@rubytech/create-maxy-code 0.1.183 → 0.1.185

package/payload/server/server.js

@@ -4149,6 +4149,17 @@ function managerLogFollowUrl(sessionId) {
 
 // app/lib/channel-pty-bridge/public-session-end-review.ts
 var TAG14 = "[public-session-review]";
+var CONSUMED_CAP = 500;
+var consumed = /* @__PURE__ */ new Set();
+function consumeOnce(sessionId) {
+  if (consumed.has(sessionId)) return false;
+  consumed.add(sessionId);
+  if (consumed.size > CONSUMED_CAP) {
+    const oldest = consumed.values().next().value;
+    if (oldest !== void 0) consumed.delete(oldest);
+  }
+  return true;
+}
 function managerBase2() {
   const port2 = requirePortEnv("CLAUDE_SESSION_MANAGER_PORT", { tag: "public-session-end-review:manager" });
   return `http://127.0.0.1:${port2}`;
@@ -4253,6 +4264,12 @@ async function firePublicSessionEndReview(input) {
   const sliceShort = input.sliceToken.slice(0, 8);
   const personField = input.personId ?? "none";
   const dispatchedAt = Date.now();
+  if (consumed.has(input.sessionId)) {
+    console.log(
+      `${TAG14} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+    );
+    return;
+  }
   const jsonl = await fetchJsonl(input.sessionId);
   if (!jsonl) {
     console.log(
@@ -4275,6 +4292,12 @@ async function firePublicSessionEndReview(input) {
     jsonl,
     priorWrites
   });
+  if (!consumeOnce(input.sessionId)) {
+    console.log(
+      `${TAG14} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+    );
+    return;
+  }
   const dispatched = await dispatchReviewer(input, initialMessage);
   if (!dispatched.ok) {
     console.error(
@@ -4463,6 +4486,16 @@ async function writeInput(entry, text) {
           `${tag} session-resolved senderId=${entry.senderId} action=respawn reason=session-gone-${result.status} sessionId=${entry.sessionId.slice(0, 8)}`
         );
         if (entry.followerAbort) entry.followerAbort.abort();
+        if (entry.role === "public" && entry.sliceToken.length > 0) {
+          void firePublicSessionEndReview({
+            sessionId: entry.sessionId,
+            sliceToken: entry.sliceToken,
+            personId: entry.personId,
+            accountId: entry.accountId,
+            agentSlug: entry.agentSlug,
+            dispatchFor: "exit"
+          });
+        }
         index.delete(indexKey(entry.accountId, entry.agentSlug, entry.senderId, entry.liveMemory, entry.sliceToken));
         const respawned = await ensureEntry({
           accountId: entry.accountId,
@@ -4586,6 +4619,33 @@ function startReaper() {
   }, 6e4);
   if (reaperHandle.unref) reaperHandle.unref();
 }
+function handlePublicSessionExit(sessionId) {
+  let found = null;
+  for (const [key2, entry2] of index) {
+    if (entry2.sessionId === sessionId) {
+      found = { key: key2, entry: entry2 };
+      break;
+    }
+  }
+  if (!found) {
+    console.error(`[public-session-exit] sessionId=${sessionId} result=no-entry`);
+    return;
+  }
+  const { key, entry } = found;
+  if (entry.role !== "public" || entry.sliceToken.length === 0) {
+    return;
+  }
+  if (entry.followerAbort) entry.followerAbort.abort();
+  index.delete(key);
+  void firePublicSessionEndReview({
+    sessionId: entry.sessionId,
+    sliceToken: entry.sliceToken,
+    personId: entry.personId,
+    accountId: entry.accountId,
+    agentSlug: entry.agentSlug,
+    dispatchFor: "exit"
+  });
+}
 
 // app/lib/access-session-store.ts
 import { randomUUID as randomUUID4 } from "crypto";
@@ -8653,18 +8713,18 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
 ]);
 var app17 = new Hono();
 app17.post("/", async (c) => {
-  const TAG27 = "[admin:events]";
+  const TAG28 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG27} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG28} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS.has(event)) {
-    console.error(`${TAG27} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG28} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -12440,8 +12500,8 @@ app34.get("/", async (c) => {
 });
 var public_session_context_default = app34;
 
