@rubytech/create-maxy-code 0.1.190 → 0.1.191

package/payload/server/server.js

@@ -816,7 +816,7 @@ var serveStatic = (options = { root: "" }) => {
 
 // server/index.ts
 import { readFileSync as readFileSync20, existsSync as existsSync23, watchFile } from "fs";
-import { resolve as resolve23, join as join15, basename as basename5 } from "path";
+import { resolve as resolve24, join as join15, basename as basename5 } from "path";
 import { homedir as homedir2 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
@@ -1274,7 +1274,7 @@ var credsSaveQueue = Promise.resolve();
 async function drainCredsSaveQueue(timeoutMs = 5e3) {
   console.error(`${TAG2} draining credential save queue\u2026`);
   const timer2 = new Promise(
-    (resolve24) => setTimeout(() => resolve24("timeout"), timeoutMs)
+    (resolve25) => setTimeout(() => resolve25("timeout"), timeoutMs)
   );
   const result = await Promise.race([
     credsSaveQueue.then(() => "drained"),
@@ -1402,11 +1402,11 @@ async function createWaSocket(opts) {
   return sock;
 }
 async function waitForConnection(sock) {
-  return new Promise((resolve24, reject) => {
+  return new Promise((resolve25, reject) => {
     const handler = (update) => {
       if (update.connection === "open") {
         sock.ev.off("connection.update", handler);
-        resolve24();
+        resolve25();
       }
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
@@ -1520,14 +1520,14 @@ ${inspected}`;
   return inspect2(err, INSPECT_OPTS2);
 }
 function withTimeout(label, promise, timeoutMs) {
-  return new Promise((resolve24, reject) => {
+  return new Promise((resolve25, reject) => {
     const timer2 = setTimeout(() => {
       reject(new Error(`${label} timed out after ${timeoutMs}ms`));
     }, timeoutMs);
     promise.then(
       (value) => {
         clearTimeout(timer2);
-        resolve24(value);
+        resolve25(value);
       },
       (err) => {
         clearTimeout(timer2);
@@ -2062,8 +2062,8 @@ async function persistWhatsAppMessage(input) {
   const { givenName, familyName } = splitName(input.pushName);
   const prev = sessionWriteLocks.get(input.cacheKey);
   let release;
-  const mine = new Promise((resolve24) => {
-    release = resolve24;
+  const mine = new Promise((resolve25) => {
+    release = resolve25;
   });
   const chained = (prev ?? Promise.resolve()).then(() => mine);
   sessionWriteLocks.set(input.cacheKey, chained);
@@ -3099,11 +3099,11 @@ async function connectWithReconnect(conn) {
       console.error(
         `${TAG12} reconnecting account=${conn.accountId} in ${delay}ms (attempt ${decision.nextAttempts}/${maxAttempts})`
       );
-      await new Promise((resolve24) => {
-        const timer2 = setTimeout(resolve24, delay);
+      await new Promise((resolve25) => {
+        const timer2 = setTimeout(resolve25, delay);
         conn.abortController.signal.addEventListener("abort", () => {
           clearTimeout(timer2);
-          resolve24();
+          resolve25();
         }, { once: true });
       });
     }
@@ -3111,16 +3111,16 @@ async function connectWithReconnect(conn) {
   }
 }
 function waitForDisconnectEvent(conn) {
-  return new Promise((resolve24) => {
+  return new Promise((resolve25) => {
     if (!conn.sock) {
-      resolve24();
+      resolve25();
       return;
     }
     const sock = conn.sock;
     const handler = (update) => {
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
-        resolve24();
+        resolve25();
       }
     };
     sock.ev.on("connection.update", handler);
@@ -3382,8 +3382,8 @@ async function handleInboundMessage(conn, msg) {
     const conversationKey = isGroup ? remoteJid : senderPhone;
     const debounceKey = `${conn.accountId}:${conversationKey}:${senderPhone}`;
     let resolvePending;
-    const sttPending = new Promise((resolve24) => {
-      resolvePending = resolve24;
+    const sttPending = new Promise((resolve25) => {
+      resolvePending = resolve25;
     });
     if (conn.debouncer) conn.debouncer.registerPending(debounceKey, sttPending);
     try {
@@ -3787,20 +3787,20 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
 
 // server/routes/health.ts
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve24) => {
+  return new Promise((resolve25) => {
     const socket = createConnection2(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve24(true);
+      resolve25(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve24(false);
+      resolve25(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve24(false);
+      resolve25(false);
     });
   });
 }
@@ -4536,12 +4536,12 @@ async function dispatchOnce(input) {
   });
   if (!entry) return { error: "spawn-failed" };
   entry.lastInboundAt = Date.now();
-  let resolve24;
+  let resolve25;
   const turnPromise = new Promise((r) => {
-    resolve24 = r;
+    resolve25 = r;
   });
   const listener = (text) => {
-    resolve24(text);
+    resolve25(text);
   };
   entry.subscribers.add(listener);
   const writeOk = await writeInput(entry, input.text);
@@ -4983,8 +4983,8 @@ async function startLogin(opts) {
   resetActiveLogin(accountId);
   let resolveQr = null;
   let rejectQr = null;
-  const qrPromise = new Promise((resolve24, reject) => {
-    resolveQr = resolve24;
+  const qrPromise = new Promise((resolve25, reject) => {
+    resolveQr = resolve25;
     rejectQr = reject;
   });
   const qrTimer = setTimeout(
@@ -8004,10 +8004,10 @@ function computeSpecialistDomains(accountId) {
   const resolveDesc = (qualified) => {
     if (!qualified.startsWith("mcp__")) return void 0;
     const rest = qualified.slice(5);
-    const sep6 = rest.indexOf("__");
-    if (sep6 < 0) return void 0;
-    const plugin = rest.slice(0, sep6);
-    const tool = rest.slice(sep6 + 2);
+    const sep7 = rest.indexOf("__");
+    if (sep7 < 0) return void 0;
+    const plugin = rest.slice(0, sep7);
+    const tool = rest.slice(sep7 + 2);
     let map = descByPlugin.get(plugin);
     if (!map) {
       const dir = pluginDirs.get(plugin);
@@ -8396,6 +8396,7 @@ import { realpathSync as realpathSync3 } from "fs";
 import { resolve as resolve12, normalize, sep as sep2, relative } from "path";
 var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT ?? resolve12(process.cwd(), "../platform");
 var DATA_ROOT = resolve12(PLATFORM_ROOT5, "..", "data");
+var CLAUDE_UPLOADS_ROOT = process.env.CLAUDE_CONFIG_DIR ? resolve12(process.env.CLAUDE_CONFIG_DIR, "uploads") : null;
 var ACCOUNT_PARTITION_DIRS = /* @__PURE__ */ new Set(["uploads", "accounts"]);
 var ACCOUNT_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function crossesForeignAccountPartition(relPath2, accountId) {
@@ -8406,17 +8407,17 @@ function crossesForeignAccountPartition(relPath2, accountId) {
   if (!ACCOUNT_UUID_RE.test(owner)) return false;
   return owner !== accountId;
 }
-function resolveDataPath(raw) {
+function resolveUnderRoot(raw, rootAbs, rootLabel) {
   const cleaned = normalize("/" + (raw ?? "").replace(/\\/g, "/")).replace(/^\/+/, "");
-  const absolute = resolve12(DATA_ROOT, cleaned);
-  let dataRootReal;
+  const absolute = resolve12(rootAbs, cleaned);
+  let rootReal;
   try {
-    dataRootReal = realpathSync3(DATA_ROOT);
+    rootReal = realpathSync3(rootAbs);
   } catch (err) {
     return {
       ok: false,
       status: 500,
-      error: `DATA_ROOT not accessible: ${err instanceof Error ? err.message : String(err)}`
+      error: `${rootLabel} not accessible: ${err instanceof Error ? err.message : String(err)}`
     };
   }
   let resolvedReal;
@@ -8425,8 +8426,8 @@ function resolveDataPath(raw) {
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      if (absolute !== dataRootReal && !absolute.startsWith(dataRootReal + sep2)) {
-        return { ok: false, status: 403, error: "Path escapes DATA_ROOT", resolved: absolute };
+      if (absolute !== rootReal && !absolute.startsWith(rootReal + sep2)) {
+        return { ok: false, status: 403, error: `Path escapes ${rootLabel}`, resolved: absolute };
       }
       return { ok: false, status: 404, error: "Not found" };
     }
@@ -8436,11 +8437,20 @@ function resolveDataPath(raw) {
       error: err instanceof Error ? err.message : String(err)
     };
   }
-  if (resolvedReal !== dataRootReal && !resolvedReal.startsWith(dataRootReal + sep2)) {
-    return { ok: false, status: 403, error: "Path escapes DATA_ROOT", resolved: resolvedReal };
+  if (resolvedReal !== rootReal && !resolvedReal.startsWith(rootReal + sep2)) {
+    return { ok: false, status: 403, error: `Path escapes ${rootLabel}`, resolved: resolvedReal };
+  }
+  const relPath2 = relative(rootReal, resolvedReal) || ".";
+  return { ok: true, absolute: resolvedReal, dataRootReal: rootReal, relative: relPath2 };
+}
+function resolveDataPath(raw) {
+  return resolveUnderRoot(raw, DATA_ROOT, "DATA_ROOT");
+}
+function resolveClaudeUploadsPath(raw) {
+  if (!CLAUDE_UPLOADS_ROOT) {
+    return { ok: false, status: 404, error: "Not found" };
   }
-  const relPath2 = relative(dataRootReal, resolvedReal) || ".";
-  return { ok: true, absolute: resolvedReal, dataRootReal, relative: relPath2 };
+  return resolveUnderRoot(raw, CLAUDE_UPLOADS_ROOT, "CLAUDE_UPLOADS_ROOT");
 }
 
 // ../lib/graph-trash/src/index.ts
@@ -9109,6 +9119,23 @@ function buildDisplayPath(relPath2, accountNames) {
     return dn ? { name: seg, displayName: dn } : { name: seg };
   });
 }
+async function knowledgeDocOwnedByAccount(accountId, attachmentId) {
+  if (!attachmentId) return false;
+  const session = getSession();
+  try {
+    const result = await session.run(
+      `MATCH (d:KnowledgeDocument { accountId: $accountId, attachmentId: $attachmentId })
+       RETURN count(d) > 0 AS owned`,
+      { accountId, attachmentId }
+    );
+    return result.records[0]?.get("owned") === true;
+  } catch (err) {
+    console.error(`[data] kd-ownership-check-failed attachmentId="${attachmentId.slice(0, 8)}\u2026" err="${err instanceof Error ? err.message : String(err)}"`);
+    return false;
+  } finally {
+    await session.close();
+  }
+}
 var app15 = new Hono();
 app15.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
@@ -9180,15 +9207,26 @@ app15.get("/download", requireAdminSession, async (c) => {
   }
   const rawPath = c.req.query("path") ?? "";
   if (!rawPath) return c.json({ error: "path required" }, 400);
-  const resolution = resolveDataPath(rawPath);
+  const root = c.req.query("root") ?? "data";
+  if (root !== "data" && root !== "claude-uploads") {
+    return c.json({ error: "invalid root" }, 400);
+  }
+  const resolution = root === "claude-uploads" ? resolveClaudeUploadsPath(rawPath) : resolveDataPath(rawPath);
   if (!resolution.ok) {
     if (resolution.status === 403) {
-      console.error(`[data] path-traversal-blocked requested="${rawPath}" resolved="${resolution.resolved ?? "n/a"}"`);
+      console.error(`[data] path-traversal-blocked root="${root}" requested="${rawPath}" resolved="${resolution.resolved ?? "n/a"}"`);
     }
     return c.json({ error: resolution.error }, resolution.status);
   }
   const { absolute, relative: relPath2 } = resolution;
-  if (crossesForeignAccountPartition(relPath2, accountId)) {
+  if (root === "claude-uploads") {
+    const attachmentId = relPath2.split("/").filter(Boolean)[0] ?? "";
+    const owned = await knowledgeDocOwnedByAccount(accountId, attachmentId);
+    if (!owned) {
+      console.error(`[data] account-scope-blocked root="claude-uploads" attachmentId="${attachmentId.slice(0, 8)}\u2026" account=${accountId.slice(0, 8)}\u2026`);
+      return c.json({ error: "Not found" }, 404);
+    }
+  } else if (crossesForeignAccountPartition(relPath2, accountId)) {
     console.error(`[data] account-scope-blocked endpoint="/api/admin/files/download" path="${relPath2}" account=${accountId.slice(0, 8)}\u2026`);
     return c.json({ error: "Not found" }, 404);
   }
@@ -9201,7 +9239,7 @@ app15.get("/download", requireAdminSession, async (c) => {
     const mimeType = detectMimeType(absolute);
     const nodeStream = createReadStream2(absolute);
     const webStream = Readable2.toWeb(nodeStream);
-    console.error(`[data] file-download path="${relPath2}" size=${info.size}`);
+    console.error(`[data] file-download root="${root}" path="${relPath2}" size=${info.size}`);
     const safeQuotedName = filename.replace(/[\r\n"\\]/g, "_");
     const encodedName = encodeURIComponent(filename);
     return new Response(webStream, {
@@ -11361,32 +11399,124 @@ var graph_default_view_default = app21;
 // server/routes/admin/sidebar-artefacts.ts
 import neo4j2 from "neo4j-driver";
 import { readFile as readFile5, readdir as readdir4, stat as stat5 } from "fs/promises";
-import { resolve as resolve15, relative as relative3, isAbsolute, sep as sep5 } from "path";
+import { resolve as resolve16, relative as relative4, isAbsolute, sep as sep6 } from "path";
 import { existsSync as existsSync16 } from "fs";
-var LIMIT = 50;
-var TEXT_MIME_PREFIXES = ["text/", "application/json", "application/markdown"];
-var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
-function toDataRootRelPath(absPath) {
-  if (absPath !== DATA_ROOT && !absPath.startsWith(DATA_ROOT + sep5)) return null;
-  return relative3(DATA_ROOT, absPath);
-}
-async function resolveDocAbsPath(accountId, attachmentId) {
-  if (!attachmentId) return null;
-  const accountDir = resolve15(ATTACHMENTS_ROOT, accountId);
-  const dir = resolve15(accountDir, attachmentId);
+
+// app/lib/doc-source-resolve.ts
+import { readdirSync as readdirSync8, realpathSync as realpathSync5, statSync as statSync7 } from "fs";
+import { relative as relative3, resolve as resolve15, sep as sep5 } from "path";
+function containedFile(absPath, root) {
   try {
-    validateFilePathInAccount(dir, accountDir);
+    const real = realpathSync5(absPath);
+    const rootReal = realpathSync5(root);
+    if (real !== rootReal && !real.startsWith(rootReal + sep5)) return null;
+    return statSync7(real).isFile() ? real : null;
   } catch {
     return null;
   }
+}
+function dataFileInDir(dir) {
+  let entries;
   try {
-    const entries = await readdir4(dir);
-    const dataFile = entries.find((f) => !f.endsWith(".meta.json"));
-    if (!dataFile) return null;
-    return resolve15(dir, dataFile);
+    entries = readdirSync8(dir, { withFileTypes: true }).flatMap((e) => e.isFile() ? [e.name] : []);
   } catch {
     return null;
   }
+  const file = entries.find((e) => !e.endsWith(".meta.json"));
+  return file ? resolve15(dir, file) : null;
+}
+function mapToDownloadRoot(absPath, roots) {
+  const underData = containedFile(absPath, roots.dataRoot);
+  if (underData) {
+    return { root: "data", relPath: relative3(realpathSync5(roots.dataRoot), underData), absReal: underData };
+  }
+  if (roots.claudeUploadsRoot) {
+    const underClaude = containedFile(absPath, roots.claudeUploadsRoot);
+    if (underClaude) {
+      return {
+        root: "claude-uploads",
+        relPath: relative3(realpathSync5(roots.claudeUploadsRoot), underClaude),
+        absReal: underClaude
+      };
+    }
+  }
+  return null;
+}
+function resolveDocDownload(input, roots) {
+  const { accountId, attachmentId, name, sourcePath, sourceType } = input;
+  if (sourcePath) {
+    const mapped = mapToDownloadRoot(sourcePath, roots);
+    if (mapped) {
+      return { ok: true, absPath: mapped.absReal, root: mapped.root, relPath: mapped.relPath, via: "stored" };
+    }
+  }
+  if (attachmentId) {
+    const uploadsDir = resolve15(roots.attachmentsRoot, accountId, attachmentId);
+    const file = dataFileInDir(uploadsDir);
+    if (file) {
+      const real = containedFile(file, roots.dataRoot);
+      if (real) {
+        return { ok: true, absPath: real, root: "data", relPath: relative3(realpathSync5(roots.dataRoot), real), via: "uploads" };
+      }
+    }
+  }
+  if (attachmentId && roots.claudeUploadsRoot) {
+    const claudeDir = resolve15(roots.claudeUploadsRoot, attachmentId);
+    const file = dataFileInDir(claudeDir);
+    if (file) {
+      const real = containedFile(file, roots.claudeUploadsRoot);
+      if (real) {
+        return {
+          ok: true,
+          absPath: real,
+          root: "claude-uploads",
+          relPath: relative3(realpathSync5(roots.claudeUploadsRoot), real),
+          via: "claude-uploads"
+        };
+      }
+    }
+  }
+  if (name) {
+    const outputFile = resolve15(roots.accountsDir, accountId, "output", name);
+    const real = containedFile(outputFile, roots.dataRoot);
+    if (real) {
+      return { ok: true, absPath: real, root: "data", relPath: relative3(realpathSync5(roots.dataRoot), real), via: "output" };
+    }
+  }
+  return { ok: false, reason: sourceType === "web" ? "no-persisted-file" : "unresolved" };
+}
+
+// server/routes/admin/sidebar-artefacts.ts
+var LIMIT = 50;
+var TEXT_MIME_PREFIXES = ["text/", "application/json", "application/markdown"];
+var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
+function toDataRootRelPath(absPath) {
+  if (absPath !== DATA_ROOT && !absPath.startsWith(DATA_ROOT + sep6)) return null;
+  return relative4(DATA_ROOT, absPath);
+}
+function resolveDocDownloadRow(meta) {
+  const result = resolveDocDownload(
+    {
+      accountId: meta.accountId,
+      attachmentId: meta.attachmentId,
+      name: meta.name,
+      sourcePath: meta.sourcePath,
+      sourceType: meta.sourceType
+    },
+    {
+      dataRoot: DATA_ROOT,
+      attachmentsRoot: ATTACHMENTS_ROOT,
+      accountsDir: ACCOUNTS_DIR,
+      claudeUploadsRoot: CLAUDE_UPLOADS_ROOT
+    }
+  );
+  const aid = meta.attachmentId ? meta.attachmentId.slice(0, 8) : "none";
+  if (result.ok) {
+    console.log(`[admin/sidebar-artefacts] download-resolved id=${aid} via=${result.via} root=${result.root}`);
+    return { downloadPath: result.relPath, downloadRoot: result.root };
+  }
+  console.log(`[admin/sidebar-artefacts] not-downloadable id=${aid} reason=${result.reason}`);
+  return { downloadPath: null, downloadRoot: null };
 }
 var app22 = new Hono();
 app22.get("/", requireAdminSession, async (c) => {
@@ -11400,7 +11530,7 @@ app22.get("/", requireAdminSession, async (c) => {
   if (docs === null) {
     return c.json({ error: "Failed to load artefacts" }, 500);
   }
-  const accountDir = resolve15(ACCOUNTS_DIR, accountId);
+  const accountDir = resolve16(ACCOUNTS_DIR, accountId);
   const agents = await fetchAgentTemplateRows(accountDir);
   const artefacts = [...docs, ...agents].sort(
     (a, b) => (b.updatedAt ?? "").localeCompare(a.updatedAt ?? "")
@@ -11419,7 +11549,8 @@ async function fetchKnowledgeDocs(accountId) {
       `MATCH (d:KnowledgeDocument { accountId: $accountId })
        WHERE d.deletedAt IS NULL AND NOT d:Trashed
        RETURN d.attachmentId AS id, d.name AS name, d.updatedAt AS updatedAt,
-              d.attachmentId AS attachmentId, d.encodingFormat AS mimeType
+              d.attachmentId AS attachmentId, d.encodingFormat AS mimeType,
+              d.sourcePath AS sourcePath, d.sourceType AS sourceType
        ORDER BY d.updatedAt DESC
        LIMIT $limit`,
       { accountId, limit: neo4j2.int(LIMIT) }
@@ -11429,7 +11560,9 @@ async function fetchKnowledgeDocs(accountId) {
       name: r.get("name") ?? "",
       updatedAt: r.get("updatedAt") ?? "",
       attachmentId: r.get("attachmentId"),
-      mimeType: r.get("mimeType") ?? ""
+      mimeType: r.get("mimeType") ?? "",
+      sourcePath: r.get("sourcePath") ?? null,
+      sourceType: r.get("sourceType") ?? null
     }));
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -11441,7 +11574,13 @@ async function fetchKnowledgeDocs(accountId) {
   }
   return Promise.all(metas.map(async (m) => {
     const { content, skipReason } = await readArtefactContent(accountId, m.attachmentId, m.mimeType, m.name);
-    const absPath = await resolveDocAbsPath(accountId, m.attachmentId);
+    const { downloadPath, downloadRoot } = resolveDocDownloadRow({
+      accountId,
+      attachmentId: m.attachmentId,
+      name: m.name,
+      sourcePath: m.sourcePath,
+      sourceType: m.sourceType
+    });
     return {
       id: m.id,
       name: m.name,
@@ -11451,7 +11590,8 @@ async function fetchKnowledgeDocs(accountId) {
       editable: skipReason === null,
       mimeType: m.mimeType,
       skipReason,
-      downloadPath: absPath ? toDataRootRelPath(absPath) : null
+      downloadPath,
+      downloadRoot
     };
   }));
 }
@@ -11465,8 +11605,8 @@ async function readArtefactContent(accountId, attachmentId, mimeType, displayNam
     logSkip(displayName, "non-text-mime", mimeType);
     return { content: "", skipReason: "non-text-mime" };
   }
-  const accountDir = resolve15(ATTACHMENTS_ROOT, accountId);
-  const dir = resolve15(accountDir, attachmentId);
+  const accountDir = resolve16(ATTACHMENTS_ROOT, accountId);
+  const dir = resolve16(accountDir, attachmentId);
   try {
     validateFilePathInAccount(dir, accountDir);
   } catch {
@@ -11480,7 +11620,7 @@ async function readArtefactContent(accountId, attachmentId, mimeType, displayNam
       logSkip(displayName, "missing-on-disk", mimeType);
       return { content: "", skipReason: "missing-on-disk" };
     }
-    return { content: await readFile5(resolve15(dir, dataFile), "utf-8"), skipReason: null };
+    return { content: await readFile5(resolve16(dir, dataFile), "utf-8"), skipReason: null };
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     console.error(`[admin/sidebar-artefacts] read-failed attachmentId=${attachmentId.slice(0, 8)} error="${message}"`);
@@ -11496,8 +11636,8 @@ function logSkip(name, reason, mimeType) {
 async function fetchAgentTemplateRows(accountDir) {
   const rows = [];
   for (const filename of ADMIN_AGENT_FILES) {
-    const overridePath = resolve15(accountDir, "agents", "admin", filename);
-    const bundledPath = resolve15(PLATFORM_ROOT, "templates", "agents", "admin", filename);
+    const overridePath = resolve16(accountDir, "agents", "admin", filename);
+    const bundledPath = resolve16(PLATFORM_ROOT, "templates", "agents", "admin", filename);
     const labelStem = filename.replace(/\.md$/, "");
     const row = await readAgentTemplateRow({
       id: `agent-template:admin:${filename}`,
@@ -11511,12 +11651,12 @@ async function fetchAgentTemplateRows(accountDir) {
     });
     if (row) rows.push(row);
   }
-  const overrideDir = resolve15(accountDir, "specialists", "agents");
-  const bundledDir = resolve15(PLATFORM_ROOT, "templates", "specialists", "agents");
+  const overrideDir = resolve16(accountDir, "specialists", "agents");
+  const bundledDir = resolve16(PLATFORM_ROOT, "templates", "specialists", "agents");
   const specialistNames = await unionSpecialistFilenames(overrideDir, bundledDir);
   for (const filename of specialistNames) {
-    const overridePath = resolve15(overrideDir, filename);
-    const bundledPath = resolve15(bundledDir, filename);
+    const overridePath = resolve16(overrideDir, filename);
+    const bundledPath = resolve16(bundledDir, filename);
     const row = await readAgentTemplateRow({
       id: `agent-template:specialist:${filename}`,
       displayName: filename.replace(/\.md$/, ""),
@@ -11575,6 +11715,7 @@ async function readAgentTemplateRow(inp) {
       readFile5(chosenPath, "utf-8"),
       stat5(chosenPath)
     ]);
+    const dlPath = toDataRootRelPath(chosenPath);
     return {
       id: inp.id,
       name: inp.displayName,
@@ -11587,7 +11728,10 @@ async function readAgentTemplateRow(inp) {
       // Override paths live under <accountDir> (inside DATA_ROOT) and are
       // downloadable; bundled-fallback templates live under PLATFORM_ROOT
       // (outside DATA_ROOT) → null, so the client shows "not downloadable".
-      downloadPath: toDataRootRelPath(chosenPath)
+      // Agent templates only ever resolve under DATA_ROOT, so the download
+      // root is `data` whenever the path is non-null.
+      downloadPath: dlPath,
+      downloadRoot: dlPath ? "data" : null
     };
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -11598,14 +11742,14 @@ async function readAgentTemplateRow(inp) {
   }
 }
 function isWithin(target, root) {
-  const rel = relative3(root, target);
+  const rel = relative4(root, target);
   return !rel.startsWith("..") && !isAbsolute(rel);
 }
 var sidebar_artefacts_default = app22;
 
 // server/routes/admin/sidebar-artefact-save.ts
 import { mkdir as mkdir4, readdir as readdir5, stat as stat6, writeFile as writeFile5 } from "fs/promises";
-import { resolve as resolve16 } from "path";
+import { resolve as resolve17 } from "path";
 import { existsSync as existsSync17 } from "fs";
 var ADMIN_AGENT_FILES2 = /* @__PURE__ */ new Set(["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"]);
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
@@ -11618,7 +11762,7 @@ app23.post("/", requireAdminSession, async (c) => {
   if (!body || typeof body.id !== "string" || typeof body.content !== "string") {
     return c.json({ error: "id and content required" }, 400);
   }
-  const accountDir = resolve16(ACCOUNTS_DIR, accountId);
+  const accountDir = resolve17(ACCOUNTS_DIR, accountId);
   const resolved = await resolveSavePath(body.id, accountId, accountDir);
   if (resolved.kind === "heal-race") {
     c.header("Retry-After", "2");
@@ -11663,17 +11807,17 @@ async function resolveSavePath(id, accountId, accountDir) {
     if (role !== "admin" || !ADMIN_AGENT_FILES2.has(filename)) {
       return { kind: "reject", status: 400, reason: "invalid-id" };
     }
-    const parent = resolve16(accountDir, "agents", "admin");
+    const parent = resolve17(accountDir, "agents", "admin");
     await mkdir4(parent, { recursive: true });
     try {
       validateFilePathInAccount(parent, accountDir);
     } catch {
       return { kind: "reject", status: 400, reason: "containment-rejected" };
     }
-    return { kind: "admin-template", path: resolve16(parent, filename) };
+    return { kind: "admin-template", path: resolve17(parent, filename) };
   }
   if (UUID_RE4.test(id)) {
-    const dir = resolve16(ATTACHMENTS_ROOT, accountId, id);
+    const dir = resolve17(ATTACHMENTS_ROOT, accountId, id);
     if (!existsSync17(dir)) {
       const attShort = id.slice(0, 8);
       if (isHealPending(accountId, id)) {
@@ -11706,7 +11850,7 @@ async function resolveSavePath(id, accountId, accountDir) {
       }
     }
     try {
-      validateFilePathInAccount(dir, resolve16(ATTACHMENTS_ROOT, accountId));
+      validateFilePathInAccount(dir, resolve17(ATTACHMENTS_ROOT, accountId));
     } catch {
       return { kind: "reject", status: 400, reason: "containment-rejected" };
     }
@@ -11715,7 +11859,7 @@ async function resolveSavePath(id, accountId, accountDir) {
     if (!dataFile) {
       return { kind: "reject", status: 400, reason: "not-found" };
     }
-    return { kind: "knowledge-doc", path: resolve16(dir, dataFile) };
+    return { kind: "knowledge-doc", path: resolve17(dir, dataFile) };
   }
   return { kind: "reject", status: 400, reason: "invalid-id" };
 }
@@ -11727,7 +11871,7 @@ var sidebar_artefact_save_default = app23;
 // server/routes/admin/sidebar-artefact-content.ts
 import { readFile as readFile6, readdir as readdir6 } from "fs/promises";
 import { existsSync as existsSync18 } from "fs";
-import { resolve as resolve17 } from "path";
+import { resolve as resolve18 } from "path";
 var UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 var app24 = new Hono();
 app24.get("/", requireAdminSession, async (c) => {
@@ -11739,14 +11883,14 @@ app24.get("/", requireAdminSession, async (c) => {
     console.error(`[admin/sidebar-artefact-content] not-found id=${id.slice(0, 8)}`);
     return new Response("Not found", { status: 404 });
   }
-  const dir = resolve17(ATTACHMENTS_ROOT, accountId, id);
+  const dir = resolve18(ATTACHMENTS_ROOT, accountId, id);
   if (!existsSync18(dir)) {
     console.error(`[admin/sidebar-artefact-content] not-found id=${id.slice(0, 8)}`);
     return new Response("Not found", { status: 404 });
   }
   let meta;
   try {
-    meta = JSON.parse(await readFile6(resolve17(dir, `${id}.meta.json`), "utf-8"));
+    meta = JSON.parse(await readFile6(resolve18(dir, `${id}.meta.json`), "utf-8"));
   } catch {
     console.error(`[admin/sidebar-artefact-content] not-found id=${id.slice(0, 8)}`);
     return new Response("Not found", { status: 404 });
@@ -11758,7 +11902,7 @@ app24.get("/", requireAdminSession, async (c) => {
     return new Response("Not found", { status: 404 });
   }
   const start = Date.now();
-  const buffer = await readFile6(resolve17(dir, dataFile));
+  const buffer = await readFile6(resolve18(dir, dataFile));
   const ms = Date.now() - start;
   console.log(
     `[admin/sidebar-artefact-content] account=${accountId} id=${id.slice(0, 8)} mime=${meta.mimeType} bytes=${buffer.length} ms=${ms}`
@@ -11896,8 +12040,8 @@ var system_stats_default = app25;
 
 // server/routes/admin/health.ts
 import { existsSync as existsSync19, readFileSync as readFileSync14 } from "fs";
-import { resolve as resolve18, join as join13 } from "path";
-var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve18(process.cwd(), "..");
+import { resolve as resolve19, join as join13 } from "path";
+var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve19(process.cwd(), "..");
 var brandHostname = "maxy";
 var brandJsonPath = join13(PLATFORM_ROOT6, "config", "brand.json");
 if (existsSync19(brandJsonPath)) {
@@ -11907,7 +12051,7 @@ if (existsSync19(brandJsonPath)) {
   } catch {
   }
 }
-var VERSION_FILE = resolve18(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
+var VERSION_FILE = resolve19(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
@@ -12422,13 +12566,13 @@ var admin_default = app32;
 // app/lib/access-gate.ts
 import neo4j5 from "neo4j-driver";
 import { readFileSync as readFileSync15 } from "fs";
-import { resolve as resolve19 } from "path";
+import { resolve as resolve20 } from "path";
 import { randomUUID as randomUUID8 } from "crypto";
-var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve19(process.cwd(), "..");
+var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve20(process.cwd(), "..");
 var driver = null;
 function readPassword() {
   if (process.env.NEO4J_PASSWORD) return process.env.NEO4J_PASSWORD;
-  const passwordFile = resolve19(PLATFORM_ROOT7, "config/.neo4j-password");
+  const passwordFile = resolve20(PLATFORM_ROOT7, "config/.neo4j-password");
   try {
     return readFileSync15(passwordFile, "utf-8").trim();
   } catch {
@@ -12718,9 +12862,9 @@ var verify_token_default = app33;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
-import { resolve as resolve20 } from "path";
-var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT ?? resolve20(process.cwd(), "..");
-var SEND_SCRIPT = resolve20(
+import { resolve as resolve21 } from "path";
+var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT ?? resolve21(process.cwd(), "..");
+var SEND_SCRIPT = resolve21(
   PLATFORM_ROOT8,
   "plugins",
   "email",
@@ -12862,8 +13006,8 @@ app35.route("/request-magic-link", request_magic_link_default);
 var access_default = app35;
 
 // server/routes/sites.ts
-import { existsSync as existsSync20, readFileSync as readFileSync16, realpathSync as realpathSync5, statSync as statSync7 } from "fs";
-import { resolve as resolve21 } from "path";
+import { existsSync as existsSync20, readFileSync as readFileSync16, realpathSync as realpathSync6, statSync as statSync8 } from "fs";
+import { resolve as resolve22 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
   ".html": "text/html; charset=utf-8",
@@ -12920,15 +13064,15 @@ app36.get("/:rel{.*}", (c) => {
     }
     segments.push(seg);
   }
-  const rootDir = resolve21(account.accountDir, "sites");
-  let filePath = segments.length === 0 ? rootDir : resolve21(rootDir, ...segments);
+  const rootDir = resolve22(account.accountDir, "sites");
+  let filePath = segments.length === 0 ? rootDir : resolve22(rootDir, ...segments);
   if (filePath !== rootDir && !filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
   let stat7;
   try {
-    stat7 = existsSync20(filePath) ? statSync7(filePath) : null;
+    stat7 = existsSync20(filePath) ? statSync8(filePath) : null;
   } catch {
     stat7 = null;
   }
@@ -12941,7 +13085,7 @@ app36.get("/:rel{.*}", (c) => {
     return c.redirect(target, 301);
   }
   if (stat7?.isDirectory()) {
-    filePath = resolve21(filePath, "index.html");
+    filePath = resolve22(filePath, "index.html");
   }
   if (!filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
@@ -12954,8 +13098,8 @@ app36.get("/:rel{.*}", (c) => {
   let realPath;
   let realRoot;
   try {
-    realPath = realpathSync5(filePath);
-    realRoot = realpathSync5(rootDir);
+    realPath = realpathSync6(filePath);
+    realRoot = realpathSync6(rootDir);
   } catch {
     console.error(`[sites] not-found path=${reqPath} status=404`);
     return c.text("Not found", 404);
@@ -13224,8 +13368,8 @@ function appendConsentParams(pageUrl, token) {
     const hashIdx = pageUrl.indexOf("#");
     const hash = hashIdx >= 0 ? pageUrl.slice(hashIdx) : "";
     const base = hashIdx >= 0 ? pageUrl.slice(0, hashIdx) : pageUrl;
-    const sep6 = base.indexOf("?") >= 0 ? "&" : "?";
-    return base + sep6 + `consent=needed&v=${encodeURIComponent(token)}` + hash;
+    const sep7 = base.indexOf("?") >= 0 ? "&" : "?";
+    return base + sep7 + `consent=needed&v=${encodeURIComponent(token)}` + hash;
   }
 }
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
@@ -13719,8 +13863,8 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash4, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync22, readFileSync as readFileSync19, statSync as statSync8 } from "fs";
-import { resolve as resolve22 } from "path";
+import { existsSync as existsSync22, readFileSync as readFileSync19, statSync as statSync9 } from "fs";
+import { resolve as resolve23 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
 function canonicalize(value) {
@@ -13755,7 +13899,7 @@ var PUBKEY_SHA256 = "8eee6bcb33545fd13b16d3199a5735ca5db5062834c7b49dfe4f23801d9
 var GRACE_DAYS = 7;
 var GRACE_MS = GRACE_DAYS * 24 * 60 * 60 * 1e3;
 function pubkeyPath(brand) {
-  return resolve22(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
+  return resolve23(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
 }
 var memo = null;
 function memoKey(mtimeMs, account) {
@@ -13767,11 +13911,11 @@ function resolveEntitlement(brand, account) {
   if (brand.commercialMode !== true) {
     return logResolved(implicitTrust(account), null);
   }
-  const entitlementPath = resolve22(brand.configDir, "entitlement.json");
+  const entitlementPath = resolve23(brand.configDir, "entitlement.json");
   if (!existsSync22(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
-  const stat7 = statSync8(entitlementPath);
+  const stat7 = statSync9(entitlementPath);
   const key = memoKey(stat7.mtimeMs, account);
   if (memo && memo.key === key) {
     return memo.result;
@@ -14352,8 +14496,8 @@ app40.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve23(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve23(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve24(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve24(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
@@ -14382,8 +14526,8 @@ app40.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve23(account.accountDir, "generated", filename);
-  const expectedDir = resolve23(account.accountDir, "generated");
+  const filePath = resolve24(account.accountDir, "generated", filename);
+  const expectedDir = resolve24(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
@@ -14470,7 +14614,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync20(resolve23(process.cwd(), "public", file), "utf-8");
+    html = readFileSync20(resolve24(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -14578,7 +14722,7 @@ app40.use("/vnc-popout.html", logViewerFetch);
 app40.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync20(resolve23(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync20(resolve24(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -14796,7 +14940,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve23(process.env.MAXY_PLATFORM_ROOT ?? join15(__dirname, "..")),
+  platformRoot: resolve24(process.env.MAXY_PLATFORM_ROOT ?? join15(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (process.env.WHATSAPP_PTY_BRIDGE_ENABLED === "true" && msg.text && !msg.isOwnerMirror) {