@rubytech/create-maxy-code 0.1.311 → 0.1.313

package/payload/server/server.js

@@ -110,7 +110,7 @@ import {
   vncLog,
   walkPremiumBundles,
   writeAdminUserAndPerson
-} from "./chunk-J6WDAWFJ.js";
+} from "./chunk-Q7EWROVN.js";
 import {
   __commonJS,
   __toESM
@@ -562,6 +562,30 @@ var require_dist2 = __commonJS({
         if (v.length > 0) {
           return v.length > 24 ? v.slice(0, 24) + "\u2026" : v;
         }
+      } else if (primaryLabel === "Job") {
+        const client = typeof props.client === "string" ? props.client : "";
+        const jobId = typeof props.jobId === "string" ? props.jobId : "";
+        const composed = [client, jobId.length > 0 ? `#${jobId}` : ""].filter((s) => s.length > 0).join(" ");
+        if (composed.length > 0) {
+          return composed.length > 24 ? composed.slice(0, 24) + "\u2026" : composed;
+        }
+      } else if (primaryLabel === "QuoteDocument") {
+        const ref = typeof props.ref === "string" ? props.ref : "";
+        if (ref.length > 0) {
+          return ref.length > 24 ? ref.slice(0, 24) + "\u2026" : ref;
+        }
+      } else if (primaryLabel === "InboundInvoice") {
+        const supplier = typeof props.supplier === "string" ? props.supplier : "";
+        const conf = typeof props.confirmationNumber === "string" ? props.confirmationNumber : "";
+        const composed = [supplier, conf.length > 0 ? `#${conf}` : ""].filter((s) => s.length > 0).join(" ");
+        if (composed.length > 0) {
+          return composed.length > 24 ? composed.slice(0, 24) + "\u2026" : composed;
+        }
+      } else if (primaryLabel === "WhatsAppGroup") {
+        const clientName = typeof props.clientName === "string" ? props.clientName : "";
+        if (clientName.length > 0) {
+          return clientName.length > 24 ? clientName.slice(0, 24) + "\u2026" : clientName;
+        }
       } else if (primaryLabel === "Message") {
         const role = typeof props.role === "string" ? props.role : "";
         const roleShort = role === "user" ? "user" : role === "assistant" ? "asst" : role === "system" ? "sys" : role === "tool" ? "tool" : null;
@@ -615,6 +639,26 @@ var require_dist2 = __commonJS({
         const v = dn.length > 0 ? dn : slug;
         if (v.length > 0)
           return v;
+      } else if (primaryLabel === "Job") {
+        const client = typeof props.client === "string" ? props.client : "";
+        const jobId = typeof props.jobId === "string" ? props.jobId : "";
+        const composed = [client, jobId.length > 0 ? `#${jobId}` : ""].filter((s) => s.length > 0).join(" ");
+        if (composed.length > 0)
+          return composed;
+      } else if (primaryLabel === "QuoteDocument") {
+        const ref = typeof props.ref === "string" ? props.ref : "";
+        if (ref.length > 0)
+          return ref;
+      } else if (primaryLabel === "InboundInvoice") {
+        const supplier = typeof props.supplier === "string" ? props.supplier : "";
+        const conf = typeof props.confirmationNumber === "string" ? props.confirmationNumber : "";
+        const composed = [supplier, conf.length > 0 ? `#${conf}` : ""].filter((s) => s.length > 0).join(" ");
+        if (composed.length > 0)
+          return composed;
+      } else if (primaryLabel === "WhatsAppGroup") {
+        const clientName = typeof props.clientName === "string" ? props.clientName : "";
+        if (clientName.length > 0)
+          return clientName;
       }
       for (const k of ["name", "title", "summary", "givenName", "subject", "text"]) {
         const v = props[k];
@@ -1227,8 +1271,8 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync27, existsSync as existsSync28, watchFile } from "fs";
-import { resolve as resolve31, join as join25, basename as basename9 } from "path";
+import { readFileSync as readFileSync29, existsSync as existsSync31, watchFile } from "fs";
+import { resolve as resolve31, join as join27, basename as basename9 } from "path";
 import { homedir as homedir3 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
@@ -4941,6 +4985,7 @@ var SUPPORTED_MIME_TYPES = /* @__PURE__ */ new Set([
 ]);
 var MAX_FILE_SIZE_BYTES = 50 * 1024 * 1024;
 var MAX_FILES_PER_MESSAGE = 5;
+var MAX_DATA_UPLOAD_BYTES = 2 * 1024 * 1024 * 1024;
 var MAX_ZIP_UNCOMPRESSED_BYTES = 100 * 1024 * 1024;
 function assertSupportedMime(mimeType) {
   if (!SUPPORTED_MIME_TYPES.has(mimeType)) {
@@ -5180,8 +5225,8 @@ function webchatTurnTimeoutMs() {
   return Number(process.env.WEBCHAT_TURN_TIMEOUT_MS ?? String(2 * 6e4));
 }
 function createChatRoutes(deps) {
-  const app51 = new Hono();
-  app51.post("/", async (c) => {
+  const app53 = new Hono();
+  app53.post("/", async (c) => {
     console.log(`[chat-route] entered route=public method=POST`);
     const contentType = c.req.header("content-type") ?? "";
     const account = resolveAccount();
@@ -5404,7 +5449,7 @@ ${result.result.text}` : result.result.text;
       }
     });
   });
-  return app51;
+  return app53;
 }
 
 // server/routes/whatsapp.ts
@@ -7065,6 +7110,20 @@ function unwrapChannel(text) {
   }
   return source ? { text: inner, source } : { text: inner };
 }
+var COMPOSED_ADMIN_FRAME = /^## Context\n([\s\S]*)\n\n## Instruction\n[\s\S]*$/;
+function rawFromComposedAdminFrame(text) {
+  return text.match(COMPOSED_ADMIN_FRAME)?.[1];
+}
+function operatorInboundTurn(u, ts) {
+  const rawBody = rawFromComposedAdminFrame(u.text);
+  return {
+    kind: "operator-inbound",
+    text: u.text,
+    ts,
+    ...u.source ? { source: u.source } : {},
+    ...rawBody !== void 0 ? { rawBody } : {}
+  };
+}
 function asString(content) {
   return typeof content === "string" ? content : null;
 }
@@ -7127,6 +7186,14 @@ function lastTurnTs(turns) {
 function isModelGated(turns) {
   return turns.some((t) => t.kind === "agent-error" && t.code === "model_unavailable");
 }
+function renderOrSuppressChannelInbound(u, ts, out, queuedPendingSuppress) {
+  const armed = queuedPendingSuppress.get(u.text) ?? 0;
+  if (armed > 0) {
+    queuedPendingSuppress.set(u.text, armed - 1);
+  } else {
+    out.push(operatorInboundTurn(u, ts));
+  }
+}
 function parseTranscript(lines) {
   const out = [];
   const queuedPendingSuppress = /* @__PURE__ */ new Map();
@@ -7158,7 +7225,7 @@ function parseTranscript(lines) {
       const content = asString(row.content);
       if (content !== null && CHANNEL_WRAPPER2.test(content)) {
         const u = unwrapChannel(content);
-        out.push({ kind: "operator-inbound", text: u.text, ts, ...u.source ? { source: u.source } : {} });
+        out.push(operatorInboundTurn(u, ts));
         queuedPendingSuppress.set(u.text, (queuedPendingSuppress.get(u.text) ?? 0) + 1);
       }
       continue;
@@ -7167,13 +7234,7 @@ function parseTranscript(lines) {
       const att = row.attachment;
       const isChannelQueued = att?.type === "queued_command" && att.isMeta === true && typeof att.origin === "object" && att.origin !== null && att.origin.kind === "channel" && typeof att.prompt === "string";
       if (isChannelQueued) {
-        const u = unwrapChannel(att.prompt);
-        const armed = queuedPendingSuppress.get(u.text) ?? 0;
-        if (armed > 0) {
-          queuedPendingSuppress.set(u.text, armed - 1);
-        } else {
-          out.push({ kind: "operator-inbound", text: u.text, ts, ...u.source ? { source: u.source } : {} });
-        }
+        renderOrSuppressChannelInbound(unwrapChannel(att.prompt), ts, out, queuedPendingSuppress);
       }
       continue;
     }
@@ -7187,8 +7248,7 @@ function parseTranscript(lines) {
     if (CLI_MARKER_PREFIXES2.some((p) => text.startsWith(p))) continue;
     const isChannel = row.isMeta === true && typeof row.origin === "object" && row.origin !== null && row.origin.kind === "channel";
     if (isChannel) {
-      const u = unwrapChannel(text);
-      out.push({ kind: "operator-inbound", text: u.text, ts, ...u.source ? { source: u.source } : {} });
+      renderOrSuppressChannelInbound(unwrapChannel(text), ts, out, queuedPendingSuppress);
     } else {
       out.push({ kind: "operator-typed", text, ts });
     }
@@ -7650,8 +7710,8 @@ var public_reader_default = app5;
 
 // server/routes/webchat.ts
 import { basename as basename4, dirname as dirname3 } from "path";
-import { join as join13 } from "path";
-import { existsSync as existsSync8, readdirSync as readdirSync7, readFileSync as readFileSync13, renameSync as renameSync2, statSync as statSync6, writeFileSync as writeFileSync6 } from "fs";
+import { join as join14 } from "path";
+import { existsSync as existsSync9, readdirSync as readdirSync8, readFileSync as readFileSync14, renameSync as renameSync3, statSync as statSync6, writeFileSync as writeFileSync7 } from "fs";
 
 // server/canonical-webchat-override.ts
 import { readFileSync as readFileSync12, writeFileSync as writeFileSync5, renameSync } from "fs";
@@ -7688,16 +7748,141 @@ function adminSessionIdFor(accountId, senderId, personId) {
   return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}`;
 }
 
+// ../services/claude-session-manager/src/sidecar-store.ts
+import { existsSync as existsSync8, mkdirSync as mkdirSync2, readdirSync as readdirSync7, readFileSync as readFileSync13, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync6 } from "fs";
+import { join as join13 } from "path";
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function createSidecarStore(config) {
+  const { suffix, validate: validate2 } = config;
+  const suffixRe = new RegExp(`${escapeRegExp(suffix)}$`);
+  function pathFor(sessionsDir, id) {
+    return join13(sessionsDir, `${id}${suffix}`);
+  }
+  function write(sessionsDir, id, record) {
+    mkdirSync2(sessionsDir, { recursive: true });
+    const path2 = pathFor(sessionsDir, id);
+    const tmp = `${path2}.tmp.${process.pid}`;
+    try {
+      writeFileSync6(tmp, JSON.stringify(record), "utf8");
+      renameSync2(tmp, path2);
+      return { ok: true };
+    } catch (error) {
+      try {
+        if (existsSync8(tmp)) unlinkSync(tmp);
+      } catch {
+      }
+      return { ok: false, error };
+    }
+  }
+  function readFileAt(path2) {
+    let raw;
+    try {
+      raw = readFileSync13(path2, "utf8");
+    } catch {
+      return null;
+    }
+    try {
+      return validate2(JSON.parse(raw));
+    } catch {
+      return null;
+    }
+  }
+  function read(sessionsDir, id) {
+    return readFileAt(pathFor(sessionsDir, id));
+  }
+  function readAll(sessionsDir, onSkip) {
+    let names;
+    try {
+      names = readdirSync7(sessionsDir, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => entry.name);
+    } catch {
+      return [];
+    }
+    const out = [];
+    for (const name of names) {
+      if (!suffixRe.test(name)) continue;
+      const path2 = join13(sessionsDir, name);
+      let raw;
+      try {
+        raw = readFileSync13(path2, "utf8");
+      } catch {
+        onSkip?.(name, "unreadable");
+        continue;
+      }
+      let parsed;
+      try {
+        parsed = JSON.parse(raw);
+      } catch {
+        onSkip?.(name, "unreadable");
+        continue;
+      }
+      const record = validate2(parsed);
+      if (record) out.push(record);
+      else onSkip?.(name, "invalid");
+    }
+    return out;
+  }
+  function clear(sessionsDir, id) {
+    const path2 = pathFor(sessionsDir, id);
+    try {
+      if (existsSync8(path2)) {
+        unlinkSync(path2);
+        return { ok: true, removed: true };
+      }
+      return { ok: true, removed: false };
+    } catch (error) {
+      return { ok: false, error };
+    }
+  }
+  return { pathFor, write, read, readAll, clear };
+}
+
+// ../services/claude-session-manager/src/reseat-ledger.ts
+var RESEAT_CHAIN_MAX_DEPTH = 16;
+var store = createSidecarStore({
+  suffix: ".reseated.json",
+  validate: (raw) => {
+    if (!raw || typeof raw !== "object") return null;
+    const r = raw;
+    if (typeof r.sourceSessionId === "string" && typeof r.forkSessionId === "string" && typeof r.at === "number") {
+      return { sourceSessionId: r.sourceSessionId, forkSessionId: r.forkSessionId, at: r.at };
+    }
+    return null;
+  }
+});
+function readAllReseatMarkers(sessionsDir, logger) {
+  return store.readAll(sessionsDir, (name) => logger(`[reseat-ledger] skip-unreadable file=${name}`));
+}
+function resolveBridgeSource(sessionsDir, forkSessionId, jsonlExists, maxDepth = RESEAT_CHAIN_MAX_DEPTH) {
+  const sourceOf = /* @__PURE__ */ new Map();
+  for (const m of readAllReseatMarkers(sessionsDir, () => {
+  })) {
+    sourceOf.set(m.forkSessionId, m.sourceSessionId);
+  }
+  const visited = /* @__PURE__ */ new Set([forkSessionId]);
+  let current = forkSessionId;
+  for (let depth = 0; depth < maxDepth; depth++) {
+    const source = sourceOf.get(current);
+    if (source === void 0) return null;
+    if (visited.has(source)) return null;
+    visited.add(source);
+    if (jsonlExists(source)) return source;
+    current = source;
+  }
+  return null;
+}
+
 // server/routes/webchat.ts
 var WEBCHAT_ADMIN_KEY = "webchat-admin";
 var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function locateSession(sessionId) {
   const cfg = claudeConfigDir();
   if (!cfg) return { projectDir: null, channel: null };
-  for (const { path: path2 } of enumerateJsonls(join13(cfg, "projects"))) {
+  for (const { path: path2 } of enumerateJsonls(join14(cfg, "projects"))) {
     if (basename4(path2) === `${sessionId}.jsonl`) {
       const dir = dirname3(path2);
-      const meta = readSidecarMeta(join13(dir, `${sessionId}.meta.json`));
+      const meta = readSidecarMeta(join14(dir, `${sessionId}.meta.json`));
       return { projectDir: dir, channel: meta.channel };
     }
   }
@@ -7706,16 +7891,16 @@ function locateSession(sessionId) {
 function locateSidecar(sessionId) {
   const cfg = claudeConfigDir();
   if (!cfg) return null;
-  const projectsRoot = join13(cfg, "projects");
+  const projectsRoot = join14(cfg, "projects");
   let slugs;
   try {
-    slugs = readdirSync7(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    slugs = readdirSync8(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
     return null;
   }
   for (const slug of slugs) {
-    const metaPath = join13(projectsRoot, slug, `${sessionId}.meta.json`);
-    if (existsSync8(metaPath)) {
+    const metaPath = join14(projectsRoot, slug, `${sessionId}.meta.json`);
+    if (existsSync9(metaPath)) {
       return { channel: readSidecarMeta(metaPath).channel };
     }
   }
@@ -7727,7 +7912,7 @@ function sessionSidecarExists(sessionId) {
 function jsonlSizeBytes(projectDir, sessionId) {
   if (projectDir === null) return null;
   try {
-    return statSync6(join13(projectDir, `${sessionId}.jsonl`)).size;
+    return statSync6(join14(projectDir, `${sessionId}.jsonl`)).size;
   } catch {
     return null;
   }
@@ -7792,14 +7977,38 @@ function readLevers(preResolved) {
     leverMode: typeof mode === "string" && PERMISSION_MODE_VALUES.has(mode) ? mode : null
   };
 }
-function resolveCanonicalSessionId(accountId, accountDir) {
+function latestAdminWebchatSessionId() {
+  const cfg = claudeConfigDir();
+  if (!cfg) return null;
+  let best = null;
+  for (const { path: path2, isSubagent, archived } of enumerateJsonls(join14(cfg, "projects"))) {
+    if (isSubagent || archived) continue;
+    const id = basename4(path2).slice(0, -".jsonl".length);
+    const meta = readSidecarMeta(join14(dirname3(path2), `${id}.meta.json`));
+    if (meta.role !== "admin" || meta.channel !== "webchat") continue;
+    let mtimeMs;
+    try {
+      mtimeMs = statSync6(path2).mtimeMs;
+    } catch {
+      continue;
+    }
+    if (best === null || mtimeMs > best.mtimeMs) best = { id, mtimeMs };
+  }
+  return best === null ? null : best.id;
+}
+function overrideKnownNonArchived(id) {
+  const { projectDir } = locateSession(id);
+  if (projectDir === null) return sessionSidecarExists(id);
+  return basename4(projectDir) !== "archive";
+}
+function resolveCanonical(accountId, accountDir) {
+  const latest = latestAdminWebchatSessionId();
+  if (latest !== null) return { sessionId: latest, source: "latest" };
   if (accountDir) {
     const override = readCanonicalOverrideId(accountDir);
-    if (override && (locateSession(override).projectDir !== null || sessionSidecarExists(override))) {
-      return override;
-    }
+    if (override && overrideKnownNonArchived(override)) return { sessionId: override, source: "override" };
   }
-  return adminSessionIdFor(accountId, WEBCHAT_ADMIN_KEY);
+  return { sessionId: adminSessionIdFor(accountId, WEBCHAT_ADMIN_KEY), source: "canonical-empty" };
 }
 var REAPPLY_TIMEOUT_MS = 1500;
 async function reapplyLeversViaManager() {
@@ -7822,8 +8031,8 @@ async function reapplyLeversViaManager() {
 var WEBCHAT_SEND_TURN_WINDOW_MS = Number(process.env.WEBCHAT_SEND_TURN_WINDOW_MS ?? String(15e3));
 var sendSeq = 0;
 function createWebchatRoutes(deps) {
-  const app51 = new Hono();
-  app51.post("/send", requireAdminSession, async (c) => {
+  const app53 = new Hono();
+  app53.post("/send", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -7872,6 +8081,10 @@ function createWebchatRoutes(deps) {
     }
     let deliveryKey = WEBCHAT_ADMIN_KEY;
     let deliverySessionId;
+    if (target === void 0) {
+      const latest = latestAdminWebchatSessionId();
+      if (latest !== null) target = latest;
+    }
     if (target !== void 0) {
       let { projectDir, channel } = locateSession(target);
       if (projectDir === null) {
@@ -7961,7 +8174,7 @@ ${note}` : note;
       } catch {
         canonAccount = null;
       }
-      turnSessionId = resolveCanonicalSessionId(accountId, canonAccount?.accountDir ?? null);
+      turnSessionId = resolveCanonical(accountId, canonAccount?.accountDir ?? null).sessionId;
     }
     const keyDisplay2 = deliveryKey.startsWith("session:") ? deliveryKey.slice(0, "session:".length + 8) : WEBCHAT_ADMIN_KEY;
     const baseline = jsonlSizeBytes(locateSession(turnSessionId).projectDir, turnSessionId);
@@ -7978,7 +8191,7 @@ ${note}` : note;
     if (turnTimer.unref) turnTimer.unref();
     return c.json({ ok: true });
   });
-  app51.post("/settings", requireAdminSession, async (c) => {
+  app53.post("/settings", requireAdminSession, async (c) => {
     const body = await c.req.json().catch(() => null);
     const op = body?.op;
     const value = body?.value;
@@ -8000,15 +8213,15 @@ ${note}` : note;
       console.error(`[webchat:settings] op=${op} outcome=refused value=${value} reason=account-unresolved`);
       return c.json({ error: "account unresolved" }, 503);
     }
-    const accountJsonPath = join13(account.accountDir, "account.json");
+    const accountJsonPath = join14(account.accountDir, "account.json");
     try {
-      const parsed = JSON.parse(readFileSync13(accountJsonPath, "utf8"));
+      const parsed = JSON.parse(readFileSync14(accountJsonPath, "utf8"));
       if (op === "model") parsed.adminModel = value;
       else if (op === "effort") parsed.effort = value;
       else parsed.adminPermissionMode = value;
       const tmp = `${accountJsonPath}.${process.pid}.tmp`;
-      writeFileSync6(tmp, JSON.stringify(parsed, null, 2), "utf8");
-      renameSync2(tmp, accountJsonPath);
+      writeFileSync7(tmp, JSON.stringify(parsed, null, 2), "utf8");
+      renameSync3(tmp, accountJsonPath);
     } catch (err) {
       const detail = err instanceof Error ? err.message : String(err);
       console.error(`[webchat:settings] op=${op} outcome=refused value=${value} reason=write-failed detail=${detail}`);
@@ -8018,7 +8231,7 @@ ${note}` : note;
     console.log(`[webchat:settings] op=${op} outcome=accepted value=${value} settingsApplied=${settingsApplied}`);
     return c.json({ ok: true, settingsApplied });
   });
-  app51.get("/session", requireAdminSession, async (c) => {
+  app53.get("/session", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -8033,9 +8246,26 @@ ${note}` : note;
         return c.json({ error: "invalid session id" }, 400);
       }
       const { projectDir: projectDir2, channel } = locateSession(target);
-      const known = projectDir2 !== null || sessionSidecarExists(target);
+      let resolvedProjectDir = projectDir2;
+      let transcriptSessionId = target;
+      if (projectDir2 === null) {
+        const cfg2 = claudeConfigDir();
+        if (cfg2) {
+          const source2 = resolveBridgeSource(
+            join14(cfg2, "sessions"),
+            target,
+            (id) => locateSession(id).projectDir !== null
+          );
+          if (source2) {
+            resolvedProjectDir = locateSession(source2).projectDir;
+            transcriptSessionId = source2;
+            console.log(`[chat-reseat] op=bridge fork=${target.slice(0, 8)} source=${source2.slice(0, 8)}`);
+          }
+        }
+      }
+      const known = resolvedProjectDir !== null || sessionSidecarExists(target);
       const indicators2 = await fetchComposerIndicators(target);
-      return c.json({ sessionId: target, projectDir: projectDir2, channelBinding: conflictingBinding(channel), known, sizeBytes: jsonlSizeBytes(projectDir2, target), ...indicators2, ...readLevers() });
+      return c.json({ sessionId: target, projectDir: resolvedProjectDir, transcriptSessionId, channelBinding: conflictingBinding(channel), known, sizeBytes: jsonlSizeBytes(projectDir2, target), ...indicators2, ...readLevers() });
     }
     let account;
     try {
@@ -8043,11 +8273,15 @@ ${note}` : note;
     } catch {
       account = null;
     }
-    const sessionId = resolveCanonicalSessionId(accountId, account?.accountDir ?? null);
+    const { sessionId, source } = resolveCanonical(accountId, account?.accountDir ?? null);
+    if (source === "latest" && account?.accountDir) {
+      writeCanonicalOverrideId(account.accountDir, sessionId);
+    }
+    console.log(`[webchat:inbound] op=session-resolve key=${sessionId.slice(0, 8)} source=${source}`);
     const cfg = claudeConfigDir();
     let projectDir = null;
     if (cfg) {
-      for (const { path: path2 } of enumerateJsonls(join13(cfg, "projects"))) {
+      for (const { path: path2 } of enumerateJsonls(join14(cfg, "projects"))) {
         if (basename4(path2) === `${sessionId}.jsonl`) {
           projectDir = dirname3(path2);
           break;
@@ -8057,15 +8291,15 @@ ${note}` : note;
     const indicators = await fetchComposerIndicators(sessionId);
     return c.json({ sessionId, projectDir, sizeBytes: jsonlSizeBytes(projectDir, sessionId), ...indicators, ...readLevers(account) });
   });
-  return app51;
+  return app53;
 }
 
