@rubytech/create-maxy-code 0.1.298 → 0.1.300

package/payload/server/server.js

@@ -1,6 +1,7 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   ACCOUNTS_DIR,
+  AGENT_SLUG_PATTERN,
   BIN_DIR,
   BRAND_NAME,
   CDP_PORT,
@@ -15,6 +16,8 @@ import {
   LOG_DIR,
   MAXY_DIR,
   PLATFORM_ROOT,
+  PUBLIC_ALLOWED_EXACT,
+  PUBLIC_ALLOWED_PREFIXES,
   RFB_PORT,
   SYSTEM_PATH_SLUGS,
   USERS_FILE,
@@ -26,6 +29,7 @@ import {
   canAccessAdmin,
   checkGroupMembership,
   checkRateLimit,
+  classifyHost,
   cleanupLeakedPremiumSubs,
   clearRateLimit,
   clientIpMiddleware,
@@ -45,6 +49,7 @@ import {
   getConversationClaudeSessionIds,
   getDefaultAccountId,
   getGroupParticipants,
+  getOperatorDomains,
   getRecentMessages,
   getRoleForSession,
   getSession,
@@ -55,7 +60,9 @@ import {
   getUserTimezone,
   httpLog,
   isActiveAgentSlug,
+  isOperatorHost,
   isPasswordValid,
+  isPublicPathAllowed,
   isRemoteAuthConfigured,
   linkConversationTranscript,
   listAdminSessions,
@@ -97,7 +104,7 @@ import {
   vncLog,
   walkPremiumBundles,
   writeAdminUserAndPerson
-} from "./chunk-7H4KMTMC.js";
+} from "./chunk-JHSF5VPE.js";
 import {
   __commonJS,
   __toESM
@@ -1214,35 +1221,21 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync26, existsSync as existsSync26, watchFile } from "fs";
-import { resolve as resolve28, join as join21, basename as basename8 } from "path";
+import { readFileSync as readFileSync26, existsSync as existsSync27, watchFile } from "fs";
+import { resolve as resolve29, join as join22, basename as basename8 } from "path";
 import { homedir as homedir3 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
-// app/lib/agent-slug-pattern.ts
-var AGENT_SLUG_PATTERN = /^\/([a-z][a-z0-9-]{2,49})$/;
-
-// server/public-host-gate.ts
-var PUBLIC_ALLOWED_PREFIXES = [
-  "/api/session",
-  "/api/chat",
-  "/api/access/",
-  "/api/health",
-  "/api/group/",
-  "/api/telegram/",
-  "/assets/",
-  "/brand/",
-  "/agent-assets/",
-  "/generated/",
-  "/g/",
-  "/sites/"
-];
-var PUBLIC_ALLOWED_EXACT = ["/favicon.ico", "/brand-defaults.css"];
-function isPublicPathAllowed(path2) {
-  if (path2 === "/") return true;
-  if (PUBLIC_ALLOWED_EXACT.includes(path2)) return true;
-  if (PUBLIC_ALLOWED_PREFIXES.some((prefix) => path2.startsWith(prefix))) return true;
-  return AGENT_SLUG_PATTERN.test(path2);
+// server/webchat-descriptor.ts
+import { resolve, join as join2 } from "path";
+function webchatGatewayUrl() {
+  return `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`;
+}
+function webchatServerPath() {
+  return process.env.MAXY_WEBCHAT_CHANNEL_SERVER_PATH ?? resolve(process.env.MAXY_PLATFORM_ROOT ?? join2(__dirname, ".."), "services/webchat-channel/dist/server.js");
+}
+function webchatChannelDescriptor(key) {
+  return { key, gatewayUrl: webchatGatewayUrl(), serverPath: webchatServerPath() };
 }
 
 // app/lib/claude-auth.ts
@@ -1794,7 +1787,7 @@ var credsSaveQueue = Promise.resolve();
 async function drainCredsSaveQueue(timeoutMs = 5e3) {
   console.error(`${TAG2} draining credential save queue\u2026`);
   const timer2 = new Promise(
-    (resolve29) => setTimeout(() => resolve29("timeout"), timeoutMs)
+    (resolve30) => setTimeout(() => resolve30("timeout"), timeoutMs)
   );
   const result = await Promise.race([
     credsSaveQueue.then(() => "drained"),
@@ -1922,11 +1915,11 @@ async function createWaSocket(opts) {
   return sock;
 }
 async function waitForConnection(sock) {
-  return new Promise((resolve29, reject) => {
+  return new Promise((resolve30, reject) => {
     const handler = (update) => {
       if (update.connection === "open") {
         sock.ev.off("connection.update", handler);
-        resolve29();
+        resolve30();
       }
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
@@ -2040,14 +2033,14 @@ ${inspected}`;
   return inspect2(err, INSPECT_OPTS2);
 }
 function withTimeout(label, promise, timeoutMs) {
-  return new Promise((resolve29, reject) => {
+  return new Promise((resolve30, reject) => {
     const timer2 = setTimeout(() => {
       reject(new Error(`${label} timed out after ${timeoutMs}ms`));
     }, timeoutMs);
     promise.then(
       (value) => {
         clearTimeout(timer2);
-        resolve29(value);
+        resolve30(value);
       },
       (err) => {
         clearTimeout(timer2);
@@ -2646,8 +2639,8 @@ async function persistWhatsAppMessage(input) {
   const { givenName, familyName } = splitName(input.pushName);
   const prev = sessionWriteLocks.get(input.cacheKey);
   let release;
-  const mine = new Promise((resolve29) => {
-    release = resolve29;
+  const mine = new Promise((resolve30) => {
+    release = resolve30;
   });
   const chained = (prev ?? Promise.resolve()).then(() => mine);
   sessionWriteLocks.set(input.cacheKey, chained);
@@ -2833,7 +2826,7 @@ async function ensureWhatsAppConversation(input) {
 
 // ../lib/account-enumeration/src/index.ts
 import { readdirSync, readFileSync as readFileSync3 } from "fs";
-import { resolve } from "path";
+import { resolve as resolve2 } from "path";
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var cache = /* @__PURE__ */ new Map();
 function enumerateValidAccountIds(accountsDir) {
@@ -2852,7 +2845,7 @@ function enumerateValidAccountIds(accountsDir) {
   const valid = [];
   for (const name of names) {
     if (!UUID_RE.test(name)) continue;
-    const configPath2 = resolve(accountsDir, name, "account.json");
+    const configPath2 = resolve2(accountsDir, name, "account.json");
     try {
       JSON.parse(readFileSync3(configPath2, "utf-8"));
       valid.push(name);
@@ -2871,7 +2864,7 @@ function getAccountsDirFromEnv() {
       "[graph-write] MAXY_PLATFORM_ROOT not set \u2014 cannot enforce accountId gate. Set MAXY_PLATFORM_ROOT in the spawning process or pass `accountsDir` explicitly."
     );
   }
-  return resolve(root, "..", "data/accounts");
+  return resolve2(root, "..", "data/accounts");
 }
 function validateAccountIdEnv(envValue, diskIds) {
   if (!envValue) {
@@ -2910,7 +2903,7 @@ function resolvePlatformAccountId(accountsDir = ACCOUNTS_DIR) {
 // app/lib/whatsapp/inbound/media.ts
 import { randomUUID as randomUUID2 } from "crypto";
 import { writeFile, mkdir } from "fs/promises";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 import {
   downloadMediaMessage,
   downloadContentFromMessage,
@@ -2996,7 +2989,7 @@ async function downloadInboundMedia(msg, sock, opts) {
     await mkdir(MEDIA_DIR, { recursive: true });
     const ext = mimeToExt(mimetype ?? "application/octet-stream");
     const filename = `${randomUUID2()}.${ext}`;
-    const filePath = join2(MEDIA_DIR, filename);
+    const filePath = join3(MEDIA_DIR, filename);
     await writeFile(filePath, buffer);
     const sizeKB = (buffer.length / 1024).toFixed(0);
     console.error(`${TAG9} media downloaded type=${mimetype ?? "unknown"} size=${sizeKB}KB path=${filePath}`);
@@ -3727,11 +3720,11 @@ async function connectWithReconnect(conn) {
       console.error(
         `${TAG13} reconnecting account=${conn.accountId} in ${delay}ms (attempt ${decision.nextAttempts}/${maxAttempts})`
       );
-      await new Promise((resolve29) => {
-        const timer2 = setTimeout(resolve29, delay);
+      await new Promise((resolve30) => {
+        const timer2 = setTimeout(resolve30, delay);
         conn.abortController.signal.addEventListener("abort", () => {
           clearTimeout(timer2);
-          resolve29();
+          resolve30();
         }, { once: true });
       });
     }
@@ -3739,16 +3732,16 @@ async function connectWithReconnect(conn) {
   }
 }
 function waitForDisconnectEvent(conn) {
-  return new Promise((resolve29) => {
+  return new Promise((resolve30) => {
     if (!conn.sock) {
-      resolve29();
+      resolve30();
       return;
     }
     const sock = conn.sock;
     const handler = (update) => {
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
-        resolve29();
+        resolve30();
       }
     };
     sock.ev.on("connection.update", handler);
@@ -4008,8 +4001,8 @@ async function handleInboundMessage(conn, msg) {
     const conversationKey = isGroup ? remoteJid : senderPhone;
     const debounceKey = `${conn.accountId}:${conversationKey}:${senderPhone}`;
     let resolvePending;
-    const sttPending = new Promise((resolve29) => {
-      resolvePending = resolve29;
+    const sttPending = new Promise((resolve30) => {
+      resolvePending = resolve30;
     });
     if (conn.debouncer) conn.debouncer.registerPending(debounceKey, sttPending);
     try {
@@ -4106,9 +4099,9 @@ async function handleInboundMessage(conn, msg) {
 import { spawnSync, execFileSync } from "child_process";
 import { createConnection } from "net";
 import { mkdirSync, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
-import { resolve as resolve2 } from "path";
-var PLATFORM_ROOT2 = process.env.MAXY_PLATFORM_ROOT ?? resolve2(process.cwd(), "..");
-var VNC_SCRIPT = resolve2(PLATFORM_ROOT2, "scripts/vnc.sh");
+import { resolve as resolve3 } from "path";
+var PLATFORM_ROOT2 = process.env.MAXY_PLATFORM_ROOT ?? resolve3(process.cwd(), "..");
+var VNC_SCRIPT = resolve3(PLATFORM_ROOT2, "scripts/vnc.sh");
 var displayMode = process.env.DISPLAY_MODE ?? "virtual";
 if (displayMode === "native") {
   console.log(`[vnc] DISPLAY_MODE=native \u2014 local requests use desktop display, remote requests use VNC`);
@@ -4221,7 +4214,7 @@ function ensureLogDir() {
   mkdirSync(LOG_DIR, { recursive: true });
 }
 function logPath(name) {
-  return resolve2(LOG_DIR, `${name}.log`);
+  return resolve3(LOG_DIR, `${name}.log`);
 }
 async function ensureVnc() {
   const up = await waitForPort(RFB_PORT, 1e3);
@@ -4300,7 +4293,7 @@ function killChromium() {
 }
 function writeChromiumWrapper() {
   mkdirSync(BIN_DIR, { recursive: true });
-  const wrapperPath = resolve2(BIN_DIR, "chromium");
+  const wrapperPath = resolve3(BIN_DIR, "chromium");
   writeFileSync3(wrapperPath, `#!/bin/bash
 LOG="${LOG_DIR}/chromium.log"
 echo "==== [$(date)] chromium wrapper ====" >> "$LOG"
@@ -4400,20 +4393,20 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
 