-// server/routes/admin/access-session-evict.ts
-var TAG23 = "[access-session-evict]";
+// server/routes/admin/public-session-exit.ts
+var TAG23 = "[public-session-exit-route]";
 function isLoopbackAddr4(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
@@ -12450,7 +12510,7 @@ app35.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr4(remoteAddr)) {
     console.error(`${TAG23} reject reason=non-loopback remoteAddr=${remoteAddr}`);
-    return c.json({ error: "access-session-evict-loopback-only" }, 403);
+    return c.json({ error: "public-session-exit-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
   const xffRaw = Array.isArray(xffHeader) ? xffHeader.join(",") : typeof xffHeader === "string" ? xffHeader : "";
@@ -12459,6 +12519,41 @@ app35.post("/", async (c) => {
     const offender = tokens.find((t) => !isLoopbackAddr4(t));
     if (offender !== void 0) {
       console.error(`${TAG23} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      return c.json({ error: "public-session-exit-loopback-only" }, 403);
+    }
+  }
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "invalid-json" }, 400);
+  }
+  const sessionId = typeof body.sessionId === "string" ? body.sessionId.trim() : "";
+  if (!sessionId) return c.json({ error: "sessionId required" }, 400);
+  handlePublicSessionExit(sessionId);
+  return c.json({ ok: true });
+});
+var public_session_exit_default = app35;
+
+// server/routes/admin/access-session-evict.ts
+var TAG24 = "[access-session-evict]";
+function isLoopbackAddr5(addr) {
+  return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
+}
+var app36 = new Hono();
+app36.post("/", async (c) => {
+  const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
+  if (!isLoopbackAddr5(remoteAddr)) {
+    console.error(`${TAG24} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    return c.json({ error: "access-session-evict-loopback-only" }, 403);
+  }
+  const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
+  const xffRaw = Array.isArray(xffHeader) ? xffHeader.join(",") : typeof xffHeader === "string" ? xffHeader : "";
+  if (xffRaw.length > 0) {
+    const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
+    const offender = tokens.find((t) => !isLoopbackAddr5(t));
+    if (offender !== void 0) {
+      console.error(`${TAG24} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "access-session-evict-loopback-only" }, 403);
     }
   }
@@ -12471,44 +12566,45 @@ app35.post("/", async (c) => {
   const grantId = typeof body.grantId === "string" ? body.grantId.trim() : "";
   if (!grantId) return c.json({ error: "grantId required" }, 400);
   const dropped = evictAccessSessionsByGrant(grantId);
-  console.log(`${TAG23} grantId=${grantId} dropped=${dropped}`);
+  console.log(`${TAG24} grantId=${grantId} dropped=${dropped}`);
   return c.json({ ok: true, dropped });
 });
-var access_session_evict_default = app35;
+var access_session_evict_default = app36;
 