 // server/routes/webchat-greeting.ts
 import { resolve as resolve13 } from "path";
 
 // app/lib/claude-agent/specialist-roster.ts
-import { existsSync as existsSync9, readFileSync as readFileSync14, readdirSync as readdirSync8 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync15, readdirSync as readdirSync9 } from "fs";
+import { join as join15 } from "path";
 function field(fm, name) {
   const m = fm.match(new RegExp(`^${name}:\\s*(.*?)\\r?$`, "m"));
   if (!m) return null;
@@ -8076,15 +8310,15 @@ function field(fm, name) {
   return value || null;
 }
 function readSpecialistRoster(specialistsDir) {
-  if (!existsSync9(specialistsDir)) return { specialists: [], skipped: [] };
-  const entries = readdirSync8(specialistsDir);
+  if (!existsSync10(specialistsDir)) return { specialists: [], skipped: [] };
+  const entries = readdirSync9(specialistsDir);
   const specialists = [];
   const skipped = [];
   for (const file of entries.sort()) {
     if (!file.endsWith(".md")) continue;
     let raw;
     try {
-      raw = readFileSync14(join14(specialistsDir, file), "utf-8");
+      raw = readFileSync15(join15(specialistsDir, file), "utf-8");
     } catch (err) {
       skipped.push({ file, reason: err instanceof Error ? err.message : String(err) });
       continue;
@@ -8201,8 +8435,8 @@ var webchat_greeting_default = app6;
 
 // server/routes/telegram.ts
 import { homedir } from "os";
-import { resolve as resolve15, join as join15 } from "path";
-import { existsSync as existsSync10, readFileSync as readFileSync15 } from "fs";
+import { resolve as resolve15, join as join16 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync16 } from "fs";
 
 // app/lib/channel-pty-bridge/bridge.ts
 import { resolve as resolve14 } from "path";
@@ -9090,10 +9324,10 @@ var TAG23 = "[telegram-inbound]";
 var DISPATCH_TIMEOUT_MS = 12e4;
 function configDirName() {
   const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? resolve15(process.cwd(), "..");
-  const brandPath = join15(platformRoot2, "config", "brand.json");
-  if (existsSync10(brandPath)) {
+  const brandPath = join16(platformRoot2, "config", "brand.json");
+  if (existsSync11(brandPath)) {
     try {
-      return JSON.parse(readFileSync15(brandPath, "utf-8")).configDir ?? ".maxy";
+      return JSON.parse(readFileSync16(brandPath, "utf-8")).configDir ?? ".maxy";
     } catch {
     }
   }
@@ -9125,11 +9359,11 @@ app7.post("/", async (c) => {
     return c.json({ ok: false }, 400);
   }
   const sp = secretPath(botType);
-  if (!existsSync10(sp)) {
+  if (!existsSync11(sp)) {
     console.error(`${TAG23} op=reject reason=no-secret-file botType=${botType}`);
     return c.json({ ok: false }, 401);
   }
-  const expected = readFileSync15(sp, "utf-8").trim();
+  const expected = readFileSync16(sp, "utf-8").trim();
   const got = c.req.header("x-telegram-bot-api-secret-token") ?? "";
   if (got !== expected) {
     console.error(`${TAG23} op=reject reason=bad-secret botType=${botType}`);
@@ -9190,14 +9424,122 @@ app7.post("/", async (c) => {
 });
 var telegram_default = app7;
 
+// server/routes/quickbooks.ts
+import { join as join17 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync17, writeFileSync as writeFileSync8, mkdirSync as mkdirSync3, rmSync, renameSync as renameSync4 } from "fs";
+var TAG24 = "[quickbooks]";
+var INTUIT_TOKEN_URL = "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer";
+var STATE_RE = /^[A-Za-z0-9_-]+$/;
+function pendingPath(accountDir, state) {
+  return join17(accountDir, "secrets", "quickbooks-pending", `${state}.json`);
+}
+function storePath(accountDir) {
+  return join17(accountDir, "secrets", "quickbooks.json");
+}
+async function completeConsent(args) {
+  const { accountDir, code, realmId } = args;
+  const state = args.state;
+  if (!state || !STATE_RE.test(state) || !existsSync12(pendingPath(accountDir, state))) {
+    console.error(`${TAG24} op=callback state=${state ?? ""} stateValid=false realmId=${realmId ?? ""}`);
+    return { ok: false, status: 400, message: "Invalid or unknown authorization state.", stateValid: false };
+  }
+  const claimFile = `${pendingPath(accountDir, state)}.claimed`;
+  try {
+    renameSync4(pendingPath(accountDir, state), claimFile);
+  } catch {
+    console.error(`${TAG24} op=callback state=${state} stateValid=false realmId=${realmId ?? ""}`);
+    return { ok: false, status: 400, message: "Invalid or unknown authorization state.", stateValid: false };
+  }
+  try {
+    let pending;
+    try {
+      pending = JSON.parse(readFileSync17(claimFile, "utf-8"));
+    } catch {
+      console.error(`${TAG24} op=callback state=${state} stateValid=false realmId=${realmId ?? ""}`);
+      return { ok: false, status: 400, message: "Authorization state could not be read.", stateValid: false };
+    }
+    if (Date.now() > pending.expiresAt) {
+      console.error(`${TAG24} op=callback state=${state} stateValid=false realmId=${realmId ?? ""}`);
+      return { ok: false, status: 400, message: "Authorization request expired. Generate a new consent link.", stateValid: false };
+    }
+    console.error(`${TAG24} op=callback state=${state} stateValid=true realmId=${realmId ?? ""}`);
+    if (!code || !realmId) {
+      return { ok: false, status: 400, message: "Missing code or realmId in the callback.", stateValid: true };
+    }
+    if (!existsSync12(storePath(accountDir))) {
+      return { ok: false, status: 500, message: "No QuickBooks credentials are stored for this account.", stateValid: true };
+    }
+    const store2 = JSON.parse(readFileSync17(storePath(accountDir), "utf-8"));
+    const form = new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: pending.redirectUri
+    });
+    const res = await fetch(args.tokenUrl ?? INTUIT_TOKEN_URL, {
+      method: "POST",
+      headers: {
+        Authorization: "Basic " + Buffer.from(`${store2.clientId}:${store2.clientSecret}`).toString("base64"),
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json"
+      },
+      body: form.toString()
+    });
+    const text = await res.text();
+    if (!res.ok) {
+      console.error(`${TAG24} op=token-exchange realmId=${realmId} persisted=false`);
+      return { ok: false, status: 502, message: `Token exchange failed (${res.status}). Generate a new consent link to retry.`, stateValid: true };
+    }
+    const body = JSON.parse(text);
+    if (!body.refresh_token) {
+      console.error(`${TAG24} op=token-exchange realmId=${realmId} persisted=false`);
+      return { ok: false, status: 502, message: "Token exchange returned no refresh token.", stateValid: true };
+    }
+    const now = Date.now();
+    store2.connections = store2.connections ?? {};
+    store2.connections[realmId] = {
+      refreshToken: body.refresh_token,
+      refreshTokenExpiry: now + (body.x_refresh_token_expires_in ?? 864e4) * 1e3,
+      lastRefresh: now
+    };
+    mkdirSync3(join17(accountDir, "secrets"), { recursive: true });
+    writeFileSync8(storePath(accountDir), JSON.stringify(store2, null, 2), { mode: 384 });
+    const persisted = JSON.parse(readFileSync17(storePath(accountDir), "utf-8")).connections?.[realmId]?.refreshToken === body.refresh_token;
+    console.error(`${TAG24} op=token-exchange realmId=${realmId} persisted=${persisted}`);
+    return { ok: persisted, status: persisted ? 200 : 500, message: persisted ? `Connected company ${realmId}.` : "Failed to persist the connection.", stateValid: true };
+  } finally {
+    rmSync(claimFile, { force: true });
+  }
+}
+function page(title, detail) {
+  return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title></head><body style="font-family:system-ui;max-width:32rem;margin:4rem auto;text-align:center"><h1>${title}</h1><p>${detail}</p><p>You can close this tab.</p></body></html>`;
+}
+var app8 = new Hono();
+app8.get("/callback", async (c) => {
+  const account = resolveAccount();
+  if (!account) {
+    console.error(`${TAG24} op=callback stateValid=false realmId= reason=no-account`);
+    return c.html(page("QuickBooks", "This install has no account configured."), 500);
+  }
+  const result = await completeConsent({
+    accountDir: account.accountDir,
+    code: c.req.query("code"),
+    state: c.req.query("state"),
+    realmId: c.req.query("realmId"),
+    tokenUrl: process.env.QUICKBOOKS_TOKEN_URL
+  });
+  const title = result.ok ? "QuickBooks connected" : "QuickBooks authorization failed";
+  return c.html(page(title, result.message), result.status);
+});
+var quickbooks_default = app8;
+
 // server/routes/onboarding.ts
 import { spawn, spawnSync as spawnSync2, execFileSync as execFileSync2 } from "child_process";
-import { openSync as openSync3, closeSync as closeSync3, writeFileSync as writeFileSync8, writeSync, existsSync as existsSync12, readFileSync as readFileSync17, unlinkSync } from "fs";
+import { openSync as openSync3, closeSync as closeSync3, writeFileSync as writeFileSync10, writeSync, existsSync as existsSync14, readFileSync as readFileSync19, unlinkSync as unlinkSync2 } from "fs";
 import { createHash as createHash3, randomUUID as randomUUID8 } from "crypto";
 
 // ../lib/admins-write/src/index.ts
-import { existsSync as existsSync11, readFileSync as readFileSync16, writeFileSync as writeFileSync7, renameSync as renameSync3, mkdirSync as mkdirSync2, readdirSync as readdirSync9, statSync as statSync7 } from "fs";
-import { dirname as dirname4, join as join16 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync18, writeFileSync as writeFileSync9, renameSync as renameSync5, mkdirSync as mkdirSync4, readdirSync as readdirSync10, statSync as statSync7 } from "fs";
+import { dirname as dirname4, join as join18 } from "path";
 function logLine(input, result) {
   const userIdShort = input.userId.slice(0, 8);
   console.error(
@@ -9205,17 +9547,17 @@ function logLine(input, result) {
   );
 }
 function writeFileAtomic(filePath, contents, mode) {
-  mkdirSync2(dirname4(filePath), { recursive: true });
+  mkdirSync4(dirname4(filePath), { recursive: true });
   const tempPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;
-  writeFileSync7(tempPath, contents, mode !== void 0 ? { mode } : void 0);
-  renameSync3(tempPath, filePath);
+  writeFileSync9(tempPath, contents, mode !== void 0 ? { mode } : void 0);
+  renameSync5(tempPath, filePath);
 }
 function writeAdminEntry(input) {
   const result = { usersJsonResult: "noop", accountJsonResult: "noop" };
   try {
     let users = [];
-    if (existsSync11(input.usersFile)) {
-      const raw = readFileSync16(input.usersFile, "utf-8").trim();
+    if (existsSync13(input.usersFile)) {
+      const raw = readFileSync18(input.usersFile, "utf-8").trim();
       if (raw) {
         const parsed = JSON.parse(raw);
         if (!Array.isArray(parsed)) {
@@ -9239,11 +9581,11 @@ function writeAdminEntry(input) {
     return result;
   }
   try {
-    const accountJsonPath = join16(input.accountDir, "account.json");
-    if (!existsSync11(accountJsonPath)) {
+    const accountJsonPath = join18(input.accountDir, "account.json");
+    if (!existsSync13(accountJsonPath)) {
       throw new Error(`account.json not found at ${accountJsonPath}`);
     }
-    const config = JSON.parse(readFileSync16(accountJsonPath, "utf-8"));
+    const config = JSON.parse(readFileSync18(accountJsonPath, "utf-8"));
     const admins = config.admins ?? [];
     if (admins.some((a) => a.userId === input.userId)) {
       result.accountJsonResult = "noop";
@@ -9267,9 +9609,9 @@ function checkAdminAuthInvariant(input) {
     usersWithoutAccount: []
   };
   const usersUserIds = /* @__PURE__ */ new Set();
-  if (existsSync11(input.usersFile)) {
+  if (existsSync13(input.usersFile)) {
     try {
-      const raw = readFileSync16(input.usersFile, "utf-8").trim();
+      const raw = readFileSync18(input.usersFile, "utf-8").trim();
       if (raw) {
         const users = JSON.parse(raw);
         for (const u of users) {
@@ -9282,10 +9624,10 @@ function checkAdminAuthInvariant(input) {
     }
   }
   const accountUserIds = /* @__PURE__ */ new Set();
-  if (existsSync11(input.accountsDir)) {
+  if (existsSync13(input.accountsDir)) {
     let entries;
     try {
-      entries = readdirSync9(input.accountsDir);
+      entries = readdirSync10(input.accountsDir);
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       console.error(`[${input.tag}] accounts-dir unreadable accountsDir=${input.accountsDir} error=${msg}`);
@@ -9294,17 +9636,17 @@ function checkAdminAuthInvariant(input) {
     }
     for (const entry of entries) {
       if (entry.startsWith(".")) continue;
-      const accountDir = join16(input.accountsDir, entry);
+      const accountDir = join18(input.accountsDir, entry);
       try {
         if (!statSync7(accountDir).isDirectory()) continue;
       } catch {
         continue;
       }
-      const accountJsonPath = join16(accountDir, "account.json");
-      if (!existsSync11(accountJsonPath)) continue;
+      const accountJsonPath = join18(accountDir, "account.json");
+      if (!existsSync13(accountJsonPath)) continue;
       let admins = [];
       try {
-        const config = JSON.parse(readFileSync16(accountJsonPath, "utf-8"));
+        const config = JSON.parse(readFileSync18(accountJsonPath, "utf-8"));
         admins = config.admins ?? [];
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
@@ -9344,8 +9686,8 @@ function hashPin2(pin) {
   return createHash3("sha256").update(pin).digest("hex");
 }
 function readUsersFile2() {
-  if (!existsSync12(USERS_FILE)) return null;
-  const raw = readFileSync17(USERS_FILE, "utf-8").trim();
+  if (!existsSync14(USERS_FILE)) return null;
+  const raw = readFileSync19(USERS_FILE, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
 }
@@ -9375,11 +9717,11 @@ async function waitForAuthPage(timeoutMs = 2e4) {
   }
   return false;
 }
-var app8 = new Hono();
-app8.get("/claude-auth", async (c) => {
+var app9 = new Hono();
+app9.get("/claude-auth", async (c) => {
   return c.json({ authenticated: await checkAuthStatus() });
 });
-app8.post("/claude-auth", async (c) => {
+app9.post("/claude-auth", async (c) => {
   let body = {};
   try {
     body = await c.req.json();
@@ -9398,7 +9740,7 @@ app8.post("/claude-auth", async (c) => {
     } catch (err) {
       logoutError = err instanceof Error ? err.message : String(err);
     }
-    const credentialsPresent = existsSync12(CLAUDE_CREDENTIALS_FILE);
+    const credentialsPresent = existsSync14(CLAUDE_CREDENTIALS_FILE);
     const ranMs = Date.now() - start;
     console.log(`[onboarding] op=claude-logout credentialsPresent=${credentialsPresent} ranMs=${ranMs} logoutError=${logoutError ? JSON.stringify(logoutError.slice(0, 120)) : "none"}`);
     return c.json({ logged_out: !credentialsPresent });
@@ -9416,7 +9758,7 @@ app8.post("/claude-auth", async (c) => {
     return c.json({ launched: cdpReady });
   }
   ensureLogDir();
-  writeFileSync8(logPath("claude-auth"), "");
+  writeFileSync10(logPath("claude-auth"), "");
   const claudeAuthLogFd = openSync3(logPath("claude-auth"), "a");
   const onClaudeOutput = (chunk) => writeSync(claudeAuthLogFd, chunk);
   if (process.platform === "darwin") {
@@ -9449,7 +9791,7 @@ app8.post("/claude-auth", async (c) => {
   await waitForAuthPage(2e4);
   return c.json({ started: true, transport });
 });
-app8.post("/set-pin", async (c) => {
+app9.post("/set-pin", async (c) => {
   let existingUsers = null;
   try {
     existingUsers = readUsersFile2();
@@ -9505,9 +9847,9 @@ app8.post("/set-pin", async (c) => {
   console.log(`[set-pin] wrote users.json + account.json admins: userId=${userId.slice(0, 8)}\u2026 role=owner`);
   if (process.platform === "linux") {
     let installOwner = null;
-    if (existsSync12(INSTALL_OWNER_FILE)) {
+    if (existsSync14(INSTALL_OWNER_FILE)) {
       try {
-        const raw = readFileSync17(INSTALL_OWNER_FILE, "utf-8").trim();
+        const raw = readFileSync19(INSTALL_OWNER_FILE, "utf-8").trim();
         if (raw.length > 0) installOwner = raw;
       } catch (err) {
         console.error(`[set-pin] install-owner-read-failed path=${INSTALL_OWNER_FILE} error=${err instanceof Error ? err.message : String(err)}`);
@@ -9551,7 +9893,7 @@ ${body.pin}
   }
   return c.json({ ok: true });
 });
-app8.delete("/set-pin", async (c) => {
+app9.delete("/set-pin", async (c) => {
   let users = null;
   try {
     users = readUsersFile2();
@@ -9577,20 +9919,20 @@ app8.delete("/set-pin", async (c) => {
   }
   const remaining = users.filter((u) => u.userId !== matchedUser.userId);
   if (remaining.length === 0) {
-    unlinkSync(USERS_FILE);
+    unlinkSync2(USERS_FILE);
     console.log(`[set-pin] cleared users.json (last entry removed): userId=${matchedUser.userId.slice(0, 8)}\u2026`);
   } else {
-    writeFileSync8(USERS_FILE, JSON.stringify(remaining), { mode: 384 });
+    writeFileSync10(USERS_FILE, JSON.stringify(remaining), { mode: 384 });
     console.log(`[set-pin] removed entry from users.json: userId=${matchedUser.userId.slice(0, 8)}\u2026 remaining=${remaining.length}`);
   }
   return c.json({ ok: true });
 });
-var onboarding_default = app8;
+var onboarding_default = app9;
 
 // server/routes/client-error.ts
-import { appendFileSync, existsSync as existsSync13, renameSync as renameSync4, statSync as statSync8 } from "fs";
-import { join as join17 } from "path";
-var CLIENT_ERRORS_LOG = join17(LOG_DIR, "client-errors.log");
+import { appendFileSync, existsSync as existsSync15, renameSync as renameSync6, statSync as statSync8 } from "fs";
+import { join as join19 } from "path";
+var CLIENT_ERRORS_LOG = join19(LOG_DIR, "client-errors.log");
 var MAX_LOG_SIZE = 10 * 1024 * 1024;
 var MAX_BODY_SIZE = 8 * 1024;
 var MAX_STACK_LEN = 2e3;
@@ -9633,16 +9975,16 @@ function stackHead(stack) {
 }
 function rotateIfNeeded() {
   try {
-    if (!existsSync13(CLIENT_ERRORS_LOG)) return;
+    if (!existsSync15(CLIENT_ERRORS_LOG)) return;
     const stats = statSync8(CLIENT_ERRORS_LOG);
     if (stats.size < MAX_LOG_SIZE) return;
-    renameSync4(CLIENT_ERRORS_LOG, CLIENT_ERRORS_LOG + ".1");
+    renameSync6(CLIENT_ERRORS_LOG, CLIENT_ERRORS_LOG + ".1");
   } catch (err) {
     console.error(`[client-error] log rotation failed: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
-var app9 = new Hono();
-app9.post("/", async (c) => {
+var app10 = new Hono();
+app10.post("/", async (c) => {
   const client = resolveClientIp(
     c.env?.incoming?.socket?.remoteAddress,
     c.req.header("x-forwarded-for")
@@ -9744,7 +10086,7 @@ app9.post("/", async (c) => {
   }
   return c.json({ ok: true });
 });
-var client_error_default = app9;
+var client_error_default = app10;
 
 // server/routes/admin/session.ts
 import { randomUUID as randomUUID9 } from "crypto";
@@ -9802,8 +10144,8 @@ async function createAdminSession(accountId, thinkingView, userId, userName, rol
     sessionId: initialSessionId
   };
 }
-var app10 = new Hono();
-app10.get("/", async (c) => {
+var app11 = new Hono();
+app11.get("/", async (c) => {
   const signedSessionToken = c.req.query("session_key");
   if (!signedSessionToken) {
     return c.json({ error: "Invalid or expired admin session" }, 401);
@@ -9849,7 +10191,7 @@ app10.get("/", async (c) => {
     sessionId: getSessionIdForSession(cacheKey) ?? null
   });
 });
-app10.post("/", async (c) => {
+app11.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -9912,21 +10254,21 @@ app10.post("/", async (c) => {
   const payload = await createAdminSession(selected.accountId, selected.config.thinkingView, userId, userName, selected.role, avatar);
   return c.json(payload);
 });
-var session_default = app10;
+var session_default = app11;
 
 // server/routes/admin/logs.ts
-import { existsSync as existsSync15, readdirSync as readdirSync10, readFileSync as readFileSync18, statSync as statSync9 } from "fs";
+import { existsSync as existsSync17, readdirSync as readdirSync11, readFileSync as readFileSync20, statSync as statSync9 } from "fs";
 import { resolve as resolve16, basename as basename5 } from "path";
 
 // app/lib/logs-read-resolve.ts
-import { existsSync as existsSync14 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync16 } from "fs";
+import { join as join20 } from "path";
 function resolveSessionLogPaths(filename, logDirs) {
   const tried = [filename];
   const hits = [];
   for (const dir of logDirs) {
-    const fullPath = join18(dir, filename);
-    if (existsSync14(fullPath)) {
+    const fullPath = join20(dir, filename);
+    if (existsSync16(fullPath)) {
       hits.push({ path: fullPath, dir });
     }
   }
@@ -9935,8 +10277,8 @@ function resolveSessionLogPaths(filename, logDirs) {
 
 // server/routes/admin/logs.ts
 var TAIL_BYTES = 8192;
-var app11 = new Hono();
-app11.get("/", async (c) => {
+var app12 = new Hono();
+app12.get("/", async (c) => {
   const fileParam = c.req.query("file");
   const typeParam = c.req.query("type");
   const sessionIdParam = c.req.query("sessionId");
@@ -9954,7 +10296,7 @@ app11.get("/", async (c) => {
       const filePath = resolve16(dir, safe);
       searched.push(filePath);
       try {
-        const buffer = readFileSync18(filePath);
+        const buffer = readFileSync20(filePath);
         const onDiskBytes = statSync9(filePath).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
@@ -10019,7 +10361,7 @@ app11.get("/", async (c) => {
       console.info(`[admin/logs] resolved cacheKey=${cacheKeySlice} sessionId=${sessionIdSlice} via=${primaryId === cacheKey ? "cacheKey" : primaryId === sessionKeyFromConv ? "reverse-lookup" : "sessionId-fallback"}`);
       try {
         const filename = basename5(hit.path);
-        const buffer = readFileSync18(hit.path);
+        const buffer = readFileSync20(hit.path);
         const onDiskBytes = statSync9(hit.path).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
@@ -10054,10 +10396,10 @@ app11.get("/", async (c) => {
   const seen = /* @__PURE__ */ new Set();
   const logs = {};
   for (const dir of logDirs) {
-    if (!existsSync15(dir)) continue;
+    if (!existsSync17(dir)) continue;
     let files;
     try {
-      files = readdirSync10(dir).filter((f) => f.endsWith(".log"));
+      files = readdirSync11(dir).filter((f) => f.endsWith(".log"));
     } catch (err) {
       const reason = err instanceof Error ? err.message : String(err);
       console.warn(`[admin/logs] readdir-fail dir=${dir} reason=${reason}`);
@@ -10066,7 +10408,7 @@ app11.get("/", async (c) => {
     files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync9(resolve16(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
-        const content = readFileSync18(resolve16(dir, name));
+        const content = readFileSync20(resolve16(dir, name));
         const tail = content.length > TAIL_BYTES ? content.subarray(content.length - TAIL_BYTES).toString("utf-8") : content.toString("utf-8");
         logs[name] = tail.trim() || "(empty)";
       } catch (err) {
@@ -10078,12 +10420,12 @@ app11.get("/", async (c) => {
   }
   return c.json({ logs });
 });
-var logs_default = app11;
+var logs_default = app12;
 
 // server/routes/admin/claude-info.ts
 import { execFileSync as execFileSync3 } from "child_process";
-var app12 = new Hono();
-app12.get("/", (c) => {
+var app13 = new Hono();
+app13.get("/", (c) => {
   let version = "unknown";
   try {
     const raw = execFileSync3("claude", ["--version"], { encoding: "utf-8", timeout: 5e3 });
@@ -10101,14 +10443,14 @@ app12.get("/", (c) => {
   const thinkingView = resolvedAccount?.config.thinkingView ?? "default";
   return c.json({ version, account, model, thinkingView });
 });
-var claude_info_default = app12;
+var claude_info_default = app13;
 
 // server/routes/admin/attachment.ts
 import { readFile as readFile2, readdir } from "fs/promises";
-import { existsSync as existsSync16 } from "fs";
+import { existsSync as existsSync18 } from "fs";
 import { resolve as resolve17 } from "path";
-var app13 = new Hono();
-app13.get("/:attachmentId", requireAdminSession, async (c) => {
+var app14 = new Hono();
+app14.get("/:attachmentId", requireAdminSession, async (c) => {
   const attachmentId = c.req.param("attachmentId");
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
@@ -10119,11 +10461,11 @@ app13.get("/:attachmentId", requireAdminSession, async (c) => {
     return new Response("Not found", { status: 404 });
   }
   const dir = resolve17(DATA_ROOT, "accounts", accountId, "uploads", attachmentId);
-  if (!existsSync16(dir)) {
+  if (!existsSync18(dir)) {
     return new Response("Not found", { status: 404 });
   }
   const metaPath = resolve17(dir, `${attachmentId}.meta.json`);
-  if (!existsSync16(metaPath)) {
+  if (!existsSync18(metaPath)) {
     return new Response("Not found", { status: 404 });
   }
   let meta;
@@ -10147,27 +10489,27 @@ app13.get("/:attachmentId", requireAdminSession, async (c) => {
     }
   });
 });
-var attachment_default = app13;
+var attachment_default = app14;
 
 // server/routes/admin/agents.ts
 import { resolve as resolve18 } from "path";
-import { readdirSync as readdirSync11, readFileSync as readFileSync19, existsSync as existsSync17, rmSync } from "fs";
-var app14 = new Hono();
-app14.get("/", (c) => {
+import { readdirSync as readdirSync12, readFileSync as readFileSync21, existsSync as existsSync19, rmSync as rmSync2 } from "fs";
+var app15 = new Hono();
+app15.get("/", (c) => {
   const account = resolveAccount();
   if (!account) return c.json({ agents: [] });
   const agentsDir = resolve18(account.accountDir, "agents");
-  if (!existsSync17(agentsDir)) return c.json({ agents: [] });
+  if (!existsSync19(agentsDir)) return c.json({ agents: [] });
   const agents = [];
   try {
-    const entries = readdirSync11(agentsDir, { withFileTypes: true });
+    const entries = readdirSync12(agentsDir, { withFileTypes: true });
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
       if (!entry.isDirectory()) continue;
       if (entry.name === "admin") continue;
       const configPath2 = resolve18(agentsDir, entry.name, "config.json");
-      if (!existsSync17(configPath2)) continue;
+      if (!existsSync19(configPath2)) continue;
       try {
-        const config = JSON.parse(readFileSync19(configPath2, "utf-8"));
+        const config = JSON.parse(readFileSync21(configPath2, "utf-8"));
         agents.push({
           slug: entry.name,
           displayName: config.displayName ?? entry.name,
@@ -10183,7 +10525,7 @@ app14.get("/", (c) => {
   }
   return c.json({ agents });
 });
-app14.delete("/:slug", async (c) => {
+app15.delete("/:slug", async (c) => {
   const slug = c.req.param("slug");
   const account = resolveAccount();
   if (!account) return c.json({ error: "No account resolved" }, 400);
@@ -10194,7 +10536,7 @@ app14.delete("/:slug", async (c) => {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
   const agentDir = resolve18(account.accountDir, "agents", slug);
-  if (!existsSync17(agentDir)) {
+  if (!existsSync19(agentDir)) {
     return c.json({ error: "Agent not found" }, 404);
   }
   try {
@@ -10205,7 +10547,7 @@ app14.delete("/:slug", async (c) => {
     return c.json({ error: `Graph cleanup failed: ${msg}` }, 500);
   }
   try {
-    rmSync(agentDir, { recursive: true, force: true });
+    rmSync2(agentDir, { recursive: true, force: true });
     console.log(`[admin/agents] deleted agent "${slug}"`);
     return c.json({ ok: true });
   } catch (err) {
@@ -10213,7 +10555,7 @@ app14.delete("/:slug", async (c) => {
     return c.json({ error: "Failed to delete agent" }, 500);
   }
 });
-app14.post("/:slug/project", async (c) => {
+app15.post("/:slug/project", async (c) => {
   const slug = c.req.param("slug");
   const account = resolveAccount();
   if (!account) return c.json({ error: "No account resolved" }, 400);
@@ -10224,7 +10566,7 @@ app14.post("/:slug/project", async (c) => {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
   const agentDir = resolve18(account.accountDir, "agents", slug);
-  if (!existsSync17(agentDir)) {
+  if (!existsSync19(agentDir)) {
     return c.json({ error: "Agent not found on disk" }, 404);
   }
   try {
@@ -10235,12 +10577,12 @@ app14.post("/:slug/project", async (c) => {
     return c.json({ error: `Projection failed: ${msg}` }, 500);
   }
 });
-var agents_default = app14;
+var agents_default = app15;
 
 // server/routes/admin/sessions.ts
 import crypto2 from "crypto";
 import { resolve as resolvePath } from "path";
-import { existsSync as existsSync18, mkdirSync as mkdirSync3, createWriteStream } from "fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync5, createWriteStream } from "fs";
 
 // ../lib/admin-conversation-purge/src/index.ts
 async function purgeAdminConversationJsonls(args) {
@@ -10387,7 +10729,7 @@ var pickComponentBytes = (..._args) => null;
 function openResumeStreamLog(accountId, sessionId) {
   const dir = resolvePath(ACCOUNTS_DIR, accountId, "resume-logs");
   try {
-    mkdirSync3(dir, { recursive: true });
+    mkdirSync5(dir, { recursive: true });
   } catch {
   }
   return createWriteStream(resolvePath(dir, `${sessionId}.log`), { flags: "a" });
@@ -10400,7 +10742,7 @@ function validateAndShapeAttachments(raws, conversationAccountId, sessionId, mes
     let reason = null;
     if (!a.attachmentId || !a.filename || !a.mimeType || !a.storagePath) reason = "schema-fail";
     else if (a.accountId !== conversationAccountId) reason = "account-mismatch";
-    else if (!existsSync18(a.storagePath)) reason = "missing-file";
+    else if (!existsSync20(a.storagePath)) reason = "missing-file";
     if (reason) {
       invalid++;
       try {
@@ -10507,8 +10849,8 @@ function formatAge(updatedAtStr) {
     return "unknown";
   }
 }
-var app15 = new Hono();
-app15.get("/", requireAdminSession, async (c) => {
+var app16 = new Hono();
+app16.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) return c.json({ error: "Account not found for session" }, 401);
@@ -10538,7 +10880,7 @@ app15.get("/", requireAdminSession, async (c) => {
     return c.json({ error: "Failed to fetch sessions" }, 500);
   }
 });
-app15.post("/new", requireAdminSession, async (c) => {
+app16.post("/new", requireAdminSession, async (c) => {
   const oldCacheKey = c.var.cacheKey;
   console.log(`[admin-chat] new-conversation outcome=ingress cacheKey=${oldCacheKey.slice(0, 8)}`);
   const accountId = getAccountIdForSession(oldCacheKey);
@@ -10555,7 +10897,7 @@ app15.post("/new", requireAdminSession, async (c) => {
   console.log(`[admin-chat] new-conversation outcome=ok oldKey=${oldCacheKey.slice(0, 8)} newKey=${newCacheKey.slice(0, 8)}`);
   return c.json({ session_key: newSignedSessionToken, sessionId: null });
 });
-app15.post("/switch", requireAdminSession, async (c) => {
+app16.post("/switch", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   const userId = getUserIdForSession(cacheKey);
@@ -10583,7 +10925,7 @@ app15.post("/switch", requireAdminSession, async (c) => {
   console.log(`[session-switch] from=${cacheKey.slice(0, 8)} to=${targetCacheKey.slice(0, 8)} targetConvId=${targetSessionId?.slice(0, 8) ?? "none"} accountId=${accountId.slice(0, 8)}`);
   return c.json({ session_key: targetSignedSessionToken, sessionId: targetSessionId });
 });
-app15.delete("/:id", requireAdminSession, async (c) => {
+app16.delete("/:id", requireAdminSession, async (c) => {
   const sessionId = c.req.param("id");
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
@@ -10628,7 +10970,7 @@ app15.delete("/:id", requireAdminSession, async (c) => {
     500
   );
 });
-app15.post("/:id/resume", async (c) => {
+app16.post("/:id/resume", async (c) => {
   const sessionId = c.req.param("id");
   const t0 = Date.now();
   const signedSessionToken = c.req.query("session_key") ?? "";
@@ -10897,7 +11239,7 @@ app15.post("/:id/resume", async (c) => {
     }
   });
 });
-app15.put("/:id/label", requireAdminSession, async (c) => {
+app16.put("/:id/label", requireAdminSession, async (c) => {
   const sessionId = c.req.param("id");
   const cacheKey = c.var.cacheKey;
   let body;
@@ -10923,11 +11265,11 @@ app15.put("/:id/label", requireAdminSession, async (c) => {
     return c.json({ error: "Failed to rename session" }, 500);
   }
 });
-var sessions_default = app15;
+var sessions_default = app16;
 
 // app/lib/claude-agent/spawn-context.ts
-import { existsSync as existsSync19, readFileSync as readFileSync20, readdirSync as readdirSync12, statSync as statSync10 } from "fs";
-import { dirname as dirname5, resolve as resolve19, join as join19 } from "path";
+import { existsSync as existsSync21, readFileSync as readFileSync22, readdirSync as readdirSync13, statSync as statSync10 } from "fs";
+import { dirname as dirname5, resolve as resolve19, join as join21 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
   try {
@@ -10968,14 +11310,14 @@ function frontmatterField(manifest, field2) {
 function extractPluginToolDescriptions(pluginDir) {
   const out = /* @__PURE__ */ new Map();
   const candidates = [
-    join19(pluginDir, "mcp/dist/index.js"),
-    join19(pluginDir, "mcp/src/index.ts")
+    join21(pluginDir, "mcp/dist/index.js"),
+    join21(pluginDir, "mcp/src/index.ts")
   ];
   let raw = null;
   for (const path2 of candidates) {
-    if (!existsSync19(path2)) continue;
+    if (!existsSync21(path2)) continue;
     try {
-      raw = readFileSync20(path2, "utf-8");
+      raw = readFileSync22(path2, "utf-8");
       break;
     } catch {
     }
@@ -11025,9 +11367,9 @@ function parseSkillPathsFromFrontmatter(fm) {
 function listPluginDirs() {
   const out = /* @__PURE__ */ new Map();
   const platformPlugins = resolve19(PLATFORM_ROOT, "plugins");
-  if (existsSync19(platformPlugins)) {
-    for (const name of readdirSync12(platformPlugins)) {
-      const dir = join19(platformPlugins, name);
+  if (existsSync21(platformPlugins)) {
+    for (const name of readdirSync13(platformPlugins)) {
+      const dir = join21(platformPlugins, name);
       try {
         if (statSync10(dir).isDirectory()) out.set(name, dir);
       } catch {
@@ -11035,13 +11377,13 @@ function listPluginDirs() {
     }
   }
   const premiumRoot = resolve19(dirname5(PLATFORM_ROOT), "premium-plugins");
-  if (existsSync19(premiumRoot)) {
-    for (const bundle of readdirSync12(premiumRoot)) {
-      const bundlePlugins = join19(premiumRoot, bundle, "plugins");
-      if (!existsSync19(bundlePlugins)) continue;
+  if (existsSync21(premiumRoot)) {
+    for (const bundle of readdirSync13(premiumRoot)) {
+      const bundlePlugins = join21(premiumRoot, bundle, "plugins");
+      if (!existsSync21(bundlePlugins)) continue;
       try {
-        for (const name of readdirSync12(bundlePlugins)) {
-          const dir = join19(bundlePlugins, name);
+        for (const name of readdirSync13(bundlePlugins)) {
+          const dir = join21(bundlePlugins, name);
           try {
             if (statSync10(dir).isDirectory()) out.set(name, dir);
           } catch {
@@ -11055,9 +11397,9 @@ function listPluginDirs() {
 }
 function readEnabledPlugins(accountId) {
   const accountFile = resolve19(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync19(accountFile)) return /* @__PURE__ */ new Set();
+  if (!existsSync21(accountFile)) return /* @__PURE__ */ new Set();
   try {
-    const parsed = JSON.parse(readFileSync20(accountFile, "utf-8"));
+    const parsed = JSON.parse(readFileSync22(accountFile, "utf-8"));
     return new Set(
       Array.isArray(parsed.enabledPlugins) ? parsed.enabledPlugins.filter((p) => typeof p === "string") : []
     );
@@ -11066,10 +11408,10 @@ function readEnabledPlugins(accountId) {
   }
 }
 function readFrontmatter(path2) {
-  if (!existsSync19(path2)) return null;
+  if (!existsSync21(path2)) return null;
   let raw;
   try {
-    raw = readFileSync20(path2, "utf-8");
+    raw = readFileSync22(path2, "utf-8");
   } catch {
     return null;
   }
@@ -11084,7 +11426,7 @@ function computeActivePlugins(accountId) {
   for (const name of Array.from(enabled).sort()) {
     const dir = pluginDirs.get(name);
     if (!dir) continue;
-    const fm = readFrontmatter(join19(dir, "PLUGIN.md"));
+    const fm = readFrontmatter(join21(dir, "PLUGIN.md"));
     if (!fm) continue;
     const description = frontmatterField(`---
 ${fm}
@@ -11101,7 +11443,7 @@ ${fm}
       `plugin-manifest-tool-coverage plugin=${name} tools=${tools.length} with-desc=${withDesc}`
     );
     if (toolNames.length > 0 && descMap.size === 0) {
-      const hasSource = existsSync19(join19(dir, "mcp/dist/index.js")) || existsSync19(join19(dir, "mcp/src/index.ts"));
+      const hasSource = existsSync21(join21(dir, "mcp/dist/index.js")) || existsSync21(join21(dir, "mcp/src/index.ts"));
       if (hasSource) {
         console.warn(
           `[spawn-context] WARN plugin=${name} mcp source present but tool-description regex matched zero entries \u2014 SDK upgrade may have changed the registration shape`
@@ -11111,7 +11453,7 @@ ${fm}
     const skillPaths = parseSkillPathsFromFrontmatter(fm);
     const skills = [];
     for (const relPath of skillPaths) {
-      const skillPath = join19(dir, relPath);
+      const skillPath = join21(dir, relPath);
       const skillFm = readFrontmatter(skillPath);
       if (!skillFm) continue;
       const skillName = frontmatterField(`---
@@ -11128,10 +11470,10 @@ ${skillFm}
 }
 function computeSpecialistDomains(accountId) {
   const specialistsDir = resolve19(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
-  if (!existsSync19(specialistsDir)) return [];
+  if (!existsSync21(specialistsDir)) return [];
   let entries;
   try {
-    entries = readdirSync12(specialistsDir);
+    entries = readdirSync13(specialistsDir);
   } catch {
     return [];
   }
@@ -11155,7 +11497,7 @@ function computeSpecialistDomains(accountId) {
   const out = [];
   for (const file of entries.sort()) {
     if (!file.endsWith(".md")) continue;
-    const fm = readFrontmatter(join19(specialistsDir, file));
+    const fm = readFrontmatter(join21(specialistsDir, file));
     if (!fm) continue;
     const wrapped = `---
 ${fm}
@@ -11174,10 +11516,10 @@ ${fm}
 }
 function computeDormantPlugins(accountId) {
   const accountFile = resolve19(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync19(accountFile)) return [];
+  if (!existsSync21(accountFile)) return [];
   let enabled;
   try {
-    const raw = readFileSync20(accountFile, "utf-8");
+    const raw = readFileSync22(accountFile, "utf-8");
     const parsed = JSON.parse(raw);
     enabled = new Set(
       Array.isArray(parsed.enabledPlugins) ? parsed.enabledPlugins.filter((p) => typeof p === "string") : []
@@ -11189,10 +11531,10 @@ function computeDormantPlugins(accountId) {
     return [];
   }
   const pluginsDir = resolve19(PLATFORM_ROOT, "plugins");
-  if (!existsSync19(pluginsDir)) return [];
+  if (!existsSync21(pluginsDir)) return [];
   let entries;
   try {
-    entries = readdirSync12(pluginsDir);
+    entries = readdirSync13(pluginsDir);
   } catch {
     return [];
   }
@@ -11200,10 +11542,10 @@ function computeDormantPlugins(accountId) {
   for (const name of entries) {
     if (enabled.has(name)) continue;
     const manifestPath = resolve19(pluginsDir, name, "PLUGIN.md");
-    if (!existsSync19(manifestPath)) continue;
+    if (!existsSync21(manifestPath)) continue;
     let manifest;
     try {
-      manifest = readFileSync20(manifestPath, "utf-8");
+      manifest = readFileSync22(manifestPath, "utf-8");
     } catch {
       continue;
     }
@@ -11217,13 +11559,13 @@ function computeDormantPlugins(accountId) {
 }
 
 // server/routes/admin/claude-sessions.ts
-import { existsSync as existsSync20, readFileSync as readFileSync21 } from "fs";
+import { existsSync as existsSync22, readFileSync as readFileSync23 } from "fs";
 import { resolve as resolve20 } from "path";
 function readTunnelState(brandConfigDir) {
   const statePath = `${process.env.HOME ?? ""}/${brandConfigDir}/cloudflared/tunnel.state`;
-  if (!existsSync20(statePath)) return null;
+  if (!existsSync22(statePath)) return null;
   try {
-    const parsed = JSON.parse(readFileSync21(statePath, "utf-8"));
+    const parsed = JSON.parse(readFileSync23(statePath, "utf-8"));
     const tunnelId = typeof parsed.tunnelId === "string" ? parsed.tunnelId : null;
     const tunnelName = typeof parsed.tunnelName === "string" ? parsed.tunnelName : null;
     const domain = typeof parsed.domain === "string" ? parsed.domain : null;
@@ -11237,7 +11579,7 @@ function resolveTunnelUrl() {
   const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve20(process.cwd(), "..");
   let brand;
   try {
-    brand = JSON.parse(readFileSync21(resolve20(platformRoot2, "config", "brand.json"), "utf-8"));
+    brand = JSON.parse(readFileSync23(resolve20(platformRoot2, "config", "brand.json"), "utf-8"));
   } catch {
     return null;
   }
@@ -11248,7 +11590,7 @@ function resolveTunnelUrl() {
   if (!state) return null;
   return `https://${hostname2}.${state.domain}`;
 }
-var TAG24 = "[claude-session-manager:wrapper]";
+var TAG25 = "[claude-session-manager:wrapper]";
 async function refuseIfClaudeAuthDead(c, route, sessionId) {
   const auth = await ensureAuth();
   if (auth.status !== "dead" && auth.status !== "missing") return null;
@@ -11260,18 +11602,18 @@ async function refuseIfClaudeAuthDead(c, route, sessionId) {
     503
   );
 }
-var app16 = new Hono();
+var app17 = new Hono();
 async function performSpawnWithInitialMessage(args) {
   const ownerStart = Date.now();
   const aboutOwner = await resolveOwnerProfileBlock(args.senderId, args.userId);
   const ownerMs = Date.now() - ownerStart;
   const aboutOwnerStatus = aboutOwner == null ? "absent" : "ok" in aboutOwner && aboutOwner.ok === false ? `unresolved:${aboutOwner.reason}` : "ok";
-  console.log(`${TAG24} about-owner-resolved status=${aboutOwnerStatus} ms=${ownerMs}`);
+  console.log(`${TAG25} about-owner-resolved status=${aboutOwnerStatus} ms=${ownerMs}`);
   const dormantPlugins = computeDormantPlugins(args.senderId);
   const activePlugins = computeActivePlugins(args.senderId);
   const specialistDomains = computeSpecialistDomains(args.senderId);
   const tunnelUrl = resolveTunnelUrl();
-  console.log(`${TAG24} tunnel-url-resolved value=${tunnelUrl ?? "null"}`);
+  console.log(`${TAG25} tunnel-url-resolved value=${tunnelUrl ?? "null"}`);
   const upstreamPayload = JSON.stringify({
     senderId: args.senderId,
     // Task 205 — pass userId through to the manager so it lands as
@@ -11298,24 +11640,24 @@ async function performSpawnWithInitialMessage(args) {
     // unshapely values.
     conversationNodeId: args.conversationNodeId
   });
-  console.log(`${TAG24} forward-spawn-start managerBase=${managerBase("claude-session-manager:wrapper")} bytes=${upstreamPayload.length} hidden=${args.hidden} specialist=${args.specialist ?? "none"}`);
+  console.log(`${TAG25} forward-spawn-start managerBase=${managerBase("claude-session-manager:wrapper")} bytes=${upstreamPayload.length} hidden=${args.hidden} specialist=${args.specialist ?? "none"}`);
   const forwardStart = Date.now();
   const upstream = await fetch(`${managerBase("claude-session-manager:wrapper")}/public-spawn`, {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: upstreamPayload
   }).catch((err) => {
-    console.error(`${TAG24} fetch-failed op=spawn message=${err instanceof Error ? err.message : String(err)} ms=${Date.now() - forwardStart}`);
+    console.error(`${TAG25} fetch-failed op=spawn message=${err instanceof Error ? err.message : String(err)} ms=${Date.now() - forwardStart}`);
     return null;
   });
   if (!upstream) return {
     response: new Response(JSON.stringify({ error: "manager-unreachable" }), { status: 503, headers: { "content-type": "application/json" } }),
     claudeSessionId: null
   };
-  console.log(`${TAG24} forward-spawn-done status=${upstream.status} ms=${Date.now() - forwardStart}`);
+  console.log(`${TAG25} forward-spawn-done status=${upstream.status} ms=${Date.now() - forwardStart}`);
   if (args.initialMessage) {
     const inputBytes = Buffer.byteLength(args.initialMessage, "utf8");
-    console.log(`${TAG24} initial-message-inlined bytes=${inputBytes}`);
+    console.log(`${TAG25} initial-message-inlined bytes=${inputBytes}`);
   }
   const bodyText = await upstream.text().catch(() => "");
   let claudeSessionId = null;
@@ -11337,8 +11679,8 @@ function mintTranscriptEdge(sessionId, claudeSessionId, accountId) {
   if (!sessionId || !claudeSessionId) return;
   void linkConversationTranscript(sessionId, claudeSessionId, accountId);
 }
-app16.use("*", requireAdminSession);
-app16.post("/", async (c) => {
+app17.use("*", requireAdminSession);
+app17.post("/", async (c) => {
   const routeStart = Date.now();
   const cacheKey = c.get("cacheKey") ?? "";
   let body = {};
@@ -11350,7 +11692,7 @@ app16.post("/", async (c) => {
   if (refusal) return refusal;
   const senderId = getAccountIdForSession(cacheKey) ?? "";
   if (!senderId) {
-    console.error(`${TAG24} reject reason=no-account-id cacheKey-prefix=${cacheKey.slice(0, 8)}`);
+    console.error(`${TAG25} reject reason=no-account-id cacheKey-prefix=${cacheKey.slice(0, 8)}`);
     return c.json({ error: "admin-account-not-resolved" }, 500);
   }
   const userId = getUserIdForSession(cacheKey) ?? void 0;
@@ -11359,7 +11701,7 @@ app16.post("/", async (c) => {
   const permissionMode = typeof body.permissionMode === "string" ? body.permissionMode : void 0;
   const specialist = typeof body.specialist === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(body.specialist) ? body.specialist : void 0;
   const model = typeof body.model === "string" && /^[A-Za-z0-9._-]{1,64}$/.test(body.model) ? body.model : void 0;
-  console.log(`${TAG24} spawn-request-in surface=cookie accountId=${senderId.slice(0, 8)} userId=${userId ? userId.slice(0, 8) : "absent"} channel=${channel} permissionMode=${permissionMode ?? "default"} specialist=${specialist ?? "none"} model=${model ?? "default"} initialMessage=${initialMessage ? "yes" : "no"}`);
+  console.log(`${TAG25} spawn-request-in surface=cookie accountId=${senderId.slice(0, 8)} userId=${userId ? userId.slice(0, 8) : "absent"} channel=${channel} permissionMode=${permissionMode ?? "default"} specialist=${specialist ?? "none"} model=${model ?? "default"} initialMessage=${initialMessage ? "yes" : "no"}`);
   const conversationNodeId = cacheKey ? getSessionIdForSession(cacheKey) : void 0;
   const { response, claudeSessionId } = await performSpawnWithInitialMessage({
     senderId,
@@ -11378,24 +11720,24 @@ app16.post("/", async (c) => {
     claudeSessionId,
     senderId
   );
-  console.log(`${TAG24} route-done surface=cookie status=${response.status} route-ms=${Date.now() - routeStart}`);
+  console.log(`${TAG25} route-done surface=cookie status=${response.status} route-ms=${Date.now() - routeStart}`);
   return response;
 });
-var claude_sessions_default = app16;
+var claude_sessions_default = app17;
 
 // server/routes/admin/log-ingest.ts
-var TAG25 = "[log-ingest]";
+var TAG26 = "[log-ingest]";
 var TAG_PATTERN = /^[A-Za-z0-9_:-]{1,32}$/;
 var LEVELS = /* @__PURE__ */ new Set(["debug", "info", "warn", "error"]);
 var MAX_LINE_BYTES = 4096;
-var app17 = new Hono();
+var app18 = new Hono();
 function isLoopbackAddr(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-app17.post("/", async (c) => {
+app18.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr(remoteAddr)) {
-    console.error(`${TAG25} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG26} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "log-ingest-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -11404,7 +11746,7 @@ app17.post("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr(t));
     if (offender !== void 0) {
-      console.error(`${TAG25} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG26} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "log-ingest-loopback-only" }, 403);
     }
   }
@@ -11435,7 +11777,7 @@ app17.post("/", async (c) => {
   else console.log(formatted);
   return c.json({ ok: true }, 200);
 });
-var log_ingest_default = app17;
+var log_ingest_default = app18;
 
 // server/routes/admin/events.ts
 var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
@@ -11444,20 +11786,20 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
   "device-url:vnc-surface-shown",
   "device-url:malformed"
 ]);
-var app18 = new Hono();
-app18.post("/", async (c) => {
-  const TAG34 = "[admin:events]";
+var app19 = new Hono();
+app19.post("/", async (c) => {
+  const TAG35 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG34} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG35} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS.has(event)) {
-    console.error(`${TAG34} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG35} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -11476,13 +11818,14 @@ app18.post("/", async (c) => {
   console.error(`[${event}] ${formatted}`);
   return c.json({ ok: true });
 });
-var events_default = app18;
+var events_default = app19;
 
 // server/routes/admin/files.ts
-import { createReadStream as createReadStream2 } from "fs";
-import { readdir as readdir3, readFile as readFile4, stat as stat4, mkdir as mkdir3, writeFile as writeFile4, unlink as unlink2, rename } from "fs/promises";
+import { createReadStream as createReadStream2, createWriteStream as createWriteStream2, existsSync as existsSync23 } from "fs";
+import { readdir as readdir3, readFile as readFile4, stat as stat4, mkdir as mkdir3, unlink as unlink2, rename } from "fs/promises";
 import { realpathSync as realpathSync4 } from "fs";
-import { basename as basename7, dirname as dirname6, join as join21, resolve as resolve22, sep as sep6 } from "path";
+import { randomUUID as randomUUID10 } from "crypto";
+import { basename as basename7, dirname as dirname6, join as join23, resolve as resolve22, sep as sep6 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // ../lib/graph-trash/src/index.ts
@@ -11800,7 +12143,7 @@ async function cascadeDeleteDocument(params) {
 
 // app/lib/file-index.ts
 import * as fsp from "fs/promises";
-import { resolve as resolve21, relative as relative2, join as join20, basename as basename6, extname as extname2, sep as sep5 } from "path";
+import { resolve as resolve21, relative as relative2, join as join22, basename as basename6, extname as extname2, sep as sep5 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
@@ -11882,7 +12225,7 @@ async function extractPdf(absolute) {
   return stdout.trim();
 }
 async function ocrPdf(absolute) {
-  const outPdf = join20(tmpdir2(), `file-index-ocr-${process.pid}-${Date.now()}.pdf`);
+  const outPdf = join22(tmpdir2(), `file-index-ocr-${process.pid}-${Date.now()}.pdf`);
   try {
     await execFileAsync2(
       "ocrmypdf",
@@ -11944,7 +12287,7 @@ async function readDisplayName(absolute) {
   const stem = dot === -1 ? base : base.slice(0, dot);
   if (base === `${stem}.meta.json`) return null;
   try {
-    const raw = await fsp.readFile(join20(dir, `${stem}.meta.json`), "utf-8");
+    const raw = await fsp.readFile(join22(dir, `${stem}.meta.json`), "utf-8");
     const meta = JSON.parse(raw);
     const dn = meta.displayName ?? meta.filename;
     return typeof dn === "string" && dn.length > 0 ? dn : null;
@@ -11964,7 +12307,8 @@ async function walkSubtree(root, dataRoot, out) {
   let clean = true;
   for (const entry of entries) {
     if (entry.isSymbolicLink()) continue;
-    const abs = join20(root, entry.name);
+    if (entry.isDirectory() && entry.name === ".uploads-tmp") continue;
+    const abs = join22(root, entry.name);
     if (entry.isDirectory()) {
       const sub = await walkSubtree(abs, dataRoot, out);
       if (!sub.clean) clean = false;
@@ -12233,10 +12577,11 @@ async function dropFileIndex(accountId, relativePath, opts) {
 }
 
 // server/routes/admin/files.ts
+var UPLOAD_TMP_DIR = ".uploads-tmp";
 var UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function readMeta(absDir, baseName) {
   try {
-    const raw = await readFile4(join21(absDir, `${baseName}.meta.json`), "utf8");
+    const raw = await readFile4(join23(absDir, `${baseName}.meta.json`), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.filename === "string") {
       return { filename: parsed.filename, mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0 };
@@ -12274,7 +12619,7 @@ async function readAccountNames() {
 }
 async function enrich(absolute, entry, accountNames) {
   if (entry.kind === "directory" && UUID_RE3.test(entry.name)) {
-    const meta = await readMeta(join21(absolute, entry.name), entry.name);
+    const meta = await readMeta(join23(absolute, entry.name), entry.name);
     if (meta?.filename) {
       entry.displayName = meta.filename;
       entry.mimeType = meta.mimeType;
@@ -12398,8 +12743,8 @@ async function knowledgeDocOwnedByAccount(accountId, attachmentId) {
     await session.close();
   }
 }
-var app19 = new Hono();
-app19.get("/", requireAdminSession, async (c) => {
+var app20 = new Hono();
+app20.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -12438,7 +12783,7 @@ app19.get("/", requireAdminSession, async (c) => {
       const childRel = relPath === "" || relPath === "." ? name : `${relPath}/${name}`;
       const protectedEntry = isProtectedFromDeletion(childRel).protected;
       try {
-        const entryPath = join21(absolute, name);
+        const entryPath = join23(absolute, name);
         const s = await stat4(entryPath);
         entries.push({
           name,
@@ -12468,7 +12813,7 @@ app19.get("/", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-app19.get("/download", requireAdminSession, async (c) => {
+app20.get("/download", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -12532,72 +12877,178 @@ app19.get("/download", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-app19.post("/upload", requireAdminSession, async (c) => {
+function dataUploadCeiling() {
+  const override = Number(process.env.MAXY_DATA_UPLOAD_MAX_BYTES);
+  return Number.isFinite(override) && override > 0 ? override : MAX_DATA_UPLOAD_BYTES;
+}
+app20.post("/upload", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
-    console.error(`[data] auth-rejected endpoint="/api/admin/files/upload" reason="no account for session"`);
+    console.error(`[data-upload] op=auth-reject reason="no account for session"`);
     return c.json({ error: "Account not found for session" }, 401);
   }
-  let formData;
-  try {
-    formData = await c.req.formData();
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    return c.json({ error: `Invalid multipart body: ${message}` }, 400);
-  }
-  const file = formData.get("file");
-  if (!(file instanceof File)) {
-    return c.json({ error: "file field required (multipart file)" }, 400);
-  }
-  if (file.size > MAX_FILE_SIZE_BYTES) {
-    console.error(`[data] file-upload rejected reason="size" filename="${file.name}" size=${file.size}`);
+  const rawName = c.req.query("filename") ?? "";
+  const safeName = basename7(rawName).replace(/[\0/\\]/g, "_");
+  if (!safeName) return c.json({ error: "filename query param required" }, 400);
+  const uid = `${Date.now()}-${randomUUID10().slice(0, 8)}`;
+  const declaredBytes = c.req.header("content-length") ?? "unknown";
+  const rawRelpath = c.req.query("relpath") ?? "";
+  const relpath = rawRelpath !== "" ? rawRelpath : null;
+  const token = c.req.query("token") ?? "";
+  const finalName = relpath ? basename7(relpath).replace(/[\0/\\]/g, "_") : `${Date.now()}-${safeName}`;
+  const mimeType = (c.req.header("content-type") ?? "").split(";")[0].trim();
+  if (!SUPPORTED_MIME_TYPES.has(mimeType)) {
+    console.error(`[data-upload] op=reject-mime uid=${uid} mime="${mimeType}" token=${token} rel="${relpath ?? ""}"`);
     return c.json({
-      error: `File "${file.name}" exceeds the 50 MB limit (${(file.size / 1024 / 1024).toFixed(1)} MB).`
+      error: `Unsupported file type: "${mimeType}". Supported: ${[...SUPPORTED_MIME_TYPES].join(", ")}.`
     }, 422);
   }
-  if (!SUPPORTED_MIME_TYPES.has(file.type)) {
-    console.error(`[data] file-upload rejected reason="mime" filename="${file.name}" mime="${file.type}"`);
-    return c.json({
-      error: `Unsupported file type: "${file.type}". Supported: ${[...SUPPORTED_MIME_TYPES].join(", ")}.`
-    }, 422);
+  const rawDir = c.req.query("path") ?? "";
+  const base = resolveOwnAccountWrite(rawDir, accountId, "POST /api/admin/files/upload");
+  if (!base.ok) return c.json({ error: base.error }, base.status);
+  const relDir = relpath ? dirname6(relpath) : ".";
+  const destRel = relDir === "." ? base.relative : join23(base.relative, relDir);
+  if (crossesForeignAccountPartition(destRel, accountId)) {
+    console.error(`[data] account-scope-blocked endpoint="POST /api/admin/files/upload" path="${destRel}" account=${accountId.slice(0, 8)}\u2026`);
+    return c.json({ error: "Not found" }, 404);
   }
-  const safeName = basename7(file.name).replace(/[\0/\\]/g, "_");
-  const finalName = `${Date.now()}-${safeName}`;
-  const rawDir = formData.get("path");
-  const dest = resolveOwnAccountWrite(typeof rawDir === "string" ? rawDir : "", accountId, "POST /api/admin/files/upload");
-  if (!dest.ok) return c.json({ error: dest.error }, dest.status);
-  const destDir = dest.absolute;
+  if (!isWithinOwnAccountPartition(destRel, accountId)) {
+    console.error(`[data] write-scope-blocked endpoint="POST /api/admin/files/upload" path="${destRel}" account=${accountId.slice(0, 8)}\u2026`);
+    return c.json({ error: "Path is outside your account folder" }, 403);
+  }
+  const destDir = relDir === "." ? base.absolute : resolve22(base.absolute, relDir);
   const destPath = resolve22(destDir, finalName);
-  try {
-    const info = await stat4(destDir);
-    if (!info.isDirectory()) return c.json({ error: "Upload destination is not a directory" }, 400);
-    const dataRootReal = realpathSync4(DATA_ROOT);
-    const destDirReal = realpathSync4(destDir);
-    if (destDirReal !== dataRootReal && !destDirReal.startsWith(dataRootReal + sep6)) {
-      console.error(`[data] path-traversal-blocked requested="${dest.relative}" resolved="${destDirReal}"`);
-      return c.json({ error: "Upload destination escapes DATA_ROOT" }, 403);
+  if (relpath) {
+    const firstCreated = await mkdir3(destDir, { recursive: true });
+    if (firstCreated) console.error(`[data-upload] op=mkdir uid=${uid} token=${token} dir="${destRel}"`);
+  } else {
+    const info = await stat4(destDir).catch(() => null);
+    if (!info || !info.isDirectory()) return c.json({ error: "Upload destination is not a directory" }, 400);
+  }
+  const dataRootReal = realpathSync4(DATA_ROOT);
+  const destDirReal = realpathSync4(destDir);
+  if (destDirReal !== dataRootReal && !destDirReal.startsWith(dataRootReal + sep6)) {
+    console.error(`[data-upload] op=path-traversal-blocked uid=${uid} requested="${destRel}" resolved="${destDirReal}"`);
+    return c.json({ error: "Upload destination escapes DATA_ROOT" }, 403);
+  }
+  const body = c.req.raw.body;
+  if (!body) return c.json({ error: "Empty request body" }, 400);
+  console.error(`[data-upload] op=request uid=${uid} account=${accountId} dir="${destRel}" token=${token} rel="${relpath ?? ""}" declaredBytes=${declaredBytes}`);
+  const ceiling = dataUploadCeiling();
+  const tmpDir = resolve22(DATA_ROOT, "accounts", accountId, UPLOAD_TMP_DIR);
+  await mkdir3(tmpDir, { recursive: true });
+  const tmpPath = resolve22(tmpDir, `${uid}.part`);
+  const out = createWriteStream2(tmpPath);
+  const t0 = Date.now();
+  let received = 0;
+  let lastLogged = 0;
+  const LOG_EVERY = 64 * 1024 * 1024;
+  let writeError = null;
+  out.on("error", (e) => {
+    writeError = e;
+  });
+  const cleanup = async () => {
+    await new Promise((res) => {
+      if (out.closed) return res();
+      out.once("close", () => res());
+      out.destroy();
+    });
+    await unlink2(tmpPath).catch(() => {
+    });
+    const tempRemoved = !existsSync23(tmpPath);
+    console.error(`[data-upload] op=cleanup uid=${uid} tempRemoved=${tempRemoved}`);
+  };
+  const reader = body.getReader();
+  try {
+    for (; ; ) {
+      if (writeError) throw writeError;
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (!value) continue;
+      received += value.byteLength;
+      if (received > ceiling) {
+        console.error(`[data-upload] op=reject-size uid=${uid} received=${received} ceiling=${ceiling}`);
+        await reader.cancel().catch(() => {
+        });
+        await cleanup();
+        return c.json({
+          error: `File exceeds the ${Math.floor(ceiling / 1024 / 1024)} MB limit.`
+        }, 413);
+      }
+      if (!out.write(value)) {
+        await new Promise((res, rej) => {
+          const onDrain = () => {
+            out.off("error", onErr);
+            res();
+          };
+          const onErr = (e) => {
+            out.off("drain", onDrain);
+            rej(e);
+          };
+          out.once("drain", onDrain);
+          out.once("error", onErr);
+        });
+      }
+      if (received - lastLogged >= LOG_EVERY) {
+        lastLogged = received;
+        console.error(`[data-upload] op=streaming uid=${uid} received=${received}`);
+      }
     }
-    const buffer = Buffer.from(await file.arrayBuffer());
-    await writeFile4(destPath, buffer);
+    await new Promise((res, rej) => {
+      if (writeError) return rej(writeError);
+      out.once("error", rej);
+      out.end(() => res());
+    });
+    await rename(tmpPath, destPath);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    console.error(`[data] file-upload error filename="${safeName}" err="${message}"`);
+    console.error(`[data-upload] op=error uid=${uid} err="${message}" token=${token} rel="${relpath ?? ""}"`);
+    await cleanup();
     return c.json({ error: message }, 500);
   }
-  const relativeDest = `${dest.relative}/${finalName}`;
-  console.error(`[data] file-upload filename="${safeName}" size=${file.size} dest="${relativeDest}"`);
+  const relativeDest = `${destRel}/${finalName}`;
+  console.error(`[data-upload] op=committed uid=${uid} path="${relativeDest}" bytes=${received} token=${token} rel="${relpath ?? ""}" ms=${Date.now() - t0}`);
   void indexFile(accountId, relativeDest).catch((err) => {
-    console.error(`[data] file-upload index-failed dest="${relativeDest}" err="${err instanceof Error ? err.message : String(err)}"`);
+    console.error(`[data-upload] op=index-failed uid=${uid} dest="${relativeDest}" err="${err instanceof Error ? err.message : String(err)}"`);
   });
   return c.json({
     path: relativeDest,
     filename: finalName,
-    sizeBytes: file.size,
-    mimeType: file.type
+    sizeBytes: received,
+    mimeType
   });
 });
-app19.delete("/", requireAdminSession, async (c) => {
+async function sweepStaleUploadTemps() {
+  const accountsRoot = resolve22(DATA_ROOT, "accounts");
+  let accounts;
+  try {
+    accounts = await readdir3(accountsRoot, { withFileTypes: true });
+  } catch {
+    return 0;
+  }
+  let removed = 0;
+  for (const acc of accounts) {
+    if (!acc.isDirectory()) continue;
+    const tmpDir = resolve22(accountsRoot, acc.name, UPLOAD_TMP_DIR);
+    let entries;
+    try {
+      entries = await readdir3(tmpDir);
+    } catch {
+      continue;
+    }
+    for (const name of entries) {
+      try {
+        await unlink2(resolve22(tmpDir, name));
+        removed++;
+      } catch {
+      }
+    }
+  }
+  if (removed > 0) console.error(`[data-upload] op=sweep removed=${removed}`);
+  return removed;
+}
+app20.delete("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -12634,7 +13085,7 @@ app19.delete("/", requireAdminSession, async (c) => {
     }
     const dot = base.lastIndexOf(".");
     const stem = dot === -1 ? base : base.slice(0, dot);
-    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join21(dirname6(absolute), `${stem}.meta.json`) : null;
+    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join23(dirname6(absolute), `${stem}.meta.json`) : null;
     await unlink2(absolute);
     if (sidecarPath) {
       try {
@@ -12673,7 +13124,7 @@ app19.delete("/", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-app19.post("/folder", requireAdminSession, async (c) => {
+app20.post("/folder", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -12708,7 +13159,7 @@ app19.post("/folder", requireAdminSession, async (c) => {
   console.error(`[data] folder-create path="${newRel}"`);
   return c.json({ path: newRel });
 });
-app19.post("/rename", requireAdminSession, async (c) => {
+app20.post("/rename", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -12758,7 +13209,7 @@ app19.post("/rename", requireAdminSession, async (c) => {
   });
   return c.json({ path: newRel });
 });
-var files_default = app19;
+var files_default = app20;
 
 // ../lib/graph-search/src/index.ts
 var import_dist = __toESM(require_dist());
@@ -13523,8 +13974,8 @@ var DEFAULT_LIMIT = 20;
 var MAX_LIMIT = 2e3;
 var MESSAGE_FAMILY_LABELS = ["Message", "UserMessage", "AssistantMessage", "WhatsAppMessage"];
 var CONVERSATION_PARENT_LABELS = /* @__PURE__ */ new Set(["AdminConversation", "PublicConversation"]);
-var app20 = new Hono();
-app20.get("/", requireAdminSession, async (c) => {
+var app21 = new Hono();
+app21.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const q = (c.req.query("q") ?? "").trim();
   const rawLimit = c.req.query("limit");
@@ -13660,7 +14111,7 @@ app20.get("/", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-var graph_search_default = app20;
+var graph_search_default = app21;
 
 // server/routes/admin/graph-subgraph.ts
 import neo4j2 from "neo4j-driver";
@@ -13744,8 +14195,8 @@ var STRIPPED_PROPERTIES = /* @__PURE__ */ new Set([
   "otpCode",
   "cacheKey"
 ]);
-var app21 = new Hono();
-app21.get("/", requireAdminSession, async (c) => {
+var app22 = new Hono();
+app22.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -14328,12 +14779,12 @@ function pruneNode(node, warnedClasses, conversationWarnings) {
   }
   return trashed ? { id: node.id, labels, properties, trashed: true } : { id: node.id, labels, properties };
 }
-var graph_subgraph_default = app21;
+var graph_subgraph_default = app22;
 
 // server/routes/admin/graph-delete.ts
 var ALLOWED_BY = ["graph-page", "graph-drag-trash", "graph-side-panel-trash"];
-var app22 = new Hono();
-app22.post("/", requireAdminSession, async (c) => {
+var app23 = new Hono();
+app23.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -14495,11 +14946,11 @@ app22.post("/", requireAdminSession, async (c) => {
     }
   }
 });
-var graph_delete_default = app22;
+var graph_delete_default = app23;
 
 // server/routes/admin/graph-restore.ts
-var app23 = new Hono();
-app23.post("/", requireAdminSession, async (c) => {
+var app24 = new Hono();
+app24.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -14563,11 +15014,11 @@ app23.post("/", requireAdminSession, async (c) => {
     }
   }
 });
-var graph_restore_default = app23;
+var graph_restore_default = app24;
 
 // server/routes/admin/graph-labels-in-graph.ts
-var app24 = new Hono();
-app24.get("/", requireAdminSession, async (c) => {
+var app25 = new Hono();
+app25.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -14633,11 +15084,11 @@ var LABELS_IN_GRAPH_CYPHER = `
        sum(halfEdges) AS relDegree
   RETURN label, nodeCount, relDegree
 `;
-var graph_labels_in_graph_default = app24;
+var graph_labels_in_graph_default = app25;
 
 // server/routes/admin/graph-default-view.ts
-var app25 = new Hono();
-app25.get("/", requireAdminSession, async (c) => {
+var app26 = new Hono();
+app26.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   const userId = getUserIdForSession(cacheKey);
@@ -14675,7 +15126,7 @@ app25.get("/", requireAdminSession, async (c) => {
     }
   }
 });
-app25.put("/", requireAdminSession, async (c) => {
+app26.put("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   const userId = getUserIdForSession(cacheKey);
@@ -14764,20 +15215,20 @@ var WRITE_CYPHER = `
       p.updatedAt = $updatedAt
   RETURN p.labels AS labels
 `;
-var graph_default_view_default = app25;
+var graph_default_view_default = app26;
 
 // server/routes/admin/sidebar-artefacts.ts
 import { readdir as readdir4, stat as stat5 } from "fs/promises";
 import { resolve as resolve23, relative as relative3, isAbsolute, sep as sep7, basename as basename8 } from "path";
-import { existsSync as existsSync21 } from "fs";
+import { existsSync as existsSync24 } from "fs";
 var LIMIT = 50;
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
 function toDataRootRelPath(absPath) {
   if (absPath !== DATA_ROOT && !absPath.startsWith(DATA_ROOT + sep7)) return null;
   return relative3(DATA_ROOT, absPath);
 }
-var app26 = new Hono();
-app26.get("/", requireAdminSession, async (c) => {
+var app27 = new Hono();
+app27.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -14876,7 +15327,7 @@ async function fetchAgentTemplateRows(accountDir) {
 async function unionSpecialistFilenames(overrideDir, bundledDir) {
   const names = /* @__PURE__ */ new Set();
   for (const dir of [overrideDir, bundledDir]) {
-    if (!existsSync21(dir)) continue;
+    if (!existsSync24(dir)) continue;
     try {
       const entries = await readdir4(dir);
       for (const entry of entries) {
@@ -14891,7 +15342,7 @@ async function unionSpecialistFilenames(overrideDir, bundledDir) {
 }
 async function readAgentTemplateRow(inp) {
   let chosenPath = null;
-  if (existsSync21(inp.overridePath)) {
+  if (existsSync24(inp.overridePath)) {
     try {
       validateFilePathInAccount(inp.overridePath, inp.overrideRoot);
       chosenPath = inp.overridePath;
@@ -14902,7 +15353,7 @@ async function readAgentTemplateRow(inp) {
       );
       return null;
     }
-  } else if (existsSync21(inp.bundledPath)) {
+  } else if (existsSync24(inp.bundledPath)) {
     if (!isWithin(inp.bundledPath, inp.bundledRoot)) {
       console.error(
         `[admin/sidebar-artefacts] agent-template-read-failed agent=${inp.displayName} kind=${inp.logName} error="bundled path outside PLATFORM_ROOT"`
@@ -14941,11 +15392,11 @@ function isWithin(target, root) {
   const rel = relative3(root, target);
   return !rel.startsWith("..") && !isAbsolute(rel);
 }
-var sidebar_artefacts_default = app26;
+var sidebar_artefacts_default = app27;
 
 // server/routes/admin/session-delete.ts
-var app27 = new Hono();
-app27.post("/", requireAdminSession, async (c) => {
+var app28 = new Hono();
+app28.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -14983,11 +15434,11 @@ app27.post("/", requireAdminSession, async (c) => {
   console.error(`[session-delete] sessionId=${sessionId} delete-status=${del.status}`);
   return c.json({ error: `manager-status-${del.status}` }, 502);
 });
-var session_delete_default = app27;
+var session_delete_default = app28;
 
 // server/routes/admin/session-stop.ts
-var app28 = new Hono();
-app28.post("/", requireAdminSession, async (c) => {
+var app29 = new Hono();
+app29.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -15012,11 +15463,11 @@ app28.post("/", requireAdminSession, async (c) => {
   console.error(`[session-stop] sessionId=${sessionId} manager-status=${res.status}`);
   return c.json({ error: `manager-status-${res.status}` }, 502);
 });
-var session_stop_default = app28;
+var session_stop_default = app29;
 
 // server/routes/admin/session-archive.ts
-var app29 = new Hono();
-app29.post("/", requireAdminSession, async (c) => {
+var app30 = new Hono();
+app30.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -15064,11 +15515,54 @@ app29.post("/", requireAdminSession, async (c) => {
   console.error(`[session-archive] sessionId=${sessionId.slice(0, 8)} manager-status=${res.status}`);
   return c.json({ error: `manager-status-${res.status}` }, 502);
 });
-var session_archive_default = app29;
+var session_archive_default = app30;
+
+// server/routes/admin/session-rename.ts
+var app31 = new Hono();
+app31.post("/", requireAdminSession, async (c) => {
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "invalid JSON body" }, 400);
+  }
+  const sessionId = typeof body.sessionId === "string" ? body.sessionId : "";
+  if (!SESSION_ID_RE2.test(sessionId)) {
+    return c.json({ error: "sessionId must be a v4 UUID" }, 400);
+  }
+  let res;
+  try {
+    res = await fetch(`${managerBase("session-rename:wrapper")}/${sessionId}/rename`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ title: body.title })
+    });
+  } catch (err) {
+    console.error(`[session-rename] sessionId=${sessionId.slice(0, 8)} manager-unreachable err=${err instanceof Error ? err.message : String(err)}`);
+    return c.json({ error: "manager-unreachable" }, 502);
+  }
+  if (res.status === 200) {
+    const ok = await res.json().catch(() => ({}));
+    console.log(`[session-rename] sessionId=${sessionId.slice(0, 8)} renamed`);
+    return c.json({ ok: true, sessionId: ok.sessionId ?? sessionId, titleSource: ok.titleSource ?? "user" });
+  }
+  if (res.status === 400) {
+    const b = await res.json().catch(() => ({}));
+    console.error(`[session-rename] sessionId=${sessionId.slice(0, 8)} invalid-title reason=${b.reason ?? "unknown"}`);
+    return c.json({ error: "invalid-title", reason: b.reason ?? "invalid" }, 400);
+  }
+  if (res.status === 404) {
+    console.error(`[session-rename] sessionId=${sessionId.slice(0, 8)} session-not-found`);
+    return c.json({ error: "session-not-found" }, 404);
+  }
+  console.error(`[session-rename] sessionId=${sessionId.slice(0, 8)} manager-status=${res.status}`);
+  return c.json({ error: `manager-status-${res.status}` }, 502);
+});
+var session_rename_default = app31;
 
 // server/routes/admin/session-rc-spawn.ts
-import { randomUUID as randomUUID10 } from "crypto";
-function resolveSpawnPlan(host, operatorDomains, body, mintId = randomUUID10, adminUserId, authenticatedName) {
+import { randomUUID as randomUUID11 } from "crypto";
+function resolveSpawnPlan(host, operatorDomains, body, mintId = randomUUID11, adminUserId, authenticatedName) {
   const operator = isOperatorHost(host, operatorDomains);
   const resumeId = typeof body.sessionId === "string" && body.sessionId.length > 0 ? body.sessionId : void 0;
   const name = typeof body.name === "string" && body.name.length > 0 ? body.name : void 0;
@@ -15101,8 +15595,8 @@ function shapeWebchatResponse(sessionId, manager) {
   const landed = redirected ? manager.sessionId : sessionId;
   return { sessionId: landed, outcome, target: `/chat?session=${landed}` };
 }
-var app30 = new Hono();
-app30.post("/", requireAdminSession, async (c) => {
+var app32 = new Hono();
+app32.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -15114,8 +15608,8 @@ app30.post("/", requireAdminSession, async (c) => {
   const adminUserId = cacheKey ? getUserIdForSession(cacheKey) : void 0;
   const accountId = cacheKey ? getAccountIdForSession(cacheKey) : void 0;
   const authenticatedName = accountId ? await resolveAuthenticatedName(accountId, adminUserId) : void 0;
-  const plan = resolveSpawnPlan(host, getOperatorDomains(), body, randomUUID10, adminUserId, authenticatedName);
-  const spawnReqId = randomUUID10();
+  const plan = resolveSpawnPlan(host, getOperatorDomains(), body, randomUUID11, adminUserId, authenticatedName);
+  const spawnReqId = randomUUID11();
   console.log(
     `[chat-spawn] op=request spawnReqId=${spawnReqId} origin=${plan.origin} kind=${plan.kind} sessionId=${plan.kind === "new" ? "new" : plan.sessionId}`
   );
@@ -15157,10 +15651,10 @@ app30.post("/", requireAdminSession, async (c) => {
   }
   return c.json(parsed ?? {});
 });
-var session_rc_spawn_default = app30;
+var session_rc_spawn_default = app32;
 
 // server/routes/admin/session-reseat.ts
-import { randomUUID as randomUUID11 } from "crypto";
+import { randomUUID as randomUUID12 } from "crypto";
 
 // ../lib/models/src/index.ts
 var OPUS_MODEL = "claude-opus-4-8[1m]";
@@ -15182,7 +15676,7 @@ function isSelectableModel(id) {
 }
 
 // server/routes/admin/session-reseat.ts
-function resolveReseatPlan(body, mintId = randomUUID11, adminUserId, authenticatedName) {
+function resolveReseatPlan(body, mintId = randomUUID12, adminUserId, authenticatedName) {
   const sessionId = mintId();
   const key = `session:${sessionId}`;
   const payload = {
@@ -15199,9 +15693,9 @@ function resolveReseatPlan(body, mintId = randomUUID11, adminUserId, authenticat
   if (authenticatedName) payload.authenticatedName = authenticatedName;
   return { sessionId, payload };
 }
-var app31 = new Hono();
+var app33 = new Hono();
 var reseatsInFlight = /* @__PURE__ */ new Set();
-app31.post("/", requireAdminSession, async (c) => {
+app33.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -15221,8 +15715,8 @@ app31.post("/", requireAdminSession, async (c) => {
     const adminUserId = cacheKey ? getUserIdForSession(cacheKey) : void 0;
     const accountId = cacheKey ? getAccountIdForSession(cacheKey) : void 0;
     const authenticatedName = accountId ? await resolveAuthenticatedName(accountId, adminUserId) : void 0;
-    const plan = resolveReseatPlan({ fromSessionId, model }, randomUUID11, adminUserId, authenticatedName);
-    const reseatReqId = randomUUID11();
+    const plan = resolveReseatPlan({ fromSessionId, model }, randomUUID12, adminUserId, authenticatedName);
+    const reseatReqId = randomUUID12();
     console.log(`[chat-reseat] op=request reseatReqId=${reseatReqId} from=${fromSessionId} to-model=${model} new=${plan.sessionId}`);
     let res;
     try {
@@ -15272,7 +15766,7 @@ app31.post("/", requireAdminSession, async (c) => {
     reseatsInFlight.delete(fromSessionId);
   }
 });
-var session_reseat_default = app31;
+var session_reseat_default = app33;
 
 // server/routes/admin/system-stats.ts
 import { readFile as readFile5 } from "fs/promises";
@@ -15369,8 +15863,8 @@ async function sample() {
   if (process.platform === "linux") return sampleLinux();
   return sampleOsFallback();
 }
-var app32 = new Hono();
-app32.get("/", async (c) => {
+var app34 = new Hono();
+app34.get("/", async (c) => {
   const started = Date.now();
   if (!inflight) {
     inflight = sample().finally(() => {
@@ -15393,17 +15887,17 @@ app32.get("/", async (c) => {
     return c.json({ degraded: true, reason, sampledAtMs: Date.now() });
   }
 });
-var system_stats_default = app32;
+var system_stats_default = app34;
 
 // server/routes/admin/health.ts
-import { existsSync as existsSync22, readFileSync as readFileSync22 } from "fs";
-import { resolve as resolve24, join as join22 } from "path";
+import { existsSync as existsSync25, readFileSync as readFileSync24 } from "fs";
+import { resolve as resolve24, join as join24 } from "path";
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve24(process.cwd(), "..");
 var brandHostname = "maxy";
-var brandJsonPath = join22(PLATFORM_ROOT6, "config", "brand.json");
-if (existsSync22(brandJsonPath)) {
+var brandJsonPath = join24(PLATFORM_ROOT6, "config", "brand.json");
+if (existsSync25(brandJsonPath)) {
   try {
-    const brand = JSON.parse(readFileSync22(brandJsonPath, "utf-8"));
+    const brand = JSON.parse(readFileSync24(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
   } catch {
   }
@@ -15412,8 +15906,8 @@ var VERSION_FILE = resolve24(PLATFORM_ROOT6, `config/.${brandHostname}-version`)
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
-  if (!existsSync22(VERSION_FILE)) return "unknown";
-  return readFileSync22(VERSION_FILE, "utf-8").trim() || "unknown";
+  if (!existsSync25(VERSION_FILE)) return "unknown";
+  return readFileSync24(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
   let session;
@@ -15438,8 +15932,8 @@ async function probeConversationDb() {
     });
   }
 }
-var app33 = new Hono();
-app33.get("/", async (c) => {
+var app35 = new Hono();
+app35.get("/", async (c) => {
   const version = readVersion();
   const probe = await probeConversationDb();
   const uptimeMs = Date.now() - new Date(PROCESS_STARTED_AT).getTime();
@@ -15461,11 +15955,11 @@ app33.get("/", async (c) => {
     uptimeMs
   });
 });
-var health_default2 = app33;
+var health_default2 = app35;
 
 // server/routes/admin/linkedin-ingest.ts
-import { randomUUID as randomUUID12 } from "crypto";
-var TAG26 = "[linkedin-ingest-route]";
+import { randomUUID as randomUUID13 } from "crypto";
+var TAG27 = "[linkedin-ingest-route]";
 var UUID2 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 var ISO = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/;
 var LINKEDIN_URL = /^https:\/\/www\.linkedin\.com\//;
@@ -15563,35 +16057,35 @@ function buildInitialMessage(env) {
   }
   return header;
 }
-var app34 = new Hono();
-app34.post("/", requireAdminSession, async (c) => {
+var app36 = new Hono();
+app36.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
   } catch {
-    console.error(TAG26 + " rejected status=400 reason=schema:body-not-json");
+    console.error(TAG27 + " rejected status=400 reason=schema:body-not-json");
     return c.json({ ok: false, error: "schema", reason: "body-not-json" }, 400);
   }
   const v = validate(body);
   if (!v.ok) {
-    console.error(TAG26 + " rejected status=" + v.status + " reason=" + v.reason + " missing=" + v.missing.join(","));
+    console.error(TAG27 + " rejected status=" + v.status + " reason=" + v.reason + " missing=" + v.missing.join(","));
     return c.json({ ok: false, error: v.error, reason: v.reason, missing: v.missing }, v.status);
   }
   const envelope = v.envelope;
   const cacheKey = c.var.cacheKey ?? "";
   const senderId = getAccountIdForSession(cacheKey) ?? "";
   if (!senderId) {
-    console.error(TAG26 + " rejected status=500 reason=admin-account-not-resolved");
+    console.error(TAG27 + " rejected status=500 reason=admin-account-not-resolved");
     return c.json({ ok: false, error: "admin-account-not-resolved" }, 500);
   }
   const payloadBytes = JSON.stringify(envelope).length;
   console.log(
-    TAG26 + " received kind=" + envelope.kind + " account=" + senderId.slice(0, 8) + " pageUrl=" + envelope.pageUrl + " dispatchId=" + envelope.dispatchId + " payloadBytes=" + payloadBytes
+    TAG27 + " received kind=" + envelope.kind + " account=" + senderId.slice(0, 8) + " pageUrl=" + envelope.pageUrl + " dispatchId=" + envelope.dispatchId + " payloadBytes=" + payloadBytes
   );
   const initialMessage = buildInitialMessage(envelope);
   const spawnStart = Date.now();
-  const sessionId = randomUUID12();
-  console.log(TAG26 + " route target=rc-spawn dispatchId=" + envelope.dispatchId + " sessionId=" + sessionId.slice(0, 8));
+  const sessionId = randomUUID13();
+  console.log(TAG27 + " route target=rc-spawn dispatchId=" + envelope.dispatchId + " sessionId=" + sessionId.slice(0, 8));
   const spawned = await managerRcSpawn({
     sessionId,
     initialMessage,
@@ -15600,20 +16094,20 @@ app34.post("/", requireAdminSession, async (c) => {
   });
   if ("error" in spawned) {
     console.error(
-      TAG26 + " dispatch-failed dispatchId=" + envelope.dispatchId + " status=" + spawned.status + " ms=" + (Date.now() - spawnStart) + " message=" + spawned.error
+      TAG27 + " dispatch-failed dispatchId=" + envelope.dispatchId + " status=" + spawned.status + " ms=" + (Date.now() - spawnStart) + " message=" + spawned.error
     );
     return c.json({ ok: false, error: "dispatch-failed", upstreamStatus: spawned.status, detail: spawned.error }, 502);
   }
   console.log(
-    TAG26 + " dispatched dispatchId=" + envelope.dispatchId + " taskId=" + spawned.sessionId + " ms=" + (Date.now() - spawnStart)
+    TAG27 + " dispatched dispatchId=" + envelope.dispatchId + " taskId=" + spawned.sessionId + " ms=" + (Date.now() - spawnStart)
   );
   return c.json({ ok: true, dispatchId: envelope.dispatchId, taskId: spawned.sessionId }, 202);
 });
-var linkedin_ingest_default = app34;
+var linkedin_ingest_default = app36;
 
 // server/routes/admin/post-turn-context.ts
 import neo4j3 from "neo4j-driver";
-var TAG27 = "[post-turn-context]";
+var TAG28 = "[post-turn-context]";
 var STRIPPED_PROPERTIES2 = /* @__PURE__ */ new Set([
   "embedding",
   "passwordHash",
@@ -15651,11 +16145,11 @@ function pruneProperties(raw) {
   }
   return out;
 }
-var app35 = new Hono();
-app35.get("/", async (c) => {
+var app37 = new Hono();
+app37.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr2(remoteAddr)) {
-    console.error(`${TAG27} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG28} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "post-turn-context-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -15664,7 +16158,7 @@ app35.get("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr2(t));
     if (offender !== void 0) {
-      console.error(`${TAG27} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG28} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "post-turn-context-loopback-only" }, 403);
     }
   }
@@ -15696,7 +16190,7 @@ app35.get("/", async (c) => {
     writes.sort((a, b) => a.sortKey.localeCompare(b.sortKey));
     const total = Date.now() - started;
     console.log(
-      `${TAG27} sessionId=${sessionId} accountId=${accountId} writes=${writes.length} ms=${total}`
+      `${TAG28} sessionId=${sessionId} accountId=${accountId} writes=${writes.length} ms=${total}`
     );
     return c.json({
       writes: writes.map(({ elementId, labels, properties }) => ({ elementId, labels, properties }))
@@ -15705,18 +16199,18 @@ app35.get("/", async (c) => {
     const elapsed = Date.now() - started;
     const message = err instanceof Error ? err.message : String(err);
     console.error(
-      `${TAG27} neo4j-unreachable sessionId=${sessionId} ms=${elapsed} err="${message}"`
+      `${TAG28} neo4j-unreachable sessionId=${sessionId} ms=${elapsed} err="${message}"`
     );
     return c.json({ error: `post-turn-context unavailable: ${message}` }, 503);
   } finally {
     await session.close();
   }
 });
-var post_turn_context_default = app35;
+var post_turn_context_default = app37;
 
 // server/routes/admin/public-session-context.ts
 import neo4j4 from "neo4j-driver";
-var TAG28 = "[public-session-context]";
+var TAG29 = "[public-session-context]";
 var STRIPPED_PROPERTIES3 = /* @__PURE__ */ new Set([
   "embedding",
   "passwordHash",
@@ -15754,11 +16248,11 @@ function pruneProperties2(raw) {
   }
   return out;
 }
-var app36 = new Hono();
-app36.get("/", async (c) => {
+var app38 = new Hono();
+app38.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr3(remoteAddr)) {
-    console.error(`${TAG28} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG29} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "public-session-context-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -15767,7 +16261,7 @@ app36.get("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr3(t));
     if (offender !== void 0) {
-      console.error(`${TAG28} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG29} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "public-session-context-loopback-only" }, 403);
     }
   }
@@ -15798,7 +16292,7 @@ app36.get("/", async (c) => {
     writes.sort((a, b) => a.sortKey.localeCompare(b.sortKey));
     const total = Date.now() - started;
     console.log(
-      `${TAG28} sliceToken=${sliceToken.slice(0, 8)} writes=${writes.length} ms=${total}`
+      `${TAG29} sliceToken=${sliceToken.slice(0, 8)} writes=${writes.length} ms=${total}`
     );
     return c.json({
       writes: writes.map(({ elementId, labels, properties }) => ({ elementId, labels, properties }))
@@ -15807,25 +16301,25 @@ app36.get("/", async (c) => {
     const elapsed = Date.now() - started;
     const message = err instanceof Error ? err.message : String(err);
     console.error(
-      `${TAG28} neo4j-unreachable sliceToken=${sliceToken.slice(0, 8)} ms=${elapsed} err="${message}"`
+      `${TAG29} neo4j-unreachable sliceToken=${sliceToken.slice(0, 8)} ms=${elapsed} err="${message}"`
     );
     return c.json({ error: `public-session-context unavailable: ${message}` }, 503);
   } finally {
     await session.close();
   }
 });
-var public_session_context_default = app36;
+var public_session_context_default = app38;
 
 // server/routes/admin/public-session-exit.ts
-var TAG29 = "[public-session-exit-route]";
+var TAG30 = "[public-session-exit-route]";
 function isLoopbackAddr4(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-var app37 = new Hono();
-app37.post("/", async (c) => {
+var app39 = new Hono();
+app39.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr4(remoteAddr)) {
-    console.error(`${TAG29} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG30} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "public-session-exit-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -15834,7 +16328,7 @@ app37.post("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr4(t));
     if (offender !== void 0) {
-      console.error(`${TAG29} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG30} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "public-session-exit-loopback-only" }, 403);
     }
   }
@@ -15849,18 +16343,18 @@ app37.post("/", async (c) => {
   handlePublicSessionExit(sessionId);
   return c.json({ ok: true });
 });
-var public_session_exit_default = app37;
+var public_session_exit_default = app39;
 
 // server/routes/admin/access-session-evict.ts
-var TAG30 = "[access-session-evict]";
+var TAG31 = "[access-session-evict]";
 function isLoopbackAddr5(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-var app38 = new Hono();
-app38.post("/", async (c) => {
+var app40 = new Hono();
+app40.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr5(remoteAddr)) {
-    console.error(`${TAG30} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG31} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "access-session-evict-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -15869,7 +16363,7 @@ app38.post("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr5(t));
     if (offender !== void 0) {
-      console.error(`${TAG30} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG31} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "access-session-evict-loopback-only" }, 403);
     }
   }
@@ -15882,22 +16376,22 @@ app38.post("/", async (c) => {
   const grantId = typeof body.grantId === "string" ? body.grantId.trim() : "";
   if (!grantId) return c.json({ error: "grantId required" }, 400);
   const dropped = evictAccessSessionsByGrant(grantId);
-  console.log(`${TAG30} grantId=${grantId} dropped=${dropped}`);
+  console.log(`${TAG31} grantId=${grantId} dropped=${dropped}`);
   return c.json({ ok: true, dropped });
 });
-var access_session_evict_default = app38;
+var access_session_evict_default = app40;
 
