@rubytech/create-maxy-code 0.1.474 → 0.1.475

package/payload/server/server.js

@@ -1534,10 +1534,10 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync41, existsSync as existsSync37, watchFile, readdirSync as readdirSync25, statSync as statSync16 } from "fs";
+import { readFileSync as readFileSync41, existsSync as existsSync38, watchFile, readdirSync as readdirSync26, statSync as statSync17 } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { createHash as createHash7 } from "crypto";
-import { resolve as resolve36, join as join41, basename as basename12 } from "path";
+import { resolve as resolve36, join as join42, basename as basename12 } from "path";
 import { homedir as homedir4 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
@@ -9687,46 +9687,74 @@ async function runPagesAudit(root) {
   }
 }
 
+// server/google-pending-audit.ts
+import { existsSync as existsSync10, readdirSync as readdirSync9, statSync as statSync4 } from "fs";
+import { join as join14 } from "path";
+var GOOGLE_PENDING_LIFETIME_SEC = 600;
+var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function runGooglePendingAudit(accountsDir, nowMs, emit, readMtimeMs = (path3) => statSync4(path3).mtimeMs) {
+  let scanned = 0;
+  let stranded = 0;
+  if (existsSync10(accountsDir)) {
+    for (const accountId of readdirSync9(accountsDir)) {
+      if (!UUID_RE2.test(accountId)) continue;
+      const pendingPath2 = join14(accountsDir, accountId, "secrets", "google", "pending-oauth.enc");
+      try {
+        if (!existsSync10(pendingPath2)) continue;
+        const ageSec = Math.max(0, Math.floor((nowMs - readMtimeMs(pendingPath2)) / 1e3));
+        scanned += 1;
+        if (ageSec >= GOOGLE_PENDING_LIFETIME_SEC) {
+          stranded += 1;
+          emit(`[google-oauth] op=pending-stranded account=${accountId} ageSec=${ageSec}`);
+        }
+      } catch {
+      }
+    }
+  }
+  emit(`[google-oauth] op=pending-audit scanned=${scanned} stranded=${stranded}`);
+  return { scanned, stranded };
+}
+
 // server/routes/whatsapp-reader.ts
-import { readFileSync as readFileSync19, watch, statSync as statSync6, openSync, readSync, closeSync, existsSync as existsSync12, readdirSync as readdirSync13, realpathSync as realpathSync5 } from "fs";
-import { basename as basename4, dirname as dirname5, isAbsolute, join as join18, relative as relative2, resolve as resolve13, sep as sep3 } from "path";
+import { readFileSync as readFileSync19, watch, statSync as statSync7, openSync, readSync, closeSync, existsSync as existsSync13, readdirSync as readdirSync14, realpathSync as realpathSync5 } from "fs";
+import { basename as basename4, dirname as dirname5, isAbsolute, join as join19, relative as relative2, resolve as resolve13, sep as sep3 } from "path";
 
 // server/routes/admin/sidebar-sessions.ts
-import { readdirSync as readdirSync11, readFileSync as readFileSync17, statSync as statSync5 } from "fs";
-import { dirname as dirname4, join as join16, resolve as resolve12 } from "path";
+import { readdirSync as readdirSync12, readFileSync as readFileSync17, statSync as statSync6 } from "fs";
+import { dirname as dirname4, join as join17, resolve as resolve12 } from "path";
 
 // ../services/claude-session-manager/src/jsonl-path.ts
-import { existsSync as existsSync10, readdirSync as readdirSync9 } from "fs";
+import { existsSync as existsSync11, readdirSync as readdirSync10 } from "fs";
 import { homedir } from "os";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 function findExistingJsonlForSessionId(claudeConfigDir2, sessionId) {
-  const projectsRoot = join14(claudeConfigDir2, "projects");
-  if (!existsSync10(projectsRoot)) return null;
+  const projectsRoot = join15(claudeConfigDir2, "projects");
+  if (!existsSync11(projectsRoot)) return null;
   let slugs;
   try {
-    slugs = readdirSync9(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    slugs = readdirSync10(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
     return null;
   }
   const basename13 = `${sessionId}.jsonl`;
   for (const slug of slugs) {
-    const live = join14(projectsRoot, slug, basename13);
-    if (existsSync10(live)) return live;
-    const archived = join14(projectsRoot, slug, "archive", basename13);
-    if (existsSync10(archived)) return archived;
+    const live = join15(projectsRoot, slug, basename13);
+    if (existsSync11(live)) return live;
+    const archived = join15(projectsRoot, slug, "archive", basename13);
+    if (existsSync11(archived)) return archived;
   }
   return null;
 }
 
 // app/lib/admin-identity/pin-validator.ts
 import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync11, readFileSync as readFileSync16, readdirSync as readdirSync10, statSync as statSync4 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync16, readdirSync as readdirSync11, statSync as statSync5 } from "fs";
+import { join as join16 } from "path";
 function hashPin(pin) {
   return createHash3("sha256").update(pin).digest("hex");
 }
 function readUsersFile(usersFilePath) {
-  if (!existsSync11(usersFilePath)) return null;
+  if (!existsSync12(usersFilePath)) return null;
   const raw = readFileSync16(usersFilePath, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
@@ -9846,16 +9874,16 @@ function enumerateJsonls(projectsRoot) {
   const out = [];
   let slugs;
   try {
-    slugs = readdirSync11(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    slugs = readdirSync12(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch (err) {
     if (err.code === "ENOENT") return out;
     throw err;
   }
   for (const slug of slugs) {
-    const slugDir = join16(projectsRoot, slug);
+    const slugDir = join17(projectsRoot, slug);
     let entries;
     try {
-      entries = readdirSync11(slugDir, { withFileTypes: true });
+      entries = readdirSync12(slugDir, { withFileTypes: true });
     } catch (err) {
       const code = err.code ?? "unknown";
       console.error(`[admin-sessions-list] slug-skipped slug=${slug} code=${code}`);
@@ -9863,12 +9891,12 @@ function enumerateJsonls(projectsRoot) {
     }
     for (const entry of entries) {
       if (entry.isFile() && SESSION_ID_RE.test(entry.name)) {
-        out.push({ path: join16(slugDir, entry.name), isSubagent: false, archived: false });
+        out.push({ path: join17(slugDir, entry.name), isSubagent: false, archived: false });
       } else if (entry.isDirectory() && entry.name === "subagents") {
-        const subDir = join16(slugDir, entry.name);
+        const subDir = join17(slugDir, entry.name);
         let subEntries;
         try {
-          subEntries = readdirSync11(subDir, { withFileTypes: true });
+          subEntries = readdirSync12(subDir, { withFileTypes: true });
         } catch (err) {
           const code = err.code ?? "unknown";
           console.error(`[admin-sessions-list] subagents-skipped slug=${slug} code=${code}`);
@@ -9876,14 +9904,14 @@ function enumerateJsonls(projectsRoot) {
         }
         for (const sub of subEntries) {
           if (sub.isFile() && SESSION_ID_RE.test(sub.name)) {
-            out.push({ path: join16(subDir, sub.name), isSubagent: true, archived: false });
+            out.push({ path: join17(subDir, sub.name), isSubagent: true, archived: false });
           }
         }
       } else if (entry.isDirectory() && entry.name === "archive") {
-        const archiveDir = join16(slugDir, entry.name);
+        const archiveDir = join17(slugDir, entry.name);
         let archiveEntries;
         try {
-          archiveEntries = readdirSync11(archiveDir, { withFileTypes: true });
+          archiveEntries = readdirSync12(archiveDir, { withFileTypes: true });
         } catch (err) {
           const code = err.code ?? "unknown";
           console.error(`[admin-sessions-list] archive-skipped slug=${slug} code=${code}`);
@@ -9891,7 +9919,7 @@ function enumerateJsonls(projectsRoot) {
         }
         for (const arc of archiveEntries) {
           if (arc.isFile() && SESSION_ID_RE.test(arc.name)) {
-            out.push({ path: join16(archiveDir, arc.name), isSubagent: false, archived: true });
+            out.push({ path: join17(archiveDir, arc.name), isSubagent: false, archived: true });
           }
         }
       }
@@ -9924,7 +9952,7 @@ async function fetchLiveSessions() {
 function loadUserTitles(accountDir) {
   const out = /* @__PURE__ */ new Map();
   if (!accountDir) return out;
-  const path3 = join16(accountDir, "session-titles.json");
+  const path3 = join17(accountDir, "session-titles.json");
   let raw;
   try {
     raw = readFileSync17(path3, "utf8");
@@ -10051,7 +10079,7 @@ app4.get("/", requireAdminSession, async (c) => {
     console.error("[admin-sessions-list] CLAUDE_CONFIG_DIR not set; returning empty list");
     return c.json({ sessions: [], accountId: scopeAccountId });
   }
-  const projectsRoot = join16(configDir2, "projects");
+  const projectsRoot = join17(configDir2, "projects");
   const jsonls = enumerateJsonls(projectsRoot);
   const liveSessions = await fetchLiveSessions();
   const accountDir = scopeAccountId ? resolve12(ACCOUNTS_DIR, scopeAccountId) : null;
@@ -10096,7 +10124,7 @@ app4.get("/", requireAdminSession, async (c) => {
     let mtimeMs;
     try {
       body = readFileSync17(path3, "utf8");
-      mtimeMs = statSync5(path3).mtimeMs;
+      mtimeMs = statSync6(path3).mtimeMs;
     } catch {
       continue;
     }
@@ -10104,7 +10132,7 @@ app4.get("/", requireAdminSession, async (c) => {
     const pid = live ? liveSessions.get(sessionId) ?? null : null;
     const resolved = resolveTitle(body, sessionId, userTitles);
     titleSourceCounts[resolved.source] += 1;
-    const metaPath = join16(projectDir, `${sessionId}.meta.json`);
+    const metaPath = join17(projectDir, `${sessionId}.meta.json`);
     const { bridgeIds, role, channel: sidecarChannel, senderId, personId, adminUserId, accountId: rowAccountId } = readSidecarMeta(metaPath);
     if (multiAccount) {
       if (rowAccountId === null) untaggedCount += 1;
@@ -10517,8 +10545,8 @@ function parseTranscript(lines, queuedPendingSuppress = /* @__PURE__ */ new Map(
 }
 
 // app/lib/whatsapp-reader/enrich-attachments.ts
-import { readFileSync as readFileSync18, readdirSync as readdirSync12 } from "fs";
-import { join as join17 } from "path";
+import { readFileSync as readFileSync18, readdirSync as readdirSync13 } from "fs";
+import { join as join18 } from "path";
 var ADMIN_UPLOAD_PATH = /\/uploads\/(?!public\/)([0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})\//gi;
 function adminAttachmentIds(text) {
   const ids = [];
@@ -10531,7 +10559,7 @@ function adminAttachmentIds(text) {
 function adminAttachmentsFromText(text, uploadsBase) {
   const out = [];
   for (const id of adminAttachmentIds(text)) {
-    const meta = readAttachmentMeta(join17(uploadsBase, id));
+    const meta = readAttachmentMeta(join18(uploadsBase, id));
     if (meta) out.push(meta);
   }
   return out;
@@ -10539,7 +10567,7 @@ function adminAttachmentsFromText(text, uploadsBase) {
 function readSidecar(dir, attachmentId) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync18(join17(dir, `${attachmentId}.meta.json`), "utf8"));
+    parsed = JSON.parse(readFileSync18(join18(dir, `${attachmentId}.meta.json`), "utf8"));
   } catch {
     return null;
   }
@@ -10562,13 +10590,13 @@ function readAttachmentMeta(dir) {
 function listSessionAttachmentsInDir(dir) {
   let entries;
   try {
-    entries = readdirSync12(dir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    entries = readdirSync13(dir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
     return [];
   }
   const sidecars = [];
   for (const name of entries) {
-    const sidecar = readSidecar(join17(dir, name), name);
+    const sidecar = readSidecar(join18(dir, name), name);
     if (sidecar) sidecars.push(sidecar);
   }
   sidecars.sort((a, b) => a.storedAt.localeCompare(b.storedAt));
@@ -10728,14 +10756,14 @@ app5.get("/conversations", requireAdminSession, async (c) => {
   }
   const cfg = claudeConfigDir();
   if (!cfg) return c.json({ conversations: [] });
-  const projectsRoot = join18(cfg, "projects");
+  const projectsRoot = join19(cfg, "projects");
   const userTitles = loadUserTitles(ACCOUNTS_DIR ?? null);
   const rows = [];
   let sessionRowsExcludedUntagged = 0;
   for (const { path: path3 } of enumerateJsonls(projectsRoot)) {
     const sessionId = basename4(path3).replace(/\.jsonl$/, "");
     const projectDir = dirname5(path3);
-    const meta = readSidecarMeta(join18(projectDir, `${sessionId}.meta.json`));
+    const meta = readSidecarMeta(join19(projectDir, `${sessionId}.meta.json`));
     if (!isReaderChannelSession(meta.role, meta.channel)) continue;
     if (multiAccount) {
       if (meta.accountId === null) sessionRowsExcludedUntagged += 1;
@@ -10827,7 +10855,7 @@ app5.get("/conversations", requireAdminSession, async (c) => {
   return c.json({ conversations: [...sessionConversations, ...allStoreRows] });
 });
 function readFrom(path3, from) {
-  const end = statSync6(path3).size;
+  const end = statSync7(path3).size;
   if (end <= from) return { buf: Buffer.alloc(0), end: from };
   const fd = openSync(path3, "r");
   try {
@@ -10912,7 +10940,7 @@ function openTaskKey(turns) {
 }
 function readSubagentMeta(dir, hex) {
   try {
-    const m = JSON.parse(readFileSync19(join18(dir, `agent-${hex}.meta.json`), "utf8"));
+    const m = JSON.parse(readFileSync19(join19(dir, `agent-${hex}.meta.json`), "utf8"));
     if (typeof m.agentType === "string" && typeof m.description === "string" && typeof m.toolUseId === "string") {
       return { agentType: m.agentType, description: m.description, toolUseId: m.toolUseId };
     }
@@ -10935,7 +10963,7 @@ function runActivityTick(c) {
   c.parentGrewThisTick = false;
   let names = [];
   try {
-    names = readdirSync13(c.subagentsDir).filter((n) => AGENT_JSONL_RE.test(n));
+    names = readdirSync14(c.subagentsDir).filter((n) => AGENT_JSONL_RE.test(n));
   } catch {
   }
   const entries = [];
@@ -10944,7 +10972,7 @@ function runActivityTick(c) {
     let size = 0;
     let mtimeMs = 0;
     try {
-      const st = statSync6(join18(c.subagentsDir, name));
+      const st = statSync7(join19(c.subagentsDir, name));
       size = st.size;
       mtimeMs = st.mtimeMs;
     } catch {
@@ -10989,11 +11017,11 @@ app5.get("/stream", requireAdminSession, (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
   const projectDir = c.req.query("projectDir") ?? "";
   const cfg = claudeConfigDir();
-  const projectsRoot = cfg ? resolve13(join18(cfg, "projects")) : null;
+  const projectsRoot = cfg ? resolve13(join19(cfg, "projects")) : null;
   if (!cfg || !projectsRoot || !SESSION_ID_RE2.test(sessionId)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const jsonlPath = resolve13(join18(projectDir, `${sessionId}.jsonl`));
+  const jsonlPath = resolve13(join19(projectDir, `${sessionId}.jsonl`));
   if (!jsonlPath.startsWith(projectsRoot + sep3)) {
     return c.json({ error: "bad session reference" }, 400);
   }
@@ -11012,7 +11040,7 @@ data: ${JSON.stringify(turn)}
     start(controller) {
       const fileEnd0 = (() => {
         try {
-          return statSync6(jsonlPath).size;
+          return statSync7(jsonlPath).size;
         } catch {
           return 0;
         }
@@ -11020,9 +11048,9 @@ data: ${JSON.stringify(turn)}
       let offset = resumeOffset(lastEventId, fileEnd0);
       console.log(`[wa-stream] op=open conn=${connId} sessionId=${sessionId} channel=reader resume=${offset}`);
       const sessionKey = c.req.query("session_key") ?? "";
-      const subagentsDir = resolve13(join18(projectDir, sessionId, "subagents"));
+      const subagentsDir = resolve13(join19(projectDir, sessionId, "subagents"));
       console.log(
-        `[webchat-activity] op=watch-subagents key=${sessionKey} dir=${subagentsDir} exists=${existsSync12(subagentsDir)}`
+        `[webchat-activity] op=watch-subagents key=${sessionKey} dir=${subagentsDir} exists=${existsSync13(subagentsDir)}`
       );
       const actx = makeActivityCtx({
         subagentsDir,
@@ -11136,10 +11164,10 @@ app5.get("/directives", requireAdminSession, (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
   if (!SESSION_ID_RE2.test(sessionId)) return c.json({ error: "bad session reference" }, 400);
   const dir = directiveStoreDir(sessionId);
-  if (!dir || !existsSync12(dir)) return c.json({ entries: [] });
+  if (!dir || !existsSync13(dir)) return c.json({ entries: [] });
   let names;
   try {
-    names = readdirSync13(dir).filter((n) => DIRECTIVE_NAME_RE.test(n));
+    names = readdirSync14(dir).filter((n) => DIRECTIVE_NAME_RE.test(n));
   } catch {
     return c.json({ entries: [] });
   }
@@ -11149,7 +11177,7 @@ app5.get("/directives", requireAdminSession, (c) => {
     const pid = Number(pidPart);
     let len = 0;
     try {
-      len = statSync6(join18(dir, name)).size;
+      len = statSync7(join19(dir, name)).size;
     } catch {
     }
     return { name, secs, pid, ts: Number.isFinite(secs) ? new Date(secs * 1e3).toISOString() : null, len };
@@ -11164,7 +11192,7 @@ app5.get("/directive", requireAdminSession, (c) => {
   }
   const dir = directiveStoreDir(sessionId);
   if (!dir) return c.json({ error: "no account" }, 404);
-  const path3 = resolve13(join18(dir, name));
+  const path3 = resolve13(join19(dir, name));
   if (!path3.startsWith(dir + sep3)) return c.json({ error: "bad reference" }, 400);
   let body;
   try {
@@ -11222,7 +11250,7 @@ app5.get("/store-stream", requireAdminSession, (c) => {
       console.log(`[wa-reader] op=store-quote msgId=${r.msgKeyId} quoted=${!!q}`);
     }
     if (r.attachmentId) {
-      const meta = readAttachmentMeta(join18(uploadsBase, r.attachmentId));
+      const meta = readAttachmentMeta(join19(uploadsBase, r.attachmentId));
       if (meta) return { ...turn, attachments: [meta] };
     }
     return turn;
@@ -11255,7 +11283,7 @@ data: ${JSON.stringify(payload)}
       };
       const fileEnd0 = (() => {
         try {
-          return statSync6(file).size;
+          return statSync7(file).size;
         } catch {
           return 0;
         }
@@ -11473,7 +11501,7 @@ app5.post("/reply", requireAdminSession, async (c) => {
       const absolute = resolved.absolute;
       let size = -1;
       try {
-        const st = statSync6(absolute);
+        const st = statSync7(absolute);
         size = st.isFile() ? st.size : -1;
       } catch {
         size = -1;
@@ -11597,8 +11625,8 @@ app5.post("/reply", requireAdminSession, async (c) => {
 var whatsapp_reader_default = app5;
 
 // server/routes/public-reader.ts
-import { statSync as statSync7, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, watch as watch2, readFileSync as readFileSync20, readdirSync as readdirSync14 } from "fs";
-import { basename as basename5, dirname as dirname6, join as join19, resolve as resolve14, sep as sep4 } from "path";
+import { statSync as statSync8, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, watch as watch2, readFileSync as readFileSync20, readdirSync as readdirSync15 } from "fs";
+import { basename as basename5, dirname as dirname6, join as join20, resolve as resolve14, sep as sep4 } from "path";
 
 // app/lib/whatsapp-reader/delivered-kinds.ts
 var PUBLIC_DELIVERED_KINDS = /* @__PURE__ */ new Set([
@@ -11672,10 +11700,10 @@ function enumeratePublicRows() {
   const cfg = claudeConfigDir();
   if (!cfg) return [];
   const rows = [];
-  for (const { path: path3 } of enumerateJsonls(join19(cfg, "projects"))) {
+  for (const { path: path3 } of enumerateJsonls(join20(cfg, "projects"))) {
     const sessionId = basename5(path3).replace(/\.jsonl$/, "");
     const projectDir = dirname6(path3);
-    const meta = readSidecarMeta(join19(projectDir, `${sessionId}.meta.json`));
+    const meta = readSidecarMeta(join20(projectDir, `${sessionId}.meta.json`));
     rows.push({
       sessionId,
       projectDir,
@@ -11731,7 +11759,7 @@ function enrichPublicAttachments(turns, sessionAttachments, cursor) {
   }
 }
 function readFrom2(path3, from) {
-  const end = statSync7(path3).size;
+  const end = statSync8(path3).size;
   if (end <= from) return { buf: Buffer.alloc(0), end: from };
   const fd = openSync2(path3, "r");
   try {
@@ -11751,15 +11779,15 @@ app6.get("/stream", (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
   const projectDir = c.req.query("projectDir") ?? "";
   const cfg = claudeConfigDir();
-  const projectsRoot = cfg ? resolve14(join19(cfg, "projects")) : null;
+  const projectsRoot = cfg ? resolve14(join20(cfg, "projects")) : null;
   if (!cfg || !projectsRoot || !SESSION_ID_RE2.test(sessionId)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const jsonlPath = resolve14(join19(projectDir, `${sessionId}.jsonl`));
+  const jsonlPath = resolve14(join20(projectDir, `${sessionId}.jsonl`));
   if (!jsonlPath.startsWith(projectsRoot + sep4)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const meta = readSidecarMeta(join19(projectDir, `${sessionId}.meta.json`));
+  const meta = readSidecarMeta(join20(projectDir, `${sessionId}.meta.json`));
   const isPublicWebchat = meta.role === "public" && meta.channel === "webchat";
   const owns = visitor.kind === "person" ? meta.personId === visitor.personId : meta.personId === null && meta.visitorId === visitor.visitorId;
   if (!(isPublicWebchat && owns)) {
@@ -11872,7 +11900,7 @@ app6.get("/attachment/:attachmentId", (c) => {
   let dataFile;
   let buffer;
   try {
-    dataFile = readdirSync14(dir).find((f) => !f.endsWith(".meta.json") && !f.endsWith(EXTRACTED_TEXT_SUFFIX));
+    dataFile = readdirSync15(dir).find((f) => !f.endsWith(".meta.json") && !f.endsWith(EXTRACTED_TEXT_SUFFIX));
     if (!dataFile) throw new Error("no data file");
     buffer = readFileSync20(resolve14(dir, dataFile));
   } catch {
@@ -11896,16 +11924,16 @@ var public_reader_default = app6;
 
 // server/routes/webchat.ts
 import { basename as basename6, dirname as dirname7 } from "path";
-import { join as join22 } from "path";
-import { existsSync as existsSync14, readdirSync as readdirSync16, readFileSync as readFileSync23, renameSync as renameSync4, statSync as statSync8, writeFileSync as writeFileSync8 } from "fs";
+import { join as join23 } from "path";
+import { existsSync as existsSync15, readdirSync as readdirSync17, readFileSync as readFileSync23, renameSync as renameSync4, statSync as statSync9, writeFileSync as writeFileSync8 } from "fs";
 
 // server/canonical-webchat-override.ts
 import { readFileSync as readFileSync21, writeFileSync as writeFileSync6, renameSync as renameSync2 } from "fs";
-import { join as join20 } from "path";
+import { join as join21 } from "path";
 var FILE = "canonical-webchat-session.json";
 var UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 function canonicalOverridePath(accountDir) {
-  return join20(accountDir, FILE);
+  return join21(accountDir, FILE);
 }
 function readRaw(accountDir) {
   try {
@@ -11984,8 +12012,8 @@ function isNewSessionEffortLevel(value) {
 }
 
 // ../services/claude-session-manager/src/sidecar-store.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync4, readdirSync as readdirSync15, readFileSync as readFileSync22, renameSync as renameSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync7 } from "fs";
-import { join as join21 } from "path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync4, readdirSync as readdirSync16, readFileSync as readFileSync22, renameSync as renameSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync7 } from "fs";
+import { join as join22 } from "path";
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -11993,7 +12021,7 @@ function createSidecarStore(config) {
   const { suffix, validate: validate2 } = config;
   const suffixRe = new RegExp(`${escapeRegExp(suffix)}$`);
   function pathFor(sessionsDir, id) {
-    return join21(sessionsDir, `${id}${suffix}`);
+    return join22(sessionsDir, `${id}${suffix}`);
   }
   function write(sessionsDir, id, record) {
     mkdirSync4(sessionsDir, { recursive: true });
@@ -12005,7 +12033,7 @@ function createSidecarStore(config) {
       return { ok: true };
     } catch (error) {
       try {
-        if (existsSync13(tmp)) unlinkSync2(tmp);
+        if (existsSync14(tmp)) unlinkSync2(tmp);
       } catch {
       }
       return { ok: false, error };
@@ -12030,14 +12058,14 @@ function createSidecarStore(config) {
   function readAll(sessionsDir, onSkip) {
     let names;
     try {
-      names = readdirSync15(sessionsDir, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => entry.name);
+      names = readdirSync16(sessionsDir, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => entry.name);
     } catch {
       return [];
     }
     const out = [];
     for (const name of names) {
       if (!suffixRe.test(name)) continue;
-      const path3 = join21(sessionsDir, name);
+      const path3 = join22(sessionsDir, name);
       let raw;
       try {
         raw = readFileSync22(path3, "utf8");
@@ -12061,7 +12089,7 @@ function createSidecarStore(config) {
   function clear(sessionsDir, id) {
     const path3 = pathFor(sessionsDir, id);
     try {
-      if (existsSync13(path3)) {
+      if (existsSync14(path3)) {
         unlinkSync2(path3);
         return { ok: true, removed: true };
       }
@@ -12114,22 +12142,22 @@ var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9
 function locateSession(sessionId) {
   const dir = findSessionProjectDir(sessionId);
   if (!dir) return { projectDir: null, channel: null, accountId: null };
-  const meta = readSidecarMeta(join22(dir, `${sessionId}.meta.json`));
+  const meta = readSidecarMeta(join23(dir, `${sessionId}.meta.json`));
   return { projectDir: dir, channel: meta.channel, accountId: meta.accountId };
 }
 function locateSidecar(sessionId) {
   const cfg = claudeConfigDir();
   if (!cfg) return null;
-  const projectsRoot = join22(cfg, "projects");
+  const projectsRoot = join23(cfg, "projects");
   let slugs;
   try {
-    slugs = readdirSync16(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    slugs = readdirSync17(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
     return null;
   }
   for (const slug of slugs) {
-    const metaPath = join22(projectsRoot, slug, `${sessionId}.meta.json`);
-    if (existsSync14(metaPath)) {
+    const metaPath = join23(projectsRoot, slug, `${sessionId}.meta.json`);
+    if (existsSync15(metaPath)) {
       const meta = readSidecarMeta(metaPath);
       return { channel: meta.channel, adminUserId: meta.adminUserId, accountId: meta.accountId };
     }
@@ -12141,7 +12169,7 @@ function readTargetOwner(sessionId) {
   if (sidecar !== null) return { found: true, owner: sidecar.adminUserId };
   const { projectDir } = locateSession(sessionId);
   if (projectDir !== null) {
-    return { found: true, owner: readSidecarMeta(join22(projectDir, `${sessionId}.meta.json`)).adminUserId };
+    return { found: true, owner: readSidecarMeta(join23(projectDir, `${sessionId}.meta.json`)).adminUserId };
   }
   return { found: false, owner: null };
 }
@@ -12155,7 +12183,7 @@ function sessionSidecarExists(sessionId) {
 function jsonlSizeBytes(projectDir, sessionId) {
   if (projectDir === null) return null;
   try {
-    return statSync8(join22(projectDir, `${sessionId}.jsonl`)).size;
+    return statSync9(join23(projectDir, `${sessionId}.jsonl`)).size;
   } catch {
     return null;
   }
@@ -12291,15 +12319,15 @@ function latestAdminWebchatSessionId(requesterUserId, primaryUserId, scopeAccoun
   const cfg = claudeConfigDir();
   if (!cfg) return null;
   let best = null;
-  for (const { path: path3, isSubagent, archived } of enumerateJsonls(join22(cfg, "projects"))) {
+  for (const { path: path3, isSubagent, archived } of enumerateJsonls(join23(cfg, "projects"))) {
     if (isSubagent || archived) continue;
     const id = basename6(path3).slice(0, -".jsonl".length);
-    const meta = readSidecarMeta(join22(dirname7(path3), `${id}.meta.json`));
+    const meta = readSidecarMeta(join23(dirname7(path3), `${id}.meta.json`));
     if (meta.role !== "admin" || meta.channel !== "webchat") continue;
     if (multiAccount && meta.accountId !== scopeAccountId) continue;
     let mtimeMs;
     try {
-      mtimeMs = statSync8(path3).mtimeMs;
+      mtimeMs = statSync9(path3).mtimeMs;
     } catch {
       continue;
     }
@@ -12616,7 +12644,7 @@ ${note}` : note;
       console.error(`[webchat:settings] op=${op} outcome=refused value=${value} reason=account-unresolved`);
       return c.json({ error: "account unresolved" }, 503);
     }
-    const accountJsonPath = join22(account.accountDir, "account.json");
+    const accountJsonPath = join23(account.accountDir, "account.json");
     try {
       const parsed = JSON.parse(readFileSync23(accountJsonPath, "utf8"));
       if (op === "model") parsed.adminModel = value;
@@ -12664,7 +12692,7 @@ ${note}` : note;
         const cfg2 = claudeConfigDir();
         if (cfg2) {
           const source2 = resolveBridgeSource(
-            join22(cfg2, "sessions"),
+            join23(cfg2, "sessions"),
             target,
             (id) => locateSession(id).projectDir !== null
           );
@@ -12696,7 +12724,7 @@ ${note}` : note;
     const cfg = claudeConfigDir();
     let projectDir = null;
     if (cfg) {
-      for (const { path: path3 } of enumerateJsonls(join22(cfg, "projects"))) {
+      for (const { path: path3 } of enumerateJsonls(join23(cfg, "projects"))) {
         if (basename6(path3) === `${sessionId}.jsonl`) {
           projectDir = dirname7(path3);
           break;
@@ -12704,7 +12732,7 @@ ${note}` : note;
       }
     }
     if (source === "latest" && requesterUserId !== null) {
-      const owner = readSidecarMeta(join22(projectDir ?? "", `${sessionId}.meta.json`)).adminUserId;
+      const owner = readSidecarMeta(join23(projectDir ?? "", `${sessionId}.meta.json`)).adminUserId;
       if (owner !== null && owner !== requesterUserId && requesterUserId !== primaryUserId) {
         console.error(`[webchat:inbound] op=session-resolve-foreign key=${sessionId.slice(0, 8)} owner=${owner.slice(0, 8)} requester=${requesterUserId.slice(0, 8)}`);
       }
@@ -12736,8 +12764,8 @@ ${note}` : note;
 import { resolve as resolve15 } from "path";
 
 // app/lib/claude-agent/specialist-roster.ts
-import { existsSync as existsSync15, readFileSync as readFileSync24, readdirSync as readdirSync17 } from "fs";
-import { join as join23 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync24, readdirSync as readdirSync18 } from "fs";
+import { join as join24 } from "path";
 function field(fm, name) {
   const m = fm.match(new RegExp(`^${name}:\\s*(.*?)\\r?$`, "m"));
   if (!m) return null;
@@ -12748,15 +12776,15 @@ function field(fm, name) {
   return value || null;
 }
 function readSpecialistRoster(specialistsDir) {
-  if (!existsSync15(specialistsDir)) return { specialists: [], skipped: [] };
-  const entries = readdirSync17(specialistsDir);
+  if (!existsSync16(specialistsDir)) return { specialists: [], skipped: [] };
+  const entries = readdirSync18(specialistsDir);
   const specialists = [];
   const skipped = [];
   for (const file of entries.sort()) {
     if (!file.endsWith(".md")) continue;
     let raw;
     try {
-      raw = readFileSync24(join23(specialistsDir, file), "utf-8");
+      raw = readFileSync24(join24(specialistsDir, file), "utf-8");
     } catch (err) {
       skipped.push({ file, reason: err instanceof Error ? err.message : String(err) });
       continue;
@@ -12873,8 +12901,8 @@ var webchat_greeting_default = app7;
 
 // server/routes/telegram.ts
 import { homedir as homedir2 } from "os";
-import { resolve as resolve16, join as join24 } from "path";
-import { existsSync as existsSync16, readFileSync as readFileSync25 } from "fs";
+import { resolve as resolve16, join as join25 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync25 } from "fs";
 
 // app/lib/telegram/gateway/instance.ts
 var instance = null;
@@ -12933,8 +12961,8 @@ function routeTelegramUpdate(input) {
 var TAG27 = "[telegram-inbound]";
 function configDirName() {
   const platformRoot5 = process.env.MAXY_PLATFORM_ROOT ?? resolve16(process.cwd(), "..");
-  const brandPath = join24(platformRoot5, "config", "brand.json");
-  if (existsSync16(brandPath)) {
+  const brandPath = join25(platformRoot5, "config", "brand.json");
+  if (existsSync17(brandPath)) {
     try {
       return JSON.parse(readFileSync25(brandPath, "utf-8")).configDir ?? ".maxy";
     } catch {
@@ -12955,7 +12983,7 @@ app8.post("/", async (c) => {
     return c.json({ ok: false }, 400);
   }
   const sp = secretPath(botType);
-  if (!existsSync16(sp)) {
+  if (!existsSync17(sp)) {
     console.error(`${TAG27} op=reject reason=no-secret-file botType=${botType}`);
     return c.json({ ok: false }, 401);
   }
@@ -13022,21 +13050,21 @@ app8.post("/", async (c) => {
 var telegram_default = app8;
 
 // server/routes/quickbooks.ts
-import { join as join25 } from "path";
-import { existsSync as existsSync17, readFileSync as readFileSync26, writeFileSync as writeFileSync9, mkdirSync as mkdirSync5, rmSync, renameSync as renameSync5 } from "fs";
+import { join as join26 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync26, writeFileSync as writeFileSync9, mkdirSync as mkdirSync5, rmSync, renameSync as renameSync5 } from "fs";
 var TAG28 = "[quickbooks]";
 var INTUIT_TOKEN_URL = "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer";
 var STATE_RE = /^[A-Za-z0-9_-]+$/;
 function pendingPath(accountDir, state) {
-  return join25(accountDir, "secrets", "quickbooks-pending", `${state}.json`);
+  return join26(accountDir, "secrets", "quickbooks-pending", `${state}.json`);
 }
 function storePath(accountDir) {
-  return join25(accountDir, "secrets", "quickbooks.json");
+  return join26(accountDir, "secrets", "quickbooks.json");
 }
 async function completeConsent(args) {
   const { accountDir, code, realmId } = args;
   const state = args.state;
-  if (!state || !STATE_RE.test(state) || !existsSync17(pendingPath(accountDir, state))) {
+  if (!state || !STATE_RE.test(state) || !existsSync18(pendingPath(accountDir, state))) {
     console.error(`${TAG28} op=callback state=${state ?? ""} stateValid=false realmId=${realmId ?? ""}`);
     return { ok: false, status: 400, message: "Invalid or unknown authorization state.", stateValid: false };
   }
@@ -13063,7 +13091,7 @@ async function completeConsent(args) {
     if (!code || !realmId) {
       return { ok: false, status: 400, message: "Missing code or realmId in the callback.", stateValid: true };
     }
-    if (!existsSync17(storePath(accountDir))) {
+    if (!existsSync18(storePath(accountDir))) {
       return { ok: false, status: 500, message: "No QuickBooks credentials are stored for this account.", stateValid: true };
     }
     const store2 = JSON.parse(readFileSync26(storePath(accountDir), "utf-8"));
@@ -13098,7 +13126,7 @@ async function completeConsent(args) {
       refreshTokenExpiry: now + (body.x_refresh_token_expires_in ?? 864e4) * 1e3,
       lastRefresh: now
     };
-    mkdirSync5(join25(accountDir, "secrets"), { recursive: true });
+    mkdirSync5(join26(accountDir, "secrets"), { recursive: true });
     writeFileSync9(storePath(accountDir), JSON.stringify(store2, null, 2), { mode: 384 });
     const persisted = JSON.parse(readFileSync26(storePath(accountDir), "utf-8")).connections?.[realmId]?.refreshToken === body.refresh_token;
     console.error(`${TAG28} op=token-exchange realmId=${realmId} persisted=${persisted}`);
@@ -13131,7 +13159,7 @@ var quickbooks_default = app9;
 
 // server/routes/onboarding.ts
 import { spawn, spawnSync as spawnSync2, execFileSync as execFileSync3 } from "child_process";
-import { openSync as openSync3, closeSync as closeSync3, writeFileSync as writeFileSync11, writeSync, existsSync as existsSync19, readFileSync as readFileSync28, unlinkSync as unlinkSync3, renameSync as renameSync7 } from "fs";
+import { openSync as openSync3, closeSync as closeSync3, writeFileSync as writeFileSync11, writeSync, existsSync as existsSync20, readFileSync as readFileSync28, unlinkSync as unlinkSync3, renameSync as renameSync7 } from "fs";
 import { createHash as createHash4, randomUUID as randomUUID8 } from "crypto";
 
 // app/lib/claude-spawn-env.ts
@@ -13140,7 +13168,7 @@ function claudeBin() {
 }
 
 // server/routes/onboarding.ts
-import { dirname as dirname9, join as join27 } from "path";
+import { dirname as dirname9, join as join28 } from "path";
 
 // app/lib/claude-keychain.ts
 import { execFileSync as execFileSync2 } from "child_process";
@@ -13269,8 +13297,8 @@ function readHostCredsBlob(service) {
 }
 
 // ../lib/admins-write/src/index.ts
-import { existsSync as existsSync18, readFileSync as readFileSync27, writeFileSync as writeFileSync10, renameSync as renameSync6, mkdirSync as mkdirSync6, readdirSync as readdirSync18, statSync as statSync9, appendFileSync as appendFileSync3 } from "fs";
-import { dirname as dirname8, join as join26 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync27, writeFileSync as writeFileSync10, renameSync as renameSync6, mkdirSync as mkdirSync6, readdirSync as readdirSync19, statSync as statSync10, appendFileSync as appendFileSync3 } from "fs";
+import { dirname as dirname8, join as join27 } from "path";
 function id8(value) {
   return value.slice(0, 8);
 }
@@ -13311,7 +13339,7 @@ function writeAdminEntry(input) {
   const result = { usersJsonResult: "noop", accountJsonResult: "noop" };
   try {
     let users = [];
-    if (existsSync18(input.usersFile)) {
+    if (existsSync19(input.usersFile)) {
       const raw = readFileSync27(input.usersFile, "utf-8").trim();
       if (raw) {
         const parsed = JSON.parse(raw);
@@ -13343,8 +13371,8 @@ function writeAdminEntry(input) {
     return result;
   }
   try {
-    const accountJsonPath = join26(input.accountDir, "account.json");
-    if (!existsSync18(accountJsonPath)) {
+    const accountJsonPath = join27(input.accountDir, "account.json");
+    if (!existsSync19(accountJsonPath)) {
       throw new Error(`account.json not found at ${accountJsonPath}`);
     }
     const config = JSON.parse(readFileSync27(accountJsonPath, "utf-8"));
@@ -13367,7 +13395,7 @@ function writeAdminEntry(input) {
 function computeAdminStoreDivergence(input) {
   const result = { divergences: 0, accountWithoutUsers: [], usersWithoutAccount: [], errors: [] };
   const usersUserIds = /* @__PURE__ */ new Set();
-  if (existsSync18(input.usersFile)) {
+  if (existsSync19(input.usersFile)) {
     try {
       const raw = readFileSync27(input.usersFile, "utf-8").trim();
       if (raw) {
@@ -13381,24 +13409,24 @@ function computeAdminStoreDivergence(input) {
     }
   }
   const accountUserIds = /* @__PURE__ */ new Set();
-  if (existsSync18(input.accountsDir)) {
+  if (existsSync19(input.accountsDir)) {
     let entries;
     try {
-      entries = readdirSync18(input.accountsDir);
+      entries = readdirSync19(input.accountsDir);
     } catch (err) {
       result.errors.push({ source: input.accountsDir, detail: err instanceof Error ? err.message : String(err) });
       return result;
     }
     for (const entry of entries) {
       if (entry.startsWith(".")) continue;
-      const accountDir = join26(input.accountsDir, entry);
+      const accountDir = join27(input.accountsDir, entry);
       try {
-        if (!statSync9(accountDir).isDirectory()) continue;
+        if (!statSync10(accountDir).isDirectory()) continue;
       } catch {
         continue;
       }
-      const accountJsonPath = join26(accountDir, "account.json");
-      if (!existsSync18(accountJsonPath)) continue;
+      const accountJsonPath = join27(accountDir, "account.json");
+      if (!existsSync19(accountJsonPath)) continue;
       let admins = [];
       try {
         const config = JSON.parse(readFileSync27(accountJsonPath, "utf-8"));
@@ -13449,7 +13477,7 @@ function hashPin2(pin) {
   return createHash4("sha256").update(pin).digest("hex");
 }
 function readUsersFile2() {
-  if (!existsSync19(USERS_FILE)) return null;
+  if (!existsSync20(USERS_FILE)) return null;
   const raw = readFileSync28(USERS_FILE, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
@@ -13509,7 +13537,7 @@ app10.post("/claude-auth", async (c) => {
     } catch (err) {
       logoutError = err instanceof Error ? err.message : String(err);
     }
-    const credentialsPresent = existsSync19(CLAUDE_CREDENTIALS_FILE);
+    const credentialsPresent = existsSync20(CLAUDE_CREDENTIALS_FILE);
     const ranMs = Date.now() - start;
     console.log(`[onboarding] op=claude-logout credentialsPresent=${credentialsPresent} ranMs=${ranMs} logoutError=${logoutError ? JSON.stringify(logoutError.slice(0, 120)) : "none"}`);
     return c.json({ logged_out: !credentialsPresent });
@@ -13575,7 +13603,7 @@ app10.post("/claude-auth", async (c) => {
       });
       persistKeychainService(
         writebackResult,
-        (service) => writeFileSync11(join27(dirname9(CLAUDE_CREDENTIALS_FILE), ".keychain-service"), service, { mode: 384 }),
+        (service) => writeFileSync11(join28(dirname9(CLAUDE_CREDENTIALS_FILE), ".keychain-service"), service, { mode: 384 }),
         (line) => console.log(line)
       );
       if (darwinAuthChild === claudeProc2) darwinAuthChild = null;
@@ -13658,7 +13686,7 @@ app10.post("/set-pin", async (c) => {
   console.log(`[set-pin] wrote users.json + account.json admins: userId=${userId.slice(0, 8)}\u2026 role=owner`);
   if (process.platform === "linux") {
     let installOwner = null;
-    if (existsSync19(INSTALL_OWNER_FILE)) {
+    if (existsSync20(INSTALL_OWNER_FILE)) {
       try {
         const raw = readFileSync28(INSTALL_OWNER_FILE, "utf-8").trim();
         if (raw.length > 0) installOwner = raw;
@@ -13806,7 +13834,7 @@ app10.put("/set-pin", requireAdminSession, async (c) => {
   console.log(`[set-pin] changed PIN in place: userId=${sessionUserId.slice(0, 8)}\u2026`);
   if (process.platform === "linux") {
     let installOwner = null;
-    if (existsSync19(INSTALL_OWNER_FILE)) {
+    if (existsSync20(INSTALL_OWNER_FILE)) {
       try {
         const raw = readFileSync28(INSTALL_OWNER_FILE, "utf-8").trim();
         if (raw.length > 0) installOwner = raw;
@@ -13840,9 +13868,9 @@ ${body.newPin}
 var onboarding_default = app10;
 
 // server/routes/client-error.ts
-import { appendFileSync as appendFileSync4, existsSync as existsSync20, renameSync as renameSync8, statSync as statSync10 } from "fs";
-import { join as join28 } from "path";
-var CLIENT_ERRORS_LOG = join28(LOG_DIR, "client-errors.log");
+import { appendFileSync as appendFileSync4, existsSync as existsSync21, renameSync as renameSync8, statSync as statSync11 } from "fs";
+import { join as join29 } from "path";
+var CLIENT_ERRORS_LOG = join29(LOG_DIR, "client-errors.log");
 var MAX_LOG_SIZE = 10 * 1024 * 1024;
 var MAX_BODY_SIZE = 8 * 1024;
 var MAX_STACK_LEN = 2e3;
@@ -13890,8 +13918,8 @@ function stackHead(stack) {
 }
 function rotateIfNeeded() {
   try {
-    if (!existsSync20(CLIENT_ERRORS_LOG)) return;
-    const stats = statSync10(CLIENT_ERRORS_LOG);
+    if (!existsSync21(CLIENT_ERRORS_LOG)) return;
+    const stats = statSync11(CLIENT_ERRORS_LOG);
     if (stats.size < MAX_LOG_SIZE) return;
     renameSync8(CLIENT_ERRORS_LOG, CLIENT_ERRORS_LOG + ".1");
   } catch (err) {
@@ -14217,18 +14245,18 @@ app13.get("/", requireAdminSession, async (c) => {
 var accounts_default = app13;
 
 // server/routes/admin/logs.ts
-import { existsSync as existsSync22, readdirSync as readdirSync19, readFileSync as readFileSync29, statSync as statSync11 } from "fs";
+import { existsSync as existsSync23, readdirSync as readdirSync20, readFileSync as readFileSync29, statSync as statSync12 } from "fs";
 import { resolve as resolve17, basename as basename7 } from "path";
 
 // app/lib/logs-read-resolve.ts
-import { existsSync as existsSync21 } from "fs";
-import { join as join29 } from "path";
+import { existsSync as existsSync22 } from "fs";
+import { join as join30 } from "path";
 function resolveSessionLogPaths(filename, logDirs) {
   const tried = [filename];
   const hits = [];
   for (const dir of logDirs) {
-    const fullPath = join29(dir, filename);
-    if (existsSync21(fullPath)) {
+    const fullPath = join30(dir, filename);
+    if (existsSync22(fullPath)) {
       hits.push({ path: fullPath, dir });
     }
   }
@@ -14257,7 +14285,7 @@ app14.get("/", async (c) => {
       searched.push(filePath);
       try {
         const buffer = readFileSync29(filePath);
-        const onDiskBytes = statSync11(filePath).size;
+        const onDiskBytes = statSync12(filePath).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
           "Content-Length": String(buffer.byteLength)
@@ -14322,7 +14350,7 @@ app14.get("/", async (c) => {
       try {
         const filename = basename7(hit.path);
         const buffer = readFileSync29(hit.path);
-        const onDiskBytes = statSync11(hit.path).size;
+        const onDiskBytes = statSync12(hit.path).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
           "Content-Length": String(buffer.byteLength)
@@ -14356,16 +14384,16 @@ app14.get("/", async (c) => {
   const seen = /* @__PURE__ */ new Set();
   const logs = {};
   for (const dir of logDirs) {
-    if (!existsSync22(dir)) continue;
+    if (!existsSync23(dir)) continue;
     let files;
     try {
-      files = readdirSync19(dir).filter((f) => f.endsWith(".log"));
+      files = readdirSync20(dir).filter((f) => f.endsWith(".log"));
     } catch (err) {
       const reason = err instanceof Error ? err.message : String(err);
       console.warn(`[admin/logs] readdir-fail dir=${dir} reason=${reason}`);
       continue;
     }
-    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync11(resolve17(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
+    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync12(resolve17(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
         const content = readFileSync29(resolve17(dir, name));
@@ -14408,7 +14436,7 @@ var claude_info_default = app15;
 
 // server/routes/admin/attachment.ts
 import { readFile as readFile2, readdir } from "fs/promises";
-import { existsSync as existsSync23 } from "fs";
+import { existsSync as existsSync24 } from "fs";
 import { resolve as resolve18 } from "path";
 var app16 = new Hono();
 var ATTACHMENT_ID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
@@ -14431,12 +14459,12 @@ app16.get("/:attachmentId", requireAdminSession, async (c) => {
   }
   let accountId = pinnedAccountId;
   let dir = uploadsDirFor2(accountId, attachmentId);
-  let found = existsSync23(dir);
+  let found = existsSync24(dir);
   if (!found) {
     for (const candidate of listValidAccounts()) {
       if (candidate.accountId === pinnedAccountId) continue;
       const candidateDir = uploadsDirFor2(candidate.accountId, attachmentId);
-      if (existsSync23(candidateDir)) {
+      if (existsSync24(candidateDir)) {
         accountId = candidate.accountId;
         dir = candidateDir;
         found = true;
@@ -14451,7 +14479,7 @@ app16.get("/:attachmentId", requireAdminSession, async (c) => {
     return new Response("Not found", { status: 404 });
   }
   const metaPath = resolve18(dir, `${attachmentId}.meta.json`);
-  if (!existsSync23(metaPath)) {
+  if (!existsSync24(metaPath)) {
     return new Response("Not found", { status: 404 });
   }
   let meta;
@@ -14485,21 +14513,21 @@ var attachment_default = app16;
 
 // server/routes/admin/agents.ts
 import { resolve as resolve19 } from "path";
-import { readdirSync as readdirSync20, readFileSync as readFileSync30, existsSync as existsSync24, rmSync as rmSync2 } from "fs";
+import { readdirSync as readdirSync21, readFileSync as readFileSync30, existsSync as existsSync25, rmSync as rmSync2 } from "fs";
 var app17 = new Hono();
 app17.get("/", (c) => {
   const account = resolveAccount();
   if (!account) return c.json({ agents: [] });
   const agentsDir = resolve19(account.accountDir, "agents");
-  if (!existsSync24(agentsDir)) return c.json({ agents: [] });
+  if (!existsSync25(agentsDir)) return c.json({ agents: [] });
   const agents = [];
   try {
-    const entries = readdirSync20(agentsDir, { withFileTypes: true });
+    const entries = readdirSync21(agentsDir, { withFileTypes: true });
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
       if (!entry.isDirectory()) continue;
       if (entry.name === "admin") continue;
       const configPath2 = resolve19(agentsDir, entry.name, "config.json");
-      if (!existsSync24(configPath2)) continue;
+      if (!existsSync25(configPath2)) continue;
       try {
         const config = JSON.parse(readFileSync30(configPath2, "utf-8"));
         agents.push({
@@ -14528,7 +14556,7 @@ app17.delete("/:slug", async (c) => {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
   const agentDir = resolve19(account.accountDir, "agents", slug);
-  if (!existsSync24(agentDir)) {
+  if (!existsSync25(agentDir)) {
     return c.json({ error: "Agent not found" }, 404);
   }
   try {
@@ -14558,7 +14586,7 @@ app17.post("/:slug/project", async (c) => {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
   const agentDir = resolve19(account.accountDir, "agents", slug);
-  if (!existsSync24(agentDir)) {
+  if (!existsSync25(agentDir)) {
     return c.json({ error: "Agent not found on disk" }, 404);
   }
   try {
@@ -14574,7 +14602,7 @@ var agents_default = app17;
 // server/routes/admin/sessions.ts
 import crypto2 from "crypto";
 import { resolve as resolvePath } from "path";
-import { existsSync as existsSync25, mkdirSync as mkdirSync7, createWriteStream } from "fs";
+import { existsSync as existsSync26, mkdirSync as mkdirSync7, createWriteStream } from "fs";
 
 // ../lib/admin-conversation-purge/src/index.ts
 async function purgeAdminConversationJsonls(args) {
@@ -14734,7 +14762,7 @@ function validateAndShapeAttachments(raws, conversationAccountId, sessionId, mes
     let reason = null;
     if (!a.attachmentId || !a.filename || !a.mimeType || !a.storagePath) reason = "schema-fail";
     else if (a.accountId !== conversationAccountId) reason = "account-mismatch";
-    else if (!existsSync25(a.storagePath)) reason = "missing-file";
+    else if (!existsSync26(a.storagePath)) reason = "missing-file";
     if (reason) {
       invalid++;
       try {
@@ -15260,8 +15288,8 @@ app18.put("/:id/label", requireAdminSession, async (c) => {
 var sessions_default = app18;
 
 // app/lib/claude-agent/spawn-context.ts
-import { existsSync as existsSync26, readFileSync as readFileSync31, readdirSync as readdirSync21, statSync as statSync12 } from "fs";
-import { dirname as dirname10, resolve as resolve20, join as join30 } from "path";
+import { existsSync as existsSync27, readFileSync as readFileSync31, readdirSync as readdirSync22, statSync as statSync13 } from "fs";
+import { dirname as dirname10, resolve as resolve20, join as join31 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
   try {
@@ -15302,12 +15330,12 @@ function frontmatterField(manifest, field2) {
 function extractPluginToolDescriptions(pluginDir) {
   const out = /* @__PURE__ */ new Map();
   const candidates = [
-    join30(pluginDir, "mcp/dist/index.js"),
-    join30(pluginDir, "mcp/src/index.ts")
+    join31(pluginDir, "mcp/dist/index.js"),
+    join31(pluginDir, "mcp/src/index.ts")
   ];
   let raw = null;
   for (const path3 of candidates) {
-    if (!existsSync26(path3)) continue;
+    if (!existsSync27(path3)) continue;
     try {
       raw = readFileSync31(path3, "utf-8");
       break;
@@ -15359,25 +15387,25 @@ function parseSkillPathsFromFrontmatter(fm) {
 function listPluginDirs() {
   const out = /* @__PURE__ */ new Map();
   const platformPlugins = resolve20(PLATFORM_ROOT, "plugins");
-  if (existsSync26(platformPlugins)) {
-    for (const name of readdirSync21(platformPlugins)) {
-      const dir = join30(platformPlugins, name);
+  if (existsSync27(platformPlugins)) {
+    for (const name of readdirSync22(platformPlugins)) {
+      const dir = join31(platformPlugins, name);
       try {
-        if (statSync12(dir).isDirectory()) out.set(name, dir);
+        if (statSync13(dir).isDirectory()) out.set(name, dir);
       } catch {
       }
     }
   }
   const premiumRoot = resolve20(dirname10(PLATFORM_ROOT), "premium-plugins");
-  if (existsSync26(premiumRoot)) {
-    for (const bundle of readdirSync21(premiumRoot)) {
-      const bundlePlugins = join30(premiumRoot, bundle, "plugins");
-      if (!existsSync26(bundlePlugins)) continue;
+  if (existsSync27(premiumRoot)) {
+    for (const bundle of readdirSync22(premiumRoot)) {
+      const bundlePlugins = join31(premiumRoot, bundle, "plugins");
+      if (!existsSync27(bundlePlugins)) continue;
       try {
-        for (const name of readdirSync21(bundlePlugins)) {
-          const dir = join30(bundlePlugins, name);
+        for (const name of readdirSync22(bundlePlugins)) {
+          const dir = join31(bundlePlugins, name);
           try {
-            if (statSync12(dir).isDirectory()) out.set(name, dir);
+            if (statSync13(dir).isDirectory()) out.set(name, dir);
           } catch {
           }
         }
@@ -15389,7 +15417,7 @@ function listPluginDirs() {
 }
 function readEnabledPlugins(accountId) {
   const accountFile = resolve20(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync26(accountFile)) return /* @__PURE__ */ new Set();
+  if (!existsSync27(accountFile)) return /* @__PURE__ */ new Set();
   try {
     const parsed = JSON.parse(readFileSync31(accountFile, "utf-8"));
     return new Set(
@@ -15400,7 +15428,7 @@ function readEnabledPlugins(accountId) {
   }
 }
 function readFrontmatter(path3) {
-  if (!existsSync26(path3)) return null;
+  if (!existsSync27(path3)) return null;
   let raw;
   try {
     raw = readFileSync31(path3, "utf-8");
@@ -15418,7 +15446,7 @@ function computeActivePlugins(accountId) {
   for (const name of Array.from(enabled).sort()) {
     const dir = pluginDirs.get(name);
     if (!dir) continue;
-    const fm = readFrontmatter(join30(dir, "PLUGIN.md"));
+    const fm = readFrontmatter(join31(dir, "PLUGIN.md"));
     if (!fm) continue;
     const description = frontmatterField(`---
 ${fm}
@@ -15435,7 +15463,7 @@ ${fm}
       `plugin-manifest-tool-coverage plugin=${name} tools=${tools.length} with-desc=${withDesc}`
     );
     if (toolNames.length > 0 && descMap.size === 0) {
-      const hasSource = existsSync26(join30(dir, "mcp/dist/index.js")) || existsSync26(join30(dir, "mcp/src/index.ts"));
+      const hasSource = existsSync27(join31(dir, "mcp/dist/index.js")) || existsSync27(join31(dir, "mcp/src/index.ts"));
       if (hasSource) {
         console.warn(
           `[spawn-context] WARN plugin=${name} mcp source present but tool-description regex matched zero entries \u2014 SDK upgrade may have changed the registration shape`
@@ -15445,7 +15473,7 @@ ${fm}
     const skillPaths = parseSkillPathsFromFrontmatter(fm);
     const skills = [];
     for (const relPath of skillPaths) {
-      const skillPath = join30(dir, relPath);
+      const skillPath = join31(dir, relPath);
       const skillFm = readFrontmatter(skillPath);
       if (!skillFm) continue;
       const skillName = frontmatterField(`---
@@ -15462,10 +15490,10 @@ ${skillFm}
 }
 function computeSpecialistDomains(accountId) {
   const specialistsDir = resolve20(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
-  if (!existsSync26(specialistsDir)) return [];
+  if (!existsSync27(specialistsDir)) return [];
   let entries;
   try {
-    entries = readdirSync21(specialistsDir);
+    entries = readdirSync22(specialistsDir);
   } catch {
     return [];
   }
@@ -15489,7 +15517,7 @@ function computeSpecialistDomains(accountId) {
   const out = [];
   for (const file of entries.sort()) {
     if (!file.endsWith(".md")) continue;
-    const fm = readFrontmatter(join30(specialistsDir, file));
+    const fm = readFrontmatter(join31(specialistsDir, file));
     if (!fm) continue;
     const wrapped = `---
 ${fm}
@@ -15508,7 +15536,7 @@ ${fm}
 }
 function computeDormantPlugins(accountId) {
   const accountFile = resolve20(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync26(accountFile)) return [];
+  if (!existsSync27(accountFile)) return [];
   let enabled;
   try {
     const raw = readFileSync31(accountFile, "utf-8");
@@ -15523,10 +15551,10 @@ function computeDormantPlugins(accountId) {
     return [];
   }
   const pluginsDir = resolve20(PLATFORM_ROOT, "plugins");
-  if (!existsSync26(pluginsDir)) return [];
+  if (!existsSync27(pluginsDir)) return [];
   let entries;
   try {
-    entries = readdirSync21(pluginsDir);
+    entries = readdirSync22(pluginsDir);
   } catch {
     return [];
   }
@@ -15534,7 +15562,7 @@ function computeDormantPlugins(accountId) {
   for (const name of entries) {
     if (enabled.has(name)) continue;
     const manifestPath = resolve20(pluginsDir, name, "PLUGIN.md");
-    if (!existsSync26(manifestPath)) continue;
+    if (!existsSync27(manifestPath)) continue;
     let manifest;
     try {
       manifest = readFileSync31(manifestPath, "utf-8");
@@ -15551,11 +15579,11 @@ function computeDormantPlugins(accountId) {
 }
 
 // server/routes/admin/claude-sessions.ts
-import { existsSync as existsSync27, readFileSync as readFileSync32 } from "fs";
+import { existsSync as existsSync28, readFileSync as readFileSync32 } from "fs";
 import { resolve as resolve21 } from "path";
 function readTunnelState(brandConfigDir) {
   const statePath = `${process.env.HOME ?? ""}/${brandConfigDir}/cloudflared/tunnel.state`;
-  if (!existsSync27(statePath)) return null;
+  if (!existsSync28(statePath)) return null;
   try {
     const parsed = JSON.parse(readFileSync32(statePath, "utf-8"));
     const tunnelId = typeof parsed.tunnelId === "string" ? parsed.tunnelId : null;
@@ -15813,11 +15841,11 @@ app21.post("/", async (c) => {
 var events_default = app21;
 
 // server/routes/admin/files.ts
-import { createReadStream as createReadStream2, createWriteStream as createWriteStream2, existsSync as existsSync28 } from "fs";
+import { createReadStream as createReadStream2, createWriteStream as createWriteStream2, existsSync as existsSync29 } from "fs";
 import { readdir as readdir3, readFile as readFile4, stat as stat4, mkdir as mkdir3, unlink as unlink2, rename, rmdir } from "fs/promises";
 import { realpathSync as realpathSync6 } from "fs";
 import { randomUUID as randomUUID10 } from "crypto";
-import { basename as basename9, dirname as dirname11, join as join32, relative as relative4, resolve as resolve23, sep as sep6 } from "path";
+import { basename as basename9, dirname as dirname11, join as join33, relative as relative4, resolve as resolve23, sep as sep6 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // ../lib/graph-trash/src/index.ts
@@ -16054,7 +16082,7 @@ async function restoreNode(params) {
 }
 
 // app/lib/file-delete-cascade.ts
-var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function parseAttachmentPath(relPath) {
   const segments = relPath.split("/").filter(Boolean);
   if (segments.length !== 5) return null;
@@ -16062,7 +16090,7 @@ function parseAttachmentPath(relPath) {
   const accountId = segments[1];
   const attachmentId = segments[3];
   const filename = segments[4];
-  if (!UUID_RE2.test(accountId) || !UUID_RE2.test(attachmentId)) return null;
+  if (!UUID_RE3.test(accountId) || !UUID_RE3.test(attachmentId)) return null;
   const dot = filename.lastIndexOf(".");
   if (dot === -1) return null;
   const stem = filename.slice(0, dot);
@@ -16135,7 +16163,7 @@ async function cascadeDeleteDocument(params) {
 
 // app/lib/file-index.ts
 import * as fsp from "fs/promises";
-import { resolve as resolve22, relative as relative3, join as join31, basename as basename8, extname as extname2, sep as sep5 } from "path";
+import { resolve as resolve22, relative as relative3, join as join32, basename as basename8, extname as extname2, sep as sep5 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
@@ -16217,7 +16245,7 @@ async function extractPdf(absolute) {
   return stdout.trim();
 }
 async function ocrPdf(absolute) {
-  const outPdf = join31(tmpdir2(), `file-index-ocr-${process.pid}-${Date.now()}.pdf`);
+  const outPdf = join32(tmpdir2(), `file-index-ocr-${process.pid}-${Date.now()}.pdf`);
   try {
     await execFileAsync2(
       "ocrmypdf",
@@ -16279,7 +16307,7 @@ async function readDisplayName(absolute) {
   const stem = dot === -1 ? base : base.slice(0, dot);
   if (base === `${stem}.meta.json`) return null;
   try {
-    const raw = await fsp.readFile(join31(dir, `${stem}.meta.json`), "utf-8");
+    const raw = await fsp.readFile(join32(dir, `${stem}.meta.json`), "utf-8");
     const meta = JSON.parse(raw);
     const dn = meta.displayName ?? meta.filename;
     return typeof dn === "string" && dn.length > 0 ? dn : null;
@@ -16300,7 +16328,7 @@ async function walkSubtree(root, dataRoot, out) {
   for (const entry of entries) {
     if (entry.isSymbolicLink()) continue;
     if (entry.isDirectory() && entry.name === ".uploads-tmp") continue;
-    const abs = join31(root, entry.name);
+    const abs = join32(root, entry.name);
     if (entry.isDirectory()) {
       const sub = await walkSubtree(abs, dataRoot, out);
       if (!sub.clean) clean = false;
@@ -16653,10 +16681,10 @@ function buildZip(entries) {
 
 // server/routes/admin/files.ts
 var UPLOAD_TMP_DIR = ".uploads-tmp";
-var UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function readMeta(absDir, baseName) {
   try {
-    const raw = await readFile4(join32(absDir, `${baseName}.meta.json`), "utf8");
+    const raw = await readFile4(join33(absDir, `${baseName}.meta.json`), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.filename === "string") {
       return { filename: parsed.filename, mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0 };
@@ -16675,7 +16703,7 @@ async function readAccountNames() {
     return map;
   }
   for (const name of names) {
-    if (!UUID_RE3.test(name)) continue;
+    if (!UUID_RE4.test(name)) continue;
     const configPath2 = resolve23(accountsDir, name, "account.json");
     try {
       const raw = await readFile4(configPath2, "utf8");
@@ -16710,8 +16738,8 @@ async function servableFilesIn(dirAbs, uuid) {
   return out;
 }
 async function enrich(absolute, entry, accountNames) {
-  if (entry.kind === "directory" && UUID_RE3.test(entry.name)) {
-    const dirAbs = join32(absolute, entry.name);
+  if (entry.kind === "directory" && UUID_RE4.test(entry.name)) {
+    const dirAbs = join33(absolute, entry.name);
     const meta = await readMeta(dirAbs, entry.name);
     if (meta?.filename) {
       const servable = await servableFilesIn(dirAbs, entry.name);
@@ -16720,7 +16748,7 @@ async function enrich(absolute, entry, accountNames) {
         let size = null;
         let modifiedAt = entry.modifiedAt;
         try {
-          const st = await stat4(join32(dirAbs, innerName));
+          const st = await stat4(join33(dirAbs, innerName));
           size = st.size;
           modifiedAt = st.mtime.toISOString();
         } catch {
@@ -16745,7 +16773,7 @@ async function enrich(absolute, entry, accountNames) {
   if (entry.kind === "file") {
     const dot = entry.name.lastIndexOf(".");
     const base = dot === -1 ? entry.name : entry.name.slice(0, dot);
-    if (UUID_RE3.test(base)) {
+    if (UUID_RE4.test(base)) {
       const meta = await readMeta(absolute, base);
       if (meta?.filename) {
         entry.displayName = meta.filename;
@@ -16758,7 +16786,7 @@ async function enrich(absolute, entry, accountNames) {
 function buildDisplayPath(relPath, accountNames) {
   if (relPath === "." || relPath === "") return [];
   return relPath.split("/").filter(Boolean).map((seg) => {
-    const dn = UUID_RE3.test(seg) ? accountNames.get(seg) : void 0;
+    const dn = UUID_RE4.test(seg) ? accountNames.get(seg) : void 0;
     return dn ? { name: seg, displayName: dn } : { name: seg };
   });
 }
@@ -16808,11 +16836,11 @@ function isProtectedFromRename(relPath) {
   if (segments.length === 3 && segments[0] === "accounts" && segments[2] === "uploads") {
     return true;
   }
-  if (segments.length === 4 && segments[0] === "accounts" && segments[2] === "uploads" && UUID_RE3.test(segments[3])) {
+  if (segments.length === 4 && segments[0] === "accounts" && segments[2] === "uploads" && UUID_RE4.test(segments[3])) {
     return true;
   }
   if (parseAttachmentPath(relPath) !== null) return true;
-  if (UUID_RE3.test(base.replace(/\.meta\.json$/, "")) && base.endsWith(".meta.json")) {
+  if (UUID_RE4.test(base.replace(/\.meta\.json$/, "")) && base.endsWith(".meta.json")) {
     return true;
   }
   return false;
@@ -16886,16 +16914,16 @@ app22.get("/", requireAdminSession, async (c) => {
     const isAccountParent = segs.length === 1 && segs[0] === "accounts";
     const entries = [];
     for (const name of names) {
-      if (UUID_RE3.test(name.replace(/\.meta\.json$/, "")) && name.endsWith(".meta.json")) {
+      if (UUID_RE4.test(name.replace(/\.meta\.json$/, "")) && name.endsWith(".meta.json")) {
         continue;
       }
-      if (isAccountParent && UUID_RE3.test(name) && name !== accountId) {
+      if (isAccountParent && UUID_RE4.test(name) && name !== accountId) {
         continue;
       }
       const childRel = relPath === "" || relPath === "." ? name : `${relPath}/${name}`;
       const protectedEntry = isProtectedFromDeletion(childRel).protected;
       try {
-        const entryPath = join32(absolute, name);
+        const entryPath = join33(absolute, name);
         const s = await stat4(entryPath);
         entries.push({
           name,
@@ -16958,7 +16986,7 @@ app22.get("/download", requireAdminSession, async (c) => {
       console.error(`[data] op=scratchpad-no-session sessionId="${sessionId.slice(0, 8)}\u2026"`);
       return c.json({ error: "Not found" }, 404);
     }
-    const meta = readSidecarMeta(join32(projectDir, `${sessionId}.meta.json`));
+    const meta = readSidecarMeta(join33(projectDir, `${sessionId}.meta.json`));
     if (!meta.accountId || meta.accountId !== accountId) {
       console.error(`[data] account-scope-blocked root="scratchpad" sessionId="${sessionId.slice(0, 8)}\u2026" account=${accountId.slice(0, 8)}\u2026`);
       return c.json({ error: "Not found" }, 404);
@@ -17053,7 +17081,7 @@ async function* walkRegularFiles(dirAbsolute) {
   const dirents = await readdir3(dirAbsolute, { withFileTypes: true });
   for (const d of dirents) {
     if (d.isSymbolicLink()) continue;
-    const child = join32(dirAbsolute, d.name);
+    const child = join33(dirAbsolute, d.name);
     if (d.isDirectory()) {
       yield* walkRegularFiles(child);
       continue;
@@ -17163,7 +17191,7 @@ async function resolveUploadTarget(c, accountId, uid) {
   const base = resolveOwnAccountWrite(rawDir, accountId, "POST /api/admin/files/upload");
   if (!base.ok) return { ok: false, status: base.status, error: base.error };
   const relDir = relpath ? dirname11(relpath) : ".";
-  const destRel = relDir === "." ? base.relative : join32(base.relative, relDir);
+  const destRel = relDir === "." ? base.relative : join33(base.relative, relDir);
   if (crossesForeignAccountPartition(destRel, accountId)) {
     console.error(`[data] account-scope-blocked endpoint="POST /api/admin/files/upload" path="${destRel}" account=${accountId.slice(0, 8)}\u2026`);
     return { ok: false, status: 404, error: "Not found" };
@@ -17237,7 +17265,7 @@ app22.post("/upload", requireAdminSession, async (c) => {
     });
     await unlink2(tmpPath).catch(() => {
     });
-    const tempRemoved = !existsSync28(tmpPath);
+    const tempRemoved = !existsSync29(tmpPath);
     console.error(`[data-upload] op=cleanup uid=${uid} tempRemoved=${tempRemoved}`);
   };
   const reader = body.getReader();
@@ -17311,7 +17339,7 @@ async function discardChunkUpload(uploadId, state) {
   });
   await unlink2(state.tmpPath).catch(() => {
   });
-  const tempRemoved = !existsSync28(state.tmpPath);
+  const tempRemoved = !existsSync29(state.tmpPath);
   console.error(`[data-upload] op=cleanup uid=${uploadId} tempRemoved=${tempRemoved}`);
 }
 async function writeChunkBody(body, out, alreadyReceived, ceiling) {
@@ -17540,8 +17568,8 @@ app22.delete("/", requireAdminSession, async (c) => {
     const dot = base.lastIndexOf(".");
     const stem = dot === -1 ? base : base.slice(0, dot);
     const containerDir = dirname11(absolute);
-    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join32(containerDir, `${stem}.meta.json`) : null;
-    const isAttachmentContainer = UUID_RE3.test(stem) && basename9(containerDir) === stem;
+    const sidecarPath = UUID_RE4.test(stem) && base !== `${stem}.meta.json` ? join33(containerDir, `${stem}.meta.json`) : null;
+    const isAttachmentContainer = UUID_RE4.test(stem) && basename9(containerDir) === stem;
     await unlink2(absolute);
     if (sidecarPath) {
       try {
@@ -17550,7 +17578,7 @@ app22.delete("/", requireAdminSession, async (c) => {
       }
     }
     if (isAttachmentContainer) {
-      await unlink2(join32(containerDir, `${stem}${EXTRACTED_TEXT_SUFFIX}`)).catch(() => {
+      await unlink2(join33(containerDir, `${stem}${EXTRACTED_TEXT_SUFFIX}`)).catch(() => {
       });
       await rmdir(containerDir).catch(() => {
       });
@@ -18654,8 +18682,8 @@ function isHiddenByDefault(label) {
 }
 
 // server/lib/top-level-labels.ts
-import { readdirSync as readdirSync22, readFileSync as readFileSync33 } from "fs";
-import { join as join33, resolve as resolve24 } from "path";
+import { readdirSync as readdirSync23, readFileSync as readFileSync33 } from "fs";
+import { join as join34, resolve as resolve24 } from "path";
 var STATIC_TOP_LEVEL_LABELS = Object.freeze(
   /* @__PURE__ */ new Set([
     // Base-schema infra (schema-base.md has no top-level section).
@@ -18748,7 +18776,7 @@ function parseTopLevelLabels(content) {
 }
 function resolveReferencesDir() {
   if (process.env.MAXY_PLATFORM_ROOT) {
-    return join33(process.env.MAXY_PLATFORM_ROOT, "plugins", "memory", "references");
+    return join34(process.env.MAXY_PLATFORM_ROOT, "plugins", "memory", "references");
   }
   return resolve24(import.meta.dirname, "../../../plugins/memory/references");
 }
@@ -18756,9 +18784,9 @@ function parseTableTopLevelLabels(referencesDir) {
   const labels = /* @__PURE__ */ new Set();
   const contributingFiles = [];
   try {
-    const fileNames = readdirSync22(referencesDir).filter((f) => f.startsWith("schema-") && f.endsWith(".md")).sort();
+    const fileNames = readdirSync23(referencesDir).filter((f) => f.startsWith("schema-") && f.endsWith(".md")).sort();
     for (const fileName of fileNames) {
-      const content = readFileSync33(join33(referencesDir, fileName), "utf-8");
+      const content = readFileSync33(join34(referencesDir, fileName), "utf-8");
       const parsed = parseTopLevelLabels(content);
       if (parsed.length > 0) contributingFiles.push(fileName);
       for (const label of parsed) labels.add(label);
@@ -19912,7 +19940,7 @@ var graph_default_view_default = app28;
 // server/routes/admin/sidebar-artefacts.ts
 import { readdir as readdir4, stat as stat5 } from "fs/promises";
 import { resolve as resolve25, relative as relative5, isAbsolute as isAbsolute2, sep as sep7, basename as basename10 } from "path";
-import { existsSync as existsSync29 } from "fs";
+import { existsSync as existsSync30 } from "fs";
 var LIMIT = 50;
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
 function toDataRootRelPath(absPath) {
@@ -20019,7 +20047,7 @@ async function fetchAgentTemplateRows(accountDir) {
 async function unionSpecialistFilenames(overrideDir, bundledDir) {
   const names = /* @__PURE__ */ new Set();
   for (const dir of [overrideDir, bundledDir]) {
-    if (!existsSync29(dir)) continue;
+    if (!existsSync30(dir)) continue;
     try {
       const entries = await readdir4(dir);
       for (const entry of entries) {
@@ -20034,7 +20062,7 @@ async function unionSpecialistFilenames(overrideDir, bundledDir) {
 }
 async function readAgentTemplateRow(inp) {
   let chosenPath = null;
-  if (existsSync29(inp.overridePath)) {
+  if (existsSync30(inp.overridePath)) {
     try {
       validateFilePathInAccount(inp.overridePath, inp.overrideRoot);
       chosenPath = inp.overridePath;
@@ -20045,7 +20073,7 @@ async function readAgentTemplateRow(inp) {
       );
       return null;
     }
-  } else if (existsSync29(inp.bundledPath)) {
+  } else if (existsSync30(inp.bundledPath)) {
     if (!isWithin(inp.bundledPath, inp.bundledRoot)) {
       console.error(
         `[admin/sidebar-artefacts] agent-template-read-failed agent=${inp.displayName} kind=${inp.logName} error="bundled path outside PLATFORM_ROOT"`
@@ -20647,12 +20675,12 @@ app37.get("/", async (c) => {
 var system_stats_default = app37;
 
 // server/routes/admin/health.ts
-import { existsSync as existsSync30, readFileSync as readFileSync34 } from "fs";
-import { resolve as resolve26, join as join34 } from "path";
+import { existsSync as existsSync31, readFileSync as readFileSync34 } from "fs";
+import { resolve as resolve26, join as join35 } from "path";
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve26(process.cwd(), "..");
 var brandHostname = "maxy";
-var brandJsonPath = join34(PLATFORM_ROOT6, "config", "brand.json");
-if (existsSync30(brandJsonPath)) {
+var brandJsonPath = join35(PLATFORM_ROOT6, "config", "brand.json");
+if (existsSync31(brandJsonPath)) {
   try {
     const brand = JSON.parse(readFileSync34(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
@@ -20663,7 +20691,7 @@ var VERSION_FILE = resolve26(PLATFORM_ROOT6, `config/.${brandHostname}-version`)
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
-  if (!existsSync30(VERSION_FILE)) return "unknown";
+  if (!existsSync31(VERSION_FILE)) return "unknown";
   return readFileSync34(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
@@ -21440,8 +21468,8 @@ app45.post("/launch", requireAdminSession, async (c) => {
 var browser_default = app45;
 
 // server/routes/admin/calendar.ts
-import { existsSync as existsSync31 } from "fs";
-import { join as join36 } from "path";
+import { existsSync as existsSync32 } from "fs";
+import { join as join37 } from "path";
 
 // server/lib/calendar-ics.ts
 var CRLF = "\r\n";
@@ -21541,7 +21569,7 @@ function countVEvents(ics) {
 
 // server/lib/calendar-availability.ts
 import { readFileSync as readFileSync35 } from "fs";
-import { join as join35 } from "path";
+import { join as join36 } from "path";
 var AVAILABILITY_FILENAME = "calendar-availability.json";
 var REQUIRED_KEYS = [
   "timezone",
@@ -21550,7 +21578,7 @@ var REQUIRED_KEYS = [
   "weekly"
 ];
 function readAvailabilityConfig(accountDir) {
-  const path3 = join35(accountDir, AVAILABILITY_FILENAME);
+  const path3 = join36(accountDir, AVAILABILITY_FILENAME);
   let raw;
   try {
     raw = readFileSync35(path3, "utf-8");
@@ -21912,7 +21940,7 @@ app46.get("/booking-link", requireAdminSession, (c) => {
       console.error('[calendar] op=booking-link-fail err="no account configured"');
       return c.json({ bookingDomain: null });
     }
-    if (!existsSync31(join36(account.accountDir, AVAILABILITY_FILENAME))) {
+    if (!existsSync32(join37(account.accountDir, AVAILABILITY_FILENAME))) {
       console.log("[calendar] op=booking-link bookingDomain=none source=availability-config");
       return c.json({ bookingDomain: null });
     }
@@ -22269,7 +22297,7 @@ app51.post("/", requireAdminSession, async (c) => {
 var task_time_adjust_default = app51;
 
 // server/routes/admin/activity.ts
-import { readdirSync as readdirSync23 } from "fs";
+import { readdirSync as readdirSync24 } from "fs";
 var app52 = new Hono();
 var TAG42 = "[activity]";
 function resolveHouseAccountId(accounts) {
@@ -22285,7 +22313,7 @@ function requestToken() {
 var short = (id) => id ? id.slice(0, 8) : "unset";
 function countAccountDirsOnDisk() {
   try {
-    return readdirSync23(ACCOUNTS_DIR, { withFileTypes: true }).filter(
+    return readdirSync24(ACCOUNTS_DIR, { withFileTypes: true }).filter(
       (e) => e.isDirectory() && !e.name.startsWith(".")
     ).length;
   } catch {
@@ -22340,8 +22368,10 @@ app52.get("/", requireAdminSession, async (c) => {
   const untaggedCount = rows.filter((r) => r.accountId === null).length;
   const meteringFailed = rows.filter((r) => r.meteringError !== null).length;
   const censusAgeMs = census ? Date.now() - census.sampleAtMs : null;
+  const ageNull = rows.filter((r) => r.ageMs === null).length;
+  const sidecarNull = rows.filter((r) => r.sidecarMissing).length;
   console.log(
-    `${TAG42} op=census req=${req} ageMs=${censusAgeMs ?? "none"} live=${census?.live ?? "none"} cpuNull=${census?.cpuNull ?? "none"}`
+    `${TAG42} op=census req=${req} ageMs=${censusAgeMs ?? "none"} live=${census?.live ?? "none"} cpuNull=${census?.cpuNull ?? "none"} rows=${rows.length} ageNull=${ageNull} sidecarNull=${sidecarNull}`
   );
   console.log(
     `${TAG42} op=response req=${req} rows=${rows.length} accounts=${valid.length} untagged=${untaggedCount} meteringFailed=${meteringFailed} ms=${Date.now() - start}`
@@ -22649,7 +22679,7 @@ app56.route("/request-magic-link", request_magic_link_default);
 var access_default = app56;
 
 // server/routes/sites.ts
-import { existsSync as existsSync32, readFileSync as readFileSync36, realpathSync as realpathSync7, statSync as statSync13 } from "fs";
+import { existsSync as existsSync33, readFileSync as readFileSync36, realpathSync as realpathSync7, statSync as statSync14 } from "fs";
 import { resolve as resolve28 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
@@ -22715,7 +22745,7 @@ app57.get("/:rel{.*}", (c) => {
   }
   let stat8;
   try {
-    stat8 = existsSync32(filePath) ? statSync13(filePath) : null;
+    stat8 = existsSync33(filePath) ? statSync14(filePath) : null;
   } catch {
     stat8 = null;
   }
@@ -22734,7 +22764,7 @@ app57.get("/:rel{.*}", (c) => {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync32(filePath)) {
+  if (!existsSync33(filePath)) {
     console.error(`[sites] not-found path=${reqPath} status=404`);
     return c.text("Not found", 404);
   }
@@ -22865,8 +22895,8 @@ var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync33, readFileSync as readFileSync38 } from "fs";
-import { join as join37 } from "path";
+import { existsSync as existsSync34, readFileSync as readFileSync38 } from "fs";
+import { join as join38 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
 function readBrandConfig() {
@@ -22874,8 +22904,8 @@ function readBrandConfig() {
   cachedAttempted = true;
   const platformRoot5 = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot5) return null;
-  const brandPath = join37(platformRoot5, "config", "brand.json");
-  if (!existsSync33(brandPath)) return null;
+  const brandPath = join38(platformRoot5, "config", "brand.json");
+  if (!existsSync34(brandPath)) return null;
   try {
     cached2 = JSON.parse(readFileSync38(brandPath, "utf-8"));
     return cached2;
@@ -23366,8 +23396,8 @@ var visitor_event_default = app60;
 
 // server/routes/session.ts
 import { resolve as resolve29 } from "path";
-import { existsSync as existsSync34, writeFileSync as writeFileSync13, mkdirSync as mkdirSync9 } from "fs";
-var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+import { existsSync as existsSync35, writeFileSync as writeFileSync13, mkdirSync as mkdirSync9 } from "fs";
+var UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function writeBrandingCache(accountId, agentSlug, branding) {
   try {
     const cacheDir = resolve29(MAXY_DIR, "branding-cache", accountId);
@@ -23382,7 +23412,7 @@ function parseVisitorCookie2(cookieHeader) {
   const match = cookieHeader.match(/(?:^|;\s*)maxy_visitor=([^;]*)/);
   if (!match) return null;
   const value = decodeURIComponent(match[1]).trim();
-  return UUID_RE4.test(value) ? value : null;
+  return UUID_RE5.test(value) ? value : null;
 }
 function parseAccessSessionId2(cookieHeader) {
   if (!cookieHeader) return null;
@@ -23450,7 +23480,7 @@ app61.post("/", async (c) => {
   let agentConfig = null;
   if (account) {
     const agentDir = resolve29(account.accountDir, "agents", agentSlug);
-    if (!existsSync34(agentDir) || !existsSync34(resolve29(agentDir, "config.json"))) {
+    if (!existsSync35(agentDir) || !existsSync35(resolve29(agentDir, "config.json"))) {
       return c.json({ error: "Agent not found" }, 404);
     }
     agentConfig = resolveAgentConfig(account.accountDir, agentSlug);
@@ -23480,7 +23510,7 @@ app61.post("/", async (c) => {
       );
     }
   }
-  if (body.session_key && typeof body.session_key === "string" && UUID_RE4.test(body.session_key)) {
+  if (body.session_key && typeof body.session_key === "string" && UUID_RE5.test(body.session_key)) {
     if (visitorId) {
       const recent = await findRecentConversation(visitorId, accountId, agentSlug).catch(() => null);
       if (recent) {
@@ -23782,8 +23812,8 @@ function startTimeEntryCensus(openSession, opts = {}) {
 }
 
 // app/lib/ledger-census.ts
-import { readdirSync as readdirSync24, readFileSync as readFileSync39, statSync as statSync14 } from "fs";
-import { join as join38 } from "path";
+import { readdirSync as readdirSync25, readFileSync as readFileSync39, statSync as statSync15 } from "fs";
+import { join as join39 } from "path";
 
 // ../lib/ledger-core/dist/reconcile.js
 var LEDGER_INDEX_NAMES = [
@@ -23831,15 +23861,15 @@ var DAY_MS = 864e5;
 function countWriteRejects24h(logDir, now) {
   let entries;
   try {
-    entries = readdirSync24(logDir).filter((f) => f.startsWith("mcp-ledger-") && f.endsWith(".log"));
+    entries = readdirSync25(logDir).filter((f) => f.startsWith("mcp-ledger-") && f.endsWith(".log"));
   } catch {
     return 0;
   }
   let total = 0;
   for (const name of entries) {
-    const path3 = join38(logDir, name);
+    const path3 = join39(logDir, name);
     try {
-      if (now - statSync14(path3).mtimeMs > DAY_MS) continue;
+      if (now - statSync15(path3).mtimeMs > DAY_MS) continue;
       for (const line of readFileSync39(path3, "utf8").split("\n")) {
         if (line.includes("[graph-write] reject")) total += 1;
       }
@@ -24327,8 +24357,8 @@ async function migrateUploads(opts = {}) {
 
 // app/lib/migrate-admin-webchat-sidecars.ts
 import { readdir as readdir6, readFile as readFile6, rename as rename3, writeFile as writeFile4, unlink as unlink3 } from "fs/promises";
-import { existsSync as existsSync35 } from "fs";
-import { join as join39 } from "path";
+import { existsSync as existsSync36 } from "fs";
+import { join as join40 } from "path";
 var ADMIN_ROLE2 = "admin";
 var WEBCHAT_CHANNEL2 = "webchat";
 var SESSION_META_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.meta\.json$/i;
@@ -24357,7 +24387,7 @@ async function writeRaw(path3, obj) {
     await rename3(tmp, path3);
   } catch (err) {
     try {
-      if (existsSync35(tmp)) await unlink3(tmp);
+      if (existsSync36(tmp)) await unlink3(tmp);
     } catch {
     }
     throw err;
@@ -24373,7 +24403,7 @@ async function collectLiveSidecars(projectsRoot) {
   }
   for (const slug of slugs) {
     if (!slug.isDirectory()) continue;
-    const slugDir = join39(projectsRoot, slug.name);
+    const slugDir = join40(projectsRoot, slug.name);
     let entries;
     try {
       entries = await readdir6(slugDir, { withFileTypes: true });
@@ -24382,9 +24412,9 @@ async function collectLiveSidecars(projectsRoot) {
     }
     for (const entry of entries) {
       if (entry.isFile() && SESSION_META_RE.test(entry.name)) {
-        out.push(join39(slugDir, entry.name));
+        out.push(join40(slugDir, entry.name));
       } else if (entry.isDirectory() && entry.name === "subagents") {
-        const subDir = join39(slugDir, entry.name);
+        const subDir = join40(slugDir, entry.name);
         let subs;
         try {
           subs = await readdir6(subDir, { withFileTypes: true });
@@ -24392,7 +24422,7 @@ async function collectLiveSidecars(projectsRoot) {
           continue;
         }
         for (const s of subs) {
-          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join39(subDir, s.name));
+          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join40(subDir, s.name));
         }
       }
     }
@@ -24404,7 +24434,7 @@ function shortId(path3) {
   return base.slice(0, 8);
 }
 async function migrateAdminWebchatSidecars(opts = {}) {
-  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join39(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
+  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join40(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
   const usersFile = opts.usersFile ?? USERS_FILE;
   const accountId = opts.accountId ?? resolveAccount()?.accountId ?? null;
   const resolveName = opts.resolveName ?? defaultResolveName;
@@ -26767,12 +26797,12 @@ function startTelegramNativeFileFollower(input) {
 }
 
 // server/telegram-descriptor.ts
-import { resolve as resolve34, join as join40 } from "path";
+import { resolve as resolve34, join as join41 } from "path";
 function telegramGatewayUrl() {
   return `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`;
 }
 function telegramServerPath() {
-  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve34(process.env.MAXY_PLATFORM_ROOT ?? join40(__dirname, ".."), "services/telegram-channel/dist/server.js");
+  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve34(process.env.MAXY_PLATFORM_ROOT ?? join41(__dirname, ".."), "services/telegram-channel/dist/server.js");
 }
 
 // app/lib/channel-pty-bridge/public-session-end-review.ts
@@ -27059,7 +27089,7 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash6, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync36, readFileSync as readFileSync40, statSync as statSync15 } from "fs";
+import { existsSync as existsSync37, readFileSync as readFileSync40, statSync as statSync16 } from "fs";
 import { resolve as resolve35 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
@@ -27108,10 +27138,10 @@ function resolveEntitlement(brand, account) {
     return logResolved(implicitTrust(account), null);
   }
   const entitlementPath = resolve35(brand.configDir, "entitlement.json");
-  if (!existsSync36(entitlementPath)) {
+  if (!existsSync37(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
-  const stat8 = statSync15(entitlementPath);
+  const stat8 = statSync16(entitlementPath);
   const key = memoKey(stat8.mtimeMs, account);
   if (memo && memo.key === key) {
     return memo.result;
@@ -27299,12 +27329,12 @@ function clientFrom(c) {
 }
 installMediaDownloadGuard();
 var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join41(PLATFORM_ROOT8, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join42(PLATFORM_ROOT8, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync37(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync38(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync37(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync38(BRAND_JSON_PATH)) {
   try {
     const parsed = JSON.parse(readFileSync41(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
@@ -27338,10 +27368,10 @@ var brandLoginOpts = {
   appleTouchIconPath: brandAppIcon512Path,
   themeColor: BRAND.defaultColors?.primary
 };
-var ALIAS_DOMAINS_PATH = join41(homedir4(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join42(homedir4(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync37(ALIAS_DOMAINS_PATH)) return null;
+    if (!existsSync38(ALIAS_DOMAINS_PATH)) return null;
     const parsed = JSON.parse(readFileSync41(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
@@ -27406,7 +27436,7 @@ async function recordPassiveDispatch(input) {
 var waGateway = new WaGateway({
   fetchStandingRules: fetchAccountStandingRules,
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve36(process.env.MAXY_PLATFORM_ROOT ?? join41(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve36(process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 / 1390 — file delivery on the native channel. `maxyAccountId` (the
   // path-validation scope) is the sender's effective SESSION account, resolved
   // once at the inbound gate and threaded here via the gateway's per-sender doc
@@ -27421,7 +27451,7 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve36(process.env.MAXY_PLATFORM_ROOT ?? join41(__dirname, ".."))
+      platformRoot: resolve36(process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
@@ -27525,7 +27555,7 @@ function runDuplicateSenderAudit() {
   try {
     const configDir2 = process.env.CLAUDE_CONFIG_DIR;
     if (!configDir2) return;
-    const projectsRoot = join41(configDir2, "projects");
+    const projectsRoot = join42(configDir2, "projects");
     const records = [];
     for (const { path: jsonlPath, isSubagent, archived } of enumerateJsonls(projectsRoot)) {
       if (isSubagent || archived) continue;
@@ -28077,7 +28107,7 @@ app63.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync37(filePath)) {
+  if (!existsSync38(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
@@ -28107,7 +28137,7 @@ app63.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync37(filePath)) {
+  if (!existsSync38(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
@@ -28127,7 +28157,7 @@ app63.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync37(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync38(BRAND_JSON_PATH)) {
   try {
     const fullBrand = JSON.parse(readFileSync41(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
@@ -28156,7 +28186,7 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 var brandThemeColor = BRAND.defaultColors?.primary ?? "#000000";
 var brandBackgroundColor = BRAND.defaultColors?.background ?? "#ffffff";
 var brandAppIconsExist = [brandAppIcon192Path, brandAppIcon512Path, brandMaskableIconPath].every(
-  (p) => existsSync37(resolve36(process.cwd(), "public", p.replace(/^\//, "")))
+  (p) => existsSync38(resolve36(process.cwd(), "public", p.replace(/^\//, "")))
 );
 var SW_SOURCE = (() => {
   try {
@@ -28168,8 +28198,8 @@ var SW_SOURCE = (() => {
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT8) return "unknown";
-    const versionFile = join41(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync37(versionFile)) return "unknown";
+    const versionFile = join42(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
+    if (!existsSync38(versionFile)) return "unknown";
     const content = readFileSync41(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
@@ -28228,12 +28258,12 @@ ${clientErrorReporterScript}
   return html;
 }
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join41(homedir4(), BRAND.configDir);
+  const configDir2 = join42(homedir4(), BRAND.configDir);
   try {
     const accountId = getDefaultAccountId();
     if (!accountId) return null;
-    const cachePath = join41(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync37(cachePath)) return null;
+    const cachePath = join42(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    if (!existsSync38(cachePath)) return null;
     return JSON.parse(readFileSync41(cachePath, "utf-8"));
   } catch {
     return null;
@@ -28466,11 +28496,11 @@ var hostname = process.env.HOSTNAME ?? "127.0.0.1";
 var httpServer = serve({ fetch: app63.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
-  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join41(__dirname, "..");
+  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, "..");
   const reconcileScript = resolve36(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
   const RECONCILE_INTERVAL_MS = 12e4;
   const runReconcile = () => {
-    if (!existsSync37(reconcileScript)) return;
+    if (!existsSync38(reconcileScript)) return;
     try {
       const child = spawn3(process.execPath, [reconcileScript], {
         env: { ...process.env, PLATFORM_ROOT: reconcilePlatformRoot },
@@ -28488,11 +28518,11 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   loop.unref();
 }
 {
-  const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join41(__dirname, "..");
+  const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, "..");
   const outlookScript = resolve36(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
   const OUTLOOK_COMPLETE_INTERVAL_MS = 3e4;
   const runOutlookComplete = () => {
-    if (!existsSync37(outlookScript)) return;
+    if (!existsSync38(outlookScript)) return;
     try {
       const child = spawn3(process.execPath, [outlookScript], {
         env: { ...process.env, PLATFORM_ROOT: outlookPlatformRoot },
@@ -28510,20 +28540,20 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   outlookLoop.unref();
 }
 {
-  const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join41(__dirname, "..");
+  const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, "..");
   const strandedAccountsDir = resolve36(auditRoot, "..", "data/accounts");
   const STRANDED_AUDIT_INTERVAL_MS = 3e5;
   const STRANDED_AGE_MS = 16 * 6e4;
   const STRANDED_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
   const runStrandedAudit = () => {
     try {
-      if (!existsSync37(strandedAccountsDir)) return;
+      if (!existsSync38(strandedAccountsDir)) return;
       const now = Date.now();
-      for (const name of readdirSync25(strandedAccountsDir)) {
+      for (const name of readdirSync26(strandedAccountsDir)) {
         if (!STRANDED_UUID_RE.test(name)) continue;
         const pendingPath2 = resolve36(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
-        if (!existsSync37(pendingPath2)) continue;
-        const ageMs = now - statSync16(pendingPath2).mtimeMs;
+        if (!existsSync38(pendingPath2)) continue;
+        const ageMs = now - statSync17(pendingPath2).mtimeMs;
         if (ageMs > STRANDED_AGE_MS) {
           console.error(`[outlook-mcp] devicecode-stranded account=${name} ageSec=${Math.floor(ageMs / 1e3)}`);
         }
@@ -28538,7 +28568,45 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   strandedLoop.unref();
 }
 {
-  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join41(__dirname, "..");
+  const googleRoot = process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, "..");
+  const googleAccountsDir = resolve36(googleRoot, "..", "data/accounts");
+  const GOOGLE_PENDING_AUDIT_INTERVAL_MS = 3e5;
+  const runGooglePendingAuditSafe = () => {
+    try {
+      runGooglePendingAudit(googleAccountsDir, Date.now(), (line) => console.error(line));
+    } catch (err) {
+      console.error(`[google-oauth] op=pending-audit-error error="${err.message}"`);
+    }
+  };
+  const googlePendingFirst = setTimeout(runGooglePendingAuditSafe, 27e3);
+  googlePendingFirst.unref();
+  const googlePendingLoop = setInterval(runGooglePendingAuditSafe, GOOGLE_PENDING_AUDIT_INTERVAL_MS);
+  googlePendingLoop.unref();
+  const googleAuditScript = resolve36(googleRoot, "plugins/google/mcp/dist/scripts/account-audit.js");
+  const GOOGLE_ACCOUNT_AUDIT_INTERVAL_MS = 36e5;
+  const runGoogleAccountAudit = () => {
+    if (!existsSync38(googleAuditScript)) return;
+    try {
+      const child = spawn3(process.execPath, [googleAuditScript], {
+        env: { ...process.env, PLATFORM_ROOT: googleRoot },
+        stdio: "inherit"
+      });
+      child.unref();
+      child.on(
+        "error",
+        (err) => console.error(`[google-account-audit] op=spawn-failed error="${err.message}"`)
+      );
+    } catch (err) {
+      console.error(`[google-account-audit] op=spawn-failed error="${err.message}"`);
+    }
+  };
+  const googleAuditFirst = setTimeout(runGoogleAccountAudit, 45e3);
+  googleAuditFirst.unref();
+  const googleAuditLoop = setInterval(runGoogleAccountAudit, GOOGLE_ACCOUNT_AUDIT_INTERVAL_MS);
+  googleAuditLoop.unref();
+}
+{
+  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, "..");
   const STORAGE_AUDIT_INTERVAL_MS = 3e5;
   const runStorageAuditSafe = () => {
     runStorageAudit(auditPlatformRoot).catch(
@@ -28560,7 +28628,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   pagesAuditLoop.unref();
 }
 {
-  const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join41(__dirname, "..");
+  const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, "..");
   const publishScript = resolve36(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
   const PUBLISH_INTERVAL_MS = 3e5;
   const currentAccount = () => {
@@ -28572,7 +28640,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     }
   };
   const spawnPublish = (account) => {
-    if (!existsSync37(publishScript)) return;
+    if (!existsSync38(publishScript)) return;
     try {
       const child = spawn3(process.execPath, [publishScript], {
         env: {
@@ -28593,7 +28661,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     const availPath = resolve36(account.accountDir, "calendar-availability.json");
     let hasBookingSite = false;
     try {
-      if (existsSync37(availPath)) {
+      if (existsSync38(availPath)) {
         const cfg = JSON.parse(readFileSync41(availPath, "utf-8"));
         hasBookingSite = typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
       }
@@ -28602,7 +28670,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     if (!hasBookingSite) return;
     const statePath = resolve36(account.accountDir, "state", "booking-availability", "last-publish.json");
     let lastSuccessAt = null;
-    if (existsSync37(statePath)) {
+    if (existsSync38(statePath)) {
       try {
         const rec = JSON.parse(readFileSync41(statePath, "utf-8"));
         lastSuccessAt = rec.lastSuccessAt ?? null;
@@ -28629,12 +28697,12 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 startTimeEntryCensus(() => getSession());
 startLedgerCensus(() => getSession());
 {
-  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join41(__dirname, "..");
+  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, "..");
   const auditScript = resolve36(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
   const auditLogDir = process.env.LOG_DIR ?? LOG_DIR;
   const CONNECTOR_AUDIT_INTERVAL_MS = 3e5;
   const runConnectorAudit = () => {
-    if (!existsSync37(auditScript)) return;
+    if (!existsSync38(auditScript)) return;
     try {
       const child = spawn3(process.execPath, [auditScript], {
         env: { ...process.env, PLATFORM_ROOT: auditPlatformRoot, LOG_DIR: auditLogDir },
@@ -28745,7 +28813,7 @@ try {
 var ADMINUSER_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 async function runAdminUserReconcileTick() {
   try {
-    if (!existsSync37(USERS_FILE)) {
+    if (!existsSync38(USERS_FILE)) {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
@@ -28790,7 +28858,7 @@ var ingestAuditTimer = setInterval(runIngestAuditTick, INGEST_AUDIT_INTERVAL_MS)
 if (typeof ingestAuditTimer.unref === "function") ingestAuditTimer.unref();
 var USERS_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 function countUsersRows() {
-  if (!existsSync37(USERS_FILE)) return 0;
+  if (!existsSync38(USERS_FILE)) return 0;
   const raw = readFileSync41(USERS_FILE, "utf-8").trim();
   if (!raw) return 0;
   const users = JSON.parse(raw);
@@ -28911,7 +28979,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve36(process.env.MAXY_PLATFORM_ROOT ?? join41(__dirname, "..")),
+  platformRoot: resolve36(process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (msg.isOwnerMirror) {