@rubytech/create-maxy-code 0.1.107 → 0.1.109

package/payload/server/server.js

@@ -6,6 +6,7 @@ import {
   CHROMIUM_PROFILE_DIR,
   CLAUDE_CREDENTIALS_FILE,
   COMMERCIAL_MODE,
+  GREETING_DIRECTIVE,
   Hono,
   LOG_DIR,
   MAXY_DIR,
@@ -15,37 +16,53 @@ import {
   VNC_DISPLAY,
   WEBSOCKIFY_PORT,
   autoDeliverPremiumPlugins,
-  browserViewerLog,
   canAccessAdmin,
   checkRateLimit,
   cleanupLeakedPremiumSubs,
   clearRateLimit,
   clientIpMiddleware,
   createRemoteSession,
+  deleteAgentProjection,
+  deleteConversation,
+  embed,
   emitMissingOnResolve,
+  ensureConversation,
+  fetchBranding,
   findMissingPlugins,
   fingerprintSessionKey,
   getAccountIdForSession,
+  getAgentSessionIdForConversation,
+  getConversationClaudeSessionIds,
+  getConversationIdByClaudeSessionId,
   getConversationIdForSession,
+  getRecentMessages,
   getRoleForSession,
+  getSession,
   getSessionKeyByConversationId,
   getUserIdForSession,
   getUserNameForSession,
+  getUserTimezone,
   httpLog,
-  isActionActive,
   isPasswordValid,
   isRemoteAuthConfigured,
-  launchAction,
+  linkConversationTranscript,
+  listAdminSessions,
   listValidAccounts,
+  loadAdminUserName,
+  loadUserProfile,
+  persistMessage,
+  projectAgent,
   reconcileEnabledPlugins,
   recordFailedAttempt,
   registerSession,
+  renameConversation,
   renderLoginPage,
   requireAdminSession,
   requirePortEnv,
   resolveAccount,
   resolveClientIp,
   resolveUserAccounts,
+  runAdminUserSelfHeal,
   safeJson,
   sanitizeClientCorrId,
   serve,
@@ -57,45 +74,13 @@ import {
   unregisterSession,
   validatePasswordStrength,
   validateSession,
-  verifyRemotePassword,
-  vncLog,
-  waitForExit,
-  walkPremiumBundles
-} from "./chunk-TZD23CX6.js";
-import {
-  CLOUDFLARE_TASK_DIAGNOSTICS,
-  appendCloudflareSteps,
-  completeCloudflareTask,
-  findMostRecentTerminalCloudflareTask,
-  openCloudflareTask,
-  readTunnelState,
-  resolveUnitGoneVerdict
-} from "./chunk-BDFOTLPW.js";
-import {
-  GREETING_DIRECTIVE,
-  deleteAgentProjection,
-  deleteConversation,
-  embed,
-  ensureConversation,
-  fetchBranding,
-  getAgentSessionIdForConversation,
-  getConversationClaudeSessionIds,
-  getConversationIdByClaudeSessionId,
-  getRecentMessages,
-  getSession,
-  getUserTimezone,
-  linkConversationTranscript,
-  listAdminSessions,
-  loadAdminUserName,
-  loadUserProfile,
-  persistMessage,
-  projectAgent,
-  renameConversation,
-  runAdminUserSelfHeal,
   verifyAndGetConversationUpdatedAt,
   verifyConversationOwnership,
+  verifyRemotePassword,
+  vncLog,
+  walkPremiumBundles,
   writeAdminUserAndPerson
-} from "./chunk-JRBCOVA4.js";
+} from "./chunk-FSPPVVWM.js";
 import {
   __commonJS,
   __toESM
@@ -600,9 +585,9 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync21, existsSync as existsSync23, watchFile } from "fs";
-import { resolve as resolve23, join as join14, basename as basename5 } from "path";
-import { homedir as homedir5 } from "os";
+import { readFileSync as readFileSync19, existsSync as existsSync23, watchFile } from "fs";
+import { resolve as resolve21, join as join14, basename as basename5 } from "path";
+import { homedir as homedir4 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
 // app/lib/agent-slug-pattern.ts
@@ -1059,7 +1044,7 @@ var credsSaveQueue = Promise.resolve();
 async function drainCredsSaveQueue(timeoutMs = 5e3) {
   console.error(`${TAG2} draining credential save queue\u2026`);
   const timer2 = new Promise(
-    (resolve24) => setTimeout(() => resolve24("timeout"), timeoutMs)
+    (resolve22) => setTimeout(() => resolve22("timeout"), timeoutMs)
   );
   const result = await Promise.race([
     credsSaveQueue.then(() => "drained"),
@@ -1187,11 +1172,11 @@ async function createWaSocket(opts) {
   return sock;
 }
 async function waitForConnection(sock) {
-  return new Promise((resolve24, reject) => {
+  return new Promise((resolve22, reject) => {
     const handler = (update) => {
       if (update.connection === "open") {
         sock.ev.off("connection.update", handler);
-        resolve24();
+        resolve22();
       }
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
@@ -1305,14 +1290,14 @@ ${inspected}`;
   return inspect2(err, INSPECT_OPTS2);
 }
 function withTimeout(label, promise, timeoutMs) {
-  return new Promise((resolve24, reject) => {
+  return new Promise((resolve22, reject) => {
     const timer2 = setTimeout(() => {
       reject(new Error(`${label} timed out after ${timeoutMs}ms`));
     }, timeoutMs);
     promise.then(
       (value) => {
         clearTimeout(timer2);
-        resolve24(value);
+        resolve22(value);
       },
       (err) => {
         clearTimeout(timer2);
@@ -1847,8 +1832,8 @@ async function persistWhatsAppMessage(input) {
   const { givenName, familyName } = splitName(input.pushName);
   const prev = sessionWriteLocks.get(input.cacheKey);
   let release;
-  const mine = new Promise((resolve24) => {
-    release = resolve24;
+  const mine = new Promise((resolve22) => {
+    release = resolve22;
   });
   const chained = (prev ?? Promise.resolve()).then(() => mine);
   sessionWriteLocks.set(input.cacheKey, chained);
@@ -2884,11 +2869,11 @@ async function connectWithReconnect(conn) {
       console.error(
         `${TAG12} reconnecting account=${conn.accountId} in ${delay}ms (attempt ${decision.nextAttempts}/${maxAttempts})`
       );
-      await new Promise((resolve24) => {
-        const timer2 = setTimeout(resolve24, delay);
+      await new Promise((resolve22) => {
+        const timer2 = setTimeout(resolve22, delay);
         conn.abortController.signal.addEventListener("abort", () => {
           clearTimeout(timer2);
-          resolve24();
+          resolve22();
         }, { once: true });
       });
     }
@@ -2896,16 +2881,16 @@ async function connectWithReconnect(conn) {
   }
 }
 function waitForDisconnectEvent(conn) {
-  return new Promise((resolve24) => {
+  return new Promise((resolve22) => {
     if (!conn.sock) {
-      resolve24();
+      resolve22();
       return;
     }
     const sock = conn.sock;
     const handler = (update) => {
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
-        resolve24();
+        resolve22();
       }
     };
     sock.ev.on("connection.update", handler);
@@ -3167,8 +3152,8 @@ async function handleInboundMessage(conn, msg) {
     const conversationKey = isGroup ? remoteJid : senderPhone;
     const debounceKey = `${conn.accountId}:${conversationKey}:${senderPhone}`;
     let resolvePending;
-    const sttPending = new Promise((resolve24) => {
-      resolvePending = resolve24;
+    const sttPending = new Promise((resolve22) => {
+      resolvePending = resolve22;
     });
     if (conn.debouncer) conn.debouncer.registerPending(debounceKey, sttPending);
     try {
@@ -3572,20 +3557,20 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
 
 // server/routes/health.ts
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve24) => {
+  return new Promise((resolve22) => {
     const socket = createConnection2(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve24(true);
+      resolve22(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve24(false);
+      resolve22(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve24(false);
+      resolve22(false);
     });
   });
 }
@@ -4673,12 +4658,12 @@ async function dispatchOnce(input) {
   });
   if (!entry) return { error: "spawn-failed" };
   entry.lastInboundAt = Date.now();
-  let resolve24;
+  let resolve22;
   const turnPromise = new Promise((r) => {
-    resolve24 = r;
+    resolve22 = r;
   });
   const listener = (text) => {
-    resolve24(text);
+    resolve22(text);
   };
   entry.subscribers.add(listener);
   const writeOk = await writeInput(entry, input.text);
@@ -5041,8 +5026,8 @@ async function startLogin(opts) {
   resetActiveLogin(accountId);
   let resolveQr = null;
   let rejectQr = null;
-  const qrPromise = new Promise((resolve24, reject) => {
-    resolveQr = resolve24;
+  const qrPromise = new Promise((resolve22, reject) => {
+    resolveQr = resolve22;
     rejectQr = reject;
   });
   const qrTimer = setTimeout(
@@ -8223,8 +8208,22 @@ function computeDormantPlugins(accountId) {
 }
 
 // server/routes/admin/claude-sessions.ts
-import { readFileSync as readFileSync15 } from "fs";
+import { existsSync as existsSync16, readFileSync as readFileSync15 } from "fs";
 import { resolve as resolve12 } from "path";
+function readTunnelState(brandConfigDir) {
+  const statePath = `${process.env.HOME ?? ""}/${brandConfigDir}/cloudflared/tunnel.state`;
+  if (!existsSync16(statePath)) return null;
+  try {
+    const parsed = JSON.parse(readFileSync15(statePath, "utf-8"));
+    const tunnelId = typeof parsed.tunnelId === "string" ? parsed.tunnelId : null;
+    const tunnelName = typeof parsed.tunnelName === "string" ? parsed.tunnelName : null;
+    const domain = typeof parsed.domain === "string" ? parsed.domain : null;
+    if (!tunnelId || !tunnelName || !domain) return null;
+    return { tunnelId, tunnelName, domain };
+  } catch {
+    return null;
+  }
+}
 function resolveTunnelUrl() {
   const platformRoot = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve12(process.cwd(), "..");
   let brand;
@@ -8692,211 +8691,15 @@ app16.post("/", async (c) => {
 });
 var log_ingest_default = app16;
 