 // server/routes/health.ts
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve29) => {
+  return new Promise((resolve30) => {
     const socket = createConnection2(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve29(true);
+      resolve30(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve29(false);
+      resolve30(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve29(false);
+      resolve30(false);
     });
   });
 }
@@ -4483,9 +4476,9 @@ var health_default = app;
 import { randomUUID as randomUUID3 } from "crypto";
 import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
 import { realpathSync } from "fs";
-import { resolve as resolve3, extname } from "path";
-var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve3(process.cwd(), "../platform");
-var ATTACHMENTS_ROOT = resolve3(PLATFORM_ROOT3, "..", "data/uploads");
+import { resolve as resolve4, extname } from "path";
+var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve4(process.cwd(), "../platform");
+var ATTACHMENTS_ROOT = resolve4(PLATFORM_ROOT3, "..", "data/uploads");
 var SUPPORTED_MIME_TYPES = /* @__PURE__ */ new Set([
   "image/jpeg",
   "image/png",
@@ -4512,11 +4505,11 @@ function assertSupportedMime(mimeType) {
 }
 async function writeAttachment(scope, filename, mimeType, sizeBytes, buffer) {
   const attachmentId = randomUUID3();
-  const dir = resolve3(ATTACHMENTS_ROOT, scope, attachmentId);
+  const dir = resolve4(ATTACHMENTS_ROOT, scope, attachmentId);
   await mkdir2(dir, { recursive: true });
   const ext = extname(filename) || "";
-  const storagePath = resolve3(dir, `${attachmentId}${ext}`);
-  const metaPath = resolve3(dir, `${attachmentId}.meta.json`);
+  const storagePath = resolve4(dir, `${attachmentId}${ext}`);
+  const metaPath = resolve4(dir, `${attachmentId}.meta.json`);
   const meta = {
     attachmentId,
     scope,
@@ -4590,11 +4583,11 @@ async function storeComponentArtefact(accountId, attachmentId, mimeType, content
       `Component artefact exceeds the 50 MB limit (${(buffer.byteLength / 1024 / 1024).toFixed(1)} MB).`
     );
   }
-  const dir = resolve3(ATTACHMENTS_ROOT, accountId, attachmentId);
+  const dir = resolve4(ATTACHMENTS_ROOT, accountId, attachmentId);
   await mkdir2(dir, { recursive: true });
   const ext = extname(filename) || (mimeType === "text/html" ? ".html" : ".md");
-  const storagePath = resolve3(dir, `${attachmentId}${ext}`);
-  const metaPath = resolve3(dir, `${attachmentId}.meta.json`);
+  const storagePath = resolve4(dir, `${attachmentId}${ext}`);
+  const metaPath = resolve4(dir, `${attachmentId}.meta.json`);
   const meta = {
     attachmentId,
     scope: accountId,
@@ -4611,7 +4604,7 @@ async function storeComponentArtefact(accountId, attachmentId, mimeType, content
 // app/lib/stt/voice-note.ts
 import { writeFile as writeFile3, mkdtemp, rm } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 var TAG14 = "[voice]";
 var AUDIO_MIME_TYPES = /* @__PURE__ */ new Set([
   "audio/ogg",
@@ -4655,9 +4648,9 @@ async function transcribeVoiceNote(file, source) {
   let tempDir;
   let tempPath;
   try {
-    tempDir = await mkdtemp(join3(tmpdir(), "voice-"));
+    tempDir = await mkdtemp(join4(tmpdir(), "voice-"));
     const ext = audioExtension(mimeType);
-    tempPath = join3(tempDir, `recording${ext}`);
+    tempPath = join4(tempDir, `recording${ext}`);
     const buffer = Buffer.from(await file.arrayBuffer());
     await writeFile3(tempPath, buffer);
   } catch (err) {
@@ -4698,7 +4691,7 @@ async function transcribeVoiceNote(file, source) {
 }
 
 // app/lib/channel-pty-bridge/bridge.ts
-import { resolve as resolve5 } from "path";
+import { resolve as resolve6 } from "path";
 
 // app/lib/channel-pty-bridge/manager-client.ts
 function managerBase() {
@@ -5150,7 +5143,7 @@ async function fanOut(subscribers, text, onError, tag) {
 // app/lib/whatsapp/outbound/send-document.ts
 import { realpathSync as realpathSync2 } from "fs";
 import { readFile, stat as stat2 } from "fs/promises";
-import { resolve as resolve4, basename } from "path";
+import { resolve as resolve5, basename } from "path";
 var TAG16 = "[whatsapp:outbound]";
 var WHATSAPP_DOCUMENT_MAX_BYTES = 100 * 1024 * 1024;
 var lastDocumentOutboundAt = /* @__PURE__ */ new Map();
@@ -5181,7 +5174,7 @@ async function sendWhatsAppDocument(input) {
   if (!maxyAccountId || !platformRoot2) {
     return { ok: false, status: 400, error: "Cannot validate file path: missing account or platform context" };
   }
-  const accountDir = resolve4(platformRoot2, "..", "data/accounts", maxyAccountId);
+  const accountDir = resolve5(platformRoot2, "..", "data/accounts", maxyAccountId);
   let resolvedPath;
   try {
     resolvedPath = realpathSync2(filePath);
@@ -5388,7 +5381,7 @@ async function ensureEntry(input) {
     });
   } else {
     console.error(`${tag} route role=${input.role} target=public-spawn senderId=${input.senderId}`);
-    const attachmentDir = resolve5(ATTACHMENTS_ROOT, "public", input.senderId);
+    const attachmentDir = resolve6(ATTACHMENTS_ROOT, "public", input.senderId);
     spawned = await managerSpawn({
       senderId: input.senderId,
       role: input.role,
@@ -5520,12 +5513,12 @@ async function dispatchOnce(input) {
   });
   if (!entry) return { error: "spawn-failed" };
   entry.lastInboundAt = Date.now();
-  let resolve29;
+  let resolve30;
   const turnPromise = new Promise((r) => {
-    resolve29 = r;
+    resolve30 = r;
   });
   const listener = (text) => {
-    resolve29(text);
+    resolve30(text);
   };
   entry.subscribers.add(listener);
   const writeAtMs = Date.now();
@@ -5895,7 +5888,7 @@ ${result.result.text}` : result.result.text;
 var chat_default = app2;
 
 // server/routes/whatsapp.ts
-import { join as join6, resolve as resolve7 } from "path";
+import { join as join7, resolve as resolve8 } from "path";
 import { readdirSync as readdirSync3, readFileSync as readFileSync7, existsSync as existsSync5 } from "fs";
 
 // app/lib/whatsapp/login.ts
@@ -5903,10 +5896,10 @@ import { randomUUID as randomUUID6 } from "crypto";
 
 // app/lib/whatsapp/config-persist.ts
 import { readFileSync as readFileSync6, writeFileSync as writeFileSync4, existsSync as existsSync4 } from "fs";
-import { resolve as resolve6, join as join4 } from "path";
+import { resolve as resolve7, join as join5 } from "path";
 var TAG18 = "[whatsapp:config]";
 function configPath(accountDir) {
-  return resolve6(accountDir, "account.json");
+  return resolve7(accountDir, "account.json");
 }
 function readConfig(accountDir) {
   const path2 = configPath(accountDir);
@@ -6055,7 +6048,7 @@ function setPublicAgent(accountDir, slug) {
   if (!trimmed) {
     return { ok: false, error: "Agent slug cannot be empty." };
   }
-  const agentConfigPath = join4(accountDir, "agents", trimmed, "config.json");
+  const agentConfigPath = join5(accountDir, "agents", trimmed, "config.json");
   if (!existsSync4(agentConfigPath)) {
     return { ok: false, error: `Agent "${trimmed}" not found \u2014 no config.json at ${agentConfigPath}. Check the agent slug and try again.` };
   }
@@ -6313,8 +6306,8 @@ async function startLogin(opts) {
   await clearAuth(authDir);
   let resolveCode = null;
   let rejectCode = null;
-  const codePromise = new Promise((resolve29, reject) => {
-    resolveCode = resolve29;
+  const codePromise = new Promise((resolve30, reject) => {
+    resolveCode = resolve30;
     rejectCode = reject;
   });
   const codeTimer = setTimeout(
@@ -6546,11 +6539,11 @@ function serializeWhatsAppSchema() {
 
 // app/lib/whatsapp/status-reconcile.ts
 import { readdirSync as readdirSync2 } from "fs";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 var TAG20 = "[whatsapp:reconcile]";
 function listCredsAccountIds(credsRoot) {
   try {
-    return readdirSync2(credsRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && hasCredsSync(join5(credsRoot, e.name))).map((e) => e.name);
+    return readdirSync2(credsRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && hasCredsSync(join6(credsRoot, e.name))).map((e) => e.name);
   } catch {
     return [];
   }
@@ -6565,7 +6558,7 @@ function reconcileCredsOnDisk(opts) {
   const entries = [];
   for (const accountId of listCredsAccountIds(credsRoot)) {
     if (liveAccountIds.has(accountId)) continue;
-    const authDir = join5(credsRoot, accountId);
+    const authDir = join6(credsRoot, accountId);
     const selfPhone = readSelfId(authDir).e164 ?? void 0;
     const configured = accountDir ? isAccountConfigured(accountDir, accountId) : false;
     console.error(
@@ -6592,7 +6585,7 @@ app3.get("/status", (c) => {
   try {
     const live = getStatus();
     const liveIds = new Set(live.map((a) => a.accountId));
-    const credsRoot = join6(MAXY_DIR, "credentials", "whatsapp");
+    const credsRoot = join7(MAXY_DIR, "credentials", "whatsapp");
     const accountDir = resolveAccount()?.accountDir ?? null;
     const reconciled = reconcileCredsOnDisk({ credsRoot, accountDir, liveAccountIds: liveIds });
     const accounts = [...live, ...reconciled];
@@ -6613,7 +6606,7 @@ app3.post("/login/start", async (c) => {
     if (!phone) {
       return c.json({ error: 'Missing required field "phone" (E.164, e.g. +441234567890).' }, 400);
     }
-    const authDir = join6(MAXY_DIR, "credentials", "whatsapp", accountId);
+    const authDir = join7(MAXY_DIR, "credentials", "whatsapp", accountId);
     const accountDir = resolveAccount()?.accountDir ?? null;
     const result = await startLogin({ accountId, authDir, phone, accountDir, force });
     console.error(`${TAG21} login/start result account=${accountId} hasCode=${!!result.pairingCode}${result.selfPhone ? ` phone=${result.selfPhone}` : ""}`);
@@ -6711,14 +6704,14 @@ app3.post("/config", async (c) => {
         return c.json({ ok: true, slug: resolved?.slug ?? null, source: resolved?.source ?? null });
       }
       case "list-public-agents": {
-        const agentsDir = resolve7(account.accountDir, "agents");
+        const agentsDir = resolve8(account.accountDir, "agents");
         const agents = [];
         if (existsSync5(agentsDir)) {
           try {
             const entries = readdirSync3(agentsDir, { withFileTypes: true });
             for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
               if (!entry.isDirectory() || entry.name === "admin") continue;
-              const configPath2 = resolve7(agentsDir, entry.name, "config.json");
+              const configPath2 = resolve8(agentsDir, entry.name, "config.json");
               if (!existsSync5(configPath2)) continue;
               try {
                 const config = JSON.parse(readFileSync7(configPath2, "utf-8"));
@@ -6991,11 +6984,11 @@ var whatsapp_default = app3;
 
 // server/routes/whatsapp-reader.ts
 import { readFileSync as readFileSync10, watch, statSync as statSync4, openSync, readSync, closeSync, existsSync as existsSync7, readdirSync as readdirSync6 } from "fs";
-import { basename as basename2, dirname, join as join9, resolve as resolve9, sep as sep2 } from "path";
+import { basename as basename2, dirname, join as join10, resolve as resolve10, sep as sep2 } from "path";
 
 // server/routes/admin/sidebar-sessions.ts
 import { readdirSync as readdirSync4, readFileSync as readFileSync8, statSync as statSync2 } from "fs";
-import { join as join7, resolve as resolve8 } from "path";
+import { join as join8, resolve as resolve9 } from "path";
 var SESSION_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.jsonl$/i;
 var CLI_MARKER_PREFIXES = ["<local-command-", "<command-name>", "<command-message>"];
 var PUBLIC_ROLE = "public";
@@ -7014,7 +7007,7 @@ function enumerateJsonls(projectsRoot) {
     throw err;
   }
   for (const slug of slugs) {
-    const slugDir = join7(projectsRoot, slug);
+    const slugDir = join8(projectsRoot, slug);
     let entries;
     try {
       entries = readdirSync4(slugDir, { withFileTypes: true });
@@ -7025,9 +7018,9 @@ function enumerateJsonls(projectsRoot) {
     }
     for (const entry of entries) {
       if (entry.isFile() && SESSION_ID_RE.test(entry.name)) {
-        out.push({ path: join7(slugDir, entry.name), isSubagent: false, archived: false });
+        out.push({ path: join8(slugDir, entry.name), isSubagent: false, archived: false });
       } else if (entry.isDirectory() && entry.name === "subagents") {
-        const subDir = join7(slugDir, entry.name);
+        const subDir = join8(slugDir, entry.name);
         let subEntries;
         try {
           subEntries = readdirSync4(subDir, { withFileTypes: true });
@@ -7038,11 +7031,11 @@ function enumerateJsonls(projectsRoot) {
         }
         for (const sub of subEntries) {
           if (sub.isFile() && SESSION_ID_RE.test(sub.name)) {
-            out.push({ path: join7(subDir, sub.name), isSubagent: true, archived: false });
+            out.push({ path: join8(subDir, sub.name), isSubagent: true, archived: false });
           }
         }
       } else if (entry.isDirectory() && entry.name === "archive") {
-        const archiveDir = join7(slugDir, entry.name);
+        const archiveDir = join8(slugDir, entry.name);
         let archiveEntries;
         try {
           archiveEntries = readdirSync4(archiveDir, { withFileTypes: true });
@@ -7053,7 +7046,7 @@ function enumerateJsonls(projectsRoot) {
         }
         for (const arc of archiveEntries) {
           if (arc.isFile() && SESSION_ID_RE.test(arc.name)) {
-            out.push({ path: join7(archiveDir, arc.name), isSubagent: false, archived: true });
+            out.push({ path: join8(archiveDir, arc.name), isSubagent: false, archived: true });
           }
         }
       }
@@ -7086,7 +7079,7 @@ async function fetchLiveSessions() {
 function loadUserTitles(accountDir) {
   const out = /* @__PURE__ */ new Map();
   if (!accountDir) return out;
-  const path2 = join7(accountDir, "session-titles.json");
+  const path2 = join8(accountDir, "session-titles.json");
   let raw;
   try {
     raw = readFileSync8(path2, "utf8");
@@ -7183,10 +7176,10 @@ app4.get("/", requireAdminSession, async (c) => {
     console.error("[admin-sessions-list] CLAUDE_CONFIG_DIR not set; returning empty list");
     return c.json({ sessions: [], accountId });
   }
-  const projectsRoot = join7(configDir2, "projects");
+  const projectsRoot = join8(configDir2, "projects");
   const jsonls = enumerateJsonls(projectsRoot);
   const liveSessions = await fetchLiveSessions();
-  const accountDir = accountId ? resolve8(ACCOUNTS_DIR, accountId) : null;
+  const accountDir = accountId ? resolve9(ACCOUNTS_DIR, accountId) : null;
   const userTitles = loadUserTitles(accountDir);
   const rows = [];
   const seenIds = /* @__PURE__ */ new Set();
@@ -7217,7 +7210,7 @@ app4.get("/", requireAdminSession, async (c) => {
     const pid = live ? liveSessions.get(sessionId) ?? null : null;
     const resolved = resolveTitle(body, sessionId, userTitles);
     titleSourceCounts[resolved.source] += 1;
-    const metaPath = join7(projectDir, `${sessionId}.meta.json`);
+    const metaPath = join8(projectDir, `${sessionId}.meta.json`);
     const { bridgeIds, role, channel } = readSidecarMeta(metaPath);
     const resumable = !(role === PUBLIC_ROLE && channel === WEBCHAT_CHANNEL);
     rows.push({
@@ -7264,7 +7257,7 @@ function selectAdminChannelSessions(rows) {
 // app/lib/admin-identity/pin-validator.ts
 import { createHash as createHash2 } from "crypto";
 import { existsSync as existsSync6, readFileSync as readFileSync9, readdirSync as readdirSync5, statSync as statSync3 } from "fs";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 function hashPin(pin) {
   return createHash2("sha256").update(pin).digest("hex");
 }
@@ -7298,13 +7291,13 @@ function scanForOrphanedAccountAdmins(users, accountsDir) {
   }
   for (const entry of entries) {
     if (entry.startsWith(".")) continue;
-    const accountDir = join8(accountsDir, entry);
+    const accountDir = join9(accountsDir, entry);
     try {
       if (!statSync3(accountDir).isDirectory()) continue;
     } catch {
       continue;
     }
-    const accountJsonPath = join8(accountDir, "account.json");
+    const accountJsonPath = join9(accountDir, "account.json");
     if (!existsSync6(accountJsonPath)) continue;
     try {
       const config = JSON.parse(readFileSync9(accountJsonPath, "utf-8"));
@@ -7484,13 +7477,13 @@ var app5 = new Hono();
 app5.get("/conversations", requireAdminSession, async (c) => {
   const cfg = claudeConfigDir();
   if (!cfg) return c.json({ conversations: [] });
-  const projectsRoot = join9(cfg, "projects");
+  const projectsRoot = join10(cfg, "projects");
   const userTitles = loadUserTitles(ACCOUNTS_DIR ?? null);
   const rows = [];
   for (const { path: path2 } of enumerateJsonls(projectsRoot)) {
     const sessionId = basename2(path2).replace(/\.jsonl$/, "");
     const projectDir = dirname(path2);
-    const meta = readSidecarMeta(join9(projectDir, `${sessionId}.meta.json`));
+    const meta = readSidecarMeta(join10(projectDir, `${sessionId}.meta.json`));
     if (meta.role !== "admin" || meta.channel !== "whatsapp" && meta.channel !== "telegram") continue;
     let body = "";
     try {
@@ -7577,11 +7570,11 @@ app5.get("/stream", requireAdminSession, (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
   const projectDir = c.req.query("projectDir") ?? "";
   const cfg = claudeConfigDir();
-  const projectsRoot = cfg ? resolve9(join9(cfg, "projects")) : null;
+  const projectsRoot = cfg ? resolve10(join10(cfg, "projects")) : null;
   if (!cfg || !projectsRoot || !SESSION_ID_RE2.test(sessionId)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const jsonlPath = resolve9(join9(projectDir, `${sessionId}.jsonl`));
+  const jsonlPath = resolve10(join10(projectDir, `${sessionId}.jsonl`));
   if (!jsonlPath.startsWith(projectsRoot + sep2)) {
     return c.json({ error: "bad session reference" }, 400);
   }
@@ -7668,7 +7661,7 @@ var DIRECTIVE_NAME_RE = /^\d+-\d+\.txt$/;
 function directiveStoreDir(sessionId) {
   const account = resolveAccount();
   if (!account) return null;
-  return resolve9(account.accountDir, "logs", "prompt-optimiser-directives", sessionId);
+  return resolve10(account.accountDir, "logs", "prompt-optimiser-directives", sessionId);
 }
 app5.get("/directives", requireAdminSession, (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
@@ -7687,7 +7680,7 @@ app5.get("/directives", requireAdminSession, (c) => {
     const pid = Number(pidPart);
     let len = 0;
     try {
-      len = statSync4(join9(dir, name)).size;
+      len = statSync4(join10(dir, name)).size;
     } catch {
     }
     return { name, secs, pid, ts: Number.isFinite(secs) ? new Date(secs * 1e3).toISOString() : null, len };
@@ -7702,7 +7695,7 @@ app5.get("/directive", requireAdminSession, (c) => {
   }
   const dir = directiveStoreDir(sessionId);
   if (!dir) return c.json({ error: "no account" }, 404);
-  const path2 = resolve9(join9(dir, name));
+  const path2 = resolve10(join10(dir, name));
   if (!path2.startsWith(dir + sep2)) return c.json({ error: "bad reference" }, 400);
   let body;
   try {
@@ -7716,22 +7709,34 @@ var whatsapp_reader_default = app5;
 
 // server/routes/webchat.ts
 import { basename as basename3, dirname as dirname2 } from "path";
-import { join as join10 } from "path";
-import { readFileSync as readFileSync11, renameSync, writeFileSync as writeFileSync5 } from "fs";
+import { join as join11 } from "path";
+import { existsSync as existsSync8, readdirSync as readdirSync7, readFileSync as readFileSync11, renameSync, writeFileSync as writeFileSync5 } from "fs";
 var WEBCHAT_ADMIN_KEY = "webchat-admin";
 var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function locateSession(sessionId) {
   const cfg = claudeConfigDir();
   if (!cfg) return { projectDir: null, channel: null };
-  for (const { path: path2 } of enumerateJsonls(join10(cfg, "projects"))) {
+  for (const { path: path2 } of enumerateJsonls(join11(cfg, "projects"))) {
     if (basename3(path2) === `${sessionId}.jsonl`) {
       const dir = dirname2(path2);
-      const meta = readSidecarMeta(join10(dir, `${sessionId}.meta.json`));
+      const meta = readSidecarMeta(join11(dir, `${sessionId}.meta.json`));
       return { projectDir: dir, channel: meta.channel };
     }
   }
   return { projectDir: null, channel: null };
 }
+function sessionSidecarExists(sessionId) {
+  const cfg = claudeConfigDir();
+  if (!cfg) return false;
+  const projectsRoot = join11(cfg, "projects");
+  let slugs;
+  try {
+    slugs = readdirSync7(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+  } catch {
+    return false;
+  }
+  return slugs.some((slug) => existsSync8(join11(projectsRoot, slug, `${sessionId}.meta.json`)));
+}
 function conflictingBinding(channel) {
   return channel !== null && channel !== "webchat" ? channel : null;
 }
@@ -7958,7 +7963,7 @@ ${note}` : note;
       console.error(`[webchat:settings] op=${op} outcome=refused value=${value} reason=account-unresolved`);
       return c.json({ error: "account unresolved" }, 503);
     }
-    const accountJsonPath = join10(account.accountDir, "account.json");
+    const accountJsonPath = join11(account.accountDir, "account.json");
     try {
       const parsed = JSON.parse(readFileSync11(accountJsonPath, "utf8"));
       if (op === "model") parsed.adminModel = value;
@@ -7991,14 +7996,15 @@ ${note}` : note;
         return c.json({ error: "invalid session id" }, 400);
       }
       const { projectDir: projectDir2, channel } = locateSession(target);
+      const known = projectDir2 !== null || sessionSidecarExists(target);
       const indicators2 = await fetchComposerIndicators(target);
-      return c.json({ sessionId: target, projectDir: projectDir2, channelBinding: conflictingBinding(channel), ...indicators2 });
+      return c.json({ sessionId: target, projectDir: projectDir2, channelBinding: conflictingBinding(channel), known, ...indicators2 });
     }
     const sessionId = adminSessionIdFor(accountId, WEBCHAT_ADMIN_KEY);
     const cfg = claudeConfigDir();
     let projectDir = null;
     if (cfg) {
-      for (const { path: path2 } of enumerateJsonls(join10(cfg, "projects"))) {
+      for (const { path: path2 } of enumerateJsonls(join11(cfg, "projects"))) {
         if (basename3(path2) === `${sessionId}.jsonl`) {
           projectDir = dirname2(path2);
           break;
@@ -8012,11 +8018,11 @@ ${note}` : note;
 }
 
 // server/routes/webchat-greeting.ts
-import { resolve as resolve10 } from "path";
+import { resolve as resolve11 } from "path";
 
 // app/lib/claude-agent/specialist-roster.ts
-import { existsSync as existsSync8, readFileSync as readFileSync12, readdirSync as readdirSync7 } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync12, readdirSync as readdirSync8 } from "fs";
+import { join as join12 } from "path";
 function field(fm, name) {
   const m = fm.match(new RegExp(`^${name}:\\s*(.*?)\\r?$`, "m"));
   if (!m) return null;
@@ -8027,15 +8033,15 @@ function field(fm, name) {
   return value || null;
 }
 function readSpecialistRoster(specialistsDir) {
-  if (!existsSync8(specialistsDir)) return { specialists: [], skipped: [] };
-  const entries = readdirSync7(specialistsDir);
+  if (!existsSync9(specialistsDir)) return { specialists: [], skipped: [] };
+  const entries = readdirSync8(specialistsDir);
   const specialists = [];
   const skipped = [];
   for (const file of entries.sort()) {
     if (!file.endsWith(".md")) continue;
     let raw;
     try {
-      raw = readFileSync12(join11(specialistsDir, file), "utf-8");
+      raw = readFileSync12(join12(specialistsDir, file), "utf-8");
     } catch (err) {
       skipped.push({ file, reason: err instanceof Error ? err.message : String(err) });
       continue;
@@ -8117,7 +8123,7 @@ app6.get("/", requireAdminSession, async (c) => {
     let specialists = [];
     try {
       const roster = readSpecialistRoster(
-        resolve10(ACCOUNTS_DIR, accountId, "specialists", "agents")
+        resolve11(ACCOUNTS_DIR, accountId, "specialists", "agents")
       );
       specialists = roster.specialists;
       for (const s of roster.skipped) {
@@ -8152,8 +8158,8 @@ var webchat_greeting_default = app6;
 
 // server/routes/telegram.ts
 import { homedir } from "os";
-import { resolve as resolve11, join as join12 } from "path";
-import { existsSync as existsSync9, readFileSync as readFileSync13 } from "fs";
+import { resolve as resolve12, join as join13 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync13 } from "fs";
 
 // app/lib/telegram/access-control.ts
 function checkTelegramAccess(params) {
@@ -8203,9 +8209,9 @@ function routeTelegramUpdate(input) {
 var TAG22 = "[telegram-inbound]";
 var DISPATCH_TIMEOUT_MS = 12e4;
 function configDirName() {
-  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? resolve11(process.cwd(), "..");
-  const brandPath = join12(platformRoot2, "config", "brand.json");
-  if (existsSync9(brandPath)) {
+  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? resolve12(process.cwd(), "..");
+  const brandPath = join13(platformRoot2, "config", "brand.json");
+  if (existsSync10(brandPath)) {
     try {
       return JSON.parse(readFileSync13(brandPath, "utf-8")).configDir ?? ".maxy";
     } catch {
@@ -8215,7 +8221,7 @@ function configDirName() {
 }
 function secretPath(botType) {
   const filename = botType === "admin" ? ".telegram-admin-webhook-secret" : ".telegram-webhook-secret";
-  return resolve11(homedir(), configDirName(), filename);
+  return resolve12(homedir(), configDirName(), filename);
 }
 async function sendTelegram(botToken, chatId, text) {
   try {
@@ -8239,7 +8245,7 @@ app7.post("/", async (c) => {
     return c.json({ ok: false }, 400);
   }
   const sp = secretPath(botType);
-  if (!existsSync9(sp)) {
+  if (!existsSync10(sp)) {
     console.error(`${TAG22} op=reject reason=no-secret-file botType=${botType}`);
     return c.json({ ok: false }, 401);
   }
@@ -8306,12 +8312,12 @@ var telegram_default = app7;
 
 // server/routes/onboarding.ts
 import { spawn, spawnSync as spawnSync2, execFileSync as execFileSync2 } from "child_process";
-import { openSync as openSync2, closeSync as closeSync2, writeFileSync as writeFileSync7, writeSync, existsSync as existsSync11, readFileSync as readFileSync15, unlinkSync } from "fs";
+import { openSync as openSync2, closeSync as closeSync2, writeFileSync as writeFileSync7, writeSync, existsSync as existsSync12, readFileSync as readFileSync15, unlinkSync } from "fs";
 import { createHash as createHash3, randomUUID as randomUUID7 } from "crypto";
 
 // ../lib/admins-write/src/index.ts
-import { existsSync as existsSync10, readFileSync as readFileSync14, writeFileSync as writeFileSync6, renameSync as renameSync2, mkdirSync as mkdirSync2, readdirSync as readdirSync8, statSync as statSync5 } from "fs";
-import { dirname as dirname3, join as join13 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync14, writeFileSync as writeFileSync6, renameSync as renameSync2, mkdirSync as mkdirSync2, readdirSync as readdirSync9, statSync as statSync5 } from "fs";
+import { dirname as dirname3, join as join14 } from "path";
 function logLine(input, result) {
   const userIdShort = input.userId.slice(0, 8);
   console.error(
@@ -8328,7 +8334,7 @@ function writeAdminEntry(input) {
   const result = { usersJsonResult: "noop", accountJsonResult: "noop" };
   try {
     let users = [];
-    if (existsSync10(input.usersFile)) {
+    if (existsSync11(input.usersFile)) {
       const raw = readFileSync14(input.usersFile, "utf-8").trim();
       if (raw) {
         const parsed = JSON.parse(raw);
@@ -8353,8 +8359,8 @@ function writeAdminEntry(input) {
     return result;
   }
   try {
-    const accountJsonPath = join13(input.accountDir, "account.json");
-    if (!existsSync10(accountJsonPath)) {
+    const accountJsonPath = join14(input.accountDir, "account.json");
+    if (!existsSync11(accountJsonPath)) {
       throw new Error(`account.json not found at ${accountJsonPath}`);
     }
     const config = JSON.parse(readFileSync14(accountJsonPath, "utf-8"));
@@ -8381,7 +8387,7 @@ function checkAdminAuthInvariant(input) {
     usersWithoutAccount: []
   };
   const usersUserIds = /* @__PURE__ */ new Set();
-  if (existsSync10(input.usersFile)) {
+  if (existsSync11(input.usersFile)) {
     try {
       const raw = readFileSync14(input.usersFile, "utf-8").trim();
       if (raw) {
@@ -8396,10 +8402,10 @@ function checkAdminAuthInvariant(input) {
     }
   }
   const accountUserIds = /* @__PURE__ */ new Set();
-  if (existsSync10(input.accountsDir)) {
+  if (existsSync11(input.accountsDir)) {
     let entries;
     try {
-      entries = readdirSync8(input.accountsDir);
+      entries = readdirSync9(input.accountsDir);
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       console.error(`[${input.tag}] accounts-dir unreadable accountsDir=${input.accountsDir} error=${msg}`);
@@ -8408,14 +8414,14 @@ function checkAdminAuthInvariant(input) {
     }
     for (const entry of entries) {
       if (entry.startsWith(".")) continue;
-      const accountDir = join13(input.accountsDir, entry);
+      const accountDir = join14(input.accountsDir, entry);
       try {
         if (!statSync5(accountDir).isDirectory()) continue;
       } catch {
         continue;
       }
-      const accountJsonPath = join13(accountDir, "account.json");
-      if (!existsSync10(accountJsonPath)) continue;
+      const accountJsonPath = join14(accountDir, "account.json");
+      if (!existsSync11(accountJsonPath)) continue;
       let admins = [];
       try {
         const config = JSON.parse(readFileSync14(accountJsonPath, "utf-8"));
@@ -8458,7 +8464,7 @@ function hashPin2(pin) {
   return createHash3("sha256").update(pin).digest("hex");
 }
 function readUsersFile2() {
-  if (!existsSync11(USERS_FILE)) return null;
+  if (!existsSync12(USERS_FILE)) return null;
   const raw = readFileSync15(USERS_FILE, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
@@ -8512,7 +8518,7 @@ app8.post("/claude-auth", async (c) => {
     } catch (err) {
       logoutError = err instanceof Error ? err.message : String(err);
     }
-    const credentialsPresent = existsSync11(CLAUDE_CREDENTIALS_FILE);
+    const credentialsPresent = existsSync12(CLAUDE_CREDENTIALS_FILE);
     const ranMs = Date.now() - start;
     console.log(`[onboarding] op=claude-logout credentialsPresent=${credentialsPresent} ranMs=${ranMs} logoutError=${logoutError ? JSON.stringify(logoutError.slice(0, 120)) : "none"}`);
     return c.json({ logged_out: !credentialsPresent });
@@ -8619,7 +8625,7 @@ app8.post("/set-pin", async (c) => {
   console.log(`[set-pin] wrote users.json + account.json admins: userId=${userId.slice(0, 8)}\u2026 role=owner`);
   if (process.platform === "linux") {
     let installOwner = null;
-    if (existsSync11(INSTALL_OWNER_FILE)) {
+    if (existsSync12(INSTALL_OWNER_FILE)) {
       try {
         const raw = readFileSync15(INSTALL_OWNER_FILE, "utf-8").trim();
         if (raw.length > 0) installOwner = raw;
@@ -8702,9 +8708,9 @@ app8.delete("/set-pin", async (c) => {
 var onboarding_default = app8;
 
 // server/routes/client-error.ts
-import { appendFileSync, existsSync as existsSync12, renameSync as renameSync3, statSync as statSync6 } from "fs";
-import { join as join14 } from "path";
-var CLIENT_ERRORS_LOG = join14(LOG_DIR, "client-errors.log");
+import { appendFileSync, existsSync as existsSync13, renameSync as renameSync3, statSync as statSync6 } from "fs";
+import { join as join15 } from "path";
+var CLIENT_ERRORS_LOG = join15(LOG_DIR, "client-errors.log");
 var MAX_LOG_SIZE = 10 * 1024 * 1024;
 var MAX_BODY_SIZE = 8 * 1024;
 var MAX_STACK_LEN = 2e3;
@@ -8747,7 +8753,7 @@ function stackHead(stack) {
 }
 function rotateIfNeeded() {
   try {
-    if (!existsSync12(CLIENT_ERRORS_LOG)) return;
+    if (!existsSync13(CLIENT_ERRORS_LOG)) return;
     const stats = statSync6(CLIENT_ERRORS_LOG);
     if (stats.size < MAX_LOG_SIZE) return;
     renameSync3(CLIENT_ERRORS_LOG, CLIENT_ERRORS_LOG + ".1");
@@ -9029,18 +9035,18 @@ app10.post("/", async (c) => {
 var session_default = app10;
 
 // server/routes/admin/logs.ts
-import { existsSync as existsSync14, readdirSync as readdirSync9, readFileSync as readFileSync16, statSync as statSync7 } from "fs";
-import { resolve as resolve12, basename as basename4 } from "path";
+import { existsSync as existsSync15, readdirSync as readdirSync10, readFileSync as readFileSync16, statSync as statSync7 } from "fs";
+import { resolve as resolve13, basename as basename4 } from "path";
 
 // app/lib/logs-read-resolve.ts
-import { existsSync as existsSync13 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync14 } from "fs";
+import { join as join16 } from "path";
 function resolveSessionLogPaths(filename, logDirs) {
   const tried = [filename];
   const hits = [];
   for (const dir of logDirs) {
-    const fullPath = join15(dir, filename);
-    if (existsSync13(fullPath)) {
+    const fullPath = join16(dir, filename);
+    if (existsSync14(fullPath)) {
       hits.push({ path: fullPath, dir });
     }
   }
@@ -9057,7 +9063,7 @@ app11.get("/", async (c) => {
   const cacheKeyParam = c.req.query("cacheKey");
   const download = c.req.query("download") === "1";
   const account = resolveAccount();
-  const accountLogDir = account ? resolve12(account.accountDir, "logs") : null;
+  const accountLogDir = account ? resolve13(account.accountDir, "logs") : null;
   const logDirs = [];
   if (accountLogDir) logDirs.push(accountLogDir);
   logDirs.push(LOG_DIR);
@@ -9065,7 +9071,7 @@ app11.get("/", async (c) => {
     const safe = basename4(fileParam);
     const searched = [];
     for (const dir of logDirs) {
-      const filePath = resolve12(dir, safe);
+      const filePath = resolve13(dir, safe);
       searched.push(filePath);
       try {
         const buffer = readFileSync16(filePath);
@@ -9168,19 +9174,19 @@ app11.get("/", async (c) => {
   const seen = /* @__PURE__ */ new Set();
   const logs = {};
   for (const dir of logDirs) {
-    if (!existsSync14(dir)) continue;
+    if (!existsSync15(dir)) continue;
     let files;
     try {
-      files = readdirSync9(dir).filter((f) => f.endsWith(".log"));
+      files = readdirSync10(dir).filter((f) => f.endsWith(".log"));
     } catch (err) {
       const reason = err instanceof Error ? err.message : String(err);
       console.warn(`[admin/logs] readdir-fail dir=${dir} reason=${reason}`);
       continue;
     }
-    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync7(resolve12(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
+    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync7(resolve13(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
-        const content = readFileSync16(resolve12(dir, name));
+        const content = readFileSync16(resolve13(dir, name));
         const tail = content.length > TAIL_BYTES ? content.subarray(content.length - TAIL_BYTES).toString("utf-8") : content.toString("utf-8");
         logs[name] = tail.trim() || "(empty)";
       } catch (err) {
@@ -9219,8 +9225,8 @@ var claude_info_default = app12;
 
 // server/routes/admin/attachment.ts
 import { readFile as readFile2, readdir } from "fs/promises";
-import { existsSync as existsSync15 } from "fs";
-import { resolve as resolve13 } from "path";
+import { existsSync as existsSync16 } from "fs";
+import { resolve as resolve14 } from "path";
 var app13 = new Hono();
 app13.get("/:attachmentId", requireAdminSession, async (c) => {
   const attachmentId = c.req.param("attachmentId");
@@ -9232,12 +9238,12 @@ app13.get("/:attachmentId", requireAdminSession, async (c) => {
   if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(attachmentId)) {
     return new Response("Not found", { status: 404 });
   }
-  const dir = resolve13(ATTACHMENTS_ROOT, accountId, attachmentId);
-  if (!existsSync15(dir)) {
+  const dir = resolve14(ATTACHMENTS_ROOT, accountId, attachmentId);
+  if (!existsSync16(dir)) {
     return new Response("Not found", { status: 404 });
   }
-  const metaPath = resolve13(dir, `${attachmentId}.meta.json`);
-  if (!existsSync15(metaPath)) {
+  const metaPath = resolve14(dir, `${attachmentId}.meta.json`);
+  if (!existsSync16(metaPath)) {
     return new Response("Not found", { status: 404 });
   }
   let meta;
@@ -9251,7 +9257,7 @@ app13.get("/:attachmentId", requireAdminSession, async (c) => {
   if (!dataFile) {
     return new Response("Not found", { status: 404 });
   }
-  const filePath = resolve13(dir, dataFile);
+  const filePath = resolve14(dir, dataFile);
   const buffer = await readFile2(filePath);
   return new Response(new Uint8Array(buffer), {
     headers: {
@@ -9264,22 +9270,22 @@ app13.get("/:attachmentId", requireAdminSession, async (c) => {
 var attachment_default = app13;
 
 // server/routes/admin/agents.ts
-import { resolve as resolve14 } from "path";
-import { readdirSync as readdirSync10, readFileSync as readFileSync17, existsSync as existsSync16, rmSync } from "fs";
+import { resolve as resolve15 } from "path";
+import { readdirSync as readdirSync11, readFileSync as readFileSync17, existsSync as existsSync17, rmSync } from "fs";
 var app14 = new Hono();
 app14.get("/", (c) => {
   const account = resolveAccount();
   if (!account) return c.json({ agents: [] });
-  const agentsDir = resolve14(account.accountDir, "agents");
-  if (!existsSync16(agentsDir)) return c.json({ agents: [] });
+  const agentsDir = resolve15(account.accountDir, "agents");
+  if (!existsSync17(agentsDir)) return c.json({ agents: [] });
   const agents = [];
   try {
-    const entries = readdirSync10(agentsDir, { withFileTypes: true });
+    const entries = readdirSync11(agentsDir, { withFileTypes: true });
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
       if (!entry.isDirectory()) continue;
       if (entry.name === "admin") continue;
-      const configPath2 = resolve14(agentsDir, entry.name, "config.json");
-      if (!existsSync16(configPath2)) continue;
+      const configPath2 = resolve15(agentsDir, entry.name, "config.json");
+      if (!existsSync17(configPath2)) continue;
       try {
         const config = JSON.parse(readFileSync17(configPath2, "utf-8"));
         agents.push({
@@ -9307,8 +9313,8 @@ app14.delete("/:slug", async (c) => {
   if (slug.includes("/") || slug.includes("..") || slug.includes("\\")) {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
-  const agentDir = resolve14(account.accountDir, "agents", slug);
-  if (!existsSync16(agentDir)) {
+  const agentDir = resolve15(account.accountDir, "agents", slug);
+  if (!existsSync17(agentDir)) {
     return c.json({ error: "Agent not found" }, 404);
   }
   try {
@@ -9337,8 +9343,8 @@ app14.post("/:slug/project", async (c) => {
   if (slug.includes("/") || slug.includes("..") || slug.includes("\\")) {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
-  const agentDir = resolve14(account.accountDir, "agents", slug);
-  if (!existsSync16(agentDir)) {
+  const agentDir = resolve15(account.accountDir, "agents", slug);
+  if (!existsSync17(agentDir)) {
     return c.json({ error: "Agent not found on disk" }, 404);
   }
   try {
@@ -9354,7 +9360,7 @@ var agents_default = app14;
 // server/routes/admin/sessions.ts
 import crypto2 from "crypto";
 import { resolve as resolvePath } from "path";
-import { existsSync as existsSync17, mkdirSync as mkdirSync3, createWriteStream } from "fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync3, createWriteStream } from "fs";
 
 // ../lib/admin-conversation-purge/src/index.ts
 async function purgeAdminConversationJsonls(args) {
@@ -9514,7 +9520,7 @@ function validateAndShapeAttachments(raws, conversationAccountId, sessionId, mes
     let reason = null;
     if (!a.attachmentId || !a.filename || !a.mimeType || !a.storagePath) reason = "schema-fail";
     else if (a.accountId !== conversationAccountId) reason = "account-mismatch";
-    else if (!existsSync17(a.storagePath)) reason = "missing-file";
+    else if (!existsSync18(a.storagePath)) reason = "missing-file";
     if (reason) {
       invalid++;
       try {
@@ -10040,8 +10046,8 @@ app15.put("/:id/label", requireAdminSession, async (c) => {
 var sessions_default = app15;
 
 // app/lib/claude-agent/spawn-context.ts
-import { existsSync as existsSync18, readFileSync as readFileSync18, readdirSync as readdirSync11, statSync as statSync8 } from "fs";
-import { dirname as dirname4, resolve as resolve15, join as join16 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync18, readdirSync as readdirSync12, statSync as statSync8 } from "fs";
+import { dirname as dirname4, resolve as resolve16, join as join17 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
   try {
@@ -10070,12 +10076,12 @@ function frontmatterField(manifest, field2) {
 function extractPluginToolDescriptions(pluginDir) {
   const out = /* @__PURE__ */ new Map();
   const candidates = [
-    join16(pluginDir, "mcp/dist/index.js"),
-    join16(pluginDir, "mcp/src/index.ts")
+    join17(pluginDir, "mcp/dist/index.js"),
+    join17(pluginDir, "mcp/src/index.ts")
   ];
   let raw = null;
   for (const path2 of candidates) {
-    if (!existsSync18(path2)) continue;
+    if (!existsSync19(path2)) continue;
     try {
       raw = readFileSync18(path2, "utf-8");
       break;
@@ -10126,24 +10132,24 @@ function parseSkillPathsFromFrontmatter(fm) {
 }
 function listPluginDirs() {
   const out = /* @__PURE__ */ new Map();
-  const platformPlugins = resolve15(PLATFORM_ROOT, "plugins");
-  if (existsSync18(platformPlugins)) {
-    for (const name of readdirSync11(platformPlugins)) {
-      const dir = join16(platformPlugins, name);
+  const platformPlugins = resolve16(PLATFORM_ROOT, "plugins");
+  if (existsSync19(platformPlugins)) {
+    for (const name of readdirSync12(platformPlugins)) {
+      const dir = join17(platformPlugins, name);
       try {
         if (statSync8(dir).isDirectory()) out.set(name, dir);
       } catch {
       }
     }
   }
-  const premiumRoot = resolve15(dirname4(PLATFORM_ROOT), "premium-plugins");
-  if (existsSync18(premiumRoot)) {
-    for (const bundle of readdirSync11(premiumRoot)) {
-      const bundlePlugins = join16(premiumRoot, bundle, "plugins");
-      if (!existsSync18(bundlePlugins)) continue;
+  const premiumRoot = resolve16(dirname4(PLATFORM_ROOT), "premium-plugins");
+  if (existsSync19(premiumRoot)) {
+    for (const bundle of readdirSync12(premiumRoot)) {
+      const bundlePlugins = join17(premiumRoot, bundle, "plugins");
+      if (!existsSync19(bundlePlugins)) continue;
       try {
-        for (const name of readdirSync11(bundlePlugins)) {
-          const dir = join16(bundlePlugins, name);
+        for (const name of readdirSync12(bundlePlugins)) {
+          const dir = join17(bundlePlugins, name);
           try {
             if (statSync8(dir).isDirectory()) out.set(name, dir);
           } catch {
@@ -10156,8 +10162,8 @@ function listPluginDirs() {
   return out;
 }
 function readEnabledPlugins(accountId) {
-  const accountFile = resolve15(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync18(accountFile)) return /* @__PURE__ */ new Set();
+  const accountFile = resolve16(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
+  if (!existsSync19(accountFile)) return /* @__PURE__ */ new Set();
   try {
     const parsed = JSON.parse(readFileSync18(accountFile, "utf-8"));
     return new Set(
@@ -10168,7 +10174,7 @@ function readEnabledPlugins(accountId) {
   }
 }
 function readFrontmatter(path2) {
-  if (!existsSync18(path2)) return null;
+  if (!existsSync19(path2)) return null;
   let raw;
   try {
     raw = readFileSync18(path2, "utf-8");
@@ -10186,7 +10192,7 @@ function computeActivePlugins(accountId) {
   for (const name of Array.from(enabled).sort()) {
     const dir = pluginDirs.get(name);
     if (!dir) continue;
-    const fm = readFrontmatter(join16(dir, "PLUGIN.md"));
+    const fm = readFrontmatter(join17(dir, "PLUGIN.md"));
     if (!fm) continue;
     const description = frontmatterField(`---
 ${fm}
@@ -10203,7 +10209,7 @@ ${fm}
       `plugin-manifest-tool-coverage plugin=${name} tools=${tools.length} with-desc=${withDesc}`
     );
     if (toolNames.length > 0 && descMap.size === 0) {
-      const hasSource = existsSync18(join16(dir, "mcp/dist/index.js")) || existsSync18(join16(dir, "mcp/src/index.ts"));
+      const hasSource = existsSync19(join17(dir, "mcp/dist/index.js")) || existsSync19(join17(dir, "mcp/src/index.ts"));
       if (hasSource) {
         console.warn(
           `[spawn-context] WARN plugin=${name} mcp source present but tool-description regex matched zero entries \u2014 SDK upgrade may have changed the registration shape`
@@ -10213,7 +10219,7 @@ ${fm}
     const skillPaths = parseSkillPathsFromFrontmatter(fm);
     const skills = [];
     for (const relPath of skillPaths) {
-      const skillPath = join16(dir, relPath);
+      const skillPath = join17(dir, relPath);
       const skillFm = readFrontmatter(skillPath);
       if (!skillFm) continue;
       const skillName = frontmatterField(`---
@@ -10229,11 +10235,11 @@ ${skillFm}
   return out;
 }
 function computeSpecialistDomains(accountId) {
-  const specialistsDir = resolve15(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
-  if (!existsSync18(specialistsDir)) return [];
+  const specialistsDir = resolve16(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
+  if (!existsSync19(specialistsDir)) return [];
   let entries;
   try {
-    entries = readdirSync11(specialistsDir);
+    entries = readdirSync12(specialistsDir);
   } catch {
     return [];
   }
@@ -10257,7 +10263,7 @@ function computeSpecialistDomains(accountId) {
   const out = [];
   for (const file of entries.sort()) {
     if (!file.endsWith(".md")) continue;
-    const fm = readFrontmatter(join16(specialistsDir, file));
+    const fm = readFrontmatter(join17(specialistsDir, file));
     if (!fm) continue;
     const wrapped = `---
 ${fm}
@@ -10275,8 +10281,8 @@ ${fm}
   return out;
 }
 function computeDormantPlugins(accountId) {
-  const accountFile = resolve15(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync18(accountFile)) return [];
+  const accountFile = resolve16(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
+  if (!existsSync19(accountFile)) return [];
   let enabled;
   try {
     const raw = readFileSync18(accountFile, "utf-8");
@@ -10290,19 +10296,19 @@ function computeDormantPlugins(accountId) {
     );
     return [];
   }
-  const pluginsDir = resolve15(PLATFORM_ROOT, "plugins");
-  if (!existsSync18(pluginsDir)) return [];
+  const pluginsDir = resolve16(PLATFORM_ROOT, "plugins");
+  if (!existsSync19(pluginsDir)) return [];
   let entries;
   try {
-    entries = readdirSync11(pluginsDir);
+    entries = readdirSync12(pluginsDir);
   } catch {
     return [];
   }
   const out = [];
   for (const name of entries) {
     if (enabled.has(name)) continue;
-    const manifestPath = resolve15(pluginsDir, name, "PLUGIN.md");
-    if (!existsSync18(manifestPath)) continue;
+    const manifestPath = resolve16(pluginsDir, name, "PLUGIN.md");
+    if (!existsSync19(manifestPath)) continue;
     let manifest;
     try {
       manifest = readFileSync18(manifestPath, "utf-8");
@@ -10319,11 +10325,11 @@ function computeDormantPlugins(accountId) {
 }
 
 // server/routes/admin/claude-sessions.ts
-import { existsSync as existsSync19, readFileSync as readFileSync19 } from "fs";
-import { resolve as resolve16 } from "path";
+import { existsSync as existsSync20, readFileSync as readFileSync19 } from "fs";
+import { resolve as resolve17 } from "path";
 function readTunnelState(brandConfigDir) {
   const statePath = `${process.env.HOME ?? ""}/${brandConfigDir}/cloudflared/tunnel.state`;
-  if (!existsSync19(statePath)) return null;
+  if (!existsSync20(statePath)) return null;
   try {
     const parsed = JSON.parse(readFileSync19(statePath, "utf-8"));
     const tunnelId = typeof parsed.tunnelId === "string" ? parsed.tunnelId : null;
@@ -10336,10 +10342,10 @@ function readTunnelState(brandConfigDir) {
   }
 }
 function resolveTunnelUrl() {
-  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve16(process.cwd(), "..");
+  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve17(process.cwd(), "..");
   let brand;
   try {
-    brand = JSON.parse(readFileSync19(resolve16(platformRoot2, "config", "brand.json"), "utf-8"));
+    brand = JSON.parse(readFileSync19(resolve17(platformRoot2, "config", "brand.json"), "utf-8"));
   } catch {
     return null;
   }
@@ -10584,15 +10590,15 @@ var events_default = app18;
 import { createReadStream as createReadStream2 } from "fs";
 import { readdir as readdir3, readFile as readFile4, stat as stat4, mkdir as mkdir3, writeFile as writeFile4, unlink as unlink2 } from "fs/promises";
 import { realpathSync as realpathSync4 } from "fs";
-import { basename as basename6, dirname as dirname5, join as join18, resolve as resolve19, sep as sep5 } from "path";
+import { basename as basename6, dirname as dirname5, join as join19, resolve as resolve20, sep as sep5 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // app/lib/data-path.ts
 import { realpathSync as realpathSync3 } from "fs";
-import { resolve as resolve17, normalize, sep as sep3, relative } from "path";
-var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT ?? resolve17(process.cwd(), "../platform");
-var DATA_ROOT = resolve17(PLATFORM_ROOT5, "..", "data");
-var CLAUDE_UPLOADS_ROOT = process.env.CLAUDE_CONFIG_DIR ? resolve17(process.env.CLAUDE_CONFIG_DIR, "uploads") : null;
+import { resolve as resolve18, normalize, sep as sep3, relative } from "path";
+var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT ?? resolve18(process.cwd(), "../platform");
+var DATA_ROOT = resolve18(PLATFORM_ROOT5, "..", "data");
+var CLAUDE_UPLOADS_ROOT = process.env.CLAUDE_CONFIG_DIR ? resolve18(process.env.CLAUDE_CONFIG_DIR, "uploads") : null;
 var ACCOUNT_PARTITION_DIRS = /* @__PURE__ */ new Set(["uploads", "accounts"]);
 var ACCOUNT_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function crossesForeignAccountPartition(relPath, accountId) {
@@ -10605,7 +10611,7 @@ function crossesForeignAccountPartition(relPath, accountId) {
 }
 function resolveUnderRoot(raw, rootAbs, rootLabel) {
   const cleaned = normalize("/" + (raw ?? "").replace(/\\/g, "/")).replace(/^\/+/, "");
-  const absolute = resolve17(rootAbs, cleaned);
+  const absolute = resolve18(rootAbs, cleaned);
   let rootReal;
   try {
     rootReal = realpathSync3(rootAbs);
@@ -10964,7 +10970,7 @@ async function cascadeDeleteDocument(params) {
 
 // app/lib/file-index.ts
 import * as fsp from "fs/promises";
-import { resolve as resolve18, relative as relative2, join as join17, basename as basename5, extname as extname2, sep as sep4 } from "path";
+import { resolve as resolve19, relative as relative2, join as join18, basename as basename5, extname as extname2, sep as sep4 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
@@ -11035,7 +11041,7 @@ async function extractPdf(absolute) {
   return stdout.trim();
 }
 async function ocrPdf(absolute) {
-  const outPdf = join17(tmpdir2(), `file-index-ocr-${process.pid}-${Date.now()}.pdf`);
+  const outPdf = join18(tmpdir2(), `file-index-ocr-${process.pid}-${Date.now()}.pdf`);
   try {
     await execFileAsync2(
       "ocrmypdf",
@@ -11097,7 +11103,7 @@ async function readDisplayName(absolute) {
   const stem = dot === -1 ? base : base.slice(0, dot);
   if (base === `${stem}.meta.json`) return null;
   try {
-    const raw = await fsp.readFile(join17(dir, `${stem}.meta.json`), "utf-8");
+    const raw = await fsp.readFile(join18(dir, `${stem}.meta.json`), "utf-8");
     const meta = JSON.parse(raw);
     const dn = meta.displayName ?? meta.filename;
     return typeof dn === "string" && dn.length > 0 ? dn : null;
@@ -11117,7 +11123,7 @@ async function walkSubtree(root, dataRoot, out) {
   let clean = true;
   for (const entry of entries) {
     if (entry.isSymbolicLink()) continue;
-    const abs = join17(root, entry.name);
+    const abs = join18(root, entry.name);
     if (entry.isDirectory()) {
       const sub = await walkSubtree(abs, dataRoot, out);
       if (!sub.clean) clean = false;
@@ -11272,8 +11278,8 @@ async function reconcileFileIndex(accountId, opts) {
   return withSession(opts, async (session) => {
     const walked = [];
     const subtreeRoots = [
-      resolve18(dataRoot, "uploads", accountId),
-      resolve18(dataRoot, "accounts", accountId)
+      resolve19(dataRoot, "uploads", accountId),
+      resolve19(dataRoot, "accounts", accountId)
     ];
     let clean = true;
     for (const root of subtreeRoots) {
@@ -11354,7 +11360,7 @@ async function reconcileFileIndexDebounced(accountId, opts) {
 async function indexFile(accountId, relativePath, opts) {
   const dataRoot = opts?.dataRoot ?? DATA_ROOT;
   const embed2 = opts?.embed ?? embed;
-  const absolute = resolve18(dataRoot, relativePath);
+  const absolute = resolve19(dataRoot, relativePath);
   await withSession(opts, async (session) => {
     const st = await fsp.stat(absolute);
     const wf = {
@@ -11388,7 +11394,7 @@ async function dropFileIndex(accountId, relativePath, opts) {
 var UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function readMeta(absDir, baseName) {
   try {
-    const raw = await readFile4(join18(absDir, `${baseName}.meta.json`), "utf8");
+    const raw = await readFile4(join19(absDir, `${baseName}.meta.json`), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.filename === "string") {
       return { filename: parsed.filename, mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0 };
@@ -11399,7 +11405,7 @@ async function readMeta(absDir, baseName) {
 }
 async function readAccountNames() {
   const map = /* @__PURE__ */ new Map();
-  const accountsDir = resolve19(DATA_ROOT, "accounts");
+  const accountsDir = resolve20(DATA_ROOT, "accounts");
   let names;
   try {
     names = await readdir3(accountsDir);
@@ -11408,7 +11414,7 @@ async function readAccountNames() {
   }
   for (const name of names) {
     if (!UUID_RE3.test(name)) continue;
-    const configPath2 = resolve19(accountsDir, name, "account.json");
+    const configPath2 = resolve20(accountsDir, name, "account.json");
     try {
       const raw = await readFile4(configPath2, "utf8");
       const parsed = JSON.parse(raw);
@@ -11426,7 +11432,7 @@ async function readAccountNames() {
 }
 async function enrich(absolute, entry, accountNames) {
   if (entry.kind === "directory" && UUID_RE3.test(entry.name)) {
-    const meta = await readMeta(join18(absolute, entry.name), entry.name);
+    const meta = await readMeta(join19(absolute, entry.name), entry.name);
     if (meta?.filename) {
       entry.displayName = meta.filename;
       entry.mimeType = meta.mimeType;
@@ -11524,7 +11530,7 @@ app19.get("/", requireAdminSession, async (c) => {
         continue;
       }
       try {
-        const entryPath = join18(absolute, name);
+        const entryPath = join19(absolute, name);
         const s = await stat4(entryPath);
         entries.push({
           name,
@@ -11649,8 +11655,8 @@ app19.post("/upload", requireAdminSession, async (c) => {
   }
   const safeName = basename6(file.name).replace(/[\0/\\]/g, "_");
   const finalName = `${Date.now()}-${safeName}`;
-  const destDir = resolve19(DATA_ROOT, "uploads", accountId);
-  const destPath = resolve19(destDir, finalName);
+  const destDir = resolve20(DATA_ROOT, "uploads", accountId);
+  const destPath = resolve20(destDir, finalName);
   try {
     await mkdir3(destDir, { recursive: true });
     const dataRootReal = realpathSync4(DATA_ROOT);
@@ -11715,7 +11721,7 @@ app19.delete("/", requireAdminSession, async (c) => {
     }
     const dot = base.lastIndexOf(".");
     const stem = dot === -1 ? base : base.slice(0, dot);
-    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join18(dirname5(absolute), `${stem}.meta.json`) : null;
+    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join19(dirname5(absolute), `${stem}.meta.json`) : null;
     await unlink2(absolute);
     if (sidecarPath) {
       try {
@@ -13764,8 +13770,8 @@ var graph_default_view_default = app25;
 
 // server/routes/admin/sidebar-artefacts.ts
 import { readdir as readdir4, stat as stat5 } from "fs/promises";
-import { resolve as resolve20, relative as relative3, isAbsolute, sep as sep6, basename as basename7 } from "path";
-import { existsSync as existsSync20 } from "fs";
+import { resolve as resolve21, relative as relative3, isAbsolute, sep as sep6, basename as basename7 } from "path";
+import { existsSync as existsSync21 } from "fs";
 var LIMIT = 50;
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
 function toDataRootRelPath(absPath) {
@@ -13784,7 +13790,7 @@ app26.get("/", requireAdminSession, async (c) => {
   if (accountFiles === null) {
     return c.json({ error: "Failed to load artefacts" }, 500);
   }
-  const accountDir = resolve20(ACCOUNTS_DIR, accountId);
+  const accountDir = resolve21(ACCOUNTS_DIR, accountId);
   const agents = await fetchAgentTemplateRows(accountDir);
   const artefacts = [...accountFiles, ...agents].sort(
     (a, b) => (b.updatedAt ?? "").localeCompare(a.updatedAt ?? "")
@@ -13835,8 +13841,8 @@ async function fetchAccountFileArtefacts(accountId) {
 async function fetchAgentTemplateRows(accountDir) {
   const rows = [];
   for (const filename of ADMIN_AGENT_FILES) {
-    const overridePath = resolve20(accountDir, "agents", "admin", filename);
-    const bundledPath = resolve20(PLATFORM_ROOT, "templates", "agents", "admin", filename);
+    const overridePath = resolve21(accountDir, "agents", "admin", filename);
+    const bundledPath = resolve21(PLATFORM_ROOT, "templates", "agents", "admin", filename);
     const labelStem = filename.replace(/\.md$/, "");
     const row = await readAgentTemplateRow({
       id: `agent-template:admin:${filename}`,
@@ -13849,12 +13855,12 @@ async function fetchAgentTemplateRows(accountDir) {
     });
     if (row) rows.push(row);
   }
-  const overrideDir = resolve20(accountDir, "specialists", "agents");
-  const bundledDir = resolve20(PLATFORM_ROOT, "templates", "specialists", "agents");
+  const overrideDir = resolve21(accountDir, "specialists", "agents");
+  const bundledDir = resolve21(PLATFORM_ROOT, "templates", "specialists", "agents");
   const specialistNames = await unionSpecialistFilenames(overrideDir, bundledDir);
   for (const filename of specialistNames) {
-    const overridePath = resolve20(overrideDir, filename);
-    const bundledPath = resolve20(bundledDir, filename);
+    const overridePath = resolve21(overrideDir, filename);
+    const bundledPath = resolve21(bundledDir, filename);
     const row = await readAgentTemplateRow({
       id: `agent-template:specialist:${filename}`,
       displayName: filename.replace(/\.md$/, ""),
@@ -13871,7 +13877,7 @@ async function fetchAgentTemplateRows(accountDir) {
 async function unionSpecialistFilenames(overrideDir, bundledDir) {
   const names = /* @__PURE__ */ new Set();
   for (const dir of [overrideDir, bundledDir]) {
-    if (!existsSync20(dir)) continue;
+    if (!existsSync21(dir)) continue;
     try {
       const entries = await readdir4(dir);
       for (const entry of entries) {
@@ -13886,7 +13892,7 @@ async function unionSpecialistFilenames(overrideDir, bundledDir) {
 }
 async function readAgentTemplateRow(inp) {
   let chosenPath = null;
-  if (existsSync20(inp.overridePath)) {
+  if (existsSync21(inp.overridePath)) {
     try {
       validateFilePathInAccount(inp.overridePath, inp.overrideRoot);
       chosenPath = inp.overridePath;
@@ -13897,7 +13903,7 @@ async function readAgentTemplateRow(inp) {
       );
       return null;
     }
-  } else if (existsSync20(inp.bundledPath)) {
+  } else if (existsSync21(inp.bundledPath)) {
     if (!isWithin(inp.bundledPath, inp.bundledRoot)) {
       console.error(
         `[admin/sidebar-artefacts] agent-template-read-failed agent=${inp.displayName} kind=${inp.logName} error="bundled path outside PLATFORM_ROOT"`
@@ -14062,6 +14068,36 @@ app29.post("/", requireAdminSession, async (c) => {
 var session_archive_default = app29;
 
 // server/routes/admin/session-rc-spawn.ts
+import { randomUUID as randomUUID9 } from "crypto";
+function resolveSpawnPlan(host, operatorDomains, body, mintId = randomUUID9) {
+  const operator = isOperatorHost(host, operatorDomains);
+  const resumeId = typeof body.sessionId === "string" && body.sessionId.length > 0 ? body.sessionId : void 0;
+  const name = typeof body.name === "string" && body.name.length > 0 ? body.name : void 0;
+  const webchatBind = resumeId === void 0 || operator;
+  const kind = resumeId === void 0 ? "new" : "resume";
+  const origin = operator ? "operator" : "admin";
+  const payload = {};
+  let sessionId;
+  if (webchatBind) {
+    sessionId = resumeId ?? mintId();
+    const key = `session:${sessionId}`;
+    payload.sessionId = sessionId;
+    payload.role = "admin";
+    payload.channel = "webchat";
+    payload.senderId = key;
+    payload.webchatChannel = webchatChannelDescriptor(key);
+    if (name) payload.name = name;
+  } else {
+    sessionId = resumeId;
+    payload.sessionId = resumeId;
+    if (name) payload.name = name;
+  }
+  return { webchatBind, origin, kind, sessionId, payload };
+}
+function shapeWebchatResponse(sessionId, manager) {
+  const outcome = typeof manager?.outcome === "string" ? manager.outcome : "bound";
+  return { sessionId, outcome, target: `/chat?session=${sessionId}` };
+}
 var app30 = new Hono();
 app30.post("/", requireAdminSession, async (c) => {
   let body;
@@ -14070,19 +14106,26 @@ app30.post("/", requireAdminSession, async (c) => {
   } catch {
     body = {};
   }
-  const payload = {};
-  if (typeof body.sessionId === "string" && body.sessionId.length > 0) payload.sessionId = body.sessionId;
-  if (typeof body.name === "string" && body.name.length > 0) payload.name = body.name;
+  const host = (c.req.header("host") ?? "").split(":")[0];
+  const plan = resolveSpawnPlan(host, getOperatorDomains(), body);
+  const spawnReqId = randomUUID9();
+  console.log(
+    `[chat-spawn] op=request spawnReqId=${spawnReqId} origin=${plan.origin} kind=${plan.kind} sessionId=${plan.kind === "new" ? "new" : plan.sessionId}`
+  );
+  if (plan.webchatBind) {
+    console.log(`[chat-spawn] op=args spawnReqId=${spawnReqId} webchatChannel=present sessionId=${plan.sessionId}`);
+  }
   let res;
   try {
     res = await fetch(`${managerBase3("session-rc-spawn:wrapper")}/rc-spawn`, {
       method: "POST",
       headers: { "content-type": "application/json" },
-      body: JSON.stringify(payload)
+      body: JSON.stringify(plan.payload)
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.error(`[session-rc-spawn] manager-unreachable err=${msg}`);
+    console.log(`[chat-spawn] op=exit spawnReqId=${spawnReqId} outcome=spawn-failed`);
     return c.json({ error: `session manager unreachable: ${msg}` }, 502);
   }
   const text = await res.text();
@@ -14093,8 +14136,18 @@ app30.post("/", requireAdminSession, async (c) => {
   }
   if (!res.ok) {
     console.error(`[session-rc-spawn] manager-error status=${res.status} body=${text.slice(0, 200)}`);
+    console.log(`[chat-spawn] op=exit spawnReqId=${spawnReqId} outcome=spawn-failed`);
     return c.json(parsed ?? { error: text }, res.status);
   }
+  if (plan.webchatBind) {
+    const target = `/chat?session=${plan.sessionId}`;
+    console.log(
+      `[chat-spawn] op=acquired spawnReqId=${spawnReqId} pid=${parsed?.spawnedPid ?? "none"} sessionId=${plan.sessionId}`
+    );
+    console.log(`[chat-spawn] op=navigate spawnReqId=${spawnReqId} target=${target}`);
+    console.log(`[chat-spawn] op=exit spawnReqId=${spawnReqId} outcome=bound`);
+    return c.json(shapeWebchatResponse(plan.sessionId, parsed));
+  }
   return c.json(parsed ?? {});
 });
 var session_rc_spawn_default = app30;
@@ -14221,23 +14274,23 @@ app31.get("/", async (c) => {
 var system_stats_default = app31;
 
 // server/routes/admin/health.ts
-import { existsSync as existsSync21, readFileSync as readFileSync20 } from "fs";
-import { resolve as resolve21, join as join19 } from "path";
-var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve21(process.cwd(), "..");
+import { existsSync as existsSync22, readFileSync as readFileSync20 } from "fs";
+import { resolve as resolve22, join as join20 } from "path";
+var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve22(process.cwd(), "..");
 var brandHostname = "maxy";
-var brandJsonPath = join19(PLATFORM_ROOT6, "config", "brand.json");
-if (existsSync21(brandJsonPath)) {
+var brandJsonPath = join20(PLATFORM_ROOT6, "config", "brand.json");
+if (existsSync22(brandJsonPath)) {
   try {
     const brand = JSON.parse(readFileSync20(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
   } catch {
   }
 }
-var VERSION_FILE = resolve21(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
+var VERSION_FILE = resolve22(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
-  if (!existsSync21(VERSION_FILE)) return "unknown";
+  if (!existsSync22(VERSION_FILE)) return "unknown";
   return readFileSync20(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
@@ -14289,7 +14342,7 @@ app32.get("/", async (c) => {
 var health_default2 = app32;
 
 // server/routes/admin/linkedin-ingest.ts
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 var TAG25 = "[linkedin-ingest-route]";
 var UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 var ISO = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/;
@@ -14415,7 +14468,7 @@ app33.post("/", requireAdminSession, async (c) => {
   );
   const initialMessage = buildInitialMessage(envelope);
   const spawnStart = Date.now();
-  const sessionId = randomUUID9();
+  const sessionId = randomUUID10();
   console.log(TAG25 + " route target=rc-spawn dispatchId=" + envelope.dispatchId + " sessionId=" + sessionId.slice(0, 8));
   const spawned = await managerRcSpawn({
     sessionId,
@@ -14781,13 +14834,13 @@ var admin_default = app39;
 // app/lib/access-gate.ts
 import neo4j4 from "neo4j-driver";
 import { readFileSync as readFileSync21 } from "fs";
-import { resolve as resolve22 } from "path";
-import { randomUUID as randomUUID10 } from "crypto";
-var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve22(process.cwd(), "..");
+import { resolve as resolve23 } from "path";
+import { randomUUID as randomUUID11 } from "crypto";
+var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve23(process.cwd(), "..");
 var driver = null;
 function readPassword() {
   if (process.env.NEO4J_PASSWORD) return process.env.NEO4J_PASSWORD;
-  const passwordFile = resolve22(PLATFORM_ROOT7, "config/.neo4j-password");
+  const passwordFile = resolve23(PLATFORM_ROOT7, "config/.neo4j-password");
   try {
     return readFileSync21(passwordFile, "utf-8").trim();
   } catch {
@@ -14965,7 +15018,7 @@ async function consumeMagicTokenAndActivate(grantId) {
   }
 }
 async function generateNewMagicToken(grantId) {
-  const token = randomUUID10();
+  const token = randomUUID11();
   const session = getSession3();
   try {
     const result = await session.run(
@@ -15077,9 +15130,9 @@ var verify_token_default = app40;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
-import { resolve as resolve23 } from "path";
-var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT ?? resolve23(process.cwd(), "..");
-var SEND_SCRIPT = resolve23(
+import { resolve as resolve24 } from "path";
+var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT ?? resolve24(process.cwd(), "..");
+var SEND_SCRIPT = resolve24(
   PLATFORM_ROOT8,
   "plugins",
   "email",
@@ -15221,8 +15274,8 @@ app42.route("/request-magic-link", request_magic_link_default);
 var access_default = app42;
 
 // server/routes/sites.ts
-import { existsSync as existsSync22, readFileSync as readFileSync22, realpathSync as realpathSync5, statSync as statSync9 } from "fs";
-import { resolve as resolve24 } from "path";
+import { existsSync as existsSync23, readFileSync as readFileSync22, realpathSync as realpathSync5, statSync as statSync9 } from "fs";
+import { resolve as resolve25 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
   ".html": "text/html; charset=utf-8",
@@ -15279,15 +15332,15 @@ app43.get("/:rel{.*}", (c) => {
     }
     segments.push(seg);
   }
-  const rootDir = resolve24(account.accountDir, "sites");
-  let filePath = segments.length === 0 ? rootDir : resolve24(rootDir, ...segments);
+  const rootDir = resolve25(account.accountDir, "sites");
+  let filePath = segments.length === 0 ? rootDir : resolve25(rootDir, ...segments);
   if (filePath !== rootDir && !filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
   let stat7;
   try {
-    stat7 = existsSync22(filePath) ? statSync9(filePath) : null;
+    stat7 = existsSync23(filePath) ? statSync9(filePath) : null;
   } catch {
     stat7 = null;
   }
@@ -15300,13 +15353,13 @@ app43.get("/:rel{.*}", (c) => {
     return c.redirect(target, 301);
   }
   if (stat7?.isDirectory()) {
-    filePath = resolve24(filePath, "index.html");
+    filePath = resolve25(filePath, "index.html");
   }
   if (!filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync22(filePath)) {
+  if (!existsSync23(filePath)) {
     console.error(`[sites] not-found path=${reqPath} status=404`);
     return c.text("Not found", 404);
   }
@@ -15437,8 +15490,8 @@ var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync23, readFileSync as readFileSync24 } from "fs";
-import { join as join20 } from "path";
+import { existsSync as existsSync24, readFileSync as readFileSync24 } from "fs";
+import { join as join21 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
 function readBrandConfig() {
@@ -15446,8 +15499,8 @@ function readBrandConfig() {
   cachedAttempted = true;
   const platformRoot2 = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot2) return null;
-  const brandPath = join20(platformRoot2, "config", "brand.json");
-  if (!existsSync23(brandPath)) return null;
+  const brandPath = join21(platformRoot2, "config", "brand.json");
+  if (!existsSync24(brandPath)) return null;
   try {
     cached2 = JSON.parse(readFileSync24(brandPath, "utf-8"));
     return cached2;
@@ -15937,14 +15990,14 @@ async function writeEvent(opts) {
 var visitor_event_default = app46;
 
 // server/routes/session.ts
-import { resolve as resolve25 } from "path";
-import { existsSync as existsSync24, writeFileSync as writeFileSync9, mkdirSync as mkdirSync5 } from "fs";
+import { resolve as resolve26 } from "path";
+import { existsSync as existsSync25, writeFileSync as writeFileSync9, mkdirSync as mkdirSync5 } from "fs";
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function writeBrandingCache(accountId, agentSlug, branding) {
   try {
-    const cacheDir = resolve25(MAXY_DIR, "branding-cache", accountId);
+    const cacheDir = resolve26(MAXY_DIR, "branding-cache", accountId);
     mkdirSync5(cacheDir, { recursive: true });
-    writeFileSync9(resolve25(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
+    writeFileSync9(resolve26(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
   } catch (err) {
     console.error(`[branding] cache write failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -16032,8 +16085,8 @@ app47.post("/", async (c) => {
   }
   let agentConfig = null;
   if (account) {
-    const agentDir = resolve25(account.accountDir, "agents", agentSlug);
-    if (!existsSync24(agentDir) || !existsSync24(resolve25(agentDir, "config.json"))) {
+    const agentDir = resolve26(account.accountDir, "agents", agentSlug);
+    if (!existsSync25(agentDir) || !existsSync25(resolve26(agentDir, "config.json"))) {
       return c.json({ error: "Agent not found" }, 404);
     }
     agentConfig = resolveAgentConfig(account.accountDir, agentSlug);
@@ -16313,7 +16366,7 @@ function startGraphHealthTimer() {
 
 // app/lib/file-watcher.ts
 import * as fsp2 from "fs/promises";
-import { resolve as resolve26, sep as sep7 } from "path";
+import { resolve as resolve27, sep as sep7 } from "path";
 var ACCOUNT_UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var DEFAULT_COALESCE_MS = 500;
 var ROOTS = ["uploads", "accounts"];
@@ -16332,7 +16385,7 @@ async function startFileWatcher(opts = {}) {
   const dropFn = opts.drop ?? dropFileIndex;
   for (const r of ROOTS) {
     try {
-      await fsp2.mkdir(resolve26(dataRoot, r), { recursive: true });
+      await fsp2.mkdir(resolve27(dataRoot, r), { recursive: true });
     } catch (err) {
       console.error(
         `[file-watcher] start-failed root="${r}" err="${err.message}" \u2014 index will be maintained by the 5-min reconcile backstop only`
@@ -16353,7 +16406,7 @@ async function startFileWatcher(opts = {}) {
     timers.set(relativePath, t);
   }
   async function runHook(relativePath, accountId) {
-    const absolute = resolve26(dataRoot, relativePath);
+    const absolute = resolve27(dataRoot, relativePath);
     let exists = false;
     try {
       const st = await fsp2.stat(absolute);
@@ -16377,7 +16430,7 @@ async function startFileWatcher(opts = {}) {
     }
   }
   async function watchRoot(rootName) {
-    const absRoot = resolve26(dataRoot, rootName);
+    const absRoot = resolve27(dataRoot, rootName);
     try {
       const iter = fsp2.watch(absRoot, { recursive: true, signal: controller.signal });
       for await (const event of iter) {
@@ -17271,8 +17324,8 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash5, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync25, readFileSync as readFileSync25, statSync as statSync10 } from "fs";
-import { resolve as resolve27 } from "path";
+import { existsSync as existsSync26, readFileSync as readFileSync25, statSync as statSync10 } from "fs";
+import { resolve as resolve28 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
 function canonicalize(value) {
@@ -17307,7 +17360,7 @@ var PUBKEY_SHA256 = "8eee6bcb33545fd13b16d3199a5735ca5db5062834c7b49dfe4f23801d9
 var GRACE_DAYS = 7;
 var GRACE_MS = GRACE_DAYS * 24 * 60 * 60 * 1e3;
 function pubkeyPath(brand) {
-  return resolve27(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
+  return resolve28(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
 }
 var memo = null;
 function memoKey(mtimeMs, account) {
@@ -17319,8 +17372,8 @@ function resolveEntitlement(brand, account) {
   if (brand.commercialMode !== true) {
     return logResolved(implicitTrust(account), null);
   }
-  const entitlementPath = resolve27(brand.configDir, "entitlement.json");
-  if (!existsSync25(entitlementPath)) {
+  const entitlementPath = resolve28(brand.configDir, "entitlement.json");
+  if (!existsSync26(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
   const stat7 = statSync10(entitlementPath);
@@ -17510,12 +17563,12 @@ function clientFrom(c) {
   );
 }
 var PLATFORM_ROOT9 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT9 ? join21(PLATFORM_ROOT9, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT9 ? join22(PLATFORM_ROOT9, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync26(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync27(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync26(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync27(BRAND_JSON_PATH)) {
   try {
     const parsed = JSON.parse(readFileSync26(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
@@ -17536,10 +17589,10 @@ var brandLoginOpts = {
   bodyFont: BRAND.defaultFonts?.body,
   logoContainsName: !!BRAND.logoContainsName
 };
-var ALIAS_DOMAINS_PATH = join21(homedir3(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join22(homedir3(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync26(ALIAS_DOMAINS_PATH)) return null;
+    if (!existsSync27(ALIAS_DOMAINS_PATH)) return null;
     const parsed = JSON.parse(readFileSync26(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
@@ -17568,7 +17621,7 @@ var app48 = new Hono();
 var nativeFileFollowers = /* @__PURE__ */ new Map();
 var waGateway = new WaGateway({
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve28(process.env.MAXY_PLATFORM_ROOT ?? join21(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve29(process.env.MAXY_PLATFORM_ROOT ?? join22(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 — file delivery on the native channel: resolve the platform
   // account + path validation here and funnel through the shared send core.
   sendDocument: async ({ senderId, accountId, filePath, caption }) => {
@@ -17584,7 +17637,7 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve28(process.env.MAXY_PLATFORM_ROOT ?? join21(__dirname, ".."))
+      platformRoot: resolve29(process.env.MAXY_PLATFORM_ROOT ?? join22(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
@@ -17623,8 +17676,8 @@ var waGateway = new WaGateway({
 app48.route("/", waGateway.routes());
 waGateway.startSweeper();
 var webchatGateway = new WebchatGateway({
-  gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WEBCHAT_CHANNEL_SERVER_PATH ?? resolve28(process.env.MAXY_PLATFORM_ROOT ?? join21(__dirname, ".."), "services/webchat-channel/dist/server.js"),
+  gatewayUrl: webchatGatewayUrl(),
+  serverPath: webchatServerPath(),
   ensureChannelSession: async ({ accountId, key, role, gatewayUrl, serverPath, sessionId }) => {
     if (role !== "admin") {
       console.error(`[webchat:inbound] op=spawn-refused key=${key} role=${role} reason=public-path-not-wired`);
@@ -17676,7 +17729,7 @@ app48.use("*", async (c, next) => {
 });
 app48.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
-  if (!isPublicHost(host)) {
+  if (isOperatorHost(host, getOperatorDomains()) || !isPublicHost(host)) {
     await next();
     return;
   }
@@ -17908,7 +17961,10 @@ app48.use("*", async (c, next) => {
     remoteAddress: rawRemote,
     xForwardedFor: rawXff,
     cookieHeader: c.req.header("cookie"),
-    isPublicHost
+    // Task 829 — operator-wins: an operator host is admin-gated, so it must not
+    // be classified public here (which would bypass the admin gate). A host in
+    // both operator-domains.json and alias-domains.json stays admin-gated.
+    isPublicHost: (h) => !isOperatorHost(h, getOperatorDomains()) && isPublicHost(h)
   });
   if (decision.allow) {
     await next();
@@ -17965,13 +18021,13 @@ app48.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve28(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve28(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve29(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve29(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync26(filePath)) {
+  if (!existsSync27(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
@@ -17995,13 +18051,13 @@ app48.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve28(account.accountDir, "generated", filename);
-  const expectedDir = resolve28(account.accountDir, "generated");
+  const filePath = resolve29(account.accountDir, "generated", filename);
+  const expectedDir = resolve29(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync26(filePath)) {
+  if (!existsSync27(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
@@ -18021,7 +18077,7 @@ app48.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync26(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync27(BRAND_JSON_PATH)) {
   try {
     const fullBrand = JSON.parse(readFileSync26(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
@@ -18040,8 +18096,8 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT9) return "unknown";
-    const versionFile = join21(PLATFORM_ROOT9, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync26(versionFile)) return "unknown";
+    const versionFile = join22(PLATFORM_ROOT9, "config", `.${BRAND.hostname}-version`);
+    if (!existsSync27(versionFile)) return "unknown";
     const content = readFileSync26(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
@@ -18083,7 +18139,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync26(resolve28(process.cwd(), "public", file), "utf-8");
+    html = readFileSync26(resolve29(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -18099,12 +18155,12 @@ ${clientErrorReporterScript}
 }
 var brandedHtmlCache = /* @__PURE__ */ new Map();
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join21(homedir3(), BRAND.configDir);
+  const configDir2 = join22(homedir3(), BRAND.configDir);
   try {
     const accountId = getDefaultAccountId();
     if (!accountId) return null;
-    const cachePath = join21(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync26(cachePath)) return null;
+    const cachePath = join22(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    if (!existsSync27(cachePath)) return null;
     return JSON.parse(readFileSync26(cachePath, "utf-8"));
   } catch {
     return null;
@@ -18150,7 +18206,12 @@ function agentUnavailableHtml() {
 }
 app48.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
-  if (isPublicHost(host)) {
+  const klass = classifyHost(host, getOperatorDomains(), isPublicHost);
+  if (klass === "operator") {
+    console.log(`[host-class] host=${host} class=operator served=operator.html`);
+    return c.html(cachedHtml("operator.html"));
+  }
+  if (klass === "public") {
     const defaultSlug = resolveDefaultSlug();
     if (!defaultSlug) {
       console.error("[public-root] op=no-default");
@@ -18162,6 +18223,7 @@ app48.get("/", (c) => {
     console.error(`[public-root] op=serve-default slug=${defaultSlug}`);
     return c.html(brandedPublicHtml(defaultSlug));
   }
+  console.log(`[host-class] host=${host} class=admin served=index.html`);
   return c.html(cachedHtml("index.html"));
 });
 app48.get("/public", (c) => {
@@ -18193,7 +18255,7 @@ app48.use("/vnc-popout.html", logViewerFetch);
 app48.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync26(resolve28(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync26(resolve29(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -18229,7 +18291,7 @@ app48.get("/g/:slug", (c) => {
 });
 app48.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
-  if (isPublicHost(host)) return c.text("Not found", 404);
+  if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
 app48.get("/chat", (c) => {
@@ -18244,7 +18306,7 @@ app48.get("/data", (c) => {
 });
 app48.get("/browser", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
-  if (isPublicHost(host)) return c.text("Not found", 404);
+  if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("browser.html"));
 });
 app48.get("/:slug", async (c, next) => {
@@ -18349,7 +18411,7 @@ try {
 var ADMINUSER_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 async function runAdminUserReconcileTick() {
   try {
-    if (!existsSync26(USERS_FILE)) {
+    if (!existsSync27(USERS_FILE)) {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
@@ -18463,7 +18525,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve28(process.env.MAXY_PLATFORM_ROOT ?? join21(__dirname, "..")),
+  platformRoot: resolve29(process.env.MAXY_PLATFORM_ROOT ?? join22(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (msg.isOwnerMirror) {