@rubytech/create-maxy-code 0.1.505 → 0.1.507

package/payload/server/{chunk-HN4HFTXE.js → chunk-2WAXM5N2.js}

@@ -2657,234 +2657,10 @@ var serve = (options, listeningListener) => {
   return server;
 };
 
-// server/loop-registry.ts
-import { readFileSync } from "fs";
-var TAG = "[loop-registry]";
-var STALL_INTERVALS = 3;
-var entries = /* @__PURE__ */ new Map();
-var defaultCpuIo = {
-  ownCpuUs: () => {
-    const u = process.cpuUsage();
-    return u.user + u.system;
-  },
-  childCpuUs: (pid) => readPidCpuUs(pid)
-};
-var cpuIo = defaultCpuIo;
-function parsePidStatCpuUs(raw2) {
-  const close = raw2.lastIndexOf(")");
-  if (close === -1) return null;
-  const after = raw2.slice(close + 2).split(" ");
-  const utime = Number(after[11]);
-  const stime = Number(after[12]);
-  if (!Number.isFinite(utime) || !Number.isFinite(stime)) return null;
-  return (utime + stime) / 100 * 1e6;
-}
-function readPidCpuUs(pid) {
-  if (process.platform !== "linux") return null;
-  try {
-    return parsePidStatCpuUs(readFileSync(`/proc/${pid}/stat`, "utf8"));
-  } catch {
-    return null;
-  }
-}
-function sampleCpu(nowMs = Date.now()) {
-  for (const e of entries.values()) {
-    if (!e.cpuAttributable) {
-      e.cpuPct = null;
-      continue;
-    }
-    let childUs = 0;
-    for (const pid of [...e.children]) {
-      const us = cpuIo.childCpuUs(pid);
-      if (us === null) {
-        e.children.delete(pid);
-        continue;
-      }
-      childUs += us;
-    }
-    e.lastChildCpuUs = Math.max(e.lastChildCpuUs, childUs);
-    const totalUs = e.cumulativeCpuUs + e.lastChildCpuUs;
-    const p = e.prior;
-    if (p) {
-      const wallUs = (nowMs - p.atMs) * 1e3;
-      e.cpuPct = wallUs > 0 && totalUs >= p.cpuUs ? (totalUs - p.cpuUs) / wallUs * 100 : null;
-    } else {
-      e.cpuPct = null;
-    }
-    e.prior = { cpuUs: totalUs, atMs: nowMs };
-  }
-}
-var processPrior = null;
-function sampleProcessCpu(nowMs = Date.now()) {
-  const cpuUs = cpuIo.ownCpuUs();
-  let processPct = null;
-  if (processPrior) {
-    const wallUs = (nowMs - processPrior.atMs) * 1e3;
-    if (wallUs > 0) processPct = (cpuUs - processPrior.cpuUs) / wallUs * 100;
-  }
-  processPrior = { cpuUs, atMs: nowMs };
-  const rows = [...entries.values()];
-  const measured = rows.filter((e) => e.cpuPct !== null);
-  const attributedPct = measured.length === 0 ? null : measured.reduce((sum, e) => sum + (e.cpuPct ?? 0), 0);
-  const unattributedPct = processPct === null || attributedPct === null ? null : Math.max(0, processPct - attributedPct);
-  return { processPct, attributedPct, unattributedPct };
-}
-function messageOf(err) {
-  return err instanceof Error ? err.message : String(err);
-}
-function finish(e, startedAt, cpuStart, cpuAttributable, note, err) {
-  const cpu = process.cpuUsage(cpuStart);
-  e.running = false;
-  e.lastDurationMs = Date.now() - startedAt;
-  e.lastCpuMs = cpuAttributable ? (cpu.user + cpu.system) / 1e3 : null;
-  if (err !== null) {
-    e.lastOutcome = "error";
-    e.lastError = messageOf(err);
-    e.lastNote = null;
-    e.consecutiveFailures += 1;
-    console.error(
-      `${TAG} op=run name=${e.spec.name} outcome=error streak=${e.consecutiveFailures} ms=${e.lastDurationMs} err="${e.lastError}"`
-    );
-    return;
-  }
-  e.lastOutcome = "ok";
-  e.lastError = null;
-  e.lastNote = typeof note === "string" && note.length > 0 ? note : null;
-  e.lastSuccessMs = Date.now();
-  e.successCount += 1;
-  e.consecutiveFailures = 0;
-}
-function invoke(e) {
-  if (e.running) {
-    console.warn(`${TAG} op=skip name=${e.spec.name} reason=still-running`);
-    return;
-  }
-  e.running = true;
-  e.runCount += 1;
-  e.lastStartMs = Date.now();
-  const startedAt = e.lastStartMs;
-  const cpuStart = process.cpuUsage();
-  const ownStartUs = cpuIo.ownCpuUs();
-  const ctx = {
-    child: (pid) => {
-      if (typeof pid === "number" && Number.isFinite(pid)) e.children.add(pid);
-    }
-  };
-  let result;
-  try {
-    result = e.spec.run(ctx);
-  } catch (err) {
-    e.cumulativeCpuUs += Math.max(0, cpuIo.ownCpuUs() - ownStartUs);
-    finish(e, startedAt, cpuStart, true, null, err);
-    return;
-  }
-  if (result instanceof Promise) {
-    e.cpuAttributable = false;
-    result.then(
-      (note) => finish(e, startedAt, cpuStart, false, note, null),
-      (err) => finish(e, startedAt, cpuStart, false, null, err)
-    );
-    return;
-  }
-  e.cumulativeCpuUs += Math.max(0, cpuIo.ownCpuUs() - ownStartUs);
-  finish(e, startedAt, cpuStart, true, result, null);
-}
-function registerLoop(spec) {
-  if (entries.has(spec.name)) {
-    throw new Error(`${TAG} loop "${spec.name}" is already registered`);
-  }
-  const e = {
-    spec,
-    armedAtMs: Date.now(),
-    lastStartMs: null,
-    lastSuccessMs: null,
-    lastDurationMs: null,
-    lastCpuMs: null,
-    lastOutcome: null,
-    lastError: null,
-    lastNote: null,
-    runCount: 0,
-    successCount: 0,
-    consecutiveFailures: 0,
-    running: false,
-    timers: [],
-    cumulativeCpuUs: 0,
-    cpuAttributable: true,
-    children: /* @__PURE__ */ new Set(),
-    lastChildCpuUs: 0,
-    prior: null,
-    cpuPct: null
-  };
-  entries.set(spec.name, e);
-  const interval = setInterval(() => invoke(e), spec.intervalMs);
-  if (typeof interval.unref === "function") interval.unref();
-  e.timers.push(interval);
-  console.log(
-    `${TAG} op=arm name=${spec.name} intervalMs=${spec.intervalMs} firstRunMs=${spec.firstRunDelayMs ?? "interval"} detached=${spec.detached === true} armed=${entries.size}`
-  );
-  if (spec.firstRunDelayMs === 0) {
-    invoke(e);
-  } else if (spec.firstRunDelayMs !== void 0) {
-    const first = setTimeout(() => invoke(e), spec.firstRunDelayMs);
-    if (typeof first.unref === "function") first.unref();
-    e.timers.push(first);
-  }
-  let stopped = false;
-  return () => {
-    if (stopped) return;
-    stopped = true;
-    for (const t of e.timers) clearInterval(t);
-    if (entries.get(spec.name) === e) entries.delete(spec.name);
-    console.log(`${TAG} op=disarm name=${spec.name} armed=${entries.size}`);
-  };
-}
-function stateOf(e, nowMs) {
-  if (e.lastStartMs === null) {
-    return nowMs - e.armedAtMs < e.spec.intervalMs ? "waiting" : "never-run";
-  }
-  const overdue = nowMs - e.lastStartMs > e.spec.intervalMs * STALL_INTERVALS;
-  if (overdue) return "stalled";
-  if (e.running) return "running";
-  if (e.successCount === 0) return "never-succeeded";
-  if (e.consecutiveFailures > 0) return "failing";
-  return "ok";
-}
-function nextDueOf(e, nowMs) {
-  const elapsed = Math.max(0, nowMs - e.armedAtMs);
-  const ticks = Math.floor(elapsed / e.spec.intervalMs) + 1;
-  return e.armedAtMs + ticks * e.spec.intervalMs;
-}
-function listLoops(nowMs = Date.now()) {
-  return [...entries.values()].map((e) => ({
-    name: e.spec.name,
-    intervalMs: e.spec.intervalMs,
-    detached: e.spec.detached === true,
-    armedAtMs: e.armedAtMs,
-    lastStartMs: e.lastStartMs,
-    lastSuccessMs: e.lastSuccessMs,
-    lastDurationMs: e.lastDurationMs,
-    lastCpuMs: e.lastCpuMs,
-    cpuPct: e.cpuPct,
-    cpuAttributable: e.cpuAttributable,
-    lastOutcome: e.lastOutcome,
-    lastError: e.lastError,
-    lastNote: e.lastNote,
-    runCount: e.runCount,
-    successCount: e.successCount,
-    consecutiveFailures: e.consecutiveFailures,
-    running: e.running,
-    state: stateOf(e, nowMs),
-    nextDueMs: nextDueOf(e, nowMs)
-  }));
-}
-function armedCount() {
-  return entries.size;
-}
-
 // app/lib/paths.ts
 import { homedir } from "os";
 import { resolve, join } from "path";
-import { existsSync, readFileSync as readFileSync2 } from "fs";
+import { existsSync, readFileSync } from "fs";
 var configDirName = ".maxy";
 var commercialMode = false;
 var bundleMode = "none";
@@ -2900,7 +2676,7 @@ if (platformRoot) {
   if (existsSync(brandPath)) {
     let brand;
     try {
-      brand = JSON.parse(readFileSync2(brandPath, "utf-8"));
+      brand = JSON.parse(readFileSync(brandPath, "utf-8"));
     } catch (err) {
       const detail = (err instanceof Error ? err.message : String(err)).slice(0, 160);
       console.error(`[paths] error reason=brand-config-missing path=${brandPath} detail="parse failed: ${detail.replace(/"/g, "'")}"`);
@@ -2970,1342 +2746,1597 @@ var TELEGRAM_ADMIN_WEBHOOK_SECRET_FILE = resolve(MAXY_DIR, ".telegram-admin-webh
 var VISITOR_TOKEN_SECRET_FILE = resolve(MAXY_DIR, "credentials", "visitor-token-secret");
 var CLAUDE_CREDENTIALS_FILE = resolve(MAXY_DIR, ".claude", ".credentials.json");
 
-// app/lib/vnc-logger.ts
-import { appendFileSync, mkdirSync } from "fs";
+// app/lib/system-path-slugs.ts
+var SYSTEM_PATH_SLUGS = ["public", "public-chat", "chat", "graph", "data", "browser"];
+
+// app/lib/claude-agent/account.ts
 import { resolve as resolve2 } from "path";
-var VNC_LOG_FILE = resolve2(LOG_DIR, "vnc-boot.log");
-try {
-  mkdirSync(LOG_DIR, { recursive: true });
-} catch (err) {
-  console.error(`[vnc-log-fail] mkdir ${LOG_DIR} failed: ${err.message}`);
-}
-function vncLog(phase, fields = {}) {
-  const ts = (/* @__PURE__ */ new Date()).toISOString();
-  const kv = Object.entries(fields).map(([k, v]) => `${k}=${JSON.stringify(v)}`).join(" ");
-  const line = kv.length > 0 ? `[${ts}] [${phase}] ${kv}
-` : `[${ts}] [${phase}]
-`;
-  try {
-    appendFileSync(VNC_LOG_FILE, line);
-  } catch (err) {
-    console.error(`[vnc-log-fail] ${err.message} \u2014 dropped: ${line.slice(0, 300).trim()}`);
+import { readFileSync as readFileSync3, readdirSync, existsSync as existsSync3, statSync } from "fs";
+
+// ../lib/brand-templating/src/index.ts
+import { join as join2 } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+var PLACEHOLDER = "{{productName}}";
+var cachedProductName = null;
+function brandJsonPath() {
+  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT;
+  if (!platformRoot2) {
+    throw new Error(
+      "[skill-loader] MAXY_PLATFORM_ROOT not set \u2014 cannot resolve brand.json"
+    );
   }
+  return join2(platformRoot2, "config", "brand.json");
 }
-var corrCounter = 0;
-function newCorrId() {
-  corrCounter = corrCounter + 1 & 4294967295;
-  const counterHex = corrCounter.toString(16).padStart(8, "0");
-  const randomHex = Math.floor(Math.random() * 16777215).toString(16).padStart(6, "0");
-  return `${counterHex}-${randomHex}`;
-}
-function sanitizeClientCorrId(raw2) {
-  if (!raw2) return null;
-  if (raw2.length > 32) return null;
-  if (!/^[A-Za-z0-9_-]+$/.test(raw2)) return null;
-  return raw2;
-}
-function formatKv(fields) {
-  return Object.entries(fields).filter(([, v]) => v !== void 0).map(([k, v]) => `${k}=${JSON.stringify(v)}`).join(" ");
-}
-function httpLog(fields) {
-  console.error(`[http] ${formatKv(fields)}`);
-}
-function websockifyLog(event, fields = {}) {
-  console.error(`[websockify] ${formatKv({ event, ...fields })}`);
-}
-
-// ../lib/admin-access-password/src/index.ts
-import { scrypt, randomBytes, timingSafeEqual } from "crypto";
-import { existsSync as existsSync2, readFileSync as readFileSync3, writeFileSync, renameSync, unlinkSync, appendFileSync as appendFileSync2, mkdirSync as mkdirSync2 } from "fs";
-import { dirname } from "path";
-var SCRYPT_N = 16384;
-var SCRYPT_R = 8;
-var SCRYPT_P = 1;
-var SCRYPT_KEYLEN = 64;
-function id8(value) {
-  return value.slice(0, 8);
-}
-function rowIds(users) {
-  return users.map((u) => id8(u.userId)).join(",");
-}
-function appendUsersAuditLine(audit, fields) {
-  const sess = audit.session ? ` session=${id8(audit.session)}` : "";
-  const actor = audit.actor.includes("-") ? id8(audit.actor) : audit.actor;
-  const targetFields = audit.target !== void 0 ? ` target=${audit.target.includes("-") ? id8(audit.target) : audit.target} explicitUserId=${audit.explicitUserId ? "true" : "false"}` : "";
-  const line = `[users-audit] action=${fields.action} actor=${actor}${targetFields}${sess} field=${fields.field} rowsBefore=${fields.rowsBefore} rowsAfter=${fields.rowsAfter} ts=${(/* @__PURE__ */ new Date()).toISOString()}
-`;
+function getBrandProductName() {
+  if (cachedProductName !== null) return cachedProductName;
+  const path = brandJsonPath();
+  if (!existsSync2(path)) {
+    throw new Error(`[skill-loader] brand.json missing at ${path}`);
+  }
+  let parsed;
   try {
-    mkdirSync2(dirname(audit.logFile), { recursive: true, mode: 448 });
-    appendFileSync2(audit.logFile, line, { mode: 384 });
+    parsed = JSON.parse(readFileSync2(path, "utf-8"));
   } catch (err) {
-    console.error(
-      `[users-audit] op=write-failed logFile=${audit.logFile} error=${err instanceof Error ? err.message : String(err)}`
+    throw new Error(
+      `[skill-loader] brand.json unreadable at ${path}: ${err instanceof Error ? err.message : String(err)}`
     );
   }
+  const value = parsed.productName;
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new Error(
+      `[skill-loader] brand.json at ${path} has missing or empty productName`
+    );
+  }
+  cachedProductName = value;
+  return value;
 }
-function scryptAsync(password, salt) {
-  return new Promise((resolve7, reject) => {
-    scrypt(password, salt, SCRYPT_KEYLEN, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P }, (err, key) => {
-      if (err) reject(err);
-      else resolve7(key);
-    });
-  });
-}
-async function hashAccessPassword(password) {
-  const salt = randomBytes(32);
-  const hash = await scryptAsync(password, salt);
-  return `${salt.toString("hex")}:${hash.toString("hex")}`;
-}
-async function matchesHash(password, stored) {
-  const colon = stored.indexOf(":");
-  if (colon === -1) return false;
-  const salt = Buffer.from(stored.slice(0, colon), "hex");
-  const storedHash = Buffer.from(stored.slice(colon + 1), "hex");
-  if (storedHash.length !== SCRYPT_KEYLEN) return false;
-  let computed;
+function substituteBrandPlaceholders(content, sourcePath) {
+  if (!content.includes(PLACEHOLDER)) return content;
+  let productName;
   try {
-    computed = await scryptAsync(password, salt);
-  } catch {
-    return false;
+    productName = getBrandProductName();
+  } catch (err) {
+    console.error(
+      `[skill-loader] ERROR: brand.json missing \u2014 cannot resolve productName for skill ${sourcePath}`
+    );
+    throw err;
   }
-  return timingSafeEqual(computed, storedHash);
-}
-function readUsers(usersFile) {
-  if (!existsSync2(usersFile)) return [];
-  const raw2 = readFileSync3(usersFile, "utf-8").trim();
-  if (!raw2) return [];
-  const parsed = JSON.parse(raw2);
-  if (!Array.isArray(parsed)) throw new Error("users.json is not an array");
-  return parsed;
+  const occurrences = content.split(PLACEHOLDER).length - 1;
+  const substituted = content.split(PLACEHOLDER).join(productName);
+  console.log(
+    `[skill-loader] brand-substituted productName=${productName} skill=${sourcePath} occurrences=${occurrences}`
+  );
+  return substituted;
 }
-function writeUsersAtomic(usersFile, users) {
-  const tmp = `${usersFile}.tmp-${process.pid}`;
-  writeFileSync(tmp, JSON.stringify(users, null, 2) + "\n", { mode: 384 });
-  renameSync(tmp, usersFile);
+
+// app/lib/claude-agent/account.ts
+var PLATFORM_ROOT2 = process.env.MAXY_PLATFORM_ROOT ?? resolve2(process.cwd(), "..");
+var ACCOUNTS_DIR = resolve2(PLATFORM_ROOT2, "..", "data/accounts");
+if (!existsSync3(PLATFORM_ROOT2)) {
+  throw new Error(
+    `PLATFORM_ROOT does not exist: ${PLATFORM_ROOT2}
+Set the MAXY_PLATFORM_ROOT environment variable to the absolute path of the platform directory.`
+  );
 }
-async function setAccessPassword(userId, password, usersFile, audit) {
-  const users = readUsers(usersFile);
-  const idx = users.findIndex((u) => u.userId === userId);
-  if (idx === -1) throw new Error(`no users.json record for userId=${userId}`);
-  if (await accessPasswordCollides(password, usersFile, userId)) {
-    throw new Error("accessHash collision: password already in use by another admin");
+var _stubDirsLoggedThisBoot = /* @__PURE__ */ new Set();
+function listValidAccounts() {
+  if (!existsSync3(ACCOUNTS_DIR)) return [];
+  const out = [];
+  const entries2 = readdirSync(ACCOUNTS_DIR, { withFileTypes: true });
+  for (const entry of entries2) {
+    if (!entry.isDirectory()) continue;
+    if (entry.name.startsWith(".")) continue;
+    const accountDir = resolve2(ACCOUNTS_DIR, entry.name);
+    const configPath = resolve2(accountDir, "account.json");
+    if (!existsSync3(configPath)) {
+      if (!_stubDirsLoggedThisBoot.has(entry.name)) {
+        console.error(
+          `[platform] accounts-state STUB-DIR id=${entry.name} \u2014 onboarding leak; remove or repair`
+        );
+        _stubDirsLoggedThisBoot.add(entry.name);
+      }
+      continue;
+    }
+    let config;
+    try {
+      config = JSON.parse(readFileSync3(configPath, "utf-8"));
+    } catch {
+      console.error(
+        `[platform] accounts-state CORRUPT-JSON id=${entry.name} \u2014 account.json failed to parse; treating as stub`
+      );
+      continue;
+    }
+    out.push({ accountId: config.accountId, accountDir, config });
   }
-  const rows = rowIds(users);
-  users[idx] = { ...users[idx], accessHash: await hashAccessPassword(password) };
-  writeUsersAtomic(usersFile, users);
-  appendUsersAuditLine(audit, { action: "set-access", field: "accessHash", rowsBefore: rows, rowsAfter: rows });
+  return out;
 }
-async function verifyAccessPassword(password, usersFile) {
-  let users;
-  try {
-    users = readUsers(usersFile);
-  } catch {
-    return null;
+function isValidAccountId(id) {
+  return listValidAccounts().some((a) => a.accountId === id);
+}
+function resolveAccount() {
+  if (!existsSync3(ACCOUNTS_DIR)) return null;
+  let usersJsonUserId = null;
+  if (existsSync3(USERS_FILE)) {
+    try {
+      const raw2 = readFileSync3(USERS_FILE, "utf-8").trim();
+      if (raw2) {
+        const users = JSON.parse(raw2);
+        if (users.length > 0) {
+          usersJsonUserId = users[0].userId;
+        }
+      }
+    } catch {
+    }
   }
-  for (const u of users) {
-    if (typeof u.accessHash === "string" && await matchesHash(password, u.accessHash)) {
-      return u.userId;
+  const entries2 = readdirSync(ACCOUNTS_DIR, { withFileTypes: true });
+  let fallback = null;
+  for (const entry of entries2) {
+    if (!entry.isDirectory()) continue;
+    const configPath = resolve2(ACCOUNTS_DIR, entry.name, "account.json");
+    if (!existsSync3(configPath)) continue;
+    const raw2 = readFileSync3(configPath, "utf-8");
+    let config;
+    try {
+      config = JSON.parse(raw2);
+    } catch {
+      console.error(`[maxy] account.json is corrupt at ${configPath} \u2014 skipping`);
+      continue;
+    }
+    if (!config.adminModel || !config.publicModel) {
+      throw new Error(
+        `[maxy] account.json at ${configPath} is missing required model fields (adminModel / publicModel). Update account.json with valid model identifiers.`
+      );
+    }
+    const result = {
+      accountId: config.accountId,
+      accountDir: resolve2(ACCOUNTS_DIR, entry.name),
+      config
+    };
+    if (usersJsonUserId && config.admins?.some((a) => a.userId === usersJsonUserId)) {
+      return result;
+    }
+    if (!fallback) {
+      fallback = result;
     }
   }
-  return null;
-}
-async function accessPasswordCollides(password, usersFile, excludeUserId) {
-  let users;
-  try {
-    users = readUsers(usersFile);
-  } catch {
-    return false;
+  if (usersJsonUserId && fallback) {
+    console.warn(
+      `[maxy] resolveAccount: no account matches users.json userId ${usersJsonUserId} \u2014 falling back to ${fallback.accountId}`
+    );
   }
-  for (const u of users) {
-    if (u.userId === excludeUserId) continue;
-    if (typeof u.accessHash === "string" && await matchesHash(password, u.accessHash)) {
-      return true;
-    }
+  return fallback;
+}
+function readAgentFile(accountDir, agentName, filename) {
+  const filePath = resolve2(accountDir, "agents", agentName, filename);
+  if (!existsSync3(filePath)) return null;
+  const raw2 = readFileSync3(filePath, "utf-8");
+  if (filename.endsWith(".md")) {
+    return substituteBrandPlaceholders(raw2, filePath);
   }
-  return false;
+  return raw2;
 }
-function anyAccessPasswordConfigured(usersFile) {
-  let users;
-  try {
-    users = readUsers(usersFile);
-  } catch {
+var RESERVED_SLUGS = /* @__PURE__ */ new Set(["admin", "api", "assets", "agent-assets", "brand", "bot", "privacy"]);
+var SHADOWED_SLUGS = new Set(SYSTEM_PATH_SLUGS);
+var SLUG_PATTERN = /^[a-z][a-z0-9-]{2,49}$/;
+function validateAgentSlug(slug) {
+  if (!SLUG_PATTERN.test(slug)) return false;
+  if (RESERVED_SLUGS.has(slug)) {
+    console.error(`[agent-slug] op=reject slug=${slug} reason=reserved`);
     return false;
   }
-  return users.some((u) => typeof u.accessHash === "string" && u.accessHash.length > 0);
-}
-function accessStoreUnreadable(usersFile) {
-  if (!existsSync2(usersFile)) return false;
-  try {
-    readUsers(usersFile);
+  if (SHADOWED_SLUGS.has(slug)) {
+    console.error(`[agent-slug] op=reject slug=${slug} reason=shadowed`);
     return false;
-  } catch {
-    return true;
   }
+  return true;
 }
-function migrateLegacyRemotePassword(usersFile, legacyFile, ownerUserId, audit) {
-  if (!existsSync2(legacyFile)) return "noop-no-legacy";
-  const legacy = readFileSync3(legacyFile, "utf-8").trim();
-  const users = readUsers(usersFile);
-  const idx = users.findIndex((u) => u.userId === ownerUserId);
-  if (idx === -1) return "noop-no-owner";
-  const existing = users[idx].accessHash;
-  if (typeof existing === "string" && existing.length > 0) {
-    unlinkSync(legacyFile);
-    return "noop-owner-has-hash";
+function resolveDefaultAgentSlug(accountDir) {
+  const configPath = resolve2(accountDir, "account.json");
+  if (!existsSync3(configPath)) {
+    console.error("[agent-resolve] account.json not found \u2014 cannot resolve defaultAgent");
+    return null;
   }
-  if (!legacy.includes(":")) {
-    unlinkSync(legacyFile);
-    return "noop-no-legacy";
+  let config;
+  try {
+    config = JSON.parse(readFileSync3(configPath, "utf-8"));
+  } catch (err) {
+    console.error("[agent-resolve] failed to read account.json:", err);
+    return null;
   }
-  const rows = rowIds(users);
-  users[idx] = { ...users[idx], accessHash: legacy };
-  writeUsersAtomic(usersFile, users);
-  unlinkSync(legacyFile);
-  appendUsersAuditLine(audit, { action: "migrate", field: "accessHash", rowsBefore: rows, rowsAfter: rows });
-  return "migrated";
-}
-function readLegacyRemoteHash(legacyFile) {
-  if (!existsSync2(legacyFile)) return null;
-  const raw2 = readFileSync3(legacyFile, "utf-8").trim();
-  return raw2.includes(":") ? raw2 : null;
-}
-
-// app/lib/password-strength.ts
-function validatePasswordStrength(password) {
-  return [
-    { key: "length", label: "At least 8 characters", met: password.length >= 8 },
-    { key: "number", label: "Contains a number", met: /\d/.test(password) },
-    { key: "special", label: "Contains a special character", met: /[^A-Za-z0-9]/.test(password) },
-    { key: "whitespace", label: "No spaces", met: password.length > 0 && !/\s/.test(password) }
-  ];
-}
-function isPasswordValid(password) {
-  return validatePasswordStrength(password).every((r) => r.met);
+  if (!config.defaultAgent) {
+    console.error("[agent-resolve] defaultAgent not configured in account.json \u2014 set it via the connect-whatsapp skill");
+    return null;
+  }
+  const agentConfigPath = resolve2(accountDir, "agents", config.defaultAgent, "config.json");
+  if (!existsSync3(agentConfigPath)) {
+    console.error(`[agent-resolve] defaultAgent="${config.defaultAgent}" has no config.json at ${agentConfigPath}`);
+    return null;
+  }
+  return config.defaultAgent;
 }
-
-// app/lib/remote-auth.ts
-import { scrypt as scrypt2, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2, createHmac } from "crypto";
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync2, mkdirSync as mkdirSync3 } from "fs";
-import { dirname as dirname2 } from "path";
-var SCRYPT_N2 = 16384;
-var SCRYPT_R2 = 8;
-var SCRYPT_P2 = 1;
-var SCRYPT_KEYLEN2 = 64;
-function scryptAsync2(password, salt) {
-  return new Promise((resolve7, reject) => {
-    scrypt2(password, salt, SCRYPT_KEYLEN2, { N: SCRYPT_N2, r: SCRYPT_R2, p: SCRYPT_P2 }, (err, key) => {
-      if (err) reject(err);
-      else resolve7(key);
-    });
-  });
+function estimateTokens(text) {
+  return Math.ceil(text.length / 4);
 }
-async function hashPassword(password) {
-  const salt = randomBytes2(32);
-  const hash = await scryptAsync2(password, salt);
-  return `${salt.toString("hex")}:${hash.toString("hex")}`;
+function resolveAgentConfig(accountDir, agentName) {
+  let model = null;
+  let status = null;
+  let displayName = null;
+  let image = null;
+  let imageShape = null;
+  let showAgentName = false;
+  let knowledgeKeywords = null;
+  let accessMode = "open";
+  const MAX_KNOWLEDGE_KEYWORDS = 5;
+  const configRaw = readAgentFile(accountDir, agentName, "config.json");
+  if (configRaw) {
+    let parsed;
+    try {
+      parsed = JSON.parse(configRaw);
+    } catch {
+      console.warn(`[agent-config] ${agentName}/config.json: invalid JSON \u2014 using defaults`);
+      parsed = {};
+    }
+    model = typeof parsed.model === "string" ? parsed.model : null;
+    status = typeof parsed.status === "string" ? parsed.status : null;
+    displayName = typeof parsed.displayName === "string" ? parsed.displayName : null;
+    image = typeof parsed.image === "string" ? parsed.image : null;
+    if (typeof parsed.imageShape === "string" && ["circle", "rounded"].includes(parsed.imageShape)) {
+      imageShape = parsed.imageShape;
+    }
+    if (parsed.showAgentName === true) {
+      showAgentName = true;
+    } else if (parsed.showAgentName === "none") {
+      showAgentName = "none";
+    }
+    if (image || imageShape || showAgentName) {
+      console.log(`[agent-config] ${agentName}: image=${image || "(none)"} imageShape=${imageShape || "(none)"} showAgentName=${showAgentName}`);
+    }
+    if (typeof parsed.accessMode === "string" && ["gated", "paid"].includes(parsed.accessMode)) {
+      accessMode = parsed.accessMode;
+    }
+    if (Array.isArray(parsed.knowledgeKeywords) && parsed.knowledgeKeywords.length > 0) {
+      const filtered = parsed.knowledgeKeywords.filter((k) => typeof k === "string" && k.trim()).map((k) => k.replace(/,/g, "").trim().toLowerCase()).filter(Boolean);
+      if (filtered.length > MAX_KNOWLEDGE_KEYWORDS) {
+        console.warn(`[agent-config] ${agentName}: knowledgeKeywords has ${filtered.length} entries \u2014 capping at ${MAX_KNOWLEDGE_KEYWORDS}`);
+      }
+      knowledgeKeywords = filtered.length > 0 ? filtered.slice(0, MAX_KNOWLEDGE_KEYWORDS) : null;
+    }
+  }
+  let knowledge = null;
+  let knowledgeBaked = false;
+  const agentDir = resolve2(accountDir, "agents", agentName);
+  const knowledgePath = resolve2(agentDir, "KNOWLEDGE.md");
+  const summaryPath = resolve2(agentDir, "KNOWLEDGE-SUMMARY.md");
+  const hasKnowledge = existsSync3(knowledgePath);
+  const hasSummary = existsSync3(summaryPath);
+  if (hasKnowledge && hasSummary) {
+    const knowledgeMtime = statSync(knowledgePath).mtimeMs;
+    const summaryMtime = statSync(summaryPath).mtimeMs;
+    if (summaryMtime >= knowledgeMtime) {
+      knowledge = readFileSync3(summaryPath, "utf-8");
+    } else {
+      console.warn(`[agent-config] ${agentName}: KNOWLEDGE-SUMMARY.md is stale (KNOWLEDGE.md is newer) \u2014 using full knowledge`);
+      knowledge = readFileSync3(knowledgePath, "utf-8");
+    }
+    knowledgeBaked = true;
+  } else if (hasKnowledge) {
+    knowledge = readFileSync3(knowledgePath, "utf-8");
+    knowledgeBaked = true;
+  }
+  let budget = null;
+  const identityRaw = readAgentFile(accountDir, agentName, "IDENTITY.md");
+  const soulRaw = readAgentFile(accountDir, agentName, "SOUL.md");
+  if (identityRaw || soulRaw || knowledge) {
+    const identityTokens = identityRaw ? estimateTokens(identityRaw) : 0;
+    const soulTokens = soulRaw ? estimateTokens(soulRaw) : 0;
+    const knowledgeTokens = knowledge ? estimateTokens(knowledge) : 0;
+    budget = {
+      identity: identityTokens,
+      soul: soulTokens,
+      knowledge: knowledgeTokens,
+      plugins: 0,
+      total: identityTokens + soulTokens + knowledgeTokens
+    };
+  }
+  return { model, status, displayName, image, imageShape, showAgentName, knowledge, knowledgeBaked, knowledgeKeywords, budget, accessMode };
 }
-function isRemoteAuthConfigured() {
-  if (anyAccessPasswordConfigured(USERS_FILE)) return true;
-  if (accessStoreUnreadable(USERS_FILE)) return true;
-  return readLegacyRemoteHash(REMOTE_PASSWORD_FILE) !== null;
+function isActiveAgentSlug(accountDir, slug) {
+  return resolveAgentConfig(accountDir, slug).status === "active";
 }
-async function setRemotePassword(password) {
-  const hash = await hashPassword(password);
-  writeFileSync2(REMOTE_PASSWORD_FILE, hash, "utf-8");
+function getDefaultAccountId() {
+  return resolveAccount()?.accountId ?? null;
 }
-async function verifyRemotePassword(password) {
-  const matchedUserId = await verifyAccessPassword(password, USERS_FILE);
-  if (matchedUserId) return { ok: true, hashBytes: SCRYPT_KEYLEN2, userId: matchedUserId };
-  const legacy = readLegacyRemoteHash(REMOTE_PASSWORD_FILE);
-  if (legacy && await matchesHash(password, legacy)) {
-    return { ok: true, hashBytes: SCRYPT_KEYLEN2, userId: null };
+
+// ../lib/require-port-env/src/index.ts
+var MissingPortEnvError = class extends Error {
+  envName;
+  tag;
+  failLine;
+  constructor(envName, tag, failLine, message) {
+    super(message);
+    this.name = "MissingPortEnvError";
+    this.envName = envName;
+    this.tag = tag;
+    this.failLine = failLine;
   }
-  const configured = anyAccessPasswordConfigured(USERS_FILE) || legacy !== null;
-  return { ok: false, why: configured ? "password-mismatch" : "no-password-file", hashBytes: 0 };
+};
+var VALID_PORT_MIN = 1;
+var VALID_PORT_MAX = 65535;
+function requirePortEnv(envName, options = {}) {
+  const tag = options.tag ?? "port-env";
+  const failLine = options.failLine ?? "missing-port-env";
+  const raw2 = process.env[envName];
+  if (raw2 === void 0 || raw2 === "") {
+    const msg = `[${tag}] ${failLine} reason=missing-env env=${envName}`;
+    throw new MissingPortEnvError(envName, tag, failLine, msg);
+  }
+  const parsed = Number.parseInt(raw2, 10);
+  if (!Number.isInteger(parsed) || parsed < VALID_PORT_MIN || parsed > VALID_PORT_MAX || String(parsed) !== raw2.trim()) {
+    const msg = `[${tag}] ${failLine} reason=invalid-port-env env=${envName} value=${JSON.stringify(raw2)}`;
+    throw new MissingPortEnvError(envName, tag, failLine, msg);
+  }
+  return parsed;
 }
+
+// app/lib/claude-agent/session-store.ts
+import { createHash } from "crypto";
 var SESSION_TTL_MS = 24 * 60 * 60 * 1e3;
-var TOKEN_PREFIX = "v1.";
-var SECRET_BYTES = 32;
-var NONCE_BYTES = 16;
-var cachedSecret = null;
-function getSecret() {
-  if (cachedSecret) return cachedSecret;
-  try {
-    const hex2 = readFileSync4(REMOTE_SESSION_SECRET_FILE, "utf-8").trim();
-    if (hex2.length === SECRET_BYTES * 2) {
-      cachedSecret = Buffer.from(hex2, "hex");
-      return cachedSecret;
-    }
-  } catch {
+var sessionStore = /* @__PURE__ */ new Map();
+function fingerprintSessionKey(raw2) {
+  if (typeof raw2 !== "string" || !raw2) return raw2;
+  if (/^sk_[a-f0-9]{16}$/.test(raw2)) return raw2;
+  if (!raw2.startsWith("v1.")) return raw2;
+  return `sk_${createHash("sha256").update(raw2).digest("hex").slice(0, 16)}`;
+}
+function registerSession(cacheKey2, agentType, accountId, _unused, userId, userName, role) {
+  const existing = sessionStore.get(cacheKey2);
+  if (existing) {
+    existing.agentType = agentType;
+    existing.accountId = accountId;
+    existing.userId = userId ?? existing.userId;
+    existing.userName = userName ?? existing.userName;
+    existing.role = role ?? existing.role;
+    return;
   }
-  const fresh = randomBytes2(SECRET_BYTES).toString("hex");
-  try {
-    mkdirSync3(dirname2(REMOTE_SESSION_SECRET_FILE), { recursive: true, mode: 448 });
-    writeFileSync2(REMOTE_SESSION_SECRET_FILE, fresh, { mode: 384, flag: "wx" });
-  } catch {
+  sessionStore.set(cacheKey2, { agentType, createdAt: Date.now(), accountId, userId, userName, role });
+}
+function validateSession(cacheKey2, agentType, _signedSessionToken) {
+  const session = sessionStore.get(cacheKey2);
+  if (!session) return { ok: false, reason: "session-not-registered" };
+  if (session.agentType !== agentType) return { ok: false, reason: "agent-type-mismatch" };
+  if (Date.now() - session.createdAt > SESSION_TTL_MS) {
+    sessionStore.delete(cacheKey2);
+    return { ok: false, reason: "session-expired-age" };
   }
-  const hex = readFileSync4(REMOTE_SESSION_SECRET_FILE, "utf-8").trim();
-  cachedSecret = Buffer.from(hex, "hex");
-  return cachedSecret;
+  return { ok: true };
 }
-function base64urlEncode(buf) {
-  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+function getAccountIdForSession(cacheKey2) {
+  return sessionStore.get(cacheKey2)?.accountId;
 }
-function base64urlDecode(s) {
-  const padded = s.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - s.length % 4) % 4);
-  return Buffer.from(padded, "base64");
+function getUserIdForSession(cacheKey2) {
+  return sessionStore.get(cacheKey2)?.userId;
 }
-function signPayload(payloadJson, secret) {
-  return base64urlEncode(createHmac("sha256", secret).update(payloadJson).digest());
+function getUserNameForSession(cacheKey2) {
+  return sessionStore.get(cacheKey2)?.userName;
 }
-function createRemoteSession(opts = {}) {
-  const payload = { c: opts.now ?? Date.now(), n: randomBytes2(NONCE_BYTES).toString("hex") };
-  const payloadJson = JSON.stringify(payload);
-  const payloadB64 = base64urlEncode(Buffer.from(payloadJson, "utf-8"));
-  const sig = signPayload(payloadJson, getSecret());
-  return `${TOKEN_PREFIX}${payloadB64}.${sig}`;
+function getRoleForSession(cacheKey2) {
+  return sessionStore.get(cacheKey2)?.role;
 }
-function parseToken(token) {
-  if (!token.startsWith(TOKEN_PREFIX)) return null;
-  const rest = token.slice(TOKEN_PREFIX.length);
-  const dot = rest.indexOf(".");
-  if (dot === -1) return null;
-  const payloadB64 = rest.slice(0, dot);
-  const sigB64 = rest.slice(dot + 1);
-  if (!payloadB64 || !sigB64) return null;
-  let payloadJson;
-  try {
-    payloadJson = base64urlDecode(payloadB64).toString("utf-8");
-  } catch {
-    return null;
-  }
-  const expected = signPayload(payloadJson, getSecret());
-  const expectedBuf = Buffer.from(expected, "utf-8");
-  const provBuf = Buffer.from(sigB64, "utf-8");
-  const signatureValid = expectedBuf.length === provBuf.length && timingSafeEqual2(expectedBuf, provBuf);
-  let payload;
-  try {
-    payload = JSON.parse(payloadJson);
-  } catch {
-    return null;
-  }
-  if (!payload || typeof payload !== "object" || typeof payload.c !== "number" || typeof payload.n !== "string") {
-    return null;
-  }
-  return { payload, signatureValid };
+function getSessionIdForSession(cacheKey2) {
+  return sessionStore.get(cacheKey2)?.sessionId;
 }
-function validateRemoteSession(token, now = Date.now()) {
-  if (!token) return false;
-  const parsed = parseToken(token);
-  if (!parsed || !parsed.signatureValid) return false;
-  return now - parsed.payload.c <= SESSION_TTL_MS;
+function setSessionIdForSession(cacheKey2, sessionId) {
+  const session = sessionStore.get(cacheKey2);
+  if (!session) return false;
+  session.sessionId = sessionId;
+  return true;
 }
-function describeRemoteSession(token, now = Date.now()) {
-  if (!token) return { present: false, expired: false };
-  const parsed = parseToken(token);
-  if (!parsed || !parsed.signatureValid) return { present: false, expired: false };
-  return { present: true, expired: now - parsed.payload.c > SESSION_TTL_MS };
+function setWantsPriorConversation(cacheKey2) {
+  const session = sessionStore.get(cacheKey2);
+  if (session) session.wantsPriorConversation = true;
 }
-function normalizeIp(ip) {
-  if (!ip) return void 0;
-  const trimmed = ip.trim();
-  if (trimmed.startsWith("::ffff:")) return trimmed.slice(7);
-  return trimmed;
+function unregisterSession(cacheKey2) {
+  return sessionStore.delete(cacheKey2);
 }
-function isLoopback(ip) {
-  return ip === "127.0.0.1" || ip.startsWith("127.") || ip === "::1";
+function getSessionKeyBySessionId(_sessionId) {
+  return void 0;
 }
-function isPrivateIp(ip) {
-  const parts = ip.split(".");
-  if (parts.length !== 4) return false;
-  const a = parseInt(parts[0], 10);
-  const b = parseInt(parts[1], 10);
-  if (Number.isNaN(a) || Number.isNaN(b)) return false;
-  if (a === 10) return true;
-  if (a === 172 && b >= 16 && b <= 31) return true;
-  if (a === 192 && b === 168) return true;
-  if (a === 169 && b === 254) return true;
-  return false;
+
+// server/loop-registry.ts
+import { readFileSync as readFileSync4 } from "fs";
+var TAG = "[loop-registry]";
+var STALL_INTERVALS = 3;
+var entries = /* @__PURE__ */ new Map();
+var defaultCpuIo = {
+  ownCpuUs: () => {
+    const u = process.cpuUsage();
+    return u.user + u.system;
+  },
+  childCpuUs: (pid) => readPidCpuUs(pid)
+};
+var cpuIo = defaultCpuIo;
+function parsePidStatCpuUs(raw2) {
+  const close = raw2.lastIndexOf(")");
+  if (close === -1) return null;
+  const after = raw2.slice(close + 2).split(" ");
+  const utime = Number(after[11]);
+  const stime = Number(after[12]);
+  if (!Number.isFinite(utime) || !Number.isFinite(stime)) return null;
+  return (utime + stime) / 100 * 1e6;
 }
-function classifyNormalizedIp(ip) {
-  if (isLoopback(ip) || isPrivateIp(ip)) return "lan";
-  return "external";
+function readPidCpuUs(pid) {
+  if (process.platform !== "linux") return null;
+  try {
+    return parsePidStatCpuUs(readFileSync4(`/proc/${pid}/stat`, "utf8"));
+  } catch {
+    return null;
+  }
 }
-function resolveClientIp(remoteAddress, xForwardedFor) {
-  const remote = normalizeIp(remoteAddress);
-  if (!remote) return { ip: "", kind: "unknown" };
-  if (isLoopback(remote) && xForwardedFor) {
-    const firstIp = normalizeIp(xForwardedFor.split(",")[0]?.trim());
-    if (firstIp) {
-      return { ip: firstIp, kind: classifyNormalizedIp(firstIp) };
+function sampleCpu(nowMs = Date.now()) {
+  for (const e of entries.values()) {
+    if (!e.cpuAttributable) {
+      e.cpuPct = null;
+      continue;
+    }
+    let childUs = 0;
+    for (const pid of [...e.children]) {
+      const us = cpuIo.childCpuUs(pid);
+      if (us === null) {
+        e.children.delete(pid);
+        continue;
+      }
+      childUs += us;
     }
+    e.lastChildCpuUs = Math.max(e.lastChildCpuUs, childUs);
+    const totalUs = e.cumulativeCpuUs + e.lastChildCpuUs;
+    const p = e.prior;
+    if (p) {
+      const wallUs = (nowMs - p.atMs) * 1e3;
+      e.cpuPct = wallUs > 0 && totalUs >= p.cpuUs ? (totalUs - p.cpuUs) / wallUs * 100 : null;
+    } else {
+      e.cpuPct = null;
+    }
+    e.prior = { cpuUs: totalUs, atMs: nowMs };
   }
-  return { ip: remote, kind: classifyNormalizedIp(remote) };
-}
-var MAX_ATTEMPTS = 5;
-var LOCKOUT_MS = 15 * 60 * 1e3;
-var LOCAL_BUCKET = "__local__";
-var rateLimitMap = /* @__PURE__ */ new Map();
-function bucketKey(client) {
-  return client.kind === "external" ? client.ip : LOCAL_BUCKET;
 }
-function checkRateLimit(client) {
-  const key = bucketKey(client);
-  const rec = rateLimitMap.get(key);
-  if (!rec) return null;
-  if (rec.lockedUntil > Date.now()) {
-    const remaining = Math.ceil((rec.lockedUntil - Date.now()) / 1e3);
-    return `Too many attempts. Try again in ${remaining}s`;
-  }
-  if (rec.lockedUntil > 0) {
-    rateLimitMap.delete(key);
+var processPrior = null;
+function sampleProcessCpu(nowMs = Date.now()) {
+  const cpuUs = cpuIo.ownCpuUs();
+  let processPct = null;
+  if (processPrior) {
+    const wallUs = (nowMs - processPrior.atMs) * 1e3;
+    if (wallUs > 0) processPct = (cpuUs - processPrior.cpuUs) / wallUs * 100;
   }
-  return null;
+  processPrior = { cpuUs, atMs: nowMs };
+  const rows = [...entries.values()];
+  const measured = rows.filter((e) => e.cpuPct !== null);
+  const attributedPct = measured.length === 0 ? null : measured.reduce((sum, e) => sum + (e.cpuPct ?? 0), 0);
+  const unattributedPct = processPct === null || attributedPct === null ? null : Math.max(0, processPct - attributedPct);
+  return { processPct, attributedPct, unattributedPct };
 }
-function recordFailedAttempt(client) {
-  const key = bucketKey(client);
-  const rec = rateLimitMap.get(key) ?? { count: 0, lockedUntil: 0 };
-  rec.count++;
-  if (rec.count >= MAX_ATTEMPTS) {
-    rec.lockedUntil = Date.now() + LOCKOUT_MS;
-    rec.count = 0;
-  }
-  rateLimitMap.set(key, rec);
+function messageOf(err) {
+  return err instanceof Error ? err.message : String(err);
 }
-function clearRateLimit(client) {
-  rateLimitMap.delete(bucketKey(client));
+function finish(e, startedAt, cpuStart, cpuAttributable, note, err) {
+  const cpu = process.cpuUsage(cpuStart);
+  e.running = false;
+  e.lastDurationMs = Date.now() - startedAt;
+  e.lastCpuMs = cpuAttributable ? (cpu.user + cpu.system) / 1e3 : null;
+  if (err !== null) {
+    e.lastOutcome = "error";
+    e.lastError = messageOf(err);
+    e.lastNote = null;
+    e.consecutiveFailures += 1;
+    console.error(
+      `${TAG} op=run name=${e.spec.name} outcome=error streak=${e.consecutiveFailures} ms=${e.lastDurationMs} err="${e.lastError}"`
+    );
+    return;
+  }
+  e.lastOutcome = "ok";
+  e.lastError = null;
+  e.lastNote = typeof note === "string" && note.length > 0 ? note : null;
+  e.lastSuccessMs = Date.now();
+  e.successCount += 1;
+  e.consecutiveFailures = 0;
 }
-registerLoop({
-  name: "rate-limit-cleanup",
-  intervalMs: 15 * 60 * 1e3,
-  run: () => {
-    const now = Date.now();
-    let purged = 0;
-    for (const [key, rec] of rateLimitMap) {
-      if (rec.lockedUntil > 0 && rec.lockedUntil <= now) {
-        rateLimitMap.delete(key);
-        purged += 1;
-      }
+function invoke(e) {
+  if (e.running) {
+    console.warn(`${TAG} op=skip name=${e.spec.name} reason=still-running`);
+    return;
+  }
+  e.running = true;
+  e.runCount += 1;
+  e.lastStartMs = Date.now();
+  const startedAt = e.lastStartMs;
+  const cpuStart = process.cpuUsage();
+  const ownStartUs = cpuIo.ownCpuUs();
+  const ctx = {
+    child: (pid) => {
+      if (typeof pid === "number" && Number.isFinite(pid)) e.children.add(pid);
     }
-    return `purged ${purged}, ${rateLimitMap.size} tracked`;
+  };
+  let result;
+  try {
+    result = e.spec.run(ctx);
+  } catch (err) {
+    e.cumulativeCpuUs += Math.max(0, cpuIo.ownCpuUs() - ownStartUs);
+    finish(e, startedAt, cpuStart, true, null, err);
+    return;
   }
-});
-function renderLoginPage(opts) {
-  const error = opts?.error ?? "";
-  const lockout = opts?.lockoutSeconds ?? 0;
-  const redirect = opts?.redirect ?? "/";
-  const mode = opts?.mode ?? "login";
-  const changeError = opts?.changeError ?? "";
-  const success = opts?.success ?? "";
-  const setupError = opts?.setupError ?? "";
-  const primaryColor = opts?.primaryColor ?? "#7C8C72";
-  const primaryHoverColor = opts?.primaryHoverColor ?? "#6A7A62";
-  const primarySubtle = opts?.primarySubtle ?? "rgba(124,140,114,0.08)";
-  const productName = opts?.productName ?? "Maxy";
-  const logoPath = opts?.logoPath ?? "/brand/maxy-monochrome.png";
-  const faviconPath = opts?.faviconPath ?? "/favicon.ico";
-  const displayFont = opts?.displayFont ?? "'Newsreader', Georgia, serif";
-  const bodyFont = opts?.bodyFont ?? "'Inter', -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif";
-  const logoContainsName = opts?.logoContainsName ?? false;
-  const tagline = opts?.tagline ?? "";
-  const origin = opts?.origin ?? "";
-  const ogCardPath = opts?.ogCardPath ?? "";
-  const manifestPath = opts?.manifestPath ?? "";
-  const appleTouchIconPath = opts?.appleTouchIconPath ?? "";
-  const pwaThemeColor = opts?.themeColor ?? "";
-  const ogBlock = origin && ogCardPath ? [
-    `<meta property="og:title" content="Sign in \u2014 ${escapeHtml(productName)}">`,
-    `<meta property="og:description" content="${escapeHtml(tagline)}">`,
-    `<meta property="og:type" content="website">`,
-    `<meta property="og:url" content="${escapeHtml(origin)}">`,
-    `<meta property="og:image" content="${escapeHtml(origin + ogCardPath)}">`,
-    `<meta property="og:image:width" content="1200">`,
-    `<meta property="og:image:height" content="630">`,
-    `<meta name="twitter:card" content="summary_large_image">`,
-    `<meta name="twitter:title" content="Sign in \u2014 ${escapeHtml(productName)}">`,
-    `<meta name="twitter:description" content="${escapeHtml(tagline)}">`,
-    `<meta name="twitter:image" content="${escapeHtml(origin + ogCardPath)}">`
-  ].join("\n  ") : "";
-  const pwaInstallBlock = manifestPath && appleTouchIconPath ? [
-    `<link rel="manifest" href="${escapeHtml(manifestPath)}">`,
-    `<link rel="apple-touch-icon" href="${escapeHtml(appleTouchIconPath)}">`,
-    `<meta name="mobile-web-app-capable" content="yes">`,
-    `<meta name="apple-mobile-web-app-capable" content="yes">`,
-    pwaThemeColor ? `<meta name="theme-color" content="${escapeHtml(pwaThemeColor)}">` : ""
-  ].filter(Boolean).join("\n  ") : "";
-  const errorHtml = error ? `<p class="msg msg--error">${escapeHtml(error)}</p>` : "";
-  const changeErrorHtml = changeError ? `<p class="msg msg--error">${escapeHtml(changeError)}</p>` : "";
-  const successHtml = success ? `<p class="msg msg--success">${escapeHtml(success)}</p>` : "";
-  const lockoutHtml = lockout > 0 ? `<p class="msg msg--error">Too many attempts. Try again in <span id="countdown">${lockout}</span>s</p>
-       <script>
-         (function() {
-           var s = ${lockout};
-           var el = document.getElementById('countdown');
-           var iv = setInterval(function() { s--; el.textContent = s; if (s <= 0) { clearInterval(iv); location.reload(); } }, 1000);
-         })();
-       </script>` : "";
-  const setupErrorHtml = setupError ? `<p class="msg msg--error">${escapeHtml(setupError)}</p>` : "";
-  const formDisabled = lockout > 0 ? "disabled" : "";
-  const loginDisplay = mode === "login" ? "block" : "none";
-  const changeDisplay = mode === "change" ? "block" : "none";
-  const setupDisplay = mode === "setup" ? "block" : "none";
-  const successDisplay = mode === "success" ? "block" : "none";
-  const subtitleText = mode === "setup" ? "Set your remote password" : "Remote access";
-  const displayFontName = displayFont.match(/^'([^']+)'/)?.[1] ?? "";
-  const bodyFontName = bodyFont.match(/^'([^']+)'/)?.[1] ?? "";
-  const googleFontsLink = displayFontName || bodyFontName ? [
-    '<link rel="preconnect" href="https://fonts.googleapis.com">',
-    '<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>',
-    '<link href="https://fonts.googleapis.com/css2?' + [
-      displayFontName ? `family=${displayFontName.replace(/ /g, "+")}:wght@300;400` : "",
-      bodyFontName ? `family=${bodyFontName.replace(/ /g, "+")}:wght@400;500` : ""
-    ].filter(Boolean).join("&") + '&display=swap" rel="stylesheet">'
-  ].join("\n  ") : "";
-  return `<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <title>Sign in \u2014 ${escapeHtml(productName)}</title>
-  <link rel="icon" href="${escapeHtml(faviconPath)}">
-  ${pwaInstallBlock}
-  ${ogBlock}
-  ${googleFontsLink}
-  <style>
-    * { margin: 0; padding: 0; box-sizing: border-box; }
-    body {
-      font-family: ${bodyFont};
-      background: #F6F5F2;
-      color: #2A2D38;
-      min-height: 100vh;
-      display: flex;
-      align-items: center;
-      justify-content: center;
-    }
-    .page {
-      display: flex;
-      flex-direction: column;
-      align-items: center;
-      gap: 24px;
-      max-width: 420px;
-      width: 100%;
-      padding: 40px 20px;
-    }
-    .logo-img {
-      width: 110px;
-      height: 110px;
-      margin: -11px;
-      object-fit: contain;
-    }
-    .title {
-      font-family: ${displayFont};
-      font-weight: 300;
-      font-size: 28px;
-      color: #2A2D38;
-      text-align: center;
-      letter-spacing: -0.01em;
-      line-height: 1.3;
-    }
-    .subtitle {
-      font-size: 15px;
-      color: #4A4D58;
-      text-align: center;
-      margin-top: -8px;
-    }
-    .form-wrap {
-      width: 100%;
-      max-width: 300px;
-    }
-    .field { margin-bottom: 12px; }
-    .field-label {
-      display: block;
-      font-size: 13px;
-      font-weight: 500;
-      color: #4A4D58;
-      margin-bottom: 6px;
-    }
-    .field-input {
-      width: 100%;
-      padding: 10px 12px;
-      border: 1px solid #E4E3DE;
-      border-radius: 8px;
-      font-size: 15px;
-      font-family: inherit;
-      outline: none;
-      background: #fff;
-      transition: border-color 0.15s, box-shadow 0.15s;
-    }
-    .field-input:focus {
-      border-color: ${primaryColor};
-      box-shadow: 0 0 0 3px ${primarySubtle};
-    }
-    .options {
-      display: flex;
-      align-items: center;
-      justify-content: space-between;
-      gap: 12px;
-      margin-top: 8px;
-    }
-
-    /* Checkbox \u2014 matches Maxy shared checkbox (asterisk-in-square) */
-    .check {
-      position: relative;
-      display: flex;
-      align-items: center;
-      gap: 8px;
-      cursor: pointer;
-      user-select: none;
-    }
-    .check input { position: absolute; opacity: 0; width: 0; height: 0; pointer-events: none; }
-    .check-box {
-      width: 14px;
-      height: 14px;
-      border: 1px solid #E4E3DE;
-      border-radius: 2px;
-      display: flex;
-      align-items: center;
-      justify-content: center;
-      font-size: 10px;
-      color: transparent;
-      transition: border-color 0.15s, color 0.15s;
-      flex-shrink: 0;
-    }
-    .check input:checked + .check-box {
-      border-color: ${primaryColor};
-      color: ${primaryColor};
-    }
-    .check-label {
-      font-size: 13px;
-      color: #4A4D58;
-    }
-
-    /* Ghost button \u2014 matches Maxy ghost variant */
-    .ghost {
-      background: none;
-      border: none;
-      font-family: inherit;
-      font-size: 13px;
-      color: #4A4D58;
-      cursor: pointer;
-      padding: 4px 0;
-      transition: color 0.15s;
-    }
-    .ghost:hover { color: #2A2D38; }
-
-    /* Primary button */
-    .btn {
-      width: 100%;
-      padding: 12px;
-      margin-top: 16px;
-      background: ${primaryColor};
-      color: #fff;
-      border: none;
-      border-radius: 10px;
-      font-size: 15px;
-      font-weight: 500;
-      font-family: inherit;
-      cursor: pointer;
-      transition: background 0.15s;
-    }
-    .btn:hover:not(:disabled) { background: ${primaryHoverColor}; }
-    .btn:disabled { opacity: 0.5; cursor: not-allowed; }
-
-    /* Messages */
-    .msg {
-      font-size: 13px;
-      text-align: center;
-      margin-top: 8px;
-    }
-    .msg--error { color: #c44; }
-    .msg--success { color: ${primaryColor}; }
-
-    /* Strength checklist (setup mode) */
-    .strength-checklist { margin: 8px 0; }
-    .strength-item {
-      font-size: 13px;
-      color: #4A4D58;
-      padding: 2px 0;
-      transition: color 0.15s;
-    }
-    .strength-icon {
-      display: inline-block;
-      width: 16px;
-      text-align: center;
-    }
-
-    @media (max-width: 440px) {
-      .page { padding: 24px 16px; }
-    }
-  </style>
-</head>
-<body>
-  <div class="page">
-    <img src="${escapeHtml(logoPath)}" alt="${escapeHtml(productName)}" class="logo-img">
-    <h1 class="title"${logoContainsName ? ' style="display:none"' : ""}>${escapeHtml(productName)}</h1>
-    <p class="subtitle">${escapeHtml(subtitleText)}</p>
-
-    ${successHtml}
-
-    <!-- Login -->
-    <div id="login-section" class="form-wrap" style="display:${loginDisplay}">
-      <form method="POST" action="/__remote-auth/login">
-        <input type="hidden" name="redirect" value="${escapeHtml(redirect)}">
-        <div class="field">
-          <label class="field-label" for="password">Password</label>
-          <input class="field-input" type="password" id="password" name="password" required autofocus ${formDisabled}>
-        </div>
-        <div class="options">
-          <label class="check">
-            <input type="checkbox" id="show-login-pw">
-            <span class="check-box">\u2731</span>
-            <span class="check-label">Show password</span>
-          </label>
-          <button type="button" class="ghost" onclick="toggleMode('change')">Change password</button>
-        </div>
-        <button type="submit" class="btn" ${formDisabled}>Sign in</button>
-      </form>
-      ${errorHtml}
-      ${lockoutHtml}
-    </div>
-
-    <!-- Change password -->
-    <div id="change-section" class="form-wrap" style="display:${changeDisplay}">
-      <form method="POST" action="/__remote-auth/change-password">
-        <input type="hidden" name="redirect" value="${escapeHtml(redirect)}">
-        <div class="field">
-          <label class="field-label" for="current_password">Current password</label>
-          <input class="field-input" type="password" id="current_password" name="current_password" required ${formDisabled}>
-        </div>
-        <div class="field">
-          <label class="field-label" for="new_password">New password</label>
-          <input class="field-input" type="password" id="new_password" name="new_password" required ${formDisabled}>
-        </div>
-        <div class="field">
-          <label class="field-label" for="confirm_password">Confirm new password</label>
-          <input class="field-input" type="password" id="confirm_password" name="confirm_password" required ${formDisabled}>
-        </div>
-        <div class="options">
-          <label class="check">
-            <input type="checkbox" id="show-change-pw">
-            <span class="check-box">\u2731</span>
-            <span class="check-label">Show passwords</span>
-          </label>
-          <button type="button" class="ghost" onclick="toggleMode('login')">Back to sign in</button>
-        </div>
-        <button type="submit" class="btn" ${formDisabled}>Change password</button>
-      </form>
-      ${changeErrorHtml}
-    </div>
-
-    <!-- Setup (initial password) -->
-    <div id="setup-section" class="form-wrap" style="display:${setupDisplay}">
-      <form method="POST" action="/__remote-auth/set-initial-password">
-        <div class="field">
-          <label class="field-label" for="setup_password">Password</label>
-          <input class="field-input" type="password" id="setup_password" name="password" required autofocus>
-        </div>
-        <div class="field">
-          <label class="field-label" for="setup_confirm">Confirm password</label>
-          <input class="field-input" type="password" id="setup_confirm" name="confirm_password" required>
-        </div>
-        <div id="strength-checklist" class="strength-checklist">
-          <div class="strength-item" id="req-length"><span class="strength-icon">\u25CB</span> At least 8 characters</div>
-          <div class="strength-item" id="req-number"><span class="strength-icon">\u25CB</span> Contains a number</div>
-          <div class="strength-item" id="req-special"><span class="strength-icon">\u25CB</span> Contains a special character</div>
-          <div class="strength-item" id="req-spaces"><span class="strength-icon">\u25CB</span> No spaces</div>
-        </div>
-        <div class="options">
-          <label class="check">
-            <input type="checkbox" id="show-setup-pw">
-            <span class="check-box">\u2731</span>
-            <span class="check-label">Show passwords</span>
-          </label>
-        </div>
-        <button type="submit" class="btn" id="setup-submit" disabled>Set password</button>
-      </form>
-      ${setupErrorHtml}
-    </div>
-
-    <!-- Success (after initial password set) -->
-    <div id="success-section" class="form-wrap" style="display:${successDisplay}">
-      <p class="msg msg--success" style="font-size:15px;margin-bottom:4px;">\u2713 Password set</p>
-      <p style="font-size:14px;color:#4A4D58;text-align:center;">You can close this tab and return to the onboarding tab.</p>
-      <a href="/" style="display:block;text-align:center;margin-top:16px;font-size:13px;color:#4A4D58;text-decoration:none;" onmouseover="this.style.color='#2A2D38'" onmouseout="this.style.color='#4A4D58'">Sign in \u2192</a>
-      <script>
-        (function() {
-          try {
-            var ch = new BroadcastChannel('platform-onboarding');
-            setTimeout(function() {
-              ch.postMessage({ type: 'remote-password-set' });
-              ch.close();
-            }, 2500);
-          } catch(e) {}
-        })();
-      </script>
-    </div>
-  </div>
-
-  <script>
-    /* Toggle between login and change-password modes */
-    function toggleMode(mode) {
-      document.getElementById('login-section').style.display = mode === 'login' ? 'block' : 'none';
-      document.getElementById('change-section').style.display = mode === 'change' ? 'block' : 'none';
-      /* Focus first input in the active section */
-      var id = mode === 'login' ? 'password' : 'current_password';
-      var el = document.getElementById(id);
-      if (el) el.focus();
-    }
-
-    /* Show/hide password toggles */
-    function bindShowHide(checkboxId, inputIds) {
-      var cb = document.getElementById(checkboxId);
-      if (!cb) return;
-      cb.addEventListener('change', function() {
-        var type = cb.checked ? 'text' : 'password';
-        inputIds.forEach(function(id) {
-          var el = document.getElementById(id);
-          if (el) el.type = type;
-        });
-      });
-    }
-    bindShowHide('show-login-pw', ['password']);
-    bindShowHide('show-change-pw', ['current_password', 'new_password', 'confirm_password']);
-    bindShowHide('show-setup-pw', ['setup_password', 'setup_confirm']);
-
-    /* Explicit Enter-to-submit for the login password field */
-    var loginPw = document.getElementById('password');
-    if (loginPw) {
-      loginPw.addEventListener('keydown', function(e) {
-        if (e.key === 'Enter') {
-          e.preventDefault();
-          this.closest('form').requestSubmit();
-        }
-      });
-    }
-
-    /* Live password strength validation (setup mode) */
-    (function() {
-      var pw = document.getElementById('setup_password');
-      var confirm = document.getElementById('setup_confirm');
-      var btn = document.getElementById('setup-submit');
-      if (!pw || !confirm || !btn) return;
-
-      var rules = [
-        { id: 'req-length', test: function(p) { return p.length >= 8; } },
-        { id: 'req-number', test: function(p) { return /\\d/.test(p); } },
-        { id: 'req-special', test: function(p) { return /[^A-Za-z0-9]/.test(p); } },
-        { id: 'req-spaces', test: function(p) { return p.length > 0 && !/\\s/.test(p); } }
-      ];
+  if (result instanceof Promise) {
+    e.cpuAttributable = false;
+    result.then(
+      (note) => finish(e, startedAt, cpuStart, false, note, null),
+      (err) => finish(e, startedAt, cpuStart, false, null, err)
+    );
+    return;
+  }
+  e.cumulativeCpuUs += Math.max(0, cpuIo.ownCpuUs() - ownStartUs);
+  finish(e, startedAt, cpuStart, true, result, null);
+}
+function registerLoop(spec) {
+  if (entries.has(spec.name)) {
+    throw new Error(`${TAG} loop "${spec.name}" is already registered`);
+  }
+  const e = {
+    spec,
+    armedAtMs: Date.now(),
+    lastStartMs: null,
+    lastSuccessMs: null,
+    lastDurationMs: null,
+    lastCpuMs: null,
+    lastOutcome: null,
+    lastError: null,
+    lastNote: null,
+    runCount: 0,
+    successCount: 0,
+    consecutiveFailures: 0,
+    running: false,
+    timers: [],
+    cumulativeCpuUs: 0,
+    cpuAttributable: true,
+    children: /* @__PURE__ */ new Set(),
+    lastChildCpuUs: 0,
+    prior: null,
+    cpuPct: null
+  };
+  entries.set(spec.name, e);
+  const interval = setInterval(() => invoke(e), spec.intervalMs);
+  if (typeof interval.unref === "function") interval.unref();
+  e.timers.push(interval);
+  console.log(
+    `${TAG} op=arm name=${spec.name} intervalMs=${spec.intervalMs} firstRunMs=${spec.firstRunDelayMs ?? "interval"} detached=${spec.detached === true} armed=${entries.size}`
+  );
+  if (spec.firstRunDelayMs === 0) {
+    invoke(e);
+  } else if (spec.firstRunDelayMs !== void 0) {
+    const first = setTimeout(() => invoke(e), spec.firstRunDelayMs);
+    if (typeof first.unref === "function") first.unref();
+    e.timers.push(first);
+  }
+  let stopped = false;
+  return () => {
+    if (stopped) return;
+    stopped = true;
+    for (const t of e.timers) clearInterval(t);
+    if (entries.get(spec.name) === e) entries.delete(spec.name);
+    console.log(`${TAG} op=disarm name=${spec.name} armed=${entries.size}`);
+  };
+}
+function stateOf(e, nowMs) {
+  if (e.lastStartMs === null) {
+    return nowMs - e.armedAtMs < e.spec.intervalMs ? "waiting" : "never-run";
+  }
+  const overdue = nowMs - e.lastStartMs > e.spec.intervalMs * STALL_INTERVALS;
+  if (overdue) return "stalled";
+  if (e.running) return "running";
+  if (e.successCount === 0) return "never-succeeded";
+  if (e.consecutiveFailures > 0) return "failing";
+  return "ok";
+}
+function nextDueOf(e, nowMs) {
+  const elapsed = Math.max(0, nowMs - e.armedAtMs);
+  const ticks = Math.floor(elapsed / e.spec.intervalMs) + 1;
+  return e.armedAtMs + ticks * e.spec.intervalMs;
+}
+function listLoops(nowMs = Date.now()) {
+  return [...entries.values()].map((e) => ({
+    name: e.spec.name,
+    intervalMs: e.spec.intervalMs,
+    detached: e.spec.detached === true,
+    armedAtMs: e.armedAtMs,
+    lastStartMs: e.lastStartMs,
+    lastSuccessMs: e.lastSuccessMs,
+    lastDurationMs: e.lastDurationMs,
+    lastCpuMs: e.lastCpuMs,
+    cpuPct: e.cpuPct,
+    cpuAttributable: e.cpuAttributable,
+    lastOutcome: e.lastOutcome,
+    lastError: e.lastError,
+    lastNote: e.lastNote,
+    runCount: e.runCount,
+    successCount: e.successCount,
+    consecutiveFailures: e.consecutiveFailures,
+    running: e.running,
+    state: stateOf(e, nowMs),
+    nextDueMs: nextDueOf(e, nowMs)
+  }));
+}
+function armedCount() {
+  return entries.size;
+}
 
-      function check() {
-        var p = pw.value;
-        var allMet = true;
-        rules.forEach(function(r) {
-          var el = document.getElementById(r.id);
-          var met = r.test(p);
-          if (!met) allMet = false;
-          el.querySelector('.strength-icon').textContent = met ? '\\u2713' : '\\u25CB';
-          el.style.color = met ? '${primaryColor}' : '#4A4D58';
-        });
-        var match = p.length > 0 && p === confirm.value;
-        btn.disabled = !(allMet && match);
-      }
+// app/lib/vnc-logger.ts
+import { appendFileSync, mkdirSync } from "fs";
+import { resolve as resolve3 } from "path";
+var VNC_LOG_FILE = resolve3(LOG_DIR, "vnc-boot.log");
+try {
+  mkdirSync(LOG_DIR, { recursive: true });
+} catch (err) {
+  console.error(`[vnc-log-fail] mkdir ${LOG_DIR} failed: ${err.message}`);
+}
+function vncLog(phase, fields = {}) {
+  const ts = (/* @__PURE__ */ new Date()).toISOString();
+  const kv = Object.entries(fields).map(([k, v]) => `${k}=${JSON.stringify(v)}`).join(" ");
+  const line = kv.length > 0 ? `[${ts}] [${phase}] ${kv}
+` : `[${ts}] [${phase}]
+`;
+  try {
+    appendFileSync(VNC_LOG_FILE, line);
+  } catch (err) {
+    console.error(`[vnc-log-fail] ${err.message} \u2014 dropped: ${line.slice(0, 300).trim()}`);
+  }
+}
+var corrCounter = 0;
+function newCorrId() {
+  corrCounter = corrCounter + 1 & 4294967295;
+  const counterHex = corrCounter.toString(16).padStart(8, "0");
+  const randomHex = Math.floor(Math.random() * 16777215).toString(16).padStart(6, "0");
+  return `${counterHex}-${randomHex}`;
+}
+function sanitizeClientCorrId(raw2) {
+  if (!raw2) return null;
+  if (raw2.length > 32) return null;
+  if (!/^[A-Za-z0-9_-]+$/.test(raw2)) return null;
+  return raw2;
+}
+function formatKv(fields) {
+  return Object.entries(fields).filter(([, v]) => v !== void 0).map(([k, v]) => `${k}=${JSON.stringify(v)}`).join(" ");
+}
+function httpLog(fields) {
+  console.error(`[http] ${formatKv(fields)}`);
+}
+function websockifyLog(event, fields = {}) {
+  console.error(`[websockify] ${formatKv({ event, ...fields })}`);
+}
 
-      pw.addEventListener('input', check);
-      confirm.addEventListener('input', check);
-    })();
-  </script>
-</body>
-</html>`;
+// ../lib/admin-access-password/src/index.ts
+import { scrypt, randomBytes, timingSafeEqual } from "crypto";
+import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync, renameSync, unlinkSync, appendFileSync as appendFileSync2, mkdirSync as mkdirSync2 } from "fs";
+import { dirname } from "path";
+var SCRYPT_N = 16384;
+var SCRYPT_R = 8;
+var SCRYPT_P = 1;
+var SCRYPT_KEYLEN = 64;
+function id8(value) {
+  return value.slice(0, 8);
+}
+function rowIds(users) {
+  return users.map((u) => id8(u.userId)).join(",");
+}
+function appendUsersAuditLine(audit, fields) {
+  const sess = audit.session ? ` session=${id8(audit.session)}` : "";
+  const actor = audit.actor.includes("-") ? id8(audit.actor) : audit.actor;
+  const targetFields = audit.target !== void 0 ? ` target=${audit.target.includes("-") ? id8(audit.target) : audit.target} explicitUserId=${audit.explicitUserId ? "true" : "false"}` : "";
+  const line = `[users-audit] action=${fields.action} actor=${actor}${targetFields}${sess} field=${fields.field} rowsBefore=${fields.rowsBefore} rowsAfter=${fields.rowsAfter} ts=${(/* @__PURE__ */ new Date()).toISOString()}
+`;
+  try {
+    mkdirSync2(dirname(audit.logFile), { recursive: true, mode: 448 });
+    appendFileSync2(audit.logFile, line, { mode: 384 });
+  } catch (err) {
+    console.error(
+      `[users-audit] op=write-failed logFile=${audit.logFile} error=${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+function scryptAsync(password, salt) {
+  return new Promise((resolve7, reject) => {
+    scrypt(password, salt, SCRYPT_KEYLEN, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P }, (err, key) => {
+      if (err) reject(err);
+      else resolve7(key);
+    });
+  });
+}
+async function hashAccessPassword(password) {
+  const salt = randomBytes(32);
+  const hash = await scryptAsync(password, salt);
+  return `${salt.toString("hex")}:${hash.toString("hex")}`;
+}
+async function matchesHash(password, stored) {
+  const colon = stored.indexOf(":");
+  if (colon === -1) return false;
+  const salt = Buffer.from(stored.slice(0, colon), "hex");
+  const storedHash = Buffer.from(stored.slice(colon + 1), "hex");
+  if (storedHash.length !== SCRYPT_KEYLEN) return false;
+  let computed;
+  try {
+    computed = await scryptAsync(password, salt);
+  } catch {
+    return false;
+  }
+  return timingSafeEqual(computed, storedHash);
 }
-function escapeHtml(str) {
-  return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+function readUsers(usersFile) {
+  if (!existsSync4(usersFile)) return [];
+  const raw2 = readFileSync5(usersFile, "utf-8").trim();
+  if (!raw2) return [];
+  const parsed = JSON.parse(raw2);
+  if (!Array.isArray(parsed)) throw new Error("users.json is not an array");
+  return parsed;
 }
-
-// app/lib/auth-gate.ts
-function canAccessAdmin(input) {
-  const client = resolveClientIp(input.remoteAddress, input.xForwardedFor);
-  if (input.isPublicHost(input.host)) {
-    return { allow: false, reason: "public-host", client };
+function writeUsersAtomic(usersFile, users) {
+  const tmp = `${usersFile}.tmp-${process.pid}`;
+  writeFileSync(tmp, JSON.stringify(users, null, 2) + "\n", { mode: 384 });
+  renameSync(tmp, usersFile);
+}
+async function setAccessPassword(userId, password, usersFile, audit) {
+  const users = readUsers(usersFile);
+  const idx = users.findIndex((u) => u.userId === userId);
+  if (idx === -1) throw new Error(`no users.json record for userId=${userId}`);
+  if (await accessPasswordCollides(password, usersFile, userId)) {
+    throw new Error("accessHash collision: password already in use by another admin");
   }
-  if (client.kind !== "external") {
-    return { allow: true, client };
+  const rows = rowIds(users);
+  users[idx] = { ...users[idx], accessHash: await hashAccessPassword(password) };
+  writeUsersAtomic(usersFile, users);
+  appendUsersAuditLine(audit, { action: "set-access", field: "accessHash", rowsBefore: rows, rowsAfter: rows });
+}
+async function verifyAccessPassword(password, usersFile) {
+  let users;
+  try {
+    users = readUsers(usersFile);
+  } catch {
+    return null;
   }
-  if (!isRemoteAuthConfigured()) {
-    return { allow: false, reason: "remote-unconfigured", client };
+  for (const u of users) {
+    if (typeof u.accessHash === "string" && await matchesHash(password, u.accessHash)) {
+      return u.userId;
+    }
   }
-  const token = parseCookieValue(input.cookieHeader, "__remote_session");
-  if (token && validateRemoteSession(token)) {
-    return { allow: true, client };
+  return null;
+}
+async function accessPasswordCollides(password, usersFile, excludeUserId) {
+  let users;
+  try {
+    users = readUsers(usersFile);
+  } catch {
+    return false;
   }
-  return { allow: false, reason: "unauthorized", client };
+  for (const u of users) {
+    if (u.userId === excludeUserId) continue;
+    if (typeof u.accessHash === "string" && await matchesHash(password, u.accessHash)) {
+      return true;
+    }
+  }
+  return false;
 }
-function parseCookieValue(cookieHeader, name) {
-  if (!cookieHeader) return null;
-  const match2 = cookieHeader.match(new RegExp(`(?:^|;\\s*)${name}=([^;]*)`));
-  if (!match2) return null;
+function anyAccessPasswordConfigured(usersFile) {
+  let users;
   try {
-    return decodeURIComponent(match2[1]);
+    users = readUsers(usersFile);
   } catch {
-    return null;
+    return false;
   }
+  return users.some((u) => typeof u.accessHash === "string" && u.accessHash.length > 0);
 }
-function isApiRequestPath(path) {
-  return path.startsWith("/api/");
+function accessStoreUnreadable(usersFile) {
+  if (!existsSync4(usersFile)) return false;
+  try {
+    readUsers(usersFile);
+    return false;
+  } catch {
+    return true;
+  }
+}
+function migrateLegacyRemotePassword(usersFile, legacyFile, ownerUserId, audit) {
+  if (!existsSync4(legacyFile)) return "noop-no-legacy";
+  const legacy = readFileSync5(legacyFile, "utf-8").trim();
+  const users = readUsers(usersFile);
+  const idx = users.findIndex((u) => u.userId === ownerUserId);
+  if (idx === -1) return "noop-no-owner";
+  const existing = users[idx].accessHash;
+  if (typeof existing === "string" && existing.length > 0) {
+    unlinkSync(legacyFile);
+    return "noop-owner-has-hash";
+  }
+  if (!legacy.includes(":")) {
+    unlinkSync(legacyFile);
+    return "noop-no-legacy";
+  }
+  const rows = rowIds(users);
+  users[idx] = { ...users[idx], accessHash: legacy };
+  writeUsersAtomic(usersFile, users);
+  unlinkSync(legacyFile);
+  appendUsersAuditLine(audit, { action: "migrate", field: "accessHash", rowsBefore: rows, rowsAfter: rows });
+  return "migrated";
+}
+function readLegacyRemoteHash(legacyFile) {
+  if (!existsSync4(legacyFile)) return null;
+  const raw2 = readFileSync5(legacyFile, "utf-8").trim();
+  return raw2.includes(":") ? raw2 : null;
 }
 
-// app/lib/agent-slug-pattern.ts
-var AGENT_SLUG_PATTERN = /^\/([a-z][a-z0-9-]{2,49})$/;
-
-// app/lib/system-path-slugs.ts
-var SYSTEM_PATH_SLUGS = ["public", "public-chat", "chat", "graph", "data", "browser"];
+// app/lib/password-strength.ts
+function validatePasswordStrength(password) {
+  return [
+    { key: "length", label: "At least 8 characters", met: password.length >= 8 },
+    { key: "number", label: "Contains a number", met: /\d/.test(password) },
+    { key: "special", label: "Contains a special character", met: /[^A-Za-z0-9]/.test(password) },
+    { key: "whitespace", label: "No spaces", met: password.length > 0 && !/\s/.test(password) }
+  ];
+}
+function isPasswordValid(password) {
+  return validatePasswordStrength(password).every((r) => r.met);
+}
 
-// server/public-host-gate.ts
-var PUBLIC_ALLOWED_PREFIXES = [
-  "/api/session",
-  "/api/chat",
-  // Task 873 — the detooled public surface's visitor-authed reader (pointer +
-  // server-filtered SSE stream). Reached by the visitor browser on the public
-  // host; authenticated by the __access_session grant inside the route.
-  "/api/public-reader/",
-  "/api/access/",
-  "/api/health",
-  // Public free/busy for the booking page. Open slots only, no :Meeting detail
-  // (server/routes/calendar-public.ts). Admitted on public hosts; on the brand
-  // host the remote-auth gate bypasses the same path (server/index.ts).
-  "/api/calendar/free-busy",
-  "/api/telegram/",
-  // Task 1881 — the data portal's device-held-file fetch. Reached by the edge
-  // Pages Function's signed HEAD/GET probe on the public host; authenticated by
-  // the per-account HMAC signature the route re-verifies (portal-fetch.ts), not
-  // the remote-auth gate. Pointing PORTAL_INSTALL_ORIGIN at the admin host
-  // instead made every download 503 (remote-auth-required on the probe).
-  "/api/portal/fetch",
-  // QuickBooks OAuth consent callback. Intuit redirects the operator's browser
-  // here with no admin cookie; the route authenticates by validating the OAuth
-  // `state` nonce, not the remote-auth gate (same model as /api/telegram/).
-  "/api/quickbooks/",
-  "/assets/",
-  "/brand/",
-  "/agent-assets/",
-  "/generated/",
-  "/g/",
-  "/sites/"
-];
-var PUBLIC_ALLOWED_EXACT = [
-  "/favicon.ico",
-  "/brand-defaults.css"
-];
-function isPublicPathAllowed(path) {
-  if (path === "/") return true;
-  if (PUBLIC_ALLOWED_EXACT.includes(path)) return true;
-  if (PUBLIC_ALLOWED_PREFIXES.some((prefix) => path.startsWith(prefix))) return true;
-  return AGENT_SLUG_PATTERN.test(path);
+// app/lib/remote-auth.ts
+import { scrypt as scrypt2, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2, createHmac } from "crypto";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync2, mkdirSync as mkdirSync3 } from "fs";
+import { dirname as dirname2 } from "path";
+var SCRYPT_N2 = 16384;
+var SCRYPT_R2 = 8;
+var SCRYPT_P2 = 1;
+var SCRYPT_KEYLEN2 = 64;
+function scryptAsync2(password, salt) {
+  return new Promise((resolve7, reject) => {
+    scrypt2(password, salt, SCRYPT_KEYLEN2, { N: SCRYPT_N2, r: SCRYPT_R2, p: SCRYPT_P2 }, (err, key) => {
+      if (err) reject(err);
+      else resolve7(key);
+    });
+  });
 }
-function isOperatorHost(host, operatorDomains2) {
-  return operatorDomains2.has(host);
+async function hashPassword(password) {
+  const salt = randomBytes2(32);
+  const hash = await scryptAsync2(password, salt);
+  return `${salt.toString("hex")}:${hash.toString("hex")}`;
 }
-function classifyHost(host, operatorDomains2, isPublicHost) {
-  if (operatorDomains2.has(host)) return "operator";
-  if (isPublicHost(host)) return "public";
-  return "admin";
+function isRemoteAuthConfigured() {
+  if (anyAccessPasswordConfigured(USERS_FILE)) return true;
+  if (accessStoreUnreadable(USERS_FILE)) return true;
+  return readLegacyRemoteHash(REMOTE_PASSWORD_FILE) !== null;
 }
-
-// server/operator-domains-reader.ts
-import { watchFile } from "fs";
-
-// app/lib/operator-domains.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname3, resolve as resolve3 } from "path";
-var OPERATOR_DOMAINS_PATH = resolve3(MAXY_DIR, "operator-domains.json");
-function loadOperatorDomains() {
-  if (!existsSync3(OPERATOR_DOMAINS_PATH)) return /* @__PURE__ */ new Set();
+async function setRemotePassword(password) {
+  const hash = await hashPassword(password);
+  writeFileSync2(REMOTE_PASSWORD_FILE, hash, "utf-8");
+}
+async function verifyRemotePassword(password) {
+  const matchedUserId = await verifyAccessPassword(password, USERS_FILE);
+  if (matchedUserId) return { ok: true, hashBytes: SCRYPT_KEYLEN2, userId: matchedUserId };
+  const legacy = readLegacyRemoteHash(REMOTE_PASSWORD_FILE);
+  if (legacy && await matchesHash(password, legacy)) {
+    return { ok: true, hashBytes: SCRYPT_KEYLEN2, userId: null };
+  }
+  const configured = anyAccessPasswordConfigured(USERS_FILE) || legacy !== null;
+  return { ok: false, why: configured ? "password-mismatch" : "no-password-file", hashBytes: 0 };
+}
+var SESSION_TTL_MS2 = 24 * 60 * 60 * 1e3;
+var TOKEN_PREFIX = "v1.";
+var SECRET_BYTES = 32;
+var NONCE_BYTES = 16;
+var cachedSecret = null;
+function getSecret() {
+  if (cachedSecret) return cachedSecret;
+  try {
+    const hex2 = readFileSync6(REMOTE_SESSION_SECRET_FILE, "utf-8").trim();
+    if (hex2.length === SECRET_BYTES * 2) {
+      cachedSecret = Buffer.from(hex2, "hex");
+      return cachedSecret;
+    }
+  } catch {
+  }
+  const fresh = randomBytes2(SECRET_BYTES).toString("hex");
+  try {
+    mkdirSync3(dirname2(REMOTE_SESSION_SECRET_FILE), { recursive: true, mode: 448 });
+    writeFileSync2(REMOTE_SESSION_SECRET_FILE, fresh, { mode: 384, flag: "wx" });
+  } catch {
+  }
+  const hex = readFileSync6(REMOTE_SESSION_SECRET_FILE, "utf-8").trim();
+  cachedSecret = Buffer.from(hex, "hex");
+  return cachedSecret;
+}
+function base64urlEncode(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64urlDecode(s) {
+  const padded = s.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - s.length % 4) % 4);
+  return Buffer.from(padded, "base64");
+}
+function signPayload(payloadJson, secret) {
+  return base64urlEncode(createHmac("sha256", secret).update(payloadJson).digest());
+}
+function createRemoteSession(opts = {}) {
+  const payload = { c: opts.now ?? Date.now(), n: randomBytes2(NONCE_BYTES).toString("hex") };
+  const payloadJson = JSON.stringify(payload);
+  const payloadB64 = base64urlEncode(Buffer.from(payloadJson, "utf-8"));
+  const sig = signPayload(payloadJson, getSecret());
+  return `${TOKEN_PREFIX}${payloadB64}.${sig}`;
+}
+function parseToken(token) {
+  if (!token.startsWith(TOKEN_PREFIX)) return null;
+  const rest = token.slice(TOKEN_PREFIX.length);
+  const dot = rest.indexOf(".");
+  if (dot === -1) return null;
+  const payloadB64 = rest.slice(0, dot);
+  const sigB64 = rest.slice(dot + 1);
+  if (!payloadB64 || !sigB64) return null;
+  let payloadJson;
   try {
-    const parsed = JSON.parse(readFileSync5(OPERATOR_DOMAINS_PATH, "utf-8"));
-    if (!Array.isArray(parsed)) return /* @__PURE__ */ new Set();
-    return new Set(parsed.filter((h) => typeof h === "string"));
+    payloadJson = base64urlDecode(payloadB64).toString("utf-8");
   } catch {
-    return /* @__PURE__ */ new Set();
+    return null;
   }
+  const expected = signPayload(payloadJson, getSecret());
+  const expectedBuf = Buffer.from(expected, "utf-8");
+  const provBuf = Buffer.from(sigB64, "utf-8");
+  const signatureValid = expectedBuf.length === provBuf.length && timingSafeEqual2(expectedBuf, provBuf);
+  let payload;
+  try {
+    payload = JSON.parse(payloadJson);
+  } catch {
+    return null;
+  }
+  if (!payload || typeof payload !== "object" || typeof payload.c !== "number" || typeof payload.n !== "string") {
+    return null;
+  }
+  return { payload, signatureValid };
 }
-
-// server/operator-domains-reader.ts
-var operatorDomains = loadOperatorDomains();
-if (operatorDomains.size > 0) {
-  console.log(
-    `[operator-domains] loaded ${operatorDomains.size} operator domain(s): ${[...operatorDomains].join(", ")}`
-  );
+function validateRemoteSession(token, now = Date.now()) {
+  if (!token) return false;
+  const parsed = parseToken(token);
+  if (!parsed || !parsed.signatureValid) return false;
+  return now - parsed.payload.c <= SESSION_TTL_MS2;
 }
-watchFile(OPERATOR_DOMAINS_PATH, { interval: 2e3 }, () => {
-  operatorDomains = loadOperatorDomains();
-  console.log(
-    `[operator-domains] reloaded ${operatorDomains.size} operator domain(s): ${[...operatorDomains].join(", ")}`
-  );
-});
-function getOperatorDomains() {
-  return operatorDomains;
+function describeRemoteSession(token, now = Date.now()) {
+  if (!token) return { present: false, expired: false };
+  const parsed = parseToken(token);
+  if (!parsed || !parsed.signatureValid) return { present: false, expired: false };
+  return { present: true, expired: now - parsed.payload.c > SESSION_TTL_MS2 };
 }
-
-// app/lib/claude-agent/account.ts
-import { resolve as resolve4 } from "path";
-import { readFileSync as readFileSync7, readdirSync, existsSync as existsSync5, statSync } from "fs";
-
-// ../lib/brand-templating/src/index.ts
-import { join as join2 } from "path";
-import { existsSync as existsSync4, readFileSync as readFileSync6 } from "fs";
-var PLACEHOLDER = "{{productName}}";
-var cachedProductName = null;
-function brandJsonPath() {
-  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT;
-  if (!platformRoot2) {
-    throw new Error(
-      "[skill-loader] MAXY_PLATFORM_ROOT not set \u2014 cannot resolve brand.json"
-    );
-  }
-  return join2(platformRoot2, "config", "brand.json");
+function normalizeIp(ip) {
+  if (!ip) return void 0;
+  const trimmed = ip.trim();
+  if (trimmed.startsWith("::ffff:")) return trimmed.slice(7);
+  return trimmed;
 }
-function getBrandProductName() {
-  if (cachedProductName !== null) return cachedProductName;
-  const path = brandJsonPath();
-  if (!existsSync4(path)) {
-    throw new Error(`[skill-loader] brand.json missing at ${path}`);
+function isLoopback(ip) {
+  return ip === "127.0.0.1" || ip.startsWith("127.") || ip === "::1";
+}
+function isPrivateIp(ip) {
+  const parts = ip.split(".");
+  if (parts.length !== 4) return false;
+  const a = parseInt(parts[0], 10);
+  const b = parseInt(parts[1], 10);
+  if (Number.isNaN(a) || Number.isNaN(b)) return false;
+  if (a === 10) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 169 && b === 254) return true;
+  return false;
+}
+function classifyNormalizedIp(ip) {
+  if (isLoopback(ip) || isPrivateIp(ip)) return "lan";
+  return "external";
+}
+function resolveClientIp(remoteAddress, xForwardedFor) {
+  const remote = normalizeIp(remoteAddress);
+  if (!remote) return { ip: "", kind: "unknown" };
+  if (isLoopback(remote) && xForwardedFor) {
+    const firstIp = normalizeIp(xForwardedFor.split(",")[0]?.trim());
+    if (firstIp) {
+      return { ip: firstIp, kind: classifyNormalizedIp(firstIp) };
+    }
   }
-  let parsed;
-  try {
-    parsed = JSON.parse(readFileSync6(path, "utf-8"));
-  } catch (err) {
-    throw new Error(
-      `[skill-loader] brand.json unreadable at ${path}: ${err instanceof Error ? err.message : String(err)}`
-    );
+  return { ip: remote, kind: classifyNormalizedIp(remote) };
+}
+var MAX_ATTEMPTS = 5;
+var LOCKOUT_MS = 15 * 60 * 1e3;
+var LOCAL_BUCKET = "__local__";
+var rateLimitMap = /* @__PURE__ */ new Map();
+function bucketKey(client) {
+  return client.kind === "external" ? client.ip : LOCAL_BUCKET;
+}
+function checkRateLimit(client) {
+  const key = bucketKey(client);
+  const rec = rateLimitMap.get(key);
+  if (!rec) return null;
+  if (rec.lockedUntil > Date.now()) {
+    const remaining = Math.ceil((rec.lockedUntil - Date.now()) / 1e3);
+    return `Too many attempts. Try again in ${remaining}s`;
   }
-  const value = parsed.productName;
-  if (typeof value !== "string" || value.trim() === "") {
-    throw new Error(
-      `[skill-loader] brand.json at ${path} has missing or empty productName`
-    );
+  if (rec.lockedUntil > 0) {
+    rateLimitMap.delete(key);
   }
-  cachedProductName = value;
-  return value;
+  return null;
 }
-function substituteBrandPlaceholders(content, sourcePath) {
-  if (!content.includes(PLACEHOLDER)) return content;
-  let productName;
-  try {
-    productName = getBrandProductName();
-  } catch (err) {
-    console.error(
-      `[skill-loader] ERROR: brand.json missing \u2014 cannot resolve productName for skill ${sourcePath}`
-    );
-    throw err;
+function recordFailedAttempt(client) {
+  const key = bucketKey(client);
+  const rec = rateLimitMap.get(key) ?? { count: 0, lockedUntil: 0 };
+  rec.count++;
+  if (rec.count >= MAX_ATTEMPTS) {
+    rec.lockedUntil = Date.now() + LOCKOUT_MS;
+    rec.count = 0;
   }
-  const occurrences = content.split(PLACEHOLDER).length - 1;
-  const substituted = content.split(PLACEHOLDER).join(productName);
-  console.log(
-    `[skill-loader] brand-substituted productName=${productName} skill=${sourcePath} occurrences=${occurrences}`
-  );
-  return substituted;
+  rateLimitMap.set(key, rec);
 }
-
-// app/lib/claude-agent/account.ts
-var PLATFORM_ROOT2 = process.env.MAXY_PLATFORM_ROOT ?? resolve4(process.cwd(), "..");
-var ACCOUNTS_DIR = resolve4(PLATFORM_ROOT2, "..", "data/accounts");
-if (!existsSync5(PLATFORM_ROOT2)) {
-  throw new Error(
-    `PLATFORM_ROOT does not exist: ${PLATFORM_ROOT2}
-Set the MAXY_PLATFORM_ROOT environment variable to the absolute path of the platform directory.`
-  );
+function clearRateLimit(client) {
+  rateLimitMap.delete(bucketKey(client));
 }
-var _stubDirsLoggedThisBoot = /* @__PURE__ */ new Set();
-function listValidAccounts() {
-  if (!existsSync5(ACCOUNTS_DIR)) return [];
-  const out = [];
-  const entries2 = readdirSync(ACCOUNTS_DIR, { withFileTypes: true });
-  for (const entry of entries2) {
-    if (!entry.isDirectory()) continue;
-    if (entry.name.startsWith(".")) continue;
-    const accountDir = resolve4(ACCOUNTS_DIR, entry.name);
-    const configPath = resolve4(accountDir, "account.json");
-    if (!existsSync5(configPath)) {
-      if (!_stubDirsLoggedThisBoot.has(entry.name)) {
-        console.error(
-          `[platform] accounts-state STUB-DIR id=${entry.name} \u2014 onboarding leak; remove or repair`
-        );
-        _stubDirsLoggedThisBoot.add(entry.name);
+registerLoop({
+  name: "rate-limit-cleanup",
+  intervalMs: 15 * 60 * 1e3,
+  run: () => {
+    const now = Date.now();
+    let purged = 0;
+    for (const [key, rec] of rateLimitMap) {
+      if (rec.lockedUntil > 0 && rec.lockedUntil <= now) {
+        rateLimitMap.delete(key);
+        purged += 1;
       }
-      continue;
     }
-    let config;
-    try {
-      config = JSON.parse(readFileSync7(configPath, "utf-8"));
-    } catch {
-      console.error(
-        `[platform] accounts-state CORRUPT-JSON id=${entry.name} \u2014 account.json failed to parse; treating as stub`
-      );
-      continue;
+    return `purged ${purged}, ${rateLimitMap.size} tracked`;
+  }
+});
+function renderLoginPage(opts) {
+  const error = opts?.error ?? "";
+  const lockout = opts?.lockoutSeconds ?? 0;
+  const redirect = opts?.redirect ?? "/";
+  const mode = opts?.mode ?? "login";
+  const changeError = opts?.changeError ?? "";
+  const success = opts?.success ?? "";
+  const setupError = opts?.setupError ?? "";
+  const primaryColor = opts?.primaryColor ?? "#7C8C72";
+  const primaryHoverColor = opts?.primaryHoverColor ?? "#6A7A62";
+  const primarySubtle = opts?.primarySubtle ?? "rgba(124,140,114,0.08)";
+  const productName = opts?.productName ?? "Maxy";
+  const logoPath = opts?.logoPath ?? "/brand/maxy-monochrome.png";
+  const faviconPath = opts?.faviconPath ?? "/favicon.ico";
+  const displayFont = opts?.displayFont ?? "'Newsreader', Georgia, serif";
+  const bodyFont = opts?.bodyFont ?? "'Inter', -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif";
+  const logoContainsName = opts?.logoContainsName ?? false;
+  const tagline = opts?.tagline ?? "";
+  const origin = opts?.origin ?? "";
+  const ogCardPath = opts?.ogCardPath ?? "";
+  const manifestPath = opts?.manifestPath ?? "";
+  const appleTouchIconPath = opts?.appleTouchIconPath ?? "";
+  const pwaThemeColor = opts?.themeColor ?? "";
+  const ogBlock = origin && ogCardPath ? [
+    `<meta property="og:title" content="Sign in \u2014 ${escapeHtml(productName)}">`,
+    `<meta property="og:description" content="${escapeHtml(tagline)}">`,
+    `<meta property="og:type" content="website">`,
+    `<meta property="og:url" content="${escapeHtml(origin)}">`,
+    `<meta property="og:image" content="${escapeHtml(origin + ogCardPath)}">`,
+    `<meta property="og:image:width" content="1200">`,
+    `<meta property="og:image:height" content="630">`,
+    `<meta name="twitter:card" content="summary_large_image">`,
+    `<meta name="twitter:title" content="Sign in \u2014 ${escapeHtml(productName)}">`,
+    `<meta name="twitter:description" content="${escapeHtml(tagline)}">`,
+    `<meta name="twitter:image" content="${escapeHtml(origin + ogCardPath)}">`
+  ].join("\n  ") : "";
+  const pwaInstallBlock = manifestPath && appleTouchIconPath ? [
+    `<link rel="manifest" href="${escapeHtml(manifestPath)}">`,
+    `<link rel="apple-touch-icon" href="${escapeHtml(appleTouchIconPath)}">`,
+    `<meta name="mobile-web-app-capable" content="yes">`,
+    `<meta name="apple-mobile-web-app-capable" content="yes">`,
+    pwaThemeColor ? `<meta name="theme-color" content="${escapeHtml(pwaThemeColor)}">` : ""
+  ].filter(Boolean).join("\n  ") : "";
+  const errorHtml = error ? `<p class="msg msg--error">${escapeHtml(error)}</p>` : "";
+  const changeErrorHtml = changeError ? `<p class="msg msg--error">${escapeHtml(changeError)}</p>` : "";
+  const successHtml = success ? `<p class="msg msg--success">${escapeHtml(success)}</p>` : "";
+  const lockoutHtml = lockout > 0 ? `<p class="msg msg--error">Too many attempts. Try again in <span id="countdown">${lockout}</span>s</p>
+       <script>
+         (function() {
+           var s = ${lockout};
+           var el = document.getElementById('countdown');
+           var iv = setInterval(function() { s--; el.textContent = s; if (s <= 0) { clearInterval(iv); location.reload(); } }, 1000);
+         })();
+       </script>` : "";
+  const setupErrorHtml = setupError ? `<p class="msg msg--error">${escapeHtml(setupError)}</p>` : "";
+  const formDisabled = lockout > 0 ? "disabled" : "";
+  const loginDisplay = mode === "login" ? "block" : "none";
+  const changeDisplay = mode === "change" ? "block" : "none";
+  const setupDisplay = mode === "setup" ? "block" : "none";
+  const successDisplay = mode === "success" ? "block" : "none";
+  const subtitleText = mode === "setup" ? "Set your remote password" : "Remote access";
+  const displayFontName = displayFont.match(/^'([^']+)'/)?.[1] ?? "";
+  const bodyFontName = bodyFont.match(/^'([^']+)'/)?.[1] ?? "";
+  const googleFontsLink = displayFontName || bodyFontName ? [
+    '<link rel="preconnect" href="https://fonts.googleapis.com">',
+    '<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>',
+    '<link href="https://fonts.googleapis.com/css2?' + [
+      displayFontName ? `family=${displayFontName.replace(/ /g, "+")}:wght@300;400` : "",
+      bodyFontName ? `family=${bodyFontName.replace(/ /g, "+")}:wght@400;500` : ""
+    ].filter(Boolean).join("&") + '&display=swap" rel="stylesheet">'
+  ].join("\n  ") : "";
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Sign in \u2014 ${escapeHtml(productName)}</title>
+  <link rel="icon" href="${escapeHtml(faviconPath)}">
+  ${pwaInstallBlock}
+  ${ogBlock}
+  ${googleFontsLink}
+  <style>
+    * { margin: 0; padding: 0; box-sizing: border-box; }
+    body {
+      font-family: ${bodyFont};
+      background: #F6F5F2;
+      color: #2A2D38;
+      min-height: 100vh;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+    }
+    .page {
+      display: flex;
+      flex-direction: column;
+      align-items: center;
+      gap: 24px;
+      max-width: 420px;
+      width: 100%;
+      padding: 40px 20px;
     }
-    out.push({ accountId: config.accountId, accountDir, config });
-  }
-  return out;
-}
-function isValidAccountId(id) {
-  return listValidAccounts().some((a) => a.accountId === id);
-}
-function resolveAccount() {
-  if (!existsSync5(ACCOUNTS_DIR)) return null;
-  let usersJsonUserId = null;
-  if (existsSync5(USERS_FILE)) {
-    try {
-      const raw2 = readFileSync7(USERS_FILE, "utf-8").trim();
-      if (raw2) {
-        const users = JSON.parse(raw2);
-        if (users.length > 0) {
-          usersJsonUserId = users[0].userId;
-        }
-      }
-    } catch {
+    .logo-img {
+      width: 110px;
+      height: 110px;
+      margin: -11px;
+      object-fit: contain;
     }
-  }
-  const entries2 = readdirSync(ACCOUNTS_DIR, { withFileTypes: true });
-  let fallback = null;
-  for (const entry of entries2) {
-    if (!entry.isDirectory()) continue;
-    const configPath = resolve4(ACCOUNTS_DIR, entry.name, "account.json");
-    if (!existsSync5(configPath)) continue;
-    const raw2 = readFileSync7(configPath, "utf-8");
-    let config;
-    try {
-      config = JSON.parse(raw2);
-    } catch {
-      console.error(`[maxy] account.json is corrupt at ${configPath} \u2014 skipping`);
-      continue;
+    .title {
+      font-family: ${displayFont};
+      font-weight: 300;
+      font-size: 28px;
+      color: #2A2D38;
+      text-align: center;
+      letter-spacing: -0.01em;
+      line-height: 1.3;
     }
-    if (!config.adminModel || !config.publicModel) {
-      throw new Error(
-        `[maxy] account.json at ${configPath} is missing required model fields (adminModel / publicModel). Update account.json with valid model identifiers.`
-      );
+    .subtitle {
+      font-size: 15px;
+      color: #4A4D58;
+      text-align: center;
+      margin-top: -8px;
     }
-    const result = {
-      accountId: config.accountId,
-      accountDir: resolve4(ACCOUNTS_DIR, entry.name),
-      config
-    };
-    if (usersJsonUserId && config.admins?.some((a) => a.userId === usersJsonUserId)) {
-      return result;
+    .form-wrap {
+      width: 100%;
+      max-width: 300px;
     }
-    if (!fallback) {
-      fallback = result;
+    .field { margin-bottom: 12px; }
+    .field-label {
+      display: block;
+      font-size: 13px;
+      font-weight: 500;
+      color: #4A4D58;
+      margin-bottom: 6px;
     }
-  }
-  if (usersJsonUserId && fallback) {
-    console.warn(
-      `[maxy] resolveAccount: no account matches users.json userId ${usersJsonUserId} \u2014 falling back to ${fallback.accountId}`
-    );
-  }
-  return fallback;
-}
-function readAgentFile(accountDir, agentName, filename) {
-  const filePath = resolve4(accountDir, "agents", agentName, filename);
-  if (!existsSync5(filePath)) return null;
-  const raw2 = readFileSync7(filePath, "utf-8");
-  if (filename.endsWith(".md")) {
-    return substituteBrandPlaceholders(raw2, filePath);
-  }
-  return raw2;
-}
-var RESERVED_SLUGS = /* @__PURE__ */ new Set(["admin", "api", "assets", "agent-assets", "brand", "bot", "privacy"]);
-var SHADOWED_SLUGS = new Set(SYSTEM_PATH_SLUGS);
-var SLUG_PATTERN = /^[a-z][a-z0-9-]{2,49}$/;
-function validateAgentSlug(slug) {
-  if (!SLUG_PATTERN.test(slug)) return false;
-  if (RESERVED_SLUGS.has(slug)) {
-    console.error(`[agent-slug] op=reject slug=${slug} reason=reserved`);
-    return false;
-  }
-  if (SHADOWED_SLUGS.has(slug)) {
-    console.error(`[agent-slug] op=reject slug=${slug} reason=shadowed`);
-    return false;
-  }
-  return true;
-}
-function resolveDefaultAgentSlug(accountDir) {
-  const configPath = resolve4(accountDir, "account.json");
-  if (!existsSync5(configPath)) {
-    console.error("[agent-resolve] account.json not found \u2014 cannot resolve defaultAgent");
-    return null;
-  }
-  let config;
-  try {
-    config = JSON.parse(readFileSync7(configPath, "utf-8"));
-  } catch (err) {
-    console.error("[agent-resolve] failed to read account.json:", err);
-    return null;
-  }
-  if (!config.defaultAgent) {
-    console.error("[agent-resolve] defaultAgent not configured in account.json \u2014 set it via the connect-whatsapp skill");
-    return null;
-  }
-  const agentConfigPath = resolve4(accountDir, "agents", config.defaultAgent, "config.json");
-  if (!existsSync5(agentConfigPath)) {
-    console.error(`[agent-resolve] defaultAgent="${config.defaultAgent}" has no config.json at ${agentConfigPath}`);
-    return null;
-  }
-  return config.defaultAgent;
-}
-function estimateTokens(text) {
-  return Math.ceil(text.length / 4);
-}
-function resolveAgentConfig(accountDir, agentName) {
-  let model = null;
-  let status = null;
-  let displayName = null;
-  let image = null;
-  let imageShape = null;
-  let showAgentName = false;
-  let knowledgeKeywords = null;
-  let accessMode = "open";
-  const MAX_KNOWLEDGE_KEYWORDS = 5;
-  const configRaw = readAgentFile(accountDir, agentName, "config.json");
-  if (configRaw) {
-    let parsed;
-    try {
-      parsed = JSON.parse(configRaw);
-    } catch {
-      console.warn(`[agent-config] ${agentName}/config.json: invalid JSON \u2014 using defaults`);
-      parsed = {};
+    .field-input {
+      width: 100%;
+      padding: 10px 12px;
+      border: 1px solid #E4E3DE;
+      border-radius: 8px;
+      font-size: 15px;
+      font-family: inherit;
+      outline: none;
+      background: #fff;
+      transition: border-color 0.15s, box-shadow 0.15s;
+    }
+    .field-input:focus {
+      border-color: ${primaryColor};
+      box-shadow: 0 0 0 3px ${primarySubtle};
+    }
+    .options {
+      display: flex;
+      align-items: center;
+      justify-content: space-between;
+      gap: 12px;
+      margin-top: 8px;
+    }
+
+    /* Checkbox \u2014 matches Maxy shared checkbox (asterisk-in-square) */
+    .check {
+      position: relative;
+      display: flex;
+      align-items: center;
+      gap: 8px;
+      cursor: pointer;
+      user-select: none;
+    }
+    .check input { position: absolute; opacity: 0; width: 0; height: 0; pointer-events: none; }
+    .check-box {
+      width: 14px;
+      height: 14px;
+      border: 1px solid #E4E3DE;
+      border-radius: 2px;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      font-size: 10px;
+      color: transparent;
+      transition: border-color 0.15s, color 0.15s;
+      flex-shrink: 0;
+    }
+    .check input:checked + .check-box {
+      border-color: ${primaryColor};
+      color: ${primaryColor};
+    }
+    .check-label {
+      font-size: 13px;
+      color: #4A4D58;
+    }
+
+    /* Ghost button \u2014 matches Maxy ghost variant */
+    .ghost {
+      background: none;
+      border: none;
+      font-family: inherit;
+      font-size: 13px;
+      color: #4A4D58;
+      cursor: pointer;
+      padding: 4px 0;
+      transition: color 0.15s;
+    }
+    .ghost:hover { color: #2A2D38; }
+
+    /* Primary button */
+    .btn {
+      width: 100%;
+      padding: 12px;
+      margin-top: 16px;
+      background: ${primaryColor};
+      color: #fff;
+      border: none;
+      border-radius: 10px;
+      font-size: 15px;
+      font-weight: 500;
+      font-family: inherit;
+      cursor: pointer;
+      transition: background 0.15s;
     }
-    model = typeof parsed.model === "string" ? parsed.model : null;
-    status = typeof parsed.status === "string" ? parsed.status : null;
-    displayName = typeof parsed.displayName === "string" ? parsed.displayName : null;
-    image = typeof parsed.image === "string" ? parsed.image : null;
-    if (typeof parsed.imageShape === "string" && ["circle", "rounded"].includes(parsed.imageShape)) {
-      imageShape = parsed.imageShape;
+    .btn:hover:not(:disabled) { background: ${primaryHoverColor}; }
+    .btn:disabled { opacity: 0.5; cursor: not-allowed; }
+
+    /* Messages */
+    .msg {
+      font-size: 13px;
+      text-align: center;
+      margin-top: 8px;
     }
-    if (parsed.showAgentName === true) {
-      showAgentName = true;
-    } else if (parsed.showAgentName === "none") {
-      showAgentName = "none";
+    .msg--error { color: #c44; }
+    .msg--success { color: ${primaryColor}; }
+
+    /* Strength checklist (setup mode) */
+    .strength-checklist { margin: 8px 0; }
+    .strength-item {
+      font-size: 13px;
+      color: #4A4D58;
+      padding: 2px 0;
+      transition: color 0.15s;
     }
-    if (image || imageShape || showAgentName) {
-      console.log(`[agent-config] ${agentName}: image=${image || "(none)"} imageShape=${imageShape || "(none)"} showAgentName=${showAgentName}`);
+    .strength-icon {
+      display: inline-block;
+      width: 16px;
+      text-align: center;
     }
-    if (typeof parsed.accessMode === "string" && ["gated", "paid"].includes(parsed.accessMode)) {
-      accessMode = parsed.accessMode;
+
+    @media (max-width: 440px) {
+      .page { padding: 24px 16px; }
     }
-    if (Array.isArray(parsed.knowledgeKeywords) && parsed.knowledgeKeywords.length > 0) {
-      const filtered = parsed.knowledgeKeywords.filter((k) => typeof k === "string" && k.trim()).map((k) => k.replace(/,/g, "").trim().toLowerCase()).filter(Boolean);
-      if (filtered.length > MAX_KNOWLEDGE_KEYWORDS) {
-        console.warn(`[agent-config] ${agentName}: knowledgeKeywords has ${filtered.length} entries \u2014 capping at ${MAX_KNOWLEDGE_KEYWORDS}`);
-      }
-      knowledgeKeywords = filtered.length > 0 ? filtered.slice(0, MAX_KNOWLEDGE_KEYWORDS) : null;
+  </style>
+</head>
+<body>
+  <div class="page">
+    <img src="${escapeHtml(logoPath)}" alt="${escapeHtml(productName)}" class="logo-img">
+    <h1 class="title"${logoContainsName ? ' style="display:none"' : ""}>${escapeHtml(productName)}</h1>
+    <p class="subtitle">${escapeHtml(subtitleText)}</p>
+
+    ${successHtml}
+
+    <!-- Login -->
+    <div id="login-section" class="form-wrap" style="display:${loginDisplay}">
+      <form method="POST" action="/__remote-auth/login">
+        <input type="hidden" name="redirect" value="${escapeHtml(redirect)}">
+        <div class="field">
+          <label class="field-label" for="password">Password</label>
+          <input class="field-input" type="password" id="password" name="password" required autofocus ${formDisabled}>
+        </div>
+        <div class="options">
+          <label class="check">
+            <input type="checkbox" id="show-login-pw">
+            <span class="check-box">\u2731</span>
+            <span class="check-label">Show password</span>
+          </label>
+          <button type="button" class="ghost" onclick="toggleMode('change')">Change password</button>
+        </div>
+        <button type="submit" class="btn" ${formDisabled}>Sign in</button>
+      </form>
+      ${errorHtml}
+      ${lockoutHtml}
+    </div>
+
+    <!-- Change password -->
+    <div id="change-section" class="form-wrap" style="display:${changeDisplay}">
+      <form method="POST" action="/__remote-auth/change-password">
+        <input type="hidden" name="redirect" value="${escapeHtml(redirect)}">
+        <div class="field">
+          <label class="field-label" for="current_password">Current password</label>
+          <input class="field-input" type="password" id="current_password" name="current_password" required ${formDisabled}>
+        </div>
+        <div class="field">
+          <label class="field-label" for="new_password">New password</label>
+          <input class="field-input" type="password" id="new_password" name="new_password" required ${formDisabled}>
+        </div>
+        <div class="field">
+          <label class="field-label" for="confirm_password">Confirm new password</label>
+          <input class="field-input" type="password" id="confirm_password" name="confirm_password" required ${formDisabled}>
+        </div>
+        <div class="options">
+          <label class="check">
+            <input type="checkbox" id="show-change-pw">
+            <span class="check-box">\u2731</span>
+            <span class="check-label">Show passwords</span>
+          </label>
+          <button type="button" class="ghost" onclick="toggleMode('login')">Back to sign in</button>
+        </div>
+        <button type="submit" class="btn" ${formDisabled}>Change password</button>
+      </form>
+      ${changeErrorHtml}
+    </div>
+
+    <!-- Setup (initial password) -->
+    <div id="setup-section" class="form-wrap" style="display:${setupDisplay}">
+      <form method="POST" action="/__remote-auth/set-initial-password">
+        <div class="field">
+          <label class="field-label" for="setup_password">Password</label>
+          <input class="field-input" type="password" id="setup_password" name="password" required autofocus>
+        </div>
+        <div class="field">
+          <label class="field-label" for="setup_confirm">Confirm password</label>
+          <input class="field-input" type="password" id="setup_confirm" name="confirm_password" required>
+        </div>
+        <div id="strength-checklist" class="strength-checklist">
+          <div class="strength-item" id="req-length"><span class="strength-icon">\u25CB</span> At least 8 characters</div>
+          <div class="strength-item" id="req-number"><span class="strength-icon">\u25CB</span> Contains a number</div>
+          <div class="strength-item" id="req-special"><span class="strength-icon">\u25CB</span> Contains a special character</div>
+          <div class="strength-item" id="req-spaces"><span class="strength-icon">\u25CB</span> No spaces</div>
+        </div>
+        <div class="options">
+          <label class="check">
+            <input type="checkbox" id="show-setup-pw">
+            <span class="check-box">\u2731</span>
+            <span class="check-label">Show passwords</span>
+          </label>
+        </div>
+        <button type="submit" class="btn" id="setup-submit" disabled>Set password</button>
+      </form>
+      ${setupErrorHtml}
+    </div>
+
+    <!-- Success (after initial password set) -->
+    <div id="success-section" class="form-wrap" style="display:${successDisplay}">
+      <p class="msg msg--success" style="font-size:15px;margin-bottom:4px;">\u2713 Password set</p>
+      <p style="font-size:14px;color:#4A4D58;text-align:center;">You can close this tab and return to the onboarding tab.</p>
+      <a href="/" style="display:block;text-align:center;margin-top:16px;font-size:13px;color:#4A4D58;text-decoration:none;" onmouseover="this.style.color='#2A2D38'" onmouseout="this.style.color='#4A4D58'">Sign in \u2192</a>
+      <script>
+        (function() {
+          try {
+            var ch = new BroadcastChannel('platform-onboarding');
+            setTimeout(function() {
+              ch.postMessage({ type: 'remote-password-set' });
+              ch.close();
+            }, 2500);
+          } catch(e) {}
+        })();
+      </script>
+    </div>
+  </div>
+
+  <script>
+    /* Toggle between login and change-password modes */
+    function toggleMode(mode) {
+      document.getElementById('login-section').style.display = mode === 'login' ? 'block' : 'none';
+      document.getElementById('change-section').style.display = mode === 'change' ? 'block' : 'none';
+      /* Focus first input in the active section */
+      var id = mode === 'login' ? 'password' : 'current_password';
+      var el = document.getElementById(id);
+      if (el) el.focus();
     }
-  }
-  let knowledge = null;
-  let knowledgeBaked = false;
-  const agentDir = resolve4(accountDir, "agents", agentName);
-  const knowledgePath = resolve4(agentDir, "KNOWLEDGE.md");
-  const summaryPath = resolve4(agentDir, "KNOWLEDGE-SUMMARY.md");
-  const hasKnowledge = existsSync5(knowledgePath);
-  const hasSummary = existsSync5(summaryPath);
-  if (hasKnowledge && hasSummary) {
-    const knowledgeMtime = statSync(knowledgePath).mtimeMs;
-    const summaryMtime = statSync(summaryPath).mtimeMs;
-    if (summaryMtime >= knowledgeMtime) {
-      knowledge = readFileSync7(summaryPath, "utf-8");
-    } else {
-      console.warn(`[agent-config] ${agentName}: KNOWLEDGE-SUMMARY.md is stale (KNOWLEDGE.md is newer) \u2014 using full knowledge`);
-      knowledge = readFileSync7(knowledgePath, "utf-8");
+
+    /* Show/hide password toggles */
+    function bindShowHide(checkboxId, inputIds) {
+      var cb = document.getElementById(checkboxId);
+      if (!cb) return;
+      cb.addEventListener('change', function() {
+        var type = cb.checked ? 'text' : 'password';
+        inputIds.forEach(function(id) {
+          var el = document.getElementById(id);
+          if (el) el.type = type;
+        });
+      });
     }
-    knowledgeBaked = true;
-  } else if (hasKnowledge) {
-    knowledge = readFileSync7(knowledgePath, "utf-8");
-    knowledgeBaked = true;
-  }
-  let budget = null;
-  const identityRaw = readAgentFile(accountDir, agentName, "IDENTITY.md");
-  const soulRaw = readAgentFile(accountDir, agentName, "SOUL.md");
-  if (identityRaw || soulRaw || knowledge) {
-    const identityTokens = identityRaw ? estimateTokens(identityRaw) : 0;
-    const soulTokens = soulRaw ? estimateTokens(soulRaw) : 0;
-    const knowledgeTokens = knowledge ? estimateTokens(knowledge) : 0;
-    budget = {
-      identity: identityTokens,
-      soul: soulTokens,
-      knowledge: knowledgeTokens,
-      plugins: 0,
-      total: identityTokens + soulTokens + knowledgeTokens
-    };
-  }
-  return { model, status, displayName, image, imageShape, showAgentName, knowledge, knowledgeBaked, knowledgeKeywords, budget, accessMode };
-}
-function isActiveAgentSlug(accountDir, slug) {
-  return resolveAgentConfig(accountDir, slug).status === "active";
+    bindShowHide('show-login-pw', ['password']);
+    bindShowHide('show-change-pw', ['current_password', 'new_password', 'confirm_password']);
+    bindShowHide('show-setup-pw', ['setup_password', 'setup_confirm']);
+
+    /* Explicit Enter-to-submit for the login password field */
+    var loginPw = document.getElementById('password');
+    if (loginPw) {
+      loginPw.addEventListener('keydown', function(e) {
+        if (e.key === 'Enter') {
+          e.preventDefault();
+          this.closest('form').requestSubmit();
+        }
+      });
+    }
+
+    /* Live password strength validation (setup mode) */
+    (function() {
+      var pw = document.getElementById('setup_password');
+      var confirm = document.getElementById('setup_confirm');
+      var btn = document.getElementById('setup-submit');
+      if (!pw || !confirm || !btn) return;
+
+      var rules = [
+        { id: 'req-length', test: function(p) { return p.length >= 8; } },
+        { id: 'req-number', test: function(p) { return /\\d/.test(p); } },
+        { id: 'req-special', test: function(p) { return /[^A-Za-z0-9]/.test(p); } },
+        { id: 'req-spaces', test: function(p) { return p.length > 0 && !/\\s/.test(p); } }
+      ];
+
+      function check() {
+        var p = pw.value;
+        var allMet = true;
+        rules.forEach(function(r) {
+          var el = document.getElementById(r.id);
+          var met = r.test(p);
+          if (!met) allMet = false;
+          el.querySelector('.strength-icon').textContent = met ? '\\u2713' : '\\u25CB';
+          el.style.color = met ? '${primaryColor}' : '#4A4D58';
+        });
+        var match = p.length > 0 && p === confirm.value;
+        btn.disabled = !(allMet && match);
+      }
+
+      pw.addEventListener('input', check);
+      confirm.addEventListener('input', check);
+    })();
+  </script>
+</body>
+</html>`;
 }
-function getDefaultAccountId() {
-  return resolveAccount()?.accountId ?? null;
+function escapeHtml(str) {
+  return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
 
-// app/lib/claude-agent/session-store.ts
-import { createHash } from "crypto";
-var SESSION_TTL_MS2 = 24 * 60 * 60 * 1e3;
-var sessionStore = /* @__PURE__ */ new Map();
-function fingerprintSessionKey(raw2) {
-  if (typeof raw2 !== "string" || !raw2) return raw2;
-  if (/^sk_[a-f0-9]{16}$/.test(raw2)) return raw2;
-  if (!raw2.startsWith("v1.")) return raw2;
-  return `sk_${createHash("sha256").update(raw2).digest("hex").slice(0, 16)}`;
-}
-function registerSession(cacheKey2, agentType, accountId, _unused, userId, userName, role) {
-  const existing = sessionStore.get(cacheKey2);
-  if (existing) {
-    existing.agentType = agentType;
-    existing.accountId = accountId;
-    existing.userId = userId ?? existing.userId;
-    existing.userName = userName ?? existing.userName;
-    existing.role = role ?? existing.role;
-    return;
+// app/lib/auth-gate.ts
+function canAccessAdmin(input) {
+  const client = resolveClientIp(input.remoteAddress, input.xForwardedFor);
+  if (input.isPublicHost(input.host)) {
+    return { allow: false, reason: "public-host", client };
   }
-  sessionStore.set(cacheKey2, { agentType, createdAt: Date.now(), accountId, userId, userName, role });
-}
-function validateSession(cacheKey2, agentType, _signedSessionToken) {
-  const session = sessionStore.get(cacheKey2);
-  if (!session) return { ok: false, reason: "session-not-registered" };
-  if (session.agentType !== agentType) return { ok: false, reason: "agent-type-mismatch" };
-  if (Date.now() - session.createdAt > SESSION_TTL_MS2) {
-    sessionStore.delete(cacheKey2);
-    return { ok: false, reason: "session-expired-age" };
+  if (client.kind !== "external") {
+    return { allow: true, client };
   }
-  return { ok: true };
-}
-function getAccountIdForSession(cacheKey2) {
-  return sessionStore.get(cacheKey2)?.accountId;
+  if (!isRemoteAuthConfigured()) {
+    return { allow: false, reason: "remote-unconfigured", client };
+  }
+  const token = parseCookieValue(input.cookieHeader, "__remote_session");
+  if (token && validateRemoteSession(token)) {
+    return { allow: true, client };
+  }
+  return { allow: false, reason: "unauthorized", client };
 }
-function getUserIdForSession(cacheKey2) {
-  return sessionStore.get(cacheKey2)?.userId;
+function parseCookieValue(cookieHeader, name) {
+  if (!cookieHeader) return null;
+  const match2 = cookieHeader.match(new RegExp(`(?:^|;\\s*)${name}=([^;]*)`));
+  if (!match2) return null;
+  try {
+    return decodeURIComponent(match2[1]);
+  } catch {
+    return null;
+  }
 }
-function getUserNameForSession(cacheKey2) {
-  return sessionStore.get(cacheKey2)?.userName;
+function isApiRequestPath(path) {
+  return path.startsWith("/api/");
 }
-function getRoleForSession(cacheKey2) {
-  return sessionStore.get(cacheKey2)?.role;
+
+// app/lib/agent-slug-pattern.ts
+var AGENT_SLUG_PATTERN = /^\/([a-z][a-z0-9-]{2,49})$/;
+
+// server/public-host-gate.ts
+var PUBLIC_ALLOWED_PREFIXES = [
+  "/api/session",
+  "/api/chat",
+  // Task 873 — the detooled public surface's visitor-authed reader (pointer +
+  // server-filtered SSE stream). Reached by the visitor browser on the public
+  // host; authenticated by the __access_session grant inside the route.
+  "/api/public-reader/",
+  "/api/access/",
+  "/api/health",
+  // Public free/busy for the booking page. Open slots only, no :Meeting detail
+  // (server/routes/calendar-public.ts). Admitted on public hosts; on the brand
+  // host the remote-auth gate bypasses the same path (server/index.ts).
+  "/api/calendar/free-busy",
+  "/api/telegram/",
+  // Task 1881 — the data portal's device-held-file fetch. Reached by the edge
+  // Pages Function's signed HEAD/GET probe on the public host; authenticated by
+  // the per-account HMAC signature the route re-verifies (portal-fetch.ts), not
+  // the remote-auth gate. Pointing PORTAL_INSTALL_ORIGIN at the admin host
+  // instead made every download 503 (remote-auth-required on the probe).
+  "/api/portal/fetch",
+  // QuickBooks OAuth consent callback. Intuit redirects the operator's browser
+  // here with no admin cookie; the route authenticates by validating the OAuth
+  // `state` nonce, not the remote-auth gate (same model as /api/telegram/).
+  "/api/quickbooks/",
+  "/assets/",
+  "/brand/",
+  "/agent-assets/",
+  "/generated/",
+  "/g/",
+  "/sites/"
+];
+var PUBLIC_ALLOWED_EXACT = [
+  "/favicon.ico",
+  "/brand-defaults.css"
+];
+function isPublicPathAllowed(path) {
+  if (path === "/") return true;
+  if (PUBLIC_ALLOWED_EXACT.includes(path)) return true;
+  if (PUBLIC_ALLOWED_PREFIXES.some((prefix) => path.startsWith(prefix))) return true;
+  return AGENT_SLUG_PATTERN.test(path);
 }
-function getSessionIdForSession(cacheKey2) {
-  return sessionStore.get(cacheKey2)?.sessionId;
+function isOperatorHost(host, operatorDomains2) {
+  return operatorDomains2.has(host);
 }
-function setSessionIdForSession(cacheKey2, sessionId) {
-  const session = sessionStore.get(cacheKey2);
-  if (!session) return false;
-  session.sessionId = sessionId;
-  return true;
+function classifyHost(host, operatorDomains2, isPublicHost) {
+  if (operatorDomains2.has(host)) return "operator";
+  if (isPublicHost(host)) return "public";
+  return "admin";
 }
-function setWantsPriorConversation(cacheKey2) {
-  const session = sessionStore.get(cacheKey2);
-  if (session) session.wantsPriorConversation = true;
+
+// server/operator-domains-reader.ts
+import { watchFile } from "fs";
+
+// app/lib/operator-domains.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname3, resolve as resolve4 } from "path";
+var OPERATOR_DOMAINS_PATH = resolve4(MAXY_DIR, "operator-domains.json");
+function loadOperatorDomains() {
+  if (!existsSync5(OPERATOR_DOMAINS_PATH)) return /* @__PURE__ */ new Set();
+  try {
+    const parsed = JSON.parse(readFileSync7(OPERATOR_DOMAINS_PATH, "utf-8"));
+    if (!Array.isArray(parsed)) return /* @__PURE__ */ new Set();
+    return new Set(parsed.filter((h) => typeof h === "string"));
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
 }
-function unregisterSession(cacheKey2) {
-  return sessionStore.delete(cacheKey2);
+
+// server/operator-domains-reader.ts
+var operatorDomains = loadOperatorDomains();
+if (operatorDomains.size > 0) {
+  console.log(
+    `[operator-domains] loaded ${operatorDomains.size} operator domain(s): ${[...operatorDomains].join(", ")}`
+  );
 }
-function getSessionKeyBySessionId(_sessionId) {
-  return void 0;
+watchFile(OPERATOR_DOMAINS_PATH, { interval: 2e3 }, () => {
+  operatorDomains = loadOperatorDomains();
+  console.log(
+    `[operator-domains] reloaded ${operatorDomains.size} operator domain(s): ${[...operatorDomains].join(", ")}`
+  );
+});
+function getOperatorDomains() {
+  return operatorDomains;
 }
 
 // app/lib/claude-agent/plugin-manifest.ts
@@ -4522,37 +4553,6 @@ var emitMissingOnResolve = (..._args) => null;
 // app/lib/claude-agent/summary-helpers.ts
 var stripAttachmentMetaSuffix = (..._args) => null;
 
-// ../lib/require-port-env/src/index.ts
-var MissingPortEnvError = class extends Error {
-  envName;
-  tag;
-  failLine;
-  constructor(envName, tag, failLine, message) {
-    super(message);
-    this.name = "MissingPortEnvError";
-    this.envName = envName;
-    this.tag = tag;
-    this.failLine = failLine;
-  }
-};
-var VALID_PORT_MIN = 1;
-var VALID_PORT_MAX = 65535;
-function requirePortEnv(envName, options = {}) {
-  const tag = options.tag ?? "port-env";
-  const failLine = options.failLine ?? "missing-port-env";
-  const raw2 = process.env[envName];
-  if (raw2 === void 0 || raw2 === "") {
-    const msg = `[${tag}] ${failLine} reason=missing-env env=${envName}`;
-    throw new MissingPortEnvError(envName, tag, failLine, msg);
-  }
-  const parsed = Number.parseInt(raw2, 10);
-  if (!Number.isInteger(parsed) || parsed < VALID_PORT_MIN || parsed > VALID_PORT_MAX || String(parsed) !== raw2.trim()) {
-    const msg = `[${tag}] ${failLine} reason=invalid-port-env env=${envName} value=${JSON.stringify(raw2)}`;
-    throw new MissingPortEnvError(envName, tag, failLine, msg);
-  }
-  return parsed;
-}
-
 // app/lib/neo4j-store.ts
 import neo4j from "neo4j-driver";
 import { randomUUID } from "crypto";
@@ -6208,11 +6208,6 @@ export {
   Hono2 as Hono,
   getRequestListener,
   serve,
-  sampleCpu,
-  sampleProcessCpu,
-  registerLoop,
-  listLoops,
-  armedCount,
   MAXY_DIR,
   BRAND_NAME,
   COMMERCIAL_MODE,
@@ -6230,6 +6225,35 @@ export {
   INSTALL_OWNER_FILE,
   VISITOR_TOKEN_SECRET_FILE,
   CLAUDE_CREDENTIALS_FILE,
+  SYSTEM_PATH_SLUGS,
+  PLATFORM_ROOT2 as PLATFORM_ROOT,
+  ACCOUNTS_DIR,
+  listValidAccounts,
+  isValidAccountId,
+  resolveAccount,
+  validateAgentSlug,
+  resolveDefaultAgentSlug,
+  resolveAgentConfig,
+  isActiveAgentSlug,
+  getDefaultAccountId,
+  requirePortEnv,
+  fingerprintSessionKey,
+  registerSession,
+  validateSession,
+  getAccountIdForSession,
+  getUserIdForSession,
+  getUserNameForSession,
+  getRoleForSession,
+  getSessionIdForSession,
+  setSessionIdForSession,
+  setWantsPriorConversation,
+  unregisterSession,
+  getSessionKeyBySessionId,
+  sampleCpu,
+  sampleProcessCpu,
+  registerLoop,
+  listLoops,
+  armedCount,
   vncLog,
   newCorrId,
   sanitizeClientCorrId,
@@ -6254,35 +6278,12 @@ export {
   parseCookieValue,
   isApiRequestPath,
   AGENT_SLUG_PATTERN,
-  SYSTEM_PATH_SLUGS,
   PUBLIC_ALLOWED_PREFIXES,
   PUBLIC_ALLOWED_EXACT,
   isPublicPathAllowed,
   isOperatorHost,
   classifyHost,
   getOperatorDomains,
-  PLATFORM_ROOT2 as PLATFORM_ROOT,
-  ACCOUNTS_DIR,
-  listValidAccounts,
-  isValidAccountId,
-  resolveAccount,
-  validateAgentSlug,
-  resolveDefaultAgentSlug,
-  resolveAgentConfig,
-  isActiveAgentSlug,
-  getDefaultAccountId,
-  fingerprintSessionKey,
-  registerSession,
-  validateSession,
-  getAccountIdForSession,
-  getUserIdForSession,
-  getUserNameForSession,
-  getRoleForSession,
-  getSessionIdForSession,
-  setSessionIdForSession,
-  setWantsPriorConversation,
-  unregisterSession,
-  getSessionKeyBySessionId,
   findMissingPlugins,
   walkPremiumBundles,
   autoDeliverPremiumPlugins,
@@ -6290,7 +6291,6 @@ export {
   cleanupLeakedPremiumSubs,
   emitMissingOnResolve,
   stripAttachmentMetaSuffix,
-  requirePortEnv,
   getSession,
   runAdminUserSelfHeal,
   runUserProfileReconcile,
@@ -6321,6 +6321,7 @@ export {
   projectAgent,
   deleteAgentProjection,
   safeJson,
+  resolveCacheKey,
   requireAdminSession,
   tryCookieBridgeForConversation,
   requireAdminCookie,