-// server/routes/admin/browser.ts
-var app17 = new Hono();
-app17.post("/launch", async (c) => {
-  try {
-    const transport = resolveBrowserTransport(c.req.raw, c.env?.incoming?.socket?.remoteAddress);
-    if (transport === "vnc") {
-      const vncOk = await ensureVnc();
-      if (!vncOk) {
-        return c.json({ ok: false, error: "VNC failed to start" }, 502);
-      }
-    }
-    const cdpOk = await ensureCdp(transport);
-    if (!cdpOk) {
-      return c.json({ ok: false, error: "Chrome failed to start" }, 502);
-    }
-    return c.json({ ok: true, transport });
-  } catch (err) {
-    console.error("[admin/browser/launch] Failed to start browser:", err);
-    return c.json(
-      { ok: false, error: err instanceof Error ? err.message : "Unknown error" },
-      500
-    );
-  }
-});
-var browser_default = app17;
-
-// server/routes/admin/browser-iframe.ts
-var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
-  "mount",
-  "unmount",
-  "rfb-connected",
-  "rfb-error",
-  "iframe-load"
-]);
-function asString(v, max = 500) {
-  if (typeof v !== "string") return void 0;
-  return v.length > max ? v.slice(0, max) : v;
-}
-function asNumber(v) {
-  return typeof v === "number" && Number.isFinite(v) ? v : void 0;
-}
-var app18 = new Hono();
-app18.post("/event", async (c) => {
-  let body = {};
-  try {
-    body = await c.req.json();
-  } catch {
-    browserViewerLog("invalid", { reason: "body-not-json" });
-    return c.body(null, 204);
-  }
-  const eventRaw = asString(body.event, 64);
-  const event = eventRaw && ALLOWED_EVENTS.has(eventRaw) ? eventRaw : "invalid";
-  browserViewerLog(event, {
-    brand: asString(body.brand, 64),
-    conversationId: asString(body.conversationId, 64),
-    session_key: asString(body.session_key, 128),
-    durationMs: asNumber(body.durationMs),
-    errorCode: asString(body.errorCode, 64),
-    message: asString(body.message, 200),
-    surface: asString(body.surface, 32)
-  });
-  return c.body(null, 204);
-});
-var browser_iframe_default = app18;
-
-// app/lib/cdp-client.ts
-var CDP_HOST = "127.0.0.1";
-var CDP_PORT2 = CDP_PORT;
-var DEFAULT_TIMEOUT_MS = 5e3;
-async function cdpNavigateNewTab(url, opts = {}) {
-  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  const endpoint = `http://${CDP_HOST}:${CDP_PORT2}/json/new?${encodeURIComponent(url)}`;
-  let res;
-  try {
-    res = await fetch(endpoint, {
-      method: "PUT",
-      signal: AbortSignal.timeout(timeoutMs)
-    });
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    if (msg.includes("ECONNREFUSED") || msg.includes("fetch failed") || msg.includes("ENOTFOUND")) {
-      return { result: "cdp-unreachable", detail: msg };
-    }
-    if (err instanceof Error && err.name === "TimeoutError") {
-      return { result: "timeout", detail: msg };
-    }
-    return { result: "error", detail: msg };
-  }
-  if (!res.ok) {
-    const body = await res.text().catch(() => "<unreadable>");
-    return {
-      result: "error",
-      detail: `CDP /json/new returned ${res.status}: ${body.slice(0, 200)}`
-    };
-  }
-  let target;
-  try {
-    target = await res.json();
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    return { result: "error", detail: `CDP /json/new response not JSON: ${msg}` };
-  }
-  return { result: "ok", targetId: target?.id };
-}
-
-// server/routes/admin/device-browser.ts
-var app19 = new Hono();
-app19.post("/navigate", async (c) => {
-  const TAG22 = "[device-url:click]";
-  let body;
-  try {
-    body = await c.req.json();
-  } catch (err) {
-    const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG22} reject reason=body-not-json detail=${detail} browser=fallback navigateResult=error`);
-    return c.json(
-      { ok: false, navigateResult: "error", browser: "fallback", detail: "Request body was not valid JSON" },
-      400
-    );
-  }
-  const url = typeof body.url === "string" ? body.url : "";
-  const intent = typeof body.intent === "string" ? body.intent : "";
-  const hostname2 = typeof body.hostname === "string" ? body.hostname : "";
-  if (!url) {
-    console.error(`${TAG22} reject reason=missing-url intent=${JSON.stringify(intent)} browser=fallback navigateResult=error`);
-    return c.json(
-      { ok: false, navigateResult: "error", browser: "fallback", detail: "url field is required" },
-      400
-    );
-  }
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    console.error(`${TAG22} reject reason=url-malformed intent=${JSON.stringify(intent)} url=${url} browser=fallback navigateResult=error`);
-    return c.json(
-      { ok: false, navigateResult: "error", browser: "fallback", detail: "url is not a valid URL" },
-      400
-    );
-  }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    console.error(
-      `${TAG22} reject reason=scheme-not-allowed scheme=${parsed.protocol} intent=${JSON.stringify(intent)} browser=fallback navigateResult=error`
-    );
-    return c.json(
-      {
-        ok: false,
-        navigateResult: "error",
-        browser: "fallback",
-        detail: `URL scheme ${parsed.protocol} is not permitted; only http and https are accepted`
-      },
-      400
-    );
-  }
-  const transport = resolveBrowserTransport(c.req.raw, c.env?.incoming?.socket?.remoteAddress);
-  const cdpOk = await ensureCdp(transport);
-  if (!cdpOk) {
-    console.error(
-      `${TAG22} intent=${JSON.stringify(intent)} browser=fallback navigateResult=cdp-unreachable hostname=${JSON.stringify(hostname2)}`
-    );
-    return c.json(
-      {
-        ok: false,
-        navigateResult: "cdp-unreachable",
-        browser: "fallback",
-        detail: `Device browser (Chromium/CDP on :${CDP_PORT}) did not start`
-      },
-      502
-    );
-  }
-  const outcome = await cdpNavigateNewTab(parsed.toString());
-  const browser = outcome.result === "ok" ? "vnc" : "fallback";
-  const detailStr = outcome.detail ? ` detail=${JSON.stringify(outcome.detail.length > 230 ? outcome.detail.slice(0, 227) + "..." : outcome.detail)}` : "";
-  console.error(
-    `${TAG22} intent=${JSON.stringify(intent)} browser=${browser} navigateResult=${outcome.result} hostname=${JSON.stringify(hostname2)} targetId=${outcome.targetId ?? "none"}${detailStr}`
-  );
-  if (outcome.result !== "ok") {
-    return c.json(
-      {
-        ok: false,
-        navigateResult: outcome.result,
-        browser: "fallback",
-        detail: outcome.detail
-      },
-      502
-    );
-  }
-  return c.json({
-    ok: true,
-    navigateResult: "ok",
-    browser: "vnc",
-    targetId: outcome.targetId
-  });
-});
-var device_browser_default = app19;
-
 // server/routes/admin/events.ts
-var ALLOWED_EVENTS2 = /* @__PURE__ */ new Set([
+var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
   "device-url:render",
   "device-url:fallback-shown",
   "device-url:vnc-surface-shown",
   "device-url:malformed"
 ]);
-var app20 = new Hono();
-app20.post("/", async (c) => {
+var app17 = new Hono();
+app17.post("/", async (c) => {
   const TAG22 = "[admin:events]";
   let body;
   try {
@@ -8907,7 +8710,7 @@ app20.post("/", async (c) => {
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
-  if (!ALLOWED_EVENTS2.has(event)) {
+  if (!ALLOWED_EVENTS.has(event)) {
     console.error(`${TAG22} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
@@ -8927,914 +8730,23 @@ app20.post("/", async (c) => {
   console.error(`[${event}] ${formatted}`);
   return c.json({ ok: true });
 });
-var events_default = app20;
-
-// server/routes/admin/cloudflare.ts
-import { homedir as homedir4 } from "os";
-import { resolve as resolve14 } from "path";
-import { readFileSync as readFileSync17 } from "fs";
-
-// app/lib/dns-label.ts
-var VALID_LABEL = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
-function isValidLabel(value) {
-  if (!value) return false;
-  return VALID_LABEL.test(value);
-}
-function isValidDomain(value) {
-  if (!value || value.length > 253) return false;
-  const parts = value.split(".");
-  if (parts.length < 2) return false;
-  return parts.every((p) => isValidLabel(p));
-}
-
-// app/lib/alias-domains.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync4, readFileSync as readFileSync16, writeFileSync as writeFileSync7 } from "fs";
-import { dirname as dirname4 } from "path";
-import { resolve as resolve13 } from "path";
-var ALIAS_DOMAINS_PATH = resolve13(MAXY_DIR, "alias-domains.json");
-function readExisting() {
-  if (!existsSync16(ALIAS_DOMAINS_PATH)) return /* @__PURE__ */ new Set();
-  try {
-    const parsed = JSON.parse(readFileSync16(ALIAS_DOMAINS_PATH, "utf-8"));
-    if (!Array.isArray(parsed)) return /* @__PURE__ */ new Set();
-    return new Set(parsed.filter((h) => typeof h === "string"));
-  } catch {
-    return /* @__PURE__ */ new Set();
-  }
-}
-function addAliasDomain(hostname2) {
-  const existing = readExisting();
-  if (existing.has(hostname2)) return;
-  existing.add(hostname2);
-  mkdirSync4(dirname4(ALIAS_DOMAINS_PATH), { recursive: true });
-  writeFileSync7(ALIAS_DOMAINS_PATH, JSON.stringify([...existing], null, 2) + "\n", "utf-8");
-}
-
-// app/lib/script-stream-tailer.ts
-import * as childProcess from "child_process";
-import { appendFileSync as appendFileSync2, createReadStream as createReadStream2, mkdirSync as mkdirSync5, statSync as statSync7 } from "fs";
-import { dirname as dirname5 } from "path";
-import { StringDecoder } from "string_decoder";
-var SCRIPT_STREAM_RE = /^\[([^\]]+)\] \[script:([a-z][a-z0-9-]*)((?::[a-z0-9:_-]+)?)\] (.*)$/;
-function parseLine(line) {
-  const m = line.match(SCRIPT_STREAM_RE);
-  if (!m) return void 0;
-  const [, timestamp, scope, tagSuffix, rest] = m;
-  return {
-    type: "script_stream",
-    source: scope + (tagSuffix ?? ""),
-    timestamp,
-    line: rest
-  };
-}
-function startScriptStreamTailer(opts) {
-  const { path: path2, onEvent, onError } = opts;
-  let offset;
-  try {
-    offset = statSync7(path2).size;
-  } catch {
-    offset = 0;
-  }
-  const utf8 = new StringDecoder("utf8");
-  let buffer = "";
-  let stopped = false;
-  let pendingRead = false;
-  let timer2;
-  const processLine = (line) => {
-    const event = parseLine(line);
-    if (event) onEvent(event);
-  };
-  const readDelta = async () => {
-    if (pendingRead) return;
-    pendingRead = true;
-    try {
-      let size;
-      try {
-        size = statSync7(path2).size;
-      } catch {
-        return;
-      }
-      if (size === offset) return;
-      if (size < offset) {
-        offset = 0;
-        buffer = "";
-      }
-      await new Promise((res, rej) => {
-        const stream = createReadStream2(path2, { start: offset, end: size - 1 });
-        stream.on("data", (chunk) => {
-          buffer += typeof chunk === "string" ? chunk : utf8.write(chunk);
-          let idx;
-          while ((idx = buffer.indexOf("\n")) !== -1) {
-            const line = buffer.slice(0, idx);
-            buffer = buffer.slice(idx + 1);
-            if (line.length > 0) processLine(line);
-          }
-        });
-        stream.on("end", () => {
-          offset = size;
-          res();
-        });
-        stream.on("error", rej);
-      });
-    } catch (err) {
-      if (onError) onError(err instanceof Error ? err : new Error(String(err)));
-    } finally {
-      pendingRead = false;
-    }
-  };
-  const tick = () => {
-    if (stopped) return;
-    readDelta().catch(() => {
-    }).finally(() => {
-      if (!stopped) timer2 = setTimeout(tick, 200);
-    });
-  };
-  timer2 = setTimeout(tick, 0);
-  return {
-    async stop() {
-      if (stopped) return;
-      stopped = true;
-      if (timer2) clearTimeout(timer2);
-      while (pendingRead) {
-        await new Promise((r) => setImmediate(r));
-      }
-      await readDelta();
-      buffer += utf8.end();
-      if (buffer.length > 0) {
-        const event = parseLine(buffer);
-        if (event) onEvent(event);
-        buffer = "";
-      }
-    }
-  };
-}
-var SCOPE_TOKEN_RE = /^[a-z][a-z0-9-]*$/;
-function writeRouteMilestone(streamLogPath, scope, line) {
-  if (scope.startsWith("script:")) {
-    throw new Error(
-      `writeRouteMilestone: scope "${scope}" must not start with "script:" \u2014 the helper prepends it`
-    );
-  }
-  if (!SCOPE_TOKEN_RE.test(scope)) {
-    throw new Error(
-      `writeRouteMilestone: scope "${scope}" must match [a-z][a-z0-9-]* \u2014 the tailer regex won't match otherwise`
-    );
-  }
-  const ts = (/* @__PURE__ */ new Date()).toISOString();
-  try {
-    mkdirSync5(dirname5(streamLogPath), { recursive: true });
-    appendFileSync2(streamLogPath, `[${ts}] [script:${scope}] ${line}
-`);
-  } catch (err) {
-    console.error(
-      `[script-stream-tailer] writeRouteMilestone failed path=${streamLogPath} scope=${scope}: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-}
-function runFormSpawn(opts) {
-  const { scriptPath, args, streamLogPath, correlationId, timeoutMs, log, logErr, broadcast } = opts;
-  return new Promise((resolveP) => {
-    let tailer = null;
-    try {
-      tailer = startScriptStreamTailer({
-        path: streamLogPath,
-        onEvent: (event) => {
-          try {
-            broadcast(correlationId, event);
-          } catch (e) {
-            logErr(
-              `phase=tailer-broadcast-failed detail="${e instanceof Error ? e.message : String(e)}"`
-            );
-          }
-        },
-        onError: (e) => {
-          logErr(`phase=tailer-error message="${e.message.slice(0, 160).replace(/"/g, "'")}"`);
-        }
-      });
-      log(`phase=tailer-started`);
-    } catch (e) {
-      logErr(`phase=tailer-start-failed detail="${e instanceof Error ? e.message : String(e)}"`);
-      tailer = null;
-    }
-    const child = childProcess.spawn(scriptPath, args, {
-      env: { ...process.env, STREAM_LOG_PATH: streamLogPath },
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    log(`phase=script-spawn pid=${child.pid ?? "unknown"} args="${args.join(" ")}"`);
-    let stdout = "";
-    let stderr = "";
-    let timedOut = false;
-    const killer = setTimeout(() => {
-      timedOut = true;
-      try {
-        child.kill("SIGTERM");
-      } catch {
-      }
-    }, timeoutMs);
-    child.stdout?.on("data", (chunk) => {
-      stdout += chunk.toString("utf-8");
-    });
-    child.stderr?.on("data", (chunk) => {
-      stderr += chunk.toString("utf-8");
-    });
-    let finalized = false;
-    const finalize = async (result) => {
-      if (finalized) return;
-      finalized = true;
-      if (tailer) {
-        try {
-          await tailer.stop();
-          log(`phase=tailer-stopped`);
-        } catch (e) {
-          logErr(
-            `phase=tailer-stop-failed detail="${e instanceof Error ? e.message : String(e)}"`
-          );
-        }
-      }
-      resolveP(result);
-    };
-    child.on("error", (e) => {
-      clearTimeout(killer);
-      void finalize({
-        code: null,
-        signal: null,
-        stdout,
-        stderr: `${stderr}
-${e.message}`,
-        timedOut: false
-      });
-    });
-    child.on("exit", (code, signal) => {
-      clearTimeout(killer);
-      log(
-        `phase=script-exit code=${code ?? "null"} signal=${signal ?? "null"} timedOut=${timedOut}`
-      );
-      void finalize({ code, signal, stdout, stderr, timedOut });
-    });
-  });
-}
-
-// app/lib/admin-sse-registry.ts
-var activeAdminSSEControllers = /* @__PURE__ */ new Set();
-function broadcastAdminShutdown(reason) {
-  const encoder = new TextEncoder();
-  const payload = JSON.stringify({ type: "server_shutdown", reason });
-  const frame = encoder.encode(`data: ${payload}
-
-`);
-  const done = encoder.encode(`data: [DONE]
-
-`);
-  for (const entry of activeAdminSSEControllers) {
-    try {
-      entry.controller.enqueue(frame);
-    } catch {
-    }
-    try {
-      entry.controller.enqueue(done);
-    } catch {
-    }
-    try {
-      entry.controller.close();
-    } catch {
-    }
-  }
-  activeAdminSSEControllers.clear();
-}
-function broadcastToConversation(conversationId, event) {
-  const encoder = new TextEncoder();
-  const frame = encoder.encode(`data: ${JSON.stringify(event)}
-
-`);
-  for (const entry of activeAdminSSEControllers) {
-    if (entry.conversationId !== conversationId) continue;
-    try {
-      entry.controller.enqueue(frame);
-    } catch {
-    }
-  }
-}
-
-// app/lib/cloudflare-setup-types.ts
-var CLOUDFLARE_SETUP_FORM_SCHEMA = {
-  secretFields: ["password", "session_key", "messageId"]
-};
-
-// app/lib/cloudflare-bundle-mtime.ts
-import { statSync as statSync8 } from "fs";
-var cachedBundleMtimeIso;
-function getBundleMtimeIso(entry = process.argv[1]) {
-  if (cachedBundleMtimeIso !== void 0) return cachedBundleMtimeIso;
-  if (!entry) {
-    process.stderr.write(`[bundle-mtime] fallback reason=empty-path
-`);
-    cachedBundleMtimeIso = "unknown";
-    return cachedBundleMtimeIso;
-  }
-  try {
-    cachedBundleMtimeIso = statSync8(entry).mtime.toISOString();
-  } catch (e) {
-    const reason = e instanceof Error ? e.message : String(e);
-    process.stderr.write(`[bundle-mtime] fallback reason=stat-threw error="${reason}"
-`);
-    cachedBundleMtimeIso = "unknown";
-  }
-  return cachedBundleMtimeIso;
-}
-function decideRetryBranch(args) {
-  const { bundleMtimeIso, prior } = args;
-  if (!prior || prior.outcome !== "failed") return "proceed";
-  if (bundleMtimeIso === "unknown") return "surface-error";
-  return bundleMtimeIso > prior.completedAt ? "re-invoke" : "surface-error";
-}
-
-// server/routes/admin/cloudflare.ts
-function cloudflareStreamLogPath(accountId, correlationId) {
-  return resolve14(ACCOUNTS_DIR, accountId, "cloudflare-stream-logs", `${correlationId}.log`);
-}
-var SETUP_TIMEOUT_MS = 10 * 60 * 1e3;
-var DOMAINS_TIMEOUT_MS = 40 * 1e3;
-var discoveryCache = /* @__PURE__ */ new Map();
-function getDiscoveryEntry(accountId) {
-  let entry = discoveryCache.get(accountId);
-  if (!entry) {
-    entry = { tunnels: [], domains: [] };
-    discoveryCache.set(accountId, entry);
-  }
-  return entry;
-}
-function rememberDomains(accountId, domains) {
-  const entry = getDiscoveryEntry(accountId);
-  entry.domains = domains;
-  entry.domainsUpdatedAt = Date.now();
-}
-function rememberTunnels(accountId, tunnels) {
-  const entry = getDiscoveryEntry(accountId);
-  entry.tunnels = tunnels;
-  entry.tunnelsUpdatedAt = Date.now();
-}
-function readDiscoveryResults(accountId) {
-  if (!accountId) return { tunnels: [], domains: [] };
-  const entry = discoveryCache.get(accountId);
-  if (!entry) return { tunnels: [], domains: [] };
-  return { tunnels: entry.tunnels, domains: entry.domains };
-}
-function loadBrandInfo() {
-  const platformRoot = process.env.MAXY_PLATFORM_ROOT ?? resolve14(process.cwd(), "..");
-  const brandPath = resolve14(platformRoot, "config", "brand.json");
-  try {
-    const parsed = JSON.parse(readFileSync17(brandPath, "utf-8"));
-    const hostname2 = typeof parsed.hostname === "string" && parsed.hostname ? parsed.hostname : "maxy";
-    const configDir2 = typeof parsed.configDir === "string" && parsed.configDir ? parsed.configDir : ".maxy";
-    return { hostname: hostname2, configDir: configDir2 };
-  } catch {
-    return { hostname: "maxy", configDir: ".maxy" };
-  }
-}
-function resolvePort() {
-  const raw = process.env.PORT;
-  if (!raw) throw new Error("PORT env var is not set \u2014 refusing to guess");
-  const n = Number(raw);
-  if (!Number.isInteger(n) || n <= 0 || n > 65535) {
-    throw new Error(`PORT env var is not a valid port: ${raw}`);
-  }
-  return n;
-}
-function isValidTunnelId(s) {
-  return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(s);
-}
-function isValidTunnelName(s) {
-  return /^[A-Za-z0-9_.-]{1,64}$/.test(s);
-}
-function validateBody(body) {
-  if (!body || typeof body !== "object") return { field: "request", message: "Invalid request body" };
-  if (typeof body.adminLabel !== "string" || !isValidLabel(body.adminLabel)) {
-    return { field: "admin", message: "Admin address is invalid." };
-  }
-  if (typeof body.adminDomain !== "string" || !isValidDomain(body.adminDomain)) {
-    return { field: "admin", message: "Admin domain is invalid." };
