@rubytech/create-maxy-code 0.1.33 → 0.1.35

package/payload/server/server.js

@@ -60,7 +60,7 @@ import {
   vncLog,
   waitForExit,
   walkPremiumBundles
-} from "./chunk-ZGJ6CUU2.js";
+} from "./chunk-3G6JMV7N.js";
 import {
   CLOUDFLARE_TASK_DIAGNOSTICS,
   appendCloudflareSteps,
@@ -69,7 +69,7 @@ import {
   openCloudflareTask,
   readTunnelState,
   resolveUnitGoneVerdict
-} from "./chunk-RZQMYJVY.js";
+} from "./chunk-QC5LHYPH.js";
 import {
   GREETING_DIRECTIVE,
   HAIKU_MODEL,
@@ -85,6 +85,7 @@ import {
   getUserTimezone,
   listAdminSessions,
   loadAdminUserName,
+  loadUserProfile,
   persistMessage,
   projectAgent,
   renameConversation,
@@ -92,35 +93,14 @@ import {
   verifyAndGetConversationUpdatedAt,
   verifyConversationOwnership,
   writeAdminUserAndPerson
-} from "./chunk-KVGTWNKQ.js";
+} from "./chunk-NNHHGQJL.js";
 import {
   __commonJS,
   __toESM
 } from "./chunk-JSBRDJBE.js";
 
-// ../lib/models/dist/index.js
-var require_dist = __commonJS({
-  "../lib/models/dist/index.js"(exports) {
-    "use strict";
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.MODEL_CONTEXT_WINDOW = exports.HAIKU_MODEL = exports.SONNET_MODEL = exports.OPUS_MODEL = void 0;
-    exports.contextWindow = contextWindow;
-    exports.OPUS_MODEL = "claude-opus-4-7";
-    exports.SONNET_MODEL = "claude-sonnet-4-6";
-    exports.HAIKU_MODEL = "claude-haiku-4-5";
-    exports.MODEL_CONTEXT_WINDOW = {
-      [exports.OPUS_MODEL]: 2e5,
-      [exports.SONNET_MODEL]: 2e5,
-      [exports.HAIKU_MODEL]: 2e5
-    };
-    function contextWindow(model) {
-      return exports.MODEL_CONTEXT_WINDOW[model] ?? 2e5;
-    }
-  }
-});
-
 // ../lib/graph-trash/dist/index.js
-var require_dist2 = __commonJS({
+var require_dist = __commonJS({
   "../lib/graph-trash/dist/index.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -616,14 +596,14 @@ var serveStatic = (options = { root: "" }) => {
 
 // server/index.ts
 import { readFileSync as readFileSync19, existsSync as existsSync22, watchFile } from "fs";
-import { resolve as resolve22, join as join13, basename as basename5 } from "path";
-import { homedir as homedir5 } from "os";
+import { resolve as resolve22, join as join12, basename as basename5 } from "path";
+import { homedir as homedir4 } from "os";
 
 // app/lib/agent-slug-pattern.ts
 var AGENT_SLUG_PATTERN = /^\/([a-z][a-z0-9-]{2,49})$/;
 
 // server/routes/health.ts
-import { existsSync as existsSync4, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync5 } from "fs";
 import { createConnection as createConnection2 } from "net";
 
 // app/lib/claude-auth.ts
@@ -820,168 +800,6 @@ function getLanIp() {
   return fallback;
 }
 
-// ../lib/anthropic-key/src/index.ts
-var import_dist = __toESM(require_dist());
-import {
-  existsSync as existsSync2,
-  mkdirSync,
-  readFileSync as readFileSync2,
-  unlinkSync,
-  writeFileSync as writeFileSync2
-} from "fs";
-import { resolve, join as join2, dirname } from "path";
-import { homedir } from "os";
-var cachedKeyFilePath = null;
-function resolveKeyFilePath() {
-  if (cachedKeyFilePath) return cachedKeyFilePath;
-  let configDirName = ".maxy";
-  const platformRoot = process.env.PLATFORM_ROOT ?? process.env.MAXY_PLATFORM_ROOT;
-  if (platformRoot) {
-    const brandPath = join2(platformRoot, "config", "brand.json");
-    if (!existsSync2(brandPath)) {
-      throw new Error(
-        `brand.json not found at ${brandPath} \u2014 platform not properly installed`
-      );
-    }
-    try {
-      const brand = JSON.parse(readFileSync2(brandPath, "utf-8"));
-      if (!brand.configDir) {
-        throw new Error(
-          `brand.json at ${brandPath} is missing the configDir field`
-        );
-      }
-      configDirName = brand.configDir;
-    } catch (err) {
-      if (err instanceof SyntaxError) {
-        throw new Error(
-          `brand.json at ${brandPath} is not valid JSON: ${err.message}`
-        );
-      }
-      throw err;
-    }
-  }
-  cachedKeyFilePath = resolve(homedir(), configDirName, ".anthropic-api-key");
-  return cachedKeyFilePath;
-}
-function readKey() {
-  const envKey = process.env.ANTHROPIC_API_KEY;
-  if (envKey && envKey.trim()) {
-    return envKey.trim();
-  }
-  let keyFilePath2;
-  try {
-    keyFilePath2 = resolveKeyFilePath();
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    console.error(`[anthropic-key] path resolution failed: ${msg}`);
-    return null;
-  }
-  if (envKey !== void 0) {
-    console.error(
-      `[anthropic-key] ANTHROPIC_API_KEY env var is set but empty, falling back to file`
-    );
-  }
-  try {
-    const raw = readFileSync2(keyFilePath2, "utf-8").trim();
-    if (!raw) {
-      console.error(
-        `[anthropic-key] key file exists but is empty: ${keyFilePath2}`
-      );
-      return null;
-    }
-    return raw;
-  } catch (err) {
-    const code = err instanceof Error && "code" in err ? err.code : void 0;
-    if (code === "ENOENT") {
-      console.error(
-        `[anthropic-key] no key available (env var unset, file not found: ${keyFilePath2})`
-      );
-    } else {
-      const msg = err instanceof Error ? err.message : String(err);
-      console.error(
-        `[anthropic-key] failed to read key file ${keyFilePath2}: ${msg}`
-      );
-    }
-    return null;
-  }
-}
-async function validateKey(key) {
-  const effectiveKey = key ?? readKey();
-  if (!effectiveKey) {
-    return {
-      status: "missing",
-      message: "No API key available (env var unset, file missing or empty)."
-    };
-  }
-  const start = Date.now();
-  try {
-    const res = await fetch("https://api.anthropic.com/v1/messages", {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "x-api-key": effectiveKey,
-        "anthropic-version": "2023-06-01"
-      },
-      body: JSON.stringify({
-        model: import_dist.HAIKU_MODEL,
-        max_tokens: 1,
-        messages: [{ role: "user", content: "hi" }]
-      }),
-      signal: AbortSignal.timeout(1e4)
-    });
-    const latency = Date.now() - start;
-    if (res.ok || res.status === 429) {
-      await res.text();
-      console.error(
-        `[anthropic-key] validate: valid (${res.status}, ${latency}ms)`
-      );
-      return {
-        status: "valid",
-        message: "API key is working. Credits available."
-      };
-    }
-    const body = await res.text();
-    if (/credit balance|billing|purchase credits/i.test(body)) {
-      console.error(
-        `[anthropic-key] validate: billing (${res.status}, ${latency}ms)`
-      );
-      return {
-        status: "billing",
-        message: "API key is valid but credit balance is too low. The user must add credits at console.anthropic.com under Plans & Billing, or enable auto-top-up."
-      };
-    }
-    if (res.status === 401 || res.status === 403 || /authentication_error|permission_error/i.test(body)) {
-      console.error(
-        `[anthropic-key] validate: auth_error (${res.status}, ${latency}ms)`
-      );
-      return {
-        status: "auth_error",
-        message: "API key was rejected. It may be invalid, revoked, or expired. The user should create a new key at console.anthropic.com/settings/keys."
-      };
-    }
-    console.error(
-      `[anthropic-key] validate: error (${res.status}, ${latency}ms)`
-    );
-    return {
-      status: "error",
-      message: `Could not verify API key. Anthropic returned ${res.status}. This may be a temporary outage \u2014 try again later.`
-    };
-  } catch (err) {
-    const latency = Date.now() - start;
-    const msg = err instanceof Error ? err.message : String(err);
-    console.error(
-      `[anthropic-key] validate: error (network failure, ${latency}ms): ${msg}`
-    );
-    return {
-      status: "error",
-      message: `Could not reach the Anthropic API: ${msg}. Check network connectivity.`
-    };
-  }
-}
-function keyFilePath() {
-  return resolveKeyFilePath();
-}
-
 // app/lib/whatsapp/schema.ts
 import { z } from "zod";
 var DmPolicySchema = z.enum(["open", "allowlist", "disabled"]);
@@ -1046,20 +864,20 @@ var WhatsAppConfigSchema = z.object({
 });
 
 // app/lib/whatsapp/config-persist.ts
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync as existsSync3 } from "fs";
-import { resolve as resolve2, join as join3 } from "path";
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync2 } from "fs";
+import { resolve, join as join2 } from "path";
 var TAG = "[whatsapp:config]";
 function configPath(accountDir) {
-  return resolve2(accountDir, "account.json");
+  return resolve(accountDir, "account.json");
 }
 function readConfig(accountDir) {
   const path2 = configPath(accountDir);
-  if (!existsSync3(path2)) throw new Error(`account.json not found at ${path2}`);
-  return JSON.parse(readFileSync3(path2, "utf-8"));
+  if (!existsSync2(path2)) throw new Error(`account.json not found at ${path2}`);
+  return JSON.parse(readFileSync2(path2, "utf-8"));
 }
 function writeConfig(accountDir, config) {
   const path2 = configPath(accountDir);
-  writeFileSync3(path2, JSON.stringify(config, null, 2) + "\n", "utf-8");
+  writeFileSync2(path2, JSON.stringify(config, null, 2) + "\n", "utf-8");
 }
 function reloadManagerConfig(accountDir) {
   try {
@@ -1229,8 +1047,8 @@ function setPublicAgent(accountDir, slug) {
   if (!trimmed) {
     return { ok: false, error: "Agent slug cannot be empty." };
   }
-  const agentConfigPath = join3(accountDir, "agents", trimmed, "config.json");
-  if (!existsSync3(agentConfigPath)) {
+  const agentConfigPath = join2(accountDir, "agents", trimmed, "config.json");
+  if (!existsSync2(agentConfigPath)) {
     return { ok: false, error: `Agent "${trimmed}" not found \u2014 no config.json at ${agentConfigPath}. Check the agent slug and try again.` };
   }
   try {
@@ -1293,8 +1111,8 @@ function setGroupPublicAgent(accountDir, accountId, groupJid, slug) {
   if (!trimmedSlug) return { ok: false, error: "Agent slug cannot be empty." };
   if (!trimmedGroup) return { ok: false, error: "Group JID cannot be empty." };
   if (!trimmedAccount) return { ok: false, error: "Account ID cannot be empty." };
-  const agentConfigPath = join3(accountDir, "agents", trimmedSlug, "config.json");
-  if (!existsSync3(agentConfigPath)) {
+  const agentConfigPath = join2(accountDir, "agents", trimmedSlug, "config.json");
+  if (!existsSync2(agentConfigPath)) {
     return { ok: false, error: `Agent "${trimmedSlug}" not found \u2014 no config.json at ${agentConfigPath}. Check the agent slug and try again.` };
   }
   try {
@@ -2572,8 +2390,8 @@ async function ensureWhatsAppConversation(input) {
 }
 
 // ../lib/account-enumeration/src/index.ts
-import { readdirSync, readFileSync as readFileSync4 } from "fs";
-import { resolve as resolve3 } from "path";
+import { readdirSync, readFileSync as readFileSync3 } from "fs";
+import { resolve as resolve2 } from "path";
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var cache = /* @__PURE__ */ new Map();
 function enumerateValidAccountIds(accountsDir) {
@@ -2592,9 +2410,9 @@ function enumerateValidAccountIds(accountsDir) {
   const valid = [];
   for (const name of names) {
     if (!UUID_RE.test(name)) continue;
-    const configPath2 = resolve3(accountsDir, name, "account.json");
+    const configPath2 = resolve2(accountsDir, name, "account.json");
     try {
-      JSON.parse(readFileSync4(configPath2, "utf-8"));
+      JSON.parse(readFileSync3(configPath2, "utf-8"));
       valid.push(name);
     } catch (err) {
       const code = err.code;
@@ -2611,7 +2429,7 @@ function getAccountsDirFromEnv() {
       "[graph-write] MAXY_PLATFORM_ROOT not set \u2014 cannot enforce accountId gate. Set MAXY_PLATFORM_ROOT in the spawning process or pass `accountsDir` explicitly."
     );
   }
-  return resolve3(root, "..", "data/accounts");
+  return resolve2(root, "..", "data/accounts");
 }
 function validateAccountIdEnv(envValue, diskIds) {
   if (!envValue) {
@@ -2650,7 +2468,7 @@ function resolvePlatformAccountId(accountsDir = ACCOUNTS_DIR) {
 // app/lib/whatsapp/inbound/media.ts
 import { randomUUID as randomUUID2 } from "crypto";
 import { writeFile, mkdir } from "fs/promises";
-import { join as join4 } from "path";
+import { join as join3 } from "path";
 import {
   downloadMediaMessage,
   downloadContentFromMessage,
@@ -2736,7 +2554,7 @@ async function downloadInboundMedia(msg, sock, opts) {
     await mkdir(MEDIA_DIR, { recursive: true });
     const ext = mimeToExt(mimetype ?? "application/octet-stream");
     const filename = `${randomUUID2()}.${ext}`;
-    const filePath = join4(MEDIA_DIR, filename);
+    const filePath = join3(MEDIA_DIR, filename);
     await writeFile(filePath, buffer);
     const sizeKB = (buffer.length / 1024).toFixed(0);
     console.error(`${TAG9} media downloaded type=${mimetype ?? "unknown"} size=${sizeKB}KB path=${filePath}`);
@@ -3817,10 +3635,10 @@ async function handleInboundMessage(conn, msg) {
 // app/lib/vnc.ts
 import { spawnSync, execFileSync } from "child_process";
 import { createConnection } from "net";
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
-import { resolve as resolve4 } from "path";
-var PLATFORM_ROOT2 = process.env.MAXY_PLATFORM_ROOT ?? resolve4(process.cwd(), "..");
-var VNC_SCRIPT = resolve4(PLATFORM_ROOT2, "scripts/vnc.sh");
+import { mkdirSync, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+import { resolve as resolve3 } from "path";
+var PLATFORM_ROOT2 = process.env.MAXY_PLATFORM_ROOT ?? resolve3(process.cwd(), "..");
+var VNC_SCRIPT = resolve3(PLATFORM_ROOT2, "scripts/vnc.sh");
 var displayMode = process.env.DISPLAY_MODE ?? "virtual";
 if (displayMode === "native") {
   console.log(`[vnc] DISPLAY_MODE=native \u2014 local requests use desktop display, remote requests use VNC`);
@@ -3875,7 +3693,7 @@ function discoverNativeDisplay() {
       const leaderPid = leaderResult.stdout?.trim();
       if (leaderPid) {
         try {
-          const environ = readFileSync5(`/proc/${leaderPid}/environ`, "utf8");
+          const environ = readFileSync4(`/proc/${leaderPid}/environ`, "utf8");
           const match = environ.split("\0").find((e) => e.startsWith("WAYLAND_DISPLAY="));
           if (match) waylandDisplay = match.split("=")[1];
         } catch {
@@ -3930,10 +3748,10 @@ async function waitForPort(port2, timeoutMs = 12e3) {
   return false;
 }
 function ensureLogDir() {
-  mkdirSync2(LOG_DIR, { recursive: true });
+  mkdirSync(LOG_DIR, { recursive: true });
 }
 function logPath(name) {
-  return resolve4(LOG_DIR, `${name}.log`);
+  return resolve3(LOG_DIR, `${name}.log`);
 }
 async function ensureVnc() {
   const up = await waitForPort(RFB_PORT, 1e3);
@@ -4011,9 +3829,9 @@ function killChromium() {
   spawnSync("pkill", ["-f", "chromium"], { stdio: "pipe" });
 }
 function writeChromiumWrapper() {
-  mkdirSync2(BIN_DIR, { recursive: true });
-  const wrapperPath = resolve4(BIN_DIR, "chromium");
-  writeFileSync4(wrapperPath, `#!/bin/bash
+  mkdirSync(BIN_DIR, { recursive: true });
+  const wrapperPath = resolve3(BIN_DIR, "chromium");
+  writeFileSync3(wrapperPath, `#!/bin/bash
 LOG="${LOG_DIR}/chromium.log"
 echo "==== [$(date)] chromium wrapper ====" >> "$LOG"
 echo "  DISPLAY=$DISPLAY WAYLAND=$WAYLAND_DISPLAY XDG_SESSION_TYPE=$XDG_SESSION_TYPE" >> "$LOG"
@@ -4027,13 +3845,13 @@ else
   echo "  xdpyinfo ${VNC_DISPLAY} FAILED \u2014 display not ready" >> "$LOG"
 fi
 
-# Task 929 \u2014 read the install-time-resolved non-snap Chromium binary path.
+# read the install-time-resolved non-snap Chromium binary path.
 # The installer (ensureNonSnapChromium + writeChromiumBinaryPathFile) writes
 # this file with the absolute path to either /usr/bin/chromium (Pi Bookworm:
 # real .deb) or /usr/bin/google-chrome-stable (Ubuntu Noble laptop: snap
 # replaced). Refusing the legacy probe loop closes the silent-fallback path
 # where /snap/bin/chromium would re-introduce the AppArmor SingletonLock
-# denial that triggered Task 929.
+# denial that triggered.
 PATH_FILE="${PLATFORM_ROOT2}/config/chromium-binary.path"
 if [ ! -r "$PATH_FILE" ]; then
   echo "  ERROR: $PATH_FILE missing \u2014 re-run installer" >> "$LOG"
@@ -4055,7 +3873,7 @@ echo "  launching $BIN (realpath=$RESOLVED)" >> "$LOG"
 
 # nohup detaches chromium from this wrapper's process group so it outlives
 # claude auth login exiting (e.g. on timeout). --user-data-dir is brand-scoped
-# (Task 553) so a wrapper-spawned chromium attaches to the same per-brand
+# so a wrapper-spawned chromium attaches to the same per-brand
 # profile that vnc.sh's start_chrome targets \u2014 no shared cookies across brands.
 nohup "$BIN" \\
   --user-data-dir=${CHROMIUM_PROFILE_DIR} \\
@@ -4111,19 +3929,6 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
 }
 
 // server/routes/health.ts
-var cachedApiKeyStatus = null;
-var API_KEY_CACHE_TTL_MS = 5 * 60 * 1e3;
-async function probeApiKey() {
-  if (cachedApiKeyStatus) {
-    const ttl = cachedApiKeyStatus.status === "valid" ? API_KEY_CACHE_TTL_MS : 3e4;
-    if (Date.now() - cachedApiKeyStatus.checkedAt < ttl) {
-      return cachedApiKeyStatus.status;
-    }
-  }
-  const result = await validateKey();
-  cachedApiKeyStatus = { status: result.status, checkedAt: Date.now() };
-  return result.status;
-}
 function checkPort(port2, timeoutMs = 500) {
   return new Promise((resolve23) => {
     const socket = createConnection2(port2, "127.0.0.1");
@@ -4147,8 +3952,8 @@ app.get("/", async (c) => {
   const browserTransport = resolveBrowserTransport(c.req.raw, c.env?.incoming?.socket?.remoteAddress);
   let pinConfigured = false;
   try {
-    if (existsSync4(USERS_FILE)) {
-      const raw = readFileSync6(USERS_FILE, "utf-8").trim();
+    if (existsSync3(USERS_FILE)) {
+      const raw = readFileSync5(USERS_FILE, "utf-8").trim();
       if (raw) {
         const users = JSON.parse(raw);
         pinConfigured = Array.isArray(users) && users.length > 0;
@@ -4165,19 +3970,6 @@ app.get("/", async (c) => {
   }
   const claudeAuthenticated = authHealth.status === "ok" || authHealth.status === "expiring";
   const vncRunning = await checkPort(WEBSOCKIFY_PORT);
-  let apiKeyConfigured = false;
-  try {
-    apiKeyConfigured = existsSync4(keyFilePath());
-  } catch {
-  }
-  let apiKeyStatus = "missing";
-  if (apiKeyConfigured) {
-    try {
-      apiKeyStatus = await probeApiKey();
-    } catch {
-      apiKeyStatus = "error";
-    }
-  }
   let whatsappAccounts = [];
   try {
     whatsappAccounts = getStatus().map((a) => ({
@@ -4203,8 +3995,6 @@ app.get("/", async (c) => {
     browser_transport: browserTransport,
     auth_status: authHealth.status,
     auth_expires_at: authHealth.expiresAt ?? null,
-    api_key_configured: apiKeyConfigured,
-    api_key_status: apiKeyStatus,
     server_ip: getLanIp(),
     missingPlugins,
     whatsapp: {
@@ -4220,9 +4010,9 @@ var health_default = app;
 import { randomUUID as randomUUID3 } from "crypto";
 import { mkdir as mkdir2, readFile, stat as stat2, writeFile as writeFile2 } from "fs/promises";
 import { realpathSync } from "fs";
-import { resolve as resolve5, extname, basename } from "path";
-var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve5(process.cwd(), "../platform");
-var ATTACHMENTS_ROOT = resolve5(PLATFORM_ROOT3, "..", "data/uploads");
+import { resolve as resolve4, extname, basename } from "path";
+var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve4(process.cwd(), "../platform");
+var ATTACHMENTS_ROOT = resolve4(PLATFORM_ROOT3, "..", "data/uploads");
 var SUPPORTED_MIME_TYPES = /* @__PURE__ */ new Set([
   "image/jpeg",
   "image/png",
@@ -4249,11 +4039,11 @@ function assertSupportedMime(mimeType) {
 }
 async function writeAttachment(scope, filename, mimeType, sizeBytes, buffer) {
   const attachmentId = randomUUID3();
-  const dir = resolve5(ATTACHMENTS_ROOT, scope, attachmentId);
+  const dir = resolve4(ATTACHMENTS_ROOT, scope, attachmentId);
   await mkdir2(dir, { recursive: true });
   const ext = extname(filename) || "";
-  const storagePath = resolve5(dir, `${attachmentId}${ext}`);
-  const metaPath = resolve5(dir, `${attachmentId}.meta.json`);
+  const storagePath = resolve4(dir, `${attachmentId}${ext}`);
+  const metaPath = resolve4(dir, `${attachmentId}.meta.json`);
   const meta = {
     attachmentId,
     scope,
@@ -4329,11 +4119,11 @@ async function storeComponentArtefact(accountId, attachmentId, mimeType, content
       `Component artefact exceeds the 50 MB limit (${(buffer.byteLength / 1024 / 1024).toFixed(1)} MB).`
     );
   }
-  const dir = resolve5(ATTACHMENTS_ROOT, accountId, attachmentId);
+  const dir = resolve4(ATTACHMENTS_ROOT, accountId, attachmentId);
   await mkdir2(dir, { recursive: true });
   const ext = extname(filename) || (mimeType === "text/html" ? ".html" : ".md");
-  const storagePath = resolve5(dir, `${attachmentId}${ext}`);
-  const metaPath = resolve5(dir, `${attachmentId}.meta.json`);
+  const storagePath = resolve4(dir, `${attachmentId}${ext}`);
+  const metaPath = resolve4(dir, `${attachmentId}.meta.json`);
   const meta = {
     attachmentId,
     scope: accountId,
@@ -4350,7 +4140,7 @@ async function storeComponentArtefact(accountId, attachmentId, mimeType, content
 // app/lib/stt/voice-note.ts
 import { writeFile as writeFile3, mkdtemp, rm } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join5 } from "path";
+import { join as join4 } from "path";
 var TAG14 = "[voice]";
 var AUDIO_MIME_TYPES = /* @__PURE__ */ new Set([
   "audio/ogg",
@@ -4394,9 +4184,9 @@ async function transcribeVoiceNote(file, source) {
   let tempDir;
   let tempPath;
   try {
-    tempDir = await mkdtemp(join5(tmpdir(), "voice-"));
+    tempDir = await mkdtemp(join4(tmpdir(), "voice-"));
     const ext = audioExtension(mimeType);
-    tempPath = join5(tempDir, `recording${ext}`);
+    tempPath = join4(tempDir, `recording${ext}`);
     const buffer = Buffer.from(await file.arrayBuffer());
     await writeFile3(tempPath, buffer);
   } catch (err) {
@@ -4437,10 +4227,10 @@ async function transcribeVoiceNote(file, source) {
 }
 
 // ../lib/oauth-llm/src/index.ts
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
-import { resolve as resolve6 } from "path";
-import { homedir as homedir2 } from "os";
-var CREDENTIALS_FILE = process.env.CLAUDE_CONFIG_DIR ? resolve6(process.env.CLAUDE_CONFIG_DIR, ".credentials.json") : resolve6(homedir2(), ".claude", ".credentials.json");
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
+import { resolve as resolve5 } from "path";
+import { homedir } from "os";
+var CREDENTIALS_FILE = process.env.CLAUDE_CONFIG_DIR ? resolve5(process.env.CLAUDE_CONFIG_DIR, ".credentials.json") : resolve5(homedir(), ".claude", ".credentials.json");
 var TOKEN_ENDPOINT2 = "https://platform.claude.com/v1/oauth/token";
 var ANTHROPIC_MESSAGES_ENDPOINT = "https://api.anthropic.com/v1/messages";
 var ANTHROPIC_VERSION = "2023-06-01";
@@ -4459,7 +4249,7 @@ function isInputTooLargeBody(body) {
 function readCredentials2() {
   let raw;
   try {
-    raw = readFileSync7(CREDENTIALS_FILE, "utf-8");
+    raw = readFileSync6(CREDENTIALS_FILE, "utf-8");
   } catch {
     return null;
   }
@@ -4488,7 +4278,7 @@ function writeCredentials(tokens) {
   const newExpiresAt = typeof tokens.expiresIn === "number" && tokens.expiresIn > 0 ? Date.now() + tokens.expiresIn * 1e3 : Date.now() + 3600 * 1e3;
   let fileData = {};
   try {
-    fileData = JSON.parse(readFileSync7(CREDENTIALS_FILE, "utf-8"));
+    fileData = JSON.parse(readFileSync6(CREDENTIALS_FILE, "utf-8"));
   } catch {
   }
   const existing = fileData.claudeAiOauth;
@@ -4498,7 +4288,7 @@ function writeCredentials(tokens) {
     ...tokens.refreshToken != null ? { refreshToken: tokens.refreshToken } : {},
     expiresAt: newExpiresAt
   };
-  writeFileSync5(CREDENTIALS_FILE, JSON.stringify(fileData, null, 2), "utf-8");
+  writeFileSync4(CREDENTIALS_FILE, JSON.stringify(fileData, null, 2), "utf-8");
   return newExpiresAt;
 }
 var refreshLock2 = null;
@@ -4972,7 +4762,7 @@ async function processInbound(rawText, channel) {
 }
 
 // app/lib/channel-pty-bridge/bridge.ts
-import { resolve as resolve7 } from "path";
+import { resolve as resolve6 } from "path";
 
 // app/lib/channel-pty-bridge/manager-client.ts
 function managerBase() {
@@ -4988,7 +4778,9 @@ async function managerSpawn(opts) {
       role: opts.role,
       channel: opts.channel,
       accountId: opts.accountId,
-      attachmentDir: opts.attachmentDir
+      attachmentDir: opts.attachmentDir,
+      aboutOwner: opts.aboutOwner,
+      dormantPlugins: opts.dormantPlugins
     })
   }).catch((err) => ({ __throw: err instanceof Error ? err.message : String(err) }));
   if ("__throw" in res) {
@@ -5130,7 +4922,7 @@ async function ensureEntry(input) {
     }
     return existing;
   }
-  const attachmentDir = input.role === "public" ? resolve7(ATTACHMENTS_ROOT, "public", input.senderId) : void 0;
+  const attachmentDir = input.role === "public" ? resolve6(ATTACHMENTS_ROOT, "public", input.senderId) : void 0;
   const spawned = await managerSpawn({
     senderId: input.senderId,
     role: input.role,
@@ -5487,9 +5279,9 @@ ${lines}]`;
 var chat_default = app2;
 
 // server/routes/whatsapp.ts
-import { join as join6, resolve as resolve8, basename as basename2 } from "path";
+import { join as join5, resolve as resolve7, basename as basename2 } from "path";
 import { readFile as readFile2, stat as stat3 } from "fs/promises";
-import { realpathSync as realpathSync2, readdirSync as readdirSync2, readFileSync as readFileSync8, existsSync as existsSync5 } from "fs";
+import { realpathSync as realpathSync2, readdirSync as readdirSync2, readFileSync as readFileSync7, existsSync as existsSync4 } from "fs";
 
 // app/lib/whatsapp/login.ts
 import { randomUUID as randomUUID4 } from "crypto";
@@ -5830,7 +5622,7 @@ app3.post("/login/start", async (c) => {
     const body = await c.req.json().catch(() => ({}));
     const accountId = validateAccountId(body.accountId);
     const force = body.force ?? false;
-    const authDir = join6(MAXY_DIR, "credentials", "whatsapp", accountId);
+    const authDir = join5(MAXY_DIR, "credentials", "whatsapp", accountId);
     const result = await startLogin({ accountId, authDir, force });
     console.error(`${TAG17} login/start result account=${accountId} hasQr=${!!result.qrRaw}${result.selfPhone ? ` phone=${result.selfPhone}` : ""}`);
     return c.json(result);
@@ -5990,17 +5782,17 @@ app3.post("/config", async (c) => {
         return c.json(result, result.ok ? 200 : 400);
       }
       case "list-public-agents": {
-        const agentsDir = resolve8(account.accountDir, "agents");
+        const agentsDir = resolve7(account.accountDir, "agents");
         const agents = [];
-        if (existsSync5(agentsDir)) {
+        if (existsSync4(agentsDir)) {
           try {
             const entries = readdirSync2(agentsDir, { withFileTypes: true });
             for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
               if (!entry.isDirectory() || entry.name === "admin") continue;
-              const configPath2 = resolve8(agentsDir, entry.name, "config.json");
-              if (!existsSync5(configPath2)) continue;
+              const configPath2 = resolve7(agentsDir, entry.name, "config.json");
+              if (!existsSync4(configPath2)) continue;
               try {
-                const config = JSON.parse(readFileSync8(configPath2, "utf-8"));
+                const config = JSON.parse(readFileSync7(configPath2, "utf-8"));
                 agents.push({ slug: entry.name, displayName: config.displayName ?? entry.name });
               } catch {
                 console.error(`${TAG17} config action=list-public-agents error="failed to parse config.json for agent ${entry.name}" \u2014 skipping`);
@@ -6075,7 +5867,7 @@ app3.post("/send-document", async (c) => {
     if (!maxyAccountId || !PLATFORM_ROOT4) {
       return c.json({ error: "Cannot validate file path: missing account or platform context" }, 400);
     }
-    const accountDir = resolve8(PLATFORM_ROOT4, "..", "data/accounts", maxyAccountId);
+    const accountDir = resolve7(PLATFORM_ROOT4, "..", "data/accounts", maxyAccountId);
     let resolvedPath;
     try {
       resolvedPath = realpathSync2(filePath);
@@ -6306,12 +6098,12 @@ var whatsapp_default = app3;
 
 // server/routes/onboarding.ts
 import { spawn, spawnSync as spawnSync2, execFileSync as execFileSync2 } from "child_process";
-import { openSync, closeSync, writeFileSync as writeFileSync7, writeSync, existsSync as existsSync7, readFileSync as readFileSync10, unlinkSync as unlinkSync2 } from "fs";
+import { openSync, closeSync, writeFileSync as writeFileSync6, writeSync, existsSync as existsSync6, readFileSync as readFileSync9, unlinkSync } from "fs";
 import { createHash, randomUUID as randomUUID5 } from "crypto";
 
 // ../lib/admins-write/src/index.ts
-import { existsSync as existsSync6, readFileSync as readFileSync9, writeFileSync as writeFileSync6, renameSync, mkdirSync as mkdirSync3, readdirSync as readdirSync3, statSync as statSync2 } from "fs";
-import { dirname as dirname2, join as join7 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync5, renameSync, mkdirSync as mkdirSync2, readdirSync as readdirSync3, statSync as statSync2 } from "fs";
+import { dirname, join as join6 } from "path";
 function logLine(input, result) {
   const userIdShort = input.userId.slice(0, 8);
   console.error(
@@ -6319,17 +6111,17 @@ function logLine(input, result) {
   );
 }
 function writeFileAtomic(filePath, contents, mode) {
-  mkdirSync3(dirname2(filePath), { recursive: true });
+  mkdirSync2(dirname(filePath), { recursive: true });
   const tempPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;
-  writeFileSync6(tempPath, contents, mode !== void 0 ? { mode } : void 0);
+  writeFileSync5(tempPath, contents, mode !== void 0 ? { mode } : void 0);
   renameSync(tempPath, filePath);
 }
 function writeAdminEntry(input) {
   const result = { usersJsonResult: "noop", accountJsonResult: "noop" };
   try {
     let users = [];
-    if (existsSync6(input.usersFile)) {
-      const raw = readFileSync9(input.usersFile, "utf-8").trim();
+    if (existsSync5(input.usersFile)) {
+      const raw = readFileSync8(input.usersFile, "utf-8").trim();
       if (raw) {
         const parsed = JSON.parse(raw);
         if (!Array.isArray(parsed)) {
@@ -6355,11 +6147,11 @@ function writeAdminEntry(input) {
     return result;
   }
   try {
-    const accountJsonPath = join7(input.accountDir, "account.json");
-    if (!existsSync6(accountJsonPath)) {
+    const accountJsonPath = join6(input.accountDir, "account.json");
+    if (!existsSync5(accountJsonPath)) {
       throw new Error(`account.json not found at ${accountJsonPath}`);
     }
-    const config = JSON.parse(readFileSync9(accountJsonPath, "utf-8"));
+    const config = JSON.parse(readFileSync8(accountJsonPath, "utf-8"));
     const admins = config.admins ?? [];
     if (admins.some((a) => a.userId === input.userId)) {
       result.accountJsonResult = "noop";
@@ -6383,9 +6175,9 @@ function checkAdminAuthInvariant(input) {
     usersWithoutAccount: []
   };
   const usersUserIds = /* @__PURE__ */ new Set();
-  if (existsSync6(input.usersFile)) {
+  if (existsSync5(input.usersFile)) {
     try {
-      const raw = readFileSync9(input.usersFile, "utf-8").trim();
+      const raw = readFileSync8(input.usersFile, "utf-8").trim();
       if (raw) {
         const users = JSON.parse(raw);
         for (const u of users) {
@@ -6398,7 +6190,7 @@ function checkAdminAuthInvariant(input) {
     }
   }
   const accountUserIds = /* @__PURE__ */ new Set();
-  if (existsSync6(input.accountsDir)) {
+  if (existsSync5(input.accountsDir)) {
     let entries;
     try {
       entries = readdirSync3(input.accountsDir);
@@ -6410,17 +6202,17 @@ function checkAdminAuthInvariant(input) {
     }
     for (const entry of entries) {
       if (entry.startsWith(".")) continue;
-      const accountDir = join7(input.accountsDir, entry);
+      const accountDir = join6(input.accountsDir, entry);
       try {
         if (!statSync2(accountDir).isDirectory()) continue;
       } catch {
         continue;
       }
-      const accountJsonPath = join7(accountDir, "account.json");
-      if (!existsSync6(accountJsonPath)) continue;
+      const accountJsonPath = join6(accountDir, "account.json");
+      if (!existsSync5(accountJsonPath)) continue;
       let admins = [];
       try {
-        const config = JSON.parse(readFileSync9(accountJsonPath, "utf-8"));
+        const config = JSON.parse(readFileSync8(accountJsonPath, "utf-8"));
         admins = config.admins ?? [];
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
@@ -6460,8 +6252,8 @@ function hashPin(pin) {
   return createHash("sha256").update(pin).digest("hex");
 }
 function readUsersFile() {
-  if (!existsSync7(USERS_FILE)) return null;
-  const raw = readFileSync10(USERS_FILE, "utf-8").trim();
+  if (!existsSync6(USERS_FILE)) return null;
+  const raw = readFileSync9(USERS_FILE, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
 }
@@ -6527,7 +6319,7 @@ app4.post("/claude-auth", async (c) => {
     if (!vncReady) return c.json({ error: "VNC display failed to start" }, 500);
   }
   await ensureCdp(transport);
-  writeFileSync7(logPath("claude-auth"), "");
+  writeFileSync6(logPath("claude-auth"), "");
   const chromiumWrapper = writeChromiumWrapper();
   const x11Env = buildX11Env(chromiumWrapper, transport);
   vncLog("claude-auth", { action: "start", transport });
@@ -6659,10 +6451,10 @@ app4.delete("/set-pin", async (c) => {
   }
   const remaining = users.filter((u) => u.userId !== matchedUser.userId);
   if (remaining.length === 0) {
-    unlinkSync2(USERS_FILE);
+    unlinkSync(USERS_FILE);
     console.log(`[set-pin] cleared users.json (last entry removed): userId=${matchedUser.userId.slice(0, 8)}\u2026`);
   } else {
-    writeFileSync7(USERS_FILE, JSON.stringify(remaining), { mode: 384 });
+    writeFileSync6(USERS_FILE, JSON.stringify(remaining), { mode: 384 });
     console.log(`[set-pin] removed entry from users.json: userId=${matchedUser.userId.slice(0, 8)}\u2026 remaining=${remaining.length}`);
   }
   return c.json({ ok: true });
@@ -6670,9 +6462,9 @@ app4.delete("/set-pin", async (c) => {
 var onboarding_default = app4;
 
 // server/routes/client-error.ts
-import { appendFileSync, existsSync as existsSync8, renameSync as renameSync2, statSync as statSync3 } from "fs";
-import { join as join8 } from "path";
-var CLIENT_ERRORS_LOG = join8(LOG_DIR, "client-errors.log");
+import { appendFileSync, existsSync as existsSync7, renameSync as renameSync2, statSync as statSync3 } from "fs";
+import { join as join7 } from "path";
+var CLIENT_ERRORS_LOG = join7(LOG_DIR, "client-errors.log");
 var MAX_LOG_SIZE = 10 * 1024 * 1024;
 var MAX_BODY_SIZE = 8 * 1024;
 var MAX_STACK_LEN = 2e3;
@@ -6715,7 +6507,7 @@ function stackHead(stack) {
 }
 function rotateIfNeeded() {
   try {
-    if (!existsSync8(CLIENT_ERRORS_LOG)) return;
+    if (!existsSync7(CLIENT_ERRORS_LOG)) return;
     const stats = statSync3(CLIENT_ERRORS_LOG);
     if (stats.size < MAX_LOG_SIZE) return;
     renameSync2(CLIENT_ERRORS_LOG, CLIENT_ERRORS_LOG + ".1");
@@ -6829,8 +6621,8 @@ app5.post("/", async (c) => {
 var client_error_default = app5;
 
 // server/routes/admin/session.ts
-import { readFileSync as readFileSync11, readdirSync as readdirSync4, statSync as statSync4, writeFileSync as writeFileSync8, existsSync as existsSync9 } from "fs";
-import { join as join9 } from "path";
+import { readFileSync as readFileSync10, readdirSync as readdirSync4, statSync as statSync4, writeFileSync as writeFileSync7, existsSync as existsSync8 } from "fs";
+import { join as join8 } from "path";
 import { createHash as createHash2 } from "crypto";
 import { randomUUID as randomUUID6 } from "crypto";
 var deprecationLogged = /* @__PURE__ */ new Set();
@@ -6838,15 +6630,15 @@ function hashPin2(pin) {
   return createHash2("sha256").update(pin).digest("hex");
 }
 function readUsersFile2() {
-  if (!existsSync9(USERS_FILE)) return null;
-  const raw = readFileSync11(USERS_FILE, "utf-8").trim();
+  if (!existsSync8(USERS_FILE)) return null;
+  const raw = readFileSync10(USERS_FILE, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
 }
 function scanForOrphanedAccountAdmins(users) {
   const usersUserIds = new Set(users.map((u) => u.userId));
   const orphans = [];
-  if (!existsSync9(ACCOUNTS_DIR)) return orphans;
+  if (!existsSync8(ACCOUNTS_DIR)) return orphans;
   let entries;
   try {
     entries = readdirSync4(ACCOUNTS_DIR);
@@ -6855,16 +6647,16 @@ function scanForOrphanedAccountAdmins(users) {
   }
   for (const entry of entries) {
     if (entry.startsWith(".")) continue;
-    const accountDir = join9(ACCOUNTS_DIR, entry);
+    const accountDir = join8(ACCOUNTS_DIR, entry);
     try {
       if (!statSync4(accountDir).isDirectory()) continue;
     } catch {
       continue;
     }
-    const accountJsonPath = join9(accountDir, "account.json");
-    if (!existsSync9(accountJsonPath)) continue;
+    const accountJsonPath = join8(accountDir, "account.json");
+    if (!existsSync8(accountJsonPath)) continue;
     try {
-      const config = JSON.parse(readFileSync11(accountJsonPath, "utf-8"));
+      const config = JSON.parse(readFileSync10(accountJsonPath, "utf-8"));
       const admins = config.admins ?? [];
       for (const a of admins) {
         if (typeof a.userId === "string" && !usersUserIds.has(a.userId)) {
@@ -6890,7 +6682,7 @@ function stripLegacyNameField(users) {
     }
   }
   try {
-    writeFileSync8(USERS_FILE, JSON.stringify(users), { mode: 384 });
+    writeFileSync7(USERS_FILE, JSON.stringify(users), { mode: 384 });
   } catch (err) {
     console.error(`[admin-identity] users-json strip failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -7185,18 +6977,18 @@ app9.post("/", requireAdminSession, async (c) => {
 var failure_report_default = app9;
 
 // server/routes/admin/logs.ts
-import { existsSync as existsSync11, readdirSync as readdirSync5, readFileSync as readFileSync12, statSync as statSync5 } from "fs";
-import { resolve as resolve9, basename as basename3 } from "path";
+import { existsSync as existsSync10, readdirSync as readdirSync5, readFileSync as readFileSync11, statSync as statSync5 } from "fs";
+import { resolve as resolve8, basename as basename3 } from "path";
 
 // app/lib/logs-read-resolve.ts
-import { existsSync as existsSync10 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync9 } from "fs";
+import { join as join9 } from "path";
 function resolveSessionLogPaths(filename, logDirs) {
   const tried = [filename];
   const hits = [];
   for (const dir of logDirs) {
-    const fullPath = join10(dir, filename);
-    if (existsSync10(fullPath)) {
+    const fullPath = join9(dir, filename);
+    if (existsSync9(fullPath)) {
       hits.push({ path: fullPath, dir });
     }
   }
@@ -7213,7 +7005,7 @@ app10.get("/", async (c) => {
   const cacheKeyParam = c.req.query("cacheKey");
   const download = c.req.query("download") === "1";
   const account = resolveAccount();
-  const accountLogDir = account ? resolve9(account.accountDir, "logs") : null;
+  const accountLogDir = account ? resolve8(account.accountDir, "logs") : null;
   const logDirs = [];
   if (accountLogDir) logDirs.push(accountLogDir);
   logDirs.push(LOG_DIR);
@@ -7221,10 +7013,10 @@ app10.get("/", async (c) => {
     const safe = basename3(fileParam);
     const searched = [];
     for (const dir of logDirs) {
-      const filePath = resolve9(dir, safe);
+      const filePath = resolve8(dir, safe);
       searched.push(filePath);
       try {
-        const buffer = readFileSync12(filePath);
+        const buffer = readFileSync11(filePath);
         const onDiskBytes = statSync5(filePath).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
@@ -7289,7 +7081,7 @@ app10.get("/", async (c) => {
       console.info(`[admin/logs] resolved cacheKey=${cacheKeySlice} conversationId=${conversationIdSlice} via=${primaryId === cacheKey ? "cacheKey" : primaryId === sessionKeyFromConv ? "reverse-lookup" : "conversationId-fallback"}`);
       try {
         const filename = basename3(hit.path);
-        const buffer = readFileSync12(hit.path);
+        const buffer = readFileSync11(hit.path);
         const onDiskBytes = statSync5(hit.path).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
@@ -7324,7 +7116,7 @@ app10.get("/", async (c) => {
   const seen = /* @__PURE__ */ new Set();
   const logs = {};
   for (const dir of logDirs) {
-    if (!existsSync11(dir)) continue;
+    if (!existsSync10(dir)) continue;
     let files;
     try {
       files = readdirSync5(dir).filter((f) => f.endsWith(".log"));
@@ -7333,10 +7125,10 @@ app10.get("/", async (c) => {
       console.warn(`[admin/logs] readdir-fail dir=${dir} reason=${reason}`);
       continue;
     }
-    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync5(resolve9(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
+    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync5(resolve8(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
-        const content = readFileSync12(resolve9(dir, name));
+        const content = readFileSync11(resolve8(dir, name));
         const tail = content.length > TAIL_BYTES ? content.subarray(content.length - TAIL_BYTES).toString("utf-8") : content.toString("utf-8");
         logs[name] = tail.trim() || "(empty)";
       } catch (err) {
@@ -7375,8 +7167,8 @@ var claude_info_default = app11;
 
 // server/routes/admin/attachment.ts
 import { readFile as readFile3, readdir } from "fs/promises";
-import { existsSync as existsSync12 } from "fs";
-import { resolve as resolve10 } from "path";
+import { existsSync as existsSync11 } from "fs";
+import { resolve as resolve9 } from "path";
 var app12 = new Hono();
 app12.get("/:attachmentId", requireAdminSession, async (c) => {
   const attachmentId = c.req.param("attachmentId");
@@ -7388,12 +7180,12 @@ app12.get("/:attachmentId", requireAdminSession, async (c) => {
   if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(attachmentId)) {
     return new Response("Not found", { status: 404 });
   }
-  const dir = resolve10(ATTACHMENTS_ROOT, accountId, attachmentId);
-  if (!existsSync12(dir)) {
+  const dir = resolve9(ATTACHMENTS_ROOT, accountId, attachmentId);
+  if (!existsSync11(dir)) {
     return new Response("Not found", { status: 404 });
   }
-  const metaPath = resolve10(dir, `${attachmentId}.meta.json`);
-  if (!existsSync12(metaPath)) {
+  const metaPath = resolve9(dir, `${attachmentId}.meta.json`);
+  if (!existsSync11(metaPath)) {
     return new Response("Not found", { status: 404 });
   }
   let meta;
@@ -7407,7 +7199,7 @@ app12.get("/:attachmentId", requireAdminSession, async (c) => {
   if (!dataFile) {
     return new Response("Not found", { status: 404 });
   }
-  const filePath = resolve10(dir, dataFile);
+  const filePath = resolve9(dir, dataFile);
   const buffer = await readFile3(filePath);
   return new Response(new Uint8Array(buffer), {
     headers: {
@@ -7420,24 +7212,24 @@ app12.get("/:attachmentId", requireAdminSession, async (c) => {
 var attachment_default = app12;
 
 // server/routes/admin/agents.ts
-import { resolve as resolve11 } from "path";
-import { readdirSync as readdirSync6, readFileSync as readFileSync13, existsSync as existsSync13, rmSync } from "fs";
+import { resolve as resolve10 } from "path";
+import { readdirSync as readdirSync6, readFileSync as readFileSync12, existsSync as existsSync12, rmSync } from "fs";
 var app13 = new Hono();
 app13.get("/", (c) => {
   const account = resolveAccount();
   if (!account) return c.json({ agents: [] });
-  const agentsDir = resolve11(account.accountDir, "agents");
-  if (!existsSync13(agentsDir)) return c.json({ agents: [] });
+  const agentsDir = resolve10(account.accountDir, "agents");
+  if (!existsSync12(agentsDir)) return c.json({ agents: [] });
   const agents = [];
   try {
     const entries = readdirSync6(agentsDir, { withFileTypes: true });
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
       if (!entry.isDirectory()) continue;
       if (entry.name === "admin") continue;
-      const configPath2 = resolve11(agentsDir, entry.name, "config.json");
-      if (!existsSync13(configPath2)) continue;
+      const configPath2 = resolve10(agentsDir, entry.name, "config.json");
+      if (!existsSync12(configPath2)) continue;
       try {
-        const config = JSON.parse(readFileSync13(configPath2, "utf-8"));
+        const config = JSON.parse(readFileSync12(configPath2, "utf-8"));
         agents.push({
           slug: entry.name,
           displayName: config.displayName ?? entry.name,
@@ -7463,8 +7255,8 @@ app13.delete("/:slug", async (c) => {
   if (slug.includes("/") || slug.includes("..") || slug.includes("\\")) {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
-  const agentDir = resolve11(account.accountDir, "agents", slug);
-  if (!existsSync13(agentDir)) {
+  const agentDir = resolve10(account.accountDir, "agents", slug);
+  if (!existsSync12(agentDir)) {
     return c.json({ error: "Agent not found" }, 404);
   }
   try {
@@ -7493,8 +7285,8 @@ app13.post("/:slug/project", async (c) => {
   if (slug.includes("/") || slug.includes("..") || slug.includes("\\")) {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
-  const agentDir = resolve11(account.accountDir, "agents", slug);
-  if (!existsSync13(agentDir)) {
+  const agentDir = resolve10(account.accountDir, "agents", slug);
+  if (!existsSync12(agentDir)) {
     return c.json({ error: "Agent not found on disk" }, 404);
   }
   try {
@@ -7510,7 +7302,7 @@ var agents_default = app13;
 // server/routes/admin/sessions.ts
 import crypto from "crypto";
 import { resolve as resolvePath } from "path";
-import { existsSync as existsSync14, mkdirSync as mkdirSync4, createWriteStream } from "fs";
+import { existsSync as existsSync13, mkdirSync as mkdirSync3, createWriteStream } from "fs";
 
 // app/lib/synthetic-marker.ts
 var CLOUDFLARE_MARKER_PREFIX = "Cloudflare setup completed (actionId: ";
@@ -7527,7 +7319,7 @@ var replayJsonl = (..._args) => null;
 var resolveJsonlPath = (..._args) => null;
 
 // server/routes/admin/sessions.ts
-import { homedir as homedir3 } from "os";
+import { homedir as homedir2 } from "os";
 
 // app/lib/claude-agent/component-attachment.ts
 var pickComponentBytes = (..._args) => null;
@@ -7536,7 +7328,7 @@ var pickComponentBytes = (..._args) => null;
 function openResumeStreamLog(accountId, conversationId) {
   const dir = resolvePath(ACCOUNTS_DIR, accountId, "resume-logs");
   try {
-    mkdirSync4(dir, { recursive: true });
+    mkdirSync3(dir, { recursive: true });
   } catch {
   }
   return createWriteStream(resolvePath(dir, `${conversationId}.log`), { flags: "a" });
@@ -7567,7 +7359,7 @@ function validateAndShapeAttachments(raws, conversationAccountId, conversationId
     let reason = null;
     if (!a.attachmentId || !a.filename || !a.mimeType || !a.storagePath) reason = "schema-fail";
     else if (a.accountId !== conversationAccountId) reason = "account-mismatch";
-    else if (!existsSync14(a.storagePath)) reason = "missing-file";
+    else if (!existsSync13(a.storagePath)) reason = "missing-file";
     if (reason) {
       invalid++;
       try {
@@ -7830,7 +7622,7 @@ app14.post("/:id/resume", async (c) => {
     return c.json({ error: "Failed to load conversation messages" }, 500);
   }
   if (persistedAgentSessionId) {
-    const jsonlPath = resolveJsonlPath(homedir3(), resolvePath(ACCOUNTS_DIR, accountId), persistedAgentSessionId);
+    const jsonlPath = resolveJsonlPath(homedir2(), resolvePath(ACCOUNTS_DIR, accountId), persistedAgentSessionId);
     const replay = replayJsonl(jsonlPath);
     jsonlMissing = replay.jsonlMissing;
     jsonlMalformedLines = replay.malformedLines;
@@ -7884,7 +7676,7 @@ app14.post("/:id/resume", async (c) => {
           ordinal: c2.ordinal,
           textOffset: c2.textOffset,
           submitted: false,
-          // Task 989 — JSONL has artefactAttachmentId for persistent components.
+          // JSONL has artefactAttachmentId for persistent components.
           ...c2.artefactAttachmentId ? { attachmentId: c2.artefactAttachmentId } : {}
         })),
         attachments: []
@@ -8093,6 +7885,77 @@ app14.put("/:id/label", requireAdminSession, async (c) => {
 });
 var sessions_default = app14;
 
+// app/lib/claude-agent/spawn-context.ts
+import { existsSync as existsSync14, readFileSync as readFileSync13, readdirSync as readdirSync7 } from "fs";
+import { resolve as resolve11 } from "path";
+async function resolveOwnerProfileBlock(accountId, userId) {
+  if (!userId) return { ok: false, reason: "missing-user-id" };
+  try {
+    const body = await loadUserProfile(accountId, userId);
+    if (body === null) return { ok: false, reason: "profile-not-found" };
+    return { ok: true, body };
+  } catch (err) {
+    console.error(
+      `[spawn-context] neo4j-unreachable: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return { ok: false, reason: "neo4j-unreachable" };
+  }
+}
+function frontmatterField(manifest, field) {
+  const fm = manifest.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+  if (!fm) return null;
+  const re = new RegExp(`^${field}:\\s*(.*?)\\r?$`, "m");
+  const m = fm[1].match(re);
+  if (!m) return null;
+  let value = m[1].trim();
+  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+    value = value.slice(1, -1);
+  }
+  return value || null;
+}
+function computeDormantPlugins(accountId) {
+  const accountFile = resolve11(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
+  if (!existsSync14(accountFile)) return [];
+  let enabled;
+  try {
+    const raw = readFileSync13(accountFile, "utf-8");
+    const parsed = JSON.parse(raw);
+    enabled = new Set(
+      Array.isArray(parsed.enabledPlugins) ? parsed.enabledPlugins.filter((p) => typeof p === "string") : []
+    );
+  } catch (err) {
+    console.error(
+      `[spawn-context] account.json read failed for ${accountId.slice(0, 8)}\u2026: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return [];
+  }
+  const pluginsDir = resolve11(PLATFORM_ROOT, "plugins");
+  if (!existsSync14(pluginsDir)) return [];
+  let entries;
+  try {
+    entries = readdirSync7(pluginsDir);
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const name of entries) {
+    if (enabled.has(name)) continue;
+    const manifestPath = resolve11(pluginsDir, name, "PLUGIN.md");
+    if (!existsSync14(manifestPath)) continue;
+    let manifest;
+    try {
+      manifest = readFileSync13(manifestPath, "utf-8");
+    } catch {
+      continue;
+    }
+    const description = frontmatterField(manifest, "description");
+    if (!description) continue;
+    out.push({ name, description });
+  }
+  out.sort((a, b) => a.name.localeCompare(b.name));
+  return out;
+}
+
 // server/routes/admin/claude-sessions.ts
 var TAG18 = "[claude-session-manager:wrapper]";
 function managerBase2() {
@@ -8102,12 +7965,14 @@ function managerBase2() {
 var app15 = new Hono();
 app15.use("*", requireAdminSession);
 app15.post("/", async (c) => {
+  const routeStart = Date.now();
   const cacheKey = c.get("cacheKey") ?? "";
   const senderId = getAccountIdForSession(cacheKey) ?? "";
   if (!senderId) {
-    console.error(`${TAG18} reject reason=no-account-id`);
+    console.error(`${TAG18} reject reason=no-account-id cacheKey-prefix=${cacheKey.slice(0, 8)}`);
     return c.json({ error: "admin-account-not-resolved" }, 500);
   }
+  const userId = getUserIdForSession(cacheKey);
   let body = {};
   try {
     body = await c.req.json();
@@ -8116,15 +7981,35 @@ app15.post("/", async (c) => {
   const channel = typeof body.channel === "string" ? body.channel : "browser";
   const initialMessage = typeof body.initialMessage === "string" && body.initialMessage.trim() ? body.initialMessage : null;
   const permissionMode = typeof body.permissionMode === "string" ? body.permissionMode : void 0;
+  console.log(`${TAG18} spawn-request-in cacheKey-prefix=${cacheKey.slice(0, 8)} senderId=${senderId.slice(0, 8)} userId=${userId ? userId.slice(0, 8) : "absent"} channel=${channel} permissionMode=${permissionMode ?? "default"} initialMessage=${initialMessage ? "yes" : "no"}`);
+  const ownerStart = Date.now();
+  const aboutOwner = await resolveOwnerProfileBlock(senderId, userId);
+  const ownerMs = Date.now() - ownerStart;
+  const aboutOwnerStatus = aboutOwner == null ? "absent" : "ok" in aboutOwner && aboutOwner.ok === false ? `unresolved:${aboutOwner.reason}` : "ok";
+  console.log(`${TAG18} about-owner-resolved status=${aboutOwnerStatus} ms=${ownerMs}`);
+  const dormantStart = Date.now();
+  const dormantPlugins = computeDormantPlugins(senderId);
+  console.log(`${TAG18} dormant-plugins-computed count=${Array.isArray(dormantPlugins) ? dormantPlugins.length : 0} ms=${Date.now() - dormantStart}`);
+  const forwardStart = Date.now();
+  const upstreamPayload = JSON.stringify({
+    senderId,
+    role: "admin",
+    channel,
+    permissionMode,
+    aboutOwner,
+    dormantPlugins
+  });
+  console.log(`${TAG18} forward-spawn-start managerBase=${managerBase2()} bytes=${upstreamPayload.length}`);
   const upstream = await fetch(`${managerBase2()}/spawn`, {
     method: "POST",
     headers: { "content-type": "application/json" },
-    body: JSON.stringify({ senderId, role: "admin", channel, permissionMode })
+    body: upstreamPayload
   }).catch((err) => {
-    console.error(`${TAG18} fetch-failed op=spawn message=${err instanceof Error ? err.message : String(err)}`);
+    console.error(`${TAG18} fetch-failed op=spawn message=${err instanceof Error ? err.message : String(err)} ms=${Date.now() - forwardStart}`);
     return null;
   });
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
+  console.log(`${TAG18} forward-spawn-done status=${upstream.status} ms=${Date.now() - forwardStart} route-ms=${Date.now() - routeStart}`);
   let spawnedSessionId = null;
   if (upstream.ok && initialMessage) {
     const buffered = await upstream.clone().json().catch(() => null);
@@ -8160,6 +8045,7 @@ app15.post("/resume", async (c) => {
   const cacheKey = c.get("cacheKey") ?? "";
   const senderId = getAccountIdForSession(cacheKey) ?? "";
   if (!senderId) return c.json({ error: "admin-account-not-resolved" }, 500);
+  const userId = getUserIdForSession(cacheKey);
   let body = {};
   try {
     body = await c.req.json();
@@ -8170,6 +8056,8 @@ app15.post("/resume", async (c) => {
     return c.json({ error: "claudeSessionId-required" }, 400);
   }
   const channel = typeof body.channel === "string" ? body.channel : "browser";
+  const aboutOwner = await resolveOwnerProfileBlock(senderId, userId);
+  const dormantPlugins = computeDormantPlugins(senderId);
   const upstream = await fetch(`${managerBase2()}/resume`, {
     method: "POST",
     headers: { "content-type": "application/json" },
@@ -8177,7 +8065,9 @@ app15.post("/resume", async (c) => {
       senderId,
       role: "admin",
       channel,
-      claudeSessionId: body.claudeSessionId
+      claudeSessionId: body.claudeSessionId,
+      aboutOwner,
+      dormantPlugins
     })
   }).catch((err) => {
     console.error(`${TAG18} fetch-failed op=resume message=${err instanceof Error ? err.message : String(err)}`);
@@ -8513,7 +8403,7 @@ app19.post("/", async (c) => {
 var events_default = app19;
 
