@rubytech/create-maxy-code 0.1.246 → 0.1.248

package/payload/server/server.js

@@ -14,6 +14,7 @@ import {
   MAXY_DIR,
   PLATFORM_ROOT,
   RFB_PORT,
+  SYSTEM_PATH_SLUGS,
   USERS_FILE,
   VISITOR_TOKEN_SECRET_FILE,
   VNC_DISPLAY,
@@ -91,7 +92,7 @@ import {
   vncLog,
   walkPremiumBundles,
   writeAdminUserAndPerson
-} from "./chunk-JMEX5NRX.js";
+} from "./chunk-UEIA5YUG.js";
 import {
   __commonJS,
   __toESM
@@ -600,6 +601,46 @@ var require_dist2 = __commonJS({
   }
 });
 
+// ../lib/require-port-env/dist/index.js
+var require_dist3 = __commonJS({
+  "../lib/require-port-env/dist/index.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.MissingPortEnvError = void 0;
+    exports.requirePortEnv = requirePortEnv3;
+    var MissingPortEnvError = class extends Error {
+      envName;
+      tag;
+      failLine;
+      constructor(envName, tag, failLine, message) {
+        super(message);
+        this.name = "MissingPortEnvError";
+        this.envName = envName;
+        this.tag = tag;
+        this.failLine = failLine;
+      }
+    };
+    exports.MissingPortEnvError = MissingPortEnvError;
+    var VALID_PORT_MIN = 1;
+    var VALID_PORT_MAX = 65535;
+    function requirePortEnv3(envName, options = {}) {
+      const tag = options.tag ?? "port-env";
+      const failLine = options.failLine ?? "missing-port-env";
+      const raw = process.env[envName];
+      if (raw === void 0 || raw === "") {
+        const msg = `[${tag}] ${failLine} reason=missing-env env=${envName}`;
+        throw new MissingPortEnvError(envName, tag, failLine, msg);
+      }
+      const parsed = Number.parseInt(raw, 10);
+      if (!Number.isInteger(parsed) || parsed < VALID_PORT_MIN || parsed > VALID_PORT_MAX || String(parsed) !== raw.trim()) {
+        const msg = `[${tag}] ${failLine} reason=invalid-port-env env=${envName} value=${JSON.stringify(raw)}`;
+        throw new MissingPortEnvError(envName, tag, failLine, msg);
+      }
+      return parsed;
+    }
+  }
+});
+
 // node_modules/hono/dist/utils/mime.js
 var getMimeType = (filename, mimes = baseMimes) => {
   const regexp = /\.([a-zA-Z0-9]+?)$/;
@@ -4777,6 +4818,7 @@ app2.post("/", async (c) => {
   let isGreeting = false;
   let requestFormat;
   let attachmentCount = 0;
+  let requestedSlug;
   if (contentType.startsWith("multipart/form-data")) {
     requestFormat = "multipart";
     let formData;
@@ -4787,6 +4829,7 @@ app2.post("/", async (c) => {
     }
     message = formData.get("message") ?? "";
     session_key = formData.get("session_key") ?? "";
+    requestedSlug = formData.get("agent") || void 0;
     userTimestamp = formData.get("timestamp") || void 0;
     if (!session_key) {
       return c.json({ error: "session_key required" }, 400);
@@ -4844,6 +4887,7 @@ app2.post("/", async (c) => {
       return c.json({ error: "Invalid request" }, 400);
     }
     session_key = body.session_key;
+    requestedSlug = typeof body.agent === "string" ? body.agent : void 0;
     userTimestamp = typeof body.timestamp === "string" ? body.timestamp : void 0;
     if (body.topicChangeAction !== void 0 || body.heldMessage !== void 0) {
       hasStaleTopicFields = true;
@@ -4874,9 +4918,19 @@ app2.post("/", async (c) => {
   if (!account) {
     return c.json({ error: "No account configured" }, 500);
   }
-  const agentSlug = resolveDefaultAgentSlug(account.accountDir);
+  let agentSlug;
+  let resolveSource;
+  if (requestedSlug) {
+    const active = validateAgentSlug(requestedSlug) && resolveAgentConfig(account.accountDir, requestedSlug).status === "active";
+    agentSlug = active ? requestedSlug : null;
+    resolveSource = active ? "slug" : "none";
+  } else {
+    agentSlug = resolveDefaultAgentSlug(account.accountDir);
+    resolveSource = agentSlug ? "default-fallback" : "none";
+  }
+  console.log(`[webchat] op=resolve slug=${requestedSlug ?? "none"} source=${resolveSource} agent=${agentSlug ?? "none"}`);
   if (!agentSlug) {
-    return c.json({ error: "No default agent configured" }, 500);
+    return c.json({ error: "no-agent-for-address" }, 404);
   }
   let accessMode = "open";
   try {
@@ -6662,32 +6716,46 @@ app5.post("/", async (c) => {
 var client_error_default = app5;
 
 // server/routes/admin/session.ts
-import { readFileSync as readFileSync9, readdirSync as readdirSync4, statSync as statSync4, existsSync as existsSync8 } from "fs";
-import { join as join8 } from "path";
-import { createHash as createHash2 } from "crypto";
 import { randomUUID as randomUUID7 } from "crypto";
+
+// app/lib/admin-identity/pin-validator.ts
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync8, readFileSync as readFileSync9, readdirSync as readdirSync4, statSync as statSync4 } from "fs";
+import { join as join8 } from "path";
 function hashPin2(pin) {
   return createHash2("sha256").update(pin).digest("hex");
 }
-function readUsersFile2() {
-  if (!existsSync8(USERS_FILE)) return null;
-  const raw = readFileSync9(USERS_FILE, "utf-8").trim();
+function readUsersFile2(usersFilePath) {
+  if (!existsSync8(usersFilePath)) return null;
+  const raw = readFileSync9(usersFilePath, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
 }
-function scanForOrphanedAccountAdmins(users) {
-  const usersUserIds = new Set(users.map((u) => u.userId));
+function validatePin(pin, usersFilePath) {
+  let users;
+  try {
+    users = readUsersFile2(usersFilePath);
+  } catch (err) {
+    return { kind: "corrupt", message: err instanceof Error ? err.message : String(err) };
+  }
+  if (users === null || users.length === 0) return { kind: "unavailable" };
+  const inputHash = hashPin2(pin);
+  const matched = users.find((u) => u.pin === inputHash);
+  return matched ? { kind: "match", userId: matched.userId } : { kind: "miss" };
+}
+function scanForOrphanedAccountAdmins(users, accountsDir) {
+  const known = new Set(users.map((u) => u.userId));
   const orphans = [];
-  if (!existsSync8(ACCOUNTS_DIR)) return orphans;
+  if (!existsSync8(accountsDir)) return orphans;
   let entries;
   try {
-    entries = readdirSync4(ACCOUNTS_DIR);
+    entries = readdirSync4(accountsDir);
   } catch {
     return orphans;
   }
   for (const entry of entries) {
     if (entry.startsWith(".")) continue;
-    const accountDir = join8(ACCOUNTS_DIR, entry);
+    const accountDir = join8(accountsDir, entry);
     try {
       if (!statSync4(accountDir).isDirectory()) continue;
     } catch {
@@ -6699,9 +6767,7 @@ function scanForOrphanedAccountAdmins(users) {
       const config = JSON.parse(readFileSync9(accountJsonPath, "utf-8"));
       const admins = config.admins ?? [];
       for (const a of admins) {
-        if (typeof a.userId === "string" && !usersUserIds.has(a.userId)) {
-          orphans.push(a.userId);
-        }
+        if (typeof a.userId === "string" && !known.has(a.userId)) orphans.push(a.userId);
       }
     } catch {
       continue;
@@ -6709,6 +6775,8 @@ function scanForOrphanedAccountAdmins(users) {
   }
   return orphans;
 }
+
+// server/routes/admin/session.ts
 async function resolveUserIdentity(accountId, userId) {
   const result = await loadAdminUserName(accountId, userId);
   if (result.source === "neo4j") {
@@ -6818,20 +6886,21 @@ app6.post("/", async (c) => {
     return c.json({ error: "Invalid request" }, 400);
   }
   if (!body.pin) return c.json({ error: "Invalid request" }, 400);
-  const inputHash = hashPin2(body.pin);
-  let users = null;
-  try {
-    users = readUsersFile2();
-  } catch (err) {
-    console.error(`[session] users.json corrupt: ${err instanceof Error ? err.message : String(err)}`);
+  const verdict = validatePin(body.pin, USERS_FILE);
+  if (verdict.kind === "corrupt") {
+    console.error(`[session] users.json corrupt: ${verdict.message}`);
     return c.json({ error: "User configuration is corrupt. Re-run the seed script." }, 503);
   }
-  if (users === null || users.length === 0) {
+  if (verdict.kind === "unavailable") {
     return c.json({ error: "PIN not configured. Complete onboarding first." }, 503);
   }
-  const matchedUser = users.find((u) => u.pin === inputHash);
-  if (!matchedUser) {
-    const orphanUserIds = scanForOrphanedAccountAdmins(users);
+  if (verdict.kind === "miss") {
+    let users = [];
+    try {
+      users = readUsersFile2(USERS_FILE) ?? [];
+    } catch {
+    }
+    const orphanUserIds = scanForOrphanedAccountAdmins(users, ACCOUNTS_DIR);
     if (orphanUserIds.length > 0) {
       const prefix = orphanUserIds[0].slice(0, 8);
       console.log(
@@ -6842,7 +6911,7 @@ app6.post("/", async (c) => {
     }
     return c.json({ error: "Invalid PIN" }, 401);
   }
-  const { userId } = matchedUser;
+  const { userId } = verdict;
   const accounts = resolveUserAccounts(userId);
   if (accounts.length === 0) {
     console.log(`[session] user has no accounts: userId=${userId}`);
@@ -7551,11 +7620,11 @@ app11.delete("/:id", requireAdminSession, async (c) => {
   const owned = await verifyConversationOwnership(sessionId, accountId);
   if (!owned) return c.json({ error: "Conversation not found" }, 404);
   const managerPort = requirePortEnv("CLAUDE_SESSION_MANAGER_PORT", { tag: "admin-conversation-delete" });
-  const managerBase5 = `http://127.0.0.1:${managerPort}`;
+  const managerBase6 = `http://127.0.0.1:${managerPort}`;
   const outcome = await cascadeAdminConversationDelete({
     sessionId,
     accountId,
-    managerBase: managerBase5
+    managerBase: managerBase6
   });
   if (outcome.ok) return c.json({ ok: true, claudeSessionIds: outcome.claudeSessionIds });
   if (outcome.reason === "pty-still-alive") {
@@ -8437,18 +8506,18 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
 ]);
 var app14 = new Hono();
 app14.post("/", async (c) => {
-  const TAG28 = "[admin:events]";
+  const TAG29 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG28} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG29} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS.has(event)) {
-    console.error(`${TAG28} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG29} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -11259,7 +11328,7 @@ app18.post("/", requireAdminSession, async (c) => {
         return c.json({ error: "AdminConversation node is missing sessionId" }, 500);
       }
       const managerPort = requirePortEnv("CLAUDE_SESSION_MANAGER_PORT", { tag: "graph-page-cascade" });
-      const managerBase5 = `http://127.0.0.1:${managerPort}`;
+      const managerBase6 = `http://127.0.0.1:${managerPort}`;
       try {
         await session.close();
       } catch {
@@ -11267,7 +11336,7 @@ app18.post("/", requireAdminSession, async (c) => {
       const outcome = await cascadeAdminConversationDelete({
         sessionId,
         accountId,
-        managerBase: managerBase5
+        managerBase: managerBase6
       });
       const elapsed2 = Date.now() - started;
       const labelSummary2 = preflightLabels.join(",");
@@ -12899,36 +12968,89 @@ app32.post("/", async (c) => {
 });
 var access_session_evict_default = app32;
 
-// server/routes/admin/index.ts
+// server/routes/admin/identity.ts
+var import_dist4 = __toESM(require_dist3(), 1);
 var app33 = new Hono();
-app33.route("/session", session_default);
-app33.route("/logs", logs_default);
-app33.route("/claude-info", claude_info_default);
-app33.route("/attachment", attachment_default);
-app33.route("/agents", agents_default);
-app33.route("/sessions", sessions_default);
-app33.route("/claude-sessions", claude_sessions_default);
-app33.route("/log-ingest", log_ingest_default);
-app33.route("/events", events_default);
-app33.route("/files", files_default);
-app33.route("/graph-search", graph_search_default);
-app33.route("/graph-subgraph", graph_subgraph_default);
-app33.route("/graph-delete", graph_delete_default);
-app33.route("/graph-restore", graph_restore_default);
-app33.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app33.route("/graph-default-view", graph_default_view_default);
-app33.route("/sidebar-artefacts", sidebar_artefacts_default);
-app33.route("/sidebar-sessions", sidebar_sessions_default);
-app33.route("/session-delete", session_delete_default);
-app33.route("/session-rc-spawn", session_rc_spawn_default);
-app33.route("/system-stats", system_stats_default);
-app33.route("/health-brand", health_default2);
-app33.route("/linkedin-ingest", linkedin_ingest_default);
-app33.route("/post-turn-context", post_turn_context_default);
-app33.route("/public-session-context", public_session_context_default);
-app33.route("/public-session-exit", public_session_exit_default);
-app33.route("/access-session-evict", access_session_evict_default);
-var admin_default = app33;
+var TAG25 = "[admin-identity]";
+function managerBase5() {
+  const port2 = (0, import_dist4.requirePortEnv)("CLAUDE_SESSION_MANAGER_PORT", { tag: "admin-identity" });
+  return `http://127.0.0.1:${port2}`;
+}
+app33.post("/validate", async (c) => {
+  const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
+  const isLoopback = remoteAddr === "127.0.0.1" || remoteAddr === "::1" || remoteAddr === "::ffff:127.0.0.1";
+  if (!isLoopback || c.req.header("x-forwarded-for")) {
+    return c.json({ error: "forbidden" }, 403);
+  }
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "bad-request" }, 400);
+  }
+  const pin = typeof body.pin === "string" ? body.pin : "";
+  const sessionId = typeof body.sessionId === "string" ? body.sessionId : void 0;
+  if (!pin) return c.json({ error: "bad-request" }, 400);
+  const fireStop = () => {
+    if (sessionId) {
+      void fetch(`${managerBase5()}/${encodeURIComponent(sessionId)}/stop`, { method: "POST" }).catch(
+        () => {
+        }
+      );
+    }
+  };
+  const verdict = validatePin(pin, USERS_FILE);
+  if (verdict.kind !== "match") {
+    if (verdict.kind === "miss") fireStop();
+    console.log(`${TAG25} op=endpoint-validate result=${verdict.kind}${sessionId ? ` sessionId=${sessionId.slice(0, 8)}` : ""}`);
+    return c.json({ kind: verdict.kind });
+  }
+  const { userId } = verdict;
+  const accounts = resolveUserAccounts(userId);
+  if (accounts.length === 0) {
+    fireStop();
+    console.log(`${TAG25} op=endpoint-validate result=no-account userId=${userId.slice(0, 8)}`);
+    return c.json({ kind: "miss" });
+  }
+  const accountId = accounts[0].accountId;
+  const { userName } = await resolveUserIdentity(accountId, userId);
+  const aboutOwner = await resolveOwnerProfileBlock(accountId, userId);
+  console.log(`${TAG25} op=endpoint-validate result=match userId=${userId.slice(0, 8)} aboutOwner=${aboutOwner.ok ? "ok" : `unresolved:${aboutOwner.reason}`}`);
+  return c.json({ kind: "match", userId, userName, aboutOwner });
+});
+var identity_default = app33;
+
+// server/routes/admin/index.ts
+var app34 = new Hono();
+app34.route("/session", session_default);
+app34.route("/identity", identity_default);
+app34.route("/logs", logs_default);
+app34.route("/claude-info", claude_info_default);
+app34.route("/attachment", attachment_default);
+app34.route("/agents", agents_default);
+app34.route("/sessions", sessions_default);
+app34.route("/claude-sessions", claude_sessions_default);
+app34.route("/log-ingest", log_ingest_default);
+app34.route("/events", events_default);
+app34.route("/files", files_default);
+app34.route("/graph-search", graph_search_default);
+app34.route("/graph-subgraph", graph_subgraph_default);
+app34.route("/graph-delete", graph_delete_default);
+app34.route("/graph-restore", graph_restore_default);
+app34.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app34.route("/graph-default-view", graph_default_view_default);
+app34.route("/sidebar-artefacts", sidebar_artefacts_default);
+app34.route("/sidebar-sessions", sidebar_sessions_default);
+app34.route("/session-delete", session_delete_default);
+app34.route("/session-rc-spawn", session_rc_spawn_default);
+app34.route("/system-stats", system_stats_default);
+app34.route("/health-brand", health_default2);
+app34.route("/linkedin-ingest", linkedin_ingest_default);
+app34.route("/post-turn-context", post_turn_context_default);
+app34.route("/public-session-context", public_session_context_default);
+app34.route("/public-session-exit", public_session_exit_default);
+app34.route("/access-session-evict", access_session_evict_default);
+var admin_default = app34;
 
 // app/lib/access-gate.ts
 import neo4j4 from "neo4j-driver";
@@ -13139,11 +13261,11 @@ async function generateNewMagicToken(grantId) {
 }
 
 // server/routes/access/verify-token.ts
-var TAG25 = "[access-verify]";
+var TAG26 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
-var app34 = new Hono();
-app34.post("/", async (c) => {
+var app35 = new Hono();
+app35.post("/", async (c) => {
   const ip = c.var.clientIp || "unknown";
   let body;
   try {
@@ -13158,39 +13280,39 @@ app34.post("/", async (c) => {
   }
   const rateMsg = checkAccessRateLimit(ip, agentSlug);
   if (rateMsg) {
-    console.error(`${TAG25} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
+    console.error(`${TAG26} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
     return c.json({ error: rateMsg }, 429);
   }
   const grant = await findGrantByMagicToken(token);
   if (!grant) {
     recordAccessFailedAttempt(ip, agentSlug);
-    console.error(`${TAG25} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
+    console.error(`${TAG26} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.agentSlug !== agentSlug) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG25} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
+      `${TAG26} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
     );
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.status === "expired" || grant.status === "revoked") {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG25} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
+      `${TAG26} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (grant.expiresAt !== null && grant.expiresAt < Date.now()) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG25} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
+      `${TAG26} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (!grant.sliceToken) {
     console.error(
-      `${TAG25} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
+      `${TAG26} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
     );
     return c.json({ error: "grant-misconfigured" }, 500);
   }
@@ -13206,12 +13328,12 @@ app34.post("/", async (c) => {
     await consumeMagicTokenAndActivate(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG25} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG26} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ error: "verification-failed" }, 500);
   }
   clearAccessRateLimit(ip, agentSlug);
-  console.log(`${TAG25} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
+  console.log(`${TAG26} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
   console.log(
     `${MINT_TAG} grantId=${grant.grantId} sliceToken=${grant.sliceToken.slice(0, 8)} agentSlug=${agentSlug} personId=${grant.personId ?? "none"}`
   );
@@ -13225,7 +13347,7 @@ app34.post("/", async (c) => {
     displayName: grant.displayName
   });
 });
-var verify_token_default = app34;
+var verify_token_default = app35;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
@@ -13287,10 +13409,10 @@ async function sendMagicLinkEmail(payload) {
 }
 
 // server/routes/access/request-magic-link.ts
-var TAG26 = "[access-request-link]";
-var app35 = new Hono();
+var TAG27 = "[access-request-link]";
+var app36 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
-app35.post("/", async (c) => {
+app36.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -13304,18 +13426,18 @@ app35.post("/", async (c) => {
   }
   const rateMsg = checkRequestLinkRateLimit(contactValue);
   if (rateMsg) {
-    console.error(`${TAG26} contactValue=${maskContact(contactValue)} result=rate-limited`);
+    console.error(`${TAG27} contactValue=${maskContact(contactValue)} result=rate-limited`);
     return c.json({ error: rateMsg }, 429);
   }
   recordRequestLinkAttempt(contactValue);
   const accountId = process.env.ACCOUNT_ID ?? "";
   if (!accountId) {
-    console.error(`${TAG26} contactValue=${maskContact(contactValue)} result=no-account-id`);
+    console.error(`${TAG27} contactValue=${maskContact(contactValue)} result=no-account-id`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   const grant = await findActiveGrantByContact(contactValue, agentSlug, accountId);
   if (!grant) {
-    console.log(`${TAG26} contactValue=${maskContact(contactValue)} result=notfound`);
+    console.log(`${TAG27} contactValue=${maskContact(contactValue)} result=notfound`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   let token;
@@ -13323,7 +13445,7 @@ app35.post("/", async (c) => {
     token = await generateNewMagicToken(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG26} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG27} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
@@ -13355,22 +13477,22 @@ app35.post("/", async (c) => {
   });
   if (!sendResult.ok) {
     console.error(
-      `${TAG26} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
+      `${TAG27} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   console.log(
-    `${TAG26} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
+    `${TAG27} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
-var request_magic_link_default = app35;
+var request_magic_link_default = app36;
 
 // server/routes/access/index.ts
-var app36 = new Hono();
-app36.route("/verify-token", verify_token_default);
-app36.route("/request-magic-link", request_magic_link_default);
-var access_default = app36;
+var app37 = new Hono();
+app37.route("/verify-token", verify_token_default);
+app37.route("/request-magic-link", request_magic_link_default);
+var access_default = app37;
 
 // server/routes/sites.ts
 import { existsSync as existsSync19, readFileSync as readFileSync18, realpathSync as realpathSync5, statSync as statSync8 } from "fs";
@@ -13405,8 +13527,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app37 = new Hono();
-app37.get("/:rel{.*}", (c) => {
+var app38 = new Hono();
+app38.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -13509,7 +13631,7 @@ app37.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app37;
+var sites_default = app38;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
@@ -13609,7 +13731,7 @@ function readBrandConfig() {
 }
 
 // server/routes/visitor-consent.ts
-var app38 = new Hono();
+var app39 = new Hono();
 var CONSENT_COOKIE_NAME = "mxy_consent";
 var CONSENT_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
 var DEFAULT_CONSENT_COPY = {
@@ -13654,17 +13776,17 @@ function siteSlugFromReferer(referer) {
     return "";
   }
 }
-app38.options("/consent", (c) => {
+app39.options("/consent", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app38.options("/brand-config", (c) => {
+app39.options("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app38.post("/consent", async (c) => {
+app39.post("/consent", async (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   let raw;
@@ -13704,7 +13826,7 @@ app38.post("/consent", async (c) => {
   console.log(`[consent] ${parsed.decision} site=${site} brand=${brandName} tokenBound=${tokenBound}`);
   return c.body(null, 204);
 });
-app38.get("/brand-config", (c) => {
+app39.get("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   const brand = readBrandConfig();
@@ -13714,7 +13836,7 @@ app38.get("/brand-config", (c) => {
   c.header("Cache-Control", "public, max-age=300");
   return c.json({ consent: { copy, palette } });
 });
-var visitor_consent_default = app38;
+var visitor_consent_default = app39;
 
 // server/routes/listings.ts
 function getCookie(headerValue, name) {
@@ -13741,8 +13863,8 @@ function appendConsentParams(pageUrl, token) {
 }
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
 var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
-var app39 = new Hono();
-app39.get("/:slug/click", async (c) => {
+var app40 = new Hono();
+app40.get("/:slug/click", async (c) => {
   const slug = c.req.param("slug") ?? "";
   const rawSession = c.req.query("session") ?? "";
   const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
@@ -13806,10 +13928,10 @@ app39.get("/:slug/click", async (c) => {
   console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} consent=${consentCookie ?? "absent"} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
   return c.redirect(redirectUrl, 302);
 });
-var listings_default = app39;
+var listings_default = app40;
 
 // server/routes/visitor-event.ts
-var app40 = new Hono();
+var app41 = new Hono();
 var BOT_UA_RE = /\b(bot|crawl|spider|slurp|headlesschrome|phantomjs|googlebot|bingbot|yandex|baiduspider|ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)\b/i;
 var buckets = /* @__PURE__ */ new Map();
 var RATE_LIMIT = 60;
@@ -13876,12 +13998,12 @@ function originAllowed(origin, allowlist) {
     return false;
   }
 }
-app40.options("/event", (c) => {
+app41.options("/event", (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   return c.body(null, 204);
 });
-app40.post("/event", async (c) => {
+app41.post("/event", async (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   const ua = c.req.header("user-agent") ?? "";
@@ -14086,7 +14208,7 @@ async function writeEvent(opts) {
     );
   }
 }
-var visitor_event_default = app40;
+var visitor_event_default = app41;
 
 // server/routes/session.ts
 import { resolve as resolve22 } from "path";
@@ -14123,8 +14245,8 @@ function withVisitorCookie(response, visitorId) {
     headers
   });
 }
-var app41 = new Hono();
-app41.post("/", async (c) => {
+var app42 = new Hono();
+app42.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -14324,7 +14446,7 @@ app41.post("/", async (c) => {
     newVisitorId
   );
 });
-var session_default2 = app41;
+var session_default2 = app42;
 
 // app/lib/graph-health.ts
 var HOUR_MS = 60 * 60 * 1e3;
@@ -14511,7 +14633,7 @@ async function startFileWatcher(opts = {}) {
 }
 
 // app/lib/whatsapp/inbound/claude-bridge.ts
-var TAG27 = "[whatsapp-adaptor]";
+var TAG28 = "[whatsapp-adaptor]";
 function whatsappTurnTimeoutMs() {
   return Number(process.env.WHATSAPP_PTY_TURN_TIMEOUT_MS ?? String(5 * 6e4));
 }
@@ -14533,7 +14655,7 @@ async function dispatchToClaude(input) {
     await input.reply(result.turnText);
   } catch (err) {
     const m = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG27} reject reason=reply-failed senderId=${input.senderId} message=${m}`);
+    console.error(`${TAG28} reject reason=reply-failed senderId=${input.senderId} message=${m}`);
   }
 }
 function startReaper2() {
@@ -14863,9 +14985,9 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app42 = new Hono();
-app42.use("*", clientIpMiddleware);
-app42.use("*", async (c, next) => {
+var app43 = new Hono();
+app43.use("*", clientIpMiddleware);
+app43.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -14875,7 +14997,7 @@ app42.use("*", async (c, next) => {
   );
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app42.use("*", async (c, next) => {
+app43.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -14893,7 +15015,7 @@ app42.use("*", async (c, next) => {
     });
   }
 });
-app42.use("*", async (c, next) => {
+app43.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (!isPublicHost(host)) {
     await next();
@@ -14924,7 +15046,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app42.post("/__remote-auth/login", async (c) => {
+app43.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -14969,7 +15091,7 @@ app42.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app42.get("/__remote-auth/logout", (c) => {
+app43.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -14982,7 +15104,7 @@ app42.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app42.post("/__remote-auth/change-password", async (c) => {
+app43.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -15033,13 +15155,13 @@ app42.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app42.get("/__remote-auth/setup", (c) => {
+app43.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app42.post("/__remote-auth/set-initial-password", async (c) => {
+app43.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -15077,10 +15199,10 @@ app42.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app42.get("/api/remote-auth/status", (c) => {
+app43.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app42.post("/api/remote-auth/set-password", async (c) => {
+app43.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -15111,9 +15233,9 @@ app42.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app42.route("/api/_client-error", client_error_default);
+app43.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
-app42.use("*", async (c, next) => {
+app43.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
@@ -15146,13 +15268,13 @@ app42.use("*", async (c, next) => {
   console.error(`[remote-auth] login required ip=${clientIp} path=${path2} ${disambig}`);
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), redirect: path2 }), 200);
 });
-app42.route("/api/health", health_default);
-app42.route("/api/chat", chat_default);
-app42.route("/api/whatsapp", whatsapp_default);
-app42.route("/api/onboarding", onboarding_default);
-app42.route("/api/admin", admin_default);
-app42.route("/api/access", access_default);
-app42.route("/api/session", session_default2);
+app43.route("/api/health", health_default);
+app43.route("/api/chat", chat_default);
+app43.route("/api/whatsapp", whatsapp_default);
+app43.route("/api/onboarding", onboarding_default);
+app43.route("/api/admin", admin_default);
+app43.route("/api/access", access_default);
+app43.route("/api/session", session_default2);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -15164,7 +15286,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app42.get("/agent-assets/:slug/:filename", (c) => {
+app43.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -15199,7 +15321,7 @@ app42.get("/agent-assets/:slug/:filename", (c) => {
     "Cache-Control": "public, max-age=3600"
   });
 });
-app42.get("/generated/:filename", (c) => {
+app43.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -15229,10 +15351,10 @@ app42.get("/generated/:filename", (c) => {
     "Cache-Control": "public, max-age=86400"
   });
 });
-app42.route("/sites", sites_default);
-app42.route("/listings", listings_default);
-app42.route("/v", visitor_event_default);
-app42.route("/v", visitor_consent_default);
+app43.route("/sites", sites_default);
+app43.route("/listings", listings_default);
+app43.route("/v", visitor_event_default);
+app43.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
@@ -15369,20 +15491,27 @@ function brandedPublicHtml(agentSlug) {
 function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-app42.get("/", (c) => {
+app43.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) {
     const defaultSlug = resolveDefaultSlug();
-    return c.html(brandedPublicHtml(defaultSlug ?? void 0));
+    if (!defaultSlug) {
+      console.error("[public-root] op=no-default");
+      return c.html(
+        `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escapeHtml(BRAND.productName)}</title></head><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1.5rem;color:#222"><h1 style="font-size:1.25rem">No agent configured</h1><p>This site has no default public agent set yet. The operator can set one from the admin console.</p></body></html>`,
+        503
+      );
+    }
+    return c.html(brandedPublicHtml(defaultSlug));
   }
   return c.html(cachedHtml("index.html"));
 });
-app42.get("/public", (c) => {
+app43.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app42.get("/chat", (c) => {
+app43.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -15401,9 +15530,9 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app42.use("/vnc-viewer.html", logViewerFetch);
-app42.use("/vnc-popout.html", logViewerFetch);
-app42.get("/vnc-popout.html", (c) => {
+app43.use("/vnc-viewer.html", logViewerFetch);
+app43.use("/vnc-popout.html", logViewerFetch);
+app43.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
     html = readFileSync22(resolve25(process.cwd(), "public", "vnc-popout.html"), "utf-8");
@@ -15416,7 +15545,7 @@ app42.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app42.post("/api/vnc/client-event", async (c) => {
+app43.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -15437,25 +15566,25 @@ app42.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app42.get("/g/:slug", (c) => {
+app43.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
-app42.get("/graph", (c) => {
+app43.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app42.get("/sessions", (c) => {
+app43.get("/sessions", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("sessions.html"));
 });
-app42.get("/data", (c) => {
+app43.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app42.get("/:slug", async (c, next) => {
+app43.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const branding = loadBrandingCache(slug);
@@ -15465,13 +15594,13 @@ app42.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app42.get("/favicon.ico", (c) => {
+  app43.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app42.use("/*", serveStatic({ root: "./public" }));
-app42.all("*", (c) => {
+app43.use("/*", serveStatic({ root: "./public" }));
+app43.all("*", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (isPublicHost(host)) {
@@ -15485,7 +15614,7 @@ app42.all("*", (c) => {
 });
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app42.fetch, port, hostname });
+var httpServer = serve({ fetch: app43.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 startAuthHealthHeartbeat();
 {
@@ -15503,7 +15632,6 @@ startAuthHealthHeartbeat();
   }, WINDOW_MS2);
   lagTimer.unref();
 }
-console.log("[boot] auth-mode summary: oauth=8 api-key=1 (api-key consumer: invokePublicAgent only)");
 var SUBAPP_MANIFEST = [
   { prefix: "/api/health", file: "server/routes/health.ts", subapp: health_default },
   { prefix: "/api/chat", file: "server/routes/chat.ts", subapp: chat_default },
@@ -15523,7 +15651,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app42.routes ?? []) {
+  for (const r of app43.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -15531,6 +15659,11 @@ try {
   }
   const summary = registered.map((r) => `${r.method} ${r.path}`).join(", ") || "(none)";
   console.log(`[route-shadow] static-paths-matching-slug-pattern count=${registered.length} routes=${summary}`);
+  const actualSlugs = [...new Set(registered.map((r) => r.path.replace(/^\//, "")))].sort();
+  const expectedSlugs = [...SYSTEM_PATH_SLUGS].sort();
+  if (actualSlugs.join(",") !== expectedSlugs.join(",")) {
+    console.error(`[route-shadow] drift expected=${expectedSlugs.join(",")} actual=${actualSlugs.join(",")} \u2014 update SYSTEM_PATH_SLUGS in app/lib/system-path-slugs.ts`);
+  }
 } catch (err) {
   console.error(`[route-shadow] introspection unavailable: ${err instanceof Error ? err.message : String(err)}`);
 }