-  }
-  if (body.publicLabel !== void 0 && body.publicLabel !== "") {
-    if (typeof body.publicLabel !== "string" || !isValidLabel(body.publicLabel)) {
-      return { field: "public", message: "Public address is invalid." };
-    }
-    if (typeof body.publicDomain !== "string" || !isValidDomain(body.publicDomain)) {
-      return { field: "public", message: "Public domain is invalid." };
-    }
-  }
-  if (typeof body.password !== "string" || !isPasswordValid(body.password)) {
-    return { field: "password", message: "Password does not meet the strength requirements." };
-  }
-  if (body.apex !== void 0 && body.apex !== "") {
-    if (typeof body.apex !== "string" || !isValidDomain(body.apex)) {
-      return { field: "request", message: "Apex must be a valid domain or omitted." };
-    }
-  }
-  const idSet = typeof body.tunnelId === "string" && body.tunnelId.length > 0;
-  const nameSet = typeof body.tunnelName === "string" && body.tunnelName.length > 0;
-  if (!idSet && !nameSet) {
-    return { field: "tunnel", message: "Pick an existing tunnel from the list, or type a name to create a new one." };
-  }
-  if (idSet && nameSet) {
-    return { field: "tunnel", message: "Pick OR create \u2014 not both. Clear one of the tunnel inputs." };
-  }
-  if (idSet && !isValidTunnelId(body.tunnelId)) {
-    return { field: "tunnel", message: "Selected tunnel UUID is malformed." };
-  }
-  if (nameSet && !isValidTunnelName(body.tunnelName)) {
-    return { field: "tunnel", message: "New-tunnel name must be 1\u201364 characters of letters, digits, dot, dash, underscore." };
-  }
-  return null;
-}
-var app21 = new Hono();
-function fieldFromReason(reason) {
-  switch (reason) {
-    case "not-signed-in":
-      return "dashboard";
-    case "brand-arg-missing":
-    case "brand-config-missing":
-    case "cdp-port-unresolved":
-      return "config";
-    case "cdp-unreachable":
-    case "target-create-failed":
-    case "ws-connect-failed":
-    case "navigate-failed":
-    case "runtime-error":
-    case "table-wait-timeout":
-    case "entry-missing":
-    case "wrapper-timeout":
-    default:
-      return "script";
-  }
-}
-app21.get("/domains", requireAdminSession, async (c) => {
-  const started = Date.now();
-  const cacheKey = c.var.cacheKey;
-  let correlationId;
-  let cacheKeyTail;
-  let streamLogPath;
-  function tag() {
-    if (!correlationId) return "";
-    return ` conversationId=${correlationId} session_key=${cacheKeyTail ?? "unknown"}`;
-  }
-  function log(line) {
-    console.log(`[cloudflare-domains] ${line}${tag()}`);
-  }
-  function logErr(line) {
-    console.error(`[cloudflare-domains] ${line}${tag()}`);
-  }
-  function err(field, message, output, brand2) {
-    logErr(`phase=error field=${field} reason="${message.slice(0, 160).replace(/"/g, "'")}"`);
-    if (streamLogPath) {
-      writeRouteMilestone(
-        streamLogPath,
-        "cloudflare-domains",
-        `phase=error field=${field} reason="${message.slice(0, 160).replace(/"/g, "'")}"`
-      );
-    }
-    const body = {
-      ok: false,
-      field,
-      message,
-      output,
-      correlationId,
-      streamLogPath,
-      brand: brand2
-    };
-    return c.json(body, 200);
-  }
-  const accountId = getAccountIdForSession(cacheKey);
-  correlationId = getConversationIdForSession(cacheKey);
-  cacheKeyTail = cacheKey.slice(-8);
-  if (!accountId) return err("session", "No account bound to session \u2014 refresh chat.");
-  if (!correlationId) return err("session", "No active conversation for session \u2014 refresh chat.");
-  streamLogPath = cloudflareStreamLogPath(accountId, correlationId);
-  log(`phase=stream-log-resolved path=${streamLogPath}`);
-  const brand = loadBrandInfo();
-  const scriptPath = resolve14(homedir4(), "list-cf-domains.sh");
-  const result = await runFormSpawn({
-    scriptPath,
-    args: [brand.hostname],
-    streamLogPath,
-    correlationId,
-    timeoutMs: DOMAINS_TIMEOUT_MS,
-    log,
-    logErr,
-    broadcast: broadcastToConversation
-  });
-  const combined = `${result.stdout}${result.stderr ? `
----
-${result.stderr}` : ""}`;
-  if (result.code !== 0) {
-    const reasonMatch = result.stderr.match(/reason=([a-z0-9-]+)/);
-    const reason = reasonMatch ? reasonMatch[1] : void 0;
-    const field = fieldFromReason(reason);
-    const message = reason ? `Domain discovery failed: ${reason}` : result.timedOut ? `Domain discovery timed out after ${DOMAINS_TIMEOUT_MS / 1e3}s` : `Domain discovery exited with code ${result.code ?? "null"}${result.signal ? ` (signal ${result.signal})` : ""}`;
-    return err(field, message, combined, field === "config" ? brand.hostname : void 0);
-  }
-  let domains;
-  try {
-    const parsed = JSON.parse(result.stdout.trim());
-    if (!Array.isArray(parsed) || !parsed.every((d) => typeof d === "string")) {
-      throw new Error("response is not string[]");
-    }
-    domains = parsed;
-  } catch (e) {
-    return err(
-      "script",
-      `Domain discovery returned malformed output: ${e instanceof Error ? e.message : String(e)}`,
-      combined
-    );
-  }
-  const success = {
-    ok: true,
-    domains,
-    correlationId,
-    streamLogPath
-  };
-  rememberDomains(accountId, domains);
-  const total = Date.now() - started;
-  log(`phase=response-sent total_ms=${total} count=${domains.length}`);
-  writeRouteMilestone(
-    streamLogPath,
-    "cloudflare-domains",
-    `phase=response-sent total_ms=${total} count=${domains.length}`
-  );
-  return c.json(success, 200);
-});
-var TUNNELS_TIMEOUT_MS = 30 * 1e3;
-app21.get("/tunnels", requireAdminSession, async (c) => {
-  const started = Date.now();
-  const cacheKey = c.var.cacheKey;
-  let correlationId;
-  let cacheKeyTail;
-  let streamLogPath;
-  function tag() {
-    if (!correlationId) return "";
-    return ` conversationId=${correlationId} session_key=${cacheKeyTail ?? "unknown"}`;
-  }
-  function log(line) {
-    console.log(`[cloudflare-tunnels] ${line}${tag()}`);
-  }
-  function logErr(line) {
-    console.error(`[cloudflare-tunnels] ${line}${tag()}`);
-  }
-  const brand = loadBrandInfo();
-  const { hostname: deviceHostnameFn } = await import("os");
-  const rawDeviceHostname = (deviceHostnameFn() || "").split(".")[0];
-  const sanitizedDevice = rawDeviceHostname.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "") || "device";
-  const defaultName = `${brand.hostname}-${sanitizedDevice}`;
-  function err(field, message, output) {
-    logErr(`phase=error field=${field} reason="${message.slice(0, 160).replace(/"/g, "'")}"`);
-    if (streamLogPath) {
-      writeRouteMilestone(
-        streamLogPath,
-        "cloudflare-tunnels",
-        `phase=error field=${field} reason="${message.slice(0, 160).replace(/"/g, "'")}"`
-      );
-    }
-    const body = { ok: false, field, message, output, defaultName, correlationId, streamLogPath };
-    return c.json(body, 200);
-  }
-  const accountId = getAccountIdForSession(cacheKey);
-  correlationId = getConversationIdForSession(cacheKey);
-  cacheKeyTail = cacheKey.slice(-8);
-  if (!accountId) return err("session", "No account bound to session \u2014 refresh chat.");
-  if (!correlationId) return err("session", "No active conversation for session \u2014 refresh chat.");
-  streamLogPath = cloudflareStreamLogPath(accountId, correlationId);
-  const certPath = resolve14(homedir4(), brand.configDir, "cloudflared", "cert.pem");
-  const { existsSync: existsSync24 } = await import("fs");
-  if (!existsSync24(certPath)) {
-    return err("cert", `Cloudflare origin certificate is not on disk yet (${certPath}). Complete the Cloudflare login first by submitting the form once \u2014 the OAuth flow writes cert.pem.`);
-  }
-  const result = await runFormSpawn({
-    scriptPath: "cloudflared",
-    args: ["--origincert", certPath, "tunnel", "list", "--output", "json"],
-    streamLogPath,
-    correlationId,
-    timeoutMs: TUNNELS_TIMEOUT_MS,
-    log,
-    logErr,
-    broadcast: broadcastToConversation
-  });
-  const combined = `${result.stdout}${result.stderr ? `
----
-${result.stderr}` : ""}`;
-  if (result.code !== 0) {
-    const message = result.timedOut ? `cloudflared tunnel list timed out after ${TUNNELS_TIMEOUT_MS / 1e3}s` : `cloudflared tunnel list exited with code ${result.code ?? "null"}${result.signal ? ` (signal ${result.signal})` : ""}`;
-    return err("script", message, combined);
-  }
-  let tunnels;
-  let nullNormalised = false;
-  try {
-    const parsed = JSON.parse(result.stdout.trim());
-    if (parsed === null) {
-      tunnels = [];
-      nullNormalised = true;
-    } else if (!Array.isArray(parsed)) {
-      throw new Error("cloudflared response is not an array");
-    } else {
-      tunnels = parsed.filter((t) => t.deleted_at == null).map((t) => {
-        if (typeof t.id !== "string" || typeof t.name !== "string") {
-          throw new Error("tunnel entry missing id or name");
-        }
-        return { id: t.id, name: t.name };
-      });
-    }
-  } catch (e) {
-    return err(
-      "script",
-      `cloudflared returned malformed JSON: ${e instanceof Error ? e.message : String(e)}`,
-      combined
-    );
-  }
-  const total = Date.now() - started;
-  const nullTag = nullNormalised ? " null_normalised=true" : "";
-  log(`phase=response-sent total_ms=${total} count=${tunnels.length}${nullTag}`);
-  writeRouteMilestone(
-    streamLogPath,
-    "cloudflare-tunnels",
-    `phase=response-sent total_ms=${total} count=${tunnels.length} source=cloudflared${nullTag}`
-  );
-  rememberTunnels(accountId, tunnels);
-  const success = { ok: true, tunnels, defaultName, correlationId, streamLogPath };
-  return c.json(success, 200);
-});
-app21.post("/setup", requireAdminSession, async (c) => {
-  const started = Date.now();
-  const cacheKey = c.var.cacheKey;
-  let correlationId;
-  let cacheKeyTail;
-  let streamLogPath;
-  let resolvedAccountId;
-  const heldInputs = {};
-  function tag() {
-    if (!correlationId) return "";
-    return ` conversationId=${correlationId} session_key=${cacheKeyTail ?? "unknown"}`;
-  }
-  function log(line) {
-    console.log(`[cloudflare-setup] ${line}${tag()}`);
-  }
-  function logErr(line) {
-    console.error(`[cloudflare-setup] ${line}${tag()}`);
-  }
-  function err(field, message, output) {
-    logErr(`phase=error field=${field} reason="${message.slice(0, 160).replace(/"/g, "'")}"`);
-    if (streamLogPath) {
-      writeRouteMilestone(
-        streamLogPath,
-        "cloudflare-setup",
-        `phase=error field=${field} reason="${message.slice(0, 160).replace(/"/g, "'")}"`
-      );
-    }
-    const body2 = {
-      ok: false,
-      field,
-      message,
-      output,
-      correlationId,
-      streamLogPath,
-      inputsAlreadyHeld: { ...heldInputs },
-      discoveryResults: readDiscoveryResults(resolvedAccountId)
-    };
-    return c.json(body2, 200);
-  }
-  function ok(result) {
-    return c.json(result, 200);
-  }
-  let body;
-  try {
-    body = await c.req.json();
-  } catch {
-    return err("request", "Invalid JSON body");
-  }
-  const accountId = getAccountIdForSession(cacheKey);
-  correlationId = getConversationIdForSession(cacheKey);
-  cacheKeyTail = cacheKey.slice(-8);
-  if (!accountId) {
-    return err("request", "No account bound to session \u2014 refresh chat.");
-  }
-  resolvedAccountId = accountId;
-  if (!correlationId) {
-    return err("request", "No active conversation for session \u2014 refresh chat.");
-  }
-  const invalid = validateBody(body);
-  if (invalid) return err(invalid.field, invalid.message);
-  const adminFqdn = `${body.adminLabel}.${body.adminDomain}`;
-  const publicFqdn = body.publicLabel ? `${body.publicLabel}.${body.publicDomain}` : void 0;
-  const apex = body.apex && body.apex.length > 0 ? body.apex : void 0;
-  heldInputs.admin = adminFqdn;
-  if (publicFqdn) heldInputs.public = publicFqdn;
-  if (apex) heldInputs.apex = apex;
-  log(`phase=submit-received admin=${adminFqdn} public=${publicFqdn ?? "absent"} apex=${apex ?? "absent"}`);
-  const bundleMtimeIso = getBundleMtimeIso();
-  try {
-    const prior = await findMostRecentTerminalCloudflareTask(accountId, correlationId);
-    const branch = decideRetryBranch({ bundleMtimeIso, prior });
-    const lastErrorAt = prior && prior.outcome === "failed" ? prior.completedAt : "none";
-    log(`retry-decision bundleMtime=${bundleMtimeIso} lastErrorAt=${lastErrorAt} branch=${branch}`);
-    if (branch === "surface-error" && prior) {
-      const literal = prior.errorMessage ?? CLOUDFLARE_TASK_DIAGNOSTICS.scriptExitedNonzero;
-      return err("script", literal);
-    }
-  } catch (e) {
-    log(`retry-decision lookup-failed reason="${e instanceof Error ? e.message : String(e)}" branch=proceed`);
-  }
-  const account = resolveAccount();
-  if (!account) {
-    return err("script", "No account on disk for this device \u2014 re-run installer.");
-  }
-  if (account.accountId !== accountId) {
-    return err("script", `Session/device account drift: session=${accountId.slice(0, 8)} device=${account.accountId.slice(0, 8)}`);
-  }
-  const accountDir = account.accountDir;
-  try {
-    await setRemotePassword(body.password);
-    log(`phase=password-set`);
-  } catch (e) {
-    return err("password", `Failed to write password: ${e instanceof Error ? e.message : String(e)}`);
-  }
-  let brand;
-  let port2;
-  try {
-    brand = loadBrandInfo();
-    port2 = resolvePort();
-  } catch (e) {
-    return err("script", `Server misconfigured: ${e instanceof Error ? e.message : String(e)}`);
-  }
-  streamLogPath = cloudflareStreamLogPath(accountId, correlationId);
-  log(`phase=stream-log-resolved path=${streamLogPath}`);
-  const args = [brand.hostname, String(port2), adminFqdn];
-  if (publicFqdn) args.push(publicFqdn);
-  if (apex) args.push(apex);
-  if (await isActionActive("cloudflare-setup")) {
-    return err("request", "Another Cloudflare setup is already running. Wait for it to finish before starting a new one.");
-  }
-  const taskInputs = {};
-  for (const [key, value] of Object.entries(body)) {
-    if (value !== void 0 && value !== null && value !== "") {
-      taskInputs[key] = value;
-    }
-  }
-  let cloudflareTask;
-  try {
-    cloudflareTask = await openCloudflareTask({
-      accountId,
-      conversationId: correlationId,
-      inputsProvided: Object.keys(taskInputs),
-      inputs: taskInputs,
-      inputSchema: CLOUDFLARE_SETUP_FORM_SCHEMA,
-      messageId: typeof body.messageId === "string" && body.messageId.length > 0 ? body.messageId : void 0
-    });
-    log(`phase=task-opened taskId=${cloudflareTask.taskId}`);
-  } catch (e) {
-    return err("script", `Failed to open process-provenance Task record: ${e instanceof Error ? e.message : String(e)}`);
-  }
-  let actionId;
-  let unit;
-  try {
-    const launched = await launchAction("cloudflare-setup", {
-      positional: args,
-      streamLogPath,
-      accountDir,
-      tunnelId: typeof body.tunnelId === "string" && body.tunnelId.length > 0 ? body.tunnelId : void 0,
-      tunnelName: typeof body.tunnelName === "string" && body.tunnelName.length > 0 ? body.tunnelName : void 0
-    });
-    actionId = launched.actionId;
-    unit = launched.unit;
-  } catch (e) {
-    return err("script", `Failed to launch cloudflare-setup action: ${e instanceof Error ? e.message : String(e)}`);
-  }
-  log(`phase=action-launched id=${actionId} unit=${unit}`);
-  void (async () => {
-    const status = await waitForExit(unit, SETUP_TIMEOUT_MS);
-    try {
-      const appendedSteps = await appendCloudflareSteps(cloudflareTask.taskId, accountId, streamLogPath);
-      log(`phase=task-steps-appended count=${appendedSteps.length}`);
-    } catch (e) {
-      logErr(`phase=task-steps-append-failed reason="${e instanceof Error ? e.message : String(e)}"`);
-    }
-    let unitGoneWithDiskProof = false;
-    if (status === null) {
-      const verdict = resolveUnitGoneVerdict({
-        tunnelState: readTunnelState(brand.configDir),
-        expected: { tunnelName: body.tunnelName, tunnelId: body.tunnelId }
-      });
-      const resolution = verdict.kind === "close-completed" ? "close-completed" : "close-failed-diagnostic";
-      log(`phase=post-exit-disk-check tunnel-state-found=${verdict.tunnelStateFound} identity-match=${verdict.identityMatch} resolution=${resolution}`);
-      if (verdict.kind === "close-failed") {
-        try {
-          await completeCloudflareTask({
-            taskId: cloudflareTask.taskId,
-            taskElementId: cloudflareTask.taskElementId,
-            accountId,
-            conversationId: correlationId,
-            status: "failed",
-            errorMessage: CLOUDFLARE_TASK_DIAGNOSTICS.endpointDiedPreReconcile
-          });
-        } catch (e) {
-          logErr(`phase=task-close-failed status=failed reason="${e instanceof Error ? e.message : String(e)}"`);
-        }
-        return;
-      }
-      unitGoneWithDiskProof = true;
-    } else if (status.execMainStatus !== 0) {
-      logErr(`phase=post-exit-skipped reason=exit=${status.execMainStatus} id=${actionId}`);
-      try {
-        await completeCloudflareTask({
-          taskId: cloudflareTask.taskId,
-          taskElementId: cloudflareTask.taskElementId,
-          accountId,
-          conversationId: correlationId,
-          status: "failed",
-          errorMessage: `${CLOUDFLARE_TASK_DIAGNOSTICS.scriptExitedNonzero} exit=${status.execMainStatus}`
-        });
-      } catch (e) {
-        logErr(`phase=task-close-failed status=failed reason="${e instanceof Error ? e.message : String(e)}"`);
-      }
-      return;
-    }
-    if (!unitGoneWithDiskProof) {
-      const candidates = [publicFqdn, apex].filter((h) => typeof h === "string" && h.length > 0);
-      for (const host of candidates) {
-        if (host === adminFqdn) {
-          log(`phase=alias-domain-write host=${host} result=skipped-admin`);
-          continue;
-        }
-        if (host.startsWith("public.")) {
-          log(`phase=alias-domain-write host=${host} result=skipped-public-prefix`);
-          continue;
-        }
-        try {
-          addAliasDomain(host);
-          log(`phase=alias-domain-write host=${host} result=written`);
-        } catch (e) {
-          logErr(`phase=alias-domain-write host=${host} result=error reason="${e instanceof Error ? e.message : String(e)}"`);
-        }
-      }
-    }
-    try {
-      const tunnelState = readTunnelState(brand.configDir);
-      const allHostnames = [adminFqdn, publicFqdn, apex].filter(
-        (h) => typeof h === "string" && h.length > 0
-      );
-      const hostnameRecords = allHostnames.map((value) => ({
-        hostnameValue: value,
-        // Apex heuristic: exactly one dot in the FQDN. Mirrors setup-tunnel.sh:332.
-        isApex: (value.match(/\./g)?.length ?? 0) === 1
-      }));
-      await completeCloudflareTask({
-        taskId: cloudflareTask.taskId,
-        taskElementId: cloudflareTask.taskElementId,
-        accountId,
-        conversationId: correlationId,
-        tunnelId: tunnelState?.tunnelId,
-        tunnelName: tunnelState?.tunnelName,
-        hostnames: tunnelState ? hostnameRecords : void 0,
-        status: "completed"
-      });
-      log(`phase=task-closed status=completed tunnelId=${tunnelState?.tunnelId ?? "absent"} hostnames=${allHostnames.length}`);
-    } catch (e) {
-      logErr(`phase=task-close-failed status=completed reason="${e instanceof Error ? e.message : String(e)}"`);
-    }
-    log(`phase=done action=${actionId}`);
-  })().catch((e) => logErr(`post-exit handler threw: ${e}`));
-  const total = Date.now() - started;
-  log(`phase=response-sent action_id=${actionId} total_ms=${total}`);
-  writeRouteMilestone(
-    streamLogPath,
-    "cloudflare-setup",
-    `phase=action-launched id=${actionId}`
-  );
-  const success = {
-    ok: true,
-    output: `Action launched \u2014 see live log in the form panel.
-actionId: ${actionId}`,
-    adminFqdn,
-    publicFqdn,
-    apex,
-    aliasesWritten: [],
-    actionId
-  };
-  return ok(success);
-});
-var cloudflare_default = app21;
+var events_default = app17;
 
