@rubytech/create-maxy-code 0.1.238 → 0.1.240

package/payload/server/server.js

@@ -19,7 +19,9 @@ import {
   VNC_DISPLAY,
   WEBSOCKIFY_PORT,
   autoDeliverPremiumPlugins,
+  bindVisitorToGroup,
   canAccessAdmin,
+  checkGroupMembership,
   checkRateLimit,
   cleanupLeakedPremiumSubs,
   clearRateLimit,
@@ -31,11 +33,15 @@ import {
   emitMissingOnResolve,
   ensureConversation,
   fetchBranding,
+  findGroupBySlug,
   findMissingPlugins,
+  findRecentConversation,
   fingerprintSessionKey,
   getAccountIdForSession,
   getAgentSessionIdForConversation,
   getConversationClaudeSessionIds,
+  getDefaultAccountId,
+  getGroupParticipants,
   getRecentMessages,
   getRoleForSession,
   getSession,
@@ -76,6 +82,7 @@ import {
   stripAttachmentMetaSuffix,
   tryCookieBridgeForConversation,
   unregisterSession,
+  validateAgentSlug,
   validatePasswordStrength,
   validateSession,
   verifyAndGetConversationUpdatedAt,
@@ -84,7 +91,7 @@ import {
   vncLog,
   walkPremiumBundles,
   writeAdminUserAndPerson
-} from "./chunk-63M3ILJ6.js";
+} from "./chunk-ZY6W3UA2.js";
 import {
   __commonJS,
   __toESM
@@ -816,14 +823,37 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync22, existsSync as existsSync22, watchFile } from "fs";
-import { resolve as resolve24, join as join17, basename as basename6 } from "path";
+import { readFileSync as readFileSync22, existsSync as existsSync23, watchFile } from "fs";
+import { resolve as resolve25, join as join17, basename as basename6 } from "path";
 import { homedir as homedir2 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
 // app/lib/agent-slug-pattern.ts
 var AGENT_SLUG_PATTERN = /^\/([a-z][a-z0-9-]{2,49})$/;
 
+// server/public-host-gate.ts
+var PUBLIC_ALLOWED_PREFIXES = [
+  "/api/session",
+  "/api/chat",
+  "/api/access/",
+  "/api/health",
+  "/api/group/",
+  "/api/telegram/",
+  "/assets/",
+  "/brand/",
+  "/agent-assets/",
+  "/generated/",
+  "/g/",
+  "/sites/"
+];
+var PUBLIC_ALLOWED_EXACT = ["/favicon.ico", "/brand-defaults.css"];
+function isPublicPathAllowed(path2) {
+  if (path2 === "/") return true;
+  if (PUBLIC_ALLOWED_EXACT.includes(path2)) return true;
+  if (PUBLIC_ALLOWED_PREFIXES.some((prefix) => path2.startsWith(prefix))) return true;
+  return AGENT_SLUG_PATTERN.test(path2);
+}
+
 // app/lib/claude-auth.ts
 import { readFileSync, writeFileSync } from "fs";
 import { sep } from "path";
@@ -1317,7 +1347,7 @@ var credsSaveQueue = Promise.resolve();
 async function drainCredsSaveQueue(timeoutMs = 5e3) {
   console.error(`${TAG2} draining credential save queue\u2026`);
   const timer2 = new Promise(
-    (resolve25) => setTimeout(() => resolve25("timeout"), timeoutMs)
+    (resolve26) => setTimeout(() => resolve26("timeout"), timeoutMs)
   );
   const result = await Promise.race([
     credsSaveQueue.then(() => "drained"),
@@ -1445,11 +1475,11 @@ async function createWaSocket(opts) {
   return sock;
 }
 async function waitForConnection(sock) {
-  return new Promise((resolve25, reject) => {
+  return new Promise((resolve26, reject) => {
     const handler = (update) => {
       if (update.connection === "open") {
         sock.ev.off("connection.update", handler);
-        resolve25();
+        resolve26();
       }
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
@@ -1563,14 +1593,14 @@ ${inspected}`;
   return inspect2(err, INSPECT_OPTS2);
 }
 function withTimeout(label, promise, timeoutMs) {
-  return new Promise((resolve25, reject) => {
+  return new Promise((resolve26, reject) => {
     const timer2 = setTimeout(() => {
       reject(new Error(`${label} timed out after ${timeoutMs}ms`));
     }, timeoutMs);
     promise.then(
       (value) => {
         clearTimeout(timer2);
-        resolve25(value);
+        resolve26(value);
       },
       (err) => {
         clearTimeout(timer2);
@@ -2105,8 +2135,8 @@ async function persistWhatsAppMessage(input) {
   const { givenName, familyName } = splitName(input.pushName);
   const prev = sessionWriteLocks.get(input.cacheKey);
   let release;
-  const mine = new Promise((resolve25) => {
-    release = resolve25;
+  const mine = new Promise((resolve26) => {
+    release = resolve26;
   });
   const chained = (prev ?? Promise.resolve()).then(() => mine);
   sessionWriteLocks.set(input.cacheKey, chained);
@@ -3142,11 +3172,11 @@ async function connectWithReconnect(conn) {
       console.error(
         `${TAG12} reconnecting account=${conn.accountId} in ${delay}ms (attempt ${decision.nextAttempts}/${maxAttempts})`
       );
-      await new Promise((resolve25) => {
-        const timer2 = setTimeout(resolve25, delay);
+      await new Promise((resolve26) => {
+        const timer2 = setTimeout(resolve26, delay);
         conn.abortController.signal.addEventListener("abort", () => {
           clearTimeout(timer2);
-          resolve25();
+          resolve26();
         }, { once: true });
       });
     }
@@ -3154,16 +3184,16 @@ async function connectWithReconnect(conn) {
   }
 }
 function waitForDisconnectEvent(conn) {
-  return new Promise((resolve25) => {
+  return new Promise((resolve26) => {
     if (!conn.sock) {
-      resolve25();
+      resolve26();
       return;
     }
     const sock = conn.sock;
     const handler = (update) => {
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
-        resolve25();
+        resolve26();
       }
     };
     sock.ev.on("connection.update", handler);
@@ -3425,8 +3455,8 @@ async function handleInboundMessage(conn, msg) {
     const conversationKey = isGroup ? remoteJid : senderPhone;
     const debounceKey = `${conn.accountId}:${conversationKey}:${senderPhone}`;
     let resolvePending;
-    const sttPending = new Promise((resolve25) => {
-      resolvePending = resolve25;
+    const sttPending = new Promise((resolve26) => {
+      resolvePending = resolve26;
     });
     if (conn.debouncer) conn.debouncer.registerPending(debounceKey, sttPending);
     try {
@@ -3830,20 +3860,20 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
 
 // server/routes/health.ts
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve25) => {
+  return new Promise((resolve26) => {
     const socket = createConnection2(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve25(true);
+      resolve26(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve25(false);
+      resolve26(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve25(false);
+      resolve26(false);
     });
   });
 }
@@ -4579,12 +4609,12 @@ async function dispatchOnce(input) {
   });
   if (!entry) return { error: "spawn-failed" };
   entry.lastInboundAt = Date.now();
-  let resolve25;
+  let resolve26;
   const turnPromise = new Promise((r) => {
-    resolve25 = r;
+    resolve26 = r;
   });
   const listener = (text) => {
-    resolve25(text);
+    resolve26(text);
   };
   entry.subscribers.add(listener);
   const writeOk = await writeInput(entry, input.text);
@@ -5026,8 +5056,8 @@ async function startLogin(opts) {
   resetActiveLogin(accountId);
   let resolveQr = null;
   let rejectQr = null;
-  const qrPromise = new Promise((resolve25, reject) => {
-    resolveQr = resolve25;
+  const qrPromise = new Promise((resolve26, reject) => {
+    resolveQr = resolve26;
     rejectQr = reject;
   });
   const qrTimer = setTimeout(
@@ -7147,7 +7177,7 @@ app10.post("/:slug/project", async (c) => {
 var agents_default = app10;
 
 // server/routes/admin/sessions.ts
-import crypto from "crypto";
+import crypto2 from "crypto";
 import { resolve as resolvePath } from "path";
 import { existsSync as existsSync13, mkdirSync as mkdirSync3, createWriteStream } from "fs";
 
@@ -7456,7 +7486,7 @@ app11.post("/new", requireAdminSession, async (c) => {
     console.error(`[admin-chat] new-conversation outcome=fail reason=missing-account-or-user cacheKey=${oldCacheKey.slice(0, 8)}`);
     return c.json({ error: "Session missing account or user context" }, 400);
   }
-  const newSignedSessionToken = crypto.randomUUID();
+  const newSignedSessionToken = crypto2.randomUUID();
   const newCacheKey = fingerprintSessionKey(newSignedSessionToken);
   const userName = getUserNameForSession(oldCacheKey);
   registerSession(newCacheKey, "admin", accountId, void 0, userId, userName);
@@ -12055,7 +12085,7 @@ function isPidAlive(pid) {
   }
 }
 function sleep2(ms) {
-  return new Promise((resolve25) => setTimeout(resolve25, ms));
+  return new Promise((resolve26) => setTimeout(resolve26, ms));
 }
 function sendSignal(pid, signal) {
   try {
@@ -14037,6 +14067,244 @@ async function writeEvent(opts) {
 }
 var visitor_event_default = app40;
 
+// server/routes/session.ts
+import { resolve as resolve22 } from "path";
+import { existsSync as existsSync21, writeFileSync as writeFileSync7, mkdirSync as mkdirSync5 } from "fs";
+var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function writeBrandingCache(accountId, agentSlug, branding) {
+  try {
+    const cacheDir = resolve22(MAXY_DIR, "branding-cache", accountId);
+    mkdirSync5(cacheDir, { recursive: true });
+    writeFileSync7(resolve22(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
+  } catch (err) {
+    console.error(`[branding] cache write failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+function parseVisitorCookie(cookieHeader) {
+  if (!cookieHeader) return null;
+  const match = cookieHeader.match(/(?:^|;\s*)maxy_visitor=([^;]*)/);
+  if (!match) return null;
+  const value = decodeURIComponent(match[1]).trim();
+  return UUID_RE4.test(value) ? value : null;
+}
+function parseAccessSessionId(cookieHeader) {
+  if (!cookieHeader) return null;
+  const part = cookieHeader.split(";").map((p) => p.trim()).find((p) => p.startsWith("__access_session="));
+  return part ? part.slice("__access_session=".length) : null;
+}
+function withVisitorCookie(response, visitorId) {
+  if (!visitorId) return response;
+  const headers = new Headers(response.headers);
+  headers.set("Set-Cookie", `maxy_visitor=${visitorId}; Path=/; Max-Age=86400; SameSite=Lax`);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+var app41 = new Hono();
+app41.post("/", async (c) => {
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "Invalid request" }, 400);
+  }
+  if (!body.session_id || typeof body.session_id !== "string") {
+    return c.json({ error: "session_id required" }, 400);
+  }
+  const accountId = getDefaultAccountId();
+  if (!accountId) {
+    console.error("[session] getDefaultAccountId() returned null \u2014 no account configured");
+    return c.json({ error: "No account configured" }, 503);
+  }
+  const account = resolveAccount();
+  const cookieHeader = c.req.header("cookie");
+  const visitorId = parseVisitorCookie(cookieHeader);
+  const groupSlug = body.group_slug && typeof body.group_slug === "string" ? body.group_slug : null;
+  let groupInfo = null;
+  if (groupSlug) {
+    groupInfo = await findGroupBySlug(groupSlug, accountId).catch(() => null);
+    if (!groupInfo) {
+      console.error(`[session] group not found: slug=${groupSlug} account=${accountId.slice(0, 8)}\u2026`);
+      return c.json({ error: "Group not found" }, 404);
+    }
+  }
+  let agentSlug = null;
+  if (groupInfo) {
+    agentSlug = groupInfo.agentSlug;
+  } else if (body.agent) {
+    if (!validateAgentSlug(body.agent)) {
+      return c.json({ error: "Invalid agent name" }, 400);
+    }
+    agentSlug = body.agent;
+  } else {
+    agentSlug = account ? resolveDefaultAgentSlug(account.accountDir) : null;
+    if (agentSlug) {
+      console.log(`[session] using defaultAgent=${agentSlug} (no agent param)`);
+    }
+  }
+  if (!agentSlug) {
+    console.error("[session] no agent resolved");
+    return c.json({ error: "No agents configured" }, 404);
+  }
+  let agentConfig = null;
+  if (account) {
+    const agentDir = resolve22(account.accountDir, "agents", agentSlug);
+    if (!existsSync21(agentDir) || !existsSync21(resolve22(agentDir, "config.json"))) {
+      return c.json({ error: "Agent not found" }, 404);
+    }
+    agentConfig = resolveAgentConfig(account.accountDir, agentSlug);
+  }
+  const agentIdentity = agentConfig ? {
+    ...agentConfig.displayName ? { displayName: agentConfig.displayName } : {},
+    ...agentConfig.image ? { agentImage: agentConfig.image } : {},
+    ...agentConfig.imageShape ? { agentImageShape: agentConfig.imageShape } : {},
+    ...agentConfig.showAgentName ? { showAgentName: agentConfig.showAgentName } : {}
+  } : {};
+  const groupFields = groupInfo ? {
+    group: true,
+    groupName: groupInfo.groupName,
+    groupSlug
+  } : {};
+  const branding = await fetchBranding(accountId).catch(() => null);
+  if (branding) writeBrandingCache(accountId, agentSlug, branding);
+  let accessSession = null;
+  if (agentConfig && agentConfig.accessMode !== "open") {
+    const accessSessionId = parseAccessSessionId(cookieHeader);
+    accessSession = accessSessionId ? getAccessSession(accessSessionId) : null;
+    if (!accessSession || accessSession.agentSlug !== agentSlug) {
+      console.log(`[session] agent=${agentSlug} accessMode=${agentConfig.accessMode} \u2014 auth required`);
+      return withVisitorCookie(
+        Response.json({
+          auth_required: true,
+          agent_id: agentSlug,
+          ...groupFields,
+          ...branding ? { branding } : {},
+          ...agentIdentity
+        }),
+        null
+      );
+    }
+  }
+  if (body.session_key && typeof body.session_key === "string" && UUID_RE4.test(body.session_key)) {
+    if (visitorId) {
+      const recent = await findRecentConversation(visitorId, accountId, agentSlug).catch(() => null);
+      if (recent) {
+        const neo4jMessages = await getRecentMessages(recent.sessionId).catch(() => []);
+        const uiMessages = neo4jMessages.filter((m) => m.content !== GREETING_DIRECTIVE).map((m) => ({
+          role: m.role === "user" ? "visitor" : "maxy",
+          content: m.content,
+          timestamp: new Date(m.createdAt).getTime() || Date.now()
+        }));
+        const resumed = uiMessages.length > 0;
+        console.log(`[session] hot-resume session=${body.session_key.slice(0, 8)}\u2026 messages=${uiMessages.length}`);
+        return c.json({
+          session_key: body.session_key,
+          agent_id: agentSlug,
+          resumed,
+          ...resumed ? { messages: uiMessages } : {},
+          ...groupFields,
+          ...branding ? { branding } : {},
+          ...agentIdentity
+        });
+      }
+    }
+    console.log(`[session] hot-resume session=${body.session_key.slice(0, 8)}\u2026 (no cookie/conversation)`);
+    return c.json({
+      session_key: body.session_key,
+      agent_id: agentSlug,
+      resumed: false,
+      ...groupFields,
+      ...branding ? { branding } : {},
+      ...agentIdentity
+    });
+  }
+  if (groupInfo && visitorId) {
+    let memberName = await checkGroupMembership(groupInfo.sessionId, visitorId).catch(() => null);
+    if (!memberName && accessSession) {
+      const contactValue = accessSession.contactValue;
+      const isEmail = contactValue?.includes("@");
+      const bindResult = await bindVisitorToGroup(
+        groupInfo.sessionId,
+        visitorId,
+        isEmail ? contactValue : void 0,
+        !isEmail ? contactValue : void 0
+      ).catch(() => null);
+      memberName = bindResult?.displayName ?? null;
+    }
+    if (memberName) {
+      const neo4jMessages = await getRecentMessages(groupInfo.sessionId).catch(() => []);
+      const uiMessages = neo4jMessages.filter((m) => m.content !== GREETING_DIRECTIVE).map((m) => ({
+        role: m.role === "user" ? "visitor" : "maxy",
+        content: m.content,
+        timestamp: new Date(m.createdAt).getTime() || Date.now()
+      }));
+      const participants = await getGroupParticipants(groupInfo.sessionId).catch(() => []);
+      const cacheKey2 = crypto.randomUUID();
+      const resumed = uiMessages.length > 0;
+      console.log(`[session] cold-resume group=${groupSlug} visitor=${visitorId.slice(0, 8)}\u2026 messages=${uiMessages.length}`);
+      return withVisitorCookie(
+        Response.json({
+          session_key: cacheKey2,
+          agent_id: agentSlug,
+          resumed,
+          ...resumed ? { messages: uiMessages } : {},
+          ...groupFields,
+          participants: participants.map((p) => ({ displayName: p.displayName, joinedAt: p.joinedAt })),
+          ...branding ? { branding } : {},
+          ...agentIdentity
+        }),
+        visitorId
+      );
+    }
+    console.log(`[session] group cold-resume denied: visitor=${visitorId.slice(0, 8)}\u2026 not a member of group=${groupSlug}`);
+    return c.json({ error: "Not a member of this group" }, 403);
+  }
+  if (groupInfo) {
+    console.error(`[session] group=${groupSlug} requires visitor cookie`);
+    return c.json({ error: "Groups require member authentication" }, 400);
+  }
+  if (visitorId) {
+    const recent = await findRecentConversation(visitorId, accountId, agentSlug).catch(() => null);
+    if (recent) {
+      const neo4jMessages = await getRecentMessages(recent.sessionId).catch(() => []);
+      const uiMessages = neo4jMessages.filter((m) => m.content !== GREETING_DIRECTIVE).map((m) => ({
+        role: m.role === "user" ? "visitor" : "maxy",
+        content: m.content,
+        timestamp: new Date(m.createdAt).getTime() || Date.now()
+      }));
+      const cacheKey2 = crypto.randomUUID();
+      const resumed = uiMessages.length > 0;
+      console.log(`[session] cold-resume visitor=${visitorId.slice(0, 8)}\u2026 session=${recent.sessionId.slice(0, 8)}\u2026 messages=${uiMessages.length}`);
+      return withVisitorCookie(
+        Response.json({
+          session_key: cacheKey2,
+          agent_id: agentSlug,
+          resumed,
+          ...resumed ? { messages: uiMessages } : {},
+          ...branding ? { branding } : {},
+          ...agentIdentity
+        }),
+        visitorId
+      );
+    }
+  }
+  const newVisitorId = visitorId ?? crypto.randomUUID();
+  const cacheKey = crypto.randomUUID();
+  console.log(`[session] new-session visitor=${newVisitorId.slice(0, 8)}\u2026 session=${cacheKey.slice(0, 8)}\u2026 agent=${agentSlug} image=${agentConfig?.image ? "yes" : "no"}`);
+  return withVisitorCookie(
+    Response.json({
+      session_key: cacheKey,
+      agent_id: agentSlug,
+      ...branding ? { branding } : {},
+      ...agentIdentity
+    }),
+    newVisitorId
+  );
+});
+var session_default2 = app41;
+
 // app/lib/graph-health.ts
 var HOUR_MS = 60 * 60 * 1e3;
 var timer = null;
@@ -14120,7 +14388,7 @@ function startGraphHealthTimer() {
 
 // app/lib/file-watcher.ts
 import * as fsp2 from "fs/promises";
-import { resolve as resolve22, sep as sep6 } from "path";
+import { resolve as resolve23, sep as sep6 } from "path";
 var ACCOUNT_UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var DEFAULT_COALESCE_MS = 500;
 var ROOTS = ["uploads", "accounts"];
@@ -14139,7 +14407,7 @@ async function startFileWatcher(opts = {}) {
   const dropFn = opts.drop ?? dropFileIndex;
   for (const r of ROOTS) {
     try {
-      await fsp2.mkdir(resolve22(dataRoot, r), { recursive: true });
+      await fsp2.mkdir(resolve23(dataRoot, r), { recursive: true });
     } catch (err) {
       console.error(
         `[file-watcher] start-failed root="${r}" err="${err.message}" \u2014 index will be maintained by the 5-min reconcile backstop only`
@@ -14160,7 +14428,7 @@ async function startFileWatcher(opts = {}) {
     timers.set(relativePath, t);
   }
   async function runHook(relativePath, accountId) {
-    const absolute = resolve22(dataRoot, relativePath);
+    const absolute = resolve23(dataRoot, relativePath);
     let exists = false;
     try {
       const st = await fsp2.stat(absolute);
@@ -14184,7 +14452,7 @@ async function startFileWatcher(opts = {}) {
     }
   }
   async function watchRoot(rootName) {
-    const absRoot = resolve22(dataRoot, rootName);
+    const absRoot = resolve23(dataRoot, rootName);
     try {
       const iter = fsp2.watch(absRoot, { recursive: true, signal: controller.signal });
       for await (const event of iter) {
@@ -14282,8 +14550,8 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash4, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync21, readFileSync as readFileSync21, statSync as statSync9 } from "fs";
-import { resolve as resolve23 } from "path";
+import { existsSync as existsSync22, readFileSync as readFileSync21, statSync as statSync9 } from "fs";
+import { resolve as resolve24 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
 function canonicalize(value) {
@@ -14318,7 +14586,7 @@ var PUBKEY_SHA256 = "8eee6bcb33545fd13b16d3199a5735ca5db5062834c7b49dfe4f23801d9
 var GRACE_DAYS = 7;
 var GRACE_MS = GRACE_DAYS * 24 * 60 * 60 * 1e3;
 function pubkeyPath(brand) {
-  return resolve23(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
+  return resolve24(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
 }
 var memo = null;
 function memoKey(mtimeMs, account) {
@@ -14330,8 +14598,8 @@ function resolveEntitlement(brand, account) {
   if (brand.commercialMode !== true) {
     return logResolved(implicitTrust(account), null);
   }
-  const entitlementPath = resolve23(brand.configDir, "entitlement.json");
-  if (!existsSync21(entitlementPath)) {
+  const entitlementPath = resolve24(brand.configDir, "entitlement.json");
+  if (!existsSync22(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
   const stat7 = statSync9(entitlementPath);
@@ -14523,10 +14791,10 @@ function clientFrom(c) {
 var PLATFORM_ROOT9 = process.env.MAXY_PLATFORM_ROOT || "";
 var BRAND_JSON_PATH = PLATFORM_ROOT9 ? join17(PLATFORM_ROOT9, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync22(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync23(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync22(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync23(BRAND_JSON_PATH)) {
   try {
     const parsed = JSON.parse(readFileSync22(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
@@ -14550,7 +14818,7 @@ var brandLoginOpts = {
 var ALIAS_DOMAINS_PATH = join17(homedir2(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync22(ALIAS_DOMAINS_PATH)) return null;
+    if (!existsSync23(ALIAS_DOMAINS_PATH)) return null;
     const parsed = JSON.parse(readFileSync22(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
@@ -14575,9 +14843,9 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app41 = new Hono();
-app41.use("*", clientIpMiddleware);
-app41.use("*", async (c, next) => {
+var app42 = new Hono();
+app42.use("*", clientIpMiddleware);
+app42.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -14587,7 +14855,7 @@ app41.use("*", async (c, next) => {
   );
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app41.use("*", async (c, next) => {
+app42.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -14605,38 +14873,14 @@ app41.use("*", async (c, next) => {
     });
   }
 });
-var PUBLIC_ALLOWED_PREFIXES = [
-  "/api/session",
-  "/api/chat",
-  "/api/access/",
-  "/api/health",
-  "/api/group/",
-  "/api/telegram/",
-  "/assets/",
-  "/brand/",
-  "/agent-assets/",
-  "/generated/",
-  "/g/",
-  "/sites/"
-];
-var PUBLIC_ALLOWED_EXACT = ["/favicon.ico"];
-app41.use("*", async (c, next) => {
+app42.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (!isPublicHost(host)) {
     await next();
     return;
   }
   const path2 = c.req.path;
-  if (path2 === "/") {
-    await next();
-    return;
-  }
-  const allowed = PUBLIC_ALLOWED_EXACT.includes(path2) || PUBLIC_ALLOWED_PREFIXES.some((prefix) => path2.startsWith(prefix));
-  if (allowed) {
-    await next();
-    return;
-  }
-  if (AGENT_SLUG_PATTERN.test(path2)) {
+  if (isPublicPathAllowed(path2)) {
     await next();
     return;
   }
@@ -14660,7 +14904,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app41.post("/__remote-auth/login", async (c) => {
+app42.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -14705,7 +14949,7 @@ app41.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app41.get("/__remote-auth/logout", (c) => {
+app42.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -14718,7 +14962,7 @@ app41.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app41.post("/__remote-auth/change-password", async (c) => {
+app42.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -14769,13 +15013,13 @@ app41.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app41.get("/__remote-auth/setup", (c) => {
+app42.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app41.post("/__remote-auth/set-initial-password", async (c) => {
+app42.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -14813,10 +15057,10 @@ app41.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app41.get("/api/remote-auth/status", (c) => {
+app42.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app41.post("/api/remote-auth/set-password", async (c) => {
+app42.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -14847,9 +15091,9 @@ app41.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app41.route("/api/_client-error", client_error_default);
+app42.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
-app41.use("*", async (c, next) => {
+app42.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
@@ -14882,12 +15126,13 @@ app41.use("*", async (c, next) => {
   console.error(`[remote-auth] login required ip=${clientIp} path=${path2} ${disambig}`);
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), redirect: path2 }), 200);
 });
-app41.route("/api/health", health_default);
-app41.route("/api/chat", chat_default);
-app41.route("/api/whatsapp", whatsapp_default);
-app41.route("/api/onboarding", onboarding_default);
-app41.route("/api/admin", admin_default);
-app41.route("/api/access", access_default);
+app42.route("/api/health", health_default);
+app42.route("/api/chat", chat_default);
+app42.route("/api/whatsapp", whatsapp_default);
+app42.route("/api/onboarding", onboarding_default);
+app42.route("/api/admin", admin_default);
+app42.route("/api/access", access_default);
+app42.route("/api/session", session_default2);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -14899,7 +15144,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app41.get("/agent-assets/:slug/:filename", (c) => {
+app42.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -14915,13 +15160,13 @@ app41.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve24(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve24(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve25(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve25(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync22(filePath)) {
+  if (!existsSync23(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
@@ -14934,7 +15179,7 @@ app41.get("/agent-assets/:slug/:filename", (c) => {
     "Cache-Control": "public, max-age=3600"
   });
 });
-app41.get("/generated/:filename", (c) => {
+app42.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -14945,13 +15190,13 @@ app41.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve24(account.accountDir, "generated", filename);
-  const expectedDir = resolve24(account.accountDir, "generated");
+  const filePath = resolve25(account.accountDir, "generated", filename);
+  const expectedDir = resolve25(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync22(filePath)) {
+  if (!existsSync23(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
@@ -14964,14 +15209,14 @@ app41.get("/generated/:filename", (c) => {
     "Cache-Control": "public, max-age=86400"
   });
 });
-app41.route("/sites", sites_default);
-app41.route("/listings", listings_default);
-app41.route("/v", visitor_event_default);
-app41.route("/v", visitor_consent_default);
+app42.route("/sites", sites_default);
+app42.route("/listings", listings_default);
+app42.route("/v", visitor_event_default);
+app42.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync22(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync23(BRAND_JSON_PATH)) {
   try {
     const fullBrand = JSON.parse(readFileSync22(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
@@ -14991,7 +15236,7 @@ function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT9) return "unknown";
     const versionFile = join17(PLATFORM_ROOT9, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync22(versionFile)) return "unknown";
+    if (!existsSync23(versionFile)) return "unknown";
     const content = readFileSync22(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
@@ -15033,7 +15278,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync22(resolve24(process.cwd(), "public", file), "utf-8");
+    html = readFileSync22(resolve25(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -15052,12 +15297,12 @@ function loadBrandingCache(agentSlug) {
   const configDir2 = join17(homedir2(), BRAND.configDir);
   try {
     const accountJsonPath = join17(configDir2, "account.json");
-    if (!existsSync22(accountJsonPath)) return null;
+    if (!existsSync23(accountJsonPath)) return null;
     const account = JSON.parse(readFileSync22(accountJsonPath, "utf-8"));
     const accountId = account.accountId;
     if (!accountId) return null;
     const cachePath = join17(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync22(cachePath)) return null;
+    if (!existsSync23(cachePath)) return null;
     return JSON.parse(readFileSync22(cachePath, "utf-8"));
   } catch {
     return null;
@@ -15067,7 +15312,7 @@ function resolveDefaultSlug() {
   try {
     const configDir2 = join17(homedir2(), BRAND.configDir);
     const accountJsonPath = join17(configDir2, "account.json");
-    if (!existsSync22(accountJsonPath)) return null;
+    if (!existsSync23(accountJsonPath)) return null;
     const account = JSON.parse(readFileSync22(accountJsonPath, "utf-8"));
     return account.defaultAgent || null;
   } catch {
@@ -15104,7 +15349,7 @@ function brandedPublicHtml(agentSlug) {
 function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-app41.get("/", (c) => {
+app42.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) {
     const defaultSlug = resolveDefaultSlug();
@@ -15112,12 +15357,12 @@ app41.get("/", (c) => {
   }
   return c.html(cachedHtml("index.html"));
 });
-app41.get("/public", (c) => {
+app42.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app41.get("/chat", (c) => {
+app42.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -15136,12 +15381,12 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app41.use("/vnc-viewer.html", logViewerFetch);
-app41.use("/vnc-popout.html", logViewerFetch);
-app41.get("/vnc-popout.html", (c) => {
+app42.use("/vnc-viewer.html", logViewerFetch);
+app42.use("/vnc-popout.html", logViewerFetch);
+app42.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync22(resolve24(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync22(resolve25(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -15151,7 +15396,7 @@ app41.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app41.post("/api/vnc/client-event", async (c) => {
+app42.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -15172,25 +15417,25 @@ app41.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app41.get("/g/:slug", (c) => {
+app42.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
-app41.get("/graph", (c) => {
+app42.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app41.get("/sessions", (c) => {
+app42.get("/sessions", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("sessions.html"));
 });
-app41.get("/data", (c) => {
+app42.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app41.get("/:slug", async (c, next) => {
+app42.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const branding = loadBrandingCache(slug);
@@ -15200,15 +15445,27 @@ app41.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app41.get("/favicon.ico", (c) => {
+  app42.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app41.use("/*", serveStatic({ root: "./public" }));
+app42.use("/*", serveStatic({ root: "./public" }));
+app42.all("*", (c) => {
+  const host = (c.req.header("host") ?? "").split(":")[0];
+  const path2 = c.req.path;
+  if (isPublicHost(host)) {
+    const inAllowedList = PUBLIC_ALLOWED_EXACT.includes(path2) || PUBLIC_ALLOWED_PREFIXES.some((prefix) => path2.startsWith(prefix));
+    if (inAllowedList) {
+      console.error(`[public-host] unmatched-allowed path=${path2}`);
+      return c.json({ error: "not-found" }, 404);
+    }
+  }
+  return c.text("Not found", 404);
+});
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app41.fetch, port, hostname });
+var httpServer = serve({ fetch: app42.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 startAuthHealthHeartbeat();
 {
@@ -15234,6 +15491,7 @@ var SUBAPP_MANIFEST = [
   { prefix: "/api/onboarding", file: "server/routes/onboarding.ts", subapp: onboarding_default },
   { prefix: "/api/admin", file: "server/routes/admin/index.ts", subapp: admin_default },
   { prefix: "/api/access", file: "server/routes/access/index.ts", subapp: access_default },
+  { prefix: "/api/session", file: "server/routes/session.ts", subapp: session_default2 },
   { prefix: "/api/_client-error", file: "server/routes/client-error.ts", subapp: client_error_default },
   { prefix: "/listings", file: "server/routes/listings.ts", subapp: listings_default },
   { prefix: "/v", file: "server/routes/visitor-event.ts", subapp: visitor_event_default },
@@ -15245,7 +15503,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app41.routes ?? []) {
+  for (const r of app42.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -15267,7 +15525,7 @@ try {
 }
 (async () => {
   try {
-    if (!existsSync22(USERS_FILE)) return;
+    if (!existsSync23(USERS_FILE)) return;
     const usersRaw = readFileSync22(USERS_FILE, "utf-8").trim();
     if (!usersRaw) return;
     const users = JSON.parse(usersRaw);
@@ -15363,7 +15621,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve24(process.env.MAXY_PLATFORM_ROOT ?? join17(__dirname, "..")),
+  platformRoot: resolve25(process.env.MAXY_PLATFORM_ROOT ?? join17(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (process.env.WHATSAPP_PTY_BRIDGE_ENABLED === "true" && msg.text && !msg.isOwnerMirror) {