@rubytech/create-maxy-code 0.1.88 → 0.1.91

package/payload/server/server.js

@@ -344,8 +344,11 @@ var require_dist = __commonJS({
           try {
             await onEmpty(c);
           } catch (err) {
-            process.stderr.write(`[trash:empty-run] onEmpty side-effect failed for elementId=${c.elementId}: ${err instanceof Error ? err.message : String(err)}
+            const id8 = c.elementId.slice(0, 8);
+            const message = err instanceof Error ? err.message : String(err);
+            process.stderr.write(`[trash:empty-run] reason=onEmpty-failed elementId=${id8} labels=${c.labels.join(",")} message=${message}
 `);
+            continue;
           }
         }
         await session.run(`MATCH (n) WHERE elementId(n) = $eid DETACH DELETE n`, { eid: c.elementId });
@@ -598,6 +601,7 @@ var serveStatic = (options = { root: "" }) => {
 import { readFileSync as readFileSync20, existsSync as existsSync22, watchFile } from "fs";
 import { resolve as resolve23, join as join13, basename as basename5 } from "path";
 import { homedir as homedir4 } from "os";
+import { monitorEventLoopDelay } from "perf_hooks";
 
 // app/lib/agent-slug-pattern.ts
 var AGENT_SLUG_PATTERN = /^\/([a-z][a-z0-9-]{2,49})$/;
@@ -7191,29 +7195,22 @@ import crypto from "crypto";
 import { resolve as resolvePath } from "path";
 import { existsSync as existsSync13, mkdirSync as mkdirSync3, createWriteStream } from "fs";
 
-// app/lib/admin-conversation-cascade.ts
-async function cascadeAdminConversationDelete(args) {
-  const started = Date.now();
+// ../lib/admin-conversation-purge/src/index.ts
+async function purgeAdminConversationJsonls(args) {
   const fetchImpl = args.fetchImpl ?? fetch;
   const log = args.logger ?? ((line) => console.log(line));
   const id8 = args.conversationId.slice(0, 8);
-  let claudeSessionIds;
-  try {
-    claudeSessionIds = args.claudeSessionIds ?? await getConversationClaudeSessionIds(args.conversationId, args.accountId);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    log(`[admin-conversation-delete] conversationId=${id8} reason=graph-delete-failed claudeSessionIds-purged= message=transcript-resolve:${message}`);
-    return { ok: false, reason: "graph-delete-failed", claudeSessionIdsPurged: [], message };
-  }
   const purged = [];
-  for (const sessionId of claudeSessionIds) {
+  for (const sessionId of args.claudeSessionIds) {
     const url = `${args.managerBase}/${encodeURIComponent(sessionId)}`;
     let res;
     try {
       res = await fetchImpl(url, { method: "DELETE" });
     } catch (err) {
       const message2 = err instanceof Error ? err.message : String(err);
-      log(`[admin-conversation-delete] conversationId=${id8} reason=jsonl-purge-failed claudeSessionId=${sessionId.slice(0, 8)} message=${message2}`);
+      log(
+        `[admin-conversation-delete] conversationId=${id8} reason=jsonl-purge-failed claudeSessionId=${sessionId.slice(0, 8)} message=${message2}`
+      );
       return {
         ok: false,
         reason: "jsonl-purge-failed",
@@ -7228,8 +7225,15 @@ async function cascadeAdminConversationDelete(args) {
       continue;
     }
     if (res.status === 409) {
-      log(`[admin-conversation-delete] conversationId=${id8} reason=pty-still-alive claudeSessionId=${sessionId.slice(0, 8)}`);
-      return { ok: false, reason: "pty-still-alive", claudeSessionId: sessionId };
+      log(
+        `[admin-conversation-delete] conversationId=${id8} reason=pty-still-alive claudeSessionId=${sessionId.slice(0, 8)}`
+      );
+      return {
+        ok: false,
+        reason: "pty-still-alive",
+        claudeSessionId: sessionId,
+        claudeSessionIdsPurged: purged
+      };
     }
     let message = `manager returned ${res.status}`;
     try {
@@ -7238,7 +7242,9 @@ async function cascadeAdminConversationDelete(args) {
       else if (typeof body.error === "string") message = body.error;
     } catch {
     }
-    log(`[admin-conversation-delete] conversationId=${id8} reason=jsonl-purge-failed claudeSessionId=${sessionId.slice(0, 8)} message=${message}`);
+    log(
+      `[admin-conversation-delete] conversationId=${id8} reason=jsonl-purge-failed claudeSessionId=${sessionId.slice(0, 8)} message=${message}`
+    );
     return {
       ok: false,
       reason: "jsonl-purge-failed",
@@ -7248,6 +7254,45 @@ async function cascadeAdminConversationDelete(args) {
       message
     };
   }
+  return { ok: true, claudeSessionIdsPurged: purged };
+}
+
+// app/lib/admin-conversation-cascade.ts
+async function cascadeAdminConversationDelete(args) {
+  const started = Date.now();
+  const fetchImpl = args.fetchImpl ?? fetch;
+  const log = args.logger ?? ((line) => console.log(line));
+  const id8 = args.conversationId.slice(0, 8);
+  let claudeSessionIds;
+  try {
+    claudeSessionIds = args.claudeSessionIds ?? await getConversationClaudeSessionIds(args.conversationId, args.accountId);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    log(`[admin-conversation-delete] conversationId=${id8} reason=graph-delete-failed claudeSessionIds-purged= message=transcript-resolve:${message}`);
+    return { ok: false, reason: "graph-delete-failed", claudeSessionIdsPurged: [], message };
+  }
+  const purgeOutcome = await purgeAdminConversationJsonls({
+    conversationId: args.conversationId,
+    accountId: args.accountId,
+    managerBase: args.managerBase,
+    claudeSessionIds,