 // server/routes/admin/files.ts
-import { createReadStream as createReadStream3 } from "fs";
+import { createReadStream as createReadStream2 } from "fs";
 import { readdir as readdir2, readFile as readFile4, stat as stat4, mkdir as mkdir3, writeFile as writeFile4, unlink as unlink2 } from "fs/promises";
 import { realpathSync as realpathSync4 } from "fs";
-import { basename as basename4, dirname as dirname6, join as join12, resolve as resolve16, sep as sep3 } from "path";
+import { basename as basename4, dirname as dirname4, join as join12, resolve as resolve14, sep as sep3 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // app/lib/data-path.ts
 import { realpathSync as realpathSync3 } from "fs";
-import { resolve as resolve15, normalize, sep as sep2, relative } from "path";
-var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT ?? resolve15(process.cwd(), "../platform");
-var DATA_ROOT = resolve15(PLATFORM_ROOT5, "..", "data");
+import { resolve as resolve13, normalize, sep as sep2, relative } from "path";
+var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT ?? resolve13(process.cwd(), "../platform");
+var DATA_ROOT = resolve13(PLATFORM_ROOT5, "..", "data");
 function resolveDataPath(raw) {
   const cleaned = normalize("/" + (raw ?? "").replace(/\\/g, "/")).replace(/^\/+/, "");
-  const absolute = resolve15(DATA_ROOT, cleaned);
+  const absolute = resolve13(DATA_ROOT, cleaned);
   let dataRootReal;
   try {
     dataRootReal = realpathSync3(DATA_ROOT);
@@ -10192,7 +9104,7 @@ async function readMeta(absDir, baseName) {
 }
 async function readAccountNames() {
   const map = /* @__PURE__ */ new Map();
-  const accountsDir = resolve16(DATA_ROOT, "accounts");
+  const accountsDir = resolve14(DATA_ROOT, "accounts");
   let names;
   try {
     names = await readdir2(accountsDir);
@@ -10201,7 +9113,7 @@ async function readAccountNames() {
   }
   for (const name of names) {
     if (!UUID_RE3.test(name)) continue;
-    const configPath2 = resolve16(accountsDir, name, "account.json");
+    const configPath2 = resolve14(accountsDir, name, "account.json");
     try {
       const raw = await readFile4(configPath2, "utf8");
       const parsed = JSON.parse(raw);
@@ -10250,8 +9162,8 @@ function buildDisplayPath(relPath2, accountNames) {
     return dn ? { name: seg, displayName: dn } : { name: seg };
   });
 }
-var app22 = new Hono();
-app22.get("/", requireAdminSession, async (c) => {
+var app18 = new Hono();
+app18.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   if (!getAccountIdForSession(cacheKey)) {
     console.error(`[data] auth-rejected endpoint="/api/admin/files" reason="no account for session"`);
@@ -10312,7 +9224,7 @@ app22.get("/", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-app22.get("/download", requireAdminSession, async (c) => {
+app18.get("/download", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   if (!getAccountIdForSession(cacheKey)) {
     console.error(`[data] auth-rejected endpoint="/api/admin/files/download" reason="no account for session"`);
@@ -10335,7 +9247,7 @@ app22.get("/download", requireAdminSession, async (c) => {
     }
     const filename = basename4(absolute);
     const mimeType = detectMimeType(absolute);
-    const nodeStream = createReadStream3(absolute);
+    const nodeStream = createReadStream2(absolute);
     const webStream = Readable2.toWeb(nodeStream);
     console.error(`[data] file-download path="${relPath2}" size=${info.size}`);
     const safeQuotedName = filename.replace(/[\r\n"\\]/g, "_");
@@ -10360,7 +9272,7 @@ app22.get("/download", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-app22.post("/upload", requireAdminSession, async (c) => {
+app18.post("/upload", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -10392,8 +9304,8 @@ app22.post("/upload", requireAdminSession, async (c) => {
   }
   const safeName = basename4(file.name).replace(/[\0/\\]/g, "_");
   const finalName = `${Date.now()}-${safeName}`;
-  const destDir = resolve16(DATA_ROOT, "uploads", accountId);
-  const destPath = resolve16(destDir, finalName);
+  const destDir = resolve14(DATA_ROOT, "uploads", accountId);
+  const destPath = resolve14(destDir, finalName);
   try {
     await mkdir3(destDir, { recursive: true });
     const dataRootReal = realpathSync4(DATA_ROOT);
@@ -10418,7 +9330,7 @@ app22.post("/upload", requireAdminSession, async (c) => {
     mimeType: file.type
   });
 });
-app22.delete("/", requireAdminSession, async (c) => {
+app18.delete("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -10451,7 +9363,7 @@ app22.delete("/", requireAdminSession, async (c) => {
     }
     const dot = base.lastIndexOf(".");
     const stem = dot === -1 ? base : base.slice(0, dot);
-    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join12(dirname6(absolute), `${stem}.meta.json`) : null;
+    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join12(dirname4(absolute), `${stem}.meta.json`) : null;
     await unlink2(absolute);
     if (sidecarPath) {
       try {
@@ -10485,7 +9397,7 @@ app22.delete("/", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-var files_default = app22;
+var files_default = app18;
 
 // ../lib/graph-search/src/index.ts
 var import_dist = __toESM(require_dist());
@@ -10865,8 +9777,8 @@ var MAX_LIMIT = 2e3;
 var DEFAULT_VECTOR_THRESHOLD = 0.82;
 var MESSAGE_FAMILY_LABELS = ["Message", "UserMessage", "AssistantMessage", "WhatsAppMessage"];
 var CONVERSATION_PARENT_LABELS = /* @__PURE__ */ new Set(["AdminConversation", "PublicConversation"]);
-var app23 = new Hono();
-app23.get("/", requireAdminSession, async (c) => {
+var app19 = new Hono();
+app19.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const q = (c.req.query("q") ?? "").trim();
   const rawLimit = c.req.query("limit");
@@ -10997,7 +9909,7 @@ app23.get("/", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-var graph_search_default = app23;
+var graph_search_default = app19;
 
 // server/routes/admin/graph-subgraph.ts
 import neo4j from "neo4j-driver";
@@ -11151,8 +10063,8 @@ var STRIPPED_PROPERTIES = /* @__PURE__ */ new Set([
   "otpCode",
   "cacheKey"
 ]);
-var app24 = new Hono();
-app24.get("/", requireAdminSession, async (c) => {
+var app20 = new Hono();
+app20.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -11735,12 +10647,12 @@ function pruneNode(node, warnedClasses, conversationWarnings) {
   }
   return trashed ? { id: node.id, labels, properties, trashed: true } : { id: node.id, labels, properties };
 }
-var graph_subgraph_default = app24;
+var graph_subgraph_default = app20;
 
 // server/routes/admin/graph-delete.ts
 var ALLOWED_BY = ["graph-page", "graph-drag-trash", "graph-side-panel-trash"];
-var app25 = new Hono();
-app25.post("/", requireAdminSession, async (c) => {
+var app21 = new Hono();
+app21.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -11903,11 +10815,11 @@ app25.post("/", requireAdminSession, async (c) => {
     }
   }
 });
-var graph_delete_default = app25;
+var graph_delete_default = app21;
 
 // server/routes/admin/graph-restore.ts
-var app26 = new Hono();
-app26.post("/", requireAdminSession, async (c) => {
+var app22 = new Hono();
+app22.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -11971,11 +10883,11 @@ app26.post("/", requireAdminSession, async (c) => {
     }
   }
 });
-var graph_restore_default = app26;
+var graph_restore_default = app22;
 
 // server/routes/admin/graph-labels-in-graph.ts
-var app27 = new Hono();
-app27.get("/", requireAdminSession, async (c) => {
+var app23 = new Hono();
+app23.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -12041,11 +10953,11 @@ var LABELS_IN_GRAPH_CYPHER = `
        sum(halfEdges) AS relDegree
   RETURN label, nodeCount, relDegree
 `;
-var graph_labels_in_graph_default = app27;
+var graph_labels_in_graph_default = app23;
 
 // server/routes/admin/graph-default-view.ts
-var app28 = new Hono();
-app28.get("/", requireAdminSession, async (c) => {
+var app24 = new Hono();
+app24.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   const userId = getUserIdForSession(cacheKey);
@@ -12083,7 +10995,7 @@ app28.get("/", requireAdminSession, async (c) => {
     }
   }
 });
-app28.put("/", requireAdminSession, async (c) => {
+app24.put("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   const userId = getUserIdForSession(cacheKey);
@@ -12095,7 +11007,7 @@ app28.put("/", requireAdminSession, async (c) => {
   if (!body) {
     return c.json({ error: "Request body must be JSON" }, 400);
   }
-  const validation = validateBody2(body);
+  const validation = validateBody(body);
   if (!validation.ok) {
     console.error(
       `[graph-page] default-view-rejected op=save account=${accountId} reason="${validation.reason}"`
@@ -12136,7 +11048,7 @@ app28.put("/", requireAdminSession, async (c) => {
     }
   }
 });
-function validateBody2(body) {
+function validateBody(body) {
   if (!Array.isArray(body.labels)) {
     return { ok: false, code: "shape", reason: "labels must be an array of strings" };
   }
@@ -12172,13 +11084,13 @@ var WRITE_CYPHER = `
       p.updatedAt = $updatedAt
   RETURN p.labels AS labels
 `;
-var graph_default_view_default = app28;
+var graph_default_view_default = app24;
 
 // server/routes/admin/session-defaults.ts
-var app29 = new Hono();
+var app25 = new Hono();
 var MODE_OPTIONS = ["default", "acceptEdits", "plan", "auto", "bypassPermissions"];
 var MODEL_OPTIONS = ["claude-opus-4-7", "claude-sonnet-4-6", "claude-haiku-4-5"];
-app29.get("/", requireAdminSession, async (c) => {
+app25.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   const userId = getUserIdForSession(cacheKey);
@@ -12216,7 +11128,7 @@ app29.get("/", requireAdminSession, async (c) => {
     }
   }
 });
-app29.put("/", requireAdminSession, async (c) => {
+app25.put("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   const userId = getUserIdForSession(cacheKey);
@@ -12228,7 +11140,7 @@ app29.put("/", requireAdminSession, async (c) => {
   if (!body) {
     return c.json({ error: "Request body must be JSON" }, 400);
   }
-  const validation = validateBody3(body);
+  const validation = validateBody2(body);
   if (!validation.ok) {
     console.error(
       `[session-defaults] rejected op=save account=${accountId} reason="${validation.reason}"`
@@ -12267,7 +11179,7 @@ app29.put("/", requireAdminSession, async (c) => {
     }
   }
 });
-function validateBody3(body) {
+function validateBody2(body) {
   if (typeof body.permissionMode !== "string") {
     return { ok: false, reason: "permissionMode must be a string" };
   }
@@ -12300,11 +11212,11 @@ var WRITE_CYPHER2 = `
       p.updatedAt = $updatedAt
   RETURN p.permissionMode AS permissionMode
 `;
-var session_defaults_default = app29;
+var session_defaults_default = app25;
 
 // server/routes/admin/file-attach.ts
-var app30 = new Hono();
-app30.post("/", async (c) => {
+var app26 = new Hono();
+app26.post("/", async (c) => {
   try {
     const body = await c.req.json();
     const { filePath, accountId } = body;
@@ -12327,18 +11239,18 @@ app30.post("/", async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-var file_attach_default = app30;
+var file_attach_default = app26;
 
 // server/routes/admin/sidebar-artefacts.ts
 import neo4j2 from "neo4j-driver";
 import { readFile as readFile5, readdir as readdir3, stat as stat5 } from "fs/promises";
-import { resolve as resolve17, relative as relative2, isAbsolute } from "path";
+import { resolve as resolve15, relative as relative2, isAbsolute } from "path";
 import { existsSync as existsSync17 } from "fs";
 var LIMIT = 50;
 var TEXT_MIME_PREFIXES = ["text/", "application/json", "application/markdown"];
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
-var app31 = new Hono();
-app31.get("/", requireAdminSession, async (c) => {
+var app27 = new Hono();
+app27.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -12349,7 +11261,7 @@ app31.get("/", requireAdminSession, async (c) => {
   if (docs === null) {
     return c.json({ error: "Failed to load artefacts" }, 500);
   }
-  const accountDir = resolve17(ACCOUNTS_DIR, accountId);
+  const accountDir = resolve15(ACCOUNTS_DIR, accountId);
   const agents = await fetchAgentTemplateRows(accountDir);
   const artefacts = [...docs, ...agents].sort(
     (a, b) => (b.updatedAt ?? "").localeCompare(a.updatedAt ?? "")
@@ -12412,8 +11324,8 @@ async function readArtefactContent(accountId, attachmentId, mimeType, displayNam
     logSkip(displayName, "non-text-mime", mimeType);
     return { content: "", skipReason: "non-text-mime" };
   }
-  const accountDir = resolve17(ATTACHMENTS_ROOT, accountId);
-  const dir = resolve17(accountDir, attachmentId);
+  const accountDir = resolve15(ATTACHMENTS_ROOT, accountId);
+  const dir = resolve15(accountDir, attachmentId);
   try {
     validateFilePathInAccount(dir, accountDir);
   } catch {
@@ -12427,7 +11339,7 @@ async function readArtefactContent(accountId, attachmentId, mimeType, displayNam
       logSkip(displayName, "missing-on-disk", mimeType);
       return { content: "", skipReason: "missing-on-disk" };
     }
-    return { content: await readFile5(resolve17(dir, dataFile), "utf-8"), skipReason: null };
+    return { content: await readFile5(resolve15(dir, dataFile), "utf-8"), skipReason: null };
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     console.error(`[admin/sidebar-artefacts] read-failed attachmentId=${attachmentId.slice(0, 8)} error="${message}"`);
@@ -12443,8 +11355,8 @@ function logSkip(name, reason, mimeType) {
 async function fetchAgentTemplateRows(accountDir) {
   const rows = [];
   for (const filename of ADMIN_AGENT_FILES) {
-    const overridePath = resolve17(accountDir, "agents", "admin", filename);
-    const bundledPath = resolve17(PLATFORM_ROOT, "templates", "agents", "admin", filename);
+    const overridePath = resolve15(accountDir, "agents", "admin", filename);
+    const bundledPath = resolve15(PLATFORM_ROOT, "templates", "agents", "admin", filename);
     const labelStem = filename.replace(/\.md$/, "");
     const row = await readAgentTemplateRow({
       id: `agent-template:admin:${filename}`,
@@ -12458,12 +11370,12 @@ async function fetchAgentTemplateRows(accountDir) {
     });
     if (row) rows.push(row);
   }
-  const overrideDir = resolve17(accountDir, "specialists", "agents");
-  const bundledDir = resolve17(PLATFORM_ROOT, "templates", "specialists", "agents");
+  const overrideDir = resolve15(accountDir, "specialists", "agents");
+  const bundledDir = resolve15(PLATFORM_ROOT, "templates", "specialists", "agents");
   const specialistNames = await unionSpecialistFilenames(overrideDir, bundledDir);
   for (const filename of specialistNames) {
-    const overridePath = resolve17(overrideDir, filename);
-    const bundledPath = resolve17(bundledDir, filename);
+    const overridePath = resolve15(overrideDir, filename);
+    const bundledPath = resolve15(bundledDir, filename);
     const row = await readAgentTemplateRow({
       id: `agent-template:specialist:${filename}`,
       displayName: filename.replace(/\.md$/, ""),
@@ -12544,16 +11456,16 @@ function isWithin(target, root) {
   const rel = relative2(root, target);
   return !rel.startsWith("..") && !isAbsolute(rel);
 }
-var sidebar_artefacts_default = app31;
+var sidebar_artefacts_default = app27;
 
 // server/routes/admin/sidebar-artefact-save.ts
 import { mkdir as mkdir4, readdir as readdir4, stat as stat6, writeFile as writeFile5 } from "fs/promises";
-import { resolve as resolve18 } from "path";
+import { resolve as resolve16 } from "path";
 import { existsSync as existsSync18 } from "fs";
 var ADMIN_AGENT_FILES2 = /* @__PURE__ */ new Set(["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"]);
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-var app32 = new Hono();
-app32.post("/", requireAdminSession, async (c) => {
+var app28 = new Hono();
+app28.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) return c.json({ error: "Account not found for session" }, 401);
@@ -12561,7 +11473,7 @@ app32.post("/", requireAdminSession, async (c) => {
   if (!body || typeof body.id !== "string" || typeof body.content !== "string") {
     return c.json({ error: "id and content required" }, 400);
   }
-  const accountDir = resolve18(ACCOUNTS_DIR, accountId);
+  const accountDir = resolve16(ACCOUNTS_DIR, accountId);
   const resolved = await resolveSavePath(body.id, accountId, accountDir);
   if (resolved.kind === "heal-race") {
     c.header("Retry-After", "2");
@@ -12606,17 +11518,17 @@ async function resolveSavePath(id, accountId, accountDir) {
     if (role !== "admin" || !ADMIN_AGENT_FILES2.has(filename)) {
       return { kind: "reject", status: 400, reason: "invalid-id" };
     }
-    const parent = resolve18(accountDir, "agents", "admin");
+    const parent = resolve16(accountDir, "agents", "admin");
     await mkdir4(parent, { recursive: true });
     try {
       validateFilePathInAccount(parent, accountDir);
     } catch {
       return { kind: "reject", status: 400, reason: "containment-rejected" };
     }
-    return { kind: "admin-template", path: resolve18(parent, filename) };
+    return { kind: "admin-template", path: resolve16(parent, filename) };
   }
   if (UUID_RE4.test(id)) {
-    const dir = resolve18(ATTACHMENTS_ROOT, accountId, id);
+    const dir = resolve16(ATTACHMENTS_ROOT, accountId, id);
     if (!existsSync18(dir)) {
       const attShort = id.slice(0, 8);
       if (isHealPending(accountId, id)) {
@@ -12649,7 +11561,7 @@ async function resolveSavePath(id, accountId, accountDir) {
       }
     }
     try {
-      validateFilePathInAccount(dir, resolve18(ATTACHMENTS_ROOT, accountId));
+      validateFilePathInAccount(dir, resolve16(ATTACHMENTS_ROOT, accountId));
     } catch {
       return { kind: "reject", status: 400, reason: "containment-rejected" };
     }
@@ -12658,22 +11570,22 @@ async function resolveSavePath(id, accountId, accountDir) {
     if (!dataFile) {
       return { kind: "reject", status: 400, reason: "not-found" };
     }
-    return { kind: "knowledge-doc", path: resolve18(dir, dataFile) };
+    return { kind: "knowledge-doc", path: resolve16(dir, dataFile) };
   }
   return { kind: "reject", status: 400, reason: "invalid-id" };
 }
 function relPath(absPath, root) {
   return absPath.startsWith(root) ? absPath.slice(root.length + 1) : absPath;
 }
-var sidebar_artefact_save_default = app32;
+var sidebar_artefact_save_default = app28;
 
 // server/routes/admin/sidebar-artefact-content.ts
 import { readFile as readFile6, readdir as readdir5 } from "fs/promises";
 import { existsSync as existsSync19 } from "fs";
-import { resolve as resolve19 } from "path";
+import { resolve as resolve17 } from "path";
 var UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-var app33 = new Hono();
-app33.get("/", requireAdminSession, async (c) => {
+var app29 = new Hono();
+app29.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) return new Response("Unauthorized", { status: 401 });
@@ -12682,14 +11594,14 @@ app33.get("/", requireAdminSession, async (c) => {
     console.error(`[admin/sidebar-artefact-content] not-found id=${id.slice(0, 8)}`);
     return new Response("Not found", { status: 404 });
   }
-  const dir = resolve19(ATTACHMENTS_ROOT, accountId, id);
+  const dir = resolve17(ATTACHMENTS_ROOT, accountId, id);
   if (!existsSync19(dir)) {
     console.error(`[admin/sidebar-artefact-content] not-found id=${id.slice(0, 8)}`);
     return new Response("Not found", { status: 404 });
   }
   let meta;
   try {
-    meta = JSON.parse(await readFile6(resolve19(dir, `${id}.meta.json`), "utf-8"));
+    meta = JSON.parse(await readFile6(resolve17(dir, `${id}.meta.json`), "utf-8"));
   } catch {
     console.error(`[admin/sidebar-artefact-content] not-found id=${id.slice(0, 8)}`);
     return new Response("Not found", { status: 404 });
@@ -12701,7 +11613,7 @@ app33.get("/", requireAdminSession, async (c) => {
     return new Response("Not found", { status: 404 });
   }
   const start = Date.now();
-  const buffer = await readFile6(resolve19(dir, dataFile));
+  const buffer = await readFile6(resolve17(dir, dataFile));
   const ms = Date.now() - start;
   console.log(
     `[admin/sidebar-artefact-content] account=${accountId} id=${id.slice(0, 8)} mime=${meta.mimeType} bytes=${buffer.length} ms=${ms}`
@@ -12714,7 +11626,7 @@ app33.get("/", requireAdminSession, async (c) => {
     }
   });
 });
-var sidebar_artefact_content_default = app33;
+var sidebar_artefact_content_default = app29;
 
 // server/routes/admin/system-stats.ts
 import { readFile as readFile7 } from "fs/promises";
@@ -12811,8 +11723,8 @@ async function sample() {
   if (process.platform === "linux") return sampleLinux();
   return sampleOsFallback();
 }
-var app34 = new Hono();
-app34.get("/", async (c) => {
+var app30 = new Hono();
+app30.get("/", async (c) => {
   const started = Date.now();
   if (!inflight) {
     inflight = sample().finally(() => {
@@ -12835,27 +11747,27 @@ app34.get("/", async (c) => {
     return c.json({ degraded: true, reason, sampledAtMs: Date.now() });
   }
 });
-var system_stats_default = app34;
+var system_stats_default = app30;
 
 // server/routes/admin/health.ts
-import { existsSync as existsSync20, readFileSync as readFileSync18 } from "fs";
-import { resolve as resolve20, join as join13 } from "path";
-var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve20(process.cwd(), "..");
+import { existsSync as existsSync20, readFileSync as readFileSync16 } from "fs";
+import { resolve as resolve18, join as join13 } from "path";
+var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve18(process.cwd(), "..");
 var brandHostname = "maxy";
 var brandJsonPath = join13(PLATFORM_ROOT6, "config", "brand.json");
 if (existsSync20(brandJsonPath)) {
   try {
-    const brand = JSON.parse(readFileSync18(brandJsonPath, "utf-8"));
+    const brand = JSON.parse(readFileSync16(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
   } catch {
   }
 }
-var VERSION_FILE = resolve20(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
+var VERSION_FILE = resolve18(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
   if (!existsSync20(VERSION_FILE)) return "unknown";
-  return readFileSync18(VERSION_FILE, "utf-8").trim() || "unknown";
+  return readFileSync16(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
   let session;
@@ -12880,8 +11792,8 @@ async function probeConversationDb() {
     });
   }
 }
-var app35 = new Hono();
-app35.get("/", async (c) => {
+var app31 = new Hono();
+app31.get("/", async (c) => {
   const version = readVersion();
   const probe = await probeConversationDb();
   const uptimeMs = Date.now() - new Date(PROCESS_STARTED_AT).getTime();
@@ -12903,7 +11815,7 @@ app35.get("/", async (c) => {
     uptimeMs
   });
 });
-var health_default2 = app35;
+var health_default2 = app31;
 
 // server/routes/admin/linkedin-ingest.ts
 var TAG20 = "[linkedin-ingest-route]";
@@ -12999,8 +11911,8 @@ function buildInitialMessage(env) {
   }
   return header;
 }
-var app36 = new Hono();
-app36.post("/", requireAdminSession, async (c) => {
+var app32 = new Hono();
+app32.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -13050,46 +11962,42 @@ app36.post("/", requireAdminSession, async (c) => {
   );
   return c.json({ ok: true, dispatchId: envelope.dispatchId, taskId: claudeSessionId }, 202);
 });
-var linkedin_ingest_default = app36;
+var linkedin_ingest_default = app32;
 
 // server/routes/admin/index.ts
-var app37 = new Hono();
-app37.route("/session", session_default);
-app37.route("/new-session-failure", new_session_failure_default);
-app37.route("/new-session-submit", new_session_submit_default);
-app37.route("/logs", logs_default);
-app37.route("/claude-info", claude_info_default);
-app37.route("/claude-capabilities", claude_capabilities_default);
-app37.route("/attachment", attachment_default);
-app37.route("/agents", agents_default);
-app37.route("/sessions", sessions_default);
-app37.route("/claude-sessions", claude_sessions_default);
-app37.route("/log-ingest", log_ingest_default);
-app37.route("/browser", browser_default);
-app37.route("/browser-iframe", browser_iframe_default);
-app37.route("/device-browser", device_browser_default);
-app37.route("/events", events_default);
-app37.route("/cloudflare", cloudflare_default);
-app37.route("/files", files_default);
-app37.route("/graph-search", graph_search_default);
-app37.route("/graph-subgraph", graph_subgraph_default);
-app37.route("/graph-delete", graph_delete_default);
-app37.route("/graph-restore", graph_restore_default);
-app37.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app37.route("/graph-default-view", graph_default_view_default);
-app37.route("/session-defaults", session_defaults_default);
-app37.route("/file-attach", file_attach_default);
-app37.route("/sidebar-artefacts", sidebar_artefacts_default);
-app37.route("/sidebar-artefact-save", sidebar_artefact_save_default);
-app37.route("/sidebar-artefact-content", sidebar_artefact_content_default);
-app37.route("/system-stats", system_stats_default);
-app37.route("/health-brand", health_default2);
-app37.route("/linkedin-ingest", linkedin_ingest_default);
-var admin_default = app37;
+var app33 = new Hono();
+app33.route("/session", session_default);
+app33.route("/new-session-failure", new_session_failure_default);
+app33.route("/new-session-submit", new_session_submit_default);
+app33.route("/logs", logs_default);
+app33.route("/claude-info", claude_info_default);
+app33.route("/claude-capabilities", claude_capabilities_default);
+app33.route("/attachment", attachment_default);
+app33.route("/agents", agents_default);
+app33.route("/sessions", sessions_default);
+app33.route("/claude-sessions", claude_sessions_default);
+app33.route("/log-ingest", log_ingest_default);
+app33.route("/events", events_default);
+app33.route("/files", files_default);
+app33.route("/graph-search", graph_search_default);
+app33.route("/graph-subgraph", graph_subgraph_default);
+app33.route("/graph-delete", graph_delete_default);
+app33.route("/graph-restore", graph_restore_default);
+app33.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app33.route("/graph-default-view", graph_default_view_default);
+app33.route("/session-defaults", session_defaults_default);
+app33.route("/file-attach", file_attach_default);
+app33.route("/sidebar-artefacts", sidebar_artefacts_default);
+app33.route("/sidebar-artefact-save", sidebar_artefact_save_default);
+app33.route("/sidebar-artefact-content", sidebar_artefact_content_default);
+app33.route("/system-stats", system_stats_default);
+app33.route("/health-brand", health_default2);
+app33.route("/linkedin-ingest", linkedin_ingest_default);
+var admin_default = app33;
 
 // server/routes/sites.ts
-import { existsSync as existsSync21, readFileSync as readFileSync19, realpathSync as realpathSync5, statSync as statSync9 } from "fs";
-import { resolve as resolve21 } from "path";
+import { existsSync as existsSync21, readFileSync as readFileSync17, realpathSync as realpathSync5, statSync as statSync7 } from "fs";
+import { resolve as resolve19 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
   ".html": "text/html; charset=utf-8",
@@ -13120,8 +12028,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app38 = new Hono();
-app38.get("/:rel{.*}", (c) => {
+var app34 = new Hono();
+app34.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -13146,15 +12054,15 @@ app38.get("/:rel{.*}", (c) => {
     }
     segments.push(seg);
   }
-  const rootDir = resolve21(account.accountDir, "sites");
-  let filePath = segments.length === 0 ? rootDir : resolve21(rootDir, ...segments);
+  const rootDir = resolve19(account.accountDir, "sites");
+  let filePath = segments.length === 0 ? rootDir : resolve19(rootDir, ...segments);
   if (filePath !== rootDir && !filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
   let stat7;
   try {
-    stat7 = existsSync21(filePath) ? statSync9(filePath) : null;
+    stat7 = existsSync21(filePath) ? statSync7(filePath) : null;
   } catch {
     stat7 = null;
   }
@@ -13167,7 +12075,7 @@ app38.get("/:rel{.*}", (c) => {
     return c.redirect(target, 301);
   }
   if (stat7?.isDirectory()) {
-    filePath = resolve21(filePath, "index.html");
+    filePath = resolve19(filePath, "index.html");
   }
   if (!filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
@@ -13192,7 +12100,7 @@ app38.get("/:rel{.*}", (c) => {
   }
   let body;
   try {
-    body = readFileSync19(realPath);
+    body = readFileSync17(realPath);
   } catch (err) {
     const code = err?.code;
     if (code === "EISDIR") {
@@ -13224,7 +12132,7 @@ app38.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app38;
+var sites_default = app34;
 
 // app/lib/graph-health.ts
 var HOUR_MS = 60 * 60 * 1e3;
@@ -13336,10 +12244,38 @@ function startReaper2() {
   startReaper();
 }
 
+// app/lib/admin-sse-registry.ts
+var activeAdminSSEControllers = /* @__PURE__ */ new Set();
+function broadcastAdminShutdown(reason) {
+  const encoder = new TextEncoder();
+  const payload = JSON.stringify({ type: "server_shutdown", reason });
+  const frame = encoder.encode(`data: ${payload}
+
+`);
+  const done = encoder.encode(`data: [DONE]
+
+`);
+  for (const entry of activeAdminSSEControllers) {
+    try {
+      entry.controller.enqueue(frame);
+    } catch {
+    }
+    try {
+      entry.controller.enqueue(done);
+    } catch {
+    }
+    try {
+      entry.controller.close();
+    } catch {
+    }
+  }
+  activeAdminSSEControllers.clear();
+}
+
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash3, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync22, readFileSync as readFileSync20, statSync as statSync10 } from "fs";
-import { resolve as resolve22 } from "path";
+import { existsSync as existsSync22, readFileSync as readFileSync18, statSync as statSync8 } from "fs";
+import { resolve as resolve20 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
 function canonicalize(value) {
@@ -13374,7 +12310,7 @@ var PUBKEY_SHA256 = "8eee6bcb33545fd13b16d3199a5735ca5db5062834c7b49dfe4f23801d9
 var GRACE_DAYS = 7;
 var GRACE_MS = GRACE_DAYS * 24 * 60 * 60 * 1e3;
 function pubkeyPath(brand) {
-  return resolve22(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
+  return resolve20(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
 }
 var memo = null;
 function memoKey(mtimeMs, account) {
@@ -13386,11 +12322,11 @@ function resolveEntitlement(brand, account) {
   if (brand.commercialMode !== true) {
     return logResolved(implicitTrust(account), null);
   }
-  const entitlementPath = resolve22(brand.configDir, "entitlement.json");
+  const entitlementPath = resolve20(brand.configDir, "entitlement.json");
   if (!existsSync22(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
-  const stat7 = statSync10(entitlementPath);
+  const stat7 = statSync8(entitlementPath);
   const key = memoKey(stat7.mtimeMs, account);
   if (memo && memo.key === key) {
     return memo.result;
@@ -13402,7 +12338,7 @@ function resolveEntitlement(brand, account) {
 function verifyAndResolve(brand, entitlementPath, account) {
   let pubkeyPem;
   try {
-    pubkeyPem = readFileSync20(pubkeyPath(brand), "utf-8");
+    pubkeyPem = readFileSync18(pubkeyPath(brand), "utf-8");
   } catch (err) {
     return logResolved(anonymousFallback("pubkey-missing"), {
       reason: "pubkey-missing"
@@ -13416,7 +12352,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(readFileSync20(entitlementPath, "utf-8"));
+    envelope = JSON.parse(readFileSync18(entitlementPath, "utf-8"));
   } catch {
     return logResolved(anonymousFallback("malformed"), { reason: "malformed" });
   }
@@ -13584,7 +12520,7 @@ if (BRAND_JSON_PATH && !existsSync23(BRAND_JSON_PATH)) {
 }
 if (BRAND_JSON_PATH && existsSync23(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync21(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync19(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -13603,11 +12539,11 @@ var brandLoginOpts = {
   bodyFont: BRAND.defaultFonts?.body,
   logoContainsName: !!BRAND.logoContainsName
 };
-var ALIAS_DOMAINS_PATH2 = join14(homedir5(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join14(homedir4(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync23(ALIAS_DOMAINS_PATH2)) return null;
-    const parsed = JSON.parse(readFileSync21(ALIAS_DOMAINS_PATH2, "utf-8"));
+    if (!existsSync23(ALIAS_DOMAINS_PATH)) return null;
+    const parsed = JSON.parse(readFileSync19(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -13622,7 +12558,7 @@ var aliasDomains = loadAliasDomains() ?? /* @__PURE__ */ new Set();
 if (aliasDomains.size > 0) {
   console.log(`[alias-domains] loaded ${aliasDomains.size} alias domain(s): ${[...aliasDomains].join(", ")}`);
 }
-watchFile(ALIAS_DOMAINS_PATH2, { interval: 2e3 }, () => {
+watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
   const updated = loadAliasDomains();
   if (!updated) return;
   aliasDomains = updated;
@@ -13631,9 +12567,9 @@ watchFile(ALIAS_DOMAINS_PATH2, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app39 = new Hono();
-app39.use("*", clientIpMiddleware);
-app39.use("*", async (c, next) => {
+var app35 = new Hono();
+app35.use("*", clientIpMiddleware);
+app35.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -13643,7 +12579,7 @@ app39.use("*", async (c, next) => {
   );
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app39.use("*", async (c, next) => {
+app35.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -13676,7 +12612,7 @@ var PUBLIC_ALLOWED_PREFIXES = [
   "/sites/"
 ];
 var PUBLIC_ALLOWED_EXACT = ["/favicon.ico"];
-app39.use("*", async (c, next) => {
+app35.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (!isPublicHost(host)) {
     await next();
@@ -13716,7 +12652,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app39.post("/__remote-auth/login", async (c) => {
+app35.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -13761,7 +12697,7 @@ app39.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app39.get("/__remote-auth/logout", (c) => {
+app35.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -13774,7 +12710,7 @@ app39.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app39.post("/__remote-auth/change-password", async (c) => {
+app35.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -13825,13 +12761,13 @@ app39.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app39.get("/__remote-auth/setup", (c) => {
+app35.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app39.post("/__remote-auth/set-initial-password", async (c) => {
+app35.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -13869,10 +12805,10 @@ app39.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app39.get("/api/remote-auth/status", (c) => {
+app35.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app39.post("/api/remote-auth/set-password", async (c) => {
+app35.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -13903,9 +12839,9 @@ app39.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app39.route("/api/_client-error", client_error_default);
+app35.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
-app39.use("*", async (c, next) => {
+app35.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
@@ -13931,13 +12867,6 @@ app39.use("*", async (c, next) => {
     return;
   }
   const disambig = `remoteAddress="${rawRemote ?? ""}" xff="${rawXff ?? ""}" resolvedKind=${decision.client.kind}`;
-  if (path2 === "/api/admin/browser-iframe/event") {
-    browserViewerLog("auth-rejected", {
-      ip: clientIp,
-      reason: decision.reason,
-      brand: BRAND.productName
-    });
-  }
   if (decision.reason === "remote-unconfigured") {
     console.error(`[remote-auth] not configured, redirecting to setup ip=${clientIp} path=${path2} ${disambig}`);
     return c.redirect("/__remote-auth/setup");
@@ -13945,11 +12874,11 @@ app39.use("*", async (c, next) => {
   console.error(`[remote-auth] login required ip=${clientIp} path=${path2} ${disambig}`);
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), redirect: path2 }), 200);
 });
-app39.route("/api/health", health_default);
-app39.route("/api/chat", chat_default);
-app39.route("/api/whatsapp", whatsapp_default);
-app39.route("/api/onboarding", onboarding_default);
-app39.route("/api/admin", admin_default);
+app35.route("/api/health", health_default);
+app35.route("/api/chat", chat_default);
+app35.route("/api/whatsapp", whatsapp_default);
+app35.route("/api/onboarding", onboarding_default);
+app35.route("/api/admin", admin_default);
 var SAFE_SLUG_RE = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -13961,7 +12890,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app39.get("/agent-assets/:slug/:filename", (c) => {
+app35.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE.test(slug)) {
@@ -13977,8 +12906,8 @@ app39.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve23(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve23(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve21(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve21(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
@@ -13990,13 +12919,13 @@ app39.get("/agent-assets/:slug/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync21(filePath);
+  const body = readFileSync19(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
   });
 });
-app39.get("/generated/:filename", (c) => {
+app35.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -14007,8 +12936,8 @@ app39.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve23(account.accountDir, "generated", filename);
-  const expectedDir = resolve23(account.accountDir, "generated");
+  const filePath = resolve21(account.accountDir, "generated", filename);
+  const expectedDir = resolve21(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
@@ -14020,19 +12949,19 @@ app39.get("/generated/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync21(filePath);
+  const body = readFileSync19(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
   });
 });
-app39.route("/sites", sites_default);
+app35.route("/sites", sites_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
 if (BRAND_JSON_PATH && existsSync23(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync21(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync19(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -14051,7 +12980,7 @@ function readInstalledVersion() {
     if (!PLATFORM_ROOT7) return "unknown";
     const versionFile = join14(PLATFORM_ROOT7, "config", `.${BRAND.hostname}-version`);
     if (!existsSync23(versionFile)) return "unknown";
-    const content = readFileSync21(versionFile, "utf-8").trim();
+    const content = readFileSync19(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -14092,7 +13021,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync21(resolve23(process.cwd(), "public", file), "utf-8");
+    html = readFileSync19(resolve21(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -14108,26 +13037,26 @@ ${clientErrorReporterScript}
 }
 var brandedHtmlCache = /* @__PURE__ */ new Map();
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join14(homedir5(), BRAND.configDir);
+  const configDir2 = join14(homedir4(), BRAND.configDir);
   try {
     const accountJsonPath = join14(configDir2, "account.json");
     if (!existsSync23(accountJsonPath)) return null;
-    const account = JSON.parse(readFileSync21(accountJsonPath, "utf-8"));
+    const account = JSON.parse(readFileSync19(accountJsonPath, "utf-8"));
     const accountId = account.accountId;
     if (!accountId) return null;
     const cachePath = join14(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
     if (!existsSync23(cachePath)) return null;
-    return JSON.parse(readFileSync21(cachePath, "utf-8"));
+    return JSON.parse(readFileSync19(cachePath, "utf-8"));
   } catch {
     return null;
   }
 }
 function resolveDefaultSlug() {
   try {
-    const configDir2 = join14(homedir5(), BRAND.configDir);
+    const configDir2 = join14(homedir4(), BRAND.configDir);
     const accountJsonPath = join14(configDir2, "account.json");
     if (!existsSync23(accountJsonPath)) return null;
-    const account = JSON.parse(readFileSync21(accountJsonPath, "utf-8"));
+    const account = JSON.parse(readFileSync19(accountJsonPath, "utf-8"));
     return account.defaultAgent || null;
   } catch {
     return null;
@@ -14163,7 +13092,7 @@ function brandedPublicHtml(agentSlug) {
 function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-app39.get("/", (c) => {
+app35.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) {
     const defaultSlug = resolveDefaultSlug();
@@ -14171,12 +13100,12 @@ app39.get("/", (c) => {
   }
   return c.html(cachedHtml("index.html"));
 });
-app39.get("/public", (c) => {
+app35.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app39.get("/chat", (c) => {
+app35.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -14195,12 +13124,12 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app39.use("/vnc-viewer.html", logViewerFetch);
-app39.use("/vnc-popout.html", logViewerFetch);
-app39.get("/vnc-popout.html", (c) => {
+app35.use("/vnc-viewer.html", logViewerFetch);
+app35.use("/vnc-popout.html", logViewerFetch);
+app35.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync21(resolve23(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync19(resolve21(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -14210,7 +13139,7 @@ app39.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app39.post("/api/vnc/client-event", async (c) => {
+app35.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -14231,25 +13160,25 @@ app39.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app39.get("/g/:slug", (c) => {
+app35.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
-app39.get("/graph", (c) => {
+app35.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app39.get("/sessions", (c) => {
+app35.get("/sessions", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("sessions.html"));
 });
-app39.get("/data", (c) => {
+app35.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app39.get("/:slug", async (c, next) => {
+app35.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const branding = loadBrandingCache(slug);
@@ -14259,15 +13188,15 @@ app39.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app39.get("/favicon.ico", (c) => {
+  app35.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app39.use("/*", serveStatic({ root: "./public" }));
+app35.use("/*", serveStatic({ root: "./public" }));
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app39.fetch, port, hostname });
+var httpServer = serve({ fetch: app35.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const loopHist = monitorEventLoopDelay({ resolution: 50 });
@@ -14299,7 +13228,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app39.routes ?? []) {
+  for (const r of app35.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -14322,7 +13251,7 @@ try {
 (async () => {
   try {
     if (!existsSync23(USERS_FILE)) return;
-    const usersRaw = readFileSync21(USERS_FILE, "utf-8").trim();
+    const usersRaw = readFileSync19(USERS_FILE, "utf-8").trim();
     if (!usersRaw) return;
     const users = JSON.parse(usersRaw);
     const userId = users[0]?.userId;
@@ -14369,32 +13298,10 @@ var bootEntitlement = bootAccountConfig ? resolveEntitlement(
   }
 ) : null;
 autoDeliverPremiumPlugins();
-reconcileEnabledPlugins(bootAccount?.accountDir, bootAccount?.config);
+reconcileEnabledPlugins(bootAccount?.accountDir, bootAccount?.config, bootAccount?.accountId);
 for (const acct of listValidAccounts()) {
   cleanupLeakedPremiumSubs(acct.accountDir, acct.config, acct.accountId);
 }
-(async () => {
-  if (!bootAccount) return;
-  try {
-    const { recoverRunningCloudflareTasks } = await import("./cloudflare-task-tracker-M5ONAGUT.js");
-    const result = await recoverRunningCloudflareTasks(
-      bootAccount.accountId,
-      configDirForWhatsApp,
-      // no conversationId at boot. The reconciler operates on
-      // Tasks whose Conversation is already linked via RAISED_DURING; the
-      // tracker resolves the conversationId off that edge when present.
-      // Pass null and let the recovery path pick it up.
-      null
-    );
-    if (result.scanned > 0) {
-      console.error(
-        `[task] reconciler-startup kind=cloudflare-tunnel-login scanned=${result.scanned} resolved=${result.resolved.length}`
-      );
-    }
-  } catch (err) {
-    console.error(`[task] reconciler-startup failed: ${err instanceof Error ? err.message : String(err)}`);
-  }
-})();
 var bootEnabled = Array.isArray(bootAccountConfig?.enabledPlugins) ? bootAccountConfig.enabledPlugins : [];
 var bootDelivered = [];
 var bootDistMissing = [];
@@ -14436,7 +13343,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve23(process.env.MAXY_PLATFORM_ROOT ?? join14(__dirname, "..")),
+  platformRoot: resolve21(process.env.MAXY_PLATFORM_ROOT ?? join14(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (process.env.WHATSAPP_PTY_BRIDGE_ENABLED === "true" && msg.text && !msg.isOwnerMirror) {