@rubytech/create-maxy-code 0.1.190 → 0.1.192

package/payload/server/server.js

@@ -815,8 +815,8 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync20, existsSync as existsSync23, watchFile } from "fs";
-import { resolve as resolve23, join as join15, basename as basename5 } from "path";
+import { readFileSync as readFileSync20, existsSync as existsSync22, watchFile } from "fs";
+import { resolve as resolve23, join as join15, basename as basename6 } from "path";
 import { homedir as homedir2 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
@@ -8004,10 +8004,10 @@ function computeSpecialistDomains(accountId) {
   const resolveDesc = (qualified) => {
     if (!qualified.startsWith("mcp__")) return void 0;
     const rest = qualified.slice(5);
-    const sep6 = rest.indexOf("__");
-    if (sep6 < 0) return void 0;
-    const plugin = rest.slice(0, sep6);
-    const tool = rest.slice(sep6 + 2);
+    const sep7 = rest.indexOf("__");
+    if (sep7 < 0) return void 0;
+    const plugin = rest.slice(0, sep7);
+    const tool = rest.slice(sep7 + 2);
     let map = descByPlugin.get(plugin);
     if (!map) {
       const dir = pluginDirs.get(plugin);
@@ -8396,6 +8396,7 @@ import { realpathSync as realpathSync3 } from "fs";
 import { resolve as resolve12, normalize, sep as sep2, relative } from "path";
 var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT ?? resolve12(process.cwd(), "../platform");
 var DATA_ROOT = resolve12(PLATFORM_ROOT5, "..", "data");
+var CLAUDE_UPLOADS_ROOT = process.env.CLAUDE_CONFIG_DIR ? resolve12(process.env.CLAUDE_CONFIG_DIR, "uploads") : null;
 var ACCOUNT_PARTITION_DIRS = /* @__PURE__ */ new Set(["uploads", "accounts"]);
 var ACCOUNT_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function crossesForeignAccountPartition(relPath2, accountId) {
@@ -8406,17 +8407,17 @@ function crossesForeignAccountPartition(relPath2, accountId) {
   if (!ACCOUNT_UUID_RE.test(owner)) return false;
   return owner !== accountId;
 }
-function resolveDataPath(raw) {
+function resolveUnderRoot(raw, rootAbs, rootLabel) {
   const cleaned = normalize("/" + (raw ?? "").replace(/\\/g, "/")).replace(/^\/+/, "");
-  const absolute = resolve12(DATA_ROOT, cleaned);
-  let dataRootReal;
+  const absolute = resolve12(rootAbs, cleaned);
+  let rootReal;
   try {
-    dataRootReal = realpathSync3(DATA_ROOT);
+    rootReal = realpathSync3(rootAbs);
   } catch (err) {
     return {
       ok: false,
       status: 500,
-      error: `DATA_ROOT not accessible: ${err instanceof Error ? err.message : String(err)}`
+      error: `${rootLabel} not accessible: ${err instanceof Error ? err.message : String(err)}`
     };
   }
   let resolvedReal;
@@ -8425,8 +8426,8 @@ function resolveDataPath(raw) {
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      if (absolute !== dataRootReal && !absolute.startsWith(dataRootReal + sep2)) {
-        return { ok: false, status: 403, error: "Path escapes DATA_ROOT", resolved: absolute };
+      if (absolute !== rootReal && !absolute.startsWith(rootReal + sep2)) {
+        return { ok: false, status: 403, error: `Path escapes ${rootLabel}`, resolved: absolute };
       }
       return { ok: false, status: 404, error: "Not found" };
     }
@@ -8436,11 +8437,20 @@ function resolveDataPath(raw) {
       error: err instanceof Error ? err.message : String(err)
     };
   }
-  if (resolvedReal !== dataRootReal && !resolvedReal.startsWith(dataRootReal + sep2)) {
-    return { ok: false, status: 403, error: "Path escapes DATA_ROOT", resolved: resolvedReal };
+  if (resolvedReal !== rootReal && !resolvedReal.startsWith(rootReal + sep2)) {
+    return { ok: false, status: 403, error: `Path escapes ${rootLabel}`, resolved: resolvedReal };
+  }
+  const relPath2 = relative(rootReal, resolvedReal) || ".";
+  return { ok: true, absolute: resolvedReal, dataRootReal: rootReal, relative: relPath2 };
+}
+function resolveDataPath(raw) {
+  return resolveUnderRoot(raw, DATA_ROOT, "DATA_ROOT");
+}
+function resolveClaudeUploadsPath(raw) {
+  if (!CLAUDE_UPLOADS_ROOT) {
+    return { ok: false, status: 404, error: "Not found" };
   }
-  const relPath2 = relative(dataRootReal, resolvedReal) || ".";
-  return { ok: true, absolute: resolvedReal, dataRootReal, relative: relPath2 };
+  return resolveUnderRoot(raw, CLAUDE_UPLOADS_ROOT, "CLAUDE_UPLOADS_ROOT");
 }
 
 // ../lib/graph-trash/src/index.ts
@@ -8759,11 +8769,23 @@ async function cascadeDeleteDocument(params) {
 // app/lib/file-index.ts
 import * as fsp from "fs/promises";
 import { resolve as resolve13, relative as relative2, join as join11, basename as basename3, extname as extname2, sep as sep3 } from "path";
+import { tmpdir as tmpdir2 } from "os";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
 var execFileAsync2 = promisify2(execFile2);
 var CONTENT_CAP = 1e5;
-var RECONCILE_DEBOUNCE_MS = 1e4;
+var OCR_TIMEOUT_MS = 3e4;
+var OCR_IMAGE_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".png",
+  ".jpg",
+  ".jpeg",
+  ".gif",
+  ".webp",
+  ".tiff",
+  ".tif",
+  ".bmp"
+]);
+var RECONCILE_DEBOUNCE_MS = 5 * 60 * 1e3;
 var lastReconcileAt = /* @__PURE__ */ new Map();
 var TEXT_EXTENSIONS = /* @__PURE__ */ new Set([
   ".txt",
@@ -8816,26 +8838,60 @@ async function extractPdf(absolute) {
   });
   return stdout.trim();
 }
+async function ocrPdf(absolute) {
+  const outPdf = join11(tmpdir2(), `file-index-ocr-${process.pid}-${Date.now()}.pdf`);
+  try {
+    await execFileAsync2(
+      "ocrmypdf",
+      ["--skip-text", "--quiet", "--output-type", "pdf", absolute, outPdf],
+      { maxBuffer: 10 * 1024 * 1024, timeout: OCR_TIMEOUT_MS }
+    );
+    const { stdout } = await execFileAsync2("pdftotext", [outPdf, "-"], {
+      maxBuffer: 10 * 1024 * 1024,
+      timeout: OCR_TIMEOUT_MS
+    });
+    return stdout.trim();
+  } finally {
+    await fsp.rm(outPdf, { force: true });
+  }
+}
+async function ocrImage(absolute) {
+  const { stdout } = await execFileAsync2(
+    "tesseract",
+    [absolute, "-", "-l", "eng", "--psm", "3"],
+    { maxBuffer: 10 * 1024 * 1024, timeout: OCR_TIMEOUT_MS }
+  );
+  return stdout.trim();
+}
 function stripHtml(html) {
   return html.replace(/<script[\s\S]*?<\/script>/gi, " ").replace(/<style[\s\S]*?<\/style>/gi, " ").replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim();
 }
 async function extractFileContent(absolute) {
   const ext = extname2(absolute).toLowerCase();
   try {
-    if (ext === ".pdf") return (await extractPdf(absolute)).slice(0, CONTENT_CAP);
+    if (ext === ".pdf") {
+      const text = (await extractPdf(absolute)).slice(0, CONTENT_CAP);
+      if (text.length > 0) return { content: text, route: "pdftotext" };
+      const ocred = (await ocrPdf(absolute)).slice(0, CONTENT_CAP);
+      return ocred.length > 0 ? { content: ocred, route: "ocr-pdf" } : { content: "", route: "name-only" };
+    }
     if (HTML_EXTENSIONS.has(ext)) {
       const raw = await fsp.readFile(absolute, "utf-8");
-      return stripHtml(raw).slice(0, CONTENT_CAP);
+      return { content: stripHtml(raw).slice(0, CONTENT_CAP), route: "html" };
     }
     if (TEXT_EXTENSIONS.has(ext)) {
       const raw = await fsp.readFile(absolute, "utf-8");
-      return raw.slice(0, CONTENT_CAP);
+      return { content: raw.slice(0, CONTENT_CAP), route: "text" };
     }
-    return "";
+    if (OCR_IMAGE_EXTENSIONS.has(ext)) {
+      const ocred = (await ocrImage(absolute)).slice(0, CONTENT_CAP);
+      return ocred.length > 0 ? { content: ocred, route: "ocr-image" } : { content: "", route: "name-only" };
+    }
+    return { content: "", route: "name-only" };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.error(`[file-index] extract-failed path="${relative2(DATA_ROOT, absolute)}" err="${msg}"`);
-    return "";
+    return { content: "", route: "name-only" };
   }
 }
 async function readDisplayName(absolute) {
@@ -8899,9 +8955,86 @@ async function upsertFileArtifact(session, f) {
     f
   );
 }
+async function linkFileArtifactToKnowledgeDocument(session, accountId, relativePath, absolutePath) {
+  const res = await session.run(
+    `MATCH (f:FileArtifact {accountId: $accountId, relativePath: $relativePath})
+     OPTIONAL MATCH (d:KnowledgeDocument {accountId: $accountId, sourcePath: $absolutePath})
+     WHERE NOT d:Trashed
+     FOREACH (_ IN CASE WHEN d IS NULL THEN [] ELSE [1] END |
+       MERGE (f)-[:INGESTED_AS]->(d))
+     RETURN elementId(d) AS docId`,
+    { accountId, relativePath, absolutePath }
+  );
+  const docId = res.records[0]?.get("docId");
+  if (docId) {
+    console.error(
+      `[file-index] linked-kd account=${accountId} relativePath="${relativePath}" docId=${docId.slice(0, 12)}`
+    );
+  }
+}
+async function findLinkedKnowledgeDocs(session, accountId, relativePaths) {
+  if (relativePaths.length === 0) return [];
+  const res = await session.run(
+    `MATCH (f:FileArtifact {accountId: $accountId})-[:INGESTED_AS]->(d:KnowledgeDocument)
+     WHERE f.relativePath IN $relativePaths AND NOT d:Trashed
+     OPTIONAL MATCH (d)-[:HAS_SECTION]->(s:Section)
+     OPTIONAL MATCH (s)-[:HAS_CHUNK]->(c:Chunk)
+     WITH d, collect(DISTINCT s) AS ss, collect(DISTINCT c) AS cc
+     RETURN elementId(d) AS docId,
+            [x IN ss WHERE x IS NOT NULL | elementId(x)] AS sectionIds,
+            [x IN cc WHERE x IS NOT NULL | elementId(x)] AS chunkIds`,
+    { accountId, relativePaths }
+  );
+  return res.records.map((rec) => ({
+    docId: rec.get("docId"),
+    sectionIds: rec.get("sectionIds") ?? [],
+    chunkIds: rec.get("chunkIds") ?? []
+  }));
+}
+async function cascadeTrashLinkedKnowledgeDocs(session, accountId, relativePaths) {
+  const linked = await findLinkedKnowledgeDocs(session, accountId, relativePaths);
+  let kds = 0, sections = 0, chunks = 0;
+  for (const { docId, sectionIds, chunkIds } of linked) {
+    try {
+      await trashNode({
+        session,
+        accountId,
+        elementId: docId,
+        by: "file-index:cascade",
+        reason: "physical file removed from FileArtifact index"
+      });
+      kds++;
+      for (const sid of sectionIds) {
+        await trashNode({
+          session,
+          accountId,
+          elementId: sid,
+          by: `file-index:cascade:from-${docId}`,
+          reason: `cascade from KnowledgeDocument ${docId}`
+        });
+        sections++;
+      }
+      for (const cid of chunkIds) {
+        await trashNode({
+          session,
+          accountId,
+          elementId: cid,
+          by: `file-index:cascade:from-${docId}`,
+          reason: `cascade from KnowledgeDocument ${docId}`
+        });
+        chunks++;
+      }
+    } catch (err) {
+      console.error(
+        `[file-index] cascade-trash-failed account=${accountId} docId=${docId.slice(0, 12)} err="${err.message}"`
+      );
+    }
+  }
+  return { kds, sections, chunks };
+}
 async function buildArtifact(accountId, wf, embed2) {
   const name = basename3(wf.absolute);
-  const content = await extractFileContent(wf.absolute);
+  const { content, route } = await extractFileContent(wf.absolute);
   const displayName = await readDisplayName(wf.absolute);
   const embedInput = `${name}
 ${content}`.slice(0, CONTENT_CAP);
@@ -8913,7 +9046,7 @@ ${content}`.slice(0, CONTENT_CAP);
     console.error(`[file-index] embed-failed path="${wf.relativePath}" err="${err.message}"`);
   }
   console.error(
-    `[file-index] index-file account=${accountId} path="${wf.relativePath}" chars=${content.length} embed-ms=${Date.now() - embedStart}`
+    `[file-index] index-file account=${accountId} path="${wf.relativePath}" extractor=${route} chars=${content.length} embed-ms=${Date.now() - embedStart}`
   );
   return {
     accountId,
@@ -8972,14 +9105,29 @@ async function reconcileFileIndex(accountId, opts) {
       const unchanged = prior && prior.sizeBytes === wf.sizeBytes && prior.modifiedAt === wf.modifiedAt && prior.hasEmbedding;
       if (unchanged) {
         skipped++;
-        continue;
+      } else {
+        await upsertFileArtifact(session, await buildArtifact(accountId, wf, embed2));
+        upserted++;
       }
-      await upsertFileArtifact(session, await buildArtifact(accountId, wf, embed2));
-      upserted++;
+      await linkFileArtifactToKnowledgeDocument(session, accountId, wf.relativePath, wf.absolute);
     }
     let pruned = 0;
+    let cascadeKds = 0, cascadeSections = 0, cascadeChunks = 0;
     if (clean) {
       const foundPaths = walked.map((w) => w.relativePath);
+      const goneRes = await session.run(
+        `MATCH (f:FileArtifact {accountId: $accountId})
+         WHERE NOT f.relativePath IN $foundPaths
+         RETURN f.relativePath AS rp`,
+        { accountId, foundPaths }
+      );
+      const gonePaths = goneRes.records.map((r) => r.get("rp"));
+      if (gonePaths.length > 0) {
+        const cascade = await cascadeTrashLinkedKnowledgeDocs(session, accountId, gonePaths);
+        cascadeKds = cascade.kds;
+        cascadeSections = cascade.sections;
+        cascadeChunks = cascade.chunks;
+      }
       const pruneRes = await session.run(
         `MATCH (f:FileArtifact {accountId: $accountId})
          WHERE NOT f.relativePath IN $foundPaths
@@ -8991,7 +9139,7 @@ async function reconcileFileIndex(accountId, opts) {
       pruned = typeof c?.toNumber === "function" ? c.toNumber() : Number(c ?? 0);
     }
     console.error(
-      `[file-index] reconcile account=${accountId} walked=${walked.length} upserted=${upserted} skipped=${skipped} pruned=${pruned} clean=${clean} ms=${Date.now() - t0}`
+      `[file-index] reconcile account=${accountId} walked=${walked.length} upserted=${upserted} skipped=${skipped} pruned=${pruned} cascade-kds=${cascadeKds} cascade-sections=${cascadeSections} cascade-chunks=${cascadeChunks} clean=${clean} ms=${Date.now() - t0}`
     );
     return { walked: walked.length, upserted, skipped, pruned };
   });
@@ -9020,10 +9168,12 @@ async function indexFile(accountId, relativePath, opts) {
       modifiedAt: st.mtime.toISOString()
     };
     await upsertFileArtifact(session, await buildArtifact(accountId, wf, embed2));
+    await linkFileArtifactToKnowledgeDocument(session, accountId, relativePath, absolute);
   });
 }
 async function dropFileIndex(accountId, relativePath, opts) {
   await withSession(opts, async (session) => {
+    const cascade = await cascadeTrashLinkedKnowledgeDocs(session, accountId, [relativePath]);
     const res = await session.run(
       `MATCH (f:FileArtifact {accountId: $accountId, relativePath: $relativePath})
        DETACH DELETE f
@@ -9032,7 +9182,9 @@ async function dropFileIndex(accountId, relativePath, opts) {
     );
     const c = res.records[0]?.get("dropped");
     const dropped = typeof c?.toNumber === "function" ? c.toNumber() : Number(c ?? 0);
-    console.error(`[file-index] drop account=${accountId} path="${relativePath}" dropped=${dropped}`);
+    console.error(
+      `[file-index] drop account=${accountId} path="${relativePath}" dropped=${dropped} cascade-kds=${cascade.kds} cascade-sections=${cascade.sections} cascade-chunks=${cascade.chunks}`
+    );
   });
 }
 
@@ -9109,10 +9261,28 @@ function buildDisplayPath(relPath2, accountNames) {
     return dn ? { name: seg, displayName: dn } : { name: seg };
   });
 }
+async function knowledgeDocOwnedByAccount(accountId, attachmentId) {
+  if (!attachmentId) return false;
+  const session = getSession();
+  try {
+    const result = await session.run(
+      `MATCH (d:KnowledgeDocument { accountId: $accountId, attachmentId: $attachmentId })
+       RETURN count(d) > 0 AS owned`,
+      { accountId, attachmentId }
+    );
+    return result.records[0]?.get("owned") === true;
+  } catch (err) {
+    console.error(`[data] kd-ownership-check-failed attachmentId="${attachmentId.slice(0, 8)}\u2026" err="${err instanceof Error ? err.message : String(err)}"`);
+    return false;
+  } finally {
+    await session.close();
+  }
+}
 var app15 = new Hono();
 app15.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
-  if (!getAccountIdForSession(cacheKey)) {
+  const accountId = getAccountIdForSession(cacheKey);
+  if (!accountId) {
     console.error(`[data] auth-rejected endpoint="/api/admin/files" reason="no account for session"`);
     return c.json({ error: "Account not found for session" }, 401);
   }
@@ -9125,17 +9295,26 @@ app15.get("/", requireAdminSession, async (c) => {
     return c.json({ error: resolution.error }, resolution.status);
   }
   const { absolute, relative: relPath2 } = resolution;
+  if (crossesForeignAccountPartition(relPath2, accountId)) {
+    console.error(`[data] account-scope-blocked endpoint="/api/admin/files" path="${relPath2}" account=${accountId.slice(0, 8)}\u2026`);
+    return c.json({ error: "Not found" }, 404);
+  }
   try {
     const info = await stat4(absolute);
     if (!info.isDirectory()) {
       return c.json({ error: "Path is not a directory \u2014 use /api/admin/files/download for files" }, 400);
     }
     const names = await readdir3(absolute);
+    const segs = relPath2.split("/").filter(Boolean);
+    const isAccountParent = segs.length === 1 && (segs[0] === "accounts" || segs[0] === "uploads");
     const entries = [];
     for (const name of names) {
       if (UUID_RE3.test(name.replace(/\.meta\.json$/, "")) && name.endsWith(".meta.json")) {
         continue;
       }
+      if (isAccountParent && UUID_RE3.test(name) && name !== accountId) {
+        continue;
+      }
       try {
         const entryPath = join12(absolute, name);
         const s = await stat4(entryPath);
@@ -9180,15 +9359,26 @@ app15.get("/download", requireAdminSession, async (c) => {
   }
   const rawPath = c.req.query("path") ?? "";
   if (!rawPath) return c.json({ error: "path required" }, 400);
-  const resolution = resolveDataPath(rawPath);
+  const root = c.req.query("root") ?? "data";
+  if (root !== "data" && root !== "claude-uploads") {
+    return c.json({ error: "invalid root" }, 400);
+  }
+  const resolution = root === "claude-uploads" ? resolveClaudeUploadsPath(rawPath) : resolveDataPath(rawPath);
   if (!resolution.ok) {
     if (resolution.status === 403) {
-      console.error(`[data] path-traversal-blocked requested="${rawPath}" resolved="${resolution.resolved ?? "n/a"}"`);
+      console.error(`[data] path-traversal-blocked root="${root}" requested="${rawPath}" resolved="${resolution.resolved ?? "n/a"}"`);
     }
     return c.json({ error: resolution.error }, resolution.status);
   }
   const { absolute, relative: relPath2 } = resolution;
-  if (crossesForeignAccountPartition(relPath2, accountId)) {
+  if (root === "claude-uploads") {
+    const attachmentId = relPath2.split("/").filter(Boolean)[0] ?? "";
+    const owned = await knowledgeDocOwnedByAccount(accountId, attachmentId);
+    if (!owned) {
+      console.error(`[data] account-scope-blocked root="claude-uploads" attachmentId="${attachmentId.slice(0, 8)}\u2026" account=${accountId.slice(0, 8)}\u2026`);
+      return c.json({ error: "Not found" }, 404);
+    }
+  } else if (crossesForeignAccountPartition(relPath2, accountId)) {
     console.error(`[data] account-scope-blocked endpoint="/api/admin/files/download" path="${relPath2}" account=${accountId.slice(0, 8)}\u2026`);
     return c.json({ error: "Not found" }, 404);
   }
@@ -9201,7 +9391,7 @@ app15.get("/download", requireAdminSession, async (c) => {
     const mimeType = detectMimeType(absolute);
     const nodeStream = createReadStream2(absolute);
     const webStream = Readable2.toWeb(nodeStream);
-    console.error(`[data] file-download path="${relPath2}" size=${info.size}`);
+    console.error(`[data] file-download root="${root}" path="${relPath2}" size=${info.size}`);
     const safeQuotedName = filename.replace(/[\r\n"\\]/g, "_");
     const encodedName = encodeURIComponent(filename);
     return new Response(webStream, {
@@ -9302,6 +9492,10 @@ app15.delete("/", requireAdminSession, async (c) => {
     return c.json({ error: resolution.error }, resolution.status);
   }
   const { absolute, relative: relPath2 } = resolution;
+  if (crossesForeignAccountPartition(relPath2, accountId)) {
+    console.error(`[data] account-scope-blocked endpoint="DELETE /api/admin/files" path="${relPath2}" account=${accountId.slice(0, 8)}\u2026`);
+    return c.json({ error: "Not found" }, 404);
+  }
   const base = basename4(absolute);
   const segments = relPath2.split("/").filter(Boolean);
   if (base === "account.json" || segments.includes(".git")) {
@@ -11359,35 +11553,15 @@ var WRITE_CYPHER = `
 var graph_default_view_default = app21;
 
 // server/routes/admin/sidebar-artefacts.ts
-import neo4j2 from "neo4j-driver";
-import { readFile as readFile5, readdir as readdir4, stat as stat5 } from "fs/promises";
-import { resolve as resolve15, relative as relative3, isAbsolute, sep as sep5 } from "path";
+import { readdir as readdir4, stat as stat5 } from "fs/promises";
+import { resolve as resolve15, relative as relative3, isAbsolute, sep as sep5, basename as basename5 } from "path";
 import { existsSync as existsSync16 } from "fs";
 var LIMIT = 50;
-var TEXT_MIME_PREFIXES = ["text/", "application/json", "application/markdown"];
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
 function toDataRootRelPath(absPath) {
   if (absPath !== DATA_ROOT && !absPath.startsWith(DATA_ROOT + sep5)) return null;
   return relative3(DATA_ROOT, absPath);
 }
-async function resolveDocAbsPath(accountId, attachmentId) {
-  if (!attachmentId) return null;
-  const accountDir = resolve15(ATTACHMENTS_ROOT, accountId);
-  const dir = resolve15(accountDir, attachmentId);
-  try {
-    validateFilePathInAccount(dir, accountDir);
-  } catch {
-    return null;
-  }
-  try {
-    const entries = await readdir4(dir);
-    const dataFile = entries.find((f) => !f.endsWith(".meta.json"));
-    if (!dataFile) return null;
-    return resolve15(dir, dataFile);
-  } catch {
-    return null;
-  }
-}
 var app22 = new Hono();
 app22.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
@@ -11396,102 +11570,58 @@ app22.get("/", requireAdminSession, async (c) => {
     return c.json({ error: "Account not found for session" }, 401);
   }
   const start = Date.now();
-  const docs = await fetchKnowledgeDocs(accountId);
-  if (docs === null) {
+  const outputs = await fetchOutputArtefacts(accountId);
+  if (outputs === null) {
     return c.json({ error: "Failed to load artefacts" }, 500);
   }
   const accountDir = resolve15(ACCOUNTS_DIR, accountId);
   const agents = await fetchAgentTemplateRows(accountDir);
-  const artefacts = [...docs, ...agents].sort(
+  const artefacts = [...outputs, ...agents].sort(
     (a, b) => (b.updatedAt ?? "").localeCompare(a.updatedAt ?? "")
   ).slice(0, LIMIT);
   const ms = Date.now() - start;
   console.log(
-    `[admin/sidebar-artefacts] account=${accountId} count=${artefacts.length} docs=${docs.length} agents=${agents.length} ms=${ms}`
+    `[admin/sidebar-artefacts] account=${accountId} count=${artefacts.length} outputs=${outputs.length} agents=${agents.length} ms=${ms}`
   );
   return c.json({ artefacts });
 });
-async function fetchKnowledgeDocs(accountId) {
+async function fetchOutputArtefacts(accountId) {
   const session = getSession();
-  let metas = [];
   try {
     const result = await session.run(
-      `MATCH (d:KnowledgeDocument { accountId: $accountId })
-       WHERE d.deletedAt IS NULL AND NOT d:Trashed
-       RETURN d.attachmentId AS id, d.name AS name, d.updatedAt AS updatedAt,
-              d.attachmentId AS attachmentId, d.encodingFormat AS mimeType
-       ORDER BY d.updatedAt DESC
-       LIMIT $limit`,
-      { accountId, limit: neo4j2.int(LIMIT) }
-    );
-    metas = result.records.map((r) => ({
-      id: r.get("id"),
-      name: r.get("name") ?? "",
-      updatedAt: r.get("updatedAt") ?? "",
-      attachmentId: r.get("attachmentId"),
-      mimeType: r.get("mimeType") ?? ""
-    }));
+      `MATCH (f:FileArtifact { accountId: $accountId })
+       WHERE f.relativePath CONTAINS '/output/'
+       RETURN f.relativePath AS relativePath,
+              f.displayName  AS displayName,
+              f.mimeType     AS mimeType,
+              f.modifiedAt   AS modifiedAt
+       ORDER BY f.modifiedAt DESC
+       LIMIT 50`,
+      { accountId }
+    );
+    return result.records.map((r) => {
+      const relativePath = r.get("relativePath");
+      const displayName = r.get("displayName") ?? null;
+      const mimeType = r.get("mimeType") ?? "";
+      const modifiedAt = r.get("modifiedAt") ?? "";
+      return {
+        id: `output-file:${relativePath}`,
+        name: displayName ?? basename5(relativePath),
+        kind: "output-file",
+        updatedAt: modifiedAt,
+        editable: false,
+        mimeType,
+        downloadPath: relativePath,
+        downloadRoot: "data"
+      };
+    });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     console.error(`[admin/sidebar-artefacts] account=${accountId} error="${message}"`);
-    await session.close();
     return null;
   } finally {
     await session.close();
   }
-  return Promise.all(metas.map(async (m) => {
-    const { content, skipReason } = await readArtefactContent(accountId, m.attachmentId, m.mimeType, m.name);
-    const absPath = await resolveDocAbsPath(accountId, m.attachmentId);
-    return {
-      id: m.id,
-      name: m.name,
-      kind: "knowledge-doc",
-      updatedAt: m.updatedAt,
-      content,
-      editable: skipReason === null,
-      mimeType: m.mimeType,
-      skipReason,
-      downloadPath: absPath ? toDataRootRelPath(absPath) : null
-    };
-  }));
-}
-async function readArtefactContent(accountId, attachmentId, mimeType, displayName) {
-  if (!attachmentId) {
-    logSkip(displayName, "null-attachmentId", mimeType);
-    return { content: "", skipReason: "null-attachmentId" };
-  }
-  const isText = TEXT_MIME_PREFIXES.some((p) => mimeType.startsWith(p));
-  if (!isText) {
-    logSkip(displayName, "non-text-mime", mimeType);
-    return { content: "", skipReason: "non-text-mime" };
-  }
-  const accountDir = resolve15(ATTACHMENTS_ROOT, accountId);
-  const dir = resolve15(accountDir, attachmentId);
-  try {
-    validateFilePathInAccount(dir, accountDir);
-  } catch {
-    logSkip(displayName, "containment-rejected", mimeType);
-    return { content: "", skipReason: "containment-rejected" };
-  }
-  try {
-    const entries = await readdir4(dir);
-    const dataFile = entries.find((f) => !f.endsWith(".meta.json"));
-    if (!dataFile) {
-      logSkip(displayName, "missing-on-disk", mimeType);
-      return { content: "", skipReason: "missing-on-disk" };
-    }
-    return { content: await readFile5(resolve15(dir, dataFile), "utf-8"), skipReason: null };
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    console.error(`[admin/sidebar-artefacts] read-failed attachmentId=${attachmentId.slice(0, 8)} error="${message}"`);
-    logSkip(displayName, "missing-on-disk", mimeType);
-    return { content: "", skipReason: "missing-on-disk" };
-  }
-}
-function logSkip(name, reason, mimeType) {
-  console.log(
-    `[admin/sidebar-artefacts] content-skipped name="${name}" reason=${reason} mimeType=${mimeType || "none"}`
-  );
 }
 async function fetchAgentTemplateRows(accountDir) {
   const rows = [];
@@ -11571,23 +11701,22 @@ async function readAgentTemplateRow(inp) {
   }
   if (!chosenPath) return null;
   try {
-    const [content, st] = await Promise.all([
-      readFile5(chosenPath, "utf-8"),
-      stat5(chosenPath)
-    ]);
+    const st = await stat5(chosenPath);
+    const dlPath = toDataRootRelPath(chosenPath);
     return {
       id: inp.id,
       name: inp.displayName,
       kind: "agent-template",
       updatedAt: st.mtime.toISOString(),
-      content,
       editable: inp.editable,
       mimeType: "text/markdown",
-      skipReason: null,
       // Override paths live under <accountDir> (inside DATA_ROOT) and are
       // downloadable; bundled-fallback templates live under PLATFORM_ROOT
       // (outside DATA_ROOT) → null, so the client shows "not downloadable".
-      downloadPath: toDataRootRelPath(chosenPath)
+      // Agent templates only ever resolve under DATA_ROOT, so the download
+      // root is `data` whenever the path is non-null.
+      downloadPath: dlPath,
+      downloadRoot: dlPath ? "data" : null
     };
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -11724,57 +11853,8 @@ function relPath(absPath, root) {
 }
 var sidebar_artefact_save_default = app23;
 
-// server/routes/admin/sidebar-artefact-content.ts
-import { readFile as readFile6, readdir as readdir6 } from "fs/promises";
-import { existsSync as existsSync18 } from "fs";
-import { resolve as resolve17 } from "path";
-var UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-var app24 = new Hono();
-app24.get("/", requireAdminSession, async (c) => {
-  const cacheKey = c.var.cacheKey;
-  const accountId = getAccountIdForSession(cacheKey);
-  if (!accountId) return new Response("Unauthorized", { status: 401 });
-  const id = c.req.query("id") ?? "";
-  if (!UUID_RE5.test(id)) {
-    console.error(`[admin/sidebar-artefact-content] not-found id=${id.slice(0, 8)}`);
-    return new Response("Not found", { status: 404 });
-  }
-  const dir = resolve17(ATTACHMENTS_ROOT, accountId, id);
-  if (!existsSync18(dir)) {
-    console.error(`[admin/sidebar-artefact-content] not-found id=${id.slice(0, 8)}`);
-    return new Response("Not found", { status: 404 });
-  }
-  let meta;
-  try {
-    meta = JSON.parse(await readFile6(resolve17(dir, `${id}.meta.json`), "utf-8"));
-  } catch {
-    console.error(`[admin/sidebar-artefact-content] not-found id=${id.slice(0, 8)}`);
-    return new Response("Not found", { status: 404 });
-  }
-  const entries = await readdir6(dir);
-  const dataFile = entries.find((f) => !f.endsWith(".meta.json"));
-  if (!dataFile) {
-    console.error(`[admin/sidebar-artefact-content] not-found id=${id.slice(0, 8)}`);
-    return new Response("Not found", { status: 404 });
-  }
-  const start = Date.now();
-  const buffer = await readFile6(resolve17(dir, dataFile));
-  const ms = Date.now() - start;
-  console.log(
-    `[admin/sidebar-artefact-content] account=${accountId} id=${id.slice(0, 8)} mime=${meta.mimeType} bytes=${buffer.length} ms=${ms}`
-  );
-  return new Response(new Uint8Array(buffer), {
-    headers: {
-      "Content-Type": meta.mimeType,
-      "Content-Disposition": `inline; filename="${meta.filename}"`,
-      "Cache-Control": "private, max-age=3600"
-    }
-  });
-});
-var sidebar_artefact_content_default = app24;
-
 // server/routes/admin/system-stats.ts
-import { readFile as readFile7 } from "fs/promises";
+import { readFile as readFile5 } from "fs/promises";
 import { cpus, loadavg, totalmem, freemem } from "os";
 function parseCpuStat(blob) {
   const line = blob.split("\n", 1)[0] ?? "";
@@ -11818,11 +11898,11 @@ function parseMeminfo(blob) {
 }
 var SAMPLE_DELAY_MS = 100;
 async function sampleLinux() {
-  const a = parseCpuStat(await readFile7("/proc/stat", "utf-8"));
+  const a = parseCpuStat(await readFile5("/proc/stat", "utf-8"));
   await new Promise((r) => setTimeout(r, SAMPLE_DELAY_MS));
-  const b = parseCpuStat(await readFile7("/proc/stat", "utf-8"));
-  const meminfo = parseMeminfo(await readFile7("/proc/meminfo", "utf-8"));
-  const loadavgRaw = (await readFile7("/proc/loadavg", "utf-8")).trim();
+  const b = parseCpuStat(await readFile5("/proc/stat", "utf-8"));
+  const meminfo = parseMeminfo(await readFile5("/proc/meminfo", "utf-8"));
+  const loadavgRaw = (await readFile5("/proc/loadavg", "utf-8")).trim();
   const [l1, l5, l15] = loadavgRaw.split(/\s+/, 3).map(Number);
   if (![l1, l5, l15].every(Number.isFinite)) {
     throw new Error(`malformed /proc/loadavg: ${loadavgRaw}`);
@@ -11868,8 +11948,8 @@ async function sample() {
   if (process.platform === "linux") return sampleLinux();
   return sampleOsFallback();
 }
-var app25 = new Hono();
-app25.get("/", async (c) => {
+var app24 = new Hono();
+app24.get("/", async (c) => {
   const started = Date.now();
   if (!inflight) {
     inflight = sample().finally(() => {
@@ -11892,26 +11972,26 @@ app25.get("/", async (c) => {
     return c.json({ degraded: true, reason, sampledAtMs: Date.now() });
   }
 });
-var system_stats_default = app25;
+var system_stats_default = app24;
 
 // server/routes/admin/health.ts
-import { existsSync as existsSync19, readFileSync as readFileSync14 } from "fs";
-import { resolve as resolve18, join as join13 } from "path";
-var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve18(process.cwd(), "..");
+import { existsSync as existsSync18, readFileSync as readFileSync14 } from "fs";
+import { resolve as resolve17, join as join13 } from "path";
+var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve17(process.cwd(), "..");
 var brandHostname = "maxy";
 var brandJsonPath = join13(PLATFORM_ROOT6, "config", "brand.json");
-if (existsSync19(brandJsonPath)) {
+if (existsSync18(brandJsonPath)) {
   try {
     const brand = JSON.parse(readFileSync14(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
   } catch {
   }
 }
-var VERSION_FILE = resolve18(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
+var VERSION_FILE = resolve17(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
-  if (!existsSync19(VERSION_FILE)) return "unknown";
+  if (!existsSync18(VERSION_FILE)) return "unknown";
   return readFileSync14(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
@@ -11937,8 +12017,8 @@ async function probeConversationDb() {
     });
   }
 }
-var app26 = new Hono();
-app26.get("/", async (c) => {
+var app25 = new Hono();
+app25.get("/", async (c) => {
   const version = readVersion();
   const probe = await probeConversationDb();
   const uptimeMs = Date.now() - new Date(PROCESS_STARTED_AT).getTime();
@@ -11960,7 +12040,7 @@ app26.get("/", async (c) => {
     uptimeMs
   });
 });
-var health_default2 = app26;
+var health_default2 = app25;
 
 // server/routes/admin/linkedin-ingest.ts
 var TAG20 = "[linkedin-ingest-route]";
@@ -12056,8 +12136,8 @@ function buildInitialMessage(env) {
   }
   return header;
 }
-var app27 = new Hono();
-app27.post("/", requireAdminSession, async (c) => {
+var app26 = new Hono();
+app26.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -12111,10 +12191,10 @@ app27.post("/", requireAdminSession, async (c) => {
   );
   return c.json({ ok: true, dispatchId: envelope.dispatchId, taskId: claudeSessionId }, 202);
 });
-var linkedin_ingest_default = app27;
+var linkedin_ingest_default = app26;
 
 // server/routes/admin/post-turn-context.ts
-import neo4j3 from "neo4j-driver";
+import neo4j2 from "neo4j-driver";
 var TAG21 = "[post-turn-context]";
 var STRIPPED_PROPERTIES2 = /* @__PURE__ */ new Set([
   "embedding",
@@ -12127,10 +12207,10 @@ function isLoopbackAddr2(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
 function convertValue(value) {
-  if (neo4j3.isDateTime(value) || neo4j3.isDate(value) || neo4j3.isLocalDateTime(value) || neo4j3.isLocalTime(value) || neo4j3.isTime(value) || neo4j3.isDuration(value)) {
+  if (neo4j2.isDateTime(value) || neo4j2.isDate(value) || neo4j2.isLocalDateTime(value) || neo4j2.isLocalTime(value) || neo4j2.isTime(value) || neo4j2.isDuration(value)) {
     return value.toString();
   }
-  if (neo4j3.isInt(value)) {
+  if (neo4j2.isInt(value)) {
     return value.inSafeRange() ? value.toNumber() : value.toString();
   }
   if (Array.isArray(value)) {
@@ -12153,8 +12233,8 @@ function pruneProperties(raw) {
   }
   return out;
 }
-var app28 = new Hono();
-app28.get("/", async (c) => {
+var app27 = new Hono();
+app27.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr2(remoteAddr)) {
     console.error(`${TAG21} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -12214,10 +12294,10 @@ app28.get("/", async (c) => {
     await session.close();
   }
 });
-var post_turn_context_default = app28;
+var post_turn_context_default = app27;
 
 // server/routes/admin/public-session-context.ts
-import neo4j4 from "neo4j-driver";
+import neo4j3 from "neo4j-driver";
 var TAG22 = "[public-session-context]";
 var STRIPPED_PROPERTIES3 = /* @__PURE__ */ new Set([
   "embedding",
@@ -12230,10 +12310,10 @@ function isLoopbackAddr3(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
 function convertValue2(value) {
-  if (neo4j4.isDateTime(value) || neo4j4.isDate(value) || neo4j4.isLocalDateTime(value) || neo4j4.isLocalTime(value) || neo4j4.isTime(value) || neo4j4.isDuration(value)) {
+  if (neo4j3.isDateTime(value) || neo4j3.isDate(value) || neo4j3.isLocalDateTime(value) || neo4j3.isLocalTime(value) || neo4j3.isTime(value) || neo4j3.isDuration(value)) {
     return value.toString();
   }
-  if (neo4j4.isInt(value)) {
+  if (neo4j3.isInt(value)) {
     return value.inSafeRange() ? value.toNumber() : value.toString();
   }
   if (Array.isArray(value)) {
@@ -12256,8 +12336,8 @@ function pruneProperties2(raw) {
   }
   return out;
 }
-var app29 = new Hono();
-app29.get("/", async (c) => {
+var app28 = new Hono();
+app28.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr3(remoteAddr)) {
     console.error(`${TAG22} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -12316,15 +12396,15 @@ app29.get("/", async (c) => {
     await session.close();
   }
 });
-var public_session_context_default = app29;
+var public_session_context_default = app28;
 
 // server/routes/admin/public-session-exit.ts
 var TAG23 = "[public-session-exit-route]";
 function isLoopbackAddr4(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-var app30 = new Hono();
-app30.post("/", async (c) => {
+var app29 = new Hono();
+app29.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr4(remoteAddr)) {
     console.error(`${TAG23} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -12351,15 +12431,15 @@ app30.post("/", async (c) => {
   handlePublicSessionExit(sessionId);
   return c.json({ ok: true });
 });
-var public_session_exit_default = app30;
+var public_session_exit_default = app29;
 
 // server/routes/admin/access-session-evict.ts
 var TAG24 = "[access-session-evict]";
 function isLoopbackAddr5(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-var app31 = new Hono();
-app31.post("/", async (c) => {
+var app30 = new Hono();
+app30.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr5(remoteAddr)) {
     console.error(`${TAG24} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -12387,48 +12467,47 @@ app31.post("/", async (c) => {
   console.log(`${TAG24} grantId=${grantId} dropped=${dropped}`);
   return c.json({ ok: true, dropped });
 });
-var access_session_evict_default = app31;
+var access_session_evict_default = app30;
 
 // server/routes/admin/index.ts
-var app32 = new Hono();
-app32.route("/session", session_default);
-app32.route("/logs", logs_default);
-app32.route("/claude-info", claude_info_default);
-app32.route("/attachment", attachment_default);
-app32.route("/agents", agents_default);
-app32.route("/sessions", sessions_default);
-app32.route("/claude-sessions", claude_sessions_default);
-app32.route("/log-ingest", log_ingest_default);
-app32.route("/events", events_default);
-app32.route("/files", files_default);
-app32.route("/graph-search", graph_search_default);
-app32.route("/graph-subgraph", graph_subgraph_default);
-app32.route("/graph-delete", graph_delete_default);
-app32.route("/graph-restore", graph_restore_default);
-app32.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app32.route("/graph-default-view", graph_default_view_default);
-app32.route("/sidebar-artefacts", sidebar_artefacts_default);
-app32.route("/sidebar-artefact-save", sidebar_artefact_save_default);
-app32.route("/sidebar-artefact-content", sidebar_artefact_content_default);
-app32.route("/system-stats", system_stats_default);
-app32.route("/health-brand", health_default2);
-app32.route("/linkedin-ingest", linkedin_ingest_default);
-app32.route("/post-turn-context", post_turn_context_default);
-app32.route("/public-session-context", public_session_context_default);
-app32.route("/public-session-exit", public_session_exit_default);
-app32.route("/access-session-evict", access_session_evict_default);
-var admin_default = app32;
+var app31 = new Hono();
+app31.route("/session", session_default);
+app31.route("/logs", logs_default);
+app31.route("/claude-info", claude_info_default);
+app31.route("/attachment", attachment_default);
+app31.route("/agents", agents_default);
+app31.route("/sessions", sessions_default);
+app31.route("/claude-sessions", claude_sessions_default);
+app31.route("/log-ingest", log_ingest_default);
+app31.route("/events", events_default);
+app31.route("/files", files_default);
+app31.route("/graph-search", graph_search_default);
+app31.route("/graph-subgraph", graph_subgraph_default);
+app31.route("/graph-delete", graph_delete_default);
+app31.route("/graph-restore", graph_restore_default);
+app31.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app31.route("/graph-default-view", graph_default_view_default);
+app31.route("/sidebar-artefacts", sidebar_artefacts_default);
+app31.route("/sidebar-artefact-save", sidebar_artefact_save_default);
+app31.route("/system-stats", system_stats_default);
+app31.route("/health-brand", health_default2);
+app31.route("/linkedin-ingest", linkedin_ingest_default);
+app31.route("/post-turn-context", post_turn_context_default);
+app31.route("/public-session-context", public_session_context_default);
+app31.route("/public-session-exit", public_session_exit_default);
+app31.route("/access-session-evict", access_session_evict_default);
+var admin_default = app31;
 
 // app/lib/access-gate.ts
-import neo4j5 from "neo4j-driver";
+import neo4j4 from "neo4j-driver";
 import { readFileSync as readFileSync15 } from "fs";
-import { resolve as resolve19 } from "path";
+import { resolve as resolve18 } from "path";
 import { randomUUID as randomUUID8 } from "crypto";
-var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve19(process.cwd(), "..");
+var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve18(process.cwd(), "..");
 var driver = null;
 function readPassword() {
   if (process.env.NEO4J_PASSWORD) return process.env.NEO4J_PASSWORD;
-  const passwordFile = resolve19(PLATFORM_ROOT7, "config/.neo4j-password");
+  const passwordFile = resolve18(PLATFORM_ROOT7, "config/.neo4j-password");
   try {
     return readFileSync15(passwordFile, "utf-8").trim();
   } catch {
@@ -12448,7 +12527,7 @@ function getDriver() {
     const user = process.env.NEO4J_USER ?? "neo4j";
     const password = readPassword();
     console.error(`[ui/access-gate] resolved neo4j_uri=${uri}`);
-    driver = neo4j5.driver(uri, neo4j5.auth.basic(user, password), {
+    driver = neo4j4.driver(uri, neo4j4.auth.basic(user, password), {
       maxConnectionPoolSize: 5
     });
   }
@@ -12631,8 +12710,8 @@ async function generateNewMagicToken(grantId) {
 var TAG25 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
-var app33 = new Hono();
-app33.post("/", async (c) => {
+var app32 = new Hono();
+app32.post("/", async (c) => {
   const ip = c.var.clientIp || "unknown";
   let body;
   try {
@@ -12714,13 +12793,13 @@ app33.post("/", async (c) => {
     displayName: grant.displayName
   });
 });
-var verify_token_default = app33;
+var verify_token_default = app32;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
-import { resolve as resolve20 } from "path";
-var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT ?? resolve20(process.cwd(), "..");
-var SEND_SCRIPT = resolve20(
+import { resolve as resolve19 } from "path";
+var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT ?? resolve19(process.cwd(), "..");
+var SEND_SCRIPT = resolve19(
   PLATFORM_ROOT8,
   "plugins",
   "email",
@@ -12777,9 +12856,9 @@ async function sendMagicLinkEmail(payload) {
 
 // server/routes/access/request-magic-link.ts
 var TAG26 = "[access-request-link]";
-var app34 = new Hono();
+var app33 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
-app34.post("/", async (c) => {
+app33.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -12853,17 +12932,17 @@ app34.post("/", async (c) => {
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
-var request_magic_link_default = app34;
+var request_magic_link_default = app33;
 
 // server/routes/access/index.ts
-var app35 = new Hono();
-app35.route("/verify-token", verify_token_default);
-app35.route("/request-magic-link", request_magic_link_default);
-var access_default = app35;
+var app34 = new Hono();
+app34.route("/verify-token", verify_token_default);
+app34.route("/request-magic-link", request_magic_link_default);
+var access_default = app34;
 
 // server/routes/sites.ts
-import { existsSync as existsSync20, readFileSync as readFileSync16, realpathSync as realpathSync5, statSync as statSync7 } from "fs";
-import { resolve as resolve21 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync16, realpathSync as realpathSync5, statSync as statSync7 } from "fs";
+import { resolve as resolve20 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
   ".html": "text/html; charset=utf-8",
@@ -12894,8 +12973,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app36 = new Hono();
-app36.get("/:rel{.*}", (c) => {
+var app35 = new Hono();
+app35.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -12920,19 +12999,19 @@ app36.get("/:rel{.*}", (c) => {
     }
     segments.push(seg);
   }
-  const rootDir = resolve21(account.accountDir, "sites");
-  let filePath = segments.length === 0 ? rootDir : resolve21(rootDir, ...segments);
+  const rootDir = resolve20(account.accountDir, "sites");
+  let filePath = segments.length === 0 ? rootDir : resolve20(rootDir, ...segments);
   if (filePath !== rootDir && !filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  let stat7;
+  let stat8;
   try {
-    stat7 = existsSync20(filePath) ? statSync7(filePath) : null;
+    stat8 = existsSync19(filePath) ? statSync7(filePath) : null;
   } catch {
-    stat7 = null;
+    stat8 = null;
   }
-  if (stat7?.isDirectory() && !reqPath.endsWith("/")) {
+  if (stat8?.isDirectory() && !reqPath.endsWith("/")) {
     const search = new URL(c.req.url).search;
     const target = `${reqPath}/${search}`;
     console.log(
@@ -12940,14 +13019,14 @@ app36.get("/:rel{.*}", (c) => {
     );
     return c.redirect(target, 301);
   }
-  if (stat7?.isDirectory()) {
-    filePath = resolve21(filePath, "index.html");
+  if (stat8?.isDirectory()) {
+    filePath = resolve20(filePath, "index.html");
   }
   if (!filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync20(filePath)) {
+  if (!existsSync19(filePath)) {
     console.error(`[sites] not-found path=${reqPath} status=404`);
     return c.text("Not found", 404);
   }
@@ -12998,7 +13077,7 @@ app36.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app36;
+var sites_default = app35;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
@@ -13078,7 +13157,7 @@ var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync21, readFileSync as readFileSync18 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync18 } from "fs";
 import { join as join14 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
@@ -13088,7 +13167,7 @@ function readBrandConfig() {
   const platformRoot = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot) return null;
   const brandPath = join14(platformRoot, "config", "brand.json");
-  if (!existsSync21(brandPath)) return null;
+  if (!existsSync20(brandPath)) return null;
   try {
     cached2 = JSON.parse(readFileSync18(brandPath, "utf-8"));
     return cached2;
@@ -13098,7 +13177,7 @@ function readBrandConfig() {
 }
 
 // server/routes/visitor-consent.ts
-var app37 = new Hono();
+var app36 = new Hono();
 var CONSENT_COOKIE_NAME = "mxy_consent";
 var CONSENT_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
 var DEFAULT_CONSENT_COPY = {
@@ -13143,17 +13222,17 @@ function siteSlugFromReferer(referer) {
     return "";
   }
 }
-app37.options("/consent", (c) => {
+app36.options("/consent", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app37.options("/brand-config", (c) => {
+app36.options("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app37.post("/consent", async (c) => {
+app36.post("/consent", async (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   let raw;
@@ -13193,7 +13272,7 @@ app37.post("/consent", async (c) => {
   console.log(`[consent] ${parsed.decision} site=${site} brand=${brandName} tokenBound=${tokenBound}`);
   return c.body(null, 204);
 });
-app37.get("/brand-config", (c) => {
+app36.get("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   const brand = readBrandConfig();
@@ -13203,7 +13282,7 @@ app37.get("/brand-config", (c) => {
   c.header("Cache-Control", "public, max-age=300");
   return c.json({ consent: { copy, palette } });
 });
-var visitor_consent_default = app37;
+var visitor_consent_default = app36;
 
 // server/routes/listings.ts
 function getCookie(headerValue, name) {
@@ -13224,14 +13303,14 @@ function appendConsentParams(pageUrl, token) {
     const hashIdx = pageUrl.indexOf("#");
     const hash = hashIdx >= 0 ? pageUrl.slice(hashIdx) : "";
     const base = hashIdx >= 0 ? pageUrl.slice(0, hashIdx) : pageUrl;
-    const sep6 = base.indexOf("?") >= 0 ? "&" : "?";
-    return base + sep6 + `consent=needed&v=${encodeURIComponent(token)}` + hash;
+    const sep7 = base.indexOf("?") >= 0 ? "&" : "?";
+    return base + sep7 + `consent=needed&v=${encodeURIComponent(token)}` + hash;
   }
 }
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
 var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
-var app38 = new Hono();
-app38.get("/:slug/click", async (c) => {
+var app37 = new Hono();
+app37.get("/:slug/click", async (c) => {
   const slug = c.req.param("slug") ?? "";
   const rawSession = c.req.query("session") ?? "";
   const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
@@ -13295,10 +13374,10 @@ app38.get("/:slug/click", async (c) => {
   console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} consent=${consentCookie ?? "absent"} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
   return c.redirect(redirectUrl, 302);
 });
-var listings_default = app38;
+var listings_default = app37;
 
 // server/routes/visitor-event.ts
-var app39 = new Hono();
+var app38 = new Hono();
 var BOT_UA_RE = /\b(bot|crawl|spider|slurp|headlesschrome|phantomjs|googlebot|bingbot|yandex|baiduspider|ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)\b/i;
 var buckets = /* @__PURE__ */ new Map();
 var RATE_LIMIT = 60;
@@ -13365,12 +13444,12 @@ function originAllowed(origin, allowlist) {
     return false;
   }
 }
-app39.options("/event", (c) => {
+app38.options("/event", (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   return c.body(null, 204);
 });
-app39.post("/event", async (c) => {
+app38.post("/event", async (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   const ua = c.req.header("user-agent") ?? "";
@@ -13575,7 +13654,7 @@ async function writeEvent(opts) {
     );
   }
 }
-var visitor_event_default = app39;
+var visitor_event_default = app38;
 
 // app/lib/graph-health.ts
 var HOUR_MS = 60 * 60 * 1e3;
@@ -13658,6 +13737,109 @@ function startGraphHealthTimer() {
   if (typeof timer.unref === "function") timer.unref();
 }
 
+// app/lib/file-watcher.ts
+import * as fsp2 from "fs/promises";
+import { resolve as resolve21, sep as sep6 } from "path";
+var ACCOUNT_UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var DEFAULT_COALESCE_MS = 500;
+var ROOTS = ["uploads", "accounts"];
+function _routeEvent(rootName, filename) {
+  if (!filename) return null;
+  const segs = filename.split(sep6).filter(Boolean);
+  if (segs.length < 2) return null;
+  const accountId = segs[0];
+  if (!ACCOUNT_UUID_RE2.test(accountId)) return null;
+  return { accountId, relativePath: `${rootName}/${segs.join("/")}` };
+}
+async function startFileWatcher(opts = {}) {
+  const dataRoot = opts.dataRoot ?? DATA_ROOT;
+  const coalesceMs = opts.coalesceMs ?? DEFAULT_COALESCE_MS;
+  const indexFn = opts.index ?? indexFile;
+  const dropFn = opts.drop ?? dropFileIndex;
+  for (const r of ROOTS) {
+    try {
+      await fsp2.mkdir(resolve21(dataRoot, r), { recursive: true });
+    } catch (err) {
+      console.error(
+        `[file-watcher] start-failed root="${r}" err="${err.message}" \u2014 index will be maintained by the 5-min reconcile backstop only`
+      );
+      return { stop: async () => {
+      } };
+    }
+  }
+  const controller = new AbortController();
+  const timers = /* @__PURE__ */ new Map();
+  function schedule(relativePath, accountId) {
+    const existing = timers.get(relativePath);
+    if (existing) clearTimeout(existing);
+    const t = setTimeout(() => {
+      timers.delete(relativePath);
+      void runHook(relativePath, accountId);
+    }, coalesceMs);
+    timers.set(relativePath, t);
+  }
+  async function runHook(relativePath, accountId) {
+    const absolute = resolve21(dataRoot, relativePath);
+    let exists = false;
+    try {
+      const st = await fsp2.stat(absolute);
+      exists = st.isFile();
+    } catch (err) {
+      const code = err.code;
+      if (code !== "ENOENT") {
+        console.error(`[file-watcher] stat-error path="${relativePath}" err="${err.message}"`);
+      }
+    }
+    try {
+      if (exists) {
+        await indexFn(accountId, relativePath);
+      } else {
+        await dropFn(accountId, relativePath);
+      }
+    } catch (err) {
+      console.error(`[file-watcher] hook-failed path="${relativePath}" err="${err.message}"`);
+    } finally {
+      opts.onSettled?.(relativePath);
+    }
+  }
+  async function watchRoot(rootName) {
+    const absRoot = resolve21(dataRoot, rootName);
+    try {
+      const iter = fsp2.watch(absRoot, { recursive: true, signal: controller.signal });
+      for await (const event of iter) {
+        const routed = _routeEvent(rootName, event.filename);
+        if (!routed) continue;
+        schedule(routed.relativePath, routed.accountId);
+      }
+    } catch (err) {
+      const code = err.code;
+      const name = err.name;
+      if (code === "ABORT_ERR" || name === "AbortError") return;
+      console.error(`[file-watcher] loop-error root="${rootName}" err="${err.message}"`);
+    }
+  }
+  for (const r of ROOTS) void watchRoot(r);
+  const sigHandler = () => {
+    void stop();
+  };
+  process.once("SIGTERM", sigHandler);
+  process.once("SIGINT", sigHandler);
+  let stopped = false;
+  async function stop() {
+    if (stopped) return;
+    stopped = true;
+    process.off("SIGTERM", sigHandler);
+    process.off("SIGINT", sigHandler);
+    controller.abort();
+    for (const t of timers.values()) clearTimeout(t);
+    timers.clear();
+  }
+  console.error(
+    `[file-watcher] started roots=${ROOTS.join(",")} dataRoot="${dataRoot}" coalesce-ms=${coalesceMs}`
+  );
+  return { stop };
+}
+
 // app/lib/whatsapp/inbound/claude-bridge.ts
 var TAG27 = "[whatsapp-adaptor]";
 function whatsappTurnTimeoutMs() {
@@ -13719,7 +13901,7 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash4, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync22, readFileSync as readFileSync19, statSync as statSync8 } from "fs";
+import { existsSync as existsSync21, readFileSync as readFileSync19, statSync as statSync8 } from "fs";
 import { resolve as resolve22 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
@@ -13768,11 +13950,11 @@ function resolveEntitlement(brand, account) {
     return logResolved(implicitTrust(account), null);
   }
   const entitlementPath = resolve22(brand.configDir, "entitlement.json");
-  if (!existsSync22(entitlementPath)) {
+  if (!existsSync21(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
-  const stat7 = statSync8(entitlementPath);
-  const key = memoKey(stat7.mtimeMs, account);
+  const stat8 = statSync8(entitlementPath);
+  const key = memoKey(stat8.mtimeMs, account);
   if (memo && memo.key === key) {
     return memo.result;
   }
@@ -13960,10 +14142,10 @@ function clientFrom(c) {
 var PLATFORM_ROOT9 = process.env.MAXY_PLATFORM_ROOT || "";
 var BRAND_JSON_PATH = PLATFORM_ROOT9 ? join15(PLATFORM_ROOT9, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync23(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync22(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync23(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync22(BRAND_JSON_PATH)) {
   try {
     const parsed = JSON.parse(readFileSync20(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
@@ -13987,7 +14169,7 @@ var brandLoginOpts = {
 var ALIAS_DOMAINS_PATH = join15(homedir2(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync23(ALIAS_DOMAINS_PATH)) return null;
+    if (!existsSync22(ALIAS_DOMAINS_PATH)) return null;
     const parsed = JSON.parse(readFileSync20(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
@@ -14012,9 +14194,9 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app40 = new Hono();
-app40.use("*", clientIpMiddleware);
-app40.use("*", async (c, next) => {
+var app39 = new Hono();
+app39.use("*", clientIpMiddleware);
+app39.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -14024,7 +14206,7 @@ app40.use("*", async (c, next) => {
   );
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app40.use("*", async (c, next) => {
+app39.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -14057,7 +14239,7 @@ var PUBLIC_ALLOWED_PREFIXES = [
   "/sites/"
 ];
 var PUBLIC_ALLOWED_EXACT = ["/favicon.ico"];
-app40.use("*", async (c, next) => {
+app39.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (!isPublicHost(host)) {
     await next();
@@ -14097,7 +14279,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app40.post("/__remote-auth/login", async (c) => {
+app39.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -14142,7 +14324,7 @@ app40.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app40.get("/__remote-auth/logout", (c) => {
+app39.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -14155,7 +14337,7 @@ app40.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app40.post("/__remote-auth/change-password", async (c) => {
+app39.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -14206,13 +14388,13 @@ app40.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app40.get("/__remote-auth/setup", (c) => {
+app39.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app40.post("/__remote-auth/set-initial-password", async (c) => {
+app39.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -14250,10 +14432,10 @@ app40.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app40.get("/api/remote-auth/status", (c) => {
+app39.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app40.post("/api/remote-auth/set-password", async (c) => {
+app39.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -14284,9 +14466,9 @@ app40.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app40.route("/api/_client-error", client_error_default);
+app39.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
-app40.use("*", async (c, next) => {
+app39.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
@@ -14319,12 +14501,12 @@ app40.use("*", async (c, next) => {
   console.error(`[remote-auth] login required ip=${clientIp} path=${path2} ${disambig}`);
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), redirect: path2 }), 200);
 });
-app40.route("/api/health", health_default);
-app40.route("/api/chat", chat_default);
-app40.route("/api/whatsapp", whatsapp_default);
-app40.route("/api/onboarding", onboarding_default);
-app40.route("/api/admin", admin_default);
-app40.route("/api/access", access_default);
+app39.route("/api/health", health_default);
+app39.route("/api/chat", chat_default);
+app39.route("/api/whatsapp", whatsapp_default);
+app39.route("/api/onboarding", onboarding_default);
+app39.route("/api/admin", admin_default);
+app39.route("/api/access", access_default);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -14336,7 +14518,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app40.get("/agent-assets/:slug/:filename", (c) => {
+app39.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -14358,7 +14540,7 @@ app40.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync23(filePath)) {
+  if (!existsSync22(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
@@ -14371,7 +14553,7 @@ app40.get("/agent-assets/:slug/:filename", (c) => {
     "Cache-Control": "public, max-age=3600"
   });
 });
-app40.get("/generated/:filename", (c) => {
+app39.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -14388,7 +14570,7 @@ app40.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync23(filePath)) {
+  if (!existsSync22(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
@@ -14401,14 +14583,14 @@ app40.get("/generated/:filename", (c) => {
     "Cache-Control": "public, max-age=86400"
   });
 });
-app40.route("/sites", sites_default);
-app40.route("/listings", listings_default);
-app40.route("/v", visitor_event_default);
-app40.route("/v", visitor_consent_default);
+app39.route("/sites", sites_default);
+app39.route("/listings", listings_default);
+app39.route("/v", visitor_event_default);
+app39.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync23(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync22(BRAND_JSON_PATH)) {
   try {
     const fullBrand = JSON.parse(readFileSync20(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
@@ -14428,7 +14610,7 @@ function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT9) return "unknown";
     const versionFile = join15(PLATFORM_ROOT9, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync23(versionFile)) return "unknown";
+    if (!existsSync22(versionFile)) return "unknown";
     const content = readFileSync20(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
@@ -14489,12 +14671,12 @@ function loadBrandingCache(agentSlug) {
   const configDir2 = join15(homedir2(), BRAND.configDir);
   try {
     const accountJsonPath = join15(configDir2, "account.json");
-    if (!existsSync23(accountJsonPath)) return null;
+    if (!existsSync22(accountJsonPath)) return null;
     const account = JSON.parse(readFileSync20(accountJsonPath, "utf-8"));
     const accountId = account.accountId;
     if (!accountId) return null;
     const cachePath = join15(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync23(cachePath)) return null;
+    if (!existsSync22(cachePath)) return null;
     return JSON.parse(readFileSync20(cachePath, "utf-8"));
   } catch {
     return null;
@@ -14504,7 +14686,7 @@ function resolveDefaultSlug() {
   try {
     const configDir2 = join15(homedir2(), BRAND.configDir);
     const accountJsonPath = join15(configDir2, "account.json");
-    if (!existsSync23(accountJsonPath)) return null;
+    if (!existsSync22(accountJsonPath)) return null;
     const account = JSON.parse(readFileSync20(accountJsonPath, "utf-8"));
     return account.defaultAgent || null;
   } catch {
@@ -14541,7 +14723,7 @@ function brandedPublicHtml(agentSlug) {
 function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-app40.get("/", (c) => {
+app39.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) {
     const defaultSlug = resolveDefaultSlug();
@@ -14549,12 +14731,12 @@ app40.get("/", (c) => {
   }
   return c.html(cachedHtml("index.html"));
 });
-app40.get("/public", (c) => {
+app39.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app40.get("/chat", (c) => {
+app39.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -14573,9 +14755,9 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app40.use("/vnc-viewer.html", logViewerFetch);
-app40.use("/vnc-popout.html", logViewerFetch);
-app40.get("/vnc-popout.html", (c) => {
+app39.use("/vnc-viewer.html", logViewerFetch);
+app39.use("/vnc-popout.html", logViewerFetch);
+app39.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
     html = readFileSync20(resolve23(process.cwd(), "public", "vnc-popout.html"), "utf-8");
@@ -14588,7 +14770,7 @@ app40.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app40.post("/api/vnc/client-event", async (c) => {
+app39.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -14609,25 +14791,25 @@ app40.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app40.get("/g/:slug", (c) => {
+app39.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
-app40.get("/graph", (c) => {
+app39.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app40.get("/sessions", (c) => {
+app39.get("/sessions", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("sessions.html"));
 });
-app40.get("/data", (c) => {
+app39.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app40.get("/:slug", async (c, next) => {
+app39.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const branding = loadBrandingCache(slug);
@@ -14637,15 +14819,15 @@ app40.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app40.get("/favicon.ico", (c) => {
+  app39.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app40.use("/*", serveStatic({ root: "./public" }));
+app39.use("/*", serveStatic({ root: "./public" }));
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app40.fetch, port, hostname });
+var httpServer = serve({ fetch: app39.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const loopHist = monitorEventLoopDelay({ resolution: 50 });
@@ -14681,7 +14863,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app40.routes ?? []) {
+  for (const r of app39.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -14703,7 +14885,7 @@ try {
 }
 (async () => {
   try {
-    if (!existsSync23(USERS_FILE)) return;
+    if (!existsSync22(USERS_FILE)) return;
     const usersRaw = readFileSync20(USERS_FILE, "utf-8").trim();
     if (!usersRaw) return;
     const users = JSON.parse(usersRaw);
@@ -14720,6 +14902,9 @@ try {
   }
 })();
 startGraphHealthTimer();
+void startFileWatcher().catch((err) => {
+  console.error(`[file-watcher] start-failed err="${err instanceof Error ? err.message : String(err)}"`);
+});
 try {
   const accounts = enumerateValidAccountIds(getAccountsDirFromEnv());
   console.error(`[graph-health] account-enumeration accounts=${accounts.length}`);
@@ -14738,7 +14923,7 @@ try {
 } catch (err) {
   console.error(`[graph-health] account-enumeration unavailable reason=${err instanceof Error ? err.message : String(err)}`);
 }
-var configDirForWhatsApp = basename5(MAXY_DIR) || ".maxy";
+var configDirForWhatsApp = basename6(MAXY_DIR) || ".maxy";
 var bootAccount = resolveAccount();
 var bootAccountConfig = bootAccount?.config;
 var bootPublicAgent = bootAccount ? resolvePublicAgent(bootAccount.accountDir, { accountId: bootAccount.accountId })?.slug ?? null : null;