@rubytech/create-maxy-code 0.1.614 → 0.1.616

package/payload/server/server.js

@@ -3220,11 +3220,11 @@ var require_dist10 = __commonJS({
 });
 
 // server/index.ts
-import { readFileSync as readFileSync64, existsSync as existsSync63, watchFile, readdirSync as readdirSync38, statSync as statSync34 } from "fs";
+import { readFileSync as readFileSync65, existsSync as existsSync64, watchFile, readdirSync as readdirSync39, statSync as statSync35 } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { createHash as createHash8 } from "crypto";
-import { resolve as resolve55, join as join78, basename as basename19 } from "path";
-import { homedir as homedir5 } from "os";
+import { resolve as resolve56, join as join79, basename as basename20 } from "path";
+import { homedir as homedir6 } from "os";
 
 // server/lib/route-cache-watchers.ts
 import { watch } from "fs";
@@ -5660,20 +5660,20 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
 
 // server/routes/health.ts
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve56) => {
+  return new Promise((resolve57) => {
     const socket = createConnection2(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve56(true);
+      resolve57(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve56(false);
+      resolve57(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve56(false);
+      resolve57(false);
     });
   });
 }
@@ -6590,11 +6590,11 @@ function findExistingJsonlForSessionId(claudeConfigDir2, sessionId) {
   } catch {
     return null;
   }
-  const basename20 = `${sessionId}.jsonl`;
+  const basename21 = `${sessionId}.jsonl`;
   for (const slug of slugs) {
-    const live = join9(projectsRoot, slug, basename20);
+    const live = join9(projectsRoot, slug, basename21);
     if (existsSync4(live)) return live;
-    const archived = join9(projectsRoot, slug, "archive", basename20);
+    const archived = join9(projectsRoot, slug, "archive", basename21);
     if (existsSync4(archived)) return archived;
   }
   return null;
@@ -8082,7 +8082,7 @@ async function defaultResolve(accountId) {
   return resolveSocket2(accountId);
 }
 async function fetchAvatar(accountId, jid, deps = {}) {
-  const resolve56 = deps.resolve;
+  const resolve57 = deps.resolve;
   const httpGet = deps.httpGet ?? defaultHttpGet;
   const maxAgeMs = deps.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
   const cached3 = readAvatar(accountId, jid);
@@ -8092,7 +8092,7 @@ async function fetchAvatar(accountId, jid, deps = {}) {
     return "fresh";
   }
   console.log(`${TAG10} op=cache jid=${jid} hit=false ageMs=${ageMs2}`);
-  const res = resolve56 ? resolve56(accountId) : await defaultResolve(accountId);
+  const res = resolve57 ? resolve57(accountId) : await defaultResolve(accountId);
   if (!res.ok) {
     console.log(`${TAG10} op=no-socket jid=${jid} account=${accountId.slice(0, 8)} reason=${res.reason}`);
     return "no-socket";
@@ -9867,8 +9867,8 @@ async function startLogin(opts) {
   await clearAuth(authDir);
   let resolveCode = null;
   let rejectCode = null;
-  const codePromise = new Promise((resolve56, reject) => {
-    resolveCode = resolve56;
+  const codePromise = new Promise((resolve57, reject) => {
+    resolveCode = resolve57;
     rejectCode = reject;
   });
   const codeTimer = setTimeout(
@@ -23625,15 +23625,15 @@ function operatorRoleFor(config, userId) {
 async function buildAccountOptionList(accounts, userId) {
   const houseAccount = accounts.find((a) => a.config.role === "house");
   console.log(`[admin-accounts] op=list count=${accounts.length} house=${houseAccount?.accountId ?? "none"}`);
-  const resolve56 = async (a) => {
+  const resolve57 = async (a) => {
     const businessName = await fetchAccountName(a.accountId) || void 0;
     return { accountId: a.accountId, businessName, role: operatorRoleFor(a.config, userId), isHouse: a.config.role === "house" };
   };
   const houseOptions = await Promise.all(
-    accounts.filter((a) => a.config.role === "house").map(resolve56)
+    accounts.filter((a) => a.config.role === "house").map(resolve57)
   );
   const nonHouseOptions = await Promise.all(
-    accounts.filter((a) => a.config.role !== "house").map(resolve56)
+    accounts.filter((a) => a.config.role !== "house").map(resolve57)
   );
   const sortKey = (o) => (o.businessName || o.accountId).toLowerCase();
   nonHouseOptions.sort((x, y) => {
@@ -26562,18 +26562,18 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
 ]);
 var app27 = new Hono();
 app27.post("/", async (c) => {
-  const TAG83 = "[admin:events]";
+  const TAG84 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG83} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG84} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS.has(event)) {
-    console.error(`${TAG83} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG84} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -38163,12 +38163,174 @@ function startSharedFolderCensus() {
   });
 }
 
+// app/lib/browser-orphan-census.ts
+import { readFileSync as readFileSync59, readdirSync as readdirSync34, statSync as statSync31, existsSync as existsSync56 } from "fs";
+import { join as join69, basename as basename18, dirname as dirname18, resolve as resolve48 } from "path";
+import { homedir as homedir4 } from "os";
+var TAG70 = "[browser-census]";
+var BROWSER_BINARIES = /* @__PURE__ */ new Set([
+  "chrome",
+  "chromium",
+  "chromium-browser",
+  "google-chrome",
+  "google-chrome-stable"
+]);
+function readProcess(procRoot, pid) {
+  try {
+    const raw = readFileSync59(join69(procRoot, String(pid), "cmdline"), "utf8");
+    const argv = raw.split("\0").filter((a) => a.length > 0);
+    if (argv.length === 0) return null;
+    const stat11 = readFileSync59(join69(procRoot, String(pid), "stat"), "utf8");
+    const close = stat11.lastIndexOf(")");
+    if (close === -1) return null;
+    const after = stat11.slice(close + 1).trim().split(/\s+/);
+    const ppid = Number(after[1]);
+    if (!Number.isInteger(ppid)) return null;
+    return { pid, ppid, argv, comm: stat11.slice(stat11.indexOf("(") + 1, close) };
+  } catch {
+    return null;
+  }
+}
+function readProcSnapshot(procRoot) {
+  let entries2;
+  try {
+    entries2 = readdirSync34(procRoot, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const e of entries2) {
+    if (!e.isDirectory()) continue;
+    const pid = Number(e.name);
+    if (!Number.isInteger(pid) || pid <= 0) continue;
+    const p = readProcess(procRoot, pid);
+    if (p) out.push(p);
+  }
+  return out.sort((a, b) => a.pid - b.pid);
+}
+function userDataDir(argv) {
+  const FLAG = "--user-data-dir";
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i].startsWith(FLAG + "=")) return argv[i].slice(FLAG.length + 1);
+    if (argv[i] === FLAG && i + 1 < argv.length) return argv[i + 1];
+  }
+  return null;
+}
+function isTopLevelBrowser(argv) {
+  if (argv.length === 0) return false;
+  if (!BROWSER_BINARIES.has(basename18(argv[0]))) return false;
+  return !argv.some((a) => a.startsWith("--type="));
+}
+function isBrandProfile(dir, home) {
+  const path = resolve48(dir);
+  if (basename18(path) !== "chromium-profile") return false;
+  const parent = dirname18(path);
+  if (dirname18(parent) !== resolve48(home)) return false;
+  return basename18(parent).startsWith(".");
+}
+function isReparented(p, byPid) {
+  if (p.ppid === 1) return true;
+  const parent = byPid.get(p.ppid);
+  if (!parent) return true;
+  return parent.comm === "systemd" && parent.argv.includes("--user");
+}
+var PROFILE_PREFIXES = ["cdp-", "playwright"];
+function dirBytes(dir) {
+  let total = 0;
+  let entries2;
+  try {
+    entries2 = readdirSync34(dir, { withFileTypes: true });
+  } catch {
+    return total;
+  }
+  for (const e of entries2) {
+    const p = join69(dir, e.name);
+    if (e.isDirectory()) {
+      total += dirBytes(p);
+    } else if (e.isFile()) {
+      try {
+        total += statSync31(p).size;
+      } catch {
+      }
+    }
+  }
+  return total;
+}
+function scanProfileDirs(tmpRoot, nowMs) {
+  let entries2;
+  try {
+    entries2 = readdirSync34(tmpRoot, { withFileTypes: true });
+  } catch {
+    return { dirs: [], scanned: 0 };
+  }
+  const dirs = [];
+  for (const e of entries2) {
+    if (!e.isDirectory()) continue;
+    if (!PROFILE_PREFIXES.some((p) => e.name.startsWith(p))) continue;
+    const path = join69(tmpRoot, e.name);
+    let ageSec;
+    try {
+      ageSec = Math.max(0, Math.floor((nowMs - statSync31(path).birthtimeMs) / 1e3));
+    } catch {
+      continue;
+    }
+    dirs.push({ name: e.name, path, ageSec, bytes: dirBytes(path) });
+  }
+  return { dirs, scanned: entries2.length };
+}
+function runBrowserOrphanCensus(deps) {
+  const { procRoot, tmpRoot, home, nowMs } = deps;
+  if (!existsSync56(procRoot)) {
+    console.error(`${TAG70} op=browser-orphan-census unsupported=no-proc scanned=0`);
+    return "no /proc \u2014 process census unavailable on this platform";
+  }
+  const procs = readProcSnapshot(procRoot);
+  const byPid = new Map(procs.map((p) => [p.pid, p]));
+  const browsers = procs.filter((p) => isTopLevelBrowser(p.argv));
+  const foreign = browsers.filter((p) => {
+    const dir = userDataDir(p.argv);
+    return dir === null || !isBrandProfile(dir, home);
+  });
+  const reparented = foreign.filter((p) => isReparented(p, byPid));
+  const ownerByDir = /* @__PURE__ */ new Map();
+  for (const b of browsers) {
+    const dir = userDataDir(b.argv);
+    if (dir) ownerByDir.set(resolve48(dir), b);
+  }
+  const { dirs, scanned: tmpScanned } = scanProfileDirs(tmpRoot, nowMs);
+  const dirBytesTotal = dirs.reduce((s, d) => s + d.bytes, 0);
+  const oldestDirAgeSec = dirs.reduce((m, d) => Math.max(m, d.ageSec), 0);
+  console.error(
+    `${TAG70} op=browser-orphan-census scanned=${procs.length} chrome=${browsers.length} brandBound=${browsers.length - foreign.length} foreign=${foreign.length} reparented=${reparented.length} dirs=${dirs.length} dirBytes=${dirBytesTotal} oldestDirAgeSec=${oldestDirAgeSec} tmpScanned=${tmpScanned}`
+  );
+  for (const d of dirs) {
+    const owner = ownerByDir.get(resolve48(d.path));
+    console.error(
+      `${TAG70} op=browser-orphan-profile dir=${d.name} ageSec=${d.ageSec} bytes=${d.bytes} owner=${owner ? owner.pid : "none"} ppid=${owner ? owner.ppid : "-"} parent=${owner ? byPid.get(owner.ppid)?.comm ?? "-" : "-"} reparented=${owner ? isReparented(owner, byPid) : "-"}`
+    );
+  }
+  return `${foreign.length} foreign browser(s), ${dirs.length} profile dir(s), ${dirBytesTotal} bytes`;
+}
+function startBrowserOrphanCensus() {
+  registerLoop({
+    name: "browser-orphan-census",
+    intervalMs: 60 * 60 * 1e3,
+    firstRunDelayMs: 6e4,
+    run: () => runBrowserOrphanCensus({
+      procRoot: "/proc",
+      tmpRoot: "/tmp",
+      home: homedir4(),
+      nowMs: Date.now()
+    })
+  });
+}
+
 // app/lib/accounts-state-census.ts
-var TAG70 = "[accounts-state]";
+var TAG71 = "[accounts-state]";
 function runAccountsStateCensus(accountsDir, nowMs) {
   const { dirs, provisioning, abandoned } = censusAccountDirs(accountsDir, nowMs);
   console.error(
-    `${TAG70} op=stub-census dirs=${dirs} provisioning=${provisioning.length} abandoned=${abandoned.length} abandonedIds=${abandoned.length > 0 ? abandoned.join(",") : "none"}`
+    `${TAG71} op=stub-census dirs=${dirs} provisioning=${provisioning.length} abandoned=${abandoned.length} abandonedIds=${abandoned.length > 0 ? abandoned.join(",") : "none"}`
   );
   return `${dirs} account dir(s), ${abandoned.length} abandoned`;
 }
@@ -38182,10 +38344,10 @@ function startAccountsStateCensus() {
 }
 
 // app/lib/cred-refresh-census.ts
-import { readdirSync as readdirSync34, readFileSync as readFileSync59 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join69 } from "path";
-var TAG71 = "[claude-auth]";
+import { readdirSync as readdirSync35, readFileSync as readFileSync60 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join70 } from "path";
+var TAG72 = "[claude-auth]";
 function refreshTokenLength(raw) {
   let data;
   try {
@@ -38200,7 +38362,7 @@ function refreshTokenLength(raw) {
 function surveyBrandCredentials(home) {
   let entries2;
   try {
-    entries2 = readdirSync34(home);
+    entries2 = readdirSync35(home);
   } catch {
     return [];
   }
@@ -38209,7 +38371,7 @@ function surveyBrandCredentials(home) {
     if (!entry3.startsWith(".")) continue;
     let raw;
     try {
-      raw = readFileSync59(join69(home, entry3, ".claude", ".credentials.json"), "utf-8");
+      raw = readFileSync60(join70(home, entry3, ".claude", ".credentials.json"), "utf-8");
     } catch {
       continue;
     }
@@ -38224,12 +38386,12 @@ function censusResult(rows) {
   if (rows.length === 0) return "no-brands-found";
   return rows.some(isBlank) ? "blank-tokens" : "ok";
 }
-function runCredRefreshCensus(home = homedir4()) {
+function runCredRefreshCensus(home = homedir5()) {
   const rows = surveyBrandCredentials(home);
   const blank = rows.filter(isBlank).length;
   const detail = rows.map((r) => `${r.brand}:${r.refreshTokenLen === null ? "unreadable" : r.refreshTokenLen}`).join(",");
   console.log(
-    `${TAG71} op=cred-refresh-census result=${censusResult(rows)} brands=${rows.length} blank=${blank} detail=${detail}`
+    `${TAG72} op=cred-refresh-census result=${censusResult(rows)} brands=${rows.length} blank=${blank} detail=${detail}`
   );
   return `${rows.length} brand(s), ${blank} blank`;
 }
@@ -38244,7 +38406,7 @@ function startCredRefreshCensus() {
 
 // app/lib/file-watcher.ts
 import * as fsp2 from "fs/promises";
-import { resolve as resolve48, sep as sep12 } from "path";
+import { resolve as resolve49, sep as sep12 } from "path";
 var ACCOUNT_UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var DEFAULT_COALESCE_MS = 500;
 var ROOTS = ["accounts"];
@@ -38263,7 +38425,7 @@ async function startFileWatcher(opts = {}) {
   const dropFn = opts.drop ?? dropFileIndex;
   for (const r of ROOTS) {
     try {
-      await fsp2.mkdir(resolve48(dataRoot, r), { recursive: true });
+      await fsp2.mkdir(resolve49(dataRoot, r), { recursive: true });
     } catch (err) {
       console.error(
         `[file-watcher] start-failed root="${r}" err="${err.message}" \u2014 index will be maintained by the 5-min reconcile backstop only`
@@ -38284,7 +38446,7 @@ async function startFileWatcher(opts = {}) {
     timers.set(relativePath, t);
   }
   async function runHook(relativePath, accountId) {
-    const absolute = resolve48(dataRoot, relativePath);
+    const absolute = resolve49(dataRoot, relativePath);
     let exists = false;
     try {
       const st = await fsp2.stat(absolute);
@@ -38308,7 +38470,7 @@ async function startFileWatcher(opts = {}) {
     }
   }
   async function watchRoot(rootName) {
-    const absRoot = resolve48(dataRoot, rootName);
+    const absRoot = resolve49(dataRoot, rootName);
     try {
       const iter = fsp2.watch(absRoot, { recursive: true, signal: controller.signal });
       for await (const event of iter) {
@@ -38347,7 +38509,7 @@ async function startFileWatcher(opts = {}) {
 
 // app/lib/migrate-uploads.ts
 import { mkdir as mkdir4, readdir as readdir6, rename as rename4, rm as rm3 } from "fs/promises";
-import { dirname as dirname18, relative as relative8, resolve as resolve49 } from "path";
+import { dirname as dirname19, relative as relative8, resolve as resolve50 } from "path";
 var ACCOUNT_UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function walkFiles(dir) {
   const out = [];
@@ -38358,7 +38520,7 @@ async function walkFiles(dir) {
     return out;
   }
   for (const e of entries2) {
-    const abs = resolve49(dir, e.name);
+    const abs = resolve50(dir, e.name);
     if (e.isDirectory()) {
       out.push(...await walkFiles(abs));
     } else if (e.isFile()) {
@@ -38378,8 +38540,8 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
   let moved = 0;
   for (const oldAbs of files) {
     const suffix = relative8(srcDir, oldAbs);
-    const newAbs = resolve49(destDir, suffix);
-    await mkdir4(dirname18(newAbs), { recursive: true });
+    const newAbs = resolve50(destDir, suffix);
+    await mkdir4(dirname19(newAbs), { recursive: true });
     await rename4(oldAbs, newAbs);
     moved++;
     const oldRel = relative8(dataRoot, oldAbs);
@@ -38405,7 +38567,7 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
 }
 async function migrateUploads(opts = {}) {
   const dataRoot = opts.dataRoot ?? DATA_ROOT;
-  const oldRoot = resolve49(dataRoot, "uploads");
+  const oldRoot = resolve50(dataRoot, "uploads");
   let topEntries;
   try {
     topEntries = await readdir6(oldRoot, { withFileTypes: true });
@@ -38426,8 +38588,8 @@ async function migrateUploads(opts = {}) {
       const name = entry3.name;
       if (ACCOUNT_UUID_RE4.test(name)) {
         moved += await relocateTree(
-          resolve49(oldRoot, name),
-          resolve49(dataRoot, "accounts", name, "uploads"),
+          resolve50(oldRoot, name),
+          resolve50(dataRoot, "accounts", name, "uploads"),
           dataRoot,
           name,
           session
@@ -38439,8 +38601,8 @@ async function migrateUploads(opts = {}) {
           continue;
         }
         moved += await relocateTree(
-          resolve49(oldRoot, "public"),
-          resolve49(dataRoot, "accounts", installAccountId, "uploads", "public"),
+          resolve50(oldRoot, "public"),
+          resolve50(dataRoot, "accounts", installAccountId, "uploads", "public"),
           dataRoot,
           null,
           // public uploads carry no graph nodes
@@ -38470,8 +38632,8 @@ async function migrateUploads(opts = {}) {
 
 // app/lib/migrate-admin-webchat-sidecars.ts
 import { readdir as readdir7, readFile as readFile13, rename as rename5, writeFile as writeFile4, unlink as unlink4 } from "fs/promises";
-import { existsSync as existsSync56 } from "fs";
-import { join as join70 } from "path";
+import { existsSync as existsSync57 } from "fs";
+import { join as join71 } from "path";
 var ADMIN_ROLE2 = "admin";
 var WEBCHAT_CHANNEL2 = "webchat";
 var SESSION_META_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.meta\.json$/i;
@@ -38500,7 +38662,7 @@ async function writeRaw(path, obj) {
     await rename5(tmp, path);
   } catch (err) {
     try {
-      if (existsSync56(tmp)) await unlink4(tmp);
+      if (existsSync57(tmp)) await unlink4(tmp);
     } catch {
     }
     throw err;
@@ -38516,7 +38678,7 @@ async function collectLiveSidecars(projectsRoot) {
   }
   for (const slug of slugs) {
     if (!slug.isDirectory()) continue;
-    const slugDir = join70(projectsRoot, slug.name);
+    const slugDir = join71(projectsRoot, slug.name);
     let entries2;
     try {
       entries2 = await readdir7(slugDir, { withFileTypes: true });
@@ -38525,9 +38687,9 @@ async function collectLiveSidecars(projectsRoot) {
     }
     for (const entry3 of entries2) {
       if (entry3.isFile() && SESSION_META_RE.test(entry3.name)) {
-        out.push(join70(slugDir, entry3.name));
+        out.push(join71(slugDir, entry3.name));
       } else if (entry3.isDirectory() && entry3.name === "subagents") {
-        const subDir = join70(slugDir, entry3.name);
+        const subDir = join71(slugDir, entry3.name);
         let subs;
         try {
           subs = await readdir7(subDir, { withFileTypes: true });
@@ -38535,7 +38697,7 @@ async function collectLiveSidecars(projectsRoot) {
           continue;
         }
         for (const s of subs) {
-          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join70(subDir, s.name));
+          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join71(subDir, s.name));
         }
       }
     }
@@ -38547,7 +38709,7 @@ function shortId(path) {
   return base.slice(0, 8);
 }
 async function migrateAdminWebchatSidecars(opts = {}) {
-  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join70(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
+  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join71(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
   const usersFile = opts.usersFile ?? USERS_FILE;
   const accountId = opts.accountId ?? resolveAccount()?.accountId ?? null;
   const resolveName = opts.resolveName ?? defaultResolveName;
@@ -38623,8 +38785,8 @@ async function migrateAdminWebchatSidecars(opts = {}) {
 
 // app/lib/migrate-sidecar-account-ids.ts
 import { readdir as readdir8, readFile as readFile14, rename as rename6, writeFile as writeFile5, unlink as unlink5 } from "fs/promises";
-import { existsSync as existsSync57 } from "fs";
-import { join as join71 } from "path";
+import { existsSync as existsSync58 } from "fs";
+import { join as join72 } from "path";
 var SESSION_META_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.meta\.json$/i;
 function projectSlugForCwd(cwd) {
   return cwd.replace(/\//g, "-");
@@ -38650,7 +38812,7 @@ async function writeRaw2(path, obj) {
     await rename6(tmp, path);
   } catch (err) {
     try {
-      if (existsSync57(tmp)) await unlink5(tmp);
+      if (existsSync58(tmp)) await unlink5(tmp);
     } catch {
     }
     throw err;
@@ -38670,7 +38832,7 @@ async function collectSidecars(projectsRoot) {
   }
   for (const slug of slugs) {
     if (!slug.isDirectory()) continue;
-    const slugDir = join71(projectsRoot, slug.name);
+    const slugDir = join72(projectsRoot, slug.name);
     let entries2;
     try {
       entries2 = await readdir8(slugDir, { withFileTypes: true });
@@ -38679,9 +38841,9 @@ async function collectSidecars(projectsRoot) {
     }
     for (const entry3 of entries2) {
       if (entry3.isFile() && SESSION_META_RE2.test(entry3.name)) {
-        out.push({ path: join71(slugDir, entry3.name), slug: slug.name });
+        out.push({ path: join72(slugDir, entry3.name), slug: slug.name });
       } else if (entry3.isDirectory() && (entry3.name === "subagents" || entry3.name === "archive")) {
-        const subDir = join71(slugDir, entry3.name);
+        const subDir = join72(slugDir, entry3.name);
         let subs;
         try {
           subs = await readdir8(subDir, { withFileTypes: true });
@@ -38690,7 +38852,7 @@ async function collectSidecars(projectsRoot) {
         }
         for (const s of subs) {
           if (s.isFile() && SESSION_META_RE2.test(s.name)) {
-            out.push({ path: join71(subDir, s.name), slug: slug.name });
+            out.push({ path: join72(subDir, s.name), slug: slug.name });
           }
         }
       }
@@ -38699,7 +38861,7 @@ async function collectSidecars(projectsRoot) {
   return out;
 }
 async function migrateSidecarAccountIds(opts = {}) {
-  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join71(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
+  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join72(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
   const accounts = opts.accounts ?? listValidAccounts();
   const result = {
     scanned: 0,
@@ -40322,8 +40484,8 @@ function createWebchatChannelRoutes(deps) {
 }
 
 // app/lib/webchat/gateway/resolve-turn-answer.ts
-import { existsSync as existsSync58, openSync as openSync10, readSync as readSync9, closeSync as closeSync10, readdirSync as readdirSync35 } from "fs";
-import { join as join72 } from "path";
+import { existsSync as existsSync59, openSync as openSync10, readSync as readSync9, closeSync as closeSync10, readdirSync as readdirSync36 } from "fs";
+import { join as join73 } from "path";
 
 // app/lib/channel-delivery/outbound-guard.ts
 var INTERNAL_LEAK_PATTERNS = [
@@ -40384,16 +40546,16 @@ function resolveTurnAnswer(p) {
   return segmentText(guardOutbound(p.senderId, parts.join("\n\n"))).join("\n\n");
 }
 function findJsonl(projectsRoot, sessionId) {
-  if (!existsSync58(projectsRoot)) return null;
+  if (!existsSync59(projectsRoot)) return null;
   let slugs;
   try {
-    slugs = readdirSync35(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    slugs = readdirSync36(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
     return null;
   }
   for (const slug of slugs) {
-    const live = join72(projectsRoot, slug, `${sessionId}.jsonl`);
-    if (existsSync58(live)) return live;
+    const live = join73(projectsRoot, slug, `${sessionId}.jsonl`);
+    if (existsSync59(live)) return live;
   }
   return null;
 }
@@ -40460,16 +40622,16 @@ var WebchatGateway = class _WebchatGateway {
    *  The public /api/chat route awaits this to return the reply on the same SSE
    *  response, preserving the pre-756 POST→single-blob browser contract. */
   awaitReply(key2, timeoutMs) {
-    return new Promise((resolve56) => {
+    return new Promise((resolve57) => {
       const timer = setTimeout(() => {
         this.replyAwaiters.delete(key2);
-        resolve56({ timeout: true });
+        resolve57({ timeout: true });
       }, timeoutMs);
       if (timer.unref) timer.unref();
       this.replyAwaiters.set(key2, (r) => {
         clearTimeout(timer);
         this.replyAwaiters.delete(key2);
-        resolve56(r);
+        resolve57(r);
       });
     });
   }
@@ -40480,11 +40642,11 @@ var WebchatGateway = class _WebchatGateway {
    *  terminal dialog stays answerable). */
   awaitPermissionVerdict(p, timeoutMs) {
     const k = _WebchatGateway.promptKey(p.key, p.requestId);
-    return new Promise((resolve56) => {
+    return new Promise((resolve57) => {
       this.pendingPrompts.get(k)?.resolve({ timeout: true });
       const timer = setTimeout(() => {
         this.pendingPrompts.delete(k);
-        resolve56({ timeout: true });
+        resolve57({ timeout: true });
       }, timeoutMs);
       if (timer.unref) timer.unref();
       this.pendingPrompts.set(k, {
@@ -40494,7 +40656,7 @@ var WebchatGateway = class _WebchatGateway {
           clearTimeout(timer);
           this.pendingPrompts.delete(k);
           this.deps.onPointerChange?.(p.key);
-          resolve56(r);
+          resolve57(r);
         }
       });
       console.error(`[webchat:perm] op=open key=${keyDisplay(p.key)} id=${p.requestId} tool=${p.toolName}`);
@@ -41339,7 +41501,7 @@ function parityCensusLines() {
 
 // app/lib/webchat/file-delivery.ts
 import { realpathSync as realpathSync9 } from "fs";
-import { resolve as resolve50 } from "path";
+import { resolve as resolve51 } from "path";
 
 // app/lib/channel-pty-bridge/file-delivery.ts
 var SEND_USER_FILE = "SendUserFile";
@@ -41430,29 +41592,29 @@ function makeFileDelivery(opts) {
 }
 
 // app/lib/webchat/file-delivery.ts
-var TAG72 = "[webchat-adaptor]";
+var TAG73 = "[webchat-adaptor]";
 function platformRoot2() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
 function makeWebchatSendFile(entry3) {
   return async (filePath) => {
     if (!entry3.accountId) {
-      console.error(`${TAG72} file-delivery reject reason=no-account sender=${entry3.senderId}`);
+      console.error(`${TAG73} file-delivery reject reason=no-account sender=${entry3.senderId}`);
       return { ok: false, error: "no-account" };
     }
-    const accountDir = resolve50(platformRoot2(), "..", "data/accounts", entry3.accountId);
+    const accountDir = resolve51(platformRoot2(), "..", "data/accounts", entry3.accountId);
     try {
       const resolved = realpathSync9(filePath);
       const accountResolved = realpathSync9(accountDir);
       if (!resolved.startsWith(accountResolved + "/")) {
-        console.error(`${TAG72} file-delivery reject reason=outside_account_directory sender=${entry3.senderId}`);
+        console.error(`${TAG73} file-delivery reject reason=outside_account_directory sender=${entry3.senderId}`);
         return { ok: false, error: "outside-account" };
       }
       return { ok: true };
     } catch (err) {
       const code = err.code;
       console.error(
-        `${TAG72} file-delivery reject reason=${code === "ENOENT" ? "not-found" : "path-error"} sender=${entry3.senderId}`
+        `${TAG73} file-delivery reject reason=${code === "ENOENT" ? "not-found" : "path-error"} sender=${entry3.senderId}`
       );
       return { ok: false, error: code === "ENOENT" ? "not-found" : "path-error" };
     }
@@ -41461,7 +41623,7 @@ function makeWebchatSendFile(entry3) {
 function makeWebchatFileDelivery(entry3) {
   return makeFileDelivery({
     entry: entry3,
-    tag: TAG72,
+    tag: TAG73,
     channel: "webchat",
     sendFile: makeWebchatSendFile(entry3),
     deferUntilVerdict: true
@@ -41540,7 +41702,7 @@ function buildPublicWebchatSpawnRequest(input) {
 }
 
 // app/lib/whatsapp/inbound/file-delivery-bridge.ts
-var TAG73 = "[whatsapp-adaptor]";
+var TAG74 = "[whatsapp-adaptor]";
 var SEND_USER_FILE2 = "SendUserFile";
 var WHATSAPP_SEND_DOCUMENT = "whatsapp-send-document";
 function platformRoot3() {
@@ -41558,7 +41720,7 @@ function makeWhatsAppSendFile(entry3, maxyAccountId) {
     });
     if (result.ok) return { ok: true };
     console.error(
-      `${TAG73} file-delivery reject reason=send-failed sender=${entry3.senderId} status=${result.status} message=${result.error}`
+      `${TAG74} file-delivery reject reason=send-failed sender=${entry3.senderId} status=${result.status} message=${result.error}`
     );
     return { ok: false, error: result.error };
   };
@@ -41566,7 +41728,7 @@ function makeWhatsAppSendFile(entry3, maxyAccountId) {
 function makeWhatsAppFileDelivery(entry3, maxyAccountId) {
   const shared = makeFileDelivery({
     entry: entry3,
-    tag: TAG73,
+    tag: TAG74,
     channel: "whatsapp",
     sendFile: makeWhatsAppSendFile(entry3, maxyAccountId)
   });
@@ -41601,7 +41763,7 @@ function makeWhatsAppFileDelivery(entry3, maxyAccountId) {
         if (!delivered) {
           const fileField = call2.filePath !== void 0 ? ` file=${call2.filePath}` : "";
           console.error(
-            `${TAG73} file-delivery-unreconciled sender=${entry3.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
+            `${TAG74} file-delivery-unreconciled sender=${entry3.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
           );
         }
       }
@@ -41767,7 +41929,7 @@ function whatsappDoorLabel(doorId) {
 }
 
 // app/lib/channel-delivery/refusal-notice.ts
-var TAG74 = "[channel-delivery]";
+var TAG75 = "[channel-delivery]";
 var notified = /* @__PURE__ */ new Set();
 function refusalNoticeText(reason) {
   return reason === "claude-auth-dead" ? "Your message arrived but no assistant could be started: the Claude sign-in on this install is not active. An operator has to sign in again; send this again once they have." : `Your message arrived but no assistant could be started (${reason}). Nothing was lost; try again shortly.`;
@@ -41776,19 +41938,19 @@ async function sendRefusalNotice(input) {
   if (notified.has(input.doorId)) return;
   const fields2 = `channel=${input.channel} sender=${input.sender} reason=${input.reason}`;
   if (!input.send) {
-    console.error(`${TAG74} op=refusal-notice-failed ${fields2} error=no-target`);
+    console.error(`${TAG75} op=refusal-notice-failed ${fields2} error=no-target`);
     return;
   }
   try {
     await input.send(guardOutbound(input.sender, refusalNoticeText(input.reason)));
   } catch (e) {
     console.error(
-      `${TAG74} op=refusal-notice-failed ${fields2} error=${e instanceof Error ? e.message : String(e)}`
+      `${TAG75} op=refusal-notice-failed ${fields2} error=${e instanceof Error ? e.message : String(e)}`
     );
     return;
   }
   notified.add(input.doorId);
-  console.error(`${TAG74} op=refusal-notice ${fields2} status=${input.status}`);
+  console.error(`${TAG75} op=refusal-notice ${fields2} status=${input.status}`);
 }
 function clearRefusalNotice(doorId) {
   notified.delete(doorId);
@@ -42498,10 +42660,10 @@ function buildTelegramSpawnRequest(input) {
 }
 
 // server/telegram-ensure-session.ts
-var TAG75 = "[telegram-inbound]";
+var TAG76 = "[telegram-inbound]";
 function reportReused(botId, channelKey, result) {
   if (!result.reused) return;
-  console.error(`${TAG75} op=spawn-reused botId=${botId} key=${channelKey} sessionId=${result.sessionId}`);
+  console.error(`${TAG76} op=spawn-reused botId=${botId} key=${channelKey} sessionId=${result.sessionId}`);
 }
 function buildTelegramEnsureSession(deps) {
   return async (input) => {
@@ -42565,10 +42727,10 @@ function buildTelegramEnsureSession(deps) {
         return;
       }
       console.error(
-        `${TAG75} op=telegram-spawn-door botId=${input.botId} role=specialist door=rc specialist=${input.specialist}`
+        `${TAG76} op=telegram-spawn-door botId=${input.botId} role=specialist door=rc specialist=${input.specialist}`
       );
       console.error(
-        `${TAG75} op=spawn botId=${input.botId} sessionId=${req.sessionId} targetAccountId=${input.accountId} role=specialist specialist=${input.specialist}`
+        `${TAG76} op=spawn botId=${input.botId} sessionId=${req.sessionId} targetAccountId=${input.accountId} role=specialist specialist=${input.specialist}`
       );
       reportReused(input.botId, req.channelKey, result2);
       noteSpawnOk2(input.botId);
@@ -42603,10 +42765,10 @@ function buildTelegramEnsureSession(deps) {
         return;
       }
       console.error(
-        `${TAG75} op=telegram-spawn-door botId=${input.botId} role=public door=rc agent=${input.agentSlug}`
+        `${TAG76} op=telegram-spawn-door botId=${input.botId} role=public door=rc agent=${input.agentSlug}`
       );
       console.error(
-        `${TAG75} op=spawn botId=${input.botId} sessionId=${result2.sessionId} targetAccountId=${input.accountId} role=public`
+        `${TAG76} op=spawn botId=${input.botId} sessionId=${result2.sessionId} targetAccountId=${input.accountId} role=public`
       );
       reportReused(input.botId, req.channelKey, result2);
       noteSpawnOk2(input.botId);
@@ -42630,7 +42792,7 @@ function buildTelegramEnsureSession(deps) {
       return;
     }
     console.error(
-      `${TAG75} op=spawn botId=${input.botId} sessionId=${req.sessionId} targetAccountId=${input.accountId} role=admin`
+      `${TAG76} op=spawn botId=${input.botId} sessionId=${req.sessionId} targetAccountId=${input.accountId} role=admin`
     );
     reportReused(input.botId, req.channelKey, result);
     noteSpawnOk2(input.botId);
@@ -42648,8 +42810,8 @@ function buildTelegramEnsureSession(deps) {
 // app/lib/telegram/outbound/send-document.ts
 import { realpathSync as realpathSync10 } from "fs";
 import { readFile as readFile15, stat as stat10 } from "fs/promises";
-import { resolve as resolve51, basename as basename18 } from "path";
-var TAG76 = "[telegram:outbound]";
+import { resolve as resolve52, basename as basename19 } from "path";
+var TAG77 = "[telegram:outbound]";
 var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
 async function sendTelegramDocument(input) {
   const { botToken, chatId, filePath, caption, maxyAccountId, platformRoot: platformRoot5 } = input;
@@ -42659,17 +42821,17 @@ async function sendTelegramDocument(input) {
   if (!maxyAccountId || !platformRoot5) {
     return { ok: false, status: 400, error: "Cannot validate file path: missing account or platform context" };
   }
-  const accountDir = resolve51(platformRoot5, "..", "data/accounts", maxyAccountId);
+  const accountDir = resolve52(platformRoot5, "..", "data/accounts", maxyAccountId);
   let accountResolved;
   try {
     accountResolved = realpathSync10(accountDir);
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      console.error(`${TAG76} document ENOENT scope=account-dir accountDir=${accountDir} maxyAccountId=${maxyAccountId}`);
+      console.error(`${TAG77} document ENOENT scope=account-dir accountDir=${accountDir} maxyAccountId=${maxyAccountId}`);
       return { ok: false, status: 500, error: `Account directory not resolvable for ${maxyAccountId}` };
     }
-    console.error(`${TAG76} document path error scope=account-dir maxyAccountId=${maxyAccountId}: ${String(err)}`);
+    console.error(`${TAG77} document path error scope=account-dir maxyAccountId=${maxyAccountId}: ${String(err)}`);
     return { ok: false, status: 500, error: String(err) };
   }
   let resolvedPath;
@@ -42678,14 +42840,14 @@ async function sendTelegramDocument(input) {
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      console.error(`${TAG76} document ENOENT scope=file path=${filePath} maxyAccountId=${maxyAccountId}`);
+      console.error(`${TAG77} document ENOENT scope=file path=${filePath} maxyAccountId=${maxyAccountId}`);
       return { ok: false, status: 404, error: `File not found: ${filePath}` };
     }
-    console.error(`${TAG76} document path error scope=file maxyAccountId=${maxyAccountId}: ${String(err)}`);
+    console.error(`${TAG77} document path error scope=file maxyAccountId=${maxyAccountId}: ${String(err)}`);
     return { ok: false, status: 500, error: String(err) };
   }
   if (!resolvedPath.startsWith(accountResolved + "/")) {
-    console.error(`${TAG76} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
+    console.error(`${TAG77} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
     return { ok: false, status: 403, error: "Access denied: file is outside the account directory" };
   }
   const fileStat = await stat10(resolvedPath);
@@ -42696,7 +42858,7 @@ async function sendTelegramDocument(input) {
       error: `File exceeds 50 MB limit (${(fileStat.size / 1024 / 1024).toFixed(1)} MB)`
     };
   }
-  const filename = basename18(resolvedPath);
+  const filename = basename19(resolvedPath);
   const buffer = Buffer.from(await readFile15(resolvedPath));
   const form = new FormData();
   form.append("chat_id", String(chatId));
@@ -42718,24 +42880,24 @@ async function sendTelegramDocument(input) {
     error = e instanceof Error ? e.message : String(e);
   }
   console.error(
-    `${TAG76} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok2}` + (messageId !== void 0 ? ` id=${messageId}` : "")
+    `${TAG77} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok2}` + (messageId !== void 0 ? ` id=${messageId}` : "")
   );
   return ok2 ? { ok: true, messageId } : { ok: false, status: 500, error };
 }
 
 // app/lib/telegram/outbound/file-delivery.ts
-var TAG77 = "[telegram:outbound]";
+var TAG78 = "[telegram:outbound]";
 function platformRoot4() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
 function makeTelegramSendFile(entry3, botToken) {
   return async (filePath, caption) => {
     if (!botToken) {
-      console.error(`${TAG77} file-delivery reject reason=no-bot-token sender=${entry3.senderId} role=${entry3.role}`);
+      console.error(`${TAG78} file-delivery reject reason=no-bot-token sender=${entry3.senderId} role=${entry3.role}`);
       return { ok: false, error: "no-bot-token" };
     }
     if (entry3.replyTarget == null) {
-      console.error(`${TAG77} file-delivery reject reason=no-reply-target sender=${entry3.senderId} role=${entry3.role}`);
+      console.error(`${TAG78} file-delivery reject reason=no-reply-target sender=${entry3.senderId} role=${entry3.role}`);
       return { ok: false, error: "no-reply-target" };
     }
     const result = await sendTelegramDocument({
@@ -42752,7 +42914,7 @@ function makeTelegramSendFile(entry3, botToken) {
 function makeTelegramFileDelivery(entry3, botToken) {
   return makeFileDelivery({
     entry: entry3,
-    tag: TAG77,
+    tag: TAG78,
     channel: "telegram",
     sendFile: makeTelegramSendFile(entry3, botToken)
   });
@@ -42982,15 +43144,15 @@ function startTelegramNativeFileFollower(input) {
 }
 
 // server/telegram-background-active.ts
-import { join as join73, resolve as resolve52 } from "path";
-import { readdirSync as readdirSync36, statSync as statSync31 } from "fs";
+import { join as join74, resolve as resolve53 } from "path";
+import { readdirSync as readdirSync37, statSync as statSync32 } from "fs";
 var SUBAGENT_STALE_WINDOW_MS = 6e4;
 var AGENT_JSONL_RE2 = /^agent-([0-9a-f]+)\.jsonl$/;
 function makeBackgroundActive(sessionId, deps = {}) {
   const findProjectDir = deps.findProjectDir ?? findSessionProjectDir;
-  const readDir = deps.readDir ?? ((d) => readdirSync36(d));
+  const readDir = deps.readDir ?? ((d) => readdirSync37(d));
   const statFile = deps.statFile ?? ((p) => {
-    const st = statSync31(p);
+    const st = statSync32(p);
     return { size: st.size, mtimeMs: st.mtimeMs };
   });
   const now = deps.now ?? (() => Date.now());
@@ -43001,7 +43163,7 @@ function makeBackgroundActive(sessionId, deps = {}) {
     if (subagentsDir === null) {
       const projectDir = findProjectDir(sessionId);
       if (projectDir === null) return false;
-      subagentsDir = resolve52(join73(projectDir, sessionId, "subagents"));
+      subagentsDir = resolve53(join74(projectDir, sessionId, "subagents"));
     }
     let names;
     try {
@@ -43015,7 +43177,7 @@ function makeBackgroundActive(sessionId, deps = {}) {
       let size;
       let mtimeMs;
       try {
-        const st = statFile(join73(subagentsDir, name));
+        const st = statFile(join74(subagentsDir, name));
         size = st.size;
         mtimeMs = st.mtimeMs;
       } catch {
@@ -43095,7 +43257,7 @@ function adminFanTargets(p) {
 
 // app/lib/channel-pty-bridge/public-session-end-review.ts
 import { randomUUID as randomUUID15 } from "crypto";
-var TAG78 = "[public-session-review]";
+var TAG79 = "[public-session-review]";
 var CONSUMED_CAP = 500;
 var consumed = /* @__PURE__ */ new Set();
 function consumeOnce(sessionId) {
@@ -43122,7 +43284,7 @@ async function fetchJsonl(sessionId) {
     return await res.text();
   } catch (err) {
     console.error(
-      `${TAG78} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG79} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return null;
   }
@@ -43146,7 +43308,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     const res = await fetch(url);
     if (!res.ok) {
       console.error(
-        `${TAG78} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
+        `${TAG79} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
       );
       return [];
     }
@@ -43154,7 +43316,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     return Array.isArray(body.writes) ? body.writes : [];
   } catch (err) {
     console.error(
-      `${TAG78} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG79} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return [];
   }
@@ -43183,7 +43345,7 @@ function composeInitialMessage(input) {
 }
 async function dispatchReviewer(input, initialMessage) {
   const sessionId = randomUUID15();
-  console.log(`${TAG78} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
+  console.log(`${TAG79} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
   const spawned = await managerRcSpawn({
     sessionId,
     initialMessage,
@@ -43207,21 +43369,21 @@ async function firePublicSessionEndReview(input) {
   const dispatchedAt = Date.now();
   if (consumed.has(input.sessionId)) {
     console.log(
-      `${TAG78} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG79} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const jsonl = await fetchJsonl(input.sessionId);
   if (!jsonl) {
     console.log(
-      `${TAG78} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
+      `${TAG79} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
     );
     return;
   }
   const operatorTurns = countOperatorTurns(jsonl);
   if (operatorTurns === 0) {
     console.log(
-      `${TAG78} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
+      `${TAG79} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
     );
     return;
   }
@@ -43235,19 +43397,19 @@ async function firePublicSessionEndReview(input) {
   });
   if (!consumeOnce(input.sessionId)) {
     console.log(
-      `${TAG78} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG79} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const dispatched = await dispatchReviewer(input, initialMessage);
   if (!dispatched.ok) {
     console.error(
-      `${TAG78} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
+      `${TAG79} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
     );
     return;
   }
   console.log(
-    `${TAG78} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
+    `${TAG79} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
   );
 }
 
@@ -43381,8 +43543,8 @@ function runPublicAddressCollisionAudit(deps) {
 }
 
 // server/telegram-audit.ts
-import { statSync as statSync32 } from "fs";
-import { join as join74 } from "path";
+import { statSync as statSync33 } from "fs";
+import { join as join75 } from "path";
 function buildTelegramAuditLines(input) {
   const lines = [];
   const entries2 = input.accounts.flatMap(
@@ -43490,19 +43652,19 @@ function countTelegramSessionsForAccount(accountId) {
 function* walkTelegramSidecars() {
   const cfg = claudeConfigDir();
   if (!cfg) return;
-  const projectsRoot = join74(cfg, "projects");
+  const projectsRoot = join75(cfg, "projects");
   for (const { path } of enumerateSessionSidecars(projectsRoot)) {
     const meta = readSidecarMeta(path);
     if (meta.channel !== "telegram" || !meta.accountId) continue;
     let spawnMs;
     try {
-      spawnMs = statSync32(path).mtimeMs;
+      spawnMs = statSync33(path).mtimeMs;
     } catch {
       continue;
     }
     let turnMs;
     try {
-      turnMs = statSync32(path.replace(/\.meta\.json$/, ".jsonl")).mtimeMs;
+      turnMs = statSync33(path.replace(/\.meta\.json$/, ".jsonl")).mtimeMs;
     } catch {
       turnMs = null;
     }
@@ -43516,13 +43678,20 @@ function* walkTelegramSidecars() {
 }
 
 // server/telegram-group-census.ts
-var TAG79 = "[telegram-audit]";
+var TAG80 = "[telegram-audit]";
 var PRESENT_STATUSES = /* @__PURE__ */ new Set(["member", "administrator", "creator"]);
 function buildGroupCensusLine(c) {
-  return `${TAG79} op=group-census bots=${c.bots} groups=${c.groups} present=${c.present} absent=${c.absent} privacyOff=${c.privacyOff}`;
+  return `${TAG80} op=group-census bots=${c.bots} groups=${c.groups} present=${c.present} absent=${c.absent} privacyOff=${c.privacyOff} cannotJoin=${c.cannotJoin}`;
 }
 async function runTelegramGroupCensus(accounts, deps) {
-  const counts = { bots: 0, groups: 0, present: 0, absent: 0, privacyOff: 0 };
+  const counts = {
+    bots: 0,
+    groups: 0,
+    present: 0,
+    absent: 0,
+    privacyOff: 0,
+    cannotJoin: 0
+  };
   for (const account of accounts) {
     for (const entry3 of listBotEntries(account.telegram)) {
       if (entry3.role !== "public") continue;
@@ -43531,6 +43700,7 @@ async function runTelegramGroupCensus(accounts, deps) {
       try {
         const me = await deps.getMe(entry3.token);
         if (me.can_read_all_group_messages === true) counts.privacyOff += 1;
+        if (me.can_join_groups === false) counts.cannotJoin += 1;
       } catch {
       }
       for (const chatId of entry3.allowGroups ?? []) {
@@ -43550,10 +43720,10 @@ async function runTelegramGroupCensus(accounts, deps) {
 }
 
 // server/telegram-channel-census.ts
-var TAG80 = "[telegram-audit]";
+var TAG81 = "[telegram-audit]";
 var ADMIN_STATUSES = /* @__PURE__ */ new Set(["administrator", "creator"]);
 function buildChannelCensusLine(c) {
-  return `${TAG80} op=channel-census bots=${c.bots} channels=${c.channels} admin=${c.admin} notAdmin=${c.notAdmin} noPostRight=${c.noPostRight}`;
+  return `${TAG81} op=channel-census bots=${c.bots} channels=${c.channels} admin=${c.admin} notAdmin=${c.notAdmin} noPostRight=${c.noPostRight}`;
 }
 async function runTelegramChannelCensus(accounts, deps) {
   const counts = { bots: 0, channels: 0, admin: 0, notAdmin: 0, noPostRight: 0 };
@@ -43585,7 +43755,7 @@ async function runTelegramChannelCensus(accounts, deps) {
 }
 
 // server/telegram-graph-duplicate-census.ts
-var TAG81 = "[telegram-audit]";
+var TAG82 = "[telegram-audit]";
 var DUPLICATE_QUERY = `
   MATCH (m:Message)
   WHERE m.accountId = $accountId AND m.channel = 'telegram'
@@ -43612,12 +43782,12 @@ async function runTelegramGraphDuplicateCensus(accountIds, deps) {
       const sessions4 = asSessions(Array.isArray(row.sessions) ? row.sessions : []);
       const named = sessions4.length > 0 ? ` ids=${sessions4.join(",")}` : "";
       lines.push(
-        `${TAG81} op=graph-duplicate accountId=${accountId} messages=${messages} sessions=${sessions4.length}${named}`
+        `${TAG82} op=graph-duplicate accountId=${accountId} messages=${messages} sessions=${sessions4.length}${named}`
       );
     } catch (err) {
       const reason = err instanceof Error ? err.message : String(err);
       lines.push(
-        `${TAG81} FAIL op=graph-duplicate accountId=${accountId} reason=${reason.slice(0, 100)}`
+        `${TAG82} FAIL op=graph-duplicate accountId=${accountId} reason=${reason.slice(0, 100)}`
       );
     }
   }
@@ -43625,9 +43795,9 @@ async function runTelegramGraphDuplicateCensus(accountIds, deps) {
 }
 
 // server/telegram-identity-census.ts
-var TAG82 = "[telegram-audit]";
+var TAG83 = "[telegram-audit]";
 function buildIdentityCensusLine(c) {
-  return `${TAG82} op=identity-census bots=${c.bots} ids=${c.ids} bound=${c.bound} unbound=${c.unbound} ambiguous=${c.ambiguous}`;
+  return `${TAG83} op=identity-census bots=${c.bots} ids=${c.ids} bound=${c.bound} unbound=${c.unbound} ambiguous=${c.ambiguous}`;
 }
 async function runTelegramIdentityCensus(accounts, deps) {
   const counts = { bots: 0, ids: 0, bound: 0, unbound: 0, ambiguous: 0 };
@@ -43702,8 +43872,8 @@ function businessConnectionCensusLine(c) {
 }
 
 // app/lib/telegram/business-window-census.ts
-import { readdirSync as readdirSync37, existsSync as existsSync59 } from "fs";
-import { join as join75 } from "path";
+import { readdirSync as readdirSync38, existsSync as existsSync60 } from "fs";
+import { join as join76 } from "path";
 var BUSINESS_WINDOW_CENSUS_TAG = "[telegram-audit]";
 var EXPIRING_SOON_S = 3600;
 function collectBusinessWindowCensus(input) {
@@ -43731,11 +43901,11 @@ function businessWindowCensusLine(c) {
 function readBusinessChatClocks(accountIds) {
   const out = [];
   for (const accountId of accountIds) {
-    const dir = join75(STORE_ROOT2(), accountId);
-    if (!existsSync59(dir)) continue;
+    const dir = join76(STORE_ROOT2(), accountId);
+    if (!existsSync60(dir)) continue;
     let names;
     try {
-      names = readdirSync37(dir);
+      names = readdirSync38(dir);
     } catch {
       continue;
     }
@@ -43793,15 +43963,15 @@ async function getTelegramBusinessConnection(botToken, connectionId, opts = {})
 }
 
 // server/telegram-migrate.ts
-import { readFileSync as readFileSync60, writeFileSync as writeFileSync23, existsSync as existsSync60, renameSync as renameSync11, mkdirSync as mkdirSync14 } from "fs";
-import { dirname as dirname19, join as join76 } from "path";
+import { readFileSync as readFileSync61, writeFileSync as writeFileSync23, existsSync as existsSync61, renameSync as renameSync11, mkdirSync as mkdirSync14 } from "fs";
+import { dirname as dirname20, join as join77 } from "path";
 function migrateTelegramTwoSlot(input) {
   const out = [];
   for (const account of input.accounts) {
-    const configPath3 = join76(account.accountDir, "account.json");
+    const configPath3 = join77(account.accountDir, "account.json");
     let config;
     try {
-      config = JSON.parse(readFileSync60(configPath3, "utf-8"));
+      config = JSON.parse(readFileSync61(configPath3, "utf-8"));
     } catch {
       console.error(`[telegram-audit] op=migrate-unreadable accountId=${account.accountId}`);
       continue;
@@ -43854,22 +44024,22 @@ function migrateTelegramTwoSlot(input) {
   return out;
 }
 function moveSecret(from, to) {
-  if (!existsSync60(from)) return;
-  mkdirSync14(dirname19(to), { recursive: true, mode: 448 });
+  if (!existsSync61(from)) return;
+  mkdirSync14(dirname20(to), { recursive: true, mode: 448 });
   renameSync11(from, to);
 }
 
 // server/telegram-unadopt.ts
-import { readFileSync as readFileSync61, writeFileSync as writeFileSync24, renameSync as renameSync12 } from "fs";
-import { join as join77 } from "path";
+import { readFileSync as readFileSync62, writeFileSync as writeFileSync24, renameSync as renameSync12 } from "fs";
+import { join as join78 } from "path";
 var FILE3 = "channel-session-override.json";
 function unadoptTelegramPointers(input) {
   return input.accounts.map(({ accountId, accountDir }) => {
     const out = { accountId, dropped: [], kept: 0, unknown: 0 };
-    const path = join77(accountDir, FILE3);
+    const path = join78(accountDir, FILE3);
     const bySender = {};
     try {
-      const raw = JSON.parse(readFileSync61(path, "utf8"));
+      const raw = JSON.parse(readFileSync62(path, "utf8"));
       if (!raw.bySender || typeof raw.bySender !== "object") return out;
       for (const [k, v] of Object.entries(raw.bySender)) if (typeof v === "string") bySender[k] = v;
     } catch {
@@ -43940,14 +44110,14 @@ function backfillMisfiledRecords(params) {
 }
 
 // server/lib/booking-site-accounts.ts
-import { existsSync as existsSync61, readFileSync as readFileSync62 } from "fs";
-import { resolve as resolve53 } from "path";
+import { existsSync as existsSync62, readFileSync as readFileSync63 } from "fs";
+import { resolve as resolve54 } from "path";
 function listBookingSiteAccounts(accounts) {
   return accounts.filter((a) => {
-    const availPath = resolve53(a.accountDir, "calendar-availability.json");
-    if (!existsSync61(availPath)) return false;
+    const availPath = resolve54(a.accountDir, "calendar-availability.json");
+    if (!existsSync62(availPath)) return false;
     try {
-      const cfg = JSON.parse(readFileSync62(availPath, "utf-8"));
+      const cfg = JSON.parse(readFileSync63(availPath, "utf-8"));
       return typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
     } catch {
       return false;
@@ -43985,8 +44155,8 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash7, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync62, readFileSync as readFileSync63, statSync as statSync33 } from "fs";
-import { resolve as resolve54 } from "path";
+import { existsSync as existsSync63, readFileSync as readFileSync64, statSync as statSync34 } from "fs";
+import { resolve as resolve55 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
 function canonicalize(value) {
@@ -44021,7 +44191,7 @@ var PUBKEY_SHA256 = "8eee6bcb33545fd13b16d3199a5735ca5db5062834c7b49dfe4f23801d9
 var GRACE_DAYS = 7;
 var GRACE_MS = GRACE_DAYS * 24 * 60 * 60 * 1e3;
 function pubkeyPath(brand) {
-  return resolve54(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
+  return resolve55(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
 }
 var memo = null;
 function memoKey(mtimeMs, account) {
@@ -44033,11 +44203,11 @@ function resolveEntitlement(brand, account) {
   if (brand.commercialMode !== true) {
     return logResolved(implicitTrust(account), null);
   }
-  const entitlementPath = resolve54(brand.configDir, "entitlement.json");
-  if (!existsSync62(entitlementPath)) {
+  const entitlementPath = resolve55(brand.configDir, "entitlement.json");
+  if (!existsSync63(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
-  const stat11 = statSync33(entitlementPath);
+  const stat11 = statSync34(entitlementPath);
   const key2 = memoKey(stat11.mtimeMs, account);
   if (memo && memo.key === key2) {
     return memo.result;
@@ -44049,7 +44219,7 @@ function resolveEntitlement(brand, account) {
 function verifyAndResolve(brand, entitlementPath, account) {
   let pubkeyPem;
   try {
-    pubkeyPem = readFileSync63(pubkeyPath(brand), "utf-8");
+    pubkeyPem = readFileSync64(pubkeyPath(brand), "utf-8");
   } catch (err) {
     return logResolved(anonymousFallback("pubkey-missing"), {
       reason: "pubkey-missing"
@@ -44063,7 +44233,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(readFileSync63(entitlementPath, "utf-8"));
+    envelope = JSON.parse(readFileSync64(entitlementPath, "utf-8"));
   } catch {
     return logResolved(anonymousFallback("malformed"), { reason: "malformed" });
   }
@@ -44225,14 +44395,14 @@ function clientFrom(c) {
 }
 installMediaDownloadGuard();
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT6 ? join78(PLATFORM_ROOT6, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT6 ? join79(PLATFORM_ROOT6, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync63(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync64(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync63(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync64(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync64(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync65(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -44264,11 +44434,11 @@ var brandLoginOpts = {
   appleTouchIconPath: brandAppIcon512Path,
   themeColor: BRAND.defaultColors?.primary
 };
-var ALIAS_DOMAINS_PATH = join78(homedir5(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join79(homedir6(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync63(ALIAS_DOMAINS_PATH)) return null;
-    const parsed = JSON.parse(readFileSync64(ALIAS_DOMAINS_PATH, "utf-8"));
+    if (!existsSync64(ALIAS_DOMAINS_PATH)) return null;
+    const parsed = JSON.parse(readFileSync65(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -44410,7 +44580,7 @@ var waGateway = new WaGateway({
   // resolver and `fanTargetsFor` is a constructor dep, not a callable method.
   fanTargetsFor: whatsappFanTargets,
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve55(process.env.MAXY_PLATFORM_ROOT ?? join78(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve56(process.env.MAXY_PLATFORM_ROOT ?? join79(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 / 1390 — file delivery on the native channel. `maxyAccountId` (the
   // path-validation scope) is the sender's effective SESSION account, resolved
   // once at the inbound gate and threaded here via the gateway's per-sender doc
@@ -44425,7 +44595,7 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve55(process.env.MAXY_PLATFORM_ROOT ?? join78(__dirname, ".."))
+      platformRoot: resolve56(process.env.MAXY_PLATFORM_ROOT ?? join79(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
@@ -44600,7 +44770,7 @@ function runDuplicateSenderAudit() {
   try {
     const configDir = process.env.CLAUDE_CONFIG_DIR;
     if (!configDir) return;
-    const projectsRoot = join78(configDir, "projects");
+    const projectsRoot = join79(configDir, "projects");
     const records5 = [];
     for (const { path: jsonlPath, isSubagent, archived } of enumerateJsonls(projectsRoot)) {
       if (isSubagent || archived) continue;
@@ -44652,7 +44822,7 @@ var webchatGateway = new WebchatGateway({
   // rather than hanging the POST.
   publicProjectsRoot: () => {
     const cfg = claudeConfigDir();
-    return cfg ? join78(cfg, "projects") : "";
+    return cfg ? join79(cfg, "projects") : "";
   },
   gatewayUrl: webchatGatewayUrl(),
   serverPath: webchatServerPath(),
@@ -45339,20 +45509,20 @@ app80.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve55(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve55(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve56(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve56(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync63(filePath)) {
+  if (!existsSync64(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync64(filePath);
+  const body = readFileSync65(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
@@ -45369,20 +45539,20 @@ app80.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve55(account.accountDir, "generated", filename);
-  const expectedDir = resolve55(account.accountDir, "generated");
+  const filePath = resolve56(account.accountDir, "generated", filename);
+  const expectedDir = resolve56(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync63(filePath)) {
+  if (!existsSync64(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync64(filePath);
+  const body = readFileSync65(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
@@ -45395,9 +45565,9 @@ app80.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync63(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync64(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync64(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync65(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -45424,11 +45594,11 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 var brandThemeColor = BRAND.defaultColors?.primary ?? "#000000";
 var brandBackgroundColor = BRAND.defaultColors?.background ?? "#ffffff";
 var brandAppIconsExist = [brandAppIcon192Path, brandAppIcon512Path, brandMaskableIconPath].every(
-  (p) => existsSync63(resolve55(process.cwd(), "public", p.replace(/^\//, "")))
+  (p) => existsSync64(resolve56(process.cwd(), "public", p.replace(/^\//, "")))
 );
 var SW_SOURCE = (() => {
   try {
-    return readFileSync64(resolve55(process.cwd(), "public", "sw.js"), "utf-8");
+    return readFileSync65(resolve56(process.cwd(), "public", "sw.js"), "utf-8");
   } catch {
     return null;
   }
@@ -45436,9 +45606,9 @@ var SW_SOURCE = (() => {
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT6) return "unknown";
-    const versionFile = join78(PLATFORM_ROOT6, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync63(versionFile)) return "unknown";
-    const content = readFileSync64(versionFile, "utf-8").trim();
+    const versionFile = join79(PLATFORM_ROOT6, "config", `.${BRAND.hostname}-version`);
+    if (!existsSync64(versionFile)) return "unknown";
+    const content = readFileSync65(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -45449,7 +45619,7 @@ var versionScript = `<script>window.__MAXY_VERSION__=${JSON.stringify(INSTALLED_
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync64(resolve55(process.cwd(), "public", file), "utf-8");
+    html = readFileSync65(resolve56(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -45466,14 +45636,14 @@ ${clientErrorReporterScript}
   return html;
 }
 function loadBrandingCache(agentSlug) {
-  const configDir = join78(homedir5(), BRAND.configDir);
+  const configDir = join79(homedir6(), BRAND.configDir);
   try {
     const verdict = resolvePublicAddressFromDisk(agentSlug);
     const accountId = verdict.kind === "served" ? verdict.owner.accountId : getDefaultAccountId();
     if (!accountId) return null;
-    const cachePath = join78(configDir, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync63(cachePath)) return null;
-    return JSON.parse(readFileSync64(cachePath, "utf-8"));
+    const cachePath = join79(configDir, "branding-cache", accountId, `${agentSlug}.json`);
+    if (!existsSync64(cachePath)) return null;
+    return JSON.parse(readFileSync65(cachePath, "utf-8"));
   } catch {
     return null;
   }
@@ -45568,7 +45738,7 @@ app80.use("/vnc-popout.html", logViewerFetch);
 app80.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync64(resolve55(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync65(resolve56(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -45722,10 +45892,10 @@ var hostname = process.env.HOSTNAME ?? "127.0.0.1";
 var httpServer = serve({ fetch: app80.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
-  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join78(__dirname, "..");
-  const reconcileScript = resolve55(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
+  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join79(__dirname, "..");
+  const reconcileScript = resolve56(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
   const runReconcile = (ctx) => {
-    if (!existsSync63(reconcileScript)) return;
+    if (!existsSync64(reconcileScript)) return;
     try {
       const child = spawn3(process.execPath, [reconcileScript], {
         env: { ...process.env, PLATFORM_ROOT: reconcilePlatformRoot },
@@ -45745,7 +45915,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     detached: true,
     run: runReconcile
   });
-  const reconcileStatePath = join78(MAXY_DIR, "booking-reconcile-state.json");
+  const reconcileStatePath = join79(MAXY_DIR, "booking-reconcile-state.json");
   registerLoop({
     name: "calendar-reconcile-liveness",
     intervalMs: 6e5,
@@ -45763,15 +45933,15 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const DREAM_CYCLE_SWEEP_INTERVAL_MS = 36e5;
-  const dreamPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join78(__dirname, "..");
-  const dreamSweepScript = resolve55(dreamPlatformRoot, "plugins/memory/mcp/dist/scripts/dream-cycle-sweep.js");
+  const dreamPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join79(__dirname, "..");
+  const dreamSweepScript = resolve56(dreamPlatformRoot, "plugins/memory/mcp/dist/scripts/dream-cycle-sweep.js");
   registerLoop({
     name: "dream-cycle-sweep",
     intervalMs: DREAM_CYCLE_SWEEP_INTERVAL_MS,
     firstRunDelayMs: 3e4,
     detached: true,
     run: (ctx) => {
-      if (!existsSync63(dreamSweepScript)) return;
+      if (!existsSync64(dreamSweepScript)) return;
       try {
         const child = spawn3(process.execPath, [dreamSweepScript], {
           env: { ...process.env, PLATFORM_ROOT: dreamPlatformRoot },
@@ -45787,11 +45957,11 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join78(__dirname, "..");
-  const outlookScript = resolve55(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
+  const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join79(__dirname, "..");
+  const outlookScript = resolve56(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
   const OUTLOOK_COMPLETE_INTERVAL_MS = 3e4;
   const runOutlookComplete = (ctx) => {
-    if (!existsSync63(outlookScript)) return;
+    if (!existsSync64(outlookScript)) return;
     try {
       const child = spawn3(process.execPath, [outlookScript], {
         env: { ...process.env, PLATFORM_ROOT: outlookPlatformRoot },
@@ -45813,20 +45983,20 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join78(__dirname, "..");
-  const strandedAccountsDir = resolve55(auditRoot, "..", "data/accounts");
+  const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join79(__dirname, "..");
+  const strandedAccountsDir = resolve56(auditRoot, "..", "data/accounts");
   const STRANDED_AUDIT_INTERVAL_MS = 3e5;
   const STRANDED_AGE_MS = 16 * 6e4;
   const STRANDED_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
   const runStrandedAudit = () => {
     try {
-      if (!existsSync63(strandedAccountsDir)) return;
+      if (!existsSync64(strandedAccountsDir)) return;
       const now = Date.now();
-      for (const name of readdirSync38(strandedAccountsDir)) {
+      for (const name of readdirSync39(strandedAccountsDir)) {
         if (!STRANDED_UUID_RE.test(name)) continue;
-        const pendingPath2 = resolve55(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
-        if (!existsSync63(pendingPath2)) continue;
-        const ageMs2 = now - statSync34(pendingPath2).mtimeMs;
+        const pendingPath2 = resolve56(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
+        if (!existsSync64(pendingPath2)) continue;
+        const ageMs2 = now - statSync35(pendingPath2).mtimeMs;
         if (ageMs2 > STRANDED_AGE_MS) {
           console.error(`[outlook-mcp] devicecode-stranded account=${name} ageSec=${Math.floor(ageMs2 / 1e3)}`);
         }
@@ -45843,8 +46013,8 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const googleRoot = process.env.MAXY_PLATFORM_ROOT ?? join78(__dirname, "..");
-  const googleAccountsDir = resolve55(googleRoot, "..", "data/accounts");
+  const googleRoot = process.env.MAXY_PLATFORM_ROOT ?? join79(__dirname, "..");
+  const googleAccountsDir = resolve56(googleRoot, "..", "data/accounts");
   const GOOGLE_PENDING_AUDIT_INTERVAL_MS = 3e5;
   const runGooglePendingAuditSafe = () => {
     try {
@@ -45859,10 +46029,10 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     firstRunDelayMs: 27e3,
     run: runGooglePendingAuditSafe
   });
-  const googleAuditScript = resolve55(googleRoot, "plugins/google/mcp/dist/scripts/account-audit.js");
+  const googleAuditScript = resolve56(googleRoot, "plugins/google/mcp/dist/scripts/account-audit.js");
   const GOOGLE_ACCOUNT_AUDIT_INTERVAL_MS = 36e5;
   const runGoogleAccountAudit = (ctx) => {
-    if (!existsSync63(googleAuditScript)) return;
+    if (!existsSync64(googleAuditScript)) return;
     try {
       const child = spawn3(process.execPath, [googleAuditScript], {
         env: { ...process.env, PLATFORM_ROOT: googleRoot },
@@ -45899,7 +46069,7 @@ registerLoop({
   }
 });
 {
-  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join78(__dirname, "..");
+  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join79(__dirname, "..");
   const STORAGE_AUDIT_INTERVAL_MS = 3e5;
   const runStorageAuditSafe = () => runStorageAudit(auditPlatformRoot).catch((err) => {
     console.error(`[storage-audit] error="${err.message}"`);
@@ -45934,8 +46104,8 @@ registerLoop({
   for (const o of migrateTelegramTwoSlot({
     accounts: listValidAccounts().map((a) => ({ accountId: a.accountId, accountDir: a.accountDir })),
     secretPathFor: secretPath,
-    legacySecretPathFor: (botType, accountId) => resolve55(
-      homedir5(),
+    legacySecretPathFor: (botType, accountId) => resolve56(
+      homedir6(),
       configDirName(),
       `${botType === "admin" ? ".telegram-admin-webhook-secret" : ".telegram-webhook-secret"}.${accountId}`
     ),
@@ -45966,15 +46136,15 @@ registerLoop({
     const lastByBot = newestTelegramSessionByBot();
     let secretFilesOnDisk = [];
     try {
-      secretFilesOnDisk = readdirSync38(telegramSecretsDir());
+      secretFilesOnDisk = readdirSync39(telegramSecretsDir());
     } catch {
     }
     const lines = buildTelegramAuditLines({
       accounts,
-      secretFileExists: (botId) => existsSync63(secretPath(botId)),
+      secretFileExists: (botId) => existsSync64(secretPath(botId)),
       agentActive: isActiveAgentSlug,
       // Task 2619 — the card set a specialist binding is reconciled against.
-      specialistCards: (accountDir) => listSpecialistCardNames(join78(accountDir, "specialists", "agents")),
+      specialistCards: (accountDir) => listSpecialistCardNames(join79(accountDir, "specialists", "agents")),
       // Task 2619 — the doors that can be sent to right now. The same accessor
       // the follower census reads (:1185), so "should have a reader" and "can be
       // sent to" stay one fact.
@@ -46383,8 +46553,8 @@ registerLoop({
   });
 }
 {
-  const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join78(__dirname, "..");
-  const publishScript = resolve55(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
+  const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join79(__dirname, "..");
+  const publishScript = resolve56(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
   const PUBLISH_INTERVAL_MS = 3e5;
   const bookingAccounts = () => {
     try {
@@ -46395,7 +46565,7 @@ registerLoop({
     }
   };
   const spawnPublish = (account, ctx) => {
-    if (!existsSync63(publishScript)) return;
+    if (!existsSync64(publishScript)) return;
     try {
       const child = spawn3(process.execPath, [publishScript], {
         env: {
@@ -46414,21 +46584,21 @@ registerLoop({
     }
   };
   const auditSnapshotAge = (account) => {
-    const availPath = resolve55(account.accountDir, "calendar-availability.json");
+    const availPath = resolve56(account.accountDir, "calendar-availability.json");
     let hasBookingSite = false;
     try {
-      if (existsSync63(availPath)) {
-        const cfg = JSON.parse(readFileSync64(availPath, "utf-8"));
+      if (existsSync64(availPath)) {
+        const cfg = JSON.parse(readFileSync65(availPath, "utf-8"));
         hasBookingSite = typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
       }
     } catch {
     }
     if (!hasBookingSite) return;
-    const statePath = resolve55(account.accountDir, "state", "booking-availability", "last-publish.json");
+    const statePath = resolve56(account.accountDir, "state", "booking-availability", "last-publish.json");
     let lastSuccessAt = null;
-    if (existsSync63(statePath)) {
+    if (existsSync64(statePath)) {
       try {
-        const rec = JSON.parse(readFileSync64(statePath, "utf-8"));
+        const rec = JSON.parse(readFileSync65(statePath, "utf-8"));
         lastSuccessAt = rec.lastSuccessAt ?? null;
       } catch {
         console.error(`[calendar-availability] op=audit accountId=${account.accountId} snapshotAgeMs=na reason=bad-state-file`);
@@ -46463,12 +46633,12 @@ startDispatchCensus(() => getSession());
 startDispatchFieldCensus(() => getSession());
 startDispatchTgCensus(() => getSession());
 {
-  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join78(__dirname, "..");
-  const auditScript = resolve55(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
+  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join79(__dirname, "..");
+  const auditScript = resolve56(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
   const auditLogDir = process.env.LOG_DIR ?? LOG_DIR;
   const CONNECTOR_AUDIT_INTERVAL_MS = 3e5;
   const runConnectorAudit = (ctx) => {
-    if (!existsSync63(auditScript)) return;
+    if (!existsSync64(auditScript)) return;
     try {
       const child = spawn3(process.execPath, [auditScript], {
         env: { ...process.env, PLATFORM_ROOT: auditPlatformRoot, LOG_DIR: auditLogDir },
@@ -46590,11 +46760,11 @@ try {
 var ADMINUSER_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 async function runAdminUserReconcileTick() {
   try {
-    if (!existsSync63(USERS_FILE)) {
+    if (!existsSync64(USERS_FILE)) {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
-    const usersRaw = readFileSync64(USERS_FILE, "utf-8").trim();
+    const usersRaw = readFileSync65(USERS_FILE, "utf-8").trim();
     if (!usersRaw) {
       console.error("[adminuser-self-heal] skip reason=empty-users-file");
       return;
@@ -46676,8 +46846,8 @@ var runIngestAuditTick = () => {
       },
       agentExists: (accountId, slug) => {
         if (!house) return false;
-        const dir = isHouseAccountKey(house.accountId, accountId) ? house.accountDir : join78(ACCOUNTS_DIR, accountId);
-        return existsSync63(join78(dir, "agents", slug, "config.json"));
+        const dir = isHouseAccountKey(house.accountId, accountId) ? house.accountDir : join79(ACCOUNTS_DIR, accountId);
+        return existsSync64(join79(dir, "agents", slug, "config.json"));
       }
     });
   } catch (err) {
@@ -46725,9 +46895,9 @@ registerLoop({
       runPublicAddressCollisionAudit({
         houseAccountId: () => resolveAccount()?.accountId ?? null,
         activeSlugs: () => listValidAccounts().map((a) => {
-          const agentsRoot = join78(a.accountDir, "agents");
-          if (!existsSync63(agentsRoot)) return { accountId: a.accountId, slugs: [] };
-          const slugs = readdirSync38(agentsRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).filter((slug) => isActiveAgentSlug(a.accountDir, slug));
+          const agentsRoot = join79(a.accountDir, "agents");
+          if (!existsSync64(agentsRoot)) return { accountId: a.accountId, slugs: [] };
+          const slugs = readdirSync39(agentsRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).filter((slug) => isActiveAgentSlug(a.accountDir, slug));
           return { accountId: a.accountId, slugs };
         })
       });
@@ -46740,8 +46910,8 @@ registerLoop({
 });
 var USERS_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 function countUsersRows() {
-  if (!existsSync63(USERS_FILE)) return 0;
-  const raw = readFileSync64(USERS_FILE, "utf-8").trim();
+  if (!existsSync64(USERS_FILE)) return 0;
+  const raw = readFileSync65(USERS_FILE, "utf-8").trim();
   if (!raw) return 0;
   const users = JSON.parse(raw);
   return users.filter((u) => typeof u.userId === "string").length;
@@ -46772,6 +46942,7 @@ registerLoop({
 });
 startGraphHealthTimer();
 startSharedFolderCensus();
+startBrowserOrphanCensus();
 startAccountsStateCensus();
 startCredRefreshCensus();
 void migrateUploads().catch((err) => console.error(`[uploads-migrate] failed err="${err instanceof Error ? err.message : String(err)}"`)).finally(() => {
@@ -46844,16 +47015,16 @@ function sessionChannelResolver() {
       byId = /* @__PURE__ */ new Map();
       const cfg = claudeConfigDir();
       if (cfg) {
-        for (const { path } of enumerateSessionSidecars(join78(cfg, "projects"))) {
+        for (const { path } of enumerateSessionSidecars(join79(cfg, "projects"))) {
           const channel = readSidecarMeta(path).channel;
-          if (channel) byId.set(basename19(path).replace(/\.meta\.json$/, ""), channel);
+          if (channel) byId.set(basename20(path).replace(/\.meta\.json$/, ""), channel);
         }
       }
     }
     return byId.get(sessionId) ?? null;
   };
 }
-var configDirForWhatsApp = basename19(MAXY_DIR) || ".maxy";
+var configDirForWhatsApp = basename20(MAXY_DIR) || ".maxy";
 var bootAccount = resolveAccount();
 if (bootAccount) {
   migrateRemovedConfigKeys(bootAccount.accountDir);
@@ -46919,7 +47090,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve55(process.env.MAXY_PLATFORM_ROOT ?? join78(__dirname, "..")),
+  platformRoot: resolve56(process.env.MAXY_PLATFORM_ROOT ?? join79(__dirname, "..")),
   accountConfig: bootAccountConfig,
   // Task 2074 — enrich with the sub-account name and fan out to every open
   // admin SSE stream. Fire-and-forget: the manager's persist path must not