@rubytech/create-maxy-code 0.1.51 → 0.1.58

package/payload/server/server.js

@@ -14,7 +14,6 @@ import {
   USERS_FILE,
   VNC_DISPLAY,
   WEBSOCKIFY_PORT,
-  appendStreamLogLine,
   autoDeliverPremiumPlugins,
   browserViewerLog,
   canAccessAdmin,
@@ -42,6 +41,7 @@ import {
   registerSession,
   renderLoginPage,
   requireAdminSession,
+  requirePortEnv,
   resolveAccount,
   resolveClientIp,
   resolveUserAccounts,
@@ -60,7 +60,7 @@ import {
   vncLog,
   waitForExit,
   walkPremiumBundles
-} from "./chunk-CWI7NOWK.js";
+} from "./chunk-2IKQERHN.js";
 import {
   CLOUDFLARE_TASK_DIAGNOSTICS,
   appendCloudflareSteps,
@@ -4410,7 +4410,7 @@ import { resolve as resolve5 } from "path";
 
 // app/lib/channel-pty-bridge/manager-client.ts
 function managerBase() {
-  const port2 = Number(process.env.CLAUDE_SESSION_MANAGER_PORT ?? "19400");
+  const port2 = requirePortEnv("CLAUDE_SESSION_MANAGER_PORT", { tag: "channel-pty-bridge:manager-client" });
   return `http://127.0.0.1:${port2}`;
 }
 async function managerSpawn(opts) {
@@ -6861,71 +6861,6 @@ app8.post("/", requireAdminSession, async (c) => {
 });
 var new_session_submit_default = app8;
 
-// server/routes/admin/failure-report.ts
-var SESSION_KEY_RE2 = /^sk_[0-9a-f]{16}$/i;
-var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-var ISO_RE3 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/;
-var SAFE_TOKEN_RE = /^[\w.:-]{1,64}$/;
-function validate(body) {
-  const missing = [];
-  if (typeof body.sessionKey !== "string" || !SESSION_KEY_RE2.test(body.sessionKey)) missing.push("sessionKey");
-  if (typeof body.conversationId !== "string" || !UUID_RE2.test(body.conversationId)) missing.push("conversationId");
-  if (typeof body.lastUserMessageId !== "string" || !SAFE_TOKEN_RE.test(body.lastUserMessageId)) missing.push("lastUserMessageId");
-  if (typeof body.clickTs !== "string" || !ISO_RE3.test(body.clickTs)) missing.push("clickTs");
-  const snap = body.clientSnapshot;
-  if (!snap || typeof snap !== "object") missing.push("clientSnapshot");
-  if (missing.length > 0) return { ok: false, missing };
-  const snapshot = snap;
-  const lastAssistantMessageId = typeof body.lastAssistantMessageId === "string" && SAFE_TOKEN_RE.test(body.lastAssistantMessageId) ? body.lastAssistantMessageId : "-";
-  const sseReadyState = typeof snapshot.sseReadyState === "string" && SAFE_TOKEN_RE.test(snapshot.sseReadyState) ? snapshot.sseReadyState : typeof snapshot.sseReadyState === "number" ? String(snapshot.sseReadyState) : "-";
-  const lastEventType = typeof snapshot.lastEventType === "string" && SAFE_TOKEN_RE.test(snapshot.lastEventType) ? snapshot.lastEventType : "-";
-  const lastAppliedMessageId = typeof snapshot.lastAppliedMessageId === "string" && SAFE_TOKEN_RE.test(snapshot.lastAppliedMessageId) ? snapshot.lastAppliedMessageId : "-";
-  return {
-    ok: true,
-    value: {
-      sessionKey: body.sessionKey,
-      conversationId: body.conversationId,
-      lastUserMessageId: body.lastUserMessageId,
-      lastAssistantMessageId,
-      clickTs: body.clickTs,
-      sseReadyState,
-      lastEventType,
-      lastAppliedMessageId
-    }
-  };
-}
-var app9 = new Hono();
-app9.post("/", requireAdminSession, async (c) => {
-  let body;
-  try {
-    body = await c.req.json();
-  } catch {
-    return c.json({ ok: false, error: "missing-turn-identifiers", missing: ["body-not-json"] }, 400);
-  }
-  const v = validate(body);
-  if (!v.ok) {
-    return c.json({ ok: false, error: "missing-turn-identifiers", missing: v.missing }, 400);
-  }
-  const cacheKey = c.var.cacheKey;
-  const accountId = getAccountIdForSession(cacheKey);
-  if (!accountId) {
-    return c.json({ ok: false, error: "no-account" }, 401);
-  }
-  const line = [
-    `[failure-report] sessionKey=${v.value.sessionKey}`,
-    `conversationId=${v.value.conversationId}`,
-    `userMessageId=${v.value.lastUserMessageId}`,
-    `assistantMessageId=${v.value.lastAssistantMessageId}`,
-    `sseState=${v.value.sseReadyState}`,
-    `lastEventType=${v.value.lastEventType}`,
-    `lastAppliedMessageId=${v.value.lastAppliedMessageId}`,
-    `ts=${v.value.clickTs}`
-  ].join(" ");
-  appendStreamLogLine(accountId, v.value.sessionKey, line);
-  return c.json({ ok: true });
-});
-var failure_report_default = app9;
-
 // server/routes/admin/logs.ts
 import { existsSync as existsSync10, readdirSync as readdirSync5, readFileSync as readFileSync11, statSync as statSync5 } from "fs";
 import { resolve as resolve8, basename as basename3 } from "path";
@@ -6947,8 +6882,8 @@ function resolveSessionLogPaths(filename, logDirs) {
 
 // server/routes/admin/logs.ts
 var TAIL_BYTES = 8192;
-var app10 = new Hono();
-app10.get("/", async (c) => {
+var app9 = new Hono();
+app9.get("/", async (c) => {
   const fileParam = c.req.query("file");
   const typeParam = c.req.query("type");
   const conversationIdParam = c.req.query("conversationId");
@@ -7090,12 +7025,12 @@ app10.get("/", async (c) => {
   }
   return c.json({ logs });
 });
-var logs_default = app10;
+var logs_default = app9;
 
 // server/routes/admin/claude-info.ts
 import { execFileSync as execFileSync3 } from "child_process";
-var app11 = new Hono();
-app11.get("/", (c) => {
+var app10 = new Hono();
+app10.get("/", (c) => {
   let version = "unknown";
   try {
     const raw = execFileSync3("claude", ["--version"], { encoding: "utf-8", timeout: 5e3 });
@@ -7113,14 +7048,14 @@ app11.get("/", (c) => {
   const thinkingView = resolvedAccount?.config.thinkingView ?? "default";
   return c.json({ version, account, model, thinkingView });
 });
-var claude_info_default = app11;
+var claude_info_default = app10;
 
 // server/routes/admin/attachment.ts
 import { readFile as readFile3, readdir } from "fs/promises";
 import { existsSync as existsSync11 } from "fs";
 import { resolve as resolve9 } from "path";
-var app12 = new Hono();
-app12.get("/:attachmentId", requireAdminSession, async (c) => {
+var app11 = new Hono();
+app11.get("/:attachmentId", requireAdminSession, async (c) => {
   const attachmentId = c.req.param("attachmentId");
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
@@ -7159,13 +7094,13 @@ app12.get("/:attachmentId", requireAdminSession, async (c) => {
     }
   });
 });
-var attachment_default = app12;
+var attachment_default = app11;
 
 // server/routes/admin/agents.ts
 import { resolve as resolve10 } from "path";
 import { readdirSync as readdirSync6, readFileSync as readFileSync12, existsSync as existsSync12, rmSync } from "fs";
-var app13 = new Hono();
-app13.get("/", (c) => {
+var app12 = new Hono();
+app12.get("/", (c) => {
   const account = resolveAccount();
   if (!account) return c.json({ agents: [] });
   const agentsDir = resolve10(account.accountDir, "agents");
@@ -7195,7 +7130,7 @@ app13.get("/", (c) => {
   }
   return c.json({ agents });
 });
-app13.delete("/:slug", async (c) => {
+app12.delete("/:slug", async (c) => {
   const slug = c.req.param("slug");
   const account = resolveAccount();
   if (!account) return c.json({ error: "No account resolved" }, 400);
@@ -7225,7 +7160,7 @@ app13.delete("/:slug", async (c) => {
     return c.json({ error: "Failed to delete agent" }, 500);
   }
 });
-app13.post("/:slug/project", async (c) => {
+app12.post("/:slug/project", async (c) => {
   const slug = c.req.param("slug");
   const account = resolveAccount();
   if (!account) return c.json({ error: "No account resolved" }, 400);
@@ -7247,7 +7182,7 @@ app13.post("/:slug/project", async (c) => {
     return c.json({ error: `Projection failed: ${msg}` }, 500);
   }
 });
-var agents_default = app13;
+var agents_default = app12;
 
 // server/routes/admin/sessions.ts
 import crypto from "crypto";
@@ -7416,8 +7351,8 @@ function formatAge(updatedAtStr) {
     return "unknown";
   }
 }
-var app14 = new Hono();
-app14.get("/", requireAdminSession, async (c) => {
+var app13 = new Hono();
+app13.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) return c.json({ error: "Account not found for session" }, 401);
@@ -7447,7 +7382,7 @@ app14.get("/", requireAdminSession, async (c) => {
     return c.json({ error: "Failed to fetch sessions" }, 500);
   }
 });
-app14.post("/new", requireAdminSession, async (c) => {
+app13.post("/new", requireAdminSession, async (c) => {
   const oldCacheKey = c.var.cacheKey;
   console.log(`[admin-chat] new-conversation outcome=ingress cacheKey=${oldCacheKey.slice(0, 8)}`);
   const accountId = getAccountIdForSession(oldCacheKey);
@@ -7464,7 +7399,7 @@ app14.post("/new", requireAdminSession, async (c) => {
   console.log(`[admin-chat] new-conversation outcome=ok oldKey=${oldCacheKey.slice(0, 8)} newKey=${newCacheKey.slice(0, 8)}`);
   return c.json({ session_key: newSignedSessionToken, conversationId: null });
 });
-app14.post("/switch", requireAdminSession, async (c) => {
+app13.post("/switch", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   const userId = getUserIdForSession(cacheKey);
@@ -7492,7 +7427,7 @@ app14.post("/switch", requireAdminSession, async (c) => {
   console.log(`[session-switch] from=${cacheKey.slice(0, 8)} to=${targetCacheKey.slice(0, 8)} targetConvId=${targetConversationId?.slice(0, 8) ?? "none"} accountId=${accountId.slice(0, 8)}`);
   return c.json({ session_key: targetSignedSessionToken, conversationId: targetConversationId });
 });
-app14.delete("/:id", requireAdminSession, async (c) => {
+app13.delete("/:id", requireAdminSession, async (c) => {
   const conversationId = c.req.param("id");
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
@@ -7507,7 +7442,7 @@ app14.delete("/:id", requireAdminSession, async (c) => {
     return c.json({ error: "Failed to delete session" }, 500);
   }
 });
-app14.post("/:id/resume", async (c) => {
+app13.post("/:id/resume", async (c) => {
   const conversationId = c.req.param("id");
   const t0 = Date.now();
   const signedSessionToken = c.req.query("session_key") ?? "";
@@ -7780,7 +7715,7 @@ app14.post("/:id/resume", async (c) => {
     }
   });
 });
-app14.put("/:id/label", requireAdminSession, async (c) => {
+app13.put("/:id/label", requireAdminSession, async (c) => {
   const conversationId = c.req.param("id");
   const cacheKey = c.var.cacheKey;
   let body;
@@ -7806,7 +7741,7 @@ app14.put("/:id/label", requireAdminSession, async (c) => {
     return c.json({ error: "Failed to rename session" }, 500);
   }
 });
-var sessions_default = app14;
+var sessions_default = app13;
 
 // app/lib/claude-agent/spawn-context.ts
 import { existsSync as existsSync14, readFileSync as readFileSync13, readdirSync as readdirSync7, statSync as statSync6 } from "fs";
@@ -8106,10 +8041,11 @@ function resolveTunnelUrl() {
 }
 var TAG18 = "[claude-session-manager:wrapper]";
 function managerBase2() {
-  const port2 = Number(process.env.CLAUDE_SESSION_MANAGER_PORT ?? "19400");
+  const port2 = requirePortEnv("CLAUDE_SESSION_MANAGER_PORT", { tag: "claude-session-manager:wrapper" });
   return `http://127.0.0.1:${port2}`;
 }
-var app15 = new Hono();
+var app14 = new Hono();
+var UUID_PATTERN = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 async function performSpawnWithInitialMessage(args) {
   const ownerStart = Date.now();
   const aboutOwner = await resolveOwnerProfileBlock(args.senderId, args.userId);
@@ -8132,7 +8068,8 @@ async function performSpawnWithInitialMessage(args) {
     dormantPlugins,
     activePlugins,
     specialistDomains,
-    tunnelUrl
+    tunnelUrl,
+    originatingSessionId: args.originatingSessionId
   });
   console.log(`${TAG18} forward-spawn-start managerBase=${managerBase2()} bytes=${upstreamPayload.length} hidden=${args.hidden} specialist=${args.specialist ?? "none"}`);
   const forwardStart = Date.now();
@@ -8166,69 +8103,123 @@ async function performSpawnWithInitialMessage(args) {
   }
   return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
 }
-app15.post("/recorder-spawn", async (c) => {
-  const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
-  const isLoopback = remoteAddr === "127.0.0.1" || remoteAddr === "::1" || remoteAddr === "::ffff:127.0.0.1";
-  if (!isLoopback) {
-    console.error(`${TAG18} recorder-spawn reject reason=non-loopback remoteAddr=${remoteAddr}`);
-    return c.json({ error: "recorder-route-loopback-only" }, 403);
-  }
-  let body = {};
-  try {
-    body = await c.req.json();
-  } catch {
-    return c.json({ error: "body-not-json" }, 400);
-  }
-  if (body.senderId !== "turn-recorder") {
-    return c.json({ error: "recorder-senderId-required" }, 400);
+var requireAdminSessionUnlessLoopbackSpawn = async (c, next) => {
+  if (c.req.method === "POST" && c.req.path === "/api/admin/claude-sessions") {
+    const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
+    const isLoopback = remoteAddr === "127.0.0.1" || remoteAddr === "::1" || remoteAddr === "::ffff:127.0.0.1";
+    const xff = c.req.header("x-forwarded-for");
+    const xffPresent = typeof xff === "string" && xff.length > 0;
+    if (isLoopback && !xffPresent) {
+      console.log(`${TAG18} loopback-spawn-bypass remoteAddr=${remoteAddr} xff=absent`);
+      return next();
+    }
   }
-  const specialist = typeof body.specialist === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(body.specialist) ? body.specialist : void 0;
-  const initialMessage = typeof body.initialMessage === "string" && body.initialMessage.length > 0 ? body.initialMessage : null;
-  console.log(`${TAG18} recorder-spawn accept specialist=${specialist ?? "none"} initialMessageBytes=${initialMessage ? Buffer.byteLength(initialMessage, "utf8") : 0}`);
-  return performSpawnWithInitialMessage({
-    senderId: "turn-recorder",
-    userId: void 0,
-    role: "admin",
-    channel: "browser",
-    permissionMode: void 0,
-    hidden: true,
-    specialist,
-    initialMessage
-  });
-});
-app15.use("*", requireAdminSession);
-app15.post("/", async (c) => {
+  return requireAdminSession(c, next);
+};
+app14.use("*", requireAdminSessionUnlessLoopbackSpawn);
+app14.post("/", async (c) => {
   const routeStart = Date.now();
   const cacheKey = c.get("cacheKey") ?? "";
-  const senderId = getAccountIdForSession(cacheKey) ?? "";
-  if (!senderId) {
-    console.error(`${TAG18} reject reason=no-account-id cacheKey-prefix=${cacheKey.slice(0, 8)}`);
-    return c.json({ error: "admin-account-not-resolved" }, 500);
-  }
-  const userId = getUserIdForSession(cacheKey);
   let body = {};
   try {
     body = await c.req.json();
   } catch {
   }
+  let senderId;
+  let userId;
+  let specialist;
+  let originatingSessionId;
+  let authSurface;
+  if (cacheKey) {
+    authSurface = "cookie";
+    senderId = getAccountIdForSession(cacheKey) ?? "";
+    if (!senderId) {
+      console.error(`${TAG18} reject reason=no-account-id cacheKey-prefix=${cacheKey.slice(0, 8)}`);
+      return c.json({ error: "admin-account-not-resolved" }, 500);
+    }
+    userId = getUserIdForSession(cacheKey) ?? void 0;
+    specialist = void 0;
+    originatingSessionId = void 0;
+  } else {
+    authSurface = "loopback";
+    if (typeof body.originatingSessionId !== "string" || !UUID_PATTERN.test(body.originatingSessionId)) {
+      console.log(`[turn-recorder] spawn-failed sessionId=unknown reason=missing-originating-session-id`);
+      return c.json({ error: "originating-session-id-required" }, 400);
+    }
+    originatingSessionId = body.originatingSessionId;
+    const operatorMeta = await fetch(
+      `${managerBase2()}/${encodeURIComponent(originatingSessionId)}/meta`
+    ).then((r) => r.ok ? r.json() : null).catch((err) => {
+      console.error(`${TAG18} fetch-failed op=operator-meta-lookup message=${err instanceof Error ? err.message : String(err)}`);
+      return null;
+    });
+    const operatorSenderId = operatorMeta && typeof operatorMeta.senderId === "string" && operatorMeta.senderId.length > 0 ? operatorMeta.senderId : null;
+    if (!operatorSenderId) {
+      console.log(
+        `[turn-recorder] spawn-failed sessionId=${originatingSessionId} reason=originating-session-not-found`
+      );
+      return c.json({ error: "originating-session-not-found" }, 404);
+    }
+    senderId = operatorSenderId;
+    userId = void 0;
+    specialist = typeof body.specialist === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(body.specialist) ? body.specialist : "database-operator";
+  }
   const channel = typeof body.channel === "string" ? body.channel : "browser";
   const initialMessage = typeof body.initialMessage === "string" && body.initialMessage.trim() ? body.initialMessage : null;
+  const initialMessageBytes = initialMessage ? Buffer.byteLength(initialMessage, "utf8") : 0;
   const permissionMode = typeof body.permissionMode === "string" ? body.permissionMode : void 0;
-  console.log(`${TAG18} spawn-request-in cacheKey-prefix=${cacheKey.slice(0, 8)} senderId=${senderId.slice(0, 8)} userId=${userId ? userId.slice(0, 8) : "absent"} channel=${channel} permissionMode=${permissionMode ?? "default"} initialMessage=${initialMessage ? "yes" : "no"}`);
-  const result = await performSpawnWithInitialMessage({
+  if (authSurface === "cookie") {
+    console.log(`${TAG18} spawn-request-in surface=cookie cacheKey-prefix=${cacheKey.slice(0, 8)} accountId=${senderId.slice(0, 8)} userId=${userId ? userId.slice(0, 8) : "absent"} channel=${channel} permissionMode=${permissionMode ?? "default"} initialMessage=${initialMessage ? "yes" : "no"}`);
+  } else {
+    console.log(`[turn-recorder] spawn-request sessionId=${originatingSessionId} specialist=${specialist ?? "none"} initialMessageBytes=${initialMessageBytes}`);
+  }
+  const t0 = Date.now();
+  const response = await performSpawnWithInitialMessage({
     senderId,
-    userId: userId ?? void 0,
+    userId,
     role: "admin",
     channel,
     permissionMode,
     hidden: false,
-    specialist: void 0,
-    initialMessage
+    specialist,
+    initialMessage,
+    originatingSessionId
   });
-  console.log(`${TAG18} route-done status=${result.status} route-ms=${Date.now() - routeStart}`);
-  return result;
+  if (authSurface === "loopback" && originatingSessionId) {
+    const respText = await response.text().catch(() => "");
+    const respStatus = response.status;
+    const replay = new Response(respText, { status: respStatus, headers: response.headers });
+    let parsed = null;
+    try {
+      parsed = JSON.parse(respText);
+    } catch {
+      parsed = null;
+    }
+    if (respStatus >= 200 && respStatus < 300 && parsed && typeof parsed.sessionId === "string") {
+      const recorderSessionId = parsed.sessionId;
+      console.log(
+        `[turn-recorder] spawn-success sessionId=${originatingSessionId} recorderSessionId=${recorderSessionId} pid=${parsed.pid ?? 0} latency-ms=${Date.now() - t0}`
+      );
+      if (initialMessage) {
+        console.log(
+          `[turn-recorder] input-delivered sessionId=${originatingSessionId} recorderSessionId=${recorderSessionId} bytes=${initialMessageBytes} multiline=${initialMessage.includes("\n")}`
+        );
+      }
+    } else {
+      const reasonRaw = parsed && typeof parsed.error === "string" ? parsed.error : "unknown";
+      if (reasonRaw !== "tool-surface-missing" && reasonRaw !== "missing-originating-session-id") {
+        const detail = parsed && typeof parsed.detail === "string" ? parsed.detail.slice(0, 200) : "";
+        console.log(
+          `[turn-recorder] spawn-failed sessionId=${originatingSessionId} reason=manager-spawn http=${respStatus} err=${JSON.stringify(detail || reasonRaw)}`
+        );
+      }
+    }
+    return replay;
+  }
+  console.log(`${TAG18} route-done surface=cookie status=${response.status} route-ms=${Date.now() - routeStart}`);
+  return response;
 });
-app15.get("/events", async (c) => {
+app14.get("/events", async (c) => {
   const upstream = await fetch(`${managerBase2()}/events`, {
     headers: { accept: "text/event-stream" }
   }).catch((err) => {
@@ -8246,7 +8237,7 @@ app15.get("/events", async (c) => {
     }
   });
 });
-app15.get("/", async (c) => {
+app14.get("/", async (c) => {
   const cacheKey = c.get("cacheKey") ?? "";
   const senderId = getAccountIdForSession(cacheKey) ?? "";
   if (!senderId) return c.json({ error: "admin-account-not-resolved" }, 500);
@@ -8259,7 +8250,7 @@ app15.get("/", async (c) => {
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
   return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
 });
-app15.post("/resume", async (c) => {
+app14.post("/resume", async (c) => {
   const cacheKey = c.get("cacheKey") ?? "";
   const senderId = getAccountIdForSession(cacheKey) ?? "";
   if (!senderId) return c.json({ error: "admin-account-not-resolved" }, 500);
@@ -8270,8 +8261,8 @@ app15.post("/resume", async (c) => {
   } catch {
     return c.json({ error: "body-not-json" }, 400);
   }
-  if (typeof body.claudeSessionId !== "string" || !body.claudeSessionId) {
-    return c.json({ error: "claudeSessionId-required" }, 400);
+  if (typeof body.sessionId !== "string" || !body.sessionId) {
+    return c.json({ error: "sessionId-required" }, 400);
   }
   const channel = typeof body.channel === "string" ? body.channel : "browser";
   const aboutOwner = await resolveOwnerProfileBlock(senderId, userId);
@@ -8286,7 +8277,7 @@ app15.post("/resume", async (c) => {
       senderId,
       role: "admin",
       channel,
-      claudeSessionId: body.claudeSessionId,
+      sessionId: body.sessionId,
       aboutOwner,
       dormantPlugins,
       activePlugins,
@@ -8300,7 +8291,7 @@ app15.post("/resume", async (c) => {
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
   return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
 });
-app15.post("/:sessionId/stop", async (c) => {
+app14.post("/:sessionId/stop", async (c) => {
   const sessionId = c.req.param("sessionId");
   const upstream = await fetch(
     `${managerBase2()}/${encodeURIComponent(sessionId)}/stop`,
@@ -8312,7 +8303,7 @@ app15.post("/:sessionId/stop", async (c) => {
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
   return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
 });
-app15.delete("/:sessionId", async (c) => {
+app14.delete("/:sessionId", async (c) => {
   const sessionId = c.req.param("sessionId");
   const upstream = await fetch(
     `${managerBase2()}/${encodeURIComponent(sessionId)}`,
@@ -8324,7 +8315,7 @@ app15.delete("/:sessionId", async (c) => {
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
   return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
 });
-app15.post("/:sessionId/archive", async (c) => {
+app14.post("/:sessionId/archive", async (c) => {
   const sessionId = c.req.param("sessionId");
   const body = await c.req.text();
   const upstream = await fetch(
@@ -8341,7 +8332,7 @@ app15.post("/:sessionId/archive", async (c) => {
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
   return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
 });
-app15.get("/:sessionId/meta", async (c) => {
+app14.get("/:sessionId/meta", async (c) => {
   const sessionId = c.req.param("sessionId");
   const upstream = await fetch(
     `${managerBase2()}/${encodeURIComponent(sessionId)}/meta`
@@ -8352,7 +8343,7 @@ app15.get("/:sessionId/meta", async (c) => {
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
   return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
 });
-app15.patch("/:sessionId", async (c) => {
+app14.patch("/:sessionId", async (c) => {
   const sessionId = c.req.param("sessionId");
   const body = await c.req.text();
   const upstream = await fetch(
@@ -8369,7 +8360,7 @@ app15.patch("/:sessionId", async (c) => {
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
   return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
 });
-app15.post("/:sessionId/input", async (c) => {
+app14.post("/:sessionId/input", async (c) => {
   const sessionId = c.req.param("sessionId");
   const rawBody = await c.req.text();
   const upstream = await fetch(
@@ -8386,7 +8377,7 @@ app15.post("/:sessionId/input", async (c) => {
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
   return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
 });
-app15.get("/:sessionId/log", async (c) => {
+app14.get("/:sessionId/log", async (c) => {
   const sessionId = c.req.param("sessionId");
   const follow = c.req.query("follow") === "1" ? "?follow=1" : "";
   const upstream = await fetch(
@@ -8398,7 +8389,49 @@ app15.get("/:sessionId/log", async (c) => {
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
   return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
 });
-var claude_sessions_default = app15;
+var claude_sessions_default = app14;
+
+// server/routes/admin/log-ingest.ts
+var TAG19 = "[log-ingest]";
+var TAG_PATTERN = /^[A-Za-z0-9_-]{1,32}$/;
+var LEVELS = /* @__PURE__ */ new Set(["debug", "info", "warn", "error"]);
+var MAX_LINE_BYTES = 4096;
+var app15 = new Hono();
+app15.post("/", async (c) => {
+  const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
+  const isLoopback = remoteAddr === "127.0.0.1" || remoteAddr === "::1" || remoteAddr === "::ffff:127.0.0.1";
+  if (!isLoopback) {
+    console.error(`${TAG19} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    return c.json({ error: "log-ingest-loopback-only" }, 403);
+  }
+  let body = {};
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "body-not-json" }, 400);
+  }
+  if (typeof body.tag !== "string" || !TAG_PATTERN.test(body.tag)) {
+    return c.json({ error: "tag-invalid" }, 400);
+  }
+  if (typeof body.level !== "string" || !LEVELS.has(body.level)) {
+    return c.json({ error: "level-invalid" }, 400);
+  }
+  if (typeof body.line !== "string" || body.line.length === 0) {
+    return c.json({ error: "line-required" }, 400);
+  }
+  if (body.line.includes("\n") || body.line.includes("\r")) {
+    return c.json({ error: "line-must-be-single-line" }, 400);
+  }
+  if (Buffer.byteLength(body.line, "utf8") > MAX_LINE_BYTES) {
+    return c.json({ error: "line-too-long", max: MAX_LINE_BYTES }, 400);
+  }
+  const formatted = `[${body.tag}] ${body.line}`;
+  if (body.level === "error") console.error(formatted);
+  else if (body.level === "warn") console.warn(formatted);
+  else console.log(formatted);
+  return c.json({ ok: true }, 200);
+});
+var log_ingest_default = app15;
 
 // server/routes/admin/browser.ts
 var app16 = new Hono();
@@ -8508,13 +8541,13 @@ async function cdpNavigateNewTab(url, opts = {}) {
 // server/routes/admin/device-browser.ts
 var app18 = new Hono();
 app18.post("/navigate", async (c) => {
-  const TAG20 = "[device-url:click]";
+  const TAG21 = "[device-url:click]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG20} reject reason=body-not-json detail=${detail} browser=fallback navigateResult=error`);
+    console.error(`${TAG21} reject reason=body-not-json detail=${detail} browser=fallback navigateResult=error`);
     return c.json(
       { ok: false, navigateResult: "error", browser: "fallback", detail: "Request body was not valid JSON" },
       400
@@ -8524,7 +8557,7 @@ app18.post("/navigate", async (c) => {
   const intent = typeof body.intent === "string" ? body.intent : "";
   const hostname2 = typeof body.hostname === "string" ? body.hostname : "";
   if (!url) {
-    console.error(`${TAG20} reject reason=missing-url intent=${JSON.stringify(intent)} browser=fallback navigateResult=error`);
+    console.error(`${TAG21} reject reason=missing-url intent=${JSON.stringify(intent)} browser=fallback navigateResult=error`);
     return c.json(
       { ok: false, navigateResult: "error", browser: "fallback", detail: "url field is required" },
       400
@@ -8534,7 +8567,7 @@ app18.post("/navigate", async (c) => {
   try {
     parsed = new URL(url);
   } catch {
-    console.error(`${TAG20} reject reason=url-malformed intent=${JSON.stringify(intent)} url=${url} browser=fallback navigateResult=error`);
+    console.error(`${TAG21} reject reason=url-malformed intent=${JSON.stringify(intent)} url=${url} browser=fallback navigateResult=error`);
     return c.json(
       { ok: false, navigateResult: "error", browser: "fallback", detail: "url is not a valid URL" },
       400
@@ -8542,7 +8575,7 @@ app18.post("/navigate", async (c) => {
   }
   if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
     console.error(
-      `${TAG20} reject reason=scheme-not-allowed scheme=${parsed.protocol} intent=${JSON.stringify(intent)} browser=fallback navigateResult=error`
+      `${TAG21} reject reason=scheme-not-allowed scheme=${parsed.protocol} intent=${JSON.stringify(intent)} browser=fallback navigateResult=error`
     );
     return c.json(
       {
@@ -8558,7 +8591,7 @@ app18.post("/navigate", async (c) => {
   const cdpOk = await ensureCdp(transport);
   if (!cdpOk) {
     console.error(
-      `${TAG20} intent=${JSON.stringify(intent)} browser=fallback navigateResult=cdp-unreachable hostname=${JSON.stringify(hostname2)}`
+      `${TAG21} intent=${JSON.stringify(intent)} browser=fallback navigateResult=cdp-unreachable hostname=${JSON.stringify(hostname2)}`
     );
     return c.json(
       {
@@ -8574,7 +8607,7 @@ app18.post("/navigate", async (c) => {
   const browser = outcome.result === "ok" ? "vnc" : "fallback";
   const detailStr = outcome.detail ? ` detail=${JSON.stringify(outcome.detail.length > 230 ? outcome.detail.slice(0, 227) + "..." : outcome.detail)}` : "";
   console.error(
-    `${TAG20} intent=${JSON.stringify(intent)} browser=${browser} navigateResult=${outcome.result} hostname=${JSON.stringify(hostname2)} targetId=${outcome.targetId ?? "none"}${detailStr}`
+    `${TAG21} intent=${JSON.stringify(intent)} browser=${browser} navigateResult=${outcome.result} hostname=${JSON.stringify(hostname2)} targetId=${outcome.targetId ?? "none"}${detailStr}`
   );
   if (outcome.result !== "ok") {
     return c.json(
@@ -8605,18 +8638,18 @@ var ALLOWED_EVENTS2 = /* @__PURE__ */ new Set([
 ]);
 var app19 = new Hono();
 app19.post("/", async (c) => {
-  const TAG20 = "[admin:events]";
+  const TAG21 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG20} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG21} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS2.has(event)) {
-    console.error(`${TAG20} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG21} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -9782,7 +9815,7 @@ async function restoreNode(params) {
 }
 
 // app/lib/file-delete-cascade.ts
-var UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function parseAttachmentPath(relPath2) {
   const segments = relPath2.split("/").filter(Boolean);
   if (segments.length !== 4) return null;
@@ -9790,7 +9823,7 @@ function parseAttachmentPath(relPath2) {
   const accountId = segments[1];
   const attachmentId = segments[2];
   const filename = segments[3];
-  if (!UUID_RE3.test(accountId) || !UUID_RE3.test(attachmentId)) return null;
+  if (!UUID_RE2.test(accountId) || !UUID_RE2.test(attachmentId)) return null;
   const dot = filename.lastIndexOf(".");
   if (dot === -1) return null;
   const stem = filename.slice(0, dot);
@@ -9862,7 +9895,7 @@ async function cascadeDeleteDocument(params) {
 }
 
 // server/routes/admin/files.ts
-var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function readMeta(absDir, baseName) {
   try {
     const raw = await readFile4(join11(absDir, `${baseName}.meta.json`), "utf8");
@@ -9884,7 +9917,7 @@ async function readAccountNames() {
     return map;
   }
   for (const name of names) {
-    if (!UUID_RE4.test(name)) continue;
+    if (!UUID_RE3.test(name)) continue;
     const configPath2 = resolve16(accountsDir, name, "account.json");
     try {
       const raw = await readFile4(configPath2, "utf8");
@@ -9902,7 +9935,7 @@ async function readAccountNames() {
   return map;
 }
 async function enrich(absolute, entry, accountNames) {
-  if (entry.kind === "directory" && UUID_RE4.test(entry.name)) {
+  if (entry.kind === "directory" && UUID_RE3.test(entry.name)) {
     const meta = await readMeta(join11(absolute, entry.name), entry.name);
     if (meta?.filename) {
       entry.displayName = meta.filename;
@@ -9918,7 +9951,7 @@ async function enrich(absolute, entry, accountNames) {
   if (entry.kind === "file") {
     const dot = entry.name.lastIndexOf(".");
     const base = dot === -1 ? entry.name : entry.name.slice(0, dot);
-    if (UUID_RE4.test(base)) {
+    if (UUID_RE3.test(base)) {
       const meta = await readMeta(absolute, base);
       if (meta?.filename) {
         entry.displayName = meta.filename;
@@ -9930,7 +9963,7 @@ async function enrich(absolute, entry, accountNames) {
 function buildDisplayPath(relPath2, accountNames) {
   if (relPath2 === "." || relPath2 === "") return [];
   return relPath2.split("/").filter(Boolean).map((seg) => {
-    const dn = UUID_RE4.test(seg) ? accountNames.get(seg) : void 0;
+    const dn = UUID_RE3.test(seg) ? accountNames.get(seg) : void 0;
     return dn ? { name: seg, displayName: dn } : { name: seg };
   });
 }
@@ -9958,7 +9991,7 @@ app21.get("/", requireAdminSession, async (c) => {
     const names = await readdir2(absolute);
     const entries = [];
     for (const name of names) {
-      if (UUID_RE4.test(name.replace(/\.meta\.json$/, "")) && name.endsWith(".meta.json")) {
+      if (UUID_RE3.test(name.replace(/\.meta\.json$/, "")) && name.endsWith(".meta.json")) {
         continue;
       }
       try {
@@ -10135,7 +10168,7 @@ app21.delete("/", requireAdminSession, async (c) => {
     }
     const dot = base.lastIndexOf(".");
     const stem = dot === -1 ? base : base.slice(0, dot);
-    const sidecarPath = UUID_RE4.test(stem) && base !== `${stem}.meta.json` ? join11(dirname5(absolute), `${stem}.meta.json`) : null;
+    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join11(dirname5(absolute), `${stem}.meta.json`) : null;
     await unlink2(absolute);
     if (sidecarPath) {
       try {
@@ -12015,7 +12048,7 @@ import { mkdir as mkdir4, readdir as readdir4, stat as stat6, writeFile as write
 import { resolve as resolve18 } from "path";
 import { existsSync as existsSync17 } from "fs";
 var ADMIN_AGENT_FILES2 = /* @__PURE__ */ new Set(["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"]);
-var UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 var app30 = new Hono();
 app30.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
@@ -12079,7 +12112,7 @@ async function resolveSavePath(id, accountId, accountDir) {
     }
     return { kind: "admin-template", path: resolve18(parent, filename) };
   }
-  if (UUID_RE5.test(id)) {
+  if (UUID_RE4.test(id)) {
     const dir = resolve18(ATTACHMENTS_ROOT, accountId, id);
     if (!existsSync17(dir)) {
       const attShort = id.slice(0, 8);
@@ -12135,14 +12168,14 @@ var sidebar_artefact_save_default = app30;
 import { readFile as readFile6, readdir as readdir5 } from "fs/promises";
 import { existsSync as existsSync18 } from "fs";
 import { resolve as resolve19 } from "path";
-var UUID_RE6 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+var UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 var app31 = new Hono();
 app31.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) return new Response("Unauthorized", { status: 401 });
   const id = c.req.query("id") ?? "";
-  if (!UUID_RE6.test(id)) {
+  if (!UUID_RE5.test(id)) {
     console.error(`[admin/sidebar-artefact-content] not-found id=${id.slice(0, 8)}`);
     return new Response("Not found", { status: 404 });
   }
@@ -12253,13 +12286,13 @@ var app33 = new Hono();
 app33.route("/session", session_default);
 app33.route("/new-session-failure", new_session_failure_default);
 app33.route("/new-session-submit", new_session_submit_default);
-app33.route("/failure-report", failure_report_default);
 app33.route("/logs", logs_default);
 app33.route("/claude-info", claude_info_default);
 app33.route("/attachment", attachment_default);
 app33.route("/agents", agents_default);
 app33.route("/sessions", sessions_default);
 app33.route("/claude-sessions", claude_sessions_default);
+app33.route("/log-ingest", log_ingest_default);
 app33.route("/browser", browser_default);
 app33.route("/browser-iframe", browser_iframe_default);
 app33.route("/device-browser", device_browser_default);
@@ -12500,7 +12533,7 @@ function startGraphHealthTimer() {
 }
 
 // app/lib/whatsapp/inbound/claude-bridge.ts
-var TAG19 = "[whatsapp-adaptor]";
+var TAG20 = "[whatsapp-adaptor]";
 function whatsappTurnTimeoutMs() {
   return Number(process.env.WHATSAPP_PTY_TURN_TIMEOUT_MS ?? String(5 * 6e4));
 }
@@ -12521,7 +12554,7 @@ async function dispatchToClaude(input) {
     await input.reply(result.turnText);
   } catch (err) {
     const m = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG19} reject reason=reply-failed senderId=${input.senderId} message=${m}`);
+    console.error(`${TAG20} reject reason=reply-failed senderId=${input.senderId} message=${m}`);
   }
 }
 function startReaper2() {
@@ -13457,7 +13490,7 @@ if (brandFaviconPath !== "/favicon.ico") {
   });
 }
 app35.use("/*", serveStatic({ root: "./public" }));
-var port = parseInt(process.env.MAXY_UI_INTERNAL_PORT ?? process.env.PORT ?? "19199", 10);
+var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
 var httpServer = serve({ fetch: app35.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);