@rubytech/create-maxy-code 0.1.192 → 0.1.193

package/payload/server/server.js

@@ -815,7 +815,7 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync20, existsSync as existsSync22, watchFile } from "fs";
+import { readFileSync as readFileSync20, existsSync as existsSync21, watchFile } from "fs";
 import { resolve as resolve23, join as join15, basename as basename6 } from "path";
 import { homedir as homedir2 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
@@ -7245,24 +7245,6 @@ function openResumeStreamLog(accountId, sessionId) {
   }
   return createWriteStream(resolvePath(dir, `${sessionId}.log`), { flags: "a" });
 }
-var healPending = /* @__PURE__ */ new Map();
-function markHealPending(accountId, attachmentId) {
-  let set = healPending.get(accountId);
-  if (!set) {
-    set = /* @__PURE__ */ new Set();
-    healPending.set(accountId, set);
-  }
-  set.add(attachmentId);
-}
-function clearHealPending(accountId, attachmentId) {
-  const set = healPending.get(accountId);
-  if (!set) return;
-  set.delete(attachmentId);
-  if (set.size === 0) healPending.delete(accountId);
-}
-function isHealPending(accountId, attachmentId) {
-  return healPending.get(accountId)?.has(attachmentId) ?? false;
-}
 function validateAndShapeAttachments(raws, conversationAccountId, sessionId, messageId, streamLogPath) {
   const chips = [];
   let valid = 0;
@@ -7640,17 +7622,14 @@ app11.post("/:id/resume", async (c) => {
                 textOffset: c2.textOffset
               };
               if (!c2.artefactAttachmentId || !c2.artefactMimeType || !c2.artefactTitle) return base;
-              markHealPending(accountId, c2.artefactAttachmentId);
               try {
                 const dataObj = JSON.parse(c2.data);
                 const bytesPick = pickComponentBytes(dataObj);
                 if (!bytesPick) {
-                  clearHealPending(accountId, c2.artefactAttachmentId);
                   return base;
                 }
                 const filename = bytesPick.mimeType === "text/html" ? `${c2.artefactTitle}.html` : `${c2.artefactTitle}.md`;
                 await storeComponentArtefact(accountId, c2.artefactAttachmentId, bytesPick.mimeType, bytesPick.content, filename);
-                clearHealPending(accountId, c2.artefactAttachmentId);
                 streamLogPath.write(
                   `[${(/* @__PURE__ */ new Date()).toISOString()}] [component-persist] heal componentName=${c2.name} attachmentId=${c2.artefactAttachmentId.slice(0, 8)} mimeType=${bytesPick.mimeType} bytes=${bytesPick.content.length} outcome=ok
 `
@@ -7662,7 +7641,6 @@ app11.post("/:id/resume", async (c) => {
                   artefactTitle: c2.artefactTitle
                 };
               } catch (writeErr) {
-                clearHealPending(accountId, c2.artefactAttachmentId);
                 const reason2 = writeErr instanceof Error ? writeErr.message : String(writeErr);
                 streamLogPath.write(
                   `[${(/* @__PURE__ */ new Date()).toISOString()}] [component-persist] heal componentName=${c2.name} attachmentId=${c2.artefactAttachmentId.slice(0, 8)} outcome=disk-fail reason=${JSON.stringify(reason2.slice(0, 200))}
@@ -11733,11 +11711,9 @@ function isWithin(target, root) {
 var sidebar_artefacts_default = app22;
 
 // server/routes/admin/sidebar-artefact-save.ts
-import { mkdir as mkdir4, readdir as readdir5, stat as stat6, writeFile as writeFile5 } from "fs/promises";
+import { mkdir as mkdir4, stat as stat6, writeFile as writeFile5 } from "fs/promises";
 import { resolve as resolve16 } from "path";
-import { existsSync as existsSync17 } from "fs";
 var ADMIN_AGENT_FILES2 = /* @__PURE__ */ new Set(["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"]);
-var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 var app23 = new Hono();
 app23.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
@@ -11748,11 +11724,7 @@ app23.post("/", requireAdminSession, async (c) => {
     return c.json({ error: "id and content required" }, 400);
   }
   const accountDir = resolve16(ACCOUNTS_DIR, accountId);
-  const resolved = await resolveSavePath(body.id, accountId, accountDir);
-  if (resolved.kind === "heal-race") {
-    c.header("Retry-After", "2");
-    return c.json({ error: "heal-race", reason: resolved.reason }, 503);
-  }
+  const resolved = await resolveSavePath(body.id, accountDir);
   if (resolved.kind === "reject") {
     console.error(
       `[admin/sidebar-artefact-save] auth-rejected reason=${resolved.reason} path=${body.id}`
@@ -11781,78 +11753,86 @@ app23.post("/", requireAdminSession, async (c) => {
   );
   return c.json({ updatedAt });
 });
-async function resolveSavePath(id, accountId, accountDir) {
-  if (id.startsWith("agent-template:")) {
-    const parts = id.split(":");
-    if (parts.length !== 3) return { kind: "reject", status: 400, reason: "invalid-id" };
-    const [, role, filename] = parts;
-    if (role === "specialist") {
-      return { kind: "reject", status: 403, reason: "specialist-write-blocked" };
-    }
-    if (role !== "admin" || !ADMIN_AGENT_FILES2.has(filename)) {
-      return { kind: "reject", status: 400, reason: "invalid-id" };
-    }
-    const parent = resolve16(accountDir, "agents", "admin");
-    await mkdir4(parent, { recursive: true });
-    try {
-      validateFilePathInAccount(parent, accountDir);
-    } catch {
-      return { kind: "reject", status: 400, reason: "containment-rejected" };
-    }
-    return { kind: "admin-template", path: resolve16(parent, filename) };
+async function resolveSavePath(id, accountDir) {
+  if (!id.startsWith("agent-template:")) {
+    return { kind: "reject", status: 400, reason: "invalid-id" };
   }
-  if (UUID_RE4.test(id)) {
-    const dir = resolve16(ATTACHMENTS_ROOT, accountId, id);
-    if (!existsSync17(dir)) {
-      const attShort = id.slice(0, 8);
-      if (isHealPending(accountId, id)) {
-        console.error(`[admin/sidebar-artefact-save] heal-race attachmentId=${attShort} outcome=503-retry source=heal-pending`);
-        return { kind: "heal-race", reason: "dir-pending" };
-      }
-      const session = getSession();
-      try {
-        const result = await session.run(
-          `MATCH (k:KnowledgeDocument {accountId: $accountId, attachmentId: $attachmentId})
-           RETURN count(k) AS cnt`,
-          { accountId, attachmentId: id }
-        );
-        const cnt = result.records[0]?.get("cnt")?.toNumber?.() ?? 0;
-        if (cnt > 0) {
-          console.error(`[admin/sidebar-artefact-save] heal-race attachmentId=${attShort} outcome=503-retry source=neo4j-row`);
-          return { kind: "heal-race", reason: "dir-pending" };
-        }
-        console.error(`[admin/sidebar-artefact-save] heal-race attachmentId=${attShort} outcome=400-terminal`);
-        return { kind: "reject", status: 400, reason: "not-found" };
-      } catch (neoErr) {
-        const reason = neoErr instanceof Error ? neoErr.message.slice(0, 120) : String(neoErr).slice(0, 120);
-        console.error(`[admin/sidebar-artefact-save] heal-race attachmentId=${attShort} outcome=neo4j-fail reason="${reason}"`);
-        return { kind: "heal-race", reason: "neo4j-fail" };
-      } finally {
-        try {
-          await session.close();
-        } catch {
-        }
-      }
-    }
-    try {
-      validateFilePathInAccount(dir, resolve16(ATTACHMENTS_ROOT, accountId));
-    } catch {
-      return { kind: "reject", status: 400, reason: "containment-rejected" };
-    }
-    const entries = await readdir5(dir);
-    const dataFile = entries.find((f) => !f.endsWith(".meta.json"));
-    if (!dataFile) {
-      return { kind: "reject", status: 400, reason: "not-found" };
-    }
-    return { kind: "knowledge-doc", path: resolve16(dir, dataFile) };
+  const parts = id.split(":");
+  if (parts.length !== 3) return { kind: "reject", status: 400, reason: "invalid-id" };
+  const [, role, filename] = parts;
+  if (role === "specialist") {
+    return { kind: "reject", status: 403, reason: "specialist-write-blocked" };
   }
-  return { kind: "reject", status: 400, reason: "invalid-id" };
+  if (role !== "admin" || !ADMIN_AGENT_FILES2.has(filename)) {
+    return { kind: "reject", status: 400, reason: "invalid-id" };
+  }
+  const parent = resolve16(accountDir, "agents", "admin");
+  await mkdir4(parent, { recursive: true });
+  try {
+    validateFilePathInAccount(parent, accountDir);
+  } catch {
+    return { kind: "reject", status: 400, reason: "containment-rejected" };
+  }
+  return { kind: "admin-template", path: resolve16(parent, filename) };
 }
 function relPath(absPath, root) {
   return absPath.startsWith(root) ? absPath.slice(root.length + 1) : absPath;
 }
 var sidebar_artefact_save_default = app23;
 
+// server/routes/admin/sidebar-sessions.ts
+var app24 = new Hono();
+app24.get("/", requireAdminSession, async (c) => {
+  const cacheKey = c.var.cacheKey;
+  const accountId = getAccountIdForSession(cacheKey);
+  if (!accountId) {
+    return c.json({ error: "Account not found for session" }, 401);
+  }
+  const port2 = requirePortEnv("CLAUDE_SESSION_MANAGER_PORT", { tag: "admin-sessions-list" });
+  const url = `http://127.0.0.1:${port2}/list?senderId=${encodeURIComponent(accountId)}`;
+  let upstream = null;
+  try {
+    upstream = await fetch(url);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(`[admin-sessions-list] account=${accountId} fetch-failed error="${message}"`);
+    return c.json({ error: "session-manager-unreachable" }, 503);
+  }
+  if (!upstream.ok) {
+    console.error(`[admin-sessions-list] account=${accountId} upstream-status=${upstream.status}`);
+    return c.json({ error: "session-manager-error", status: upstream.status }, 502);
+  }
+  let payloads;
+  try {
+    payloads = await upstream.json();
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(`[admin-sessions-list] account=${accountId} parse-failed error="${message}"`);
+    return c.json({ error: "session-manager-bad-body" }, 502);
+  }
+  if (!Array.isArray(payloads)) {
+    console.error(`[admin-sessions-list] account=${accountId} bad-shape=not-array`);
+    return c.json({ error: "session-manager-bad-body" }, 502);
+  }
+  const rows = [];
+  for (const p of payloads) {
+    const sessionId = typeof p.sessionId === "string" ? p.sessionId : null;
+    const capturedUrl = typeof p.url === "string" ? p.url : null;
+    const startedAt = typeof p.startedAt === "string" ? p.startedAt : null;
+    if (!sessionId || !capturedUrl || !startedAt) continue;
+    const displayName = typeof p.displayName === "string" && p.displayName.length > 0 ? p.displayName : sessionId.slice(0, 8);
+    rows.push({
+      sessionId,
+      title: displayName,
+      url: capturedUrl,
+      capturedAt: startedAt
+    });
+  }
+  console.log(`[admin-sessions-list] account=${accountId} rows=${rows.length}`);
+  return c.json({ sessions: rows });
+});
+var sidebar_sessions_default = app24;
+
 // server/routes/admin/system-stats.ts
 import { readFile as readFile5 } from "fs/promises";
 import { cpus, loadavg, totalmem, freemem } from "os";
@@ -11948,8 +11928,8 @@ async function sample() {
   if (process.platform === "linux") return sampleLinux();
   return sampleOsFallback();
 }
-var app24 = new Hono();
-app24.get("/", async (c) => {
+var app25 = new Hono();
+app25.get("/", async (c) => {
   const started = Date.now();
   if (!inflight) {
     inflight = sample().finally(() => {
@@ -11972,15 +11952,15 @@ app24.get("/", async (c) => {
     return c.json({ degraded: true, reason, sampledAtMs: Date.now() });
   }
 });
-var system_stats_default = app24;
+var system_stats_default = app25;
 
 // server/routes/admin/health.ts
-import { existsSync as existsSync18, readFileSync as readFileSync14 } from "fs";
+import { existsSync as existsSync17, readFileSync as readFileSync14 } from "fs";
 import { resolve as resolve17, join as join13 } from "path";
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve17(process.cwd(), "..");
 var brandHostname = "maxy";
 var brandJsonPath = join13(PLATFORM_ROOT6, "config", "brand.json");
-if (existsSync18(brandJsonPath)) {
+if (existsSync17(brandJsonPath)) {
   try {
     const brand = JSON.parse(readFileSync14(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
@@ -11991,7 +11971,7 @@ var VERSION_FILE = resolve17(PLATFORM_ROOT6, `config/.${brandHostname}-version`)
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
-  if (!existsSync18(VERSION_FILE)) return "unknown";
+  if (!existsSync17(VERSION_FILE)) return "unknown";
   return readFileSync14(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
@@ -12017,8 +11997,8 @@ async function probeConversationDb() {
     });
   }
 }
-var app25 = new Hono();
-app25.get("/", async (c) => {
+var app26 = new Hono();
+app26.get("/", async (c) => {
   const version = readVersion();
   const probe = await probeConversationDb();
   const uptimeMs = Date.now() - new Date(PROCESS_STARTED_AT).getTime();
@@ -12040,7 +12020,7 @@ app25.get("/", async (c) => {
     uptimeMs
   });
 });
-var health_default2 = app25;
+var health_default2 = app26;
 
 // server/routes/admin/linkedin-ingest.ts
 var TAG20 = "[linkedin-ingest-route]";
@@ -12136,8 +12116,8 @@ function buildInitialMessage(env) {
   }
   return header;
 }
-var app26 = new Hono();
-app26.post("/", requireAdminSession, async (c) => {
+var app27 = new Hono();
+app27.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -12191,7 +12171,7 @@ app26.post("/", requireAdminSession, async (c) => {
   );
   return c.json({ ok: true, dispatchId: envelope.dispatchId, taskId: claudeSessionId }, 202);
 });
-var linkedin_ingest_default = app26;
+var linkedin_ingest_default = app27;
 
 // server/routes/admin/post-turn-context.ts
 import neo4j2 from "neo4j-driver";
@@ -12233,8 +12213,8 @@ function pruneProperties(raw) {
   }
   return out;
 }
-var app27 = new Hono();
-app27.get("/", async (c) => {
+var app28 = new Hono();
+app28.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr2(remoteAddr)) {
     console.error(`${TAG21} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -12294,7 +12274,7 @@ app27.get("/", async (c) => {
     await session.close();
   }
 });
-var post_turn_context_default = app27;
+var post_turn_context_default = app28;
 
 // server/routes/admin/public-session-context.ts
 import neo4j3 from "neo4j-driver";
@@ -12336,8 +12316,8 @@ function pruneProperties2(raw) {
   }
   return out;
 }
-var app28 = new Hono();
-app28.get("/", async (c) => {
+var app29 = new Hono();
+app29.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr3(remoteAddr)) {
     console.error(`${TAG22} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -12396,15 +12376,15 @@ app28.get("/", async (c) => {
     await session.close();
   }
 });
-var public_session_context_default = app28;
+var public_session_context_default = app29;
 
 // server/routes/admin/public-session-exit.ts
 var TAG23 = "[public-session-exit-route]";
 function isLoopbackAddr4(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-var app29 = new Hono();
-app29.post("/", async (c) => {
+var app30 = new Hono();
+app30.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr4(remoteAddr)) {
     console.error(`${TAG23} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -12431,15 +12411,15 @@ app29.post("/", async (c) => {
   handlePublicSessionExit(sessionId);
   return c.json({ ok: true });
 });
-var public_session_exit_default = app29;
+var public_session_exit_default = app30;
 
 // server/routes/admin/access-session-evict.ts
 var TAG24 = "[access-session-evict]";
 function isLoopbackAddr5(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-var app30 = new Hono();
-app30.post("/", async (c) => {
+var app31 = new Hono();
+app31.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr5(remoteAddr)) {
     console.error(`${TAG24} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -12467,36 +12447,37 @@ app30.post("/", async (c) => {
   console.log(`${TAG24} grantId=${grantId} dropped=${dropped}`);
   return c.json({ ok: true, dropped });
 });
-var access_session_evict_default = app30;
+var access_session_evict_default = app31;
 
 // server/routes/admin/index.ts
-var app31 = new Hono();
-app31.route("/session", session_default);
-app31.route("/logs", logs_default);
-app31.route("/claude-info", claude_info_default);
-app31.route("/attachment", attachment_default);
-app31.route("/agents", agents_default);
-app31.route("/sessions", sessions_default);
-app31.route("/claude-sessions", claude_sessions_default);
-app31.route("/log-ingest", log_ingest_default);
-app31.route("/events", events_default);
-app31.route("/files", files_default);
-app31.route("/graph-search", graph_search_default);
-app31.route("/graph-subgraph", graph_subgraph_default);
-app31.route("/graph-delete", graph_delete_default);
-app31.route("/graph-restore", graph_restore_default);
-app31.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app31.route("/graph-default-view", graph_default_view_default);
-app31.route("/sidebar-artefacts", sidebar_artefacts_default);
-app31.route("/sidebar-artefact-save", sidebar_artefact_save_default);
-app31.route("/system-stats", system_stats_default);
-app31.route("/health-brand", health_default2);
-app31.route("/linkedin-ingest", linkedin_ingest_default);
-app31.route("/post-turn-context", post_turn_context_default);
-app31.route("/public-session-context", public_session_context_default);
-app31.route("/public-session-exit", public_session_exit_default);
-app31.route("/access-session-evict", access_session_evict_default);
-var admin_default = app31;
+var app32 = new Hono();
+app32.route("/session", session_default);
+app32.route("/logs", logs_default);
+app32.route("/claude-info", claude_info_default);
+app32.route("/attachment", attachment_default);
+app32.route("/agents", agents_default);
+app32.route("/sessions", sessions_default);
+app32.route("/claude-sessions", claude_sessions_default);
+app32.route("/log-ingest", log_ingest_default);
+app32.route("/events", events_default);
+app32.route("/files", files_default);
+app32.route("/graph-search", graph_search_default);
+app32.route("/graph-subgraph", graph_subgraph_default);
+app32.route("/graph-delete", graph_delete_default);
+app32.route("/graph-restore", graph_restore_default);
+app32.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app32.route("/graph-default-view", graph_default_view_default);
+app32.route("/sidebar-artefacts", sidebar_artefacts_default);
+app32.route("/sidebar-artefact-save", sidebar_artefact_save_default);
+app32.route("/sidebar-sessions", sidebar_sessions_default);
+app32.route("/system-stats", system_stats_default);
+app32.route("/health-brand", health_default2);
+app32.route("/linkedin-ingest", linkedin_ingest_default);
+app32.route("/post-turn-context", post_turn_context_default);
+app32.route("/public-session-context", public_session_context_default);
+app32.route("/public-session-exit", public_session_exit_default);
+app32.route("/access-session-evict", access_session_evict_default);
+var admin_default = app32;
 
 // app/lib/access-gate.ts
 import neo4j4 from "neo4j-driver";
@@ -12710,8 +12691,8 @@ async function generateNewMagicToken(grantId) {
 var TAG25 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
-var app32 = new Hono();
-app32.post("/", async (c) => {
+var app33 = new Hono();
+app33.post("/", async (c) => {
   const ip = c.var.clientIp || "unknown";
   let body;
   try {
@@ -12793,7 +12774,7 @@ app32.post("/", async (c) => {
     displayName: grant.displayName
   });
 });
-var verify_token_default = app32;
+var verify_token_default = app33;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
@@ -12856,9 +12837,9 @@ async function sendMagicLinkEmail(payload) {
 
 // server/routes/access/request-magic-link.ts
 var TAG26 = "[access-request-link]";
-var app33 = new Hono();
+var app34 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
-app33.post("/", async (c) => {
+app34.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -12932,16 +12913,16 @@ app33.post("/", async (c) => {
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
-var request_magic_link_default = app33;
+var request_magic_link_default = app34;
 
 // server/routes/access/index.ts
-var app34 = new Hono();
-app34.route("/verify-token", verify_token_default);
-app34.route("/request-magic-link", request_magic_link_default);
-var access_default = app34;
+var app35 = new Hono();
+app35.route("/verify-token", verify_token_default);
+app35.route("/request-magic-link", request_magic_link_default);
+var access_default = app35;
 
 // server/routes/sites.ts
-import { existsSync as existsSync19, readFileSync as readFileSync16, realpathSync as realpathSync5, statSync as statSync7 } from "fs";
+import { existsSync as existsSync18, readFileSync as readFileSync16, realpathSync as realpathSync5, statSync as statSync7 } from "fs";
 import { resolve as resolve20 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
@@ -12973,8 +12954,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app35 = new Hono();
-app35.get("/:rel{.*}", (c) => {
+var app36 = new Hono();
+app36.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -13007,7 +12988,7 @@ app35.get("/:rel{.*}", (c) => {
   }
   let stat8;
   try {
-    stat8 = existsSync19(filePath) ? statSync7(filePath) : null;
+    stat8 = existsSync18(filePath) ? statSync7(filePath) : null;
   } catch {
     stat8 = null;
   }
@@ -13026,7 +13007,7 @@ app35.get("/:rel{.*}", (c) => {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync19(filePath)) {
+  if (!existsSync18(filePath)) {
     console.error(`[sites] not-found path=${reqPath} status=404`);
     return c.text("Not found", 404);
   }
@@ -13077,7 +13058,7 @@ app35.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app35;
+var sites_default = app36;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
@@ -13157,7 +13138,7 @@ var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync20, readFileSync as readFileSync18 } from "fs";
+import { existsSync as existsSync19, readFileSync as readFileSync18 } from "fs";
 import { join as join14 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
@@ -13167,7 +13148,7 @@ function readBrandConfig() {
   const platformRoot = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot) return null;
   const brandPath = join14(platformRoot, "config", "brand.json");
-  if (!existsSync20(brandPath)) return null;
+  if (!existsSync19(brandPath)) return null;
   try {
     cached2 = JSON.parse(readFileSync18(brandPath, "utf-8"));
     return cached2;
@@ -13177,7 +13158,7 @@ function readBrandConfig() {
 }
 
 // server/routes/visitor-consent.ts
-var app36 = new Hono();
+var app37 = new Hono();
 var CONSENT_COOKIE_NAME = "mxy_consent";
 var CONSENT_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
 var DEFAULT_CONSENT_COPY = {
@@ -13222,17 +13203,17 @@ function siteSlugFromReferer(referer) {
     return "";
   }
 }
-app36.options("/consent", (c) => {
+app37.options("/consent", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app36.options("/brand-config", (c) => {
+app37.options("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app36.post("/consent", async (c) => {
+app37.post("/consent", async (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   let raw;
@@ -13272,7 +13253,7 @@ app36.post("/consent", async (c) => {
   console.log(`[consent] ${parsed.decision} site=${site} brand=${brandName} tokenBound=${tokenBound}`);
   return c.body(null, 204);
 });
-app36.get("/brand-config", (c) => {
+app37.get("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   const brand = readBrandConfig();
@@ -13282,7 +13263,7 @@ app36.get("/brand-config", (c) => {
   c.header("Cache-Control", "public, max-age=300");
   return c.json({ consent: { copy, palette } });
 });
-var visitor_consent_default = app36;
+var visitor_consent_default = app37;
 
 // server/routes/listings.ts
 function getCookie(headerValue, name) {
@@ -13309,8 +13290,8 @@ function appendConsentParams(pageUrl, token) {
 }
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
 var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
-var app37 = new Hono();
-app37.get("/:slug/click", async (c) => {
+var app38 = new Hono();
+app38.get("/:slug/click", async (c) => {
   const slug = c.req.param("slug") ?? "";
   const rawSession = c.req.query("session") ?? "";
   const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
@@ -13374,10 +13355,10 @@ app37.get("/:slug/click", async (c) => {
   console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} consent=${consentCookie ?? "absent"} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
   return c.redirect(redirectUrl, 302);
 });
-var listings_default = app37;
+var listings_default = app38;
 
 // server/routes/visitor-event.ts
-var app38 = new Hono();
+var app39 = new Hono();
 var BOT_UA_RE = /\b(bot|crawl|spider|slurp|headlesschrome|phantomjs|googlebot|bingbot|yandex|baiduspider|ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)\b/i;
 var buckets = /* @__PURE__ */ new Map();
 var RATE_LIMIT = 60;
@@ -13444,12 +13425,12 @@ function originAllowed(origin, allowlist) {
     return false;
   }
 }
-app38.options("/event", (c) => {
+app39.options("/event", (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   return c.body(null, 204);
 });
-app38.post("/event", async (c) => {
+app39.post("/event", async (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   const ua = c.req.header("user-agent") ?? "";
@@ -13654,7 +13635,7 @@ async function writeEvent(opts) {
     );
   }
 }
-var visitor_event_default = app38;
+var visitor_event_default = app39;
 
 // app/lib/graph-health.ts
 var HOUR_MS = 60 * 60 * 1e3;
@@ -13901,7 +13882,7 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash4, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync21, readFileSync as readFileSync19, statSync as statSync8 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync19, statSync as statSync8 } from "fs";
 import { resolve as resolve22 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
@@ -13950,7 +13931,7 @@ function resolveEntitlement(brand, account) {
     return logResolved(implicitTrust(account), null);
   }
   const entitlementPath = resolve22(brand.configDir, "entitlement.json");
-  if (!existsSync21(entitlementPath)) {
+  if (!existsSync20(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
   const stat8 = statSync8(entitlementPath);
@@ -14142,10 +14123,10 @@ function clientFrom(c) {
 var PLATFORM_ROOT9 = process.env.MAXY_PLATFORM_ROOT || "";
 var BRAND_JSON_PATH = PLATFORM_ROOT9 ? join15(PLATFORM_ROOT9, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync22(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync21(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync22(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync21(BRAND_JSON_PATH)) {
   try {
     const parsed = JSON.parse(readFileSync20(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
@@ -14169,7 +14150,7 @@ var brandLoginOpts = {
 var ALIAS_DOMAINS_PATH = join15(homedir2(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync22(ALIAS_DOMAINS_PATH)) return null;
+    if (!existsSync21(ALIAS_DOMAINS_PATH)) return null;
     const parsed = JSON.parse(readFileSync20(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
@@ -14194,9 +14175,9 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app39 = new Hono();
-app39.use("*", clientIpMiddleware);
-app39.use("*", async (c, next) => {
+var app40 = new Hono();
+app40.use("*", clientIpMiddleware);
+app40.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -14206,7 +14187,7 @@ app39.use("*", async (c, next) => {
   );
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app39.use("*", async (c, next) => {
+app40.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -14239,7 +14220,7 @@ var PUBLIC_ALLOWED_PREFIXES = [
   "/sites/"
 ];
 var PUBLIC_ALLOWED_EXACT = ["/favicon.ico"];
-app39.use("*", async (c, next) => {
+app40.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (!isPublicHost(host)) {
     await next();
@@ -14279,7 +14260,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app39.post("/__remote-auth/login", async (c) => {
+app40.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -14324,7 +14305,7 @@ app39.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app39.get("/__remote-auth/logout", (c) => {
+app40.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -14337,7 +14318,7 @@ app39.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app39.post("/__remote-auth/change-password", async (c) => {
+app40.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -14388,13 +14369,13 @@ app39.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app39.get("/__remote-auth/setup", (c) => {
+app40.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app39.post("/__remote-auth/set-initial-password", async (c) => {
+app40.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -14432,10 +14413,10 @@ app39.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app39.get("/api/remote-auth/status", (c) => {
+app40.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app39.post("/api/remote-auth/set-password", async (c) => {
+app40.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -14466,9 +14447,9 @@ app39.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app39.route("/api/_client-error", client_error_default);
+app40.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
-app39.use("*", async (c, next) => {
+app40.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
@@ -14501,12 +14482,12 @@ app39.use("*", async (c, next) => {
   console.error(`[remote-auth] login required ip=${clientIp} path=${path2} ${disambig}`);
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), redirect: path2 }), 200);
 });
-app39.route("/api/health", health_default);
-app39.route("/api/chat", chat_default);
-app39.route("/api/whatsapp", whatsapp_default);
-app39.route("/api/onboarding", onboarding_default);
-app39.route("/api/admin", admin_default);
-app39.route("/api/access", access_default);
+app40.route("/api/health", health_default);
+app40.route("/api/chat", chat_default);
+app40.route("/api/whatsapp", whatsapp_default);
+app40.route("/api/onboarding", onboarding_default);
+app40.route("/api/admin", admin_default);
+app40.route("/api/access", access_default);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -14518,7 +14499,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app39.get("/agent-assets/:slug/:filename", (c) => {
+app40.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -14540,7 +14521,7 @@ app39.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync22(filePath)) {
+  if (!existsSync21(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
@@ -14553,7 +14534,7 @@ app39.get("/agent-assets/:slug/:filename", (c) => {
     "Cache-Control": "public, max-age=3600"
   });
 });
-app39.get("/generated/:filename", (c) => {
+app40.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -14570,7 +14551,7 @@ app39.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync22(filePath)) {
+  if (!existsSync21(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
@@ -14583,14 +14564,14 @@ app39.get("/generated/:filename", (c) => {
     "Cache-Control": "public, max-age=86400"
   });
 });
-app39.route("/sites", sites_default);
-app39.route("/listings", listings_default);
-app39.route("/v", visitor_event_default);
-app39.route("/v", visitor_consent_default);
+app40.route("/sites", sites_default);
+app40.route("/listings", listings_default);
+app40.route("/v", visitor_event_default);
+app40.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync22(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync21(BRAND_JSON_PATH)) {
   try {
     const fullBrand = JSON.parse(readFileSync20(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
@@ -14610,7 +14591,7 @@ function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT9) return "unknown";
     const versionFile = join15(PLATFORM_ROOT9, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync22(versionFile)) return "unknown";
+    if (!existsSync21(versionFile)) return "unknown";
     const content = readFileSync20(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
@@ -14671,12 +14652,12 @@ function loadBrandingCache(agentSlug) {
   const configDir2 = join15(homedir2(), BRAND.configDir);
   try {
     const accountJsonPath = join15(configDir2, "account.json");
-    if (!existsSync22(accountJsonPath)) return null;
+    if (!existsSync21(accountJsonPath)) return null;
     const account = JSON.parse(readFileSync20(accountJsonPath, "utf-8"));
     const accountId = account.accountId;
     if (!accountId) return null;
     const cachePath = join15(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync22(cachePath)) return null;
+    if (!existsSync21(cachePath)) return null;
     return JSON.parse(readFileSync20(cachePath, "utf-8"));
   } catch {
     return null;
@@ -14686,7 +14667,7 @@ function resolveDefaultSlug() {
   try {
     const configDir2 = join15(homedir2(), BRAND.configDir);
     const accountJsonPath = join15(configDir2, "account.json");
-    if (!existsSync22(accountJsonPath)) return null;
+    if (!existsSync21(accountJsonPath)) return null;
     const account = JSON.parse(readFileSync20(accountJsonPath, "utf-8"));
     return account.defaultAgent || null;
   } catch {
@@ -14723,7 +14704,7 @@ function brandedPublicHtml(agentSlug) {
 function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-app39.get("/", (c) => {
+app40.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) {
     const defaultSlug = resolveDefaultSlug();
@@ -14731,12 +14712,12 @@ app39.get("/", (c) => {
   }
   return c.html(cachedHtml("index.html"));
 });
-app39.get("/public", (c) => {
+app40.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app39.get("/chat", (c) => {
+app40.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -14755,9 +14736,9 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app39.use("/vnc-viewer.html", logViewerFetch);
-app39.use("/vnc-popout.html", logViewerFetch);
-app39.get("/vnc-popout.html", (c) => {
+app40.use("/vnc-viewer.html", logViewerFetch);
+app40.use("/vnc-popout.html", logViewerFetch);
+app40.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
     html = readFileSync20(resolve23(process.cwd(), "public", "vnc-popout.html"), "utf-8");
@@ -14770,7 +14751,7 @@ app39.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app39.post("/api/vnc/client-event", async (c) => {
+app40.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -14791,25 +14772,25 @@ app39.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app39.get("/g/:slug", (c) => {
+app40.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
-app39.get("/graph", (c) => {
+app40.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app39.get("/sessions", (c) => {
+app40.get("/sessions", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("sessions.html"));
 });
-app39.get("/data", (c) => {
+app40.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app39.get("/:slug", async (c, next) => {
+app40.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const branding = loadBrandingCache(slug);
@@ -14819,15 +14800,15 @@ app39.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app39.get("/favicon.ico", (c) => {
+  app40.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app39.use("/*", serveStatic({ root: "./public" }));
+app40.use("/*", serveStatic({ root: "./public" }));
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app39.fetch, port, hostname });
+var httpServer = serve({ fetch: app40.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const loopHist = monitorEventLoopDelay({ resolution: 50 });
@@ -14863,7 +14844,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app39.routes ?? []) {
+  for (const r of app40.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -14885,7 +14866,7 @@ try {
 }
 (async () => {
   try {
-    if (!existsSync22(USERS_FILE)) return;
+    if (!existsSync21(USERS_FILE)) return;
     const usersRaw = readFileSync20(USERS_FILE, "utf-8").trim();
     if (!usersRaw) return;
     const users = JSON.parse(usersRaw);