 // server/routes/admin/index.ts
-var app36 = new Hono();
-app36.route("/session", session_default);
-app36.route("/new-session-failure", new_session_failure_default);
-app36.route("/new-session-submit", new_session_submit_default);
-app36.route("/logs", logs_default);
-app36.route("/claude-info", claude_info_default);
-app36.route("/claude-capabilities", claude_capabilities_default);
-app36.route("/attachment", attachment_default);
-app36.route("/agents", agents_default);
-app36.route("/sessions", sessions_default);
-app36.route("/claude-sessions", claude_sessions_default);
-app36.route("/log-ingest", log_ingest_default);
-app36.route("/events", events_default);
-app36.route("/files", files_default);
-app36.route("/graph-search", graph_search_default);
-app36.route("/graph-subgraph", graph_subgraph_default);
-app36.route("/graph-delete", graph_delete_default);
-app36.route("/graph-restore", graph_restore_default);
-app36.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app36.route("/graph-default-view", graph_default_view_default);
-app36.route("/session-defaults", session_defaults_default);
-app36.route("/file-attach", file_attach_default);
-app36.route("/sidebar-artefacts", sidebar_artefacts_default);
-app36.route("/sidebar-artefact-save", sidebar_artefact_save_default);
-app36.route("/sidebar-artefact-content", sidebar_artefact_content_default);
-app36.route("/system-stats", system_stats_default);
-app36.route("/health-brand", health_default2);
-app36.route("/linkedin-ingest", linkedin_ingest_default);
-app36.route("/post-turn-context", post_turn_context_default);
-app36.route("/public-session-context", public_session_context_default);
-app36.route("/access-session-evict", access_session_evict_default);
-var admin_default = app36;
+var app37 = new Hono();
+app37.route("/session", session_default);
+app37.route("/new-session-failure", new_session_failure_default);
+app37.route("/new-session-submit", new_session_submit_default);
+app37.route("/logs", logs_default);
+app37.route("/claude-info", claude_info_default);
+app37.route("/claude-capabilities", claude_capabilities_default);
+app37.route("/attachment", attachment_default);
+app37.route("/agents", agents_default);
+app37.route("/sessions", sessions_default);
+app37.route("/claude-sessions", claude_sessions_default);
+app37.route("/log-ingest", log_ingest_default);
+app37.route("/events", events_default);
+app37.route("/files", files_default);
+app37.route("/graph-search", graph_search_default);
+app37.route("/graph-subgraph", graph_subgraph_default);
+app37.route("/graph-delete", graph_delete_default);
+app37.route("/graph-restore", graph_restore_default);
+app37.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app37.route("/graph-default-view", graph_default_view_default);
+app37.route("/session-defaults", session_defaults_default);
+app37.route("/file-attach", file_attach_default);
+app37.route("/sidebar-artefacts", sidebar_artefacts_default);
+app37.route("/sidebar-artefact-save", sidebar_artefact_save_default);
+app37.route("/sidebar-artefact-content", sidebar_artefact_content_default);
+app37.route("/system-stats", system_stats_default);
+app37.route("/health-brand", health_default2);
+app37.route("/linkedin-ingest", linkedin_ingest_default);
+app37.route("/post-turn-context", post_turn_context_default);
+app37.route("/public-session-context", public_session_context_default);
+app37.route("/public-session-exit", public_session_exit_default);
+app37.route("/access-session-evict", access_session_evict_default);
+var admin_default = app37;
 
 // app/lib/access-gate.ts
 import neo4j5 from "neo4j-driver";
@@ -12719,11 +12815,11 @@ async function generateNewMagicToken(grantId) {
 }
 
 // server/routes/access/verify-token.ts
-var TAG24 = "[access-verify]";
+var TAG25 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
-var app37 = new Hono();
-app37.post("/", async (c) => {
+var app38 = new Hono();
+app38.post("/", async (c) => {
   const ip = c.var.clientIp || "unknown";
   let body;
   try {
@@ -12738,39 +12834,39 @@ app37.post("/", async (c) => {
   }
   const rateMsg = checkAccessRateLimit(ip, agentSlug);
   if (rateMsg) {
-    console.error(`${TAG24} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
+    console.error(`${TAG25} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
     return c.json({ error: rateMsg }, 429);
   }
   const grant = await findGrantByMagicToken(token);
   if (!grant) {
     recordAccessFailedAttempt(ip, agentSlug);
-    console.error(`${TAG24} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
+    console.error(`${TAG25} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.agentSlug !== agentSlug) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG24} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
+      `${TAG25} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
     );
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.status === "expired" || grant.status === "revoked") {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG24} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
+      `${TAG25} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (grant.expiresAt !== null && grant.expiresAt < Date.now()) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG24} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
+      `${TAG25} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (!grant.sliceToken) {
     console.error(
-      `${TAG24} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
+      `${TAG25} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
     );
     return c.json({ error: "grant-misconfigured" }, 500);
   }
@@ -12786,12 +12882,12 @@ app37.post("/", async (c) => {
     await consumeMagicTokenAndActivate(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG24} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG25} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ error: "verification-failed" }, 500);
   }
   clearAccessRateLimit(ip, agentSlug);
-  console.log(`${TAG24} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
+  console.log(`${TAG25} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
   console.log(
     `${MINT_TAG} grantId=${grant.grantId} sliceToken=${grant.sliceToken.slice(0, 8)} agentSlug=${agentSlug} personId=${grant.personId ?? "none"}`
   );
@@ -12805,7 +12901,7 @@ app37.post("/", async (c) => {
     displayName: grant.displayName
   });
 });
-var verify_token_default = app37;
+var verify_token_default = app38;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
@@ -12867,10 +12963,10 @@ async function sendMagicLinkEmail(payload) {
 }
 
 // server/routes/access/request-magic-link.ts
-var TAG25 = "[access-request-link]";
-var app38 = new Hono();
+var TAG26 = "[access-request-link]";
+var app39 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
-app38.post("/", async (c) => {
+app39.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -12884,18 +12980,18 @@ app38.post("/", async (c) => {
   }
   const rateMsg = checkRequestLinkRateLimit(contactValue);
   if (rateMsg) {
-    console.error(`${TAG25} contactValue=${maskContact(contactValue)} result=rate-limited`);
+    console.error(`${TAG26} contactValue=${maskContact(contactValue)} result=rate-limited`);
     return c.json({ error: rateMsg }, 429);
   }
   recordRequestLinkAttempt(contactValue);
   const accountId = process.env.ACCOUNT_ID ?? "";
   if (!accountId) {
-    console.error(`${TAG25} contactValue=${maskContact(contactValue)} result=no-account-id`);
+    console.error(`${TAG26} contactValue=${maskContact(contactValue)} result=no-account-id`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   const grant = await findActiveGrantByContact(contactValue, agentSlug, accountId);
   if (!grant) {
-    console.log(`${TAG25} contactValue=${maskContact(contactValue)} result=notfound`);
+    console.log(`${TAG26} contactValue=${maskContact(contactValue)} result=notfound`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   let token;
@@ -12903,7 +12999,7 @@ app38.post("/", async (c) => {
     token = await generateNewMagicToken(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG25} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG26} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
@@ -12935,22 +13031,22 @@ app38.post("/", async (c) => {
   });
   if (!sendResult.ok) {
     console.error(
-      `${TAG25} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
+      `${TAG26} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   console.log(
-    `${TAG25} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
+    `${TAG26} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
-var request_magic_link_default = app38;
+var request_magic_link_default = app39;
 
 // server/routes/access/index.ts
-var app39 = new Hono();
-app39.route("/verify-token", verify_token_default);
-app39.route("/request-magic-link", request_magic_link_default);
-var access_default = app39;
+var app40 = new Hono();
+app40.route("/verify-token", verify_token_default);
+app40.route("/request-magic-link", request_magic_link_default);
+var access_default = app40;
 
 // server/routes/sites.ts
 import { existsSync as existsSync21, readFileSync as readFileSync17, realpathSync as realpathSync5, statSync as statSync7 } from "fs";
@@ -12985,8 +13081,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app40 = new Hono();
-app40.get("/:rel{.*}", (c) => {
+var app41 = new Hono();
+app41.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -13089,7 +13185,7 @@ app40.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app40;
+var sites_default = app41;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
@@ -13189,7 +13285,7 @@ function readBrandConfig() {
 }
 
 // server/routes/visitor-consent.ts
-var app41 = new Hono();
+var app42 = new Hono();
 var CONSENT_COOKIE_NAME = "mxy_consent";
 var CONSENT_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
 var DEFAULT_CONSENT_COPY = {
@@ -13234,17 +13330,17 @@ function siteSlugFromReferer(referer) {
     return "";
   }
 }
-app41.options("/consent", (c) => {
+app42.options("/consent", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app41.options("/brand-config", (c) => {
+app42.options("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app41.post("/consent", async (c) => {
+app42.post("/consent", async (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   let raw;
@@ -13284,7 +13380,7 @@ app41.post("/consent", async (c) => {
   console.log(`[consent] ${parsed.decision} site=${site} brand=${brandName} tokenBound=${tokenBound}`);
   return c.body(null, 204);
 });
-app41.get("/brand-config", (c) => {
+app42.get("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   const brand = readBrandConfig();
@@ -13294,7 +13390,7 @@ app41.get("/brand-config", (c) => {
   c.header("Cache-Control", "public, max-age=300");
   return c.json({ consent: { copy, palette } });
 });
-var visitor_consent_default = app41;
+var visitor_consent_default = app42;
 
 // server/routes/listings.ts
 function getCookie(headerValue, name) {
@@ -13321,8 +13417,8 @@ function appendConsentParams(pageUrl, token) {
 }
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
 var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
-var app42 = new Hono();
-app42.get("/:slug/click", async (c) => {
+var app43 = new Hono();
+app43.get("/:slug/click", async (c) => {
   const slug = c.req.param("slug") ?? "";
   const rawSession = c.req.query("session") ?? "";
   const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
@@ -13386,10 +13482,10 @@ app42.get("/:slug/click", async (c) => {
   console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} consent=${consentCookie ?? "absent"} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
   return c.redirect(redirectUrl, 302);
 });
-var listings_default = app42;
+var listings_default = app43;
 
 // server/routes/visitor-event.ts
-var app43 = new Hono();
+var app44 = new Hono();
 var BOT_UA_RE = /\b(bot|crawl|spider|slurp|headlesschrome|phantomjs|googlebot|bingbot|yandex|baiduspider|ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)\b/i;
 var buckets = /* @__PURE__ */ new Map();
 var RATE_LIMIT = 60;
@@ -13456,12 +13552,12 @@ function originAllowed(origin, allowlist) {
     return false;
   }
 }
-app43.options("/event", (c) => {
+app44.options("/event", (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   return c.body(null, 204);
 });
-app43.post("/event", async (c) => {
+app44.post("/event", async (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   const ua = c.req.header("user-agent") ?? "";
@@ -13666,7 +13762,7 @@ async function writeEvent(opts) {
     );
   }
 }
-var visitor_event_default = app43;
+var visitor_event_default = app44;
 
 // app/lib/graph-health.ts
 var HOUR_MS = 60 * 60 * 1e3;
@@ -13750,7 +13846,7 @@ function startGraphHealthTimer() {
 }
 
 // app/lib/whatsapp/inbound/claude-bridge.ts
-var TAG26 = "[whatsapp-adaptor]";
+var TAG27 = "[whatsapp-adaptor]";
 function whatsappTurnTimeoutMs() {
   return Number(process.env.WHATSAPP_PTY_TURN_TIMEOUT_MS ?? String(5 * 6e4));
 }
@@ -13773,7 +13869,7 @@ async function dispatchToClaude(input) {
     await input.reply(result.turnText);
   } catch (err) {
     const m = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG26} reject reason=reply-failed senderId=${input.senderId} message=${m}`);
+    console.error(`${TAG27} reject reason=reply-failed senderId=${input.senderId} message=${m}`);
   }
 }
 function startReaper2() {
@@ -14103,9 +14199,9 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app44 = new Hono();
-app44.use("*", clientIpMiddleware);
-app44.use("*", async (c, next) => {
+var app45 = new Hono();
+app45.use("*", clientIpMiddleware);
+app45.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -14115,7 +14211,7 @@ app44.use("*", async (c, next) => {
   );
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app44.use("*", async (c, next) => {
+app45.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -14148,7 +14244,7 @@ var PUBLIC_ALLOWED_PREFIXES = [
   "/sites/"
 ];
 var PUBLIC_ALLOWED_EXACT = ["/favicon.ico"];
-app44.use("*", async (c, next) => {
+app45.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (!isPublicHost(host)) {
     await next();
@@ -14188,7 +14284,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app44.post("/__remote-auth/login", async (c) => {
+app45.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -14233,7 +14329,7 @@ app44.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app44.get("/__remote-auth/logout", (c) => {
+app45.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -14246,7 +14342,7 @@ app44.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app44.post("/__remote-auth/change-password", async (c) => {
+app45.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -14297,13 +14393,13 @@ app44.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app44.get("/__remote-auth/setup", (c) => {
+app45.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app44.post("/__remote-auth/set-initial-password", async (c) => {
+app45.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -14341,10 +14437,10 @@ app44.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app44.get("/api/remote-auth/status", (c) => {
+app45.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app44.post("/api/remote-auth/set-password", async (c) => {
+app45.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -14375,9 +14471,9 @@ app44.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app44.route("/api/_client-error", client_error_default);
+app45.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
-app44.use("*", async (c, next) => {
+app45.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
@@ -14410,12 +14506,12 @@ app44.use("*", async (c, next) => {
   console.error(`[remote-auth] login required ip=${clientIp} path=${path2} ${disambig}`);
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), redirect: path2 }), 200);
 });
-app44.route("/api/health", health_default);
-app44.route("/api/chat", chat_default);
-app44.route("/api/whatsapp", whatsapp_default);
-app44.route("/api/onboarding", onboarding_default);
-app44.route("/api/admin", admin_default);
-app44.route("/api/access", access_default);
+app45.route("/api/health", health_default);
+app45.route("/api/chat", chat_default);
+app45.route("/api/whatsapp", whatsapp_default);
+app45.route("/api/onboarding", onboarding_default);
+app45.route("/api/admin", admin_default);
+app45.route("/api/access", access_default);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -14427,7 +14523,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app44.get("/agent-assets/:slug/:filename", (c) => {
+app45.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -14462,7 +14558,7 @@ app44.get("/agent-assets/:slug/:filename", (c) => {
     "Cache-Control": "public, max-age=3600"
   });
 });
-app44.get("/generated/:filename", (c) => {
+app45.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -14492,10 +14588,10 @@ app44.get("/generated/:filename", (c) => {
     "Cache-Control": "public, max-age=86400"
   });
 });
-app44.route("/sites", sites_default);
-app44.route("/listings", listings_default);
-app44.route("/v", visitor_event_default);
-app44.route("/v", visitor_consent_default);
+app45.route("/sites", sites_default);
+app45.route("/listings", listings_default);
+app45.route("/v", visitor_event_default);
+app45.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
@@ -14632,7 +14728,7 @@ function brandedPublicHtml(agentSlug) {
 function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-app44.get("/", (c) => {
+app45.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) {
     const defaultSlug = resolveDefaultSlug();
@@ -14640,12 +14736,12 @@ app44.get("/", (c) => {
   }
   return c.html(cachedHtml("index.html"));
 });
-app44.get("/public", (c) => {
+app45.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app44.get("/chat", (c) => {
+app45.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -14664,9 +14760,9 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app44.use("/vnc-viewer.html", logViewerFetch);
-app44.use("/vnc-popout.html", logViewerFetch);
-app44.get("/vnc-popout.html", (c) => {
+app45.use("/vnc-viewer.html", logViewerFetch);
+app45.use("/vnc-popout.html", logViewerFetch);
+app45.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
     html = readFileSync21(resolve22(process.cwd(), "public", "vnc-popout.html"), "utf-8");
@@ -14679,7 +14775,7 @@ app44.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app44.post("/api/vnc/client-event", async (c) => {
+app45.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -14700,25 +14796,25 @@ app44.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app44.get("/g/:slug", (c) => {
+app45.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
-app44.get("/graph", (c) => {
+app45.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app44.get("/sessions", (c) => {
+app45.get("/sessions", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("sessions.html"));
 });
-app44.get("/data", (c) => {
+app45.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app44.get("/:slug", async (c, next) => {
+app45.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const branding = loadBrandingCache(slug);
@@ -14728,15 +14824,15 @@ app44.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app44.get("/favicon.ico", (c) => {
+  app45.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app44.use("/*", serveStatic({ root: "./public" }));
+app45.use("/*", serveStatic({ root: "./public" }));
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app44.fetch, port, hostname });
+var httpServer = serve({ fetch: app45.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const loopHist = monitorEventLoopDelay({ resolution: 50 });
@@ -14772,7 +14868,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app44.routes ?? []) {
+  for (const r of app45.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });