@rubytech/create-maxy-code 0.1.196 → 0.1.197

package/payload/server/server.js

@@ -817,7 +817,7 @@ var serveStatic = (options = { root: "" }) => {
 
 // server/index.ts
 import { readFileSync as readFileSync21, existsSync as existsSync21, watchFile } from "fs";
-import { resolve as resolve23, join as join16, basename as basename6 } from "path";
+import { resolve as resolve22, join as join16, basename as basename6 } from "path";
 import { homedir as homedir2 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
@@ -1275,7 +1275,7 @@ var credsSaveQueue = Promise.resolve();
 async function drainCredsSaveQueue(timeoutMs = 5e3) {
   console.error(`${TAG2} draining credential save queue\u2026`);
   const timer2 = new Promise(
-    (resolve24) => setTimeout(() => resolve24("timeout"), timeoutMs)
+    (resolve23) => setTimeout(() => resolve23("timeout"), timeoutMs)
   );
   const result = await Promise.race([
     credsSaveQueue.then(() => "drained"),
@@ -1403,11 +1403,11 @@ async function createWaSocket(opts) {
   return sock;
 }
 async function waitForConnection(sock) {
-  return new Promise((resolve24, reject) => {
+  return new Promise((resolve23, reject) => {
     const handler = (update) => {
       if (update.connection === "open") {
         sock.ev.off("connection.update", handler);
-        resolve24();
+        resolve23();
       }
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
@@ -1521,14 +1521,14 @@ ${inspected}`;
   return inspect2(err, INSPECT_OPTS2);
 }
 function withTimeout(label, promise, timeoutMs) {
-  return new Promise((resolve24, reject) => {
+  return new Promise((resolve23, reject) => {
     const timer2 = setTimeout(() => {
       reject(new Error(`${label} timed out after ${timeoutMs}ms`));
     }, timeoutMs);
     promise.then(
       (value) => {
         clearTimeout(timer2);
-        resolve24(value);
+        resolve23(value);
       },
       (err) => {
         clearTimeout(timer2);
@@ -2063,8 +2063,8 @@ async function persistWhatsAppMessage(input) {
   const { givenName, familyName } = splitName(input.pushName);
   const prev = sessionWriteLocks.get(input.cacheKey);
   let release;
-  const mine = new Promise((resolve24) => {
-    release = resolve24;
+  const mine = new Promise((resolve23) => {
+    release = resolve23;
   });
   const chained = (prev ?? Promise.resolve()).then(() => mine);
   sessionWriteLocks.set(input.cacheKey, chained);
@@ -3100,11 +3100,11 @@ async function connectWithReconnect(conn) {
       console.error(
         `${TAG12} reconnecting account=${conn.accountId} in ${delay}ms (attempt ${decision.nextAttempts}/${maxAttempts})`
       );
-      await new Promise((resolve24) => {
-        const timer2 = setTimeout(resolve24, delay);
+      await new Promise((resolve23) => {
+        const timer2 = setTimeout(resolve23, delay);
         conn.abortController.signal.addEventListener("abort", () => {
           clearTimeout(timer2);
-          resolve24();
+          resolve23();
         }, { once: true });
       });
     }
@@ -3112,16 +3112,16 @@ async function connectWithReconnect(conn) {
   }
 }
 function waitForDisconnectEvent(conn) {
-  return new Promise((resolve24) => {
+  return new Promise((resolve23) => {
     if (!conn.sock) {
-      resolve24();
+      resolve23();
       return;
     }
     const sock = conn.sock;
     const handler = (update) => {
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
-        resolve24();
+        resolve23();
       }
     };
     sock.ev.on("connection.update", handler);
@@ -3383,8 +3383,8 @@ async function handleInboundMessage(conn, msg) {
     const conversationKey = isGroup ? remoteJid : senderPhone;
     const debounceKey = `${conn.accountId}:${conversationKey}:${senderPhone}`;
     let resolvePending;
-    const sttPending = new Promise((resolve24) => {
-      resolvePending = resolve24;
+    const sttPending = new Promise((resolve23) => {
+      resolvePending = resolve23;
     });
     if (conn.debouncer) conn.debouncer.registerPending(debounceKey, sttPending);
     try {
@@ -3788,20 +3788,20 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
 
 // server/routes/health.ts
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve24) => {
+  return new Promise((resolve23) => {
     const socket = createConnection2(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve24(true);
+      resolve23(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve24(false);
+      resolve23(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve24(false);
+      resolve23(false);
     });
   });
 }
@@ -4537,12 +4537,12 @@ async function dispatchOnce(input) {
   });
   if (!entry) return { error: "spawn-failed" };
   entry.lastInboundAt = Date.now();
-  let resolve24;
+  let resolve23;
   const turnPromise = new Promise((r) => {
-    resolve24 = r;
+    resolve23 = r;
   });
   const listener = (text) => {
-    resolve24(text);
+    resolve23(text);
   };
   entry.subscribers.add(listener);
   const writeOk = await writeInput(entry, input.text);
@@ -4984,8 +4984,8 @@ async function startLogin(opts) {
   resetActiveLogin(accountId);
   let resolveQr = null;
   let rejectQr = null;
-  const qrPromise = new Promise((resolve24, reject) => {
-    resolveQr = resolve24;
+  const qrPromise = new Promise((resolve23, reject) => {
+    resolveQr = resolve23;
     rejectQr = reject;
   });
   const qrTimer = setTimeout(
@@ -7966,13 +7966,13 @@ ${fm}
     }
     const skillPaths = parseSkillPathsFromFrontmatter(fm);
     const skills = [];
-    for (const relPath2 of skillPaths) {
-      const skillPath = join10(dir, relPath2);
+    for (const relPath of skillPaths) {
+      const skillPath = join10(dir, relPath);
       const skillFm = readFrontmatter(skillPath);
       if (!skillFm) continue;
       const skillName = frontmatterField(`---
 ${skillFm}
----`, "name") ?? relPath2;
+---`, "name") ?? relPath;
       const skillDesc = frontmatterField(`---
 ${skillFm}
 ---`, "description");
@@ -8391,8 +8391,8 @@ var DATA_ROOT = resolve12(PLATFORM_ROOT5, "..", "data");
 var CLAUDE_UPLOADS_ROOT = process.env.CLAUDE_CONFIG_DIR ? resolve12(process.env.CLAUDE_CONFIG_DIR, "uploads") : null;
 var ACCOUNT_PARTITION_DIRS = /* @__PURE__ */ new Set(["uploads", "accounts"]);
 var ACCOUNT_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function crossesForeignAccountPartition(relPath2, accountId) {
-  const segs = relPath2.split("/").filter(Boolean);
+function crossesForeignAccountPartition(relPath, accountId) {
+  const segs = relPath.split("/").filter(Boolean);
   if (segs.length < 2) return false;
   if (!ACCOUNT_PARTITION_DIRS.has(segs[0])) return false;
   const owner = segs[1];
@@ -8432,8 +8432,8 @@ function resolveUnderRoot(raw, rootAbs, rootLabel) {
   if (resolvedReal !== rootReal && !resolvedReal.startsWith(rootReal + sep2)) {
     return { ok: false, status: 403, error: `Path escapes ${rootLabel}`, resolved: resolvedReal };
   }
-  const relPath2 = relative(rootReal, resolvedReal) || ".";
-  return { ok: true, absolute: resolvedReal, dataRootReal: rootReal, relative: relPath2 };
+  const relPath = relative(rootReal, resolvedReal) || ".";
+  return { ok: true, absolute: resolvedReal, dataRootReal: rootReal, relative: relPath };
 }
 function resolveDataPath(raw) {
   return resolveUnderRoot(raw, DATA_ROOT, "DATA_ROOT");
@@ -8680,8 +8680,8 @@ async function restoreNode(params) {
 
 // app/lib/file-delete-cascade.ts
 var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function parseAttachmentPath(relPath2) {
-  const segments = relPath2.split("/").filter(Boolean);
+function parseAttachmentPath(relPath) {
+  const segments = relPath.split("/").filter(Boolean);
   if (segments.length !== 4) return null;
   if (segments[0] !== "uploads") return null;
   const accountId = segments[1];
@@ -9246,9 +9246,9 @@ async function enrich(absolute, entry, accountNames) {
     }
   }
 }
-function buildDisplayPath(relPath2, accountNames) {
-  if (relPath2 === "." || relPath2 === "") return [];
-  return relPath2.split("/").filter(Boolean).map((seg) => {
+function buildDisplayPath(relPath, accountNames) {
+  if (relPath === "." || relPath === "") return [];
+  return relPath.split("/").filter(Boolean).map((seg) => {
     const dn = UUID_RE3.test(seg) ? accountNames.get(seg) : void 0;
     return dn ? { name: seg, displayName: dn } : { name: seg };
   });
@@ -9286,9 +9286,9 @@ app15.get("/", requireAdminSession, async (c) => {
     }
     return c.json({ error: resolution.error }, resolution.status);
   }
-  const { absolute, relative: relPath2 } = resolution;
-  if (crossesForeignAccountPartition(relPath2, accountId)) {
-    console.error(`[data] account-scope-blocked endpoint="/api/admin/files" path="${relPath2}" account=${accountId.slice(0, 8)}\u2026`);
+  const { absolute, relative: relPath } = resolution;
+  if (crossesForeignAccountPartition(relPath, accountId)) {
+    console.error(`[data] account-scope-blocked endpoint="/api/admin/files" path="${relPath}" account=${accountId.slice(0, 8)}\u2026`);
     return c.json({ error: "Not found" }, 404);
   }
   try {
@@ -9297,7 +9297,7 @@ app15.get("/", requireAdminSession, async (c) => {
       return c.json({ error: "Path is not a directory \u2014 use /api/admin/files/download for files" }, 400);
     }
     const names = await readdir3(absolute);
-    const segs = relPath2.split("/").filter(Boolean);
+    const segs = relPath.split("/").filter(Boolean);
     const isAccountParent = segs.length === 1 && (segs[0] === "accounts" || segs[0] === "uploads");
     const entries = [];
     for (const name of names) {
@@ -9328,17 +9328,17 @@ app15.get("/", requireAdminSession, async (c) => {
       const bKey = b.displayName ?? b.name;
       return aKey.localeCompare(bKey);
     });
-    const displayPath = buildDisplayPath(relPath2, accountNames);
-    console.error(`[data] file-list path="${relPath2}" entries=${entries.length}`);
-    return c.json({ path: relPath2, displayPath, entries });
+    const displayPath = buildDisplayPath(relPath, accountNames);
+    console.error(`[data] file-list path="${relPath}" entries=${entries.length}`);
+    return c.json({ path: relPath, displayPath, entries });
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      console.error(`[data] file-list not-found path="${relPath2}"`);
+      console.error(`[data] file-list not-found path="${relPath}"`);
       return c.json({ error: "Not found" }, 404);
     }
     const message = err instanceof Error ? err.message : String(err);
-    console.error(`[data] file-list error path="${relPath2}" err="${message}"`);
+    console.error(`[data] file-list error path="${relPath}" err="${message}"`);
     return c.json({ error: message }, 500);
   }
 });
@@ -9362,16 +9362,16 @@ app15.get("/download", requireAdminSession, async (c) => {
     }
     return c.json({ error: resolution.error }, resolution.status);
   }
-  const { absolute, relative: relPath2 } = resolution;
+  const { absolute, relative: relPath } = resolution;
   if (root === "claude-uploads") {
-    const attachmentId = relPath2.split("/").filter(Boolean)[0] ?? "";
+    const attachmentId = relPath.split("/").filter(Boolean)[0] ?? "";
     const owned = await knowledgeDocOwnedByAccount(accountId, attachmentId);
     if (!owned) {
       console.error(`[data] account-scope-blocked root="claude-uploads" attachmentId="${attachmentId.slice(0, 8)}\u2026" account=${accountId.slice(0, 8)}\u2026`);
       return c.json({ error: "Not found" }, 404);
     }
-  } else if (crossesForeignAccountPartition(relPath2, accountId)) {
-    console.error(`[data] account-scope-blocked endpoint="/api/admin/files/download" path="${relPath2}" account=${accountId.slice(0, 8)}\u2026`);
+  } else if (crossesForeignAccountPartition(relPath, accountId)) {
+    console.error(`[data] account-scope-blocked endpoint="/api/admin/files/download" path="${relPath}" account=${accountId.slice(0, 8)}\u2026`);
     return c.json({ error: "Not found" }, 404);
   }
   try {
@@ -9383,7 +9383,7 @@ app15.get("/download", requireAdminSession, async (c) => {
     const mimeType = detectMimeType(absolute);
     const nodeStream = createReadStream2(absolute);
     const webStream = Readable2.toWeb(nodeStream);
-    console.error(`[data] file-download root="${root}" path="${relPath2}" size=${info.size}`);
+    console.error(`[data] file-download root="${root}" path="${relPath}" size=${info.size}`);
     const safeQuotedName = filename.replace(/[\r\n"\\]/g, "_");
     const encodedName = encodeURIComponent(filename);
     return new Response(webStream, {
@@ -9398,11 +9398,11 @@ app15.get("/download", requireAdminSession, async (c) => {
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      console.error(`[data] file-download not-found path="${relPath2}"`);
+      console.error(`[data] file-download not-found path="${relPath}"`);
       return c.json({ error: "Not found" }, 404);
     }
     const message = err instanceof Error ? err.message : String(err);
-    console.error(`[data] file-download error path="${relPath2}" err="${message}"`);
+    console.error(`[data] file-download error path="${relPath}" err="${message}"`);
     return c.json({ error: message }, 500);
   }
 });
@@ -9483,15 +9483,15 @@ app15.delete("/", requireAdminSession, async (c) => {
     }
     return c.json({ error: resolution.error }, resolution.status);
   }
-  const { absolute, relative: relPath2 } = resolution;
-  if (crossesForeignAccountPartition(relPath2, accountId)) {
-    console.error(`[data] account-scope-blocked endpoint="DELETE /api/admin/files" path="${relPath2}" account=${accountId.slice(0, 8)}\u2026`);
+  const { absolute, relative: relPath } = resolution;
+  if (crossesForeignAccountPartition(relPath, accountId)) {
+    console.error(`[data] account-scope-blocked endpoint="DELETE /api/admin/files" path="${relPath}" account=${accountId.slice(0, 8)}\u2026`);
     return c.json({ error: "Not found" }, 404);
   }
   const base = basename4(absolute);
-  const segments = relPath2.split("/").filter(Boolean);
+  const segments = relPath.split("/").filter(Boolean);
   if (base === "account.json" || segments.includes(".git")) {
-    console.error(`[data] file-delete blocked path="${relPath2}" reason="protected"`);
+    console.error(`[data] file-delete blocked path="${relPath}" reason="protected"`);
     return c.json({ error: "Protected file \u2014 refusing to delete" }, 403);
   }
   try {
@@ -9512,34 +9512,34 @@ app15.delete("/", requireAdminSession, async (c) => {
       } catch {
       }
     }
-    console.error(`[data] file-delete path="${relPath2}" bytes=${info.size}`);
+    console.error(`[data] file-delete path="${relPath}" bytes=${info.size}`);
     try {
-      await dropFileIndex(accountId, relPath2);
+      await dropFileIndex(accountId, relPath);
     } catch (err) {
-      console.error(`[data] file-delete index-drop-failed path="${relPath2}" err="${err instanceof Error ? err.message : String(err)}"`);
+      console.error(`[data] file-delete index-drop-failed path="${relPath}" err="${err instanceof Error ? err.message : String(err)}"`);
     }
-    const parsed = parseAttachmentPath(relPath2);
+    const parsed = parseAttachmentPath(relPath);
     if (parsed) {
       try {
         const { nodes } = await cascadeDeleteDocument({
           accountId,
           attachmentId: parsed.attachmentId
         });
-        console.error(`[data] file-delete graph-cascade path="${relPath2}" nodes=${nodes}`);
+        console.error(`[data] file-delete graph-cascade path="${relPath}" nodes=${nodes}`);
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
-        console.error(`[data] file-delete graph-cascade-failed path="${relPath2}" err="${message}"`);
+        console.error(`[data] file-delete graph-cascade-failed path="${relPath}" err="${message}"`);
       }
     }
     return c.json({ ok: true });
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      console.error(`[data] file-delete not-found path="${relPath2}"`);
+      console.error(`[data] file-delete not-found path="${relPath}"`);
       return c.json({ error: "Not found" }, 404);
     }
     const message = err instanceof Error ? err.message : String(err);
-    console.error(`[data] file-delete error path="${relPath2}" err="${message}"`);
+    console.error(`[data] file-delete error path="${relPath}" err="${message}"`);
     return c.json({ error: message }, 500);
   }
 });
@@ -11601,7 +11601,6 @@ async function fetchOutputArtefacts(accountId) {
         name: displayName ?? basename5(relativePath),
         kind: "output-file",
         updatedAt: modifiedAt,
-        editable: false,
         mimeType,
         downloadPath: relativePath,
         downloadRoot: "data"
@@ -11628,8 +11627,7 @@ async function fetchAgentTemplateRows(accountDir) {
       overridePath,
       overrideRoot: accountDir,
       bundledPath,
-      bundledRoot: PLATFORM_ROOT,
-      editable: true
+      bundledRoot: PLATFORM_ROOT
     });
     if (row) rows.push(row);
   }
@@ -11646,8 +11644,7 @@ async function fetchAgentTemplateRows(accountDir) {
       overridePath,
       overrideRoot: accountDir,
       bundledPath,
-      bundledRoot: PLATFORM_ROOT,
-      editable: false
+      bundledRoot: PLATFORM_ROOT
     });
     if (row) rows.push(row);
   }
@@ -11700,7 +11697,6 @@ async function readAgentTemplateRow(inp) {
       name: inp.displayName,
       kind: "agent-template",
       updatedAt: st.mtime.toISOString(),
-      editable: inp.editable,
       mimeType: "text/markdown",
       // Override paths live under <accountDir> (inside DATA_ROOT) and are
       // downloadable; bundled-fallback templates live under PLATFORM_ROOT
@@ -11724,83 +11720,13 @@ function isWithin(target, root) {
 }
 var sidebar_artefacts_default = app22;
 
-// server/routes/admin/sidebar-artefact-save.ts
-import { mkdir as mkdir4, stat as stat6, writeFile as writeFile5 } from "fs/promises";
-import { resolve as resolve16 } from "path";
-var ADMIN_AGENT_FILES2 = /* @__PURE__ */ new Set(["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"]);
-var app23 = new Hono();
-app23.post("/", requireAdminSession, async (c) => {
-  const cacheKey = c.var.cacheKey;
-  const accountId = getAccountIdForSession(cacheKey);
-  if (!accountId) return c.json({ error: "Account not found for session" }, 401);
-  const body = await safeJson(c);
-  if (!body || typeof body.id !== "string" || typeof body.content !== "string") {
-    return c.json({ error: "id and content required" }, 400);
-  }
-  const accountDir = resolve16(ACCOUNTS_DIR, accountId);
-  const resolved = await resolveSavePath(body.id, accountDir);
-  if (resolved.kind === "reject") {
-    console.error(
-      `[admin/sidebar-artefact-save] auth-rejected reason=${resolved.reason} path=${body.id}`
-    );
-    return c.json({ error: resolved.reason }, resolved.status);
-  }
-  const start = Date.now();
-  try {
-    await writeFile5(resolved.path, body.content, "utf-8");
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    console.error(
-      `[admin/sidebar-artefact-save] write-failed path=${relPath(resolved.path, accountDir)} error="${message}"`
-    );
-    return c.json({ error: "Write failed" }, 500);
-  }
-  let updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  try {
-    const st = await stat6(resolved.path);
-    updatedAt = st.mtime.toISOString();
-  } catch {
-  }
-  const ms = Date.now() - start;
-  console.log(
-    `[admin/sidebar-artefact-save] account=${accountId} path=${relPath(resolved.path, accountDir)} bytes=${body.content.length} ms=${ms}`
-  );
-  return c.json({ updatedAt });
-});
-async function resolveSavePath(id, accountDir) {
-  if (!id.startsWith("agent-template:")) {
-    return { kind: "reject", status: 400, reason: "invalid-id" };
-  }
-  const parts = id.split(":");
-  if (parts.length !== 3) return { kind: "reject", status: 400, reason: "invalid-id" };
-  const [, role, filename] = parts;
-  if (role === "specialist") {
-    return { kind: "reject", status: 403, reason: "specialist-write-blocked" };
-  }
-  if (role !== "admin" || !ADMIN_AGENT_FILES2.has(filename)) {
-    return { kind: "reject", status: 400, reason: "invalid-id" };
-  }
-  const parent = resolve16(accountDir, "agents", "admin");
-  await mkdir4(parent, { recursive: true });
-  try {
-    validateFilePathInAccount(parent, accountDir);
-  } catch {
-    return { kind: "reject", status: 400, reason: "containment-rejected" };
-  }
-  return { kind: "admin-template", path: resolve16(parent, filename) };
-}
-function relPath(absPath, root) {
-  return absPath.startsWith(root) ? absPath.slice(root.length + 1) : absPath;
-}
-var sidebar_artefact_save_default = app23;
-
 // server/routes/admin/sidebar-sessions.ts
 import { readdirSync as readdirSync8, readFileSync as readFileSync14, statSync as statSync7 } from "fs";
 import { join as join13 } from "path";
 var RC_URL_RE = /https:\/\/claude\.ai\/code\/session_[A-Za-z0-9_-]+/;
 var SESSION_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.jsonl$/i;
 var TITLE_MAX = 80;
-var app24 = new Hono();
+var app23 = new Hono();
 function claudeConfigDir() {
   return process.env.CLAUDE_CONFIG_DIR ?? null;
 }
@@ -11895,7 +11821,7 @@ function firstUserMessage(body) {
   }
   return null;
 }
-app24.get("/", requireAdminSession, async (c) => {
+app23.get("/", requireAdminSession, async (c) => {
   const configDir2 = claudeConfigDir();
   if (!configDir2) {
     console.error("[admin-sessions-list] CLAUDE_CONFIG_DIR not set; returning empty list");
@@ -11947,7 +11873,7 @@ app24.get("/", requireAdminSession, async (c) => {
   );
   return c.json({ sessions: rows });
 });
-var sidebar_sessions_default = app24;
+var sidebar_sessions_default = app23;
 
 // server/routes/admin/system-stats.ts
 import { readFile as readFile5 } from "fs/promises";
@@ -12044,8 +11970,8 @@ async function sample() {
   if (process.platform === "linux") return sampleLinux();
   return sampleOsFallback();
 }
-var app25 = new Hono();
-app25.get("/", async (c) => {
+var app24 = new Hono();
+app24.get("/", async (c) => {
   const started = Date.now();
   if (!inflight) {
     inflight = sample().finally(() => {
@@ -12068,12 +11994,12 @@ app25.get("/", async (c) => {
     return c.json({ degraded: true, reason, sampledAtMs: Date.now() });
   }
 });
-var system_stats_default = app25;
+var system_stats_default = app24;
 
 // server/routes/admin/health.ts
 import { existsSync as existsSync17, readFileSync as readFileSync15 } from "fs";
-import { resolve as resolve17, join as join14 } from "path";
-var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve17(process.cwd(), "..");
+import { resolve as resolve16, join as join14 } from "path";
+var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve16(process.cwd(), "..");
 var brandHostname = "maxy";
 var brandJsonPath = join14(PLATFORM_ROOT6, "config", "brand.json");
 if (existsSync17(brandJsonPath)) {
@@ -12083,7 +12009,7 @@ if (existsSync17(brandJsonPath)) {
   } catch {
   }
 }
-var VERSION_FILE = resolve17(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
+var VERSION_FILE = resolve16(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
@@ -12113,8 +12039,8 @@ async function probeConversationDb() {
     });
   }
 }
-var app26 = new Hono();
-app26.get("/", async (c) => {
+var app25 = new Hono();
+app25.get("/", async (c) => {
   const version = readVersion();
   const probe = await probeConversationDb();
   const uptimeMs = Date.now() - new Date(PROCESS_STARTED_AT).getTime();
@@ -12136,7 +12062,7 @@ app26.get("/", async (c) => {
     uptimeMs
   });
 });
-var health_default2 = app26;
+var health_default2 = app25;
 
 // server/routes/admin/linkedin-ingest.ts
 var TAG20 = "[linkedin-ingest-route]";
@@ -12232,8 +12158,8 @@ function buildInitialMessage(env) {
   }
   return header;
 }
-var app27 = new Hono();
-app27.post("/", requireAdminSession, async (c) => {
+var app26 = new Hono();
+app26.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -12287,7 +12213,7 @@ app27.post("/", requireAdminSession, async (c) => {
   );
   return c.json({ ok: true, dispatchId: envelope.dispatchId, taskId: claudeSessionId }, 202);
 });
-var linkedin_ingest_default = app27;
+var linkedin_ingest_default = app26;
 
 // server/routes/admin/post-turn-context.ts
 import neo4j2 from "neo4j-driver";
@@ -12329,8 +12255,8 @@ function pruneProperties(raw) {
   }
   return out;
 }
-var app28 = new Hono();
-app28.get("/", async (c) => {
+var app27 = new Hono();
+app27.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr2(remoteAddr)) {
     console.error(`${TAG21} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -12390,7 +12316,7 @@ app28.get("/", async (c) => {
     await session.close();
   }
 });
-var post_turn_context_default = app28;
+var post_turn_context_default = app27;
 
 // server/routes/admin/public-session-context.ts
 import neo4j3 from "neo4j-driver";
@@ -12432,8 +12358,8 @@ function pruneProperties2(raw) {
   }
   return out;
 }
-var app29 = new Hono();
-app29.get("/", async (c) => {
+var app28 = new Hono();
+app28.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr3(remoteAddr)) {
     console.error(`${TAG22} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -12492,15 +12418,15 @@ app29.get("/", async (c) => {
     await session.close();
   }
 });
-var public_session_context_default = app29;
+var public_session_context_default = app28;
 
 // server/routes/admin/public-session-exit.ts
 var TAG23 = "[public-session-exit-route]";
 function isLoopbackAddr4(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-var app30 = new Hono();
-app30.post("/", async (c) => {
+var app29 = new Hono();
+app29.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr4(remoteAddr)) {
     console.error(`${TAG23} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -12527,15 +12453,15 @@ app30.post("/", async (c) => {
   handlePublicSessionExit(sessionId);
   return c.json({ ok: true });
 });
-var public_session_exit_default = app30;
+var public_session_exit_default = app29;
 
 // server/routes/admin/access-session-evict.ts
 var TAG24 = "[access-session-evict]";
 function isLoopbackAddr5(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-var app31 = new Hono();
-app31.post("/", async (c) => {
+var app30 = new Hono();
+app30.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr5(remoteAddr)) {
     console.error(`${TAG24} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -12563,48 +12489,47 @@ app31.post("/", async (c) => {
   console.log(`${TAG24} grantId=${grantId} dropped=${dropped}`);
   return c.json({ ok: true, dropped });
 });
-var access_session_evict_default = app31;
+var access_session_evict_default = app30;
 
 // server/routes/admin/index.ts
-var app32 = new Hono();
-app32.route("/session", session_default);
-app32.route("/logs", logs_default);
-app32.route("/claude-info", claude_info_default);
-app32.route("/attachment", attachment_default);
-app32.route("/agents", agents_default);
-app32.route("/sessions", sessions_default);
-app32.route("/claude-sessions", claude_sessions_default);
-app32.route("/log-ingest", log_ingest_default);
-app32.route("/events", events_default);
-app32.route("/files", files_default);
-app32.route("/graph-search", graph_search_default);
-app32.route("/graph-subgraph", graph_subgraph_default);
-app32.route("/graph-delete", graph_delete_default);
-app32.route("/graph-restore", graph_restore_default);
-app32.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app32.route("/graph-default-view", graph_default_view_default);
-app32.route("/sidebar-artefacts", sidebar_artefacts_default);
-app32.route("/sidebar-artefact-save", sidebar_artefact_save_default);
-app32.route("/sidebar-sessions", sidebar_sessions_default);
-app32.route("/system-stats", system_stats_default);
-app32.route("/health-brand", health_default2);
-app32.route("/linkedin-ingest", linkedin_ingest_default);
-app32.route("/post-turn-context", post_turn_context_default);
-app32.route("/public-session-context", public_session_context_default);
-app32.route("/public-session-exit", public_session_exit_default);
-app32.route("/access-session-evict", access_session_evict_default);
-var admin_default = app32;
+var app31 = new Hono();
+app31.route("/session", session_default);
+app31.route("/logs", logs_default);
+app31.route("/claude-info", claude_info_default);
+app31.route("/attachment", attachment_default);
+app31.route("/agents", agents_default);
+app31.route("/sessions", sessions_default);
+app31.route("/claude-sessions", claude_sessions_default);
+app31.route("/log-ingest", log_ingest_default);
+app31.route("/events", events_default);
+app31.route("/files", files_default);
+app31.route("/graph-search", graph_search_default);
+app31.route("/graph-subgraph", graph_subgraph_default);
+app31.route("/graph-delete", graph_delete_default);
+app31.route("/graph-restore", graph_restore_default);
+app31.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app31.route("/graph-default-view", graph_default_view_default);
+app31.route("/sidebar-artefacts", sidebar_artefacts_default);
+app31.route("/sidebar-sessions", sidebar_sessions_default);
+app31.route("/system-stats", system_stats_default);
+app31.route("/health-brand", health_default2);
+app31.route("/linkedin-ingest", linkedin_ingest_default);
+app31.route("/post-turn-context", post_turn_context_default);
+app31.route("/public-session-context", public_session_context_default);
+app31.route("/public-session-exit", public_session_exit_default);
+app31.route("/access-session-evict", access_session_evict_default);
+var admin_default = app31;
 
 // app/lib/access-gate.ts
 import neo4j4 from "neo4j-driver";
 import { readFileSync as readFileSync16 } from "fs";
-import { resolve as resolve18 } from "path";
+import { resolve as resolve17 } from "path";
 import { randomUUID as randomUUID8 } from "crypto";
-var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve18(process.cwd(), "..");
+var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve17(process.cwd(), "..");
 var driver = null;
 function readPassword() {
   if (process.env.NEO4J_PASSWORD) return process.env.NEO4J_PASSWORD;
-  const passwordFile = resolve18(PLATFORM_ROOT7, "config/.neo4j-password");
+  const passwordFile = resolve17(PLATFORM_ROOT7, "config/.neo4j-password");
   try {
     return readFileSync16(passwordFile, "utf-8").trim();
   } catch {
@@ -12807,8 +12732,8 @@ async function generateNewMagicToken(grantId) {
 var TAG25 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
-var app33 = new Hono();
-app33.post("/", async (c) => {
+var app32 = new Hono();
+app32.post("/", async (c) => {
   const ip = c.var.clientIp || "unknown";
   let body;
   try {
@@ -12890,13 +12815,13 @@ app33.post("/", async (c) => {
     displayName: grant.displayName
   });
 });
-var verify_token_default = app33;
+var verify_token_default = app32;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
-import { resolve as resolve19 } from "path";
-var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT ?? resolve19(process.cwd(), "..");
-var SEND_SCRIPT = resolve19(
+import { resolve as resolve18 } from "path";
+var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT ?? resolve18(process.cwd(), "..");
+var SEND_SCRIPT = resolve18(
   PLATFORM_ROOT8,
   "plugins",
   "email",
@@ -12953,9 +12878,9 @@ async function sendMagicLinkEmail(payload) {
 
 // server/routes/access/request-magic-link.ts
 var TAG26 = "[access-request-link]";
-var app34 = new Hono();
+var app33 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
-app34.post("/", async (c) => {
+app33.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -13029,17 +12954,17 @@ app34.post("/", async (c) => {
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
-var request_magic_link_default = app34;
+var request_magic_link_default = app33;
 
 // server/routes/access/index.ts
-var app35 = new Hono();
-app35.route("/verify-token", verify_token_default);
-app35.route("/request-magic-link", request_magic_link_default);
-var access_default = app35;
+var app34 = new Hono();
+app34.route("/verify-token", verify_token_default);
+app34.route("/request-magic-link", request_magic_link_default);
+var access_default = app34;
 
 // server/routes/sites.ts
 import { existsSync as existsSync18, readFileSync as readFileSync17, realpathSync as realpathSync5, statSync as statSync8 } from "fs";
-import { resolve as resolve20 } from "path";
+import { resolve as resolve19 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
   ".html": "text/html; charset=utf-8",
@@ -13070,8 +12995,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app36 = new Hono();
-app36.get("/:rel{.*}", (c) => {
+var app35 = new Hono();
+app35.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -13096,19 +13021,19 @@ app36.get("/:rel{.*}", (c) => {
     }
     segments.push(seg);
   }
-  const rootDir = resolve20(account.accountDir, "sites");
-  let filePath = segments.length === 0 ? rootDir : resolve20(rootDir, ...segments);
+  const rootDir = resolve19(account.accountDir, "sites");
+  let filePath = segments.length === 0 ? rootDir : resolve19(rootDir, ...segments);
   if (filePath !== rootDir && !filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  let stat8;
+  let stat7;
   try {
-    stat8 = existsSync18(filePath) ? statSync8(filePath) : null;
+    stat7 = existsSync18(filePath) ? statSync8(filePath) : null;
   } catch {
-    stat8 = null;
+    stat7 = null;
   }
-  if (stat8?.isDirectory() && !reqPath.endsWith("/")) {
+  if (stat7?.isDirectory() && !reqPath.endsWith("/")) {
     const search = new URL(c.req.url).search;
     const target = `${reqPath}/${search}`;
     console.log(
@@ -13116,8 +13041,8 @@ app36.get("/:rel{.*}", (c) => {
     );
     return c.redirect(target, 301);
   }
-  if (stat8?.isDirectory()) {
-    filePath = resolve20(filePath, "index.html");
+  if (stat7?.isDirectory()) {
+    filePath = resolve19(filePath, "index.html");
   }
   if (!filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
@@ -13174,7 +13099,7 @@ app36.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app36;
+var sites_default = app35;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
@@ -13274,7 +13199,7 @@ function readBrandConfig() {
 }
 
 // server/routes/visitor-consent.ts
-var app37 = new Hono();
+var app36 = new Hono();
 var CONSENT_COOKIE_NAME = "mxy_consent";
 var CONSENT_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
 var DEFAULT_CONSENT_COPY = {
@@ -13319,17 +13244,17 @@ function siteSlugFromReferer(referer) {
     return "";
   }
 }
-app37.options("/consent", (c) => {
+app36.options("/consent", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app37.options("/brand-config", (c) => {
+app36.options("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app37.post("/consent", async (c) => {
+app36.post("/consent", async (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   let raw;
@@ -13369,7 +13294,7 @@ app37.post("/consent", async (c) => {
   console.log(`[consent] ${parsed.decision} site=${site} brand=${brandName} tokenBound=${tokenBound}`);
   return c.body(null, 204);
 });
-app37.get("/brand-config", (c) => {
+app36.get("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   const brand = readBrandConfig();
@@ -13379,7 +13304,7 @@ app37.get("/brand-config", (c) => {
   c.header("Cache-Control", "public, max-age=300");
   return c.json({ consent: { copy, palette } });
 });
-var visitor_consent_default = app37;
+var visitor_consent_default = app36;
 
 // server/routes/listings.ts
 function getCookie(headerValue, name) {
@@ -13406,8 +13331,8 @@ function appendConsentParams(pageUrl, token) {
 }
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
 var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
-var app38 = new Hono();
-app38.get("/:slug/click", async (c) => {
+var app37 = new Hono();
+app37.get("/:slug/click", async (c) => {
   const slug = c.req.param("slug") ?? "";
   const rawSession = c.req.query("session") ?? "";
   const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
@@ -13471,10 +13396,10 @@ app38.get("/:slug/click", async (c) => {
   console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} consent=${consentCookie ?? "absent"} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
   return c.redirect(redirectUrl, 302);
 });
-var listings_default = app38;
+var listings_default = app37;
 
 // server/routes/visitor-event.ts
-var app39 = new Hono();
+var app38 = new Hono();
 var BOT_UA_RE = /\b(bot|crawl|spider|slurp|headlesschrome|phantomjs|googlebot|bingbot|yandex|baiduspider|ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)\b/i;
 var buckets = /* @__PURE__ */ new Map();
 var RATE_LIMIT = 60;
@@ -13541,12 +13466,12 @@ function originAllowed(origin, allowlist) {
     return false;
   }
 }
-app39.options("/event", (c) => {
+app38.options("/event", (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   return c.body(null, 204);
 });
-app39.post("/event", async (c) => {
+app38.post("/event", async (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   const ua = c.req.header("user-agent") ?? "";
@@ -13751,7 +13676,7 @@ async function writeEvent(opts) {
     );
   }
 }
-var visitor_event_default = app39;
+var visitor_event_default = app38;
 
 // app/lib/graph-health.ts
 var HOUR_MS = 60 * 60 * 1e3;
@@ -13836,7 +13761,7 @@ function startGraphHealthTimer() {
 
 // app/lib/file-watcher.ts
 import * as fsp2 from "fs/promises";
-import { resolve as resolve21, sep as sep6 } from "path";
+import { resolve as resolve20, sep as sep6 } from "path";
 var ACCOUNT_UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var DEFAULT_COALESCE_MS = 500;
 var ROOTS = ["uploads", "accounts"];
@@ -13855,7 +13780,7 @@ async function startFileWatcher(opts = {}) {
   const dropFn = opts.drop ?? dropFileIndex;
   for (const r of ROOTS) {
     try {
-      await fsp2.mkdir(resolve21(dataRoot, r), { recursive: true });
+      await fsp2.mkdir(resolve20(dataRoot, r), { recursive: true });
     } catch (err) {
       console.error(
         `[file-watcher] start-failed root="${r}" err="${err.message}" \u2014 index will be maintained by the 5-min reconcile backstop only`
@@ -13876,7 +13801,7 @@ async function startFileWatcher(opts = {}) {
     timers.set(relativePath, t);
   }
   async function runHook(relativePath, accountId) {
-    const absolute = resolve21(dataRoot, relativePath);
+    const absolute = resolve20(dataRoot, relativePath);
     let exists = false;
     try {
       const st = await fsp2.stat(absolute);
@@ -13900,7 +13825,7 @@ async function startFileWatcher(opts = {}) {
     }
   }
   async function watchRoot(rootName) {
-    const absRoot = resolve21(dataRoot, rootName);
+    const absRoot = resolve20(dataRoot, rootName);
     try {
       const iter = fsp2.watch(absRoot, { recursive: true, signal: controller.signal });
       for await (const event of iter) {
@@ -13999,7 +13924,7 @@ function broadcastAdminShutdown(reason) {
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash4, verify as cryptoVerify } from "crypto";
 import { existsSync as existsSync20, readFileSync as readFileSync20, statSync as statSync9 } from "fs";
-import { resolve as resolve22 } from "path";
+import { resolve as resolve21 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
 function canonicalize(value) {
@@ -14034,7 +13959,7 @@ var PUBKEY_SHA256 = "8eee6bcb33545fd13b16d3199a5735ca5db5062834c7b49dfe4f23801d9
 var GRACE_DAYS = 7;
 var GRACE_MS = GRACE_DAYS * 24 * 60 * 60 * 1e3;
 function pubkeyPath(brand) {
-  return resolve22(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
+  return resolve21(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
 }
 var memo = null;
 function memoKey(mtimeMs, account) {
@@ -14046,12 +13971,12 @@ function resolveEntitlement(brand, account) {
   if (brand.commercialMode !== true) {
     return logResolved(implicitTrust(account), null);
   }
-  const entitlementPath = resolve22(brand.configDir, "entitlement.json");
+  const entitlementPath = resolve21(brand.configDir, "entitlement.json");
   if (!existsSync20(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
-  const stat8 = statSync9(entitlementPath);
-  const key = memoKey(stat8.mtimeMs, account);
+  const stat7 = statSync9(entitlementPath);
+  const key = memoKey(stat7.mtimeMs, account);
   if (memo && memo.key === key) {
     return memo.result;
   }
@@ -14291,9 +14216,9 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app40 = new Hono();
-app40.use("*", clientIpMiddleware);
-app40.use("*", async (c, next) => {
+var app39 = new Hono();
+app39.use("*", clientIpMiddleware);
+app39.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -14303,7 +14228,7 @@ app40.use("*", async (c, next) => {
   );
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app40.use("*", async (c, next) => {
+app39.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -14336,7 +14261,7 @@ var PUBLIC_ALLOWED_PREFIXES = [
   "/sites/"
 ];
 var PUBLIC_ALLOWED_EXACT = ["/favicon.ico"];
-app40.use("*", async (c, next) => {
+app39.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (!isPublicHost(host)) {
     await next();
@@ -14376,7 +14301,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app40.post("/__remote-auth/login", async (c) => {
+app39.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -14421,7 +14346,7 @@ app40.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app40.get("/__remote-auth/logout", (c) => {
+app39.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -14434,7 +14359,7 @@ app40.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app40.post("/__remote-auth/change-password", async (c) => {
+app39.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -14485,13 +14410,13 @@ app40.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app40.get("/__remote-auth/setup", (c) => {
+app39.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app40.post("/__remote-auth/set-initial-password", async (c) => {
+app39.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -14529,10 +14454,10 @@ app40.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app40.get("/api/remote-auth/status", (c) => {
+app39.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app40.post("/api/remote-auth/set-password", async (c) => {
+app39.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -14563,9 +14488,9 @@ app40.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app40.route("/api/_client-error", client_error_default);
+app39.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
-app40.use("*", async (c, next) => {
+app39.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
@@ -14598,12 +14523,12 @@ app40.use("*", async (c, next) => {
   console.error(`[remote-auth] login required ip=${clientIp} path=${path2} ${disambig}`);
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), redirect: path2 }), 200);
 });
-app40.route("/api/health", health_default);
-app40.route("/api/chat", chat_default);
-app40.route("/api/whatsapp", whatsapp_default);
-app40.route("/api/onboarding", onboarding_default);
-app40.route("/api/admin", admin_default);
-app40.route("/api/access", access_default);
+app39.route("/api/health", health_default);
+app39.route("/api/chat", chat_default);
+app39.route("/api/whatsapp", whatsapp_default);
+app39.route("/api/onboarding", onboarding_default);
+app39.route("/api/admin", admin_default);
+app39.route("/api/access", access_default);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -14615,7 +14540,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app40.get("/agent-assets/:slug/:filename", (c) => {
+app39.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -14631,8 +14556,8 @@ app40.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve23(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve23(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve22(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve22(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
@@ -14650,7 +14575,7 @@ app40.get("/agent-assets/:slug/:filename", (c) => {
     "Cache-Control": "public, max-age=3600"
   });
 });
-app40.get("/generated/:filename", (c) => {
+app39.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -14661,8 +14586,8 @@ app40.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve23(account.accountDir, "generated", filename);
-  const expectedDir = resolve23(account.accountDir, "generated");
+  const filePath = resolve22(account.accountDir, "generated", filename);
+  const expectedDir = resolve22(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
@@ -14680,10 +14605,10 @@ app40.get("/generated/:filename", (c) => {
     "Cache-Control": "public, max-age=86400"
   });
 });
-app40.route("/sites", sites_default);
-app40.route("/listings", listings_default);
-app40.route("/v", visitor_event_default);
-app40.route("/v", visitor_consent_default);
+app39.route("/sites", sites_default);
+app39.route("/listings", listings_default);
+app39.route("/v", visitor_event_default);
+app39.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
@@ -14749,7 +14674,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync21(resolve23(process.cwd(), "public", file), "utf-8");
+    html = readFileSync21(resolve22(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -14820,7 +14745,7 @@ function brandedPublicHtml(agentSlug) {
 function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-app40.get("/", (c) => {
+app39.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) {
     const defaultSlug = resolveDefaultSlug();
@@ -14828,12 +14753,12 @@ app40.get("/", (c) => {
   }
   return c.html(cachedHtml("index.html"));
 });
-app40.get("/public", (c) => {
+app39.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app40.get("/chat", (c) => {
+app39.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -14852,12 +14777,12 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app40.use("/vnc-viewer.html", logViewerFetch);
-app40.use("/vnc-popout.html", logViewerFetch);
-app40.get("/vnc-popout.html", (c) => {
+app39.use("/vnc-viewer.html", logViewerFetch);
+app39.use("/vnc-popout.html", logViewerFetch);
+app39.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync21(resolve23(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync21(resolve22(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -14867,7 +14792,7 @@ app40.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app40.post("/api/vnc/client-event", async (c) => {
+app39.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -14888,25 +14813,25 @@ app40.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app40.get("/g/:slug", (c) => {
+app39.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
-app40.get("/graph", (c) => {
+app39.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app40.get("/sessions", (c) => {
+app39.get("/sessions", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("sessions.html"));
 });
-app40.get("/data", (c) => {
+app39.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app40.get("/:slug", async (c, next) => {
+app39.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const branding = loadBrandingCache(slug);
@@ -14916,15 +14841,15 @@ app40.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app40.get("/favicon.ico", (c) => {
+  app39.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app40.use("/*", serveStatic({ root: "./public" }));
+app39.use("/*", serveStatic({ root: "./public" }));
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app40.fetch, port, hostname });
+var httpServer = serve({ fetch: app39.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const loopHist = monitorEventLoopDelay({ resolution: 50 });
@@ -14960,7 +14885,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app40.routes ?? []) {
+  for (const r of app39.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -15078,7 +15003,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve23(process.env.MAXY_PLATFORM_ROOT ?? join16(__dirname, "..")),
+  platformRoot: resolve22(process.env.MAXY_PLATFORM_ROOT ?? join16(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (process.env.WHATSAPP_PTY_BRIDGE_ENABLED === "true" && msg.text && !msg.isOwnerMirror) {