding", onboarding_default);
+app39.route("/api/admin", admin_default);
 var SAFE_SLUG_RE = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -13807,7 +13959,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app37.get("/agent-assets/:slug/:filename", (c) => {
+app39.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE.test(slug)) {
@@ -13829,20 +13981,20 @@ app37.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync22(filePath)) {
+  if (!existsSync23(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync20(filePath);
+  const body = readFileSync21(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
   });
 });
-app37.get("/generated/:filename", (c) => {
+app39.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -13859,26 +14011,26 @@ app37.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync22(filePath)) {
+  if (!existsSync23(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync20(filePath);
+  const body = readFileSync21(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
   });
 });
-app37.route("/sites", sites_default);
+app39.route("/sites", sites_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync22(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync23(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync20(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync21(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -13895,9 +14047,9 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT7) return "unknown";
-    const versionFile = join13(PLATFORM_ROOT7, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync22(versionFile)) return "unknown";
-    const content = readFileSync20(versionFile, "utf-8").trim();
+    const versionFile = join14(PLATFORM_ROOT7, "config", `.${BRAND.hostname}-version`);
+    if (!existsSync23(versionFile)) return "unknown";
+    const content = readFileSync21(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -13938,7 +14090,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync20(resolve23(process.cwd(), "public", file), "utf-8");
+    html = readFileSync21(resolve23(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -13954,26 +14106,26 @@ ${clientErrorReporterScript}
 }
 var brandedHtmlCache = /* @__PURE__ */ new Map();
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join13(homedir4(), BRAND.configDir);
+  const configDir2 = join14(homedir5(), BRAND.configDir);
   try {
-    const accountJsonPath = join13(configDir2, "account.json");
-    if (!existsSync22(accountJsonPath)) return null;
-    const account = JSON.parse(readFileSync20(accountJsonPath, "utf-8"));
+    const accountJsonPath = join14(configDir2, "account.json");
+    if (!existsSync23(accountJsonPath)) return null;
+    const account = JSON.parse(readFileSync21(accountJsonPath, "utf-8"));
     const accountId = account.accountId;
     if (!accountId) return null;
-    const cachePath = join13(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync22(cachePath)) return null;
-    return JSON.parse(readFileSync20(cachePath, "utf-8"));
+    const cachePath = join14(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    if (!existsSync23(cachePath)) return null;
+    return JSON.parse(readFileSync21(cachePath, "utf-8"));
   } catch {
     return null;
   }
 }
 function resolveDefaultSlug() {
   try {
-    const configDir2 = join13(homedir4(), BRAND.configDir);
-    const accountJsonPath = join13(configDir2, "account.json");
-    if (!existsSync22(accountJsonPath)) return null;
-    const account = JSON.parse(readFileSync20(accountJsonPath, "utf-8"));
+    const configDir2 = join14(homedir5(), BRAND.configDir);
+    const accountJsonPath = join14(configDir2, "account.json");
+    if (!existsSync23(accountJsonPath)) return null;
+    const account = JSON.parse(readFileSync21(accountJsonPath, "utf-8"));
     return account.defaultAgent || null;
   } catch {
     return null;
@@ -14009,7 +14161,7 @@ function brandedPublicHtml(agentSlug) {
 function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-app37.get("/", (c) => {
+app39.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) {
     const defaultSlug = resolveDefaultSlug();
@@ -14017,12 +14169,12 @@ app37.get("/", (c) => {
   }
   return c.html(cachedHtml("index.html"));
 });
-app37.get("/public", (c) => {
+app39.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app37.get("/chat", (c) => {
+app39.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -14041,12 +14193,12 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app37.use("/vnc-viewer.html", logViewerFetch);
-app37.use("/vnc-popout.html", logViewerFetch);
-app37.get("/vnc-popout.html", (c) => {
+app39.use("/vnc-viewer.html", logViewerFetch);
+app39.use("/vnc-popout.html", logViewerFetch);
+app39.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync20(resolve23(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync21(resolve23(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -14056,7 +14208,7 @@ app37.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app37.post("/api/vnc/client-event", async (c) => {
+app39.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -14077,25 +14229,25 @@ app37.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app37.get("/g/:slug", (c) => {
+app39.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
-app37.get("/graph", (c) => {
+app39.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app37.get("/sessions", (c) => {
+app39.get("/sessions", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("sessions.html"));
 });
-app37.get("/data", (c) => {
+app39.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app37.get("/:slug", async (c, next) => {
+app39.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const branding = loadBrandingCache(slug);
@@ -14105,15 +14257,15 @@ app37.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app37.get("/favicon.ico", (c) => {
+  app39.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app37.use("/*", serveStatic({ root: "./public" }));
+app39.use("/*", serveStatic({ root: "./public" }));
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app37.fetch, port, hostname });
+var httpServer = serve({ fetch: app39.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const loopHist = monitorEventLoopDelay({ resolution: 50 });
@@ -14145,7 +14297,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app37.routes ?? []) {
+  for (const r of app39.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -14167,8 +14319,8 @@ try {
 }
 (async () => {
   try {
-    if (!existsSync22(USERS_FILE)) return;
-    const usersRaw = readFileSync20(USERS_FILE, "utf-8").trim();
+    if (!existsSync23(USERS_FILE)) return;
+    const usersRaw = readFileSync21(USERS_FILE, "utf-8").trim();
     if (!usersRaw) return;
     const users = JSON.parse(usersRaw);
     const userId = users[0]?.userId;
@@ -14279,7 +14431,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve23(process.env.MAXY_PLATFORM_ROOT ?? join13(__dirname, "..")),
+  platformRoot: resolve23(process.env.MAXY_PLATFORM_ROOT ?? join14(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (process.env.WHATSAPP_PTY_BRIDGE_ENABLED === "true" && msg.text && !msg.isOwnerMirror) {