@rubytech/create-maxy-code 0.1.187 → 0.1.189

package/payload/server/server.js

@@ -38,7 +38,6 @@ import {
   getRecentMessages,
   getRoleForSession,
   getSession,
-  getSessionIdByClaudeSessionId,
   getSessionIdForSession,
   getSessionKeyBySessionId,
   getUserIdForSession,
@@ -84,7 +83,7 @@ import {
   vncLog,
   walkPremiumBundles,
   writeAdminUserAndPerson
-} from "./chunk-EFJ2EXZK.js";
+} from "./chunk-WWD4TCJJ.js";
 import {
   __commonJS,
   __toESM
@@ -816,9 +815,9 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync21, existsSync as existsSync24, watchFile } from "fs";
-import { resolve as resolve22, join as join15, basename as basename5 } from "path";
-import { homedir as homedir3 } from "os";
+import { readFileSync as readFileSync20, existsSync as existsSync23, watchFile } from "fs";
+import { resolve as resolve22, join as join14, basename as basename5 } from "path";
+import { homedir as homedir2 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
 // app/lib/agent-slug-pattern.ts
@@ -6780,64 +6779,6 @@ app6.post("/", async (c) => {
 });
 var session_default = app6;
 
-// server/routes/admin/new-session-failure.ts
-var REASON_VALUES = /* @__PURE__ */ new Set(["server-status", "network-error"]);
-var ISO_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/;
-var app7 = new Hono();
-app7.post("/", requireAdminSession, async (c) => {
-  let body;
-  try {
-    body = await c.req.json();
-  } catch {
-    console.error(`[admin-chat] new-conversation outcome=fail reason=schema:body-not-json`);
-    return c.json({ ok: false, reason: "body-not-json" }, 400);
-  }
-  if (typeof body.reason !== "string" || !REASON_VALUES.has(body.reason)) {
-    console.error(`[admin-chat] new-conversation outcome=fail reason=schema:reason`);
-    return c.json({ ok: false, reason: "schema:reason" }, 400);
-  }
-  if (typeof body.at !== "string" || !ISO_RE.test(body.at)) {
-    console.error(`[admin-chat] new-conversation outcome=fail reason=schema:at`);
-    return c.json({ ok: false, reason: "schema:at" }, 400);
-  }
-  let statusToken;
-  if (body.reason === "server-status") {
-    if (typeof body.status !== "number" || !Number.isInteger(body.status) || body.status < 100 || body.status > 599) {
-      console.error(`[admin-chat] new-conversation outcome=fail reason=schema:status`);
-      return c.json({ ok: false, reason: "schema:status" }, 400);
-    }
-    statusToken = String(body.status);
-  } else {
-    statusToken = "net";
-  }
-  const cacheKey = c.var.cacheKey;
-  const cacheKeyTag = cacheKey.slice(0, 8);
-  console.log(`[admin-chat] new-conversation outcome=fail cacheKey=${cacheKeyTag} status=${statusToken} reason=${body.reason} at=${body.at}`);
-  return c.body(null, 204);
-});
-var new_session_failure_default = app7;
-
-// server/routes/admin/new-session-submit.ts
-var ISO_RE2 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/;
-var app8 = new Hono();
-app8.post("/", requireAdminSession, async (c) => {
-  let body;
-  try {
-    body = await c.req.json();
-  } catch {
-    console.error(`[admin-chat] new-conversation outcome=submit reason=schema:body-not-json`);
-    return c.json({ ok: false, reason: "body-not-json" }, 400);
-  }
-  if (typeof body.at !== "string" || !ISO_RE2.test(body.at)) {
-    console.error(`[admin-chat] new-conversation outcome=submit reason=schema:at`);
-    return c.json({ ok: false, reason: "schema:at" }, 400);
-  }
-  const cacheKey = c.var.cacheKey;
-  console.log(`[admin-chat] new-conversation outcome=submit cacheKey=${cacheKey.slice(0, 8)} at=${body.at}`);
-  return c.body(null, 204);
-});
-var new_session_submit_default = app8;
-
 // server/routes/admin/logs.ts
 import { existsSync as existsSync10, readdirSync as readdirSync5, readFileSync as readFileSync10, statSync as statSync5 } from "fs";
 import { resolve as resolve7, basename as basename3 } from "path";
@@ -6859,8 +6800,8 @@ function resolveSessionLogPaths(filename, logDirs) {
 
 // server/routes/admin/logs.ts
 var TAIL_BYTES = 8192;
-var app9 = new Hono();
-app9.get("/", async (c) => {
+var app7 = new Hono();
+app7.get("/", async (c) => {
   const fileParam = c.req.query("file");
   const typeParam = c.req.query("type");
   const sessionIdParam = c.req.query("sessionId");
@@ -7002,12 +6943,12 @@ app9.get("/", async (c) => {
   }
   return c.json({ logs });
 });
-var logs_default = app9;
+var logs_default = app7;
 
 // server/routes/admin/claude-info.ts
 import { execFileSync as execFileSync3 } from "child_process";
-var app10 = new Hono();
-app10.get("/", (c) => {
+var app8 = new Hono();
+app8.get("/", (c) => {
   let version = "unknown";
   try {
     const raw = execFileSync3("claude", ["--version"], { encoding: "utf-8", timeout: 5e3 });
@@ -7025,55 +6966,14 @@ app10.get("/", (c) => {
   const thinkingView = resolvedAccount?.config.thinkingView ?? "default";
   return c.json({ version, account, model, thinkingView });
 });
-var claude_info_default = app10;
-
-// server/routes/admin/claude-capabilities.ts
-import { existsSync as existsSync11, readFileSync as readFileSync11 } from "fs";
-import { dirname as dirname2, join as join10 } from "path";
-import { homedir } from "os";
-var app11 = new Hono();
-function resolveClaudeJsonPath() {
-  const configDir2 = process.env.CLAUDE_CONFIG_DIR ?? join10(homedir(), ".claude");
-  return join10(dirname2(configDir2), ".claude.json");
-}
-function readSeatTier(path2) {
-  if (!existsSync11(path2)) return null;
-  let raw;
-  try {
-    raw = readFileSync11(path2, "utf8");
-  } catch {
-    return null;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return null;
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-  const oauth = parsed.oauthAccount;
-  if (!oauth || typeof oauth !== "object" || Array.isArray(oauth)) return null;
-  const seatTier = oauth.seatTier;
-  if (typeof seatTier !== "string") return null;
-  return seatTier;
-}
-app11.get("/", (c) => {
-  const path2 = resolveClaudeJsonPath();
-  const seatTier = readSeatTier(path2);
-  const body = {
-    seatTier,
-    autoModeAvailable: typeof seatTier === "string" && seatTier.length > 0
-  };
-  return c.json(body);
-});
-var claude_capabilities_default = app11;
+var claude_info_default = app8;
 
 // server/routes/admin/attachment.ts
 import { readFile as readFile3, readdir } from "fs/promises";
-import { existsSync as existsSync12 } from "fs";
+import { existsSync as existsSync11 } from "fs";
 import { resolve as resolve8 } from "path";
-var app12 = new Hono();
-app12.get("/:attachmentId", requireAdminSession, async (c) => {
+var app9 = new Hono();
+app9.get("/:attachmentId", requireAdminSession, async (c) => {
   const attachmentId = c.req.param("attachmentId");
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
@@ -7084,11 +6984,11 @@ app12.get("/:attachmentId", requireAdminSession, async (c) => {
     return new Response("Not found", { status: 404 });
   }
   const dir = resolve8(ATTACHMENTS_ROOT, accountId, attachmentId);
-  if (!existsSync12(dir)) {
+  if (!existsSync11(dir)) {
     return new Response("Not found", { status: 404 });
   }
   const metaPath = resolve8(dir, `${attachmentId}.meta.json`);
-  if (!existsSync12(metaPath)) {
+  if (!existsSync11(metaPath)) {
     return new Response("Not found", { status: 404 });
   }
   let meta;
@@ -7112,17 +7012,17 @@ app12.get("/:attachmentId", requireAdminSession, async (c) => {
     }
   });
 });
-var attachment_default = app12;
+var attachment_default = app9;
 
 // server/routes/admin/agents.ts
 import { resolve as resolve9 } from "path";
-import { readdirSync as readdirSync6, readFileSync as readFileSync12, existsSync as existsSync13, rmSync } from "fs";
-var app13 = new Hono();
-app13.get("/", (c) => {
+import { readdirSync as readdirSync6, readFileSync as readFileSync11, existsSync as existsSync12, rmSync } from "fs";
+var app10 = new Hono();
+app10.get("/", (c) => {
   const account = resolveAccount();
   if (!account) return c.json({ agents: [] });
   const agentsDir = resolve9(account.accountDir, "agents");
-  if (!existsSync13(agentsDir)) return c.json({ agents: [] });
+  if (!existsSync12(agentsDir)) return c.json({ agents: [] });
   const agents = [];
   try {
     const entries = readdirSync6(agentsDir, { withFileTypes: true });
@@ -7130,9 +7030,9 @@ app13.get("/", (c) => {
       if (!entry.isDirectory()) continue;
       if (entry.name === "admin") continue;
       const configPath2 = resolve9(agentsDir, entry.name, "config.json");
-      if (!existsSync13(configPath2)) continue;
+      if (!existsSync12(configPath2)) continue;
       try {
-        const config = JSON.parse(readFileSync12(configPath2, "utf-8"));
+        const config = JSON.parse(readFileSync11(configPath2, "utf-8"));
         agents.push({
           slug: entry.name,
           displayName: config.displayName ?? entry.name,
@@ -7148,7 +7048,7 @@ app13.get("/", (c) => {
   }
   return c.json({ agents });
 });
-app13.delete("/:slug", async (c) => {
+app10.delete("/:slug", async (c) => {
   const slug = c.req.param("slug");
   const account = resolveAccount();
   if (!account) return c.json({ error: "No account resolved" }, 400);
@@ -7159,7 +7059,7 @@ app13.delete("/:slug", async (c) => {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
   const agentDir = resolve9(account.accountDir, "agents", slug);
-  if (!existsSync13(agentDir)) {
+  if (!existsSync12(agentDir)) {
     return c.json({ error: "Agent not found" }, 404);
   }
   try {
@@ -7178,7 +7078,7 @@ app13.delete("/:slug", async (c) => {
     return c.json({ error: "Failed to delete agent" }, 500);
   }
 });
-app13.post("/:slug/project", async (c) => {
+app10.post("/:slug/project", async (c) => {
   const slug = c.req.param("slug");
   const account = resolveAccount();
   if (!account) return c.json({ error: "No account resolved" }, 400);
@@ -7189,7 +7089,7 @@ app13.post("/:slug/project", async (c) => {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
   const agentDir = resolve9(account.accountDir, "agents", slug);
-  if (!existsSync13(agentDir)) {
+  if (!existsSync12(agentDir)) {
     return c.json({ error: "Agent not found on disk" }, 404);
   }
   try {
@@ -7200,12 +7100,12 @@ app13.post("/:slug/project", async (c) => {
     return c.json({ error: `Projection failed: ${msg}` }, 500);
   }
 });
-var agents_default = app13;
+var agents_default = app10;
 
