@rubytech/create-maxy-code 0.1.299 → 0.1.300

package/payload/server/server.js

@@ -1,6 +1,7 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   ACCOUNTS_DIR,
+  AGENT_SLUG_PATTERN,
   BIN_DIR,
   BRAND_NAME,
   CDP_PORT,
@@ -15,6 +16,8 @@ import {
   LOG_DIR,
   MAXY_DIR,
   PLATFORM_ROOT,
+  PUBLIC_ALLOWED_EXACT,
+  PUBLIC_ALLOWED_PREFIXES,
   RFB_PORT,
   SYSTEM_PATH_SLUGS,
   USERS_FILE,
@@ -26,6 +29,7 @@ import {
   canAccessAdmin,
   checkGroupMembership,
   checkRateLimit,
+  classifyHost,
   cleanupLeakedPremiumSubs,
   clearRateLimit,
   clientIpMiddleware,
@@ -45,6 +49,7 @@ import {
   getConversationClaudeSessionIds,
   getDefaultAccountId,
   getGroupParticipants,
+  getOperatorDomains,
   getRecentMessages,
   getRoleForSession,
   getSession,
@@ -55,7 +60,9 @@ import {
   getUserTimezone,
   httpLog,
   isActiveAgentSlug,
+  isOperatorHost,
   isPasswordValid,
+  isPublicPathAllowed,
   isRemoteAuthConfigured,
   linkConversationTranscript,
   listAdminSessions,
@@ -97,7 +104,7 @@ import {
   vncLog,
   walkPremiumBundles,
   writeAdminUserAndPerson
-} from "./chunk-7H4KMTMC.js";
+} from "./chunk-JHSF5VPE.js";
 import {
   __commonJS,
   __toESM
@@ -1214,40 +1221,11 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync26, existsSync as existsSync26, watchFile } from "fs";
+import { readFileSync as readFileSync26, existsSync as existsSync27, watchFile } from "fs";
 import { resolve as resolve29, join as join22, basename as basename8 } from "path";
 import { homedir as homedir3 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
-// app/lib/agent-slug-pattern.ts
-var AGENT_SLUG_PATTERN = /^\/([a-z][a-z0-9-]{2,49})$/;
-
-// server/public-host-gate.ts
-var PUBLIC_ALLOWED_PREFIXES = [
-  "/api/session",
-  "/api/chat",
-  "/api/access/",
-  "/api/health",
-  "/api/group/",
-  "/api/telegram/",
-  "/assets/",
-  "/brand/",
-  "/agent-assets/",
-  "/generated/",
-  "/g/",
-  "/sites/"
-];
-var PUBLIC_ALLOWED_EXACT = ["/favicon.ico", "/brand-defaults.css"];
-function isPublicPathAllowed(path2) {
-  if (path2 === "/") return true;
-  if (PUBLIC_ALLOWED_EXACT.includes(path2)) return true;
-  if (PUBLIC_ALLOWED_PREFIXES.some((prefix) => path2.startsWith(prefix))) return true;
-  return AGENT_SLUG_PATTERN.test(path2);
-}
-function isOperatorHost(host) {
-  return host.startsWith("operator.");
-}
-
 // server/webchat-descriptor.ts
 import { resolve, join as join2 } from "path";
 function webchatGatewayUrl() {
@@ -7732,7 +7710,7 @@ var whatsapp_reader_default = app5;
 // server/routes/webchat.ts
 import { basename as basename3, dirname as dirname2 } from "path";
 import { join as join11 } from "path";
-import { readFileSync as readFileSync11, renameSync, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync8, readdirSync as readdirSync7, readFileSync as readFileSync11, renameSync, writeFileSync as writeFileSync5 } from "fs";
 var WEBCHAT_ADMIN_KEY = "webchat-admin";
 var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function locateSession(sessionId) {
@@ -7747,6 +7725,18 @@ function locateSession(sessionId) {
   }
   return { projectDir: null, channel: null };
 }
+function sessionSidecarExists(sessionId) {
+  const cfg = claudeConfigDir();
+  if (!cfg) return false;
+  const projectsRoot = join11(cfg, "projects");
+  let slugs;
+  try {
+    slugs = readdirSync7(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+  } catch {
+    return false;
+  }
+  return slugs.some((slug) => existsSync8(join11(projectsRoot, slug, `${sessionId}.meta.json`)));
+}
 function conflictingBinding(channel) {
   return channel !== null && channel !== "webchat" ? channel : null;
 }
@@ -8006,8 +7996,9 @@ ${note}` : note;
         return c.json({ error: "invalid session id" }, 400);
       }
       const { projectDir: projectDir2, channel } = locateSession(target);
+      const known = projectDir2 !== null || sessionSidecarExists(target);
       const indicators2 = await fetchComposerIndicators(target);
-      return c.json({ sessionId: target, projectDir: projectDir2, channelBinding: conflictingBinding(channel), ...indicators2 });
+      return c.json({ sessionId: target, projectDir: projectDir2, channelBinding: conflictingBinding(channel), known, ...indicators2 });
     }
     const sessionId = adminSessionIdFor(accountId, WEBCHAT_ADMIN_KEY);
     const cfg = claudeConfigDir();
@@ -8030,7 +8021,7 @@ ${note}` : note;
 import { resolve as resolve11 } from "path";
 
 // app/lib/claude-agent/specialist-roster.ts
-import { existsSync as existsSync8, readFileSync as readFileSync12, readdirSync as readdirSync7 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync12, readdirSync as readdirSync8 } from "fs";
 import { join as join12 } from "path";
 function field(fm, name) {
   const m = fm.match(new RegExp(`^${name}:\\s*(.*?)\\r?$`, "m"));
@@ -8042,8 +8033,8 @@ function field(fm, name) {
   return value || null;
 }
 function readSpecialistRoster(specialistsDir) {
-  if (!existsSync8(specialistsDir)) return { specialists: [], skipped: [] };
-  const entries = readdirSync7(specialistsDir);
+  if (!existsSync9(specialistsDir)) return { specialists: [], skipped: [] };
+  const entries = readdirSync8(specialistsDir);
   const specialists = [];
   const skipped = [];
   for (const file of entries.sort()) {
@@ -8168,7 +8159,7 @@ var webchat_greeting_default = app6;
 // server/routes/telegram.ts
 import { homedir } from "os";
 import { resolve as resolve12, join as join13 } from "path";
-import { existsSync as existsSync9, readFileSync as readFileSync13 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync13 } from "fs";
 
 // app/lib/telegram/access-control.ts
 function checkTelegramAccess(params) {
@@ -8220,7 +8211,7 @@ var DISPATCH_TIMEOUT_MS = 12e4;
 function configDirName() {
   const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? resolve12(process.cwd(), "..");
   const brandPath = join13(platformRoot2, "config", "brand.json");
-  if (existsSync9(brandPath)) {
+  if (existsSync10(brandPath)) {
     try {
       return JSON.parse(readFileSync13(brandPath, "utf-8")).configDir ?? ".maxy";
     } catch {
@@ -8254,7 +8245,7 @@ app7.post("/", async (c) => {
     return c.json({ ok: false }, 400);
   }
   const sp = secretPath(botType);
-  if (!existsSync9(sp)) {
+  if (!existsSync10(sp)) {
     console.error(`${TAG22} op=reject reason=no-secret-file botType=${botType}`);
     return c.json({ ok: false }, 401);
   }
@@ -8321,11 +8312,11 @@ var telegram_default = app7;
 
 // server/routes/onboarding.ts
 import { spawn, spawnSync as spawnSync2, execFileSync as execFileSync2 } from "child_process";
-import { openSync as openSync2, closeSync as closeSync2, writeFileSync as writeFileSync7, writeSync, existsSync as existsSync11, readFileSync as readFileSync15, unlinkSync } from "fs";
+import { openSync as openSync2, closeSync as closeSync2, writeFileSync as writeFileSync7, writeSync, existsSync as existsSync12, readFileSync as readFileSync15, unlinkSync } from "fs";
 import { createHash as createHash3, randomUUID as randomUUID7 } from "crypto";
 
