@rubytech/create-maxy-code 0.1.188 → 0.1.190

package/payload/server/server.js

@@ -756,8 +756,8 @@ var serveStatic = (options = { root: "" }) => {
     );
     let stats = getStats(path2);
     if (stats && stats.isDirectory()) {
-      const indexFile = options.index ?? "index.html";
-      path2 = join(path2, indexFile);
+      const indexFile2 = options.index ?? "index.html";
+      path2 = join(path2, indexFile2);
       stats = getStats(path2);
     }
     if (!stats) {
@@ -816,7 +816,7 @@ var serveStatic = (options = { root: "" }) => {
 
 // server/index.ts
 import { readFileSync as readFileSync20, existsSync as existsSync23, watchFile } from "fs";
-import { resolve as resolve22, join as join14, basename as basename5 } from "path";
+import { resolve as resolve23, join as join15, basename as basename5 } from "path";
 import { homedir as homedir2 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
@@ -1274,7 +1274,7 @@ var credsSaveQueue = Promise.resolve();
 async function drainCredsSaveQueue(timeoutMs = 5e3) {
   console.error(`${TAG2} draining credential save queue\u2026`);
   const timer2 = new Promise(
-    (resolve23) => setTimeout(() => resolve23("timeout"), timeoutMs)
+    (resolve24) => setTimeout(() => resolve24("timeout"), timeoutMs)
   );
   const result = await Promise.race([
     credsSaveQueue.then(() => "drained"),
@@ -1402,11 +1402,11 @@ async function createWaSocket(opts) {
   return sock;
 }
 async function waitForConnection(sock) {
-  return new Promise((resolve23, reject) => {
+  return new Promise((resolve24, reject) => {
     const handler = (update) => {
       if (update.connection === "open") {
         sock.ev.off("connection.update", handler);
-        resolve23();
+        resolve24();
       }
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
@@ -1520,14 +1520,14 @@ ${inspected}`;
   return inspect2(err, INSPECT_OPTS2);
 }
 function withTimeout(label, promise, timeoutMs) {
-  return new Promise((resolve23, reject) => {
+  return new Promise((resolve24, reject) => {
     const timer2 = setTimeout(() => {
       reject(new Error(`${label} timed out after ${timeoutMs}ms`));
     }, timeoutMs);
     promise.then(
       (value) => {
         clearTimeout(timer2);
-        resolve23(value);
+        resolve24(value);
       },
       (err) => {
         clearTimeout(timer2);
@@ -2062,8 +2062,8 @@ async function persistWhatsAppMessage(input) {
   const { givenName, familyName } = splitName(input.pushName);
   const prev = sessionWriteLocks.get(input.cacheKey);
   let release;
-  const mine = new Promise((resolve23) => {
-    release = resolve23;
+  const mine = new Promise((resolve24) => {
+    release = resolve24;
   });
   const chained = (prev ?? Promise.resolve()).then(() => mine);
   sessionWriteLocks.set(input.cacheKey, chained);
@@ -3099,11 +3099,11 @@ async function connectWithReconnect(conn) {
       console.error(
         `${TAG12} reconnecting account=${conn.accountId} in ${delay}ms (attempt ${decision.nextAttempts}/${maxAttempts})`
       );
-      await new Promise((resolve23) => {
-        const timer2 = setTimeout(resolve23, delay);
+      await new Promise((resolve24) => {
+        const timer2 = setTimeout(resolve24, delay);
         conn.abortController.signal.addEventListener("abort", () => {
           clearTimeout(timer2);
-          resolve23();
+          resolve24();
         }, { once: true });
       });
     }
@@ -3111,16 +3111,16 @@ async function connectWithReconnect(conn) {
   }
 }
 function waitForDisconnectEvent(conn) {
-  return new Promise((resolve23) => {
+  return new Promise((resolve24) => {
     if (!conn.sock) {
-      resolve23();
+      resolve24();
       return;
     }
     const sock = conn.sock;
     const handler = (update) => {
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
-        resolve23();
+        resolve24();
       }
     };
     sock.ev.on("connection.update", handler);
@@ -3382,8 +3382,8 @@ async function handleInboundMessage(conn, msg) {
     const conversationKey = isGroup ? remoteJid : senderPhone;
     const debounceKey = `${conn.accountId}:${conversationKey}:${senderPhone}`;
     let resolvePending;
-    const sttPending = new Promise((resolve23) => {
-      resolvePending = resolve23;
+    const sttPending = new Promise((resolve24) => {
+      resolvePending = resolve24;
     });
     if (conn.debouncer) conn.debouncer.registerPending(debounceKey, sttPending);
     try {
@@ -3787,20 +3787,20 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
 
 // server/routes/health.ts
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve23) => {
+  return new Promise((resolve24) => {
     const socket = createConnection2(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve23(true);
+      resolve24(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve23(false);
+      resolve24(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve23(false);
+      resolve24(false);
     });
   });
 }
@@ -3865,9 +3865,9 @@ var health_default = app;
 
 // app/lib/attachments.ts
 import { randomUUID as randomUUID3 } from "crypto";
-import { mkdir as mkdir2, readFile, stat as stat2, writeFile as writeFile2 } from "fs/promises";
+import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
 import { realpathSync } from "fs";
-import { resolve as resolve3, extname, basename } from "path";
+import { resolve as resolve3, extname } from "path";
 var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve3(process.cwd(), "../platform");
 var ATTACHMENTS_ROOT = resolve3(PLATFORM_ROOT3, "..", "data/uploads");
 var SUPPORTED_MIME_TYPES = /* @__PURE__ */ new Set([
@@ -3957,18 +3957,6 @@ function validateFilePathInAccount(filePath, accountDir) {
   }
   return resolved;
 }
-async function storeGeneratedFile(accountId, filePath) {
-  const fileStat = await stat2(filePath);
-  if (fileStat.size > MAX_FILE_SIZE_BYTES) {
-    throw new Error(
-      `File exceeds the 50 MB limit (${(fileStat.size / 1024 / 1024).toFixed(1)} MB).`
-    );
-  }
-  const filename = basename(filePath);
-  const mimeType = detectMimeType(filePath);
-  const buffer = await readFile(filePath);
-  return writeAttachment(accountId, filename, mimeType, fileStat.size, buffer);
-}
 async function storeComponentArtefact(accountId, attachmentId, mimeType, content, filename) {
   const buffer = Buffer.from(content, "utf-8");
   if (buffer.byteLength > MAX_FILE_SIZE_BYTES) {
@@ -4548,12 +4536,12 @@ async function dispatchOnce(input) {
   });
   if (!entry) return { error: "spawn-failed" };
   entry.lastInboundAt = Date.now();
-  let resolve23;
+  let resolve24;
   const turnPromise = new Promise((r) => {
-    resolve23 = r;
+    resolve24 = r;
   });
   const listener = (text) => {
-    resolve23(text);
+    resolve24(text);
   };
   entry.subscribers.add(listener);
   const writeOk = await writeInput(entry, input.text);
@@ -4887,8 +4875,8 @@ ${lines}]`;
 var chat_default = app2;
 
 // server/routes/whatsapp.ts
-import { join as join5, resolve as resolve6, basename as basename2 } from "path";
-import { readFile as readFile2, stat as stat3 } from "fs/promises";
+import { join as join5, resolve as resolve6, basename } from "path";
+import { readFile, stat as stat2 } from "fs/promises";
 import { realpathSync as realpathSync2, readdirSync as readdirSync2, readFileSync as readFileSync6, existsSync as existsSync4 } from "fs";
 
 // app/lib/whatsapp/login.ts
@@ -4995,8 +4983,8 @@ async function startLogin(opts) {
   resetActiveLogin(accountId);
   let resolveQr = null;
   let rejectQr = null;
-  const qrPromise = new Promise((resolve23, reject) => {
-    resolveQr = resolve23;
+  const qrPromise = new Promise((resolve24, reject) => {
+    resolveQr = resolve24;
     rejectQr = reject;
   });
   const qrTimer = setTimeout(
@@ -5820,12 +5808,12 @@ app3.post("/send-document", async (c) => {
       console.error(`${TAG17} send-document path error: ${String(err)}`);
       return c.json({ error: String(err) }, 500);
     }
-    const fileStat = await stat3(resolvedPath);
+    const fileStat = await stat2(resolvedPath);
     if (fileStat.size > MAX_FILE_SIZE_BYTES) {
       return c.json({ error: `File exceeds 50 MB limit (${(fileStat.size / 1024 / 1024).toFixed(1)} MB)` }, 400);
     }
-    const buffer = Buffer.from(await readFile2(resolvedPath));
-    const filename = basename2(resolvedPath);
+    const buffer = Buffer.from(await readFile(resolvedPath));
+    const filename = basename(resolvedPath);
     const mimetype = detectMimeType(resolvedPath);
     const sock = getSocket(accountId);
     if (!sock) {
@@ -6781,7 +6769,7 @@ var session_default = app6;
 
