@rubytech/create-maxy-code 0.1.442 → 0.1.443

package/payload/server/server.js

@@ -1413,10 +1413,10 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync36, existsSync as existsSync35, watchFile } from "fs";
+import { readFileSync as readFileSync37, existsSync as existsSync35, watchFile } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { createHash as createHash7 } from "crypto";
-import { resolve as resolve33, join as join36, basename as basename12 } from "path";
+import { resolve as resolve34, join as join37, basename as basename12 } from "path";
 import { homedir as homedir4 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
@@ -2129,7 +2129,7 @@ var credsSaveQueue = Promise.resolve();
 async function drainCredsSaveQueue(timeoutMs = 5e3) {
   console.error(`${TAG2} draining credential save queue\u2026`);
   const timer2 = new Promise(
-    (resolve34) => setTimeout(() => resolve34("timeout"), timeoutMs)
+    (resolve35) => setTimeout(() => resolve35("timeout"), timeoutMs)
   );
   const result = await Promise.race([
     credsSaveQueue.then(() => "drained"),
@@ -2292,11 +2292,11 @@ async function createWaSocket(opts) {
   return sock;
 }
 async function waitForConnection(sock) {
-  return new Promise((resolve34, reject) => {
+  return new Promise((resolve35, reject) => {
     const handler = (update) => {
       if (update.connection === "open") {
         sock.ev.off("connection.update", handler);
-        resolve34();
+        resolve35();
       }
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
@@ -2401,7 +2401,7 @@ import { inspect as inspect2 } from "util";
 
 // app/lib/whatsapp/with-timeout.ts
 function withTimeout(label, promise, timeoutMs) {
-  return new Promise((resolve34, reject) => {
+  return new Promise((resolve35, reject) => {
     const timer2 = setTimeout(() => {
       reject(new Error(`${label} timed out after ${timeoutMs}ms`));
     }, timeoutMs);
@@ -2409,7 +2409,7 @@ function withTimeout(label, promise, timeoutMs) {
     promise.then(
       (value) => {
         clearTimeout(timer2);
-        resolve34(value);
+        resolve35(value);
       },
       (err) => {
         clearTimeout(timer2);
@@ -3489,10 +3489,10 @@ function readConversationSummaries(platformAccountId) {
       } catch {
         continue;
       }
-      const cached2 = summaryCache.get(file);
-      if (cached2 && cached2.size === size && cached2.mtimeMs === mtimeMs) {
+      const cached3 = summaryCache.get(file);
+      if (cached3 && cached3.size === size && cached3.mtimeMs === mtimeMs) {
         cacheHits++;
-        out.set(remoteJid, cached2.summary);
+        out.set(remoteJid, cached3.summary);
         continue;
       }
       let summary;
@@ -3556,8 +3556,8 @@ async function persistWhatsAppMessage(input) {
   const { givenName, familyName } = splitName(input.pushName);
   const prev = sessionWriteLocks.get(input.cacheKey);
   let release;
-  const mine = new Promise((resolve34) => {
-    release = resolve34;
+  const mine = new Promise((resolve35) => {
+    release = resolve35;
   });
   const chained = (prev ?? Promise.resolve()).then(() => mine);
   sessionWriteLocks.set(input.cacheKey, chained);
@@ -3700,8 +3700,8 @@ import { resolve as resolve3 } from "path";
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var cache = /* @__PURE__ */ new Map();
 function enumerateValidAccountIds(accountsDir) {
-  const cached2 = cache.get(accountsDir);
-  if (cached2 !== void 0) return cached2;
+  const cached3 = cache.get(accountsDir);
+  if (cached3 !== void 0) return cached3;
   let names;
   try {
     names = readdirSync2(accountsDir);
@@ -5259,11 +5259,11 @@ async function connectWithReconnect(conn) {
       console.error(
         `${TAG13} reconnecting account=${conn.accountId} in ${delay}ms (attempt ${decision.nextAttempts}/${maxAttempts})`
       );
-      await new Promise((resolve34) => {
-        const timer2 = setTimeout(resolve34, delay);
+      await new Promise((resolve35) => {
+        const timer2 = setTimeout(resolve35, delay);
         conn.abortController.signal.addEventListener("abort", () => {
           clearTimeout(timer2);
-          resolve34();
+          resolve35();
         }, { once: true });
       });
     }
@@ -5271,16 +5271,16 @@ async function connectWithReconnect(conn) {
   }
 }
 function waitForDisconnectEvent(conn) {
-  return new Promise((resolve34) => {
+  return new Promise((resolve35) => {
     if (!conn.sock) {
-      resolve34();
+      resolve35();
       return;
     }
     const sock = conn.sock;
     const handler = (update) => {
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
-        resolve34();
+        resolve35();
       }
     };
     sock.ev.on("connection.update", handler);
@@ -5602,8 +5602,8 @@ async function handleInboundMessage(conn, msg) {
     const conversationKey = isGroup ? remoteJid : senderPhone;
     const debounceKey = `${conn.accountId}:${conversationKey}:${senderPhone}`;
     let resolvePending;
-    const sttPending = new Promise((resolve34) => {
-      resolvePending = resolve34;
+    const sttPending = new Promise((resolve35) => {
+      resolvePending = resolve35;
     });
     if (conn.debouncer) conn.debouncer.registerPending(debounceKey, sttPending);
     try {
@@ -6031,20 +6031,20 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
 
 // server/routes/health.ts
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve34) => {
+  return new Promise((resolve35) => {
     const socket = createConnection2(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve34(true);
+      resolve35(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve34(false);
+      resolve35(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve34(false);
+      resolve35(false);
     });
   });
 }
@@ -7321,8 +7321,8 @@ async function startLogin(opts) {
   await clearAuth(authDir);
   let resolveCode = null;
   let rejectCode = null;
-  const codePromise = new Promise((resolve34, reject) => {
-    resolveCode = resolve34;
+  const codePromise = new Promise((resolve35, reject) => {
+    resolveCode = resolve35;
     rejectCode = reject;
   });
   const codeTimer = setTimeout(
@@ -9210,6 +9210,24 @@ function splitNewLines(buf, baseOffset) {
   };
 }
 
+// app/lib/whatsapp-reader/authorize-reply-file-ref.ts
+var ACCOUNT_UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function accountPartitionOwner(relative7) {
+  const segs = relative7.split("/").filter(Boolean);
+  if (segs.length < 2 || segs[0] !== "accounts") return null;
+  return ACCOUNT_UUID_RE2.test(segs[1]) ? segs[1] : null;
+}
+function authorizeReplyFileRef(input) {
+  const { relative: relative7, sendAccountId, sessionAccountId } = input;
+  const segs = relative7.split("/").filter(Boolean);
+  const inAccounts = segs.length >= 2 && segs[0] === "accounts";
+  if (inAccounts && segs[1] === sendAccountId) return { allow: true, via: "own" };
+  if (inAccounts && sessionAccountId && segs[1] === sessionAccountId) return { allow: true, via: "session" };
+  if (accountPartitionOwner(relative7)) return { allow: false, reason: "cross-account" };
+  if (segs[0] === "public" || inAccounts && segs[1] === "public") return { allow: false, reason: "public" };
+  return { allow: false, reason: "foreign" };
+}
+
 // server/routes/admin/manager-client.ts
 var SESSION_ID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function isSessionId(value) {
@@ -9244,6 +9262,11 @@ function isMimeAdmitted(mimeType, supportedSet) {
 
 // server/routes/whatsapp-reader.ts
 var app4 = new Hono();
+var DENY_COPY = {
+  "cross-account": "This file belongs to another account. Open that account to send it.",
+  public: "This file cannot be sent to a WhatsApp contact.",
+  foreign: "This file cannot be sent to a WhatsApp contact."
+};
 app4.get("/conversations", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const scopeAccountId = getAccountIdForSession(cacheKey) ?? null;
@@ -9891,7 +9914,9 @@ app4.post("/reply", requireAdminSession, async (c) => {
       return c.json({ error: "invalid accountId" }, 400);
     }
     const validAccount = isValidAccountId(accountId);
-    console.log(`${MANUAL_TAG} op=scope sendId=${sendId} accountId=${accountId} validAccount=${validAccount}`);
+    const cacheKey = c.var.cacheKey;
+    const sessionAccountId = getAccountIdForSession(cacheKey) ?? null;
+    console.log(`${MANUAL_TAG} op=scope sendId=${sendId} accountId=${accountId} validAccount=${validAccount} sessionAccount=${sessionAccountId ?? "null"} src=session`);
     if (!validAccount) {
       exit("rejected");
       return c.json({ error: "unknown account" }, 400);
@@ -9929,26 +9954,37 @@ app4.post("/reply", requireAdminSession, async (c) => {
       }
     }
     const resolvedRefs = [];
+    const acct8 = accountId.slice(0, 8);
+    const sess8 = sessionAccountId ? sessionAccountId.slice(0, 8) : "";
     for (const ref of fileRefs) {
       const resolved = resolveDataPath(ref);
-      const withinOwn = resolved.ok && !crossesForeignAccountPartition(resolved.relative, accountId) && isWithinOwnAccountPartition(resolved.relative, accountId);
-      let absolute = "";
+      if (!resolved.ok) {
+        console.log(`${MANUAL_TAG} op=reply-file-ref sendId=${sendId} path=${ref} owner= sendAccount=${acct8} sessionAccount=${sess8} via=deny reason=unresolved ok=false`);
+        exit("rejected");
+        return c.json({ error: `device file not found: ${ref}`, reason: "file-ref-unresolved" }, 404);
+      }
+      const owner = accountPartitionOwner(resolved.relative);
+      const owner8 = owner ? owner.slice(0, 8) : "";
+      const decision = authorizeReplyFileRef({ relative: resolved.relative, sendAccountId: accountId, sessionAccountId });
+      if (!decision.allow) {
+        console.log(`${MANUAL_TAG} op=reply-file-ref sendId=${sendId} path=${ref} owner=${owner8} sendAccount=${acct8} sessionAccount=${sess8} via=deny reason=${decision.reason} ok=false`);
+        exit("rejected");
+        return c.json({ error: DENY_COPY[decision.reason], reason: `file-ref-${decision.reason}` }, 403);
+      }
+      const absolute = resolved.absolute;
       let size = -1;
-      if (withinOwn) {
-        absolute = resolved.absolute;
-        try {
-          const st = statSync5(absolute);
-          size = st.isFile() ? st.size : -1;
-        } catch {
-          size = -1;
-        }
+      try {
+        const st = statSync5(absolute);
+        size = st.isFile() ? st.size : -1;
+      } catch {
+        size = -1;
       }
-      const ok = size >= 0;
-      console.log(`${MANUAL_TAG} op=reply-file-ref sendId=${sendId} path=${ref} resolved=${absolute} ok=${ok}`);
-      if (!ok) {
+      if (size < 0) {
+        console.log(`${MANUAL_TAG} op=reply-file-ref sendId=${sendId} path=${ref} owner=${owner8} sendAccount=${acct8} sessionAccount=${sess8} via=${decision.via} reason=missing ok=false`);
         exit("rejected");
         return c.json({ error: `device file not found: ${ref}`, reason: "file-ref-unresolved" }, 404);
       }
+      console.log(`${MANUAL_TAG} op=reply-file-ref sendId=${sendId} path=${ref} owner=${owner8} sendAccount=${acct8} sessionAccount=${sess8} via=${decision.via} reason=none ok=true`);
       if (size > MAX_FILE_BYTES) {
         exit("rejected");
         return c.json({ error: `"${basename4(absolute)}" exceeds the 50 MB limit` }, 400);
@@ -17099,6 +17135,142 @@ function isHiddenByDefault(label) {
   return HIDDEN_BY_DEFAULT_LABELS.has(label);
 }
 
+// server/lib/top-level-labels.ts
+import { readdirSync as readdirSync19, readFileSync as readFileSync30 } from "fs";
+import { join as join30, resolve as resolve23 } from "path";
+var STATIC_TOP_LEVEL_LABELS = Object.freeze(
+  /* @__PURE__ */ new Set([
+    // Base-schema infra (schema-base.md has no top-level section).
+    "LocalBusiness",
+    "Service",
+    "PriceSpecification",
+    "OpeningHoursSpecification",
+    "Organization",
+    "Person",
+    "UserProfile",
+    "Preference",
+    "AdminUser",
+    "AccessGrant",
+    "KnowledgeDocument",
+    "DigitalDocument",
+    "CreativeWork",
+    "Question",
+    "FAQPage",
+    "DefinedTerm",
+    "Review",
+    "ImageObject",
+    "Invoice",
+    "Task",
+    "Project",
+    "Event",
+    "Workflow",
+    "Email",
+    "EmailAccount",
+    "Agent",
+    // Knowledge-work vertical: schema-knowledge-work.md has no top-level
+    // section yet.
+    "Objective",
+    "KeyResult",
+    "Decision",
+    "Risk",
+    "Source",
+    "Finding",
+    "Hypothesis"
+  ])
+);
+function splitPipeRow(row) {
+  let trimmed = row.trim();
+  if (trimmed.startsWith("|")) trimmed = trimmed.slice(1);
+  if (trimmed.endsWith("|")) trimmed = trimmed.slice(0, -1);
+  const cells = [];
+  let inBacktick = false;
+  let start = 0;
+  for (let i = 0; i < trimmed.length; i++) {
+    const ch = trimmed[i];
+    if (ch === "`") inBacktick = !inBacktick;
+    else if (ch === "|" && !inBacktick) {
+      cells.push(trimmed.slice(start, i).trim());
+      start = i + 1;
+    }
+  }
+  cells.push(trimmed.slice(start).trim());
+  return cells;
+}
+var stripBackticks = (s) => s.replace(/`/g, "").trim();
+function parseTopLevelLabels(content) {
+  const lines = content.split(/\r?\n/);
+  let i = 0;
+  while (i < lines.length) {
+    if (lines[i].toLowerCase().startsWith("## top-level node types")) break;
+    i++;
+  }
+  if (i >= lines.length) return [];
+  i++;
+  for (; i < lines.length - 1; i++) {
+    const line = lines[i];
+    if (line.startsWith("## ")) return [];
+    if (!line.includes("|")) continue;
+    const sep9 = lines[i + 1];
+    if (!/^\s*\|?[\s:|-]+\|?\s*$/.test(sep9) || !sep9.includes("-")) continue;
+    const headers = splitPipeRow(line).map((h) => stripBackticks(h).toLowerCase());
+    const labelCol = headers.findIndex((h) => h === "neo4j label");
+    if (labelCol === -1) return [];
+    const out = [];
+    let j = i + 2;
+    for (; j < lines.length; j++) {
+      const row = lines[j];
+      if (!row.trim() || !row.includes("|")) break;
+      const cells = splitPipeRow(row);
+      const label = stripBackticks(cells[labelCol] ?? "");
+      if (label) out.push(label);
+    }
+    return out;
+  }
+  return [];
+}
+function resolveReferencesDir() {
+  if (process.env.MAXY_PLATFORM_ROOT) {
+    return join30(process.env.MAXY_PLATFORM_ROOT, "plugins", "memory", "references");
+  }
+  return resolve23(import.meta.dirname, "../../../plugins/memory/references");
+}
+function parseTableTopLevelLabels(referencesDir) {
+  const labels = /* @__PURE__ */ new Set();
+  const contributingFiles = [];
+  try {
+    const fileNames = readdirSync19(referencesDir).filter((f) => f.startsWith("schema-") && f.endsWith(".md")).sort();
+    for (const fileName of fileNames) {
+      const content = readFileSync30(join30(referencesDir, fileName), "utf-8");
+      const parsed = parseTopLevelLabels(content);
+      if (parsed.length > 0) contributingFiles.push(fileName);
+      for (const label of parsed) labels.add(label);
+    }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    process.stderr.write(
+      `[graph-page] op=top-level-labels source=ontology status=error dir=${referencesDir} reason="${message}"
+`
+    );
+    throw err;
+  }
+  return { labels, contributingFiles };
+}
+var cached = null;
+function getTopLevelLabelAllowlist(opts = {}) {
+  if (!opts.referencesDir && cached) return cached;
+  const referencesDir = opts.referencesDir ?? resolveReferencesDir();
+  const { labels: derived, contributingFiles } = parseTableTopLevelLabels(referencesDir);
+  const derivedCount = derived.size;
+  for (const label of STATIC_TOP_LEVEL_LABELS) derived.add(label);
+  const result = Object.freeze(derived);
+  process.stderr.write(
+    `[graph-page] op=top-level-labels source=ontology count=${derived.size} files=${contributingFiles.join("|") || "none"} derived=${derivedCount} static=${STATIC_TOP_LEVEL_LABELS.size}
+`
+  );
+  if (!opts.referencesDir) cached = result;
+  return result;
+}
+
 // server/routes/admin/graph-subgraph.ts
 var CEILING = 2e3;
 var TOP_LEVEL_LIMIT = 1e3;
@@ -17220,7 +17392,7 @@ async function handleDefault(c, accountId) {
 }
 async function handleDefaultTopLevel(c, accountId, flags) {
   const { includeTrashed, includeAgentActions } = flags;
-  const labels = [...FILTER_TOP_LEVEL_LABELS].filter((l) => !HIDDEN_BY_DEFAULT_LABELS.has(l));
+  const labels = [...getTopLevelLabelAllowlist()].filter((l) => !HIDDEN_BY_DEFAULT_LABELS.has(l));
   const agentActionLabels = [...AGENT_ACTION_LABELS];
   const started = Date.now();
   const session = getSession();
@@ -18031,7 +18203,7 @@ app26.get("/", requireAdminSession, async (c) => {
   const started = Date.now();
   const session = getSession();
   try {
-    const allowedSet = new Set(FILTER_TOP_LEVEL_LABELS);
+    const allowedSet = new Set(getTopLevelLabelAllowlist());
     if (includeAgentActions) {
       for (const label of AGENT_ACTION_LABELS) allowedSet.add(label);
     }
@@ -18193,12 +18365,12 @@ function validateBody(body) {
     if (typeof lbl !== "string") {
       return { ok: false, code: "shape", reason: "labels must be an array of strings" };
     }
-    if (!FILTER_TOP_LEVEL_LABELS.has(lbl)) {
+    if (!getTopLevelLabelAllowlist().has(lbl)) {
       return {
         ok: false,
         code: "not-eligible-chip",
         label: lbl,
-        reason: `label "${lbl}" is not eligible for default view \u2014 outside the chip allowlist (FILTER_TOP_LEVEL_LABELS)`
+        reason: `label "${lbl}" is not eligible for default view \u2014 outside the chip allowlist`
       };
     }
     seen.add(lbl);
@@ -18221,7 +18393,7 @@ var graph_default_view_default = app27;
 