 // ../lib/admins-write/src/index.ts
-import { existsSync as existsSync10, readFileSync as readFileSync14, writeFileSync as writeFileSync6, renameSync as renameSync2, mkdirSync as mkdirSync2, readdirSync as readdirSync8, statSync as statSync5 } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync14, writeFileSync as writeFileSync6, renameSync as renameSync2, mkdirSync as mkdirSync2, readdirSync as readdirSync9, statSync as statSync5 } from "fs";
 import { dirname as dirname3, join as join14 } from "path";
 function logLine(input, result) {
   const userIdShort = input.userId.slice(0, 8);
@@ -8343,7 +8334,7 @@ function writeAdminEntry(input) {
   const result = { usersJsonResult: "noop", accountJsonResult: "noop" };
   try {
     let users = [];
-    if (existsSync10(input.usersFile)) {
+    if (existsSync11(input.usersFile)) {
       const raw = readFileSync14(input.usersFile, "utf-8").trim();
       if (raw) {
         const parsed = JSON.parse(raw);
@@ -8369,7 +8360,7 @@ function writeAdminEntry(input) {
   }
   try {
     const accountJsonPath = join14(input.accountDir, "account.json");
-    if (!existsSync10(accountJsonPath)) {
+    if (!existsSync11(accountJsonPath)) {
       throw new Error(`account.json not found at ${accountJsonPath}`);
     }
     const config = JSON.parse(readFileSync14(accountJsonPath, "utf-8"));
@@ -8396,7 +8387,7 @@ function checkAdminAuthInvariant(input) {
     usersWithoutAccount: []
   };
   const usersUserIds = /* @__PURE__ */ new Set();
-  if (existsSync10(input.usersFile)) {
+  if (existsSync11(input.usersFile)) {
     try {
       const raw = readFileSync14(input.usersFile, "utf-8").trim();
       if (raw) {
@@ -8411,10 +8402,10 @@ function checkAdminAuthInvariant(input) {
     }
   }
   const accountUserIds = /* @__PURE__ */ new Set();
-  if (existsSync10(input.accountsDir)) {
+  if (existsSync11(input.accountsDir)) {
     let entries;
     try {
-      entries = readdirSync8(input.accountsDir);
+      entries = readdirSync9(input.accountsDir);
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       console.error(`[${input.tag}] accounts-dir unreadable accountsDir=${input.accountsDir} error=${msg}`);
@@ -8430,7 +8421,7 @@ function checkAdminAuthInvariant(input) {
         continue;
       }
       const accountJsonPath = join14(accountDir, "account.json");
-      if (!existsSync10(accountJsonPath)) continue;
+      if (!existsSync11(accountJsonPath)) continue;
       let admins = [];
       try {
         const config = JSON.parse(readFileSync14(accountJsonPath, "utf-8"));
@@ -8473,7 +8464,7 @@ function hashPin2(pin) {
   return createHash3("sha256").update(pin).digest("hex");
 }
 function readUsersFile2() {
-  if (!existsSync11(USERS_FILE)) return null;
+  if (!existsSync12(USERS_FILE)) return null;
   const raw = readFileSync15(USERS_FILE, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
@@ -8527,7 +8518,7 @@ app8.post("/claude-auth", async (c) => {
     } catch (err) {
       logoutError = err instanceof Error ? err.message : String(err);
     }
-    const credentialsPresent = existsSync11(CLAUDE_CREDENTIALS_FILE);
+    const credentialsPresent = existsSync12(CLAUDE_CREDENTIALS_FILE);
     const ranMs = Date.now() - start;
     console.log(`[onboarding] op=claude-logout credentialsPresent=${credentialsPresent} ranMs=${ranMs} logoutError=${logoutError ? JSON.stringify(logoutError.slice(0, 120)) : "none"}`);
     return c.json({ logged_out: !credentialsPresent });
@@ -8634,7 +8625,7 @@ app8.post("/set-pin", async (c) => {
   console.log(`[set-pin] wrote users.json + account.json admins: userId=${userId.slice(0, 8)}\u2026 role=owner`);
   if (process.platform === "linux") {
     let installOwner = null;
-    if (existsSync11(INSTALL_OWNER_FILE)) {
+    if (existsSync12(INSTALL_OWNER_FILE)) {
       try {
         const raw = readFileSync15(INSTALL_OWNER_FILE, "utf-8").trim();
         if (raw.length > 0) installOwner = raw;
@@ -8717,7 +8708,7 @@ app8.delete("/set-pin", async (c) => {
 var onboarding_default = app8;
 
 // server/routes/client-error.ts
-import { appendFileSync, existsSync as existsSync12, renameSync as renameSync3, statSync as statSync6 } from "fs";
+import { appendFileSync, existsSync as existsSync13, renameSync as renameSync3, statSync as statSync6 } from "fs";
 import { join as join15 } from "path";
 var CLIENT_ERRORS_LOG = join15(LOG_DIR, "client-errors.log");
 var MAX_LOG_SIZE = 10 * 1024 * 1024;
@@ -8762,7 +8753,7 @@ function stackHead(stack) {
 }
 function rotateIfNeeded() {
   try {
-    if (!existsSync12(CLIENT_ERRORS_LOG)) return;
+    if (!existsSync13(CLIENT_ERRORS_LOG)) return;
     const stats = statSync6(CLIENT_ERRORS_LOG);
     if (stats.size < MAX_LOG_SIZE) return;
     renameSync3(CLIENT_ERRORS_LOG, CLIENT_ERRORS_LOG + ".1");
@@ -9044,18 +9035,18 @@ app10.post("/", async (c) => {
 var session_default = app10;
 
 // server/routes/admin/logs.ts
-import { existsSync as existsSync14, readdirSync as readdirSync9, readFileSync as readFileSync16, statSync as statSync7 } from "fs";
+import { existsSync as existsSync15, readdirSync as readdirSync10, readFileSync as readFileSync16, statSync as statSync7 } from "fs";
 import { resolve as resolve13, basename as basename4 } from "path";
 
 // app/lib/logs-read-resolve.ts
-import { existsSync as existsSync13 } from "fs";
+import { existsSync as existsSync14 } from "fs";
 import { join as join16 } from "path";
 function resolveSessionLogPaths(filename, logDirs) {
   const tried = [filename];
   const hits = [];
   for (const dir of logDirs) {
     const fullPath = join16(dir, filename);
-    if (existsSync13(fullPath)) {
+    if (existsSync14(fullPath)) {
       hits.push({ path: fullPath, dir });
     }
   }
@@ -9183,10 +9174,10 @@ app11.get("/", async (c) => {
   const seen = /* @__PURE__ */ new Set();
   const logs = {};
   for (const dir of logDirs) {
-    if (!existsSync14(dir)) continue;
+    if (!existsSync15(dir)) continue;
     let files;
     try {
-      files = readdirSync9(dir).filter((f) => f.endsWith(".log"));
+      files = readdirSync10(dir).filter((f) => f.endsWith(".log"));
     } catch (err) {
       const reason = err instanceof Error ? err.message : String(err);
       console.warn(`[admin/logs] readdir-fail dir=${dir} reason=${reason}`);
@@ -9234,7 +9225,7 @@ var claude_info_default = app12;
 
 // server/routes/admin/attachment.ts
 import { readFile as readFile2, readdir } from "fs/promises";
-import { existsSync as existsSync15 } from "fs";
+import { existsSync as existsSync16 } from "fs";
 import { resolve as resolve14 } from "path";
 var app13 = new Hono();
 app13.get("/:attachmentId", requireAdminSession, async (c) => {
@@ -9248,11 +9239,11 @@ app13.get("/:attachmentId", requireAdminSession, async (c) => {
     return new Response("Not found", { status: 404 });
   }
   const dir = resolve14(ATTACHMENTS_ROOT, accountId, attachmentId);
-  if (!existsSync15(dir)) {
+  if (!existsSync16(dir)) {
     return new Response("Not found", { status: 404 });
   }
   const metaPath = resolve14(dir, `${attachmentId}.meta.json`);
-  if (!existsSync15(metaPath)) {
+  if (!existsSync16(metaPath)) {
     return new Response("Not found", { status: 404 });
   }
   let meta;
@@ -9280,21 +9271,21 @@ var attachment_default = app13;
 
 // server/routes/admin/agents.ts
 import { resolve as resolve15 } from "path";
-import { readdirSync as readdirSync10, readFileSync as readFileSync17, existsSync as existsSync16, rmSync } from "fs";
+import { readdirSync as readdirSync11, readFileSync as readFileSync17, existsSync as existsSync17, rmSync } from "fs";
 var app14 = new Hono();
 app14.get("/", (c) => {
   const account = resolveAccount();
   if (!account) return c.json({ agents: [] });
   const agentsDir = resolve15(account.accountDir, "agents");
-  if (!existsSync16(agentsDir)) return c.json({ agents: [] });
+  if (!existsSync17(agentsDir)) return c.json({ agents: [] });
   const agents = [];
   try {
-    const entries = readdirSync10(agentsDir, { withFileTypes: true });
+    const entries = readdirSync11(agentsDir, { withFileTypes: true });
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
       if (!entry.isDirectory()) continue;
       if (entry.name === "admin") continue;
       const configPath2 = resolve15(agentsDir, entry.name, "config.json");
-      if (!existsSync16(configPath2)) continue;
+      if (!existsSync17(configPath2)) continue;
       try {
         const config = JSON.parse(readFileSync17(configPath2, "utf-8"));
         agents.push({
@@ -9323,7 +9314,7 @@ app14.delete("/:slug", async (c) => {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
   const agentDir = resolve15(account.accountDir, "agents", slug);
-  if (!existsSync16(agentDir)) {
+  if (!existsSync17(agentDir)) {
     return c.json({ error: "Agent not found" }, 404);
   }
   try {
@@ -9353,7 +9344,7 @@ app14.post("/:slug/project", async (c) => {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
   const agentDir = resolve15(account.accountDir, "agents", slug);
-  if (!existsSync16(agentDir)) {
+  if (!existsSync17(agentDir)) {
     return c.json({ error: "Agent not found on disk" }, 404);
   }
   try {
@@ -9369,7 +9360,7 @@ var agents_default = app14;
 // server/routes/admin/sessions.ts
 import crypto2 from "crypto";
 import { resolve as resolvePath } from "path";
-import { existsSync as existsSync17, mkdirSync as mkdirSync3, createWriteStream } from "fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync3, createWriteStream } from "fs";
 
 // ../lib/admin-conversation-purge/src/index.ts
 async function purgeAdminConversationJsonls(args) {
@@ -9529,7 +9520,7 @@ function validateAndShapeAttachments(raws, conversationAccountId, sessionId, mes
     let reason = null;
     if (!a.attachmentId || !a.filename || !a.mimeType || !a.storagePath) reason = "schema-fail";
     else if (a.accountId !== conversationAccountId) reason = "account-mismatch";
-    else if (!existsSync17(a.storagePath)) reason = "missing-file";
+    else if (!existsSync18(a.storagePath)) reason = "missing-file";
     if (reason) {
       invalid++;
       try {
@@ -10055,7 +10046,7 @@ app15.put("/:id/label", requireAdminSession, async (c) => {
 var sessions_default = app15;
 
 // app/lib/claude-agent/spawn-context.ts
-import { existsSync as existsSync18, readFileSync as readFileSync18, readdirSync as readdirSync11, statSync as statSync8 } from "fs";
+import { existsSync as existsSync19, readFileSync as readFileSync18, readdirSync as readdirSync12, statSync as statSync8 } from "fs";
 import { dirname as dirname4, resolve as resolve16, join as join17 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
@@ -10090,7 +10081,7 @@ function extractPluginToolDescriptions(pluginDir) {
   ];
   let raw = null;
   for (const path2 of candidates) {
-    if (!existsSync18(path2)) continue;
+    if (!existsSync19(path2)) continue;
     try {
       raw = readFileSync18(path2, "utf-8");
       break;
@@ -10142,8 +10133,8 @@ function parseSkillPathsFromFrontmatter(fm) {
 function listPluginDirs() {
   const out = /* @__PURE__ */ new Map();
   const platformPlugins = resolve16(PLATFORM_ROOT, "plugins");
-  if (existsSync18(platformPlugins)) {
-    for (const name of readdirSync11(platformPlugins)) {
+  if (existsSync19(platformPlugins)) {
+    for (const name of readdirSync12(platformPlugins)) {
       const dir = join17(platformPlugins, name);
       try {
         if (statSync8(dir).isDirectory()) out.set(name, dir);
@@ -10152,12 +10143,12 @@ function listPluginDirs() {
     }
   }
   const premiumRoot = resolve16(dirname4(PLATFORM_ROOT), "premium-plugins");
-  if (existsSync18(premiumRoot)) {
-    for (const bundle of readdirSync11(premiumRoot)) {
+  if (existsSync19(premiumRoot)) {
+    for (const bundle of readdirSync12(premiumRoot)) {
       const bundlePlugins = join17(premiumRoot, bundle, "plugins");
-      if (!existsSync18(bundlePlugins)) continue;
+      if (!existsSync19(bundlePlugins)) continue;
       try {
-        for (const name of readdirSync11(bundlePlugins)) {
+        for (const name of readdirSync12(bundlePlugins)) {
           const dir = join17(bundlePlugins, name);
           try {
             if (statSync8(dir).isDirectory()) out.set(name, dir);
@@ -10172,7 +10163,7 @@ function listPluginDirs() {
 }
 function readEnabledPlugins(accountId) {
   const accountFile = resolve16(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync18(accountFile)) return /* @__PURE__ */ new Set();
+  if (!existsSync19(accountFile)) return /* @__PURE__ */ new Set();
   try {
     const parsed = JSON.parse(readFileSync18(accountFile, "utf-8"));
     return new Set(
@@ -10183,7 +10174,7 @@ function readEnabledPlugins(accountId) {
   }
 }
 function readFrontmatter(path2) {
-  if (!existsSync18(path2)) return null;
+  if (!existsSync19(path2)) return null;
   let raw;
   try {
     raw = readFileSync18(path2, "utf-8");
@@ -10218,7 +10209,7 @@ ${fm}
       `plugin-manifest-tool-coverage plugin=${name} tools=${tools.length} with-desc=${withDesc}`
     );
     if (toolNames.length > 0 && descMap.size === 0) {
-      const hasSource = existsSync18(join17(dir, "mcp/dist/index.js")) || existsSync18(join17(dir, "mcp/src/index.ts"));
+      const hasSource = existsSync19(join17(dir, "mcp/dist/index.js")) || existsSync19(join17(dir, "mcp/src/index.ts"));
       if (hasSource) {
         console.warn(
           `[spawn-context] WARN plugin=${name} mcp source present but tool-description regex matched zero entries \u2014 SDK upgrade may have changed the registration shape`
@@ -10245,10 +10236,10 @@ ${skillFm}
 }
 function computeSpecialistDomains(accountId) {
   const specialistsDir = resolve16(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
-  if (!existsSync18(specialistsDir)) return [];
+  if (!existsSync19(specialistsDir)) return [];
   let entries;
   try {
-    entries = readdirSync11(specialistsDir);
+    entries = readdirSync12(specialistsDir);
   } catch {
     return [];
   }
@@ -10291,7 +10282,7 @@ ${fm}
 }
 function computeDormantPlugins(accountId) {
   const accountFile = resolve16(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync18(accountFile)) return [];
+  if (!existsSync19(accountFile)) return [];
   let enabled;
   try {
     const raw = readFileSync18(accountFile, "utf-8");
@@ -10306,10 +10297,10 @@ function computeDormantPlugins(accountId) {
     return [];
   }
   const pluginsDir = resolve16(PLATFORM_ROOT, "plugins");
-  if (!existsSync18(pluginsDir)) return [];
+  if (!existsSync19(pluginsDir)) return [];
   let entries;
   try {
-    entries = readdirSync11(pluginsDir);
+    entries = readdirSync12(pluginsDir);
   } catch {
     return [];
   }
@@ -10317,7 +10308,7 @@ function computeDormantPlugins(accountId) {
   for (const name of entries) {
     if (enabled.has(name)) continue;
     const manifestPath = resolve16(pluginsDir, name, "PLUGIN.md");
-    if (!existsSync18(manifestPath)) continue;
+    if (!existsSync19(manifestPath)) continue;
     let manifest;
     try {
       manifest = readFileSync18(manifestPath, "utf-8");
@@ -10334,11 +10325,11 @@ function computeDormantPlugins(accountId) {
 }
 
 // server/routes/admin/claude-sessions.ts
-import { existsSync as existsSync19, readFileSync as readFileSync19 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync19 } from "fs";
 import { resolve as resolve17 } from "path";
 function readTunnelState(brandConfigDir) {
   const statePath = `${process.env.HOME ?? ""}/${brandConfigDir}/cloudflared/tunnel.state`;
-  if (!existsSync19(statePath)) return null;
+  if (!existsSync20(statePath)) return null;
   try {
     const parsed = JSON.parse(readFileSync19(statePath, "utf-8"));
     const tunnelId = typeof parsed.tunnelId === "string" ? parsed.tunnelId : null;
@@ -13780,7 +13771,7 @@ var graph_default_view_default = app25;
 // server/routes/admin/sidebar-artefacts.ts
 import { readdir as readdir4, stat as stat5 } from "fs/promises";
 import { resolve as resolve21, relative as relative3, isAbsolute, sep as sep6, basename as basename7 } from "path";
-import { existsSync as existsSync20 } from "fs";
+import { existsSync as existsSync21 } from "fs";
 var LIMIT = 50;
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
 function toDataRootRelPath(absPath) {
@@ -13886,7 +13877,7 @@ async function fetchAgentTemplateRows(accountDir) {
 async function unionSpecialistFilenames(overrideDir, bundledDir) {
   const names = /* @__PURE__ */ new Set();
   for (const dir of [overrideDir, bundledDir]) {
-    if (!existsSync20(dir)) continue;
+    if (!existsSync21(dir)) continue;
     try {
       const entries = await readdir4(dir);
       for (const entry of entries) {
@@ -13901,7 +13892,7 @@ async function unionSpecialistFilenames(overrideDir, bundledDir) {
 }
 async function readAgentTemplateRow(inp) {
   let chosenPath = null;
-  if (existsSync20(inp.overridePath)) {
+  if (existsSync21(inp.overridePath)) {
     try {
       validateFilePathInAccount(inp.overridePath, inp.overrideRoot);
       chosenPath = inp.overridePath;
@@ -13912,7 +13903,7 @@ async function readAgentTemplateRow(inp) {
       );
       return null;
     }
-  } else if (existsSync20(inp.bundledPath)) {
+  } else if (existsSync21(inp.bundledPath)) {
     if (!isWithin(inp.bundledPath, inp.bundledRoot)) {
       console.error(
         `[admin/sidebar-artefacts] agent-template-read-failed agent=${inp.displayName} kind=${inp.logName} error="bundled path outside PLATFORM_ROOT"`
@@ -14078,8 +14069,8 @@ var session_archive_default = app29;
 
 // server/routes/admin/session-rc-spawn.ts
 import { randomUUID as randomUUID9 } from "crypto";
-function resolveSpawnPlan(host, body, mintId = randomUUID9) {
-  const operator = isOperatorHost(host);
+function resolveSpawnPlan(host, operatorDomains, body, mintId = randomUUID9) {
+  const operator = isOperatorHost(host, operatorDomains);
   const resumeId = typeof body.sessionId === "string" && body.sessionId.length > 0 ? body.sessionId : void 0;
   const name = typeof body.name === "string" && body.name.length > 0 ? body.name : void 0;
   const webchatBind = resumeId === void 0 || operator;
@@ -14115,8 +14106,8 @@ app30.post("/", requireAdminSession, async (c) => {
   } catch {
     body = {};
   }
-  const host = c.req.header("host") ?? "";
-  const plan = resolveSpawnPlan(host, body);
+  const host = (c.req.header("host") ?? "").split(":")[0];
+  const plan = resolveSpawnPlan(host, getOperatorDomains(), body);
   const spawnReqId = randomUUID9();
   console.log(
     `[chat-spawn] op=request spawnReqId=${spawnReqId} origin=${plan.origin} kind=${plan.kind} sessionId=${plan.kind === "new" ? "new" : plan.sessionId}`
@@ -14283,12 +14274,12 @@ app31.get("/", async (c) => {
 var system_stats_default = app31;
 
 // server/routes/admin/health.ts
-import { existsSync as existsSync21, readFileSync as readFileSync20 } from "fs";
+import { existsSync as existsSync22, readFileSync as readFileSync20 } from "fs";
 import { resolve as resolve22, join as join20 } from "path";
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve22(process.cwd(), "..");
 var brandHostname = "maxy";
 var brandJsonPath = join20(PLATFORM_ROOT6, "config", "brand.json");
-if (existsSync21(brandJsonPath)) {
+if (existsSync22(brandJsonPath)) {
   try {
     const brand = JSON.parse(readFileSync20(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
@@ -14299,7 +14290,7 @@ var VERSION_FILE = resolve22(PLATFORM_ROOT6, `config/.${brandHostname}-version`)
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
-  if (!existsSync21(VERSION_FILE)) return "unknown";
+  if (!existsSync22(VERSION_FILE)) return "unknown";
   return readFileSync20(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
@@ -15283,7 +15274,7 @@ app42.route("/request-magic-link", request_magic_link_default);
 var access_default = app42;
 
 // server/routes/sites.ts
-import { existsSync as existsSync22, readFileSync as readFileSync22, realpathSync as realpathSync5, statSync as statSync9 } from "fs";
+import { existsSync as existsSync23, readFileSync as readFileSync22, realpathSync as realpathSync5, statSync as statSync9 } from "fs";
 import { resolve as resolve25 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
@@ -15349,7 +15340,7 @@ app43.get("/:rel{.*}", (c) => {
   }
   let stat7;
   try {
-    stat7 = existsSync22(filePath) ? statSync9(filePath) : null;
+    stat7 = existsSync23(filePath) ? statSync9(filePath) : null;
   } catch {
     stat7 = null;
   }
@@ -15368,7 +15359,7 @@ app43.get("/:rel{.*}", (c) => {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync22(filePath)) {
+  if (!existsSync23(filePath)) {
     console.error(`[sites] not-found path=${reqPath} status=404`);
     return c.text("Not found", 404);
   }
@@ -15499,7 +15490,7 @@ var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync23, readFileSync as readFileSync24 } from "fs";
+import { existsSync as existsSync24, readFileSync as readFileSync24 } from "fs";
 import { join as join21 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
@@ -15509,7 +15500,7 @@ function readBrandConfig() {
   const platformRoot2 = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot2) return null;
   const brandPath = join21(platformRoot2, "config", "brand.json");
-  if (!existsSync23(brandPath)) return null;
+  if (!existsSync24(brandPath)) return null;
   try {
     cached2 = JSON.parse(readFileSync24(brandPath, "utf-8"));
     return cached2;
@@ -16000,7 +15991,7 @@ var visitor_event_default = app46;
 
 // server/routes/session.ts
 import { resolve as resolve26 } from "path";
-import { existsSync as existsSync24, writeFileSync as writeFileSync9, mkdirSync as mkdirSync5 } from "fs";
+import { existsSync as existsSync25, writeFileSync as writeFileSync9, mkdirSync as mkdirSync5 } from "fs";
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function writeBrandingCache(accountId, agentSlug, branding) {
   try {
@@ -16095,7 +16086,7 @@ app47.post("/", async (c) => {
   let agentConfig = null;
   if (account) {
     const agentDir = resolve26(account.accountDir, "agents", agentSlug);
-    if (!existsSync24(agentDir) || !existsSync24(resolve26(agentDir, "config.json"))) {
+    if (!existsSync25(agentDir) || !existsSync25(resolve26(agentDir, "config.json"))) {
       return c.json({ error: "Agent not found" }, 404);
     }
     agentConfig = resolveAgentConfig(account.accountDir, agentSlug);
@@ -17333,7 +17324,7 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash5, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync25, readFileSync as readFileSync25, statSync as statSync10 } from "fs";
+import { existsSync as existsSync26, readFileSync as readFileSync25, statSync as statSync10 } from "fs";
 import { resolve as resolve28 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
@@ -17382,7 +17373,7 @@ function resolveEntitlement(brand, account) {
     return logResolved(implicitTrust(account), null);
   }
   const entitlementPath = resolve28(brand.configDir, "entitlement.json");
-  if (!existsSync25(entitlementPath)) {
+  if (!existsSync26(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
   const stat7 = statSync10(entitlementPath);
@@ -17574,10 +17565,10 @@ function clientFrom(c) {
 var PLATFORM_ROOT9 = process.env.MAXY_PLATFORM_ROOT || "";
 var BRAND_JSON_PATH = PLATFORM_ROOT9 ? join22(PLATFORM_ROOT9, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync26(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync27(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync26(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync27(BRAND_JSON_PATH)) {
   try {
     const parsed = JSON.parse(readFileSync26(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
@@ -17601,7 +17592,7 @@ var brandLoginOpts = {
 var ALIAS_DOMAINS_PATH = join22(homedir3(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync26(ALIAS_DOMAINS_PATH)) return null;
+    if (!existsSync27(ALIAS_DOMAINS_PATH)) return null;
     const parsed = JSON.parse(readFileSync26(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
@@ -17738,7 +17729,7 @@ app48.use("*", async (c, next) => {
 });
 app48.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
-  if (!isPublicHost(host)) {
+  if (isOperatorHost(host, getOperatorDomains()) || !isPublicHost(host)) {
     await next();
     return;
   }
@@ -17970,7 +17961,10 @@ app48.use("*", async (c, next) => {
     remoteAddress: rawRemote,
     xForwardedFor: rawXff,
     cookieHeader: c.req.header("cookie"),
-    isPublicHost
+    // Task 829 — operator-wins: an operator host is admin-gated, so it must not
+    // be classified public here (which would bypass the admin gate). A host in
+    // both operator-domains.json and alias-domains.json stays admin-gated.
+    isPublicHost: (h) => !isOperatorHost(h, getOperatorDomains()) && isPublicHost(h)
   });
   if (decision.allow) {
     await next();
@@ -18033,7 +18027,7 @@ app48.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync26(filePath)) {
+  if (!existsSync27(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
@@ -18063,7 +18057,7 @@ app48.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync26(filePath)) {
+  if (!existsSync27(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
@@ -18083,7 +18077,7 @@ app48.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync26(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync27(BRAND_JSON_PATH)) {
   try {
     const fullBrand = JSON.parse(readFileSync26(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
@@ -18103,7 +18097,7 @@ function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT9) return "unknown";
     const versionFile = join22(PLATFORM_ROOT9, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync26(versionFile)) return "unknown";
+    if (!existsSync27(versionFile)) return "unknown";
     const content = readFileSync26(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
@@ -18166,7 +18160,7 @@ function loadBrandingCache(agentSlug) {
     const accountId = getDefaultAccountId();
     if (!accountId) return null;
     const cachePath = join22(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync26(cachePath)) return null;
+    if (!existsSync27(cachePath)) return null;
     return JSON.parse(readFileSync26(cachePath, "utf-8"));
   } catch {
     return null;
@@ -18212,11 +18206,12 @@ function agentUnavailableHtml() {
 }
 app48.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
-  if (isOperatorHost(host)) {
+  const klass = classifyHost(host, getOperatorDomains(), isPublicHost);
+  if (klass === "operator") {
     console.log(`[host-class] host=${host} class=operator served=operator.html`);
     return c.html(cachedHtml("operator.html"));
   }
-  if (isPublicHost(host)) {
+  if (klass === "public") {
     const defaultSlug = resolveDefaultSlug();
     if (!defaultSlug) {
       console.error("[public-root] op=no-default");
@@ -18296,7 +18291,7 @@ app48.get("/g/:slug", (c) => {
 });
 app48.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
-  if (isPublicHost(host) || isOperatorHost(host)) return c.text("Not found", 404);
+  if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
 app48.get("/chat", (c) => {
@@ -18311,7 +18306,7 @@ app48.get("/data", (c) => {
 });
 app48.get("/browser", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
-  if (isPublicHost(host) || isOperatorHost(host)) return c.text("Not found", 404);
+  if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("browser.html"));
 });
 app48.get("/:slug", async (c, next) => {
@@ -18416,7 +18411,7 @@ try {
 var ADMINUSER_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 async function runAdminUserReconcileTick() {
   try {
-    if (!existsSync26(USERS_FILE)) {
+    if (!existsSync27(USERS_FILE)) {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }