@rubytech/create-maxy-code 0.1.299 → 0.1.300

package/payload/server/{chunk-7H4KMTMC.js → chunk-JHSF5VPE.js}

@@ -2481,7 +2481,7 @@ var responseViaResponseObject = async (res, outgoing, options = {}) => {
         });
         if (!chunk) {
           if (i === 1) {
-            await new Promise((resolve6) => setTimeout(resolve6));
+            await new Promise((resolve7) => setTimeout(resolve7));
             maxReadCount = 3;
             continue;
           }
@@ -2778,10 +2778,10 @@ var SCRYPT_R = 8;
 var SCRYPT_P = 1;
 var SCRYPT_KEYLEN = 64;
 function scryptAsync(password, salt) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     scrypt(password, salt, SCRYPT_KEYLEN, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P }, (err, key) => {
       if (err) reject(err);
-      else resolve6(key);
+      else resolve7(key);
     });
   });
 }
@@ -3429,16 +3429,85 @@ function parseCookieValue(cookieHeader, name) {
   }
 }
 
+// app/lib/agent-slug-pattern.ts
+var AGENT_SLUG_PATTERN = /^\/([a-z][a-z0-9-]{2,49})$/;
+
 // app/lib/system-path-slugs.ts
 var SYSTEM_PATH_SLUGS = ["public", "public-chat", "chat", "graph", "data", "browser"];
 
+// server/public-host-gate.ts
+var PUBLIC_ALLOWED_PREFIXES = [
+  "/api/session",
+  "/api/chat",
+  "/api/access/",
+  "/api/health",
+  "/api/group/",
+  "/api/telegram/",
+  "/assets/",
+  "/brand/",
+  "/agent-assets/",
+  "/generated/",
+  "/g/",
+  "/sites/"
+];
+var PUBLIC_ALLOWED_EXACT = ["/favicon.ico", "/brand-defaults.css"];
+function isPublicPathAllowed(path) {
+  if (path === "/") return true;
+  if (PUBLIC_ALLOWED_EXACT.includes(path)) return true;
+  if (PUBLIC_ALLOWED_PREFIXES.some((prefix) => path.startsWith(prefix))) return true;
+  return AGENT_SLUG_PATTERN.test(path);
+}
+function isOperatorHost(host, operatorDomains2) {
+  return operatorDomains2.has(host);
+}
+function classifyHost(host, operatorDomains2, isPublicHost) {
+  if (operatorDomains2.has(host)) return "operator";
+  if (isPublicHost(host)) return "public";
+  return "admin";
+}
+
+// server/operator-domains-reader.ts
+import { watchFile } from "fs";
+
+// app/lib/operator-domains.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, resolve as resolve3 } from "path";
+var OPERATOR_DOMAINS_PATH = resolve3(MAXY_DIR, "operator-domains.json");
+function loadOperatorDomains() {
+  if (!existsSync3(OPERATOR_DOMAINS_PATH)) return /* @__PURE__ */ new Set();
+  try {
+    const parsed = JSON.parse(readFileSync3(OPERATOR_DOMAINS_PATH, "utf-8"));
+    if (!Array.isArray(parsed)) return /* @__PURE__ */ new Set();
+    return new Set(parsed.filter((h) => typeof h === "string"));
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+}
+
+// server/operator-domains-reader.ts
+var operatorDomains = loadOperatorDomains();
+if (operatorDomains.size > 0) {
+  console.log(
+    `[operator-domains] loaded ${operatorDomains.size} operator domain(s): ${[...operatorDomains].join(", ")}`
+  );
+}
+watchFile(OPERATOR_DOMAINS_PATH, { interval: 2e3 }, () => {
+  operatorDomains = loadOperatorDomains();
+  console.log(
+    `[operator-domains] reloaded ${operatorDomains.size} operator domain(s): ${[...operatorDomains].join(", ")}`
+  );
+});
+function getOperatorDomains() {
+  return operatorDomains;
+}
+
 // app/lib/claude-agent/account.ts
-import { resolve as resolve3 } from "path";
-import { readFileSync as readFileSync4, readdirSync, existsSync as existsSync4, statSync } from "fs";
+import { resolve as resolve4 } from "path";
+import { readFileSync as readFileSync5, readdirSync, existsSync as existsSync5, statSync } from "fs";
 
 // ../lib/brand-templating/src/index.ts
 import { join as join2 } from "path";
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
 var PLACEHOLDER = "{{productName}}";
 var cachedProductName = null;
 function brandJsonPath() {
@@ -3453,12 +3522,12 @@ function brandJsonPath() {
 function getBrandProductName() {
   if (cachedProductName !== null) return cachedProductName;
   const path = brandJsonPath();
-  if (!existsSync3(path)) {
+  if (!existsSync4(path)) {
     throw new Error(`[skill-loader] brand.json missing at ${path}`);
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync3(path, "utf-8"));
+    parsed = JSON.parse(readFileSync4(path, "utf-8"));
   } catch (err) {
     throw new Error(
       `[skill-loader] brand.json unreadable at ${path}: ${err instanceof Error ? err.message : String(err)}`
@@ -3493,9 +3562,9 @@ function substituteBrandPlaceholders(content, sourcePath) {
 }
 
 // app/lib/claude-agent/account.ts
-var PLATFORM_ROOT2 = process.env.MAXY_PLATFORM_ROOT ?? resolve3(process.cwd(), "..");
-var ACCOUNTS_DIR = resolve3(PLATFORM_ROOT2, "..", "data/accounts");
-if (!existsSync4(PLATFORM_ROOT2)) {
+var PLATFORM_ROOT2 = process.env.MAXY_PLATFORM_ROOT ?? resolve4(process.cwd(), "..");
+var ACCOUNTS_DIR = resolve4(PLATFORM_ROOT2, "..", "data/accounts");
+if (!existsSync5(PLATFORM_ROOT2)) {
   throw new Error(
     `PLATFORM_ROOT does not exist: ${PLATFORM_ROOT2}
 Set the MAXY_PLATFORM_ROOT environment variable to the absolute path of the platform directory.`
@@ -3503,15 +3572,15 @@ Set the MAXY_PLATFORM_ROOT environment variable to the absolute path of the plat
 }
 var _stubDirsLoggedThisBoot = /* @__PURE__ */ new Set();
 function listValidAccounts() {
-  if (!existsSync4(ACCOUNTS_DIR)) return [];
+  if (!existsSync5(ACCOUNTS_DIR)) return [];
   const out = [];
   const entries = readdirSync(ACCOUNTS_DIR, { withFileTypes: true });
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
     if (entry.name.startsWith(".")) continue;
-    const accountDir = resolve3(ACCOUNTS_DIR, entry.name);
-    const configPath = resolve3(accountDir, "account.json");
-    if (!existsSync4(configPath)) {
+    const accountDir = resolve4(ACCOUNTS_DIR, entry.name);
+    const configPath = resolve4(accountDir, "account.json");
+    if (!existsSync5(configPath)) {
       if (!_stubDirsLoggedThisBoot.has(entry.name)) {
         console.error(
           `[platform] accounts-state STUB-DIR id=${entry.name} \u2014 onboarding leak; remove or repair`
@@ -3522,7 +3591,7 @@ function listValidAccounts() {
     }
     let config;
     try {
-      config = JSON.parse(readFileSync4(configPath, "utf-8"));
+      config = JSON.parse(readFileSync5(configPath, "utf-8"));
     } catch {
       console.error(
         `[platform] accounts-state CORRUPT-JSON id=${entry.name} \u2014 account.json failed to parse; treating as stub`
@@ -3534,11 +3603,11 @@ function listValidAccounts() {
   return out;
 }
 function resolveAccount() {
-  if (!existsSync4(ACCOUNTS_DIR)) return null;
+  if (!existsSync5(ACCOUNTS_DIR)) return null;
   let usersJsonUserId = null;
-  if (existsSync4(USERS_FILE)) {
+  if (existsSync5(USERS_FILE)) {
     try {
-      const raw2 = readFileSync4(USERS_FILE, "utf-8").trim();
+      const raw2 = readFileSync5(USERS_FILE, "utf-8").trim();
       if (raw2) {
         const users = JSON.parse(raw2);
         if (users.length > 0) {
@@ -3552,9 +3621,9 @@ function resolveAccount() {
   let fallback = null;
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const configPath = resolve3(ACCOUNTS_DIR, entry.name, "account.json");
-    if (!existsSync4(configPath)) continue;
-    const raw2 = readFileSync4(configPath, "utf-8");
+    const configPath = resolve4(ACCOUNTS_DIR, entry.name, "account.json");
+    if (!existsSync5(configPath)) continue;
+    const raw2 = readFileSync5(configPath, "utf-8");
     let config;
     try {
       config = JSON.parse(raw2);
@@ -3569,7 +3638,7 @@ function resolveAccount() {
     }
     const result = {
       accountId: config.accountId,
-      accountDir: resolve3(ACCOUNTS_DIR, entry.name),
+      accountDir: resolve4(ACCOUNTS_DIR, entry.name),
       config
     };
     if (usersJsonUserId && config.admins?.some((a) => a.userId === usersJsonUserId)) {
@@ -3587,9 +3656,9 @@ function resolveAccount() {
   return fallback;
 }
 function readAgentFile(accountDir, agentName, filename) {
-  const filePath = resolve3(accountDir, "agents", agentName, filename);
-  if (!existsSync4(filePath)) return null;
-  const raw2 = readFileSync4(filePath, "utf-8");
+  const filePath = resolve4(accountDir, "agents", agentName, filename);
+  if (!existsSync5(filePath)) return null;
+  const raw2 = readFileSync5(filePath, "utf-8");
   if (filename.endsWith(".md")) {
     return substituteBrandPlaceholders(raw2, filePath);
   }
@@ -3611,14 +3680,14 @@ function validateAgentSlug(slug) {
   return true;
 }
 function resolveDefaultAgentSlug(accountDir) {
-  const configPath = resolve3(accountDir, "account.json");
-  if (!existsSync4(configPath)) {
+  const configPath = resolve4(accountDir, "account.json");
+  if (!existsSync5(configPath)) {
     console.error("[agent-resolve] account.json not found \u2014 cannot resolve defaultAgent");
     return null;
   }
   let config;
   try {
-    config = JSON.parse(readFileSync4(configPath, "utf-8"));
+    config = JSON.parse(readFileSync5(configPath, "utf-8"));
   } catch (err) {
     console.error("[agent-resolve] failed to read account.json:", err);
     return null;
@@ -3627,8 +3696,8 @@ function resolveDefaultAgentSlug(accountDir) {
     console.error("[agent-resolve] defaultAgent not configured in account.json \u2014 set it via the connect-whatsapp skill");
     return null;
   }
-  const agentConfigPath = resolve3(accountDir, "agents", config.defaultAgent, "config.json");
-  if (!existsSync4(agentConfigPath)) {
+  const agentConfigPath = resolve4(accountDir, "agents", config.defaultAgent, "config.json");
+  if (!existsSync5(agentConfigPath)) {
     console.error(`[agent-resolve] defaultAgent="${config.defaultAgent}" has no config.json at ${agentConfigPath}`);
     return null;
   }
@@ -3684,23 +3753,23 @@ function resolveAgentConfig(accountDir, agentName) {
   }
   let knowledge = null;
   let knowledgeBaked = false;
-  const agentDir = resolve3(accountDir, "agents", agentName);
-  const knowledgePath = resolve3(agentDir, "KNOWLEDGE.md");
-  const summaryPath = resolve3(agentDir, "KNOWLEDGE-SUMMARY.md");
-  const hasKnowledge = existsSync4(knowledgePath);
-  const hasSummary = existsSync4(summaryPath);
+  const agentDir = resolve4(accountDir, "agents", agentName);
+  const knowledgePath = resolve4(agentDir, "KNOWLEDGE.md");
+  const summaryPath = resolve4(agentDir, "KNOWLEDGE-SUMMARY.md");
+  const hasKnowledge = existsSync5(knowledgePath);
+  const hasSummary = existsSync5(summaryPath);
   if (hasKnowledge && hasSummary) {
     const knowledgeMtime = statSync(knowledgePath).mtimeMs;
     const summaryMtime = statSync(summaryPath).mtimeMs;
     if (summaryMtime >= knowledgeMtime) {
-      knowledge = readFileSync4(summaryPath, "utf-8");
+      knowledge = readFileSync5(summaryPath, "utf-8");
     } else {
       console.warn(`[agent-config] ${agentName}: KNOWLEDGE-SUMMARY.md is stale (KNOWLEDGE.md is newer) \u2014 using full knowledge`);
-      knowledge = readFileSync4(knowledgePath, "utf-8");
+      knowledge = readFileSync5(knowledgePath, "utf-8");
     }
     knowledgeBaked = true;
   } else if (hasKnowledge) {
-    knowledge = readFileSync4(knowledgePath, "utf-8");
+    knowledge = readFileSync5(knowledgePath, "utf-8");
     knowledgeBaked = true;
   }
   let budget = null;
@@ -3727,16 +3796,16 @@ function getDefaultAccountId() {
   return resolveAccount()?.accountId ?? null;
 }
 function resolveUserAccounts(userId) {
-  if (!existsSync4(ACCOUNTS_DIR)) return [];
+  if (!existsSync5(ACCOUNTS_DIR)) return [];
   const results = [];
   const entries = readdirSync(ACCOUNTS_DIR, { withFileTypes: true });
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const configPath = resolve3(ACCOUNTS_DIR, entry.name, "account.json");
-    if (!existsSync4(configPath)) continue;
+    const configPath = resolve4(ACCOUNTS_DIR, entry.name, "account.json");
+    if (!existsSync5(configPath)) continue;
     let config;
     try {
-      config = JSON.parse(readFileSync4(configPath, "utf-8"));
+      config = JSON.parse(readFileSync5(configPath, "utf-8"));
     } catch {
       console.error(`[session] account.json corrupt at ${configPath} \u2014 skipping`);
       continue;
@@ -3745,7 +3814,7 @@ function resolveUserAccounts(userId) {
     if (adminEntry) {
       results.push({
         accountId: config.accountId,
-        accountDir: resolve3(ACCOUNTS_DIR, entry.name),
+        accountDir: resolve4(ACCOUNTS_DIR, entry.name),
         config,
         role: adminEntry.role
       });
@@ -3819,20 +3888,20 @@ function getSessionKeyBySessionId(_sessionId) {
 }
 
 // app/lib/claude-agent/plugin-manifest.ts
-import { resolve as resolve4, join as join3 } from "path";
+import { resolve as resolve5, join as join3 } from "path";
 import {
-  readFileSync as readFileSync5,
-  writeFileSync as writeFileSync2,
+  readFileSync as readFileSync6,
+  writeFileSync as writeFileSync3,
   readdirSync as readdirSync2,
-  existsSync as existsSync5,
+  existsSync as existsSync6,
   statSync as statSync2,
   rmSync
 } from "fs";
 import { createHash as createHash2 } from "crypto";
 function isMissingPluginDir(pluginDir) {
-  const pluginRoot = resolve4(PLATFORM_ROOT2, "plugins", pluginDir);
-  if (existsSync5(resolve4(pluginRoot, "PLUGIN.md"))) return false;
-  if (existsSync5(resolve4(pluginRoot, "mcp/dist/index.js"))) return false;
+  const pluginRoot = resolve5(PLATFORM_ROOT2, "plugins", pluginDir);
+  if (existsSync6(resolve5(pluginRoot, "PLUGIN.md"))) return false;
+  if (existsSync6(resolve5(pluginRoot, "mcp/dist/index.js"))) return false;
   return true;
 }
 function findMissingPlugins(enabledPlugins) {
@@ -3840,10 +3909,10 @@ function findMissingPlugins(enabledPlugins) {
   return enabledPlugins.filter(isMissingPluginDir);
 }
 function readBundleSubPlugins(bundlePath) {
-  if (!existsSync5(bundlePath)) return [];
+  if (!existsSync6(bundlePath)) return [];
   let raw2;
   try {
-    raw2 = readFileSync5(bundlePath, "utf-8");
+    raw2 = readFileSync6(bundlePath, "utf-8");
   } catch {
     return [];
   }
@@ -3885,8 +3954,8 @@ function walkPremiumBundles() {
   return kept;
 }
 function walkPremiumBundlesOnDisk() {
-  const stagingRoot = resolve4(PLATFORM_ROOT2, "../premium-plugins");
-  if (!existsSync5(stagingRoot)) return [];
+  const stagingRoot = resolve5(PLATFORM_ROOT2, "../premium-plugins");
+  if (!existsSync6(stagingRoot)) return [];
   let entries;
   try {
     entries = readdirSync2(stagingRoot);
@@ -3896,7 +3965,7 @@ function walkPremiumBundlesOnDisk() {
   const result = [];
   for (const bundle of entries) {
     if (bundle.startsWith(".")) continue;
-    const bundleDir = resolve4(stagingRoot, bundle);
+    const bundleDir = resolve5(stagingRoot, bundle);
     try {
       if (!statSync2(bundleDir).isDirectory()) continue;
     } catch {
@@ -3910,14 +3979,14 @@ function walkPremiumBundlesOnDisk() {
 function reapDuplicateFlatPremiumSubs(bundles, stagingRoot, pluginsDir) {
   const TAG = "[premium-auto-deliver]";
   for (const { bundle, subs } of bundles) {
-    const isBundle = existsSync5(join3(stagingRoot, bundle, "BUNDLE.md"));
+    const isBundle = existsSync6(join3(stagingRoot, bundle, "BUNDLE.md"));
     for (const sub of subs) {
-      const premiumManifest = isBundle ? resolve4(stagingRoot, bundle, "plugins", sub, "PLUGIN.md") : resolve4(stagingRoot, bundle, "PLUGIN.md");
-      const flatDir = resolve4(pluginsDir, sub);
-      const flatManifest = resolve4(flatDir, "PLUGIN.md");
-      if (!existsSync5(premiumManifest) || !existsSync5(flatManifest)) continue;
-      const premiumSha = createHash2("sha256").update(readFileSync5(premiumManifest)).digest("hex");
-      const flatSha = createHash2("sha256").update(readFileSync5(flatManifest)).digest("hex");
+      const premiumManifest = isBundle ? resolve5(stagingRoot, bundle, "plugins", sub, "PLUGIN.md") : resolve5(stagingRoot, bundle, "PLUGIN.md");
+      const flatDir = resolve5(pluginsDir, sub);
+      const flatManifest = resolve5(flatDir, "PLUGIN.md");
+      if (!existsSync6(premiumManifest) || !existsSync6(flatManifest)) continue;
+      const premiumSha = createHash2("sha256").update(readFileSync6(premiumManifest)).digest("hex");
+      const flatSha = createHash2("sha256").update(readFileSync6(flatManifest)).digest("hex");
       if (isBundle) {
         if (premiumSha === flatSha) {
           try {
@@ -3943,24 +4012,24 @@ function reapDuplicateFlatPremiumSubs(bundles, stagingRoot, pluginsDir) {
 function autoDeliverPremiumPlugins() {
   const bundles = walkPremiumBundles();
   if (bundles.length === 0) return;
-  const stagingRoot = resolve4(PLATFORM_ROOT2, "../premium-plugins");
-  const pluginsDir = resolve4(PLATFORM_ROOT2, "plugins");
+  const stagingRoot = resolve5(PLATFORM_ROOT2, "../premium-plugins");
+  const pluginsDir = resolve5(PLATFORM_ROOT2, "plugins");
   reapDuplicateFlatPremiumSubs(bundles, stagingRoot, pluginsDir);
 }
 function reconcileEnabledPlugins(accountDir, config, accountId) {
   const TAG = "[premium-auto-deliver]";
   if (!accountDir || !config) return;
   const bundles = walkPremiumBundles();
-  const stagingRoot = resolve4(PLATFORM_ROOT2, "../premium-plugins");
+  const stagingRoot = resolve5(PLATFORM_ROOT2, "../premium-plugins");
   const bundleNames = [];
   const allSubs = [];
   for (const { bundle, subs } of bundles) {
     bundleNames.push(bundle);
     const bundlePath = join3(stagingRoot, bundle, "BUNDLE.md");
-    const isBundle = existsSync5(bundlePath);
+    const isBundle = existsSync6(bundlePath);
     for (const sub of subs) {
-      const subManifest = isBundle ? resolve4(stagingRoot, bundle, "plugins", sub, "PLUGIN.md") : resolve4(stagingRoot, bundle, "PLUGIN.md");
-      if (!existsSync5(subManifest)) continue;
+      const subManifest = isBundle ? resolve5(stagingRoot, bundle, "plugins", sub, "PLUGIN.md") : resolve5(stagingRoot, bundle, "PLUGIN.md");
+      if (!existsSync6(subManifest)) continue;
       allSubs.push(sub);
     }
   }
@@ -3977,12 +4046,12 @@ function reconcileEnabledPlugins(accountDir, config, accountId) {
   );
   if (added.length === 0) return;
   const merged = [...currentSet];
-  const configPath = resolve4(accountDir, "account.json");
+  const configPath = resolve5(accountDir, "account.json");
   try {
-    const raw2 = readFileSync5(configPath, "utf-8");
+    const raw2 = readFileSync6(configPath, "utf-8");
     const parsed = JSON.parse(raw2);
     parsed.enabledPlugins = merged;
-    writeFileSync2(configPath, JSON.stringify(parsed, null, 2) + "\n");
+    writeFileSync3(configPath, JSON.stringify(parsed, null, 2) + "\n");
     config.enabledPlugins = merged;
   } catch (err) {
     console.error(`${TAG} enabled-stamp write failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -4008,12 +4077,12 @@ function cleanupLeakedPremiumSubs(accountDir, config, accountId) {
     else kept.push(name);
   }
   if (removed.length === 0) return;
-  const configPath = resolve4(accountDir, "account.json");
+  const configPath = resolve5(accountDir, "account.json");
   try {
-    const raw2 = readFileSync5(configPath, "utf-8");
+    const raw2 = readFileSync6(configPath, "utf-8");
     const parsed = JSON.parse(raw2);
     parsed.enabledPlugins = kept;
-    writeFileSync2(configPath, JSON.stringify(parsed, null, 2) + "\n");
+    writeFileSync3(configPath, JSON.stringify(parsed, null, 2) + "\n");
     config.enabledPlugins = kept;
     console.log(`${TAG} cleanup accountId=${accountId ?? "unknown"} removed=[${removed.join(",")}]`);
   } catch (err) {
@@ -4061,15 +4130,15 @@ function requirePortEnv(envName, options = {}) {
 // app/lib/neo4j-store.ts
 import neo4j from "neo4j-driver";
 import { randomUUID } from "crypto";
-import { readFileSync as readFileSync6, readdirSync as readdirSync3, existsSync as existsSync6, openSync, readSync, closeSync, statSync as statSync3 } from "fs";
-import { resolve as resolve5 } from "path";
-var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve5(process.cwd(), "..");
+import { readFileSync as readFileSync7, readdirSync as readdirSync3, existsSync as existsSync7, openSync, readSync, closeSync, statSync as statSync3 } from "fs";
+import { resolve as resolve6 } from "path";
+var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve6(process.cwd(), "..");
 var driver = null;
 function readPassword() {
   if (process.env.NEO4J_PASSWORD) return process.env.NEO4J_PASSWORD;
-  const passwordFile = resolve5(PLATFORM_ROOT3, "config/.neo4j-password");
+  const passwordFile = resolve6(PLATFORM_ROOT3, "config/.neo4j-password");
   try {
-    return readFileSync6(passwordFile, "utf-8").trim();
+    return readFileSync7(passwordFile, "utf-8").trim();
   } catch {
     throw new Error(
       `Neo4j password not found. Expected at ${passwordFile} or in NEO4J_PASSWORD env var.`
@@ -4387,8 +4456,8 @@ async function persistMessage(sessionId, role, content, accountId, tokens, creat
   const prev = persistMessageLocks.get(sessionId);
   const waited = prev !== void 0;
   let release;
-  const mine = new Promise((resolve6) => {
-    release = resolve6;
+  const mine = new Promise((resolve7) => {
+    release = resolve7;
   });
   const chained = (prev ?? Promise.resolve()).then(() => mine);
   persistMessageLocks.set(sessionId, chained);
@@ -5088,11 +5157,11 @@ function parsePluginProfileKeys(manifest) {
   return out;
 }
 function loadEnabledPluginProfileKeys(accountId) {
-  const accountFile = resolve5(PLATFORM_ROOT3, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync6(accountFile)) return {};
+  const accountFile = resolve6(PLATFORM_ROOT3, "..", "data/accounts", accountId, "account.json");
+  if (!existsSync7(accountFile)) return {};
   let enabled;
   try {
-    const raw2 = readFileSync6(accountFile, "utf-8");
+    const raw2 = readFileSync7(accountFile, "utf-8");
     const parsed = JSON.parse(raw2);
     enabled = Array.isArray(parsed.enabledPlugins) ? parsed.enabledPlugins.filter((p) => typeof p === "string") : [];
   } catch (err) {
@@ -5103,11 +5172,11 @@ function loadEnabledPluginProfileKeys(accountId) {
   }
   const merged = {};
   for (const pluginName of enabled) {
-    const manifestPath = resolve5(PLATFORM_ROOT3, "plugins", pluginName, "PLUGIN.md");
-    if (!existsSync6(manifestPath)) continue;
+    const manifestPath = resolve6(PLATFORM_ROOT3, "plugins", pluginName, "PLUGIN.md");
+    if (!existsSync7(manifestPath)) continue;
     let manifest;
     try {
-      manifest = readFileSync6(manifestPath, "utf-8");
+      manifest = readFileSync7(manifestPath, "utf-8");
     } catch {
       continue;
     }
@@ -5352,22 +5421,22 @@ async function projectAgent(accountId, accountDir, slug) {
     );
     return;
   }
-  const agentDir = resolve5(accountDir, "agents", slug);
-  const configPath = resolve5(agentDir, "config.json");
+  const agentDir = resolve6(accountDir, "agents", slug);
+  const configPath = resolve6(agentDir, "config.json");
   let config;
   let presentRoles = [];
   try {
-    if (!existsSync6(configPath)) {
+    if (!existsSync7(configPath)) {
       console.error(
         `[agent-graph] project FAILED slug=${slug} account=${account8} error="config.json missing at ${configPath}"`
       );
       return;
     }
-    config = JSON.parse(readFileSync6(configPath, "utf-8"));
+    config = JSON.parse(readFileSync7(configPath, "utf-8"));
     for (const { filename, role } of AGENT_FILE_ROLES) {
-      const filePath = resolve5(agentDir, filename);
-      if (!existsSync6(filePath)) continue;
-      const body = readFileSync6(filePath, "utf-8");
+      const filePath = resolve6(agentDir, filename);
+      if (!existsSync7(filePath)) continue;
+      const body = readFileSync7(filePath, "utf-8");
       presentRoles.push({ role, body, edge: ROLE_TO_EDGE[role] });
     }
   } catch (err) {
@@ -5650,7 +5719,14 @@ export {
   renderLoginPage,
   canAccessAdmin,
   parseCookieValue,
+  AGENT_SLUG_PATTERN,
   SYSTEM_PATH_SLUGS,
+  PUBLIC_ALLOWED_PREFIXES,
+  PUBLIC_ALLOWED_EXACT,
+  isPublicPathAllowed,
+  isOperatorHost,
+  classifyHost,
+  getOperatorDomains,
   PLATFORM_ROOT2 as PLATFORM_ROOT,
   ACCOUNTS_DIR,
   listValidAccounts,

package/payload/server/maxy-edge.js

@@ -6,7 +6,9 @@ import {
   canAccessAdmin,
   clientIpMiddleware,
   describeRemoteSession,
+  getOperatorDomains,
   getRequestListener,
+  isOperatorHost,
   newCorrId,
   parseCookieValue,
   requireAdminCookie,
@@ -14,7 +16,7 @@ import {
   sanitizeClientCorrId,
   vncLog,
   websockifyLog
-} from "./chunk-7H4KMTMC.js";
+} from "./chunk-JHSF5VPE.js";
 import "./chunk-PFF6I7KP.js";
 
 // server/edge.ts
@@ -46,6 +48,7 @@ function attachVncWsProxy(server2, opts) {
     try {
       handleUpgrade(req, clientSocket, head, {
         isPublicHost: opts.isPublicHost,
+        isOperatorHost: opts.isOperatorHost ?? (() => false),
         upstreamHost,
         upstreamPort,
         brand
@@ -143,6 +146,19 @@ function handleUpgrade(req, clientSocket, head, opts) {
     writeStatusAndDestroy(clientSocket, 403, "Forbidden");
     return;
   }
+  if (opts.isOperatorHost(originHost)) {
+    vncLog("ws-upgrade", {
+      corrId,
+      clientCorrId: clientCorrId ?? null,
+      decision: "rejected",
+      reason: "origin-operator-host",
+      origin_host: originHost,
+      host: hostHeader,
+      ip: remote
+    });
+    writeStatusAndDestroy(clientSocket, 403, "Forbidden");
+    return;
+  }
   vncLog("ws-upgrade", {
     corrId,
     clientCorrId: clientCorrId ?? null,
@@ -795,6 +811,8 @@ server.keepAliveTimeout = parseInt(process.env.KEEP_ALIVE_TIMEOUT ?? "61000", 10
 server.headersTimeout = server.keepAliveTimeout + 1e3;
 attachVncWsProxy(server, {
   isPublicHost,
+  // Task 829 — deny VNC on operator hosts (operator shell has no /browser).
+  isOperatorHost: (h) => isOperatorHost(h, getOperatorDomains()),
   upstreamHost: WEBSOCKIFY_HOST,
   upstreamPort: WEBSOCKIFY_PORT2,
   brand: BRAND.productName