 // server/routes/admin/sidebar-artefacts.ts
 import { readdir as readdir4, stat as stat5 } from "fs/promises";
-import { resolve as resolve23, relative as relative5, isAbsolute as isAbsolute2, sep as sep7, basename as basename10 } from "path";
+import { resolve as resolve24, relative as relative5, isAbsolute as isAbsolute2, sep as sep7, basename as basename10 } from "path";
 import { existsSync as existsSync27 } from "fs";
 var LIMIT = 50;
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
@@ -18241,7 +18413,7 @@ app28.get("/", requireAdminSession, async (c) => {
   if (accountFiles === null) {
     return c.json({ error: "Failed to load artefacts" }, 500);
   }
-  const accountDir = resolve23(ACCOUNTS_DIR, accountId);
+  const accountDir = resolve24(ACCOUNTS_DIR, accountId);
   const agents = await fetchAgentTemplateRows(accountDir);
   const artefacts = [...accountFiles, ...agents].sort(
     (a, b) => (b.updatedAt ?? "").localeCompare(a.updatedAt ?? "")
@@ -18293,8 +18465,8 @@ async function fetchAccountFileArtefacts(accountId) {
 async function fetchAgentTemplateRows(accountDir) {
   const rows = [];
   for (const filename of ADMIN_AGENT_FILES) {
-    const overridePath = resolve23(accountDir, "agents", "admin", filename);
-    const bundledPath = resolve23(PLATFORM_ROOT, "templates", "agents", "admin", filename);
+    const overridePath = resolve24(accountDir, "agents", "admin", filename);
+    const bundledPath = resolve24(PLATFORM_ROOT, "templates", "agents", "admin", filename);
     const labelStem = filename.replace(/\.md$/, "");
     const row = await readAgentTemplateRow({
       id: `agent-template:admin:${filename}`,
@@ -18307,12 +18479,12 @@ async function fetchAgentTemplateRows(accountDir) {
     });
     if (row) rows.push(row);
   }
-  const overrideDir = resolve23(accountDir, "specialists", "agents");
-  const bundledDir = resolve23(PLATFORM_ROOT, "templates", "specialists", "agents");
+  const overrideDir = resolve24(accountDir, "specialists", "agents");
+  const bundledDir = resolve24(PLATFORM_ROOT, "templates", "specialists", "agents");
   const specialistNames = await unionSpecialistFilenames(overrideDir, bundledDir);
   for (const filename of specialistNames) {
-    const overridePath = resolve23(overrideDir, filename);
-    const bundledPath = resolve23(bundledDir, filename);
+    const overridePath = resolve24(overrideDir, filename);
+    const bundledPath = resolve24(bundledDir, filename);
     const row = await readAgentTemplateRow({
       id: `agent-template:specialist:${filename}`,
       displayName: filename.replace(/\.md$/, ""),
@@ -18594,7 +18766,7 @@ var session_usage_default = app33;
 
 // server/routes/admin/session-rc-spawn.ts
 import { randomUUID as randomUUID10 } from "crypto";
-var ACCOUNT_UUID_RE2 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+var ACCOUNT_UUID_RE3 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 function resolveSpawnPlan(host, operatorDomains, body, mintId = randomUUID10, adminUserId, authenticatedName, callerAccountId) {
   const operator = isOperatorHost(host, operatorDomains);
   const resumeId = typeof body.sessionId === "string" && body.sessionId.length > 0 ? body.sessionId : void 0;
@@ -18605,8 +18777,8 @@ function resolveSpawnPlan(host, operatorDomains, body, mintId = randomUUID10, ad
   const pickedModel = kind === "new" && typeof body.model === "string" && isSelectableModel(body.model) ? body.model : null;
   const pickedEffort = kind === "new" && typeof body.effort === "string" && isNewSessionEffortLevel(body.effort) ? body.effort : null;
   const paramsSource = pickedModel !== null && pickedEffort !== null ? "picker" : "default";
-  const callerTargetAccountId = typeof callerAccountId === "string" && ACCOUNT_UUID_RE2.test(callerAccountId) ? callerAccountId : void 0;
-  const bodyTargetAccountId = typeof body.targetAccountId === "string" && ACCOUNT_UUID_RE2.test(body.targetAccountId) ? body.targetAccountId : void 0;
+  const callerTargetAccountId = typeof callerAccountId === "string" && ACCOUNT_UUID_RE3.test(callerAccountId) ? callerAccountId : void 0;
+  const bodyTargetAccountId = typeof body.targetAccountId === "string" && ACCOUNT_UUID_RE3.test(body.targetAccountId) ? body.targetAccountId : void 0;
   const targetAccountId = kind === "new" ? callerTargetAccountId : bodyTargetAccountId;
   const payload = {};
   let sessionId;
@@ -18957,24 +19129,24 @@ app36.get("/", async (c) => {
 var system_stats_default = app36;
 
 // server/routes/admin/health.ts
-import { existsSync as existsSync28, readFileSync as readFileSync30 } from "fs";
-import { resolve as resolve24, join as join30 } from "path";
-var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve24(process.cwd(), "..");
+import { existsSync as existsSync28, readFileSync as readFileSync31 } from "fs";
+import { resolve as resolve25, join as join31 } from "path";
+var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve25(process.cwd(), "..");
 var brandHostname = "maxy";
-var brandJsonPath = join30(PLATFORM_ROOT6, "config", "brand.json");
+var brandJsonPath = join31(PLATFORM_ROOT6, "config", "brand.json");
 if (existsSync28(brandJsonPath)) {
   try {
-    const brand = JSON.parse(readFileSync30(brandJsonPath, "utf-8"));
+    const brand = JSON.parse(readFileSync31(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
   } catch {
   }
 }
-var VERSION_FILE = resolve24(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
+var VERSION_FILE = resolve25(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
   if (!existsSync28(VERSION_FILE)) return "unknown";
-  return readFileSync30(VERSION_FILE, "utf-8").trim() || "unknown";
+  return readFileSync31(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
   let session;
@@ -19751,7 +19923,7 @@ var browser_default = app44;
 
 // server/routes/admin/calendar.ts
 import { existsSync as existsSync29 } from "fs";
-import { join as join32 } from "path";
+import { join as join33 } from "path";
 
 // server/lib/calendar-ics.ts
 var CRLF = "\r\n";
@@ -19850,8 +20022,8 @@ function countVEvents(ics) {
 }
 
 // server/lib/calendar-availability.ts
-import { readFileSync as readFileSync31 } from "fs";
-import { join as join31 } from "path";
+import { readFileSync as readFileSync32 } from "fs";
+import { join as join32 } from "path";
 var AVAILABILITY_FILENAME = "calendar-availability.json";
 var REQUIRED_KEYS = [
   "timezone",
@@ -19860,10 +20032,10 @@ var REQUIRED_KEYS = [
   "weekly"
 ];
 function readAvailabilityConfig(accountDir) {
-  const path2 = join31(accountDir, AVAILABILITY_FILENAME);
+  const path2 = join32(accountDir, AVAILABILITY_FILENAME);
   let raw;
   try {
-    raw = readFileSync31(path2, "utf-8");
+    raw = readFileSync32(path2, "utf-8");
   } catch {
     throw new Error(`availability not configured: ${path2} not found`);
   }
@@ -20222,7 +20394,7 @@ app45.get("/booking-link", requireAdminSession, (c) => {
       console.error('[calendar] op=booking-link-fail err="no account configured"');
       return c.json({ bookingDomain: null });
     }
-    if (!existsSync29(join32(account.accountDir, AVAILABILITY_FILENAME))) {
+    if (!existsSync29(join33(account.accountDir, AVAILABILITY_FILENAME))) {
       console.log("[calendar] op=booking-link bookingDomain=none source=availability-config");
       return c.json({ bookingDomain: null });
     }
@@ -20696,9 +20868,9 @@ var verify_token_default = app52;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
-import { resolve as resolve25 } from "path";
-var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve25(process.cwd(), "..");
-var SEND_SCRIPT = resolve25(
+import { resolve as resolve26 } from "path";
+var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve26(process.cwd(), "..");
+var SEND_SCRIPT = resolve26(
   PLATFORM_ROOT7,
   "plugins",
   "email",
@@ -20840,8 +21012,8 @@ app54.route("/request-magic-link", request_magic_link_default);
 var access_default = app54;
 
 // server/routes/sites.ts
-import { existsSync as existsSync30, readFileSync as readFileSync32, realpathSync as realpathSync6, statSync as statSync12 } from "fs";
-import { resolve as resolve26 } from "path";
+import { existsSync as existsSync30, readFileSync as readFileSync33, realpathSync as realpathSync6, statSync as statSync12 } from "fs";
+import { resolve as resolve27 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
   ".html": "text/html; charset=utf-8",
@@ -20898,8 +21070,8 @@ app55.get("/:rel{.*}", (c) => {
     }
     segments.push(seg);
   }
-  const rootDir = resolve26(account.accountDir, "sites");
-  let filePath = segments.length === 0 ? rootDir : resolve26(rootDir, ...segments);
+  const rootDir = resolve27(account.accountDir, "sites");
+  let filePath = segments.length === 0 ? rootDir : resolve27(rootDir, ...segments);
   if (filePath !== rootDir && !filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
@@ -20919,7 +21091,7 @@ app55.get("/:rel{.*}", (c) => {
     return c.redirect(target, 301);
   }
   if (stat8?.isDirectory()) {
-    filePath = resolve26(filePath, "index.html");
+    filePath = resolve27(filePath, "index.html");
   }
   if (!filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
@@ -20944,7 +21116,7 @@ app55.get("/:rel{.*}", (c) => {
   }
   let body;
   try {
-    body = readFileSync32(realPath);
+    body = readFileSync33(realPath);
   } catch (err) {
     const code = err?.code;
     if (code === "EISDIR") {
@@ -20980,7 +21152,7 @@ var sites_default = app55;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync33, writeFileSync as writeFileSync11 } from "fs";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync34, writeFileSync as writeFileSync11 } from "fs";
 import { dirname as dirname11 } from "path";
 var TOKEN_PREFIX = "v1.";
 var SECRET_BYTES = 32;
@@ -20989,7 +21161,7 @@ var cachedSecret = null;
 function getSecret() {
   if (cachedSecret) return cachedSecret;
   try {
-    const hex2 = readFileSync33(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+    const hex2 = readFileSync34(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
     if (hex2.length === SECRET_BYTES * 2) {
       cachedSecret = Buffer.from(hex2, "hex");
       return cachedSecret;
@@ -21003,7 +21175,7 @@ function getSecret() {
     console.log(`[visitor-token] secret minted path=${VISITOR_TOKEN_SECRET_FILE}`);
   } catch {
   }
-  const hex = readFileSync33(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+  const hex = readFileSync34(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
   cachedSecret = Buffer.from(hex, "hex");
   return cachedSecret;
 }
@@ -21056,20 +21228,20 @@ var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync31, readFileSync as readFileSync34 } from "fs";
-import { join as join33 } from "path";
-var cached = null;
+import { existsSync as existsSync31, readFileSync as readFileSync35 } from "fs";
+import { join as join34 } from "path";
+var cached2 = null;
 var cachedAttempted = false;
 function readBrandConfig() {
-  if (cachedAttempted) return cached;
+  if (cachedAttempted) return cached2;
   cachedAttempted = true;
   const platformRoot3 = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot3) return null;
-  const brandPath = join33(platformRoot3, "config", "brand.json");
+  const brandPath = join34(platformRoot3, "config", "brand.json");
   if (!existsSync31(brandPath)) return null;
   try {
-    cached = JSON.parse(readFileSync34(brandPath, "utf-8"));
-    return cached;
+    cached2 = JSON.parse(readFileSync35(brandPath, "utf-8"));
+    return cached2;
   } catch {
     return null;
   }
@@ -21556,14 +21728,14 @@ async function writeEvent(opts) {
 var visitor_event_default = app58;
 
 // server/routes/session.ts
-import { resolve as resolve27 } from "path";
+import { resolve as resolve28 } from "path";
 import { existsSync as existsSync32, writeFileSync as writeFileSync12, mkdirSync as mkdirSync8 } from "fs";
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function writeBrandingCache(accountId, agentSlug, branding) {
   try {
-    const cacheDir = resolve27(MAXY_DIR, "branding-cache", accountId);
+    const cacheDir = resolve28(MAXY_DIR, "branding-cache", accountId);
     mkdirSync8(cacheDir, { recursive: true });
-    writeFileSync12(resolve27(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
+    writeFileSync12(resolve28(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
   } catch (err) {
     console.error(`[branding] cache write failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -21640,8 +21812,8 @@ app59.post("/", async (c) => {
   }
   let agentConfig = null;
   if (account) {
-    const agentDir = resolve27(account.accountDir, "agents", agentSlug);
-    if (!existsSync32(agentDir) || !existsSync32(resolve27(agentDir, "config.json"))) {
+    const agentDir = resolve28(account.accountDir, "agents", agentSlug);
+    if (!existsSync32(agentDir) || !existsSync32(resolve28(agentDir, "config.json"))) {
       return c.json({ error: "Agent not found" }, 404);
     }
     agentConfig = resolveAgentConfig(account.accountDir, agentSlug);
@@ -22087,8 +22259,8 @@ function startGraphHealthTimer() {
 
 // app/lib/file-watcher.ts
 import * as fsp2 from "fs/promises";
-import { resolve as resolve28, sep as sep8 } from "path";
-var ACCOUNT_UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+import { resolve as resolve29, sep as sep8 } from "path";
+var ACCOUNT_UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var DEFAULT_COALESCE_MS = 500;
 var ROOTS = ["accounts"];
 function _routeEvent(rootName, filename) {
@@ -22096,7 +22268,7 @@ function _routeEvent(rootName, filename) {
   const segs = filename.split(sep8).filter(Boolean);
   if (segs.length < 2) return null;
   const accountId = segs[0];
-  if (!ACCOUNT_UUID_RE3.test(accountId)) return null;
+  if (!ACCOUNT_UUID_RE4.test(accountId)) return null;
   return { accountId, relativePath: `${rootName}/${segs.join("/")}` };
 }
 async function startFileWatcher(opts = {}) {
@@ -22106,7 +22278,7 @@ async function startFileWatcher(opts = {}) {
   const dropFn = opts.drop ?? dropFileIndex;
   for (const r of ROOTS) {
     try {
-      await fsp2.mkdir(resolve28(dataRoot, r), { recursive: true });
+      await fsp2.mkdir(resolve29(dataRoot, r), { recursive: true });
     } catch (err) {
       console.error(
         `[file-watcher] start-failed root="${r}" err="${err.message}" \u2014 index will be maintained by the 5-min reconcile backstop only`
@@ -22127,7 +22299,7 @@ async function startFileWatcher(opts = {}) {
     timers.set(relativePath, t);
   }
   async function runHook(relativePath, accountId) {
-    const absolute = resolve28(dataRoot, relativePath);
+    const absolute = resolve29(dataRoot, relativePath);
     let exists = false;
     try {
       const st = await fsp2.stat(absolute);
@@ -22151,7 +22323,7 @@ async function startFileWatcher(opts = {}) {
     }
   }
   async function watchRoot(rootName) {
-    const absRoot = resolve28(dataRoot, rootName);
+    const absRoot = resolve29(dataRoot, rootName);
     try {
       const iter = fsp2.watch(absRoot, { recursive: true, signal: controller.signal });
       for await (const event of iter) {
@@ -22190,8 +22362,8 @@ async function startFileWatcher(opts = {}) {
 
 // app/lib/migrate-uploads.ts
 import { mkdir as mkdir5, readdir as readdir5, rename as rename2, rm as rm3 } from "fs/promises";
-import { dirname as dirname12, relative as relative6, resolve as resolve29 } from "path";
-var ACCOUNT_UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+import { dirname as dirname12, relative as relative6, resolve as resolve30 } from "path";
+var ACCOUNT_UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function walkFiles(dir) {
   const out = [];
   let entries;
@@ -22201,7 +22373,7 @@ async function walkFiles(dir) {
     return out;
   }
   for (const e of entries) {
-    const abs = resolve29(dir, e.name);
+    const abs = resolve30(dir, e.name);
     if (e.isDirectory()) {
       out.push(...await walkFiles(abs));
     } else if (e.isFile()) {
@@ -22221,7 +22393,7 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
   let moved = 0;
   for (const oldAbs of files) {
     const suffix = relative6(srcDir, oldAbs);
-    const newAbs = resolve29(destDir, suffix);
+    const newAbs = resolve30(destDir, suffix);
     await mkdir5(dirname12(newAbs), { recursive: true });
     await rename2(oldAbs, newAbs);
     moved++;
@@ -22248,7 +22420,7 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
 }
 async function migrateUploads(opts = {}) {
   const dataRoot = opts.dataRoot ?? DATA_ROOT;
-  const oldRoot = resolve29(dataRoot, "uploads");
+  const oldRoot = resolve30(dataRoot, "uploads");
   let topEntries;
   try {
     topEntries = await readdir5(oldRoot, { withFileTypes: true });
@@ -22267,10 +22439,10 @@ async function migrateUploads(opts = {}) {
   try {
     for (const entry of topEntries) {
       const name = entry.name;
-      if (ACCOUNT_UUID_RE4.test(name)) {
+      if (ACCOUNT_UUID_RE5.test(name)) {
         moved += await relocateTree(
-          resolve29(oldRoot, name),
-          resolve29(dataRoot, "accounts", name, "uploads"),
+          resolve30(oldRoot, name),
+          resolve30(dataRoot, "accounts", name, "uploads"),
           dataRoot,
           name,
           session
@@ -22282,8 +22454,8 @@ async function migrateUploads(opts = {}) {
           continue;
         }
         moved += await relocateTree(
-          resolve29(oldRoot, "public"),
-          resolve29(dataRoot, "accounts", installAccountId, "uploads", "public"),
+          resolve30(oldRoot, "public"),
+          resolve30(dataRoot, "accounts", installAccountId, "uploads", "public"),
           dataRoot,
           null,
           // public uploads carry no graph nodes
@@ -22314,7 +22486,7 @@ async function migrateUploads(opts = {}) {
 // app/lib/migrate-admin-webchat-sidecars.ts
 import { readdir as readdir6, readFile as readFile6, rename as rename3, writeFile as writeFile4, unlink as unlink3 } from "fs/promises";
 import { existsSync as existsSync33 } from "fs";
-import { join as join34 } from "path";
+import { join as join35 } from "path";
 var ADMIN_ROLE2 = "admin";
 var WEBCHAT_CHANNEL2 = "webchat";
 var SESSION_META_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.meta\.json$/i;
@@ -22359,7 +22531,7 @@ async function collectLiveSidecars(projectsRoot) {
   }
   for (const slug of slugs) {
     if (!slug.isDirectory()) continue;
-    const slugDir = join34(projectsRoot, slug.name);
+    const slugDir = join35(projectsRoot, slug.name);
     let entries;
     try {
       entries = await readdir6(slugDir, { withFileTypes: true });
@@ -22368,9 +22540,9 @@ async function collectLiveSidecars(projectsRoot) {
     }
     for (const entry of entries) {
       if (entry.isFile() && SESSION_META_RE.test(entry.name)) {
-        out.push(join34(slugDir, entry.name));
+        out.push(join35(slugDir, entry.name));
       } else if (entry.isDirectory() && entry.name === "subagents") {
-        const subDir = join34(slugDir, entry.name);
+        const subDir = join35(slugDir, entry.name);
         let subs;
         try {
           subs = await readdir6(subDir, { withFileTypes: true });
@@ -22378,7 +22550,7 @@ async function collectLiveSidecars(projectsRoot) {
           continue;
         }
         for (const s of subs) {
-          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join34(subDir, s.name));
+          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join35(subDir, s.name));
         }
       }
     }
@@ -22390,7 +22562,7 @@ function shortId(path2) {
   return base.slice(0, 8);
 }
 async function migrateAdminWebchatSidecars(opts = {}) {
-  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join34(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
+  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join35(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
   const usersFile = opts.usersFile ?? USERS_FILE;
   const accountId = opts.accountId ?? resolveAccount()?.accountId ?? null;
   const resolveName = opts.resolveName ?? defaultResolveName;
@@ -23369,16 +23541,16 @@ var WebchatGateway = class _WebchatGateway {
    *  The public /api/chat route awaits this to return the reply on the same SSE
    *  response, preserving the pre-756 POST→single-blob browser contract. */
   awaitReply(key, timeoutMs) {
-    return new Promise((resolve34) => {
+    return new Promise((resolve35) => {
       const timer2 = setTimeout(() => {
         this.replyAwaiters.delete(key);
-        resolve34({ timeout: true });
+        resolve35({ timeout: true });
       }, timeoutMs);
       if (timer2.unref) timer2.unref();
       this.replyAwaiters.set(key, (r) => {
         clearTimeout(timer2);
         this.replyAwaiters.delete(key);
-        resolve34(r);
+        resolve35(r);
       });
     });
   }
@@ -23389,11 +23561,11 @@ var WebchatGateway = class _WebchatGateway {
    *  terminal dialog stays answerable). */
   awaitPermissionVerdict(p, timeoutMs) {
     const k = _WebchatGateway.promptKey(p.key, p.requestId);
-    return new Promise((resolve34) => {
+    return new Promise((resolve35) => {
       this.pendingPrompts.get(k)?.resolve({ timeout: true });
       const timer2 = setTimeout(() => {
         this.pendingPrompts.delete(k);
-        resolve34({ timeout: true });
+        resolve35({ timeout: true });
       }, timeoutMs);
       if (timer2.unref) timer2.unref();
       this.pendingPrompts.set(k, {
@@ -23402,7 +23574,7 @@ var WebchatGateway = class _WebchatGateway {
         resolve: (r) => {
           clearTimeout(timer2);
           this.pendingPrompts.delete(k);
-          resolve34(r);
+          resolve35(r);
         }
       });
       console.error(`[webchat:perm] op=open key=${keyDisplay(p.key)} id=${p.requestId} tool=${p.toolName}`);
@@ -24398,7 +24570,7 @@ function buildTelegramSpawnRequest(input) {
 // app/lib/telegram/outbound/send-document.ts
 import { realpathSync as realpathSync7 } from "fs";
 import { readFile as readFile7, stat as stat7 } from "fs/promises";
-import { resolve as resolve30, basename as basename11 } from "path";
+import { resolve as resolve31, basename as basename11 } from "path";
 var TAG42 = "[telegram:outbound]";
 var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
 async function sendTelegramDocument(input) {
@@ -24409,7 +24581,7 @@ async function sendTelegramDocument(input) {
   if (!maxyAccountId || !platformRoot3) {
     return { ok: false, status: 400, error: "Cannot validate file path: missing account or platform context" };
   }
-  const accountDir = resolve30(platformRoot3, "..", "data/accounts", maxyAccountId);
+  const accountDir = resolve31(platformRoot3, "..", "data/accounts", maxyAccountId);
   let resolvedPath;
   try {
     resolvedPath = realpathSync7(filePath);
@@ -24536,12 +24708,12 @@ function startTelegramNativeFileFollower(input) {
 }
 
 // server/telegram-descriptor.ts
-import { resolve as resolve31, join as join35 } from "path";
+import { resolve as resolve32, join as join36 } from "path";
 function telegramGatewayUrl() {
   return `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`;
 }
 function telegramServerPath() {
-  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve31(process.env.MAXY_PLATFORM_ROOT ?? join35(__dirname, ".."), "services/telegram-channel/dist/server.js");
+  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve32(process.env.MAXY_PLATFORM_ROOT ?? join36(__dirname, ".."), "services/telegram-channel/dist/server.js");
 }
 
 // app/lib/channel-pty-bridge/public-session-end-review.ts
@@ -24803,8 +24975,8 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash6, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync34, readFileSync as readFileSync35, statSync as statSync13 } from "fs";
-import { resolve as resolve32 } from "path";
+import { existsSync as existsSync34, readFileSync as readFileSync36, statSync as statSync13 } from "fs";
+import { resolve as resolve33 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
 function canonicalize(value) {
@@ -24839,7 +25011,7 @@ var PUBKEY_SHA256 = "8eee6bcb33545fd13b16d3199a5735ca5db5062834c7b49dfe4f23801d9
 var GRACE_DAYS = 7;
 var GRACE_MS = GRACE_DAYS * 24 * 60 * 60 * 1e3;
 function pubkeyPath(brand) {
-  return resolve32(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
+  return resolve33(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
 }
 var memo = null;
 function memoKey(mtimeMs, account) {
@@ -24851,7 +25023,7 @@ function resolveEntitlement(brand, account) {
   if (brand.commercialMode !== true) {
     return logResolved(implicitTrust(account), null);
   }
-  const entitlementPath = resolve32(brand.configDir, "entitlement.json");
+  const entitlementPath = resolve33(brand.configDir, "entitlement.json");
   if (!existsSync34(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
@@ -24867,7 +25039,7 @@ function resolveEntitlement(brand, account) {
 function verifyAndResolve(brand, entitlementPath, account) {
   let pubkeyPem;
   try {
-    pubkeyPem = readFileSync35(pubkeyPath(brand), "utf-8");
+    pubkeyPem = readFileSync36(pubkeyPath(brand), "utf-8");
   } catch (err) {
     return logResolved(anonymousFallback("pubkey-missing"), {
       reason: "pubkey-missing"
@@ -24881,7 +25053,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(readFileSync35(entitlementPath, "utf-8"));
+    envelope = JSON.parse(readFileSync36(entitlementPath, "utf-8"));
   } catch {
     return logResolved(anonymousFallback("malformed"), { reason: "malformed" });
   }
@@ -25042,14 +25214,14 @@ function clientFrom(c) {
   );
 }
 var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join36(PLATFORM_ROOT8, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join37(PLATFORM_ROOT8, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
 if (BRAND_JSON_PATH && !existsSync35(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
 if (BRAND_JSON_PATH && existsSync35(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync36(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync37(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -25081,11 +25253,11 @@ var brandLoginOpts = {
   appleTouchIconPath: brandAppIcon512Path,
   themeColor: BRAND.defaultColors?.primary
 };
-var ALIAS_DOMAINS_PATH = join36(homedir4(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join37(homedir4(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
     if (!existsSync35(ALIAS_DOMAINS_PATH)) return null;
-    const parsed = JSON.parse(readFileSync36(ALIAS_DOMAINS_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync37(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -25148,7 +25320,7 @@ async function recordPassiveDispatch(input) {
 var waGateway = new WaGateway({
   fetchStandingRules: fetchAccountStandingRules,
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve33(process.env.MAXY_PLATFORM_ROOT ?? join36(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve34(process.env.MAXY_PLATFORM_ROOT ?? join37(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 / 1390 — file delivery on the native channel. `maxyAccountId` (the
   // path-validation scope) is the sender's effective SESSION account, resolved
   // once at the inbound gate and threaded here via the gateway's per-sender doc
@@ -25163,7 +25335,7 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve33(process.env.MAXY_PLATFORM_ROOT ?? join36(__dirname, ".."))
+      platformRoot: resolve34(process.env.MAXY_PLATFORM_ROOT ?? join37(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
@@ -25761,8 +25933,8 @@ app61.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve33(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve33(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve34(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve34(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
@@ -25774,7 +25946,7 @@ app61.get("/agent-assets/:slug/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync36(filePath);
+  const body = readFileSync37(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
@@ -25791,8 +25963,8 @@ app61.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve33(account.accountDir, "generated", filename);
-  const expectedDir = resolve33(account.accountDir, "generated");
+  const filePath = resolve34(account.accountDir, "generated", filename);
+  const expectedDir = resolve34(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
@@ -25804,7 +25976,7 @@ app61.get("/generated/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync36(filePath);
+  const body = readFileSync37(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
@@ -25819,7 +25991,7 @@ var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
 if (BRAND_JSON_PATH && existsSync35(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync36(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync37(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -25846,11 +26018,11 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 var brandThemeColor = BRAND.defaultColors?.primary ?? "#000000";
 var brandBackgroundColor = BRAND.defaultColors?.background ?? "#ffffff";
 var brandAppIconsExist = [brandAppIcon192Path, brandAppIcon512Path, brandMaskableIconPath].every(
-  (p) => existsSync35(resolve33(process.cwd(), "public", p.replace(/^\//, "")))
+  (p) => existsSync35(resolve34(process.cwd(), "public", p.replace(/^\//, "")))
 );
 var SW_SOURCE = (() => {
   try {
-    return readFileSync36(resolve33(process.cwd(), "public", "sw.js"), "utf-8");
+    return readFileSync37(resolve34(process.cwd(), "public", "sw.js"), "utf-8");
   } catch {
     return null;
   }
@@ -25858,9 +26030,9 @@ var SW_SOURCE = (() => {
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT8) return "unknown";
-    const versionFile = join36(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
+    const versionFile = join37(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
     if (!existsSync35(versionFile)) return "unknown";
-    const content = readFileSync36(versionFile, "utf-8").trim();
+    const content = readFileSync37(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -25901,7 +26073,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync36(resolve33(process.cwd(), "public", file), "utf-8");
+    html = readFileSync37(resolve34(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -25918,13 +26090,13 @@ ${clientErrorReporterScript}
   return html;
 }
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join36(homedir4(), BRAND.configDir);
+  const configDir2 = join37(homedir4(), BRAND.configDir);
   try {
     const accountId = getDefaultAccountId();
     if (!accountId) return null;
-    const cachePath = join36(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    const cachePath = join37(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
     if (!existsSync35(cachePath)) return null;
-    return JSON.parse(readFileSync36(cachePath, "utf-8"));
+    return JSON.parse(readFileSync37(cachePath, "utf-8"));
   } catch {
     return null;
   }
@@ -25941,11 +26113,11 @@ var brandedHtmlCache = /* @__PURE__ */ new Map();
 function brandedPublicHtml(agentSlug) {
   const baseHtml = cachedHtml("public.html");
   if (!agentSlug) return baseHtml;
-  const cached2 = brandedHtmlCache.get(agentSlug);
+  const cached3 = brandedHtmlCache.get(agentSlug);
   const branding = loadBrandingCache(agentSlug);
   if (!branding) return baseHtml;
   const brandHash = JSON.stringify(branding).length;
-  if (cached2 && cached2.mtime === brandHash) return cached2.html;
+  if (cached3 && cached3.mtime === brandHash) return cached3.html;
   const title = escapeHtml(branding.name);
   const description = branding.tagline ? escapeHtml(branding.tagline) : "";
   const themeColor = branding.primaryColor || "";
@@ -26019,7 +26191,7 @@ app61.use("/vnc-popout.html", logViewerFetch);
 app61.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync36(resolve33(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync37(resolve34(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -26151,8 +26323,8 @@ var hostname = process.env.HOSTNAME ?? "127.0.0.1";
 var httpServer = serve({ fetch: app61.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
-  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join36(__dirname, "..");
-  const reconcileScript = resolve33(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
+  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join37(__dirname, "..");
+  const reconcileScript = resolve34(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
   const RECONCILE_INTERVAL_MS = 12e4;
   const runReconcile = () => {
     if (!existsSync35(reconcileScript)) return;
@@ -26173,8 +26345,8 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   loop.unref();
 }
 {
-  const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join36(__dirname, "..");
-  const publishScript = resolve33(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
+  const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join37(__dirname, "..");
+  const publishScript = resolve34(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
   const PUBLISH_INTERVAL_MS = 3e5;
   const currentAccount = () => {
     try {
@@ -26203,21 +26375,21 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     }
   };
   const auditSnapshotAge = (account) => {
-    const availPath = resolve33(account.accountDir, "calendar-availability.json");
+    const availPath = resolve34(account.accountDir, "calendar-availability.json");
     let hasBookingSite = false;
     try {
       if (existsSync35(availPath)) {
-        const cfg = JSON.parse(readFileSync36(availPath, "utf-8"));
+        const cfg = JSON.parse(readFileSync37(availPath, "utf-8"));
         hasBookingSite = typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
       }
     } catch {
     }
     if (!hasBookingSite) return;
-    const statePath = resolve33(account.accountDir, "state", "booking-availability", "last-publish.json");
+    const statePath = resolve34(account.accountDir, "state", "booking-availability", "last-publish.json");
     let lastSuccessAt = null;
     if (existsSync35(statePath)) {
       try {
-        const rec = JSON.parse(readFileSync36(statePath, "utf-8"));
+        const rec = JSON.parse(readFileSync37(statePath, "utf-8"));
         lastSuccessAt = rec.lastSuccessAt ?? null;
       } catch {
         console.error(`[calendar-availability] op=audit accountId=${account.accountId} snapshotAgeMs=na reason=bad-state-file`);
@@ -26241,8 +26413,8 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 startTimeEntryCensus(() => getSession());
 {
-  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join36(__dirname, "..");
-  const auditScript = resolve33(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
+  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join37(__dirname, "..");
+  const auditScript = resolve34(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
   const auditLogDir = process.env.LOG_DIR ?? LOG_DIR;
   const CONNECTOR_AUDIT_INTERVAL_MS = 3e5;
   const runConnectorAudit = () => {
@@ -26360,7 +26532,7 @@ async function runAdminUserReconcileTick() {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
-    const usersRaw = readFileSync36(USERS_FILE, "utf-8").trim();
+    const usersRaw = readFileSync37(USERS_FILE, "utf-8").trim();
     if (!usersRaw) {
       console.error("[adminuser-self-heal] skip reason=empty-users-file");
       return;
@@ -26390,7 +26562,7 @@ if (typeof adminUserReconcileTimer.unref === "function") adminUserReconcileTimer
 var USERS_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 function countUsersRows() {
   if (!existsSync35(USERS_FILE)) return 0;
-  const raw = readFileSync36(USERS_FILE, "utf-8").trim();
+  const raw = readFileSync37(USERS_FILE, "utf-8").trim();
   if (!raw) return 0;
   const users = JSON.parse(raw);
   return users.filter((u) => typeof u.userId === "string").length;
@@ -26510,7 +26682,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve33(process.env.MAXY_PLATFORM_ROOT ?? join36(__dirname, "..")),
+  platformRoot: resolve34(process.env.MAXY_PLATFORM_ROOT ?? join37(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (msg.isOwnerMirror) {