+    fetchImpl,
+    logger: log
+  });
+  if (!purgeOutcome.ok) {
+    if (purgeOutcome.reason === "pty-still-alive") {
+      return { ok: false, reason: "pty-still-alive", claudeSessionId: purgeOutcome.claudeSessionId };
+    }
+    return {
+      ok: false,
+      reason: "jsonl-purge-failed",
+      claudeSessionId: purgeOutcome.claudeSessionId,
+      claudeSessionIdsPurged: purgeOutcome.claudeSessionIdsPurged,
+      status: purgeOutcome.status,
+      message: purgeOutcome.message
+    };
+  }
+  const purged = purgeOutcome.claudeSessionIdsPurged;
   let found;
   try {
     ({ found } = await deleteConversation(args.conversationId));
@@ -8695,13 +8740,13 @@ async function cdpNavigateNewTab(url, opts = {}) {
 // server/routes/admin/device-browser.ts
 var app18 = new Hono();
 app18.post("/navigate", async (c) => {
-  const TAG21 = "[device-url:click]";
+  const TAG22 = "[device-url:click]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG21} reject reason=body-not-json detail=${detail} browser=fallback navigateResult=error`);
+    console.error(`${TAG22} reject reason=body-not-json detail=${detail} browser=fallback navigateResult=error`);
     return c.json(
       { ok: false, navigateResult: "error", browser: "fallback", detail: "Request body was not valid JSON" },
       400
@@ -8711,7 +8756,7 @@ app18.post("/navigate", async (c) => {
   const intent = typeof body.intent === "string" ? body.intent : "";
   const hostname2 = typeof body.hostname === "string" ? body.hostname : "";
   if (!url) {
-    console.error(`${TAG21} reject reason=missing-url intent=${JSON.stringify(intent)} browser=fallback navigateResult=error`);
+    console.error(`${TAG22} reject reason=missing-url intent=${JSON.stringify(intent)} browser=fallback navigateResult=error`);
     return c.json(
       { ok: false, navigateResult: "error", browser: "fallback", detail: "url field is required" },
       400
@@ -8721,7 +8766,7 @@ app18.post("/navigate", async (c) => {
   try {
     parsed = new URL(url);
   } catch {
-    console.error(`${TAG21} reject reason=url-malformed intent=${JSON.stringify(intent)} url=${url} browser=fallback navigateResult=error`);
+    console.error(`${TAG22} reject reason=url-malformed intent=${JSON.stringify(intent)} url=${url} browser=fallback navigateResult=error`);
     return c.json(
       { ok: false, navigateResult: "error", browser: "fallback", detail: "url is not a valid URL" },
       400
@@ -8729,7 +8774,7 @@ app18.post("/navigate", async (c) => {
   }
   if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
     console.error(
-      `${TAG21} reject reason=scheme-not-allowed scheme=${parsed.protocol} intent=${JSON.stringify(intent)} browser=fallback navigateResult=error`
+      `${TAG22} reject reason=scheme-not-allowed scheme=${parsed.protocol} intent=${JSON.stringify(intent)} browser=fallback navigateResult=error`
     );
     return c.json(
       {
@@ -8745,7 +8790,7 @@ app18.post("/navigate", async (c) => {
   const cdpOk = await ensureCdp(transport);
   if (!cdpOk) {
     console.error(
-      `${TAG21} intent=${JSON.stringify(intent)} browser=fallback navigateResult=cdp-unreachable hostname=${JSON.stringify(hostname2)}`
+      `${TAG22} intent=${JSON.stringify(intent)} browser=fallback navigateResult=cdp-unreachable hostname=${JSON.stringify(hostname2)}`
     );
     return c.json(
       {
@@ -8761,7 +8806,7 @@ app18.post("/navigate", async (c) => {
   const browser = outcome.result === "ok" ? "vnc" : "fallback";
   const detailStr = outcome.detail ? ` detail=${JSON.stringify(outcome.detail.length > 230 ? outcome.detail.slice(0, 227) + "..." : outcome.detail)}` : "";
   console.error(
-    `${TAG21} intent=${JSON.stringify(intent)} browser=${browser} navigateResult=${outcome.result} hostname=${JSON.stringify(hostname2)} targetId=${outcome.targetId ?? "none"}${detailStr}`
+    `${TAG22} intent=${JSON.stringify(intent)} browser=${browser} navigateResult=${outcome.result} hostname=${JSON.stringify(hostname2)} targetId=${outcome.targetId ?? "none"}${detailStr}`
   );
   if (outcome.result !== "ok") {
     return c.json(
@@ -8792,18 +8837,18 @@ var ALLOWED_EVENTS2 = /* @__PURE__ */ new Set([
 ]);
 var app19 = new Hono();
 app19.post("/", async (c) => {
-  const TAG21 = "[admin:events]";
+  const TAG22 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG21} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG22} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS2.has(event)) {
-    console.error(`${TAG21} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG22} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -11633,7 +11678,7 @@ function pruneNode(node, warnedClasses, conversationWarnings) {
 var graph_subgraph_default = app23;
 
 // server/routes/admin/graph-delete.ts
-var ALLOWED_BY = ["graph-page", "graph-drag-trash"];
+var ALLOWED_BY = ["graph-page", "graph-drag-trash", "graph-side-panel-trash"];
 var app24 = new Hono();
 app24.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
@@ -11663,17 +11708,108 @@ app24.post("/", requireAdminSession, async (c) => {
     const lookup = await session.run(
       `MATCH (n)
        WHERE elementId(n) = $elementId AND n.accountId = $accountId
-       RETURN labels(n) AS labels LIMIT 1`,
+       RETURN labels(n) AS labels, n.conversationId AS conversationId LIMIT 1`,
       { elementId, accountId }
     );
     if (lookup.records.length === 0) {
       const elapsed2 = Date.now() - started;
       console.error(
-        `[graph-page] delete account=${accountId} elementId=${elementId} by=${by} labels= result=not-found ms=${elapsed2}`
+        `[graph-page] delete account=${accountId} elementId=${elementId} by=${by} labels= route=trash result=not-found ms=${elapsed2}`
       );
       return c.json({ error: "Node not found" }, 404);
     }
     const preflightLabels = lookup.records[0].get("labels") ?? [];
+    const conversationId = lookup.records[0].get("conversationId");
+    if (preflightLabels.includes("AdminConversation")) {
+      if (!conversationId) {
+        const elapsed3 = Date.now() - started;
+        console.error(
+          `[graph-page] delete account=${accountId} elementId=${elementId} by=${by} labels=${preflightLabels.join(",")} route=cascade result=error ms=${elapsed3} err="AdminConversation node has no conversationId"`
+        );
+        return c.json({ error: "AdminConversation node is missing conversationId" }, 500);
+      }
+      const managerPort = requirePortEnv("CLAUDE_SESSION_MANAGER_PORT", { tag: "graph-page-cascade" });
+      const managerBase3 = `http://127.0.0.1:${managerPort}`;
+      try {
+        await session.close();
+      } catch {
+      }
+      const outcome = await cascadeAdminConversationDelete({
+        conversationId,
+        accountId,
+        managerBase: managerBase3
+      });
+      const elapsed2 = Date.now() - started;
+      const labelSummary2 = preflightLabels.join(",");
+      if (outcome.ok) {
+        console.error(
+          `[graph-page] delete account=${accountId} elementId=${elementId} by=${by} labels=${labelSummary2} route=cascade result=ok ms=${elapsed2}`
+        );
+        const response2 = {
+          route: "cascade",
+          elementId,
+          conversationId,
+          labels: preflightLabels,
+          claudeSessionIds: outcome.claudeSessionIds
+        };
+        return c.json(response2);
+      }
+      if (outcome.reason === "pty-still-alive") {
+        console.error(
+          `[graph-page] delete account=${accountId} elementId=${elementId} by=${by} labels=${labelSummary2} route=cascade result=pty-still-alive claudeSessionId=${outcome.claudeSessionId.slice(0, 8)} ms=${elapsed2}`
+        );
+        return c.json(
+          {
+            error: "pty-still-alive",
+            detail: "stop the session before deleting",
+            claudeSessionId: outcome.claudeSessionId,
+            conversationId
+          },
+          409
+        );
+      }
+      if (outcome.reason === "conversation-not-found") {
+        console.error(
+          `[graph-page] delete account=${accountId} elementId=${elementId} by=${by} labels=${labelSummary2} route=cascade result=ok-already-gone ms=${elapsed2}`
+        );
+        const response2 = {
+          route: "cascade",
+          elementId,
+          conversationId,
+          labels: preflightLabels,
+          claudeSessionIds: []
+        };
+        return c.json(response2);
+      }
+      if (outcome.reason === "jsonl-purge-failed") {
+        console.error(
+          `[graph-page] delete account=${accountId} elementId=${elementId} by=${by} labels=${labelSummary2} route=cascade result=jsonl-purge-failed claudeSessionId=${outcome.claudeSessionId.slice(0, 8)} ms=${elapsed2} err="${outcome.message}"`
+        );
+        const status = outcome.status >= 400 && outcome.status < 600 ? outcome.status : 502;
+        return c.json(
+          {
+            error: "jsonl-purge-failed",
+            detail: outcome.message,
+            claudeSessionId: outcome.claudeSessionId,
+            conversationId,
+            claudeSessionIdsPurged: outcome.claudeSessionIdsPurged
+          },
+          status
+        );
+      }
+      console.error(
+        `[graph-page] delete account=${accountId} elementId=${elementId} by=${by} labels=${labelSummary2} route=cascade result=graph-delete-failed ms=${elapsed2} err="${outcome.message}"`
+      );
+      return c.json(
+        {
+          error: "graph-delete-failed",
+          detail: outcome.message,
+          conversationId,
+          claudeSessionIdsPurged: outcome.claudeSessionIdsPurged
+        },
+        500
+      );
+    }
     const result = await trashNode({
       session,
       accountId,
@@ -11683,9 +11819,10 @@ app24.post("/", requireAdminSession, async (c) => {
     const elapsed = Date.now() - started;
     const labelSummary = (result.labels.length > 0 ? result.labels : preflightLabels).join(",");
     console.error(
-      `[graph-page] delete account=${accountId} elementId=${elementId} by=${by} labels=${labelSummary} result=ok ms=${elapsed}`
+      `[graph-page] delete account=${accountId} elementId=${elementId} by=${by} labels=${labelSummary} route=trash result=ok ms=${elapsed}`
     );
     const response = {
+      route: "trash",
       elementId: result.nodeId,
       labels: result.labels.length > 0 ? result.labels : preflightLabels,
       trashedAt: result.trashedAt,
@@ -11977,9 +12114,137 @@ var WRITE_CYPHER = `
 `;
 var graph_default_view_default = app27;
 
-// server/routes/admin/file-attach.ts
+// server/routes/admin/session-defaults.ts
 var app28 = new Hono();
-app28.post("/", async (c) => {
+var MODE_OPTIONS = ["default", "acceptEdits", "plan", "auto", "bypassPermissions"];
+var MODEL_OPTIONS = ["claude-opus-4-7", "claude-sonnet-4-6", "claude-haiku-4-5"];
+app28.get("/", requireAdminSession, async (c) => {
+  const cacheKey = c.var.cacheKey;
+  const accountId = getAccountIdForSession(cacheKey);
+  const userId = getUserIdForSession(cacheKey);
+  if (!accountId || !userId) {
+    console.error('[session-defaults] rejected op=load reason="missing account or user context"');
+    return c.json({ error: "Account and user context required for session defaults" }, 401);
+  }
+  const started = Date.now();
+  const session = getSession();
+  try {
+    const result = await session.executeRead(async (tx) => {
+      return await tx.run(READ_CYPHER2, { accountId, userId });
+    });
+    const record = result.records[0];
+    const rawMode = record?.get("permissionMode");
+    const rawModel = record?.get("model");
+    const permissionMode = MODE_OPTIONS.includes(rawMode ?? "") ? rawMode : "default";
+    const model = MODEL_OPTIONS.includes(rawModel ?? "") ? rawModel : null;
+    const elapsed = Date.now() - started;
+    console.error(
+      `[session-defaults] load account=${accountId} user=${userId} permissionMode=${permissionMode} model=${model ?? "null"} ms=${elapsed}`
+    );
+    return c.json({ permissionMode, model });
+  } catch (err) {
+    const elapsed = Date.now() - started;
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(
+      `[session-defaults] rejected op=load account=${accountId} reason="${message}" ms=${elapsed}`
+    );
+    return c.json({ error: `Session defaults unavailable: ${message}` }, 503);
+  } finally {
+    try {
+      await session.close();
+    } catch {
+    }
+  }
+});
+app28.put("/", requireAdminSession, async (c) => {
+  const cacheKey = c.var.cacheKey;
+  const accountId = getAccountIdForSession(cacheKey);
+  const userId = getUserIdForSession(cacheKey);
+  if (!accountId || !userId) {
+    console.error('[session-defaults] rejected op=save reason="missing account or user context"');
+    return c.json({ error: "Account and user context required for session defaults" }, 401);
+  }
+  const body = await safeJson(c);
+  if (!body) {
+    return c.json({ error: "Request body must be JSON" }, 400);
+  }
+  const validation = validateBody3(body);
+  if (!validation.ok) {
+    console.error(
+      `[session-defaults] rejected op=save account=${accountId} reason="${validation.reason}"`
+    );
+    return c.json({ error: validation.reason }, 400);
+  }
+  const { permissionMode, model } = validation;
+  const started = Date.now();
+  const session = getSession();
+  try {
+    await session.executeWrite(async (tx) => {
+      return await tx.run(WRITE_CYPHER2, {
+        accountId,
+        userId,
+        permissionMode,
+        model,
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    });
+    const elapsed = Date.now() - started;
+    console.error(
+      `[session-defaults] save account=${accountId} user=${userId} permissionMode=${permissionMode} model=${model ?? "null"} ms=${elapsed}`
+    );
+    return c.json({ permissionMode, model });
+  } catch (err) {
+    const elapsed = Date.now() - started;
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(
+      `[session-defaults] rejected op=save account=${accountId} reason="${message}" ms=${elapsed}`
+    );
+    return c.json({ error: `Failed to save session defaults: ${message}` }, 503);
+  } finally {
+    try {
+      await session.close();
+    } catch {
+    }
+  }
+});
+function validateBody3(body) {
+  if (typeof body.permissionMode !== "string") {
+    return { ok: false, reason: "permissionMode must be a string" };
+  }
+  if (!MODE_OPTIONS.includes(body.permissionMode)) {
+    return { ok: false, reason: `permissionMode "${body.permissionMode}" is not one of ${MODE_OPTIONS.join(", ")}` };
+  }
+  if (!("model" in body)) {
+    return { ok: false, reason: "model is required (use null for no override)" };
+  }
+  if (body.model !== null && typeof body.model !== "string") {
+    return { ok: false, reason: "model must be a string or null" };
+  }
+  if (body.model !== null && !MODEL_OPTIONS.includes(body.model)) {
+    return { ok: false, reason: `model "${body.model}" is not one of ${MODEL_OPTIONS.join(", ")} (or null)` };
+  }
+  return {
+    ok: true,
+    permissionMode: body.permissionMode,
+    model: body.model
+  };
+}
+var READ_CYPHER2 = `
+  OPTIONAL MATCH (p:SpawnPreference {accountId: $accountId, userId: $userId})
+  RETURN p.permissionMode AS permissionMode, p.model AS model
+`;
+var WRITE_CYPHER2 = `
+  MERGE (p:SpawnPreference {accountId: $accountId, userId: $userId})
+  SET p.permissionMode = $permissionMode,
+      p.model = $model,
+      p.updatedAt = $updatedAt
+  RETURN p.permissionMode AS permissionMode
+`;
+var session_defaults_default = app28;
+
+// server/routes/admin/file-attach.ts
+var app29 = new Hono();
+app29.post("/", async (c) => {
   try {
     const body = await c.req.json();
     const { filePath, accountId } = body;
@@ -12002,7 +12267,7 @@ app28.post("/", async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-var file_attach_default = app28;
+var file_attach_default = app29;
 
 // server/routes/admin/sidebar-artefacts.ts
 import neo4j2 from "neo4j-driver";
@@ -12012,8 +12277,8 @@ import { existsSync as existsSync16 } from "fs";
 var LIMIT = 50;
 var TEXT_MIME_PREFIXES = ["text/", "application/json", "application/markdown"];
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
-var app29 = new Hono();
-app29.get("/", requireAdminSession, async (c) => {
+var app30 = new Hono();
+app30.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -12219,7 +12484,7 @@ function isWithin(target, root) {
   const rel = relative2(root, target);
   return !rel.startsWith("..") && !isAbsolute(rel);
 }
-var sidebar_artefacts_default = app29;
+var sidebar_artefacts_default = app30;
 
 // server/routes/admin/sidebar-artefact-save.ts
 import { mkdir as mkdir4, readdir as readdir4, stat as stat6, writeFile as writeFile5 } from "fs/promises";
@@ -12227,8 +12492,8 @@ import { resolve as resolve18 } from "path";
 import { existsSync as existsSync17 } from "fs";
 var ADMIN_AGENT_FILES2 = /* @__PURE__ */ new Set(["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"]);
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-var app30 = new Hono();
-app30.post("/", requireAdminSession, async (c) => {
+var app31 = new Hono();
+app31.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) return c.json({ error: "Account not found for session" }, 401);
@@ -12340,15 +12605,15 @@ async function resolveSavePath(id, accountId, accountDir) {
 function relPath(absPath, root) {
   return absPath.startsWith(root) ? absPath.slice(root.length + 1) : absPath;
 }
-var sidebar_artefact_save_default = app30;
+var sidebar_artefact_save_default = app31;
 
 // server/routes/admin/sidebar-artefact-content.ts
 import { readFile as readFile6, readdir as readdir5 } from "fs/promises";
 import { existsSync as existsSync18 } from "fs";
 import { resolve as resolve19 } from "path";
 var UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-var app31 = new Hono();
-app31.get("/", requireAdminSession, async (c) => {
+var app32 = new Hono();
+app32.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) return new Response("Unauthorized", { status: 401 });
@@ -12389,7 +12654,7 @@ app31.get("/", requireAdminSession, async (c) => {
     }
   });
 });
-var sidebar_artefact_content_default = app31;
+var sidebar_artefact_content_default = app32;
 
 // server/routes/admin/health.ts
 import { existsSync as existsSync19, readFileSync as readFileSync17 } from "fs";
@@ -12434,8 +12699,8 @@ async function probeConversationDb() {
     });
   }
 }
-var app32 = new Hono();
-app32.get("/", async (c) => {
+var app33 = new Hono();
+app33.get("/", async (c) => {
   const version = readVersion();
   const probe = await probeConversationDb();
   const uptimeMs = Date.now() - new Date(PROCESS_STARTED_AT).getTime();
@@ -12457,38 +12722,187 @@ app32.get("/", async (c) => {
     uptimeMs
   });
 });
-var health_default2 = app32;
+var health_default2 = app33;
+
+// server/routes/admin/linkedin-ingest.ts
+var TAG20 = "[linkedin-ingest-route]";
+var UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+var ISO = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/;
+var LINKEDIN_URL = /^https:\/\/www\.linkedin\.com\//;
+function rejectSchema(reason, missing = []) {
+  return { ok: false, status: 400, error: "schema", reason, missing };
+}
+function validate(body) {
+  if (!body || typeof body !== "object") return rejectSchema("not-object");
+  const b = body;
+  const missing = [];
+  if (b.source !== "linkedin") missing.push("source");
+  if (b.kind !== "profile" && b.kind !== "thread") missing.push("kind");
+  if (typeof b.capturedAt !== "string" || !ISO.test(b.capturedAt)) missing.push("capturedAt");
+  if (typeof b.pageUrl !== "string" || !LINKEDIN_URL.test(b.pageUrl)) missing.push("pageUrl");
+  if (typeof b.dispatchId !== "string" || !UUID.test(b.dispatchId)) missing.push("dispatchId");
+  if (missing.length) return rejectSchema("envelope", missing);
+  if (b.kind === "profile") {
+    const p = b.profile;
+    if (!p || typeof p !== "object") return rejectSchema("profile-shape", ["profile"]);
+    const pMissing = [];
+    if (typeof p.name !== "string" || !p.name.trim()) pMissing.push("profile.name");
+    if (typeof p.headline !== "string") pMissing.push("profile.headline");
+    if (typeof p.bodyText !== "string" || !p.bodyText.trim()) pMissing.push("profile.bodyText");
+    if (pMissing.length) return rejectSchema("profile-shape", pMissing);
+  } else {
+    const t = b.thread;
+    if (!t || typeof t !== "object") return rejectSchema("thread-shape", ["thread"]);
+    const tMissing = [];
+    if (!Array.isArray(t.participants) || t.participants.length === 0) tMissing.push("thread.participants");
+    if (typeof t.bodyText !== "string" || !t.bodyText.trim()) tMissing.push("thread.bodyText");
+    if (tMissing.length) return rejectSchema("thread-shape", tMissing);
+  }
+  return { ok: true, envelope: b };
+}
+function buildInitialMessage(env) {
+  const header = [
+    "LinkedIn ingest \u2014 dispatchId=" + env.dispatchId,
+    "kind=" + env.kind,
+    "sourceUrl=" + env.pageUrl,
+    "capturedAt=" + env.capturedAt
+  ].join(" \xB7 ");
+  if (env.kind === "profile" && env.profile) {
+    const p = env.profile;
+    return [
+      header,
+      "",
+      "Surface: LinkedIn profile. Run the document-ingest skill in document mode against the body below, anchored to a Person subject for this profile.",
+      "",
+      "Conservative-extraction rules apply (see Task 234 spec):",
+      "- One :KnowledgeDocument MERGE keyed on sourceUrl=" + env.pageUrl + " with the verbatim body as body, plus one :Section:Note child with the summary.",
+      "- MERGE :Person on canonical key (name + sourceUrl). When the body assertively states currentCompany, MERGE :Organization and create (:Person)-[:WORKS_AT]->(:Organization).",
+      "- MERGE any other derived entities only when assertively stated in the body. Use whatever ontology label fits (:Event, :Task, :Service, :PriceSpecification, \u2026). Each carries sourceUrl=" + env.pageUrl + ".",
+      "- (:KD)-[:MENTIONS]->(:Person) for the subject, (:KD)-[:MENTIONS]->(:Organization) for the employer, (:KD)-[:MENTIONS]->(<derived entity>) for each.",
+      "- No :Communication, :ConversationArchive, or :Message nodes \u2014 those belong to other flows.",
+      "",
+      "Subject (assertive):",
+      "- name=" + p.name,
+      "- headline=" + p.headline,
+      "- location=" + (p.location || "(none)"),
+      "- currentTitle=" + (p.currentTitle || "(none)"),
+      "- currentCompany=" + (p.currentCompany || "(none)"),
+      "",
+      "Body (verbatim, write to :KnowledgeDocument.body):",
+      p.bodyText
+    ].join("\n");
+  }
+  if (env.kind === "thread" && env.thread) {
+    const t = env.thread;
+    const participantList = t.participants.map(function(p) {
+      return p.name + (p.profileUrl ? " (" + p.profileUrl + ")" : "");
+    }).join(", ");
+    return [
+      header,
+      "",
+      "Surface: LinkedIn DM thread. Run the document-ingest skill in document mode against the transcript below.",
+      "",
+      "Conservative-extraction rules apply (see Task 234 spec):",
+      "- One :KnowledgeDocument MERGE keyed on sourceUrl=" + env.pageUrl + " with the verbatim transcript as body, plus one :Section:Note child with the summary.",
+      "- (:KD)-[:PARTICIPANT]->(:Person) for each participant. MERGE :Person on (name, profileUrl) where present.",
+      "- MERGE any derived entity only when assertively stated. Whatever ontology label fits: :Event {startDate, endDate} with ATTENDED_BY edges for scheduled meetings; :Task {kind, name, status} with RAISED_BY/ABOUT edges for actions without a scheduled time; :Service/:PriceSpecification when an offer or price is discussed. Each carries sourceUrl=" + env.pageUrl + ".",
+      "- (:KD)-[:MENTIONS]->(<derived entity>) for every derived entity. Person-attached insights stay in the :Section:Note body plus a (:KD)-[:MENTIONS]->(:Person) edge \u2014 no standalone insight node.",
+      "- No :Communication, :ConversationArchive, or :Message nodes \u2014 those belong to other flows.",
+      "",
+      "Participants:",
+      participantList,
+      "",
+      "Transcript (verbatim, write to :KnowledgeDocument.body):",
+      t.bodyText
+    ].join("\n");
+  }
+  return header;
+}
+var app34 = new Hono();
+app34.post("/", requireAdminSession, async (c) => {
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    console.error(TAG20 + " rejected status=400 reason=schema:body-not-json");
+    return c.json({ ok: false, error: "schema", reason: "body-not-json" }, 400);
+  }
+  const v = validate(body);
+  if (!v.ok) {
+    console.error(TAG20 + " rejected status=" + v.status + " reason=" + v.reason + " missing=" + v.missing.join(","));
+    return c.json({ ok: false, error: v.error, reason: v.reason, missing: v.missing }, v.status);
+  }
+  const envelope = v.envelope;
+  const cacheKey = c.var.cacheKey ?? "";
+  const senderId = getAccountIdForSession(cacheKey) ?? "";
+  if (!senderId) {
+    console.error(TAG20 + " rejected status=500 reason=admin-account-not-resolved");
+    return c.json({ ok: false, error: "admin-account-not-resolved" }, 500);
+  }
+  const userId = getUserIdForSession(cacheKey) ?? void 0;
+  const payloadBytes = JSON.stringify(envelope).length;
+  console.log(
+    TAG20 + " received kind=" + envelope.kind + " account=" + senderId.slice(0, 8) + " pageUrl=" + envelope.pageUrl + " dispatchId=" + envelope.dispatchId + " payloadBytes=" + payloadBytes
+  );
+  const initialMessage = buildInitialMessage(envelope);
+  const spawnStart = Date.now();
+  const { response, claudeSessionId } = await performSpawnWithInitialMessage({
+    senderId,
+    userId,
+    role: "admin",
+    channel: "linkedin-extension",
+    permissionMode: void 0,
+    hidden: true,
+    specialist: "database-operator",
+    model: void 0,
+    initialMessage
+  });
+  if (!response.ok) {
+    const detail = await response.text().catch(() => "");
+    console.error(
+      TAG20 + " dispatch-failed dispatchId=" + envelope.dispatchId + " status=" + response.status + " ms=" + (Date.now() - spawnStart) + " detail=" + detail.slice(0, 200)
+    );
+    return c.json({ ok: false, error: "dispatch-failed", upstreamStatus: response.status, detail: detail.slice(0, 500) }, 502);
+  }
+  console.log(
+    TAG20 + " dispatched dispatchId=" + envelope.dispatchId + " taskId=" + (claudeSessionId ?? "unknown") + " ms=" + (Date.now() - spawnStart)
+  );
+  return c.json({ ok: true, dispatchId: envelope.dispatchId, taskId: claudeSessionId }, 202);
+});
+var linkedin_ingest_default = app34;
 
 // server/routes/admin/index.ts
-var app33 = new Hono();
-app33.route("/session", session_default);
-app33.route("/new-session-failure", new_session_failure_default);
-app33.route("/new-session-submit", new_session_submit_default);
-app33.route("/logs", logs_default);
-app33.route("/claude-info", claude_info_default);
-app33.route("/attachment", attachment_default);
-app33.route("/agents", agents_default);
-app33.route("/sessions", sessions_default);
-app33.route("/claude-sessions", claude_sessions_default);
-app33.route("/log-ingest", log_ingest_default);
-app33.route("/browser", browser_default);
-app33.route("/browser-iframe", browser_iframe_default);
-app33.route("/device-browser", device_browser_default);
-app33.route("/events", events_default);
-app33.route("/cloudflare", cloudflare_default);
-app33.route("/files", files_default);
-app33.route("/graph-search", graph_search_default);
-app33.route("/graph-subgraph", graph_subgraph_default);
-app33.route("/graph-delete", graph_delete_default);
-app33.route("/graph-restore", graph_restore_default);
-app33.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app33.route("/graph-default-view", graph_default_view_default);
-app33.route("/file-attach", file_attach_default);
-app33.route("/sidebar-artefacts", sidebar_artefacts_default);
-app33.route("/sidebar-artefact-save", sidebar_artefact_save_default);
-app33.route("/sidebar-artefact-content", sidebar_artefact_content_default);
-app33.route("/health-brand", health_default2);
-var admin_default = app33;
+var app35 = new Hono();
+app35.route("/session", session_default);
+app35.route("/new-session-failure", new_session_failure_default);
+app35.route("/new-session-submit", new_session_submit_default);
+app35.route("/logs", logs_default);
+app35.route("/claude-info", claude_info_default);
+app35.route("/attachment", attachment_default);
+app35.route("/agents", agents_default);
+app35.route("/sessions", sessions_default);
+app35.route("/claude-sessions", claude_sessions_default);
+app35.route("/log-ingest", log_ingest_default);
+app35.route("/browser", browser_default);
+app35.route("/browser-iframe", browser_iframe_default);
+app35.route("/device-browser", device_browser_default);
+app35.route("/events", events_default);
+app35.route("/cloudflare", cloudflare_default);
+app35.route("/files", files_default);
+app35.route("/graph-search", graph_search_default);
+app35.route("/graph-subgraph", graph_subgraph_default);
+app35.route("/graph-delete", graph_delete_default);
+app35.route("/graph-restore", graph_restore_default);
+app35.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app35.route("/graph-default-view", graph_default_view_default);
+app35.route("/session-defaults", session_defaults_default);
+app35.route("/file-attach", file_attach_default);
+app35.route("/sidebar-artefacts", sidebar_artefacts_default);
+app35.route("/sidebar-artefact-save", sidebar_artefact_save_default);
+app35.route("/sidebar-artefact-content", sidebar_artefact_content_default);
+app35.route("/health-brand", health_default2);
+app35.route("/linkedin-ingest", linkedin_ingest_default);
+var admin_default = app35;
 
 // server/routes/sites.ts
 import { existsSync as existsSync20, readFileSync as readFileSync18, realpathSync as realpathSync5, statSync as statSync9 } from "fs";
@@ -12523,8 +12937,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app34 = new Hono();
-app34.get("/:rel{.*}", (c) => {
+var app36 = new Hono();
+app36.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -12627,7 +13041,7 @@ app34.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app34;
+var sites_default = app36;
 
 // app/lib/graph-health.ts
 var HOUR_MS = 60 * 60 * 1e3;
@@ -12711,7 +13125,7 @@ function startGraphHealthTimer() {
 }
 
 // app/lib/whatsapp/inbound/claude-bridge.ts
-var TAG20 = "[whatsapp-adaptor]";
+var TAG21 = "[whatsapp-adaptor]";
 function whatsappTurnTimeoutMs() {
   return Number(process.env.WHATSAPP_PTY_TURN_TIMEOUT_MS ?? String(5 * 6e4));
 }
@@ -12732,7 +13146,7 @@ async function dispatchToClaude(input) {
     await input.reply(result.turnText);
   } catch (err) {
     const m = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG20} reject reason=reply-failed senderId=${input.senderId} message=${m}`);
+    console.error(`${TAG21} reject reason=reply-failed senderId=${input.senderId} message=${m}`);
   }
 }
 function startReaper2() {
@@ -13034,9 +13448,9 @@ watchFile(ALIAS_DOMAINS_PATH2, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app35 = new Hono();
-app35.use("*", clientIpMiddleware);
-app35.use("*", async (c, next) => {
+var app37 = new Hono();
+app37.use("*", clientIpMiddleware);
+app37.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -13046,7 +13460,7 @@ app35.use("*", async (c, next) => {
   );
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app35.use("*", async (c, next) => {
+app37.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -13079,7 +13493,7 @@ var PUBLIC_ALLOWED_PREFIXES = [
   "/sites/"
 ];
 var PUBLIC_ALLOWED_EXACT = ["/favicon.ico"];
-app35.use("*", async (c, next) => {
+app37.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (!isPublicHost(host)) {
     await next();
@@ -13119,7 +13533,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app35.post("/__remote-auth/login", async (c) => {
+app37.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -13164,7 +13578,7 @@ app35.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app35.get("/__remote-auth/logout", (c) => {
+app37.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -13177,7 +13591,7 @@ app35.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app35.post("/__remote-auth/change-password", async (c) => {
+app37.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -13228,13 +13642,13 @@ app35.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app35.get("/__remote-auth/setup", (c) => {
+app37.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app35.post("/__remote-auth/set-initial-password", async (c) => {
+app37.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -13272,10 +13686,10 @@ app35.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app35.get("/api/remote-auth/status", (c) => {
+app37.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app35.post("/api/remote-auth/set-password", async (c) => {
+app37.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -13306,9 +13720,9 @@ app35.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app35.route("/api/_client-error", client_error_default);
+app37.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
-app35.use("*", async (c, next) => {
+app37.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
@@ -13348,11 +13762,11 @@ app35.use("*", async (c, next) => {
   console.error(`[remote-auth] login required ip=${clientIp} path=${path2} ${disambig}`);
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), redirect: path2 }), 200);
 });
-app35.route("/api/health", health_default);
-app35.route("/api/chat", chat_default);
-app35.route("/api/whatsapp", whatsapp_default);
-app35.route("/api/onboarding", onboarding_default);
-app35.route("/api/admin", admin_default);
+app37.route("/api/health", health_default);
+app37.route("/api/chat", chat_default);
+app37.route("/api/whatsapp", whatsapp_default);
+app37.route("/api/onboarding", onboarding_default);
+app37.route("/api/admin", admin_default);
 var SAFE_SLUG_RE = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -13364,7 +13778,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app35.get("/agent-assets/:slug/:filename", (c) => {
+app37.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE.test(slug)) {
@@ -13399,7 +13813,7 @@ app35.get("/agent-assets/:slug/:filename", (c) => {
     "Cache-Control": "public, max-age=3600"
   });
 });
-app35.get("/generated/:filename", (c) => {
+app37.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -13429,7 +13843,7 @@ app35.get("/generated/:filename", (c) => {
     "Cache-Control": "public, max-age=86400"
   });
 });
-app35.route("/sites", sites_default);
+app37.route("/sites", sites_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
@@ -13566,7 +13980,7 @@ function brandedPublicHtml(agentSlug) {
 function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-app35.get("/", (c) => {
+app37.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) {
     const defaultSlug = resolveDefaultSlug();
@@ -13574,12 +13988,12 @@ app35.get("/", (c) => {
   }
   return c.html(cachedHtml("index.html"));
 });
-app35.get("/public", (c) => {
+app37.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app35.get("/chat", (c) => {
+app37.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -13598,9 +14012,9 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app35.use("/vnc-viewer.html", logViewerFetch);
-app35.use("/vnc-popout.html", logViewerFetch);
-app35.get("/vnc-popout.html", (c) => {
+app37.use("/vnc-viewer.html", logViewerFetch);
+app37.use("/vnc-popout.html", logViewerFetch);
+app37.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
     html = readFileSync20(resolve23(process.cwd(), "public", "vnc-popout.html"), "utf-8");
@@ -13613,7 +14027,7 @@ app35.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app35.post("/api/vnc/client-event", async (c) => {
+app37.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -13634,25 +14048,25 @@ app35.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app35.get("/g/:slug", (c) => {
+app37.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
-app35.get("/graph", (c) => {
+app37.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app35.get("/sessions", (c) => {
+app37.get("/sessions", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("sessions.html"));
 });
-app35.get("/data", (c) => {
+app37.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app35.get("/:slug", async (c, next) => {
+app37.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const branding = loadBrandingCache(slug);
@@ -13662,16 +14076,31 @@ app35.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app35.get("/favicon.ico", (c) => {
+  app37.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app35.use("/*", serveStatic({ root: "./public" }));
+app37.use("/*", serveStatic({ root: "./public" }));
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app35.fetch, port, hostname });
+var httpServer = serve({ fetch: app37.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
+{
+  const loopHist = monitorEventLoopDelay({ resolution: 50 });
+  loopHist.enable();
+  const LOG_THRESHOLD_MS = 1e3;
+  const WINDOW_MS2 = 3e4;
+  const lagTimer = setInterval(() => {
+    const maxMs = loopHist.max / 1e6;
+    const p99Ms = loopHist.percentile(99) / 1e6;
+    loopHist.reset();
+    if (maxMs >= LOG_THRESHOLD_MS) {
+      console.error(`[event-loop] lag p99=${Math.round(p99Ms)} max=${Math.round(maxMs)} window=${WINDOW_MS2 / 1e3}s`);
+    }
+  }, WINDOW_MS2);
+  lagTimer.unref();
+}
 console.log("[boot] auth-mode summary: oauth=8 api-key=1 (api-key consumer: invokePublicAgent only)");
 var SUBAPP_MANIFEST = [
   { prefix: "/api/health", file: "server/routes/health.ts", subapp: health_default },
@@ -13687,7 +14116,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app35.routes ?? []) {
+  for (const r of app37.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });