@rubytech/create-maxy-code 0.1.501 → 0.1.502

package/payload/server/server.js

@@ -1753,10 +1753,10 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync46, existsSync as existsSync43, watchFile, readdirSync as readdirSync27, statSync as statSync18 } from "fs";
+import { readFileSync as readFileSync46, existsSync as existsSync45, watchFile, readdirSync as readdirSync27, statSync as statSync20 } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { createHash as createHash7 } from "crypto";
-import { resolve as resolve42, join as join47, basename as basename13 } from "path";
+import { resolve as resolve43, join as join47, basename as basename14 } from "path";
 import { homedir as homedir4 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
@@ -3030,7 +3030,7 @@ var credsSaveQueue = Promise.resolve();
 async function drainCredsSaveQueue(timeoutMs = 5e3) {
   console.error(`${TAG6} draining credential save queue\u2026`);
   const timer = new Promise(
-    (resolve43) => setTimeout(() => resolve43("timeout"), timeoutMs)
+    (resolve44) => setTimeout(() => resolve44("timeout"), timeoutMs)
   );
   const result = await Promise.race([
     credsSaveQueue.then(() => "drained"),
@@ -3207,11 +3207,11 @@ async function createWaSocket(opts) {
   return sock;
 }
 async function waitForConnection(sock) {
-  return new Promise((resolve43, reject) => {
+  return new Promise((resolve44, reject) => {
     const handler = (update) => {
       if (update.connection === "open") {
         sock.ev.off("connection.update", handler);
-        resolve43();
+        resolve44();
       }
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
@@ -3319,7 +3319,7 @@ function isTimeoutError(err) {
   return Boolean(err?.__maxyTimeout);
 }
 function withTimeout(label, promise, timeoutMs) {
-  return new Promise((resolve43, reject) => {
+  return new Promise((resolve44, reject) => {
     const timer = setTimeout(() => {
       const err = new Error(`${label} timed out after ${timeoutMs}ms`);
       err.__maxyTimeout = true;
@@ -3329,7 +3329,7 @@ function withTimeout(label, promise, timeoutMs) {
     promise.then(
       (value) => {
         clearTimeout(timer);
-        resolve43(value);
+        resolve44(value);
       },
       (err) => {
         clearTimeout(timer);
@@ -4394,8 +4394,8 @@ async function persistWhatsAppMessage(input) {
   const { givenName, familyName } = splitName(input.pushName);
   const prev = sessionWriteLocks.get(input.cacheKey);
   let release;
-  const mine = new Promise((resolve43) => {
-    release = resolve43;
+  const mine = new Promise((resolve44) => {
+    release = resolve44;
   });
   const chained = (prev ?? Promise.resolve()).then(() => mine);
   sessionWriteLocks.set(input.cacheKey, chained);
@@ -6132,11 +6132,11 @@ async function connectWithReconnect(conn) {
       console.error(
         `${TAG17} reconnecting account=${conn.accountId} in ${delay}ms (attempt ${decision.nextAttempts}/${maxAttempts})`
       );
-      await new Promise((resolve43) => {
-        const timer = setTimeout(resolve43, delay);
+      await new Promise((resolve44) => {
+        const timer = setTimeout(resolve44, delay);
         conn.abortController.signal.addEventListener("abort", () => {
           clearTimeout(timer);
-          resolve43();
+          resolve44();
         }, { once: true });
       });
     }
@@ -6144,16 +6144,16 @@ async function connectWithReconnect(conn) {
   }
 }
 function waitForDisconnectEvent(conn) {
-  return new Promise((resolve43) => {
+  return new Promise((resolve44) => {
     if (!conn.sock) {
-      resolve43();
+      resolve44();
       return;
     }
     const sock = conn.sock;
     const handler = (update) => {
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
-        resolve43();
+        resolve44();
       }
     };
     sock.ev.on("connection.update", handler);
@@ -6627,8 +6627,8 @@ async function handleInboundMessage(conn, msg) {
     const conversationKey = isGroup ? remoteJid : senderPhone;
     const debounceKey = `${conn.accountId}:${conversationKey}:${senderPhone}`;
     let resolvePending;
-    const sttPending = new Promise((resolve43) => {
-      resolvePending = resolve43;
+    const sttPending = new Promise((resolve44) => {
+      resolvePending = resolve44;
     });
     if (conn.debouncer) conn.debouncer.registerPending(debounceKey, sttPending);
     try {
@@ -7017,20 +7017,20 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
 
 // server/routes/health.ts
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve43) => {
+  return new Promise((resolve44) => {
     const socket = createConnection2(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve43(true);
+      resolve44(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve43(false);
+      resolve44(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve43(false);
+      resolve44(false);
     });
   });
 }
@@ -7285,8 +7285,8 @@ function webchatTurnTimeoutMs() {
   return Number(process.env.WEBCHAT_TURN_TIMEOUT_MS ?? String(2 * 6e4));
 }
 function createChatRoutes(deps) {
-  const app67 = new Hono();
-  app67.post("/", async (c) => {
+  const app68 = new Hono();
+  app68.post("/", async (c) => {
     console.log(`[chat-route] entered route=public method=POST`);
     const contentType = c.req.header("content-type") ?? "";
     const account = resolveAccount();
@@ -7550,7 +7550,7 @@ ${result.result.text}` : result.result.text;
       }
     });
   });
-  return app67;
+  return app68;
 }
 
 // app/lib/channel-pty-bridge/admin-session-id.ts
@@ -7584,8 +7584,8 @@ function isLoopbackAddr(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
 function createScheduleInjectRoutes(deps) {
-  const app67 = new Hono();
-  app67.post("/", async (c) => {
+  const app68 = new Hono();
+  app68.post("/", async (c) => {
     const env = c.env;
     const remoteAddr = env?.incoming?.socket?.remoteAddress ?? "";
     if (!isLoopbackAddr(remoteAddr)) {
@@ -7686,7 +7686,7 @@ function createScheduleInjectRoutes(deps) {
     console.error(`${TAG20} op=inject-spawn eventId=${eventId} sessionId=${sessionId} result=ok status=-`);
     return c.json({ ok: true }, 200);
   });
-  return app67;
+  return app68;
 }
 
 // server/index.ts
@@ -8369,8 +8369,8 @@ async function startLogin(opts) {
   await clearAuth(authDir);
   let resolveCode = null;
   let rejectCode = null;
-  const codePromise = new Promise((resolve43, reject) => {
-    resolveCode = resolve43;
+  const codePromise = new Promise((resolve44, reject) => {
+    resolveCode = resolve44;
     rejectCode = reject;
   });
   const codeTimer = setTimeout(
@@ -11164,8 +11164,8 @@ function runReconcileLivenessAudit(statePath, nowMs, intervalMs, emit) {
 }
 
 // server/routes/whatsapp-reader.ts
-import { readFileSync as readFileSync21, watch, statSync as statSync7, openSync, readSync, closeSync, existsSync as existsSync16, readdirSync as readdirSync14, realpathSync as realpathSync5 } from "fs";
-import { basename as basename5, dirname as dirname6, isAbsolute, join as join21, relative as relative3, resolve as resolve15, sep as sep4 } from "path";
+import { readFileSync as readFileSync21, watch, statSync as statSync8, openSync, readSync, closeSync, existsSync as existsSync17, readdirSync as readdirSync14, realpathSync as realpathSync6 } from "fs";
+import { basename as basename6, dirname as dirname7, isAbsolute, join as join21, relative as relative3, resolve as resolve16, sep as sep5 } from "path";
 
 // server/routes/admin/sidebar-sessions.ts
 import { readdirSync as readdirSync12, readFileSync as readFileSync19, statSync as statSync6 } from "fs";
@@ -11184,11 +11184,11 @@ function findExistingJsonlForSessionId(claudeConfigDir2, sessionId) {
   } catch {
     return null;
   }
-  const basename14 = `${sessionId}.jsonl`;
+  const basename15 = `${sessionId}.jsonl`;
   for (const slug of slugs) {
-    const live = join17(projectsRoot, slug, basename14);
+    const live = join17(projectsRoot, slug, basename15);
     if (existsSync14(live)) return live;
-    const archived = join17(projectsRoot, slug, "archive", basename14);
+    const archived = join17(projectsRoot, slug, "archive", basename15);
     if (existsSync14(archived)) return archived;
   }
   return null;
@@ -11982,8 +11982,8 @@ function parseTranscript(lines, queuedPendingSuppress = /* @__PURE__ */ new Map(
 }
 
 // app/lib/whatsapp-reader/enrich-attachments.ts
-import { readFileSync as readFileSync20, readdirSync as readdirSync13 } from "fs";
-import { join as join20 } from "path";
+import { readFileSync as readFileSync20, readdirSync as readdirSync13, existsSync as existsSync16, statSync as statSync7, realpathSync as realpathSync5 } from "fs";
+import { basename as basename5, dirname as dirname6, join as join20, resolve as resolve15, sep as sep4 } from "path";
 var ADMIN_UPLOAD_PATH = /\/uploads\/(?!public\/)([0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})\//gi;
 function adminAttachmentIds(text) {
   const ids = [];
@@ -12001,6 +12001,48 @@ function adminAttachmentsFromText(text, uploadsBase) {
   }
   return out;
 }
+function claudeUploadsRoot() {
+  return process.env.CLAUDE_CONFIG_DIR ? resolve15(process.env.CLAUDE_CONFIG_DIR, "uploads") : null;
+}
+var CC_MENTION_RE = /@"([^"]+)"/g;
+function claudeUploadAttachmentsFromText(text, sessionId) {
+  const root = claudeUploadsRoot();
+  if (!root) return { attachments: [], strippedText: text };
+  const sessionDir = resolve15(root, sessionId);
+  const attachments = [];
+  const accepted = [];
+  for (const m of text.matchAll(CC_MENTION_RE)) {
+    let abs;
+    try {
+      abs = resolve15(m[1]);
+    } catch {
+      continue;
+    }
+    if (dirname6(abs) !== sessionDir) continue;
+    if (abs !== sessionDir + sep4 + basename5(abs)) continue;
+    if (!existsSync16(abs)) continue;
+    let real;
+    try {
+      real = realpathSync5(abs);
+    } catch {
+      continue;
+    }
+    if (dirname6(real) !== realpathSync5(sessionDir)) continue;
+    const filename = basename5(abs);
+    attachments.push({
+      attachmentId: filename,
+      filename,
+      mimeType: detectMimeType(filename),
+      sizeBytes: statSync7(real).size,
+      source: "claude-upload"
+    });
+    accepted.push(m[0]);
+  }
+  if (accepted.length === 0) return { attachments, strippedText: text };
+  let strippedText = text;
+  for (const tok of accepted) strippedText = strippedText.split(tok).join("");
+  return { attachments, strippedText: strippedText.trim() };
+}
 function readSidecar(dir, attachmentId) {
   let parsed;
   try {
@@ -12198,8 +12240,8 @@ app5.get("/conversations", requireAdminSession, async (c) => {
   const rows = [];
   let sessionRowsExcludedUntagged = 0;
   for (const { path: path3 } of enumerateJsonls(projectsRoot)) {
-    const sessionId = basename5(path3).replace(/\.jsonl$/, "");
-    const projectDir = dirname6(path3);
+    const sessionId = basename6(path3).replace(/\.jsonl$/, "");
+    const projectDir = dirname7(path3);
     const meta = readSidecarMeta(join21(projectDir, `${sessionId}.meta.json`));
     if (!isReaderChannelSession(meta.role, meta.channel)) continue;
     if (multiAccount) {
@@ -12337,8 +12379,8 @@ app5.get("/conversations-all", requireAdminSession, async (c) => {
   const houseIds = new Set(validAccounts.filter((a) => a.config.role === "house").map((a) => a.accountId));
   const rawByAccount = /* @__PURE__ */ new Map();
   for (const { path: path3 } of enumerateJsonls(projectsRoot)) {
-    const sessionId = basename5(path3).replace(/\.jsonl$/, "");
-    const projectDir = dirname6(path3);
+    const sessionId = basename6(path3).replace(/\.jsonl$/, "");
+    const projectDir = dirname7(path3);
     const meta = readSidecarMeta(join21(projectDir, `${sessionId}.meta.json`));
     if (!isReaderChannelSession(meta.role, meta.channel)) continue;
     if (meta.accountId === null || !validIds.has(meta.accountId)) continue;
@@ -12407,7 +12449,7 @@ app5.get("/conversations-all", requireAdminSession, async (c) => {
   return c.json({ conversations });
 });
 function readFrom(path3, from) {
-  const end = statSync7(path3).size;
+  const end = statSync8(path3).size;
   if (end <= from) return { buf: Buffer.alloc(0), end: from };
   const fd = openSync(path3, "r");
   try {
@@ -12431,7 +12473,7 @@ function enrichDownloads(turn, scratchpadRoot) {
   if (turn.kind !== "agent-file") return turn;
   let scratchpadReal = null;
   try {
-    scratchpadReal = realpathSync5(scratchpadRoot);
+    scratchpadReal = realpathSync6(scratchpadRoot);
   } catch {
     scratchpadReal = null;
   }
@@ -12442,8 +12484,8 @@ function enrichDownloads(turn, scratchpadRoot) {
     }
     if (scratchpadReal) {
       try {
-        const fileReal = realpathSync5(f);
-        if (fileReal === scratchpadReal || fileReal.startsWith(scratchpadReal + sep4)) {
+        const fileReal = realpathSync6(f);
+        if (fileReal === scratchpadReal || fileReal.startsWith(scratchpadReal + sep5)) {
           return { root: "scratchpad", path: relative3(scratchpadReal, fileReal) };
         }
       } catch {
@@ -12454,13 +12496,19 @@ function enrichDownloads(turn, scratchpadRoot) {
   });
   return { ...turn, downloads };
 }
-function enrichAdminAttachments(turn) {
+function enrichAdminAttachments(turn, sessionId) {
   if (turn.kind !== "operator-inbound") return turn;
-  if (adminAttachmentIds(turn.text).length === 0) return turn;
+  if (!turn.text.includes('@"') && adminAttachmentIds(turn.text).length === 0) return turn;
   const account = resolveAccount();
-  if (!account) return turn;
-  const attachments = adminAttachmentsFromText(turn.text, resolve15(DATA_ROOT, "accounts", account.accountId, "uploads"));
-  return attachments.length > 0 ? { ...turn, attachments } : turn;
+  const store2 = account ? adminAttachmentsFromText(turn.text, resolve16(DATA_ROOT, "accounts", account.accountId, "uploads")) : [];
+  const cc = claudeUploadAttachmentsFromText(turn.text, sessionId);
+  if (cc.attachments.length > 0) {
+    console.log(`[session-upload-shape] op=mention accepted=${cc.attachments.length} session=${sessionId.slice(0, 8)}`);
+  }
+  const attachments = [...store2, ...cc.attachments];
+  if (attachments.length === 0) return turn;
+  const text = cc.attachments.length > 0 ? cc.strippedText : turn.text;
+  return { ...turn, attachments, text };
 }
 var CONCURRENCY_WINDOW_MS = 3e5;
 var AGENT_JSONL_RE = /^agent-([0-9a-f]+)\.jsonl$/;
@@ -12527,7 +12575,7 @@ function runActivityTick(c) {
     let size = 0;
     let mtimeMs = 0;
     try {
-      const st = statSync7(join21(c.subagentsDir, name));
+      const st = statSync8(join21(c.subagentsDir, name));
       size = st.size;
       mtimeMs = st.mtimeMs;
     } catch {
@@ -12572,12 +12620,12 @@ app5.get("/stream", requireAdminSession, (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
   const projectDir = c.req.query("projectDir") ?? "";
   const cfg = claudeConfigDir();
-  const projectsRoot = cfg ? resolve15(join21(cfg, "projects")) : null;
+  const projectsRoot = cfg ? resolve16(join21(cfg, "projects")) : null;
   if (!cfg || !projectsRoot || !SESSION_ID_RE2.test(sessionId)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const jsonlPath = resolve15(join21(projectDir, `${sessionId}.jsonl`));
-  if (!jsonlPath.startsWith(projectsRoot + sep4)) {
+  const jsonlPath = resolve16(join21(projectDir, `${sessionId}.jsonl`));
+  if (!jsonlPath.startsWith(projectsRoot + sep5)) {
     return c.json({ error: "bad session reference" }, 400);
   }
   const scratchpadRoot = sessionScratchpadRoot(projectDir, sessionId);
@@ -12595,7 +12643,7 @@ data: ${JSON.stringify(turn)}
     start(controller) {
       const fileEnd0 = (() => {
         try {
-          return statSync7(jsonlPath).size;
+          return statSync8(jsonlPath).size;
         } catch {
           return 0;
         }
@@ -12603,9 +12651,9 @@ data: ${JSON.stringify(turn)}
       let offset = resumeOffset(lastEventId, fileEnd0);
       console.log(`[wa-stream] op=open conn=${connId} sessionId=${sessionId} channel=reader resume=${offset}`);
       const sessionKey = c.req.query("session_key") ?? "";
-      const subagentsDir = resolve15(join21(projectDir, sessionId, "subagents"));
+      const subagentsDir = resolve16(join21(projectDir, sessionId, "subagents"));
       console.log(
-        `[webchat-activity] op=watch-subagents key=${sessionKey} dir=${subagentsDir} exists=${existsSync16(subagentsDir)}`
+        `[webchat-activity] op=watch-subagents key=${sessionKey} dir=${subagentsDir} exists=${existsSync17(subagentsDir)}`
       );
       const actx = makeActivityCtx({
         subagentsDir,
@@ -12631,7 +12679,7 @@ data: ${JSON.stringify(obj)}
           offset = nextOffset;
           let n = 0;
           for (const turn of parseTranscript(lines, queuedPendingSuppress, turnCtx)) {
-            send(controller, enrichAdminAttachments(enrichDownloads(turn, scratchpadRoot)), offset);
+            send(controller, enrichAdminAttachments(enrichDownloads(turn, scratchpadRoot), sessionId), offset);
             actx.lastParentTurns.push(turn);
             if (turn.kind === "agent-error") {
               console.log(`[wa-stream] op=agent-error conn=${connId} sessionId=${sessionId} code=${turn.code} source=jsonl`);
@@ -12651,7 +12699,7 @@ data: ${JSON.stringify(obj)}
           offset = end;
           let n = 0;
           for (const turn of parseTranscript(buf.toString("utf8").split("\n"), queuedPendingSuppress, turnCtx)) {
-            send(controller, enrichAdminAttachments(enrichDownloads(turn, scratchpadRoot)), offset);
+            send(controller, enrichAdminAttachments(enrichDownloads(turn, scratchpadRoot), sessionId), offset);
             actx.lastParentTurns.push(turn);
             if (turn.kind === "agent-error") {
               console.log(`[wa-stream] op=agent-error conn=${connId} sessionId=${sessionId} code=${turn.code} source=jsonl`);
@@ -12713,13 +12761,13 @@ var DIRECTIVE_NAME_RE = /^\d+-\d+\.txt$/;
 function directiveStoreDir(sessionId) {
   const account = resolveAccount();
   if (!account) return null;
-  return resolve15(account.accountDir, "logs", "prompt-optimiser-directives", sessionId);
+  return resolve16(account.accountDir, "logs", "prompt-optimiser-directives", sessionId);
 }
 app5.get("/directives", requireAdminSession, (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
   if (!SESSION_ID_RE2.test(sessionId)) return c.json({ error: "bad session reference" }, 400);
   const dir = directiveStoreDir(sessionId);
-  if (!dir || !existsSync16(dir)) return c.json({ entries: [] });
+  if (!dir || !existsSync17(dir)) return c.json({ entries: [] });
   let names;
   try {
     names = readdirSync14(dir).filter((n) => DIRECTIVE_NAME_RE.test(n));
@@ -12732,7 +12780,7 @@ app5.get("/directives", requireAdminSession, (c) => {
     const pid = Number(pidPart);
     let len = 0;
     try {
-      len = statSync7(join21(dir, name)).size;
+      len = statSync8(join21(dir, name)).size;
     } catch {
     }
     return { name, secs, pid, ts: Number.isFinite(secs) ? new Date(secs * 1e3).toISOString() : null, len };
@@ -12747,8 +12795,8 @@ app5.get("/directive", requireAdminSession, (c) => {
   }
   const dir = directiveStoreDir(sessionId);
   if (!dir) return c.json({ error: "no account" }, 404);
-  const path3 = resolve15(join21(dir, name));
-  if (!path3.startsWith(dir + sep4)) return c.json({ error: "bad reference" }, 400);
+  const path3 = resolve16(join21(dir, name));
+  if (!path3.startsWith(dir + sep5)) return c.json({ error: "bad reference" }, 400);
   let body;
   try {
     body = readFileSync21(path3, "utf8");
@@ -12777,7 +12825,7 @@ app5.get("/store-stream", requireAdminSession, (c) => {
   const connId = `${remoteJid.slice(0, 12)}-${process.hrtime.bigint().toString(36).slice(-6)}`;
   const startedAt = Date.now();
   const lastEventId = c.req.header("Last-Event-ID");
-  const uploadsBase = resolve15(DATA_ROOT, "accounts", accountId, "uploads");
+  const uploadsBase = resolve16(DATA_ROOT, "accounts", accountId, "uploads");
   const byMsgKeyId = /* @__PURE__ */ new Map();
   const reactionRecords = [];
   const reactionsForTarget = (msgKeyId) => foldReactions(reactionRecords).get(msgKeyId);
@@ -12838,7 +12886,7 @@ data: ${JSON.stringify(payload)}
       };
       const fileEnd0 = (() => {
         try {
-          return statSync7(file).size;
+          return statSync8(file).size;
         } catch {
           return 0;
         }
@@ -13056,7 +13104,7 @@ app5.post("/reply", requireAdminSession, async (c) => {
       const absolute = resolved.absolute;
       let size = -1;
       try {
-        const st = statSync7(absolute);
+        const st = statSync8(absolute);
         size = st.isFile() ? st.size : -1;
       } catch {
         size = -1;
@@ -13069,7 +13117,7 @@ app5.post("/reply", requireAdminSession, async (c) => {
       console.log(`${MANUAL_TAG} op=reply-file-ref sendId=${sendId} path=${ref} owner=${owner8} sendAccount=${acct8} sessionAccount=${sess8} via=${decision.via} reason=none ok=true`);
       if (size > MAX_FILE_BYTES) {
         exit("rejected");
-        return c.json({ error: `"${basename5(absolute)}" exceeds the 50 MB limit` }, 400);
+        return c.json({ error: `"${basename6(absolute)}" exceeds the 50 MB limit` }, 400);
       }
       const mime = detectMimeType(absolute);
       if (!isMimeAdmitted(mime, SUPPORTED_MIME_SET)) {
@@ -13166,7 +13214,7 @@ app5.post("/reply", requireAdminSession, async (c) => {
     }
     for (let i = 0; i < resolvedRefs.length; i++) {
       const { absolute, mime } = resolvedRefs[i];
-      const file = new File([readFileSync21(absolute)], basename5(absolute), { type: mime });
+      const file = new File([readFileSync21(absolute)], basename6(absolute), { type: mime });
       const out = await sendStagedFile(file, `ref=${i}`);
       if (!out.ok) {
         exit("error");
@@ -13185,8 +13233,8 @@ app5.post("/reply", requireAdminSession, async (c) => {
 var whatsapp_reader_default = app5;
 
 // server/routes/public-reader.ts
-import { statSync as statSync8, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, watch as watch2, readFileSync as readFileSync22, readdirSync as readdirSync15 } from "fs";
-import { basename as basename6, dirname as dirname7, join as join22, resolve as resolve16, sep as sep5 } from "path";
+import { statSync as statSync9, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, watch as watch2, readFileSync as readFileSync22, readdirSync as readdirSync15 } from "fs";
+import { basename as basename7, dirname as dirname8, join as join22, resolve as resolve17, sep as sep6 } from "path";
 
 // app/lib/whatsapp-reader/delivered-kinds.ts
 var PUBLIC_DELIVERED_KINDS = /* @__PURE__ */ new Set([
@@ -13261,8 +13309,8 @@ function enumeratePublicRows() {
   if (!cfg) return [];
   const rows = [];
   for (const { path: path3 } of enumerateJsonls(join22(cfg, "projects"))) {
-    const sessionId = basename6(path3).replace(/\.jsonl$/, "");
-    const projectDir = dirname7(path3);
+    const sessionId = basename7(path3).replace(/\.jsonl$/, "");
+    const projectDir = dirname8(path3);
     const meta = readSidecarMeta(join22(projectDir, `${sessionId}.meta.json`));
     rows.push({
       sessionId,
@@ -13308,7 +13356,7 @@ app6.get("/session", (c) => {
   return c.json({ sessionId: null, projectDir: null, sessionKey });
 });
 function publicUploadsDir(accountId, sessionId) {
-  return resolve16(DATA_ROOT, "accounts", accountId, "uploads", "public", sessionId);
+  return resolve17(DATA_ROOT, "accounts", accountId, "uploads", "public", sessionId);
 }
 function enrichPublicAttachments(turns, sessionAttachments, cursor) {
   for (const turn of turns) {
@@ -13319,7 +13367,7 @@ function enrichPublicAttachments(turns, sessionAttachments, cursor) {
   }
 }
 function readFrom2(path3, from) {
-  const end = statSync8(path3).size;
+  const end = statSync9(path3).size;
   if (end <= from) return { buf: Buffer.alloc(0), end: from };
   const fd = openSync2(path3, "r");
   try {
@@ -13339,12 +13387,12 @@ app6.get("/stream", (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
   const projectDir = c.req.query("projectDir") ?? "";
   const cfg = claudeConfigDir();
-  const projectsRoot = cfg ? resolve16(join22(cfg, "projects")) : null;
+  const projectsRoot = cfg ? resolve17(join22(cfg, "projects")) : null;
   if (!cfg || !projectsRoot || !SESSION_ID_RE2.test(sessionId)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const jsonlPath = resolve16(join22(projectDir, `${sessionId}.jsonl`));
-  if (!jsonlPath.startsWith(projectsRoot + sep5)) {
+  const jsonlPath = resolve17(join22(projectDir, `${sessionId}.jsonl`));
+  if (!jsonlPath.startsWith(projectsRoot + sep6)) {
     return c.json({ error: "bad session reference" }, 400);
   }
   const meta = readSidecarMeta(join22(projectDir, `${sessionId}.meta.json`));
@@ -13447,8 +13495,8 @@ app6.get("/attachment/:attachmentId", (c) => {
     return new Response("Not found", { status: 404 });
   }
   const uploadsRoot = publicUploadsDir(account.accountId, sessionId);
-  const dir = resolve16(uploadsRoot, attachmentId);
-  if (!dir.startsWith(uploadsRoot + sep5)) {
+  const dir = resolve17(uploadsRoot, attachmentId);
+  if (!dir.startsWith(uploadsRoot + sep6)) {
     console.error(`${ATT_TAG} op=denied session=${ses} att=${at} reason=bad-id`);
     return new Response("Not found", { status: 404 });
   }
@@ -13462,7 +13510,7 @@ app6.get("/attachment/:attachmentId", (c) => {
   try {
     dataFile = readdirSync15(dir).find((f) => !f.endsWith(".meta.json") && !f.endsWith(EXTRACTED_TEXT_SUFFIX));
     if (!dataFile) throw new Error("no data file");
-    buffer = readFileSync22(resolve16(dir, dataFile));
+    buffer = readFileSync22(resolve17(dir, dataFile));
   } catch {
     console.error(`${ATT_TAG} op=denied session=${ses} att=${at} reason=not-found`);
     return new Response("Not found", { status: 404 });
@@ -13483,9 +13531,9 @@ app6.get("/attachment/:attachmentId", (c) => {
 var public_reader_default = app6;
 
 // server/routes/webchat.ts
-import { basename as basename7, dirname as dirname8 } from "path";
+import { basename as basename8, dirname as dirname9 } from "path";
 import { join as join25 } from "path";
-import { existsSync as existsSync18, readdirSync as readdirSync17, readFileSync as readFileSync25, renameSync as renameSync4, statSync as statSync9, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync19, readdirSync as readdirSync17, readFileSync as readFileSync25, renameSync as renameSync4, statSync as statSync10, writeFileSync as writeFileSync9 } from "fs";
 
 // server/canonical-webchat-override.ts
 import { readFileSync as readFileSync23, writeFileSync as writeFileSync7, renameSync as renameSync2 } from "fs";
@@ -13572,7 +13620,7 @@ function isNewSessionEffortLevel(value) {
 }
 
 // ../services/claude-session-manager/src/sidecar-store.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync4, readdirSync as readdirSync16, readFileSync as readFileSync24, renameSync as renameSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync4, readdirSync as readdirSync16, readFileSync as readFileSync24, renameSync as renameSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync8 } from "fs";
 import { join as join24 } from "path";
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -13593,7 +13641,7 @@ function createSidecarStore(config) {
       return { ok: true };
     } catch (error) {
       try {
-        if (existsSync17(tmp)) unlinkSync2(tmp);
+        if (existsSync18(tmp)) unlinkSync2(tmp);
       } catch {
       }
       return { ok: false, error };
@@ -13649,7 +13697,7 @@ function createSidecarStore(config) {
   function clear(sessionsDir, id) {
     const path3 = pathFor(sessionsDir, id);
     try {
-      if (existsSync17(path3)) {
+      if (existsSync18(path3)) {
         unlinkSync2(path3);
         return { ok: true, removed: true };
       }
@@ -13717,7 +13765,7 @@ function locateSidecar(sessionId) {
   }
   for (const slug of slugs) {
     const metaPath = join25(projectsRoot, slug, `${sessionId}.meta.json`);
-    if (existsSync18(metaPath)) return readSidecarMeta(metaPath);
+    if (existsSync19(metaPath)) return readSidecarMeta(metaPath);
   }
   return null;
 }
@@ -13747,7 +13795,7 @@ function sessionSidecarExists(sessionId) {
 function jsonlSizeBytes(projectDir, sessionId) {
   if (projectDir === null) return null;
   try {
-    return statSync9(join25(projectDir, `${sessionId}.jsonl`)).size;
+    return statSync10(join25(projectDir, `${sessionId}.jsonl`)).size;
   } catch {
     return null;
   }
@@ -13885,13 +13933,13 @@ function latestAdminWebchatSessionId(requesterUserId, primaryUserId, scopeAccoun
   let best = null;
   for (const { path: path3, isSubagent, archived } of enumerateJsonls(join25(cfg, "projects"))) {
     if (isSubagent || archived) continue;
-    const id = basename7(path3).slice(0, -".jsonl".length);
-    const meta = readSidecarMeta(join25(dirname8(path3), `${id}.meta.json`));
+    const id = basename8(path3).slice(0, -".jsonl".length);
+    const meta = readSidecarMeta(join25(dirname9(path3), `${id}.meta.json`));
     if (meta.role !== "admin" || meta.channel !== "webchat") continue;
     if (multiAccount && meta.accountId !== scopeAccountId) continue;
     let mtimeMs;
     try {
-      mtimeMs = statSync9(path3).mtimeMs;
+      mtimeMs = statSync10(path3).mtimeMs;
     } catch {
       continue;
     }
@@ -13909,7 +13957,7 @@ function latestAdminWebchatSessionId(requesterUserId, primaryUserId, scopeAccoun
 function overrideKnownNonArchived(id) {
   const { projectDir } = locateSession(id);
   if (projectDir === null) return sessionSidecarExists(id);
-  return basename7(projectDir) !== "archive";
+  return basename8(projectDir) !== "archive";
 }
 function resolveCanonical(accountId, accountDir, requesterUserId, primaryUserId, scopeAccountId, multiAccount) {
   const bootstrapAccountId = scopeAccountId ?? accountId;
@@ -13945,8 +13993,8 @@ async function reapplyLeversViaManager() {
 var WEBCHAT_SEND_TURN_WINDOW_MS = Number(process.env.WEBCHAT_SEND_TURN_WINDOW_MS ?? String(15e3));
 var sendSeq = 0;
 function createWebchatRoutes(deps) {
-  const app67 = new Hono();
-  app67.post("/send", requireAdminSession, async (c) => {
+  const app68 = new Hono();
+  app68.post("/send", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -14149,7 +14197,7 @@ ${note}` : note;
     if (turnTimer.unref) turnTimer.unref();
     return c.json({ ok: true });
   });
-  app67.post("/interrupt", requireAdminSession, async (c) => {
+  app68.post("/interrupt", requireAdminSession, async (c) => {
     const cacheKey = c.get("cacheKey");
     const requesterUserId = (cacheKey ? getUserIdForSession(cacheKey) : void 0) ?? null;
     const primaryUserId = resolvePrimaryAdminUserId();
@@ -14177,7 +14225,7 @@ ${note}` : note;
     }
     return c.json({ ok: true, stopped: outcome.stopped, intId: outcome.intId, deadChild: outcome.deadChild }, 200);
   });
-  app67.post("/settings", requireAdminSession, async (c) => {
+  app68.post("/settings", requireAdminSession, async (c) => {
     const body = await c.req.json().catch(() => null);
     const op = body?.op;
     const value = body?.value;
@@ -14217,7 +14265,7 @@ ${note}` : note;
     console.log(`[webchat:settings] op=${op} outcome=accepted value=${value} settingsApplied=${settingsApplied}`);
     return c.json({ ok: true, settingsApplied });
   });
-  app67.get("/session", requireAdminSession, async (c) => {
+  app68.get("/session", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -14280,8 +14328,8 @@ ${note}` : note;
     let projectDir = null;
     if (cfg) {
       for (const { path: path3 } of enumerateJsonls(join25(cfg, "projects"))) {
-        if (basename7(path3) === `${sessionId}.jsonl`) {
-          projectDir = dirname8(path3);
+        if (basename8(path3) === `${sessionId}.jsonl`) {
+          projectDir = dirname9(path3);
           break;
         }
       }
@@ -14295,7 +14343,7 @@ ${note}` : note;
     const indicators = await fetchComposerIndicators(sessionId);
     return c.json({ sessionId, projectDir, source, sizeBytes: jsonlSizeBytes(projectDir, sessionId), pendingPermissionPrompt: deps.pendingPromptFor?.(`session:${sessionId}`) ?? null, deliveryFailure: deps.deliveryFailureFor?.(`session:${sessionId}`) ?? null, ...indicators, ...readLevers(account) });
   });
-  app67.post("/permission-verdict", requireAdminSession, async (c) => {
+  app68.post("/permission-verdict", requireAdminSession, async (c) => {
     const body = await c.req.json().catch(() => null);
     const sessionId = body?.sessionId;
     const requestId = body?.request_id;
@@ -14312,14 +14360,14 @@ ${note}` : note;
     const ok = deps.resolvePermissionVerdict?.(`session:${sessionId}`, requestId, behavior) ?? false;
     return c.json({ ok });
   });
-  return app67;
+  return app68;
 }
 
 // server/routes/webchat-greeting.ts
-import { resolve as resolve17 } from "path";
+import { resolve as resolve18 } from "path";
 
 // app/lib/claude-agent/specialist-roster.ts
-import { existsSync as existsSync19, readFileSync as readFileSync26, readdirSync as readdirSync18 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync26, readdirSync as readdirSync18 } from "fs";
 import { join as join26 } from "path";
 function field(fm, name) {
   const m = fm.match(new RegExp(`^${name}:\\s*(.*?)\\r?$`, "m"));
@@ -14331,7 +14379,7 @@ function field(fm, name) {
   return value || null;
 }
 function readSpecialistRoster(specialistsDir) {
-  if (!existsSync19(specialistsDir)) return { specialists: [], skipped: [] };
+  if (!existsSync20(specialistsDir)) return { specialists: [], skipped: [] };
   const entries = readdirSync18(specialistsDir);
   const specialists = [];
   const skipped = [];
@@ -14421,7 +14469,7 @@ app7.get("/", requireAdminSession, async (c) => {
     let specialists = [];
     try {
       const roster = readSpecialistRoster(
-        resolve17(ACCOUNTS_DIR, accountId, "specialists", "agents")
+        resolve18(ACCOUNTS_DIR, accountId, "specialists", "agents")
       );
       specialists = roster.specialists;
       for (const s of roster.skipped) {
@@ -14456,8 +14504,8 @@ var webchat_greeting_default = app7;
 
 // server/routes/telegram.ts
 import { homedir as homedir2 } from "os";
-import { resolve as resolve18, join as join27 } from "path";
-import { existsSync as existsSync20, readFileSync as readFileSync27 } from "fs";
+import { resolve as resolve19, join as join27 } from "path";
+import { existsSync as existsSync21, readFileSync as readFileSync27 } from "fs";
 
 // app/lib/telegram/gateway/instance.ts
 var instance = null;
@@ -14515,9 +14563,9 @@ function routeTelegramUpdate(input) {
 // server/routes/telegram.ts
 var TAG29 = "[telegram-inbound]";
 function configDirName() {
-  const platformRoot5 = process.env.MAXY_PLATFORM_ROOT ?? resolve18(process.cwd(), "..");
+  const platformRoot5 = process.env.MAXY_PLATFORM_ROOT ?? resolve19(process.cwd(), "..");
   const brandPath = join27(platformRoot5, "config", "brand.json");
-  if (existsSync20(brandPath)) {
+  if (existsSync21(brandPath)) {
     try {
       return JSON.parse(readFileSync27(brandPath, "utf-8")).configDir ?? ".maxy";
     } catch {
@@ -14527,7 +14575,7 @@ function configDirName() {
 }
 function secretPath(botType) {
   const filename = botType === "admin" ? ".telegram-admin-webhook-secret" : ".telegram-webhook-secret";
-  return resolve18(homedir2(), configDirName(), filename);
+  return resolve19(homedir2(), configDirName(), filename);
 }
 var app8 = new Hono();
 app8.post("/", async (c) => {
@@ -14538,7 +14586,7 @@ app8.post("/", async (c) => {
     return c.json({ ok: false }, 400);
   }
   const sp = secretPath(botType);
-  if (!existsSync20(sp)) {
+  if (!existsSync21(sp)) {
     console.error(`${TAG29} op=reject reason=no-secret-file botType=${botType}`);
     return c.json({ ok: false }, 401);
   }
@@ -14606,7 +14654,7 @@ var telegram_default = app8;
 
 // server/routes/quickbooks.ts
 import { join as join28 } from "path";
-import { existsSync as existsSync21, readFileSync as readFileSync28, writeFileSync as writeFileSync10, mkdirSync as mkdirSync5, rmSync, renameSync as renameSync5 } from "fs";
+import { existsSync as existsSync22, readFileSync as readFileSync28, writeFileSync as writeFileSync10, mkdirSync as mkdirSync5, rmSync, renameSync as renameSync5 } from "fs";
 var TAG30 = "[quickbooks]";
 var INTUIT_TOKEN_URL = "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer";
 var STATE_RE = /^[A-Za-z0-9_-]+$/;
@@ -14619,7 +14667,7 @@ function storePath(accountDir) {
 async function completeConsent(args) {
   const { accountDir, code, realmId } = args;
   const state = args.state;
-  if (!state || !STATE_RE.test(state) || !existsSync21(pendingPath(accountDir, state))) {
+  if (!state || !STATE_RE.test(state) || !existsSync22(pendingPath(accountDir, state))) {
     console.error(`${TAG30} op=callback state=${state ?? ""} stateValid=false realmId=${realmId ?? ""}`);
     return { ok: false, status: 400, message: "Invalid or unknown authorization state.", stateValid: false };
   }
@@ -14646,7 +14694,7 @@ async function completeConsent(args) {
     if (!code || !realmId) {
       return { ok: false, status: 400, message: "Missing code or realmId in the callback.", stateValid: true };
     }
-    if (!existsSync21(storePath(accountDir))) {
+    if (!existsSync22(storePath(accountDir))) {
       return { ok: false, status: 500, message: "No QuickBooks credentials are stored for this account.", stateValid: true };
     }
     const store2 = JSON.parse(readFileSync28(storePath(accountDir), "utf-8"));
@@ -14714,7 +14762,7 @@ var quickbooks_default = app9;
 
 // server/routes/onboarding.ts
 import { spawn, spawnSync as spawnSync2, execFileSync as execFileSync4 } from "child_process";
-import { openSync as openSync3, closeSync as closeSync3, writeFileSync as writeFileSync12, writeSync, existsSync as existsSync23, readFileSync as readFileSync30, unlinkSync as unlinkSync3, renameSync as renameSync7 } from "fs";
+import { openSync as openSync3, closeSync as closeSync3, writeFileSync as writeFileSync12, writeSync, existsSync as existsSync24, readFileSync as readFileSync30, unlinkSync as unlinkSync3, renameSync as renameSync7 } from "fs";
 import { createHash as createHash4, randomUUID as randomUUID8 } from "crypto";
 
 // app/lib/claude-spawn-env.ts
@@ -14723,7 +14771,7 @@ function claudeBin() {
 }
 
 // server/routes/onboarding.ts
-import { dirname as dirname10, join as join30 } from "path";
+import { dirname as dirname11, join as join30 } from "path";
 
 // app/lib/claude-keychain.ts
 import { execFileSync as execFileSync3 } from "child_process";
@@ -14852,8 +14900,8 @@ function readHostCredsBlob(service) {
 }
 
 // ../lib/admins-write/src/index.ts
-import { existsSync as existsSync22, readFileSync as readFileSync29, writeFileSync as writeFileSync11, renameSync as renameSync6, mkdirSync as mkdirSync6, readdirSync as readdirSync19, statSync as statSync10, appendFileSync as appendFileSync3 } from "fs";
-import { dirname as dirname9, join as join29 } from "path";
+import { existsSync as existsSync23, readFileSync as readFileSync29, writeFileSync as writeFileSync11, renameSync as renameSync6, mkdirSync as mkdirSync6, readdirSync as readdirSync19, statSync as statSync11, appendFileSync as appendFileSync3 } from "fs";
+import { dirname as dirname10, join as join29 } from "path";
 function id8(value) {
   return value.slice(0, 8);
 }
@@ -14867,7 +14915,7 @@ function appendUsersAuditLine(audit, fields) {
   const line = `[users-audit] action=${fields.action} actor=${actor}${targetFields}${sess} field=${fields.field} rowsBefore=${fields.rowsBefore} rowsAfter=${fields.rowsAfter} ts=${(/* @__PURE__ */ new Date()).toISOString()}
 `;
   try {
-    mkdirSync6(dirname9(audit.logFile), { recursive: true, mode: 448 });
+    mkdirSync6(dirname10(audit.logFile), { recursive: true, mode: 448 });
     appendFileSync3(audit.logFile, line, { mode: 384 });
   } catch (err) {
     console.error(
@@ -14885,7 +14933,7 @@ function logLine(input, result) {
   );
 }
 function writeFileAtomic(filePath, contents, mode) {
-  mkdirSync6(dirname9(filePath), { recursive: true });
+  mkdirSync6(dirname10(filePath), { recursive: true });
   const tempPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;
   writeFileSync11(tempPath, contents, mode !== void 0 ? { mode } : void 0);
   renameSync6(tempPath, filePath);
@@ -14894,7 +14942,7 @@ function writeAdminEntry(input) {
   const result = { usersJsonResult: "noop", accountJsonResult: "noop" };
   try {
     let users = [];
-    if (existsSync22(input.usersFile)) {
+    if (existsSync23(input.usersFile)) {
       const raw = readFileSync29(input.usersFile, "utf-8").trim();
       if (raw) {
         const parsed = JSON.parse(raw);
@@ -14927,7 +14975,7 @@ function writeAdminEntry(input) {
   }
   try {
     const accountJsonPath = join29(input.accountDir, "account.json");
-    if (!existsSync22(accountJsonPath)) {
+    if (!existsSync23(accountJsonPath)) {
       throw new Error(`account.json not found at ${accountJsonPath}`);
     }
     const config = JSON.parse(readFileSync29(accountJsonPath, "utf-8"));
@@ -14950,7 +14998,7 @@ function writeAdminEntry(input) {
 function computeAdminStoreDivergence(input) {
   const result = { divergences: 0, accountWithoutUsers: [], usersWithoutAccount: [], errors: [] };
   const usersUserIds = /* @__PURE__ */ new Set();
-  if (existsSync22(input.usersFile)) {
+  if (existsSync23(input.usersFile)) {
     try {
       const raw = readFileSync29(input.usersFile, "utf-8").trim();
       if (raw) {
@@ -14964,7 +15012,7 @@ function computeAdminStoreDivergence(input) {
     }
   }
   const accountUserIds = /* @__PURE__ */ new Set();
-  if (existsSync22(input.accountsDir)) {
+  if (existsSync23(input.accountsDir)) {
     let entries;
     try {
       entries = readdirSync19(input.accountsDir);
@@ -14976,12 +15024,12 @@ function computeAdminStoreDivergence(input) {
       if (entry.startsWith(".")) continue;
       const accountDir = join29(input.accountsDir, entry);
       try {
-        if (!statSync10(accountDir).isDirectory()) continue;
+        if (!statSync11(accountDir).isDirectory()) continue;
       } catch {
         continue;
       }
       const accountJsonPath = join29(accountDir, "account.json");
-      if (!existsSync22(accountJsonPath)) continue;
+      if (!existsSync23(accountJsonPath)) continue;
       let admins = [];
       try {
         const config = JSON.parse(readFileSync29(accountJsonPath, "utf-8"));
@@ -15032,7 +15080,7 @@ function hashPin2(pin) {
   return createHash4("sha256").update(pin).digest("hex");
 }
 function readUsersFile2() {
-  if (!existsSync23(USERS_FILE)) return null;
+  if (!existsSync24(USERS_FILE)) return null;
   const raw = readFileSync30(USERS_FILE, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
@@ -15092,7 +15140,7 @@ app10.post("/claude-auth", async (c) => {
     } catch (err) {
       logoutError = err instanceof Error ? err.message : String(err);
     }
-    const credentialsPresent = existsSync23(CLAUDE_CREDENTIALS_FILE);
+    const credentialsPresent = existsSync24(CLAUDE_CREDENTIALS_FILE);
     const ranMs = Date.now() - start;
     console.log(`[onboarding] op=claude-logout credentialsPresent=${credentialsPresent} ranMs=${ranMs} logoutError=${logoutError ? JSON.stringify(logoutError.slice(0, 120)) : "none"}`);
     return c.json({ logged_out: !credentialsPresent });
@@ -15158,7 +15206,7 @@ app10.post("/claude-auth", async (c) => {
       });
       persistKeychainService(
         writebackResult,
-        (service) => writeFileSync12(join30(dirname10(CLAUDE_CREDENTIALS_FILE), ".keychain-service"), service, { mode: 384 }),
+        (service) => writeFileSync12(join30(dirname11(CLAUDE_CREDENTIALS_FILE), ".keychain-service"), service, { mode: 384 }),
         (line) => console.log(line)
       );
       if (darwinAuthChild === claudeProc2) darwinAuthChild = null;
@@ -15241,7 +15289,7 @@ app10.post("/set-pin", async (c) => {
   console.log(`[set-pin] wrote users.json + account.json admins: userId=${userId.slice(0, 8)}\u2026 role=owner`);
   if (process.platform === "linux") {
     let installOwner = null;
-    if (existsSync23(INSTALL_OWNER_FILE)) {
+    if (existsSync24(INSTALL_OWNER_FILE)) {
       try {
         const raw = readFileSync30(INSTALL_OWNER_FILE, "utf-8").trim();
         if (raw.length > 0) installOwner = raw;
@@ -15389,7 +15437,7 @@ app10.put("/set-pin", requireAdminSession, async (c) => {
   console.log(`[set-pin] changed PIN in place: userId=${sessionUserId.slice(0, 8)}\u2026`);
   if (process.platform === "linux") {
     let installOwner = null;
-    if (existsSync23(INSTALL_OWNER_FILE)) {
+    if (existsSync24(INSTALL_OWNER_FILE)) {
       try {
         const raw = readFileSync30(INSTALL_OWNER_FILE, "utf-8").trim();
         if (raw.length > 0) installOwner = raw;
@@ -15423,7 +15471,7 @@ ${body.newPin}
 var onboarding_default = app10;
 
 // server/routes/client-error.ts
-import { appendFileSync as appendFileSync4, existsSync as existsSync24, renameSync as renameSync8, statSync as statSync11 } from "fs";
+import { appendFileSync as appendFileSync4, existsSync as existsSync25, renameSync as renameSync8, statSync as statSync12 } from "fs";
 import { join as join31 } from "path";
 var CLIENT_ERRORS_LOG = join31(LOG_DIR, "client-errors.log");
 var MAX_LOG_SIZE = 10 * 1024 * 1024;
@@ -15482,8 +15530,8 @@ function stackHead(stack) {
 }
 function rotateIfNeeded() {
   try {
-    if (!existsSync24(CLIENT_ERRORS_LOG)) return;
-    const stats = statSync11(CLIENT_ERRORS_LOG);
+    if (!existsSync25(CLIENT_ERRORS_LOG)) return;
+    const stats = statSync12(CLIENT_ERRORS_LOG);
     if (stats.size < MAX_LOG_SIZE) return;
     renameSync8(CLIENT_ERRORS_LOG, CLIENT_ERRORS_LOG + ".1");
   } catch (err) {
@@ -15668,15 +15716,15 @@ function operatorRoleFor(config, userId) {
 async function buildAccountOptionList(accounts, userId) {
   const houseAccount = accounts.find((a) => a.config.role === "house");
   console.log(`[admin-accounts] op=list count=${accounts.length} house=${houseAccount?.accountId ?? "none"}`);
-  const resolve43 = async (a) => {
+  const resolve44 = async (a) => {
     const businessName = await fetchAccountName(a.accountId) || void 0;
     return { accountId: a.accountId, businessName, role: operatorRoleFor(a.config, userId), isHouse: a.config.role === "house" };
   };
   const houseOptions = await Promise.all(
-    accounts.filter((a) => a.config.role === "house").map(resolve43)
+    accounts.filter((a) => a.config.role === "house").map(resolve44)
   );
   const nonHouseOptions = await Promise.all(
-    accounts.filter((a) => a.config.role !== "house").map(resolve43)
+    accounts.filter((a) => a.config.role !== "house").map(resolve44)
   );
   const sortKey = (o) => (o.businessName || o.accountId).toLowerCase();
   nonHouseOptions.sort((x, y) => {
@@ -15809,18 +15857,18 @@ app13.get("/", requireAdminSession, async (c) => {
 var accounts_default = app13;
 
 // server/routes/admin/logs.ts
-import { existsSync as existsSync26, readdirSync as readdirSync20, readFileSync as readFileSync31, statSync as statSync12 } from "fs";
-import { resolve as resolve19, basename as basename8 } from "path";
+import { existsSync as existsSync27, readdirSync as readdirSync20, readFileSync as readFileSync31, statSync as statSync13 } from "fs";
+import { resolve as resolve20, basename as basename9 } from "path";
 
 // app/lib/logs-read-resolve.ts
-import { existsSync as existsSync25 } from "fs";
+import { existsSync as existsSync26 } from "fs";
 import { join as join32 } from "path";
 function resolveSessionLogPaths(filename, logDirs) {
   const tried = [filename];
   const hits = [];
   for (const dir of logDirs) {
     const fullPath = join32(dir, filename);
-    if (existsSync25(fullPath)) {
+    if (existsSync26(fullPath)) {
       hits.push({ path: fullPath, dir });
     }
   }
@@ -15837,19 +15885,19 @@ app14.get("/", async (c) => {
   const cacheKeyParam = c.req.query("cacheKey");
   const download = c.req.query("download") === "1";
   const account = resolveAccount();
-  const accountLogDir = account ? resolve19(account.accountDir, "logs") : null;
+  const accountLogDir = account ? resolve20(account.accountDir, "logs") : null;
   const logDirs = [];
   if (accountLogDir) logDirs.push(accountLogDir);
   logDirs.push(LOG_DIR);
   if (fileParam) {
-    const safe = basename8(fileParam);
+    const safe = basename9(fileParam);
     const searched = [];
     for (const dir of logDirs) {
-      const filePath = resolve19(dir, safe);
+      const filePath = resolve20(dir, safe);
       searched.push(filePath);
       try {
         const buffer = readFileSync31(filePath);
-        const onDiskBytes = statSync12(filePath).size;
+        const onDiskBytes = statSync13(filePath).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
           "Content-Length": String(buffer.byteLength)
@@ -15912,9 +15960,9 @@ app14.get("/", async (c) => {
     if (hit) {
       console.info(`[admin/logs] resolved cacheKey=${cacheKeySlice} sessionId=${sessionIdSlice} via=${primaryId === cacheKey ? "cacheKey" : primaryId === sessionKeyFromConv ? "reverse-lookup" : "sessionId-fallback"}`);
       try {
-        const filename = basename8(hit.path);
+        const filename = basename9(hit.path);
         const buffer = readFileSync31(hit.path);
-        const onDiskBytes = statSync12(hit.path).size;
+        const onDiskBytes = statSync13(hit.path).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
           "Content-Length": String(buffer.byteLength)
@@ -15948,7 +15996,7 @@ app14.get("/", async (c) => {
   const seen = /* @__PURE__ */ new Set();
   const logs = {};
   for (const dir of logDirs) {
-    if (!existsSync26(dir)) continue;
+    if (!existsSync27(dir)) continue;
     let files;
     try {
       files = readdirSync20(dir).filter((f) => f.endsWith(".log"));
@@ -15957,10 +16005,10 @@ app14.get("/", async (c) => {
       console.warn(`[admin/logs] readdir-fail dir=${dir} reason=${reason}`);
       continue;
     }
-    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync12(resolve19(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
+    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync13(resolve20(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
-        const content = readFileSync31(resolve19(dir, name));
+        const content = readFileSync31(resolve20(dir, name));
         const tail = content.length > TAIL_BYTES ? content.subarray(content.length - TAIL_BYTES).toString("utf-8") : content.toString("utf-8");
         logs[name] = tail.trim() || "(empty)";
       } catch (err) {
@@ -16000,12 +16048,12 @@ var claude_info_default = app15;
 
 // server/routes/admin/attachment.ts
 import { readFile as readFile4, readdir as readdir2 } from "fs/promises";
-import { existsSync as existsSync27 } from "fs";
-import { resolve as resolve20 } from "path";
+import { existsSync as existsSync28 } from "fs";
+import { resolve as resolve21 } from "path";
 var app16 = new Hono();
 var ATTACHMENT_ID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 function uploadsDirFor2(accountId, attachmentId) {
-  return resolve20(DATA_ROOT, "accounts", accountId, "uploads", attachmentId);
+  return resolve21(DATA_ROOT, "accounts", accountId, "uploads", attachmentId);
 }
 app16.get("/:attachmentId", requireAdminSession, async (c) => {
   const attachmentId = c.req.param("attachmentId");
@@ -16023,12 +16071,12 @@ app16.get("/:attachmentId", requireAdminSession, async (c) => {
   }
   let accountId = pinnedAccountId;
   let dir = uploadsDirFor2(accountId, attachmentId);
-  let found = existsSync27(dir);
+  let found = existsSync28(dir);
   if (!found) {
     for (const candidate of listValidAccounts()) {
       if (candidate.accountId === pinnedAccountId) continue;
       const candidateDir = uploadsDirFor2(candidate.accountId, attachmentId);
-      if (existsSync27(candidateDir)) {
+      if (existsSync28(candidateDir)) {
         accountId = candidate.accountId;
         dir = candidateDir;
         found = true;
@@ -16042,8 +16090,8 @@ app16.get("/:attachmentId", requireAdminSession, async (c) => {
   if (!found) {
     return new Response("Not found", { status: 404 });
   }
-  const metaPath = resolve20(dir, `${attachmentId}.meta.json`);
-  if (!existsSync27(metaPath)) {
+  const metaPath = resolve21(dir, `${attachmentId}.meta.json`);
+  if (!existsSync28(metaPath)) {
     return new Response("Not found", { status: 404 });
   }
   let meta;
@@ -16057,7 +16105,7 @@ app16.get("/:attachmentId", requireAdminSession, async (c) => {
   if (!dataFile) {
     return new Response("Not found", { status: 404 });
   }
-  const filePath = resolve20(dir, dataFile);
+  const filePath = resolve21(dir, dataFile);
   const buffer = await readFile4(filePath);
   const inlineSafe = isInlineSafeMime(meta.mimeType);
   const safeName = meta.filename.replace(/["\\\r\n]/g, "_");
@@ -16075,23 +16123,66 @@ app16.get("/:attachmentId", requireAdminSession, async (c) => {
 });
 var attachment_default = app16;
 
-// server/routes/admin/agents.ts
-import { resolve as resolve21 } from "path";
-import { readdirSync as readdirSync21, readFileSync as readFileSync32, existsSync as existsSync28, rmSync as rmSync2 } from "fs";
+// server/routes/admin/session-upload.ts
+import { readFile as readFile5 } from "fs/promises";
+import { existsSync as existsSync29, statSync as statSync14 } from "fs";
 var app17 = new Hono();
-app17.get("/", (c) => {
+app17.get("/", requireAdminSession, async (c) => {
+  const cacheKey = c.var.cacheKey;
+  const sessionId = c.req.query("session_id") ?? "";
+  const file = c.req.query("file") ?? "";
+  const short2 = sessionId.slice(0, 8);
+  if (!SESSION_ID_RE2.test(sessionId) || !file || file.includes("/") || file.includes("\\") || file.includes("..")) {
+    console.log(`[session-upload] op=miss session=${short2} status=400 reason=bad-param`);
+    return c.json({ error: "bad request" }, 400);
+  }
+  const accountId = getAccountIdForSession(cacheKey);
+  if (!accountId) {
+    console.log(`[session-upload] op=miss session=${short2} status=401 reason=no-account`);
+    return c.json({ error: "Unauthorized" }, 401);
+  }
+  if (await verifyAndGetConversationUpdatedAt(sessionId, accountId) === null) {
+    console.log(`[session-upload] op=miss session=${short2} status=404 reason=not-owned account=${accountId.slice(0, 8)}`);
+    return c.json({ error: "Not found" }, 404);
+  }
+  const resolution = resolveClaudeUploadsPath(`${sessionId}/${file}`);
+  if (!resolution.ok || !existsSync29(resolution.absolute) || !statSync14(resolution.absolute).isFile()) {
+    console.log(`[session-upload] op=miss session=${short2} file=${file} status=404 reason=absent`);
+    return c.json({ error: "Not found" }, 404);
+  }
+  const mimeType = detectMimeType(file);
+  const inlineSafe = isInlineSafeMime(mimeType);
+  const safeName = file.replace(/["\\\r\n]/g, "_");
+  console.log(`[session-upload] op=served session=${short2} file=${file} disposition=${inlineSafe ? "inline" : "attachment"} mime=${mimeType}`);
+  const buffer = await readFile5(resolution.absolute);
+  return new Response(new Uint8Array(buffer), {
+    headers: {
+      "Content-Type": mimeType,
+      "Content-Disposition": `${inlineSafe ? "inline" : "attachment"}; filename="${safeName}"`,
+      "X-Content-Type-Options": "nosniff",
+      "Cache-Control": "private, max-age=3600"
+    }
+  });
+});
+var session_upload_default = app17;
+
+// server/routes/admin/agents.ts
+import { resolve as resolve22 } from "path";
+import { readdirSync as readdirSync21, readFileSync as readFileSync32, existsSync as existsSync30, rmSync as rmSync2 } from "fs";
+var app18 = new Hono();
+app18.get("/", (c) => {
   const account = resolveAccount();
   if (!account) return c.json({ agents: [] });
-  const agentsDir = resolve21(account.accountDir, "agents");
-  if (!existsSync28(agentsDir)) return c.json({ agents: [] });
+  const agentsDir = resolve22(account.accountDir, "agents");
+  if (!existsSync30(agentsDir)) return c.json({ agents: [] });
   const agents = [];
   try {
     const entries = readdirSync21(agentsDir, { withFileTypes: true });
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
       if (!entry.isDirectory()) continue;
       if (entry.name === "admin") continue;
-      const configPath2 = resolve21(agentsDir, entry.name, "config.json");
-      if (!existsSync28(configPath2)) continue;
+      const configPath2 = resolve22(agentsDir, entry.name, "config.json");
+      if (!existsSync30(configPath2)) continue;
       try {
         const config = JSON.parse(readFileSync32(configPath2, "utf-8"));
         agents.push({
@@ -16109,7 +16200,7 @@ app17.get("/", (c) => {
   }
   return c.json({ agents });
 });
-app17.delete("/:slug", async (c) => {
+app18.delete("/:slug", async (c) => {
   const slug = c.req.param("slug");
   const account = resolveAccount();
   if (!account) return c.json({ error: "No account resolved" }, 400);
@@ -16119,8 +16210,8 @@ app17.delete("/:slug", async (c) => {
   if (slug.includes("/") || slug.includes("..") || slug.includes("\\")) {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
-  const agentDir = resolve21(account.accountDir, "agents", slug);
-  if (!existsSync28(agentDir)) {
+  const agentDir = resolve22(account.accountDir, "agents", slug);
+  if (!existsSync30(agentDir)) {
     return c.json({ error: "Agent not found" }, 404);
   }
   try {
@@ -16139,7 +16230,7 @@ app17.delete("/:slug", async (c) => {
     return c.json({ error: "Failed to delete agent" }, 500);
   }
 });
-app17.post("/:slug/project", async (c) => {
+app18.post("/:slug/project", async (c) => {
   const slug = c.req.param("slug");
   const account = resolveAccount();
   if (!account) return c.json({ error: "No account resolved" }, 400);
@@ -16149,8 +16240,8 @@ app17.post("/:slug/project", async (c) => {
   if (slug.includes("/") || slug.includes("..") || slug.includes("\\")) {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
-  const agentDir = resolve21(account.accountDir, "agents", slug);
-  if (!existsSync28(agentDir)) {
+  const agentDir = resolve22(account.accountDir, "agents", slug);
+  if (!existsSync30(agentDir)) {
     return c.json({ error: "Agent not found on disk" }, 404);
   }
   try {
@@ -16161,12 +16252,12 @@ app17.post("/:slug/project", async (c) => {
     return c.json({ error: `Projection failed: ${msg}` }, 500);
   }
 });
-var agents_default = app17;
+var agents_default = app18;
 
 // server/routes/admin/sessions.ts
 import crypto2 from "crypto";
 import { resolve as resolvePath } from "path";
-import { existsSync as existsSync29, mkdirSync as mkdirSync7, createWriteStream } from "fs";
+import { existsSync as existsSync31, mkdirSync as mkdirSync7, createWriteStream } from "fs";
 
 // ../lib/admin-conversation-purge/src/index.ts
 async function purgeAdminConversationJsonls(args) {
@@ -16326,7 +16417,7 @@ function validateAndShapeAttachments(raws, conversationAccountId, sessionId, mes
     let reason = null;
     if (!a.attachmentId || !a.filename || !a.mimeType || !a.storagePath) reason = "schema-fail";
     else if (a.accountId !== conversationAccountId) reason = "account-mismatch";
-    else if (!existsSync29(a.storagePath)) reason = "missing-file";
+    else if (!existsSync31(a.storagePath)) reason = "missing-file";
     if (reason) {
       invalid++;
       try {
@@ -16433,8 +16524,8 @@ function formatAge(updatedAtStr) {
     return "unknown";
   }
 }
-var app18 = new Hono();
-app18.get("/", requireAdminSession, async (c) => {
+var app19 = new Hono();
+app19.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) return c.json({ error: "Account not found for session" }, 401);
@@ -16464,7 +16555,7 @@ app18.get("/", requireAdminSession, async (c) => {
     return c.json({ error: "Failed to fetch sessions" }, 500);
   }
 });
-app18.post("/new", requireAdminSession, async (c) => {
+app19.post("/new", requireAdminSession, async (c) => {
   const oldCacheKey = c.var.cacheKey;
   console.log(`[admin-chat] new-conversation outcome=ingress cacheKey=${oldCacheKey.slice(0, 8)}`);
   const accountId = getAccountIdForSession(oldCacheKey);
@@ -16481,7 +16572,7 @@ app18.post("/new", requireAdminSession, async (c) => {
   console.log(`[admin-chat] new-conversation outcome=ok oldKey=${oldCacheKey.slice(0, 8)} newKey=${newCacheKey.slice(0, 8)}`);
   return c.json({ session_key: newSignedSessionToken, sessionId: null });
 });
-app18.post("/switch", requireAdminSession, async (c) => {
+app19.post("/switch", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   const userId = getUserIdForSession(cacheKey);
@@ -16509,7 +16600,7 @@ app18.post("/switch", requireAdminSession, async (c) => {
   console.log(`[session-switch] from=${cacheKey.slice(0, 8)} to=${targetCacheKey.slice(0, 8)} targetConvId=${targetSessionId?.slice(0, 8) ?? "none"} accountId=${accountId.slice(0, 8)}`);
   return c.json({ session_key: targetSignedSessionToken, sessionId: targetSessionId });
 });
-app18.delete("/:id", requireAdminSession, async (c) => {
+app19.delete("/:id", requireAdminSession, async (c) => {
   const sessionId = c.req.param("id");
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
@@ -16554,7 +16645,7 @@ app18.delete("/:id", requireAdminSession, async (c) => {
     500
   );
 });
-app18.post("/:id/resume", async (c) => {
+app19.post("/:id/resume", async (c) => {
   const sessionId = c.req.param("id");
   const t0 = Date.now();
   const signedSessionToken = c.req.query("session_key") ?? "";
@@ -16823,7 +16914,7 @@ app18.post("/:id/resume", async (c) => {
     }
   });
 });
-app18.put("/:id/label", requireAdminSession, async (c) => {
+app19.put("/:id/label", requireAdminSession, async (c) => {
   const sessionId = c.req.param("id");
   const cacheKey = c.var.cacheKey;
   let body;
@@ -16849,11 +16940,11 @@ app18.put("/:id/label", requireAdminSession, async (c) => {
     return c.json({ error: "Failed to rename session" }, 500);
   }
 });
-var sessions_default = app18;
+var sessions_default = app19;
 
 // app/lib/claude-agent/spawn-context.ts
-import { existsSync as existsSync30, readFileSync as readFileSync33, readdirSync as readdirSync22, statSync as statSync13 } from "fs";
-import { dirname as dirname11, resolve as resolve22, join as join33 } from "path";
+import { existsSync as existsSync32, readFileSync as readFileSync33, readdirSync as readdirSync22, statSync as statSync15 } from "fs";
+import { dirname as dirname12, resolve as resolve23, join as join33 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
   try {
@@ -16899,7 +16990,7 @@ function extractPluginToolDescriptions(pluginDir) {
   ];
   let raw = null;
   for (const path3 of candidates) {
-    if (!existsSync30(path3)) continue;
+    if (!existsSync32(path3)) continue;
     try {
       raw = readFileSync33(path3, "utf-8");
       break;
@@ -16950,26 +17041,26 @@ function parseSkillPathsFromFrontmatter(fm) {
 }
 function listPluginDirs(accountPluginsDir) {
   const out = /* @__PURE__ */ new Map();
-  const platformPlugins = resolve22(PLATFORM_ROOT, "plugins");
-  if (existsSync30(platformPlugins)) {
+  const platformPlugins = resolve23(PLATFORM_ROOT, "plugins");
+  if (existsSync32(platformPlugins)) {
     for (const name of readdirSync22(platformPlugins)) {
       const dir = join33(platformPlugins, name);
       try {
-        if (statSync13(dir).isDirectory()) out.set(name, dir);
+        if (statSync15(dir).isDirectory()) out.set(name, dir);
       } catch {
       }
     }
   }
-  const premiumRoot = resolve22(dirname11(PLATFORM_ROOT), "premium-plugins");
-  if (existsSync30(premiumRoot)) {
+  const premiumRoot = resolve23(dirname12(PLATFORM_ROOT), "premium-plugins");
+  if (existsSync32(premiumRoot)) {
     for (const bundle of readdirSync22(premiumRoot)) {
       const bundlePlugins = join33(premiumRoot, bundle, "plugins");
-      if (!existsSync30(bundlePlugins)) continue;
+      if (!existsSync32(bundlePlugins)) continue;
       try {
         for (const name of readdirSync22(bundlePlugins)) {
           const dir = join33(bundlePlugins, name);
           try {
-            if (statSync13(dir).isDirectory()) out.set(name, dir);
+            if (statSync15(dir).isDirectory()) out.set(name, dir);
           } catch {
           }
         }
@@ -16977,13 +17068,13 @@ function listPluginDirs(accountPluginsDir) {
       }
     }
   }
-  if (accountPluginsDir && existsSync30(accountPluginsDir)) {
+  if (accountPluginsDir && existsSync32(accountPluginsDir)) {
     try {
       for (const name of readdirSync22(accountPluginsDir)) {
         if (out.has(name)) continue;
         const dir = join33(accountPluginsDir, name);
         try {
-          if (statSync13(dir).isDirectory()) out.set(name, dir);
+          if (statSync15(dir).isDirectory()) out.set(name, dir);
         } catch {
         }
       }
@@ -16993,14 +17084,14 @@ function listPluginDirs(accountPluginsDir) {
   return out;
 }
 function accountPluginsDirFor(accountId) {
-  return resolve22(PLATFORM_ROOT, "..", "data/accounts", accountId, "plugins");
+  return resolve23(PLATFORM_ROOT, "..", "data/accounts", accountId, "plugins");
 }
 function listAccountPluginNames(accountPluginsDir) {
-  if (!existsSync30(accountPluginsDir)) return [];
+  if (!existsSync32(accountPluginsDir)) return [];
   try {
     return readdirSync22(accountPluginsDir).filter((name) => {
       try {
-        return statSync13(join33(accountPluginsDir, name)).isDirectory();
+        return statSync15(join33(accountPluginsDir, name)).isDirectory();
       } catch {
         return false;
       }
@@ -17010,8 +17101,8 @@ function listAccountPluginNames(accountPluginsDir) {
   }
 }
 function readEnabledPlugins(accountId) {
-  const accountFile = resolve22(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync30(accountFile)) return /* @__PURE__ */ new Set();
+  const accountFile = resolve23(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
+  if (!existsSync32(accountFile)) return /* @__PURE__ */ new Set();
   try {
     const parsed = JSON.parse(readFileSync33(accountFile, "utf-8"));
     return new Set(
@@ -17022,7 +17113,7 @@ function readEnabledPlugins(accountId) {
   }
 }
 function readFrontmatter(path3) {
-  if (!existsSync30(path3)) return null;
+  if (!existsSync32(path3)) return null;
   let raw;
   try {
     raw = readFileSync33(path3, "utf-8");
@@ -17060,7 +17151,7 @@ ${fm}
       `plugin-manifest-tool-coverage plugin=${name} tools=${tools.length} with-desc=${withDesc}`
     );
     if (toolNames.length > 0 && descMap.size === 0) {
-      const hasSource = existsSync30(join33(dir, "mcp/dist/index.js")) || existsSync30(join33(dir, "mcp/src/index.ts"));
+      const hasSource = existsSync32(join33(dir, "mcp/dist/index.js")) || existsSync32(join33(dir, "mcp/src/index.ts"));
       if (hasSource) {
         console.warn(
           `[spawn-context] WARN plugin=${name} mcp source present but tool-description regex matched zero entries \u2014 SDK upgrade may have changed the registration shape`
@@ -17086,8 +17177,8 @@ ${skillFm}
   return out;
 }
 function computeSpecialistDomains(accountId) {
-  const specialistsDir = resolve22(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
-  if (!existsSync30(specialistsDir)) return [];
+  const specialistsDir = resolve23(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
+  if (!existsSync32(specialistsDir)) return [];
   let entries;
   try {
     entries = readdirSync22(specialistsDir);
@@ -17099,10 +17190,10 @@ function computeSpecialistDomains(accountId) {
   const resolveDesc = (qualified) => {
     if (!qualified.startsWith("mcp__")) return void 0;
     const rest = qualified.slice(5);
-    const sep11 = rest.indexOf("__");
-    if (sep11 < 0) return void 0;
-    const plugin = rest.slice(0, sep11);
-    const tool = rest.slice(sep11 + 2);
+    const sep12 = rest.indexOf("__");
+    if (sep12 < 0) return void 0;
+    const plugin = rest.slice(0, sep12);
+    const tool = rest.slice(sep12 + 2);
     let map = descByPlugin.get(plugin);
     if (!map) {
       const dir = pluginDirs.get(plugin);
@@ -17132,8 +17223,8 @@ ${fm}
   return out;
 }
 function computeDormantPlugins(accountId) {
-  const accountFile = resolve22(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync30(accountFile)) return [];
+  const accountFile = resolve23(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
+  if (!existsSync32(accountFile)) return [];
   let enabled;
   try {
     const raw = readFileSync33(accountFile, "utf-8");
@@ -17147,8 +17238,8 @@ function computeDormantPlugins(accountId) {
     );
     return [];
   }
-  const pluginsDir = resolve22(PLATFORM_ROOT, "plugins");
-  if (!existsSync30(pluginsDir)) return [];
+  const pluginsDir = resolve23(PLATFORM_ROOT, "plugins");
+  if (!existsSync32(pluginsDir)) return [];
   let entries;
   try {
     entries = readdirSync22(pluginsDir);
@@ -17158,8 +17249,8 @@ function computeDormantPlugins(accountId) {
   const out = [];
   for (const name of entries) {
     if (enabled.has(name)) continue;
-    const manifestPath = resolve22(pluginsDir, name, "PLUGIN.md");
-    if (!existsSync30(manifestPath)) continue;
+    const manifestPath = resolve23(pluginsDir, name, "PLUGIN.md");
+    if (!existsSync32(manifestPath)) continue;
     let manifest;
     try {
       manifest = readFileSync33(manifestPath, "utf-8");
@@ -17176,11 +17267,11 @@ function computeDormantPlugins(accountId) {
 }
 
 // server/routes/admin/claude-sessions.ts
-import { existsSync as existsSync31, readFileSync as readFileSync34 } from "fs";
-import { resolve as resolve23 } from "path";
+import { existsSync as existsSync33, readFileSync as readFileSync34 } from "fs";
+import { resolve as resolve24 } from "path";
 function readTunnelState(brandConfigDir) {
   const statePath = `${process.env.HOME ?? ""}/${brandConfigDir}/cloudflared/tunnel.state`;
-  if (!existsSync31(statePath)) return null;
+  if (!existsSync33(statePath)) return null;
   try {
     const parsed = JSON.parse(readFileSync34(statePath, "utf-8"));
     const tunnelId = typeof parsed.tunnelId === "string" ? parsed.tunnelId : null;
@@ -17193,10 +17284,10 @@ function readTunnelState(brandConfigDir) {
   }
 }
 function resolveTunnelUrl() {
-  const platformRoot5 = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve23(process.cwd(), "..");
+  const platformRoot5 = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve24(process.cwd(), "..");
   let brand;
   try {
-    brand = JSON.parse(readFileSync34(resolve23(platformRoot5, "config", "brand.json"), "utf-8"));
+    brand = JSON.parse(readFileSync34(resolve24(platformRoot5, "config", "brand.json"), "utf-8"));
   } catch {
     return null;
   }
@@ -17219,7 +17310,7 @@ async function refuseIfClaudeAuthDead(c, route, sessionId) {
     503
   );
 }
-var app19 = new Hono();
+var app20 = new Hono();
 async function performSpawnWithInitialMessage(args) {
   const ownerStart = Date.now();
   const aboutOwner = await resolveOwnerProfileBlock(args.senderId, args.userId);
@@ -17296,8 +17387,8 @@ function mintTranscriptEdge(sessionId, claudeSessionId, accountId) {
   if (!sessionId || !claudeSessionId) return;
   void linkConversationTranscript(sessionId, claudeSessionId, accountId);
 }
-app19.use("*", requireAdminSession);
-app19.post("/", async (c) => {
+app20.use("*", requireAdminSession);
+app20.post("/", async (c) => {
   const routeStart = Date.now();
   const cacheKey = c.get("cacheKey") ?? "";
   let body = {};
@@ -17340,18 +17431,18 @@ app19.post("/", async (c) => {
   console.log(`${TAG31} route-done surface=cookie status=${response.status} route-ms=${Date.now() - routeStart}`);
   return response;
 });
-var claude_sessions_default = app19;
+var claude_sessions_default = app20;
 
 // server/routes/admin/log-ingest.ts
 var TAG32 = "[log-ingest]";
 var TAG_PATTERN = /^[A-Za-z0-9_:-]{1,32}$/;
 var LEVELS = /* @__PURE__ */ new Set(["debug", "info", "warn", "error"]);
 var MAX_LINE_BYTES = 4096;
-var app20 = new Hono();
+var app21 = new Hono();
 function isLoopbackAddr2(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-app20.post("/", async (c) => {
+app21.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr2(remoteAddr)) {
     console.error(`${TAG32} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -17394,7 +17485,7 @@ app20.post("/", async (c) => {
   else console.log(formatted);
   return c.json({ ok: true }, 200);
 });
-var log_ingest_default = app20;
+var log_ingest_default = app21;
 
 // server/routes/admin/events.ts
 var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
@@ -17403,8 +17494,8 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
   "device-url:vnc-surface-shown",
   "device-url:malformed"
 ]);
-var app21 = new Hono();
-app21.post("/", async (c) => {
+var app22 = new Hono();
+app22.post("/", async (c) => {
   const TAG56 = "[admin:events]";
   let body;
   try {
@@ -17435,14 +17526,14 @@ app21.post("/", async (c) => {
   console.error(`[${event}] ${formatted}`);
   return c.json({ ok: true });
 });
-var events_default = app21;
+var events_default = app22;
 
 // server/routes/admin/files.ts
-import { createReadStream as createReadStream2, createWriteStream as createWriteStream2, existsSync as existsSync32 } from "fs";
-import { readdir as readdir4, readFile as readFile6, stat as stat6, mkdir as mkdir4, unlink as unlink3, rename as rename2, rmdir } from "fs/promises";
-import { realpathSync as realpathSync6 } from "fs";
+import { createReadStream as createReadStream2, createWriteStream as createWriteStream2, existsSync as existsSync34 } from "fs";
+import { readdir as readdir4, readFile as readFile7, stat as stat6, mkdir as mkdir4, unlink as unlink3, rename as rename2, rmdir } from "fs/promises";
+import { realpathSync as realpathSync7 } from "fs";
 import { randomUUID as randomUUID10 } from "crypto";
-import { basename as basename10, dirname as dirname12, join as join35, relative as relative5, resolve as resolve25, sep as sep7 } from "path";
+import { basename as basename11, dirname as dirname13, join as join35, relative as relative5, resolve as resolve26, sep as sep8 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // ../lib/graph-trash/src/index.ts
@@ -17760,7 +17851,7 @@ async function cascadeDeleteDocument(params) {
 
 // app/lib/file-index.ts
 import * as fsp from "fs/promises";
-import { resolve as resolve24, relative as relative4, join as join34, basename as basename9, extname as extname2, sep as sep6 } from "path";
+import { resolve as resolve25, relative as relative4, join as join34, basename as basename10, extname as extname2, sep as sep7 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
@@ -17898,8 +17989,8 @@ async function extractFileContent(absolute) {
   }
 }
 async function readDisplayName(absolute) {
-  const dir = absolute.slice(0, absolute.length - basename9(absolute).length);
-  const base = basename9(absolute);
+  const dir = absolute.slice(0, absolute.length - basename10(absolute).length);
+  const base = basename10(absolute);
   const dot = base.lastIndexOf(".");
   const stem = dot === -1 ? base : base.slice(0, dot);
   if (base === `${stem}.meta.json`) return null;
@@ -17934,7 +18025,7 @@ async function walkSubtree(root, dataRoot, out) {
         const st = await fsp.stat(abs);
         out.push({
           absolute: abs,
-          relativePath: relative4(dataRoot, abs).split(sep6).join("/"),
+          relativePath: relative4(dataRoot, abs).split(sep7).join("/"),
           sizeBytes: st.size,
           modifiedAt: st.mtime.toISOString()
         });
@@ -18037,7 +18128,7 @@ async function cascadeTrashLinkedKnowledgeDocs(session, accountId, relativePaths
   return { kds, sections, chunks };
 }
 async function buildArtifact(accountId, wf, embed2) {
-  const name = basename9(wf.absolute);
+  const name = basename10(wf.absolute);
   const { content, route } = await extractFileContent(wf.absolute);
   const displayName = await readDisplayName(wf.absolute);
   const embedInput = `${name}
@@ -18080,7 +18171,7 @@ async function reconcileFileIndex(accountId, opts) {
   return withSession(opts, async (session) => {
     const walked = [];
     const subtreeRoots = [
-      resolve24(dataRoot, "accounts", accountId)
+      resolve25(dataRoot, "accounts", accountId)
     ];
     let clean = true;
     for (const root of subtreeRoots) {
@@ -18163,7 +18254,7 @@ async function reconcileFileIndexDebounced(accountId, opts) {
 async function indexFile(accountId, relativePath, opts) {
   const dataRoot = opts?.dataRoot ?? DATA_ROOT;
   const embed2 = opts?.embed ?? embed;
-  const absolute = resolve24(dataRoot, relativePath);
+  const absolute = resolve25(dataRoot, relativePath);
   await withSession(opts, async (session) => {
     const st = await fsp.stat(absolute);
     const wf = {
@@ -18281,7 +18372,7 @@ var UPLOAD_TMP_DIR = ".uploads-tmp";
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function readMeta(absDir, baseName) {
   try {
-    const raw = await readFile6(join35(absDir, `${baseName}.meta.json`), "utf8");
+    const raw = await readFile7(join35(absDir, `${baseName}.meta.json`), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.filename === "string") {
       return { filename: parsed.filename, mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0 };
@@ -18292,7 +18383,7 @@ async function readMeta(absDir, baseName) {
 }
 async function readAccountNames() {
   const map = /* @__PURE__ */ new Map();
-  const accountsDir = resolve25(DATA_ROOT, "accounts");
+  const accountsDir = resolve26(DATA_ROOT, "accounts");
   let names;
   try {
     names = await readdir4(accountsDir);
@@ -18301,9 +18392,9 @@ async function readAccountNames() {
   }
   for (const name of names) {
     if (!UUID_RE4.test(name)) continue;
-    const configPath2 = resolve25(accountsDir, name, "account.json");
+    const configPath2 = resolve26(accountsDir, name, "account.json");
     try {
-      const raw = await readFile6(configPath2, "utf8");
+      const raw = await readFile7(configPath2, "utf8");
       const parsed = JSON.parse(raw);
       if (typeof parsed?.name === "string" && parsed.name.length > 0) {
         map.set(name, parsed.name);
@@ -18480,8 +18571,8 @@ async function knowledgeDocOwnedByAccount(accountId, attachmentId) {
     await session.close();
   }
 }
-var app22 = new Hono();
-app22.get("/", requireAdminSession, async (c) => {
+var app23 = new Hono();
+app23.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -18560,7 +18651,7 @@ app22.get("/", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-app22.get("/download", requireAdminSession, async (c) => {
+app23.get("/download", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -18614,7 +18705,7 @@ app22.get("/download", requireAdminSession, async (c) => {
     if (!info.isFile()) {
       return c.json({ error: "Path is not a file" }, 400);
     }
-    const filename = basename10(absolute);
+    const filename = basename11(absolute);
     const mimeType = detectMimeType(absolute);
     const nodeStream = createReadStream2(absolute);
     const webStream = Readable2.toWeb(nodeStream);
@@ -18638,7 +18729,7 @@ app22.get("/download", requireAdminSession, async (c) => {
     if (root === "data") {
       const parsed = parseAttachmentPath(relPath);
       if (parsed) {
-        const meta = await readMeta(dirname12(absolute), parsed.attachmentId);
+        const meta = await readMeta(dirname13(absolute), parsed.attachmentId);
         if (meta?.filename) downloadName = meta.filename;
       }
     }
@@ -18686,7 +18777,7 @@ async function* walkRegularFiles(dirAbsolute) {
     if (d.isFile()) yield child;
   }
 }
-app22.get("/download-zip", requireAdminSession, async (c) => {
+app23.get("/download-zip", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -18707,7 +18798,7 @@ app22.get("/download-zip", requireAdminSession, async (c) => {
     if (entries.length >= maxFiles) return c.json({ error: `Too many files (max ${maxFiles})` }, 413);
     total += size;
     if (total > maxTotalBytes) return c.json({ error: "Selection too large to zip" }, 413);
-    entries.push({ name: member, data: await readFile6(absolute) });
+    entries.push({ name: member, data: await readFile7(absolute) });
     return null;
   };
   for (const rawPath of rawPaths) {
@@ -18727,21 +18818,21 @@ app22.get("/download-zip", requireAdminSession, async (c) => {
       const info = await stat6(absolute);
       if (info.isDirectory()) {
         dirsWalked++;
-        const parentAbs = dirname12(absolute);
+        const parentAbs = dirname13(absolute);
         for await (const fileAbs of walkRegularFiles(absolute)) {
-          const within = relative5(absolute, fileAbs).split(sep7).join("/");
+          const within = relative5(absolute, fileAbs).split(sep8).join("/");
           const fileRel = relPath === "" || relPath === "." ? within : `${relPath}/${within}`;
           if (crossesForeignAccountPartition(fileRel, accountId)) continue;
           const fileInfo = await stat6(fileAbs);
-          const member = relative5(parentAbs, fileAbs).split(sep7).join("/");
+          const member = relative5(parentAbs, fileAbs).split(sep8).join("/");
           const over = await addFile(fileAbs, fileInfo.size, member);
           if (over) return over;
         }
       } else if (info.isFile()) {
-        let member = basename10(absolute);
+        let member = basename11(absolute);
         const parsed = parseAttachmentPath(relPath);
         if (parsed) {
-          const meta = await readMeta(dirname12(absolute), parsed.attachmentId);
+          const meta = await readMeta(dirname13(absolute), parsed.attachmentId);
           if (meta?.filename) member = meta.filename;
         }
         const over = await addFile(absolute, info.size, member);
@@ -18773,12 +18864,12 @@ function dataUploadCeiling() {
 }
 async function resolveUploadTarget(c, accountId, uid) {
   const rawName = c.req.query("filename") ?? "";
-  const safeName = basename10(rawName).replace(/[\0/\\]/g, "_");
+  const safeName = basename11(rawName).replace(/[\0/\\]/g, "_");
   if (!safeName) return { ok: false, status: 400, error: "filename query param required" };
   const rawRelpath = c.req.query("relpath") ?? "";
   const relpath = rawRelpath !== "" ? rawRelpath : null;
   const token = c.req.query("token") ?? "";
-  const finalName = relpath ? basename10(relpath).replace(/[\0/\\]/g, "_") : `${Date.now()}-${safeName}`;
+  const finalName = relpath ? basename11(relpath).replace(/[\0/\\]/g, "_") : `${Date.now()}-${safeName}`;
   const mimeType = (c.req.header("content-type") ?? "").split(";")[0].trim();
   if (!SUPPORTED_MIME_TYPES.has(mimeType)) {
     console.error(`[data-upload] op=reject-mime uid=${uid} mime="${mimeType}" token=${token} rel="${relpath ?? ""}"`);
@@ -18787,7 +18878,7 @@ async function resolveUploadTarget(c, accountId, uid) {
   const rawDir = c.req.query("path") ?? "";
   const base = resolveOwnAccountWrite(rawDir, accountId, "POST /api/admin/files/upload");
   if (!base.ok) return { ok: false, status: base.status, error: base.error };
-  const relDir = relpath ? dirname12(relpath) : ".";
+  const relDir = relpath ? dirname13(relpath) : ".";
   const destRel = relDir === "." ? base.relative : join35(base.relative, relDir);
   if (crossesForeignAccountPartition(destRel, accountId)) {
     console.error(`[data] account-scope-blocked endpoint="POST /api/admin/files/upload" path="${destRel}" account=${accountId.slice(0, 8)}\u2026`);
@@ -18797,8 +18888,8 @@ async function resolveUploadTarget(c, accountId, uid) {
     console.error(`[data] write-scope-blocked endpoint="POST /api/admin/files/upload" path="${destRel}" account=${accountId.slice(0, 8)}\u2026`);
     return { ok: false, status: 403, error: "Path is outside your account folder" };
   }
-  const destDir = relDir === "." ? base.absolute : resolve25(base.absolute, relDir);
-  const destPath = resolve25(destDir, finalName);
+  const destDir = relDir === "." ? base.absolute : resolve26(base.absolute, relDir);
+  const destPath = resolve26(destDir, finalName);
   if (relpath) {
     const firstCreated = await mkdir4(destDir, { recursive: true });
     if (firstCreated) console.error(`[data-upload] op=mkdir uid=${uid} token=${token} dir="${destRel}"`);
@@ -18806,16 +18897,16 @@ async function resolveUploadTarget(c, accountId, uid) {
     const info = await stat6(destDir).catch(() => null);
     if (!info || !info.isDirectory()) return { ok: false, status: 400, error: "Upload destination is not a directory" };
   }
-  const dataRootReal = realpathSync6(DATA_ROOT);
-  const destDirReal = realpathSync6(destDir);
-  if (destDirReal !== dataRootReal && !destDirReal.startsWith(dataRootReal + sep7)) {
+  const dataRootReal = realpathSync7(DATA_ROOT);
+  const destDirReal = realpathSync7(destDir);
+  if (destDirReal !== dataRootReal && !destDirReal.startsWith(dataRootReal + sep8)) {
     console.error(`[data-upload] op=path-traversal-blocked uid=${uid} requested="${destRel}" resolved="${destDirReal}"`);
     return { ok: false, status: 403, error: "Upload destination escapes DATA_ROOT" };
   }
   return { ok: true, destDir, destPath, destRel, finalName, mimeType, relpath, token };
 }
 async function logUploadsTmpCensus(accountId) {
-  const tmpDir = resolve25(DATA_ROOT, "accounts", accountId, UPLOAD_TMP_DIR);
+  const tmpDir = resolve26(DATA_ROOT, "accounts", accountId, UPLOAD_TMP_DIR);
   let live = 0;
   try {
     live = (await readdir4(tmpDir)).length;
@@ -18823,7 +18914,7 @@ async function logUploadsTmpCensus(accountId) {
   }
   console.error(`[uploads-tmp-census] dir=${accountId} live=${live}`);
 }
-app22.post("/upload", requireAdminSession, async (c) => {
+app23.post("/upload", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -18842,9 +18933,9 @@ app22.post("/upload", requireAdminSession, async (c) => {
   if (!body) return c.json({ error: "Empty request body" }, 400);
   console.error(`[data-upload] op=request uid=${uid} account=${accountId} dir="${destRel}" token=${token} rel="${relpath ?? ""}" declaredBytes=${declaredBytes}`);
   const ceiling = dataUploadCeiling();
-  const tmpDir = resolve25(DATA_ROOT, "accounts", accountId, UPLOAD_TMP_DIR);
+  const tmpDir = resolve26(DATA_ROOT, "accounts", accountId, UPLOAD_TMP_DIR);
   await mkdir4(tmpDir, { recursive: true });
-  const tmpPath = resolve25(tmpDir, `${uid}.part`);
+  const tmpPath = resolve26(tmpDir, `${uid}.part`);
   const out = createWriteStream2(tmpPath);
   const t0 = Date.now();
   let received = 0;
@@ -18862,7 +18953,7 @@ app22.post("/upload", requireAdminSession, async (c) => {
     });
     await unlink3(tmpPath).catch(() => {
     });
-    const tempRemoved = !existsSync32(tmpPath);
+    const tempRemoved = !existsSync34(tmpPath);
     console.error(`[data-upload] op=cleanup uid=${uid} tempRemoved=${tempRemoved}`);
   };
   const reader = body.getReader();
@@ -18936,7 +19027,7 @@ async function discardChunkUpload(uploadId, state) {
   });
   await unlink3(state.tmpPath).catch(() => {
   });
-  const tempRemoved = !existsSync32(state.tmpPath);
+  const tempRemoved = !existsSync34(state.tmpPath);
   console.error(`[data-upload] op=cleanup uid=${uploadId} tempRemoved=${tempRemoved}`);
 }
 async function writeChunkBody(body, out, alreadyReceived, ceiling) {
@@ -18991,9 +19082,9 @@ async function handleChunkUpload(c, accountId) {
     }
     const target = await resolveUploadTarget(c, accountId, uploadId);
     if (!target.ok) return c.json({ error: target.error }, target.status);
-    const tmpDir = resolve25(DATA_ROOT, "accounts", accountId, UPLOAD_TMP_DIR);
+    const tmpDir = resolve26(DATA_ROOT, "accounts", accountId, UPLOAD_TMP_DIR);
     await mkdir4(tmpDir, { recursive: true });
-    const tmpPath = resolve25(tmpDir, `${uploadId}.part`);
+    const tmpPath = resolve26(tmpDir, `${uploadId}.part`);
     const out = createWriteStream2(tmpPath);
     const state2 = {
       accountId,
@@ -19099,7 +19190,7 @@ async function evictStaleChunkUploads(ttlMs) {
   return evicted;
 }
 async function sweepStaleUploadTemps() {
-  const accountsRoot = resolve25(DATA_ROOT, "accounts");
+  const accountsRoot = resolve26(DATA_ROOT, "accounts");
   let accounts;
   try {
     accounts = await readdir4(accountsRoot, { withFileTypes: true });
@@ -19109,7 +19200,7 @@ async function sweepStaleUploadTemps() {
   let removed = 0;
   for (const acc of accounts) {
     if (!acc.isDirectory()) continue;
-    const tmpDir = resolve25(accountsRoot, acc.name, UPLOAD_TMP_DIR);
+    const tmpDir = resolve26(accountsRoot, acc.name, UPLOAD_TMP_DIR);
     let entries;
     try {
       entries = await readdir4(tmpDir);
@@ -19118,7 +19209,7 @@ async function sweepStaleUploadTemps() {
     }
     for (const name of entries) {
       try {
-        await unlink3(resolve25(tmpDir, name));
+        await unlink3(resolve26(tmpDir, name));
         removed++;
       } catch {
       }
@@ -19127,7 +19218,7 @@ async function sweepStaleUploadTemps() {
   if (removed > 0) console.error(`[data-upload] op=sweep removed=${removed}`);
   return removed;
 }
-app22.delete("/", requireAdminSession, async (c) => {
+app23.delete("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -19148,7 +19239,7 @@ app22.delete("/", requireAdminSession, async (c) => {
     console.error(`[data] account-scope-blocked endpoint="DELETE /api/admin/files" path="${relPath}" account=${accountId.slice(0, 8)}\u2026`);
     return c.json({ error: "Not found" }, 404);
   }
-  const base = basename10(absolute);
+  const base = basename11(absolute);
   const protection = isProtectedFromDeletion(relPath);
   if (protection.protected) {
     console.error(`[data] file-delete blocked path="${relPath}" reason="protected" rule="${protection.rule}"`);
@@ -19164,9 +19255,9 @@ app22.delete("/", requireAdminSession, async (c) => {
     }
     const dot = base.lastIndexOf(".");
     const stem = dot === -1 ? base : base.slice(0, dot);
-    const containerDir = dirname12(absolute);
+    const containerDir = dirname13(absolute);
     const sidecarPath = UUID_RE4.test(stem) && base !== `${stem}.meta.json` ? join35(containerDir, `${stem}.meta.json`) : null;
-    const isAttachmentContainer = UUID_RE4.test(stem) && basename10(containerDir) === stem;
+    const isAttachmentContainer = UUID_RE4.test(stem) && basename11(containerDir) === stem;
     await unlink3(absolute);
     if (sidecarPath) {
       try {
@@ -19211,7 +19302,7 @@ app22.delete("/", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-app22.post("/folder", requireAdminSession, async (c) => {
+app23.post("/folder", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -19229,7 +19320,7 @@ app22.post("/folder", requireAdminSession, async (c) => {
   if (!isValidEntryName(name)) return c.json({ error: "Invalid folder name" }, 400);
   const parent = resolveOwnAccountWrite(rawPath, accountId, "POST /api/admin/files/folder");
   if (!parent.ok) return c.json({ error: parent.error }, parent.status);
-  const newAbs = resolve25(parent.absolute, name);
+  const newAbs = resolve26(parent.absolute, name);
   const newRel = `${parent.relative}/${name}`;
   try {
     const info = await stat6(parent.absolute);
@@ -19246,7 +19337,7 @@ app22.post("/folder", requireAdminSession, async (c) => {
   console.error(`[data] folder-create path="${newRel}"`);
   return c.json({ path: newRel });
 });
-app22.post("/rename", requireAdminSession, async (c) => {
+app23.post("/rename", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -19268,8 +19359,8 @@ app22.post("/rename", requireAdminSession, async (c) => {
     console.error(`[data] file-rename blocked path="${src.relative}" reason="protected"`);
     return c.json({ error: "Protected entry \u2014 refusing to rename" }, 403);
   }
-  const destAbs = resolve25(dirname12(src.absolute), newName);
-  const newRel = `${dirname12(src.relative)}/${newName}`.replace(/^\.\//, "");
+  const destAbs = resolve26(dirname13(src.absolute), newName);
+  const newRel = `${dirname13(src.relative)}/${newName}`.replace(/^\.\//, "");
   if (isProtectedFromRename(newRel)) {
     console.error(`[data] file-rename blocked path="${newRel}" reason="protected-target"`);
     return c.json({ error: "That name is reserved" }, 403);
@@ -19296,7 +19387,7 @@ app22.post("/rename", requireAdminSession, async (c) => {
   });
   return c.json({ path: newRel });
 });
-var files_default = app22;
+var files_default = app23;
 
 // ../lib/graph-search/src/index.ts
 var import_dist = __toESM(require_dist2());
@@ -20054,8 +20145,8 @@ var DEFAULT_LIMIT = 20;
 var MAX_LIMIT = 2e3;
 var MESSAGE_FAMILY_LABELS = ["Message", "UserMessage", "AssistantMessage"];
 var CONVERSATION_PARENT_LABELS = /* @__PURE__ */ new Set(["AdminConversation", "PublicConversation"]);
-var app23 = new Hono();
-app23.get("/", requireAdminSession, async (c) => {
+var app24 = new Hono();
+app24.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const q2 = (c.req.query("q") ?? "").trim();
   const rawLimit = c.req.query("limit");
@@ -20086,7 +20177,7 @@ app23.get("/", requireAdminSession, async (c) => {
   const wantsBodyFulltext = !allLabels && labels.some((l) => CONVERSATION_PARENT_LABELS.has(l));
   const forwardedLabels = allLabels ? void 0 : wantsBodyFulltext ? Array.from(/* @__PURE__ */ new Set([...labels, ...MESSAGE_FAMILY_LABELS])) : labels;
   if (labels.includes("FileArtifact")) {
-    await reconcileFileIndexDebounced(accountId);
+    void reconcileFileIndexDebounced(accountId);
   }
   const started = Date.now();
   const session = getSession();
@@ -20191,7 +20282,7 @@ app23.get("/", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-var graph_search_default = app23;
+var graph_search_default = app24;
 
 // server/routes/admin/graph-subgraph.ts
 import neo4j2 from "neo4j-driver";
@@ -20285,7 +20376,7 @@ function isHiddenByDefault(label) {
 // server/lib/top-level-labels.ts
 var import_dist4 = __toESM(require_dist3(), 1);
 import { readdirSync as readdirSync23, readFileSync as readFileSync35 } from "fs";
-import { join as join36, resolve as resolve26 } from "path";
+import { join as join36, resolve as resolve27 } from "path";
 var STATIC_TOP_LEVEL_LABELS = Object.freeze(
   /* @__PURE__ */ new Set([
     // Base-schema infra (schema-base.md has no top-level section).
@@ -20369,8 +20460,8 @@ function parseTopLevelLabels(content) {
     const line = lines[i];
     if (line.startsWith("## ")) return [];
     if (!line.includes("|")) continue;
-    const sep11 = lines[i + 1];
-    if (!/^\s*\|?[\s:|-]+\|?\s*$/.test(sep11) || !sep11.includes("-")) continue;
+    const sep12 = lines[i + 1];
+    if (!/^\s*\|?[\s:|-]+\|?\s*$/.test(sep12) || !sep12.includes("-")) continue;
     const headers = splitPipeRow(line).map((h) => stripBackticks(h).toLowerCase());
     const labelCol = headers.findIndex((h) => h === "neo4j label");
     if (labelCol === -1) return [];
@@ -20391,7 +20482,7 @@ function resolveReferencesDir() {
   if (process.env.MAXY_PLATFORM_ROOT) {
     return join36(process.env.MAXY_PLATFORM_ROOT, "plugins", "memory", "references");
   }
-  return resolve26(import.meta.dirname, "../../../plugins/memory/references");
+  return resolve27(import.meta.dirname, "../../../plugins/memory/references");
 }
 function parseTableTopLevelLabels(referencesDir) {
   const labels = /* @__PURE__ */ new Set();
@@ -20444,8 +20535,8 @@ var STRIPPED_PROPERTIES = /* @__PURE__ */ new Set([
   "otpCode",
   "cacheKey"
 ]);
-var app24 = new Hono();
-app24.get("/", requireAdminSession, async (c) => {
+var app25 = new Hono();
+app25.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -21116,12 +21207,12 @@ function pruneNode(node, warnedClasses, conversationWarnings) {
   }
   return trashed ? { id: node.id, labels, properties, trashed: true } : { id: node.id, labels, properties };
 }
-var graph_subgraph_default = app24;
+var graph_subgraph_default = app25;
 
 // server/routes/admin/graph-delete.ts
 var ALLOWED_BY = ["graph-page", "graph-drag-trash", "graph-side-panel-trash"];
-var app25 = new Hono();
-app25.post("/", requireAdminSession, async (c) => {
+var app26 = new Hono();
+app26.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -21283,11 +21374,11 @@ app25.post("/", requireAdminSession, async (c) => {
     }
   }
 });
-var graph_delete_default = app25;
+var graph_delete_default = app26;
 
 // server/routes/admin/graph-restore.ts
-var app26 = new Hono();
-app26.post("/", requireAdminSession, async (c) => {
+var app27 = new Hono();
+app27.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -21351,11 +21442,11 @@ app26.post("/", requireAdminSession, async (c) => {
     }
   }
 });
-var graph_restore_default = app26;
+var graph_restore_default = app27;
 
 // server/routes/admin/graph-labels-in-graph.ts
-var app27 = new Hono();
-app27.get("/", requireAdminSession, async (c) => {
+var app28 = new Hono();
+app28.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -21421,11 +21512,11 @@ var LABELS_IN_GRAPH_CYPHER = `
        sum(halfEdges) AS relDegree
   RETURN label, nodeCount, relDegree
 `;
-var graph_labels_in_graph_default = app27;
+var graph_labels_in_graph_default = app28;
 
 // server/routes/admin/graph-default-view.ts
-var app28 = new Hono();
-app28.get("/", requireAdminSession, async (c) => {
+var app29 = new Hono();
+app29.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   const userId = getUserIdForSession(cacheKey);
@@ -21463,7 +21554,7 @@ app28.get("/", requireAdminSession, async (c) => {
     }
   }
 });
-app28.put("/", requireAdminSession, async (c) => {
+app29.put("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   const userId = getUserIdForSession(cacheKey);
@@ -21552,20 +21643,20 @@ var WRITE_CYPHER = `
       p.updatedAt = $updatedAt
   RETURN p.labels AS labels
 `;
-var graph_default_view_default = app28;
+var graph_default_view_default = app29;
 
 // server/routes/admin/sidebar-artefacts.ts
 import { readdir as readdir5, stat as stat7 } from "fs/promises";
-import { resolve as resolve27, relative as relative6, isAbsolute as isAbsolute2, sep as sep8, basename as basename11 } from "path";
-import { existsSync as existsSync33 } from "fs";
+import { resolve as resolve28, relative as relative6, isAbsolute as isAbsolute2, sep as sep9, basename as basename12 } from "path";
+import { existsSync as existsSync35 } from "fs";
 var LIMIT = 50;
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
 function toDataRootRelPath(absPath) {
-  if (absPath !== DATA_ROOT && !absPath.startsWith(DATA_ROOT + sep8)) return null;
+  if (absPath !== DATA_ROOT && !absPath.startsWith(DATA_ROOT + sep9)) return null;
   return relative6(DATA_ROOT, absPath);
 }
-var app29 = new Hono();
-app29.get("/", requireAdminSession, async (c) => {
+var app30 = new Hono();
+app30.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -21576,7 +21667,7 @@ app29.get("/", requireAdminSession, async (c) => {
   if (accountFiles === null) {
     return c.json({ error: "Failed to load artefacts" }, 500);
   }
-  const accountDir = resolve27(ACCOUNTS_DIR, accountId);
+  const accountDir = resolve28(ACCOUNTS_DIR, accountId);
   const agents = await fetchAgentTemplateRows(accountDir);
   const artefacts = [...accountFiles, ...agents].sort(
     (a, b) => (b.updatedAt ?? "").localeCompare(a.updatedAt ?? "")
@@ -21609,7 +21700,7 @@ async function fetchAccountFileArtefacts(accountId) {
       const modifiedAt = r.get("modifiedAt") ?? "";
       return {
         id: `account-file:${relativePath}`,
-        name: displayName ?? basename11(relativePath),
+        name: displayName ?? basename12(relativePath),
         kind: "account-file",
         updatedAt: modifiedAt,
         mimeType,
@@ -21628,8 +21719,8 @@ async function fetchAccountFileArtefacts(accountId) {
 async function fetchAgentTemplateRows(accountDir) {
   const rows = [];
   for (const filename of ADMIN_AGENT_FILES) {
-    const overridePath = resolve27(accountDir, "agents", "admin", filename);
-    const bundledPath = resolve27(PLATFORM_ROOT, "templates", "agents", "admin", filename);
+    const overridePath = resolve28(accountDir, "agents", "admin", filename);
+    const bundledPath = resolve28(PLATFORM_ROOT, "templates", "agents", "admin", filename);
     const labelStem = filename.replace(/\.md$/, "");
     const row = await readAgentTemplateRow({
       id: `agent-template:admin:${filename}`,
@@ -21642,12 +21733,12 @@ async function fetchAgentTemplateRows(accountDir) {
     });
     if (row) rows.push(row);
   }
-  const overrideDir = resolve27(accountDir, "specialists", "agents");
-  const bundledDir = resolve27(PLATFORM_ROOT, "templates", "specialists", "agents");
+  const overrideDir = resolve28(accountDir, "specialists", "agents");
+  const bundledDir = resolve28(PLATFORM_ROOT, "templates", "specialists", "agents");
   const specialistNames = await unionSpecialistFilenames(overrideDir, bundledDir);
   for (const filename of specialistNames) {
-    const overridePath = resolve27(overrideDir, filename);
-    const bundledPath = resolve27(bundledDir, filename);
+    const overridePath = resolve28(overrideDir, filename);
+    const bundledPath = resolve28(bundledDir, filename);
     const row = await readAgentTemplateRow({
       id: `agent-template:specialist:${filename}`,
       displayName: filename.replace(/\.md$/, ""),
@@ -21664,7 +21755,7 @@ async function fetchAgentTemplateRows(accountDir) {
 async function unionSpecialistFilenames(overrideDir, bundledDir) {
   const names = /* @__PURE__ */ new Set();
   for (const dir of [overrideDir, bundledDir]) {
-    if (!existsSync33(dir)) continue;
+    if (!existsSync35(dir)) continue;
     try {
       const entries = await readdir5(dir);
       for (const entry of entries) {
@@ -21679,7 +21770,7 @@ async function unionSpecialistFilenames(overrideDir, bundledDir) {
 }
 async function readAgentTemplateRow(inp) {
   let chosenPath = null;
-  if (existsSync33(inp.overridePath)) {
+  if (existsSync35(inp.overridePath)) {
     try {
       validateFilePathInAccount(inp.overridePath, inp.overrideRoot);
       chosenPath = inp.overridePath;
@@ -21690,7 +21781,7 @@ async function readAgentTemplateRow(inp) {
       );
       return null;
     }
-  } else if (existsSync33(inp.bundledPath)) {
+  } else if (existsSync35(inp.bundledPath)) {
     if (!isWithin(inp.bundledPath, inp.bundledRoot)) {
       console.error(
         `[admin/sidebar-artefacts] agent-template-read-failed agent=${inp.displayName} kind=${inp.logName} error="bundled path outside PLATFORM_ROOT"`
@@ -21729,7 +21820,7 @@ function isWithin(target, root) {
   const rel = relative6(root, target);
   return !rel.startsWith("..") && !isAbsolute2(rel);
 }
-var sidebar_artefacts_default = app29;
+var sidebar_artefacts_default = app30;
 
 // server/channel-session-override.ts
 import { readFileSync as readFileSync36, writeFileSync as writeFileSync13, renameSync as renameSync9 } from "fs";
@@ -21802,8 +21893,8 @@ function clearForwardPointers(sessionId) {
 }
 
 // server/routes/admin/session-delete.ts
-var app30 = new Hono();
-app30.post("/", requireAdminSession, async (c) => {
+var app31 = new Hono();
+app31.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -21842,11 +21933,11 @@ app30.post("/", requireAdminSession, async (c) => {
   console.error(`[session-delete] sessionId=${sessionId} delete-status=${del.status}`);
   return c.json({ error: `manager-status-${del.status}` }, 502);
 });
-var session_delete_default = app30;
+var session_delete_default = app31;
 
 // server/routes/admin/session-stop.ts
-var app31 = new Hono();
-app31.post("/", requireAdminSession, async (c) => {
+var app32 = new Hono();
+app32.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -21871,11 +21962,11 @@ app31.post("/", requireAdminSession, async (c) => {
   console.error(`[session-stop] sessionId=${sessionId} manager-status=${res.status}`);
   return c.json({ error: `manager-status-${res.status}` }, 502);
 });
-var session_stop_default = app31;
+var session_stop_default = app32;
 
 // server/routes/admin/session-archive.ts
-var app32 = new Hono();
-app32.post("/", requireAdminSession, async (c) => {
+var app33 = new Hono();
+app33.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -21924,11 +22015,11 @@ app32.post("/", requireAdminSession, async (c) => {
   console.error(`[session-archive] sessionId=${sessionId.slice(0, 8)} manager-status=${res.status}`);
   return c.json({ error: `manager-status-${res.status}` }, 502);
 });
-var session_archive_default = app32;
+var session_archive_default = app33;
 
 // server/routes/admin/session-rename.ts
-var app33 = new Hono();
-app33.post("/", requireAdminSession, async (c) => {
+var app34 = new Hono();
+app34.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -21967,11 +22058,11 @@ app33.post("/", requireAdminSession, async (c) => {
   console.error(`[session-rename] sessionId=${sessionId.slice(0, 8)} manager-status=${res.status}`);
   return c.json({ error: `manager-status-${res.status}` }, 502);
 });
-var session_rename_default = app33;
+var session_rename_default = app34;
 
 // server/routes/admin/session-usage.ts
-var app34 = new Hono();
-app34.get("/", requireAdminSession, async (c) => {
+var app35 = new Hono();
+app35.get("/", requireAdminSession, async (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
   if (!SESSION_ID_RE2.test(sessionId)) {
     return c.json({ error: "sessionId must be a v4 UUID" }, 400);
@@ -21997,7 +22088,7 @@ app34.get("/", requireAdminSession, async (c) => {
   console.error(`[session-usage] sessionId=${sessionId.slice(0, 8)} manager-status=${res.status}`);
   return c.json({ error: `manager-status-${res.status}` }, 502);
 });
-var session_usage_default = app34;
+var session_usage_default = app35;
 
 // server/routes/admin/session-rc-spawn.ts
 import { randomUUID as randomUUID11 } from "crypto";
@@ -22044,8 +22135,8 @@ function shapeWebchatResponse(sessionId, manager) {
   const landed = redirected ? manager.sessionId : sessionId;
   return { sessionId: landed, outcome, target: `/chat?session=${landed}` };
 }
-var app35 = new Hono();
-app35.post("/", requireAdminSession, async (c) => {
+var app36 = new Hono();
+app36.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -22127,30 +22218,30 @@ app35.post("/", requireAdminSession, async (c) => {
   }
   return c.json(parsed ?? {});
 });
-var session_rc_spawn_default = app35;
+var session_rc_spawn_default = app36;
 
 // server/routes/admin/session-reseat.ts
 import { randomUUID as randomUUID12 } from "crypto";
 
 // server/wa-descriptor.ts
-import { resolve as resolve28, join as join38 } from "path";
+import { resolve as resolve29, join as join38 } from "path";
 function waGatewayUrl() {
   return `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`;
 }
 function waServerPath() {
-  return process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve28(process.env.MAXY_PLATFORM_ROOT ?? join38(__dirname, ".."), "services/whatsapp-channel/dist/server.js");
+  return process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve29(process.env.MAXY_PLATFORM_ROOT ?? join38(__dirname, ".."), "services/whatsapp-channel/dist/server.js");
 }
 function waChannelDescriptor(senderId) {
   return { senderId, gatewayUrl: waGatewayUrl(), serverPath: waServerPath() };
 }
 
 // server/telegram-descriptor.ts
-import { resolve as resolve29, join as join39 } from "path";
+import { resolve as resolve30, join as join39 } from "path";
 function telegramGatewayUrl() {
   return `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`;
 }
 function telegramServerPath() {
-  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve29(process.env.MAXY_PLATFORM_ROOT ?? join39(__dirname, ".."), "services/telegram-channel/dist/server.js");
+  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve30(process.env.MAXY_PLATFORM_ROOT ?? join39(__dirname, ".."), "services/telegram-channel/dist/server.js");
 }
 function telegramChannelDescriptor(senderId) {
   return { senderId, gatewayUrl: telegramGatewayUrl(), serverPath: telegramServerPath() };
@@ -22193,9 +22284,9 @@ function resolveReseatPlan(body, mintId = randomUUID12, adminUserId, authenticat
   if (authenticatedName) payload.authenticatedName = authenticatedName;
   return { sessionId, payload };
 }
-var app36 = new Hono();
+var app37 = new Hono();
 var reseatsInFlight = /* @__PURE__ */ new Set();
-app36.post("/", requireAdminSession, async (c) => {
+app37.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -22310,10 +22401,10 @@ app36.post("/", requireAdminSession, async (c) => {
     reseatsInFlight.delete(fromSessionId);
   }
 });
-var session_reseat_default = app36;
+var session_reseat_default = app37;
 
 // server/routes/admin/system-stats.ts
-import { readFile as readFile7 } from "fs/promises";
+import { readFile as readFile8 } from "fs/promises";
 import { cpus, loadavg, totalmem, freemem } from "os";
 function parseCpuStat(blob) {
   const line = blob.split("\n", 1)[0] ?? "";
@@ -22357,11 +22448,11 @@ function parseMeminfo(blob) {
 }
 var SAMPLE_DELAY_MS = 100;
 async function sampleLinux() {
-  const a = parseCpuStat(await readFile7("/proc/stat", "utf-8"));
+  const a = parseCpuStat(await readFile8("/proc/stat", "utf-8"));
   await new Promise((r) => setTimeout(r, SAMPLE_DELAY_MS));
-  const b = parseCpuStat(await readFile7("/proc/stat", "utf-8"));
-  const meminfo = parseMeminfo(await readFile7("/proc/meminfo", "utf-8"));
-  const loadavgRaw = (await readFile7("/proc/loadavg", "utf-8")).trim();
+  const b = parseCpuStat(await readFile8("/proc/stat", "utf-8"));
+  const meminfo = parseMeminfo(await readFile8("/proc/meminfo", "utf-8"));
+  const loadavgRaw = (await readFile8("/proc/loadavg", "utf-8")).trim();
   const [l1, l5, l15] = loadavgRaw.split(/\s+/, 3).map(Number);
   if (![l1, l5, l15].every(Number.isFinite)) {
     throw new Error(`malformed /proc/loadavg: ${loadavgRaw}`);
@@ -22407,8 +22498,8 @@ async function sample() {
   if (process.platform === "linux") return sampleLinux();
   return sampleOsFallback();
 }
-var app37 = new Hono();
-app37.get("/", async (c) => {
+var app38 = new Hono();
+app38.get("/", async (c) => {
   const started = Date.now();
   if (!inflight) {
     inflight = sample().finally(() => {
@@ -22431,26 +22522,26 @@ app37.get("/", async (c) => {
     return c.json({ degraded: true, reason, sampledAtMs: Date.now() });
   }
 });
-var system_stats_default = app37;
+var system_stats_default = app38;
 
 // server/routes/admin/health.ts
-import { existsSync as existsSync34, readFileSync as readFileSync37 } from "fs";
-import { resolve as resolve30, join as join40 } from "path";
-var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve30(process.cwd(), "..");
+import { existsSync as existsSync36, readFileSync as readFileSync37 } from "fs";
+import { resolve as resolve31, join as join40 } from "path";
+var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve31(process.cwd(), "..");
 var brandHostname = "maxy";
 var brandJsonPath = join40(PLATFORM_ROOT6, "config", "brand.json");
-if (existsSync34(brandJsonPath)) {
+if (existsSync36(brandJsonPath)) {
   try {
     const brand = JSON.parse(readFileSync37(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
   } catch {
   }
 }
-var VERSION_FILE = resolve30(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
+var VERSION_FILE = resolve31(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
-  if (!existsSync34(VERSION_FILE)) return "unknown";
+  if (!existsSync36(VERSION_FILE)) return "unknown";
   return readFileSync37(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
@@ -22476,8 +22567,8 @@ async function probeConversationDb() {
     });
   }
 }
-var app38 = new Hono();
-app38.get("/", async (c) => {
+var app39 = new Hono();
+app39.get("/", async (c) => {
   const version = readVersion();
   const probe = await probeConversationDb();
   const uptimeMs = Date.now() - new Date(PROCESS_STARTED_AT).getTime();
@@ -22499,7 +22590,7 @@ app38.get("/", async (c) => {
     uptimeMs
   });
 });
-var health_default2 = app38;
+var health_default2 = app39;
 
 // server/routes/admin/linkedin-ingest.ts
 import { randomUUID as randomUUID13 } from "crypto";
@@ -22728,8 +22819,8 @@ function buildInitialMessage(env) {
   }
   return header;
 }
-var app39 = new Hono();
-app39.post("/", requireAdminSession, async (c) => {
+var app40 = new Hono();
+app40.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -22774,7 +22865,7 @@ app39.post("/", requireAdminSession, async (c) => {
   );
   return c.json({ ok: true, dispatchId: envelope.dispatchId, taskId: spawned.sessionId }, 202);
 });
-var linkedin_ingest_default = app39;
+var linkedin_ingest_default = app40;
 
 // server/routes/admin/post-turn-context.ts
 import neo4j3 from "neo4j-driver";
@@ -22816,8 +22907,8 @@ function pruneProperties(raw) {
   }
   return out;
 }
-var app40 = new Hono();
-app40.get("/", async (c) => {
+var app41 = new Hono();
+app41.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr3(remoteAddr)) {
     console.error(`${TAG34} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -22877,7 +22968,7 @@ app40.get("/", async (c) => {
     await session.close();
   }
 });
-var post_turn_context_default = app40;
+var post_turn_context_default = app41;
 
 // app/lib/slice-writes.ts
 import neo4j4 from "neo4j-driver";
@@ -22987,8 +23078,8 @@ var TAG35 = "[public-session-context]";
 function isLoopbackAddr4(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-var app41 = new Hono();
-app41.get("/", async (c) => {
+var app42 = new Hono();
+app42.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr4(remoteAddr)) {
     console.error(`${TAG35} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -23028,7 +23119,7 @@ app41.get("/", async (c) => {
     await session.close();
   }
 });
-var public_session_context_default = app41;
+var public_session_context_default = app42;
 
 // app/lib/webchat/gateway/instance.ts
 var instance2 = null;
@@ -23044,8 +23135,8 @@ var TAG36 = "[public-session-exit-route]";
 function isLoopbackAddr5(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-var app42 = new Hono();
-app42.post("/", async (c) => {
+var app43 = new Hono();
+app43.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr5(remoteAddr)) {
     console.error(`${TAG36} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -23077,15 +23168,15 @@ app42.post("/", async (c) => {
   gateway.handlePublicSessionExit(sessionId);
   return c.json({ ok: true });
 });
-var public_session_exit_default = app42;
+var public_session_exit_default = app43;
 
 // server/routes/admin/access-session-evict.ts
 var TAG37 = "[access-session-evict]";
 function isLoopbackAddr6(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-var app43 = new Hono();
-app43.post("/", async (c) => {
+var app44 = new Hono();
+app44.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr6(remoteAddr)) {
     console.error(`${TAG37} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -23113,7 +23204,7 @@ app43.post("/", async (c) => {
   console.log(`${TAG37} grantId=${grantId} dropped=${dropped}`);
   return c.json({ ok: true, dropped });
 });
-var access_session_evict_default = app43;
+var access_session_evict_default = app44;
 
 // server/routes/admin/enrol-person.ts
 var TAG38 = "[enrol]";
@@ -23121,8 +23212,8 @@ function isLoopbackAddr7(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
 var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-var app44 = new Hono();
-app44.post("/", async (c) => {
+var app45 = new Hono();
+app45.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr7(remoteAddr)) {
     console.error(`${TAG38} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -23185,11 +23276,11 @@ app44.post("/", async (c) => {
   );
   return c.json({ personId, grant }, 200);
 });
-var enrol_person_default = app44;
+var enrol_person_default = app45;
 
 // server/routes/admin/browser.ts
-var app45 = new Hono();
-app45.post("/launch", requireAdminSession, async (c) => {
+var app46 = new Hono();
+app46.post("/launch", requireAdminSession, async (c) => {
   try {
     if (process.platform !== "linux") {
       console.error("[admin/browser/launch] op=skipped platform=darwin reason=no-display-stack");
@@ -23224,10 +23315,10 @@ app45.post("/launch", requireAdminSession, async (c) => {
     );
   }
 });
-var browser_default = app45;
+var browser_default = app46;
 
 // server/routes/admin/calendar.ts
-import { existsSync as existsSync35 } from "fs";
+import { existsSync as existsSync37 } from "fs";
 import { join as join42 } from "path";
 
 // server/lib/calendar-ics.ts
@@ -23370,7 +23461,7 @@ function readAvailabilityConfig(accountDir) {
 }
 
 // server/routes/admin/calendar.ts
-var app46 = new Hono();
+var app47 = new Hono();
 function normalizeAttendees(raw) {
   if (!Array.isArray(raw)) return [];
   return raw.map((a) => {
@@ -23401,7 +23492,7 @@ function mapMeeting(r) {
     privateNote: r.get("privateNote")
   };
 }
-app46.get("/meetings", requireAdminSession, async (c) => {
+app47.get("/meetings", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -23464,7 +23555,7 @@ function icsFilename(title) {
   const slug = (title ?? "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60);
   return `${slug || "meeting"}.ics`;
 }
-app46.get("/meetings/:id/ics", requireAdminSession, async (c) => {
+app47.get("/meetings/:id/ics", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -23522,7 +23613,7 @@ app46.get("/meetings/:id/ics", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-app46.patch("/meetings/:id", requireAdminSession, async (c) => {
+app47.patch("/meetings/:id", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -23566,7 +23657,7 @@ app46.patch("/meetings/:id", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-app46.post("/meetings/:id/attendees", requireAdminSession, async (c) => {
+app47.post("/meetings/:id/attendees", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -23616,7 +23707,7 @@ app46.post("/meetings/:id/attendees", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-app46.delete("/meetings/:id/attendees", requireAdminSession, async (c) => {
+app47.delete("/meetings/:id/attendees", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -23662,7 +23753,7 @@ app46.delete("/meetings/:id/attendees", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-app46.delete("/meetings/:id", requireAdminSession, async (c) => {
+app47.delete("/meetings/:id", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -23692,14 +23783,14 @@ app46.delete("/meetings/:id", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-app46.get("/booking-link", requireAdminSession, (c) => {
+app47.get("/booking-link", requireAdminSession, (c) => {
   try {
     const account = resolveAccount();
     if (!account) {
       console.error('[calendar] op=booking-link-fail err="no account configured"');
       return c.json({ bookingDomain: null });
     }
-    if (!existsSync35(join42(account.accountDir, AVAILABILITY_FILENAME))) {
+    if (!existsSync37(join42(account.accountDir, AVAILABILITY_FILENAME))) {
       console.log("[calendar] op=booking-link bookingDomain=none source=availability-config");
       return c.json({ bookingDomain: null });
     }
@@ -23715,12 +23806,12 @@ app46.get("/booking-link", requireAdminSession, (c) => {
     return c.json({ bookingDomain: null });
   }
 });
-var calendar_default = app46;
+var calendar_default = app47;
 
 // server/routes/admin/routines.ts
 import cronParser from "cron-parser";
 var { parseExpression } = cronParser;
-var app47 = new Hono();
+var app48 = new Hono();
 var AUTOMATION_WHERE = "(e.recurrence IS NOT NULL OR e.agentChannel IS NOT NULL OR e.actionPlugin IS NOT NULL)";
 var ROUTINE_COLS = `e.eventId AS eventId, e.name AS name, e.eventStatus AS eventStatus,
   e.recurrence AS recurrence, e.nextRun AS nextRun, e.lastTriggered AS lastTriggered,
@@ -23750,7 +23841,7 @@ function mapRoutine(r) {
     lastDispatchAt: g("lastDispatchAt")
   };
 }
-app47.get("/", requireAdminSession, async (c) => {
+app48.get("/", requireAdminSession, async (c) => {
   const accountId = getAccountIdForSession(c.var.cacheKey);
   if (!accountId) {
     console.error('[admin:routines] op=list auth-rejected reason="no account for session"');
@@ -23776,7 +23867,7 @@ app47.get("/", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-app47.get("/:eventId", requireAdminSession, async (c) => {
+app48.get("/:eventId", requireAdminSession, async (c) => {
   const accountId = getAccountIdForSession(c.var.cacheKey);
   if (!accountId) return c.json({ error: "Account not found for session" }, 401);
   const eventId = c.req.param("eventId");
@@ -23800,7 +23891,7 @@ app47.get("/:eventId", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-app47.patch("/:eventId", requireAdminSession, async (c) => {
+app48.patch("/:eventId", requireAdminSession, async (c) => {
   const accountId = getAccountIdForSession(c.var.cacheKey);
   if (!accountId) return c.json({ error: "Account not found for session" }, 401);
   const eventId = c.req.param("eventId");
@@ -23870,7 +23961,7 @@ app47.patch("/:eventId", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-app47.delete("/:eventId", requireAdminSession, async (c) => {
+app48.delete("/:eventId", requireAdminSession, async (c) => {
   const accountId = getAccountIdForSession(c.var.cacheKey);
   if (!accountId) {
     console.error('[admin:routines] op=delete auth-rejected reason="no account for session"');
@@ -23898,12 +23989,12 @@ app47.delete("/:eventId", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-var routines_default = app47;
+var routines_default = app48;
 
 // server/routes/admin/skills.ts
-import { existsSync as existsSync36, readdirSync as readdirSync24, readFileSync as readFileSync39, rmSync as rmSync3 } from "fs";
-import { resolve as resolve31 } from "path";
-var app48 = new Hono();
+import { existsSync as existsSync38, readdirSync as readdirSync24, readFileSync as readFileSync39, rmSync as rmSync3 } from "fs";
+import { resolve as resolve32 } from "path";
+var app49 = new Hono();
 var NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
 function splitSkillMd(text) {
   const m = text.match(/^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/);
@@ -23931,32 +24022,32 @@ function accountDirForSession(cacheKey) {
   return match ? { accountId, accountDir: match.accountDir } : null;
 }
 function subdirs(dir) {
-  if (!existsSync36(dir)) return [];
+  if (!existsSync38(dir)) return [];
   try {
     return readdirSync24(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
     return [];
   }
 }
-app48.get("/", requireAdminSession, async (c) => {
+app49.get("/", requireAdminSession, async (c) => {
   const acct = accountDirForSession(c.var.cacheKey);
   if (!acct) {
     console.error('[admin:skills] op=list auth-rejected reason="no account for session"');
     return c.json({ error: "Account not found for session" }, 401);
   }
-  const pluginsDir = resolve31(acct.accountDir, "plugins");
+  const pluginsDir = resolve32(acct.accountDir, "plugins");
   const skills = [];
   let pluginCount = 0;
   for (const plugin of subdirs(pluginsDir)) {
     pluginCount++;
-    const skillsDir = resolve31(pluginsDir, plugin, "skills");
+    const skillsDir = resolve32(pluginsDir, plugin, "skills");
     for (const skill of subdirs(skillsDir)) {
-      const skillMd = resolve31(skillsDir, skill, "SKILL.md");
-      if (!existsSync36(skillMd)) continue;
+      const skillMd = resolve32(skillsDir, skill, "SKILL.md");
+      if (!existsSync38(skillMd)) continue;
       try {
         const { frontmatter } = splitSkillMd(readFileSync39(skillMd, "utf-8"));
-        const refsDir = resolve31(skillsDir, skill, "references");
-        const refCount = existsSync36(refsDir) ? readdirSync24(refsDir, { withFileTypes: true }).filter((e) => e.isFile()).length : 0;
+        const refsDir = resolve32(skillsDir, skill, "references");
+        const refCount = existsSync38(refsDir) ? readdirSync24(refsDir, { withFileTypes: true }).filter((e) => e.isFile()).length : 0;
         skills.push({ plugin, skill, description: frontmatter.description, refCount });
       } catch (err) {
         console.error(`[admin:skills] op=list-skip plugin=${plugin} skill=${skill} reason="${err instanceof Error ? err.message : String(err)}"`);
@@ -23967,7 +24058,7 @@ app48.get("/", requireAdminSession, async (c) => {
   console.log(`[admin:skills] op=list accountId=${acct.accountId.slice(0, 8)} plugins=${pluginCount} skills=${skills.length}`);
   return c.json({ skills });
 });
-app48.get("/:plugin/:skill", requireAdminSession, async (c) => {
+app49.get("/:plugin/:skill", requireAdminSession, async (c) => {
   const acct = accountDirForSession(c.var.cacheKey);
   if (!acct) return c.json({ error: "Account not found for session" }, 401);
   const plugin = c.req.param("plugin");
@@ -23976,15 +24067,15 @@ app48.get("/:plugin/:skill", requireAdminSession, async (c) => {
     console.error(`[admin:skills] op=get outcome=rejected reason=invalid-name plugin="${plugin}" skill="${skill}"`);
     return c.json({ error: "Invalid plugin or skill name" }, 400);
   }
-  const skillDir = resolve31(acct.accountDir, "plugins", plugin, "skills", skill);
-  const skillMd = resolve31(skillDir, "SKILL.md");
-  const found = existsSync36(skillMd);
+  const skillDir = resolve32(acct.accountDir, "plugins", plugin, "skills", skill);
+  const skillMd = resolve32(skillDir, "SKILL.md");
+  const found = existsSync38(skillMd);
   console.log(`[admin:skills] op=get plugin=${plugin} skill=${skill} found=${found}`);
   if (!found) return c.json({ error: "Skill not found" }, 404);
   try {
     const { frontmatter, body } = splitSkillMd(readFileSync39(skillMd, "utf-8"));
-    const refsDir = resolve31(skillDir, "references");
-    const references = existsSync36(refsDir) ? readdirSync24(refsDir, { withFileTypes: true }).filter((e) => e.isFile()).map((e) => e.name).sort() : [];
+    const refsDir = resolve32(skillDir, "references");
+    const references = existsSync38(refsDir) ? readdirSync24(refsDir, { withFileTypes: true }).filter((e) => e.isFile()).map((e) => e.name).sort() : [];
     return c.json({ skill: { plugin, skill, frontmatter, body, references } });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -23992,7 +24083,7 @@ app48.get("/:plugin/:skill", requireAdminSession, async (c) => {
     return c.json({ error: `Skill unavailable: ${message}` }, 503);
   }
 });
-app48.delete("/:plugin/:skill", requireAdminSession, async (c) => {
+app49.delete("/:plugin/:skill", requireAdminSession, async (c) => {
   const acct = accountDirForSession(c.var.cacheKey);
   if (!acct) return c.json({ error: "Account not found for session" }, 401);
   const plugin = c.req.param("plugin");
@@ -24001,10 +24092,10 @@ app48.delete("/:plugin/:skill", requireAdminSession, async (c) => {
     console.error(`[admin:skills] op=delete outcome=rejected reason=invalid-name plugin="${plugin}" skill="${skill}"`);
     return c.json({ error: "Invalid plugin or skill name" }, 400);
   }
-  const pluginDir = resolve31(acct.accountDir, "plugins", plugin);
-  const skillsDir = resolve31(pluginDir, "skills");
-  const skillDir = resolve31(skillsDir, skill);
-  if (!existsSync36(resolve31(skillDir, "SKILL.md"))) {
+  const pluginDir = resolve32(acct.accountDir, "plugins", plugin);
+  const skillsDir = resolve32(pluginDir, "skills");
+  const skillDir = resolve32(skillsDir, skill);
+  if (!existsSync38(resolve32(skillDir, "SKILL.md"))) {
     console.error(`[admin:skills] op=delete outcome=rejected reason=not-found plugin=${plugin} skill=${skill}`);
     return c.json({ error: "Skill not found" }, 404);
   }
@@ -24012,7 +24103,7 @@ app48.delete("/:plugin/:skill", requireAdminSession, async (c) => {
     rmSync3(skillDir, { recursive: true, force: true });
     const pluginDirRemoved = subdirs(skillsDir).length === 0;
     if (pluginDirRemoved) rmSync3(pluginDir, { recursive: true, force: true });
-    const skillDirGone = !existsSync36(skillDir);
+    const skillDirGone = !existsSync38(skillDir);
     if (!skillDirGone) {
       console.error(`[admin:skills] op=delete plugin=${plugin} skill=${skill} outcome=rejected reason=rm-incomplete skillDirGone=false`);
       return c.json({ error: "Delete did not remove the skill directory" }, 503);
@@ -24025,7 +24116,7 @@ app48.delete("/:plugin/:skill", requireAdminSession, async (c) => {
     return c.json({ error: `Delete failed: ${message}` }, 503);
   }
 });
-var skills_default = app48;
+var skills_default = app49;
 
 // app/lib/time-entry-format.ts
 function secondsBetween(startIso, endIso) {
@@ -24048,8 +24139,8 @@ function toNum(v) {
 var TAG39 = "[task-timer]";
 var COMPLETED = /* @__PURE__ */ new Set(["completed"]);
 var HIDDEN_FROM_OPEN = /* @__PURE__ */ new Set(["completed", "cancelled"]);
-var app49 = new Hono();
-app49.get("/", requireAdminSession, async (c) => {
+var app50 = new Hono();
+app50.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -24136,13 +24227,13 @@ app49.get("/", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-var tasks_list_default = app49;
+var tasks_list_default = app50;
 
 // server/routes/admin/task-timer-start.ts
 import { randomUUID as randomUUID14 } from "crypto";
 var TAG40 = "[task-timer]";
-var app50 = new Hono();
-app50.post("/", requireAdminSession, async (c) => {
+var app51 = new Hono();
+app51.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) return c.json({ error: "Account not found for session" }, 401);
@@ -24197,13 +24288,13 @@ app50.post("/", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-var task_timer_start_default = app50;
+var task_timer_start_default = app51;
 
 // server/routes/admin/task-timer-stop.ts
 import neo4j5 from "neo4j-driver";
 var TAG41 = "[task-timer]";
-var app51 = new Hono();
-app51.post("/", requireAdminSession, async (c) => {
+var app52 = new Hono();
+app52.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) return c.json({ error: "Account not found for session" }, 401);
@@ -24270,12 +24361,12 @@ app51.post("/", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-var task_timer_stop_default = app51;
+var task_timer_stop_default = app52;
 
 // server/routes/admin/task-complete.ts
 var TAG42 = "[task-timer]";
-var app52 = new Hono();
-app52.post("/", requireAdminSession, async (c) => {
+var app53 = new Hono();
+app53.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) return c.json({ error: "Account not found for session" }, 401);
@@ -24313,14 +24404,14 @@ app52.post("/", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-var task_complete_default = app52;
+var task_complete_default = app53;
 
 // server/routes/admin/task-time-adjust.ts
 import { randomUUID as randomUUID15 } from "crypto";
 import neo4j6 from "neo4j-driver";
 var TAG43 = "[task-time-adjust]";
-var app53 = new Hono();
-app53.post("/", requireAdminSession, async (c) => {
+var app54 = new Hono();
+app54.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) return c.json({ error: "Account not found for session" }, 401);
@@ -24394,11 +24485,11 @@ app53.post("/", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-var task_time_adjust_default = app53;
+var task_time_adjust_default = app54;
 
 // server/routes/admin/activity.ts
 import { readdirSync as readdirSync25 } from "fs";
-var app54 = new Hono();
+var app55 = new Hono();
 var TAG44 = "[activity]";
 function resolveHouseAccountId(accounts) {
   const houses = accounts.filter((a) => a.config.role === "house");
@@ -24420,7 +24511,7 @@ function countAccountDirsOnDisk() {
     return null;
   }
 }
-app54.get("/", requireAdminSession, async (c) => {
+app55.get("/", requireAdminSession, async (c) => {
   const req = requestToken();
   const cacheKey = c.var.cacheKey;
   const caller2 = getAccountIdForSession(cacheKey) ?? null;
@@ -24529,62 +24620,63 @@ app54.get("/", requireAdminSession, async (c) => {
     }
   });
 });
-var activity_default = app54;
+var activity_default = app55;
 
 // server/routes/admin/index.ts
-var app55 = new Hono();
-app55.route("/session", session_default);
-app55.route("/accounts", accounts_default);
-app55.route("/logs", logs_default);
-app55.route("/claude-info", claude_info_default);
-app55.route("/attachment", attachment_default);
-app55.route("/agents", agents_default);
-app55.route("/sessions", sessions_default);
-app55.route("/claude-sessions", claude_sessions_default);
-app55.route("/log-ingest", log_ingest_default);
-app55.route("/events", events_default);
-app55.route("/files", files_default);
-app55.route("/graph-search", graph_search_default);
-app55.route("/graph-subgraph", graph_subgraph_default);
-app55.route("/graph-delete", graph_delete_default);
-app55.route("/graph-restore", graph_restore_default);
-app55.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app55.route("/graph-default-view", graph_default_view_default);
-app55.route("/sidebar-artefacts", sidebar_artefacts_default);
-app55.route("/sidebar-sessions", sidebar_sessions_default);
-app55.route("/session-delete", session_delete_default);
-app55.route("/session-stop", session_stop_default);
-app55.route("/session-archive", session_archive_default);
-app55.route("/session-rename", session_rename_default);
-app55.route("/session-usage", session_usage_default);
-app55.route("/browser", browser_default);
-app55.route("/session-rc-spawn", session_rc_spawn_default);
-app55.route("/session-reseat", session_reseat_default);
-app55.route("/system-stats", system_stats_default);
-app55.route("/health-brand", health_default2);
-app55.route("/linkedin-ingest", linkedin_ingest_default);
-app55.route("/post-turn-context", post_turn_context_default);
-app55.route("/public-session-context", public_session_context_default);
-app55.route("/public-session-exit", public_session_exit_default);
-app55.route("/access-session-evict", access_session_evict_default);
-app55.route("/enrol-person", enrol_person_default);
-app55.route("/calendar", calendar_default);
-app55.route("/routines", routines_default);
-app55.route("/skills", skills_default);
-app55.route("/tasks-list", tasks_list_default);
-app55.route("/task-timer-start", task_timer_start_default);
-app55.route("/task-timer-stop", task_timer_stop_default);
-app55.route("/task-complete", task_complete_default);
-app55.route("/task-time-adjust", task_time_adjust_default);
-app55.route("/activity", activity_default);
-var admin_default = app55;
+var app56 = new Hono();
+app56.route("/session", session_default);
+app56.route("/accounts", accounts_default);
+app56.route("/logs", logs_default);
+app56.route("/claude-info", claude_info_default);
+app56.route("/attachment", attachment_default);
+app56.route("/session-upload", session_upload_default);
+app56.route("/agents", agents_default);
+app56.route("/sessions", sessions_default);
+app56.route("/claude-sessions", claude_sessions_default);
+app56.route("/log-ingest", log_ingest_default);
+app56.route("/events", events_default);
+app56.route("/files", files_default);
+app56.route("/graph-search", graph_search_default);
+app56.route("/graph-subgraph", graph_subgraph_default);
+app56.route("/graph-delete", graph_delete_default);
+app56.route("/graph-restore", graph_restore_default);
+app56.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app56.route("/graph-default-view", graph_default_view_default);
+app56.route("/sidebar-artefacts", sidebar_artefacts_default);
+app56.route("/sidebar-sessions", sidebar_sessions_default);
+app56.route("/session-delete", session_delete_default);
+app56.route("/session-stop", session_stop_default);
+app56.route("/session-archive", session_archive_default);
+app56.route("/session-rename", session_rename_default);
+app56.route("/session-usage", session_usage_default);
+app56.route("/browser", browser_default);
+app56.route("/session-rc-spawn", session_rc_spawn_default);
+app56.route("/session-reseat", session_reseat_default);
+app56.route("/system-stats", system_stats_default);
+app56.route("/health-brand", health_default2);
+app56.route("/linkedin-ingest", linkedin_ingest_default);
+app56.route("/post-turn-context", post_turn_context_default);
+app56.route("/public-session-context", public_session_context_default);
+app56.route("/public-session-exit", public_session_exit_default);
+app56.route("/access-session-evict", access_session_evict_default);
+app56.route("/enrol-person", enrol_person_default);
+app56.route("/calendar", calendar_default);
+app56.route("/routines", routines_default);
+app56.route("/skills", skills_default);
+app56.route("/tasks-list", tasks_list_default);
+app56.route("/task-timer-start", task_timer_start_default);
+app56.route("/task-timer-stop", task_timer_stop_default);
+app56.route("/task-complete", task_complete_default);
+app56.route("/task-time-adjust", task_time_adjust_default);
+app56.route("/activity", activity_default);
+var admin_default = app56;
 
 // server/routes/access/verify-token.ts
 var TAG45 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
-var app56 = new Hono();
-app56.post("/", async (c) => {
+var app57 = new Hono();
+app57.post("/", async (c) => {
   const ip = c.var.clientIp || "unknown";
   let body;
   try {
@@ -24666,13 +24758,13 @@ app56.post("/", async (c) => {
     displayName: grant.displayName
   });
 });
-var verify_token_default = app56;
+var verify_token_default = app57;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
-import { resolve as resolve32 } from "path";
-var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve32(process.cwd(), "..");
-var SEND_SCRIPT = resolve32(
+import { resolve as resolve33 } from "path";
+var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve33(process.cwd(), "..");
+var SEND_SCRIPT = resolve33(
   PLATFORM_ROOT7,
   "plugins",
   "email",
@@ -24729,9 +24821,9 @@ async function sendMagicLinkEmail(payload) {
 
 // server/routes/access/request-magic-link.ts
 var TAG46 = "[access-request-link]";
-var app57 = new Hono();
+var app58 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
-app57.post("/", async (c) => {
+app58.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -24805,17 +24897,17 @@ app57.post("/", async (c) => {
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
-var request_magic_link_default = app57;
+var request_magic_link_default = app58;
 
 // server/routes/access/index.ts
-var app58 = new Hono();
-app58.route("/verify-token", verify_token_default);
-app58.route("/request-magic-link", request_magic_link_default);
-var access_default = app58;
+var app59 = new Hono();
+app59.route("/verify-token", verify_token_default);
+app59.route("/request-magic-link", request_magic_link_default);
+var access_default = app59;
 
 // server/routes/sites.ts
-import { existsSync as existsSync37, readFileSync as readFileSync40, realpathSync as realpathSync7, statSync as statSync15 } from "fs";
-import { resolve as resolve33 } from "path";
+import { existsSync as existsSync39, readFileSync as readFileSync40, realpathSync as realpathSync8, statSync as statSync17 } from "fs";
+import { resolve as resolve34 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
   ".html": "text/html; charset=utf-8",
@@ -24846,8 +24938,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app59 = new Hono();
-app59.get("/:rel{.*}", (c) => {
+var app60 = new Hono();
+app60.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -24872,15 +24964,15 @@ app59.get("/:rel{.*}", (c) => {
     }
     segments.push(seg);
   }
-  const rootDir = resolve33(account.accountDir, "sites");
-  let filePath = segments.length === 0 ? rootDir : resolve33(rootDir, ...segments);
+  const rootDir = resolve34(account.accountDir, "sites");
+  let filePath = segments.length === 0 ? rootDir : resolve34(rootDir, ...segments);
   if (filePath !== rootDir && !filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
   let stat11;
   try {
-    stat11 = existsSync37(filePath) ? statSync15(filePath) : null;
+    stat11 = existsSync39(filePath) ? statSync17(filePath) : null;
   } catch {
     stat11 = null;
   }
@@ -24893,21 +24985,21 @@ app59.get("/:rel{.*}", (c) => {
     return c.redirect(target, 301);
   }
   if (stat11?.isDirectory()) {
-    filePath = resolve33(filePath, "index.html");
+    filePath = resolve34(filePath, "index.html");
   }
   if (!filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync37(filePath)) {
+  if (!existsSync39(filePath)) {
     console.error(`[sites] not-found path=${reqPath} status=404`);
     return c.text("Not found", 404);
   }
   let realPath;
   let realRoot;
   try {
-    realPath = realpathSync7(filePath);
-    realRoot = realpathSync7(rootDir);
+    realPath = realpathSync8(filePath);
+    realRoot = realpathSync8(rootDir);
   } catch {
     console.error(`[sites] not-found path=${reqPath} status=404`);
     return c.text("Not found", 404);
@@ -24950,12 +25042,12 @@ app59.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app59;
+var sites_default = app60;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
 import { mkdirSync as mkdirSync8, readFileSync as readFileSync41, writeFileSync as writeFileSync14 } from "fs";
-import { dirname as dirname13 } from "path";
+import { dirname as dirname14 } from "path";
 var TOKEN_PREFIX = "v1.";
 var SECRET_BYTES = 32;
 var DEFAULT_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
@@ -24972,7 +25064,7 @@ function getSecret() {
   }
   const fresh = randomBytes(SECRET_BYTES).toString("hex");
   try {
-    mkdirSync8(dirname13(VISITOR_TOKEN_SECRET_FILE), { recursive: true, mode: 448 });
+    mkdirSync8(dirname14(VISITOR_TOKEN_SECRET_FILE), { recursive: true, mode: 448 });
     writeFileSync14(VISITOR_TOKEN_SECRET_FILE, fresh, { mode: 384, flag: "wx" });
     console.log(`[visitor-token] secret minted path=${VISITOR_TOKEN_SECRET_FILE}`);
   } catch {
@@ -25030,7 +25122,7 @@ var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync38, readFileSync as readFileSync42 } from "fs";
+import { existsSync as existsSync40, readFileSync as readFileSync42 } from "fs";
 import { join as join43 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
@@ -25040,7 +25132,7 @@ function readBrandConfig() {
   const platformRoot5 = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot5) return null;
   const brandPath = join43(platformRoot5, "config", "brand.json");
-  if (!existsSync38(brandPath)) return null;
+  if (!existsSync40(brandPath)) return null;
   try {
     cached2 = JSON.parse(readFileSync42(brandPath, "utf-8"));
     return cached2;
@@ -25050,7 +25142,7 @@ function readBrandConfig() {
 }
 
 // server/routes/visitor-consent.ts
-var app60 = new Hono();
+var app61 = new Hono();
 var CONSENT_COOKIE_NAME = "mxy_consent";
 var CONSENT_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
 var DEFAULT_CONSENT_COPY = {
@@ -25095,17 +25187,17 @@ function siteSlugFromReferer(referer) {
     return "";
   }
 }
-app60.options("/consent", (c) => {
+app61.options("/consent", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app60.options("/brand-config", (c) => {
+app61.options("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app60.post("/consent", async (c) => {
+app61.post("/consent", async (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   let raw;
@@ -25145,7 +25237,7 @@ app60.post("/consent", async (c) => {
   console.log(`[consent] ${parsed.decision} site=${site} brand=${brandName} tokenBound=${tokenBound}`);
   return c.body(null, 204);
 });
-app60.get("/brand-config", (c) => {
+app61.get("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   const brand = readBrandConfig();
@@ -25155,7 +25247,7 @@ app60.get("/brand-config", (c) => {
   c.header("Cache-Control", "public, max-age=300");
   return c.json({ consent: { copy, palette } });
 });
-var visitor_consent_default = app60;
+var visitor_consent_default = app61;
 
 // server/routes/listings.ts
 function getCookie(headerValue, name) {
@@ -25176,14 +25268,14 @@ function appendConsentParams(pageUrl, token) {
     const hashIdx = pageUrl.indexOf("#");
     const hash = hashIdx >= 0 ? pageUrl.slice(hashIdx) : "";
     const base = hashIdx >= 0 ? pageUrl.slice(0, hashIdx) : pageUrl;
-    const sep11 = base.indexOf("?") >= 0 ? "&" : "?";
-    return base + sep11 + `consent=needed&v=${encodeURIComponent(token)}` + hash;
+    const sep12 = base.indexOf("?") >= 0 ? "&" : "?";
+    return base + sep12 + `consent=needed&v=${encodeURIComponent(token)}` + hash;
   }
 }
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
 var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
-var app61 = new Hono();
-app61.get("/:slug/click", async (c) => {
+var app62 = new Hono();
+app62.get("/:slug/click", async (c) => {
   const slug = c.req.param("slug") ?? "";
   const rawSession = c.req.query("session") ?? "";
   const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
@@ -25247,10 +25339,10 @@ app61.get("/:slug/click", async (c) => {
   console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} consent=${consentCookie ?? "absent"} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
   return c.redirect(redirectUrl, 302);
 });
-var listings_default = app61;
+var listings_default = app62;
 
 // server/routes/visitor-event.ts
-var app62 = new Hono();
+var app63 = new Hono();
 var BOT_UA_RE = /\b(bot|crawl|spider|slurp|headlesschrome|phantomjs|googlebot|bingbot|yandex|baiduspider|ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)\b/i;
 var buckets = /* @__PURE__ */ new Map();
 var RATE_LIMIT = 60;
@@ -25326,12 +25418,12 @@ function originAllowed(origin, allowlist) {
     return false;
   }
 }
-app62.options("/event", (c) => {
+app63.options("/event", (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   return c.body(null, 204);
 });
-app62.post("/event", async (c) => {
+app63.post("/event", async (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   const ua = c.req.header("user-agent") ?? "";
@@ -25536,17 +25628,17 @@ async function writeEvent(opts) {
     );
   }
 }
-var visitor_event_default = app62;
+var visitor_event_default = app63;
 
 // server/routes/session.ts
-import { resolve as resolve34 } from "path";
-import { existsSync as existsSync39, writeFileSync as writeFileSync15, mkdirSync as mkdirSync9 } from "fs";
+import { resolve as resolve35 } from "path";
+import { existsSync as existsSync41, writeFileSync as writeFileSync15, mkdirSync as mkdirSync9 } from "fs";
 var UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function writeBrandingCache(accountId, agentSlug, branding) {
   try {
-    const cacheDir = resolve34(MAXY_DIR, "branding-cache", accountId);
+    const cacheDir = resolve35(MAXY_DIR, "branding-cache", accountId);
     mkdirSync9(cacheDir, { recursive: true });
-    writeFileSync15(resolve34(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
+    writeFileSync15(resolve35(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
   } catch (err) {
     console.error(`[branding] cache write failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -25582,8 +25674,8 @@ function withVisitorCookie(response, visitorId) {
     headers
   });
 }
-var app63 = new Hono();
-app63.post("/", async (c) => {
+var app64 = new Hono();
+app64.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -25623,8 +25715,8 @@ app63.post("/", async (c) => {
   }
   let agentConfig = null;
   if (account) {
-    const agentDir = resolve34(account.accountDir, "agents", agentSlug);
-    if (!existsSync39(agentDir) || !existsSync39(resolve34(agentDir, "config.json"))) {
+    const agentDir = resolve35(account.accountDir, "agents", agentSlug);
+    if (!existsSync41(agentDir) || !existsSync41(resolve35(agentDir, "config.json"))) {
       return c.json({ error: "Agent not found" }, 404);
     }
     agentConfig = resolveAgentConfig(account.accountDir, agentSlug);
@@ -25730,7 +25822,7 @@ app63.post("/", async (c) => {
     newVisitorId
   );
 });
-var session_default2 = app63;
+var session_default2 = app64;
 
 // server/lib/calendar-slots.ts
 var WEEKDAYS = ["sun", "mon", "tue", "wed", "thu", "fri", "sat"];
@@ -25813,17 +25905,17 @@ function computeOpenSlots(config, busy, fromISO, toISO) {
 }
 
 // server/routes/calendar-public.ts
-var app64 = new Hono();
+var app65 = new Hono();
 function setCors(c) {
   c.header("Access-Control-Allow-Origin", "*");
   c.header("Access-Control-Allow-Methods", "GET, OPTIONS");
   c.header("Access-Control-Allow-Headers", "content-type");
 }
-app64.options("/free-busy", (c) => {
+app65.options("/free-busy", (c) => {
   setCors(c);
   return c.body(null, 204);
 });
-app64.get("/free-busy", async (c) => {
+app65.get("/free-busy", async (c) => {
   setCors(c);
   const from = c.req.query("from");
   const to = c.req.query("to");
@@ -25879,14 +25971,14 @@ app64.get("/free-busy", async (c) => {
     await session.close();
   }
 });
-var calendar_public_default = app64;
+var calendar_public_default = app65;
 
 // server/routes/portal-fetch.ts
 import { createReadStream as createReadStream3 } from "fs";
-import { stat as stat8, readFile as readFile8, realpath } from "fs/promises";
-import { join as join44, resolve as resolve35, sep as sep9 } from "path";
+import { stat as stat8, readFile as readFile9, realpath } from "fs/promises";
+import { join as join44, resolve as resolve36, sep as sep10 } from "path";
 import { Readable as Readable3 } from "stream";
-var app65 = new Hono();
+var app66 = new Hono();
 var TAG47 = "[portal-fetch]";
 async function verifySignature(secret, accountId, relPath, expiresAtMs, signature, nowMs) {
   if (!secret || !signature) return false;
@@ -25937,10 +26029,10 @@ ${expiresAtMs}`)
   return diff === 0;
 }
 async function readAccountSecret(accountId) {
-  const path3 = resolve35(DATA_ROOT, "accounts", accountId, "secrets", "data-portal.env");
+  const path3 = resolve36(DATA_ROOT, "accounts", accountId, "secrets", "data-portal.env");
   let text;
   try {
-    text = await readFile8(path3, "utf8");
+    text = await readFile9(path3, "utf8");
   } catch {
     console.error(`${TAG47} op=no-secret account="${accountId}" path="${path3}"`);
     return "";
@@ -25957,7 +26049,7 @@ function isValidAccountId2(value) {
 }
 async function readExposeFolders2(accountDir) {
   try {
-    const cfg = JSON.parse(await readFile8(join44(accountDir, "data-portal.json"), "utf8"));
+    const cfg = JSON.parse(await readFile9(join44(accountDir, "data-portal.json"), "utf8"));
     return Array.isArray(cfg?.exposeFolders) ? cfg.exposeFolders.filter((f) => typeof f === "string") : [];
   } catch {
     return [];
@@ -25966,14 +26058,14 @@ async function readExposeFolders2(accountDir) {
 async function resolveFetchTarget(accountDir, relPath, ownerId) {
   let schemaText = null;
   try {
-    schemaText = await readFile8(join44(accountDir, "SCHEMA.md"), "utf8");
+    schemaText = await readFile9(join44(accountDir, "SCHEMA.md"), "utf8");
   } catch {
     schemaText = null;
   }
   const exposeFolders = await readExposeFolders2(accountDir);
   const { exposed } = resolveExposedDirs(schemaText, exposeFolders);
   if (exposed.length === 0 && !ownerId) return { ok: false, reason: "not-exposed" };
-  const lexical = resolve35(accountDir, relPath);
+  const lexical = resolve36(accountDir, relPath);
   let root;
   let absolute;
   try {
@@ -25982,11 +26074,11 @@ async function resolveFetchTarget(accountDir, relPath, ownerId) {
   } catch {
     return { ok: false, reason: "enoent" };
   }
-  if (absolute === root || !absolute.startsWith(root + sep9)) return { ok: false, reason: "not-exposed" };
+  if (absolute === root || !absolute.startsWith(root + sep10)) return { ok: false, reason: "not-exposed" };
   const rel = absolute.slice(root.length + 1);
-  const top = rel.split(sep9)[0];
+  const top = rel.split(sep10)[0];
   if (ownerId) {
-    const own = `uploads${sep9}${ownerId}${sep9}`;
+    const own = `uploads${sep10}${ownerId}${sep10}`;
     if (!rel.startsWith(own)) return { ok: false, reason: "not-exposed" };
   } else if (!exposed.includes(top)) {
     return { ok: false, reason: "not-exposed" };
@@ -26022,7 +26114,7 @@ async function handle(c, headOnly) {
     return c.json({ ok: false, error: "denied" }, 401);
   }
   const target = await resolveFetchTarget(
-    resolve35(DATA_ROOT, "accounts", accountId),
+    resolve36(DATA_ROOT, "accounts", accountId),
     relPath,
     owner || void 0
   );
@@ -26049,9 +26141,9 @@ async function handle(c, headOnly) {
     }
   });
 }
-app65.get("/fetch", (c) => handle(c, false));
-app65.on("HEAD", "/fetch", (c) => handle(c, true));
-var portal_fetch_default = app65;
+app66.get("/fetch", (c) => handle(c, false));
+app66.on("HEAD", "/fetch", (c) => handle(c, true));
+var portal_fetch_default = app66;
 
 // app/lib/timeentry-census.ts
 var TAG48 = "[timeentry-census]";
@@ -26136,7 +26228,7 @@ function startTimeEntryCensus(openSession, opts = {}) {
 }
 
 // app/lib/ledger-census.ts
-import { readdirSync as readdirSync26, readFileSync as readFileSync43, statSync as statSync16 } from "fs";
+import { readdirSync as readdirSync26, readFileSync as readFileSync43, statSync as statSync18 } from "fs";
 import { join as join45 } from "path";
 
 // ../lib/ledger-core/dist/reconcile.js
@@ -26193,7 +26285,7 @@ function countWriteRejects24h(logDir, now) {
   for (const name of entries) {
     const path3 = join45(logDir, name);
     try {
-      if (now - statSync16(path3).mtimeMs > DAY_MS) continue;
+      if (now - statSync18(path3).mtimeMs > DAY_MS) continue;
       for (const line of readFileSync43(path3, "utf8").split("\n")) {
         if (line.includes("[graph-write] reject")) total += 1;
       }
@@ -26463,13 +26555,13 @@ function startGraphHealthTimer() {
 
 // app/lib/file-watcher.ts
 import * as fsp2 from "fs/promises";
-import { resolve as resolve36, sep as sep10 } from "path";
+import { resolve as resolve37, sep as sep11 } from "path";
 var ACCOUNT_UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var DEFAULT_COALESCE_MS = 500;
 var ROOTS = ["accounts"];
 function _routeEvent(rootName, filename) {
   if (!filename) return null;
-  const segs = filename.split(sep10).filter(Boolean);
+  const segs = filename.split(sep11).filter(Boolean);
   if (segs.length < 2) return null;
   const accountId = segs[0];
   if (!ACCOUNT_UUID_RE4.test(accountId)) return null;
@@ -26482,7 +26574,7 @@ async function startFileWatcher(opts = {}) {
   const dropFn = opts.drop ?? dropFileIndex;
   for (const r of ROOTS) {
     try {
-      await fsp2.mkdir(resolve36(dataRoot, r), { recursive: true });
+      await fsp2.mkdir(resolve37(dataRoot, r), { recursive: true });
     } catch (err) {
       console.error(
         `[file-watcher] start-failed root="${r}" err="${err.message}" \u2014 index will be maintained by the 5-min reconcile backstop only`
@@ -26503,7 +26595,7 @@ async function startFileWatcher(opts = {}) {
     timers.set(relativePath, t);
   }
   async function runHook(relativePath, accountId) {
-    const absolute = resolve36(dataRoot, relativePath);
+    const absolute = resolve37(dataRoot, relativePath);
     let exists = false;
     try {
       const st = await fsp2.stat(absolute);
@@ -26527,7 +26619,7 @@ async function startFileWatcher(opts = {}) {
     }
   }
   async function watchRoot(rootName) {
-    const absRoot = resolve36(dataRoot, rootName);
+    const absRoot = resolve37(dataRoot, rootName);
     try {
       const iter = fsp2.watch(absRoot, { recursive: true, signal: controller.signal });
       for await (const event of iter) {
@@ -26566,7 +26658,7 @@ async function startFileWatcher(opts = {}) {
 
 // app/lib/migrate-uploads.ts
 import { mkdir as mkdir6, readdir as readdir6, rename as rename3, rm as rm3 } from "fs/promises";
-import { dirname as dirname14, relative as relative7, resolve as resolve37 } from "path";
+import { dirname as dirname15, relative as relative7, resolve as resolve38 } from "path";
 var ACCOUNT_UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function walkFiles(dir) {
   const out = [];
@@ -26577,7 +26669,7 @@ async function walkFiles(dir) {
     return out;
   }
   for (const e of entries) {
-    const abs = resolve37(dir, e.name);
+    const abs = resolve38(dir, e.name);
     if (e.isDirectory()) {
       out.push(...await walkFiles(abs));
     } else if (e.isFile()) {
@@ -26597,8 +26689,8 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
   let moved = 0;
   for (const oldAbs of files) {
     const suffix = relative7(srcDir, oldAbs);
-    const newAbs = resolve37(destDir, suffix);
-    await mkdir6(dirname14(newAbs), { recursive: true });
+    const newAbs = resolve38(destDir, suffix);
+    await mkdir6(dirname15(newAbs), { recursive: true });
     await rename3(oldAbs, newAbs);
     moved++;
     const oldRel = relative7(dataRoot, oldAbs);
@@ -26624,7 +26716,7 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
 }
 async function migrateUploads(opts = {}) {
   const dataRoot = opts.dataRoot ?? DATA_ROOT;
-  const oldRoot = resolve37(dataRoot, "uploads");
+  const oldRoot = resolve38(dataRoot, "uploads");
   let topEntries;
   try {
     topEntries = await readdir6(oldRoot, { withFileTypes: true });
@@ -26645,8 +26737,8 @@ async function migrateUploads(opts = {}) {
       const name = entry.name;
       if (ACCOUNT_UUID_RE5.test(name)) {
         moved += await relocateTree(
-          resolve37(oldRoot, name),
-          resolve37(dataRoot, "accounts", name, "uploads"),
+          resolve38(oldRoot, name),
+          resolve38(dataRoot, "accounts", name, "uploads"),
           dataRoot,
           name,
           session
@@ -26658,8 +26750,8 @@ async function migrateUploads(opts = {}) {
           continue;
         }
         moved += await relocateTree(
-          resolve37(oldRoot, "public"),
-          resolve37(dataRoot, "accounts", installAccountId, "uploads", "public"),
+          resolve38(oldRoot, "public"),
+          resolve38(dataRoot, "accounts", installAccountId, "uploads", "public"),
           dataRoot,
           null,
           // public uploads carry no graph nodes
@@ -26688,8 +26780,8 @@ async function migrateUploads(opts = {}) {
 }
 
 // app/lib/migrate-admin-webchat-sidecars.ts
-import { readdir as readdir7, readFile as readFile9, rename as rename4, writeFile as writeFile5, unlink as unlink4 } from "fs/promises";
-import { existsSync as existsSync40 } from "fs";
+import { readdir as readdir7, readFile as readFile10, rename as rename4, writeFile as writeFile5, unlink as unlink4 } from "fs/promises";
+import { existsSync as existsSync42 } from "fs";
 import { join as join46 } from "path";
 var ADMIN_ROLE2 = "admin";
 var WEBCHAT_CHANNEL2 = "webchat";
@@ -26701,7 +26793,7 @@ var defaultResolveName = async (_accountId, userId) => {
 async function readRaw3(path3) {
   let raw;
   try {
-    raw = await readFile9(path3, "utf8");
+    raw = await readFile10(path3, "utf8");
   } catch {
     return null;
   }
@@ -26719,7 +26811,7 @@ async function writeRaw(path3, obj) {
     await rename4(tmp, path3);
   } catch (err) {
     try {
-      if (existsSync40(tmp)) await unlink4(tmp);
+      if (existsSync42(tmp)) await unlink4(tmp);
     } catch {
     }
     throw err;
@@ -27108,8 +27200,8 @@ var streamSSE = (c, cb, onError) => {
 
 // app/lib/whatsapp/gateway/routes.ts
 function createWaChannelRoutes(deps) {
-  const app67 = new Hono();
-  app67.get("/wa-channel/inbound", (c) => {
+  const app68 = new Hono();
+  app68.get("/wa-channel/inbound", (c) => {
     const senderId = c.req.query("senderId");
     if (!senderId) return c.json({ error: "senderId required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -27127,7 +27219,7 @@ function createWaChannelRoutes(deps) {
       }
     });
   });
-  app67.post("/wa-channel/reply", async (c) => {
+  app68.post("/wa-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const text = body?.text;
@@ -27148,7 +27240,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=reply-dispatch senderId=${senderId} bytes=${bytes}`);
     return c.json({ ok: true });
   });
-  app67.post("/wa-channel/reply-document", async (c) => {
+  app68.post("/wa-channel/reply-document", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const files = body?.files;
@@ -27187,7 +27279,7 @@ function createWaChannelRoutes(deps) {
     }
     return c.json({ ok: true, results });
   });
-  app67.post("/wa-channel/ready", async (c) => {
+  app68.post("/wa-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     if (typeof senderId !== "string") {
@@ -27196,7 +27288,7 @@ function createWaChannelRoutes(deps) {
     deps.onReady?.(senderId);
     return c.json({ ok: true });
   });
-  app67.post("/wa-channel/received", async (c) => {
+  app68.post("/wa-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const waMessageId = body?.waMessageId;
@@ -27206,7 +27298,7 @@ function createWaChannelRoutes(deps) {
     deps.onReceived?.(senderId, waMessageId);
     return c.json({ ok: true });
   });
-  app67.post("/wa-channel/turn-end", async (c) => {
+  app68.post("/wa-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const sessionId = body?.sessionId;
@@ -27239,7 +27331,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=turn-end sessionId=${sid} replied=no delivered=none`);
     return c.json({ ok: true, delivered: "none" });
   });
-  return app67;
+  return app68;
 }
 
 // app/lib/whatsapp/gateway/wa-gateway.ts
@@ -27654,8 +27746,8 @@ var InboundHub2 = class {
 
 // app/lib/webchat/gateway/routes.ts
 function createWebchatChannelRoutes(deps) {
-  const app67 = new Hono();
-  app67.get("/webchat-channel/inbound", (c) => {
+  const app68 = new Hono();
+  app68.get("/webchat-channel/inbound", (c) => {
     const key = c.req.query("key");
     if (!key) return c.json({ error: "key required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -27673,7 +27765,7 @@ function createWebchatChannelRoutes(deps) {
       }
     });
   });
-  app67.post("/webchat-channel/reply", async (c) => {
+  app68.post("/webchat-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const text = body?.text;
@@ -27683,7 +27775,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReply?.(key, text);
     return c.json({ ok: true });
   });
-  app67.post("/webchat-channel/connector-auth", async (c) => {
+  app68.post("/webchat-channel/connector-auth", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -27696,7 +27788,7 @@ function createWebchatChannelRoutes(deps) {
     const result = await deps.onConnectorAuth({ key, sessionId, name, completed });
     return c.json(result);
   });
-  app67.post("/webchat-channel/ready", async (c) => {
+  app68.post("/webchat-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     if (typeof key !== "string") {
@@ -27705,7 +27797,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReady?.(key);
     return c.json({ ok: true });
   });
-  app67.post("/webchat-channel/permission-request", async (c) => {
+  app68.post("/webchat-channel/permission-request", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const requestId = body?.request_id;
@@ -27719,7 +27811,7 @@ function createWebchatChannelRoutes(deps) {
     const verdict = await deps.awaitPermissionVerdict({ key, requestId, toolName, description, inputPreview });
     return c.json(verdict);
   });
-  app67.post("/webchat-channel/received", async (c) => {
+  app68.post("/webchat-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const messageId = body?.messageId;
@@ -27729,7 +27821,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReceived?.(key, messageId);
     return c.json({ ok: true });
   });
-  app67.post("/webchat-channel/turn-end", async (c) => {
+  app68.post("/webchat-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -27743,7 +27835,7 @@ function createWebchatChannelRoutes(deps) {
     console.error(`[webchat-native] op=turn-end channel=webchat key=${k} sessionId=${sid} replied=${replied ? "yes" : "no"} trailing=${finalBytes}`);
     return c.json({ ok: true });
   });
-  return app67;
+  return app68;
 }
 
 // app/lib/webchat/gateway/webchat-gateway.ts
@@ -27801,16 +27893,16 @@ var WebchatGateway = class _WebchatGateway {
    *  The public /api/chat route awaits this to return the reply on the same SSE
    *  response, preserving the pre-756 POST→single-blob browser contract. */
   awaitReply(key, timeoutMs) {
-    return new Promise((resolve43) => {
+    return new Promise((resolve44) => {
       const timer = setTimeout(() => {
         this.replyAwaiters.delete(key);
-        resolve43({ timeout: true });
+        resolve44({ timeout: true });
       }, timeoutMs);
       if (timer.unref) timer.unref();
       this.replyAwaiters.set(key, (r) => {
         clearTimeout(timer);
         this.replyAwaiters.delete(key);
-        resolve43(r);
+        resolve44(r);
       });
     });
   }
@@ -27821,11 +27913,11 @@ var WebchatGateway = class _WebchatGateway {
    *  terminal dialog stays answerable). */
   awaitPermissionVerdict(p, timeoutMs) {
     const k = _WebchatGateway.promptKey(p.key, p.requestId);
-    return new Promise((resolve43) => {
+    return new Promise((resolve44) => {
       this.pendingPrompts.get(k)?.resolve({ timeout: true });
       const timer = setTimeout(() => {
         this.pendingPrompts.delete(k);
-        resolve43({ timeout: true });
+        resolve44({ timeout: true });
       }, timeoutMs);
       if (timer.unref) timer.unref();
       this.pendingPrompts.set(k, {
@@ -27834,7 +27926,7 @@ var WebchatGateway = class _WebchatGateway {
         resolve: (r) => {
           clearTimeout(timer);
           this.pendingPrompts.delete(k);
-          resolve43(r);
+          resolve44(r);
         }
       });
       console.error(`[webchat:perm] op=open key=${keyDisplay(p.key)} id=${p.requestId} tool=${p.toolName}`);
@@ -28398,8 +28490,8 @@ async function fanOut(subscribers, text, onError, tag) {
 }
 
 // app/lib/webchat/file-delivery.ts
-import { realpathSync as realpathSync8 } from "fs";
-import { resolve as resolve38 } from "path";
+import { realpathSync as realpathSync9 } from "fs";
+import { resolve as resolve39 } from "path";
 
 // app/lib/channel-pty-bridge/file-delivery.ts
 var SEND_USER_FILE = "SendUserFile";
@@ -28500,10 +28592,10 @@ function makeWebchatSendFile(entry) {
       console.error(`${TAG51} file-delivery reject reason=no-account sender=${entry.senderId}`);
       return { ok: false, error: "no-account" };
     }
-    const accountDir = resolve38(platformRoot2(), "..", "data/accounts", entry.accountId);
+    const accountDir = resolve39(platformRoot2(), "..", "data/accounts", entry.accountId);
     try {
-      const resolved = realpathSync8(filePath);
-      const accountResolved = realpathSync8(accountDir);
+      const resolved = realpathSync9(filePath);
+      const accountResolved = realpathSync9(accountDir);
       if (!resolved.startsWith(accountResolved + "/")) {
         console.error(`${TAG51} file-delivery reject reason=outside_account_directory sender=${entry.senderId}`);
         return { ok: false, error: "outside-account" };
@@ -28827,8 +28919,8 @@ var InboundHub3 = class {
 
 // app/lib/telegram/gateway/routes.ts
 function createTelegramChannelRoutes(deps) {
-  const app67 = new Hono();
-  app67.get("/tg-channel/inbound", (c) => {
+  const app68 = new Hono();
+  app68.get("/tg-channel/inbound", (c) => {
     const key = c.req.query("key");
     if (!key) return c.json({ error: "key required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -28846,7 +28938,7 @@ function createTelegramChannelRoutes(deps) {
       }
     });
   });
-  app67.post("/tg-channel/reply", async (c) => {
+  app68.post("/tg-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const text = body?.text;
@@ -28862,7 +28954,7 @@ function createTelegramChannelRoutes(deps) {
     console.error(`[telegram-native] op=reply key=${key} bytes=${Buffer.byteLength(text, "utf8")}`);
     return c.json({ ok: true });
   });
-  app67.post("/tg-channel/ready", async (c) => {
+  app68.post("/tg-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     if (typeof key !== "string") {
@@ -28871,7 +28963,7 @@ function createTelegramChannelRoutes(deps) {
     deps.onReady?.(key);
     return c.json({ ok: true });
   });
-  app67.post("/tg-channel/received", async (c) => {
+  app68.post("/tg-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const messageId = body?.messageId;
@@ -28881,7 +28973,7 @@ function createTelegramChannelRoutes(deps) {
     deps.onReceived?.(key, messageId);
     return c.json({ ok: true });
   });
-  app67.post("/tg-channel/turn-end", async (c) => {
+  app68.post("/tg-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -28914,7 +29006,7 @@ function createTelegramChannelRoutes(deps) {
     console.error(`[telegram-native] op=turn-end key=${key} sessionId=${sid} replied=no delivered=none`);
     return c.json({ ok: true, delivered: "none" });
   });
-  return app67;
+  return app68;
 }
 
 // app/lib/telegram/gateway/telegram-gateway.ts
@@ -29062,9 +29154,9 @@ function buildTelegramSpawnRequest(input) {
 }
 
 // app/lib/telegram/outbound/send-document.ts
-import { realpathSync as realpathSync9 } from "fs";
-import { readFile as readFile10, stat as stat10 } from "fs/promises";
-import { resolve as resolve39, basename as basename12 } from "path";
+import { realpathSync as realpathSync10 } from "fs";
+import { readFile as readFile11, stat as stat10 } from "fs/promises";
+import { resolve as resolve40, basename as basename13 } from "path";
 var TAG53 = "[telegram:outbound]";
 var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
 async function sendTelegramDocument(input) {
@@ -29075,10 +29167,10 @@ async function sendTelegramDocument(input) {
   if (!maxyAccountId || !platformRoot5) {
     return { ok: false, status: 400, error: "Cannot validate file path: missing account or platform context" };
   }
-  const accountDir = resolve39(platformRoot5, "..", "data/accounts", maxyAccountId);
+  const accountDir = resolve40(platformRoot5, "..", "data/accounts", maxyAccountId);
   let accountResolved;
   try {
-    accountResolved = realpathSync9(accountDir);
+    accountResolved = realpathSync10(accountDir);
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
@@ -29090,7 +29182,7 @@ async function sendTelegramDocument(input) {
   }
   let resolvedPath;
   try {
-    resolvedPath = realpathSync9(filePath);
+    resolvedPath = realpathSync10(filePath);
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
@@ -29112,8 +29204,8 @@ async function sendTelegramDocument(input) {
       error: `File exceeds 50 MB limit (${(fileStat.size / 1024 / 1024).toFixed(1)} MB)`
     };
   }
-  const filename = basename12(resolvedPath);
-  const buffer = Buffer.from(await readFile10(resolvedPath));
+  const filename = basename13(resolvedPath);
+  const buffer = Buffer.from(await readFile11(resolvedPath));
   const form = new FormData();
   form.append("chat_id", String(chatId));
   if (caption) form.append("caption", caption);
@@ -29467,12 +29559,12 @@ function warnOnChannelAdminBindingDrift() {
 }
 
 // server/lib/booking-site-accounts.ts
-import { existsSync as existsSync41, readFileSync as readFileSync44 } from "fs";
-import { resolve as resolve40 } from "path";
+import { existsSync as existsSync43, readFileSync as readFileSync44 } from "fs";
+import { resolve as resolve41 } from "path";
 function listBookingSiteAccounts(accounts) {
   return accounts.filter((a) => {
-    const availPath = resolve40(a.accountDir, "calendar-availability.json");
-    if (!existsSync41(availPath)) return false;
+    const availPath = resolve41(a.accountDir, "calendar-availability.json");
+    if (!existsSync43(availPath)) return false;
     try {
       const cfg = JSON.parse(readFileSync44(availPath, "utf-8"));
       return typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
@@ -29512,8 +29604,8 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash6, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync42, readFileSync as readFileSync45, statSync as statSync17 } from "fs";
-import { resolve as resolve41 } from "path";
+import { existsSync as existsSync44, readFileSync as readFileSync45, statSync as statSync19 } from "fs";
+import { resolve as resolve42 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
 function canonicalize(value) {
@@ -29548,7 +29640,7 @@ var PUBKEY_SHA256 = "8eee6bcb33545fd13b16d3199a5735ca5db5062834c7b49dfe4f23801d9
 var GRACE_DAYS = 7;
 var GRACE_MS = GRACE_DAYS * 24 * 60 * 60 * 1e3;
 function pubkeyPath(brand) {
-  return resolve41(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
+  return resolve42(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
 }
 var memo = null;
 function memoKey(mtimeMs, account) {
@@ -29560,11 +29652,11 @@ function resolveEntitlement(brand, account) {
   if (brand.commercialMode !== true) {
     return logResolved(implicitTrust(account), null);
   }
-  const entitlementPath = resolve41(brand.configDir, "entitlement.json");
-  if (!existsSync42(entitlementPath)) {
+  const entitlementPath = resolve42(brand.configDir, "entitlement.json");
+  if (!existsSync44(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
-  const stat11 = statSync17(entitlementPath);
+  const stat11 = statSync19(entitlementPath);
   const key = memoKey(stat11.mtimeMs, account);
   if (memo && memo.key === key) {
     return memo.result;
@@ -29754,10 +29846,10 @@ installMediaDownloadGuard();
 var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT || "";
 var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join47(PLATFORM_ROOT8, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync43(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync45(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync43(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync45(BRAND_JSON_PATH)) {
   try {
     const parsed = JSON.parse(readFileSync46(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
@@ -29794,7 +29886,7 @@ var brandLoginOpts = {
 var ALIAS_DOMAINS_PATH = join47(homedir4(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync43(ALIAS_DOMAINS_PATH)) return null;
+    if (!existsSync45(ALIAS_DOMAINS_PATH)) return null;
     const parsed = JSON.parse(readFileSync46(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
@@ -29819,7 +29911,7 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app66 = new Hono();
+var app67 = new Hono();
 function resolveChannelOverride(accountId, channel, senderId) {
   try {
     const dir = listValidAccounts().find((a) => a.accountId === accountId)?.accountDir;
@@ -29868,7 +29960,7 @@ var waGateway = new WaGateway({
   fetchStandingRules: fetchAccountStandingRules,
   resolveSessionOverride: (accountId, senderId) => resolveChannelOverride(accountId, "whatsapp", senderId),
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve42(process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve43(process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 / 1390 — file delivery on the native channel. `maxyAccountId` (the
   // path-validation scope) is the sender's effective SESSION account, resolved
   // once at the inbound gate and threaded here via the gateway's per-sender doc
@@ -29883,7 +29975,7 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve42(process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, ".."))
+      platformRoot: resolve43(process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
@@ -29995,7 +30087,7 @@ var waGateway = new WaGateway({
     nativeFileFollowers.set(senderId, ac);
   }
 });
-app66.route("/", waGateway.routes());
+app67.route("/", waGateway.routes());
 waGateway.startSweeper();
 function runDuplicateSenderAudit() {
   try {
@@ -30118,7 +30210,7 @@ var webchatGateway = new WebchatGateway({
   firePublicSessionEndReview: (input) => firePublicSessionEndReview(input)
 });
 setWebchatGateway(webchatGateway);
-app66.route("/", webchatGateway.routes());
+app67.route("/", webchatGateway.routes());
 webchatGateway.startSweeper();
 webchatGateway.startPublicReaper();
 var telegramFileFollowers = /* @__PURE__ */ new Map();
@@ -30162,7 +30254,7 @@ var telegramGateway = new TelegramGateway({
   }
 });
 setTelegramGateway(telegramGateway);
-app66.route("/", telegramGateway.routes());
+app67.route("/", telegramGateway.routes());
 telegramGateway.startSweeper();
 var chatRoutes = createChatRoutes({
   handleInbound: (input) => webchatGateway.handleInbound(input),
@@ -30196,19 +30288,19 @@ var scheduleInjectRoutes = createScheduleInjectRoutes({
     return managed.account;
   }
 });
-app66.route("/api/channel/schedule-inject", scheduleInjectRoutes);
-app66.use("*", clientIpMiddleware);
+app67.route("/api/channel/schedule-inject", scheduleInjectRoutes);
+app67.use("*", clientIpMiddleware);
 function allowsSameOriginFraming(path3) {
-  return path3 === "/vnc-viewer.html" || path3.startsWith("/api/admin/attachment/") || path3.startsWith("/api/public-reader/attachment/") || path3 === "/api/admin/files/download";
+  return path3 === "/vnc-viewer.html" || path3.startsWith("/api/admin/attachment/") || path3.startsWith("/api/public-reader/attachment/") || path3 === "/api/admin/files/download" || path3 === "/api/admin/session-upload";
 }
-app66.use("*", async (c, next) => {
+app67.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
   c.header("X-Frame-Options", allowsSameOriginFraming(c.req.path) ? "SAMEORIGIN" : "DENY");
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app66.use("*", async (c, next) => {
+app67.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -30226,7 +30318,7 @@ app66.use("*", async (c, next) => {
     });
   }
 });
-app66.use("*", async (c, next) => {
+app67.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isOperatorHost(host, getOperatorDomains()) || !isPublicHost(host)) {
     await next();
@@ -30264,7 +30356,7 @@ function resolveRemoteAuthOpts(c) {
   return { ...brandLoginOpts, origin };
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app66.post("/__remote-auth/login", async (c) => {
+app67.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -30309,7 +30401,7 @@ app66.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app66.get("/__remote-auth/logout", (c) => {
+app67.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -30322,7 +30414,7 @@ app66.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app66.post("/__remote-auth/change-password", async (c) => {
+app67.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -30381,13 +30473,13 @@ app66.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app66.get("/__remote-auth/setup", (c) => {
+app67.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "setup" }), 200);
 });
-app66.post("/__remote-auth/set-initial-password", async (c) => {
+app67.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -30425,10 +30517,10 @@ app66.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app66.get("/api/remote-auth/status", (c) => {
+app67.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app66.post("/api/remote-auth/set-password", async (c) => {
+app67.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -30467,10 +30559,10 @@ app66.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app66.route("/api/_client-error", client_error_default);
+app67.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
 var PWA_PUBLIC_PATHS = /* @__PURE__ */ new Set(["/sw.js", ...PWA_SURFACES.map((s) => s.manifestPath)]);
-app66.use("*", async (c, next) => {
+app67.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path3 = c.req.path;
   if (path3 === "/favicon.ico" || path3.startsWith("/assets/") || path3.startsWith("/brand/") || // Public free/busy is read by the booking page (a separate Cloudflare Pages
@@ -30514,28 +30606,28 @@ app66.use("*", async (c, next) => {
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), redirect: path3 }), 200);
 });
-app66.route("/api/health", health_default);
-app66.route("/api/chat", chatRoutes);
-app66.route("/api/whatsapp", whatsapp_default);
-app66.route("/api/storage", storage_broker_default);
-app66.route("/api/whatsapp-reader", whatsapp_reader_default);
-app66.route("/api/public-reader", public_reader_default);
-app66.route("/api/webchat", createWebchatRoutes({
+app67.route("/api/health", health_default);
+app67.route("/api/chat", chatRoutes);
+app67.route("/api/whatsapp", whatsapp_default);
+app67.route("/api/storage", storage_broker_default);
+app67.route("/api/whatsapp-reader", whatsapp_reader_default);
+app67.route("/api/public-reader", public_reader_default);
+app67.route("/api/webchat", createWebchatRoutes({
   handleInbound: (input) => webchatGateway.handleInbound(input),
   // Task 940 — the permission relay's pointer read + verdict write.
   pendingPromptFor: (key) => webchatGateway.pendingPromptFor(key),
   deliveryFailureFor: (key) => webchatGateway.deliveryFailureFor(key),
   resolvePermissionVerdict: (key, requestId, behavior) => webchatGateway.resolvePermissionVerdict(key, requestId, behavior)
 }));
-app66.route("/api/webchat/greeting", webchat_greeting_default);
-app66.route("/api/telegram", telegram_default);
-app66.route("/api/quickbooks", quickbooks_default);
-app66.route("/api/onboarding", onboarding_default);
-app66.route("/api/admin", admin_default);
-app66.route("/api/access", access_default);
-app66.route("/api/session", session_default2);
-app66.route("/api/calendar", calendar_public_default);
-app66.route("/api/portal", portal_fetch_default);
+app67.route("/api/webchat/greeting", webchat_greeting_default);
+app67.route("/api/telegram", telegram_default);
+app67.route("/api/quickbooks", quickbooks_default);
+app67.route("/api/onboarding", onboarding_default);
+app67.route("/api/admin", admin_default);
+app67.route("/api/access", access_default);
+app67.route("/api/session", session_default2);
+app67.route("/api/calendar", calendar_public_default);
+app67.route("/api/portal", portal_fetch_default);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -30547,7 +30639,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app66.get("/agent-assets/:slug/:filename", (c) => {
+app67.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -30563,13 +30655,13 @@ app66.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve42(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve42(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve43(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve43(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync43(filePath)) {
+  if (!existsSync45(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
@@ -30582,7 +30674,7 @@ app66.get("/agent-assets/:slug/:filename", (c) => {
     "Cache-Control": "public, max-age=3600"
   });
 });
-app66.get("/generated/:filename", (c) => {
+app67.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -30593,13 +30685,13 @@ app66.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve42(account.accountDir, "generated", filename);
-  const expectedDir = resolve42(account.accountDir, "generated");
+  const filePath = resolve43(account.accountDir, "generated", filename);
+  const expectedDir = resolve43(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync43(filePath)) {
+  if (!existsSync45(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
@@ -30612,14 +30704,14 @@ app66.get("/generated/:filename", (c) => {
     "Cache-Control": "public, max-age=86400"
   });
 });
-app66.route("/sites", sites_default);
-app66.route("/listings", listings_default);
-app66.route("/v", visitor_event_default);
-app66.route("/v", visitor_consent_default);
+app67.route("/sites", sites_default);
+app67.route("/listings", listings_default);
+app67.route("/v", visitor_event_default);
+app67.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync43(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync45(BRAND_JSON_PATH)) {
   try {
     const fullBrand = JSON.parse(readFileSync46(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
@@ -30648,11 +30740,11 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 var brandThemeColor = BRAND.defaultColors?.primary ?? "#000000";
 var brandBackgroundColor = BRAND.defaultColors?.background ?? "#ffffff";
 var brandAppIconsExist = [brandAppIcon192Path, brandAppIcon512Path, brandMaskableIconPath].every(
-  (p) => existsSync43(resolve42(process.cwd(), "public", p.replace(/^\//, "")))
+  (p) => existsSync45(resolve43(process.cwd(), "public", p.replace(/^\//, "")))
 );
 var SW_SOURCE = (() => {
   try {
-    return readFileSync46(resolve42(process.cwd(), "public", "sw.js"), "utf-8");
+    return readFileSync46(resolve43(process.cwd(), "public", "sw.js"), "utf-8");
   } catch {
     return null;
   }
@@ -30661,7 +30753,7 @@ function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT8) return "unknown";
     const versionFile = join47(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync43(versionFile)) return "unknown";
+    if (!existsSync45(versionFile)) return "unknown";
     const content = readFileSync46(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
@@ -30703,7 +30795,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync46(resolve42(process.cwd(), "public", file), "utf-8");
+    html = readFileSync46(resolve43(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -30725,7 +30817,7 @@ function loadBrandingCache(agentSlug) {
     const accountId = getDefaultAccountId();
     if (!accountId) return null;
     const cachePath = join47(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync43(cachePath)) return null;
+    if (!existsSync45(cachePath)) return null;
     return JSON.parse(readFileSync46(cachePath, "utf-8"));
   } catch {
     return null;
@@ -30770,7 +30862,7 @@ function brandedPublicHtml(agentSlug) {
 function agentUnavailableHtml() {
   return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escapeHtml(BRAND.productName)}</title></head><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1.5rem;color:#222"><h1 style="font-size:1.25rem">Agent unavailable</h1><p>This agent isn't available right now. If you reached this page from a saved link, the agent may have been turned off.</p></body></html>`;
 }
-app66.get("/", (c) => {
+app67.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const klass = classifyHost(host, getOperatorDomains(), isPublicHost);
   if (klass === "operator") {
@@ -30792,12 +30884,12 @@ app66.get("/", (c) => {
   console.log(`[host-class] host=${host} class=admin served=index.html`);
   return c.html(cachedHtml("index.html"));
 });
-app66.get("/public", (c) => {
+app67.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app66.get("/public-chat", (c) => {
+app67.get("/public-chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -30816,12 +30908,12 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app66.use("/vnc-viewer.html", logViewerFetch);
-app66.use("/vnc-popout.html", logViewerFetch);
-app66.get("/vnc-popout.html", (c) => {
+app67.use("/vnc-viewer.html", logViewerFetch);
+app67.use("/vnc-popout.html", logViewerFetch);
+app67.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync46(resolve42(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync46(resolve43(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -30831,7 +30923,7 @@ app66.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app66.post("/api/vnc/client-event", async (c) => {
+app67.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -30852,11 +30944,11 @@ app66.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app66.get("/g/:slug", (c) => {
+app67.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml(resolveDefaultSlug() ?? void 0));
 });
 for (const pwa of PWA_SURFACES) {
-  app66.get(pwa.manifestPath, (c) => {
+  app67.get(pwa.manifestPath, (c) => {
     const manifest = buildManifest(pwa, {
       productName: BRAND.productName,
       appIcon192: brandAppIcon192Path,
@@ -30872,7 +30964,7 @@ for (const pwa of PWA_SURFACES) {
     return c.body(JSON.stringify(manifest));
   });
 }
-app66.get("/sw.js", (c) => {
+app67.get("/sw.js", (c) => {
   if (SW_SOURCE == null) {
     console.error("[pwa] op=sw status=500 reason=sw-source-missing");
     return c.text("Service worker unavailable", 500);
@@ -30881,12 +30973,12 @@ app66.get("/sw.js", (c) => {
   console.log(`[pwa] op=sw status=200 ct=${SW_CONTENT_TYPE}`);
   return c.body(SW_SOURCE);
 });
-app66.get("/graph", (c) => {
+app67.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app66.get("/chat", (c) => {
+app67.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isOperatorHost(host, getOperatorDomains())) {
     console.log(`[host-class] host=${host} class=operator served=operator.html`);
@@ -30895,42 +30987,42 @@ app66.get("/chat", (c) => {
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("chat.html"));
 });
-app66.get("/data", (c) => {
+app67.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app66.get("/tasks", (c) => {
+app67.get("/tasks", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("tasks.html"));
 });
-app66.get("/activity", (c) => {
+app67.get("/activity", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("activity.html"));
 });
-app66.get("/calendar", (c) => {
+app67.get("/calendar", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("calendar.html"));
 });
-app66.get("/routines", (c) => {
+app67.get("/routines", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("routines.html"));
 });
-app66.get("/skills", (c) => {
+app67.get("/skills", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("skills.html"));
 });
-app66.get("/browser", (c) => {
+app67.get("/browser", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("browser.html"));
 });
-app66.get("/:slug", async (c, next) => {
+app67.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const account = resolveAccount();
@@ -30945,13 +31037,13 @@ app66.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app66.get("/favicon.ico", (c) => {
+  app67.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app66.use("/*", serveStatic({ root: "./public" }));
-app66.all("*", (c) => {
+app67.use("/*", serveStatic({ root: "./public" }));
+app67.all("*", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path3 = c.req.path;
   if (isPublicHost(host)) {
@@ -30965,13 +31057,13 @@ app66.all("*", (c) => {
 });
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app66.fetch, port, hostname });
+var httpServer = serve({ fetch: app67.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..");
-  const reconcileScript = resolve42(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
+  const reconcileScript = resolve43(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
   const runReconcile = (ctx) => {
-    if (!existsSync43(reconcileScript)) return;
+    if (!existsSync45(reconcileScript)) return;
     try {
       const child = spawn3(process.execPath, [reconcileScript], {
         env: { ...process.env, PLATFORM_ROOT: reconcilePlatformRoot },
@@ -31010,14 +31102,14 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const DREAM_CYCLE_SWEEP_INTERVAL_MS = 36e5;
   const dreamPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..");
-  const dreamSweepScript = resolve42(dreamPlatformRoot, "plugins/memory/mcp/dist/scripts/dream-cycle-sweep.js");
+  const dreamSweepScript = resolve43(dreamPlatformRoot, "plugins/memory/mcp/dist/scripts/dream-cycle-sweep.js");
   registerLoop({
     name: "dream-cycle-sweep",
     intervalMs: DREAM_CYCLE_SWEEP_INTERVAL_MS,
     firstRunDelayMs: 3e4,
     detached: true,
     run: (ctx) => {
-      if (!existsSync43(dreamSweepScript)) return;
+      if (!existsSync45(dreamSweepScript)) return;
       try {
         const child = spawn3(process.execPath, [dreamSweepScript], {
           env: { ...process.env, PLATFORM_ROOT: dreamPlatformRoot },
@@ -31034,10 +31126,10 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..");
-  const outlookScript = resolve42(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
+  const outlookScript = resolve43(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
   const OUTLOOK_COMPLETE_INTERVAL_MS = 3e4;
   const runOutlookComplete = (ctx) => {
-    if (!existsSync43(outlookScript)) return;
+    if (!existsSync45(outlookScript)) return;
     try {
       const child = spawn3(process.execPath, [outlookScript], {
         env: { ...process.env, PLATFORM_ROOT: outlookPlatformRoot },
@@ -31060,19 +31152,19 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..");
-  const strandedAccountsDir = resolve42(auditRoot, "..", "data/accounts");
+  const strandedAccountsDir = resolve43(auditRoot, "..", "data/accounts");
   const STRANDED_AUDIT_INTERVAL_MS = 3e5;
   const STRANDED_AGE_MS = 16 * 6e4;
   const STRANDED_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
   const runStrandedAudit = () => {
     try {
-      if (!existsSync43(strandedAccountsDir)) return;
+      if (!existsSync45(strandedAccountsDir)) return;
       const now = Date.now();
       for (const name of readdirSync27(strandedAccountsDir)) {
         if (!STRANDED_UUID_RE.test(name)) continue;
-        const pendingPath2 = resolve42(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
-        if (!existsSync43(pendingPath2)) continue;
-        const ageMs2 = now - statSync18(pendingPath2).mtimeMs;
+        const pendingPath2 = resolve43(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
+        if (!existsSync45(pendingPath2)) continue;
+        const ageMs2 = now - statSync20(pendingPath2).mtimeMs;
         if (ageMs2 > STRANDED_AGE_MS) {
           console.error(`[outlook-mcp] devicecode-stranded account=${name} ageSec=${Math.floor(ageMs2 / 1e3)}`);
         }
@@ -31090,7 +31182,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const googleRoot = process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..");
-  const googleAccountsDir = resolve42(googleRoot, "..", "data/accounts");
+  const googleAccountsDir = resolve43(googleRoot, "..", "data/accounts");
   const GOOGLE_PENDING_AUDIT_INTERVAL_MS = 3e5;
   const runGooglePendingAuditSafe = () => {
     try {
@@ -31105,10 +31197,10 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     firstRunDelayMs: 27e3,
     run: runGooglePendingAuditSafe
   });
-  const googleAuditScript = resolve42(googleRoot, "plugins/google/mcp/dist/scripts/account-audit.js");
+  const googleAuditScript = resolve43(googleRoot, "plugins/google/mcp/dist/scripts/account-audit.js");
   const GOOGLE_ACCOUNT_AUDIT_INTERVAL_MS = 36e5;
   const runGoogleAccountAudit = (ctx) => {
-    if (!existsSync43(googleAuditScript)) return;
+    if (!existsSync45(googleAuditScript)) return;
     try {
       const child = spawn3(process.execPath, [googleAuditScript], {
         env: { ...process.env, PLATFORM_ROOT: googleRoot },
@@ -31180,7 +31272,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..");
-  const publishScript = resolve42(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
+  const publishScript = resolve43(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
   const PUBLISH_INTERVAL_MS = 3e5;
   const bookingAccounts = () => {
     try {
@@ -31191,7 +31283,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     }
   };
   const spawnPublish = (account, ctx) => {
-    if (!existsSync43(publishScript)) return;
+    if (!existsSync45(publishScript)) return;
     try {
       const child = spawn3(process.execPath, [publishScript], {
         env: {
@@ -31210,19 +31302,19 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     }
   };
   const auditSnapshotAge = (account) => {
-    const availPath = resolve42(account.accountDir, "calendar-availability.json");
+    const availPath = resolve43(account.accountDir, "calendar-availability.json");
     let hasBookingSite = false;
     try {
-      if (existsSync43(availPath)) {
+      if (existsSync45(availPath)) {
         const cfg = JSON.parse(readFileSync46(availPath, "utf-8"));
         hasBookingSite = typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
       }
     } catch {
     }
     if (!hasBookingSite) return;
-    const statePath = resolve42(account.accountDir, "state", "booking-availability", "last-publish.json");
+    const statePath = resolve43(account.accountDir, "state", "booking-availability", "last-publish.json");
     let lastSuccessAt = null;
-    if (existsSync43(statePath)) {
+    if (existsSync45(statePath)) {
       try {
         const rec = JSON.parse(readFileSync46(statePath, "utf-8"));
         lastSuccessAt = rec.lastSuccessAt ?? null;
@@ -31257,11 +31349,11 @@ startTimeEntryCensus(() => getSession());
 startLedgerCensus(() => getSession());
 {
   const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..");
-  const auditScript = resolve42(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
+  const auditScript = resolve43(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
   const auditLogDir = process.env.LOG_DIR ?? LOG_DIR;
   const CONNECTOR_AUDIT_INTERVAL_MS = 3e5;
   const runConnectorAudit = (ctx) => {
-    if (!existsSync43(auditScript)) return;
+    if (!existsSync45(auditScript)) return;
     try {
       const child = spawn3(process.execPath, [auditScript], {
         env: { ...process.env, PLATFORM_ROOT: auditPlatformRoot, LOG_DIR: auditLogDir },
@@ -31341,7 +31433,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app66.routes ?? []) {
+  for (const r of app67.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -31381,7 +31473,7 @@ try {
 var ADMINUSER_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 async function runAdminUserReconcileTick() {
   try {
-    if (!existsSync43(USERS_FILE)) {
+    if (!existsSync45(USERS_FILE)) {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
@@ -31432,7 +31524,7 @@ registerLoop({
 });
 var USERS_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 function countUsersRows() {
-  if (!existsSync43(USERS_FILE)) return 0;
+  if (!existsSync45(USERS_FILE)) return 0;
   const raw = readFileSync46(USERS_FILE, "utf-8").trim();
   if (!raw) return 0;
   const users = JSON.parse(raw);
@@ -31502,7 +31594,7 @@ try {
 } catch (err) {
   console.error(`[graph-health] account-enumeration unavailable reason=${err instanceof Error ? err.message : String(err)}`);
 }
-var configDirForWhatsApp = basename13(MAXY_DIR) || ".maxy";
+var configDirForWhatsApp = basename14(MAXY_DIR) || ".maxy";
 var bootAccount = resolveAccount();
 if (bootAccount) {
   migrateRemovedConfigKeys(bootAccount.accountDir);
@@ -31566,7 +31658,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve42(process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..")),
+  platformRoot: resolve43(process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (isObserveAccount(msg.accountId)) {