 // server/routes/admin/sessions.ts
 import crypto from "crypto";
 import { resolve as resolvePath } from "path";
-import { existsSync as existsSync14, mkdirSync as mkdirSync3, createWriteStream } from "fs";
+import { existsSync as existsSync13, mkdirSync as mkdirSync3, createWriteStream } from "fs";
 
 // ../lib/admin-conversation-purge/src/index.ts
 async function purgeAdminConversationJsonls(args) {
@@ -7343,7 +7243,7 @@ var replayJsonl = (..._args) => null;
 var resolveJsonlPath = (..._args) => null;
 
 // server/routes/admin/sessions.ts
-import { homedir as homedir2 } from "os";
+import { homedir } from "os";
 
 // app/lib/claude-agent/component-attachment.ts
 var pickComponentBytes = (..._args) => null;
@@ -7383,7 +7283,7 @@ function validateAndShapeAttachments(raws, conversationAccountId, sessionId, mes
     let reason = null;
     if (!a.attachmentId || !a.filename || !a.mimeType || !a.storagePath) reason = "schema-fail";
     else if (a.accountId !== conversationAccountId) reason = "account-mismatch";
-    else if (!existsSync14(a.storagePath)) reason = "missing-file";
+    else if (!existsSync13(a.storagePath)) reason = "missing-file";
     if (reason) {
       invalid++;
       try {
@@ -7490,8 +7390,8 @@ function formatAge(updatedAtStr) {
     return "unknown";
   }
 }
-var app14 = new Hono();
-app14.get("/", requireAdminSession, async (c) => {
+var app11 = new Hono();
+app11.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) return c.json({ error: "Account not found for session" }, 401);
@@ -7521,7 +7421,7 @@ app14.get("/", requireAdminSession, async (c) => {
     return c.json({ error: "Failed to fetch sessions" }, 500);
   }
 });
-app14.post("/new", requireAdminSession, async (c) => {
+app11.post("/new", requireAdminSession, async (c) => {
   const oldCacheKey = c.var.cacheKey;
   console.log(`[admin-chat] new-conversation outcome=ingress cacheKey=${oldCacheKey.slice(0, 8)}`);
   const accountId = getAccountIdForSession(oldCacheKey);
@@ -7538,7 +7438,7 @@ app14.post("/new", requireAdminSession, async (c) => {
   console.log(`[admin-chat] new-conversation outcome=ok oldKey=${oldCacheKey.slice(0, 8)} newKey=${newCacheKey.slice(0, 8)}`);
   return c.json({ session_key: newSignedSessionToken, sessionId: null });
 });
-app14.post("/switch", requireAdminSession, async (c) => {
+app11.post("/switch", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   const userId = getUserIdForSession(cacheKey);
@@ -7566,7 +7466,7 @@ app14.post("/switch", requireAdminSession, async (c) => {
   console.log(`[session-switch] from=${cacheKey.slice(0, 8)} to=${targetCacheKey.slice(0, 8)} targetConvId=${targetSessionId?.slice(0, 8) ?? "none"} accountId=${accountId.slice(0, 8)}`);
   return c.json({ session_key: targetSignedSessionToken, sessionId: targetSessionId });
 });
-app14.delete("/:id", requireAdminSession, async (c) => {
+app11.delete("/:id", requireAdminSession, async (c) => {
   const sessionId = c.req.param("id");
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
@@ -7612,7 +7512,7 @@ app14.delete("/:id", requireAdminSession, async (c) => {
     500
   );
 });
-app14.post("/:id/resume", async (c) => {
+app11.post("/:id/resume", async (c) => {
   const sessionId = c.req.param("id");
   const t0 = Date.now();
   const signedSessionToken = c.req.query("session_key") ?? "";
@@ -7677,7 +7577,7 @@ app14.post("/:id/resume", async (c) => {
     return c.json({ error: "Failed to load conversation messages" }, 500);
   }
   if (persistedAgentSessionId) {
-    const jsonlPath = resolveJsonlPath(homedir2(), resolvePath(ACCOUNTS_DIR, accountId), persistedAgentSessionId);
+    const jsonlPath = resolveJsonlPath(homedir(), resolvePath(ACCOUNTS_DIR, accountId), persistedAgentSessionId);
     const replay = replayJsonl(jsonlPath);
     jsonlMissing = replay.jsonlMissing;
     jsonlMalformedLines = replay.malformedLines;
@@ -7885,7 +7785,7 @@ app14.post("/:id/resume", async (c) => {
     }
   });
 });
-app14.put("/:id/label", requireAdminSession, async (c) => {
+app11.put("/:id/label", requireAdminSession, async (c) => {
   const sessionId = c.req.param("id");
   const cacheKey = c.var.cacheKey;
   let body;
@@ -7911,11 +7811,11 @@ app14.put("/:id/label", requireAdminSession, async (c) => {
     return c.json({ error: "Failed to rename session" }, 500);
   }
 });
-var sessions_default = app14;
+var sessions_default = app11;
 
 // app/lib/claude-agent/spawn-context.ts
-import { existsSync as existsSync15, readFileSync as readFileSync13, readdirSync as readdirSync7, statSync as statSync6 } from "fs";
-import { dirname as dirname3, resolve as resolve10, join as join11 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync12, readdirSync as readdirSync7, statSync as statSync6 } from "fs";
+import { dirname as dirname2, resolve as resolve10, join as join10 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
   try {
@@ -7944,14 +7844,14 @@ function frontmatterField(manifest, field) {
 function extractPluginToolDescriptions(pluginDir) {
   const out = /* @__PURE__ */ new Map();
   const candidates = [
-    join11(pluginDir, "mcp/dist/index.js"),
-    join11(pluginDir, "mcp/src/index.ts")
+    join10(pluginDir, "mcp/dist/index.js"),
+    join10(pluginDir, "mcp/src/index.ts")
   ];
   let raw = null;
   for (const path2 of candidates) {
-    if (!existsSync15(path2)) continue;
+    if (!existsSync14(path2)) continue;
     try {
-      raw = readFileSync13(path2, "utf-8");
+      raw = readFileSync12(path2, "utf-8");
       break;
     } catch {
     }
@@ -8001,23 +7901,23 @@ function parseSkillPathsFromFrontmatter(fm) {
 function listPluginDirs() {
   const out = /* @__PURE__ */ new Map();
   const platformPlugins = resolve10(PLATFORM_ROOT, "plugins");
-  if (existsSync15(platformPlugins)) {
+  if (existsSync14(platformPlugins)) {
     for (const name of readdirSync7(platformPlugins)) {
-      const dir = join11(platformPlugins, name);
+      const dir = join10(platformPlugins, name);
       try {
         if (statSync6(dir).isDirectory()) out.set(name, dir);
       } catch {
       }
     }
   }
-  const premiumRoot = resolve10(dirname3(PLATFORM_ROOT), "premium-plugins");
-  if (existsSync15(premiumRoot)) {
+  const premiumRoot = resolve10(dirname2(PLATFORM_ROOT), "premium-plugins");
+  if (existsSync14(premiumRoot)) {
     for (const bundle of readdirSync7(premiumRoot)) {
-      const bundlePlugins = join11(premiumRoot, bundle, "plugins");
-      if (!existsSync15(bundlePlugins)) continue;
+      const bundlePlugins = join10(premiumRoot, bundle, "plugins");
+      if (!existsSync14(bundlePlugins)) continue;
       try {
         for (const name of readdirSync7(bundlePlugins)) {
-          const dir = join11(bundlePlugins, name);
+          const dir = join10(bundlePlugins, name);
           try {
             if (statSync6(dir).isDirectory()) out.set(name, dir);
           } catch {
@@ -8031,9 +7931,9 @@ function listPluginDirs() {
 }
 function readEnabledPlugins(accountId) {
   const accountFile = resolve10(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync15(accountFile)) return /* @__PURE__ */ new Set();
+  if (!existsSync14(accountFile)) return /* @__PURE__ */ new Set();
   try {
-    const parsed = JSON.parse(readFileSync13(accountFile, "utf-8"));
+    const parsed = JSON.parse(readFileSync12(accountFile, "utf-8"));
     return new Set(
       Array.isArray(parsed.enabledPlugins) ? parsed.enabledPlugins.filter((p) => typeof p === "string") : []
     );
@@ -8042,10 +7942,10 @@ function readEnabledPlugins(accountId) {
   }
 }
 function readFrontmatter(path2) {
-  if (!existsSync15(path2)) return null;
+  if (!existsSync14(path2)) return null;
   let raw;
   try {
-    raw = readFileSync13(path2, "utf-8");
+    raw = readFileSync12(path2, "utf-8");
   } catch {
     return null;
   }
@@ -8060,7 +7960,7 @@ function computeActivePlugins(accountId) {
   for (const name of Array.from(enabled).sort()) {
     const dir = pluginDirs.get(name);
     if (!dir) continue;
-    const fm = readFrontmatter(join11(dir, "PLUGIN.md"));
+    const fm = readFrontmatter(join10(dir, "PLUGIN.md"));
     if (!fm) continue;
     const description = frontmatterField(`---
 ${fm}
@@ -8077,7 +7977,7 @@ ${fm}
       `plugin-manifest-tool-coverage plugin=${name} tools=${tools.length} with-desc=${withDesc}`
     );
     if (toolNames.length > 0 && descMap.size === 0) {
-      const hasSource = existsSync15(join11(dir, "mcp/dist/index.js")) || existsSync15(join11(dir, "mcp/src/index.ts"));
+      const hasSource = existsSync14(join10(dir, "mcp/dist/index.js")) || existsSync14(join10(dir, "mcp/src/index.ts"));
       if (hasSource) {
         console.warn(
           `[spawn-context] WARN plugin=${name} mcp source present but tool-description regex matched zero entries \u2014 SDK upgrade may have changed the registration shape`
@@ -8087,7 +7987,7 @@ ${fm}
     const skillPaths = parseSkillPathsFromFrontmatter(fm);
     const skills = [];
     for (const relPath2 of skillPaths) {
-      const skillPath = join11(dir, relPath2);
+      const skillPath = join10(dir, relPath2);
       const skillFm = readFrontmatter(skillPath);
       if (!skillFm) continue;
       const skillName = frontmatterField(`---
@@ -8104,7 +8004,7 @@ ${skillFm}
 }
 function computeSpecialistDomains(accountId) {
   const specialistsDir = resolve10(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
-  if (!existsSync15(specialistsDir)) return [];
+  if (!existsSync14(specialistsDir)) return [];
   let entries;
   try {
     entries = readdirSync7(specialistsDir);
@@ -8131,7 +8031,7 @@ function computeSpecialistDomains(accountId) {
   const out = [];
   for (const file of entries.sort()) {
     if (!file.endsWith(".md")) continue;
-    const fm = readFrontmatter(join11(specialistsDir, file));
+    const fm = readFrontmatter(join10(specialistsDir, file));
     if (!fm) continue;
     const wrapped = `---
 ${fm}
@@ -8150,10 +8050,10 @@ ${fm}
 }
 function computeDormantPlugins(accountId) {
   const accountFile = resolve10(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync15(accountFile)) return [];
+  if (!existsSync14(accountFile)) return [];
   let enabled;
   try {
-    const raw = readFileSync13(accountFile, "utf-8");
+    const raw = readFileSync12(accountFile, "utf-8");
     const parsed = JSON.parse(raw);
     enabled = new Set(
       Array.isArray(parsed.enabledPlugins) ? parsed.enabledPlugins.filter((p) => typeof p === "string") : []
@@ -8165,7 +8065,7 @@ function computeDormantPlugins(accountId) {
     return [];
   }
   const pluginsDir = resolve10(PLATFORM_ROOT, "plugins");
-  if (!existsSync15(pluginsDir)) return [];
+  if (!existsSync14(pluginsDir)) return [];
   let entries;
   try {
     entries = readdirSync7(pluginsDir);
@@ -8176,10 +8076,10 @@ function computeDormantPlugins(accountId) {
   for (const name of entries) {
     if (enabled.has(name)) continue;
     const manifestPath = resolve10(pluginsDir, name, "PLUGIN.md");
-    if (!existsSync15(manifestPath)) continue;
+    if (!existsSync14(manifestPath)) continue;
     let manifest;
     try {
-      manifest = readFileSync13(manifestPath, "utf-8");
+      manifest = readFileSync12(manifestPath, "utf-8");
     } catch {
       continue;
     }
@@ -8193,13 +8093,13 @@ function computeDormantPlugins(accountId) {
 }
 
 // server/routes/admin/claude-sessions.ts
-import { existsSync as existsSync16, readFileSync as readFileSync14 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync13 } from "fs";
 import { resolve as resolve11 } from "path";
 function readTunnelState(brandConfigDir) {
   const statePath = `${process.env.HOME ?? ""}/${brandConfigDir}/cloudflared/tunnel.state`;
-  if (!existsSync16(statePath)) return null;
+  if (!existsSync15(statePath)) return null;
   try {
-    const parsed = JSON.parse(readFileSync14(statePath, "utf-8"));
+    const parsed = JSON.parse(readFileSync13(statePath, "utf-8"));
     const tunnelId = typeof parsed.tunnelId === "string" ? parsed.tunnelId : null;
     const tunnelName = typeof parsed.tunnelName === "string" ? parsed.tunnelName : null;
     const domain = typeof parsed.domain === "string" ? parsed.domain : null;
@@ -8213,7 +8113,7 @@ function resolveTunnelUrl() {
   const platformRoot = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve11(process.cwd(), "..");
   let brand;
   try {
-    brand = JSON.parse(readFileSync14(resolve11(platformRoot, "config", "brand.json"), "utf-8"));
+    brand = JSON.parse(readFileSync13(resolve11(platformRoot, "config", "brand.json"), "utf-8"));
   } catch {
     return null;
   }
@@ -8240,7 +8140,7 @@ function managerBase3() {
   const port2 = requirePortEnv("CLAUDE_SESSION_MANAGER_PORT", { tag: "claude-session-manager:wrapper" });
   return `http://127.0.0.1:${port2}`;
 }
-var app15 = new Hono();
+var app12 = new Hono();
 var UUID_PATTERN = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 async function performSpawnWithInitialMessage(args) {
   const ownerStart = Date.now();
@@ -8327,8 +8227,8 @@ var requireAdminSessionUnlessLoopbackSpawn = async (c, next) => {
   }
   return requireAdminSession(c, next);
 };
-app15.use("*", requireAdminSessionUnlessLoopbackSpawn);
-app15.post("/", async (c) => {
+app12.use("*", requireAdminSessionUnlessLoopbackSpawn);
+app12.post("/", async (c) => {
   const routeStart = Date.now();
   const cacheKey = c.get("cacheKey") ?? "";
   let body = {};
@@ -8361,10 +8261,14 @@ app15.post("/", async (c) => {
       console.error(`${TAG18} fetch-failed op=operator-meta-lookup message=${err instanceof Error ? err.message : String(err)}`);
       return null;
     });
-    const operatorSenderId = operatorMeta && typeof operatorMeta.senderId === "string" && operatorMeta.senderId.length > 0 ? operatorMeta.senderId : null;
+    const metaSenderId = operatorMeta && typeof operatorMeta.senderId === "string" && operatorMeta.senderId.length > 0 ? operatorMeta.senderId : null;
+    const bodyAccountId = typeof body.accountId === "string" && UUID_PATTERN.test(body.accountId) ? body.accountId : null;
+    const operatorSenderId = metaSenderId ?? bodyAccountId;
     if (!operatorSenderId) {
+      console.error(`${TAG18} reject reason=no-sender-id adminSessionId=${lookupSessionId.slice(0, 8)} metaSenderId=${metaSenderId ? "present" : "absent"} bodyAccountId=${bodyAccountId ? "present" : "absent"}`);
       return c.json({ error: "admin-session-not-found" }, 404);
     }
+    console.log(`${TAG18} loopback-sender-resolved source=${metaSenderId ? "meta" : "body-accountId"} accountId=${operatorSenderId.slice(0, 8)}`);
     senderId = operatorSenderId;
     userId = void 0;
   }
@@ -8395,271 +8299,18 @@ app15.post("/", async (c) => {
   console.log(`${TAG18} route-done surface=${authSurface} status=${response.status} route-ms=${Date.now() - routeStart}`);
   return response;
 });
-app15.get("/events", async (c) => {
-  const upstream = await fetch(`${managerBase3()}/events`, {
-    headers: { accept: "text/event-stream" }
-  }).catch((err) => {
-    console.error(`${TAG18} fetch-failed op=events message=${err instanceof Error ? err.message : String(err)}`);
-    return null;
-  });
-  if (!upstream || !upstream.body) return c.json({ error: "manager-unreachable" }, 503);
-  return new Response(upstream.body, {
-    status: upstream.status,
-    headers: {
-      "content-type": "text/event-stream",
-      "cache-control": "no-cache, no-transform",
-      "x-accel-buffering": "no",
-      connection: "keep-alive"
-    }
-  });
-});
-app15.get("/", async (c) => {
-  const cacheKey = c.get("cacheKey") ?? "";
-  const senderId = getAccountIdForSession(cacheKey) ?? "";
-  if (!senderId) return c.json({ error: "admin-account-not-resolved" }, 500);
-  const upstream = await fetch(
-    `${managerBase3()}/list?senderId=${encodeURIComponent(senderId)}`
-  ).catch((err) => {
-    console.error(`${TAG18} fetch-failed op=list message=${err instanceof Error ? err.message : String(err)}`);
-    return null;
-  });
-  if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
-  return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
-});
-app15.post("/resume", async (c) => {
-  const cacheKey = c.get("cacheKey") ?? "";
-  const senderId = getAccountIdForSession(cacheKey) ?? "";
-  if (!senderId) return c.json({ error: "admin-account-not-resolved" }, 500);
-  const userId = getUserIdForSession(cacheKey);
-  let body = {};
-  try {
-    body = await c.req.json();
-  } catch {
-    return c.json({ error: "body-not-json" }, 400);
-  }
-  if (typeof body.sessionId !== "string" || !body.sessionId) {
-    return c.json({ error: "sessionId-required" }, 400);
-  }
-  const refusal = await refuseIfClaudeAuthDead(c, "resume", body.sessionId);
-  if (refusal) return refusal;
-  const channel = typeof body.channel === "string" ? body.channel : "browser";
-  const idempotencyKey = typeof body.idempotencyKey === "string" ? body.idempotencyKey : void 0;
-  const aboutOwner = await resolveOwnerProfileBlock(senderId, userId);
-  const dormantPlugins = computeDormantPlugins(senderId);
-  const activePlugins = computeActivePlugins(senderId);
-  const specialistDomains = computeSpecialistDomains(senderId);
-  const tunnelUrl = resolveTunnelUrl();
-  const upstream = await fetch(`${managerBase3()}/resume`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({
-      senderId,
-      // Task 205 — resume parity with /spawn: thread userId so the
-      // respawned pty inherits the same USER_ID env.
-      userId,
-      role: "admin",
-      channel,
-      sessionId: body.sessionId,
-      idempotencyKey,
-      aboutOwner,
-      dormantPlugins,
-      activePlugins,
-      specialistDomains,
-      tunnelUrl,
-      // Task 382 — resume parity with /spawn: thread the active
-      // sessionId so the re-spawned PTY's MCP env carries
-      // SESSION_NODE_ID. Undefined when no active conversation is
-      // bound to this cacheKey (rare for resume — the user is by
-      // definition continuing a known conversation).
-      conversationNodeId: getSessionIdForSession(cacheKey)
-    })
-  }).catch((err) => {
-    console.error(`${TAG18} fetch-failed op=resume message=${err instanceof Error ? err.message : String(err)}`);
-    return null;
-  });
-  if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
-  const bodyText = await upstream.text().catch(() => "");
-  let claudeSessionIdFromResume = null;
-  if (upstream.ok) {
-    try {
-      const parsed = JSON.parse(bodyText);
-      if (typeof parsed.sessionId === "string" && parsed.sessionId.length > 0) {
-        claudeSessionIdFromResume = parsed.sessionId;
-      }
-    } catch {
-    }
-  }
-  mintTranscriptEdge(
-    getSessionIdForSession(cacheKey),
-    claudeSessionIdFromResume,
-    senderId
-  );
-  return new Response(bodyText, { status: upstream.status, headers: upstream.headers });
-});
-app15.post("/:sessionId/stop", async (c) => {
-  const sessionId = c.req.param("sessionId");
-  const upstream = await fetch(
-    `${managerBase3()}/${encodeURIComponent(sessionId)}/stop`,
-    { method: "POST" }
-  ).catch((err) => {
-    console.error(`${TAG18} fetch-failed op=stop message=${err instanceof Error ? err.message : String(err)}`);
-    return null;
-  });
-  if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
-  return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
-});
-app15.post("/:sessionId/rename", async (c) => {
-  const sessionId = c.req.param("sessionId");
-  const body = await c.req.text();
-  const upstream = await fetch(
-    `${managerBase3()}/${encodeURIComponent(sessionId)}/rename`,
-    {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body
-    }
-  ).catch((err) => {
-    console.error(`${TAG18} fetch-failed op=rename message=${err instanceof Error ? err.message : String(err)}`);
-    return null;
-  });
-  if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
-  return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
-});
-app15.delete("/:sessionId", async (c) => {
-  const claudeSessionId = c.req.param("sessionId");
-  const cacheKey = c.get("cacheKey") ?? "";
-  const accountId = getAccountIdForSession(cacheKey) ?? "";
-  if (!accountId) return c.json({ error: "admin-account-not-resolved" }, 500);
-  const sessionId = await getSessionIdByClaudeSessionId(claudeSessionId, accountId);
-  if (!sessionId) {
-    console.log(`[admin-conversation-delete] reason=no-conversation-mapping claudeSessionId=${claudeSessionId.slice(0, 8)}`);
-    const upstream = await fetch(
-      `${managerBase3()}/${encodeURIComponent(claudeSessionId)}`,
-      { method: "DELETE" }
-    ).catch((err) => {
-      console.error(`${TAG18} fetch-failed op=delete message=${err instanceof Error ? err.message : String(err)}`);
-      return null;
-    });
-    if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
-    return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
-  }
-  let siblings;
-  try {
-    siblings = await getConversationClaudeSessionIds(sessionId, accountId);
-  } catch {
-    siblings = [claudeSessionId];
-  }
-  const all = [claudeSessionId, ...siblings.filter((s) => s !== claudeSessionId)];
-  const outcome = await cascadeAdminConversationDelete({
-    sessionId,
-    accountId,
-    managerBase: managerBase3(),
-    claudeSessionIds: all
-  });
-  if (outcome.ok) return c.json({ ok: true, claudeSessionIds: outcome.claudeSessionIds });
-  if (outcome.reason === "pty-still-alive") {
-    return c.json(
-      { error: "pty-still-alive", detail: "stop the session before deleting", claudeSessionId: outcome.claudeSessionId },
-      409
-    );
-  }
-  if (outcome.reason === "conversation-not-found") {
-    return c.json({ ok: true, claudeSessionIds: [] });
-  }
-  if (outcome.reason === "jsonl-purge-failed") {
-    return c.json(
-      {
-        error: "jsonl-purge-failed",
-        detail: outcome.message,
-        claudeSessionId: outcome.claudeSessionId,
-        sessionId,
-        claudeSessionIdsPurged: outcome.claudeSessionIdsPurged
-      },
-      outcome.status >= 400 && outcome.status < 600 ? outcome.status : 502
-    );
-  }
-  return c.json(
-    {
-      error: "graph-delete-failed",
-      detail: outcome.message,
-      sessionId,
-      claudeSessionIdsPurged: outcome.claudeSessionIdsPurged
-    },
-    500
-  );
-});
-app15.post("/:sessionId/archive", async (c) => {
-  const sessionId = c.req.param("sessionId");
-  const body = await c.req.text();
-  const upstream = await fetch(
-    `${managerBase3()}/${encodeURIComponent(sessionId)}/archive`,
-    {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body
-    }
-  ).catch((err) => {
-    console.error(`${TAG18} fetch-failed op=archive message=${err instanceof Error ? err.message : String(err)}`);
-    return null;
-  });
-  if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
-  return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
-});
-app15.get("/:sessionId/meta", async (c) => {
-  const sessionId = c.req.param("sessionId");
-  const upstream = await fetch(
-    `${managerBase3()}/${encodeURIComponent(sessionId)}/meta`
-  ).catch((err) => {
-    console.error(`${TAG18} fetch-failed op=meta message=${err instanceof Error ? err.message : String(err)}`);
-    return null;
-  });
-  if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
-  return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
-});
-app15.post("/:sessionId/input", async (c) => {
-  const sessionId = c.req.param("sessionId");
-  const rawBody = await c.req.text();
-  const upstream = await fetch(
-    `${managerBase3()}/${encodeURIComponent(sessionId)}/input`,
-    {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: rawBody
-    }
-  ).catch((err) => {
-    console.error(`${TAG18} fetch-failed op=input message=${err instanceof Error ? err.message : String(err)}`);
-    return null;
-  });
-  if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
-  return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
-});
-app15.get("/:sessionId/log", async (c) => {
-  const sessionId = c.req.param("sessionId");
-  const search = new URLSearchParams();
-  if (c.req.query("follow") === "1") search.set("follow", "1");
-  if (c.req.query("download") === "1") search.set("download", "1");
-  const qs = search.toString() ? `?${search.toString()}` : "";
-  const upstream = await fetch(
-    `${managerBase3()}/${encodeURIComponent(sessionId)}/log${qs}`
-  ).catch((err) => {
-    console.error(`${TAG18} fetch-failed op=log message=${err instanceof Error ? err.message : String(err)}`);
-    return null;
-  });
-  if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
-  return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
-});
-var claude_sessions_default = app15;
+var claude_sessions_default = app12;
 
 // server/routes/admin/log-ingest.ts
 var TAG19 = "[log-ingest]";
 var TAG_PATTERN = /^[A-Za-z0-9_:-]{1,32}$/;
 var LEVELS = /* @__PURE__ */ new Set(["debug", "info", "warn", "error"]);
 var MAX_LINE_BYTES = 4096;
-var app16 = new Hono();
+var app13 = new Hono();
 function isLoopbackAddr(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-app16.post("/", async (c) => {
+app13.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr(remoteAddr)) {
     console.error(`${TAG19} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -8702,7 +8353,7 @@ app16.post("/", async (c) => {
   else console.log(formatted);
   return c.json({ ok: true }, 200);
 });
-var log_ingest_default = app16;
+var log_ingest_default = app13;
 
 // server/routes/admin/events.ts
 var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
@@ -8711,8 +8362,8 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
   "device-url:vnc-surface-shown",
   "device-url:malformed"
 ]);
-var app17 = new Hono();
-app17.post("/", async (c) => {
+var app14 = new Hono();
+app14.post("/", async (c) => {
   const TAG28 = "[admin:events]";
   let body;
   try {
@@ -8743,13 +8394,13 @@ app17.post("/", async (c) => {
   console.error(`[${event}] ${formatted}`);
   return c.json({ ok: true });
 });
-var events_default = app17;
+var events_default = app14;
 
 // server/routes/admin/files.ts
 import { createReadStream as createReadStream2 } from "fs";
 import { readdir as readdir2, readFile as readFile4, stat as stat4, mkdir as mkdir3, writeFile as writeFile4, unlink as unlink2 } from "fs/promises";
 import { realpathSync as realpathSync4 } from "fs";
-import { basename as basename4, dirname as dirname4, join as join12, resolve as resolve13, sep as sep3 } from "path";
+import { basename as basename4, dirname as dirname3, join as join11, resolve as resolve13, sep as sep3 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // app/lib/data-path.ts
@@ -9111,7 +8762,7 @@ async function cascadeDeleteDocument(params) {
 var UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function readMeta(absDir, baseName) {
   try {
-    const raw = await readFile4(join12(absDir, `${baseName}.meta.json`), "utf8");
+    const raw = await readFile4(join11(absDir, `${baseName}.meta.json`), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.filename === "string") {
       return { filename: parsed.filename, mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0 };
@@ -9149,7 +8800,7 @@ async function readAccountNames() {
 }
 async function enrich(absolute, entry, accountNames) {
   if (entry.kind === "directory" && UUID_RE3.test(entry.name)) {
-    const meta = await readMeta(join12(absolute, entry.name), entry.name);
+    const meta = await readMeta(join11(absolute, entry.name), entry.name);
     if (meta?.filename) {
       entry.displayName = meta.filename;
       entry.mimeType = meta.mimeType;
@@ -9180,8 +8831,8 @@ function buildDisplayPath(relPath2, accountNames) {
     return dn ? { name: seg, displayName: dn } : { name: seg };
   });
 }
-var app18 = new Hono();
-app18.get("/", requireAdminSession, async (c) => {
+var app15 = new Hono();
+app15.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   if (!getAccountIdForSession(cacheKey)) {
     console.error(`[data] auth-rejected endpoint="/api/admin/files" reason="no account for session"`);
@@ -9208,7 +8859,7 @@ app18.get("/", requireAdminSession, async (c) => {
         continue;
       }
       try {
-        const entryPath = join12(absolute, name);
+        const entryPath = join11(absolute, name);
         const s = await stat4(entryPath);
         entries.push({
           name,
@@ -9242,7 +8893,7 @@ app18.get("/", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-app18.get("/download", requireAdminSession, async (c) => {
+app15.get("/download", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   if (!getAccountIdForSession(cacheKey)) {
     console.error(`[data] auth-rejected endpoint="/api/admin/files/download" reason="no account for session"`);
@@ -9290,7 +8941,7 @@ app18.get("/download", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-app18.post("/upload", requireAdminSession, async (c) => {
+app15.post("/upload", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -9348,7 +8999,7 @@ app18.post("/upload", requireAdminSession, async (c) => {
     mimeType: file.type
   });
 });
-app18.delete("/", requireAdminSession, async (c) => {
+app15.delete("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -9381,7 +9032,7 @@ app18.delete("/", requireAdminSession, async (c) => {
     }
     const dot = base.lastIndexOf(".");
     const stem = dot === -1 ? base : base.slice(0, dot);
-    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join12(dirname4(absolute), `${stem}.meta.json`) : null;
+    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join11(dirname3(absolute), `${stem}.meta.json`) : null;
     await unlink2(absolute);
     if (sidecarPath) {
       try {
@@ -9415,7 +9066,7 @@ app18.delete("/", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-var files_default = app18;
+var files_default = app15;
 
 // ../lib/graph-search/src/index.ts
 var import_dist = __toESM(require_dist());
@@ -10180,8 +9831,8 @@ var MAX_LIMIT = 2e3;
 var DEFAULT_VECTOR_THRESHOLD = 0.82;
 var MESSAGE_FAMILY_LABELS = ["Message", "UserMessage", "AssistantMessage", "WhatsAppMessage"];
 var CONVERSATION_PARENT_LABELS = /* @__PURE__ */ new Set(["AdminConversation", "PublicConversation"]);
-var app19 = new Hono();
-app19.get("/", requireAdminSession, async (c) => {
+var app16 = new Hono();
+app16.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const q = (c.req.query("q") ?? "").trim();
   const rawLimit = c.req.query("limit");
@@ -10312,7 +9963,7 @@ app19.get("/", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-var graph_search_default = app19;
+var graph_search_default = app16;
 
 // server/routes/admin/graph-subgraph.ts
 import neo4j from "neo4j-driver";
@@ -10390,8 +10041,8 @@ var STRIPPED_PROPERTIES = /* @__PURE__ */ new Set([
   "otpCode",
   "cacheKey"
 ]);
-var app20 = new Hono();
-app20.get("/", requireAdminSession, async (c) => {
+var app17 = new Hono();
+app17.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -10974,12 +10625,12 @@ function pruneNode(node, warnedClasses, conversationWarnings) {
   }
   return trashed ? { id: node.id, labels, properties, trashed: true } : { id: node.id, labels, properties };
 }
-var graph_subgraph_default = app20;
+var graph_subgraph_default = app17;
 
 // server/routes/admin/graph-delete.ts
 var ALLOWED_BY = ["graph-page", "graph-drag-trash", "graph-side-panel-trash"];
-var app21 = new Hono();
-app21.post("/", requireAdminSession, async (c) => {
+var app18 = new Hono();
+app18.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -11142,11 +10793,11 @@ app21.post("/", requireAdminSession, async (c) => {
     }
   }
 });
-var graph_delete_default = app21;
+var graph_delete_default = app18;
 
 // server/routes/admin/graph-restore.ts
-var app22 = new Hono();
-app22.post("/", requireAdminSession, async (c) => {
+var app19 = new Hono();
+app19.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -11210,11 +10861,11 @@ app22.post("/", requireAdminSession, async (c) => {
     }
   }
 });
-var graph_restore_default = app22;
+var graph_restore_default = app19;
 
 // server/routes/admin/graph-labels-in-graph.ts
-var app23 = new Hono();
-app23.get("/", requireAdminSession, async (c) => {
+var app20 = new Hono();
+app20.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -11280,11 +10931,11 @@ var LABELS_IN_GRAPH_CYPHER = `
        sum(halfEdges) AS relDegree
   RETURN label, nodeCount, relDegree
 `;
-var graph_labels_in_graph_default = app23;
+var graph_labels_in_graph_default = app20;
 
 // server/routes/admin/graph-default-view.ts
-var app24 = new Hono();
-app24.get("/", requireAdminSession, async (c) => {
+var app21 = new Hono();
+app21.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   const userId = getUserIdForSession(cacheKey);
@@ -11322,7 +10973,7 @@ app24.get("/", requireAdminSession, async (c) => {
     }
   }
 });
-app24.put("/", requireAdminSession, async (c) => {
+app21.put("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   const userId = getUserIdForSession(cacheKey);
@@ -11411,139 +11062,11 @@ var WRITE_CYPHER = `
       p.updatedAt = $updatedAt
   RETURN p.labels AS labels
 `;
-var graph_default_view_default = app24;
-
-// server/routes/admin/session-defaults.ts
-var app25 = new Hono();
-var MODE_OPTIONS = ["default", "acceptEdits", "plan", "auto", "bypassPermissions"];
-var MODEL_OPTIONS = ["claude-opus-4-7", "claude-sonnet-4-6", "claude-haiku-4-5"];
-app25.get("/", requireAdminSession, async (c) => {
-  const cacheKey = c.var.cacheKey;
-  const accountId = getAccountIdForSession(cacheKey);
-  const userId = getUserIdForSession(cacheKey);
-  if (!accountId || !userId) {
-    console.error('[session-defaults] rejected op=load reason="missing account or user context"');
-    return c.json({ error: "Account and user context required for session defaults" }, 401);
-  }
-  const started = Date.now();
-  const session = getSession();
-  try {
-    const result = await session.executeRead(async (tx) => {
-      return await tx.run(READ_CYPHER2, { accountId, userId });
-    });
-    const record = result.records[0];
-    const rawMode = record?.get("permissionMode");
-    const rawModel = record?.get("model");
-    const permissionMode = MODE_OPTIONS.includes(rawMode ?? "") ? rawMode : "default";
-    const model = MODEL_OPTIONS.includes(rawModel ?? "") ? rawModel : null;
-    const elapsed = Date.now() - started;
-    console.error(
-      `[session-defaults] load account=${accountId} user=${userId} permissionMode=${permissionMode} model=${model ?? "null"} ms=${elapsed}`
-    );
-    return c.json({ permissionMode, model });
-  } catch (err) {
-    const elapsed = Date.now() - started;
-    const message = err instanceof Error ? err.message : String(err);
-    console.error(
-      `[session-defaults] rejected op=load account=${accountId} reason="${message}" ms=${elapsed}`
-    );
-    return c.json({ error: `Session defaults unavailable: ${message}` }, 503);
-  } finally {
-    try {
-      await session.close();
-    } catch {
-    }
-  }
-});
-app25.put("/", requireAdminSession, async (c) => {
-  const cacheKey = c.var.cacheKey;
-  const accountId = getAccountIdForSession(cacheKey);
-  const userId = getUserIdForSession(cacheKey);
-  if (!accountId || !userId) {
-    console.error('[session-defaults] rejected op=save reason="missing account or user context"');
-    return c.json({ error: "Account and user context required for session defaults" }, 401);
-  }
-  const body = await safeJson(c);
-  if (!body) {
-    return c.json({ error: "Request body must be JSON" }, 400);
-  }
-  const validation = validateBody2(body);
-  if (!validation.ok) {
-    console.error(
-      `[session-defaults] rejected op=save account=${accountId} reason="${validation.reason}"`
-    );
-    return c.json({ error: validation.reason }, 400);
-  }
-  const { permissionMode, model } = validation;
-  const started = Date.now();
-  const session = getSession();
-  try {
-    await session.executeWrite(async (tx) => {
-      return await tx.run(WRITE_CYPHER2, {
-        accountId,
-        userId,
-        permissionMode,
-        model,
-        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-    });
-    const elapsed = Date.now() - started;
-    console.error(
-      `[session-defaults] save account=${accountId} user=${userId} permissionMode=${permissionMode} model=${model ?? "null"} ms=${elapsed}`
-    );
-    return c.json({ permissionMode, model });
-  } catch (err) {
-    const elapsed = Date.now() - started;
-    const message = err instanceof Error ? err.message : String(err);
-    console.error(
-      `[session-defaults] rejected op=save account=${accountId} reason="${message}" ms=${elapsed}`
-    );
-    return c.json({ error: `Failed to save session defaults: ${message}` }, 503);
-  } finally {
-    try {
-      await session.close();
-    } catch {
-    }
-  }
-});
-function validateBody2(body) {
-  if (typeof body.permissionMode !== "string") {
-    return { ok: false, reason: "permissionMode must be a string" };
-  }
-  if (!MODE_OPTIONS.includes(body.permissionMode)) {
-    return { ok: false, reason: `permissionMode "${body.permissionMode}" is not one of ${MODE_OPTIONS.join(", ")}` };
-  }
-  if (!("model" in body)) {
-    return { ok: false, reason: "model is required (use null for no override)" };
-  }
-  if (body.model !== null && typeof body.model !== "string") {
-    return { ok: false, reason: "model must be a string or null" };
-  }
-  if (body.model !== null && !MODEL_OPTIONS.includes(body.model)) {
-    return { ok: false, reason: `model "${body.model}" is not one of ${MODEL_OPTIONS.join(", ")} (or null)` };
-  }
-  return {
-    ok: true,
-    permissionMode: body.permissionMode,
-    model: body.model
-  };
-}
-var READ_CYPHER2 = `
-  OPTIONAL MATCH (p:SpawnPreference {accountId: $accountId, userId: $userId})
-  RETURN p.permissionMode AS permissionMode, p.model AS model
-`;
-var WRITE_CYPHER2 = `
-  MERGE (p:SpawnPreference {accountId: $accountId, userId: $userId})
-  SET p.permissionMode = $permissionMode,
-      p.model = $model,
-      p.updatedAt = $updatedAt
-  RETURN p.permissionMode AS permissionMode
-`;
-var session_defaults_default = app25;
+var graph_default_view_default = app21;
 
 // server/routes/admin/file-attach.ts
-var app26 = new Hono();
-app26.post("/", async (c) => {
+var app22 = new Hono();
+app22.post("/", async (c) => {
   try {
     const body = await c.req.json();
     const { filePath, accountId } = body;
@@ -11566,18 +11089,18 @@ app26.post("/", async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-var file_attach_default = app26;
+var file_attach_default = app22;
 
 // server/routes/admin/sidebar-artefacts.ts
 import neo4j2 from "neo4j-driver";
 import { readFile as readFile5, readdir as readdir3, stat as stat5 } from "fs/promises";
 import { resolve as resolve14, relative as relative2, isAbsolute } from "path";
-import { existsSync as existsSync17 } from "fs";
+import { existsSync as existsSync16 } from "fs";
 var LIMIT = 50;
 var TEXT_MIME_PREFIXES = ["text/", "application/json", "application/markdown"];
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
-var app27 = new Hono();
-app27.get("/", requireAdminSession, async (c) => {
+var app23 = new Hono();
+app23.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -11720,7 +11243,7 @@ async function fetchAgentTemplateRows(accountDir) {
 async function unionSpecialistFilenames(overrideDir, bundledDir) {
   const names = /* @__PURE__ */ new Set();
   for (const dir of [overrideDir, bundledDir]) {
-    if (!existsSync17(dir)) continue;
+    if (!existsSync16(dir)) continue;
     try {
       const entries = await readdir3(dir);
       for (const entry of entries) {
@@ -11735,7 +11258,7 @@ async function unionSpecialistFilenames(overrideDir, bundledDir) {
 }
 async function readAgentTemplateRow(inp) {
   let chosenPath = null;
-  if (existsSync17(inp.overridePath)) {
+  if (existsSync16(inp.overridePath)) {
     try {
       validateFilePathInAccount(inp.overridePath, inp.overrideRoot);
       chosenPath = inp.overridePath;
@@ -11746,7 +11269,7 @@ async function readAgentTemplateRow(inp) {
       );
       return null;
     }
-  } else if (existsSync17(inp.bundledPath)) {
+  } else if (existsSync16(inp.bundledPath)) {
     if (!isWithin(inp.bundledPath, inp.bundledRoot)) {
       console.error(
         `[admin/sidebar-artefacts] agent-template-read-failed agent=${inp.displayName} kind=${inp.logName} error="bundled path outside PLATFORM_ROOT"`
@@ -11783,16 +11306,16 @@ function isWithin(target, root) {
   const rel = relative2(root, target);
   return !rel.startsWith("..") && !isAbsolute(rel);
 }
-var sidebar_artefacts_default = app27;
+var sidebar_artefacts_default = app23;
 
 // server/routes/admin/sidebar-artefact-save.ts
 import { mkdir as mkdir4, readdir as readdir4, stat as stat6, writeFile as writeFile5 } from "fs/promises";
 import { resolve as resolve15 } from "path";
-import { existsSync as existsSync18 } from "fs";
+import { existsSync as existsSync17 } from "fs";
 var ADMIN_AGENT_FILES2 = /* @__PURE__ */ new Set(["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"]);
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-var app28 = new Hono();
-app28.post("/", requireAdminSession, async (c) => {
+var app24 = new Hono();
+app24.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) return c.json({ error: "Account not found for session" }, 401);
@@ -11856,7 +11379,7 @@ async function resolveSavePath(id, accountId, accountDir) {
   }
   if (UUID_RE4.test(id)) {
     const dir = resolve15(ATTACHMENTS_ROOT, accountId, id);
-    if (!existsSync18(dir)) {
+    if (!existsSync17(dir)) {
       const attShort = id.slice(0, 8);
       if (isHealPending(accountId, id)) {
         console.error(`[admin/sidebar-artefact-save] heal-race attachmentId=${attShort} outcome=503-retry source=heal-pending`);
@@ -11904,15 +11427,15 @@ async function resolveSavePath(id, accountId, accountDir) {
 function relPath(absPath, root) {
   return absPath.startsWith(root) ? absPath.slice(root.length + 1) : absPath;
 }
-var sidebar_artefact_save_default = app28;
+var sidebar_artefact_save_default = app24;
 
 // server/routes/admin/sidebar-artefact-content.ts
 import { readFile as readFile6, readdir as readdir5 } from "fs/promises";
-import { existsSync as existsSync19 } from "fs";
+import { existsSync as existsSync18 } from "fs";
 import { resolve as resolve16 } from "path";
 var UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-var app29 = new Hono();
-app29.get("/", requireAdminSession, async (c) => {
+var app25 = new Hono();
+app25.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) return new Response("Unauthorized", { status: 401 });
@@ -11922,7 +11445,7 @@ app29.get("/", requireAdminSession, async (c) => {
     return new Response("Not found", { status: 404 });
   }
   const dir = resolve16(ATTACHMENTS_ROOT, accountId, id);
-  if (!existsSync19(dir)) {
+  if (!existsSync18(dir)) {
     console.error(`[admin/sidebar-artefact-content] not-found id=${id.slice(0, 8)}`);
     return new Response("Not found", { status: 404 });
   }
@@ -11953,7 +11476,7 @@ app29.get("/", requireAdminSession, async (c) => {
     }
   });
 });
-var sidebar_artefact_content_default = app29;
+var sidebar_artefact_content_default = app25;
 
 // server/routes/admin/system-stats.ts
 import { readFile as readFile7 } from "fs/promises";
@@ -12050,8 +11573,8 @@ async function sample() {
   if (process.platform === "linux") return sampleLinux();
   return sampleOsFallback();
 }
-var app30 = new Hono();
-app30.get("/", async (c) => {
+var app26 = new Hono();
+app26.get("/", async (c) => {
   const started = Date.now();
   if (!inflight) {
     inflight = sample().finally(() => {
@@ -12074,17 +11597,17 @@ app30.get("/", async (c) => {
     return c.json({ degraded: true, reason, sampledAtMs: Date.now() });
   }
 });
-var system_stats_default = app30;
+var system_stats_default = app26;
 
 // server/routes/admin/health.ts
-import { existsSync as existsSync20, readFileSync as readFileSync15 } from "fs";
-import { resolve as resolve17, join as join13 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync14 } from "fs";
+import { resolve as resolve17, join as join12 } from "path";
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve17(process.cwd(), "..");
 var brandHostname = "maxy";
-var brandJsonPath = join13(PLATFORM_ROOT6, "config", "brand.json");
-if (existsSync20(brandJsonPath)) {
+var brandJsonPath = join12(PLATFORM_ROOT6, "config", "brand.json");
+if (existsSync19(brandJsonPath)) {
   try {
-    const brand = JSON.parse(readFileSync15(brandJsonPath, "utf-8"));
+    const brand = JSON.parse(readFileSync14(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
   } catch {
   }
@@ -12093,8 +11616,8 @@ var VERSION_FILE = resolve17(PLATFORM_ROOT6, `config/.${brandHostname}-version`)
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
-  if (!existsSync20(VERSION_FILE)) return "unknown";
-  return readFileSync15(VERSION_FILE, "utf-8").trim() || "unknown";
+  if (!existsSync19(VERSION_FILE)) return "unknown";
+  return readFileSync14(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
   let session;
@@ -12119,8 +11642,8 @@ async function probeConversationDb() {
     });
   }
 }
-var app31 = new Hono();
-app31.get("/", async (c) => {
+var app27 = new Hono();
+app27.get("/", async (c) => {
   const version = readVersion();
   const probe = await probeConversationDb();
   const uptimeMs = Date.now() - new Date(PROCESS_STARTED_AT).getTime();
@@ -12142,7 +11665,7 @@ app31.get("/", async (c) => {
     uptimeMs
   });
 });
-var health_default2 = app31;
+var health_default2 = app27;
 
 // server/routes/admin/linkedin-ingest.ts
 var TAG20 = "[linkedin-ingest-route]";
@@ -12238,8 +11761,8 @@ function buildInitialMessage(env) {
   }
   return header;
 }
-var app32 = new Hono();
-app32.post("/", requireAdminSession, async (c) => {
+var app28 = new Hono();
+app28.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -12293,7 +11816,7 @@ app32.post("/", requireAdminSession, async (c) => {
   );
   return c.json({ ok: true, dispatchId: envelope.dispatchId, taskId: claudeSessionId }, 202);
 });
-var linkedin_ingest_default = app32;
+var linkedin_ingest_default = app28;
 
 // server/routes/admin/post-turn-context.ts
 import neo4j3 from "neo4j-driver";
@@ -12335,8 +11858,8 @@ function pruneProperties(raw) {
   }
   return out;
 }
-var app33 = new Hono();
-app33.get("/", async (c) => {
+var app29 = new Hono();
+app29.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr2(remoteAddr)) {
     console.error(`${TAG21} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -12396,7 +11919,7 @@ app33.get("/", async (c) => {
     await session.close();
   }
 });
-var post_turn_context_default = app33;
+var post_turn_context_default = app29;
 
 // server/routes/admin/public-session-context.ts
 import neo4j4 from "neo4j-driver";
@@ -12438,8 +11961,8 @@ function pruneProperties2(raw) {
   }
   return out;
 }
-var app34 = new Hono();
-app34.get("/", async (c) => {
+var app30 = new Hono();
+app30.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr3(remoteAddr)) {
     console.error(`${TAG22} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -12498,15 +12021,15 @@ app34.get("/", async (c) => {
     await session.close();
   }
 });
-var public_session_context_default = app34;
+var public_session_context_default = app30;
 
 // server/routes/admin/public-session-exit.ts
 var TAG23 = "[public-session-exit-route]";
 function isLoopbackAddr4(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-var app35 = new Hono();
-app35.post("/", async (c) => {
+var app31 = new Hono();
+app31.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr4(remoteAddr)) {
     console.error(`${TAG23} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -12533,15 +12056,15 @@ app35.post("/", async (c) => {
   handlePublicSessionExit(sessionId);
   return c.json({ ok: true });
 });
-var public_session_exit_default = app35;
+var public_session_exit_default = app31;
 
 // server/routes/admin/access-session-evict.ts
 var TAG24 = "[access-session-evict]";
 function isLoopbackAddr5(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-var app36 = new Hono();
-app36.post("/", async (c) => {
+var app32 = new Hono();
+app32.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr5(remoteAddr)) {
     console.error(`${TAG24} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -12569,46 +12092,42 @@ app36.post("/", async (c) => {
   console.log(`${TAG24} grantId=${grantId} dropped=${dropped}`);
   return c.json({ ok: true, dropped });
 });
-var access_session_evict_default = app36;
+var access_session_evict_default = app32;
 
 // server/routes/admin/index.ts
-var app37 = new Hono();
-app37.route("/session", session_default);
-app37.route("/new-session-failure", new_session_failure_default);
-app37.route("/new-session-submit", new_session_submit_default);
-app37.route("/logs", logs_default);
-app37.route("/claude-info", claude_info_default);
-app37.route("/claude-capabilities", claude_capabilities_default);
-app37.route("/attachment", attachment_default);
-app37.route("/agents", agents_default);
-app37.route("/sessions", sessions_default);
-app37.route("/claude-sessions", claude_sessions_default);
-app37.route("/log-ingest", log_ingest_default);
-app37.route("/events", events_default);
-app37.route("/files", files_default);
-app37.route("/graph-search", graph_search_default);
-app37.route("/graph-subgraph", graph_subgraph_default);
-app37.route("/graph-delete", graph_delete_default);
-app37.route("/graph-restore", graph_restore_default);
-app37.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app37.route("/graph-default-view", graph_default_view_default);
-app37.route("/session-defaults", session_defaults_default);
-app37.route("/file-attach", file_attach_default);
-app37.route("/sidebar-artefacts", sidebar_artefacts_default);
-app37.route("/sidebar-artefact-save", sidebar_artefact_save_default);
-app37.route("/sidebar-artefact-content", sidebar_artefact_content_default);
-app37.route("/system-stats", system_stats_default);
-app37.route("/health-brand", health_default2);
-app37.route("/linkedin-ingest", linkedin_ingest_default);
-app37.route("/post-turn-context", post_turn_context_default);
-app37.route("/public-session-context", public_session_context_default);
-app37.route("/public-session-exit", public_session_exit_default);
-app37.route("/access-session-evict", access_session_evict_default);
-var admin_default = app37;
+var app33 = new Hono();
+app33.route("/session", session_default);
+app33.route("/logs", logs_default);
+app33.route("/claude-info", claude_info_default);
+app33.route("/attachment", attachment_default);
+app33.route("/agents", agents_default);
+app33.route("/sessions", sessions_default);
+app33.route("/claude-sessions", claude_sessions_default);
+app33.route("/log-ingest", log_ingest_default);
+app33.route("/events", events_default);
+app33.route("/files", files_default);
+app33.route("/graph-search", graph_search_default);
+app33.route("/graph-subgraph", graph_subgraph_default);
+app33.route("/graph-delete", graph_delete_default);
+app33.route("/graph-restore", graph_restore_default);
+app33.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app33.route("/graph-default-view", graph_default_view_default);
+app33.route("/file-attach", file_attach_default);
+app33.route("/sidebar-artefacts", sidebar_artefacts_default);
+app33.route("/sidebar-artefact-save", sidebar_artefact_save_default);
+app33.route("/sidebar-artefact-content", sidebar_artefact_content_default);
+app33.route("/system-stats", system_stats_default);
+app33.route("/health-brand", health_default2);
+app33.route("/linkedin-ingest", linkedin_ingest_default);
+app33.route("/post-turn-context", post_turn_context_default);
+app33.route("/public-session-context", public_session_context_default);
+app33.route("/public-session-exit", public_session_exit_default);
+app33.route("/access-session-evict", access_session_evict_default);
+var admin_default = app33;
 
 // app/lib/access-gate.ts
 import neo4j5 from "neo4j-driver";
-import { readFileSync as readFileSync16 } from "fs";
+import { readFileSync as readFileSync15 } from "fs";
 import { resolve as resolve18 } from "path";
 import { randomUUID as randomUUID8 } from "crypto";
 var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve18(process.cwd(), "..");
@@ -12617,7 +12136,7 @@ function readPassword() {
   if (process.env.NEO4J_PASSWORD) return process.env.NEO4J_PASSWORD;
   const passwordFile = resolve18(PLATFORM_ROOT7, "config/.neo4j-password");
   try {
-    return readFileSync16(passwordFile, "utf-8").trim();
+    return readFileSync15(passwordFile, "utf-8").trim();
   } catch {
     throw new Error(
       `Neo4j password not found. Expected at ${passwordFile} or in NEO4J_PASSWORD env var.`
@@ -12818,8 +12337,8 @@ async function generateNewMagicToken(grantId) {
 var TAG25 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
-var app38 = new Hono();
-app38.post("/", async (c) => {
+var app34 = new Hono();
+app34.post("/", async (c) => {
   const ip = c.var.clientIp || "unknown";
   let body;
   try {
@@ -12901,7 +12420,7 @@ app38.post("/", async (c) => {
     displayName: grant.displayName
   });
 });
-var verify_token_default = app38;
+var verify_token_default = app34;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
@@ -12964,9 +12483,9 @@ async function sendMagicLinkEmail(payload) {
 
 // server/routes/access/request-magic-link.ts
 var TAG26 = "[access-request-link]";
-var app39 = new Hono();
+var app35 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
-app39.post("/", async (c) => {
+app35.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -13040,16 +12559,16 @@ app39.post("/", async (c) => {
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
-var request_magic_link_default = app39;
+var request_magic_link_default = app35;
 
 // server/routes/access/index.ts
-var app40 = new Hono();
-app40.route("/verify-token", verify_token_default);
-app40.route("/request-magic-link", request_magic_link_default);
-var access_default = app40;
+var app36 = new Hono();
+app36.route("/verify-token", verify_token_default);
+app36.route("/request-magic-link", request_magic_link_default);
+var access_default = app36;
 
 // server/routes/sites.ts
-import { existsSync as existsSync21, readFileSync as readFileSync17, realpathSync as realpathSync5, statSync as statSync7 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync16, realpathSync as realpathSync5, statSync as statSync7 } from "fs";
 import { resolve as resolve20 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
@@ -13081,8 +12600,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app41 = new Hono();
-app41.get("/:rel{.*}", (c) => {
+var app37 = new Hono();
+app37.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -13115,7 +12634,7 @@ app41.get("/:rel{.*}", (c) => {
   }
   let stat7;
   try {
-    stat7 = existsSync21(filePath) ? statSync7(filePath) : null;
+    stat7 = existsSync20(filePath) ? statSync7(filePath) : null;
   } catch {
     stat7 = null;
   }
@@ -13134,7 +12653,7 @@ app41.get("/:rel{.*}", (c) => {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync21(filePath)) {
+  if (!existsSync20(filePath)) {
     console.error(`[sites] not-found path=${reqPath} status=404`);
     return c.text("Not found", 404);
   }
@@ -13153,7 +12672,7 @@ app41.get("/:rel{.*}", (c) => {
   }
   let body;
   try {
-    body = readFileSync17(realPath);
+    body = readFileSync16(realPath);
   } catch (err) {
     const code = err?.code;
     if (code === "EISDIR") {
@@ -13185,12 +12704,12 @@ app41.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app41;
+var sites_default = app37;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync18, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname5 } from "path";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync17, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname4 } from "path";
 var TOKEN_PREFIX = "v1.";
 var SECRET_BYTES = 32;
 var DEFAULT_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
@@ -13198,7 +12717,7 @@ var cachedSecret = null;
 function getSecret() {
   if (cachedSecret) return cachedSecret;
   try {
-    const hex2 = readFileSync18(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+    const hex2 = readFileSync17(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
     if (hex2.length === SECRET_BYTES * 2) {
       cachedSecret = Buffer.from(hex2, "hex");
       return cachedSecret;
@@ -13207,12 +12726,12 @@ function getSecret() {
   }
   const fresh = randomBytes(SECRET_BYTES).toString("hex");
   try {
-    mkdirSync4(dirname5(VISITOR_TOKEN_SECRET_FILE), { recursive: true, mode: 448 });
+    mkdirSync4(dirname4(VISITOR_TOKEN_SECRET_FILE), { recursive: true, mode: 448 });
     writeFileSync6(VISITOR_TOKEN_SECRET_FILE, fresh, { mode: 384, flag: "wx" });
     console.log(`[visitor-token] secret minted path=${VISITOR_TOKEN_SECRET_FILE}`);
   } catch {
   }
-  const hex = readFileSync18(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+  const hex = readFileSync17(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
   cachedSecret = Buffer.from(hex, "hex");
   return cachedSecret;
 }
@@ -13265,8 +12784,8 @@ var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync22, readFileSync as readFileSync19 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync21, readFileSync as readFileSync18 } from "fs";
+import { join as join13 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
 function readBrandConfig() {
@@ -13274,10 +12793,10 @@ function readBrandConfig() {
   cachedAttempted = true;
   const platformRoot = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot) return null;
-  const brandPath = join14(platformRoot, "config", "brand.json");
-  if (!existsSync22(brandPath)) return null;
+  const brandPath = join13(platformRoot, "config", "brand.json");
+  if (!existsSync21(brandPath)) return null;
   try {
-    cached2 = JSON.parse(readFileSync19(brandPath, "utf-8"));
+    cached2 = JSON.parse(readFileSync18(brandPath, "utf-8"));
     return cached2;
   } catch {
     return null;
@@ -13285,7 +12804,7 @@ function readBrandConfig() {
 }
 
 // server/routes/visitor-consent.ts
-var app42 = new Hono();
+var app38 = new Hono();
 var CONSENT_COOKIE_NAME = "mxy_consent";
 var CONSENT_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
 var DEFAULT_CONSENT_COPY = {
@@ -13330,17 +12849,17 @@ function siteSlugFromReferer(referer) {
     return "";
   }
 }
-app42.options("/consent", (c) => {
+app38.options("/consent", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app42.options("/brand-config", (c) => {
+app38.options("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app42.post("/consent", async (c) => {
+app38.post("/consent", async (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   let raw;
@@ -13380,7 +12899,7 @@ app42.post("/consent", async (c) => {
   console.log(`[consent] ${parsed.decision} site=${site} brand=${brandName} tokenBound=${tokenBound}`);
   return c.body(null, 204);
 });
-app42.get("/brand-config", (c) => {
+app38.get("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   const brand = readBrandConfig();
@@ -13390,7 +12909,7 @@ app42.get("/brand-config", (c) => {
   c.header("Cache-Control", "public, max-age=300");
   return c.json({ consent: { copy, palette } });
 });
-var visitor_consent_default = app42;
+var visitor_consent_default = app38;
 
 // server/routes/listings.ts
 function getCookie(headerValue, name) {
@@ -13417,8 +12936,8 @@ function appendConsentParams(pageUrl, token) {
 }
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
 var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
-var app43 = new Hono();
-app43.get("/:slug/click", async (c) => {
+var app39 = new Hono();
+app39.get("/:slug/click", async (c) => {
   const slug = c.req.param("slug") ?? "";
   const rawSession = c.req.query("session") ?? "";
   const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
@@ -13482,10 +13001,10 @@ app43.get("/:slug/click", async (c) => {
   console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} consent=${consentCookie ?? "absent"} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
   return c.redirect(redirectUrl, 302);
 });
-var listings_default = app43;
+var listings_default = app39;
 
 // server/routes/visitor-event.ts
-var app44 = new Hono();
+var app40 = new Hono();
 var BOT_UA_RE = /\b(bot|crawl|spider|slurp|headlesschrome|phantomjs|googlebot|bingbot|yandex|baiduspider|ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)\b/i;
 var buckets = /* @__PURE__ */ new Map();
 var RATE_LIMIT = 60;
@@ -13552,12 +13071,12 @@ function originAllowed(origin, allowlist) {
     return false;
   }
 }
-app44.options("/event", (c) => {
+app40.options("/event", (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   return c.body(null, 204);
 });
-app44.post("/event", async (c) => {
+app40.post("/event", async (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   const ua = c.req.header("user-agent") ?? "";
@@ -13762,7 +13281,7 @@ async function writeEvent(opts) {
     );
   }
 }
-var visitor_event_default = app44;
+var visitor_event_default = app40;
 
 // app/lib/graph-health.ts
 var HOUR_MS = 60 * 60 * 1e3;
@@ -13906,7 +13425,7 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash4, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync23, readFileSync as readFileSync20, statSync as statSync8 } from "fs";
+import { existsSync as existsSync22, readFileSync as readFileSync19, statSync as statSync8 } from "fs";
 import { resolve as resolve21 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
@@ -13955,7 +13474,7 @@ function resolveEntitlement(brand, account) {
     return logResolved(implicitTrust(account), null);
   }
   const entitlementPath = resolve21(brand.configDir, "entitlement.json");
-  if (!existsSync23(entitlementPath)) {
+  if (!existsSync22(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
   const stat7 = statSync8(entitlementPath);
@@ -13970,7 +13489,7 @@ function resolveEntitlement(brand, account) {
 function verifyAndResolve(brand, entitlementPath, account) {
   let pubkeyPem;
   try {
-    pubkeyPem = readFileSync20(pubkeyPath(brand), "utf-8");
+    pubkeyPem = readFileSync19(pubkeyPath(brand), "utf-8");
   } catch (err) {
     return logResolved(anonymousFallback("pubkey-missing"), {
       reason: "pubkey-missing"
@@ -13984,7 +13503,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(readFileSync20(entitlementPath, "utf-8"));
+    envelope = JSON.parse(readFileSync19(entitlementPath, "utf-8"));
   } catch {
     return logResolved(anonymousFallback("malformed"), { reason: "malformed" });
   }
@@ -14145,14 +13664,14 @@ function clientFrom(c) {
   );
 }
 var PLATFORM_ROOT9 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT9 ? join15(PLATFORM_ROOT9, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT9 ? join14(PLATFORM_ROOT9, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync24(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync23(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync24(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync23(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync21(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync20(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -14171,11 +13690,11 @@ var brandLoginOpts = {
   bodyFont: BRAND.defaultFonts?.body,
   logoContainsName: !!BRAND.logoContainsName
 };
-var ALIAS_DOMAINS_PATH = join15(homedir3(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join14(homedir2(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync24(ALIAS_DOMAINS_PATH)) return null;
-    const parsed = JSON.parse(readFileSync21(ALIAS_DOMAINS_PATH, "utf-8"));
+    if (!existsSync23(ALIAS_DOMAINS_PATH)) return null;
+    const parsed = JSON.parse(readFileSync20(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -14199,9 +13718,9 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app45 = new Hono();
-app45.use("*", clientIpMiddleware);
-app45.use("*", async (c, next) => {
+var app41 = new Hono();
+app41.use("*", clientIpMiddleware);
+app41.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -14211,7 +13730,7 @@ app45.use("*", async (c, next) => {
   );
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app45.use("*", async (c, next) => {
+app41.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -14244,7 +13763,7 @@ var PUBLIC_ALLOWED_PREFIXES = [
   "/sites/"
 ];
 var PUBLIC_ALLOWED_EXACT = ["/favicon.ico"];
-app45.use("*", async (c, next) => {
+app41.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (!isPublicHost(host)) {
     await next();
@@ -14284,7 +13803,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app45.post("/__remote-auth/login", async (c) => {
+app41.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -14329,7 +13848,7 @@ app45.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app45.get("/__remote-auth/logout", (c) => {
+app41.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -14342,7 +13861,7 @@ app45.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app45.post("/__remote-auth/change-password", async (c) => {
+app41.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -14393,13 +13912,13 @@ app45.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app45.get("/__remote-auth/setup", (c) => {
+app41.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app45.post("/__remote-auth/set-initial-password", async (c) => {
+app41.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -14437,10 +13956,10 @@ app45.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app45.get("/api/remote-auth/status", (c) => {
+app41.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app45.post("/api/remote-auth/set-password", async (c) => {
+app41.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -14471,9 +13990,9 @@ app45.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app45.route("/api/_client-error", client_error_default);
+app41.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
-app45.use("*", async (c, next) => {
+app41.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
@@ -14506,12 +14025,12 @@ app45.use("*", async (c, next) => {
   console.error(`[remote-auth] login required ip=${clientIp} path=${path2} ${disambig}`);
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), redirect: path2 }), 200);
 });
-app45.route("/api/health", health_default);
-app45.route("/api/chat", chat_default);
-app45.route("/api/whatsapp", whatsapp_default);
-app45.route("/api/onboarding", onboarding_default);
-app45.route("/api/admin", admin_default);
-app45.route("/api/access", access_default);
+app41.route("/api/health", health_default);
+app41.route("/api/chat", chat_default);
+app41.route("/api/whatsapp", whatsapp_default);
+app41.route("/api/onboarding", onboarding_default);
+app41.route("/api/admin", admin_default);
+app41.route("/api/access", access_default);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -14523,7 +14042,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app45.get("/agent-assets/:slug/:filename", (c) => {
+app41.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -14545,20 +14064,20 @@ app45.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync24(filePath)) {
+  if (!existsSync23(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync21(filePath);
+  const body = readFileSync20(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
   });
 });
-app45.get("/generated/:filename", (c) => {
+app41.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -14575,29 +14094,29 @@ app45.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync24(filePath)) {
+  if (!existsSync23(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync21(filePath);
+  const body = readFileSync20(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
   });
 });
-app45.route("/sites", sites_default);
-app45.route("/listings", listings_default);
-app45.route("/v", visitor_event_default);
-app45.route("/v", visitor_consent_default);
+app41.route("/sites", sites_default);
+app41.route("/listings", listings_default);
+app41.route("/v", visitor_event_default);
+app41.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync24(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync23(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync21(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync20(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -14614,9 +14133,9 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT9) return "unknown";
-    const versionFile = join15(PLATFORM_ROOT9, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync24(versionFile)) return "unknown";
-    const content = readFileSync21(versionFile, "utf-8").trim();
+    const versionFile = join14(PLATFORM_ROOT9, "config", `.${BRAND.hostname}-version`);
+    if (!existsSync23(versionFile)) return "unknown";
+    const content = readFileSync20(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -14657,7 +14176,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync21(resolve22(process.cwd(), "public", file), "utf-8");
+    html = readFileSync20(resolve22(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -14673,26 +14192,26 @@ ${clientErrorReporterScript}
 }
 var brandedHtmlCache = /* @__PURE__ */ new Map();
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join15(homedir3(), BRAND.configDir);
+  const configDir2 = join14(homedir2(), BRAND.configDir);
   try {
-    const accountJsonPath = join15(configDir2, "account.json");
-    if (!existsSync24(accountJsonPath)) return null;
-    const account = JSON.parse(readFileSync21(accountJsonPath, "utf-8"));
+    const accountJsonPath = join14(configDir2, "account.json");
+    if (!existsSync23(accountJsonPath)) return null;
+    const account = JSON.parse(readFileSync20(accountJsonPath, "utf-8"));
     const accountId = account.accountId;
     if (!accountId) return null;
-    const cachePath = join15(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync24(cachePath)) return null;
-    return JSON.parse(readFileSync21(cachePath, "utf-8"));
+    const cachePath = join14(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    if (!existsSync23(cachePath)) return null;
+    return JSON.parse(readFileSync20(cachePath, "utf-8"));
   } catch {
     return null;
   }
 }
 function resolveDefaultSlug() {
   try {
-    const configDir2 = join15(homedir3(), BRAND.configDir);
-    const accountJsonPath = join15(configDir2, "account.json");
-    if (!existsSync24(accountJsonPath)) return null;
-    const account = JSON.parse(readFileSync21(accountJsonPath, "utf-8"));
+    const configDir2 = join14(homedir2(), BRAND.configDir);
+    const accountJsonPath = join14(configDir2, "account.json");
+    if (!existsSync23(accountJsonPath)) return null;
+    const account = JSON.parse(readFileSync20(accountJsonPath, "utf-8"));
     return account.defaultAgent || null;
   } catch {
     return null;
@@ -14728,7 +14247,7 @@ function brandedPublicHtml(agentSlug) {
 function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-app45.get("/", (c) => {
+app41.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) {
     const defaultSlug = resolveDefaultSlug();
@@ -14736,12 +14255,12 @@ app45.get("/", (c) => {
   }
   return c.html(cachedHtml("index.html"));
 });
-app45.get("/public", (c) => {
+app41.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app45.get("/chat", (c) => {
+app41.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -14760,12 +14279,12 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app45.use("/vnc-viewer.html", logViewerFetch);
-app45.use("/vnc-popout.html", logViewerFetch);
-app45.get("/vnc-popout.html", (c) => {
+app41.use("/vnc-viewer.html", logViewerFetch);
+app41.use("/vnc-popout.html", logViewerFetch);
+app41.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync21(resolve22(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync20(resolve22(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -14775,7 +14294,7 @@ app45.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app45.post("/api/vnc/client-event", async (c) => {
+app41.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -14796,25 +14315,25 @@ app45.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app45.get("/g/:slug", (c) => {
+app41.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
-app45.get("/graph", (c) => {
+app41.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app45.get("/sessions", (c) => {
+app41.get("/sessions", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("sessions.html"));
 });
-app45.get("/data", (c) => {
+app41.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app45.get("/:slug", async (c, next) => {
+app41.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const branding = loadBrandingCache(slug);
@@ -14824,15 +14343,15 @@ app45.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app45.get("/favicon.ico", (c) => {
+  app41.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app45.use("/*", serveStatic({ root: "./public" }));
+app41.use("/*", serveStatic({ root: "./public" }));
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app45.fetch, port, hostname });
+var httpServer = serve({ fetch: app41.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const loopHist = monitorEventLoopDelay({ resolution: 50 });
@@ -14868,7 +14387,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app45.routes ?? []) {
+  for (const r of app41.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -14890,8 +14409,8 @@ try {
 }
 (async () => {
   try {
-    if (!existsSync24(USERS_FILE)) return;
-    const usersRaw = readFileSync21(USERS_FILE, "utf-8").trim();
+    if (!existsSync23(USERS_FILE)) return;
+    const usersRaw = readFileSync20(USERS_FILE, "utf-8").trim();
     if (!usersRaw) return;
     const users = JSON.parse(usersRaw);
     const userId = users[0]?.userId;
@@ -14983,7 +14502,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve22(process.env.MAXY_PLATFORM_ROOT ?? join15(__dirname, "..")),
+  platformRoot: resolve22(process.env.MAXY_PLATFORM_ROOT ?? join14(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (process.env.WHATSAPP_PTY_BRIDGE_ENABLED === "true" && msg.text && !msg.isOwnerMirror) {