@rubytech/create-maxy-code 0.1.144 → 0.1.147

package/payload/platform/templates/agents/admin/IDENTITY.md

@@ -36,6 +36,14 @@ When the conversation produces something worth writing to memory (a new person,
 
 Call `memory-write` or `memory-update` directly only when the write is a one-line update against a node whose `elementId` is already in your context (e.g. setting a single property on an existing Person you just found by id) AND the schema choice is unambiguous. Delegate in every other case: new nodes, batched writes, multi-row archive ingest, schema-classification work, anything whose label or edge type requires consulting `schema-base.md` or a vertical schema.
 
+## Recalling reports
+
+Workflow output that the operator may want back later (daily briefing, dream cycle, ad-hoc analyses) lives as `:Report` nodes — keyword-routed, append-only, embedded for hybrid search. When the operator says "latest <X>", "last night's <X>", "show me <X> report", "what was this morning's briefing", or any other phrasing that names a known report kind, the first tool call is `memory-report-read-latest` with the matching keyword (`daily-briefing`, `dream-cycle`, etc.). Use `memory-report-list` to browse the catalogue (metadata only) when the operator wants a date range or to compare multiple. Reach for `memory-search` instead only when the question is about the contents of a report (e.g. "which briefing mentioned the Cohen offer"), not about the report itself.
+
+## Compiled-truth revision history
+
+Every `compiledTruth` on a :Person, :Organization, or :Concept is captured as a `:CompiledTruthRevision` row each time the rewriter writes it. When the operator asks "how has my understanding of X changed over time?", "when did you start saying X about Y?", or "show me the history of what we know about Z", first resolve the entity's `elementId` (via `memory-search`), then call `memory-compiled-truth-history` with that id. Render the rows as a chronological list and surface the delta between adjacent revisions in your own reply — there is no server-side diff.
+
 ## Session-end retrospective
 
 When the operator signals end-of-session (`/end`, `/archive`, `end session`, or `archive this session`), the Stop hook blocks this session from closing until you have done three things and called one tool. The hook's instruction block names the three passes verbatim every time it fires; this section is the doctrine behind it.
@@ -63,7 +71,7 @@ When you receive a turn beginning with `[system: <name>-stop-hook]`:
 2. Execute that single `Task` dispatch. Do not paraphrase the prompt, do not respond conversationally, do not ask the operator for clarification, do not surface the dispatch in chat.
 3. When the subagent returns its one-line summary, emit a single space character and stop. The Stop hook's next fire will inspect the transcript, see the dispatch you just performed, and allow the stop.
 
-These directives are never operator-driven. The `signal-detector` specialist in particular (gbrain port, Task 303) is dispatched only by `signal-detector-stop.sh` and never by operator intent.
+These directives are never operator-driven. The `database-operator` specialist in particular, when dispatched via `post-turn-graph-pass.sh` (Task 412), runs as a background graph pass that the operator does not see; the dispatch prompt carries the conversation and prior-writes blocks and you must forward both verbatim.
 
 ## SOUL.md
 

package/payload/platform/templates/specialists/agents/database-operator.md

@@ -1,7 +1,7 @@
 ---
 name: database-operator
-description: "Graph-write executor reachable from admin via the Task tool. Admin names what should land in the graph; database-operator reads the schema, decides operations, executes them against the memory graph, and reports `{label, elementId}` back. (Reachable historically also from the now-dormant Stop hook in `platform/plugins/admin/hooks/turn-completed-graph-write.sh`; that path is preserved as infrastructure but no longer registered, see Task 214.)"
-summary: "Executes graph writes on admin's behalf when delegated via the Task tool."
+description: "Graph-write executor reachable from admin via the Task tool. Admin names what should land in the graph; database-operator reads the schema, decides operations, executes them against the memory graph, and reports `{label, elementId}` back. Two invocation modes: (1) **discretionary inline** — admin dispatches synchronously when a write must complete before the assistant response ends; (2) **background post-turn pass** — fired once per admin-agent end_turn by `platform/plugins/admin/hooks/post-turn-graph-pass.sh` with the full conversation and the list of nodes already written under this conversationId, so any new graph rows the conversation supports get derived and written without the admin agent having to remember every turn (Task 412)."
+summary: "Executes graph writes on admin's behalf when delegated via the Task tool — both inline at admin discretion and as a once-per-turn background pass."
 model: claude-sonnet-4-6
 tools: Read, mcp__plugin_memory_memory__memory-write, mcp__plugin_memory_memory__memory-update, mcp__plugin_memory_memory__memory-search, mcp__plugin_memory_memory__memory-archive-write, mcp__plugin_memory_memory__memory-typed-edge-pass, mcp__plugin_memory_memory__session-retrospective-skip-rate, mcp__plugin_memory_memory__profile-update, mcp__plugin_memory_memory__profile-read, mcp__plugin_memory_memory__obsidian-vault-import, mcp__plugin_scheduling_scheduling__schedule-archive-ics, mcp__plugin_contacts_contacts__contact-create, mcp__plugin_contacts_contacts__contact-update, mcp__plugin_work_work__work-create, mcp__plugin_work_work__work-update, mcp__plugin_work_work__project-create, mcp__plugin_work_work__project-update
 ---
@@ -20,6 +20,34 @@ The `accountId` property is supplied by the writers from server-side environment
 