 // server/routes/admin/cloudflare.ts
-import { homedir as homedir4 } from "os";
+import { homedir as homedir3 } from "os";
 import { resolve as resolve13 } from "path";
 import { readFileSync as readFileSync15 } from "fs";
 
@@ -8531,8 +8421,8 @@ function isValidDomain(value) {
 }
 
 // app/lib/alias-domains.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync5, readFileSync as readFileSync14, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname3 } from "path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync4, readFileSync as readFileSync14, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname2 } from "path";
 import { resolve as resolve12 } from "path";
 var ALIAS_DOMAINS_PATH = resolve12(MAXY_DIR, "alias-domains.json");
 function readExisting() {
@@ -8549,14 +8439,14 @@ function addAliasDomain(hostname2) {
   const existing = readExisting();
   if (existing.has(hostname2)) return;
   existing.add(hostname2);
-  mkdirSync5(dirname3(ALIAS_DOMAINS_PATH), { recursive: true });
-  writeFileSync9(ALIAS_DOMAINS_PATH, JSON.stringify([...existing], null, 2) + "\n", "utf-8");
+  mkdirSync4(dirname2(ALIAS_DOMAINS_PATH), { recursive: true });
+  writeFileSync8(ALIAS_DOMAINS_PATH, JSON.stringify([...existing], null, 2) + "\n", "utf-8");
 }
 
 // app/lib/script-stream-tailer.ts
 import * as childProcess from "child_process";
-import { appendFileSync as appendFileSync2, createReadStream as createReadStream2, mkdirSync as mkdirSync6, statSync as statSync6 } from "fs";
-import { dirname as dirname4 } from "path";
+import { appendFileSync as appendFileSync2, createReadStream as createReadStream2, mkdirSync as mkdirSync5, statSync as statSync6 } from "fs";
+import { dirname as dirname3 } from "path";
 import { StringDecoder } from "string_decoder";
 var SCRIPT_STREAM_RE = /^\[([^\]]+)\] \[script:([a-z][a-z0-9-]*)((?::[a-z0-9:_-]+)?)\] (.*)$/;
 function parseLine(line) {
@@ -8665,7 +8555,7 @@ function writeRouteMilestone(streamLogPath, scope, line) {
   }
   const ts = (/* @__PURE__ */ new Date()).toISOString();
   try {
-    mkdirSync6(dirname4(streamLogPath), { recursive: true });
+    mkdirSync5(dirname3(streamLogPath), { recursive: true });
     appendFileSync2(streamLogPath, `[${ts}] [script:${scope}] ${line}
 `);
   } catch (err) {
@@ -8966,7 +8856,7 @@ app20.get("/domains", requireAdminSession, async (c) => {
   streamLogPath = cloudflareStreamLogPath(accountId, correlationId);
   log(`phase=stream-log-resolved path=${streamLogPath}`);
   const brand = loadBrandInfo();
-  const scriptPath = resolve13(homedir4(), "list-cf-domains.sh");
+  const scriptPath = resolve13(homedir3(), "list-cf-domains.sh");
   const result = await runFormSpawn({
     scriptPath,
     args: [brand.hostname],
@@ -9057,7 +8947,7 @@ app20.get("/tunnels", requireAdminSession, async (c) => {
   if (!accountId) return err("session", "No account bound to session \u2014 refresh chat.");
   if (!correlationId) return err("session", "No active conversation for session \u2014 refresh chat.");
   streamLogPath = cloudflareStreamLogPath(accountId, correlationId);
-  const certPath = resolve13(homedir4(), brand.configDir, "cloudflared", "cert.pem");
+  const certPath = resolve13(homedir3(), brand.configDir, "cloudflared", "cert.pem");
   const { existsSync: existsSync23 } = await import("fs");
   if (!existsSync23(certPath)) {
     return err("cert", `Cloudflare origin certificate is not on disk yet (${certPath}). Complete the Cloudflare login first by submitting the form once \u2014 the OAuth flow writes cert.pem.`);
@@ -9383,7 +9273,7 @@ var cloudflare_default = app20;
 import { createReadStream as createReadStream3 } from "fs";
 import { readdir as readdir2, readFile as readFile4, stat as stat4, mkdir as mkdir3, writeFile as writeFile4, unlink as unlink2 } from "fs/promises";
 import { realpathSync as realpathSync4 } from "fs";
-import { basename as basename4, dirname as dirname5, join as join11, resolve as resolve15, sep as sep3 } from "path";
+import { basename as basename4, dirname as dirname4, join as join10, resolve as resolve15, sep as sep3 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // app/lib/data-path.ts
@@ -9740,7 +9630,7 @@ async function cascadeDeleteDocument(params) {
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function readMeta(absDir, baseName) {
   try {
-    const raw = await readFile4(join11(absDir, `${baseName}.meta.json`), "utf8");
+    const raw = await readFile4(join10(absDir, `${baseName}.meta.json`), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.filename === "string") {
       return { filename: parsed.filename, mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0 };
@@ -9778,7 +9668,7 @@ async function readAccountNames() {
 }
 async function enrich(absolute, entry, accountNames) {
   if (entry.kind === "directory" && UUID_RE4.test(entry.name)) {
-    const meta = await readMeta(join11(absolute, entry.name), entry.name);
+    const meta = await readMeta(join10(absolute, entry.name), entry.name);
     if (meta?.filename) {
       entry.displayName = meta.filename;
       entry.mimeType = meta.mimeType;
@@ -9837,7 +9727,7 @@ app21.get("/", requireAdminSession, async (c) => {
         continue;
       }
       try {
-        const entryPath = join11(absolute, name);
+        const entryPath = join10(absolute, name);
         const s = await stat4(entryPath);
         entries.push({
           name,
@@ -10010,7 +9900,7 @@ app21.delete("/", requireAdminSession, async (c) => {
     }
     const dot = base.lastIndexOf(".");
     const stem = dot === -1 ? base : base.slice(0, dot);
-    const sidecarPath = UUID_RE4.test(stem) && base !== `${stem}.meta.json` ? join11(dirname5(absolute), `${stem}.meta.json`) : null;
+    const sidecarPath = UUID_RE4.test(stem) && base !== `${stem}.meta.json` ? join10(dirname4(absolute), `${stem}.meta.json`) : null;
     await unlink2(absolute);
     if (sidecarPath) {
       try {
@@ -10047,7 +9937,7 @@ app21.delete("/", requireAdminSession, async (c) => {
 var files_default = app21;
 
 // ../lib/graph-search/src/index.ts
-var import_dist2 = __toESM(require_dist2());
+var import_dist = __toESM(require_dist());
 import { int } from "neo4j-driver";
 var VECTOR_WEIGHT = 0.7;
 var BM25_WEIGHT = 0.3;
@@ -10102,7 +9992,7 @@ async function bm25Only(session, params) {
        ${scopeClause}
        ${agentClause}
        ${labelClause}
-       AND ${(0, import_dist2.notTrashed)("node")}
+       AND ${(0, import_dist.notTrashed)("node")}
        ${kwClause}
        RETURN node, score, labels(node) AS nodeLabels, elementId(node) AS nodeId
        ORDER BY score DESC
@@ -10209,7 +10099,7 @@ async function hybrid(session, embed2, params) {
        WHERE node.accountId = $accountId
        ${scopeClause}
        ${agentClause}
-       AND ${(0, import_dist2.notTrashed)("node")}
+       AND ${(0, import_dist.notTrashed)("node")}
        ${keywordClause}
        RETURN node, score, labels(node) AS nodeLabels, elementId(node) AS nodeId
        ORDER BY score DESC
@@ -10271,7 +10161,7 @@ async function hybrid(session, embed2, params) {
     const propResult = await session.run(
       `MATCH (node)
        WHERE node.accountId = $accountId
-       AND ${(0, import_dist2.notTrashed)("node")}
+       AND ${(0, import_dist.notTrashed)("node")}
        AND node.keywords IS NOT NULL
        AND ANY(kw IN $kwSubs WHERE ANY(nk IN node.keywords WHERE toLower(nk) = kw))
        ${propScopeClause}
@@ -10329,7 +10219,7 @@ async function hybrid(session, embed2, params) {
     labels: node.labels,
     properties: node.properties,
     score: node.combinedScore,
-    // Task 878 — carry the per-half components so the /data UI can render
+    // carry the per-half components so the /data UI can render
     // a per-row breakdown. These are already computed on `ScoredNode` from
     // the vector half (raw cosine) and the bm25 half (post-merge normalised
     // value, NOT raw Lucene). Memory MCP ignores both; admin route forwards
@@ -10347,7 +10237,7 @@ async function hybrid(session, embed2, params) {
       `UNWIND $nodeIds AS nid
        MATCH (n)-[r]-(related)
        WHERE elementId(n) = nid
-       AND ${(0, import_dist2.notTrashed)("related")}
+       AND ${(0, import_dist.notTrashed)("related")}
        ${expandScopeClause}
        ${expandAgentClause}
        WITH nid, n, r, related
@@ -10537,7 +10427,7 @@ app22.get("/", requireAdminSession, async (c) => {
       mode: res.mode,
       embedError: res.embedError,
       elapsedMs: total,
-      // Task 967 — UI surfaces ("N suppressed — show all" affordance on
+      // UI surfaces ("N suppressed — show all" affordance on
       // /graph and /data). `suppressed` is the count of rows the lib
       // dropped via the vector-cosine floor; `threshold` echoes the value
       // applied (null when no filter ran). `bm25Bypass` is operator-only
@@ -10581,7 +10471,7 @@ var GRAPH_LABEL_COLOURS = {
   AccessGrant: "#66381F",
   // Knowledge — moss family (organic)
   KnowledgeDocument: "#6E8A5A",
-  // Task 891 — chunked WhatsApp/messaging archive parent. Sits in the
+  // chunked WhatsApp/messaging archive parent. Sits in the
   // knowledge moss family because it's structurally a document parent
   // (HAS_SECTION → :Section:Conversation chunks); the conversational
   // plum family is reserved for the live Conversation/Message labels.
@@ -10597,7 +10487,7 @@ var GRAPH_LABEL_COLOURS = {
   ImageObject: "#A0BB8C",
   // Conversational — muted plum/lavender family
   //
-  // Pairwise-distinctness invariants (carried forward from the Task 649
+  // Pairwise-distinctness invariants (carried forward
   // palette):
   //   - Four sublabelled conversation/message labels (AdminConversation,
   //     PublicConversation, UserMessage, AssistantMessage) are pairwise
@@ -10632,7 +10522,7 @@ var GRAPH_LABEL_COLOURS = {
   // confusion doesn't apply, but kept distinguishable for the legend)
   Email: "#6F7F4A",
   EmailAccount: "#91A063",
-  // Public-agent projection (Task 837) — burnished bronze sits between
+  // Public-agent projection — burnished bronze sits between
   // people-terracotta and email-moss but shares neither hue, signalling
   // "operator-defined persona that traverses to KnowledgeDocuments,
   // Conversations, and other entities" without colliding with any existing
@@ -10884,7 +10774,7 @@ async function handleNeighbourhood(c, accountId) {
       // bare JS `number` works on Pi 4 today but errors on driver versions
       // that strictly type-check LIMIT clauses against Long.
       neighbourhoodLimit: neo4j.int(NEIGHBOURHOOD_LIMIT),
-      // Task 886 §C — same Long-int discipline for the cluster-expand cap.
+      // same Long-int discipline for the cluster-expand cap.
       // Used by NEIGHBOURHOOD_CYPHER's `siblingMessages[0..$clusterMessagesCap]`
       // slice. The search-intersect variant ignores it (cluster-expand
       // does not apply when search is narrowing the canvas).
@@ -11620,7 +11510,7 @@ function validateBody2(body) {
         ok: false,
         code: "not-eligible-chip",
         label: lbl,
-        reason: `label "${lbl}" is not eligible for default view \u2014 outside the chip allowlist (FILTER_TOP_LEVEL_LABELS, Task 753)`
+        reason: `label "${lbl}" is not eligible for default view \u2014 outside the chip allowlist (FILTER_TOP_LEVEL_LABELS)`
       };
     }
     seen.add(lbl);
@@ -12057,10 +11947,10 @@ var sidebar_artefact_content_default = app31;
 
 // server/routes/admin/health.ts
 import { existsSync as existsSync19, readFileSync as readFileSync16 } from "fs";
-import { resolve as resolve19, join as join12 } from "path";
+import { resolve as resolve19, join as join11 } from "path";
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve19(process.cwd(), "..");
 var brandHostname = "maxy";
-var brandJsonPath = join12(PLATFORM_ROOT6, "config", "brand.json");
+var brandJsonPath = join11(PLATFORM_ROOT6, "config", "brand.json");
 if (existsSync19(brandJsonPath)) {
   try {
     const brand = JSON.parse(readFileSync16(brandJsonPath, "utf-8"));
@@ -12644,7 +12534,7 @@ function clientFrom(c) {
   );
 }
 var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT7 ? join13(PLATFORM_ROOT7, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT7 ? join12(PLATFORM_ROOT7, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", domain: "getmaxy.com" };
 if (BRAND_JSON_PATH && !existsSync22(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
@@ -12670,7 +12560,7 @@ var brandLoginOpts = {
   bodyFont: BRAND.defaultFonts?.body,
   logoContainsName: !!BRAND.logoContainsName
 };
-var ALIAS_DOMAINS_PATH2 = join13(homedir5(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH2 = join12(homedir4(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
     if (!existsSync22(ALIAS_DOMAINS_PATH2)) return null;
@@ -13116,7 +13006,7 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT7) return "unknown";
-    const versionFile = join13(PLATFORM_ROOT7, "config", `.${BRAND.hostname}-version`);
+    const versionFile = join12(PLATFORM_ROOT7, "config", `.${BRAND.hostname}-version`);
     if (!existsSync22(versionFile)) return "unknown";
     const content = readFileSync19(versionFile, "utf-8").trim();
     return content || "unknown";
@@ -13175,14 +13065,14 @@ ${clientErrorReporterScript}
 }
 var brandedHtmlCache = /* @__PURE__ */ new Map();
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join13(homedir5(), BRAND.configDir);
+  const configDir2 = join12(homedir4(), BRAND.configDir);
   try {
-    const accountJsonPath = join13(configDir2, "account.json");
+    const accountJsonPath = join12(configDir2, "account.json");
     if (!existsSync22(accountJsonPath)) return null;
     const account = JSON.parse(readFileSync19(accountJsonPath, "utf-8"));
     const accountId = account.accountId;
     if (!accountId) return null;
-    const cachePath = join13(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    const cachePath = join12(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
     if (!existsSync22(cachePath)) return null;
     return JSON.parse(readFileSync19(cachePath, "utf-8"));
   } catch {
@@ -13191,8 +13081,8 @@ function loadBrandingCache(agentSlug) {
 }
 function resolveDefaultSlug() {
   try {
-    const configDir2 = join13(homedir5(), BRAND.configDir);
-    const accountJsonPath = join13(configDir2, "account.json");
+    const configDir2 = join12(homedir4(), BRAND.configDir);
+    const accountJsonPath = join12(configDir2, "account.json");
     if (!existsSync22(accountJsonPath)) return null;
     const account = JSON.parse(readFileSync19(accountJsonPath, "utf-8"));
     return account.defaultAgent || null;
@@ -13316,20 +13206,6 @@ app35.get("/data", (c) => {
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app35.get("/docs/desktop-code-controls", (c) => {
-  const host = (c.req.header("host") ?? "").split(":")[0];
-  if (isPublicHost(host)) return c.text("Not found", 404);
-  const docsPath = PLATFORM_ROOT7 ? resolve22(PLATFORM_ROOT7, "..", "docs", "desktop-code-controls.md") : resolve22(process.cwd(), "docs", "desktop-code-controls.md");
-  if (!existsSync22(docsPath)) {
-    console.error(`[docs] desktop-code-controls.md missing at ${docsPath}`);
-    return c.text(`docs/desktop-code-controls.md not found at ${docsPath}`, 404);
-  }
-  const md = readFileSync19(docsPath, "utf-8");
-  const escaped = md.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-  return c.html(
-    `<!doctype html><meta charset="utf-8"><title>Desktop Code-tab controls</title><style>body{font:14px/1.55 -apple-system,system-ui,sans-serif;max-width:760px;margin:2rem auto;padding:0 1rem;color:#111}pre{white-space:pre-wrap;font:inherit}</style><pre>${escaped}</pre>`
-  );
-});
 app35.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
@@ -13454,11 +13330,11 @@ reconcileEnabledPlugins(bootAccount?.accountDir, bootAccount?.config);
 (async () => {
   if (!bootAccount) return;
   try {
-    const { recoverRunningCloudflareTasks } = await import("./cloudflare-task-tracker-4PKOLE4H.js");
+    const { recoverRunningCloudflareTasks } = await import("./cloudflare-task-tracker-NEB3X6O2.js");
     const result = await recoverRunningCloudflareTasks(
       bootAccount.accountId,
       configDirForWhatsApp,
-      // Task 985 — no conversationId at boot. The reconciler operates on
+      // no conversationId at boot. The reconciler operates on
       // Tasks whose Conversation is already linked via RAISED_DURING; the
       // tracker resolves the conversationId off that edge when present.
       // Pass null and let the recovery path pick it up.
@@ -13514,7 +13390,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve22(process.env.MAXY_PLATFORM_ROOT ?? join13(__dirname, "..")),
+  platformRoot: resolve22(process.env.MAXY_PLATFORM_ROOT ?? join12(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (process.env.WHATSAPP_PTY_BRIDGE_ENABLED === "true" && msg.text && !msg.isOwnerMirror) {