 // server/routes/admin/logs.ts
 import { existsSync as existsSync10, readdirSync as readdirSync5, readFileSync as readFileSync10, statSync as statSync5 } from "fs";
-import { resolve as resolve7, basename as basename3 } from "path";
+import { resolve as resolve7, basename as basename2 } from "path";
 
 // app/lib/logs-read-resolve.ts
 import { existsSync as existsSync9 } from "fs";
@@ -6813,7 +6801,7 @@ app7.get("/", async (c) => {
   if (accountLogDir) logDirs.push(accountLogDir);
   logDirs.push(LOG_DIR);
   if (fileParam) {
-    const safe = basename3(fileParam);
+    const safe = basename2(fileParam);
     const searched = [];
     for (const dir of logDirs) {
       const filePath = resolve7(dir, safe);
@@ -6883,7 +6871,7 @@ app7.get("/", async (c) => {
     if (hit) {
       console.info(`[admin/logs] resolved cacheKey=${cacheKeySlice} sessionId=${sessionIdSlice} via=${primaryId === cacheKey ? "cacheKey" : primaryId === sessionKeyFromConv ? "reverse-lookup" : "sessionId-fallback"}`);
       try {
-        const filename = basename3(hit.path);
+        const filename = basename2(hit.path);
         const buffer = readFileSync10(hit.path);
         const onDiskBytes = statSync5(hit.path).size;
         const headers = {
@@ -6969,7 +6957,7 @@ app8.get("/", (c) => {
 var claude_info_default = app8;
 
 // server/routes/admin/attachment.ts
-import { readFile as readFile3, readdir } from "fs/promises";
+import { readFile as readFile2, readdir } from "fs/promises";
 import { existsSync as existsSync11 } from "fs";
 import { resolve as resolve8 } from "path";
 var app9 = new Hono();
@@ -6993,7 +6981,7 @@ app9.get("/:attachmentId", requireAdminSession, async (c) => {
   }
   let meta;
   try {
-    meta = JSON.parse(await readFile3(metaPath, "utf-8"));
+    meta = JSON.parse(await readFile2(metaPath, "utf-8"));
   } catch {
     return new Response("Not found", { status: 404 });
   }
@@ -7003,7 +6991,7 @@ app9.get("/:attachmentId", requireAdminSession, async (c) => {
     return new Response("Not found", { status: 404 });
   }
   const filePath = resolve8(dir, dataFile);
-  const buffer = await readFile3(filePath);
+  const buffer = await readFile2(filePath);
   return new Response(new Uint8Array(buffer), {
     headers: {
       "Content-Type": meta.mimeType,
@@ -8016,10 +8004,10 @@ function computeSpecialistDomains(accountId) {
   const resolveDesc = (qualified) => {
     if (!qualified.startsWith("mcp__")) return void 0;
     const rest = qualified.slice(5);
-    const sep4 = rest.indexOf("__");
-    if (sep4 < 0) return void 0;
-    const plugin = rest.slice(0, sep4);
-    const tool = rest.slice(sep4 + 2);
+    const sep6 = rest.indexOf("__");
+    if (sep6 < 0) return void 0;
+    const plugin = rest.slice(0, sep6);
+    const tool = rest.slice(sep6 + 2);
     let map = descByPlugin.get(plugin);
     if (!map) {
       const dir = pluginDirs.get(plugin);
@@ -8398,9 +8386,9 @@ var events_default = app14;
 
 // server/routes/admin/files.ts
 import { createReadStream as createReadStream2 } from "fs";
-import { readdir as readdir2, readFile as readFile4, stat as stat4, mkdir as mkdir3, writeFile as writeFile4, unlink as unlink2 } from "fs/promises";
+import { readdir as readdir3, readFile as readFile4, stat as stat4, mkdir as mkdir3, writeFile as writeFile4, unlink as unlink2 } from "fs/promises";
 import { realpathSync as realpathSync4 } from "fs";
-import { basename as basename4, dirname as dirname3, join as join11, resolve as resolve13, sep as sep3 } from "path";
+import { basename as basename4, dirname as dirname3, join as join12, resolve as resolve14, sep as sep4 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // app/lib/data-path.ts
@@ -8408,6 +8396,16 @@ import { realpathSync as realpathSync3 } from "fs";
 import { resolve as resolve12, normalize, sep as sep2, relative } from "path";
 var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT ?? resolve12(process.cwd(), "../platform");
 var DATA_ROOT = resolve12(PLATFORM_ROOT5, "..", "data");
+var ACCOUNT_PARTITION_DIRS = /* @__PURE__ */ new Set(["uploads", "accounts"]);
+var ACCOUNT_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function crossesForeignAccountPartition(relPath2, accountId) {
+  const segs = relPath2.split("/").filter(Boolean);
+  if (segs.length < 2) return false;
+  if (!ACCOUNT_PARTITION_DIRS.has(segs[0])) return false;
+  const owner = segs[1];
+  if (!ACCOUNT_UUID_RE.test(owner)) return false;
+  return owner !== accountId;
+}
 function resolveDataPath(raw) {
   const cleaned = normalize("/" + (raw ?? "").replace(/\\/g, "/")).replace(/^\/+/, "");
   const absolute = resolve12(DATA_ROOT, cleaned);
@@ -8758,11 +8756,291 @@ async function cascadeDeleteDocument(params) {
   }
 }
 
+// app/lib/file-index.ts
+import * as fsp from "fs/promises";
+import { resolve as resolve13, relative as relative2, join as join11, basename as basename3, extname as extname2, sep as sep3 } from "path";
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
+var execFileAsync2 = promisify2(execFile2);
+var CONTENT_CAP = 1e5;
+var RECONCILE_DEBOUNCE_MS = 1e4;
+var lastReconcileAt = /* @__PURE__ */ new Map();
+var TEXT_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".txt",
+  ".md",
+  ".markdown",
+  ".csv",
+  ".tsv",
+  ".json",
+  ".jsonl",
+  ".log",
+  ".yaml",
+  ".yml",
+  ".xml",
+  ".toml",
+  ".ini",
+  ".env",
+  ".sql",
+  ".sh",
+  ".py",
+  ".js",
+  ".ts",
+  ".tsx",
+  ".jsx",
+  ".css",
+  ".svg",
+  ".rtf"
+]);
+var HTML_EXTENSIONS = /* @__PURE__ */ new Set([".html", ".htm"]);
+var MIME_BY_EXT2 = {
+  ".pdf": "application/pdf",
+  ".txt": "text/plain",
+  ".md": "text/markdown",
+  ".markdown": "text/markdown",
+  ".csv": "text/csv",
+  ".json": "application/json",
+  ".html": "text/html",
+  ".htm": "text/html",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp"
+};
+function mimeForExt(ext) {
+  return MIME_BY_EXT2[ext.toLowerCase()] ?? "application/octet-stream";
+}
+async function extractPdf(absolute) {
+  const { stdout } = await execFileAsync2("pdftotext", [absolute, "-"], {
+    maxBuffer: 10 * 1024 * 1024
+  });
+  return stdout.trim();
+}
+function stripHtml(html) {
+  return html.replace(/<script[\s\S]*?<\/script>/gi, " ").replace(/<style[\s\S]*?<\/style>/gi, " ").replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim();
+}
+async function extractFileContent(absolute) {
+  const ext = extname2(absolute).toLowerCase();
+  try {
+    if (ext === ".pdf") return (await extractPdf(absolute)).slice(0, CONTENT_CAP);
+    if (HTML_EXTENSIONS.has(ext)) {
+      const raw = await fsp.readFile(absolute, "utf-8");
+      return stripHtml(raw).slice(0, CONTENT_CAP);
+    }
+    if (TEXT_EXTENSIONS.has(ext)) {
+      const raw = await fsp.readFile(absolute, "utf-8");
+      return raw.slice(0, CONTENT_CAP);
+    }
+    return "";
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`[file-index] extract-failed path="${relative2(DATA_ROOT, absolute)}" err="${msg}"`);
+    return "";
+  }
+}
+async function readDisplayName(absolute) {
+  const dir = absolute.slice(0, absolute.length - basename3(absolute).length);
+  const base = basename3(absolute);
+  const dot = base.lastIndexOf(".");
+  const stem = dot === -1 ? base : base.slice(0, dot);
+  if (base === `${stem}.meta.json`) return null;
+  try {
+    const raw = await fsp.readFile(join11(dir, `${stem}.meta.json`), "utf-8");
+    const meta = JSON.parse(raw);
+    const dn = meta.displayName ?? meta.filename;
+    return typeof dn === "string" && dn.length > 0 ? dn : null;
+  } catch {
+    return null;
+  }
+}
+async function walkSubtree(root, dataRoot, out) {
+  let entries;
+  try {
+    entries = await fsp.readdir(root, { withFileTypes: true });
+  } catch (err) {
+    if (err.code === "ENOENT") return { clean: true };
+    console.error(`[file-index] walk-error dir="${relative2(dataRoot, root)}" err="${err.message}"`);
+    return { clean: false };
+  }
+  let clean = true;
+  for (const entry of entries) {
+    if (entry.isSymbolicLink()) continue;
+    const abs = join11(root, entry.name);
+    if (entry.isDirectory()) {
+      const sub = await walkSubtree(abs, dataRoot, out);
+      if (!sub.clean) clean = false;
+    } else if (entry.isFile()) {
+      try {
+        const st = await fsp.stat(abs);
+        out.push({
+          absolute: abs,
+          relativePath: relative2(dataRoot, abs).split(sep3).join("/"),
+          sizeBytes: st.size,
+          modifiedAt: st.mtime.toISOString()
+        });
+      } catch (err) {
+        console.error(`[file-index] stat-error path="${relative2(dataRoot, abs)}" err="${err.message}"`);
+        clean = false;
+      }
+    }
+  }
+  return { clean };
+}
+async function upsertFileArtifact(session, f) {
+  await session.run(
+    `MERGE (f:FileArtifact {accountId: $accountId, relativePath: $relativePath})
+     SET f.name = $name,
+         f.displayName = $displayName,
+         f.mimeType = $mimeType,
+         f.sizeBytes = $sizeBytes,
+         f.modifiedAt = $modifiedAt,
+         f.content = $content,
+         f.embedding = $embedding`,
+    f
+  );
+}
+async function buildArtifact(accountId, wf, embed2) {
+  const name = basename3(wf.absolute);
+  const content = await extractFileContent(wf.absolute);
+  const displayName = await readDisplayName(wf.absolute);
+  const embedInput = `${name}
+${content}`.slice(0, CONTENT_CAP);
+  let embedding = null;
+  const embedStart = Date.now();
+  try {
+    embedding = await embed2(embedInput);
+  } catch (err) {
+    console.error(`[file-index] embed-failed path="${wf.relativePath}" err="${err.message}"`);
+  }
+  console.error(
+    `[file-index] index-file account=${accountId} path="${wf.relativePath}" chars=${content.length} embed-ms=${Date.now() - embedStart}`
+  );
+  return {
+    accountId,
+    relativePath: wf.relativePath,
+    name,
+    displayName,
+    mimeType: mimeForExt(extname2(wf.absolute)),
+    sizeBytes: wf.sizeBytes,
+    modifiedAt: wf.modifiedAt,
+    content,
+    embedding
+  };
+}
+async function withSession(opts, fn) {
+  if (opts?.session) return fn(opts.session);
+  const session = getSession();
+  try {
+    return await fn(session);
+  } finally {
+    await session.close();
+  }
+}
+async function reconcileFileIndex(accountId, opts) {
+  const dataRoot = opts?.dataRoot ?? DATA_ROOT;
+  const embed2 = opts?.embed ?? embed;
+  const t0 = Date.now();
+  return withSession(opts, async (session) => {
+    const walked = [];
+    const subtreeRoots = [
+      resolve13(dataRoot, "uploads", accountId),
+      resolve13(dataRoot, "accounts", accountId)
+    ];
+    let clean = true;
+    for (const root of subtreeRoots) {
+      const r = await walkSubtree(root, dataRoot, walked);
+      if (!r.clean) clean = false;
+    }
+    const existing = /* @__PURE__ */ new Map();
+    const existingRes = await session.run(
+      `MATCH (f:FileArtifact {accountId: $accountId})
+       RETURN f.relativePath AS relativePath, f.sizeBytes AS sizeBytes,
+              f.modifiedAt AS modifiedAt, f.embedding IS NOT NULL AS hasEmbedding`,
+      { accountId }
+    );
+    for (const rec of existingRes.records) {
+      existing.set(rec.get("relativePath"), {
+        sizeBytes: typeof rec.get("sizeBytes")?.toNumber === "function" ? rec.get("sizeBytes").toNumber() : Number(rec.get("sizeBytes")),
+        modifiedAt: rec.get("modifiedAt"),
+        hasEmbedding: rec.get("hasEmbedding") === true
+      });
+    }
+    let upserted = 0;
+    let skipped = 0;
+    for (const wf of walked) {
+      const prior = existing.get(wf.relativePath);
+      const unchanged = prior && prior.sizeBytes === wf.sizeBytes && prior.modifiedAt === wf.modifiedAt && prior.hasEmbedding;
+      if (unchanged) {
+        skipped++;
+        continue;
+      }
+      await upsertFileArtifact(session, await buildArtifact(accountId, wf, embed2));
+      upserted++;
+    }
+    let pruned = 0;
+    if (clean) {
+      const foundPaths = walked.map((w) => w.relativePath);
+      const pruneRes = await session.run(
+        `MATCH (f:FileArtifact {accountId: $accountId})
+         WHERE NOT f.relativePath IN $foundPaths
+         DETACH DELETE f
+         RETURN count(f) AS pruned`,
+        { accountId, foundPaths }
+      );
+      const c = pruneRes.records[0]?.get("pruned");
+      pruned = typeof c?.toNumber === "function" ? c.toNumber() : Number(c ?? 0);
+    }
+    console.error(
+      `[file-index] reconcile account=${accountId} walked=${walked.length} upserted=${upserted} skipped=${skipped} pruned=${pruned} clean=${clean} ms=${Date.now() - t0}`
+    );
+    return { walked: walked.length, upserted, skipped, pruned };
+  });
+}
+async function reconcileFileIndexDebounced(accountId, opts) {
+  const now = Date.now();
+  const last = lastReconcileAt.get(accountId) ?? 0;
+  if (now - last < RECONCILE_DEBOUNCE_MS) return;
+  lastReconcileAt.set(accountId, now);
+  try {
+    await reconcileFileIndex(accountId, opts);
+  } catch (err) {
+    console.error(`[file-index] reconcile-failed account=${accountId} err="${err.message}"`);
+  }
+}
+async function indexFile(accountId, relativePath, opts) {
+  const dataRoot = opts?.dataRoot ?? DATA_ROOT;
+  const embed2 = opts?.embed ?? embed;
+  const absolute = resolve13(dataRoot, relativePath);
+  await withSession(opts, async (session) => {
+    const st = await fsp.stat(absolute);
+    const wf = {
+      absolute,
+      relativePath,
+      sizeBytes: st.size,
+      modifiedAt: st.mtime.toISOString()
+    };
+    await upsertFileArtifact(session, await buildArtifact(accountId, wf, embed2));
+  });
+}
+async function dropFileIndex(accountId, relativePath, opts) {
+  await withSession(opts, async (session) => {
+    const res = await session.run(
+      `MATCH (f:FileArtifact {accountId: $accountId, relativePath: $relativePath})
+       DETACH DELETE f
+       RETURN count(f) AS dropped`,
+      { accountId, relativePath }
+    );
+    const c = res.records[0]?.get("dropped");
+    const dropped = typeof c?.toNumber === "function" ? c.toNumber() : Number(c ?? 0);
+    console.error(`[file-index] drop account=${accountId} path="${relativePath}" dropped=${dropped}`);
+  });
+}
+
 // server/routes/admin/files.ts
 var UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function readMeta(absDir, baseName) {
   try {
-    const raw = await readFile4(join11(absDir, `${baseName}.meta.json`), "utf8");
+    const raw = await readFile4(join12(absDir, `${baseName}.meta.json`), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.filename === "string") {
       return { filename: parsed.filename, mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0 };
@@ -8773,16 +9051,16 @@ async function readMeta(absDir, baseName) {
 }
 async function readAccountNames() {
   const map = /* @__PURE__ */ new Map();
-  const accountsDir = resolve13(DATA_ROOT, "accounts");
+  const accountsDir = resolve14(DATA_ROOT, "accounts");
   let names;
   try {
-    names = await readdir2(accountsDir);
+    names = await readdir3(accountsDir);
   } catch {
     return map;
   }
   for (const name of names) {
     if (!UUID_RE3.test(name)) continue;
-    const configPath2 = resolve13(accountsDir, name, "account.json");
+    const configPath2 = resolve14(accountsDir, name, "account.json");
     try {
       const raw = await readFile4(configPath2, "utf8");
       const parsed = JSON.parse(raw);
@@ -8800,7 +9078,7 @@ async function readAccountNames() {
 }
 async function enrich(absolute, entry, accountNames) {
   if (entry.kind === "directory" && UUID_RE3.test(entry.name)) {
-    const meta = await readMeta(join11(absolute, entry.name), entry.name);
+    const meta = await readMeta(join12(absolute, entry.name), entry.name);
     if (meta?.filename) {
       entry.displayName = meta.filename;
       entry.mimeType = meta.mimeType;
@@ -8852,14 +9130,14 @@ app15.get("/", requireAdminSession, async (c) => {
     if (!info.isDirectory()) {
       return c.json({ error: "Path is not a directory \u2014 use /api/admin/files/download for files" }, 400);
     }
-    const names = await readdir2(absolute);
+    const names = await readdir3(absolute);
     const entries = [];
     for (const name of names) {
       if (UUID_RE3.test(name.replace(/\.meta\.json$/, "")) && name.endsWith(".meta.json")) {
         continue;
       }
       try {
-        const entryPath = join11(absolute, name);
+        const entryPath = join12(absolute, name);
         const s = await stat4(entryPath);
         entries.push({
           name,
@@ -8895,7 +9173,8 @@ app15.get("/", requireAdminSession, async (c) => {
 });
 app15.get("/download", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
-  if (!getAccountIdForSession(cacheKey)) {
+  const accountId = getAccountIdForSession(cacheKey);
+  if (!accountId) {
     console.error(`[data] auth-rejected endpoint="/api/admin/files/download" reason="no account for session"`);
     return c.json({ error: "Account not found for session" }, 401);
   }
@@ -8909,6 +9188,10 @@ app15.get("/download", requireAdminSession, async (c) => {
     return c.json({ error: resolution.error }, resolution.status);
   }
   const { absolute, relative: relPath2 } = resolution;
+  if (crossesForeignAccountPartition(relPath2, accountId)) {
+    console.error(`[data] account-scope-blocked endpoint="/api/admin/files/download" path="${relPath2}" account=${accountId.slice(0, 8)}\u2026`);
+    return c.json({ error: "Not found" }, 404);
+  }
   try {
     const info = await stat4(absolute);
     if (!info.isFile()) {
@@ -8973,13 +9256,13 @@ app15.post("/upload", requireAdminSession, async (c) => {
   }
   const safeName = basename4(file.name).replace(/[\0/\\]/g, "_");
   const finalName = `${Date.now()}-${safeName}`;
-  const destDir = resolve13(DATA_ROOT, "uploads", accountId);
-  const destPath = resolve13(destDir, finalName);
+  const destDir = resolve14(DATA_ROOT, "uploads", accountId);
+  const destPath = resolve14(destDir, finalName);
   try {
     await mkdir3(destDir, { recursive: true });
     const dataRootReal = realpathSync4(DATA_ROOT);
     const destDirReal = realpathSync4(destDir);
-    if (destDirReal !== dataRootReal && !destDirReal.startsWith(dataRootReal + sep3)) {
+    if (destDirReal !== dataRootReal && !destDirReal.startsWith(dataRootReal + sep4)) {
       console.error(`[data] path-traversal-blocked requested="uploads/${accountId}" resolved="${destDirReal}"`);
       return c.json({ error: "Upload destination escapes DATA_ROOT" }, 403);
     }
@@ -8992,6 +9275,9 @@ app15.post("/upload", requireAdminSession, async (c) => {
   }
   const relativeDest = `uploads/${accountId}/${finalName}`;
   console.error(`[data] file-upload filename="${safeName}" size=${file.size} dest="${relativeDest}"`);
+  void indexFile(accountId, relativeDest).catch((err) => {
+    console.error(`[data] file-upload index-failed dest="${relativeDest}" err="${err instanceof Error ? err.message : String(err)}"`);
+  });
   return c.json({
     path: relativeDest,
     filename: finalName,
@@ -9032,7 +9318,7 @@ app15.delete("/", requireAdminSession, async (c) => {
     }
     const dot = base.lastIndexOf(".");
     const stem = dot === -1 ? base : base.slice(0, dot);
-    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join11(dirname3(absolute), `${stem}.meta.json`) : null;
+    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join12(dirname3(absolute), `${stem}.meta.json`) : null;
     await unlink2(absolute);
     if (sidecarPath) {
       try {
@@ -9041,6 +9327,11 @@ app15.delete("/", requireAdminSession, async (c) => {
       }
     }
     console.error(`[data] file-delete path="${relPath2}" bytes=${info.size}`);
+    try {
+      await dropFileIndex(accountId, relPath2);
+    } catch (err) {
+      console.error(`[data] file-delete index-drop-failed path="${relPath2}" err="${err instanceof Error ? err.message : String(err)}"`);
+    }
     const parsed = parseAttachmentPath(relPath2);
     if (parsed) {
       try {
@@ -9860,6 +10151,9 @@ app16.get("/", requireAdminSession, async (c) => {
   }
   const wantsBodyFulltext = !wildcard && labels.some((l) => CONVERSATION_PARENT_LABELS.has(l));
   const forwardedLabels = wildcard ? void 0 : wantsBodyFulltext ? Array.from(/* @__PURE__ */ new Set([...labels, ...MESSAGE_FAMILY_LABELS])) : labels;
+  if (labels.includes("FileArtifact")) {
+    await reconcileFileIndexDebounced(accountId);
+  }
   const started = Date.now();
   const session = getSession();
   try {
@@ -11064,43 +11358,38 @@ var WRITE_CYPHER = `
 `;
 var graph_default_view_default = app21;
 
-// server/routes/admin/file-attach.ts
-var app22 = new Hono();
-app22.post("/", async (c) => {
-  try {
-    const body = await c.req.json();
-    const { filePath, accountId } = body;
-    if (!filePath || !accountId) {
-      return c.json({ error: "Missing required fields: filePath, accountId" }, 400);
-    }
-    const attachment = await storeGeneratedFile(accountId, filePath);
-    console.error(
-      `[admin:file-attach] stored path=${filePath} id=${attachment.attachmentId} filename=${JSON.stringify(attachment.filename)} size=${attachment.sizeBytes} mime=${attachment.mimeType}`
-    );
-    return c.json({
-      attachmentId: attachment.attachmentId,
-      filename: attachment.filename,
-      sizeBytes: attachment.sizeBytes,
-      mimeType: attachment.mimeType
-    });
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    console.error(`[admin:file-attach] error: ${message}`);
-    return c.json({ error: message }, 500);
-  }
-});
-var file_attach_default = app22;
-
 // server/routes/admin/sidebar-artefacts.ts
 import neo4j2 from "neo4j-driver";
-import { readFile as readFile5, readdir as readdir3, stat as stat5 } from "fs/promises";
-import { resolve as resolve14, relative as relative2, isAbsolute } from "path";
+import { readFile as readFile5, readdir as readdir4, stat as stat5 } from "fs/promises";
+import { resolve as resolve15, relative as relative3, isAbsolute, sep as sep5 } from "path";
 import { existsSync as existsSync16 } from "fs";
 var LIMIT = 50;
 var TEXT_MIME_PREFIXES = ["text/", "application/json", "application/markdown"];
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
-var app23 = new Hono();
-app23.get("/", requireAdminSession, async (c) => {
+function toDataRootRelPath(absPath) {
+  if (absPath !== DATA_ROOT && !absPath.startsWith(DATA_ROOT + sep5)) return null;
+  return relative3(DATA_ROOT, absPath);
+}
+async function resolveDocAbsPath(accountId, attachmentId) {
+  if (!attachmentId) return null;
+  const accountDir = resolve15(ATTACHMENTS_ROOT, accountId);
+  const dir = resolve15(accountDir, attachmentId);
+  try {
+    validateFilePathInAccount(dir, accountDir);
+  } catch {
+    return null;
+  }
+  try {
+    const entries = await readdir4(dir);
+    const dataFile = entries.find((f) => !f.endsWith(".meta.json"));
+    if (!dataFile) return null;
+    return resolve15(dir, dataFile);
+  } catch {
+    return null;
+  }
+}
+var app22 = new Hono();
+app22.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -11111,7 +11400,7 @@ app23.get("/", requireAdminSession, async (c) => {
   if (docs === null) {
     return c.json({ error: "Failed to load artefacts" }, 500);
   }
-  const accountDir = resolve14(ACCOUNTS_DIR, accountId);
+  const accountDir = resolve15(ACCOUNTS_DIR, accountId);
   const agents = await fetchAgentTemplateRows(accountDir);
   const artefacts = [...docs, ...agents].sort(
     (a, b) => (b.updatedAt ?? "").localeCompare(a.updatedAt ?? "")
@@ -11152,6 +11441,7 @@ async function fetchKnowledgeDocs(accountId) {
   }
   return Promise.all(metas.map(async (m) => {
     const { content, skipReason } = await readArtefactContent(accountId, m.attachmentId, m.mimeType, m.name);
+    const absPath = await resolveDocAbsPath(accountId, m.attachmentId);
     return {
       id: m.id,
       name: m.name,
@@ -11160,7 +11450,8 @@ async function fetchKnowledgeDocs(accountId) {
       content,
       editable: skipReason === null,
       mimeType: m.mimeType,
-      skipReason
+      skipReason,
+      downloadPath: absPath ? toDataRootRelPath(absPath) : null
     };
   }));
 }
@@ -11174,8 +11465,8 @@ async function readArtefactContent(accountId, attachmentId, mimeType, displayNam
     logSkip(displayName, "non-text-mime", mimeType);
     return { content: "", skipReason: "non-text-mime" };
   }
-  const accountDir = resolve14(ATTACHMENTS_ROOT, accountId);
-  const dir = resolve14(accountDir, attachmentId);
+  const accountDir = resolve15(ATTACHMENTS_ROOT, accountId);
+  const dir = resolve15(accountDir, attachmentId);
   try {
     validateFilePathInAccount(dir, accountDir);
   } catch {
@@ -11183,13 +11474,13 @@ async function readArtefactContent(accountId, attachmentId, mimeType, displayNam
     return { content: "", skipReason: "containment-rejected" };
   }
   try {
-    const entries = await readdir3(dir);
+    const entries = await readdir4(dir);
     const dataFile = entries.find((f) => !f.endsWith(".meta.json"));
     if (!dataFile) {
       logSkip(displayName, "missing-on-disk", mimeType);
       return { content: "", skipReason: "missing-on-disk" };
     }
-    return { content: await readFile5(resolve14(dir, dataFile), "utf-8"), skipReason: null };
+    return { content: await readFile5(resolve15(dir, dataFile), "utf-8"), skipReason: null };
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     console.error(`[admin/sidebar-artefacts] read-failed attachmentId=${attachmentId.slice(0, 8)} error="${message}"`);
@@ -11205,8 +11496,8 @@ function logSkip(name, reason, mimeType) {
 async function fetchAgentTemplateRows(accountDir) {
   const rows = [];
   for (const filename of ADMIN_AGENT_FILES) {
-    const overridePath = resolve14(accountDir, "agents", "admin", filename);
-    const bundledPath = resolve14(PLATFORM_ROOT, "templates", "agents", "admin", filename);
+    const overridePath = resolve15(accountDir, "agents", "admin", filename);
+    const bundledPath = resolve15(PLATFORM_ROOT, "templates", "agents", "admin", filename);
     const labelStem = filename.replace(/\.md$/, "");
     const row = await readAgentTemplateRow({
       id: `agent-template:admin:${filename}`,
@@ -11220,12 +11511,12 @@ async function fetchAgentTemplateRows(accountDir) {
     });
     if (row) rows.push(row);
   }
-  const overrideDir = resolve14(accountDir, "specialists", "agents");
-  const bundledDir = resolve14(PLATFORM_ROOT, "templates", "specialists", "agents");
+  const overrideDir = resolve15(accountDir, "specialists", "agents");
+  const bundledDir = resolve15(PLATFORM_ROOT, "templates", "specialists", "agents");
   const specialistNames = await unionSpecialistFilenames(overrideDir, bundledDir);
   for (const filename of specialistNames) {
-    const overridePath = resolve14(overrideDir, filename);
-    const bundledPath = resolve14(bundledDir, filename);
+    const overridePath = resolve15(overrideDir, filename);
+    const bundledPath = resolve15(bundledDir, filename);
     const row = await readAgentTemplateRow({
       id: `agent-template:specialist:${filename}`,
       displayName: filename.replace(/\.md$/, ""),
@@ -11245,7 +11536,7 @@ async function unionSpecialistFilenames(overrideDir, bundledDir) {
   for (const dir of [overrideDir, bundledDir]) {
     if (!existsSync16(dir)) continue;
     try {
-      const entries = await readdir3(dir);
+      const entries = await readdir4(dir);
       for (const entry of entries) {
         if (entry.endsWith(".md")) names.add(entry);
       }
@@ -11292,7 +11583,11 @@ async function readAgentTemplateRow(inp) {
       content,
       editable: inp.editable,
       mimeType: "text/markdown",
-      skipReason: null
+      skipReason: null,
+      // Override paths live under <accountDir> (inside DATA_ROOT) and are
+      // downloadable; bundled-fallback templates live under PLATFORM_ROOT
+      // (outside DATA_ROOT) → null, so the client shows "not downloadable".
+      downloadPath: toDataRootRelPath(chosenPath)
     };
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -11303,19 +11598,19 @@ async function readAgentTemplateRow(inp) {
   }
 }
 function isWithin(target, root) {
-  const rel = relative2(root, target);
+  const rel = relative3(root, target);
   return !rel.startsWith("..") && !isAbsolute(rel);
 }
-var sidebar_artefacts_default = app23;
+var sidebar_artefacts_default = app22;
 
 // server/routes/admin/sidebar-artefact-save.ts
-import { mkdir as mkdir4, readdir as readdir4, stat as stat6, writeFile as writeFile5 } from "fs/promises";
-import { resolve as resolve15 } from "path";
+import { mkdir as mkdir4, readdir as readdir5, stat as stat6, writeFile as writeFile5 } from "fs/promises";
+import { resolve as resolve16 } from "path";
 import { existsSync as existsSync17 } from "fs";
 var ADMIN_AGENT_FILES2 = /* @__PURE__ */ new Set(["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"]);
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-var app24 = new Hono();
-app24.post("/", requireAdminSession, async (c) => {
+var app23 = new Hono();
+app23.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) return c.json({ error: "Account not found for session" }, 401);
@@ -11323,7 +11618,7 @@ app24.post("/", requireAdminSession, async (c) => {
   if (!body || typeof body.id !== "string" || typeof body.content !== "string") {
     return c.json({ error: "id and content required" }, 400);
   }
-  const accountDir = resolve15(ACCOUNTS_DIR, accountId);
+  const accountDir = resolve16(ACCOUNTS_DIR, accountId);
   const resolved = await resolveSavePath(body.id, accountId, accountDir);
   if (resolved.kind === "heal-race") {
     c.header("Retry-After", "2");
@@ -11368,17 +11663,17 @@ async function resolveSavePath(id, accountId, accountDir) {
     if (role !== "admin" || !ADMIN_AGENT_FILES2.has(filename)) {
       return { kind: "reject", status: 400, reason: "invalid-id" };
     }
-    const parent = resolve15(accountDir, "agents", "admin");
+    const parent = resolve16(accountDir, "agents", "admin");
     await mkdir4(parent, { recursive: true });
     try {
       validateFilePathInAccount(parent, accountDir);
     } catch {
       return { kind: "reject", status: 400, reason: "containment-rejected" };
     }
-    return { kind: "admin-template", path: resolve15(parent, filename) };
+    return { kind: "admin-template", path: resolve16(parent, filename) };
   }
   if (UUID_RE4.test(id)) {
-    const dir = resolve15(ATTACHMENTS_ROOT, accountId, id);
+    const dir = resolve16(ATTACHMENTS_ROOT, accountId, id);
     if (!existsSync17(dir)) {
       const attShort = id.slice(0, 8);
       if (isHealPending(accountId, id)) {
@@ -11411,31 +11706,31 @@ async function resolveSavePath(id, accountId, accountDir) {
       }
     }
     try {
-      validateFilePathInAccount(dir, resolve15(ATTACHMENTS_ROOT, accountId));
+      validateFilePathInAccount(dir, resolve16(ATTACHMENTS_ROOT, accountId));
     } catch {
       return { kind: "reject", status: 400, reason: "containment-rejected" };
     }
-    const entries = await readdir4(dir);
+    const entries = await readdir5(dir);
     const dataFile = entries.find((f) => !f.endsWith(".meta.json"));
     if (!dataFile) {
       return { kind: "reject", status: 400, reason: "not-found" };
     }
-    return { kind: "knowledge-doc", path: resolve15(dir, dataFile) };
+    return { kind: "knowledge-doc", path: resolve16(dir, dataFile) };
   }
   return { kind: "reject", status: 400, reason: "invalid-id" };
 }
 function relPath(absPath, root) {
   return absPath.startsWith(root) ? absPath.slice(root.length + 1) : absPath;
 }
-var sidebar_artefact_save_default = app24;
+var sidebar_artefact_save_default = app23;
 
 // server/routes/admin/sidebar-artefact-content.ts
-import { readFile as readFile6, readdir as readdir5 } from "fs/promises";
+import { readFile as readFile6, readdir as readdir6 } from "fs/promises";
 import { existsSync as existsSync18 } from "fs";
-import { resolve as resolve16 } from "path";
+import { resolve as resolve17 } from "path";
 var UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-var app25 = new Hono();
-app25.get("/", requireAdminSession, async (c) => {
+var app24 = new Hono();
+app24.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) return new Response("Unauthorized", { status: 401 });
@@ -11444,26 +11739,26 @@ app25.get("/", requireAdminSession, async (c) => {
     console.error(`[admin/sidebar-artefact-content] not-found id=${id.slice(0, 8)}`);
     return new Response("Not found", { status: 404 });
   }
-  const dir = resolve16(ATTACHMENTS_ROOT, accountId, id);
+  const dir = resolve17(ATTACHMENTS_ROOT, accountId, id);
   if (!existsSync18(dir)) {
     console.error(`[admin/sidebar-artefact-content] not-found id=${id.slice(0, 8)}`);
     return new Response("Not found", { status: 404 });
   }
   let meta;
   try {
-    meta = JSON.parse(await readFile6(resolve16(dir, `${id}.meta.json`), "utf-8"));
+    meta = JSON.parse(await readFile6(resolve17(dir, `${id}.meta.json`), "utf-8"));
   } catch {
     console.error(`[admin/sidebar-artefact-content] not-found id=${id.slice(0, 8)}`);
     return new Response("Not found", { status: 404 });
   }
-  const entries = await readdir5(dir);
+  const entries = await readdir6(dir);
   const dataFile = entries.find((f) => !f.endsWith(".meta.json"));
   if (!dataFile) {
     console.error(`[admin/sidebar-artefact-content] not-found id=${id.slice(0, 8)}`);
     return new Response("Not found", { status: 404 });
   }
   const start = Date.now();
-  const buffer = await readFile6(resolve16(dir, dataFile));
+  const buffer = await readFile6(resolve17(dir, dataFile));
   const ms = Date.now() - start;
   console.log(
     `[admin/sidebar-artefact-content] account=${accountId} id=${id.slice(0, 8)} mime=${meta.mimeType} bytes=${buffer.length} ms=${ms}`
@@ -11476,7 +11771,7 @@ app25.get("/", requireAdminSession, async (c) => {
     }
   });
 });
-var sidebar_artefact_content_default = app25;
+var sidebar_artefact_content_default = app24;
 
 // server/routes/admin/system-stats.ts
 import { readFile as readFile7 } from "fs/promises";
@@ -11573,8 +11868,8 @@ async function sample() {
   if (process.platform === "linux") return sampleLinux();
   return sampleOsFallback();
 }
-var app26 = new Hono();
-app26.get("/", async (c) => {
+var app25 = new Hono();
+app25.get("/", async (c) => {
   const started = Date.now();
   if (!inflight) {
     inflight = sample().finally(() => {
@@ -11597,14 +11892,14 @@ app26.get("/", async (c) => {
     return c.json({ degraded: true, reason, sampledAtMs: Date.now() });
   }
 });
-var system_stats_default = app26;
+var system_stats_default = app25;
 
 // server/routes/admin/health.ts
 import { existsSync as existsSync19, readFileSync as readFileSync14 } from "fs";
-import { resolve as resolve17, join as join12 } from "path";
-var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve17(process.cwd(), "..");
+import { resolve as resolve18, join as join13 } from "path";
+var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve18(process.cwd(), "..");
 var brandHostname = "maxy";
-var brandJsonPath = join12(PLATFORM_ROOT6, "config", "brand.json");
+var brandJsonPath = join13(PLATFORM_ROOT6, "config", "brand.json");
 if (existsSync19(brandJsonPath)) {
   try {
     const brand = JSON.parse(readFileSync14(brandJsonPath, "utf-8"));
@@ -11612,7 +11907,7 @@ if (existsSync19(brandJsonPath)) {
   } catch {
   }
 }
-var VERSION_FILE = resolve17(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
+var VERSION_FILE = resolve18(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
@@ -11642,8 +11937,8 @@ async function probeConversationDb() {
     });
   }
 }
-var app27 = new Hono();
-app27.get("/", async (c) => {
+var app26 = new Hono();
+app26.get("/", async (c) => {
   const version = readVersion();
   const probe = await probeConversationDb();
   const uptimeMs = Date.now() - new Date(PROCESS_STARTED_AT).getTime();
@@ -11665,7 +11960,7 @@ app27.get("/", async (c) => {
     uptimeMs
   });
 });
-var health_default2 = app27;
+var health_default2 = app26;
 
 // server/routes/admin/linkedin-ingest.ts
 var TAG20 = "[linkedin-ingest-route]";
@@ -11761,8 +12056,8 @@ function buildInitialMessage(env) {
   }
   return header;
 }
-var app28 = new Hono();
-app28.post("/", requireAdminSession, async (c) => {
+var app27 = new Hono();
+app27.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -11816,7 +12111,7 @@ app28.post("/", requireAdminSession, async (c) => {
   );
   return c.json({ ok: true, dispatchId: envelope.dispatchId, taskId: claudeSessionId }, 202);
 });
-var linkedin_ingest_default = app28;
+var linkedin_ingest_default = app27;
 
 // server/routes/admin/post-turn-context.ts
 import neo4j3 from "neo4j-driver";
@@ -11858,8 +12153,8 @@ function pruneProperties(raw) {
   }
   return out;
 }
-var app29 = new Hono();
-app29.get("/", async (c) => {
+var app28 = new Hono();
+app28.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr2(remoteAddr)) {
     console.error(`${TAG21} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -11919,7 +12214,7 @@ app29.get("/", async (c) => {
     await session.close();
   }
 });
-var post_turn_context_default = app29;
+var post_turn_context_default = app28;
 
 // server/routes/admin/public-session-context.ts
 import neo4j4 from "neo4j-driver";
@@ -11961,8 +12256,8 @@ function pruneProperties2(raw) {
   }
   return out;
 }
-var app30 = new Hono();
-app30.get("/", async (c) => {
+var app29 = new Hono();
+app29.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr3(remoteAddr)) {
     console.error(`${TAG22} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -12021,15 +12316,15 @@ app30.get("/", async (c) => {
     await session.close();
   }
 });
-var public_session_context_default = app30;
+var public_session_context_default = app29;
 
 // server/routes/admin/public-session-exit.ts
 var TAG23 = "[public-session-exit-route]";
 function isLoopbackAddr4(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-var app31 = new Hono();
-app31.post("/", async (c) => {
+var app30 = new Hono();
+app30.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr4(remoteAddr)) {
     console.error(`${TAG23} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -12056,15 +12351,15 @@ app31.post("/", async (c) => {
   handlePublicSessionExit(sessionId);
   return c.json({ ok: true });
 });
-var public_session_exit_default = app31;
+var public_session_exit_default = app30;
 
 // server/routes/admin/access-session-evict.ts
 var TAG24 = "[access-session-evict]";
 function isLoopbackAddr5(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-var app32 = new Hono();
-app32.post("/", async (c) => {
+var app31 = new Hono();
+app31.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr5(remoteAddr)) {
     console.error(`${TAG24} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -12092,49 +12387,48 @@ app32.post("/", async (c) => {
   console.log(`${TAG24} grantId=${grantId} dropped=${dropped}`);
   return c.json({ ok: true, dropped });
 });
-var access_session_evict_default = app32;
+var access_session_evict_default = app31;
 
 // server/routes/admin/index.ts
-var app33 = new Hono();
-app33.route("/session", session_default);
-app33.route("/logs", logs_default);
-app33.route("/claude-info", claude_info_default);
-app33.route("/attachment", attachment_default);
-app33.route("/agents", agents_default);
-app33.route("/sessions", sessions_default);
-app33.route("/claude-sessions", claude_sessions_default);
-app33.route("/log-ingest", log_ingest_default);
-app33.route("/events", events_default);
-app33.route("/files", files_default);
-app33.route("/graph-search", graph_search_default);
-app33.route("/graph-subgraph", graph_subgraph_default);
-app33.route("/graph-delete", graph_delete_default);
-app33.route("/graph-restore", graph_restore_default);
-app33.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app33.route("/graph-default-view", graph_default_view_default);
-app33.route("/file-attach", file_attach_default);
-app33.route("/sidebar-artefacts", sidebar_artefacts_default);
-app33.route("/sidebar-artefact-save", sidebar_artefact_save_default);
-app33.route("/sidebar-artefact-content", sidebar_artefact_content_default);
-app33.route("/system-stats", system_stats_default);
-app33.route("/health-brand", health_default2);
-app33.route("/linkedin-ingest", linkedin_ingest_default);
-app33.route("/post-turn-context", post_turn_context_default);
-app33.route("/public-session-context", public_session_context_default);
-app33.route("/public-session-exit", public_session_exit_default);
-app33.route("/access-session-evict", access_session_evict_default);
-var admin_default = app33;
+var app32 = new Hono();
+app32.route("/session", session_default);
+app32.route("/logs", logs_default);
+app32.route("/claude-info", claude_info_default);
+app32.route("/attachment", attachment_default);
+app32.route("/agents", agents_default);
+app32.route("/sessions", sessions_default);
+app32.route("/claude-sessions", claude_sessions_default);
+app32.route("/log-ingest", log_ingest_default);
+app32.route("/events", events_default);
+app32.route("/files", files_default);
+app32.route("/graph-search", graph_search_default);
+app32.route("/graph-subgraph", graph_subgraph_default);
+app32.route("/graph-delete", graph_delete_default);
+app32.route("/graph-restore", graph_restore_default);
+app32.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app32.route("/graph-default-view", graph_default_view_default);
+app32.route("/sidebar-artefacts", sidebar_artefacts_default);
+app32.route("/sidebar-artefact-save", sidebar_artefact_save_default);
+app32.route("/sidebar-artefact-content", sidebar_artefact_content_default);
+app32.route("/system-stats", system_stats_default);
+app32.route("/health-brand", health_default2);
+app32.route("/linkedin-ingest", linkedin_ingest_default);
+app32.route("/post-turn-context", post_turn_context_default);
+app32.route("/public-session-context", public_session_context_default);
+app32.route("/public-session-exit", public_session_exit_default);
+app32.route("/access-session-evict", access_session_evict_default);
+var admin_default = app32;
 
 // app/lib/access-gate.ts
 import neo4j5 from "neo4j-driver";
 import { readFileSync as readFileSync15 } from "fs";
-import { resolve as resolve18 } from "path";
+import { resolve as resolve19 } from "path";
 import { randomUUID as randomUUID8 } from "crypto";
-var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve18(process.cwd(), "..");
+var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve19(process.cwd(), "..");
 var driver = null;
 function readPassword() {
   if (process.env.NEO4J_PASSWORD) return process.env.NEO4J_PASSWORD;
-  const passwordFile = resolve18(PLATFORM_ROOT7, "config/.neo4j-password");
+  const passwordFile = resolve19(PLATFORM_ROOT7, "config/.neo4j-password");
   try {
     return readFileSync15(passwordFile, "utf-8").trim();
   } catch {
@@ -12337,8 +12631,8 @@ async function generateNewMagicToken(grantId) {
 var TAG25 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
-var app34 = new Hono();
-app34.post("/", async (c) => {
+var app33 = new Hono();
+app33.post("/", async (c) => {
   const ip = c.var.clientIp || "unknown";
   let body;
   try {
@@ -12420,13 +12714,13 @@ app34.post("/", async (c) => {
     displayName: grant.displayName
   });
 });
-var verify_token_default = app34;
+var verify_token_default = app33;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
-import { resolve as resolve19 } from "path";
-var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT ?? resolve19(process.cwd(), "..");
-var SEND_SCRIPT = resolve19(
+import { resolve as resolve20 } from "path";
+var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT ?? resolve20(process.cwd(), "..");
+var SEND_SCRIPT = resolve20(
   PLATFORM_ROOT8,
   "plugins",
   "email",
@@ -12483,9 +12777,9 @@ async function sendMagicLinkEmail(payload) {
 
 // server/routes/access/request-magic-link.ts
 var TAG26 = "[access-request-link]";
-var app35 = new Hono();
+var app34 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
-app35.post("/", async (c) => {
+app34.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -12559,17 +12853,17 @@ app35.post("/", async (c) => {
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
-var request_magic_link_default = app35;
+var request_magic_link_default = app34;
 
 // server/routes/access/index.ts
-var app36 = new Hono();
-app36.route("/verify-token", verify_token_default);
-app36.route("/request-magic-link", request_magic_link_default);
-var access_default = app36;
+var app35 = new Hono();
+app35.route("/verify-token", verify_token_default);
+app35.route("/request-magic-link", request_magic_link_default);
+var access_default = app35;
 
 // server/routes/sites.ts
 import { existsSync as existsSync20, readFileSync as readFileSync16, realpathSync as realpathSync5, statSync as statSync7 } from "fs";
-import { resolve as resolve20 } from "path";
+import { resolve as resolve21 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
   ".html": "text/html; charset=utf-8",
@@ -12600,8 +12894,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app37 = new Hono();
-app37.get("/:rel{.*}", (c) => {
+var app36 = new Hono();
+app36.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -12626,8 +12920,8 @@ app37.get("/:rel{.*}", (c) => {
     }
     segments.push(seg);
   }
-  const rootDir = resolve20(account.accountDir, "sites");
-  let filePath = segments.length === 0 ? rootDir : resolve20(rootDir, ...segments);
+  const rootDir = resolve21(account.accountDir, "sites");
+  let filePath = segments.length === 0 ? rootDir : resolve21(rootDir, ...segments);
   if (filePath !== rootDir && !filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
@@ -12647,7 +12941,7 @@ app37.get("/:rel{.*}", (c) => {
     return c.redirect(target, 301);
   }
   if (stat7?.isDirectory()) {
-    filePath = resolve20(filePath, "index.html");
+    filePath = resolve21(filePath, "index.html");
   }
   if (!filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
@@ -12704,7 +12998,7 @@ app37.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app37;
+var sites_default = app36;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
@@ -12785,7 +13079,7 @@ var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
 import { existsSync as existsSync21, readFileSync as readFileSync18 } from "fs";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
 function readBrandConfig() {
@@ -12793,7 +13087,7 @@ function readBrandConfig() {
   cachedAttempted = true;
   const platformRoot = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot) return null;
-  const brandPath = join13(platformRoot, "config", "brand.json");
+  const brandPath = join14(platformRoot, "config", "brand.json");
   if (!existsSync21(brandPath)) return null;
   try {
     cached2 = JSON.parse(readFileSync18(brandPath, "utf-8"));
@@ -12804,7 +13098,7 @@ function readBrandConfig() {
 }
 
 // server/routes/visitor-consent.ts
-var app38 = new Hono();
+var app37 = new Hono();
 var CONSENT_COOKIE_NAME = "mxy_consent";
 var CONSENT_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
 var DEFAULT_CONSENT_COPY = {
@@ -12849,17 +13143,17 @@ function siteSlugFromReferer(referer) {
     return "";
   }
 }
-app38.options("/consent", (c) => {
+app37.options("/consent", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app38.options("/brand-config", (c) => {
+app37.options("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app38.post("/consent", async (c) => {
+app37.post("/consent", async (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   let raw;
@@ -12899,7 +13193,7 @@ app38.post("/consent", async (c) => {
   console.log(`[consent] ${parsed.decision} site=${site} brand=${brandName} tokenBound=${tokenBound}`);
   return c.body(null, 204);
 });
-app38.get("/brand-config", (c) => {
+app37.get("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   const brand = readBrandConfig();
@@ -12909,7 +13203,7 @@ app38.get("/brand-config", (c) => {
   c.header("Cache-Control", "public, max-age=300");
   return c.json({ consent: { copy, palette } });
 });
-var visitor_consent_default = app38;
+var visitor_consent_default = app37;
 
 // server/routes/listings.ts
 function getCookie(headerValue, name) {
@@ -12930,14 +13224,14 @@ function appendConsentParams(pageUrl, token) {
     const hashIdx = pageUrl.indexOf("#");
     const hash = hashIdx >= 0 ? pageUrl.slice(hashIdx) : "";
     const base = hashIdx >= 0 ? pageUrl.slice(0, hashIdx) : pageUrl;
-    const sep4 = base.indexOf("?") >= 0 ? "&" : "?";
-    return base + sep4 + `consent=needed&v=${encodeURIComponent(token)}` + hash;
+    const sep6 = base.indexOf("?") >= 0 ? "&" : "?";
+    return base + sep6 + `consent=needed&v=${encodeURIComponent(token)}` + hash;
   }
 }
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
 var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
-var app39 = new Hono();
-app39.get("/:slug/click", async (c) => {
+var app38 = new Hono();
+app38.get("/:slug/click", async (c) => {
   const slug = c.req.param("slug") ?? "";
   const rawSession = c.req.query("session") ?? "";
   const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
@@ -13001,10 +13295,10 @@ app39.get("/:slug/click", async (c) => {
   console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} consent=${consentCookie ?? "absent"} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
   return c.redirect(redirectUrl, 302);
 });
-var listings_default = app39;
+var listings_default = app38;
 
 // server/routes/visitor-event.ts
-var app40 = new Hono();
+var app39 = new Hono();
 var BOT_UA_RE = /\b(bot|crawl|spider|slurp|headlesschrome|phantomjs|googlebot|bingbot|yandex|baiduspider|ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)\b/i;
 var buckets = /* @__PURE__ */ new Map();
 var RATE_LIMIT = 60;
@@ -13071,12 +13365,12 @@ function originAllowed(origin, allowlist) {
     return false;
   }
 }
-app40.options("/event", (c) => {
+app39.options("/event", (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   return c.body(null, 204);
 });
-app40.post("/event", async (c) => {
+app39.post("/event", async (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   const ua = c.req.header("user-agent") ?? "";
@@ -13281,7 +13575,7 @@ async function writeEvent(opts) {
     );
   }
 }
-var visitor_event_default = app40;
+var visitor_event_default = app39;
 
 // app/lib/graph-health.ts
 var HOUR_MS = 60 * 60 * 1e3;
@@ -13426,7 +13720,7 @@ function broadcastAdminShutdown(reason) {
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash4, verify as cryptoVerify } from "crypto";
 import { existsSync as existsSync22, readFileSync as readFileSync19, statSync as statSync8 } from "fs";
-import { resolve as resolve21 } from "path";
+import { resolve as resolve22 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
 function canonicalize(value) {
@@ -13461,7 +13755,7 @@ var PUBKEY_SHA256 = "8eee6bcb33545fd13b16d3199a5735ca5db5062834c7b49dfe4f23801d9
 var GRACE_DAYS = 7;
 var GRACE_MS = GRACE_DAYS * 24 * 60 * 60 * 1e3;
 function pubkeyPath(brand) {
-  return resolve21(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
+  return resolve22(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
 }
 var memo = null;
 function memoKey(mtimeMs, account) {
@@ -13473,7 +13767,7 @@ function resolveEntitlement(brand, account) {
   if (brand.commercialMode !== true) {
     return logResolved(implicitTrust(account), null);
   }
-  const entitlementPath = resolve21(brand.configDir, "entitlement.json");
+  const entitlementPath = resolve22(brand.configDir, "entitlement.json");
   if (!existsSync22(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
@@ -13664,7 +13958,7 @@ function clientFrom(c) {
   );
 }
 var PLATFORM_ROOT9 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT9 ? join14(PLATFORM_ROOT9, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT9 ? join15(PLATFORM_ROOT9, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
 if (BRAND_JSON_PATH && !existsSync23(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
@@ -13690,7 +13984,7 @@ var brandLoginOpts = {
   bodyFont: BRAND.defaultFonts?.body,
   logoContainsName: !!BRAND.logoContainsName
 };
-var ALIAS_DOMAINS_PATH = join14(homedir2(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join15(homedir2(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
     if (!existsSync23(ALIAS_DOMAINS_PATH)) return null;
@@ -13718,9 +14012,9 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app41 = new Hono();
-app41.use("*", clientIpMiddleware);
-app41.use("*", async (c, next) => {
+var app40 = new Hono();
+app40.use("*", clientIpMiddleware);
+app40.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -13730,7 +14024,7 @@ app41.use("*", async (c, next) => {
   );
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app41.use("*", async (c, next) => {
+app40.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -13763,7 +14057,7 @@ var PUBLIC_ALLOWED_PREFIXES = [
   "/sites/"
 ];
 var PUBLIC_ALLOWED_EXACT = ["/favicon.ico"];
-app41.use("*", async (c, next) => {
+app40.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (!isPublicHost(host)) {
     await next();
@@ -13803,7 +14097,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app41.post("/__remote-auth/login", async (c) => {
+app40.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -13848,7 +14142,7 @@ app41.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app41.get("/__remote-auth/logout", (c) => {
+app40.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -13861,7 +14155,7 @@ app41.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app41.post("/__remote-auth/change-password", async (c) => {
+app40.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -13912,13 +14206,13 @@ app41.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app41.get("/__remote-auth/setup", (c) => {
+app40.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app41.post("/__remote-auth/set-initial-password", async (c) => {
+app40.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -13956,10 +14250,10 @@ app41.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app41.get("/api/remote-auth/status", (c) => {
+app40.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app41.post("/api/remote-auth/set-password", async (c) => {
+app40.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -13990,9 +14284,9 @@ app41.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app41.route("/api/_client-error", client_error_default);
+app40.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
-app41.use("*", async (c, next) => {
+app40.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
@@ -14025,12 +14319,12 @@ app41.use("*", async (c, next) => {
   console.error(`[remote-auth] login required ip=${clientIp} path=${path2} ${disambig}`);
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), redirect: path2 }), 200);
 });
-app41.route("/api/health", health_default);
-app41.route("/api/chat", chat_default);
-app41.route("/api/whatsapp", whatsapp_default);
-app41.route("/api/onboarding", onboarding_default);
-app41.route("/api/admin", admin_default);
-app41.route("/api/access", access_default);
+app40.route("/api/health", health_default);
+app40.route("/api/chat", chat_default);
+app40.route("/api/whatsapp", whatsapp_default);
+app40.route("/api/onboarding", onboarding_default);
+app40.route("/api/admin", admin_default);
+app40.route("/api/access", access_default);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -14042,7 +14336,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app41.get("/agent-assets/:slug/:filename", (c) => {
+app40.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -14058,8 +14352,8 @@ app41.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve22(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve22(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve23(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve23(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
@@ -14077,7 +14371,7 @@ app41.get("/agent-assets/:slug/:filename", (c) => {
     "Cache-Control": "public, max-age=3600"
   });
 });
-app41.get("/generated/:filename", (c) => {
+app40.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -14088,8 +14382,8 @@ app41.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve22(account.accountDir, "generated", filename);
-  const expectedDir = resolve22(account.accountDir, "generated");
+  const filePath = resolve23(account.accountDir, "generated", filename);
+  const expectedDir = resolve23(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
@@ -14107,10 +14401,10 @@ app41.get("/generated/:filename", (c) => {
     "Cache-Control": "public, max-age=86400"
   });
 });
-app41.route("/sites", sites_default);
-app41.route("/listings", listings_default);
-app41.route("/v", visitor_event_default);
-app41.route("/v", visitor_consent_default);
+app40.route("/sites", sites_default);
+app40.route("/listings", listings_default);
+app40.route("/v", visitor_event_default);
+app40.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
@@ -14133,7 +14427,7 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT9) return "unknown";
-    const versionFile = join14(PLATFORM_ROOT9, "config", `.${BRAND.hostname}-version`);
+    const versionFile = join15(PLATFORM_ROOT9, "config", `.${BRAND.hostname}-version`);
     if (!existsSync23(versionFile)) return "unknown";
     const content = readFileSync20(versionFile, "utf-8").trim();
     return content || "unknown";
@@ -14176,7 +14470,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync20(resolve22(process.cwd(), "public", file), "utf-8");
+    html = readFileSync20(resolve23(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -14192,14 +14486,14 @@ ${clientErrorReporterScript}
 }
 var brandedHtmlCache = /* @__PURE__ */ new Map();
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join14(homedir2(), BRAND.configDir);
+  const configDir2 = join15(homedir2(), BRAND.configDir);
   try {
-    const accountJsonPath = join14(configDir2, "account.json");
+    const accountJsonPath = join15(configDir2, "account.json");
     if (!existsSync23(accountJsonPath)) return null;
     const account = JSON.parse(readFileSync20(accountJsonPath, "utf-8"));
     const accountId = account.accountId;
     if (!accountId) return null;
-    const cachePath = join14(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    const cachePath = join15(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
     if (!existsSync23(cachePath)) return null;
     return JSON.parse(readFileSync20(cachePath, "utf-8"));
   } catch {
@@ -14208,8 +14502,8 @@ function loadBrandingCache(agentSlug) {
 }
 function resolveDefaultSlug() {
   try {
-    const configDir2 = join14(homedir2(), BRAND.configDir);
-    const accountJsonPath = join14(configDir2, "account.json");
+    const configDir2 = join15(homedir2(), BRAND.configDir);
+    const accountJsonPath = join15(configDir2, "account.json");
     if (!existsSync23(accountJsonPath)) return null;
     const account = JSON.parse(readFileSync20(accountJsonPath, "utf-8"));
     return account.defaultAgent || null;
@@ -14247,7 +14541,7 @@ function brandedPublicHtml(agentSlug) {
 function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-app41.get("/", (c) => {
+app40.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) {
     const defaultSlug = resolveDefaultSlug();
@@ -14255,12 +14549,12 @@ app41.get("/", (c) => {
   }
   return c.html(cachedHtml("index.html"));
 });
-app41.get("/public", (c) => {
+app40.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app41.get("/chat", (c) => {
+app40.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -14279,12 +14573,12 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app41.use("/vnc-viewer.html", logViewerFetch);
-app41.use("/vnc-popout.html", logViewerFetch);
-app41.get("/vnc-popout.html", (c) => {
+app40.use("/vnc-viewer.html", logViewerFetch);
+app40.use("/vnc-popout.html", logViewerFetch);
+app40.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync20(resolve22(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync20(resolve23(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -14294,7 +14588,7 @@ app41.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app41.post("/api/vnc/client-event", async (c) => {
+app40.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -14315,25 +14609,25 @@ app41.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app41.get("/g/:slug", (c) => {
+app40.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
-app41.get("/graph", (c) => {
+app40.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app41.get("/sessions", (c) => {
+app40.get("/sessions", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("sessions.html"));
 });
-app41.get("/data", (c) => {
+app40.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app41.get("/:slug", async (c, next) => {
+app40.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const branding = loadBrandingCache(slug);
@@ -14343,15 +14637,15 @@ app41.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app41.get("/favicon.ico", (c) => {
+  app40.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app41.use("/*", serveStatic({ root: "./public" }));
+app40.use("/*", serveStatic({ root: "./public" }));
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app41.fetch, port, hostname });
+var httpServer = serve({ fetch: app40.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const loopHist = monitorEventLoopDelay({ resolution: 50 });
@@ -14387,7 +14681,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app41.routes ?? []) {
+  for (const r of app40.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -14502,7 +14796,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve22(process.env.MAXY_PLATFORM_ROOT ?? join14(__dirname, "..")),
+  platformRoot: resolve23(process.env.MAXY_PLATFORM_ROOT ?? join15(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (process.env.WHATSAPP_PTY_BRIDGE_ENABLED === "true" && msg.text && !msg.isOwnerMirror) {