@rubytech/create-maxy-code 0.1.503 → 0.1.505

package/payload/server/server.js

@@ -146,7 +146,7 @@ var require_dist = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.ACTIVE_CANDIDATE_FLOOR = exports.SAME_SUBJECT_COSINE = void 0;
     exports.formatStandingRulesBlock = formatStandingRulesBlock2;
-    exports.resolveOwnerUserId = resolveOwnerUserId2;
+    exports.resolveOwnerUserId = resolveOwnerUserId3;
     exports.queryActiveRuleCandidates = queryActiveRuleCandidates;
     exports.resolveActiveRules = resolveActiveRules2;
     exports.activeRuleSet = activeRuleSet;
@@ -159,7 +159,7 @@ var require_dist = __commonJS({
       return `## Standing rules
 ${lines.join("\n")}`;
     }
-    async function resolveOwnerUserId2(session, accountId) {
+    async function resolveOwnerUserId3(session, accountId) {
       const res = await session.run(`
     MATCH (au:AdminUser {accountId: $accountId, role: 'owner'})
     RETURN au.userId AS userId
@@ -194,7 +194,7 @@ ${lines.join("\n")}`;
     async function resolveCandidates(session, accountId) {
       let ownerUserId;
       try {
-        ownerUserId = await resolveOwnerUserId2(session, accountId);
+        ownerUserId = await resolveOwnerUserId3(session, accountId);
       } catch {
         return { candidates: [], ownerUserId: null, source: "owner-error" };
       }
@@ -1753,10 +1753,10 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync46, existsSync as existsSync45, watchFile, readdirSync as readdirSync27, statSync as statSync20 } from "fs";
+import { readFileSync as readFileSync47, existsSync as existsSync46, watchFile, readdirSync as readdirSync28, statSync as statSync20 } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { createHash as createHash7 } from "crypto";
-import { resolve as resolve43, join as join47, basename as basename14 } from "path";
+import { resolve as resolve44, join as join47, basename as basename14 } from "path";
 import { homedir as homedir4 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
@@ -3030,7 +3030,7 @@ var credsSaveQueue = Promise.resolve();
 async function drainCredsSaveQueue(timeoutMs = 5e3) {
   console.error(`${TAG6} draining credential save queue\u2026`);
   const timer = new Promise(
-    (resolve44) => setTimeout(() => resolve44("timeout"), timeoutMs)
+    (resolve45) => setTimeout(() => resolve45("timeout"), timeoutMs)
   );
   const result = await Promise.race([
     credsSaveQueue.then(() => "drained"),
@@ -3207,11 +3207,11 @@ async function createWaSocket(opts) {
   return sock;
 }
 async function waitForConnection(sock) {
-  return new Promise((resolve44, reject) => {
+  return new Promise((resolve45, reject) => {
     const handler = (update) => {
       if (update.connection === "open") {
         sock.ev.off("connection.update", handler);
-        resolve44();
+        resolve45();
       }
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
@@ -3319,7 +3319,7 @@ function isTimeoutError(err) {
   return Boolean(err?.__maxyTimeout);
 }
 function withTimeout(label, promise, timeoutMs) {
-  return new Promise((resolve44, reject) => {
+  return new Promise((resolve45, reject) => {
     const timer = setTimeout(() => {
       const err = new Error(`${label} timed out after ${timeoutMs}ms`);
       err.__maxyTimeout = true;
@@ -3329,7 +3329,7 @@ function withTimeout(label, promise, timeoutMs) {
     promise.then(
       (value) => {
         clearTimeout(timer);
-        resolve44(value);
+        resolve45(value);
       },
       (err) => {
         clearTimeout(timer);
@@ -4394,8 +4394,8 @@ async function persistWhatsAppMessage(input) {
   const { givenName, familyName } = splitName(input.pushName);
   const prev = sessionWriteLocks.get(input.cacheKey);
   let release;
-  const mine = new Promise((resolve44) => {
-    release = resolve44;
+  const mine = new Promise((resolve45) => {
+    release = resolve45;
   });
   const chained = (prev ?? Promise.resolve()).then(() => mine);
   sessionWriteLocks.set(input.cacheKey, chained);
@@ -6132,11 +6132,11 @@ async function connectWithReconnect(conn) {
       console.error(
         `${TAG17} reconnecting account=${conn.accountId} in ${delay}ms (attempt ${decision.nextAttempts}/${maxAttempts})`
       );
-      await new Promise((resolve44) => {
-        const timer = setTimeout(resolve44, delay);
+      await new Promise((resolve45) => {
+        const timer = setTimeout(resolve45, delay);
         conn.abortController.signal.addEventListener("abort", () => {
           clearTimeout(timer);
-          resolve44();
+          resolve45();
         }, { once: true });
       });
     }
@@ -6144,16 +6144,16 @@ async function connectWithReconnect(conn) {
   }
 }
 function waitForDisconnectEvent(conn) {
-  return new Promise((resolve44) => {
+  return new Promise((resolve45) => {
     if (!conn.sock) {
-      resolve44();
+      resolve45();
       return;
     }
     const sock = conn.sock;
     const handler = (update) => {
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
-        resolve44();
+        resolve45();
       }
     };
     sock.ev.on("connection.update", handler);
@@ -6627,8 +6627,8 @@ async function handleInboundMessage(conn, msg) {
     const conversationKey = isGroup ? remoteJid : senderPhone;
     const debounceKey = `${conn.accountId}:${conversationKey}:${senderPhone}`;
     let resolvePending;
-    const sttPending = new Promise((resolve44) => {
-      resolvePending = resolve44;
+    const sttPending = new Promise((resolve45) => {
+      resolvePending = resolve45;
     });
     if (conn.debouncer) conn.debouncer.registerPending(debounceKey, sttPending);
     try {
@@ -7017,20 +7017,20 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
 
 // server/routes/health.ts
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve44) => {
+  return new Promise((resolve45) => {
     const socket = createConnection2(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve44(true);
+      resolve45(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve44(false);
+      resolve45(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve44(false);
+      resolve45(false);
     });
   });
 }
@@ -7285,8 +7285,8 @@ function webchatTurnTimeoutMs() {
   return Number(process.env.WEBCHAT_TURN_TIMEOUT_MS ?? String(2 * 6e4));
 }
 function createChatRoutes(deps) {
-  const app68 = new Hono();
-  app68.post("/", async (c) => {
+  const app70 = new Hono();
+  app70.post("/", async (c) => {
     console.log(`[chat-route] entered route=public method=POST`);
     const contentType = c.req.header("content-type") ?? "";
     const account = resolveAccount();
@@ -7550,7 +7550,7 @@ ${result.result.text}` : result.result.text;
       }
     });
   });
-  return app68;
+  return app70;
 }
 
 // app/lib/channel-pty-bridge/admin-session-id.ts
@@ -7584,8 +7584,8 @@ function isLoopbackAddr(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
 function createScheduleInjectRoutes(deps) {
-  const app68 = new Hono();
-  app68.post("/", async (c) => {
+  const app70 = new Hono();
+  app70.post("/", async (c) => {
     const env = c.env;
     const remoteAddr = env?.incoming?.socket?.remoteAddress ?? "";
     if (!isLoopbackAddr(remoteAddr)) {
@@ -7686,7 +7686,7 @@ function createScheduleInjectRoutes(deps) {
     console.error(`${TAG20} op=inject-spawn eventId=${eventId} sessionId=${sessionId} result=ok status=-`);
     return c.json({ ok: true }, 200);
   });
-  return app68;
+  return app70;
 }
 
 // server/index.ts
@@ -8369,8 +8369,8 @@ async function startLogin(opts) {
   await clearAuth(authDir);
   let resolveCode = null;
   let rejectCode = null;
-  const codePromise = new Promise((resolve44, reject) => {
-    resolveCode = resolve44;
+  const codePromise = new Promise((resolve45, reject) => {
+    resolveCode = resolve45;
     rejectCode = reject;
   });
   const codeTimer = setTimeout(
@@ -13578,7 +13578,7 @@ function writeCanonicalOverrideId(accountDir, userId, sessionId) {
 }
 
 // ../lib/models/src/index.ts
-var OPUS_MODEL = "claude-opus-4-8[1m]";
+var OPUS_MODEL = "claude-opus-5[1m]";
 var SONNET_MODEL = "claude-sonnet-5";
 var HAIKU_MODEL = "claude-haiku-4-5";
 var MODEL_CONTEXT_WINDOW = {
@@ -13590,7 +13590,7 @@ function contextWindow(model) {
   return MODEL_CONTEXT_WINDOW[model] ?? 2e5;
 }
 var MODEL_DISPLAY_NAMES = {
-  [OPUS_MODEL]: "Opus 4.8 (1M context)",
+  [OPUS_MODEL]: "Opus 5 (1M context)",
   [SONNET_MODEL]: "Sonnet 5",
   [HAIKU_MODEL]: "Haiku 4.5"
 };
@@ -13993,8 +13993,8 @@ async function reapplyLeversViaManager() {
 var WEBCHAT_SEND_TURN_WINDOW_MS = Number(process.env.WEBCHAT_SEND_TURN_WINDOW_MS ?? String(15e3));
 var sendSeq = 0;
 function createWebchatRoutes(deps) {
-  const app68 = new Hono();
-  app68.post("/send", requireAdminSession, async (c) => {
+  const app70 = new Hono();
+  app70.post("/send", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -14197,7 +14197,7 @@ ${note}` : note;
     if (turnTimer.unref) turnTimer.unref();
     return c.json({ ok: true });
   });
-  app68.post("/interrupt", requireAdminSession, async (c) => {
+  app70.post("/interrupt", requireAdminSession, async (c) => {
     const cacheKey = c.get("cacheKey");
     const requesterUserId = (cacheKey ? getUserIdForSession(cacheKey) : void 0) ?? null;
     const primaryUserId = resolvePrimaryAdminUserId();
@@ -14225,7 +14225,7 @@ ${note}` : note;
     }
     return c.json({ ok: true, stopped: outcome.stopped, intId: outcome.intId, deadChild: outcome.deadChild }, 200);
   });
-  app68.post("/settings", requireAdminSession, async (c) => {
+  app70.post("/settings", requireAdminSession, async (c) => {
     const body = await c.req.json().catch(() => null);
     const op = body?.op;
     const value = body?.value;
@@ -14265,7 +14265,7 @@ ${note}` : note;
     console.log(`[webchat:settings] op=${op} outcome=accepted value=${value} settingsApplied=${settingsApplied}`);
     return c.json({ ok: true, settingsApplied });
   });
-  app68.get("/session", requireAdminSession, async (c) => {
+  app70.get("/session", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -14343,7 +14343,7 @@ ${note}` : note;
     const indicators = await fetchComposerIndicators(sessionId);
     return c.json({ sessionId, projectDir, source, sizeBytes: jsonlSizeBytes(projectDir, sessionId), pendingPermissionPrompt: deps.pendingPromptFor?.(`session:${sessionId}`) ?? null, deliveryFailure: deps.deliveryFailureFor?.(`session:${sessionId}`) ?? null, ...indicators, ...readLevers(account) });
   });
-  app68.post("/permission-verdict", requireAdminSession, async (c) => {
+  app70.post("/permission-verdict", requireAdminSession, async (c) => {
     const body = await c.req.json().catch(() => null);
     const sessionId = body?.sessionId;
     const requestId = body?.request_id;
@@ -14360,7 +14360,7 @@ ${note}` : note;
     const ok = deps.resolvePermissionVerdict?.(`session:${sessionId}`, requestId, behavior) ?? false;
     return c.json({ ok });
   });
-  return app68;
+  return app70;
 }
 
 // server/routes/webchat-greeting.ts
@@ -15716,15 +15716,15 @@ function operatorRoleFor(config, userId) {
 async function buildAccountOptionList(accounts, userId) {
   const houseAccount = accounts.find((a) => a.config.role === "house");
   console.log(`[admin-accounts] op=list count=${accounts.length} house=${houseAccount?.accountId ?? "none"}`);
-  const resolve44 = async (a) => {
+  const resolve45 = async (a) => {
     const businessName = await fetchAccountName(a.accountId) || void 0;
     return { accountId: a.accountId, businessName, role: operatorRoleFor(a.config, userId), isHouse: a.config.role === "house" };
   };
   const houseOptions = await Promise.all(
-    accounts.filter((a) => a.config.role === "house").map(resolve44)
+    accounts.filter((a) => a.config.role === "house").map(resolve45)
   );
   const nonHouseOptions = await Promise.all(
-    accounts.filter((a) => a.config.role !== "house").map(resolve44)
+    accounts.filter((a) => a.config.role !== "house").map(resolve45)
   );
   const sortKey = (o) => (o.businessName || o.accountId).toLowerCase();
   nonHouseOptions.sort((x, y) => {
@@ -16169,36 +16169,175 @@ var session_upload_default = app17;
 // server/routes/admin/agents.ts
 import { resolve as resolve22 } from "path";
 import { readdirSync as readdirSync21, readFileSync as readFileSync32, existsSync as existsSync30, rmSync as rmSync2 } from "fs";
+var SLUG_UNSAFE = (s) => s.includes("/") || s.includes("..") || s.includes("\\");
+function subdirs(dir) {
+  if (!existsSync30(dir)) return [];
+  try {
+    return readdirSync21(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+  } catch {
+    return [];
+  }
+}
+function splitFrontmatter(text) {
+  const m = text.match(/^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/);
+  const fm = {};
+  if (!m) return { fm, body: text };
+  for (const line of m[1].split(/\r?\n/)) {
+    const kv = line.match(/^([A-Za-z][\w-]*):[ \t]*(.*)$/);
+    if (kv) fm[kv[1]] = kv[2].trim().replace(/^["']|["']$/g, "").trim();
+  }
+  return { fm, body: text.slice(m[0].length) };
+}
+function listSpecialists(accountDir) {
+  const pluginsDir = resolve22(accountDir, "plugins");
+  const specialists = [];
+  let specialistsSkipped = 0;
+  for (const plugin of subdirs(pluginsDir).sort()) {
+    const agentsDirP = resolve22(pluginsDir, plugin, "agents");
+    if (!existsSync30(agentsDirP)) continue;
+    let entries;
+    try {
+      entries = readdirSync21(agentsDirP, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
+      try {
+        const { fm } = splitFrontmatter(readFileSync32(resolve22(agentsDirP, entry.name), "utf-8"));
+        if (!fm.name) {
+          specialistsSkipped++;
+          console.error(`[admin/agents] op=list-specialist-skip plugin=${plugin} file=${entry.name}`);
+          continue;
+        }
+        specialists.push({
+          slug: entry.name.replace(/\.md$/, ""),
+          displayName: fm.name,
+          kind: "specialist",
+          plugin,
+          description: fm.description ?? ""
+        });
+      } catch {
+        specialistsSkipped++;
+        console.error(`[admin/agents] op=list-specialist-skip plugin=${plugin} file=${entry.name}`);
+      }
+    }
+  }
+  return { specialists, specialistsSkipped };
+}
+var OWNED_DOCS = [
+  { file: "IDENTITY.md", key: "identity" },
+  { file: "SOUL.md", key: "soul" },
+  { file: "KNOWLEDGE.md", key: "knowledge" },
+  { file: "KNOWLEDGE-SUMMARY.md", key: "knowledgeSummary" }
+];
 var app18 = new Hono();
 app18.get("/", (c) => {
   const account = resolveAccount();
-  if (!account) return c.json({ agents: [] });
-  const agentsDir = resolve22(account.accountDir, "agents");
-  if (!existsSync30(agentsDir)) return c.json({ agents: [] });
+  if (!account) return c.json({ agents: [], skipped: 0, specialistsSkipped: 0 });
   const agents = [];
+  let skipped = 0;
+  const agentsDir = resolve22(account.accountDir, "agents");
+  if (existsSync30(agentsDir)) {
+    try {
+      const entries = readdirSync21(agentsDir, { withFileTypes: true });
+      for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+        if (!entry.isDirectory()) continue;
+        if (entry.name === "admin") continue;
+        const configPath2 = resolve22(agentsDir, entry.name, "config.json");
+        if (!existsSync30(configPath2)) continue;
+        try {
+          const config = JSON.parse(readFileSync32(configPath2, "utf-8"));
+          agents.push({
+            slug: entry.name,
+            displayName: config.displayName ?? entry.name,
+            status: config.status ?? "unknown",
+            kind: "public"
+          });
+        } catch {
+          skipped++;
+          console.error(`[admin/agents] failed to parse config.json for agent "${entry.name}" \u2014 skipping`);
+        }
+      }
+    } catch (err) {
+      console.error(`[admin/agents] failed to scan agents directory: ${err}`);
+    }
+  }
+  const { specialists, specialistsSkipped } = listSpecialists(account.accountDir);
+  console.log(`[admin/agents] op=list agents=${agents.length} specialists=${specialists.length} skipped=${skipped} specialistsSkipped=${specialistsSkipped}`);
+  return c.json({ agents: [...agents, ...specialists], skipped, specialistsSkipped });
+});
+app18.get("/:slug", (c) => {
+  const slug = c.req.param("slug");
+  const account = resolveAccount();
+  if (!account) return c.json({ error: "No account resolved" }, 400);
+  if (SLUG_UNSAFE(slug)) return c.json({ error: "Invalid agent slug" }, 400);
+  const pluginParam = c.req.query("plugin");
+  if (pluginParam) {
+    if (SLUG_UNSAFE(pluginParam)) return c.json({ error: "Invalid plugin" }, 400);
+    const file = resolve22(account.accountDir, "plugins", pluginParam, "agents", `${slug}.md`);
+    if (!existsSync30(file)) return c.json({ error: "Agent not found" }, 404);
+    const { fm, body } = splitFrontmatter(readFileSync32(file, "utf-8"));
+    const skills = subdirs(resolve22(account.accountDir, "plugins", pluginParam, "skills"));
+    console.log(`[admin/agents] op=detail slug=${slug} kind=specialist plugin=${pluginParam}`);
+    return c.json({
+      agent: {
+        kind: "specialist",
+        slug,
+        displayName: fm.name ?? slug,
+        description: fm.description ?? "",
+        summary: fm.summary ?? "",
+        model: fm.model ?? null,
+        tools: fm.tools ? fm.tools.split(",").map((t) => t.trim()).filter(Boolean) : [],
+        systemPrompt: body.trim(),
+        skills
+      }
+    });
+  }
+  const agentDir = resolve22(account.accountDir, "agents", slug);
+  const configPath2 = resolve22(agentDir, "config.json");
+  if (!existsSync30(configPath2)) return c.json({ error: "Agent not found" }, 404);
+  let config;
   try {
-    const entries = readdirSync21(agentsDir, { withFileTypes: true });
-    for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
-      if (!entry.isDirectory()) continue;
-      if (entry.name === "admin") continue;
-      const configPath2 = resolve22(agentsDir, entry.name, "config.json");
-      if (!existsSync30(configPath2)) continue;
-      try {
-        const config = JSON.parse(readFileSync32(configPath2, "utf-8"));
-        agents.push({
-          slug: entry.name,
-          displayName: config.displayName ?? entry.name,
-          status: config.status ?? "unknown"
-        });
-      } catch {
-        console.error(`[admin/agents] failed to parse config.json for agent "${entry.name}" \u2014 skipping`);
+    config = JSON.parse(readFileSync32(configPath2, "utf-8"));
+  } catch {
+    console.error(`[admin/agents] op=detail slug=${slug} error="config.json parse failed"`);
+    return c.json({ error: "Agent config unreadable" }, 500);
+  }
+  const docs = {};
+  const present = {};
+  for (const { file, key } of OWNED_DOCS) {
+    const p = resolve22(agentDir, file);
+    try {
+      if (existsSync30(p)) {
+        docs[key] = readFileSync32(p, "utf-8");
+        present[key] = true;
+      } else {
+        docs[key] = "";
+        present[key] = false;
       }
+    } catch {
+      console.error(`[admin/agents] op=detail slug=${slug} doc=${file} error="read failed, treating as absent"`);
+      docs[key] = "";
+      present[key] = false;
     }
-  } catch (err) {
-    console.error(`[admin/agents] failed to scan agents directory: ${err}`);
-    return c.json({ agents: [] });
   }
-  return c.json({ agents });
+  const found = Object.keys(present).filter((k) => present[k]);
+  console.log(`[admin/agents] op=detail slug=${slug} present=${found.join(",") || "none"}`);
+  return c.json({
+    agent: {
+      slug,
+      displayName: config.displayName ?? slug,
+      status: config.status ?? "unknown",
+      model: config.model ?? null,
+      knowledgeKeywords: config.knowledgeKeywords ?? [],
+      identity: docs.identity,
+      soul: docs.soul,
+      knowledge: docs.knowledge,
+      knowledgeSummary: docs.knowledgeSummary,
+      present
+    }
+  });
 });
 app18.delete("/:slug", async (c) => {
   const slug = c.req.param("slug");
@@ -16207,7 +16346,7 @@ app18.delete("/:slug", async (c) => {
   if (slug === "admin") {
     return c.json({ error: "Cannot delete the admin agent" }, 403);
   }
-  if (slug.includes("/") || slug.includes("..") || slug.includes("\\")) {
+  if (SLUG_UNSAFE(slug)) {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
   const agentDir = resolve22(account.accountDir, "agents", slug);
@@ -16237,7 +16376,7 @@ app18.post("/:slug/project", async (c) => {
   if (slug === "admin") {
     return c.json({ error: "Cannot project the admin agent" }, 403);
   }
-  if (slug.includes("/") || slug.includes("..") || slug.includes("\\")) {
+  if (SLUG_UNSAFE(slug)) {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
   const agentDir = resolve22(account.accountDir, "agents", slug);
@@ -17496,18 +17635,18 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
 ]);
 var app22 = new Hono();
 app22.post("/", async (c) => {
-  const TAG56 = "[admin:events]";
+  const TAG58 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG56} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG58} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS.has(event)) {
-    console.error(`${TAG56} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG58} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -24021,7 +24160,7 @@ function accountDirForSession(cacheKey) {
   const match = listValidAccounts().find((a) => a.accountId === accountId);
   return match ? { accountId, accountDir: match.accountDir } : null;
 }
-function subdirs(dir) {
+function subdirs2(dir) {
   if (!existsSync38(dir)) return [];
   try {
     return readdirSync24(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
@@ -24038,10 +24177,10 @@ app49.get("/", requireAdminSession, async (c) => {
   const pluginsDir = resolve32(acct.accountDir, "plugins");
   const skills = [];
   let pluginCount = 0;
-  for (const plugin of subdirs(pluginsDir)) {
+  for (const plugin of subdirs2(pluginsDir)) {
     pluginCount++;
     const skillsDir = resolve32(pluginsDir, plugin, "skills");
-    for (const skill of subdirs(skillsDir)) {
+    for (const skill of subdirs2(skillsDir)) {
       const skillMd = resolve32(skillsDir, skill, "SKILL.md");
       if (!existsSync38(skillMd)) continue;
       try {
@@ -24101,7 +24240,7 @@ app49.delete("/:plugin/:skill", requireAdminSession, async (c) => {
   }
   try {
     rmSync3(skillDir, { recursive: true, force: true });
-    const pluginDirRemoved = subdirs(skillsDir).length === 0;
+    const pluginDirRemoved = subdirs2(skillsDir).length === 0;
     if (pluginDirRemoved) rmSync3(pluginDir, { recursive: true, force: true });
     const skillDirGone = !existsSync38(skillDir);
     if (!skillDirGone) {
@@ -24162,12 +24301,19 @@ app50.get("/", requireAdminSession, async (c) => {
        // it: a second ASSIGNED_TO edge would fan the row out, duplicating
        // rowKey and double-counting the assignee.
        WITH t, openTe, head(collect(a)) AS assignee
+       // The AdminUser carries no name property (Task 1570); the name lives on
+       // its owned Person. Resolve it here so an assigned task shows a real name
+       // rather than a userId slice (Task 1982).
+       OPTIONAL MATCH (assignee)-[:OWNS]->(ap:Person) WHERE ap.accountId = assignee.accountId
+       WITH t, openTe, assignee, head(collect(ap)) AS assigneePerson
        RETURN t.taskId AS taskId, elementId(t) AS rowKey, t.name AS name, t.clientName AS clientName,
               t.propertyAddress AS propertyAddress, t.fee AS fee, t.status AS status,
               coalesce(t.secondsLogged, 0) AS secondsLogged,
               openTe.startedAt AS runningStartedAt,
               t.createdAt AS createdAt,
-              assignee.userId AS assigneeUserId, assignee.name AS assigneeName
+              assignee.userId AS assigneeUserId,
+              assigneePerson.givenName AS assigneeGivenName,
+              assigneePerson.familyName AS assigneeFamilyName
        ORDER BY t.createdAt DESC`,
       { accountId }
     );
@@ -24192,6 +24338,9 @@ app50.get("/", requireAdminSession, async (c) => {
       if (createdAt === null) missingCreatedAt++;
       const assigneeUserId = rec.get("assigneeUserId") ?? null;
       if (assigneeUserId !== null) assigned++;
+      const assigneeGivenName = rec.get("assigneeGivenName") ?? null;
+      const assigneeFamilyName = rec.get("assigneeFamilyName") ?? null;
+      const assigneeName = assigneeGivenName && assigneeGivenName.trim().length > 0 ? assigneeFamilyName && assigneeFamilyName.trim().length > 0 ? `${assigneeGivenName.trim()} ${assigneeFamilyName.trim()}` : assigneeGivenName.trim() : null;
       const row = {
         taskId,
         rowKey: rec.get("rowKey"),
@@ -24205,7 +24354,7 @@ app50.get("/", requireAdminSession, async (c) => {
         runningStartedAt,
         createdAt,
         assigneeUserId,
-        assigneeName: rec.get("assigneeName") ?? null
+        assigneeName
       };
       if (COMPLETED.has(status)) completed.push(row);
       else if (!HIDDEN_FROM_OPEN.has(status)) open.push(row);
@@ -24487,10 +24636,200 @@ app54.post("/", requireAdminSession, async (c) => {
 });
 var task_time_adjust_default = app54;
 
-// server/routes/admin/activity.ts
-import { readdirSync as readdirSync25 } from "fs";
+// app/lib/admin-roster.ts
+import { existsSync as existsSync39, readdirSync as readdirSync25, readFileSync as readFileSync40 } from "fs";
+import { resolve as resolve33 } from "path";
+function readHouseAdminUserIds(accountsDir = ACCOUNTS_DIR) {
+  let entries;
+  try {
+    entries = readdirSync25(accountsDir);
+  } catch {
+    return [];
+  }
+  for (const entry of entries) {
+    const cfgPath = resolve33(accountsDir, entry, "account.json");
+    if (!existsSync39(cfgPath)) continue;
+    try {
+      const cfg = JSON.parse(readFileSync40(cfgPath, "utf-8"));
+      if (cfg.role !== "house") continue;
+      if (!Array.isArray(cfg.admins)) return [];
+      return cfg.admins.map(
+        (a) => a && typeof a === "object" && typeof a.userId === "string" ? a.userId : null
+      ).filter((u) => u !== null && u.length > 0);
+    } catch {
+    }
+  }
+  return [];
+}
+async function resolveOwnerUserId2(accountId) {
+  const session = getSession();
+  try {
+    const r = await session.run(
+      `MATCH (au:AdminUser {accountId: $accountId, role: 'owner'})
+       RETURN au.userId AS userId ORDER BY au.createdAt ASC LIMIT 1`,
+      { accountId }
+    );
+    return r.records.length > 0 ? r.records[0].get("userId") ?? null : null;
+  } finally {
+    await session.close();
+  }
+}
+async function resolveAllowedAssigneeIds(accountId, accountsDir = ACCOUNTS_DIR) {
+  const houseIds = readHouseAdminUserIds(accountsDir);
+  const ownerId = await resolveOwnerUserId2(accountId);
+  const ids = new Set(houseIds);
+  if (ownerId) ids.add(ownerId);
+  return { ids, ownerId, houseIds };
+}
+async function resolveAssignableAdmins(accountId, accountsDir = ACCOUNTS_DIR) {
+  const { ownerId, houseIds } = await resolveAllowedAssigneeIds(accountId, accountsDir);
+  const candidates = Array.from(/* @__PURE__ */ new Set([...ownerId ? [ownerId] : [], ...houseIds]));
+  if (candidates.length === 0) return [];
+  const session = getSession();
+  try {
+    const r = await session.run(
+      `UNWIND $userIds AS uid
+       MATCH (au:AdminUser {userId: uid})
+       OPTIONAL MATCH (au)-[:OWNS]->(p:Person) WHERE p.accountId = au.accountId
+       RETURN au.userId AS userId, p.givenName AS givenName, p.familyName AS familyName`,
+      { userIds: candidates }
+    );
+    const present = /* @__PURE__ */ new Set();
+    const out = [];
+    for (const rec of r.records) {
+      const userId = rec.get("userId");
+      present.add(userId);
+      const given = rec.get("givenName") ?? null;
+      const family = rec.get("familyName") ?? null;
+      const name = given && given.trim().length > 0 ? family && family.trim().length > 0 ? `${given.trim()} ${family.trim()}` : given.trim() : null;
+      out.push({ userId, name, kind: userId === ownerId ? "owner" : "house-admin" });
+    }
+    const dropped = candidates.filter((u) => !present.has(u));
+    if (dropped.length > 0) {
+      console.error(
+        `[admin-roster] op=roster account=${accountId} dropped-no-adminuser=${dropped.length} ids=${dropped.map((u) => u.slice(0, 8)).join(",")}`
+      );
+    }
+    out.sort((a, b) => {
+      if (a.kind !== b.kind) return a.kind === "owner" ? -1 : 1;
+      return (a.name ?? a.userId).localeCompare(b.name ?? b.userId);
+    });
+    return out;
+  } finally {
+    await session.close();
+  }
+}
+
+// server/routes/admin/task-assign.ts
+var TAG44 = "[task-assign]";
 var app55 = new Hono();
-var TAG44 = "[activity]";
+app55.post("/", requireAdminSession, async (c) => {
+  const cacheKey = c.var.cacheKey;
+  const accountId = getAccountIdForSession(cacheKey);
+  if (!accountId) return c.json({ error: "Account not found for session" }, 401);
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "invalid-json" }, 400);
+  }
+  const taskId = typeof body.taskId === "string" ? body.taskId : "";
+  if (!taskId) {
+    const reason = body.taskId === null ? "null-taskId" : "missing-taskId";
+    console.error(`${TAG44} op=assign rejected reason=${reason} account=${accountId}`);
+    return c.json({ error: "taskId required" }, 400);
+  }
+  const rawAssignee = body.assigneeUserId;
+  if (rawAssignee !== null && rawAssignee !== void 0 && typeof rawAssignee !== "string") {
+    return c.json({ error: "assigneeUserId must be a string or null" }, 400);
+  }
+  const assigneeUserId = typeof rawAssignee === "string" && rawAssignee.length > 0 ? rawAssignee : null;
+  if (assigneeUserId !== null) {
+    const { ids } = await resolveAllowedAssigneeIds(accountId);
+    if (!ids.has(assigneeUserId)) {
+      console.error(
+        `${TAG44} op=assign taskId=${taskId.slice(0, 8)} assigneeUserId=${assigneeUserId.slice(0, 8)} assigned=false source=route reason=not-in-roster`
+      );
+      return c.json({ error: "assignee-not-in-roster" }, 403);
+    }
+  }
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const session = getSession();
+  try {
+    const cleared = await session.run(
+      `MATCH (t:Task {taskId: $taskId, accountId: $accountId})
+       OPTIONAL MATCH (t)-[r:ASSIGNED_TO]->(:AdminUser) DELETE r
+       RETURN t.taskId AS taskId`,
+      { taskId, accountId, now }
+    );
+    if (cleared.records.length === 0) {
+      return c.json({ error: "task-not-found" }, 404);
+    }
+    if (assigneeUserId === null) {
+      await session.run(
+        `MATCH (t:Task {taskId: $taskId, accountId: $accountId}) SET t.updatedAt = $now`,
+        { taskId, accountId, now }
+      );
+      console.log(`${TAG44} op=assign taskId=${taskId.slice(0, 8)} assigneeUserId=none assigned=false source=route`);
+      return c.json({ ok: true, assigneeUserId: null, assigneeName: null });
+    }
+    const set = await session.run(
+      `MATCH (t:Task {taskId: $taskId, accountId: $accountId})
+       MATCH (au:AdminUser {userId: $assigneeUserId})
+       MERGE (t)-[:ASSIGNED_TO]->(au)
+       SET t.updatedAt = $now
+       WITH t, au
+       OPTIONAL MATCH (au)-[:OWNS]->(p:Person) WHERE p.accountId = au.accountId
+       RETURN au.userId AS userId, p.givenName AS givenName, p.familyName AS familyName`,
+      { taskId, accountId, assigneeUserId, now }
+    );
+    if (set.records.length === 0) {
+      console.error(
+        `${TAG44} op=assign taskId=${taskId.slice(0, 8)} assigneeUserId=${assigneeUserId.slice(0, 8)} assigned=false source=route reason=no-adminuser-node`
+      );
+      return c.json({ error: "assignee-no-admin-node" }, 409);
+    }
+    const given = set.records[0].get("givenName") ?? null;
+    const family = set.records[0].get("familyName") ?? null;
+    const assigneeName = given && given.trim().length > 0 ? family && family.trim().length > 0 ? `${given.trim()} ${family.trim()}` : given.trim() : null;
+    console.log(
+      `${TAG44} op=assign taskId=${taskId.slice(0, 8)} assigneeUserId=${assigneeUserId.slice(0, 8)} assigned=true source=route`
+    );
+    return c.json({ ok: true, assigneeUserId, assigneeName });
+  } catch (err) {
+    console.error(`${TAG44} op=assign error="${err instanceof Error ? err.message : String(err)}"`);
+    return c.json({ error: "task-assign-failed" }, 500);
+  } finally {
+    await session.close();
+  }
+});
+var task_assign_default = app55;
+
+// server/routes/admin/admin-users-list.ts
+var TAG45 = "[admin-users]";
+var app56 = new Hono();
+app56.get("/", requireAdminSession, async (c) => {
+  const cacheKey = c.var.cacheKey;
+  const accountId = getAccountIdForSession(cacheKey);
+  if (!accountId) {
+    console.error(`${TAG45} op=list auth-rejected reason="no account for session"`);
+    return c.json({ error: "Account not found for session" }, 401);
+  }
+  try {
+    const users = await resolveAssignableAdmins(accountId);
+    console.log(`${TAG45} op=list account=${accountId} count=${users.length}`);
+    return c.json({ ok: true, users });
+  } catch (err) {
+    console.error(`${TAG45} op=list error="${err instanceof Error ? err.message : String(err)}"`);
+    return c.json({ error: "admin-users-list-failed" }, 500);
+  }
+});
+var admin_users_list_default = app56;
+
+// server/routes/admin/activity.ts
+import { readdirSync as readdirSync26 } from "fs";
+var app57 = new Hono();
+var TAG46 = "[activity]";
 function resolveHouseAccountId(accounts) {
   const houses = accounts.filter((a) => a.config.role === "house");
   if (houses.length === 1) return { accountId: houses[0].accountId, reason: "house" };
@@ -24504,14 +24843,14 @@ function requestToken() {
 var short = (id) => id ? id.slice(0, 8) : "unset";
 function countAccountDirsOnDisk() {
   try {
-    return readdirSync25(ACCOUNTS_DIR, { withFileTypes: true }).filter(
+    return readdirSync26(ACCOUNTS_DIR, { withFileTypes: true }).filter(
       (e) => e.isDirectory() && !e.name.startsWith(".")
     ).length;
   } catch {
     return null;
   }
 }
-app55.get("/", requireAdminSession, async (c) => {
+app57.get("/", requireAdminSession, async (c) => {
   const req = requestToken();
   const cacheKey = c.var.cacheKey;
   const caller2 = getAccountIdForSession(cacheKey) ?? null;
@@ -24519,19 +24858,19 @@ app55.get("/", requireAdminSession, async (c) => {
   const house = resolveHouseAccountId(valid);
   const isHouse = caller2 !== null && house.accountId !== null && caller2 === house.accountId;
   console.log(
-    `${TAG44} op=request req=${req} caller=${short(caller2)} house=${isHouse} houseVia=${house.reason}`
+    `${TAG46} op=request req=${req} caller=${short(caller2)} house=${isHouse} houseVia=${house.reason}`
   );
   if (!isHouse) {
     const reason = house.accountId === null ? house.reason : "not-house";
     console.error(
-      `${TAG44} op=gate req=${req} decision=deny reason=${reason} caller=${short(caller2)} houseAcct=${short(house.accountId)} accounts=${valid.length}`
+      `${TAG46} op=gate req=${req} decision=deny reason=${reason} caller=${short(caller2)} houseAcct=${short(house.accountId)} accounts=${valid.length}`
     );
     return c.json({ error: "house-only" }, 403);
   }
-  console.log(`${TAG44} op=gate req=${req} decision=allow caller=${short(caller2)} via=${house.reason}`);
+  console.log(`${TAG46} op=gate req=${req} decision=allow caller=${short(caller2)} via=${house.reason}`);
   const onDisk = countAccountDirsOnDisk();
   console.log(
-    `${TAG44} op=accounts req=${req} onDisk=${onDisk ?? "unknown"} valid=${valid.length} ids=${valid.map((a) => short(a.accountId)).join(",")}`
+    `${TAG46} op=accounts req=${req} onDisk=${onDisk ?? "unknown"} valid=${valid.length} ids=${valid.map((a) => short(a.accountId)).join(",")}`
   );
   const start = Date.now();
   let res;
@@ -24547,17 +24886,17 @@ app55.get("/", requireAdminSession, async (c) => {
     });
   } catch (err) {
     console.error(
-      `${TAG44} op=manager-fail req=${req} reason=unreachable err=${err instanceof Error ? err.message : String(err)}`
+      `${TAG46} op=manager-fail req=${req} reason=unreachable err=${err instanceof Error ? err.message : String(err)}`
     );
     return c.json({ error: "manager-unreachable" }, 502);
   }
   if (res.status !== 200) {
-    console.error(`${TAG44} op=manager-fail req=${req} reason=status status=${res.status}`);
+    console.error(`${TAG46} op=manager-fail req=${req} reason=status status=${res.status}`);
     return c.json({ error: `manager-status-${res.status}` }, 502);
   }
   const body = await res.json().catch(() => null);
   if (!body || !Array.isArray(body.rows)) {
-    console.error(`${TAG44} op=manager-fail req=${req} reason=bad-json`);
+    console.error(`${TAG46} op=manager-fail req=${req} reason=bad-json`);
     return c.json({ error: "manager-bad-json" }, 502);
   }
   const rows = body.rows;
@@ -24568,10 +24907,10 @@ app55.get("/", requireAdminSession, async (c) => {
   const ageNull = rows.filter((r) => r.ageMs === null).length;
   const sidecarNull = rows.filter((r) => r.sidecarMissing).length;
   console.log(
-    `${TAG44} op=census req=${req} ageMs=${censusAgeMs ?? "none"} live=${census?.live ?? "none"} cpuNull=${census?.cpuNull ?? "none"} rows=${rows.length} ageNull=${ageNull} sidecarNull=${sidecarNull}`
+    `${TAG46} op=census req=${req} ageMs=${censusAgeMs ?? "none"} live=${census?.live ?? "none"} cpuNull=${census?.cpuNull ?? "none"} rows=${rows.length} ageNull=${ageNull} sidecarNull=${sidecarNull}`
   );
   console.log(
-    `${TAG44} op=response req=${req} rows=${rows.length} accounts=${valid.length} untagged=${untaggedCount} meteringFailed=${meteringFailed} ms=${Date.now() - start}`
+    `${TAG46} op=response req=${req} rows=${rows.length} accounts=${valid.length} untagged=${untaggedCount} meteringFailed=${meteringFailed} ms=${Date.now() - start}`
   );
   const names = {};
   await Promise.all(
@@ -24590,7 +24929,7 @@ app55.get("/", requireAdminSession, async (c) => {
     return acc;
   }, {});
   console.log(
-    `${TAG44} op=loops req=${req} armed=${armed2} rendered=${loopRows.length} procPct=${cpu.processPct?.toFixed(1) ?? "null"} attributedPct=${cpu.attributedPct?.toFixed(1) ?? "null"} ` + Object.entries(byState).map(([s, n]) => `${s}=${n}`).join(" ")
+    `${TAG46} op=loops req=${req} armed=${armed2} rendered=${loopRows.length} procPct=${cpu.processPct?.toFixed(1) ?? "null"} attributedPct=${cpu.attributedPct?.toFixed(1) ?? "null"} ` + Object.entries(byState).map(([s, n]) => `${s}=${n}`).join(" ")
   );
   return c.json({
     rows,
@@ -24620,63 +24959,65 @@ app55.get("/", requireAdminSession, async (c) => {
     }
   });
 });
-var activity_default = app55;
+var activity_default = app57;
 
 // server/routes/admin/index.ts
-var app56 = new Hono();
-app56.route("/session", session_default);
-app56.route("/accounts", accounts_default);
-app56.route("/logs", logs_default);
-app56.route("/claude-info", claude_info_default);
-app56.route("/attachment", attachment_default);
-app56.route("/session-upload", session_upload_default);
-app56.route("/agents", agents_default);
-app56.route("/sessions", sessions_default);
-app56.route("/claude-sessions", claude_sessions_default);
-app56.route("/log-ingest", log_ingest_default);
-app56.route("/events", events_default);
-app56.route("/files", files_default);
-app56.route("/graph-search", graph_search_default);
-app56.route("/graph-subgraph", graph_subgraph_default);
-app56.route("/graph-delete", graph_delete_default);
-app56.route("/graph-restore", graph_restore_default);
-app56.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app56.route("/graph-default-view", graph_default_view_default);
-app56.route("/sidebar-artefacts", sidebar_artefacts_default);
-app56.route("/sidebar-sessions", sidebar_sessions_default);
-app56.route("/session-delete", session_delete_default);
-app56.route("/session-stop", session_stop_default);
-app56.route("/session-archive", session_archive_default);
-app56.route("/session-rename", session_rename_default);
-app56.route("/session-usage", session_usage_default);
-app56.route("/browser", browser_default);
-app56.route("/session-rc-spawn", session_rc_spawn_default);
-app56.route("/session-reseat", session_reseat_default);
-app56.route("/system-stats", system_stats_default);
-app56.route("/health-brand", health_default2);
-app56.route("/linkedin-ingest", linkedin_ingest_default);
-app56.route("/post-turn-context", post_turn_context_default);
-app56.route("/public-session-context", public_session_context_default);
-app56.route("/public-session-exit", public_session_exit_default);
-app56.route("/access-session-evict", access_session_evict_default);
-app56.route("/enrol-person", enrol_person_default);
-app56.route("/calendar", calendar_default);
-app56.route("/routines", routines_default);
-app56.route("/skills", skills_default);
-app56.route("/tasks-list", tasks_list_default);
-app56.route("/task-timer-start", task_timer_start_default);
-app56.route("/task-timer-stop", task_timer_stop_default);
-app56.route("/task-complete", task_complete_default);
-app56.route("/task-time-adjust", task_time_adjust_default);
-app56.route("/activity", activity_default);
-var admin_default = app56;
+var app58 = new Hono();
+app58.route("/session", session_default);
+app58.route("/accounts", accounts_default);
+app58.route("/logs", logs_default);
+app58.route("/claude-info", claude_info_default);
+app58.route("/attachment", attachment_default);
+app58.route("/session-upload", session_upload_default);
+app58.route("/agents", agents_default);
+app58.route("/sessions", sessions_default);
+app58.route("/claude-sessions", claude_sessions_default);
+app58.route("/log-ingest", log_ingest_default);
+app58.route("/events", events_default);
+app58.route("/files", files_default);
+app58.route("/graph-search", graph_search_default);
+app58.route("/graph-subgraph", graph_subgraph_default);
+app58.route("/graph-delete", graph_delete_default);
+app58.route("/graph-restore", graph_restore_default);
+app58.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app58.route("/graph-default-view", graph_default_view_default);
+app58.route("/sidebar-artefacts", sidebar_artefacts_default);
+app58.route("/sidebar-sessions", sidebar_sessions_default);
+app58.route("/session-delete", session_delete_default);
+app58.route("/session-stop", session_stop_default);
+app58.route("/session-archive", session_archive_default);
+app58.route("/session-rename", session_rename_default);
+app58.route("/session-usage", session_usage_default);
+app58.route("/browser", browser_default);
+app58.route("/session-rc-spawn", session_rc_spawn_default);
+app58.route("/session-reseat", session_reseat_default);
+app58.route("/system-stats", system_stats_default);
+app58.route("/health-brand", health_default2);
+app58.route("/linkedin-ingest", linkedin_ingest_default);
+app58.route("/post-turn-context", post_turn_context_default);
+app58.route("/public-session-context", public_session_context_default);
+app58.route("/public-session-exit", public_session_exit_default);
+app58.route("/access-session-evict", access_session_evict_default);
+app58.route("/enrol-person", enrol_person_default);
+app58.route("/calendar", calendar_default);
+app58.route("/routines", routines_default);
+app58.route("/skills", skills_default);
+app58.route("/tasks-list", tasks_list_default);
+app58.route("/task-timer-start", task_timer_start_default);
+app58.route("/task-timer-stop", task_timer_stop_default);
+app58.route("/task-complete", task_complete_default);
+app58.route("/task-time-adjust", task_time_adjust_default);
+app58.route("/task-assign", task_assign_default);
+app58.route("/admin-users-list", admin_users_list_default);
+app58.route("/activity", activity_default);
+var admin_default = app58;
 
 // server/routes/access/verify-token.ts
-var TAG45 = "[access-verify]";
+var TAG47 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
-var app57 = new Hono();
-app57.post("/", async (c) => {
+var app59 = new Hono();
+app59.post("/", async (c) => {
   const ip = c.var.clientIp || "unknown";
   let body;
   try {
@@ -24691,39 +25032,39 @@ app57.post("/", async (c) => {
   }
   const rateMsg = checkAccessRateLimit(ip, agentSlug);
   if (rateMsg) {
-    console.error(`${TAG45} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
+    console.error(`${TAG47} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
     return c.json({ error: rateMsg }, 429);
   }
   const grant = await findGrantByMagicToken(token);
   if (!grant) {
     recordAccessFailedAttempt(ip, agentSlug);
-    console.error(`${TAG45} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
+    console.error(`${TAG47} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.agentSlug !== agentSlug) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG45} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
+      `${TAG47} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
     );
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.status === "expired" || grant.status === "revoked") {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG45} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
+      `${TAG47} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (grant.expiresAt !== null && grant.expiresAt < Date.now()) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG45} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
+      `${TAG47} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (!grant.sliceToken) {
     console.error(
-      `${TAG45} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
+      `${TAG47} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
     );
     return c.json({ error: "grant-misconfigured" }, 500);
   }
@@ -24739,12 +25080,12 @@ app57.post("/", async (c) => {
     await consumeMagicTokenAndActivate(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG45} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG47} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ error: "verification-failed" }, 500);
   }
   clearAccessRateLimit(ip, agentSlug);
-  console.log(`${TAG45} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
+  console.log(`${TAG47} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
   console.log(
     `${MINT_TAG} grantId=${grant.grantId} sliceToken=${grant.sliceToken.slice(0, 8)} agentSlug=${agentSlug} personId=${grant.personId ?? "none"}`
   );
@@ -24758,13 +25099,13 @@ app57.post("/", async (c) => {
     displayName: grant.displayName
   });
 });
-var verify_token_default = app57;
+var verify_token_default = app59;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
-import { resolve as resolve33 } from "path";
-var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve33(process.cwd(), "..");
-var SEND_SCRIPT = resolve33(
+import { resolve as resolve34 } from "path";
+var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve34(process.cwd(), "..");
+var SEND_SCRIPT = resolve34(
   PLATFORM_ROOT7,
   "plugins",
   "email",
@@ -24820,10 +25161,10 @@ async function sendMagicLinkEmail(payload) {
 }
 
 // server/routes/access/request-magic-link.ts
-var TAG46 = "[access-request-link]";
-var app58 = new Hono();
+var TAG48 = "[access-request-link]";
+var app60 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
-app58.post("/", async (c) => {
+app60.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -24837,18 +25178,18 @@ app58.post("/", async (c) => {
   }
   const rateMsg = checkRequestLinkRateLimit(contactValue);
   if (rateMsg) {
-    console.error(`${TAG46} contactValue=${maskContact(contactValue)} result=rate-limited`);
+    console.error(`${TAG48} contactValue=${maskContact(contactValue)} result=rate-limited`);
     return c.json({ error: rateMsg }, 429);
   }
   recordRequestLinkAttempt(contactValue);
   const accountId = process.env.ACCOUNT_ID ?? "";
   if (!accountId) {
-    console.error(`${TAG46} contactValue=${maskContact(contactValue)} result=no-account-id`);
+    console.error(`${TAG48} contactValue=${maskContact(contactValue)} result=no-account-id`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   const grant = await findActiveGrantByContact(contactValue, agentSlug, accountId);
   if (!grant) {
-    console.log(`${TAG46} contactValue=${maskContact(contactValue)} result=notfound`);
+    console.log(`${TAG48} contactValue=${maskContact(contactValue)} result=notfound`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   let token;
@@ -24856,7 +25197,7 @@ app58.post("/", async (c) => {
     token = await generateNewMagicToken(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG46} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG48} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
@@ -24888,26 +25229,26 @@ app58.post("/", async (c) => {
   });
   if (!sendResult.ok) {
     console.error(
-      `${TAG46} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
+      `${TAG48} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   console.log(
-    `${TAG46} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
+    `${TAG48} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
-var request_magic_link_default = app58;
+var request_magic_link_default = app60;
 
 // server/routes/access/index.ts
-var app59 = new Hono();
-app59.route("/verify-token", verify_token_default);
-app59.route("/request-magic-link", request_magic_link_default);
-var access_default = app59;
+var app61 = new Hono();
+app61.route("/verify-token", verify_token_default);
+app61.route("/request-magic-link", request_magic_link_default);
+var access_default = app61;
 
 // server/routes/sites.ts
-import { existsSync as existsSync39, readFileSync as readFileSync40, realpathSync as realpathSync8, statSync as statSync17 } from "fs";
-import { resolve as resolve34 } from "path";
+import { existsSync as existsSync40, readFileSync as readFileSync41, realpathSync as realpathSync8, statSync as statSync17 } from "fs";
+import { resolve as resolve35 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
   ".html": "text/html; charset=utf-8",
@@ -24938,8 +25279,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app60 = new Hono();
-app60.get("/:rel{.*}", (c) => {
+var app62 = new Hono();
+app62.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -24964,15 +25305,15 @@ app60.get("/:rel{.*}", (c) => {
     }
     segments.push(seg);
   }
-  const rootDir = resolve34(account.accountDir, "sites");
-  let filePath = segments.length === 0 ? rootDir : resolve34(rootDir, ...segments);
+  const rootDir = resolve35(account.accountDir, "sites");
+  let filePath = segments.length === 0 ? rootDir : resolve35(rootDir, ...segments);
   if (filePath !== rootDir && !filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
   let stat11;
   try {
-    stat11 = existsSync39(filePath) ? statSync17(filePath) : null;
+    stat11 = existsSync40(filePath) ? statSync17(filePath) : null;
   } catch {
     stat11 = null;
   }
@@ -24985,13 +25326,13 @@ app60.get("/:rel{.*}", (c) => {
     return c.redirect(target, 301);
   }
   if (stat11?.isDirectory()) {
-    filePath = resolve34(filePath, "index.html");
+    filePath = resolve35(filePath, "index.html");
   }
   if (!filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync39(filePath)) {
+  if (!existsSync40(filePath)) {
     console.error(`[sites] not-found path=${reqPath} status=404`);
     return c.text("Not found", 404);
   }
@@ -25010,7 +25351,7 @@ app60.get("/:rel{.*}", (c) => {
   }
   let body;
   try {
-    body = readFileSync40(realPath);
+    body = readFileSync41(realPath);
   } catch (err) {
     const code = err?.code;
     if (code === "EISDIR") {
@@ -25042,11 +25383,11 @@ app60.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app60;
+var sites_default = app62;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
-import { mkdirSync as mkdirSync8, readFileSync as readFileSync41, writeFileSync as writeFileSync14 } from "fs";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync42, writeFileSync as writeFileSync14 } from "fs";
 import { dirname as dirname14 } from "path";
 var TOKEN_PREFIX = "v1.";
 var SECRET_BYTES = 32;
@@ -25055,7 +25396,7 @@ var cachedSecret = null;
 function getSecret() {
   if (cachedSecret) return cachedSecret;
   try {
-    const hex2 = readFileSync41(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+    const hex2 = readFileSync42(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
     if (hex2.length === SECRET_BYTES * 2) {
       cachedSecret = Buffer.from(hex2, "hex");
       return cachedSecret;
@@ -25069,7 +25410,7 @@ function getSecret() {
     console.log(`[visitor-token] secret minted path=${VISITOR_TOKEN_SECRET_FILE}`);
   } catch {
   }
-  const hex = readFileSync41(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+  const hex = readFileSync42(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
   cachedSecret = Buffer.from(hex, "hex");
   return cachedSecret;
 }
@@ -25122,7 +25463,7 @@ var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync40, readFileSync as readFileSync42 } from "fs";
+import { existsSync as existsSync41, readFileSync as readFileSync43 } from "fs";
 import { join as join43 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
@@ -25132,9 +25473,9 @@ function readBrandConfig() {
   const platformRoot5 = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot5) return null;
   const brandPath = join43(platformRoot5, "config", "brand.json");
-  if (!existsSync40(brandPath)) return null;
+  if (!existsSync41(brandPath)) return null;
   try {
-    cached2 = JSON.parse(readFileSync42(brandPath, "utf-8"));
+    cached2 = JSON.parse(readFileSync43(brandPath, "utf-8"));
     return cached2;
   } catch {
     return null;
@@ -25142,7 +25483,7 @@ function readBrandConfig() {
 }
 
 // server/routes/visitor-consent.ts
-var app61 = new Hono();
+var app63 = new Hono();
 var CONSENT_COOKIE_NAME = "mxy_consent";
 var CONSENT_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
 var DEFAULT_CONSENT_COPY = {
@@ -25187,17 +25528,17 @@ function siteSlugFromReferer(referer) {
     return "";
   }
 }
-app61.options("/consent", (c) => {
+app63.options("/consent", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app61.options("/brand-config", (c) => {
+app63.options("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app61.post("/consent", async (c) => {
+app63.post("/consent", async (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   let raw;
@@ -25237,7 +25578,7 @@ app61.post("/consent", async (c) => {
   console.log(`[consent] ${parsed.decision} site=${site} brand=${brandName} tokenBound=${tokenBound}`);
   return c.body(null, 204);
 });
-app61.get("/brand-config", (c) => {
+app63.get("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   const brand = readBrandConfig();
@@ -25247,7 +25588,7 @@ app61.get("/brand-config", (c) => {
   c.header("Cache-Control", "public, max-age=300");
   return c.json({ consent: { copy, palette } });
 });
-var visitor_consent_default = app61;
+var visitor_consent_default = app63;
 
 // server/routes/listings.ts
 function getCookie(headerValue, name) {
@@ -25274,8 +25615,8 @@ function appendConsentParams(pageUrl, token) {
 }
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
 var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
-var app62 = new Hono();
-app62.get("/:slug/click", async (c) => {
+var app64 = new Hono();
+app64.get("/:slug/click", async (c) => {
   const slug = c.req.param("slug") ?? "";
   const rawSession = c.req.query("session") ?? "";
   const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
@@ -25339,10 +25680,10 @@ app62.get("/:slug/click", async (c) => {
   console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} consent=${consentCookie ?? "absent"} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
   return c.redirect(redirectUrl, 302);
 });
-var listings_default = app62;
+var listings_default = app64;
 
 // server/routes/visitor-event.ts
-var app63 = new Hono();
+var app65 = new Hono();
 var BOT_UA_RE = /\b(bot|crawl|spider|slurp|headlesschrome|phantomjs|googlebot|bingbot|yandex|baiduspider|ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)\b/i;
 var buckets = /* @__PURE__ */ new Map();
 var RATE_LIMIT = 60;
@@ -25418,12 +25759,12 @@ function originAllowed(origin, allowlist) {
     return false;
   }
 }
-app63.options("/event", (c) => {
+app65.options("/event", (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   return c.body(null, 204);
 });
-app63.post("/event", async (c) => {
+app65.post("/event", async (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   const ua = c.req.header("user-agent") ?? "";
@@ -25628,17 +25969,17 @@ async function writeEvent(opts) {
     );
   }
 }
-var visitor_event_default = app63;
+var visitor_event_default = app65;
 
 // server/routes/session.ts
-import { resolve as resolve35 } from "path";
-import { existsSync as existsSync41, writeFileSync as writeFileSync15, mkdirSync as mkdirSync9 } from "fs";
+import { resolve as resolve36 } from "path";
+import { existsSync as existsSync42, writeFileSync as writeFileSync15, mkdirSync as mkdirSync9 } from "fs";
 var UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function writeBrandingCache(accountId, agentSlug, branding) {
   try {
-    const cacheDir = resolve35(MAXY_DIR, "branding-cache", accountId);
+    const cacheDir = resolve36(MAXY_DIR, "branding-cache", accountId);
     mkdirSync9(cacheDir, { recursive: true });
-    writeFileSync15(resolve35(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
+    writeFileSync15(resolve36(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
   } catch (err) {
     console.error(`[branding] cache write failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -25674,8 +26015,8 @@ function withVisitorCookie(response, visitorId) {
     headers
   });
 }
-var app64 = new Hono();
-app64.post("/", async (c) => {
+var app66 = new Hono();
+app66.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -25715,8 +26056,8 @@ app64.post("/", async (c) => {
   }
   let agentConfig = null;
   if (account) {
-    const agentDir = resolve35(account.accountDir, "agents", agentSlug);
-    if (!existsSync41(agentDir) || !existsSync41(resolve35(agentDir, "config.json"))) {
+    const agentDir = resolve36(account.accountDir, "agents", agentSlug);
+    if (!existsSync42(agentDir) || !existsSync42(resolve36(agentDir, "config.json"))) {
       return c.json({ error: "Agent not found" }, 404);
     }
     agentConfig = resolveAgentConfig(account.accountDir, agentSlug);
@@ -25822,7 +26163,7 @@ app64.post("/", async (c) => {
     newVisitorId
   );
 });
-var session_default2 = app64;
+var session_default2 = app66;
 
 // server/lib/calendar-slots.ts
 var WEEKDAYS = ["sun", "mon", "tue", "wed", "thu", "fri", "sat"];
@@ -25905,17 +26246,17 @@ function computeOpenSlots(config, busy, fromISO, toISO) {
 }
 
 // server/routes/calendar-public.ts
-var app65 = new Hono();
+var app67 = new Hono();
 function setCors(c) {
   c.header("Access-Control-Allow-Origin", "*");
   c.header("Access-Control-Allow-Methods", "GET, OPTIONS");
   c.header("Access-Control-Allow-Headers", "content-type");
 }
-app65.options("/free-busy", (c) => {
+app67.options("/free-busy", (c) => {
   setCors(c);
   return c.body(null, 204);
 });
-app65.get("/free-busy", async (c) => {
+app67.get("/free-busy", async (c) => {
   setCors(c);
   const from = c.req.query("from");
   const to = c.req.query("to");
@@ -25971,15 +26312,15 @@ app65.get("/free-busy", async (c) => {
     await session.close();
   }
 });
-var calendar_public_default = app65;
+var calendar_public_default = app67;
 
 // server/routes/portal-fetch.ts
 import { createReadStream as createReadStream3 } from "fs";
 import { stat as stat8, readFile as readFile9, realpath } from "fs/promises";
-import { join as join44, resolve as resolve36, sep as sep10 } from "path";
+import { join as join44, resolve as resolve37, sep as sep10 } from "path";
 import { Readable as Readable3 } from "stream";
-var app66 = new Hono();
-var TAG47 = "[portal-fetch]";
+var app68 = new Hono();
+var TAG49 = "[portal-fetch]";
 async function verifySignature(secret, accountId, relPath, expiresAtMs, signature, nowMs) {
   if (!secret || !signature) return false;
   if (!Number.isFinite(expiresAtMs) || expiresAtMs <= nowMs) return false;
@@ -26029,19 +26370,19 @@ ${expiresAtMs}`)
   return diff === 0;
 }
 async function readAccountSecret(accountId) {
-  const path3 = resolve36(DATA_ROOT, "accounts", accountId, "secrets", "data-portal.env");
+  const path3 = resolve37(DATA_ROOT, "accounts", accountId, "secrets", "data-portal.env");
   let text;
   try {
     text = await readFile9(path3, "utf8");
   } catch {
-    console.error(`${TAG47} op=no-secret account="${accountId}" path="${path3}"`);
+    console.error(`${TAG49} op=no-secret account="${accountId}" path="${path3}"`);
     return "";
   }
   for (const line of text.split("\n")) {
     const m = line.match(/^PORTAL_FETCH_SECRET=(.*)$/);
     if (m) return m[1].trim();
   }
-  console.error(`${TAG47} op=no-secret account="${accountId}" reason=key-absent path="${path3}"`);
+  console.error(`${TAG49} op=no-secret account="${accountId}" reason=key-absent path="${path3}"`);
   return "";
 }
 function isValidAccountId2(value) {
@@ -26065,7 +26406,7 @@ async function resolveFetchTarget(accountDir, relPath, ownerId) {
   const exposeFolders = await readExposeFolders2(accountDir);
   const { exposed } = resolveExposedDirs(schemaText, exposeFolders);
   if (exposed.length === 0 && !ownerId) return { ok: false, reason: "not-exposed" };
-  const lexical = resolve36(accountDir, relPath);
+  const lexical = resolve37(accountDir, relPath);
   let root;
   let absolute;
   try {
@@ -26101,33 +26442,33 @@ async function handle(c, headOnly) {
   const sig = c.req.query("sig") ?? "";
   const owner = c.req.query("owner") ?? "";
   console.log(
-    `${TAG47} op=request account=${q(accountId)} path=${q(relPath)} owner=${q(owner)} head=${headOnly}`
+    `${TAG49} op=request account=${q(accountId)} path=${q(relPath)} owner=${q(owner)} head=${headOnly}`
   );
   if (!isValidAccountId2(accountId)) {
-    console.error(`${TAG47} op=denied account=${q(accountId)} reason=account-id`);
+    console.error(`${TAG49} op=denied account=${q(accountId)} reason=account-id`);
     return c.json({ ok: false, error: "denied" }, 401);
   }
   const secret = await readAccountSecret(accountId);
   const verified = owner ? await verifyOwnUploadSignature(secret, accountId, owner, relPath, exp, sig, Date.now()) : await verifySignature(secret, accountId, relPath, exp, sig, Date.now());
   if (!verified) {
-    console.error(`${TAG47} op=denied account=${q(accountId)} reason=secret`);
+    console.error(`${TAG49} op=denied account=${q(accountId)} reason=secret`);
     return c.json({ ok: false, error: "denied" }, 401);
   }
   const target = await resolveFetchTarget(
-    resolve36(DATA_ROOT, "accounts", accountId),
+    resolve37(DATA_ROOT, "accounts", accountId),
     relPath,
     owner || void 0
   );
   if (!target.ok) {
     const op = target.reason === "enoent" ? "miss" : "denied";
-    console.error(`${TAG47} op=${op} account=${accountId} reason=${target.reason}`);
+    console.error(`${TAG49} op=${op} account=${accountId} reason=${target.reason}`);
     return c.json({ ok: false, error: "not found" }, 404);
   }
   if (headOnly) {
-    console.log(`${TAG47} op=served account=${accountId} bytes=${target.sizeBytes} head=true`);
+    console.log(`${TAG49} op=served account=${accountId} bytes=${target.sizeBytes} head=true`);
     return c.body(null, 200);
   }
-  console.log(`${TAG47} op=served account=${accountId} bytes=${target.sizeBytes}`);
+  console.log(`${TAG49} op=served account=${accountId} bytes=${target.sizeBytes}`);
   return new Response(Readable3.toWeb(createReadStream3(target.absolute)), {
     status: 200,
     headers: {
@@ -26141,12 +26482,12 @@ async function handle(c, headOnly) {
     }
   });
 }
-app66.get("/fetch", (c) => handle(c, false));
-app66.on("HEAD", "/fetch", (c) => handle(c, true));
-var portal_fetch_default = app66;
+app68.get("/fetch", (c) => handle(c, false));
+app68.on("HEAD", "/fetch", (c) => handle(c, true));
+var portal_fetch_default = app68;
 
 // app/lib/timeentry-census.ts
-var TAG48 = "[timeentry-census]";
+var TAG50 = "[timeentry-census]";
 function reconcileTimeEntries(rows, now, horizonMs) {
   const openEntries = rows.openEntries.length;
   let oldestOpenAgeMs = 0;
@@ -26186,12 +26527,12 @@ async function runTimeEntryCensusOnce(session, now, horizonMs) {
       sumAdjustments: toNum(r.get("sumAdjustments"))
     }));
     const finding = reconcileTimeEntries({ openEntries, taskSums }, now, horizonMs);
-    const line = `${TAG48} openEntries=${finding.openEntries} oldestOpenAgeMin=${finding.oldestOpenAgeMin} maxOpenPerAccount=${finding.maxOpenPerAccount} driftTasks=${finding.driftTasks}`;
+    const line = `${TAG50} openEntries=${finding.openEntries} oldestOpenAgeMin=${finding.oldestOpenAgeMin} maxOpenPerAccount=${finding.maxOpenPerAccount} driftTasks=${finding.driftTasks}`;
     if (finding.alarm) console.error(`${line} alarm=true`);
     else console.log(line);
     return finding;
   } catch (err) {
-    console.error(`${TAG48} error="${err instanceof Error ? err.message : String(err)}"`);
+    console.error(`${TAG50} error="${err instanceof Error ? err.message : String(err)}"`);
     return null;
   }
 }
@@ -26205,13 +26546,13 @@ function startTimeEntryCensus(openSession, opts = {}) {
     try {
       session = openSession();
     } catch (err) {
-      console.error(`${TAG48} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`);
+      console.error(`${TAG50} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`);
       return;
     }
     try {
       await runTimeEntryCensusOnce(session, Date.now(), horizonMs);
     } catch (err) {
-      console.error(`${TAG48} tick-failed error="${err instanceof Error ? err.message : String(err)}"`);
+      console.error(`${TAG50} tick-failed error="${err instanceof Error ? err.message : String(err)}"`);
     } finally {
       try {
         await session.close();
@@ -26228,7 +26569,7 @@ function startTimeEntryCensus(openSession, opts = {}) {
 }
 
 // app/lib/ledger-census.ts
-import { readdirSync as readdirSync26, readFileSync as readFileSync43, statSync as statSync18 } from "fs";
+import { readdirSync as readdirSync27, readFileSync as readFileSync44, statSync as statSync18 } from "fs";
 import { join as join45 } from "path";
 
 // ../lib/ledger-core/dist/reconcile.js
@@ -26272,12 +26613,12 @@ function formatCensusLine(f) {
 }
 
 // app/lib/ledger-census.ts
-var TAG49 = "[ledger-census]";
+var TAG51 = "[ledger-census]";
 var DAY_MS = 864e5;
 function countWriteRejects24h(logDir, now) {
   let entries;
   try {
-    entries = readdirSync26(logDir).filter((f) => f.startsWith("mcp-ledger-") && f.endsWith(".log"));
+    entries = readdirSync27(logDir).filter((f) => f.startsWith("mcp-ledger-") && f.endsWith(".log"));
   } catch {
     return 0;
   }
@@ -26286,7 +26627,7 @@ function countWriteRejects24h(logDir, now) {
     const path3 = join45(logDir, name);
     try {
       if (now - statSync18(path3).mtimeMs > DAY_MS) continue;
-      for (const line of readFileSync43(path3, "utf8").split("\n")) {
+      for (const line of readFileSync44(path3, "utf8").split("\n")) {
         if (line.includes("[graph-write] reject")) total += 1;
       }
     } catch {
@@ -26348,7 +26689,7 @@ async function runLedgerCensusOnce(session, now) {
     else console.log(line);
     return finding;
   } catch (err) {
-    console.error(`${TAG49} error="${err instanceof Error ? err.message : String(err)}"`);
+    console.error(`${TAG51} error="${err instanceof Error ? err.message : String(err)}"`);
     return null;
   }
 }
@@ -26361,7 +26702,7 @@ function startLedgerCensus(openSession, opts = {}) {
       session = openSession();
     } catch (err) {
       console.error(
-        `${TAG49} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`
+        `${TAG51} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`
       );
       return;
     }
@@ -26369,7 +26710,7 @@ function startLedgerCensus(openSession, opts = {}) {
       await runLedgerCensusOnce(session, Date.now());
     } catch (err) {
       console.error(
-        `${TAG49} tick-failed error="${err instanceof Error ? err.message : String(err)}"`
+        `${TAG51} tick-failed error="${err instanceof Error ? err.message : String(err)}"`
       );
     } finally {
       try {
@@ -26387,7 +26728,7 @@ function startLedgerCensus(openSession, opts = {}) {
 }
 
 // app/lib/conversation-audit.ts
-var TAG50 = "[conversation-audit]";
+var TAG52 = "[conversation-audit]";
 async function runConversationAudit() {
   const session = getSession();
   try {
@@ -26424,12 +26765,12 @@ async function runConversationAudit() {
       multiAnchored: Number(multiRec?.get("multiAnchored") ?? 0)
     };
     console.error(
-      `${TAG50} channel=whatsapp total=${result.total} senders=${result.senders} multiAnchored=${result.multiAnchored} unreconciled=${result.unreconciled} unpairable=${result.unpairable}`
+      `${TAG52} channel=whatsapp total=${result.total} senders=${result.senders} multiAnchored=${result.multiAnchored} unreconciled=${result.unreconciled} unpairable=${result.unpairable}`
     );
     return result;
   } catch (err) {
     const reason = err instanceof Error ? `${err.name}:${err.message.slice(0, 200)}` : String(err).slice(0, 200);
-    console.error(`${TAG50} op=failed reason=${reason}`);
+    console.error(`${TAG52} op=failed reason=${reason}`);
     return null;
   } finally {
     await session.close();
@@ -26555,7 +26896,7 @@ function startGraphHealthTimer() {
 
 // app/lib/file-watcher.ts
 import * as fsp2 from "fs/promises";
-import { resolve as resolve37, sep as sep11 } from "path";
+import { resolve as resolve38, sep as sep11 } from "path";
 var ACCOUNT_UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var DEFAULT_COALESCE_MS = 500;
 var ROOTS = ["accounts"];
@@ -26574,7 +26915,7 @@ async function startFileWatcher(opts = {}) {
   const dropFn = opts.drop ?? dropFileIndex;
   for (const r of ROOTS) {
     try {
-      await fsp2.mkdir(resolve37(dataRoot, r), { recursive: true });
+      await fsp2.mkdir(resolve38(dataRoot, r), { recursive: true });
     } catch (err) {
       console.error(
         `[file-watcher] start-failed root="${r}" err="${err.message}" \u2014 index will be maintained by the 5-min reconcile backstop only`
@@ -26595,7 +26936,7 @@ async function startFileWatcher(opts = {}) {
     timers.set(relativePath, t);
   }
   async function runHook(relativePath, accountId) {
-    const absolute = resolve37(dataRoot, relativePath);
+    const absolute = resolve38(dataRoot, relativePath);
     let exists = false;
     try {
       const st = await fsp2.stat(absolute);
@@ -26619,7 +26960,7 @@ async function startFileWatcher(opts = {}) {
     }
   }
   async function watchRoot(rootName) {
-    const absRoot = resolve37(dataRoot, rootName);
+    const absRoot = resolve38(dataRoot, rootName);
     try {
       const iter = fsp2.watch(absRoot, { recursive: true, signal: controller.signal });
       for await (const event of iter) {
@@ -26658,7 +26999,7 @@ async function startFileWatcher(opts = {}) {
 
 // app/lib/migrate-uploads.ts
 import { mkdir as mkdir6, readdir as readdir6, rename as rename3, rm as rm3 } from "fs/promises";
-import { dirname as dirname15, relative as relative7, resolve as resolve38 } from "path";
+import { dirname as dirname15, relative as relative7, resolve as resolve39 } from "path";
 var ACCOUNT_UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function walkFiles(dir) {
   const out = [];
@@ -26669,7 +27010,7 @@ async function walkFiles(dir) {
     return out;
   }
   for (const e of entries) {
-    const abs = resolve38(dir, e.name);
+    const abs = resolve39(dir, e.name);
     if (e.isDirectory()) {
       out.push(...await walkFiles(abs));
     } else if (e.isFile()) {
@@ -26689,7 +27030,7 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
   let moved = 0;
   for (const oldAbs of files) {
     const suffix = relative7(srcDir, oldAbs);
-    const newAbs = resolve38(destDir, suffix);
+    const newAbs = resolve39(destDir, suffix);
     await mkdir6(dirname15(newAbs), { recursive: true });
     await rename3(oldAbs, newAbs);
     moved++;
@@ -26716,7 +27057,7 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
 }
 async function migrateUploads(opts = {}) {
   const dataRoot = opts.dataRoot ?? DATA_ROOT;
-  const oldRoot = resolve38(dataRoot, "uploads");
+  const oldRoot = resolve39(dataRoot, "uploads");
   let topEntries;
   try {
     topEntries = await readdir6(oldRoot, { withFileTypes: true });
@@ -26737,8 +27078,8 @@ async function migrateUploads(opts = {}) {
       const name = entry.name;
       if (ACCOUNT_UUID_RE5.test(name)) {
         moved += await relocateTree(
-          resolve38(oldRoot, name),
-          resolve38(dataRoot, "accounts", name, "uploads"),
+          resolve39(oldRoot, name),
+          resolve39(dataRoot, "accounts", name, "uploads"),
           dataRoot,
           name,
           session
@@ -26750,8 +27091,8 @@ async function migrateUploads(opts = {}) {
           continue;
         }
         moved += await relocateTree(
-          resolve38(oldRoot, "public"),
-          resolve38(dataRoot, "accounts", installAccountId, "uploads", "public"),
+          resolve39(oldRoot, "public"),
+          resolve39(dataRoot, "accounts", installAccountId, "uploads", "public"),
           dataRoot,
           null,
           // public uploads carry no graph nodes
@@ -26781,7 +27122,7 @@ async function migrateUploads(opts = {}) {
 
 // app/lib/migrate-admin-webchat-sidecars.ts
 import { readdir as readdir7, readFile as readFile10, rename as rename4, writeFile as writeFile5, unlink as unlink4 } from "fs/promises";
-import { existsSync as existsSync42 } from "fs";
+import { existsSync as existsSync43 } from "fs";
 import { join as join46 } from "path";
 var ADMIN_ROLE2 = "admin";
 var WEBCHAT_CHANNEL2 = "webchat";
@@ -26811,7 +27152,7 @@ async function writeRaw(path3, obj) {
     await rename4(tmp, path3);
   } catch (err) {
     try {
-      if (existsSync42(tmp)) await unlink4(tmp);
+      if (existsSync43(tmp)) await unlink4(tmp);
     } catch {
     }
     throw err;
@@ -27200,8 +27541,8 @@ var streamSSE = (c, cb, onError) => {
 
 // app/lib/whatsapp/gateway/routes.ts
 function createWaChannelRoutes(deps) {
-  const app68 = new Hono();
-  app68.get("/wa-channel/inbound", (c) => {
+  const app70 = new Hono();
+  app70.get("/wa-channel/inbound", (c) => {
     const senderId = c.req.query("senderId");
     if (!senderId) return c.json({ error: "senderId required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -27219,7 +27560,7 @@ function createWaChannelRoutes(deps) {
       }
     });
   });
-  app68.post("/wa-channel/reply", async (c) => {
+  app70.post("/wa-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const text = body?.text;
@@ -27240,7 +27581,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=reply-dispatch senderId=${senderId} bytes=${bytes}`);
     return c.json({ ok: true });
   });
-  app68.post("/wa-channel/reply-document", async (c) => {
+  app70.post("/wa-channel/reply-document", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const files = body?.files;
@@ -27279,7 +27620,7 @@ function createWaChannelRoutes(deps) {
     }
     return c.json({ ok: true, results });
   });
-  app68.post("/wa-channel/ready", async (c) => {
+  app70.post("/wa-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     if (typeof senderId !== "string") {
@@ -27288,7 +27629,7 @@ function createWaChannelRoutes(deps) {
     deps.onReady?.(senderId);
     return c.json({ ok: true });
   });
-  app68.post("/wa-channel/received", async (c) => {
+  app70.post("/wa-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const waMessageId = body?.waMessageId;
@@ -27298,7 +27639,7 @@ function createWaChannelRoutes(deps) {
     deps.onReceived?.(senderId, waMessageId);
     return c.json({ ok: true });
   });
-  app68.post("/wa-channel/turn-end", async (c) => {
+  app70.post("/wa-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const sessionId = body?.sessionId;
@@ -27331,7 +27672,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=turn-end sessionId=${sid} replied=no delivered=none`);
     return c.json({ ok: true, delivered: "none" });
   });
-  return app68;
+  return app70;
 }
 
 // app/lib/whatsapp/gateway/wa-gateway.ts
@@ -27746,8 +28087,8 @@ var InboundHub2 = class {
 
 // app/lib/webchat/gateway/routes.ts
 function createWebchatChannelRoutes(deps) {
-  const app68 = new Hono();
-  app68.get("/webchat-channel/inbound", (c) => {
+  const app70 = new Hono();
+  app70.get("/webchat-channel/inbound", (c) => {
     const key = c.req.query("key");
     if (!key) return c.json({ error: "key required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -27765,7 +28106,7 @@ function createWebchatChannelRoutes(deps) {
       }
     });
   });
-  app68.post("/webchat-channel/reply", async (c) => {
+  app70.post("/webchat-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const text = body?.text;
@@ -27775,7 +28116,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReply?.(key, text);
     return c.json({ ok: true });
   });
-  app68.post("/webchat-channel/connector-auth", async (c) => {
+  app70.post("/webchat-channel/connector-auth", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -27788,7 +28129,7 @@ function createWebchatChannelRoutes(deps) {
     const result = await deps.onConnectorAuth({ key, sessionId, name, completed });
     return c.json(result);
   });
-  app68.post("/webchat-channel/ready", async (c) => {
+  app70.post("/webchat-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     if (typeof key !== "string") {
@@ -27797,7 +28138,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReady?.(key);
     return c.json({ ok: true });
   });
-  app68.post("/webchat-channel/permission-request", async (c) => {
+  app70.post("/webchat-channel/permission-request", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const requestId = body?.request_id;
@@ -27811,7 +28152,7 @@ function createWebchatChannelRoutes(deps) {
     const verdict = await deps.awaitPermissionVerdict({ key, requestId, toolName, description, inputPreview });
     return c.json(verdict);
   });
-  app68.post("/webchat-channel/received", async (c) => {
+  app70.post("/webchat-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const messageId = body?.messageId;
@@ -27821,7 +28162,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReceived?.(key, messageId);
     return c.json({ ok: true });
   });
-  app68.post("/webchat-channel/turn-end", async (c) => {
+  app70.post("/webchat-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -27835,7 +28176,7 @@ function createWebchatChannelRoutes(deps) {
     console.error(`[webchat-native] op=turn-end channel=webchat key=${k} sessionId=${sid} replied=${replied ? "yes" : "no"} trailing=${finalBytes}`);
     return c.json({ ok: true });
   });
-  return app68;
+  return app70;
 }
 
 // app/lib/webchat/gateway/webchat-gateway.ts
@@ -27893,16 +28234,16 @@ var WebchatGateway = class _WebchatGateway {
    *  The public /api/chat route awaits this to return the reply on the same SSE
    *  response, preserving the pre-756 POST→single-blob browser contract. */
   awaitReply(key, timeoutMs) {
-    return new Promise((resolve44) => {
+    return new Promise((resolve45) => {
       const timer = setTimeout(() => {
         this.replyAwaiters.delete(key);
-        resolve44({ timeout: true });
+        resolve45({ timeout: true });
       }, timeoutMs);
       if (timer.unref) timer.unref();
       this.replyAwaiters.set(key, (r) => {
         clearTimeout(timer);
         this.replyAwaiters.delete(key);
-        resolve44(r);
+        resolve45(r);
       });
     });
   }
@@ -27913,11 +28254,11 @@ var WebchatGateway = class _WebchatGateway {
    *  terminal dialog stays answerable). */
   awaitPermissionVerdict(p, timeoutMs) {
     const k = _WebchatGateway.promptKey(p.key, p.requestId);
-    return new Promise((resolve44) => {
+    return new Promise((resolve45) => {
       this.pendingPrompts.get(k)?.resolve({ timeout: true });
       const timer = setTimeout(() => {
         this.pendingPrompts.delete(k);
-        resolve44({ timeout: true });
+        resolve45({ timeout: true });
       }, timeoutMs);
       if (timer.unref) timer.unref();
       this.pendingPrompts.set(k, {
@@ -27926,7 +28267,7 @@ var WebchatGateway = class _WebchatGateway {
         resolve: (r) => {
           clearTimeout(timer);
           this.pendingPrompts.delete(k);
-          resolve44(r);
+          resolve45(r);
         }
       });
       console.error(`[webchat:perm] op=open key=${keyDisplay(p.key)} id=${p.requestId} tool=${p.toolName}`);
@@ -28491,7 +28832,7 @@ async function fanOut(subscribers, text, onError, tag) {
 
 // app/lib/webchat/file-delivery.ts
 import { realpathSync as realpathSync9 } from "fs";
-import { resolve as resolve39 } from "path";
+import { resolve as resolve40 } from "path";
 
 // app/lib/channel-pty-bridge/file-delivery.ts
 var SEND_USER_FILE = "SendUserFile";
@@ -28582,29 +28923,29 @@ function makeFileDelivery(opts) {
 }
 
 // app/lib/webchat/file-delivery.ts
-var TAG51 = "[webchat-adaptor]";
+var TAG53 = "[webchat-adaptor]";
 function platformRoot2() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
 function makeWebchatSendFile(entry) {
   return async (filePath) => {
     if (!entry.accountId) {
-      console.error(`${TAG51} file-delivery reject reason=no-account sender=${entry.senderId}`);
+      console.error(`${TAG53} file-delivery reject reason=no-account sender=${entry.senderId}`);
       return { ok: false, error: "no-account" };
     }
-    const accountDir = resolve39(platformRoot2(), "..", "data/accounts", entry.accountId);
+    const accountDir = resolve40(platformRoot2(), "..", "data/accounts", entry.accountId);
     try {
       const resolved = realpathSync9(filePath);
       const accountResolved = realpathSync9(accountDir);
       if (!resolved.startsWith(accountResolved + "/")) {
-        console.error(`${TAG51} file-delivery reject reason=outside_account_directory sender=${entry.senderId}`);
+        console.error(`${TAG53} file-delivery reject reason=outside_account_directory sender=${entry.senderId}`);
         return { ok: false, error: "outside-account" };
       }
       return { ok: true };
     } catch (err) {
       const code = err.code;
       console.error(
-        `${TAG51} file-delivery reject reason=${code === "ENOENT" ? "not-found" : "path-error"} sender=${entry.senderId}`
+        `${TAG53} file-delivery reject reason=${code === "ENOENT" ? "not-found" : "path-error"} sender=${entry.senderId}`
       );
       return { ok: false, error: code === "ENOENT" ? "not-found" : "path-error" };
     }
@@ -28613,7 +28954,7 @@ function makeWebchatSendFile(entry) {
 function makeWebchatFileDelivery(entry) {
   return makeFileDelivery({
     entry,
-    tag: TAG51,
+    tag: TAG53,
     channel: "webchat",
     sendFile: makeWebchatSendFile(entry),
     deferUntilVerdict: true
@@ -28675,7 +29016,7 @@ function buildPublicWebchatSpawnRequest(input) {
 }
 
 // app/lib/whatsapp/inbound/file-delivery-bridge.ts
-var TAG52 = "[whatsapp-adaptor]";
+var TAG54 = "[whatsapp-adaptor]";
 var SEND_USER_FILE2 = "SendUserFile";
 var WHATSAPP_SEND_DOCUMENT = "whatsapp-send-document";
 function platformRoot3() {
@@ -28693,7 +29034,7 @@ function makeWhatsAppSendFile(entry, maxyAccountId) {
     });
     if (result.ok) return { ok: true };
     console.error(
-      `${TAG52} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
+      `${TAG54} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
     );
     return { ok: false, error: result.error };
   };
@@ -28701,7 +29042,7 @@ function makeWhatsAppSendFile(entry, maxyAccountId) {
 function makeWhatsAppFileDelivery(entry, maxyAccountId) {
   const shared = makeFileDelivery({
     entry,
-    tag: TAG52,
+    tag: TAG54,
     channel: "whatsapp",
     sendFile: makeWhatsAppSendFile(entry, maxyAccountId)
   });
@@ -28736,7 +29077,7 @@ function makeWhatsAppFileDelivery(entry, maxyAccountId) {
         if (!delivered) {
           const fileField = call.filePath !== void 0 ? ` file=${call.filePath}` : "";
           console.error(
-            `${TAG52} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
+            `${TAG54} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
           );
         }
       }
@@ -28919,8 +29260,8 @@ var InboundHub3 = class {
 
 // app/lib/telegram/gateway/routes.ts
 function createTelegramChannelRoutes(deps) {
-  const app68 = new Hono();
-  app68.get("/tg-channel/inbound", (c) => {
+  const app70 = new Hono();
+  app70.get("/tg-channel/inbound", (c) => {
     const key = c.req.query("key");
     if (!key) return c.json({ error: "key required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -28938,7 +29279,7 @@ function createTelegramChannelRoutes(deps) {
       }
     });
   });
-  app68.post("/tg-channel/reply", async (c) => {
+  app70.post("/tg-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const text = body?.text;
@@ -28954,7 +29295,7 @@ function createTelegramChannelRoutes(deps) {
     console.error(`[telegram-native] op=reply key=${key} bytes=${Buffer.byteLength(text, "utf8")}`);
     return c.json({ ok: true });
   });
-  app68.post("/tg-channel/ready", async (c) => {
+  app70.post("/tg-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     if (typeof key !== "string") {
@@ -28963,7 +29304,7 @@ function createTelegramChannelRoutes(deps) {
     deps.onReady?.(key);
     return c.json({ ok: true });
   });
-  app68.post("/tg-channel/received", async (c) => {
+  app70.post("/tg-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const messageId = body?.messageId;
@@ -28973,7 +29314,7 @@ function createTelegramChannelRoutes(deps) {
     deps.onReceived?.(key, messageId);
     return c.json({ ok: true });
   });
-  app68.post("/tg-channel/turn-end", async (c) => {
+  app70.post("/tg-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -29006,7 +29347,7 @@ function createTelegramChannelRoutes(deps) {
     console.error(`[telegram-native] op=turn-end key=${key} sessionId=${sid} replied=no delivered=none`);
     return c.json({ ok: true, delivered: "none" });
   });
-  return app68;
+  return app70;
 }
 
 // app/lib/telegram/gateway/telegram-gateway.ts
@@ -29156,8 +29497,8 @@ function buildTelegramSpawnRequest(input) {
 // app/lib/telegram/outbound/send-document.ts
 import { realpathSync as realpathSync10 } from "fs";
 import { readFile as readFile11, stat as stat10 } from "fs/promises";
-import { resolve as resolve40, basename as basename13 } from "path";
-var TAG53 = "[telegram:outbound]";
+import { resolve as resolve41, basename as basename13 } from "path";
+var TAG55 = "[telegram:outbound]";
 var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
 async function sendTelegramDocument(input) {
   const { botToken, chatId, filePath, caption, maxyAccountId, platformRoot: platformRoot5 } = input;
@@ -29167,17 +29508,17 @@ async function sendTelegramDocument(input) {
   if (!maxyAccountId || !platformRoot5) {
     return { ok: false, status: 400, error: "Cannot validate file path: missing account or platform context" };
   }
-  const accountDir = resolve40(platformRoot5, "..", "data/accounts", maxyAccountId);
+  const accountDir = resolve41(platformRoot5, "..", "data/accounts", maxyAccountId);
   let accountResolved;
   try {
     accountResolved = realpathSync10(accountDir);
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      console.error(`${TAG53} document ENOENT scope=account-dir accountDir=${accountDir} maxyAccountId=${maxyAccountId}`);
+      console.error(`${TAG55} document ENOENT scope=account-dir accountDir=${accountDir} maxyAccountId=${maxyAccountId}`);
       return { ok: false, status: 500, error: `Account directory not resolvable for ${maxyAccountId}` };
     }
-    console.error(`${TAG53} document path error scope=account-dir maxyAccountId=${maxyAccountId}: ${String(err)}`);
+    console.error(`${TAG55} document path error scope=account-dir maxyAccountId=${maxyAccountId}: ${String(err)}`);
     return { ok: false, status: 500, error: String(err) };
   }
   let resolvedPath;
@@ -29186,14 +29527,14 @@ async function sendTelegramDocument(input) {
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      console.error(`${TAG53} document ENOENT scope=file path=${filePath} maxyAccountId=${maxyAccountId}`);
+      console.error(`${TAG55} document ENOENT scope=file path=${filePath} maxyAccountId=${maxyAccountId}`);
       return { ok: false, status: 404, error: `File not found: ${filePath}` };
     }
-    console.error(`${TAG53} document path error scope=file maxyAccountId=${maxyAccountId}: ${String(err)}`);
+    console.error(`${TAG55} document path error scope=file maxyAccountId=${maxyAccountId}: ${String(err)}`);
     return { ok: false, status: 500, error: String(err) };
   }
   if (!resolvedPath.startsWith(accountResolved + "/")) {
-    console.error(`${TAG53} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
+    console.error(`${TAG55} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
     return { ok: false, status: 403, error: "Access denied: file is outside the account directory" };
   }
   const fileStat = await stat10(resolvedPath);
@@ -29226,13 +29567,13 @@ async function sendTelegramDocument(input) {
     error = e instanceof Error ? e.message : String(e);
   }
   console.error(
-    `${TAG53} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok}` + (messageId !== void 0 ? ` id=${messageId}` : "")
+    `${TAG55} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok}` + (messageId !== void 0 ? ` id=${messageId}` : "")
   );
   return ok ? { ok: true, messageId } : { ok: false, status: 500, error };
 }
 
 // app/lib/telegram/outbound/file-delivery.ts
-var TAG54 = "[telegram:outbound]";
+var TAG56 = "[telegram:outbound]";
 function platformRoot4() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
@@ -29244,11 +29585,11 @@ function makeTelegramSendFile(entry) {
       botToken = (entry.role === "admin" ? tg?.adminBotToken : tg?.publicBotToken) ?? null;
     }
     if (!botToken) {
-      console.error(`${TAG54} file-delivery reject reason=no-bot-token sender=${entry.senderId} role=${entry.role}`);
+      console.error(`${TAG56} file-delivery reject reason=no-bot-token sender=${entry.senderId} role=${entry.role}`);
       return { ok: false, error: "no-bot-token" };
     }
     if (entry.replyTarget == null) {
-      console.error(`${TAG54} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
+      console.error(`${TAG56} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
       return { ok: false, error: "no-reply-target" };
     }
     const result = await sendTelegramDocument({
@@ -29265,7 +29606,7 @@ function makeTelegramSendFile(entry) {
 function makeTelegramFileDelivery(entry) {
   return makeFileDelivery({
     entry,
-    tag: TAG54,
+    tag: TAG56,
     channel: "telegram",
     sendFile: makeTelegramSendFile(entry)
   });
@@ -29306,7 +29647,7 @@ function startTelegramNativeFileFollower(input) {
 
 // app/lib/channel-pty-bridge/public-session-end-review.ts
 import { randomUUID as randomUUID16 } from "crypto";
-var TAG55 = "[public-session-review]";
+var TAG57 = "[public-session-review]";
 var CONSUMED_CAP = 500;
 var consumed = /* @__PURE__ */ new Set();
 function consumeOnce(sessionId) {
@@ -29333,7 +29674,7 @@ async function fetchJsonl(sessionId) {
     return await res.text();
   } catch (err) {
     console.error(
-      `${TAG55} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG57} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return null;
   }
@@ -29357,7 +29698,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     const res = await fetch(url);
     if (!res.ok) {
       console.error(
-        `${TAG55} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
+        `${TAG57} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
       );
       return [];
     }
@@ -29365,7 +29706,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     return Array.isArray(body.writes) ? body.writes : [];
   } catch (err) {
     console.error(
-      `${TAG55} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG57} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return [];
   }
@@ -29394,7 +29735,7 @@ function composeInitialMessage(input) {
 }
 async function dispatchReviewer(input, initialMessage) {
   const sessionId = randomUUID16();
-  console.log(`${TAG55} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
+  console.log(`${TAG57} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
   const spawned = await managerRcSpawn({
     sessionId,
     initialMessage,
@@ -29414,21 +29755,21 @@ async function firePublicSessionEndReview(input) {
   const dispatchedAt = Date.now();
   if (consumed.has(input.sessionId)) {
     console.log(
-      `${TAG55} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG57} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const jsonl = await fetchJsonl(input.sessionId);
   if (!jsonl) {
     console.log(
-      `${TAG55} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
+      `${TAG57} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
     );
     return;
   }
   const operatorTurns = countOperatorTurns(jsonl);
   if (operatorTurns === 0) {
     console.log(
-      `${TAG55} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
+      `${TAG57} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
     );
     return;
   }
@@ -29442,19 +29783,19 @@ async function firePublicSessionEndReview(input) {
   });
   if (!consumeOnce(input.sessionId)) {
     console.log(
-      `${TAG55} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG57} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const dispatched = await dispatchReviewer(input, initialMessage);
   if (!dispatched.ok) {
     console.error(
-      `${TAG55} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
+      `${TAG57} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
     );
     return;
   }
   console.log(
-    `${TAG55} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
+    `${TAG57} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
   );
 }
 
@@ -29559,14 +29900,14 @@ function warnOnChannelAdminBindingDrift() {
 }
 
 // server/lib/booking-site-accounts.ts
-import { existsSync as existsSync43, readFileSync as readFileSync44 } from "fs";
-import { resolve as resolve41 } from "path";
+import { existsSync as existsSync44, readFileSync as readFileSync45 } from "fs";
+import { resolve as resolve42 } from "path";
 function listBookingSiteAccounts(accounts) {
   return accounts.filter((a) => {
-    const availPath = resolve41(a.accountDir, "calendar-availability.json");
-    if (!existsSync43(availPath)) return false;
+    const availPath = resolve42(a.accountDir, "calendar-availability.json");
+    if (!existsSync44(availPath)) return false;
     try {
-      const cfg = JSON.parse(readFileSync44(availPath, "utf-8"));
+      const cfg = JSON.parse(readFileSync45(availPath, "utf-8"));
       return typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
     } catch {
       return false;
@@ -29604,8 +29945,8 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash6, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync44, readFileSync as readFileSync45, statSync as statSync19 } from "fs";
-import { resolve as resolve42 } from "path";
+import { existsSync as existsSync45, readFileSync as readFileSync46, statSync as statSync19 } from "fs";
+import { resolve as resolve43 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
 function canonicalize(value) {
@@ -29640,7 +29981,7 @@ var PUBKEY_SHA256 = "8eee6bcb33545fd13b16d3199a5735ca5db5062834c7b49dfe4f23801d9
 var GRACE_DAYS = 7;
 var GRACE_MS = GRACE_DAYS * 24 * 60 * 60 * 1e3;
 function pubkeyPath(brand) {
-  return resolve42(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
+  return resolve43(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
 }
 var memo = null;
 function memoKey(mtimeMs, account) {
@@ -29652,8 +29993,8 @@ function resolveEntitlement(brand, account) {
   if (brand.commercialMode !== true) {
     return logResolved(implicitTrust(account), null);
   }
-  const entitlementPath = resolve42(brand.configDir, "entitlement.json");
-  if (!existsSync44(entitlementPath)) {
+  const entitlementPath = resolve43(brand.configDir, "entitlement.json");
+  if (!existsSync45(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
   const stat11 = statSync19(entitlementPath);
@@ -29668,7 +30009,7 @@ function resolveEntitlement(brand, account) {
 function verifyAndResolve(brand, entitlementPath, account) {
   let pubkeyPem;
   try {
-    pubkeyPem = readFileSync45(pubkeyPath(brand), "utf-8");
+    pubkeyPem = readFileSync46(pubkeyPath(brand), "utf-8");
   } catch (err) {
     return logResolved(anonymousFallback("pubkey-missing"), {
       reason: "pubkey-missing"
@@ -29682,7 +30023,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(readFileSync45(entitlementPath, "utf-8"));
+    envelope = JSON.parse(readFileSync46(entitlementPath, "utf-8"));
   } catch {
     return logResolved(anonymousFallback("malformed"), { reason: "malformed" });
   }
@@ -29846,12 +30187,12 @@ installMediaDownloadGuard();
 var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT || "";
 var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join47(PLATFORM_ROOT8, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync45(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync46(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync45(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync46(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync46(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync47(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -29886,8 +30227,8 @@ var brandLoginOpts = {
 var ALIAS_DOMAINS_PATH = join47(homedir4(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync45(ALIAS_DOMAINS_PATH)) return null;
-    const parsed = JSON.parse(readFileSync46(ALIAS_DOMAINS_PATH, "utf-8"));
+    if (!existsSync46(ALIAS_DOMAINS_PATH)) return null;
+    const parsed = JSON.parse(readFileSync47(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -29911,7 +30252,7 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app67 = new Hono();
+var app69 = new Hono();
 function resolveChannelOverride(accountId, channel, senderId) {
   try {
     const dir = listValidAccounts().find((a) => a.accountId === accountId)?.accountDir;
@@ -29960,7 +30301,7 @@ var waGateway = new WaGateway({
   fetchStandingRules: fetchAccountStandingRules,
   resolveSessionOverride: (accountId, senderId) => resolveChannelOverride(accountId, "whatsapp", senderId),
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve43(process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve44(process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 / 1390 — file delivery on the native channel. `maxyAccountId` (the
   // path-validation scope) is the sender's effective SESSION account, resolved
   // once at the inbound gate and threaded here via the gateway's per-sender doc
@@ -29975,7 +30316,7 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve43(process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, ".."))
+      platformRoot: resolve44(process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
@@ -30087,7 +30428,7 @@ var waGateway = new WaGateway({
     nativeFileFollowers.set(senderId, ac);
   }
 });
-app67.route("/", waGateway.routes());
+app69.route("/", waGateway.routes());
 waGateway.startSweeper();
 function runDuplicateSenderAudit() {
   try {
@@ -30210,7 +30551,7 @@ var webchatGateway = new WebchatGateway({
   firePublicSessionEndReview: (input) => firePublicSessionEndReview(input)
 });
 setWebchatGateway(webchatGateway);
-app67.route("/", webchatGateway.routes());
+app69.route("/", webchatGateway.routes());
 webchatGateway.startSweeper();
 webchatGateway.startPublicReaper();
 var telegramFileFollowers = /* @__PURE__ */ new Map();
@@ -30254,7 +30595,7 @@ var telegramGateway = new TelegramGateway({
   }
 });
 setTelegramGateway(telegramGateway);
-app67.route("/", telegramGateway.routes());
+app69.route("/", telegramGateway.routes());
 telegramGateway.startSweeper();
 var chatRoutes = createChatRoutes({
   handleInbound: (input) => webchatGateway.handleInbound(input),
@@ -30288,19 +30629,19 @@ var scheduleInjectRoutes = createScheduleInjectRoutes({
     return managed.account;
   }
 });
-app67.route("/api/channel/schedule-inject", scheduleInjectRoutes);
-app67.use("*", clientIpMiddleware);
+app69.route("/api/channel/schedule-inject", scheduleInjectRoutes);
+app69.use("*", clientIpMiddleware);
 function allowsSameOriginFraming(path3) {
   return path3 === "/vnc-viewer.html" || path3.startsWith("/api/admin/attachment/") || path3.startsWith("/api/public-reader/attachment/") || path3 === "/api/admin/files/download" || path3 === "/api/admin/session-upload";
 }
-app67.use("*", async (c, next) => {
+app69.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
   c.header("X-Frame-Options", allowsSameOriginFraming(c.req.path) ? "SAMEORIGIN" : "DENY");
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app67.use("*", async (c, next) => {
+app69.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -30318,7 +30659,7 @@ app67.use("*", async (c, next) => {
     });
   }
 });
-app67.use("*", async (c, next) => {
+app69.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isOperatorHost(host, getOperatorDomains()) || !isPublicHost(host)) {
     await next();
@@ -30356,7 +30697,7 @@ function resolveRemoteAuthOpts(c) {
   return { ...brandLoginOpts, origin };
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app67.post("/__remote-auth/login", async (c) => {
+app69.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -30401,7 +30742,7 @@ app67.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app67.get("/__remote-auth/logout", (c) => {
+app69.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -30414,7 +30755,7 @@ app67.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app67.post("/__remote-auth/change-password", async (c) => {
+app69.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -30473,13 +30814,13 @@ app67.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app67.get("/__remote-auth/setup", (c) => {
+app69.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "setup" }), 200);
 });
-app67.post("/__remote-auth/set-initial-password", async (c) => {
+app69.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -30517,10 +30858,10 @@ app67.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app67.get("/api/remote-auth/status", (c) => {
+app69.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app67.post("/api/remote-auth/set-password", async (c) => {
+app69.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -30559,10 +30900,10 @@ app67.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app67.route("/api/_client-error", client_error_default);
+app69.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
 var PWA_PUBLIC_PATHS = /* @__PURE__ */ new Set(["/sw.js", ...PWA_SURFACES.map((s) => s.manifestPath)]);
-app67.use("*", async (c, next) => {
+app69.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path3 = c.req.path;
   if (path3 === "/favicon.ico" || path3.startsWith("/assets/") || path3.startsWith("/brand/") || // Public free/busy is read by the booking page (a separate Cloudflare Pages
@@ -30606,28 +30947,28 @@ app67.use("*", async (c, next) => {
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), redirect: path3 }), 200);
 });
-app67.route("/api/health", health_default);
-app67.route("/api/chat", chatRoutes);
-app67.route("/api/whatsapp", whatsapp_default);
-app67.route("/api/storage", storage_broker_default);
-app67.route("/api/whatsapp-reader", whatsapp_reader_default);
-app67.route("/api/public-reader", public_reader_default);
-app67.route("/api/webchat", createWebchatRoutes({
+app69.route("/api/health", health_default);
+app69.route("/api/chat", chatRoutes);
+app69.route("/api/whatsapp", whatsapp_default);
+app69.route("/api/storage", storage_broker_default);
+app69.route("/api/whatsapp-reader", whatsapp_reader_default);
+app69.route("/api/public-reader", public_reader_default);
+app69.route("/api/webchat", createWebchatRoutes({
   handleInbound: (input) => webchatGateway.handleInbound(input),
   // Task 940 — the permission relay's pointer read + verdict write.
   pendingPromptFor: (key) => webchatGateway.pendingPromptFor(key),
   deliveryFailureFor: (key) => webchatGateway.deliveryFailureFor(key),
   resolvePermissionVerdict: (key, requestId, behavior) => webchatGateway.resolvePermissionVerdict(key, requestId, behavior)
 }));
-app67.route("/api/webchat/greeting", webchat_greeting_default);
-app67.route("/api/telegram", telegram_default);
-app67.route("/api/quickbooks", quickbooks_default);
-app67.route("/api/onboarding", onboarding_default);
-app67.route("/api/admin", admin_default);
-app67.route("/api/access", access_default);
-app67.route("/api/session", session_default2);
-app67.route("/api/calendar", calendar_public_default);
-app67.route("/api/portal", portal_fetch_default);
+app69.route("/api/webchat/greeting", webchat_greeting_default);
+app69.route("/api/telegram", telegram_default);
+app69.route("/api/quickbooks", quickbooks_default);
+app69.route("/api/onboarding", onboarding_default);
+app69.route("/api/admin", admin_default);
+app69.route("/api/access", access_default);
+app69.route("/api/session", session_default2);
+app69.route("/api/calendar", calendar_public_default);
+app69.route("/api/portal", portal_fetch_default);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -30639,7 +30980,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app67.get("/agent-assets/:slug/:filename", (c) => {
+app69.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -30655,26 +30996,26 @@ app67.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve43(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve43(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve44(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve44(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync45(filePath)) {
+  if (!existsSync46(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync46(filePath);
+  const body = readFileSync47(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
   });
 });
-app67.get("/generated/:filename", (c) => {
+app69.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -30685,35 +31026,35 @@ app67.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve43(account.accountDir, "generated", filename);
-  const expectedDir = resolve43(account.accountDir, "generated");
+  const filePath = resolve44(account.accountDir, "generated", filename);
+  const expectedDir = resolve44(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync45(filePath)) {
+  if (!existsSync46(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync46(filePath);
+  const body = readFileSync47(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
   });
 });
-app67.route("/sites", sites_default);
-app67.route("/listings", listings_default);
-app67.route("/v", visitor_event_default);
-app67.route("/v", visitor_consent_default);
+app69.route("/sites", sites_default);
+app69.route("/listings", listings_default);
+app69.route("/v", visitor_event_default);
+app69.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync45(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync46(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync46(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync47(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -30740,11 +31081,11 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 var brandThemeColor = BRAND.defaultColors?.primary ?? "#000000";
 var brandBackgroundColor = BRAND.defaultColors?.background ?? "#ffffff";
 var brandAppIconsExist = [brandAppIcon192Path, brandAppIcon512Path, brandMaskableIconPath].every(
-  (p) => existsSync45(resolve43(process.cwd(), "public", p.replace(/^\//, "")))
+  (p) => existsSync46(resolve44(process.cwd(), "public", p.replace(/^\//, "")))
 );
 var SW_SOURCE = (() => {
   try {
-    return readFileSync46(resolve43(process.cwd(), "public", "sw.js"), "utf-8");
+    return readFileSync47(resolve44(process.cwd(), "public", "sw.js"), "utf-8");
   } catch {
     return null;
   }
@@ -30753,8 +31094,8 @@ function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT8) return "unknown";
     const versionFile = join47(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync45(versionFile)) return "unknown";
-    const content = readFileSync46(versionFile, "utf-8").trim();
+    if (!existsSync46(versionFile)) return "unknown";
+    const content = readFileSync47(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -30795,7 +31136,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync46(resolve43(process.cwd(), "public", file), "utf-8");
+    html = readFileSync47(resolve44(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -30817,8 +31158,8 @@ function loadBrandingCache(agentSlug) {
     const accountId = getDefaultAccountId();
     if (!accountId) return null;
     const cachePath = join47(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync45(cachePath)) return null;
-    return JSON.parse(readFileSync46(cachePath, "utf-8"));
+    if (!existsSync46(cachePath)) return null;
+    return JSON.parse(readFileSync47(cachePath, "utf-8"));
   } catch {
     return null;
   }
@@ -30862,7 +31203,7 @@ function brandedPublicHtml(agentSlug) {
 function agentUnavailableHtml() {
   return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escapeHtml(BRAND.productName)}</title></head><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1.5rem;color:#222"><h1 style="font-size:1.25rem">Agent unavailable</h1><p>This agent isn't available right now. If you reached this page from a saved link, the agent may have been turned off.</p></body></html>`;
 }
-app67.get("/", (c) => {
+app69.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const klass = classifyHost(host, getOperatorDomains(), isPublicHost);
   if (klass === "operator") {
@@ -30884,12 +31225,12 @@ app67.get("/", (c) => {
   console.log(`[host-class] host=${host} class=admin served=index.html`);
   return c.html(cachedHtml("index.html"));
 });
-app67.get("/public", (c) => {
+app69.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app67.get("/public-chat", (c) => {
+app69.get("/public-chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -30908,12 +31249,12 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app67.use("/vnc-viewer.html", logViewerFetch);
-app67.use("/vnc-popout.html", logViewerFetch);
-app67.get("/vnc-popout.html", (c) => {
+app69.use("/vnc-viewer.html", logViewerFetch);
+app69.use("/vnc-popout.html", logViewerFetch);
+app69.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync46(resolve43(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync47(resolve44(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -30923,7 +31264,7 @@ app67.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app67.post("/api/vnc/client-event", async (c) => {
+app69.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -30944,11 +31285,11 @@ app67.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app67.get("/g/:slug", (c) => {
+app69.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml(resolveDefaultSlug() ?? void 0));
 });
 for (const pwa of PWA_SURFACES) {
-  app67.get(pwa.manifestPath, (c) => {
+  app69.get(pwa.manifestPath, (c) => {
     const manifest = buildManifest(pwa, {
       productName: BRAND.productName,
       appIcon192: brandAppIcon192Path,
@@ -30964,7 +31305,7 @@ for (const pwa of PWA_SURFACES) {
     return c.body(JSON.stringify(manifest));
   });
 }
-app67.get("/sw.js", (c) => {
+app69.get("/sw.js", (c) => {
   if (SW_SOURCE == null) {
     console.error("[pwa] op=sw status=500 reason=sw-source-missing");
     return c.text("Service worker unavailable", 500);
@@ -30973,12 +31314,12 @@ app67.get("/sw.js", (c) => {
   console.log(`[pwa] op=sw status=200 ct=${SW_CONTENT_TYPE}`);
   return c.body(SW_SOURCE);
 });
-app67.get("/graph", (c) => {
+app69.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app67.get("/chat", (c) => {
+app69.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isOperatorHost(host, getOperatorDomains())) {
     console.log(`[host-class] host=${host} class=operator served=operator.html`);
@@ -30987,42 +31328,47 @@ app67.get("/chat", (c) => {
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("chat.html"));
 });
-app67.get("/data", (c) => {
+app69.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app67.get("/tasks", (c) => {
+app69.get("/tasks", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("tasks.html"));
 });
-app67.get("/activity", (c) => {
+app69.get("/activity", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("activity.html"));
 });
-app67.get("/calendar", (c) => {
+app69.get("/calendar", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("calendar.html"));
 });
-app67.get("/routines", (c) => {
+app69.get("/routines", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("routines.html"));
 });
-app67.get("/skills", (c) => {
+app69.get("/skills", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("skills.html"));
 });
-app67.get("/browser", (c) => {
+app69.get("/agents", (c) => {
+  const host = (c.req.header("host") ?? "").split(":")[0];
+  if (isPublicHost(host)) return c.text("Not found", 404);
+  return c.html(cachedHtml("agents.html"));
+});
+app69.get("/browser", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("browser.html"));
 });
-app67.get("/:slug", async (c, next) => {
+app69.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const account = resolveAccount();
@@ -31037,13 +31383,13 @@ app67.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app67.get("/favicon.ico", (c) => {
+  app69.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app67.use("/*", serveStatic({ root: "./public" }));
-app67.all("*", (c) => {
+app69.use("/*", serveStatic({ root: "./public" }));
+app69.all("*", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path3 = c.req.path;
   if (isPublicHost(host)) {
@@ -31057,13 +31403,13 @@ app67.all("*", (c) => {
 });
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app67.fetch, port, hostname });
+var httpServer = serve({ fetch: app69.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..");
-  const reconcileScript = resolve43(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
+  const reconcileScript = resolve44(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
   const runReconcile = (ctx) => {
-    if (!existsSync45(reconcileScript)) return;
+    if (!existsSync46(reconcileScript)) return;
     try {
       const child = spawn3(process.execPath, [reconcileScript], {
         env: { ...process.env, PLATFORM_ROOT: reconcilePlatformRoot },
@@ -31102,14 +31448,14 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const DREAM_CYCLE_SWEEP_INTERVAL_MS = 36e5;
   const dreamPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..");
-  const dreamSweepScript = resolve43(dreamPlatformRoot, "plugins/memory/mcp/dist/scripts/dream-cycle-sweep.js");
+  const dreamSweepScript = resolve44(dreamPlatformRoot, "plugins/memory/mcp/dist/scripts/dream-cycle-sweep.js");
   registerLoop({
     name: "dream-cycle-sweep",
     intervalMs: DREAM_CYCLE_SWEEP_INTERVAL_MS,
     firstRunDelayMs: 3e4,
     detached: true,
     run: (ctx) => {
-      if (!existsSync45(dreamSweepScript)) return;
+      if (!existsSync46(dreamSweepScript)) return;
       try {
         const child = spawn3(process.execPath, [dreamSweepScript], {
           env: { ...process.env, PLATFORM_ROOT: dreamPlatformRoot },
@@ -31126,10 +31472,10 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..");
-  const outlookScript = resolve43(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
+  const outlookScript = resolve44(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
   const OUTLOOK_COMPLETE_INTERVAL_MS = 3e4;
   const runOutlookComplete = (ctx) => {
-    if (!existsSync45(outlookScript)) return;
+    if (!existsSync46(outlookScript)) return;
     try {
       const child = spawn3(process.execPath, [outlookScript], {
         env: { ...process.env, PLATFORM_ROOT: outlookPlatformRoot },
@@ -31152,18 +31498,18 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..");
-  const strandedAccountsDir = resolve43(auditRoot, "..", "data/accounts");
+  const strandedAccountsDir = resolve44(auditRoot, "..", "data/accounts");
   const STRANDED_AUDIT_INTERVAL_MS = 3e5;
   const STRANDED_AGE_MS = 16 * 6e4;
   const STRANDED_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
   const runStrandedAudit = () => {
     try {
-      if (!existsSync45(strandedAccountsDir)) return;
+      if (!existsSync46(strandedAccountsDir)) return;
       const now = Date.now();
-      for (const name of readdirSync27(strandedAccountsDir)) {
+      for (const name of readdirSync28(strandedAccountsDir)) {
         if (!STRANDED_UUID_RE.test(name)) continue;
-        const pendingPath2 = resolve43(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
-        if (!existsSync45(pendingPath2)) continue;
+        const pendingPath2 = resolve44(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
+        if (!existsSync46(pendingPath2)) continue;
         const ageMs2 = now - statSync20(pendingPath2).mtimeMs;
         if (ageMs2 > STRANDED_AGE_MS) {
           console.error(`[outlook-mcp] devicecode-stranded account=${name} ageSec=${Math.floor(ageMs2 / 1e3)}`);
@@ -31182,7 +31528,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const googleRoot = process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..");
-  const googleAccountsDir = resolve43(googleRoot, "..", "data/accounts");
+  const googleAccountsDir = resolve44(googleRoot, "..", "data/accounts");
   const GOOGLE_PENDING_AUDIT_INTERVAL_MS = 3e5;
   const runGooglePendingAuditSafe = () => {
     try {
@@ -31197,10 +31543,10 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     firstRunDelayMs: 27e3,
     run: runGooglePendingAuditSafe
   });
-  const googleAuditScript = resolve43(googleRoot, "plugins/google/mcp/dist/scripts/account-audit.js");
+  const googleAuditScript = resolve44(googleRoot, "plugins/google/mcp/dist/scripts/account-audit.js");
   const GOOGLE_ACCOUNT_AUDIT_INTERVAL_MS = 36e5;
   const runGoogleAccountAudit = (ctx) => {
-    if (!existsSync45(googleAuditScript)) return;
+    if (!existsSync46(googleAuditScript)) return;
     try {
       const child = spawn3(process.execPath, [googleAuditScript], {
         env: { ...process.env, PLATFORM_ROOT: googleRoot },
@@ -31272,7 +31618,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..");
-  const publishScript = resolve43(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
+  const publishScript = resolve44(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
   const PUBLISH_INTERVAL_MS = 3e5;
   const bookingAccounts = () => {
     try {
@@ -31283,7 +31629,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     }
   };
   const spawnPublish = (account, ctx) => {
-    if (!existsSync45(publishScript)) return;
+    if (!existsSync46(publishScript)) return;
     try {
       const child = spawn3(process.execPath, [publishScript], {
         env: {
@@ -31302,21 +31648,21 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     }
   };
   const auditSnapshotAge = (account) => {
-    const availPath = resolve43(account.accountDir, "calendar-availability.json");
+    const availPath = resolve44(account.accountDir, "calendar-availability.json");
     let hasBookingSite = false;
     try {
-      if (existsSync45(availPath)) {
-        const cfg = JSON.parse(readFileSync46(availPath, "utf-8"));
+      if (existsSync46(availPath)) {
+        const cfg = JSON.parse(readFileSync47(availPath, "utf-8"));
         hasBookingSite = typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
       }
     } catch {
     }
     if (!hasBookingSite) return;
-    const statePath = resolve43(account.accountDir, "state", "booking-availability", "last-publish.json");
+    const statePath = resolve44(account.accountDir, "state", "booking-availability", "last-publish.json");
     let lastSuccessAt = null;
-    if (existsSync45(statePath)) {
+    if (existsSync46(statePath)) {
       try {
-        const rec = JSON.parse(readFileSync46(statePath, "utf-8"));
+        const rec = JSON.parse(readFileSync47(statePath, "utf-8"));
         lastSuccessAt = rec.lastSuccessAt ?? null;
       } catch {
         console.error(`[calendar-availability] op=audit accountId=${account.accountId} snapshotAgeMs=na reason=bad-state-file`);
@@ -31349,11 +31695,11 @@ startTimeEntryCensus(() => getSession());
 startLedgerCensus(() => getSession());
 {
   const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..");
-  const auditScript = resolve43(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
+  const auditScript = resolve44(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
   const auditLogDir = process.env.LOG_DIR ?? LOG_DIR;
   const CONNECTOR_AUDIT_INTERVAL_MS = 3e5;
   const runConnectorAudit = (ctx) => {
-    if (!existsSync45(auditScript)) return;
+    if (!existsSync46(auditScript)) return;
     try {
       const child = spawn3(process.execPath, [auditScript], {
         env: { ...process.env, PLATFORM_ROOT: auditPlatformRoot, LOG_DIR: auditLogDir },
@@ -31433,7 +31779,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app67.routes ?? []) {
+  for (const r of app69.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -31473,11 +31819,11 @@ try {
 var ADMINUSER_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 async function runAdminUserReconcileTick() {
   try {
-    if (!existsSync45(USERS_FILE)) {
+    if (!existsSync46(USERS_FILE)) {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
-    const usersRaw = readFileSync46(USERS_FILE, "utf-8").trim();
+    const usersRaw = readFileSync47(USERS_FILE, "utf-8").trim();
     if (!usersRaw) {
       console.error("[adminuser-self-heal] skip reason=empty-users-file");
       return;
@@ -31524,8 +31870,8 @@ registerLoop({
 });
 var USERS_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 function countUsersRows() {
-  if (!existsSync45(USERS_FILE)) return 0;
-  const raw = readFileSync46(USERS_FILE, "utf-8").trim();
+  if (!existsSync46(USERS_FILE)) return 0;
+  const raw = readFileSync47(USERS_FILE, "utf-8").trim();
   if (!raw) return 0;
   const users = JSON.parse(raw);
   return users.filter((u) => typeof u.userId === "string").length;
@@ -31658,7 +32004,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve43(process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..")),
+  platformRoot: resolve44(process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (isObserveAccount(msg.accountId)) {