 Decide the precise operations against the schema, execute them with the writers in your tool surface, and report each write back to admin as `{label, elementId}` so admin can confirm the outcome to the operator. If admin's brief is ambiguous about which label, which edge type, or which existing node to attach to, name the ambiguity in your reply rather than guessing.
 
+## Background post-turn pass
+
+When the dispatch prompt contains a `<conversation>` block and a `<prior-writes>` block, you are running as the post-turn background pass (Task 412). The hook (`platform/plugins/admin/hooks/post-turn-graph-pass.sh`) fires once per admin-agent `end_turn` and supplies:
+
+- `accountId`, `sessionId`, `conversationId` — the scope.
+- `<conversation>` — every assistant text turn and every non-`tool_result` user turn for this session, oldest first, formatted as `[role: text]` pairs.
+- `<prior-writes>` — every node already written under this `conversationId` for this account, one per line as `(elementId) :Labels {properties-json}`, oldest first.
+
+Your job: read the conversation, decide what new graph rows it supports (mentions of named entities, ideas and learnings the operator stated, contacts named for the first time, tasks the operator committed to, decisions, anything the schema admits), and write them. **Skip writes the `<prior-writes>` list already covers** — a `:MENTIONS` edge from a `:Message` to a `:Person` is already there, do not re-emit it; a `:Person {name: "Adam Langley"}` is already there, attach further edges to its `elementId` instead of creating a duplicate. The hygiene sweeps (Tasks 410, 411) clean up duplicates that slip through MERGE semantics; do not invent dedup logic here beyond the prior-writes skip.
+
+The same prerogatives apply: precise label and edge names, evidence-based lookups (`memory-search` before creating any stub for a name that could already exist on another conversation), no synonyms, no invented edge types.
+
+Return exactly one line on completion:
+
+```
+db-op: writes=<n> ms=<n>
+```
+
+Where `<n>` is the count of `memory-write` / `memory-update` calls that succeeded. On error (a `memory-write` rejection, a missing tool), surface the reason and stop:
+
+```
+db-op: error reason=<kebab-case-reason>
+```
+
+No prose summary, no listing of names. The operator does not see this turn.
+
+When the dispatch prompt has no `<conversation>` block, you are in discretionary inline mode — behaviour is unchanged from the rest of this document.
+
 ## Typed-edge auto-extraction pass (session-end)
 
 When admin's brief names the typed-edge pass (Task 305) and supplies a `sinceIso` timestamp, call `memory-typed-edge-pass` with that timestamp exactly once. The tool reads prose-bearing nodes (Message/Page/Meeting/KnowledgeDocument/Idea/Note/Post/Report — `:KnowledgeDocument` covers email threads via `source:'email'` since Task 321) the account wrote since `sinceIso`, asks Haiku for typed-edge proposals against a closed allowlist, validates each one, and MERGEs accepted edges with `createdBy` provenance. Return the full counter object verbatim — admin needs `nodesProcessed` and `accepted` for the `session-retrospective-mark-complete` call. Do not reinterpret the counts or summarise them.