 // server/routes/admin/enrol-person.ts
-var TAG31 = "[enrol]";
+var TAG32 = "[enrol]";
 function isLoopbackAddr6(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
 var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-var app39 = new Hono();
-app39.post("/", async (c) => {
+var app41 = new Hono();
+app41.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr6(remoteAddr)) {
-    console.error(`${TAG31} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG32} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "enrol-person-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -15906,7 +16400,7 @@ app39.post("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr6(t));
     if (offender !== void 0) {
-      console.error(`${TAG31} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG32} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "enrol-person-loopback-only" }, 403);
     }
   }
@@ -15931,7 +16425,7 @@ app39.post("/", async (c) => {
   }
   const accountId = process.env.ACCOUNT_ID ?? "";
   if (!accountId) {
-    console.error(`${TAG31} op=person result=no-account-id`);
+    console.error(`${TAG32} op=person result=no-account-id`);
     return c.json({ error: "no-account-id" }, 500);
   }
   let personId;
@@ -15939,7 +16433,7 @@ app39.post("/", async (c) => {
     personId = await enrolPerson({ accountId, phone, email, agentSlug });
   } catch (err) {
     console.error(
-      `${TAG31} op=person result=write-failed agentSlug=${agentSlug} contact=${maskContact(email)} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG32} op=person result=write-failed agentSlug=${agentSlug} contact=${maskContact(email)} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ error: "enrol-failed" }, 500);
   }
@@ -15949,19 +16443,19 @@ app39.post("/", async (c) => {
     if (g) grant = { grantId: g.grantId, status: g.status, contactValue: g.contactValue };
   } catch (err) {
     console.error(
-      `${TAG31} op=person result=grant-lookup-failed contact=${maskContact(email)} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG32} op=person result=grant-lookup-failed contact=${maskContact(email)} err="${err instanceof Error ? err.message : String(err)}"`
     );
   }
   console.log(
-    `${TAG31} op=person personId=${personId} account=${accountId} agentSlug=${agentSlug} contact=${maskContact(email)}`
+    `${TAG32} op=person personId=${personId} account=${accountId} agentSlug=${agentSlug} contact=${maskContact(email)}`
   );
   return c.json({ personId, grant }, 200);
 });
-var enrol_person_default = app39;
+var enrol_person_default = app41;
 
 // server/routes/admin/browser.ts
-var app40 = new Hono();
-app40.post("/launch", requireAdminSession, async (c) => {
+var app42 = new Hono();
+app42.post("/launch", requireAdminSession, async (c) => {
   try {
     const transport = resolveBrowserTransport(c.req.raw, c.env?.incoming?.socket?.remoteAddress);
     console.error(`[admin/browser/launch] op=request transport=${transport}`);
@@ -15989,50 +16483,51 @@ app40.post("/launch", requireAdminSession, async (c) => {
     );
   }
 });
-var browser_default = app40;
+var browser_default = app42;
 
 // server/routes/admin/index.ts
-var app41 = new Hono();
-app41.route("/session", session_default);
-app41.route("/logs", logs_default);
-app41.route("/claude-info", claude_info_default);
-app41.route("/attachment", attachment_default);
-app41.route("/agents", agents_default);
-app41.route("/sessions", sessions_default);
-app41.route("/claude-sessions", claude_sessions_default);
-app41.route("/log-ingest", log_ingest_default);
-app41.route("/events", events_default);
-app41.route("/files", files_default);
-app41.route("/graph-search", graph_search_default);
-app41.route("/graph-subgraph", graph_subgraph_default);
-app41.route("/graph-delete", graph_delete_default);
-app41.route("/graph-restore", graph_restore_default);
-app41.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app41.route("/graph-default-view", graph_default_view_default);
-app41.route("/sidebar-artefacts", sidebar_artefacts_default);
-app41.route("/sidebar-sessions", sidebar_sessions_default);
-app41.route("/session-delete", session_delete_default);
-app41.route("/session-stop", session_stop_default);
-app41.route("/session-archive", session_archive_default);
-app41.route("/browser", browser_default);
-app41.route("/session-rc-spawn", session_rc_spawn_default);
-app41.route("/session-reseat", session_reseat_default);
-app41.route("/system-stats", system_stats_default);
-app41.route("/health-brand", health_default2);
-app41.route("/linkedin-ingest", linkedin_ingest_default);
-app41.route("/post-turn-context", post_turn_context_default);
-app41.route("/public-session-context", public_session_context_default);
-app41.route("/public-session-exit", public_session_exit_default);
-app41.route("/access-session-evict", access_session_evict_default);
-app41.route("/enrol-person", enrol_person_default);
-var admin_default = app41;
+var app43 = new Hono();
+app43.route("/session", session_default);
+app43.route("/logs", logs_default);
+app43.route("/claude-info", claude_info_default);
+app43.route("/attachment", attachment_default);
+app43.route("/agents", agents_default);
+app43.route("/sessions", sessions_default);
+app43.route("/claude-sessions", claude_sessions_default);
+app43.route("/log-ingest", log_ingest_default);
+app43.route("/events", events_default);
+app43.route("/files", files_default);
+app43.route("/graph-search", graph_search_default);
+app43.route("/graph-subgraph", graph_subgraph_default);
+app43.route("/graph-delete", graph_delete_default);
+app43.route("/graph-restore", graph_restore_default);
+app43.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app43.route("/graph-default-view", graph_default_view_default);
+app43.route("/sidebar-artefacts", sidebar_artefacts_default);
+app43.route("/sidebar-sessions", sidebar_sessions_default);
+app43.route("/session-delete", session_delete_default);
+app43.route("/session-stop", session_stop_default);
+app43.route("/session-archive", session_archive_default);
+app43.route("/session-rename", session_rename_default);
+app43.route("/browser", browser_default);
+app43.route("/session-rc-spawn", session_rc_spawn_default);
+app43.route("/session-reseat", session_reseat_default);
+app43.route("/system-stats", system_stats_default);
+app43.route("/health-brand", health_default2);
+app43.route("/linkedin-ingest", linkedin_ingest_default);
+app43.route("/post-turn-context", post_turn_context_default);
+app43.route("/public-session-context", public_session_context_default);
+app43.route("/public-session-exit", public_session_exit_default);
+app43.route("/access-session-evict", access_session_evict_default);
+app43.route("/enrol-person", enrol_person_default);
+var admin_default = app43;
 
 // server/routes/access/verify-token.ts
-var TAG32 = "[access-verify]";
+var TAG33 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
-var app42 = new Hono();
-app42.post("/", async (c) => {
+var app44 = new Hono();
+app44.post("/", async (c) => {
   const ip = c.var.clientIp || "unknown";
   let body;
   try {
@@ -16047,39 +16542,39 @@ app42.post("/", async (c) => {
   }
   const rateMsg = checkAccessRateLimit(ip, agentSlug);
   if (rateMsg) {
-    console.error(`${TAG32} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
+    console.error(`${TAG33} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
     return c.json({ error: rateMsg }, 429);
   }
   const grant = await findGrantByMagicToken(token);
   if (!grant) {
     recordAccessFailedAttempt(ip, agentSlug);
-    console.error(`${TAG32} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
+    console.error(`${TAG33} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.agentSlug !== agentSlug) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG32} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
+      `${TAG33} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
     );
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.status === "expired" || grant.status === "revoked") {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG32} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
+      `${TAG33} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (grant.expiresAt !== null && grant.expiresAt < Date.now()) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG32} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
+      `${TAG33} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (!grant.sliceToken) {
     console.error(
-      `${TAG32} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
+      `${TAG33} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
     );
     return c.json({ error: "grant-misconfigured" }, 500);
   }
@@ -16095,12 +16590,12 @@ app42.post("/", async (c) => {
     await consumeMagicTokenAndActivate(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG32} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG33} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ error: "verification-failed" }, 500);
   }
   clearAccessRateLimit(ip, agentSlug);
-  console.log(`${TAG32} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
+  console.log(`${TAG33} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
   console.log(
     `${MINT_TAG} grantId=${grant.grantId} sliceToken=${grant.sliceToken.slice(0, 8)} agentSlug=${agentSlug} personId=${grant.personId ?? "none"}`
   );
@@ -16114,7 +16609,7 @@ app42.post("/", async (c) => {
     displayName: grant.displayName
   });
 });
-var verify_token_default = app42;
+var verify_token_default = app44;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
@@ -16176,10 +16671,10 @@ async function sendMagicLinkEmail(payload) {
 }
 
 // server/routes/access/request-magic-link.ts
-var TAG33 = "[access-request-link]";
-var app43 = new Hono();
+var TAG34 = "[access-request-link]";
+var app45 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
-app43.post("/", async (c) => {
+app45.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -16193,18 +16688,18 @@ app43.post("/", async (c) => {
   }
   const rateMsg = checkRequestLinkRateLimit(contactValue);
   if (rateMsg) {
-    console.error(`${TAG33} contactValue=${maskContact(contactValue)} result=rate-limited`);
+    console.error(`${TAG34} contactValue=${maskContact(contactValue)} result=rate-limited`);
     return c.json({ error: rateMsg }, 429);
   }
   recordRequestLinkAttempt(contactValue);
   const accountId = process.env.ACCOUNT_ID ?? "";
   if (!accountId) {
-    console.error(`${TAG33} contactValue=${maskContact(contactValue)} result=no-account-id`);
+    console.error(`${TAG34} contactValue=${maskContact(contactValue)} result=no-account-id`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   const grant = await findActiveGrantByContact(contactValue, agentSlug, accountId);
   if (!grant) {
-    console.log(`${TAG33} contactValue=${maskContact(contactValue)} result=notfound`);
+    console.log(`${TAG34} contactValue=${maskContact(contactValue)} result=notfound`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   let token;
@@ -16212,7 +16707,7 @@ app43.post("/", async (c) => {
     token = await generateNewMagicToken(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG33} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG34} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
@@ -16244,25 +16739,25 @@ app43.post("/", async (c) => {
   });
   if (!sendResult.ok) {
     console.error(
-      `${TAG33} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
+      `${TAG34} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   console.log(
-    `${TAG33} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
+    `${TAG34} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
-var request_magic_link_default = app43;
+var request_magic_link_default = app45;
 
 // server/routes/access/index.ts
-var app44 = new Hono();
-app44.route("/verify-token", verify_token_default);
-app44.route("/request-magic-link", request_magic_link_default);
-var access_default = app44;
+var app46 = new Hono();
+app46.route("/verify-token", verify_token_default);
+app46.route("/request-magic-link", request_magic_link_default);
+var access_default = app46;
 
 // server/routes/sites.ts
-import { existsSync as existsSync23, readFileSync as readFileSync23, realpathSync as realpathSync5, statSync as statSync11 } from "fs";
+import { existsSync as existsSync26, readFileSync as readFileSync25, realpathSync as realpathSync5, statSync as statSync11 } from "fs";
 import { resolve as resolve26 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
@@ -16294,8 +16789,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app45 = new Hono();
-app45.get("/:rel{.*}", (c) => {
+var app47 = new Hono();
+app47.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -16328,7 +16823,7 @@ app45.get("/:rel{.*}", (c) => {
   }
   let stat7;
   try {
-    stat7 = existsSync23(filePath) ? statSync11(filePath) : null;
+    stat7 = existsSync26(filePath) ? statSync11(filePath) : null;
   } catch {
     stat7 = null;
   }
@@ -16347,7 +16842,7 @@ app45.get("/:rel{.*}", (c) => {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync23(filePath)) {
+  if (!existsSync26(filePath)) {
     console.error(`[sites] not-found path=${reqPath} status=404`);
     return c.text("Not found", 404);
   }
@@ -16366,7 +16861,7 @@ app45.get("/:rel{.*}", (c) => {
   }
   let body;
   try {
-    body = readFileSync23(realPath);
+    body = readFileSync25(realPath);
   } catch (err) {
     const code = err?.code;
     if (code === "EISDIR") {
@@ -16398,11 +16893,11 @@ app45.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app45;
+var sites_default = app47;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync24, writeFileSync as writeFileSync9 } from "fs";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync26, writeFileSync as writeFileSync11 } from "fs";
 import { dirname as dirname7 } from "path";
 var TOKEN_PREFIX = "v1.";
 var SECRET_BYTES = 32;
@@ -16411,7 +16906,7 @@ var cachedSecret = null;
 function getSecret() {
   if (cachedSecret) return cachedSecret;
   try {
-    const hex2 = readFileSync24(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+    const hex2 = readFileSync26(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
     if (hex2.length === SECRET_BYTES * 2) {
       cachedSecret = Buffer.from(hex2, "hex");
       return cachedSecret;
@@ -16420,12 +16915,12 @@ function getSecret() {
   }
   const fresh = randomBytes(SECRET_BYTES).toString("hex");
   try {
-    mkdirSync4(dirname7(VISITOR_TOKEN_SECRET_FILE), { recursive: true, mode: 448 });
-    writeFileSync9(VISITOR_TOKEN_SECRET_FILE, fresh, { mode: 384, flag: "wx" });
+    mkdirSync6(dirname7(VISITOR_TOKEN_SECRET_FILE), { recursive: true, mode: 448 });
+    writeFileSync11(VISITOR_TOKEN_SECRET_FILE, fresh, { mode: 384, flag: "wx" });
     console.log(`[visitor-token] secret minted path=${VISITOR_TOKEN_SECRET_FILE}`);
   } catch {
   }
-  const hex = readFileSync24(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+  const hex = readFileSync26(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
   cachedSecret = Buffer.from(hex, "hex");
   return cachedSecret;
 }
@@ -16478,8 +16973,8 @@ var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync24, readFileSync as readFileSync25 } from "fs";
-import { join as join23 } from "path";
+import { existsSync as existsSync27, readFileSync as readFileSync27 } from "fs";
+import { join as join25 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
 function readBrandConfig() {
@@ -16487,10 +16982,10 @@ function readBrandConfig() {
   cachedAttempted = true;
   const platformRoot2 = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot2) return null;
-  const brandPath = join23(platformRoot2, "config", "brand.json");
-  if (!existsSync24(brandPath)) return null;
+  const brandPath = join25(platformRoot2, "config", "brand.json");
+  if (!existsSync27(brandPath)) return null;
   try {
-    cached2 = JSON.parse(readFileSync25(brandPath, "utf-8"));
+    cached2 = JSON.parse(readFileSync27(brandPath, "utf-8"));
     return cached2;
   } catch {
     return null;
@@ -16498,7 +16993,7 @@ function readBrandConfig() {
 }
 
 // server/routes/visitor-consent.ts
-var app46 = new Hono();
+var app48 = new Hono();
 var CONSENT_COOKIE_NAME = "mxy_consent";
 var CONSENT_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
 var DEFAULT_CONSENT_COPY = {
@@ -16543,17 +17038,17 @@ function siteSlugFromReferer(referer) {
     return "";
   }
 }
-app46.options("/consent", (c) => {
+app48.options("/consent", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app46.options("/brand-config", (c) => {
+app48.options("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app46.post("/consent", async (c) => {
+app48.post("/consent", async (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   let raw;
@@ -16593,7 +17088,7 @@ app46.post("/consent", async (c) => {
   console.log(`[consent] ${parsed.decision} site=${site} brand=${brandName} tokenBound=${tokenBound}`);
   return c.body(null, 204);
 });
-app46.get("/brand-config", (c) => {
+app48.get("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   const brand = readBrandConfig();
@@ -16603,7 +17098,7 @@ app46.get("/brand-config", (c) => {
   c.header("Cache-Control", "public, max-age=300");
   return c.json({ consent: { copy, palette } });
 });
-var visitor_consent_default = app46;
+var visitor_consent_default = app48;
 
 // server/routes/listings.ts
 function getCookie(headerValue, name) {
@@ -16630,8 +17125,8 @@ function appendConsentParams(pageUrl, token) {
 }
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
 var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
-var app47 = new Hono();
-app47.get("/:slug/click", async (c) => {
+var app49 = new Hono();
+app49.get("/:slug/click", async (c) => {
   const slug = c.req.param("slug") ?? "";
   const rawSession = c.req.query("session") ?? "";
   const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
@@ -16695,10 +17190,10 @@ app47.get("/:slug/click", async (c) => {
   console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} consent=${consentCookie ?? "absent"} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
   return c.redirect(redirectUrl, 302);
 });
-var listings_default = app47;
+var listings_default = app49;
 
 // server/routes/visitor-event.ts
-var app48 = new Hono();
+var app50 = new Hono();
 var BOT_UA_RE = /\b(bot|crawl|spider|slurp|headlesschrome|phantomjs|googlebot|bingbot|yandex|baiduspider|ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)\b/i;
 var buckets = /* @__PURE__ */ new Map();
 var RATE_LIMIT = 60;
@@ -16765,12 +17260,12 @@ function originAllowed(origin, allowlist) {
     return false;
   }
 }
-app48.options("/event", (c) => {
+app50.options("/event", (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   return c.body(null, 204);
 });
-app48.post("/event", async (c) => {
+app50.post("/event", async (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   const ua = c.req.header("user-agent") ?? "";
@@ -16975,17 +17470,17 @@ async function writeEvent(opts) {
     );
   }
 }
-var visitor_event_default = app48;
+var visitor_event_default = app50;
 
 // server/routes/session.ts
 import { resolve as resolve27 } from "path";
-import { existsSync as existsSync25, writeFileSync as writeFileSync10, mkdirSync as mkdirSync5 } from "fs";
+import { existsSync as existsSync28, writeFileSync as writeFileSync12, mkdirSync as mkdirSync7 } from "fs";
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function writeBrandingCache(accountId, agentSlug, branding) {
   try {
     const cacheDir = resolve27(MAXY_DIR, "branding-cache", accountId);
-    mkdirSync5(cacheDir, { recursive: true });
-    writeFileSync10(resolve27(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
+    mkdirSync7(cacheDir, { recursive: true });
+    writeFileSync12(resolve27(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
   } catch (err) {
     console.error(`[branding] cache write failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -17021,8 +17516,8 @@ function withVisitorCookie(response, visitorId) {
     headers
   });
 }
-var app49 = new Hono();
-app49.post("/", async (c) => {
+var app51 = new Hono();
+app51.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -17074,7 +17569,7 @@ app49.post("/", async (c) => {
   let agentConfig = null;
   if (account) {
     const agentDir = resolve27(account.accountDir, "agents", agentSlug);
-    if (!existsSync25(agentDir) || !existsSync25(resolve27(agentDir, "config.json"))) {
+    if (!existsSync28(agentDir) || !existsSync28(resolve27(agentDir, "config.json"))) {
       return c.json({ error: "Agent not found" }, 404);
     }
     agentConfig = resolveAgentConfig(account.accountDir, agentSlug);
@@ -17233,7 +17728,7 @@ app49.post("/", async (c) => {
     newVisitorId
   );
 });
-var session_default2 = app49;
+var session_default2 = app51;
 
 // app/lib/graph-health.ts
 var import_dist4 = __toESM(require_dist3(), 1);
@@ -17579,9 +18074,9 @@ async function migrateUploads(opts = {}) {
 }
 
 // app/lib/migrate-admin-webchat-sidecars.ts
-import { readdir as readdir6, readFile as readFile6, rename as rename3, writeFile as writeFile5, unlink as unlink3 } from "fs/promises";
-import { existsSync as existsSync26 } from "fs";
-import { join as join24 } from "path";
+import { readdir as readdir6, readFile as readFile6, rename as rename3, writeFile as writeFile4, unlink as unlink3 } from "fs/promises";
+import { existsSync as existsSync29 } from "fs";
+import { join as join26 } from "path";
 var ADMIN_ROLE2 = "admin";
 var WEBCHAT_CHANNEL2 = "webchat";
 var SESSION_META_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.meta\.json$/i;
@@ -17606,11 +18101,11 @@ async function readRaw(path2) {
 async function writeRaw(path2, obj) {
   const tmp = `${path2}.tmp.${process.pid}.${Date.now()}`;
   try {
-    await writeFile5(tmp, JSON.stringify(obj, null, 2), "utf8");
+    await writeFile4(tmp, JSON.stringify(obj, null, 2), "utf8");
     await rename3(tmp, path2);
   } catch (err) {
     try {
-      if (existsSync26(tmp)) await unlink3(tmp);
+      if (existsSync29(tmp)) await unlink3(tmp);
     } catch {
     }
     throw err;
@@ -17626,7 +18121,7 @@ async function collectLiveSidecars(projectsRoot) {
   }
   for (const slug of slugs) {
     if (!slug.isDirectory()) continue;
-    const slugDir = join24(projectsRoot, slug.name);
+    const slugDir = join26(projectsRoot, slug.name);
     let entries;
     try {
       entries = await readdir6(slugDir, { withFileTypes: true });
@@ -17635,9 +18130,9 @@ async function collectLiveSidecars(projectsRoot) {
     }
     for (const entry of entries) {
       if (entry.isFile() && SESSION_META_RE.test(entry.name)) {
-        out.push(join24(slugDir, entry.name));
+        out.push(join26(slugDir, entry.name));
       } else if (entry.isDirectory() && entry.name === "subagents") {
-        const subDir = join24(slugDir, entry.name);
+        const subDir = join26(slugDir, entry.name);
         let subs;
         try {
           subs = await readdir6(subDir, { withFileTypes: true });
@@ -17645,7 +18140,7 @@ async function collectLiveSidecars(projectsRoot) {
           continue;
         }
         for (const s of subs) {
-          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join24(subDir, s.name));
+          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join26(subDir, s.name));
         }
       }
     }
@@ -17657,7 +18152,7 @@ function shortId(path2) {
   return base.slice(0, 8);
 }
 async function migrateAdminWebchatSidecars(opts = {}) {
-  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join24(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
+  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join26(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
   const usersFile = opts.usersFile ?? USERS_FILE;
   const accountId = opts.accountId ?? resolveAccount()?.accountId ?? null;
   const resolveName = opts.resolveName ?? defaultResolveName;
@@ -17999,8 +18494,8 @@ var streamSSE = (c, cb, onError) => {
 
 // app/lib/whatsapp/gateway/routes.ts
 function createWaChannelRoutes(deps) {
-  const app51 = new Hono();
-  app51.get("/wa-channel/inbound", (c) => {
+  const app53 = new Hono();
+  app53.get("/wa-channel/inbound", (c) => {
     const senderId = c.req.query("senderId");
     if (!senderId) return c.json({ error: "senderId required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -18018,7 +18513,7 @@ function createWaChannelRoutes(deps) {
       }
     });
   });
-  app51.post("/wa-channel/reply", async (c) => {
+  app53.post("/wa-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const text = body?.text;
@@ -18039,7 +18534,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=reply-dispatch senderId=${senderId} bytes=${bytes}`);
     return c.json({ ok: true });
   });
-  app51.post("/wa-channel/reply-document", async (c) => {
+  app53.post("/wa-channel/reply-document", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const files = body?.files;
@@ -18078,7 +18573,7 @@ function createWaChannelRoutes(deps) {
     }
     return c.json({ ok: true, results });
   });
-  app51.post("/wa-channel/ready", async (c) => {
+  app53.post("/wa-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     if (typeof senderId !== "string") {
@@ -18087,7 +18582,7 @@ function createWaChannelRoutes(deps) {
     deps.onReady?.(senderId);
     return c.json({ ok: true });
   });
-  app51.post("/wa-channel/received", async (c) => {
+  app53.post("/wa-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const waMessageId = body?.waMessageId;
@@ -18097,7 +18592,7 @@ function createWaChannelRoutes(deps) {
     deps.onReceived?.(senderId, waMessageId);
     return c.json({ ok: true });
   });
-  app51.post("/wa-channel/turn-end", async (c) => {
+  app53.post("/wa-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const sessionId = body?.sessionId;
@@ -18128,7 +18623,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=turn-end sessionId=${sid} replied=no delivered=fallback bytes=${bytes}`);
     return c.json({ ok: true, delivered: "fallback" });
   });
-  return app51;
+  return app53;
 }
 
 // app/lib/whatsapp/gateway/wa-gateway.ts
@@ -18381,8 +18876,8 @@ var InboundHub2 = class {
 
 // app/lib/webchat/gateway/routes.ts
 function createWebchatChannelRoutes(deps) {
-  const app51 = new Hono();
-  app51.get("/webchat-channel/inbound", (c) => {
+  const app53 = new Hono();
+  app53.get("/webchat-channel/inbound", (c) => {
     const key = c.req.query("key");
     if (!key) return c.json({ error: "key required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -18400,7 +18895,7 @@ function createWebchatChannelRoutes(deps) {
       }
     });
   });
-  app51.post("/webchat-channel/reply", async (c) => {
+  app53.post("/webchat-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const text = body?.text;
@@ -18410,7 +18905,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReply?.(key, text);
     return c.json({ ok: true });
   });
-  app51.post("/webchat-channel/ready", async (c) => {
+  app53.post("/webchat-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     if (typeof key !== "string") {
@@ -18419,7 +18914,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReady?.(key);
     return c.json({ ok: true });
   });
-  app51.post("/webchat-channel/received", async (c) => {
+  app53.post("/webchat-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const messageId = body?.messageId;
@@ -18429,7 +18924,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReceived?.(key, messageId);
     return c.json({ ok: true });
   });
-  return app51;
+  return app53;
 }
 
 // app/lib/webchat/gateway/webchat-gateway.ts
@@ -18742,7 +19237,7 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash5, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync27, readFileSync as readFileSync26, statSync as statSync12 } from "fs";
+import { existsSync as existsSync30, readFileSync as readFileSync28, statSync as statSync12 } from "fs";
 import { resolve as resolve30 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
@@ -18791,7 +19286,7 @@ function resolveEntitlement(brand, account) {
     return logResolved(implicitTrust(account), null);
   }
   const entitlementPath = resolve30(brand.configDir, "entitlement.json");
-  if (!existsSync27(entitlementPath)) {
+  if (!existsSync30(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
   const stat7 = statSync12(entitlementPath);
@@ -18806,7 +19301,7 @@ function resolveEntitlement(brand, account) {
 function verifyAndResolve(brand, entitlementPath, account) {
   let pubkeyPem;
   try {
-    pubkeyPem = readFileSync26(pubkeyPath(brand), "utf-8");
+    pubkeyPem = readFileSync28(pubkeyPath(brand), "utf-8");
   } catch (err) {
     return logResolved(anonymousFallback("pubkey-missing"), {
       reason: "pubkey-missing"
@@ -18820,7 +19315,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(readFileSync26(entitlementPath, "utf-8"));
+    envelope = JSON.parse(readFileSync28(entitlementPath, "utf-8"));
   } catch {
     return logResolved(anonymousFallback("malformed"), { reason: "malformed" });
   }
@@ -18981,14 +19476,14 @@ function clientFrom(c) {
   );
 }
 var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join25(PLATFORM_ROOT8, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join27(PLATFORM_ROOT8, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync28(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync31(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync28(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync31(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync27(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync29(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -19007,11 +19502,11 @@ var brandLoginOpts = {
   bodyFont: BRAND.defaultFonts?.body,
   logoContainsName: !!BRAND.logoContainsName
 };
-var ALIAS_DOMAINS_PATH = join25(homedir3(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join27(homedir3(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync28(ALIAS_DOMAINS_PATH)) return null;
-    const parsed = JSON.parse(readFileSync27(ALIAS_DOMAINS_PATH, "utf-8"));
+    if (!existsSync31(ALIAS_DOMAINS_PATH)) return null;
+    const parsed = JSON.parse(readFileSync29(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -19035,11 +19530,11 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app50 = new Hono();
+var app52 = new Hono();
 var nativeFileFollowers = /* @__PURE__ */ new Map();
 var waGateway = new WaGateway({
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve31(process.env.MAXY_PLATFORM_ROOT ?? join25(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve31(process.env.MAXY_PLATFORM_ROOT ?? join27(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 — file delivery on the native channel: resolve the platform
   // account + path validation here and funnel through the shared send core.
   sendDocument: async ({ senderId, accountId, filePath, caption }) => {
@@ -19055,7 +19550,7 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve31(process.env.MAXY_PLATFORM_ROOT ?? join25(__dirname, ".."))
+      platformRoot: resolve31(process.env.MAXY_PLATFORM_ROOT ?? join27(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
@@ -19085,7 +19580,7 @@ var waGateway = new WaGateway({
     nativeFileFollowers.set(senderId, ac);
   }
 });
-app50.route("/", waGateway.routes());
+app52.route("/", waGateway.routes());
 waGateway.startSweeper();
 var webchatGateway = new WebchatGateway({
   gatewayUrl: webchatGatewayUrl(),
@@ -19125,15 +19620,15 @@ var webchatGateway = new WebchatGateway({
   deleteSession: (sessionId) => managerDelete(sessionId),
   firePublicSessionEndReview: (input) => firePublicSessionEndReview(input)
 });
-app50.route("/", webchatGateway.routes());
+app52.route("/", webchatGateway.routes());
 webchatGateway.startSweeper();
 webchatGateway.startPublicReaper();
 var chatRoutes = createChatRoutes({
   handleInbound: (input) => webchatGateway.handleInbound(input),
   awaitReply: (key, timeoutMs) => webchatGateway.awaitReply(key, timeoutMs)
 });
-app50.use("*", clientIpMiddleware);
-app50.use("*", async (c, next) => {
+app52.use("*", clientIpMiddleware);
+app52.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -19143,7 +19638,7 @@ app50.use("*", async (c, next) => {
   );
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app50.use("*", async (c, next) => {
+app52.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -19161,7 +19656,7 @@ app50.use("*", async (c, next) => {
     });
   }
 });
-app50.use("*", async (c, next) => {
+app52.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isOperatorHost(host, getOperatorDomains()) || !isPublicHost(host)) {
     await next();
@@ -19192,7 +19687,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app50.post("/__remote-auth/login", async (c) => {
+app52.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -19237,7 +19732,7 @@ app50.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app50.get("/__remote-auth/logout", (c) => {
+app52.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -19250,7 +19745,7 @@ app50.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app50.post("/__remote-auth/change-password", async (c) => {
+app52.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -19309,13 +19804,13 @@ app50.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app50.get("/__remote-auth/setup", (c) => {
+app52.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app50.post("/__remote-auth/set-initial-password", async (c) => {
+app52.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -19353,10 +19848,10 @@ app50.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app50.get("/api/remote-auth/status", (c) => {
+app52.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app50.post("/api/remote-auth/set-password", async (c) => {
+app52.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -19395,10 +19890,10 @@ app50.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app50.route("/api/_client-error", client_error_default);
+app52.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
 var PWA_PUBLIC_PATHS = /* @__PURE__ */ new Set(["/sw.js", ...PWA_SURFACES.map((s) => s.manifestPath)]);
-app50.use("*", async (c, next) => {
+app52.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/") || PWA_PUBLIC_PATHS.has(path2)) {
@@ -19438,18 +19933,19 @@ app50.use("*", async (c, next) => {
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), redirect: path2 }), 200);
 });
-app50.route("/api/health", health_default);
-app50.route("/api/chat", chatRoutes);
-app50.route("/api/whatsapp", whatsapp_default);
-app50.route("/api/whatsapp-reader", whatsapp_reader_default);
-app50.route("/api/public-reader", public_reader_default);
-app50.route("/api/webchat", createWebchatRoutes({ handleInbound: (input) => webchatGateway.handleInbound(input) }));
-app50.route("/api/webchat/greeting", webchat_greeting_default);
-app50.route("/api/telegram", telegram_default);
-app50.route("/api/onboarding", onboarding_default);
-app50.route("/api/admin", admin_default);
-app50.route("/api/access", access_default);
-app50.route("/api/session", session_default2);
+app52.route("/api/health", health_default);
+app52.route("/api/chat", chatRoutes);
+app52.route("/api/whatsapp", whatsapp_default);
+app52.route("/api/whatsapp-reader", whatsapp_reader_default);
+app52.route("/api/public-reader", public_reader_default);
+app52.route("/api/webchat", createWebchatRoutes({ handleInbound: (input) => webchatGateway.handleInbound(input) }));
+app52.route("/api/webchat/greeting", webchat_greeting_default);
+app52.route("/api/telegram", telegram_default);
+app52.route("/api/quickbooks", quickbooks_default);
+app52.route("/api/onboarding", onboarding_default);
+app52.route("/api/admin", admin_default);
+app52.route("/api/access", access_default);
+app52.route("/api/session", session_default2);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -19461,7 +19957,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app50.get("/agent-assets/:slug/:filename", (c) => {
+app52.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -19483,20 +19979,20 @@ app50.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync28(filePath)) {
+  if (!existsSync31(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync27(filePath);
+  const body = readFileSync29(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
   });
 });
-app50.get("/generated/:filename", (c) => {
+app52.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -19513,29 +20009,29 @@ app50.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync28(filePath)) {
+  if (!existsSync31(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync27(filePath);
+  const body = readFileSync29(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
   });
 });
-app50.route("/sites", sites_default);
-app50.route("/listings", listings_default);
-app50.route("/v", visitor_event_default);
-app50.route("/v", visitor_consent_default);
+app52.route("/sites", sites_default);
+app52.route("/listings", listings_default);
+app52.route("/v", visitor_event_default);
+app52.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync28(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync31(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync27(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync29(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -19552,10 +20048,10 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 var brandThemeColor = BRAND.defaultColors?.primary ?? "#000000";
 var brandBackgroundColor = BRAND.defaultColors?.background ?? "#ffffff";
 var brandIconFsPath = resolve31(process.cwd(), "public", brandIconPath.replace(/^\//, ""));
-var brandIconExists = existsSync28(brandIconFsPath);
+var brandIconExists = existsSync31(brandIconFsPath);
 var SW_SOURCE = (() => {
   try {
-    return readFileSync27(resolve31(process.cwd(), "public", "sw.js"), "utf-8");
+    return readFileSync29(resolve31(process.cwd(), "public", "sw.js"), "utf-8");
   } catch {
     return null;
   }
@@ -19563,9 +20059,9 @@ var SW_SOURCE = (() => {
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT8) return "unknown";
-    const versionFile = join25(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync28(versionFile)) return "unknown";
-    const content = readFileSync27(versionFile, "utf-8").trim();
+    const versionFile = join27(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
+    if (!existsSync31(versionFile)) return "unknown";
+    const content = readFileSync29(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -19606,7 +20102,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync27(resolve31(process.cwd(), "public", file), "utf-8");
+    html = readFileSync29(resolve31(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -19624,13 +20120,13 @@ ${clientErrorReporterScript}
 }
 var brandedHtmlCache = /* @__PURE__ */ new Map();
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join25(homedir3(), BRAND.configDir);
+  const configDir2 = join27(homedir3(), BRAND.configDir);
   try {
     const accountId = getDefaultAccountId();
     if (!accountId) return null;
-    const cachePath = join25(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync28(cachePath)) return null;
-    return JSON.parse(readFileSync27(cachePath, "utf-8"));
+    const cachePath = join27(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    if (!existsSync31(cachePath)) return null;
+    return JSON.parse(readFileSync29(cachePath, "utf-8"));
   } catch {
     return null;
   }
@@ -19676,7 +20172,7 @@ function escapeHtml(s) {
 function agentUnavailableHtml() {
   return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escapeHtml(BRAND.productName)}</title></head><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1.5rem;color:#222"><h1 style="font-size:1.25rem">Agent unavailable</h1><p>This agent isn't available right now. If you reached this page from a saved link, the agent may have been turned off.</p></body></html>`;
 }
-app50.get("/", (c) => {
+app52.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const klass = classifyHost(host, getOperatorDomains(), isPublicHost);
   if (klass === "operator") {
@@ -19699,13 +20195,13 @@ app50.get("/", (c) => {
   console.log(`[host-class] host=${host} class=admin served=index.html`);
   return c.html(cachedHtml("index.html"));
 });
-app50.get("/public", (c) => {
+app52.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   if (wantsNextSurface(c)) return c.html(cachedHtml("public-next.html"));
   return c.html(cachedHtml("public.html"));
 });
-app50.get("/public-chat", (c) => {
+app52.get("/public-chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   if (wantsNextSurface(c)) return c.html(cachedHtml("public-next.html"));
@@ -19725,12 +20221,12 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app50.use("/vnc-viewer.html", logViewerFetch);
-app50.use("/vnc-popout.html", logViewerFetch);
-app50.get("/vnc-popout.html", (c) => {
+app52.use("/vnc-viewer.html", logViewerFetch);
+app52.use("/vnc-popout.html", logViewerFetch);
+app52.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync27(resolve31(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync29(resolve31(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -19740,7 +20236,7 @@ app50.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app50.post("/api/vnc/client-event", async (c) => {
+app52.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -19761,11 +20257,11 @@ app50.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app50.get("/g/:slug", (c) => {
+app52.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
 for (const pwa of PWA_SURFACES) {
-  app50.get(pwa.manifestPath, (c) => {
+  app52.get(pwa.manifestPath, (c) => {
     const manifest = buildManifest(pwa, {
       productName: BRAND.productName,
       iconPath: brandIconPath,
@@ -19779,7 +20275,7 @@ for (const pwa of PWA_SURFACES) {
     return c.body(JSON.stringify(manifest));
   });
 }
-app50.get("/sw.js", (c) => {
+app52.get("/sw.js", (c) => {
   if (SW_SOURCE == null) {
     console.error("[pwa] op=sw status=500 reason=sw-source-missing");
     return c.text("Service worker unavailable", 500);
@@ -19788,27 +20284,27 @@ app50.get("/sw.js", (c) => {
   console.log(`[pwa] op=sw status=200 ct=${SW_CONTENT_TYPE}`);
   return c.body(SW_SOURCE);
 });
-app50.get("/graph", (c) => {
+app52.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app50.get("/chat", (c) => {
+app52.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("chat.html"));
 });
-app50.get("/data", (c) => {
+app52.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app50.get("/browser", (c) => {
+app52.get("/browser", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("browser.html"));
 });
-app50.get("/:slug", async (c, next) => {
+app52.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const account = resolveAccount();
@@ -19824,13 +20320,13 @@ app50.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app50.get("/favicon.ico", (c) => {
+  app52.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app50.use("/*", serveStatic({ root: "./public" }));
-app50.all("*", (c) => {
+app52.use("/*", serveStatic({ root: "./public" }));
+app52.all("*", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (isPublicHost(host)) {
@@ -19844,7 +20340,7 @@ app50.all("*", (c) => {
 });
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app50.fetch, port, hostname });
+var httpServer = serve({ fetch: app52.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const census = pwaCensus({
@@ -19898,7 +20394,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app50.routes ?? []) {
+  for (const r of app52.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -19938,11 +20434,11 @@ try {
 var ADMINUSER_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 async function runAdminUserReconcileTick() {
   try {
-    if (!existsSync28(USERS_FILE)) {
+    if (!existsSync31(USERS_FILE)) {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
-    const usersRaw = readFileSync27(USERS_FILE, "utf-8").trim();
+    const usersRaw = readFileSync29(USERS_FILE, "utf-8").trim();
     if (!usersRaw) {
       console.error("[adminuser-self-heal] skip reason=empty-users-file");
       return;
@@ -19974,6 +20470,7 @@ void migrateUploads().catch((err) => console.error(`[uploads-migrate] failed err
     console.error(`[file-watcher] start-failed err="${err instanceof Error ? err.message : String(err)}"`);
   });
 });
+void sweepStaleUploadTemps().catch((err) => console.error(`[data-upload] op=sweep-failed err="${err instanceof Error ? err.message : String(err)}"`));
 void migrateAdminWebchatSidecars().catch((err) => console.error(`[sidecar-backfill] failed err="${err instanceof Error ? err.message : String(err)}"`));
 try {
   const accounts = enumerateValidAccountIds(getAccountsDirFromEnv());
@@ -20055,7 +20552,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve31(process.env.MAXY_PLATFORM_ROOT ?? join25(__dirname, "..")),
+  platformRoot: resolve31(process.env.MAXY_PLATFORM_ROOT ?? join27(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (msg.isOwnerMirror) {