@rubytech/create-maxy-code 0.1.193 → 0.1.195

package/dist/__tests__/samba-provision.test.js

@@ -62,7 +62,7 @@ test("pickLanInterface: returns null when the only non-loopback iface has no IPv
 // renderBrandStanza — exact spec match
 // ---------------------------------------------------------------------------
 test("renderBrandStanza emits the spec directives in order", () => {
-    const stanza = renderBrandStanza({ brand: "maxy-code", sharePath: "/home/admin/maxy-code" });
+    const stanza = renderBrandStanza({ brand: "maxy-code", sharePath: "/home/admin/maxy-code", installOwner: "admin" });
     assert.equal(stanza, [
         "[maxy-code]",
         "   path = /home/admin/maxy-code",
@@ -76,11 +76,34 @@ test("renderBrandStanza emits the spec directives in order", () => {
     ].join("\n"));
 });
 test("renderBrandStanza handles realagent-code with its own share path", () => {
-    const stanza = renderBrandStanza({ brand: "realagent-code", sharePath: "/home/admin/realagent-code" });
+    const stanza = renderBrandStanza({ brand: "realagent-code", sharePath: "/home/admin/realagent-code", installOwner: "admin" });
     assert.match(stanza, /^\[realagent-code\]\n/);
     assert.match(stanza, /\n   path = \/home\/admin\/realagent-code\n/);
     assert.match(stanza, /\n   force user = admin\n/);
 });
+test("renderBrandStanza substitutes a non-admin install owner into valid users and force user", () => {
+    // Laptop case (Task 534): the install owner is the operator's Unix user
+    // (`neo` etc.), not the literal `admin`. The same renderer must produce a
+    // stanza whose `valid users` and `force user` name that owner, so SMB
+    // clients authenticate as a Unix user that actually exists on the device.
+    const stanza = renderBrandStanza({ brand: "maxy-code", sharePath: "/home/neo/maxy-code", installOwner: "neo" });
+    assert.match(stanza, /\n   valid users = neo\n/);
+    assert.match(stanza, /\n   force user = neo\n/);
+    assert.doesNotMatch(stanza, /valid users = admin/);
+    assert.doesNotMatch(stanza, /force user = admin/);
+});
+test("mergeSmbConf preserves a peer brand stanza when the new install owner differs", () => {
+    // Peer-brand isolation must hold across owners: a laptop install
+    // (installOwner=neo) adding its `[maxy-code]` stanza to a conf that
+    // already holds a peer `[realagent-code]` stanza provisioned for owner
+    // `admin` must leave the peer stanza byte-identical. The new stanza
+    // carries the laptop owner; the peer keeps its own. Task 534.
+    const peerStanza = renderBrandStanza({ brand: "realagent-code", sharePath: "/home/admin/realagent-code", installOwner: "admin" });
+    const existing = renderGlobalSection({ lanInterface: "eth0" }) + peerStanza;
+    const merged = mergeSmbConf({ existing, brand: "maxy-code", sharePath: "/home/neo/maxy-code", lanInterface: "wlan0", installOwner: "neo" });
+    assert.ok(merged.includes(peerStanza), "peer brand stanza must survive unchanged");
+    assert.match(merged, /\[maxy-code\][\s\S]+valid users = neo[\s\S]+force user = neo/);
+});
 // ---------------------------------------------------------------------------
 // renderGlobalSection — LAN-only enforcement
 // ---------------------------------------------------------------------------
@@ -96,7 +119,7 @@ test("renderGlobalSection binds to lo + LAN interface only", () => {
 // renderFullSmbConf — composition order
 // ---------------------------------------------------------------------------
 test("renderFullSmbConf places globals before the brand stanza", () => {
-    const conf = renderFullSmbConf({ brand: "maxy-code", sharePath: "/home/admin/maxy-code", lanInterface: "wlan0" });
+    const conf = renderFullSmbConf({ brand: "maxy-code", sharePath: "/home/admin/maxy-code", lanInterface: "wlan0", installOwner: "admin" });
     const globalIdx = conf.indexOf("[global]");
     const brandIdx = conf.indexOf("[maxy-code]");
     assert.ok(globalIdx >= 0 && brandIdx > globalIdx, "[global] must come before [maxy-code]");
@@ -105,13 +128,13 @@ test("renderFullSmbConf places globals before the brand stanza", () => {
 // mergeSmbConf — idempotency and section preservation
 // ---------------------------------------------------------------------------
 test("mergeSmbConf: empty existing conf gets globals + brand stanza", () => {
-    const merged = mergeSmbConf({ existing: "", brand: "maxy-code", sharePath: "/home/admin/maxy-code", lanInterface: "wlan0" });
+    const merged = mergeSmbConf({ existing: "", brand: "maxy-code", sharePath: "/home/admin/maxy-code", lanInterface: "wlan0", installOwner: "admin" });
     assert.match(merged, /\[global\][\s\S]+\[maxy-code\]/);
     assert.match(merged, /interfaces = lo wlan0/);
 });
 test("mergeSmbConf: idempotent on second application", () => {
-    const once = mergeSmbConf({ existing: "", brand: "maxy-code", sharePath: "/home/admin/maxy-code", lanInterface: "wlan0" });
-    const twice = mergeSmbConf({ existing: once, brand: "maxy-code", sharePath: "/home/admin/maxy-code", lanInterface: "wlan0" });
+    const once = mergeSmbConf({ existing: "", brand: "maxy-code", sharePath: "/home/admin/maxy-code", lanInterface: "wlan0", installOwner: "admin" });
+    const twice = mergeSmbConf({ existing: once, brand: "maxy-code", sharePath: "/home/admin/maxy-code", lanInterface: "wlan0", installOwner: "admin" });
     assert.equal(twice, once, "second merge must produce byte-identical output");
 });
 test("mergeSmbConf: replaces an existing global section in place, preserving peer stanzas", () => {
@@ -125,26 +148,26 @@ test("mergeSmbConf: replaces an existing global section in place, preserving pee
         "   guest ok = yes",
         "",
     ].join("\n");
-    const merged = mergeSmbConf({ existing, brand: "maxy-code", sharePath: "/home/admin/maxy-code", lanInterface: "wlan0" });
+    const merged = mergeSmbConf({ existing, brand: "maxy-code", sharePath: "/home/admin/maxy-code", lanInterface: "wlan0", installOwner: "admin" });
     assert.match(merged, /interfaces = lo wlan0/);
     assert.doesNotMatch(merged, /workgroup = OLDGROUP/);
     assert.match(merged, /\[printers\][\s\S]+path = \/var\/spool\/samba/, "[printers] stanza must survive");
     assert.match(merged, /\[maxy-code\][\s\S]+path = \/home\/admin\/maxy-code/);
 });
 test("mergeSmbConf: replaces an existing brand stanza in place, leaves peer brand alone", () => {
-    const peerStanza = renderBrandStanza({ brand: "realagent-code", sharePath: "/home/admin/realagent-code" });
+    const peerStanza = renderBrandStanza({ brand: "realagent-code", sharePath: "/home/admin/realagent-code", installOwner: "admin" });
     const oldBrandStanza = "[maxy-code]\n   path = /OLD/PATH\n   read only = yes\n\n";
     const existing = renderGlobalSection({ lanInterface: "eth0" }) + oldBrandStanza + peerStanza;
-    const merged = mergeSmbConf({ existing, brand: "maxy-code", sharePath: "/home/admin/maxy-code", lanInterface: "wlan0" });
+    const merged = mergeSmbConf({ existing, brand: "maxy-code", sharePath: "/home/admin/maxy-code", lanInterface: "wlan0", installOwner: "admin" });
     assert.doesNotMatch(merged, /\/OLD\/PATH/, "old maxy-code path must be replaced");
     assert.doesNotMatch(merged, /read only = yes/, "old maxy-code directives must be replaced");
     assert.match(merged, /\[realagent-code\][\s\S]+path = \/home\/admin\/realagent-code/, "peer brand stanza must survive");
     assert.match(merged, /\[maxy-code\][\s\S]+path = \/home\/admin\/maxy-code/);
 });
 test("mergeSmbConf: appends brand stanza when not present, keeps existing peer stanzas", () => {
-    const peerStanza = renderBrandStanza({ brand: "realagent-code", sharePath: "/home/admin/realagent-code" });
+    const peerStanza = renderBrandStanza({ brand: "realagent-code", sharePath: "/home/admin/realagent-code", installOwner: "admin" });
     const existing = renderGlobalSection({ lanInterface: "eth0" }) + peerStanza;
-    const merged = mergeSmbConf({ existing, brand: "maxy-code", sharePath: "/home/admin/maxy-code", lanInterface: "wlan0" });
+    const merged = mergeSmbConf({ existing, brand: "maxy-code", sharePath: "/home/admin/maxy-code", lanInterface: "wlan0", installOwner: "admin" });
     assert.match(merged, /\[realagent-code\]/, "peer brand stanza must survive");
     assert.match(merged, /\[maxy-code\][\s\S]+path = \/home\/admin\/maxy-code/, "new brand stanza must be appended");
 });
@@ -153,10 +176,11 @@ test("mergeSmbConf: appends brand stanza when not present, keeps existing peer s
 // ---------------------------------------------------------------------------
 test("removeBrandStanza: removes only this brand, leaves peer brand and global intact", () => {
     const conf = mergeSmbConf({
-        existing: renderBrandStanza({ brand: "realagent-code", sharePath: "/home/admin/realagent-code" }),
+        existing: renderBrandStanza({ brand: "realagent-code", sharePath: "/home/admin/realagent-code", installOwner: "admin" }),
         brand: "maxy-code",
         sharePath: "/home/admin/maxy-code",
         lanInterface: "wlan0",
+        installOwner: "admin",
     });
     const after = removeBrandStanza({ existing: conf, brand: "maxy-code" });
     assert.doesNotMatch(after, /\[maxy-code\]/);
@@ -164,7 +188,7 @@ test("removeBrandStanza: removes only this brand, leaves peer brand and global i
     assert.match(after, /\[global\]/);
 });
 test("removeBrandStanza: returns input unchanged when stanza is absent", () => {
-    const conf = mergeSmbConf({ existing: "", brand: "realagent-code", sharePath: "/home/admin/realagent-code", lanInterface: "wlan0" });
+    const conf = mergeSmbConf({ existing: "", brand: "realagent-code", sharePath: "/home/admin/realagent-code", lanInterface: "wlan0", installOwner: "admin" });
     const after = removeBrandStanza({ existing: conf, brand: "maxy-code" });
     assert.equal(after, conf);
 });
@@ -177,12 +201,12 @@ test("hasAnyBrandStanza: false when only [global] is present", () => {
 });
 test("hasAnyBrandStanza: true when any non-global stanza is present", () => {
     const conf = renderGlobalSection({ lanInterface: "wlan0" }) +
-        renderBrandStanza({ brand: "realagent-code", sharePath: "/home/admin/realagent-code" });
+        renderBrandStanza({ brand: "realagent-code", sharePath: "/home/admin/realagent-code", installOwner: "admin" });
     assert.equal(hasAnyBrandStanza(conf), true);
 });
 test("hasAnyBrandStanza: false when both brand stanzas have been removed", () => {
-    let conf = renderFullSmbConf({ brand: "maxy-code", sharePath: "/home/admin/maxy-code", lanInterface: "wlan0" });
-    conf = mergeSmbConf({ existing: conf, brand: "realagent-code", sharePath: "/home/admin/realagent-code", lanInterface: "wlan0" });
+    let conf = renderFullSmbConf({ brand: "maxy-code", sharePath: "/home/admin/maxy-code", lanInterface: "wlan0", installOwner: "admin" });
+    conf = mergeSmbConf({ existing: conf, brand: "realagent-code", sharePath: "/home/admin/realagent-code", lanInterface: "wlan0", installOwner: "admin" });
     conf = removeBrandStanza({ existing: conf, brand: "maxy-code" });
     conf = removeBrandStanza({ existing: conf, brand: "realagent-code" });
     assert.equal(hasAnyBrandStanza(conf), false);

package/dist/index.js

@@ -18,7 +18,7 @@ import { classifyPortHolder } from "./preflight-port-classifier.js";
 import { parsePluginList, computeInstallActions, computeConfigureActions, parseExternalPlugins, } from "./lib/plugin-install.js";
 import { findPremiumMcpDirs } from "./lib/premium-mcp-discover.js";
 import { pickLanInterface, mergeSmbConf, formatSambaMarker, } from "./samba-provision.js";
-import { networkInterfaces } from "node:os";
+import { networkInterfaces, userInfo } from "node:os";
 const PAYLOAD_DIR = resolve(import.meta.dirname, "../payload");
 // Brand manifest — read from payload to derive all brand-specific installation values.
 // The bundler stamps brand.json into the payload at build time.
@@ -3371,12 +3371,16 @@ WantedBy=multi-user.target
 // marker:
 //   apt   — install the `samba` package
 //   conf  — write the brand stanza + LAN-only globals to /etc/samba/smb.conf
-//   user  — smbpasswd the admin Linux user; deferred at install time on fresh
-//           Pi installs (no plaintext PIN until the operator runs set-pin)
+//   user  — smbpasswd the install-owner Linux user; deferred at install time
+//           on fresh Pi installs (no plaintext PIN until the operator runs set-pin)
 //   units — systemctl enable --now smbd nmbd
 //
 // The platform's set-pin route handler closes the deferral loop by running
-// `smbpasswd -a admin` inline whenever the PIN is set or rotated.
+// `smbpasswd -a -s <install-owner>` inline whenever the PIN is set or
+// rotated. Install owner is the Unix user the installer is running as —
+// `admin` on a Pi/Hetzner box, `neo` (etc.) on a self-hosted laptop. It is
+// persisted to `~/.<brand>/.install-owner` so every later read uses the same
+// value the installer wrote.
 // ---------------------------------------------------------------------------
 function emitSambaMarker(step, state) {
     const line = formatSambaMarker(step, state);
@@ -3390,6 +3394,16 @@ function provisionSamba() {
     }
     const brand = BRAND.hostname;
     const sharePath = INSTALL_DIR;
+    // Install owner — the Unix user that owns this brand's install on the
+    // device. On a Pi/Hetzner box this is `admin`; on a self-hosted laptop it
+    // is the operator's Unix user (`neo` etc.). Persisted to a file next to
+    // the other install identity (`.neo4j-password`, `.admin-pin`) so the
+    // platform's set-pin route and the uninstall path read the same value the
+    // installer wrote, rather than re-detecting at request time. Task 534.
+    const installOwner = userInfo().username;
+    const installOwnerPersistDir = resolve(process.env.HOME ?? "/root", BRAND.configDir);
+    mkdirSync(installOwnerPersistDir, { recursive: true });
+    writeFileSync(join(installOwnerPersistDir, ".install-owner"), `${installOwner}\n`, { mode: 0o644 });
     // Step 1 — apt install samba. Precheck `dpkg -s samba` first; if the
     // package is already installed, skip apt entirely so the install does not
     // contend with `unattended-upgrades` for `/var/lib/dpkg/lock-frontend`
@@ -3426,7 +3440,7 @@ function provisionSamba() {
         }
         catch { /* treat as empty */ }
     }
-    const merged = mergeSmbConf({ existing, brand, sharePath, lanInterface });
+    const merged = mergeSmbConf({ existing, brand, sharePath, lanInterface, installOwner });
     try {
         const tee = spawnSync("sudo", ["tee", SMB_CONF], { input: merged, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"], timeout: 10_000 });
         if (tee.status !== 0) {
@@ -3436,15 +3450,18 @@ function provisionSamba() {
         if (testparm.status !== 0) {
             throw new Error(`testparm rejected merged smb.conf: ${(testparm.stderr ?? "").trim()}`);
         }
-        // Grant passwordless sudo to the admin user for the two smbpasswd
-        // invocations the platform's set-pin route makes (add-user-with-stdin
-        // and remove-user). Without this, the user systemd-unit-spawned admin
-        // server cannot sync the SMB password when the operator sets/rotates
-        // the PIN. Scoped tight: only these two literal arg-vectors are
-        // permitted; every other smbpasswd flavour still prompts.
+        // Grant passwordless sudo to the install-owner Unix user for the two
+        // smbpasswd invocations the platform's set-pin route makes (add-user-
+        // with-stdin and remove-user). Without this, the user systemd-unit-
+        // spawned admin server cannot sync the SMB password when the operator
+        // sets/rotates the PIN. Scoped tight: only these two literal arg-vectors
+        // are permitted; every other smbpasswd flavour still prompts. Principal
+        // and `-a -s <user>` / `-x <user>` arguments are the install owner, not
+        // a literal `admin`, so the grant works on a Pi (owner=admin) and on a
+        // laptop (owner=neo) without divergence. Task 534.
         const SUDOERS = "/etc/sudoers.d/maxy-samba";
         const sudoersBody = "# maxy-code Samba provisioning (smbpasswd sync from platform set-pin route).\n" +
-            "admin ALL=(root) NOPASSWD: /usr/bin/smbpasswd -a -s admin, /usr/bin/smbpasswd -x admin\n";
+            `${installOwner} ALL=(root) NOPASSWD: /usr/bin/smbpasswd -a -s ${installOwner}, /usr/bin/smbpasswd -x ${installOwner}\n`;
         const sudoersTee = spawnSync("sudo", ["tee", SUDOERS], { input: sudoersBody, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"], timeout: 5_000 });
         if (sudoersTee.status !== 0) {
             throw new Error(`sudo tee ${SUDOERS} exited ${sudoersTee.status}: ${(sudoersTee.stderr ?? "").trim()}`);
@@ -3454,18 +3471,20 @@ function provisionSamba() {
         if (visudoCheck.status !== 0) {
             throw new Error(`visudo rejected ${SUDOERS}: ${(visudoCheck.stderr ?? "").trim()}`);
         }
-        emitSambaMarker("conf", `ok lan=${lanInterface}`);
+        emitSambaMarker("conf", `ok lan=${lanInterface} owner=${installOwner}`);
     }
     catch (err) {
         const stderr = err instanceof Error ? err.message : String(err);
         emitSambaMarker("conf", `fail: ${stderr}`);
         throw err;
     }
-    // Step 3 — smbpasswd for the admin user. At install time the plaintext PIN
-    // is not in any file on disk (users.json stores the SHA-256 hash only); the
-    // platform's set-pin route is responsible for syncing on PIN set/rotate.
-    // Mark as deferred so the four-marker contract still fires unbroken.
-    emitSambaMarker("user", "deferred reason=no-plaintext-pin-at-install (set-pin route syncs)");
+    // Step 3 — smbpasswd for the install-owner Unix user. At install time the
+    // plaintext PIN is not in any file on disk (users.json stores the SHA-256
+    // hash only); the platform's set-pin route is responsible for syncing on
+    // PIN set/rotate. Mark as deferred so the four-marker contract still fires
+    // unbroken. Owner is recorded in the marker state so the install log shows
+    // which Unix user the smbpasswd entry will target. Task 534.
+    emitSambaMarker("user", `deferred reason=no-plaintext-pin-at-install owner=${installOwner} (set-pin route syncs)`);
     // Step 4 — enable + start smbd and nmbd.
     try {
         shell("systemctl", ["enable", "--now", "smbd", "nmbd"], { sudo: true, timeout: 30_000 });

package/dist/samba-provision.js

@@ -19,17 +19,20 @@
 // ---------------------------------------------------------------------------
 /**
  * Render the `[<brand>]` share stanza. Exact directives are the task's spec
- * verbatim: share rooted at `sharePath`, writable by `admin` only, force-uid
- * to admin so files created via SMB are owned by the same uid as files
- * created over SSH, and standard create/dir masks for an ext4 home directory.
+ * verbatim: share rooted at `sharePath`, writable by `installOwner` only,
+ * force-uid to `installOwner` so files created via SMB are owned by the same
+ * uid as files created over SSH, and standard create/dir masks for an ext4
+ * home directory. `installOwner` is the Unix user that owns this brand's
+ * install on the device — `admin` on a Pi or Hetzner box, the operator's
+ * Unix user on a self-hosted laptop. Task 534.
  */
 export function renderBrandStanza(input) {
     return [
         `[${input.brand}]`,
         `   path = ${input.sharePath}`,
         `   read only = no`,
-        `   valid users = admin`,
-        `   force user = admin`,
+        `   valid users = ${input.installOwner}`,
+        `   force user = ${input.installOwner}`,
         `   browseable = yes`,
         `   create mask = 0664`,
         `   directory mask = 0775`,
@@ -69,7 +72,7 @@ export function renderGlobalSection(input) {
  */
 export function renderFullSmbConf(input) {
     return renderGlobalSection({ lanInterface: input.lanInterface }) +
-        renderBrandStanza({ brand: input.brand, sharePath: input.sharePath });
+        renderBrandStanza({ brand: input.brand, sharePath: input.sharePath, installOwner: input.installOwner });
 }
 // ---------------------------------------------------------------------------
 // LAN interface detection
@@ -148,9 +151,9 @@ function findSectionRange(conf, section) {
  *     brand stanzas (other `[…]` blocks) are preserved verbatim.
  */
 export function mergeSmbConf(input) {
-    const { existing, brand, sharePath, lanInterface } = input;
+    const { existing, brand, sharePath, lanInterface, installOwner } = input;
     const newGlobals = renderGlobalSection({ lanInterface });
-    const newBrand = renderBrandStanza({ brand, sharePath });
+    const newBrand = renderBrandStanza({ brand, sharePath, installOwner });
     let conf = existing;
     // Replace or insert the global section.
     const globalRange = findSectionRange(conf, "global");

package/dist/uninstall.js

@@ -759,9 +759,25 @@ function removeSamba() {
     catch (err) {
         console.log(`  Failed to disable smbd/nmbd: ${err instanceof Error ? err.message : String(err)}`);
     }
-    // Drop the admin smbpasswd entry. `smbpasswd -x` exits 0 on success, non-zero
-    // if the user isn't in the passdb — both are acceptable end-states.
-    spawnSync("sudo", ["smbpasswd", "-x", "admin"], { stdio: "pipe", timeout: 10_000 });
+    // Drop the install-owner's smbpasswd entry. `smbpasswd -x` exits 0 on
+    // success, non-zero if the user isn't in the passdb — both are acceptable
+    // end-states. Owner is read from the persisted file the installer wrote
+    // so the cleanup targets the same Unix user the provisioning step keyed
+    // on (Task 534): `admin` on a Pi/Hetzner box, `neo` (etc.) on a laptop.
+    // Missing file falls back to `admin` because an install that ran before
+    // the install-owner persistence existed only ever provisioned `admin`.
+    const installOwnerFile = join(CONFIG_DIR, ".install-owner");
+    let installOwner = "admin";
+    if (existsSync(installOwnerFile)) {
+        try {
+            const raw = readFileSync(installOwnerFile, "utf-8").trim();
+            if (raw.length > 0)
+                installOwner = raw;
+        }
+        catch { /* keep default */ }
+    }
+    spawnSync("sudo", ["smbpasswd", "-x", installOwner], { stdio: "pipe", timeout: 10_000 });
+    console.log(`  smbpasswd -x ${installOwner}`);
     try {
         shell("apt-get", ["remove", "--purge", "-y", "samba", "samba-common-bin"], { sudo: true, timeout: 120_000 });
         console.log("  Purged samba package.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.193",
+  "version": "0.1.195",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/plugins/docs/references/access-control.md

@@ -78,3 +78,7 @@ Tell {{productName}} to change which actions require approval:
 - "What actions currently require my approval?" — lists the current policy
 
 Changes are per-account and take effect immediately.
+
+## Filesystem Access (SMB Share)
+
+Brand isolation extends to the device filesystem. Every {{productName}} install provisions an SMB share scoped to that brand's install folder, credentialled by the brand's install owner and the {{productName}} PIN. A device that hosts more than one brand carries one share per brand; tearing one brand down never exposes another brand's files. See [Samba Share](./samba.md) for the credential model, per-OS mount syntax, and peer-brand lifecycle.

package/payload/platform/plugins/docs/references/deployment.md

@@ -121,23 +121,7 @@ If you need to restart the service manually (rare), ask {{productName}} to do it
 
 ## Browsing the brand filesystem on your LAN (SMB)
 
-{{productName}} exposes its install folder (`/home/admin/<brand>` on the Pi) as a network share so you can drop files in, drag files out, and edit them from your Mac, Windows PC, iPhone, or Android device. It uses SMB — the same protocol Windows file sharing uses — which every modern OS speaks natively. No client install required.
-
-The share is **LAN-only**: it binds to the loopback and your Pi's Wi-Fi/Ethernet interface only. Cloudflare tunnels carry HTTPS for the web UI, not SMB, so the share is invisible from the public internet. Off-LAN access for travelling operators is handled by a separate route (in progress).
-
-**Credentials:** SMB user is `admin`; password is your {{productName}} PIN. The installer wires the sync so every time you set or rotate the PIN in the admin UI, the SMB password updates with it.
-
-**macOS Finder**: Press `Cmd-K` from any Finder window, type `smb://<hostname>.local` (use the hostname your installer printed — for example `smb://maxy-code.local` or `smb://realagent-code.local`), click Connect, sign in as `admin` with your PIN. The share appears in the Finder sidebar; drag-and-drop works in both directions.
-
-**Windows Explorer**: Open File Explorer, type `\\<hostname>.local\<brand>` in the address bar (for example `\\maxy-code.local\maxy-code`), press Enter, sign in as `admin` with your PIN. To keep it across reboots, right-click → "Map network drive".
-
-**iOS Files**: Open Files → tap the `…` menu (top-right) → "Connect to Server" → enter `smb://<hostname>.local` → "Registered User" → username `admin`, password is your PIN.
-
-**Android (Solid Explorer, CX File Explorer)**: Add a new connection of type SMB / Network. Host = `<hostname>.local`, share = `<brand>` (same as your install folder name), user = `admin`, password = your PIN.
-
-**Troubleshooting:** if the mount fails with "logon failure", change your PIN in the admin UI and try again — that re-triggers the smbpasswd sync. If the share doesn't show up at all, your client may need `<hostname>.local` resolved by mDNS — try the Pi's LAN IP address as a fallback (`smb://192.168.1.50` on macOS, `\\192.168.1.50\<brand>` on Windows).
-
-The installer maintains the share automatically. To remove it, uninstalling the brand strips its stanza from `/etc/samba/smb.conf` and (when no peer brand remains on the device) stops `smbd`, drops the smbpasswd entry, and purges the samba package.
+Every install provisions a per-brand SMB share against the brand's install folder. See [Samba Share](./samba.md) for the share path, credentials, per-OS mount instructions, peer-brand lifecycle, and the LAN-only binding posture.
 
 ## Remote Access via Cloudflare
 

package/payload/platform/plugins/docs/references/samba.md

@@ -0,0 +1,80 @@
+# Samba Share
+
+Every {{productName}} install provisions a per-brand SMB network share so you can read and write the brand's install folder from Finder, File Explorer, the Files app on iOS, or any SMB-capable client on Android or Linux. No client install required — every modern OS speaks SMB natively.
+
+The share lives next to the rest of the brand. On a device that runs more than one brand, each brand gets its own stanza, its own credentials, and its own lifecycle. Tearing one brand down never touches another brand's share.
+
+## What gets provisioned
+
+The installer runs the same Samba step on every supported footprint — Raspberry Pi, Hetzner Cloud server, and self-hosted Linux laptop. Four sub-steps emit `[install-invariant] samba-provision-<step>` markers in order:
+
+1. **apt** — installs the `samba` package (skipped if `dpkg -s samba` already reports installed, so re-runs don't fight `unattended-upgrades` for the dpkg lock).
+2. **conf** — writes `/etc/samba/smb.conf` with a LAN-only `[global]` section plus a `[<brand>]` stanza pointing at the brand's install directory. The stanza is owned by the install owner (see below) and is marked `read only = no`, `browseable = yes`.
+3. **user** — deferred at install time on a fresh Pi or Hetzner box because there is no PIN to hand to `smbpasswd` yet. The user is created the moment the operator sets a PIN in the admin UI (see "PIN rotation" below).
+4. **units** — `systemctl enable --now smbd nmbd` so the share is reachable as soon as the install finishes.
+
+macOS install is a no-op for this step — the installer logs `samba-provision skipped: platform=darwin` and returns. Mac operators do not get an SMB share against their laptop.
+
+## Share path
+
+| Client | Address |
+|---|---|
+| macOS Finder | `smb://<hostname>.local` then pick the `<brand>` share |
+| Windows Explorer | `\\<hostname>.local\<brand>` |
+| Linux (`mount.cifs`, Nautilus, KDE) | `//<hostname>.local/<brand>` |
+| iOS Files | `smb://<hostname>.local` |
+| Android (Solid Explorer, CX File Explorer) | Host `<hostname>.local`, share `<brand>` |
+
+`<hostname>` is whatever the installer printed at the end of `npx @rubytech/create-<brand>-code install` — usually the brand name on a fresh Pi (`maxy-code.local`, `realagent-code.local`). `<brand>` is the same string — it is also the install folder name under the install owner's home.
+
+If `<hostname>.local` does not resolve from your client (some networks do not route mDNS), fall back to the LAN IP: `smb://192.168.1.50` on macOS, `\\192.168.1.50\<brand>` on Windows.
+
+## Credentials
+
+- **Username** — the Unix user that owns the install on the device. On a Pi or Hetzner box this is `admin`; on a self-hosted Linux laptop it is whatever Linux user ran the installer (for example `neo`). The installer persists this value to `~/.<brand>/.install-owner` so every later read uses the same identity the installer wrote.
+- **Password** — your current {{productName}} PIN. The same PIN that unlocks the admin UI unlocks the SMB share.
+
+Both halves are required. SMB never accepts a guest connection; `map to guest = bad user` is set in the global stanza.
+
+## PIN rotation
+
+There is no separate "SMB password." When you set or rotate the PIN in the admin UI, the platform's `set-pin` route runs `sudo -n smbpasswd -a -s <install-owner>` inline with the new PIN, behind a `NOPASSWD` sudoers grant written at install time and scoped to that exact command.
+
+So:
+
+- On a fresh Pi or Hetzner box, the share is reachable as soon as you set the first PIN. Before that point the `smbpasswd` entry does not exist and the mount fails with a logon error — that is expected.
+- Rotating the PIN re-syncs the SMB password to the new value on the next set-pin request. Mounts using the old PIN start failing immediately; remount with the new PIN.
+- If `set-pin` cannot read `~/.<brand>/.install-owner` (file missing or empty), it logs `[set-pin] smbpasswd sync failed owner=<unknown> rc=-1 reason=install-owner-file-missing` and skips the sync. The PIN still writes to the admin UI, but the SMB mount keeps refusing the new password until the install-owner file is restored.
+
+## LAN-only binding
+
+The `[global]` section binds smbd to loopback plus one LAN interface:
+
+```
+interfaces = lo <lan>
+bind interfaces only = yes
+```
+
+`<lan>` is whichever non-loopback interface has an IPv4 address — `wlan0` preferred, then `eth0`, then the first other interface with an address. If the device has no LAN interface at all, the installer refuses to provision and exits — there is nothing safe to bind to.
+
+This is the structural guarantee that SMB never leaves the LAN, even if upstream firewall rules are misconfigured. The Cloudflare tunnel that fronts the admin UI carries HTTPS only; it does not route SMB. **On a Hetzner box the share is therefore not reachable from the public internet** — operators reach it by `ssh -L 4445:localhost:445 admin@<tunnel-host>` and then mounting `smb://localhost:4445`, or by running the Hetzner box on a private network that the operator's machine also joins.
+
+## Peer-brand lifecycle
+
+A device that hosts more than one brand carries one stanza per brand in `/etc/samba/smb.conf`. The provisioner is idempotent and peer-safe:
+
+- **Install a second brand** — the new brand's stanza is appended next to the existing one. The shared `[global]` section is rewritten to keep the LAN-only directives current but is otherwise unchanged. Peer-brand stanzas are preserved byte-for-byte.
+- **Re-run the installer on an existing brand** — the brand's own stanza is replaced in place. Peer stanzas are not touched.
+- **Uninstall one brand** — only that brand's stanza is stripped. `smbd` is then `reload`ed so the brand share disappears from the running config without dropping connections to peer shares.
+- **Uninstall the last brand** — after the stanza is removed, the uninstaller checks `hasAnyBrandStanza()` and, if false, stops and disables `smbd`/`nmbd`, runs `smbpasswd -x <install-owner>` to drop the smbpasswd entry, and `apt-purge samba`. If any peer stanza remains, the units stay running and the package stays installed — the uninstaller logs `Leaving smbd/nmbd + samba package in place — other brand stanza remains`.
+
+The brand-stanza name is the only identifier the uninstaller matches on, so two brands with different `BRAND.hostname` values cannot collide.
+
+## Troubleshooting
+
+- **"Logon failure" on mount.** The PIN you typed does not match the current `smbpasswd` entry. Set a new PIN in the admin UI and remount. If the PIN was just rotated and the mount still fails, check `~/.<brand>/.install-owner` exists and is non-empty.
+- **Share does not show up in Finder / network browser.** mDNS may not be routed on your network. Mount by LAN IP instead of `<hostname>.local`.
+- **`smbd` not running after install.** Check the install log for the four `[install-invariant] samba-provision-<step>` markers. The `units` step running `systemctl enable --now smbd nmbd` is the last to fire; if it failed the marker prints `fail: <reason>`.
+- **Hetzner share not reachable from outside the box.** This is by design — see "LAN-only binding" above. Use SSH port forwarding.
+
+Also see [Deployment Guide](./deployment.md) for the surrounding install flow, and [Access Control](./access-control.md) for how the brand isolation extends from the admin UI to the SMB share.

package/payload/platform/plugins/docs/references/troubleshooting.md

@@ -134,6 +134,20 @@ tail -200 ~/.maxy/logs/maxy-ui.log | rg '\[remote-auth\].*resolvedKind='
 
 ---
 
+## Cannot Mount the SMB Share
+
+**Symptom:** Mounting `smb://<hostname>.local` (or `\\<hostname>.local\<brand>`) fails with a "logon failure" or the share does not appear in your network browser.
+
+**Check:**
+1. Confirm you have set a PIN in the admin UI at least once. On a fresh Pi or Hetzner box the `smbpasswd` entry does not exist until the first set-pin runs — mounts before that point always fail.
+2. Use the install owner as the username (`admin` on a Pi or Hetzner box; the Linux user that ran the installer on a self-hosted laptop) and the current {{productName}} PIN as the password. The SMB password is not stored separately — it is the PIN.
+3. If `<hostname>.local` does not resolve from your client, mount by LAN IP instead (`smb://192.168.1.50` on macOS, `\\192.168.1.50\<brand>` on Windows).
+4. Rotate the PIN in the admin UI. That re-triggers the `smbpasswd` sync on the device. If the resync log line reads `[set-pin] smbpasswd sync failed owner=<unknown> rc=-1 reason=install-owner-file-missing`, restore `~/.<brand>/.install-owner` from the installer log.
+
+See [Samba Share](./samba.md) for the full credential model and per-OS mount syntax.
+
+---
+
 ## Restarting the Platform
 
 From the admin interface, ask {{productName}}: "Restart the platform."

package/payload/server/{chunk-WWD4TCJJ.js → chunk-EXIPYITB.js}

@@ -2705,6 +2705,7 @@ var BIN_DIR = resolve(MAXY_DIR, "bin");
 var REMOTE_PASSWORD_FILE = resolve(MAXY_DIR, ".remote-password");
 var REMOTE_SESSION_SECRET_FILE = resolve(MAXY_DIR, "credentials", "remote-session-secret");
 var ADMIN_SESSION_SECRET_FILE = resolve(MAXY_DIR, "credentials", "admin-session-secret");
+var INSTALL_OWNER_FILE = resolve(MAXY_DIR, ".install-owner");
 var TELEGRAM_WEBHOOK_SECRET_FILE = resolve(MAXY_DIR, ".telegram-webhook-secret");
 var TELEGRAM_ADMIN_WEBHOOK_SECRET_FILE = resolve(MAXY_DIR, ".telegram-admin-webhook-secret");
 var VISITOR_TOKEN_SECRET_FILE = resolve(MAXY_DIR, "credentials", "visitor-token-secret");
@@ -5454,6 +5455,7 @@ export {
   USERS_FILE,
   LOG_DIR,
   BIN_DIR,
+  INSTALL_OWNER_FILE,
   VISITOR_TOKEN_SECRET_FILE,
   CLAUDE_CREDENTIALS_FILE,
   vncLog,

package/payload/server/maxy-edge.js

@@ -14,7 +14,7 @@ import {
   sanitizeClientCorrId,
   vncLog,
   websockifyLog
-} from "./chunk-WWD4TCJJ.js";
+} from "./chunk-EXIPYITB.js";
 import "./chunk-PFF6I7KP.js";
 
 // server/edge.ts

package/payload/server/server.js

@@ -9,6 +9,7 @@ import {
   COMMERCIAL_MODE,
   GREETING_DIRECTIVE,
   Hono,
+  INSTALL_OWNER_FILE,
   LOG_DIR,
   MAXY_DIR,
   PLATFORM_ROOT,
@@ -83,7 +84,7 @@ import {
   vncLog,
   walkPremiumBundles,
   writeAdminUserAndPerson
-} from "./chunk-WWD4TCJJ.js";
+} from "./chunk-EXIPYITB.js";
 import {
   __commonJS,
   __toESM
@@ -815,8 +816,8 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync20, existsSync as existsSync21, watchFile } from "fs";
-import { resolve as resolve23, join as join15, basename as basename6 } from "path";
+import { readFileSync as readFileSync21, existsSync as existsSync21, watchFile } from "fs";
+import { resolve as resolve23, join as join16, basename as basename6 } from "path";
 import { homedir as homedir2 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
@@ -6325,19 +6326,32 @@ app4.post("/set-pin", async (c) => {
   }
   console.log(`[set-pin] wrote users.json + account.json admins: userId=${userId.slice(0, 8)}\u2026 role=owner`);
   if (process.platform === "linux") {
-    const smbProc = spawnSync2("sudo", ["-n", "smbpasswd", "-a", "-s", "admin"], {
-      input: `${body.pin}
+    let installOwner = null;
+    if (existsSync6(INSTALL_OWNER_FILE)) {
+      try {
+        const raw = readFileSync8(INSTALL_OWNER_FILE, "utf-8").trim();
+        if (raw.length > 0) installOwner = raw;
+      } catch (err) {
+        console.error(`[set-pin] install-owner-read-failed path=${INSTALL_OWNER_FILE} error=${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+    if (!installOwner) {
+      console.error(`[set-pin] smbpasswd sync failed owner=<unknown> rc=-1 reason=install-owner-file-missing path=${INSTALL_OWNER_FILE}`);
+    } else {
+      const smbProc = spawnSync2("sudo", ["-n", "smbpasswd", "-a", "-s", installOwner], {
+        input: `${body.pin}
 ${body.pin}
 `,
-      stdio: ["pipe", "pipe", "pipe"],
-      encoding: "utf-8",
-      timeout: 1e4
-    });
-    if (smbProc.status === 0) {
-      console.log(`[set-pin] smb-password-synced userId=${userId.slice(0, 8)}\u2026`);
-    } else {
-      const stderr = (smbProc.stderr ?? "").trim().slice(0, 200);
-      console.error(`[set-pin] smb-password-sync-failed exit=${smbProc.status} stderr=${JSON.stringify(stderr)}`);
+        stdio: ["pipe", "pipe", "pipe"],
+        encoding: "utf-8",
+        timeout: 1e4
+      });
+      if (smbProc.status === 0) {
+        console.log(`[set-pin] smbpasswd sync ok owner=${installOwner} userId=${userId.slice(0, 8)}\u2026`);
+      } else {
+        const stderr = (smbProc.stderr ?? "").trim().slice(0, 200);
+        console.error(`[set-pin] smbpasswd sync failed owner=${installOwner} rc=${smbProc.status} stderr=${JSON.stringify(stderr)}`);
+      }
     }
   } else {
     console.log(`[set-pin] smb-password-sync-skipped reason=non-linux platform=${process.platform}`);
@@ -11781,53 +11795,87 @@ function relPath(absPath, root) {
 var sidebar_artefact_save_default = app23;
 
 // server/routes/admin/sidebar-sessions.ts
+import { readdirSync as readdirSync8, readFileSync as readFileSync14, statSync as statSync7 } from "fs";
+import { join as join13 } from "path";
+var RC_URL_RE = /https:\/\/claude\.ai\/code\/session_[A-Za-z0-9_-]+/;
+var SESSION_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.jsonl$/i;
+var TITLE_MAX = 80;
 var app24 = new Hono();
+function projectsDirForAccount(accountId) {
+  const configDir2 = process.env.CLAUDE_CONFIG_DIR;
+  if (!configDir2) return null;
+  const accountCwd = join13(DATA_ROOT, "accounts", accountId);
+  const slug = accountCwd.replace(/\//g, "-");
+  return join13(configDir2, "projects", slug);
+}
+function firstUserMessage(body) {
+  for (const line of body.split("\n")) {
+    if (!line || line[0] !== "{") continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (!parsed || typeof parsed !== "object") continue;
+    const row = parsed;
+    if (row.type !== "user" || !row.message || row.message.role !== "user") continue;
+    const content = row.message.content;
+    if (typeof content !== "string") continue;
+    const trimmed = content.trim().replace(/\s+/g, " ");
+    if (!trimmed) continue;
+    return trimmed.length > TITLE_MAX ? trimmed.slice(0, TITLE_MAX - 1) + "\u2026" : trimmed;
+  }
+  return null;
+}
 app24.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
     return c.json({ error: "Account not found for session" }, 401);
   }
-  const port2 = requirePortEnv("CLAUDE_SESSION_MANAGER_PORT", { tag: "admin-sessions-list" });
-  const url = `http://127.0.0.1:${port2}/list?senderId=${encodeURIComponent(accountId)}`;
-  let upstream = null;
-  try {
-    upstream = await fetch(url);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    console.error(`[admin-sessions-list] account=${accountId} fetch-failed error="${message}"`);
-    return c.json({ error: "session-manager-unreachable" }, 503);
+  const projectsDir = projectsDirForAccount(accountId);
+  if (!projectsDir) {
+    console.error(`[admin-sessions-list] account=${accountId} no-claude-config-dir`);
+    return c.json({ sessions: [] });
   }
-  if (!upstream.ok) {
-    console.error(`[admin-sessions-list] account=${accountId} upstream-status=${upstream.status}`);
-    return c.json({ error: "session-manager-error", status: upstream.status }, 502);
-  }
-  let payloads;
+  let entries;
   try {
-    payloads = await upstream.json();
+    entries = readdirSync8(projectsDir);
   } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT") {
+      console.log(`[admin-sessions-list] account=${accountId} rows=0 reason=no-projects-dir`);
+      return c.json({ sessions: [] });
+    }
     const message = err instanceof Error ? err.message : String(err);
-    console.error(`[admin-sessions-list] account=${accountId} parse-failed error="${message}"`);
-    return c.json({ error: "session-manager-bad-body" }, 502);
-  }
-  if (!Array.isArray(payloads)) {
-    console.error(`[admin-sessions-list] account=${accountId} bad-shape=not-array`);
-    return c.json({ error: "session-manager-bad-body" }, 502);
+    console.error(`[admin-sessions-list] account=${accountId} readdir-failed error="${message}"`);
+    return c.json({ error: "projects-dir-unreadable" }, 500);
   }
   const rows = [];
-  for (const p of payloads) {
-    const sessionId = typeof p.sessionId === "string" ? p.sessionId : null;
-    const capturedUrl = typeof p.url === "string" ? p.url : null;
-    const startedAt = typeof p.startedAt === "string" ? p.startedAt : null;
-    if (!sessionId || !capturedUrl || !startedAt) continue;
-    const displayName = typeof p.displayName === "string" && p.displayName.length > 0 ? p.displayName : sessionId.slice(0, 8);
+  for (const name of entries) {
+    if (!SESSION_ID_RE.test(name)) continue;
+    const sessionId = name.slice(0, -".jsonl".length);
+    const path2 = join13(projectsDir, name);
+    let body;
+    let mtimeMs;
+    try {
+      body = readFileSync14(path2, "utf8");
+      mtimeMs = statSync7(path2).mtimeMs;
+    } catch {
+      continue;
+    }
+    const urlMatch = body.match(RC_URL_RE);
+    if (!urlMatch) continue;
+    const title = firstUserMessage(body) ?? sessionId.slice(0, 8);
     rows.push({
       sessionId,
-      title: displayName,
-      url: capturedUrl,
-      capturedAt: startedAt
+      title,
+      url: urlMatch[0],
+      capturedAt: new Date(mtimeMs).toISOString()
     });
   }
+  rows.sort((a, b) => a.capturedAt < b.capturedAt ? 1 : -1);
   console.log(`[admin-sessions-list] account=${accountId} rows=${rows.length}`);
   return c.json({ sessions: rows });
 });
@@ -11955,14 +12003,14 @@ app25.get("/", async (c) => {
 var system_stats_default = app25;
 
 // server/routes/admin/health.ts
-import { existsSync as existsSync17, readFileSync as readFileSync14 } from "fs";
-import { resolve as resolve17, join as join13 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync15 } from "fs";
+import { resolve as resolve17, join as join14 } from "path";
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve17(process.cwd(), "..");
 var brandHostname = "maxy";
-var brandJsonPath = join13(PLATFORM_ROOT6, "config", "brand.json");
+var brandJsonPath = join14(PLATFORM_ROOT6, "config", "brand.json");
 if (existsSync17(brandJsonPath)) {
   try {
-    const brand = JSON.parse(readFileSync14(brandJsonPath, "utf-8"));
+    const brand = JSON.parse(readFileSync15(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
   } catch {
   }
@@ -11972,7 +12020,7 @@ var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
   if (!existsSync17(VERSION_FILE)) return "unknown";
-  return readFileSync14(VERSION_FILE, "utf-8").trim() || "unknown";
+  return readFileSync15(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
   let session;
@@ -12481,7 +12529,7 @@ var admin_default = app32;
 
 // app/lib/access-gate.ts
 import neo4j4 from "neo4j-driver";
-import { readFileSync as readFileSync15 } from "fs";
+import { readFileSync as readFileSync16 } from "fs";
 import { resolve as resolve18 } from "path";
 import { randomUUID as randomUUID8 } from "crypto";
 var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve18(process.cwd(), "..");
@@ -12490,7 +12538,7 @@ function readPassword() {
   if (process.env.NEO4J_PASSWORD) return process.env.NEO4J_PASSWORD;
   const passwordFile = resolve18(PLATFORM_ROOT7, "config/.neo4j-password");
   try {
-    return readFileSync15(passwordFile, "utf-8").trim();
+    return readFileSync16(passwordFile, "utf-8").trim();
   } catch {
     throw new Error(
       `Neo4j password not found. Expected at ${passwordFile} or in NEO4J_PASSWORD env var.`
@@ -12922,7 +12970,7 @@ app35.route("/request-magic-link", request_magic_link_default);
 var access_default = app35;
 
 // server/routes/sites.ts
-import { existsSync as existsSync18, readFileSync as readFileSync16, realpathSync as realpathSync5, statSync as statSync7 } from "fs";
+import { existsSync as existsSync18, readFileSync as readFileSync17, realpathSync as realpathSync5, statSync as statSync8 } from "fs";
 import { resolve as resolve20 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
@@ -12988,7 +13036,7 @@ app36.get("/:rel{.*}", (c) => {
   }
   let stat8;
   try {
-    stat8 = existsSync18(filePath) ? statSync7(filePath) : null;
+    stat8 = existsSync18(filePath) ? statSync8(filePath) : null;
   } catch {
     stat8 = null;
   }
@@ -13026,7 +13074,7 @@ app36.get("/:rel{.*}", (c) => {
   }
   let body;
   try {
-    body = readFileSync16(realPath);
+    body = readFileSync17(realPath);
   } catch (err) {
     const code = err?.code;
     if (code === "EISDIR") {
@@ -13062,7 +13110,7 @@ var sites_default = app36;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync17, writeFileSync as writeFileSync6 } from "fs";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync18, writeFileSync as writeFileSync6 } from "fs";
 import { dirname as dirname4 } from "path";
 var TOKEN_PREFIX = "v1.";
 var SECRET_BYTES = 32;
@@ -13071,7 +13119,7 @@ var cachedSecret = null;
 function getSecret() {
   if (cachedSecret) return cachedSecret;
   try {
-    const hex2 = readFileSync17(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+    const hex2 = readFileSync18(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
     if (hex2.length === SECRET_BYTES * 2) {
       cachedSecret = Buffer.from(hex2, "hex");
       return cachedSecret;
@@ -13085,7 +13133,7 @@ function getSecret() {
     console.log(`[visitor-token] secret minted path=${VISITOR_TOKEN_SECRET_FILE}`);
   } catch {
   }
-  const hex = readFileSync17(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+  const hex = readFileSync18(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
   cachedSecret = Buffer.from(hex, "hex");
   return cachedSecret;
 }
@@ -13138,8 +13186,8 @@ var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync19, readFileSync as readFileSync18 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync19 } from "fs";
+import { join as join15 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
 function readBrandConfig() {
@@ -13147,10 +13195,10 @@ function readBrandConfig() {
   cachedAttempted = true;
   const platformRoot = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot) return null;
-  const brandPath = join14(platformRoot, "config", "brand.json");
+  const brandPath = join15(platformRoot, "config", "brand.json");
   if (!existsSync19(brandPath)) return null;
   try {
-    cached2 = JSON.parse(readFileSync18(brandPath, "utf-8"));
+    cached2 = JSON.parse(readFileSync19(brandPath, "utf-8"));
     return cached2;
   } catch {
     return null;
@@ -13882,7 +13930,7 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash4, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync20, readFileSync as readFileSync19, statSync as statSync8 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync20, statSync as statSync9 } from "fs";
 import { resolve as resolve22 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
@@ -13934,7 +13982,7 @@ function resolveEntitlement(brand, account) {
   if (!existsSync20(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
-  const stat8 = statSync8(entitlementPath);
+  const stat8 = statSync9(entitlementPath);
   const key = memoKey(stat8.mtimeMs, account);
   if (memo && memo.key === key) {
     return memo.result;
@@ -13946,7 +13994,7 @@ function resolveEntitlement(brand, account) {
 function verifyAndResolve(brand, entitlementPath, account) {
   let pubkeyPem;
   try {
-    pubkeyPem = readFileSync19(pubkeyPath(brand), "utf-8");
+    pubkeyPem = readFileSync20(pubkeyPath(brand), "utf-8");
   } catch (err) {
     return logResolved(anonymousFallback("pubkey-missing"), {
       reason: "pubkey-missing"
@@ -13960,7 +14008,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(readFileSync19(entitlementPath, "utf-8"));
+    envelope = JSON.parse(readFileSync20(entitlementPath, "utf-8"));
   } catch {
     return logResolved(anonymousFallback("malformed"), { reason: "malformed" });
   }
@@ -14121,14 +14169,14 @@ function clientFrom(c) {
   );
 }
 var PLATFORM_ROOT9 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT9 ? join15(PLATFORM_ROOT9, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT9 ? join16(PLATFORM_ROOT9, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
 if (BRAND_JSON_PATH && !existsSync21(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
 if (BRAND_JSON_PATH && existsSync21(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync20(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync21(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -14147,11 +14195,11 @@ var brandLoginOpts = {
   bodyFont: BRAND.defaultFonts?.body,
   logoContainsName: !!BRAND.logoContainsName
 };
-var ALIAS_DOMAINS_PATH = join15(homedir2(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join16(homedir2(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
     if (!existsSync21(ALIAS_DOMAINS_PATH)) return null;
-    const parsed = JSON.parse(readFileSync20(ALIAS_DOMAINS_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync21(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -14528,7 +14576,7 @@ app40.get("/agent-assets/:slug/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync20(filePath);
+  const body = readFileSync21(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
@@ -14558,7 +14606,7 @@ app40.get("/generated/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync20(filePath);
+  const body = readFileSync21(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
@@ -14573,7 +14621,7 @@ var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
 if (BRAND_JSON_PATH && existsSync21(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync20(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync21(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -14590,9 +14638,9 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT9) return "unknown";
-    const versionFile = join15(PLATFORM_ROOT9, "config", `.${BRAND.hostname}-version`);
+    const versionFile = join16(PLATFORM_ROOT9, "config", `.${BRAND.hostname}-version`);
     if (!existsSync21(versionFile)) return "unknown";
-    const content = readFileSync20(versionFile, "utf-8").trim();
+    const content = readFileSync21(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -14633,7 +14681,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync20(resolve23(process.cwd(), "public", file), "utf-8");
+    html = readFileSync21(resolve23(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -14649,26 +14697,26 @@ ${clientErrorReporterScript}
 }
 var brandedHtmlCache = /* @__PURE__ */ new Map();
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join15(homedir2(), BRAND.configDir);
+  const configDir2 = join16(homedir2(), BRAND.configDir);
   try {
-    const accountJsonPath = join15(configDir2, "account.json");
+    const accountJsonPath = join16(configDir2, "account.json");
     if (!existsSync21(accountJsonPath)) return null;
-    const account = JSON.parse(readFileSync20(accountJsonPath, "utf-8"));
+    const account = JSON.parse(readFileSync21(accountJsonPath, "utf-8"));
     const accountId = account.accountId;
     if (!accountId) return null;
-    const cachePath = join15(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    const cachePath = join16(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
     if (!existsSync21(cachePath)) return null;
-    return JSON.parse(readFileSync20(cachePath, "utf-8"));
+    return JSON.parse(readFileSync21(cachePath, "utf-8"));
   } catch {
     return null;
   }
 }
 function resolveDefaultSlug() {
   try {
-    const configDir2 = join15(homedir2(), BRAND.configDir);
-    const accountJsonPath = join15(configDir2, "account.json");
+    const configDir2 = join16(homedir2(), BRAND.configDir);
+    const accountJsonPath = join16(configDir2, "account.json");
     if (!existsSync21(accountJsonPath)) return null;
-    const account = JSON.parse(readFileSync20(accountJsonPath, "utf-8"));
+    const account = JSON.parse(readFileSync21(accountJsonPath, "utf-8"));
     return account.defaultAgent || null;
   } catch {
     return null;
@@ -14741,7 +14789,7 @@ app40.use("/vnc-popout.html", logViewerFetch);
 app40.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync20(resolve23(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync21(resolve23(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -14867,7 +14915,7 @@ try {
 (async () => {
   try {
     if (!existsSync21(USERS_FILE)) return;
-    const usersRaw = readFileSync20(USERS_FILE, "utf-8").trim();
+    const usersRaw = readFileSync21(USERS_FILE, "utf-8").trim();
     if (!usersRaw) return;
     const users = JSON.parse(usersRaw);
     const userId = users[0]?.userId;
@@ -14962,7 +15010,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve23(process.env.MAXY_PLATFORM_ROOT ?? join15(__dirname, "..")),
+  platformRoot: resolve23(process.env.MAXY_PLATFORM_ROOT ?? join16(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (process.env.WHATSAPP_PTY_BRIDGE_ENABLED === "true" && msg.text && !msg.isOwnerMirror) {