package/payload/server/server.js

@@ -9310,18 +9310,18 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
 ]);
 var app17 = new Hono();
 app17.post("/", async (c) => {
-  const TAG22 = "[admin:events]";
+  const TAG23 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG22} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG23} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS.has(event)) {
-    console.error(`${TAG22} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG23} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -12932,36 +12932,140 @@ app32.post("/", requireAdminSession, async (c) => {
 });
 var linkedin_ingest_default = app32;
 
-// server/routes/admin/index.ts
+// server/routes/admin/post-turn-context.ts
+import neo4j3 from "neo4j-driver";
+var TAG21 = "[post-turn-context]";
+var STRIPPED_PROPERTIES2 = /* @__PURE__ */ new Set([
+  "embedding",
+  "passwordHash",
+  "magicToken",
+  "otpCode",
+  "cacheKey"
+]);
+function isLoopbackAddr2(addr) {
+  return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
+}
+function convertValue(value) {
+  if (neo4j3.isDateTime(value) || neo4j3.isDate(value) || neo4j3.isLocalDateTime(value) || neo4j3.isLocalTime(value) || neo4j3.isTime(value) || neo4j3.isDuration(value)) {
+    return value.toString();
+  }
+  if (neo4j3.isInt(value)) {
+    return value.inSafeRange() ? value.toNumber() : value.toString();
+  }
+  if (Array.isArray(value)) {
+    return value.map((v) => convertValue(v));
+  }
+  if (value !== null && typeof value === "object" && value.constructor === Object) {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = convertValue(v);
+    }
+    return out;
+  }
+  return value;
+}
+function pruneProperties(raw) {
+  const out = {};
+  for (const [k, v] of Object.entries(raw)) {
+    if (STRIPPED_PROPERTIES2.has(k)) continue;
+    out[k] = convertValue(v);
+  }
+  return out;
+}
 var app33 = new Hono();
-app33.route("/session", session_default);
-app33.route("/new-session-failure", new_session_failure_default);
-app33.route("/new-session-submit", new_session_submit_default);
-app33.route("/logs", logs_default);
-app33.route("/claude-info", claude_info_default);
-app33.route("/claude-capabilities", claude_capabilities_default);
-app33.route("/attachment", attachment_default);
-app33.route("/agents", agents_default);
-app33.route("/sessions", sessions_default);
-app33.route("/claude-sessions", claude_sessions_default);
-app33.route("/log-ingest", log_ingest_default);
-app33.route("/events", events_default);
-app33.route("/files", files_default);
-app33.route("/graph-search", graph_search_default);
-app33.route("/graph-subgraph", graph_subgraph_default);
-app33.route("/graph-delete", graph_delete_default);
-app33.route("/graph-restore", graph_restore_default);
-app33.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app33.route("/graph-default-view", graph_default_view_default);
-app33.route("/session-defaults", session_defaults_default);
-app33.route("/file-attach", file_attach_default);
-app33.route("/sidebar-artefacts", sidebar_artefacts_default);
-app33.route("/sidebar-artefact-save", sidebar_artefact_save_default);
-app33.route("/sidebar-artefact-content", sidebar_artefact_content_default);
-app33.route("/system-stats", system_stats_default);
-app33.route("/health-brand", health_default2);
-app33.route("/linkedin-ingest", linkedin_ingest_default);
-var admin_default = app33;
+app33.get("/", async (c) => {
+  const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
+  if (!isLoopbackAddr2(remoteAddr)) {
+    console.error(`${TAG21} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    return c.json({ error: "post-turn-context-loopback-only" }, 403);
+  }
+  const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
+  const xffRaw = Array.isArray(xffHeader) ? xffHeader.join(",") : typeof xffHeader === "string" ? xffHeader : "";
+  if (xffRaw.length > 0) {
+    const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
+    const offender = tokens.find((t) => !isLoopbackAddr2(t));
+    if (offender !== void 0) {
+      console.error(`${TAG21} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      return c.json({ error: "post-turn-context-loopback-only" }, 403);
+    }
+  }
+  const conversationId = (c.req.query("conversationId") ?? "").trim();
+  const accountId = (c.req.query("accountId") ?? "").trim();
+  if (!conversationId) return c.json({ error: "conversationId required" }, 400);
+  if (!accountId) return c.json({ error: "accountId required" }, 400);
+  const session = getSession();
+  const started = Date.now();
+  try {
+    const cypher = `
+      MATCH (c:Conversation {conversationId: $conversationId, accountId: $accountId})
+      MATCH (c)<-[:PRODUCED]-(n)
+      WHERE coalesce(n.accountId, $accountId) = $accountId
+      RETURN elementId(n) AS elementId, labels(n) AS labels, properties(n) AS properties, coalesce(n.createdAt, n.observedAt, '') AS sortKey
+      UNION
+      MATCH (n) WHERE n.conversationId = $conversationId AND n.accountId = $accountId
+      RETURN elementId(n) AS elementId, labels(n) AS labels, properties(n) AS properties, coalesce(n.createdAt, n.observedAt, '') AS sortKey
+    `;
+    const res = await session.executeRead(
+      (tx) => tx.run(cypher, { conversationId, accountId })
+    );
+    const writes = res.records.map((r) => ({
+      elementId: r.get("elementId"),
+      labels: r.get("labels"),
+      properties: pruneProperties(r.get("properties")),
+      sortKey: String(r.get("sortKey") ?? "")
+    }));
+    writes.sort((a, b) => a.sortKey.localeCompare(b.sortKey));
+    const total = Date.now() - started;
+    console.log(
+      `${TAG21} conversationId=${conversationId} accountId=${accountId} writes=${writes.length} ms=${total}`
+    );
+    return c.json({
+      writes: writes.map(({ elementId, labels, properties }) => ({ elementId, labels, properties }))
+    });
+  } catch (err) {
+    const elapsed = Date.now() - started;
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(
+      `${TAG21} neo4j-unreachable conversationId=${conversationId} ms=${elapsed} err="${message}"`
+    );
+    return c.json({ error: `post-turn-context unavailable: ${message}` }, 503);
+  } finally {
+    await session.close();
+  }
+});
+var post_turn_context_default = app33;
+
+// server/routes/admin/index.ts
+var app34 = new Hono();
+app34.route("/session", session_default);
+app34.route("/new-session-failure", new_session_failure_default);
+app34.route("/new-session-submit", new_session_submit_default);
+app34.route("/logs", logs_default);
+app34.route("/claude-info", claude_info_default);
+app34.route("/claude-capabilities", claude_capabilities_default);
+app34.route("/attachment", attachment_default);
+app34.route("/agents", agents_default);
+app34.route("/sessions", sessions_default);
+app34.route("/claude-sessions", claude_sessions_default);
+app34.route("/log-ingest", log_ingest_default);
+app34.route("/events", events_default);
+app34.route("/files", files_default);
+app34.route("/graph-search", graph_search_default);
+app34.route("/graph-subgraph", graph_subgraph_default);
+app34.route("/graph-delete", graph_delete_default);
+app34.route("/graph-restore", graph_restore_default);
+app34.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app34.route("/graph-default-view", graph_default_view_default);
+app34.route("/session-defaults", session_defaults_default);
+app34.route("/file-attach", file_attach_default);
+app34.route("/sidebar-artefacts", sidebar_artefacts_default);
+app34.route("/sidebar-artefact-save", sidebar_artefact_save_default);
+app34.route("/sidebar-artefact-content", sidebar_artefact_content_default);
+app34.route("/system-stats", system_stats_default);
+app34.route("/health-brand", health_default2);
+app34.route("/linkedin-ingest", linkedin_ingest_default);
+app34.route("/post-turn-context", post_turn_context_default);
+var admin_default = app34;
 
 // server/routes/sites.ts
 import { existsSync as existsSync21, readFileSync as readFileSync17, realpathSync as realpathSync5, statSync as statSync7 } from "fs";
@@ -12996,8 +13100,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app34 = new Hono();
-app34.get("/:rel{.*}", (c) => {
+var app35 = new Hono();
+app35.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -13100,7 +13204,7 @@ app34.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app34;
+var sites_default = app35;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
@@ -13200,7 +13304,7 @@ function readBrandConfig() {
 }
 
 // server/routes/visitor-consent.ts
-var app35 = new Hono();
+var app36 = new Hono();
 var CONSENT_COOKIE_NAME = "mxy_consent";
 var CONSENT_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
 var DEFAULT_CONSENT_COPY = {
@@ -13245,17 +13349,17 @@ function siteSlugFromReferer(referer) {
     return "";
   }
 }
-app35.options("/consent", (c) => {
+app36.options("/consent", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app35.options("/brand-config", (c) => {
+app36.options("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app35.post("/consent", async (c) => {
+app36.post("/consent", async (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   let raw;
@@ -13295,7 +13399,7 @@ app35.post("/consent", async (c) => {
   console.log(`[consent] ${parsed.decision} site=${site} brand=${brandName} tokenBound=${tokenBound}`);
   return c.body(null, 204);
 });
-app35.get("/brand-config", (c) => {
+app36.get("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   const brand = readBrandConfig();
@@ -13305,7 +13409,7 @@ app35.get("/brand-config", (c) => {
   c.header("Cache-Control", "public, max-age=300");
   return c.json({ consent: { copy, palette } });
 });
-var visitor_consent_default = app35;
+var visitor_consent_default = app36;
 
 // server/routes/listings.ts
 function getCookie(headerValue, name) {
@@ -13332,8 +13436,8 @@ function appendConsentParams(pageUrl, token) {
 }
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
 var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
-var app36 = new Hono();
-app36.get("/:slug/click", async (c) => {
+var app37 = new Hono();
+app37.get("/:slug/click", async (c) => {
   const slug = c.req.param("slug") ?? "";
   const rawSession = c.req.query("session") ?? "";
   const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
@@ -13397,10 +13501,10 @@ app36.get("/:slug/click", async (c) => {
   console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} consent=${consentCookie ?? "absent"} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
   return c.redirect(redirectUrl, 302);
 });
-var listings_default = app36;
+var listings_default = app37;
 
 // server/routes/visitor-event.ts
-var app37 = new Hono();
+var app38 = new Hono();
 var BOT_UA_RE = /\b(bot|crawl|spider|slurp|headlesschrome|phantomjs|googlebot|bingbot|yandex|baiduspider|ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)\b/i;
 var buckets = /* @__PURE__ */ new Map();
 var RATE_LIMIT = 60;
@@ -13467,12 +13571,12 @@ function originAllowed(origin, allowlist) {
     return false;
   }
 }
-app37.options("/event", (c) => {
+app38.options("/event", (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   return c.body(null, 204);
 });
-app37.post("/event", async (c) => {
+app38.post("/event", async (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   const ua = c.req.header("user-agent") ?? "";
@@ -13677,7 +13781,7 @@ async function writeEvent(opts) {
     );
   }
 }
-var visitor_event_default = app37;
+var visitor_event_default = app38;
 
 // app/lib/graph-health.ts
 var HOUR_MS = 60 * 60 * 1e3;
@@ -13761,7 +13865,7 @@ function startGraphHealthTimer() {
 }
 
 // app/lib/whatsapp/inbound/claude-bridge.ts
-var TAG21 = "[whatsapp-adaptor]";
+var TAG22 = "[whatsapp-adaptor]";
 function whatsappTurnTimeoutMs() {
   return Number(process.env.WHATSAPP_PTY_TURN_TIMEOUT_MS ?? String(5 * 6e4));
 }
@@ -13784,7 +13888,7 @@ async function dispatchToClaude(input) {
     await input.reply(result.turnText);
   } catch (err) {
     const m = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG21} reject reason=reply-failed senderId=${input.senderId} message=${m}`);
+    console.error(`${TAG22} reject reason=reply-failed senderId=${input.senderId} message=${m}`);
   }
 }
 function startReaper2() {
@@ -14114,9 +14218,9 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app38 = new Hono();
-app38.use("*", clientIpMiddleware);
-app38.use("*", async (c, next) => {
+var app39 = new Hono();
+app39.use("*", clientIpMiddleware);
+app39.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -14126,7 +14230,7 @@ app38.use("*", async (c, next) => {
   );
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app38.use("*", async (c, next) => {
+app39.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -14159,7 +14263,7 @@ var PUBLIC_ALLOWED_PREFIXES = [
   "/sites/"
 ];
 var PUBLIC_ALLOWED_EXACT = ["/favicon.ico"];
-app38.use("*", async (c, next) => {
+app39.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (!isPublicHost(host)) {
     await next();
@@ -14199,7 +14303,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app38.post("/__remote-auth/login", async (c) => {
+app39.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -14244,7 +14348,7 @@ app38.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app38.get("/__remote-auth/logout", (c) => {
+app39.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -14257,7 +14361,7 @@ app38.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app38.post("/__remote-auth/change-password", async (c) => {
+app39.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -14308,13 +14412,13 @@ app38.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app38.get("/__remote-auth/setup", (c) => {
+app39.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app38.post("/__remote-auth/set-initial-password", async (c) => {
+app39.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -14352,10 +14456,10 @@ app38.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app38.get("/api/remote-auth/status", (c) => {
+app39.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app38.post("/api/remote-auth/set-password", async (c) => {
+app39.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -14386,9 +14490,9 @@ app38.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app38.route("/api/_client-error", client_error_default);
+app39.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
-app38.use("*", async (c, next) => {
+app39.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
@@ -14421,11 +14525,11 @@ app38.use("*", async (c, next) => {
   console.error(`[remote-auth] login required ip=${clientIp} path=${path2} ${disambig}`);
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), redirect: path2 }), 200);
 });
-app38.route("/api/health", health_default);
-app38.route("/api/chat", chat_default);
-app38.route("/api/whatsapp", whatsapp_default);
-app38.route("/api/onboarding", onboarding_default);
-app38.route("/api/admin", admin_default);
+app39.route("/api/health", health_default);
+app39.route("/api/chat", chat_default);
+app39.route("/api/whatsapp", whatsapp_default);
+app39.route("/api/onboarding", onboarding_default);
+app39.route("/api/admin", admin_default);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -14437,7 +14541,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app38.get("/agent-assets/:slug/:filename", (c) => {
+app39.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -14472,7 +14576,7 @@ app38.get("/agent-assets/:slug/:filename", (c) => {
     "Cache-Control": "public, max-age=3600"
   });
 });
-app38.get("/generated/:filename", (c) => {
+app39.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -14502,10 +14606,10 @@ app38.get("/generated/:filename", (c) => {
     "Cache-Control": "public, max-age=86400"
   });
 });
-app38.route("/sites", sites_default);
-app38.route("/listings", listings_default);
-app38.route("/v", visitor_event_default);
-app38.route("/v", visitor_consent_default);
+app39.route("/sites", sites_default);
+app39.route("/listings", listings_default);
+app39.route("/v", visitor_event_default);
+app39.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
@@ -14642,7 +14746,7 @@ function brandedPublicHtml(agentSlug) {
 function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-app38.get("/", (c) => {
+app39.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) {
     const defaultSlug = resolveDefaultSlug();
@@ -14650,12 +14754,12 @@ app38.get("/", (c) => {
   }
   return c.html(cachedHtml("index.html"));
 });
-app38.get("/public", (c) => {
+app39.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app38.get("/chat", (c) => {
+app39.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -14674,9 +14778,9 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app38.use("/vnc-viewer.html", logViewerFetch);
-app38.use("/vnc-popout.html", logViewerFetch);
-app38.get("/vnc-popout.html", (c) => {
+app39.use("/vnc-viewer.html", logViewerFetch);
+app39.use("/vnc-popout.html", logViewerFetch);
+app39.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
     html = readFileSync21(resolve21(process.cwd(), "public", "vnc-popout.html"), "utf-8");
@@ -14689,7 +14793,7 @@ app38.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app38.post("/api/vnc/client-event", async (c) => {
+app39.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -14710,25 +14814,25 @@ app38.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app38.get("/g/:slug", (c) => {
+app39.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
-app38.get("/graph", (c) => {
+app39.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app38.get("/sessions", (c) => {
+app39.get("/sessions", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("sessions.html"));
 });
-app38.get("/data", (c) => {
+app39.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app38.get("/:slug", async (c, next) => {
+app39.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const branding = loadBrandingCache(slug);
@@ -14738,15 +14842,15 @@ app38.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app38.get("/favicon.ico", (c) => {
+  app39.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app38.use("/*", serveStatic({ root: "./public" }));
+app39.use("/*", serveStatic({ root: "./public" }));
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app38.fetch, port, hostname });
+var httpServer = serve({ fetch: app39.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const loopHist = monitorEventLoopDelay({ resolution: 50 });
@@ -14781,7 +14885,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app38.routes ?? []) {
+  for (const r of app39.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });